xytara 3.1.0 → 3.1.2

package/lib/commerce_identity.js

@@ -1,578 +1,578 @@
-"use strict";
-
-function ensureArray(value) {
-  return Array.isArray(value) ? value : [];
-}
-
-function nowIso() {
-  return new Date().toISOString();
-}
-
-function listTransactionEntriesForAccount(state, accountId) {
-  return Array.from(state.transactions.values())
-    .filter((entry) => entry && entry.transaction && entry.transaction.account_id === accountId);
-}
-
-function listReceiptsForAccount(state, accountId) {
-  return Array.from(state.receipts.values())
-    .map((entry) => entry && entry.receipt ? entry.receipt : null)
-    .filter((receipt) => receipt && receipt.account_id === accountId);
-}
-
-function listAgentAccountsForIdentity(state, accountId) {
-  return Array.from(state.agentAccounts.values())
-    .map((entry) => entry && entry.account ? entry.account : null)
-    .filter((account) => account && account.account_id === accountId);
-}
-
-function listIdentityBindingsForAccount(state, accountId) {
-  return Array.from(state.machineIdentityBindings.values())
-    .filter((binding) => binding && binding.account_id === accountId);
-}
-
-function collectIdentityDeliverables(entry) {
-  const deliverables = entry && entry.command && Array.isArray(entry.command.deliverables)
-    ? entry.command.deliverables
-    : [];
-  const identityRefs = [];
-  const registryRefs = [];
-  const anchorRefs = [];
-  for (const item of deliverables) {
-    if (!item || typeof item !== "object") continue;
-    if (item.identity_attestation_ref) identityRefs.push(item.identity_attestation_ref);
-    if (item.identity_link_ref) identityRefs.push(item.identity_link_ref);
-    if (item.registry_record_ref) registryRefs.push(item.registry_record_ref);
-    if (item.registry_pack_ref) registryRefs.push(item.registry_pack_ref);
-    if (item.anchor_ref) anchorRefs.push(item.anchor_ref);
-  }
-  return {
-    identity_refs: identityRefs,
-    registry_refs: registryRefs,
-    anchor_refs: anchorRefs
-  };
-}
-
-function buildMachineIdentitySummary(state, accountId) {
-  const agentAccounts = listAgentAccountsForIdentity(state, accountId);
-  const identityBindings = listIdentityBindingsForAccount(state, accountId);
-  const transactionEntries = listTransactionEntriesForAccount(state, accountId);
-  const receipts = listReceiptsForAccount(state, accountId);
-  const identityTransactions = transactionEntries.filter((entry) =>
-    ensureArray(entry.command && entry.command.deliverables).some((task) =>
-      task && typeof task.task_ref === "string" && (
-        task.task_ref === "identity.attest.preview" ||
-        task.task_ref === "identity.registry.link" ||
-        task.task_ref === "registry.register" ||
-        task.task_ref === "registry.pack.bundle" ||
-        task.task_ref === "anchoring.submit"
-      )
-    ) || ensureArray(entry.transaction && entry.transaction.execution && entry.transaction.execution.tasks).some((task) =>
-      task && typeof task.task_ref === "string" && (
-        task.task_ref === "identity.attest.preview" ||
-        task.task_ref === "identity.registry.link" ||
-        task.task_ref === "registry.register" ||
-        task.task_ref === "registry.pack.bundle" ||
-        task.task_ref === "anchoring.submit"
-      )
-    )
-  );
-  const refs = identityTransactions.reduce((acc, transaction) => {
-    const next = collectIdentityDeliverables(transaction);
-    acc.identity_refs.push(...next.identity_refs);
-    acc.registry_refs.push(...next.registry_refs);
-    acc.anchor_refs.push(...next.anchor_refs);
-    return acc;
-  }, {
-    identity_refs: [],
-    registry_refs: [],
-    anchor_refs: []
-  });
-
-  const latestIdentityTransaction = identityTransactions
-    .map((entry) => ({
-      transaction_id: entry.transaction && entry.transaction.transaction_id ? entry.transaction.transaction_id : null,
-      created_at_iso: entry.transaction && entry.transaction.created_at_iso ? entry.transaction.created_at_iso : null
-    }))
-    .sort((a, b) => String(a.created_at_iso || "").localeCompare(String(b.created_at_iso || "")))
-    .slice(-1)[0] || null;
-
-  let identityState = "unbound";
-  if (agentAccounts.length > 0) identityState = "account_issued";
-  if (identityBindings.length > 0) identityState = "identity_binding_present";
-  if (identityTransactions.length > 0) identityState = "identity_activity_present";
-  if (refs.registry_refs.length > 0 && refs.anchor_refs.length > 0) identityState = "registry_anchor_present";
-
-  return {
-    summary_version: "xytara-machine-identity-summary-v1",
-    account_id: accountId,
-    machine_identity_state: identityState,
-    counts: {
-      agent_account_count: agentAccounts.length,
-      identity_binding_count: identityBindings.length,
-      identity_transaction_count: identityTransactions.length,
-      receipt_count: receipts.length,
-      identity_ref_count: refs.identity_refs.length,
-      registry_ref_count: refs.registry_refs.length,
-      anchor_ref_count: refs.anchor_refs.length
-    },
-    latest_identity_transaction_id: latestIdentityTransaction ? latestIdentityTransaction.transaction_id : null,
-    linked_surfaces: {
-      machine_identity_bundle_ref: `/v1/economics/accounts/${encodeURIComponent(accountId)}/machine-identity-bundle`,
-      agent_accounts_ref: "/v1/agent-accounts",
-      operator_shell_summary_ref: "/v1/operator-shell/summary"
-    },
-    generated_at_iso: nowIso()
-  };
-}
-
-function buildMachineIdentityBundle(state, accountId) {
-  const summary = buildMachineIdentitySummary(state, accountId);
-  const agentAccounts = listAgentAccountsForIdentity(state, accountId);
-  const identityBindings = listIdentityBindingsForAccount(state, accountId);
-  const transactionEntries = listTransactionEntriesForAccount(state, accountId);
-  const identityTransactions = transactionEntries
-    .filter((entry) =>
-      ensureArray(entry.command && entry.command.deliverables).some((task) =>
-        task && typeof task.task_ref === "string" && (
-          task.task_ref === "identity.attest.preview" ||
-          task.task_ref === "identity.registry.link" ||
-          task.task_ref === "registry.register" ||
-          task.task_ref === "registry.pack.bundle" ||
-          task.task_ref === "anchoring.submit"
-        )
-      ) || ensureArray(entry.transaction && entry.transaction.execution && entry.transaction.execution.tasks).some((task) =>
-        task && typeof task.task_ref === "string" && (
-          task.task_ref === "identity.attest.preview" ||
-          task.task_ref === "identity.registry.link" ||
-          task.task_ref === "registry.register" ||
-          task.task_ref === "registry.pack.bundle" ||
-          task.task_ref === "anchoring.submit"
-        )
-      )
-    )
-    .map((entry) => {
-      const refs = collectIdentityDeliverables(entry);
-      return {
-        transaction_id: entry.transaction && entry.transaction.transaction_id ? entry.transaction.transaction_id : null,
-        status: entry.transaction && entry.transaction.status ? entry.transaction.status : null,
-        created_at_iso: entry.transaction && entry.transaction.created_at_iso ? entry.transaction.created_at_iso : null,
-        identity_refs: refs.identity_refs,
-        registry_refs: refs.registry_refs,
-        anchor_refs: refs.anchor_refs
-      };
-    });
-
-  return {
-    bundle_version: "xytara-machine-identity-bundle-v1",
-    account_id: accountId,
-    machine_identity_summary: summary,
-    agent_accounts: agentAccounts,
-    identity_bindings: identityBindings,
-    identity_transactions: identityTransactions,
-    linked_surfaces: {
-      machine_identity_summary_ref: `/v1/economics/accounts/${encodeURIComponent(accountId)}/machine-identity-summary`,
-      authority_summary_ref: `/v1/economics/accounts/${encodeURIComponent(accountId)}/authority-summary`,
-      wallet_ledger_bundle_ref: `/v1/economics/accounts/${encodeURIComponent(accountId)}/wallet-ledger-bundle`
-    },
-    generated_at_iso: nowIso()
-  };
-}
-
-function buildMachineIdentityAttachmentSummary(state, accountId) {
-  const agentAccounts = listAgentAccountsForIdentity(state, accountId);
-  const bundle = buildMachineIdentityBundle(state, accountId);
-  const attachmentRows = bundle.identity_transactions.map((entry) => ({
-    transaction_id: entry.transaction_id,
-    identity_attachment_count: ensureArray(entry.identity_refs).length,
-    registry_attachment_count: ensureArray(entry.registry_refs).length,
-    anchor_attachment_count: ensureArray(entry.anchor_refs).length,
-    has_registry_anchor_pair: ensureArray(entry.registry_refs).length > 0 && ensureArray(entry.anchor_refs).length > 0,
-    created_at_iso: entry.created_at_iso || null
-  }));
-
-  return {
-    summary_version: "xytara-machine-identity-attachment-summary-v1",
-    account_id: accountId,
-    machine_identity_attachment_state: attachmentRows.length > 0 ? "attachments_present" : agentAccounts.length > 0 ? "account_only" : "unattached",
-    counts: {
-      agent_account_count: agentAccounts.length,
-      identity_binding_count: Array.isArray(bundle.identity_bindings) ? bundle.identity_bindings.length : 0,
-      attachment_row_count: attachmentRows.length,
-      registry_anchor_pair_count: attachmentRows.filter((entry) => entry.has_registry_anchor_pair).length
-    },
-    attachment_rows: attachmentRows,
-    linked_surfaces: {
-      machine_identity_bundle_ref: `/v1/economics/accounts/${encodeURIComponent(accountId)}/machine-identity-bundle`,
-      machine_identity_lineage_summary_ref: `/v1/economics/accounts/${encodeURIComponent(accountId)}/machine-identity-lineage-summary`
-    },
-    generated_at_iso: nowIso()
-  };
-}
-
-function buildMachineIdentityLineageSummary(state, accountId) {
-  const bundle = buildMachineIdentityBundle(state, accountId);
-  const lineageRows = bundle.identity_transactions.map((entry, index) => {
-    const predecessor = index > 0 ? bundle.identity_transactions[index - 1] : null;
-    const successor = index < bundle.identity_transactions.length - 1 ? bundle.identity_transactions[index + 1] : null;
-    return {
-      transaction_id: entry.transaction_id,
-      predecessor_transaction_id: predecessor ? predecessor.transaction_id : null,
-      successor_transaction_id: successor ? successor.transaction_id : null,
-      lineage_position: predecessor ? successor ? "middle" : "leaf" : successor ? "root" : "standalone",
-      registry_ref_count: ensureArray(entry.registry_refs).length,
-      anchor_ref_count: ensureArray(entry.anchor_refs).length,
-      created_at_iso: entry.created_at_iso || null
-    };
-  });
-
-  return {
-    summary_version: "xytara-machine-identity-lineage-summary-v1",
-    account_id: accountId,
-    identity_transaction_count: bundle.identity_transactions.length,
-    root_count: lineageRows.filter((entry) => entry.lineage_position === "root" || entry.lineage_position === "standalone").length,
-    leaf_count: lineageRows.filter((entry) => entry.lineage_position === "leaf" || entry.lineage_position === "standalone").length,
-    lineage_rows: lineageRows,
-    linked_surfaces: {
-      machine_identity_summary_ref: `/v1/economics/accounts/${encodeURIComponent(accountId)}/machine-identity-summary`,
-      machine_identity_attachment_summary_ref: `/v1/economics/accounts/${encodeURIComponent(accountId)}/machine-identity-attachment-summary`
-    },
-    generated_at_iso: nowIso()
-  };
-}
-
-function buildMachineIdentityBindingLineageSummary(state, accountId) {
-  const identityBindings = listIdentityBindingsForAccount(state, accountId)
-    .slice()
-    .sort((a, b) => String(a.created_at_iso || "").localeCompare(String(b.created_at_iso || "")));
-  const lineageRows = identityBindings.map((entry) => ({
-    binding_id: entry.binding_id,
-    status: entry.status,
-    identity_kind: entry.identity_kind,
-    predecessor_binding_id: entry.rotated_from_binding_id || null,
-    successor_binding_id: entry.replaced_by_binding_id || null,
-    lineage_position: entry.rotated_from_binding_id
-      ? entry.replaced_by_binding_id
-        ? "middle"
-        : "leaf"
-      : entry.replaced_by_binding_id
-        ? "root"
-        : "standalone",
-    expires_at_iso: entry.expires_at_iso || null,
-    created_at_iso: entry.created_at_iso || null,
-    updated_at_iso: entry.updated_at_iso || null
-  }));
-
-  return {
-    summary_version: "xytara-machine-identity-binding-lineage-summary-v1",
-    account_id: accountId,
-    identity_binding_count: identityBindings.length,
-    rotated_binding_count: lineageRows.filter((entry) => entry.predecessor_binding_id || entry.successor_binding_id).length,
-    lineage_rows: lineageRows,
-    linked_surfaces: {
-      machine_identity_summary_ref: `/v1/economics/accounts/${encodeURIComponent(accountId)}/machine-identity-summary`,
-      machine_identity_review_bundle_ref: `/v1/economics/accounts/${encodeURIComponent(accountId)}/machine-identity-review-bundle`,
-      machine_identity_attention_summary_ref: `/v1/economics/accounts/${encodeURIComponent(accountId)}/machine-identity-attention-summary`
-    },
-    generated_at_iso: nowIso()
-  };
-}
-
-function buildMachineIdentityProfile(state, accountId) {
-  const summary = buildMachineIdentitySummary(state, accountId);
-  const bundle = buildMachineIdentityBundle(state, accountId);
-  const attachment = buildMachineIdentityAttachmentSummary(state, accountId);
-  const lineage = buildMachineIdentityLineageSummary(state, accountId);
-  const primaryAgentAccount = Array.isArray(bundle.agent_accounts) && bundle.agent_accounts.length > 0
-    ? bundle.agent_accounts[0]
-    : null;
-  const primaryIdentityBinding = Array.isArray(bundle.identity_bindings) && bundle.identity_bindings.length > 0
-    ? bundle.identity_bindings[0]
-    : null;
-
-  return {
-    profile_version: "xytara-machine-identity-profile-v1",
-    account_id: accountId,
-    machine_identity_state: summary.machine_identity_state,
-    primary_identity_kind: primaryIdentityBinding
-      ? primaryIdentityBinding.identity_kind
-      : primaryAgentAccount
-        ? "agent_account"
-        : "runtime_account_only",
-    primary_agent_account_id: primaryAgentAccount ? primaryAgentAccount.account_id : null,
-    primary_identity_binding_id: primaryIdentityBinding ? primaryIdentityBinding.binding_id : null,
-    settlement_mode: primaryAgentAccount ? primaryAgentAccount.settlement_mode || null : null,
-    protocol: primaryAgentAccount ? primaryAgentAccount.protocol || null : null,
-    attachment_state: attachment.machine_identity_attachment_state,
-    lineage_state: lineage.identity_transaction_count > 0 ? "lineage_present" : "lineage_absent",
-    linked_surfaces: {
-      machine_identity_summary_ref: `/v1/economics/accounts/${encodeURIComponent(accountId)}/machine-identity-summary`,
-      machine_identity_bundle_ref: `/v1/economics/accounts/${encodeURIComponent(accountId)}/machine-identity-bundle`,
-      machine_identity_policy_pack_ref: `/v1/economics/accounts/${encodeURIComponent(accountId)}/machine-identity-policy-pack`,
-      machine_identity_binding_lineage_summary_ref: `/v1/economics/accounts/${encodeURIComponent(accountId)}/machine-identity-binding-lineage-summary`
-    },
-    generated_at_iso: nowIso()
-  };
-}
-
-function buildMachineIdentityPolicyPack(state, accountId) {
-  const summary = buildMachineIdentitySummary(state, accountId);
-  const profile = buildMachineIdentityProfile(state, accountId);
-  const attachment = buildMachineIdentityAttachmentSummary(state, accountId);
-  const lineage = buildMachineIdentityLineageSummary(state, accountId);
-  const bindingLineage = buildMachineIdentityBindingLineageSummary(state, accountId);
-  const policyTemplates = [
-    {
-      template_id: "runtime_builder_identity",
-      target_state: "account_issued",
-      recommended_for: "runtime-first machine onboarding",
-      steps: ["issue_agent_account", "confirm_protocol", "confirm_settlement_mode"],
-      binding_defaults: {
-        identity_kind: "runtime_builder_identity",
-        registry_scope: null,
-        attach_primary_agent_account: true,
-        use_latest_identity_transaction: false
-      }
-    },
-    {
-      template_id: "registry_anchor_identity",
-      target_state: "registry_anchor_present",
-      recommended_for: "identity-plus-registry continuity",
-      steps: ["identity_attest_preview", "registry_register", "identity_registry_link", "anchoring_submit"],
-      binding_defaults: {
-        identity_kind: "registry_anchor_identity",
-        registry_scope: "registry.identity.default",
-        attach_primary_agent_account: false,
-        use_latest_identity_transaction: true
-      }
-    },
-    {
-      template_id: "continuity_repair_identity",
-      target_state: "identity_activity_present",
-      recommended_for: "repair partial identity attachment posture",
-      steps: ["review_attachment_rows", "complete_registry_anchor_pair", "inspect_lineage"],
-      binding_defaults: {
-        identity_kind: "registry_anchor_identity",
-        registry_scope: "registry.identity.default",
-        attach_primary_agent_account: true,
-        use_latest_identity_transaction: true
-      }
-    }
-  ];
-
-  let recommendedPolicyMotion = "issue_identity_from_template";
-  if (summary.machine_identity_state === "registry_anchor_present") {
-    recommendedPolicyMotion = "maintain_identity_profile";
-  } else if (attachment.counts.registry_anchor_pair_count === 0 && attachment.counts.attachment_row_count > 0) {
-    recommendedPolicyMotion = "complete_registry_anchor_pair";
-  } else if (lineage.identity_transaction_count > 0) {
-    recommendedPolicyMotion = "stabilize_identity_lineage";
-  }
-
-  return {
-    pack_version: "xytara-machine-identity-policy-pack-v1",
-    account_id: accountId,
-    machine_identity_summary: summary,
-    machine_identity_profile: profile,
-    machine_identity_attachment_summary: attachment,
-    machine_identity_lineage_summary: lineage,
-    machine_identity_binding_lineage_summary: bindingLineage,
-    recommended_policy_motion: recommendedPolicyMotion,
-    policy_templates: policyTemplates,
-    linked_surfaces: {
-      machine_identity_profile_ref: `/v1/economics/accounts/${encodeURIComponent(accountId)}/machine-identity-profile`,
-      machine_identity_attachment_summary_ref: `/v1/economics/accounts/${encodeURIComponent(accountId)}/machine-identity-attachment-summary`,
-      machine_identity_lineage_summary_ref: `/v1/economics/accounts/${encodeURIComponent(accountId)}/machine-identity-lineage-summary`,
-      machine_identity_binding_lineage_summary_ref: `/v1/economics/accounts/${encodeURIComponent(accountId)}/machine-identity-binding-lineage-summary`
-    },
-    generated_at_iso: nowIso()
-  };
-}
-
-function buildMachineIdentityPolicyApplicationSummary(state, accountId, templateId) {
-  const pack = buildMachineIdentityPolicyPack(state, accountId);
-  const selectedTemplate = ensureArray(pack.policy_templates).find((entry) => entry.template_id === templateId)
-    || ensureArray(pack.policy_templates).find((entry) => {
-      if (pack.recommended_policy_motion === "maintain_identity_profile") {
-        return entry.template_id === "registry_anchor_identity";
-      }
-      if (pack.recommended_policy_motion === "complete_registry_anchor_pair") {
-        return entry.template_id === "continuity_repair_identity";
-      }
-      if (pack.recommended_policy_motion === "stabilize_identity_lineage") {
-        return entry.template_id === "continuity_repair_identity";
-      }
-      return entry.template_id === "runtime_builder_identity";
-    })
-    || ensureArray(pack.policy_templates)[0]
-    || null;
-  const bindingDefaults = selectedTemplate && selectedTemplate.binding_defaults ? selectedTemplate.binding_defaults : {};
-  const suggestedBindingPayload = {
-    account_id: accountId,
-    identity_kind: bindingDefaults.identity_kind || "registry_anchor_identity",
-    registry_scope: bindingDefaults.registry_scope || null,
-    attached_agent_account_id: bindingDefaults.attach_primary_agent_account
-      ? pack.machine_identity_profile.primary_agent_account_id || null
-      : null,
-    source_transaction_id: bindingDefaults.use_latest_identity_transaction
-      ? pack.machine_identity_summary.latest_identity_transaction_id || null
-      : null,
-    issued_by: "operator",
-    labels: selectedTemplate ? [`policy:${selectedTemplate.template_id}`] : []
-  };
-
-  return {
-    summary_version: "xytara-machine-identity-policy-application-summary-v1",
-    account_id: accountId,
-    recommended_policy_motion: pack.recommended_policy_motion,
-    selected_template_id: selectedTemplate ? selectedTemplate.template_id : null,
-    available_template_ids: ensureArray(pack.policy_templates).map((entry) => entry.template_id),
-    suggested_binding_payload: suggestedBindingPayload,
-    selected_template: selectedTemplate,
-    linked_surfaces: {
-      machine_identity_policy_pack_ref: `/v1/economics/accounts/${encodeURIComponent(accountId)}/machine-identity-policy-pack`,
-      machine_identity_profile_ref: `/v1/economics/accounts/${encodeURIComponent(accountId)}/machine-identity-profile`,
-      machine_identity_binding_lineage_summary_ref: `/v1/economics/accounts/${encodeURIComponent(accountId)}/machine-identity-binding-lineage-summary`
-    },
-    generated_at_iso: nowIso()
-  };
-}
-
-function buildMachineIdentityPolicyPackSummary(state, accountId) {
-  const pack = buildMachineIdentityPolicyPack(state, accountId);
-  return {
-    summary_version: "xytara-machine-identity-policy-pack-summary-v1",
-    account_id: accountId,
-    machine_identity_state: pack.machine_identity_summary.machine_identity_state,
-    recommended_policy_motion: pack.recommended_policy_motion,
-    template_count: Array.isArray(pack.policy_templates) ? pack.policy_templates.length : 0,
-    linked_surfaces: pack.linked_surfaces,
-    generated_at_iso: pack.generated_at_iso
-  };
-}
-
-function buildMachineIdentityReviewBundle(state, accountId) {
-  const summary = buildMachineIdentitySummary(state, accountId);
-  const bundle = buildMachineIdentityBundle(state, accountId);
-  const reviewRows = ensureArray(bundle.identity_bindings).map((binding) => {
-    const hasRegistryScope = typeof binding.registry_scope === "string" && binding.registry_scope.length > 0;
-    const hasSourceTransaction = typeof binding.source_transaction_id === "string" && binding.source_transaction_id.length > 0;
-    const hasAttachedAgent = typeof binding.attached_agent_account_id === "string" && binding.attached_agent_account_id.length > 0;
-    const hasRotationLineage = Boolean(binding.rotated_from_binding_id || binding.replaced_by_binding_id);
-    const reviewState = binding.status !== "active"
-      ? "revoked"
-      : hasRegistryScope && (hasSourceTransaction || hasAttachedAgent)
-        ? "healthy"
-        : "repair_candidate";
-    return {
-      binding_id: binding.binding_id,
-      identity_kind: binding.identity_kind,
-      review_state: reviewState,
-      has_registry_scope: hasRegistryScope,
-      has_source_transaction: hasSourceTransaction,
-      has_attached_agent_account: hasAttachedAgent,
-      has_rotation_lineage: hasRotationLineage,
-      recommended_action: reviewState === "repair_candidate"
-        ? "complete_identity_binding_context"
-        : reviewState === "revoked"
-          ? "review_for_replacement"
-          : "keep_active"
-    };
-  });
-
-  return {
-    bundle_version: "xytara-machine-identity-review-bundle-v1",
-    account_id: accountId,
-    machine_identity_summary: summary,
-    review_rows: reviewRows,
-    review_counts: {
-      healthy_count: reviewRows.filter((entry) => entry.review_state === "healthy").length,
-      repair_candidate_count: reviewRows.filter((entry) => entry.review_state === "repair_candidate").length,
-      revoked_count: reviewRows.filter((entry) => entry.review_state === "revoked").length
-    },
-    linked_surfaces: {
-      machine_identity_bundle_ref: `/v1/economics/accounts/${encodeURIComponent(accountId)}/machine-identity-bundle`,
-      machine_identity_attention_summary_ref: `/v1/economics/accounts/${encodeURIComponent(accountId)}/machine-identity-attention-summary`,
-      machine_identity_binding_lineage_summary_ref: `/v1/economics/accounts/${encodeURIComponent(accountId)}/machine-identity-binding-lineage-summary`
-    },
-    generated_at_iso: nowIso()
-  };
-}
-
-function buildMachineIdentityAttentionSummary(state, accountId) {
-  const reviewBundle = buildMachineIdentityReviewBundle(state, accountId);
-  const attentionRows = reviewBundle.review_rows.filter((entry) => entry.review_state !== "healthy");
-  return {
-    summary_version: "xytara-machine-identity-attention-summary-v1",
-    account_id: accountId,
-    overall_attention_state: attentionRows.length > 0 ? "attention_required" : "healthy",
-    attention_binding_count: attentionRows.length,
-    attention_rows: attentionRows,
-    review_counts: reviewBundle.review_counts,
-    linked_surfaces: {
-      machine_identity_review_bundle_ref: `/v1/economics/accounts/${encodeURIComponent(accountId)}/machine-identity-review-bundle`,
-      machine_identity_bundle_ref: `/v1/economics/accounts/${encodeURIComponent(accountId)}/machine-identity-bundle`
-    },
-    generated_at_iso: nowIso()
-  };
-}
-
-function buildMachineIdentityOperatorBundle(state, accountId) {
-  const summary = buildMachineIdentitySummary(state, accountId);
-  const bundle = buildMachineIdentityBundle(state, accountId);
-  const attachment = buildMachineIdentityAttachmentSummary(state, accountId);
-  const lineage = buildMachineIdentityLineageSummary(state, accountId);
-  const bindingLineage = buildMachineIdentityBindingLineageSummary(state, accountId);
-  const profile = buildMachineIdentityProfile(state, accountId);
-  const policyPackSummary = buildMachineIdentityPolicyPackSummary(state, accountId);
-  const policyApplicationSummary = buildMachineIdentityPolicyApplicationSummary(state, accountId, null);
-  const reviewBundle = buildMachineIdentityReviewBundle(state, accountId);
-  const attentionSummary = buildMachineIdentityAttentionSummary(state, accountId);
-
-  return {
-    bundle_version: "xytara-machine-identity-operator-bundle-v1",
-    account_id: accountId,
-    operator_posture: {
-      machine_identity_state: summary.machine_identity_state,
-      overall_attention_state: attentionSummary.overall_attention_state,
-      recommended_policy_motion: policyPackSummary.recommended_policy_motion,
-      identity_binding_count: summary.counts.identity_binding_count,
-      identity_transaction_count: summary.counts.identity_transaction_count,
-      rotated_binding_count: bindingLineage.rotated_binding_count,
-      repair_candidate_count: reviewBundle.review_counts.repair_candidate_count,
-      revoked_binding_count: reviewBundle.review_counts.revoked_count
-    },
-    machine_identity_summary: summary,
-    machine_identity_profile: profile,
-    machine_identity_bundle: bundle,
-    machine_identity_attachment_summary: attachment,
-    machine_identity_lineage_summary: lineage,
-    machine_identity_binding_lineage_summary: bindingLineage,
-    machine_identity_policy_pack_summary: policyPackSummary,
-    machine_identity_policy_application_summary: policyApplicationSummary,
-    machine_identity_review_bundle: reviewBundle,
-    machine_identity_attention_summary: attentionSummary,
-    linked_surfaces: {
-      machine_identity_summary_ref: `/v1/economics/accounts/${encodeURIComponent(accountId)}/machine-identity-summary`,
-      machine_identity_profile_ref: `/v1/economics/accounts/${encodeURIComponent(accountId)}/machine-identity-profile`,
-      machine_identity_policy_pack_ref: `/v1/economics/accounts/${encodeURIComponent(accountId)}/machine-identity-policy-pack`,
-      machine_identity_review_bundle_ref: `/v1/economics/accounts/${encodeURIComponent(accountId)}/machine-identity-review-bundle`,
-      machine_identity_attention_summary_ref: `/v1/economics/accounts/${encodeURIComponent(accountId)}/machine-identity-attention-summary`
-    },
-    generated_at_iso: nowIso()
-  };
-}
-
-module.exports = {
-  buildMachineIdentitySummary,
-  buildMachineIdentityBundle,
-  buildMachineIdentityAttachmentSummary,
-  buildMachineIdentityLineageSummary,
-  buildMachineIdentityBindingLineageSummary,
-  buildMachineIdentityProfile,
-  buildMachineIdentityPolicyPack,
-  buildMachineIdentityPolicyPackSummary,
-  buildMachineIdentityPolicyApplicationSummary,
-  buildMachineIdentityReviewBundle,
-  buildMachineIdentityAttentionSummary,
-  buildMachineIdentityOperatorBundle
-};
+"use strict";
+
+function ensureArray(value) {
+  return Array.isArray(value) ? value : [];
+}
+
+function nowIso() {
+  return new Date().toISOString();
+}
+
+function listTransactionEntriesForAccount(state, accountId) {
+  return Array.from(state.transactions.values())
+    .filter((entry) => entry && entry.transaction && entry.transaction.account_id === accountId);
+}
+
+function listReceiptsForAccount(state, accountId) {
+  return Array.from(state.receipts.values())
+    .map((entry) => entry && entry.receipt ? entry.receipt : null)
+    .filter((receipt) => receipt && receipt.account_id === accountId);
+}
+
+function listAgentAccountsForIdentity(state, accountId) {
+  return Array.from(state.agentAccounts.values())
+    .map((entry) => entry && entry.account ? entry.account : null)
+    .filter((account) => account && account.account_id === accountId);
+}
+
+function listIdentityBindingsForAccount(state, accountId) {
+  return Array.from(state.machineIdentityBindings.values())
+    .filter((binding) => binding && binding.account_id === accountId);
+}
+
+function collectIdentityDeliverables(entry) {
+  const deliverables = entry && entry.command && Array.isArray(entry.command.deliverables)
+    ? entry.command.deliverables
+    : [];
+  const identityRefs = [];
+  const registryRefs = [];
+  const anchorRefs = [];
+  for (const item of deliverables) {
+    if (!item || typeof item !== "object") continue;
+    if (item.identity_attestation_ref) identityRefs.push(item.identity_attestation_ref);
+    if (item.identity_link_ref) identityRefs.push(item.identity_link_ref);
+    if (item.registry_record_ref) registryRefs.push(item.registry_record_ref);
+    if (item.registry_pack_ref) registryRefs.push(item.registry_pack_ref);
+    if (item.anchor_ref) anchorRefs.push(item.anchor_ref);
+  }
+  return {
+    identity_refs: identityRefs,
+    registry_refs: registryRefs,
+    anchor_refs: anchorRefs
+  };
+}
+
+function buildMachineIdentitySummary(state, accountId) {
+  const agentAccounts = listAgentAccountsForIdentity(state, accountId);
+  const identityBindings = listIdentityBindingsForAccount(state, accountId);
+  const transactionEntries = listTransactionEntriesForAccount(state, accountId);
+  const receipts = listReceiptsForAccount(state, accountId);
+  const identityTransactions = transactionEntries.filter((entry) =>
+    ensureArray(entry.command && entry.command.deliverables).some((task) =>
+      task && typeof task.task_ref === "string" && (
+        task.task_ref === "identity.attest.preview" ||
+        task.task_ref === "identity.registry.link" ||
+        task.task_ref === "registry.register" ||
+        task.task_ref === "registry.pack.bundle" ||
+        task.task_ref === "anchoring.submit"
+      )
+    ) || ensureArray(entry.transaction && entry.transaction.execution && entry.transaction.execution.tasks).some((task) =>
+      task && typeof task.task_ref === "string" && (
+        task.task_ref === "identity.attest.preview" ||
+        task.task_ref === "identity.registry.link" ||
+        task.task_ref === "registry.register" ||
+        task.task_ref === "registry.pack.bundle" ||
+        task.task_ref === "anchoring.submit"
+      )
+    )
+  );
+  const refs = identityTransactions.reduce((acc, transaction) => {
+    const next = collectIdentityDeliverables(transaction);
+    acc.identity_refs.push(...next.identity_refs);
+    acc.registry_refs.push(...next.registry_refs);
+    acc.anchor_refs.push(...next.anchor_refs);
+    return acc;
+  }, {
+    identity_refs: [],
+    registry_refs: [],
+    anchor_refs: []
+  });
+
+  const latestIdentityTransaction = identityTransactions
+    .map((entry) => ({
+      transaction_id: entry.transaction && entry.transaction.transaction_id ? entry.transaction.transaction_id : null,
+      created_at_iso: entry.transaction && entry.transaction.created_at_iso ? entry.transaction.created_at_iso : null
+    }))
+    .sort((a, b) => String(a.created_at_iso || "").localeCompare(String(b.created_at_iso || "")))
+    .slice(-1)[0] || null;
+
+  let identityState = "unbound";
+  if (agentAccounts.length > 0) identityState = "account_issued";
+  if (identityBindings.length > 0) identityState = "identity_binding_present";
+  if (identityTransactions.length > 0) identityState = "identity_activity_present";
+  if (refs.registry_refs.length > 0 && refs.anchor_refs.length > 0) identityState = "registry_anchor_present";
+
+  return {
+    summary_version: "xytara-machine-identity-summary-v1",
+    account_id: accountId,
+    machine_identity_state: identityState,
+    counts: {
+      agent_account_count: agentAccounts.length,
+      identity_binding_count: identityBindings.length,
+      identity_transaction_count: identityTransactions.length,
+      receipt_count: receipts.length,
+      identity_ref_count: refs.identity_refs.length,
+      registry_ref_count: refs.registry_refs.length,
+      anchor_ref_count: refs.anchor_refs.length
+    },
+    latest_identity_transaction_id: latestIdentityTransaction ? latestIdentityTransaction.transaction_id : null,
+    linked_surfaces: {
+      machine_identity_bundle_ref: `/v1/economics/accounts/${encodeURIComponent(accountId)}/machine-identity-bundle`,
+      agent_accounts_ref: "/v1/agent-accounts",
+      operator_shell_summary_ref: "/v1/operator-shell/summary"
+    },
+    generated_at_iso: nowIso()
+  };
+}
+
+function buildMachineIdentityBundle(state, accountId) {
+  const summary = buildMachineIdentitySummary(state, accountId);
+  const agentAccounts = listAgentAccountsForIdentity(state, accountId);
+  const identityBindings = listIdentityBindingsForAccount(state, accountId);
+  const transactionEntries = listTransactionEntriesForAccount(state, accountId);
+  const identityTransactions = transactionEntries
+    .filter((entry) =>
+      ensureArray(entry.command && entry.command.deliverables).some((task) =>
+        task && typeof task.task_ref === "string" && (
+          task.task_ref === "identity.attest.preview" ||
+          task.task_ref === "identity.registry.link" ||
+          task.task_ref === "registry.register" ||
+          task.task_ref === "registry.pack.bundle" ||
+          task.task_ref === "anchoring.submit"
+        )
+      ) || ensureArray(entry.transaction && entry.transaction.execution && entry.transaction.execution.tasks).some((task) =>
+        task && typeof task.task_ref === "string" && (
+          task.task_ref === "identity.attest.preview" ||
+          task.task_ref === "identity.registry.link" ||
+          task.task_ref === "registry.register" ||
+          task.task_ref === "registry.pack.bundle" ||
+          task.task_ref === "anchoring.submit"
+        )
+      )
+    )
+    .map((entry) => {
+      const refs = collectIdentityDeliverables(entry);
+      return {
+        transaction_id: entry.transaction && entry.transaction.transaction_id ? entry.transaction.transaction_id : null,
+        status: entry.transaction && entry.transaction.status ? entry.transaction.status : null,
+        created_at_iso: entry.transaction && entry.transaction.created_at_iso ? entry.transaction.created_at_iso : null,
+        identity_refs: refs.identity_refs,
+        registry_refs: refs.registry_refs,
+        anchor_refs: refs.anchor_refs
+      };
+    });
+
+  return {
+    bundle_version: "xytara-machine-identity-bundle-v1",
+    account_id: accountId,
+    machine_identity_summary: summary,
+    agent_accounts: agentAccounts,
+    identity_bindings: identityBindings,
+    identity_transactions: identityTransactions,
+    linked_surfaces: {
+      machine_identity_summary_ref: `/v1/economics/accounts/${encodeURIComponent(accountId)}/machine-identity-summary`,
+      authority_summary_ref: `/v1/economics/accounts/${encodeURIComponent(accountId)}/authority-summary`,
+      wallet_ledger_bundle_ref: `/v1/economics/accounts/${encodeURIComponent(accountId)}/wallet-ledger-bundle`
+    },
+    generated_at_iso: nowIso()
+  };
+}
+
+function buildMachineIdentityAttachmentSummary(state, accountId) {
+  const agentAccounts = listAgentAccountsForIdentity(state, accountId);
+  const bundle = buildMachineIdentityBundle(state, accountId);
+  const attachmentRows = bundle.identity_transactions.map((entry) => ({
+    transaction_id: entry.transaction_id,
+    identity_attachment_count: ensureArray(entry.identity_refs).length,
+    registry_attachment_count: ensureArray(entry.registry_refs).length,
+    anchor_attachment_count: ensureArray(entry.anchor_refs).length,
+    has_registry_anchor_pair: ensureArray(entry.registry_refs).length > 0 && ensureArray(entry.anchor_refs).length > 0,
+    created_at_iso: entry.created_at_iso || null
+  }));
+
+  return {
+    summary_version: "xytara-machine-identity-attachment-summary-v1",
+    account_id: accountId,
+    machine_identity_attachment_state: attachmentRows.length > 0 ? "attachments_present" : agentAccounts.length > 0 ? "account_only" : "unattached",
+    counts: {
+      agent_account_count: agentAccounts.length,
+      identity_binding_count: Array.isArray(bundle.identity_bindings) ? bundle.identity_bindings.length : 0,
+      attachment_row_count: attachmentRows.length,
+      registry_anchor_pair_count: attachmentRows.filter((entry) => entry.has_registry_anchor_pair).length
+    },
+    attachment_rows: attachmentRows,
+    linked_surfaces: {
+      machine_identity_bundle_ref: `/v1/economics/accounts/${encodeURIComponent(accountId)}/machine-identity-bundle`,
+      machine_identity_lineage_summary_ref: `/v1/economics/accounts/${encodeURIComponent(accountId)}/machine-identity-lineage-summary`
+    },
+    generated_at_iso: nowIso()
+  };
+}
+
+function buildMachineIdentityLineageSummary(state, accountId) {
+  const bundle = buildMachineIdentityBundle(state, accountId);
+  const lineageRows = bundle.identity_transactions.map((entry, index) => {
+    const predecessor = index > 0 ? bundle.identity_transactions[index - 1] : null;
+    const successor = index < bundle.identity_transactions.length - 1 ? bundle.identity_transactions[index + 1] : null;
+    return {
+      transaction_id: entry.transaction_id,
+      predecessor_transaction_id: predecessor ? predecessor.transaction_id : null,
+      successor_transaction_id: successor ? successor.transaction_id : null,
+      lineage_position: predecessor ? successor ? "middle" : "leaf" : successor ? "root" : "standalone",
+      registry_ref_count: ensureArray(entry.registry_refs).length,
+      anchor_ref_count: ensureArray(entry.anchor_refs).length,
+      created_at_iso: entry.created_at_iso || null
+    };
+  });
+
+  return {
+    summary_version: "xytara-machine-identity-lineage-summary-v1",
+    account_id: accountId,
+    identity_transaction_count: bundle.identity_transactions.length,
+    root_count: lineageRows.filter((entry) => entry.lineage_position === "root" || entry.lineage_position === "standalone").length,
+    leaf_count: lineageRows.filter((entry) => entry.lineage_position === "leaf" || entry.lineage_position === "standalone").length,
+    lineage_rows: lineageRows,
+    linked_surfaces: {
+      machine_identity_summary_ref: `/v1/economics/accounts/${encodeURIComponent(accountId)}/machine-identity-summary`,
+      machine_identity_attachment_summary_ref: `/v1/economics/accounts/${encodeURIComponent(accountId)}/machine-identity-attachment-summary`
+    },
+    generated_at_iso: nowIso()
+  };
+}
+
+function buildMachineIdentityBindingLineageSummary(state, accountId) {
+  const identityBindings = listIdentityBindingsForAccount(state, accountId)
+    .slice()
+    .sort((a, b) => String(a.created_at_iso || "").localeCompare(String(b.created_at_iso || "")));
+  const lineageRows = identityBindings.map((entry) => ({
+    binding_id: entry.binding_id,
+    status: entry.status,
+    identity_kind: entry.identity_kind,
+    predecessor_binding_id: entry.rotated_from_binding_id || null,
+    successor_binding_id: entry.replaced_by_binding_id || null,
+    lineage_position: entry.rotated_from_binding_id
+      ? entry.replaced_by_binding_id
+        ? "middle"
+        : "leaf"
+      : entry.replaced_by_binding_id
+        ? "root"
+        : "standalone",
+    expires_at_iso: entry.expires_at_iso || null,
+    created_at_iso: entry.created_at_iso || null,
+    updated_at_iso: entry.updated_at_iso || null
+  }));
+
+  return {
+    summary_version: "xytara-machine-identity-binding-lineage-summary-v1",
+    account_id: accountId,
+    identity_binding_count: identityBindings.length,
+    rotated_binding_count: lineageRows.filter((entry) => entry.predecessor_binding_id || entry.successor_binding_id).length,
+    lineage_rows: lineageRows,
+    linked_surfaces: {
+      machine_identity_summary_ref: `/v1/economics/accounts/${encodeURIComponent(accountId)}/machine-identity-summary`,
+      machine_identity_review_bundle_ref: `/v1/economics/accounts/${encodeURIComponent(accountId)}/machine-identity-review-bundle`,
+      machine_identity_attention_summary_ref: `/v1/economics/accounts/${encodeURIComponent(accountId)}/machine-identity-attention-summary`
+    },
+    generated_at_iso: nowIso()
+  };
+}
+
+function buildMachineIdentityProfile(state, accountId) {
+  const summary = buildMachineIdentitySummary(state, accountId);
+  const bundle = buildMachineIdentityBundle(state, accountId);
+  const attachment = buildMachineIdentityAttachmentSummary(state, accountId);
+  const lineage = buildMachineIdentityLineageSummary(state, accountId);
+  const primaryAgentAccount = Array.isArray(bundle.agent_accounts) && bundle.agent_accounts.length > 0
+    ? bundle.agent_accounts[0]
+    : null;
+  const primaryIdentityBinding = Array.isArray(bundle.identity_bindings) && bundle.identity_bindings.length > 0
+    ? bundle.identity_bindings[0]
+    : null;
+
+  return {
+    profile_version: "xytara-machine-identity-profile-v1",
+    account_id: accountId,
+    machine_identity_state: summary.machine_identity_state,
+    primary_identity_kind: primaryIdentityBinding
+      ? primaryIdentityBinding.identity_kind
+      : primaryAgentAccount
+        ? "agent_account"
+        : "runtime_account_only",
+    primary_agent_account_id: primaryAgentAccount ? primaryAgentAccount.account_id : null,
+    primary_identity_binding_id: primaryIdentityBinding ? primaryIdentityBinding.binding_id : null,
+    settlement_mode: primaryAgentAccount ? primaryAgentAccount.settlement_mode || null : null,
+    protocol: primaryAgentAccount ? primaryAgentAccount.protocol || null : null,
+    attachment_state: attachment.machine_identity_attachment_state,
+    lineage_state: lineage.identity_transaction_count > 0 ? "lineage_present" : "lineage_absent",
+    linked_surfaces: {
+      machine_identity_summary_ref: `/v1/economics/accounts/${encodeURIComponent(accountId)}/machine-identity-summary`,
+      machine_identity_bundle_ref: `/v1/economics/accounts/${encodeURIComponent(accountId)}/machine-identity-bundle`,
+      machine_identity_policy_pack_ref: `/v1/economics/accounts/${encodeURIComponent(accountId)}/machine-identity-policy-pack`,
+      machine_identity_binding_lineage_summary_ref: `/v1/economics/accounts/${encodeURIComponent(accountId)}/machine-identity-binding-lineage-summary`
+    },
+    generated_at_iso: nowIso()
+  };
+}
+
+function buildMachineIdentityPolicyPack(state, accountId) {
+  const summary = buildMachineIdentitySummary(state, accountId);
+  const profile = buildMachineIdentityProfile(state, accountId);
+  const attachment = buildMachineIdentityAttachmentSummary(state, accountId);
+  const lineage = buildMachineIdentityLineageSummary(state, accountId);
+  const bindingLineage = buildMachineIdentityBindingLineageSummary(state, accountId);
+  const policyTemplates = [
+    {
+      template_id: "runtime_builder_identity",
+      target_state: "account_issued",
+      recommended_for: "runtime-first machine onboarding",
+      steps: ["issue_agent_account", "confirm_protocol", "confirm_settlement_mode"],
+      binding_defaults: {
+        identity_kind: "runtime_builder_identity",
+        registry_scope: null,
+        attach_primary_agent_account: true,
+        use_latest_identity_transaction: false
+      }
+    },
+    {
+      template_id: "registry_anchor_identity",
+      target_state: "registry_anchor_present",
+      recommended_for: "identity-plus-registry continuity",
+      steps: ["identity_attest_preview", "registry_register", "identity_registry_link", "anchoring_submit"],
+      binding_defaults: {
+        identity_kind: "registry_anchor_identity",
+        registry_scope: "registry.identity.default",
+        attach_primary_agent_account: false,
+        use_latest_identity_transaction: true
+      }
+    },
+    {
+      template_id: "continuity_repair_identity",
+      target_state: "identity_activity_present",
+      recommended_for: "repair partial identity attachment posture",
+      steps: ["review_attachment_rows", "complete_registry_anchor_pair", "inspect_lineage"],
+      binding_defaults: {
+        identity_kind: "registry_anchor_identity",
+        registry_scope: "registry.identity.default",
+        attach_primary_agent_account: true,
+        use_latest_identity_transaction: true
+      }
+    }
+  ];
+
+  let recommendedPolicyMotion = "issue_identity_from_template";
+  if (summary.machine_identity_state === "registry_anchor_present") {
+    recommendedPolicyMotion = "maintain_identity_profile";
+  } else if (attachment.counts.registry_anchor_pair_count === 0 && attachment.counts.attachment_row_count > 0) {
+    recommendedPolicyMotion = "complete_registry_anchor_pair";
+  } else if (lineage.identity_transaction_count > 0) {
+    recommendedPolicyMotion = "stabilize_identity_lineage";
+  }
+
+  return {
+    pack_version: "xytara-machine-identity-policy-pack-v1",
+    account_id: accountId,
+    machine_identity_summary: summary,
+    machine_identity_profile: profile,
+    machine_identity_attachment_summary: attachment,
+    machine_identity_lineage_summary: lineage,
+    machine_identity_binding_lineage_summary: bindingLineage,
+    recommended_policy_motion: recommendedPolicyMotion,
+    policy_templates: policyTemplates,
+    linked_surfaces: {
+      machine_identity_profile_ref: `/v1/economics/accounts/${encodeURIComponent(accountId)}/machine-identity-profile`,
+      machine_identity_attachment_summary_ref: `/v1/economics/accounts/${encodeURIComponent(accountId)}/machine-identity-attachment-summary`,
+      machine_identity_lineage_summary_ref: `/v1/economics/accounts/${encodeURIComponent(accountId)}/machine-identity-lineage-summary`,
+      machine_identity_binding_lineage_summary_ref: `/v1/economics/accounts/${encodeURIComponent(accountId)}/machine-identity-binding-lineage-summary`
+    },
+    generated_at_iso: nowIso()
+  };
+}
+
+function buildMachineIdentityPolicyApplicationSummary(state, accountId, templateId) {
+  const pack = buildMachineIdentityPolicyPack(state, accountId);
+  const selectedTemplate = ensureArray(pack.policy_templates).find((entry) => entry.template_id === templateId)
+    || ensureArray(pack.policy_templates).find((entry) => {
+      if (pack.recommended_policy_motion === "maintain_identity_profile") {
+        return entry.template_id === "registry_anchor_identity";
+      }
+      if (pack.recommended_policy_motion === "complete_registry_anchor_pair") {
+        return entry.template_id === "continuity_repair_identity";
+      }
+      if (pack.recommended_policy_motion === "stabilize_identity_lineage") {
+        return entry.template_id === "continuity_repair_identity";
+      }
+      return entry.template_id === "runtime_builder_identity";
+    })
+    || ensureArray(pack.policy_templates)[0]
+    || null;
+  const bindingDefaults = selectedTemplate && selectedTemplate.binding_defaults ? selectedTemplate.binding_defaults : {};
+  const suggestedBindingPayload = {
+    account_id: accountId,
+    identity_kind: bindingDefaults.identity_kind || "registry_anchor_identity",
+    registry_scope: bindingDefaults.registry_scope || null,
+    attached_agent_account_id: bindingDefaults.attach_primary_agent_account
+      ? pack.machine_identity_profile.primary_agent_account_id || null
+      : null,
+    source_transaction_id: bindingDefaults.use_latest_identity_transaction
+      ? pack.machine_identity_summary.latest_identity_transaction_id || null
+      : null,
+    issued_by: "operator",
+    labels: selectedTemplate ? [`policy:${selectedTemplate.template_id}`] : []
+  };
+
+  return {
+    summary_version: "xytara-machine-identity-policy-application-summary-v1",
+    account_id: accountId,
+    recommended_policy_motion: pack.recommended_policy_motion,
+    selected_template_id: selectedTemplate ? selectedTemplate.template_id : null,
+    available_template_ids: ensureArray(pack.policy_templates).map((entry) => entry.template_id),
+    suggested_binding_payload: suggestedBindingPayload,
+    selected_template: selectedTemplate,
+    linked_surfaces: {
+      machine_identity_policy_pack_ref: `/v1/economics/accounts/${encodeURIComponent(accountId)}/machine-identity-policy-pack`,
+      machine_identity_profile_ref: `/v1/economics/accounts/${encodeURIComponent(accountId)}/machine-identity-profile`,
+      machine_identity_binding_lineage_summary_ref: `/v1/economics/accounts/${encodeURIComponent(accountId)}/machine-identity-binding-lineage-summary`
+    },
+    generated_at_iso: nowIso()
+  };
+}
+
+function buildMachineIdentityPolicyPackSummary(state, accountId) {
+  const pack = buildMachineIdentityPolicyPack(state, accountId);
+  return {
+    summary_version: "xytara-machine-identity-policy-pack-summary-v1",
+    account_id: accountId,
+    machine_identity_state: pack.machine_identity_summary.machine_identity_state,
+    recommended_policy_motion: pack.recommended_policy_motion,
+    template_count: Array.isArray(pack.policy_templates) ? pack.policy_templates.length : 0,
+    linked_surfaces: pack.linked_surfaces,
+    generated_at_iso: pack.generated_at_iso
+  };
+}
+
+function buildMachineIdentityReviewBundle(state, accountId) {
+  const summary = buildMachineIdentitySummary(state, accountId);
+  const bundle = buildMachineIdentityBundle(state, accountId);
+  const reviewRows = ensureArray(bundle.identity_bindings).map((binding) => {
+    const hasRegistryScope = typeof binding.registry_scope === "string" && binding.registry_scope.length > 0;
+    const hasSourceTransaction = typeof binding.source_transaction_id === "string" && binding.source_transaction_id.length > 0;
+    const hasAttachedAgent = typeof binding.attached_agent_account_id === "string" && binding.attached_agent_account_id.length > 0;
+    const hasRotationLineage = Boolean(binding.rotated_from_binding_id || binding.replaced_by_binding_id);
+    const reviewState = binding.status !== "active"
+      ? "revoked"
+      : hasRegistryScope && (hasSourceTransaction || hasAttachedAgent)
+        ? "healthy"
+        : "repair_candidate";
+    return {
+      binding_id: binding.binding_id,
+      identity_kind: binding.identity_kind,
+      review_state: reviewState,
+      has_registry_scope: hasRegistryScope,
+      has_source_transaction: hasSourceTransaction,
+      has_attached_agent_account: hasAttachedAgent,
+      has_rotation_lineage: hasRotationLineage,
+      recommended_action: reviewState === "repair_candidate"
+        ? "complete_identity_binding_context"
+        : reviewState === "revoked"
+          ? "review_for_replacement"
+          : "keep_active"
+    };
+  });
+
+  return {
+    bundle_version: "xytara-machine-identity-review-bundle-v1",
+    account_id: accountId,
+    machine_identity_summary: summary,
+    review_rows: reviewRows,
+    review_counts: {
+      healthy_count: reviewRows.filter((entry) => entry.review_state === "healthy").length,
+      repair_candidate_count: reviewRows.filter((entry) => entry.review_state === "repair_candidate").length,
+      revoked_count: reviewRows.filter((entry) => entry.review_state === "revoked").length
+    },
+    linked_surfaces: {
+      machine_identity_bundle_ref: `/v1/economics/accounts/${encodeURIComponent(accountId)}/machine-identity-bundle`,
+      machine_identity_attention_summary_ref: `/v1/economics/accounts/${encodeURIComponent(accountId)}/machine-identity-attention-summary`,
+      machine_identity_binding_lineage_summary_ref: `/v1/economics/accounts/${encodeURIComponent(accountId)}/machine-identity-binding-lineage-summary`
+    },
+    generated_at_iso: nowIso()
+  };
+}
+
+function buildMachineIdentityAttentionSummary(state, accountId) {
+  const reviewBundle = buildMachineIdentityReviewBundle(state, accountId);
+  const attentionRows = reviewBundle.review_rows.filter((entry) => entry.review_state !== "healthy");
+  return {
+    summary_version: "xytara-machine-identity-attention-summary-v1",
+    account_id: accountId,
+    overall_attention_state: attentionRows.length > 0 ? "attention_required" : "healthy",
+    attention_binding_count: attentionRows.length,
+    attention_rows: attentionRows,
+    review_counts: reviewBundle.review_counts,
+    linked_surfaces: {
+      machine_identity_review_bundle_ref: `/v1/economics/accounts/${encodeURIComponent(accountId)}/machine-identity-review-bundle`,
+      machine_identity_bundle_ref: `/v1/economics/accounts/${encodeURIComponent(accountId)}/machine-identity-bundle`
+    },
+    generated_at_iso: nowIso()
+  };
+}
+
+function buildMachineIdentityOperatorBundle(state, accountId) {
+  const summary = buildMachineIdentitySummary(state, accountId);
+  const bundle = buildMachineIdentityBundle(state, accountId);
+  const attachment = buildMachineIdentityAttachmentSummary(state, accountId);
+  const lineage = buildMachineIdentityLineageSummary(state, accountId);
+  const bindingLineage = buildMachineIdentityBindingLineageSummary(state, accountId);
+  const profile = buildMachineIdentityProfile(state, accountId);
+  const policyPackSummary = buildMachineIdentityPolicyPackSummary(state, accountId);
+  const policyApplicationSummary = buildMachineIdentityPolicyApplicationSummary(state, accountId, null);
+  const reviewBundle = buildMachineIdentityReviewBundle(state, accountId);
+  const attentionSummary = buildMachineIdentityAttentionSummary(state, accountId);
+
+  return {
+    bundle_version: "xytara-machine-identity-operator-bundle-v1",
+    account_id: accountId,
+    operator_posture: {
+      machine_identity_state: summary.machine_identity_state,
+      overall_attention_state: attentionSummary.overall_attention_state,
+      recommended_policy_motion: policyPackSummary.recommended_policy_motion,
+      identity_binding_count: summary.counts.identity_binding_count,
+      identity_transaction_count: summary.counts.identity_transaction_count,
+      rotated_binding_count: bindingLineage.rotated_binding_count,
+      repair_candidate_count: reviewBundle.review_counts.repair_candidate_count,
+      revoked_binding_count: reviewBundle.review_counts.revoked_count
+    },
+    machine_identity_summary: summary,
+    machine_identity_profile: profile,
+    machine_identity_bundle: bundle,
+    machine_identity_attachment_summary: attachment,
+    machine_identity_lineage_summary: lineage,
+    machine_identity_binding_lineage_summary: bindingLineage,
+    machine_identity_policy_pack_summary: policyPackSummary,
+    machine_identity_policy_application_summary: policyApplicationSummary,
+    machine_identity_review_bundle: reviewBundle,
+    machine_identity_attention_summary: attentionSummary,
+    linked_surfaces: {
+      machine_identity_summary_ref: `/v1/economics/accounts/${encodeURIComponent(accountId)}/machine-identity-summary`,
+      machine_identity_profile_ref: `/v1/economics/accounts/${encodeURIComponent(accountId)}/machine-identity-profile`,
+      machine_identity_policy_pack_ref: `/v1/economics/accounts/${encodeURIComponent(accountId)}/machine-identity-policy-pack`,
+      machine_identity_review_bundle_ref: `/v1/economics/accounts/${encodeURIComponent(accountId)}/machine-identity-review-bundle`,
+      machine_identity_attention_summary_ref: `/v1/economics/accounts/${encodeURIComponent(accountId)}/machine-identity-attention-summary`
+    },
+    generated_at_iso: nowIso()
+  };
+}
+
+module.exports = {
+  buildMachineIdentitySummary,
+  buildMachineIdentityBundle,
+  buildMachineIdentityAttachmentSummary,
+  buildMachineIdentityLineageSummary,
+  buildMachineIdentityBindingLineageSummary,
+  buildMachineIdentityProfile,
+  buildMachineIdentityPolicyPack,
+  buildMachineIdentityPolicyPackSummary,
+  buildMachineIdentityPolicyApplicationSummary,
+  buildMachineIdentityReviewBundle,
+  buildMachineIdentityAttentionSummary,
+  buildMachineIdentityOperatorBundle
+};