xytara 3.1.16 → 3.2.0

package/lib/event_system_lane_contract.js

@@ -1,75 +0,0 @@
-"use strict";
-
-const {
-  buildPhase7EventSystemPack,
-  summarizePhase7EventSystemPack
-} = require("./phase_7_event_system_pack");
-const {
-  buildPhase7NatsRuntimePack,
-  summarizePhase7NatsRuntimePack
-} = require("./phase_7_nats_runtime_pack");
-
-function buildEventSystemLanePack() {
-  const phasePack = buildPhase7EventSystemPack();
-  const natsPack = buildPhase7NatsRuntimePack();
-  return {
-    product: "xytara",
-    category: "machine-commerce-event-system-lane-pack",
-    pack_version: "xytara-event-system-lane-pack-v1",
-    lane_state: "first_party_event_system_family_present",
-    posture: "event_and_system_integration_runtime_lane",
-    phase_alignment: {
-      phase_ref: phasePack.phase_ref,
-      phase_pack: phasePack,
-      phase_summary: summarizePhase7EventSystemPack(),
-      featured_lane: {
-        pack: natsPack,
-        summary: summarizePhase7NatsRuntimePack()
-      }
-    },
-    supported_surfaces: {
-      phase_summary_ref: "/v1/phases/phase-7/summary",
-      nats_runtime_summary_ref: "/v1/phases/phase-7/nats/summary",
-      kafka_runtime_summary_ref: "/v1/phases/phase-7/kafka/summary",
-      mqtt_runtime_summary_ref: "/v1/phases/phase-7/mqtt/summary",
-      webhook_runtime_summary_ref: "/v1/phases/phase-7/webhook-event-bus/summary",
-      continuity_summary_ref: "/v1/phases/phase-7/event-system-continuity/summary",
-      asyncapi_ref: "/asyncapi.json",
-      cloudevents_ref: "/cloudevents.json"
-    },
-    first_run_flows: [
-      {
-        flow_ref: "nats_subject_mesh_runtime",
-        recommended_reason: "best first durable event/system lane for subject-oriented machine coordination with NATS plus JetStream-style persistence posture",
-        sequence: [
-          "inspect_event_system_lane_summary",
-          "inspect_nats_runtime_summary",
-          "inspect_asyncapi_and_cloudevents_contracts",
-          "choose_broker_or_callback_family_for_the_integration"
-        ]
-      }
-    ],
-    guardrails: [
-      "event-system lanes extend runtime coordination rather than replace the default transaction flow",
-      "nats and jetstream style durability should improve integration fit without widening the public runtime core into a generic bus platform"
-    ]
-  };
-}
-
-function summarizeEventSystemLanePack() {
-  const pack = buildEventSystemLanePack();
-  return {
-    product: "xytara",
-    category: "machine-commerce-event-system-lane-pack-summary",
-    summary_version: "xytara-event-system-lane-pack-summary-v1",
-    lane_state: pack.lane_state,
-    posture: pack.posture,
-    first_run_flow_count: pack.first_run_flows.length,
-    linked_surfaces: pack.supported_surfaces
-  };
-}
-
-module.exports = {
-  buildEventSystemLanePack,
-  summarizeEventSystemLanePack
-};

package/lib/execution_dedupe.js

@@ -1,86 +0,0 @@
-"use strict";
-
-// Concurrency guard for the deferred (x402) verify -> execute -> settle path.
-//
-// Deferring settlement until after execution opened a narrow window: two in-flight
-// requests carrying the SAME signed EIP-3009 authorization (a genuine replay, or two
-// concurrent copies of one request) would both pass verification and both EXECUTE the
-// external target before the second /settle fails on the now-spent on-chain nonce. No
-// double-CHARGE can occur (the on-chain nonce is single-use), but the external work —
-// which may be billable, side-effecting seller cost — would run twice.
-//
-// This guard reserves an in-flight slot keyed on the authorization so a duplicate is
-// rejected with 409 BEFORE it executes. It is deliberately minimal:
-//   - it guards only the in-flight window (a post-success replay is already rejected
-//     upstream: the facilitator's verify simulates the transfer and a spent nonce
-//     reverts, so a consumed authorization never reaches execution again);
-//   - it FAILS OPEN — if the store is missing it allows the request, because wrongly
-//     blocking a paid request is worse than a rare duplicate execution, and the
-//     on-chain nonce still guarantees no double-charge;
-//   - slots carry a TTL well beyond the EIP-3009 window and are pruned on each claim,
-//     so a crash mid-execution cannot wedge an authorization permanently.
-
-const DEDUPE_TTL_MS = 180000; // ~3x the ~60s EIP-3009 authorization validity window
-
-// The globally-unique fingerprint of a deferred x402 authorization: the signer address
-// plus the 32-byte EIP-3009 nonce. Returns null for anything we do not defer (native,
-// credits, L402/BOLT/MPP) or if the nonce is absent — callers treat null as "nothing to
-// dedupe".
-function deferredAuthorizationKey(verification) {
-  const deferred = verification && verification.deferred_settlement;
-  if (!deferred || deferred.protocol !== "x402_facilitator") return null;
-  const paymentPayload = deferred.authorization && deferred.authorization.paymentPayload;
-  const auth = paymentPayload && paymentPayload.payload && paymentPayload.payload.authorization;
-  if (!auth) return null;
-  const nonce = typeof auth.nonce === "string" ? auth.nonce.trim().toLowerCase() : "";
-  if (!nonce) return null;
-  const from = typeof auth.from === "string" ? auth.from.trim().toLowerCase() : "";
-  return `x402:${from}:${nonce}`;
-}
-
-function pruneExpired(store, now) {
-  for (const [key, entry] of store) {
-    const expiresAt = entry && Number.isFinite(entry.expires_at) ? entry.expires_at : 0;
-    if (expiresAt <= now) store.delete(key);
-  }
-}
-
-// Reserve an execution slot for a deferred x402 authorization. Returns
-// { ok:true, key } on a fresh claim (key is null when there is nothing to dedupe, which
-// is still a success), or { ok:false, status:409, reason, detail } when the same
-// authorization is already executing. The check-and-set is synchronous (no await
-// between get and set), so two concurrent requests cannot both claim the same key.
-function claimDeferredExecution(state, verification) {
-  const key = deferredAuthorizationKey(verification);
-  if (!key) return { ok: true, key: null };
-  const store = state && state.inFlightPaymentAuthorizations instanceof Map ? state.inFlightPaymentAuthorizations : null;
-  if (!store) return { ok: true, key: null }; // fail open; on-chain nonce still prevents double-charge
-  const now = Date.now();
-  pruneExpired(store, now);
-  if (store.has(key)) {
-    return {
-      ok: false,
-      status: 409,
-      reason: "payment_authorization_in_progress",
-      detail: "a command for this x402 authorization is already executing; wait for it or sign a fresh authorization"
-    };
-  }
-  store.set(key, { status: "in_flight", claimed_at: now, expires_at: now + DEDUPE_TTL_MS });
-  return { ok: true, key };
-}
-
-// Release a reserved slot once execution+settlement has resolved (success or failure).
-// Always removes the slot so a legitimate retry with the same still-unspent nonce can
-// proceed; a replay of an already-settled nonce is stopped upstream at verify.
-function releaseDeferredExecution(state, key) {
-  if (!key) return;
-  const store = state && state.inFlightPaymentAuthorizations instanceof Map ? state.inFlightPaymentAuthorizations : null;
-  if (store) store.delete(key);
-}
-
-module.exports = {
-  DEDUPE_TTL_MS,
-  claimDeferredExecution,
-  deferredAuthorizationKey,
-  releaseDeferredExecution
-};

package/lib/execution_truth_contract.js

@@ -1,234 +0,0 @@
-"use strict";
-
-const packageJson = require("../package.json");
-const { summarizeCapabilityExecutionTruthBundle } = require("./capability_execution_truth");
-const { summarizeLifecycleContinuityPack } = require("./lifecycle_continuity_contract");
-const { summarizeDeliveryState } = require("./delivery_summary_contract");
-const { summarizeRevenueLaunchPathPack } = require("./revenue_launch_path_contract");
-const { summarizeProviderRuntimeJourneyPack } = require("./provider_runtime_journey_contract");
-
-function buildExecutionTruthModelPack() {
-  const capabilityExecutionTruth = summarizeCapabilityExecutionTruthBundle();
-  const lifecycleContinuity = summarizeLifecycleContinuityPack();
-  const deliverySummary = summarizeDeliveryState();
-  const revenueLaunchPathSummary = summarizeRevenueLaunchPathPack();
-  const providerJourneySummary = summarizeProviderRuntimeJourneyPack();
-
-  return {
-    ok: true,
-    product: packageJson.name,
-    category: "machine-commerce-execution-truth-model",
-    pack_version: "xytara-execution-truth-model-v1",
-    coined_standard: {
-      id: "XT1",
-      name: "xytara execution truth standard",
-      version: "xt1/v1",
-      role: "canonical_runtime_side_execution_transcript_and_fact_spine",
-      boundary: "xt1_names_the_xytara_runtime_truth_standard_without_claiming_xoonya_proof_validity_or_external_chain_truth"
-    },
-    doctrine: "xytara_owns_hot_state_execution_truth_and_emits_proof_compatible_facts_without_collapsing_into_xoonya_proof_semantics",
-    model_state: "frozen_for_3_0_0_closeout",
-    core_claim: "XT1 is the canonical xytara runtime-side fact model linking quote, payment, execution, delivery, settlement, and proof handoff",
-    canonical_objects: [
-      {
-        object_id: "quote",
-        role: "priced_pre_execution_offer",
-        required_fields: [
-          "quote_id",
-          "account_id",
-          "amount_minor",
-          "currency",
-          "capabilities",
-          "adapters",
-          "settlement_mode"
-        ],
-        primary_surfaces: ["/v1/payment-quotes", "/v1/payment-quotes/:quote_id"]
-      },
-      {
-        object_id: "transaction",
-        role: "hot_state_execution_record",
-        required_fields: [
-          "transaction_id",
-          "account_id",
-          "status",
-          "quote_id",
-          "payment",
-          "settlement",
-          "treasury",
-          "default_path",
-          "execution",
-          "timing",
-          "remediation"
-        ],
-        primary_surfaces: ["/v1/transactions", "/v1/transactions/:transaction_id"]
-      },
-      {
-        object_id: "receipt",
-        role: "runtime_completion_record_with_proof_pointer",
-        required_fields: [
-          "receipt_id",
-          "transaction_id",
-          "status",
-          "payment",
-          "settlement",
-          "treasury",
-          "default_path",
-          "proof_ref",
-          "execution_summary",
-          "timing",
-          "remediation"
-        ],
-        primary_surfaces: ["/v1/receipts", "/v1/receipts/:receipt_id"]
-      },
-      {
-        object_id: "delivery",
-        role: "deliverable_and_callback_state_record",
-        required_fields: [
-          "delivery_id",
-          "transaction_id",
-          "receipt_id",
-          "status",
-          "output_ref",
-          "proof_ref",
-          "delivery_target_kind"
-        ],
-        primary_surfaces: ["/v1/deliveries", "/v1/deliveries/:delivery_id"]
-      },
-      {
-        object_id: "settlement",
-        role: "external_finality_and_reconciliation_binding",
-        required_fields: [
-          "settlement_id",
-          "mode",
-          "adapter",
-          "binding_hash",
-          "status"
-        ],
-        primary_surfaces: ["/v1/settlement/bsv-teranode", "/v1/settlement/bsv-teranode/:settlement_id"]
-      },
-      {
-        object_id: "proof_handoff",
-        role: "xytara_to_xoonya_followthrough_boundary",
-        required_fields: [
-          "receipt.proof_ref",
-          "receipt.execution_summary",
-          "transaction.execution.results_by_task_id",
-          "delivery.proof_ref"
-        ],
-        primary_surfaces: [
-          "/v1/transaction-center/result-packages/export",
-          "https://xoonya.onrender.com/v1/proof-center/result-package-handoff/run"
-        ]
-      }
-    ],
-    layer_model: [
-      {
-        layer_id: "priced_intent",
-        order_index: 1,
-        objects: ["quote"],
-        invariants: [
-          "quote_must_exist_before_irreversible_paid_execution",
-          "quote_must_bind_amount_currency_and_settlement_posture"
-        ]
-      },
-      {
-        layer_id: "runtime_execution",
-        order_index: 2,
-        objects: ["transaction"],
-        invariants: [
-          "transaction_is_the_primary_hot_state_execution_record",
-          "execution_success_and_settlement_finality_must_remain_distinct"
-        ]
-      },
-      {
-        layer_id: "runtime_completion",
-        order_index: 3,
-        objects: ["receipt"],
-        invariants: [
-          "receipt_carries_execution_summary_and_proof_pointer",
-          "receipt_must_not_redefine_xoonya_proof_validity"
-        ]
-      },
-      {
-        layer_id: "deliverable_state",
-        order_index: 4,
-        objects: ["delivery"],
-        invariants: [
-          "delivery_tracks_where_the_result_went",
-          "callback_state_is_runtime_truth_not_external_proof_semantics"
-        ]
-      },
-      {
-        layer_id: "settlement_and_treasury",
-        order_index: 5,
-        objects: ["settlement"],
-        invariants: [
-          "settlement_records_external_finality_posture_without_becoming_execution_truth",
-          "treasury_and_settlement_must_stay_reconcilable_from_runtime_artifacts"
-        ]
-      },
-      {
-        layer_id: "proof_followthrough",
-        order_index: 6,
-        objects: ["proof_handoff"],
-        invariants: [
-          "xytara_emits_proof_compatible_facts_and_handoff_refs",
-          "xoonya_owns_proof_semantics_and_verification_truth"
-        ]
-      }
-    ],
-    execution_truth_invariants: [
-      "quote_precedes_paid_execution",
-      "transaction_is_the_canonical_hot_state_execution_record",
-      "receipt_is_the_runtime_completion_record_not_the_proof_core",
-      "delivery_truth_and_callback_truth_remain_first_class_runtime_artifacts",
-      "settlement_truth_is_linked_but_not_collapsed_into_execution_success",
-      "treasury_consequence_remains_reconstructible_from_runtime_artifacts",
-      "xytara_emits_proof_compatible_facts_without_redefining_xoonya_proof_semantics"
-    ],
-    linked_summaries: {
-      capability_execution_truth: capabilityExecutionTruth,
-      lifecycle_continuity: lifecycleContinuity,
-      delivery_summary: deliverySummary,
-      revenue_launch_path_summary: revenueLaunchPathSummary,
-      provider_runtime_journey_summary: providerJourneySummary
-    },
-    linked_surfaces: {
-      xt1_ref: "/v1/xt1",
-      xt1_summary_ref: "/v1/xt1/summary",
-      capability_execution_truth_ref: "/v1/capability-registry/execution-truth",
-      execution_truth_ref: "/v1/execution-truth",
-      execution_truth_summary_ref: "/v1/execution-truth/summary",
-      lifecycle_continuity_ref: "/v1/lifecycle-continuity",
-      deliveries_ref: "/v1/deliveries",
-      revenue_launch_paths_ref: "/v1/revenue-launch/paths",
-      providers_journeys_ref: "/v1/providers/journeys",
-      result_package_export_ref: "/v1/transaction-center/result-packages/export",
-      xoonya_result_package_handoff_ref: "https://xoonya.onrender.com/v1/proof-center/result-package-handoff/run"
-    },
-    claim_boundary: "claim_the_runtime_side_fact_model_and_handoff_boundary_only_without_claiming_xoonya_proof_validity_or_external_chain_truth_inside_xytara"
-  };
-}
-
-function summarizeExecutionTruthModelPack() {
-  const pack = buildExecutionTruthModelPack();
-  return {
-    ok: true,
-    product: pack.product,
-    category: pack.category,
-    summary_version: "xytara-execution-truth-model-summary-v1",
-    pack_version: pack.pack_version,
-    coined_standard_id: pack.coined_standard.id,
-    coined_standard_version: pack.coined_standard.version,
-    model_state: pack.model_state,
-    canonical_object_count: pack.canonical_objects.length,
-    layer_count: pack.layer_model.length,
-    invariant_count: pack.execution_truth_invariants.length,
-    linked_surfaces: pack.linked_surfaces
-  };
-}
-
-module.exports = {
-  buildExecutionTruthModelPack,
-  summarizeExecutionTruthModelPack
-};

package/lib/external_credit_bridge.js

@@ -1,142 +0,0 @@
-"use strict";
-
-const { applyRailCredits, upsertEntitlementPool } = require("./commerce_economics");
-const { findCreditPack } = require("../fixtures/catalog");
-
-function normalizeString(value, fallback) {
-  const trimmed = typeof value === "string" ? value.trim() : "";
-  return trimmed || fallback || null;
-}
-
-function ensureObject(value) {
-  return value && typeof value === "object" && !Array.isArray(value) ? value : {};
-}
-
-function nowIso() {
-  return new Date().toISOString();
-}
-
-function listExternalCreditGrants(state, accountId) {
-  const grants = Array.from(state.externalCreditGrants.values());
-  if (!accountId) return grants;
-  return grants.filter((grant) => grant && grant.account_id === accountId);
-}
-
-function getExternalCreditGrant(state, grantId) {
-  return state.externalCreditGrants.get(grantId) || null;
-}
-
-function findExternalCreditGrantByIdempotencyKey(state, idempotencyKey) {
-  if (!idempotencyKey) return null;
-  return Array.from(state.externalCreditGrants.values()).find((grant) => grant && grant.idempotency_key === idempotencyKey) || null;
-}
-
-function createExternalCreditGrant(state, body) {
-  const payload = ensureObject(body);
-  const grantId = normalizeString(payload.grant_id, null);
-  const idempotencyKey = normalizeString(payload.idempotency_key, null);
-
-  if (grantId && state.externalCreditGrants.has(grantId)) {
-    return state.externalCreditGrants.get(grantId);
-  }
-  const existingByIdempotency = findExternalCreditGrantByIdempotencyKey(state, idempotencyKey);
-  if (existingByIdempotency) {
-    return existingByIdempotency;
-  }
-
-  const createdAt = nowIso();
-  const nextGrantId = grantId || `external_credit_grant_${state.externalCreditGrants.size + 1}`;
-  const accountId = normalizeString(payload.account_id, "acct_demo");
-  const packId = normalizeString(payload.pack_id, normalizeString(payload.package_id, null));
-  const creditPack = packId ? findCreditPack(packId) : null;
-  if (packId && !creditPack) {
-    return {
-      ok: false,
-      reason: "credit_pack_not_found",
-      pack_id: packId
-    };
-  }
-  const units = Number.isFinite(Number(payload.units))
-    ? Number(payload.units)
-    : creditPack
-      ? Number(creditPack.issued_units || 0)
-      : 0;
-  const amountMinor = Number.isFinite(Number(payload.amount_minor))
-    ? Number(payload.amount_minor)
-    : creditPack && Number.isFinite(Number(creditPack.nominal_amount_minor))
-      ? Number(creditPack.nominal_amount_minor)
-      : null;
-  const currency = normalizeString(
-    payload.currency,
-    creditPack
-      ? normalizeString(creditPack.nominal_currency, amountMinor != null ? "USD" : null)
-      : amountMinor != null
-        ? "USD"
-        : null
-  );
-  const source = normalizeString(payload.source, "external_checkout");
-  const providerReference = normalizeString(payload.provider_reference, null);
-  const purchaseReference = normalizeString(payload.purchase_reference, null);
-  const metadata = ensureObject(payload.metadata);
-  const creditEventId = normalizeString(payload.credit_event_id, `credit_${nextGrantId}`);
-
-  const creditEvent = applyRailCredits(state, {
-    account_id: accountId,
-    credit_event_id: creditEventId,
-    rail_kind: normalizeString(payload.rail_kind, "external_checkout_bridge"),
-    units,
-    amount_minor: amountMinor,
-    currency,
-    provider_reference: providerReference,
-    reason: normalizeString(payload.reason, "external_credit_grant"),
-    metadata: {
-      source,
-      purchase_reference: purchaseReference,
-      pack_id: packId,
-      ...metadata
-    }
-  });
-
-  const grant = {
-    grant_id: nextGrantId,
-    account_id: accountId,
-    units,
-    amount_minor: amountMinor,
-    currency,
-    source,
-    provider_reference: providerReference,
-    purchase_reference: purchaseReference,
-    pack_id: packId,
-    credit_pack: creditPack ? {
-      pack_id: creditPack.pack_id,
-      title: creditPack.title,
-      category: creditPack.category,
-      intended_usage_posture: creditPack.intended_usage_posture
-    } : null,
-    idempotency_key: idempotencyKey || nextGrantId,
-    metadata,
-    entitlement_id: normalizeString(payload.entitlement_id, `entitlement_${nextGrantId}`),
-    credit_event_id: creditEvent.credit_event_id,
-    credit_event: creditEvent,
-    status: "recorded",
-    created_at_iso: createdAt,
-    updated_at_iso: createdAt
-  };
-
-  grant.entitlement = upsertEntitlementPool(state, {
-    entitlement_id: grant.entitlement_id,
-    account_id: accountId,
-    pack_id: packId,
-    source_ref: grant.grant_id,
-    issued_units: units
-  });
-
-  state.externalCreditGrants.set(grant.grant_id, grant);
-  return grant;
-}
-
-module.exports = {
-  createExternalCreditGrant,
-  getExternalCreditGrant,
-  listExternalCreditGrants
-};

package/lib/external_execution_policy.js

@@ -1,143 +0,0 @@
-"use strict";
-
-const dns = require("dns").promises;
-const net = require("net");
-
-// Upper bound on a single provider call. The x402 (EIP-3009) authorization a buyer signs is valid
-// for roughly a minute, so a provider allowed to run longer than this could do real work for a
-// payment that then fails to settle (nobody pays). Applies to env targets and registered providers.
-const MAX_TARGET_TIMEOUT_MS = 30000;
-const DEFAULT_TARGET_TIMEOUT_MS = 10000;
-const MIN_TARGET_TIMEOUT_MS = 500;
-
-// Total wall-clock budget for ONE buyer call across cold-start ride-out retries AND failover
-// candidates, shared so three candidates can never each consume a full window. Kept inside the
-// x402 settlement window (~60s) with headroom for the settle call itself.
-const DEFAULT_EXECUTION_BUDGET_MS = 50000;
-const MAX_EXECUTION_BUDGET_MS = 55000;
-
-function clampTargetTimeoutMs(value) {
-  const n = Number(value || DEFAULT_TARGET_TIMEOUT_MS) || DEFAULT_TARGET_TIMEOUT_MS;
-  return Math.min(MAX_TARGET_TIMEOUT_MS, Math.max(MIN_TARGET_TIMEOUT_MS, Math.round(n)));
-}
-
-function externalExecutionBudgetMs() {
-  const raw = process.env.XYTARA_EXTERNAL_EXECUTION_BUDGET_MS;
-  if (raw === undefined || raw === "") return DEFAULT_EXECUTION_BUDGET_MS;
-  const n = Number(raw);
-  if (!Number.isFinite(n) || n <= 0) return DEFAULT_EXECUTION_BUDGET_MS;
-  return Math.min(MAX_EXECUTION_BUDGET_MS, Math.max(1000, Math.round(n)));
-}
-
-// Endpoint policy. "strict" (default on a hosted deploy, i.e. when RENDER is set) requires https
-// and refuses endpoints at loopback / private / link-local / metadata addresses, so a registered
-// provider cannot turn the runtime into a request proxy into its own network (SSRF). "permissive"
-// (default locally) keeps http://127.0.0.1-style endpoints usable for tests and development.
-function endpointPolicyMode() {
-  const raw = String(process.env.XYTARA_PROVIDER_ENDPOINT_POLICY || "").trim().toLowerCase();
-  if (raw === "strict" || raw === "permissive") return raw;
-  return process.env.RENDER ? "strict" : "permissive";
-}
-
-function isPrivateIp(ip) {
-  const family = net.isIP(ip);
-  if (family === 4) {
-    const p = ip.split(".").map(Number);
-    if (p[0] === 10 || p[0] === 127 || p[0] === 0) return true;
-    if (p[0] === 169 && p[1] === 254) return true;              // link-local + cloud metadata
-    if (p[0] === 172 && p[1] >= 16 && p[1] <= 31) return true;
-    if (p[0] === 192 && p[1] === 168) return true;
-    if (p[0] === 100 && p[1] >= 64 && p[1] <= 127) return true; // carrier-grade NAT
-    if (p[0] >= 224) return true;                                // multicast / reserved / broadcast
-    return false;
-  }
-  if (family === 6) {
-    const lower = ip.toLowerCase();
-    if (lower === "::" || lower === "::1") return true;
-    if (lower.startsWith("fe80:") || lower.startsWith("fc") || lower.startsWith("fd")) return true; // link-local, ULA
-    if (lower.startsWith("::ffff:")) return isPrivateIp(lower.slice(7));                            // v4-mapped
-    if (lower.startsWith("ff")) return true;                                                        // multicast
-    return false;
-  }
-  return false;
-}
-
-function isBlockedHostname(hostname) {
-  const h = String(hostname || "").toLowerCase().replace(/\.$/, "");
-  if (!h || h === "localhost" || h.endsWith(".localhost")) return true;
-  if (h.endsWith(".local") || h.endsWith(".internal") || h.endsWith(".localdomain")) return true;
-  if (h === "metadata" || h === "metadata.google.internal") return true;
-  return false;
-}
-
-function hostOf(parsedUrl) {
-  return String(parsedUrl.hostname || "").replace(/^\[|\]$/g, "");
-}
-
-// Synchronous shape check (used at registration): protocol + literal-host rules. No DNS here.
-function checkEndpointUrlShape(endpointUrl) {
-  const policy = endpointPolicyMode();
-  let parsed;
-  try {
-    parsed = new URL(String(endpointUrl || ""));
-  } catch (_) {
-    return { ok: false, reason: "endpoint_url_invalid", policy };
-  }
-  if (parsed.username || parsed.password) {
-    return { ok: false, reason: "endpoint_url_credentials_not_allowed", policy };
-  }
-  if (policy !== "strict") return { ok: true, policy };
-  if (parsed.protocol !== "https:") {
-    return { ok: false, reason: "endpoint_url_insecure", detail: "https:// is required for provider endpoints", policy };
-  }
-  const host = hostOf(parsed);
-  if (isBlockedHostname(host) || (net.isIP(host) && isPrivateIp(host))) {
-    return { ok: false, reason: "endpoint_url_not_public", detail: "loopback, private, link-local and metadata hosts are refused", policy };
-  }
-  return { ok: true, policy };
-}
-
-// Dispatch-time check: re-validates the shape AND resolves the host, refusing any address in a
-// private range (defeats DNS rebinding to an internal address after registration). Results are
-// cached briefly so the hot path adds at most one lookup per host per minute.
-const resolveCache = new Map();
-const RESOLVE_CACHE_TTL_MS = 60000;
-
-async function checkEndpointBeforeDispatch(endpointUrl) {
-  const shape = checkEndpointUrlShape(endpointUrl);
-  if (!shape.ok || shape.policy !== "strict") return shape;
-  let host;
-  try {
-    host = hostOf(new URL(String(endpointUrl)));
-  } catch (_) {
-    return { ok: false, reason: "endpoint_url_invalid", policy: shape.policy };
-  }
-  if (net.isIP(host)) return shape; // literal already checked above
-  const cached = resolveCache.get(host);
-  if (cached && cached.expires_at > Date.now()) return cached.result;
-  let result;
-  try {
-    const addresses = await dns.lookup(host, { all: true, verbatim: true });
-    const bad = addresses.find((entry) => isPrivateIp(entry.address));
-    result = bad
-      ? { ok: false, reason: "endpoint_url_not_public", detail: "endpoint resolves to a non-public address", policy: shape.policy }
-      : { ok: true, policy: shape.policy };
-  } catch (_) {
-    // Unresolvable host: let the fetch surface ENOTFOUND (a not-processed, failover-safe signal).
-    result = { ok: true, policy: shape.policy, unresolved: true };
-  }
-  resolveCache.set(host, { result, expires_at: Date.now() + RESOLVE_CACHE_TTL_MS });
-  return result;
-}
-
-module.exports = {
-  MAX_TARGET_TIMEOUT_MS,
-  DEFAULT_TARGET_TIMEOUT_MS,
-  DEFAULT_EXECUTION_BUDGET_MS,
-  clampTargetTimeoutMs,
-  externalExecutionBudgetMs,
-  endpointPolicyMode,
-  isPrivateIp,
-  checkEndpointUrlShape,
-  checkEndpointBeforeDispatch
-};