xytara 3.1.16 → 3.2.0

package/lib/go_live_operator_pack.js

@@ -1,391 +0,0 @@
-"use strict";
-
-const packageJson = require("../package.json");
-const {
-  buildCapabilityExecutionTruthBundle,
-  buildCapabilityCommercializationSummary
-} = require("./capability_execution_truth");
-const { buildPaymentProtocolStrategyPack } = require("./payment_protocol_contract");
-const { summarizeTreasuryDestinationsPack } = require("./treasury_destinations_contract");
-const { loadExecutionTargetRegistry } = require("./external_execution_runtime");
-const { buildCheckoutEventSecuritySummary } = require("./checkout_event_security");
-const { summarizeDeliveryState } = require("./delivery_summary_contract");
-const {
-  buildOperatorIntelligencePack,
-  summarizeOperatorIntelligencePack
-} = require("./operator_intelligence");
-
-function normalizeFunction(fn, fallback) {
-  return typeof fn === "function" ? fn : fallback;
-}
-
-function buildDefaultGoLiveState() {
-  return {
-    economicsBudgets: new Map(),
-    economicsAgents: new Map(),
-    economicsReceipts: new Map(),
-    economicsAllocations: [],
-    economicsRailCredits: [],
-    economicsEntitlements: new Map(),
-    economicsCreditSpends: [],
-    economicsUsageMeters: new Map(),
-    economicsJobActions: [],
-    quotes: new Map(),
-    transactions: new Map(),
-    receipts: new Map(),
-    deliveries: new Map(),
-    paymentLedger: [],
-    externalCreditGrants: [],
-    bsvSettlementRecords: [],
-    disputes: new Map(),
-    refunds: new Map(),
-    remediationTickets: new Map(),
-    operatorParticipants: new Map(),
-    agentAccounts: new Map(),
-    networkParticipants: new Map(),
-    coordinationHandoffs: [],
-    zoneAdmissionCases: []
-  };
-}
-
-function normalizeGoLiveState(state) {
-  const normalized = buildDefaultGoLiveState();
-  if (!state || typeof state !== "object") {
-    return normalized;
-  }
-  for (const [key, value] of Object.entries(state)) {
-    if (typeof value !== "undefined") {
-      normalized[key] = value;
-    }
-  }
-  return normalized;
-}
-
-function buildDefaultRuntimeDurability() {
-  return {
-    ok: true,
-    recovery_posture: "unknown",
-    blockers: ["runtime_durability_unavailable"],
-    operator_guidance: "inspect /v1/runtime/durability from the live service to confirm persistence posture"
-  };
-}
-
-function buildDefaultSettlementReadiness() {
-  return {
-    ok: true,
-    ready: false,
-    runtime_mode: "unknown",
-    blockers: ["native_settlement_readiness_unavailable"],
-    next_manual_inputs: ["inspect_live_service_settlement_readiness"]
-  };
-}
-
-function rankBlockerSeverity(blocker) {
-  if (typeof blocker !== "string" || blocker.length === 0) return "medium";
-  if (
-    blocker.includes("missing")
-    || blocker.includes("failed")
-    || blocker.includes("unreachable")
-    || blocker.includes("not_ready")
-    || blocker.includes("not_writable")
-    || blocker.includes("mock")
-    || blocker.includes("too_weak")
-  ) {
-    return "high";
-  }
-  return "medium";
-}
-
-function buildBlockingIssues(executionTruth, commercialization, runtimeDurability, settlementReadiness, treasurySummary, checkoutSecurity) {
-  const issues = [];
-
-  (Array.isArray(runtimeDurability.blockers) ? runtimeDurability.blockers : []).forEach((blocker) => {
-    issues.push({
-      lane: "runtime_durability",
-      severity: rankBlockerSeverity(blocker),
-      blocker,
-      reason: runtimeDurability.operator_guidance || "runtime durability requires operator review",
-      ref: "/v1/runtime/durability"
-    });
-  });
-
-  (Array.isArray(settlementReadiness.blockers) ? settlementReadiness.blockers : []).forEach((blocker) => {
-    issues.push({
-      lane: "native_settlement",
-      severity: rankBlockerSeverity(blocker),
-      blocker,
-      reason: "native settlement readiness still has blocking configuration gaps",
-      ref: "/v1/settlement/bsv-teranode/readiness"
-    });
-  });
-
-  if (Number(treasurySummary.configured_profile_count || 0) < 1) {
-    issues.push({
-      lane: "treasury_destinations",
-      severity: "high",
-      blocker: "treasury_destinations_unconfigured",
-      reason: "no treasury destination profile is configured with a real landing reference",
-      ref: "/v1/treasury-destinations"
-    });
-  }
-
-  if (Number(executionTruth.counts.provider_wiring_required_count || 0) > 0) {
-    issues.push({
-      lane: "provider_execution",
-      severity: "high",
-      blocker: "provider_execution_targets_missing",
-      reason: `${executionTruth.counts.provider_wiring_required_count} capability lane(s) still need execution target bindings`,
-      ref: "/v1/capability-registry/execution-truth"
-    });
-  }
-
-  if (Number(executionTruth.counts.operator_classification_required_count || 0) > 0) {
-    issues.push({
-      lane: "capability_classification",
-      severity: "medium",
-      blocker: "capability_classification_incomplete",
-      reason: `${executionTruth.counts.operator_classification_required_count} capability lane(s) still require execution classification`,
-      ref: "/v1/capability-registry/execution-truth"
-    });
-  }
-
-  if (Number(commercialization.counts.hold_until_classified || 0) > 0) {
-    issues.push({
-      lane: "commercialization",
-      severity: "medium",
-      blocker: "catalog_items_not_ready_for_public_sale",
-      reason: `${commercialization.counts.hold_until_classified} capability lane(s) should stay off live public sale surfaces`,
-      ref: "/v1/capability-registry/commercialization-summary"
-    });
-  }
-
-  (Array.isArray(checkoutSecurity.blockers) ? checkoutSecurity.blockers : []).forEach((blocker) => {
-    issues.push({
-      lane: "hosted_checkout_ingress",
-      severity: rankBlockerSeverity(blocker),
-      blocker,
-      reason: checkoutSecurity.operator_guidance || "hosted checkout ingress security requires operator review",
-      ref: "/v1/checkout/events/security"
-    });
-  });
-
-  return issues;
-}
-
-function buildNextActions(blockingIssues, operatorIntelligence, executionTruth, treasurySummary, settlementReadiness) {
-  const actions = [];
-
-  if (blockingIssues.some((issue) => issue.blocker === "treasury_destinations_unconfigured")) {
-    actions.push({
-      priority: "high",
-      action: "configure_treasury_destinations",
-      reason: "real money should not land until treasury destinations are explicitly configured",
-      refs: [
-        "/v1/treasury-destinations",
-        "/v1/treasury-destinations/operator-pack"
-      ]
-    });
-  }
-
-  if (blockingIssues.some((issue) => issue.blocker === "provider_execution_targets_missing")) {
-    const providerRequiredTasks = (Array.isArray(executionTruth.tasks) ? executionTruth.tasks : [])
-      .filter((task) => task.execution_truth === "provider_wiring_required")
-      .map((task) => task.task_ref);
-    actions.push({
-      priority: "high",
-      action: "bind_provider_execution_targets",
-      reason: `provider-backed execution is still missing for ${providerRequiredTasks.join(", ") || "one or more capability lanes"}`,
-      refs: [
-        "/v1/capability-registry/execution-truth",
-        "/v1/capability-registry/commercialization-summary"
-      ]
-    });
-  }
-
-  if (settlementReadiness.ready !== true) {
-    actions.push({
-      priority: "high",
-      action: "close_native_settlement_inputs",
-      reason: `native settlement readiness is blocked by ${(settlementReadiness.blockers || []).join(", ") || "unresolved inputs"}`,
-      refs: [
-        "/v1/settlement/bsv-teranode/readiness",
-        "/v1/settlement/bsv-teranode"
-      ]
-    });
-  }
-
-  if (blockingIssues.some((issue) => issue.lane === "hosted_checkout_ingress")) {
-    actions.push({
-      priority: "high",
-      action: "configure_checkout_webhook_verification",
-      reason: "hosted checkout event ingress should be signed before xytara trusts payment-state transitions",
-      refs: [
-        "/v1/checkout/events/security",
-        "/v1/stripe-mpp"
-      ]
-    });
-  }
-
-  if (Number(treasurySummary.explicit_per_rail_configured_count || 0) < 1) {
-    actions.push({
-      priority: "medium",
-      action: "upgrade_from_fallback_to_per_rail_treasury_profiles",
-      reason: "explicit per-rail treasury profiles strengthen reconciliation and public claim integrity",
-      refs: [
-        "/v1/treasury-destinations",
-        "/v1/treasury-destinations/operator-pack"
-      ]
-    });
-  }
-
-  if (operatorIntelligence && operatorIntelligence.recommended_operator_motion) {
-    actions.push({
-      priority: operatorIntelligence.overall_operator_state && operatorIntelligence.overall_operator_state.top_priority
-        ? operatorIntelligence.overall_operator_state.top_priority
-        : "medium",
-      action: operatorIntelligence.recommended_operator_motion,
-      reason: "current operator intelligence indicates this as the next best runtime or adoption move",
-      refs: [
-        "/v1/operator-intelligence",
-        `/v1/economics/accounts/${encodeURIComponent(operatorIntelligence.account_id || "acct_demo")}/operator-dashboard`
-      ]
-    });
-  }
-
-  if (actions.length === 0) {
-    actions.push({
-      priority: "low",
-      action: "run_first_live_money_flow",
-      reason: "core launch blockers are cleared enough to run a first live end-to-end production transaction",
-      refs: [
-        "/v1/payment-ledger",
-        "/v1/activity-ledger",
-        "/v1/reconciliation-report"
-      ]
-    });
-  }
-
-  return actions;
-}
-
-function buildGoLiveOperatorPack(state, input, options) {
-  const payload = input && typeof input === "object" && !Array.isArray(input) ? input : {};
-  const accountId = String(payload.account_id || "acct_demo").trim() || "acct_demo";
-  const runtimeDurabilityBuilder = normalizeFunction(options && options.buildRuntimeDurabilitySummary, buildDefaultRuntimeDurability);
-  const settlementReadinessBuilder = normalizeFunction(options && options.buildNativeSettlementReadinessSummary, buildDefaultSettlementReadiness);
-  const runtimeState = normalizeGoLiveState(state);
-
-  const executionTruth = buildCapabilityExecutionTruthBundle();
-  const commercialization = buildCapabilityCommercializationSummary();
-  const paymentStrategy = buildPaymentProtocolStrategyPack();
-  const treasurySummary = summarizeTreasuryDestinationsPack();
-  const checkoutSecurity = buildCheckoutEventSecuritySummary();
-  const deliverySummary = summarizeDeliveryState(runtimeState);
-  const runtimeDurability = runtimeDurabilityBuilder();
-  const settlementReadiness = settlementReadinessBuilder();
-  const operatorIntelligence = buildOperatorIntelligencePack(runtimeState, { account_id: accountId });
-  const executionTargets = loadExecutionTargetRegistry();
-  const blockingIssues = buildBlockingIssues(
-    executionTruth,
-    commercialization,
-    runtimeDurability,
-    settlementReadiness,
-    treasurySummary,
-    checkoutSecurity
-  );
-  const nextActions = buildNextActions(
-    blockingIssues,
-    operatorIntelligence,
-    executionTruth,
-    treasurySummary,
-    settlementReadiness
-  );
-
-  return {
-    ok: true,
-    product: packageJson.name,
-    category: "machine-commerce-go-live-operator-pack",
-    pack_version: "xytara-go-live-operator-pack-v1",
-    account_id: accountId,
-    go_live_state: blockingIssues.length === 0 ? "launch_ready_for_first_live_money_flow" : "launch_blocked_pending_operator_closeout",
-    launch_posture: {
-      public_capability_count: executionTruth.counts.task_count,
-      self_serve_live_now_count: commercialization.counts.self_serve_live_now,
-      operator_enabled_after_config_count: commercialization.counts.operator_enabled_after_config,
-      configured_execution_target_count: executionTargets.length,
-      configured_treasury_profile_count: treasurySummary.configured_profile_count,
-      explicit_per_rail_treasury_profile_count: treasurySummary.explicit_per_rail_configured_count,
-      callback_delivery_enabled: deliverySummary.callback_delivery_enabled,
-      callback_signing_secret_configured: deliverySummary.callback_signing_secret_configured,
-      callback_delivery_count: deliverySummary.callback_delivery_count,
-      delivered_callback_delivery_count: deliverySummary.delivered_delivery_count,
-      retrying_callback_delivery_count: deliverySummary.retrying_callback_delivery_count,
-      runtime_recovery_posture: runtimeDurability.recovery_posture,
-      native_settlement_ready: settlementReadiness.ready === true,
-      checkout_ingress_security_ready: checkoutSecurity.ready === true
-    },
-    payment_posture: {
-      machine_primary: paymentStrategy.primary_machine_payment_front || null,
-      repeat_use_primary: paymentStrategy.primary_repeat_use_payment_front || null,
-      human_primary: paymentStrategy.human_and_enterprise_procurement_front || null,
-      external_front_count: Array.isArray(paymentStrategy.adapter_ready_external_fronts)
-        ? paymentStrategy.adapter_ready_external_fronts.length
-        : 0
-    },
-    blocking_issues: blockingIssues,
-    next_actions: nextActions,
-    launch_sequence: [
-      "configure_treasury_and_wallet_security",
-      "bind_provider_execution_targets_for_external_capability_lanes",
-      "close_native_settlement_readiness_inputs",
-      "confirm_persistent_runtime_storage_and_recovery",
-      "run_first_live_end_to_end_money_flow",
-      "watch_activity_payment_and_reconciliation_surfaces"
-    ],
-    linked_surfaces: {
-      capability_execution_truth_ref: "/v1/capability-registry/execution-truth",
-      commercialization_summary_ref: "/v1/capability-registry/commercialization-summary",
-      payment_strategy_ref: "/v1/payment-protocols/strategy",
-      payment_fronts_ref: "/v1/payment-fronts",
-      checkout_event_security_ref: "/v1/checkout/events/security",
-      delivery_summary_ref: "/v1/deliveries/summary",
-      treasury_ref: "/v1/treasury-destinations",
-      native_settlement_ref: "/v1/settlement/bsv-teranode/readiness",
-      runtime_durability_ref: "/v1/runtime/durability",
-      operator_intelligence_ref: "/v1/operator-intelligence",
-      payment_ledger_ref: "/v1/payment-ledger",
-      reconciliation_ref: "/v1/reconciliation-report"
-    },
-    supporting_summaries: {
-      capability_counts: executionTruth.counts,
-      commercialization_counts: commercialization.counts,
-      treasury_summary: treasurySummary,
-      checkout_event_security: checkoutSecurity,
-      delivery_summary: deliverySummary,
-      runtime_durability: runtimeDurability,
-      native_settlement: settlementReadiness,
-      operator_intelligence: summarizeOperatorIntelligencePack(runtimeState, { account_id: accountId })
-    }
-  };
-}
-
-function summarizeGoLiveOperatorPack(state, input, options) {
-  const pack = buildGoLiveOperatorPack(state, input, options);
-  return {
-    ok: true,
-    product: pack.product,
-    category: pack.category,
-    pack_version: pack.pack_version,
-    account_id: pack.account_id,
-    go_live_state: pack.go_live_state,
-    blocking_issue_count: pack.blocking_issues.length,
-    top_action: pack.next_actions[0] || null,
-    launch_posture: pack.launch_posture,
-    linked_surfaces: pack.linked_surfaces
-  };
-}
-
-module.exports = {
-  buildGoLiveOperatorPack,
-  summarizeGoLiveOperatorPack
-};

package/lib/http_transport.js

@@ -1,99 +0,0 @@
-"use strict";
-
-function sendJson(res, statusCode, payload, headers) {
-  // Remember the outcome for the buyer event log (createServer reads it when the response finishes).
-  if (res && typeof res === "object" && payload && typeof payload === "object") {
-    res.__xytaraOutcome = {
-      reason: typeof payload.reason === "string" ? payload.reason : null,
-      detail: typeof payload.detail === "string" ? payload.detail : null,
-      challenge: Boolean(payload.payment_required) && typeof payload.reason !== "string",
-      money_moved: payload.money_moved === true
-    };
-  }
-  const body = JSON.stringify(payload);
-  res.writeHead(statusCode, {
-    "content-type": "application/json; charset=utf-8",
-    "content-length": Buffer.byteLength(body),
-    ...(headers && typeof headers === "object" ? headers : {})
-  });
-  res.end(body);
-}
-
-function readJsonBody(req) {
-  return new Promise((resolve, reject) => {
-    let body = "";
-    req.on("data", (chunk) => {
-      body += chunk;
-      if (body.length > 1024 * 1024) {
-        reject(Object.assign(new Error("request body too large"), { statusCode: 413, reason: "request_body_too_large" }));
-        req.destroy();
-      }
-    });
-    req.on("end", () => {
-      if (!body) {
-        resolve({});
-        return;
-      }
-      try {
-        const parsed = JSON.parse(body);
-        // Only the selectors the event log needs — never the body itself.
-        if (parsed && typeof parsed === "object") {
-          req.__xytaraSelectors = {
-            task_ref: typeof parsed.task_ref === "string" ? parsed.task_ref : null,
-            tool_name: parsed.body && typeof parsed.body.tool_name === "string" ? parsed.body.tool_name
-              : typeof parsed.tool_name === "string" ? parsed.tool_name : null
-          };
-        }
-        resolve(parsed);
-      } catch (error) {
-        reject(Object.assign(new Error("body must be valid JSON"), { statusCode: 400, reason: "invalid_json" }));
-      }
-    });
-    req.on("error", reject);
-  });
-}
-
-function readJsonBodyWithRaw(req) {
-  return new Promise((resolve, reject) => {
-    // Collect raw bytes and only decode once, so multibyte UTF-8 that splits
-    // across a chunk boundary is not corrupted. The exact raw body is required
-    // for processor webhook signature verification (e.g. Stripe HMAC).
-    const chunks = [];
-    let size = 0;
-    req.on("data", (chunk) => {
-      const buf = Buffer.isBuffer(chunk) ? chunk : Buffer.from(chunk);
-      size += buf.length;
-      if (size > 1024 * 1024) {
-        reject(Object.assign(new Error("request body too large"), { statusCode: 413, reason: "request_body_too_large" }));
-        req.destroy();
-        return;
-      }
-      chunks.push(buf);
-    });
-    req.on("end", () => {
-      const raw = Buffer.concat(chunks).toString("utf8");
-      if (!raw) {
-        resolve({
-          body: {},
-          raw_body: ""
-        });
-        return;
-      }
-      try {
-        resolve({
-          body: JSON.parse(raw),
-          raw_body: raw
-        });
-      } catch (error) {
-        reject(Object.assign(new Error("body must be valid JSON"), { statusCode: 400, reason: "invalid_json" }));
-      }
-    });
-    req.on("error", reject);
-  });
-}
-
-module.exports = {
-  readJsonBody,
-  readJsonBodyWithRaw,
-  sendJson
-};

package/lib/identity_auth.js

@@ -1,175 +0,0 @@
-"use strict";
-
-function normalizeString(value, fallback = null) {
-  const trimmed = typeof value === "string" ? value.trim() : "";
-  return trimmed || fallback;
-}
-
-function ensureArray(value) {
-  return Array.isArray(value) ? value : [];
-}
-
-function nowIso() {
-  return new Date().toISOString();
-}
-
-function buildIdentityBindingPublicView(binding) {
-  if (!binding) return null;
-  return {
-    binding_id: binding.binding_id,
-    account_id: binding.account_id,
-    status: binding.status,
-    identity_kind: binding.identity_kind,
-    identity_ref: binding.identity_ref,
-    registry_scope: binding.registry_scope || null,
-    attached_agent_account_id: binding.attached_agent_account_id || null,
-    source_transaction_id: binding.source_transaction_id || null,
-    expires_at_iso: binding.expires_at_iso || null,
-    rotated_from_binding_id: binding.rotated_from_binding_id || null,
-    replaced_by_binding_id: binding.replaced_by_binding_id || null,
-    created_at_iso: binding.created_at_iso,
-    updated_at_iso: binding.updated_at_iso,
-    revoked_at_iso: binding.revoked_at_iso || null,
-    revoke_reason: binding.revoke_reason || null,
-    labels: ensureArray(binding.labels),
-    issued_by: binding.issued_by || null
-  };
-}
-
-function createIdentityBinding(state, body) {
-  const payload = body && typeof body === "object" && !Array.isArray(body) ? body : {};
-  const createdAtIso = nowIso();
-  const binding = {
-    binding_id: normalizeString(payload.binding_id, `identity_binding_${state.machineIdentityBindings.size + 1}`),
-    account_id: normalizeString(payload.account_id, "acct_demo"),
-    status: normalizeString(payload.status, "active"),
-    identity_kind: normalizeString(payload.identity_kind, "registry_anchor_identity"),
-    identity_ref: normalizeString(payload.identity_ref, `identity_ref_${state.machineIdentityBindings.size + 1}`),
-    registry_scope: normalizeString(payload.registry_scope, null),
-    attached_agent_account_id: normalizeString(payload.attached_agent_account_id, null),
-    source_transaction_id: normalizeString(payload.source_transaction_id, null),
-    expires_at_iso: normalizeString(payload.expires_at_iso, null),
-    labels: ensureArray(payload.labels).map((value) => String(value || "").trim()).filter(Boolean),
-    issued_by: normalizeString(payload.issued_by, "operator"),
-    rotated_from_binding_id: normalizeString(payload.rotated_from_binding_id, null),
-    replaced_by_binding_id: normalizeString(payload.replaced_by_binding_id, null),
-    created_at_iso: createdAtIso,
-    updated_at_iso: createdAtIso,
-    revoked_at_iso: null,
-    revoke_reason: null
-  };
-  state.machineIdentityBindings.set(binding.binding_id, binding);
-  return buildIdentityBindingPublicView(binding);
-}
-
-function listIdentityBindings(state, filters) {
-  const payload = filters && typeof filters === "object" && !Array.isArray(filters) ? filters : {};
-  const accountId = normalizeString(payload.account_id, null);
-  const status = normalizeString(payload.status, null);
-  return Array.from(state.machineIdentityBindings.values())
-    .filter((binding) => {
-      if (accountId && binding.account_id !== accountId) return false;
-      if (status && binding.status !== status) return false;
-      return true;
-    })
-    .map((binding) => buildIdentityBindingPublicView(binding));
-}
-
-function getIdentityBinding(state, bindingId) {
-  if (!bindingId || !state.machineIdentityBindings.has(bindingId)) return null;
-  return buildIdentityBindingPublicView(state.machineIdentityBindings.get(bindingId));
-}
-
-function revokeIdentityBinding(state, bindingId, body) {
-  if (!bindingId || !state.machineIdentityBindings.has(bindingId)) return null;
-  const payload = body && typeof body === "object" && !Array.isArray(body) ? body : {};
-  const current = state.machineIdentityBindings.get(bindingId);
-  const next = {
-    ...current,
-    status: "revoked",
-    revoked_at_iso: nowIso(),
-    revoke_reason: normalizeString(payload.reason, "operator_revoked"),
-    updated_at_iso: nowIso()
-  };
-  state.machineIdentityBindings.set(bindingId, next);
-  return buildIdentityBindingPublicView(next);
-}
-
-function getIdentityBindingRotationSummary(state, bindingId) {
-  if (!bindingId || !state.machineIdentityBindings.has(bindingId)) return null;
-  const binding = state.machineIdentityBindings.get(bindingId);
-  return {
-    summary_version: "xytara-identity-binding-rotation-summary-v1",
-    binding_id: binding.binding_id,
-    account_id: binding.account_id,
-    status: binding.status,
-    predecessor_binding_id: binding.rotated_from_binding_id || null,
-    successor_binding_id: binding.replaced_by_binding_id || null,
-    expires_at_iso: binding.expires_at_iso || null,
-    rotation_state: binding.rotated_from_binding_id || binding.replaced_by_binding_id
-      ? "lineage_present"
-      : "standalone",
-    linked_surfaces: {
-      identity_binding_ref: `/v1/identity/bindings/${encodeURIComponent(binding.binding_id)}`
-    },
-    generated_at_iso: nowIso()
-  };
-}
-
-function renewIdentityBinding(state, bindingId, body) {
-  if (!bindingId || !state.machineIdentityBindings.has(bindingId)) return null;
-  const payload = body && typeof body === "object" && !Array.isArray(body) ? body : {};
-  const current = state.machineIdentityBindings.get(bindingId);
-  const next = {
-    ...current,
-    expires_at_iso: normalizeString(payload.expires_at_iso, current.expires_at_iso || null),
-    updated_at_iso: nowIso()
-  };
-  state.machineIdentityBindings.set(bindingId, next);
-  return buildIdentityBindingPublicView(next);
-}
-
-function rotateIdentityBinding(state, bindingId, body) {
-  if (!bindingId || !state.machineIdentityBindings.has(bindingId)) return null;
-  const payload = body && typeof body === "object" && !Array.isArray(body) ? body : {};
-  const current = state.machineIdentityBindings.get(bindingId);
-  const successorBindingId = normalizeString(payload.successor_binding_id, `${bindingId}_rotated`);
-  const successor = createIdentityBinding(state, {
-    binding_id: successorBindingId,
-    account_id: current.account_id,
-    identity_kind: normalizeString(payload.identity_kind, current.identity_kind),
-    identity_ref: normalizeString(payload.identity_ref, current.identity_ref),
-    registry_scope: normalizeString(payload.registry_scope, current.registry_scope),
-    attached_agent_account_id: normalizeString(payload.attached_agent_account_id, current.attached_agent_account_id),
-    source_transaction_id: normalizeString(payload.source_transaction_id, current.source_transaction_id),
-    expires_at_iso: normalizeString(payload.expires_at_iso, current.expires_at_iso || null),
-    labels: ensureArray(payload.labels).length > 0 ? ensureArray(payload.labels) : ensureArray(current.labels),
-    issued_by: normalizeString(payload.issued_by, current.issued_by || "operator"),
-    rotated_from_binding_id: current.binding_id
-  });
-  revokeIdentityBinding(state, bindingId, {
-    reason: normalizeString(payload.reason, "rotated_to_successor")
-  });
-  state.machineIdentityBindings.set(successor.binding_id, {
-    ...state.machineIdentityBindings.get(successor.binding_id),
-    rotated_from_binding_id: current.binding_id
-  });
-  state.machineIdentityBindings.set(bindingId, {
-    ...state.machineIdentityBindings.get(bindingId),
-    replaced_by_binding_id: successor.binding_id
-  });
-  return {
-    rotated_binding: buildIdentityBindingPublicView(state.machineIdentityBindings.get(bindingId)),
-    successor_identity_binding: buildIdentityBindingPublicView(state.machineIdentityBindings.get(successor.binding_id))
-  };
-}
-
-module.exports = {
-  createIdentityBinding,
-  listIdentityBindings,
-  getIdentityBinding,
-  getIdentityBindingRotationSummary,
-  renewIdentityBinding,
-  revokeIdentityBinding,
-  rotateIdentityBinding
-};