xytara 3.1.0 → 3.1.2

package/.env.production.checklist

@@ -1,77 +0,0 @@
-# xytara production env checklist
-# Copy values from here into your real .env.production.
-# Do not commit live secrets.
-
-# 1. Persistent runtime state
-XYTARA_STATE_FILE=
-XYTARA_SUPABASE_URL=
-XYTARA_SUPABASE_SERVICE_ROLE_KEY=
-
-# 2. Payment verification
-XYTARA_PAYMENT_VERIFICATION_MODE=local_signed
-XYTARA_PAYMENT_MAX_AGE_SECONDS=300
-XYTARA_WALLET_REGISTRY_JSON=
-
-# 3. Operator security
-XYTARA_CREDIT_BRIDGE_BEARER_TOKEN=
-XYTARA_ACCOUNT_AUTH_BEARER_TOKEN=
-XYTARA_CALLBACK_DELIVERY_ENABLED=true
-XYTARA_CALLBACK_SIGNING_SECRET=
-XYTARA_CHECKOUT_WEBHOOK_SECRET=
-XYTARA_L402_ENABLED=false
-XYTARA_L402_SHARED_SECRET=
-XYTARA_BOLT_ENABLED=false
-XYTARA_BOLT_SHARED_SECRET=
-XYTARA_BOLT_NETWORK=mainnet
-XYTARA_BOLT_PROOF_MODE=spv_or_block_header_verifiable
-XYTARA_BOLT_MAX_AGE_SECONDS=300
-XYTARA_MPP_ENABLED=false
-XYTARA_MPP_SHARED_SECRET=
-XYTARA_MPP_PROVIDER=stripe_tempo_compatible
-XYTARA_MPP_SETTLEMENT_FAMILY=cards_or_stablecoin_or_lightning
-XYTARA_MPP_MAX_AGE_SECONDS=300
-XYTARA_NETWORK_DNS_RESULT_ORDER=verbatim
-XYTARA_NETWORK_PREFERRED_IP_FAMILY=auto
-XYTARA_EXTERNAL_EXECUTION_IP_FAMILY=auto
-XYTARA_CALLBACK_IP_FAMILY=auto
-XYTARA_SETTLEMENT_IP_FAMILY=auto
-XYTARA_CALLBACK_TIMEOUT_MS=5000
-XYTARA_CALLBACK_MAX_ATTEMPTS=5
-XYTARA_CALLBACK_RETRY_BASE_MS=2000
-
-# 4. Runtime worker and abuse controls
-XYTARA_RUNTIME_WORKER_INTERVAL_MS=500
-XYTARA_SETTLEMENT_REFRESH_INTERVAL_MS=1500
-XYTARA_RATE_LIMIT_ENABLED=true
-XYTARA_RATE_LIMIT_WINDOW_MS=60000
-XYTARA_RATE_LIMIT_MAX_REQUESTS=600
-
-# 5. Provider-backed execution
-# Set to true if live launch requires external execution targets to be present.
-XYTARA_EXTERNAL_EXECUTION_REQUIRED=true
-XYTARA_EXECUTION_TARGETS_JSON=
-
-# 6. Native BSV settlement
-XYTARA_BSV_TERANODE_NETWORK=mainnet
-XYTARA_BSV_TERANODE_SETTLEMENT_RUNTIME_MODE=observe
-XYTARA_BSV_TERANODE_MERCHANT_ADDRESS=
-XYTARA_BSV_TERANODE_MERCHANT_PAYMAIL=
-XYTARA_BSV_TERANODE_RPC_URL=
-XYTARA_BSV_TERANODE_RPC_API_KEY=
-XYTARA_BSV_TERANODE_RPC_AUTH_HEADER=authorization
-XYTARA_BSV_TERANODE_RPC_AUTH_SCHEME=
-
-# 7. Treasury destinations
-XYTARA_TREASURY_DESTINATIONS_PATH=./TREASURY_DESTINATIONS.production.json
-
-# 8. Recommended production notes
-# - Fill either XYTARA_STATE_FILE or the XYTARA_SUPABASE_* pair.
-# - Fill either XYTARA_BSV_TERANODE_MERCHANT_ADDRESS or XYTARA_BSV_TERANODE_MERCHANT_PAYMAIL.
-# - If XYTARA_BSV_TERANODE_SETTLEMENT_RUNTIME_MODE=arc, RPC URL and API key are required.
-# - XYTARA_WALLET_REGISTRY_JSON should contain real wallet ids/secrets/account ids.
-# - XYTARA_EXECUTION_TARGETS_JSON should contain real provider endpoints for every provider-backed lane you plan to sell.
-# - XYTARA_CHECKOUT_WEBHOOK_SECRET is required when hosted-checkout ingress is enabled.
-# - If XYTARA_L402_ENABLED=true, set XYTARA_L402_SHARED_SECRET.
-# - If XYTARA_BOLT_ENABLED=true, set XYTARA_BOLT_SHARED_SECRET.
-# - If XYTARA_MPP_ENABLED=true, set XYTARA_MPP_SHARED_SECRET.
-# - Use the IP family settings only if you want to prefer IPv4 or IPv6 for outbound execution, callbacks, or settlement transport.

package/.env.production.template

@@ -1,54 +0,0 @@
-# xytara production environment template
-
-# Persistent runtime state
-XYTARA_STATE_FILE=./data/xytara-state.json
-
-# Payment verification and admission defaults
-XYTARA_PAYMENT_VERIFICATION_MODE=local_signed
-XYTARA_PAYMENT_MAX_AGE_SECONDS=300
-
-# Credit/auth operator controls
-XYTARA_CREDIT_BRIDGE_BEARER_TOKEN=replace-with-credit-bridge-token
-XYTARA_ACCOUNT_AUTH_BEARER_TOKEN=replace-with-account-auth-token
-XYTARA_CALLBACK_DELIVERY_ENABLED=true
-XYTARA_CALLBACK_SIGNING_SECRET=replace-with-callback-signing-secret
-XYTARA_CALLBACK_TIMEOUT_MS=5000
-XYTARA_CALLBACK_MAX_ATTEMPTS=5
-XYTARA_CALLBACK_RETRY_BASE_MS=2000
-XYTARA_RUNTIME_WORKER_INTERVAL_MS=500
-XYTARA_SETTLEMENT_REFRESH_INTERVAL_MS=1500
-XYTARA_RATE_LIMIT_ENABLED=true
-XYTARA_RATE_LIMIT_WINDOW_MS=60000
-XYTARA_RATE_LIMIT_MAX_REQUESTS=600
-XYTARA_WALLET_REGISTRY_JSON=[{"wallet_id":"replace-with-wallet-id","secret":"replace-with-wallet-secret","account_id":"replace-with-account-id"}]
-XYTARA_EXTERNAL_EXECUTION_REQUIRED=false
-# Populate this with real provider-backed execution targets for the capabilities you sell live.
-# Each entry should match by task_ref, tool_name, or integration_id and point to a real endpoint.
-XYTARA_EXECUTION_TARGETS_JSON=[]
-XYTARA_L402_ENABLED=true
-XYTARA_L402_SHARED_SECRET=replace-with-l402-shared-secret
-XYTARA_BOLT_ENABLED=false
-XYTARA_BOLT_SHARED_SECRET=replace-with-bolt-shared-secret-if-enabled
-XYTARA_BOLT_NETWORK=mainnet
-XYTARA_BOLT_PROOF_MODE=spv_or_block_header_verifiable
-XYTARA_BOLT_MAX_AGE_SECONDS=300
-XYTARA_MPP_ENABLED=false
-XYTARA_MPP_SHARED_SECRET=replace-with-mpp-shared-secret-if-enabled
-XYTARA_MPP_PROVIDER=stripe_tempo_compatible
-XYTARA_MPP_SETTLEMENT_FAMILY=cards_or_stablecoin_or_lightning
-XYTARA_MPP_MAX_AGE_SECONDS=300
-XYTARA_NETWORK_DNS_RESULT_ORDER=verbatim
-XYTARA_NETWORK_PREFERRED_IP_FAMILY=auto
-XYTARA_EXTERNAL_EXECUTION_IP_FAMILY=auto
-XYTARA_CALLBACK_IP_FAMILY=auto
-XYTARA_SETTLEMENT_IP_FAMILY=auto
-
-# BSV / teranode runtime settlement
-XYTARA_BSV_TERANODE_NETWORK=mainnet
-XYTARA_BSV_TERANODE_SETTLEMENT_RUNTIME_MODE=observe
-XYTARA_BSV_TERANODE_MERCHANT_ADDRESS=replace-with-bsv-address-or-paymail
-
-# Multi-rail treasury destinations
-# Create TREASURY_DESTINATIONS.production.json from TREASURY_DESTINATIONS.production.template.json
-# and point xytara to it here.
-XYTARA_TREASURY_DESTINATIONS_PATH=./TREASURY_DESTINATIONS.production.json

package/.github/workflows/publish-mcp-executor.yml

@@ -1,43 +0,0 @@
-name: Publish MCP Executor
-
-on:
-  workflow_dispatch:
-  push:
-    branches:
-      - main
-    paths:
-      - "services/mcp-execution-target/server.json"
-      - "services/mcp-execution-target/server.js"
-      - "services/mcp-execution-target/README.md"
-      - "services/mcp-execution-target/DISCOVERY_REGISTRY_PLAYBOOK.md"
-
-jobs:
-  publish:
-    runs-on: ubuntu-latest
-    defaults:
-      run:
-        working-directory: services/mcp-execution-target
-    steps:
-      - name: Checkout
-        uses: actions/checkout@v4
-
-      - name: Verify public surfaces
-        run: |
-          curl --fail --silent --show-error https://xytara-mcp-executor.onrender.com/health > /tmp/mcp-health.json
-          curl --fail --silent --show-error https://xytara-mcp-executor.onrender.com/server.json > /tmp/mcp-server-card.json
-          curl --fail --silent --show-error https://xytara-mcp-executor.onrender.com/mcp > /tmp/mcp-discovery.json
-
-      - name: Download MCP publisher
-        run: |
-          curl -L "https://github.com/modelcontextprotocol/registry/releases/latest/download/mcp-publisher_$(uname -s | tr '[:upper:]' '[:lower:]')_$(uname -m | sed 's/x86_64/amd64/;s/aarch64/arm64/').tar.gz" | tar xz mcp-publisher
-          chmod +x mcp-publisher
-
-      - name: Login with domain auth
-        env:
-          MCP_PRIVATE_KEY: ${{ secrets.MCP_PRIVATE_KEY }}
-        run: |
-          test -n "$MCP_PRIVATE_KEY"
-          ./mcp-publisher login http --domain naxytra.com --private-key "$MCP_PRIVATE_KEY"
-
-      - name: Publish remote server
-        run: ./mcp-publisher publish

package/ADAPTER_PARTNER_PATH.md

@@ -1,47 +0,0 @@
-# xytara Adapter Partner Path
-
-Use this path if you are an outside ecosystem partner deciding whether to build and promote an adapter on `xytara`.
-
-## Why build here
-
-- you can start from a public minimal adapter instead of inventing the contract from scratch
-- you can validate and review the same artifacts operators will later inspect
-- you can see promotion blockers and valid actions as data
-- you do not need private exceptions to become a trusted integration
-
-## Fastest first path
-
-1. Read `ADAPTER_START_HERE.md`.
-2. Read `ADAPTER_PROMOTION_START_HERE.md`.
-3. Run:
-   - `npm run verify:adapters`
-   - `node scripts/registry_cli.js review-bundle --file adapters/examples/minimal-third-party-execution.submission-bundle.json`
-   - `node scripts/registry_cli.js promotion-workflow --integration partner.execution.minimal_echo`
-4. Inspect:
-   - `/v1/adapter-pack/summary`
-   - `/v1/adapter-promotion/summary`
-   - `/v1/integrations/promotion-readiness`
-   - `/v1/integrations/promotion-workflow`
-   - `/v1/integrations/promotion-actions`
-
-## What first success looks like
-
-First success is not “production default on day one.”
-
-First success is:
-
-1. copy the minimal starter
-2. validate it locally
-3. produce a reviewable submission bundle
-4. inspect the next promotion action without private coordination
-5. understand exactly what still blocks broader trust
-
-## Trust path
-
-The intended public maturity path is:
-
-1. `starter_example`
-2. `staging_registered`
-3. `review_ready`
-4. `default_eligible`
-5. `production_default_ready`

package/ADAPTER_PROMOTION_START_HERE.md

@@ -1,44 +0,0 @@
-# xytara Adapter Promotion Start Here
-
-Use this path if you already have a third-party adapter starter and want to move it toward trusted runtime posture.
-
-## Recommended order
-
-1. Start from `ADAPTER_START_HERE.md`.
-2. Review the minimal starter bundle:
-   - `node scripts/registry_cli.js review-bundle --file adapters/examples/minimal-third-party-execution.submission-bundle.json`
-3. Inspect its readiness:
-   - `node scripts/registry_cli.js promotion-readiness --integration partner.execution.minimal_echo`
-4. Inspect the next promotion step:
-   - `node scripts/registry_cli.js promotion-workflow --integration partner.execution.minimal_echo`
-5. Inspect all valid actions now:
-   - `node scripts/registry_cli.js promotion-action-set --integration partner.execution.minimal_echo`
-6. Preview one concrete action:
-   - `node scripts/registry_cli.js promotion-action-preview --integration partner.execution.minimal_echo --action complete_certification`
-
-## Promotion states
-
-The public maturity path should stay explicit:
-
-1. `starter_example`
-2. `staging_registered`
-3. `review_ready`
-4. `default_eligible`
-5. `production_default_ready`
-
-## What review should answer
-
-- Is the integration review-ready right now?
-- What blockers still prevent default eligibility?
-- What certification gaps still need evidence?
-- What action is valid now, and what would it change?
-
-## Key public surfaces
-
-- `/v1/integrations/promotion-readiness`
-- `/v1/integrations/promotion-workflow`
-- `/v1/integrations/promotion-actions`
-- `/v1/integrations/:integration_id/promotion-readiness`
-- `/v1/integrations/:integration_id/promotion-workflow`
-- `/v1/integrations/:integration_id/promotion-actions`
-- `/v1/integrations/promotion-actions/preview`

package/BOLT_BINDINGS.production.worksheet.json

@@ -1,31 +0,0 @@
-{
-  "_notes": [
-    "Fill this privately if you want to bind a BOLT-style or UTXO-SPV-verifiable payment front into xytara.",
-    "This is an operator worksheet for payment-front binding and settlement-proof mapping."
-  ],
-  "binding_id": "bolt_primary",
-  "enabled": false,
-  "front_protocol": "bolt_utxo_spv",
-  "settlement_family": "utxo_native",
-  "proof_family": "spv_or_block_header_proof",
-  "gateway_base_url": "",
-  "gateway_auth_token": "",
-  "gateway_payment_verify_path": "/verify-payment",
-  "gateway_proof_verify_path": "/verify-proof",
-  "gateway_quote_issue_path": "/quote",
-  "supported_task_refs": [
-    "trust.verify",
-    "settlement.submit",
-    "adapter.mcp.invoke"
-  ],
-  "account_id": "",
-  "treasury_ref": "",
-  "reporting_ref": "",
-  "chain_id": "",
-  "network": "",
-  "notes_for_runtime_mapping": [
-    "Bind BOLT-style fronts to xytara as payment and settlement-proof inputs into the same runtime core.",
-    "Keep execution, proof, and operator accounting unified after payment/proof verification succeeds.",
-    "Use explicit runtime mapping for quote binding, transaction acceptance, and settlement proof continuity."
-  ]
-}

package/EXECUTION_TARGETS.production.worksheet.json

@@ -1,73 +0,0 @@
-[
-  {
-    "_notes": [
-      "Use one entry per provider-backed capability lane.",
-      "Match by task_ref for whole-lane routing, by tool_name for MCP tool routing, or by integration_id for integration-family routing.",
-      "Remove _notes arrays from your final production JSON if you want a cleaner file."
-    ],
-    "target_id": "provider_trust_verify_primary",
-    "task_ref": "trust.verify",
-    "tool_name": "",
-    "integration_id": "",
-    "endpoint_url": "",
-    "provider": "provider_example",
-    "auth_token": "",
-    "timeout_ms": 10000,
-    "enabled": true
-  },
-  {
-    "target_id": "provider_mcp_invoke_primary",
-    "task_ref": "adapter.mcp.invoke",
-    "tool_name": "zones.lookup",
-    "integration_id": "",
-    "endpoint_url": "https://your-mcp-executor.onrender.com/execute",
-    "provider": "xytara_mcp_executor",
-    "auth_token": "replace-with-mcp-executor-bearer-token",
-    "timeout_ms": 10000,
-    "enabled": true
-  },
-  {
-    "target_id": "provider_mcp_summarize_primary",
-    "task_ref": "adapter.mcp.invoke",
-    "tool_name": "summarize",
-    "integration_id": "",
-    "endpoint_url": "https://your-mcp-executor.onrender.com/execute",
-    "provider": "xytara_mcp_executor",
-    "auth_token": "replace-with-mcp-executor-bearer-token",
-    "timeout_ms": 10000,
-    "enabled": true
-  },
-  {
-    "target_id": "provider_mcp_catalog_primary",
-    "task_ref": "adapter.mcp.catalog",
-    "tool_name": "catalog",
-    "integration_id": "",
-    "endpoint_url": "https://your-mcp-executor.onrender.com/execute",
-    "provider": "xytara_mcp_executor",
-    "auth_token": "replace-with-mcp-executor-bearer-token",
-    "timeout_ms": 10000,
-    "enabled": true
-  },
-  {
-    "target_id": "provider_mcp_reply_draft_primary",
-    "task_ref": "adapter.mcp.reply.draft",
-    "tool_name": "reply.draft",
-    "integration_id": "",
-    "endpoint_url": "https://your-mcp-executor.onrender.com/execute",
-    "provider": "xytara_mcp_executor",
-    "auth_token": "replace-with-mcp-executor-bearer-token",
-    "timeout_ms": 10000,
-    "enabled": true
-  },
-  {
-    "target_id": "provider_mcp_json_validate_primary",
-    "task_ref": "adapter.mcp.json.validate",
-    "tool_name": "json.validate",
-    "integration_id": "",
-    "endpoint_url": "https://your-mcp-executor.onrender.com/execute",
-    "provider": "xytara_mcp_executor",
-    "auth_token": "replace-with-mcp-executor-bearer-token",
-    "timeout_ms": 10000,
-    "enabled": true
-  }
-]