xytara 3.1.0 → 3.1.2

package/bin/xytara-run.js

@@ -1,186 +1,186 @@
-#!/usr/bin/env node
-"use strict";
-
-const crypto = require("crypto");
-
-function parseArgs(argv) {
-  const args = {};
-  for (let index = 0; index < argv.length; index += 1) {
-    const token = argv[index];
-    if (!token.startsWith("--")) continue;
-    const key = token.slice(2);
-    const next = argv[index + 1];
-    if (!next || next.startsWith("--")) {
-      args[key] = true;
-      continue;
-    }
-    args[key] = next;
-    index += 1;
-  }
-  return args;
-}
-
-function printUsage() {
-  process.stdout.write([
-    "Usage: xytara-run --url <service_url> --account <account_id> --command <intent> --task <task_ref> [options]",
-    "",
-    "Options:",
-    "  --body-json <json>        JSON body for the task payload",
-    "  --wallet-id <id>          Wallet id for local_signed x402 payment",
-    "  --wallet-secret <secret>  Shared secret for local_signed payment",
-    "  --txid <txid>             Existing BSV txid for bsv_teranode settlement",
-    "  --raw-tx <hex>            Raw BSV transaction for arc submission flows",
-    "  --quote-only              Stop after returning the payment challenge",
-    "  --pretty                  Pretty-print JSON output",
-    "  --help                    Show this help message"
-  ].join("\n"));
-}
-
-function parseJson(value, label) {
-  if (value == null || value === "") return {};
-  try {
-    return JSON.parse(value);
-  } catch (error) {
-    throw new Error(`${label}_must_be_valid_json`);
-  }
-}
-
-async function postJson(url, payload, headers = {}) {
-  const response = await fetch(url, {
-    method: "POST",
-    headers: {
-      "content-type": "application/json",
-      ...headers
-    },
-    body: JSON.stringify(payload)
-  });
-  const text = await response.text();
-  let json = null;
-  try {
-    json = text ? JSON.parse(text) : null;
-  } catch (_) {
-    json = null;
-  }
-  return {
-    status: response.status,
-    ok: response.ok,
-    json,
-    text
-  };
-}
-
-function buildLocalSignedPaymentSignature({ quote, accountId, walletId, walletSecret, txid, rawTx }) {
-  const payment = {
-    account_id: accountId,
-    wallet_id: walletId,
-    quote_id: quote.quote_id,
-    amount_minor: quote.amount_minor,
-    currency: quote.currency,
-    settlement_mode: quote.settlement.mode,
-    settlement_binding_hash: quote.settlement_binding_hash
-  };
-
-  if (quote.settlement && quote.settlement.mode === "bsv_teranode") {
-    payment.bsv_teranode = {
-      network: quote.settlement.hints && quote.settlement.hints.network ? quote.settlement.hints.network : null,
-      merchant_address: quote.settlement.hints && quote.settlement.hints.merchant_address ? quote.settlement.hints.merchant_address : null,
-      amount_satoshis: quote.settlement.hints && quote.settlement.hints.amount_satoshis != null ? quote.settlement.hints.amount_satoshis : null,
-      settlement_reference: quote.settlement.hints && quote.settlement.hints.settlement_reference ? quote.settlement.hints.settlement_reference : null
-    };
-    if (txid) payment.bsv_teranode.txid = txid;
-    if (rawTx) payment.bsv_teranode.raw_tx = rawTx;
-  }
-
-  payment.issued_at_iso = new Date().toISOString();
-  payment.nonce = `xytara-cli-${Date.now()}`;
-
-  const encoded = Buffer.from(JSON.stringify(payment), "utf8").toString("base64url");
-  const signature = crypto.createHmac("sha256", walletSecret).update(encoded).digest("hex");
-  return Buffer.from(JSON.stringify({
-    scheme: "exact",
-    wallet_id: walletId,
-    payload: encoded,
-    signature
-  }), "utf8").toString("base64url");
-}
-
-function writeOutput(payload, pretty) {
-  process.stdout.write(JSON.stringify(payload, null, pretty ? 2 : 0));
-}
-
-async function main() {
-  const args = parseArgs(process.argv.slice(2));
-  if (args.help) {
-    printUsage();
-    return;
-  }
-
-  const serviceUrl = String(args.url || "").replace(/\/$/, "");
-  const accountId = String(args.account || "").trim();
-  const command = String(args.command || "").trim();
-  const taskRef = String(args.task || args["task-ref"] || "").trim();
-  const body = parseJson(args["body-json"], "body_json");
-  const walletId = String(args["wallet-id"] || "").trim();
-  const walletSecret = String(args["wallet-secret"] || "").trim();
-  const txid = String(args.txid || "").trim() || null;
-  const rawTx = String(args["raw-tx"] || "").trim() || null;
-  const pretty = args.pretty === true;
-
-  if (!serviceUrl || !accountId || !command || !taskRef) {
-    printUsage();
-    process.exitCode = 1;
-    return;
-  }
-
-  const executeUrl = `${serviceUrl}/x402/commands/execute`;
-  const payload = {
-    account_id: accountId,
-    command,
-    task_ref: taskRef,
-    body
-  };
-
-  const challengeResult = await postJson(executeUrl, payload);
-  if (challengeResult.ok) {
-    writeOutput(challengeResult.json || { ok: true }, pretty);
-    return;
-  }
-  if (challengeResult.status !== 402 || !challengeResult.json || !challengeResult.json.payment_required) {
-    writeOutput(challengeResult.json || { ok: false, status: challengeResult.status, body: challengeResult.text || null }, pretty);
-    process.exitCode = 1;
-    return;
-  }
-
-  if (args["quote-only"] === true || !walletId || !walletSecret) {
-    writeOutput(challengeResult.json, pretty);
-    return;
-  }
-
-  const quote = challengeResult.json.payment_required.quote;
-  const paymentSignature = buildLocalSignedPaymentSignature({
-    quote,
-    accountId,
-    walletId,
-    walletSecret,
-    txid,
-    rawTx
-  });
-  const paidPayload = {
-    ...payload,
-    quote_id: quote.quote_id
-  };
-  const paidResult = await postJson(executeUrl, paidPayload, {
-    "payment-signature": paymentSignature
-  });
-  if (!paidResult.ok) {
-    writeOutput(paidResult.json || { ok: false, status: paidResult.status, body: paidResult.text || null }, pretty);
-    process.exitCode = 1;
-    return;
-  }
-  writeOutput(paidResult.json || { ok: true }, pretty);
-}
-
-main().catch((error) => {
-  process.stderr.write(`${error.message}\n`);
-  process.exitCode = 1;
-});
+#!/usr/bin/env node
+"use strict";
+
+const crypto = require("crypto");
+
+function parseArgs(argv) {
+  const args = {};
+  for (let index = 0; index < argv.length; index += 1) {
+    const token = argv[index];
+    if (!token.startsWith("--")) continue;
+    const key = token.slice(2);
+    const next = argv[index + 1];
+    if (!next || next.startsWith("--")) {
+      args[key] = true;
+      continue;
+    }
+    args[key] = next;
+    index += 1;
+  }
+  return args;
+}
+
+function printUsage() {
+  process.stdout.write([
+    "Usage: xytara-run --url <service_url> --account <account_id> --command <intent> --task <task_ref> [options]",
+    "",
+    "Options:",
+    "  --body-json <json>        JSON body for the task payload",
+    "  --wallet-id <id>          Wallet id for local_signed x402 payment",
+    "  --wallet-secret <secret>  Shared secret for local_signed payment",
+    "  --txid <txid>             Existing BSV txid for bsv_teranode settlement",
+    "  --raw-tx <hex>            Raw BSV transaction for arc submission flows",
+    "  --quote-only              Stop after returning the payment challenge",
+    "  --pretty                  Pretty-print JSON output",
+    "  --help                    Show this help message"
+  ].join("\n"));
+}
+
+function parseJson(value, label) {
+  if (value == null || value === "") return {};
+  try {
+    return JSON.parse(value);
+  } catch (error) {
+    throw new Error(`${label}_must_be_valid_json`);
+  }
+}
+
+async function postJson(url, payload, headers = {}) {
+  const response = await fetch(url, {
+    method: "POST",
+    headers: {
+      "content-type": "application/json",
+      ...headers
+    },
+    body: JSON.stringify(payload)
+  });
+  const text = await response.text();
+  let json = null;
+  try {
+    json = text ? JSON.parse(text) : null;
+  } catch (_) {
+    json = null;
+  }
+  return {
+    status: response.status,
+    ok: response.ok,
+    json,
+    text
+  };
+}
+
+function buildLocalSignedPaymentSignature({ quote, accountId, walletId, walletSecret, txid, rawTx }) {
+  const payment = {
+    account_id: accountId,
+    wallet_id: walletId,
+    quote_id: quote.quote_id,
+    amount_minor: quote.amount_minor,
+    currency: quote.currency,
+    settlement_mode: quote.settlement.mode,
+    settlement_binding_hash: quote.settlement_binding_hash
+  };
+
+  if (quote.settlement && quote.settlement.mode === "bsv_teranode") {
+    payment.bsv_teranode = {
+      network: quote.settlement.hints && quote.settlement.hints.network ? quote.settlement.hints.network : null,
+      merchant_address: quote.settlement.hints && quote.settlement.hints.merchant_address ? quote.settlement.hints.merchant_address : null,
+      amount_satoshis: quote.settlement.hints && quote.settlement.hints.amount_satoshis != null ? quote.settlement.hints.amount_satoshis : null,
+      settlement_reference: quote.settlement.hints && quote.settlement.hints.settlement_reference ? quote.settlement.hints.settlement_reference : null
+    };
+    if (txid) payment.bsv_teranode.txid = txid;
+    if (rawTx) payment.bsv_teranode.raw_tx = rawTx;
+  }
+
+  payment.issued_at_iso = new Date().toISOString();
+  payment.nonce = `xytara-cli-${Date.now()}`;
+
+  const encoded = Buffer.from(JSON.stringify(payment), "utf8").toString("base64url");
+  const signature = crypto.createHmac("sha256", walletSecret).update(encoded).digest("hex");
+  return Buffer.from(JSON.stringify({
+    scheme: "exact",
+    wallet_id: walletId,
+    payload: encoded,
+    signature
+  }), "utf8").toString("base64url");
+}
+
+function writeOutput(payload, pretty) {
+  process.stdout.write(JSON.stringify(payload, null, pretty ? 2 : 0));
+}
+
+async function main() {
+  const args = parseArgs(process.argv.slice(2));
+  if (args.help) {
+    printUsage();
+    return;
+  }
+
+  const serviceUrl = String(args.url || "").replace(/\/$/, "");
+  const accountId = String(args.account || "").trim();
+  const command = String(args.command || "").trim();
+  const taskRef = String(args.task || args["task-ref"] || "").trim();
+  const body = parseJson(args["body-json"], "body_json");
+  const walletId = String(args["wallet-id"] || "").trim();
+  const walletSecret = String(args["wallet-secret"] || "").trim();
+  const txid = String(args.txid || "").trim() || null;
+  const rawTx = String(args["raw-tx"] || "").trim() || null;
+  const pretty = args.pretty === true;
+
+  if (!serviceUrl || !accountId || !command || !taskRef) {
+    printUsage();
+    process.exitCode = 1;
+    return;
+  }
+
+  const executeUrl = `${serviceUrl}/x402/commands/execute`;
+  const payload = {
+    account_id: accountId,
+    command,
+    task_ref: taskRef,
+    body
+  };
+
+  const challengeResult = await postJson(executeUrl, payload);
+  if (challengeResult.ok) {
+    writeOutput(challengeResult.json || { ok: true }, pretty);
+    return;
+  }
+  if (challengeResult.status !== 402 || !challengeResult.json || !challengeResult.json.payment_required) {
+    writeOutput(challengeResult.json || { ok: false, status: challengeResult.status, body: challengeResult.text || null }, pretty);
+    process.exitCode = 1;
+    return;
+  }
+
+  if (args["quote-only"] === true || !walletId || !walletSecret) {
+    writeOutput(challengeResult.json, pretty);
+    return;
+  }
+
+  const quote = challengeResult.json.payment_required.quote;
+  const paymentSignature = buildLocalSignedPaymentSignature({
+    quote,
+    accountId,
+    walletId,
+    walletSecret,
+    txid,
+    rawTx
+  });
+  const paidPayload = {
+    ...payload,
+    quote_id: quote.quote_id
+  };
+  const paidResult = await postJson(executeUrl, paidPayload, {
+    "payment-signature": paymentSignature
+  });
+  if (!paidResult.ok) {
+    writeOutput(paidResult.json || { ok: false, status: paidResult.status, body: paidResult.text || null }, pretty);
+    process.exitCode = 1;
+    return;
+  }
+  writeOutput(paidResult.json || { ok: true }, pretty);
+}
+
+main().catch((error) => {
+  process.stderr.write(`${error.message}\n`);
+  process.exitCode = 1;
+});

package/bin/xytara.js

@@ -1,80 +1,80 @@
-#!/usr/bin/env node
-"use strict";
-
-const path = require("path");
-const { spawnSync } = require("child_process");
-
-function printUsage() {
-  process.stdout.write([
-    "Usage: xytara <command> [options]",
-    "",
-    "Commands:",
-    "  release [args]    Open the release/adoption/reporting surface",
-    "  run [args]        Execute the paid runtime command path",
-    "  first-run [args]  Guide or run the safe public quote-first path",
-    "  start-here        Print the shortest first-run path",
-    "  help              Show this help message",
-    "",
-    "Fastest first run:",
-    "  xytara start-here",
-    "  xytara first-run",
-    "  xytara first-run --run-quote --account ACCOUNT_REF --pretty",
-    "  xytara first-run --execute-with-credits --account ACCOUNT_REF --pretty",
-    "  xytara release --summary",
-    "  xytara run --help"
-  ].join("\n"));
-}
-
-function printStartHere() {
-  process.stdout.write([
-    "xytara start-here",
-    "",
-    "Public first-run spine:",
-    "  quote -> pay/credits -> execute -> prove",
-    "",
-    "Guided CLI:",
-    "  xytara first-run",
-    "  xytara first-run --run-quote --account ACCOUNT_REF --pretty",
-    "  xytara first-run --execute-with-credits --account ACCOUNT_REF --pretty",
-    "",
-    "1. Open https://www.naxytra.com/v1/first-run-path",
-    "2. Open https://www.naxytra.com/v1/first-run-kit for copyable commands.",
-    "3. Quote safely first:",
-    "   xytara-run --url https://xytara.onrender.com --account ACCOUNT_REF --task adapter.mcp.invoke --command mcp.invoke:summarize --body-json \"{\\\"tool_name\\\":\\\"summarize\\\",\\\"arguments\\\":{\\\"text\\\":\\\"Summarize the naxytra first-run path in one sentence.\\\"}}\" --quote-only --pretty",
-    "4. Execute with direct signed payment or credits-first on a funded account.",
-    "5. Hand the result into xoonya for proof review and verification.",
-    "",
-    "Boundaries:",
-    "  quote-only mode needs no wallet secret",
-    "  funded execution needs direct payment material or reusable credits",
-    "  proof stays in xoonya; runtime payment state stays in xytara",
-    "",
-    "Local package confidence:",
-    "  node examples/quickstart.js",
-    "  npm run verify:all",
-    "  xytara release --summary"
-  ].join("\n"));
-}
-
-function delegate(scriptName, args) {
-  const scriptPath = path.join(__dirname, scriptName);
-  const result = spawnSync(process.execPath, [scriptPath, ...args], { stdio: "inherit" });
-  process.exitCode = typeof result.status === "number" ? result.status : 1;
-}
-
-const [command, ...rest] = process.argv.slice(2);
-
-if (!command || command === "help" || command === "--help" || command === "-h") {
-  printUsage();
-} else if (command === "start-here" || command === "--start-here") {
-  printStartHere();
-} else if (command === "release") {
-  delegate("xytara-release.js", rest);
-} else if (command === "run") {
-  delegate("xytara-run.js", rest);
-} else if (command === "first-run" || command === "firstrun") {
-  delegate("xytara-first-run.js", rest);
-} else {
-  printUsage();
-  process.exitCode = 1;
-}
+#!/usr/bin/env node
+"use strict";
+
+const path = require("path");
+const { spawnSync } = require("child_process");
+
+function printUsage() {
+  process.stdout.write([
+    "Usage: xytara <command> [options]",
+    "",
+    "Commands:",
+    "  release [args]    Open the release/adoption/reporting surface",
+    "  run [args]        Execute the paid runtime command path",
+    "  first-run [args]  Guide or run the safe public quote-first path",
+    "  start-here        Print the shortest first-run path",
+    "  help              Show this help message",
+    "",
+    "Fastest first run:",
+    "  xytara start-here",
+    "  xytara first-run",
+    "  xytara first-run --run-quote --account ACCOUNT_REF --pretty",
+    "  xytara first-run --execute-with-credits --account ACCOUNT_REF --pretty",
+    "  xytara release --summary",
+    "  xytara run --help"
+  ].join("\n"));
+}
+
+function printStartHere() {
+  process.stdout.write([
+    "xytara start-here",
+    "",
+    "Public first-run spine:",
+    "  quote -> pay/credits -> execute -> prove",
+    "",
+    "Guided CLI:",
+    "  xytara first-run",
+    "  xytara first-run --run-quote --account ACCOUNT_REF --pretty",
+    "  xytara first-run --execute-with-credits --account ACCOUNT_REF --pretty",
+    "",
+    "1. Open https://www.naxytra.com/v1/first-run-path",
+    "2. Open https://www.naxytra.com/v1/first-run-kit for copyable commands.",
+    "3. Quote safely first:",
+    "   xytara-run --url https://xytara.onrender.com --account ACCOUNT_REF --task adapter.mcp.invoke --command mcp.invoke:summarize --body-json \"{\\\"tool_name\\\":\\\"summarize\\\",\\\"arguments\\\":{\\\"text\\\":\\\"Summarize the naxytra first-run path in one sentence.\\\"}}\" --quote-only --pretty",
+    "4. Execute with direct signed payment or credits-first on a funded account.",
+    "5. Hand the result into xoonya for proof review and verification.",
+    "",
+    "Boundaries:",
+    "  quote-only mode needs no wallet secret",
+    "  funded execution needs direct payment material or reusable credits",
+    "  proof stays in xoonya; runtime payment state stays in xytara",
+    "",
+    "Local package confidence:",
+    "  node examples/quickstart.js",
+    "  npm run verify:all",
+    "  xytara release --summary"
+  ].join("\n"));
+}
+
+function delegate(scriptName, args) {
+  const scriptPath = path.join(__dirname, scriptName);
+  const result = spawnSync(process.execPath, [scriptPath, ...args], { stdio: "inherit" });
+  process.exitCode = typeof result.status === "number" ? result.status : 1;
+}
+
+const [command, ...rest] = process.argv.slice(2);
+
+if (!command || command === "help" || command === "--help" || command === "-h") {
+  printUsage();
+} else if (command === "start-here" || command === "--start-here") {
+  printStartHere();
+} else if (command === "release") {
+  delegate("xytara-release.js", rest);
+} else if (command === "run") {
+  delegate("xytara-run.js", rest);
+} else if (command === "first-run" || command === "firstrun") {
+  delegate("xytara-first-run.js", rest);
+} else {
+  printUsage();
+  process.exitCode = 1;
+}

package/client.js

@@ -1,3 +1,3 @@
-"use strict";
-
-module.exports = require("./lib/commerce_client");
+"use strict";
+
+module.exports = require("./lib/commerce_client");

package/examples/_demo_env.js

@@ -0,0 +1,40 @@
+"use strict";
+
+// Local demo environment for the bundled examples.
+//
+// The runtime is fail-closed by default: signed payment acceptance (`local_signed`) and
+// operator write surfaces that require bearer tokens. The examples therefore register a
+// demo wallet and demo operator tokens before the in-process server is created. Every value
+// here is only applied when the corresponding variable is not already set, so a real
+// configuration always wins.
+
+function setDefault(name, value) {
+  if (typeof process.env[name] !== "string" || !process.env[name].trim()) {
+    process.env[name] = value;
+  }
+}
+
+setDefault("XYTARA_PAYMENT_VERIFICATION_MODE", "local_signed");
+setDefault(
+  "XYTARA_WALLET_REGISTRY_JSON",
+  JSON.stringify([
+    {
+      wallet_id: "demo-wallet",
+      secret: "demo-wallet-secret",
+      account_id: "acct_demo",
+      enabled: true
+    }
+  ])
+);
+setDefault("XYTARA_CREDIT_BRIDGE_BEARER_TOKEN", "demo-credit-bridge-token");
+setDefault("XYTARA_ACCOUNT_AUTH_BEARER_TOKEN", "demo-account-auth-token");
+setDefault("XYTARA_BSV_TERANODE_MERCHANT_ADDRESS", "1MerchantBsvAddressExample");
+setDefault("XYTARA_BSV_TERANODE_SETTLEMENT_RUNTIME_MODE", "mock");
+
+module.exports = {
+  demoWalletId: "demo-wallet",
+  demoWalletSecret: "demo-wallet-secret",
+  demoAccountId: "acct_demo",
+  demoCreditBridgeToken: process.env.XYTARA_CREDIT_BRIDGE_BEARER_TOKEN,
+  demoAccountAuthToken: process.env.XYTARA_ACCOUNT_AUTH_BEARER_TOKEN
+};