xytara 3.1.16 → 3.2.0

package/lib/commerce_identity.js

@@ -1,578 +0,0 @@
-"use strict";
-
-function ensureArray(value) {
-  return Array.isArray(value) ? value : [];
-}
-
-function nowIso() {
-  return new Date().toISOString();
-}
-
-function listTransactionEntriesForAccount(state, accountId) {
-  return Array.from(state.transactions.values())
-    .filter((entry) => entry && entry.transaction && entry.transaction.account_id === accountId);
-}
-
-function listReceiptsForAccount(state, accountId) {
-  return Array.from(state.receipts.values())
-    .map((entry) => entry && entry.receipt ? entry.receipt : null)
-    .filter((receipt) => receipt && receipt.account_id === accountId);
-}
-
-function listAgentAccountsForIdentity(state, accountId) {
-  return Array.from(state.agentAccounts.values())
-    .map((entry) => entry && entry.account ? entry.account : null)
-    .filter((account) => account && account.account_id === accountId);
-}
-
-function listIdentityBindingsForAccount(state, accountId) {
-  return Array.from(state.machineIdentityBindings.values())
-    .filter((binding) => binding && binding.account_id === accountId);
-}
-
-function collectIdentityDeliverables(entry) {
-  const deliverables = entry && entry.command && Array.isArray(entry.command.deliverables)
-    ? entry.command.deliverables
-    : [];
-  const identityRefs = [];
-  const registryRefs = [];
-  const anchorRefs = [];
-  for (const item of deliverables) {
-    if (!item || typeof item !== "object") continue;
-    if (item.identity_attestation_ref) identityRefs.push(item.identity_attestation_ref);
-    if (item.identity_link_ref) identityRefs.push(item.identity_link_ref);
-    if (item.registry_record_ref) registryRefs.push(item.registry_record_ref);
-    if (item.registry_pack_ref) registryRefs.push(item.registry_pack_ref);
-    if (item.anchor_ref) anchorRefs.push(item.anchor_ref);
-  }
-  return {
-    identity_refs: identityRefs,
-    registry_refs: registryRefs,
-    anchor_refs: anchorRefs
-  };
-}
-
-function buildMachineIdentitySummary(state, accountId) {
-  const agentAccounts = listAgentAccountsForIdentity(state, accountId);
-  const identityBindings = listIdentityBindingsForAccount(state, accountId);
-  const transactionEntries = listTransactionEntriesForAccount(state, accountId);
-  const receipts = listReceiptsForAccount(state, accountId);
-  const identityTransactions = transactionEntries.filter((entry) =>
-    ensureArray(entry.command && entry.command.deliverables).some((task) =>
-      task && typeof task.task_ref === "string" && (
-        task.task_ref === "identity.attest.preview" ||
-        task.task_ref === "identity.registry.link" ||
-        task.task_ref === "registry.register" ||
-        task.task_ref === "registry.pack.bundle" ||
-        task.task_ref === "anchoring.submit"
-      )
-    ) || ensureArray(entry.transaction && entry.transaction.execution && entry.transaction.execution.tasks).some((task) =>
-      task && typeof task.task_ref === "string" && (
-        task.task_ref === "identity.attest.preview" ||
-        task.task_ref === "identity.registry.link" ||
-        task.task_ref === "registry.register" ||
-        task.task_ref === "registry.pack.bundle" ||
-        task.task_ref === "anchoring.submit"
-      )
-    )
-  );
-  const refs = identityTransactions.reduce((acc, transaction) => {
-    const next = collectIdentityDeliverables(transaction);
-    acc.identity_refs.push(...next.identity_refs);
-    acc.registry_refs.push(...next.registry_refs);
-    acc.anchor_refs.push(...next.anchor_refs);
-    return acc;
-  }, {
-    identity_refs: [],
-    registry_refs: [],
-    anchor_refs: []
-  });
-
-  const latestIdentityTransaction = identityTransactions
-    .map((entry) => ({
-      transaction_id: entry.transaction && entry.transaction.transaction_id ? entry.transaction.transaction_id : null,
-      created_at_iso: entry.transaction && entry.transaction.created_at_iso ? entry.transaction.created_at_iso : null
-    }))
-    .sort((a, b) => String(a.created_at_iso || "").localeCompare(String(b.created_at_iso || "")))
-    .slice(-1)[0] || null;
-
-  let identityState = "unbound";
-  if (agentAccounts.length > 0) identityState = "account_issued";
-  if (identityBindings.length > 0) identityState = "identity_binding_present";
-  if (identityTransactions.length > 0) identityState = "identity_activity_present";
-  if (refs.registry_refs.length > 0 && refs.anchor_refs.length > 0) identityState = "registry_anchor_present";
-
-  return {
-    summary_version: "xytara-machine-identity-summary-v1",
-    account_id: accountId,
-    machine_identity_state: identityState,
-    counts: {
-      agent_account_count: agentAccounts.length,
-      identity_binding_count: identityBindings.length,
-      identity_transaction_count: identityTransactions.length,
-      receipt_count: receipts.length,
-      identity_ref_count: refs.identity_refs.length,
-      registry_ref_count: refs.registry_refs.length,
-      anchor_ref_count: refs.anchor_refs.length
-    },
-    latest_identity_transaction_id: latestIdentityTransaction ? latestIdentityTransaction.transaction_id : null,
-    linked_surfaces: {
-      machine_identity_bundle_ref: `/v1/economics/accounts/${encodeURIComponent(accountId)}/machine-identity-bundle`,
-      agent_accounts_ref: "/v1/agent-accounts",
-      operator_shell_summary_ref: "/v1/operator-shell/summary"
-    },
-    generated_at_iso: nowIso()
-  };
-}
-
-function buildMachineIdentityBundle(state, accountId) {
-  const summary = buildMachineIdentitySummary(state, accountId);
-  const agentAccounts = listAgentAccountsForIdentity(state, accountId);
-  const identityBindings = listIdentityBindingsForAccount(state, accountId);
-  const transactionEntries = listTransactionEntriesForAccount(state, accountId);
-  const identityTransactions = transactionEntries
-    .filter((entry) =>
-      ensureArray(entry.command && entry.command.deliverables).some((task) =>
-        task && typeof task.task_ref === "string" && (
-          task.task_ref === "identity.attest.preview" ||
-          task.task_ref === "identity.registry.link" ||
-          task.task_ref === "registry.register" ||
-          task.task_ref === "registry.pack.bundle" ||
-          task.task_ref === "anchoring.submit"
-        )
-      ) || ensureArray(entry.transaction && entry.transaction.execution && entry.transaction.execution.tasks).some((task) =>
-        task && typeof task.task_ref === "string" && (
-          task.task_ref === "identity.attest.preview" ||
-          task.task_ref === "identity.registry.link" ||
-          task.task_ref === "registry.register" ||
-          task.task_ref === "registry.pack.bundle" ||
-          task.task_ref === "anchoring.submit"
-        )
-      )
-    )
-    .map((entry) => {
-      const refs = collectIdentityDeliverables(entry);
-      return {
-        transaction_id: entry.transaction && entry.transaction.transaction_id ? entry.transaction.transaction_id : null,
-        status: entry.transaction && entry.transaction.status ? entry.transaction.status : null,
-        created_at_iso: entry.transaction && entry.transaction.created_at_iso ? entry.transaction.created_at_iso : null,
-        identity_refs: refs.identity_refs,
-        registry_refs: refs.registry_refs,
-        anchor_refs: refs.anchor_refs
-      };
-    });
-
-  return {
-    bundle_version: "xytara-machine-identity-bundle-v1",
-    account_id: accountId,
-    machine_identity_summary: summary,
-    agent_accounts: agentAccounts,
-    identity_bindings: identityBindings,
-    identity_transactions: identityTransactions,
-    linked_surfaces: {
-      machine_identity_summary_ref: `/v1/economics/accounts/${encodeURIComponent(accountId)}/machine-identity-summary`,
-      authority_summary_ref: `/v1/economics/accounts/${encodeURIComponent(accountId)}/authority-summary`,
-      wallet_ledger_bundle_ref: `/v1/economics/accounts/${encodeURIComponent(accountId)}/wallet-ledger-bundle`
-    },
-    generated_at_iso: nowIso()
-  };
-}
-
-function buildMachineIdentityAttachmentSummary(state, accountId) {
-  const agentAccounts = listAgentAccountsForIdentity(state, accountId);
-  const bundle = buildMachineIdentityBundle(state, accountId);
-  const attachmentRows = bundle.identity_transactions.map((entry) => ({
-    transaction_id: entry.transaction_id,
-    identity_attachment_count: ensureArray(entry.identity_refs).length,
-    registry_attachment_count: ensureArray(entry.registry_refs).length,
-    anchor_attachment_count: ensureArray(entry.anchor_refs).length,
-    has_registry_anchor_pair: ensureArray(entry.registry_refs).length > 0 && ensureArray(entry.anchor_refs).length > 0,
-    created_at_iso: entry.created_at_iso || null
-  }));
-
-  return {
-    summary_version: "xytara-machine-identity-attachment-summary-v1",
-    account_id: accountId,
-    machine_identity_attachment_state: attachmentRows.length > 0 ? "attachments_present" : agentAccounts.length > 0 ? "account_only" : "unattached",
-    counts: {
-      agent_account_count: agentAccounts.length,
-      identity_binding_count: Array.isArray(bundle.identity_bindings) ? bundle.identity_bindings.length : 0,
-      attachment_row_count: attachmentRows.length,
-      registry_anchor_pair_count: attachmentRows.filter((entry) => entry.has_registry_anchor_pair).length
-    },
-    attachment_rows: attachmentRows,
-    linked_surfaces: {
-      machine_identity_bundle_ref: `/v1/economics/accounts/${encodeURIComponent(accountId)}/machine-identity-bundle`,
-      machine_identity_lineage_summary_ref: `/v1/economics/accounts/${encodeURIComponent(accountId)}/machine-identity-lineage-summary`
-    },
-    generated_at_iso: nowIso()
-  };
-}
-
-function buildMachineIdentityLineageSummary(state, accountId) {
-  const bundle = buildMachineIdentityBundle(state, accountId);
-  const lineageRows = bundle.identity_transactions.map((entry, index) => {
-    const predecessor = index > 0 ? bundle.identity_transactions[index - 1] : null;
-    const successor = index < bundle.identity_transactions.length - 1 ? bundle.identity_transactions[index + 1] : null;
-    return {
-      transaction_id: entry.transaction_id,
-      predecessor_transaction_id: predecessor ? predecessor.transaction_id : null,
-      successor_transaction_id: successor ? successor.transaction_id : null,
-      lineage_position: predecessor ? successor ? "middle" : "leaf" : successor ? "root" : "standalone",
-      registry_ref_count: ensureArray(entry.registry_refs).length,
-      anchor_ref_count: ensureArray(entry.anchor_refs).length,
-      created_at_iso: entry.created_at_iso || null
-    };
-  });
-
-  return {
-    summary_version: "xytara-machine-identity-lineage-summary-v1",
-    account_id: accountId,
-    identity_transaction_count: bundle.identity_transactions.length,
-    root_count: lineageRows.filter((entry) => entry.lineage_position === "root" || entry.lineage_position === "standalone").length,
-    leaf_count: lineageRows.filter((entry) => entry.lineage_position === "leaf" || entry.lineage_position === "standalone").length,
-    lineage_rows: lineageRows,
-    linked_surfaces: {
-      machine_identity_summary_ref: `/v1/economics/accounts/${encodeURIComponent(accountId)}/machine-identity-summary`,
-      machine_identity_attachment_summary_ref: `/v1/economics/accounts/${encodeURIComponent(accountId)}/machine-identity-attachment-summary`
-    },
-    generated_at_iso: nowIso()
-  };
-}
-
-function buildMachineIdentityBindingLineageSummary(state, accountId) {
-  const identityBindings = listIdentityBindingsForAccount(state, accountId)
-    .slice()
-    .sort((a, b) => String(a.created_at_iso || "").localeCompare(String(b.created_at_iso || "")));
-  const lineageRows = identityBindings.map((entry) => ({
-    binding_id: entry.binding_id,
-    status: entry.status,
-    identity_kind: entry.identity_kind,
-    predecessor_binding_id: entry.rotated_from_binding_id || null,
-    successor_binding_id: entry.replaced_by_binding_id || null,
-    lineage_position: entry.rotated_from_binding_id
-      ? entry.replaced_by_binding_id
-        ? "middle"
-        : "leaf"
-      : entry.replaced_by_binding_id
-        ? "root"
-        : "standalone",
-    expires_at_iso: entry.expires_at_iso || null,
-    created_at_iso: entry.created_at_iso || null,
-    updated_at_iso: entry.updated_at_iso || null
-  }));
-
-  return {
-    summary_version: "xytara-machine-identity-binding-lineage-summary-v1",
-    account_id: accountId,
-    identity_binding_count: identityBindings.length,
-    rotated_binding_count: lineageRows.filter((entry) => entry.predecessor_binding_id || entry.successor_binding_id).length,
-    lineage_rows: lineageRows,
-    linked_surfaces: {
-      machine_identity_summary_ref: `/v1/economics/accounts/${encodeURIComponent(accountId)}/machine-identity-summary`,
-      machine_identity_review_bundle_ref: `/v1/economics/accounts/${encodeURIComponent(accountId)}/machine-identity-review-bundle`,
-      machine_identity_attention_summary_ref: `/v1/economics/accounts/${encodeURIComponent(accountId)}/machine-identity-attention-summary`
-    },
-    generated_at_iso: nowIso()
-  };
-}
-
-function buildMachineIdentityProfile(state, accountId) {
-  const summary = buildMachineIdentitySummary(state, accountId);
-  const bundle = buildMachineIdentityBundle(state, accountId);
-  const attachment = buildMachineIdentityAttachmentSummary(state, accountId);
-  const lineage = buildMachineIdentityLineageSummary(state, accountId);
-  const primaryAgentAccount = Array.isArray(bundle.agent_accounts) && bundle.agent_accounts.length > 0
-    ? bundle.agent_accounts[0]
-    : null;
-  const primaryIdentityBinding = Array.isArray(bundle.identity_bindings) && bundle.identity_bindings.length > 0
-    ? bundle.identity_bindings[0]
-    : null;
-
-  return {
-    profile_version: "xytara-machine-identity-profile-v1",
-    account_id: accountId,
-    machine_identity_state: summary.machine_identity_state,
-    primary_identity_kind: primaryIdentityBinding
-      ? primaryIdentityBinding.identity_kind
-      : primaryAgentAccount
-        ? "agent_account"
-        : "runtime_account_only",
-    primary_agent_account_id: primaryAgentAccount ? primaryAgentAccount.account_id : null,
-    primary_identity_binding_id: primaryIdentityBinding ? primaryIdentityBinding.binding_id : null,
-    settlement_mode: primaryAgentAccount ? primaryAgentAccount.settlement_mode || null : null,
-    protocol: primaryAgentAccount ? primaryAgentAccount.protocol || null : null,
-    attachment_state: attachment.machine_identity_attachment_state,
-    lineage_state: lineage.identity_transaction_count > 0 ? "lineage_present" : "lineage_absent",
-    linked_surfaces: {
-      machine_identity_summary_ref: `/v1/economics/accounts/${encodeURIComponent(accountId)}/machine-identity-summary`,
-      machine_identity_bundle_ref: `/v1/economics/accounts/${encodeURIComponent(accountId)}/machine-identity-bundle`,
-      machine_identity_policy_pack_ref: `/v1/economics/accounts/${encodeURIComponent(accountId)}/machine-identity-policy-pack`,
-      machine_identity_binding_lineage_summary_ref: `/v1/economics/accounts/${encodeURIComponent(accountId)}/machine-identity-binding-lineage-summary`
-    },
-    generated_at_iso: nowIso()
-  };
-}
-
-function buildMachineIdentityPolicyPack(state, accountId) {
-  const summary = buildMachineIdentitySummary(state, accountId);
-  const profile = buildMachineIdentityProfile(state, accountId);
-  const attachment = buildMachineIdentityAttachmentSummary(state, accountId);
-  const lineage = buildMachineIdentityLineageSummary(state, accountId);
-  const bindingLineage = buildMachineIdentityBindingLineageSummary(state, accountId);
-  const policyTemplates = [
-    {
-      template_id: "runtime_builder_identity",
-      target_state: "account_issued",
-      recommended_for: "runtime-first machine onboarding",
-      steps: ["issue_agent_account", "confirm_protocol", "confirm_settlement_mode"],
-      binding_defaults: {
-        identity_kind: "runtime_builder_identity",
-        registry_scope: null,
-        attach_primary_agent_account: true,
-        use_latest_identity_transaction: false
-      }
-    },
-    {
-      template_id: "registry_anchor_identity",
-      target_state: "registry_anchor_present",
-      recommended_for: "identity-plus-registry continuity",
-      steps: ["identity_attest_preview", "registry_register", "identity_registry_link", "anchoring_submit"],
-      binding_defaults: {
-        identity_kind: "registry_anchor_identity",
-        registry_scope: "registry.identity.default",
-        attach_primary_agent_account: false,
-        use_latest_identity_transaction: true
-      }
-    },
-    {
-      template_id: "continuity_repair_identity",
-      target_state: "identity_activity_present",
-      recommended_for: "repair partial identity attachment posture",
-      steps: ["review_attachment_rows", "complete_registry_anchor_pair", "inspect_lineage"],
-      binding_defaults: {
-        identity_kind: "registry_anchor_identity",
-        registry_scope: "registry.identity.default",
-        attach_primary_agent_account: true,
-        use_latest_identity_transaction: true
-      }
-    }
-  ];
-
-  let recommendedPolicyMotion = "issue_identity_from_template";
-  if (summary.machine_identity_state === "registry_anchor_present") {
-    recommendedPolicyMotion = "maintain_identity_profile";
-  } else if (attachment.counts.registry_anchor_pair_count === 0 && attachment.counts.attachment_row_count > 0) {
-    recommendedPolicyMotion = "complete_registry_anchor_pair";
-  } else if (lineage.identity_transaction_count > 0) {
-    recommendedPolicyMotion = "stabilize_identity_lineage";
-  }
-
-  return {
-    pack_version: "xytara-machine-identity-policy-pack-v1",
-    account_id: accountId,
-    machine_identity_summary: summary,
-    machine_identity_profile: profile,
-    machine_identity_attachment_summary: attachment,
-    machine_identity_lineage_summary: lineage,
-    machine_identity_binding_lineage_summary: bindingLineage,
-    recommended_policy_motion: recommendedPolicyMotion,
-    policy_templates: policyTemplates,
-    linked_surfaces: {
-      machine_identity_profile_ref: `/v1/economics/accounts/${encodeURIComponent(accountId)}/machine-identity-profile`,
-      machine_identity_attachment_summary_ref: `/v1/economics/accounts/${encodeURIComponent(accountId)}/machine-identity-attachment-summary`,
-      machine_identity_lineage_summary_ref: `/v1/economics/accounts/${encodeURIComponent(accountId)}/machine-identity-lineage-summary`,
-      machine_identity_binding_lineage_summary_ref: `/v1/economics/accounts/${encodeURIComponent(accountId)}/machine-identity-binding-lineage-summary`
-    },
-    generated_at_iso: nowIso()
-  };
-}
-
-function buildMachineIdentityPolicyApplicationSummary(state, accountId, templateId) {
-  const pack = buildMachineIdentityPolicyPack(state, accountId);
-  const selectedTemplate = ensureArray(pack.policy_templates).find((entry) => entry.template_id === templateId)
-    || ensureArray(pack.policy_templates).find((entry) => {
-      if (pack.recommended_policy_motion === "maintain_identity_profile") {
-        return entry.template_id === "registry_anchor_identity";
-      }
-      if (pack.recommended_policy_motion === "complete_registry_anchor_pair") {
-        return entry.template_id === "continuity_repair_identity";
-      }
-      if (pack.recommended_policy_motion === "stabilize_identity_lineage") {
-        return entry.template_id === "continuity_repair_identity";
-      }
-      return entry.template_id === "runtime_builder_identity";
-    })
-    || ensureArray(pack.policy_templates)[0]
-    || null;
-  const bindingDefaults = selectedTemplate && selectedTemplate.binding_defaults ? selectedTemplate.binding_defaults : {};
-  const suggestedBindingPayload = {
-    account_id: accountId,
-    identity_kind: bindingDefaults.identity_kind || "registry_anchor_identity",
-    registry_scope: bindingDefaults.registry_scope || null,
-    attached_agent_account_id: bindingDefaults.attach_primary_agent_account
-      ? pack.machine_identity_profile.primary_agent_account_id || null
-      : null,
-    source_transaction_id: bindingDefaults.use_latest_identity_transaction
-      ? pack.machine_identity_summary.latest_identity_transaction_id || null
-      : null,
-    issued_by: "operator",
-    labels: selectedTemplate ? [`policy:${selectedTemplate.template_id}`] : []
-  };
-
-  return {
-    summary_version: "xytara-machine-identity-policy-application-summary-v1",
-    account_id: accountId,
-    recommended_policy_motion: pack.recommended_policy_motion,
-    selected_template_id: selectedTemplate ? selectedTemplate.template_id : null,
-    available_template_ids: ensureArray(pack.policy_templates).map((entry) => entry.template_id),
-    suggested_binding_payload: suggestedBindingPayload,
-    selected_template: selectedTemplate,
-    linked_surfaces: {
-      machine_identity_policy_pack_ref: `/v1/economics/accounts/${encodeURIComponent(accountId)}/machine-identity-policy-pack`,
-      machine_identity_profile_ref: `/v1/economics/accounts/${encodeURIComponent(accountId)}/machine-identity-profile`,
-      machine_identity_binding_lineage_summary_ref: `/v1/economics/accounts/${encodeURIComponent(accountId)}/machine-identity-binding-lineage-summary`
-    },
-    generated_at_iso: nowIso()
-  };
-}
-
-function buildMachineIdentityPolicyPackSummary(state, accountId) {
-  const pack = buildMachineIdentityPolicyPack(state, accountId);
-  return {
-    summary_version: "xytara-machine-identity-policy-pack-summary-v1",
-    account_id: accountId,
-    machine_identity_state: pack.machine_identity_summary.machine_identity_state,
-    recommended_policy_motion: pack.recommended_policy_motion,
-    template_count: Array.isArray(pack.policy_templates) ? pack.policy_templates.length : 0,
-    linked_surfaces: pack.linked_surfaces,
-    generated_at_iso: pack.generated_at_iso
-  };
-}
-
-function buildMachineIdentityReviewBundle(state, accountId) {
-  const summary = buildMachineIdentitySummary(state, accountId);
-  const bundle = buildMachineIdentityBundle(state, accountId);
-  const reviewRows = ensureArray(bundle.identity_bindings).map((binding) => {
-    const hasRegistryScope = typeof binding.registry_scope === "string" && binding.registry_scope.length > 0;
-    const hasSourceTransaction = typeof binding.source_transaction_id === "string" && binding.source_transaction_id.length > 0;
-    const hasAttachedAgent = typeof binding.attached_agent_account_id === "string" && binding.attached_agent_account_id.length > 0;
-    const hasRotationLineage = Boolean(binding.rotated_from_binding_id || binding.replaced_by_binding_id);
-    const reviewState = binding.status !== "active"
-      ? "revoked"
-      : hasRegistryScope && (hasSourceTransaction || hasAttachedAgent)
-        ? "healthy"
-        : "repair_candidate";
-    return {
-      binding_id: binding.binding_id,
-      identity_kind: binding.identity_kind,
-      review_state: reviewState,
-      has_registry_scope: hasRegistryScope,
-      has_source_transaction: hasSourceTransaction,
-      has_attached_agent_account: hasAttachedAgent,
-      has_rotation_lineage: hasRotationLineage,
-      recommended_action: reviewState === "repair_candidate"
-        ? "complete_identity_binding_context"
-        : reviewState === "revoked"
-          ? "review_for_replacement"
-          : "keep_active"
-    };
-  });
-
-  return {
-    bundle_version: "xytara-machine-identity-review-bundle-v1",
-    account_id: accountId,
-    machine_identity_summary: summary,
-    review_rows: reviewRows,
-    review_counts: {
-      healthy_count: reviewRows.filter((entry) => entry.review_state === "healthy").length,
-      repair_candidate_count: reviewRows.filter((entry) => entry.review_state === "repair_candidate").length,
-      revoked_count: reviewRows.filter((entry) => entry.review_state === "revoked").length
-    },
-    linked_surfaces: {
-      machine_identity_bundle_ref: `/v1/economics/accounts/${encodeURIComponent(accountId)}/machine-identity-bundle`,
-      machine_identity_attention_summary_ref: `/v1/economics/accounts/${encodeURIComponent(accountId)}/machine-identity-attention-summary`,
-      machine_identity_binding_lineage_summary_ref: `/v1/economics/accounts/${encodeURIComponent(accountId)}/machine-identity-binding-lineage-summary`
-    },
-    generated_at_iso: nowIso()
-  };
-}
-
-function buildMachineIdentityAttentionSummary(state, accountId) {
-  const reviewBundle = buildMachineIdentityReviewBundle(state, accountId);
-  const attentionRows = reviewBundle.review_rows.filter((entry) => entry.review_state !== "healthy");
-  return {
-    summary_version: "xytara-machine-identity-attention-summary-v1",
-    account_id: accountId,
-    overall_attention_state: attentionRows.length > 0 ? "attention_required" : "healthy",
-    attention_binding_count: attentionRows.length,
-    attention_rows: attentionRows,
-    review_counts: reviewBundle.review_counts,
-    linked_surfaces: {
-      machine_identity_review_bundle_ref: `/v1/economics/accounts/${encodeURIComponent(accountId)}/machine-identity-review-bundle`,
-      machine_identity_bundle_ref: `/v1/economics/accounts/${encodeURIComponent(accountId)}/machine-identity-bundle`
-    },
-    generated_at_iso: nowIso()
-  };
-}
-
-function buildMachineIdentityOperatorBundle(state, accountId) {
-  const summary = buildMachineIdentitySummary(state, accountId);
-  const bundle = buildMachineIdentityBundle(state, accountId);
-  const attachment = buildMachineIdentityAttachmentSummary(state, accountId);
-  const lineage = buildMachineIdentityLineageSummary(state, accountId);
-  const bindingLineage = buildMachineIdentityBindingLineageSummary(state, accountId);
-  const profile = buildMachineIdentityProfile(state, accountId);
-  const policyPackSummary = buildMachineIdentityPolicyPackSummary(state, accountId);
-  const policyApplicationSummary = buildMachineIdentityPolicyApplicationSummary(state, accountId, null);
-  const reviewBundle = buildMachineIdentityReviewBundle(state, accountId);
-  const attentionSummary = buildMachineIdentityAttentionSummary(state, accountId);
-
-  return {
-    bundle_version: "xytara-machine-identity-operator-bundle-v1",
-    account_id: accountId,
-    operator_posture: {
-      machine_identity_state: summary.machine_identity_state,
-      overall_attention_state: attentionSummary.overall_attention_state,
-      recommended_policy_motion: policyPackSummary.recommended_policy_motion,
-      identity_binding_count: summary.counts.identity_binding_count,
-      identity_transaction_count: summary.counts.identity_transaction_count,
-      rotated_binding_count: bindingLineage.rotated_binding_count,
-      repair_candidate_count: reviewBundle.review_counts.repair_candidate_count,
-      revoked_binding_count: reviewBundle.review_counts.revoked_count
-    },
-    machine_identity_summary: summary,
-    machine_identity_profile: profile,
-    machine_identity_bundle: bundle,
-    machine_identity_attachment_summary: attachment,
-    machine_identity_lineage_summary: lineage,
-    machine_identity_binding_lineage_summary: bindingLineage,
-    machine_identity_policy_pack_summary: policyPackSummary,
-    machine_identity_policy_application_summary: policyApplicationSummary,
-    machine_identity_review_bundle: reviewBundle,
-    machine_identity_attention_summary: attentionSummary,
-    linked_surfaces: {
-      machine_identity_summary_ref: `/v1/economics/accounts/${encodeURIComponent(accountId)}/machine-identity-summary`,
-      machine_identity_profile_ref: `/v1/economics/accounts/${encodeURIComponent(accountId)}/machine-identity-profile`,
-      machine_identity_policy_pack_ref: `/v1/economics/accounts/${encodeURIComponent(accountId)}/machine-identity-policy-pack`,
-      machine_identity_review_bundle_ref: `/v1/economics/accounts/${encodeURIComponent(accountId)}/machine-identity-review-bundle`,
-      machine_identity_attention_summary_ref: `/v1/economics/accounts/${encodeURIComponent(accountId)}/machine-identity-attention-summary`
-    },
-    generated_at_iso: nowIso()
-  };
-}
-
-module.exports = {
-  buildMachineIdentitySummary,
-  buildMachineIdentityBundle,
-  buildMachineIdentityAttachmentSummary,
-  buildMachineIdentityLineageSummary,
-  buildMachineIdentityBindingLineageSummary,
-  buildMachineIdentityProfile,
-  buildMachineIdentityPolicyPack,
-  buildMachineIdentityPolicyPackSummary,
-  buildMachineIdentityPolicyApplicationSummary,
-  buildMachineIdentityReviewBundle,
-  buildMachineIdentityAttentionSummary,
-  buildMachineIdentityOperatorBundle
-};