xytara 3.1.16 → 3.2.0

package/lib/provider_runtime_journey_contract.js

@@ -1,183 +0,0 @@
-"use strict";
-
-const {
-  buildPhase1OpenaiCodexRuntimePack
-} = require("./phase_1_openai_codex_runtime_pack");
-const {
-  buildPhase1ClaudeMcpRuntimePack
-} = require("./phase_1_claude_mcp_runtime_pack");
-const {
-  buildProviderLanePack,
-  getProviderProfileDetail
-} = require("./provider_lane_contract");
-const { summarizeMarketLaneTracePack } = require("./market_lane_trace_contract");
-const { summarizeMarketLanePromotionPack } = require("./market_lane_promotion_contract");
-
-function uniqueSorted(values) {
-  return Array.from(new Set((Array.isArray(values) ? values : []).filter(Boolean))).sort();
-}
-
-function buildJourneyStages(providerId, profile, runtimePack) {
-  const firstPath = runtimePack.first_path || {};
-  const executeSurface = Array.isArray(profile.primary_call_surfaces) && profile.primary_call_surfaces.length
-    ? profile.primary_call_surfaces[0]
-    : null;
-  return [
-    {
-      stage_index: 1,
-      stage_id: "discover",
-      posture: "inspect_named_provider_entry",
-      surface_ref: "/v1/providers/summary",
-      expected_outcome: `discover the bounded ${providerId} entry posture before quoting or execution`
-    },
-    {
-      stage_index: 2,
-      stage_id: "quote",
-      posture: "secretless_first_contact_quote",
-      surface_ref: "xytara first-run --run-quote --account ACCOUNT_REF --pretty",
-      expected_outcome: "produce a quote or payment-required challenge without spending funds or requiring wallet secrets"
-    },
-    {
-      stage_index: 3,
-      stage_id: "fund",
-      posture: "credits_or_direct_payment_after_quote",
-      surface_ref: providerId === "openai_codex" ? "/v1/x402" : "/v1/commands/execute",
-      expected_outcome: "move from quoted intent into a bounded paid path through credits-first or approved payment proof"
-    },
-    {
-      stage_index: 4,
-      stage_id: "execute",
-      posture: "provider_bounded_runtime_execution",
-      surface_ref: executeSurface,
-      expected_outcome: "run the listed provider entry through the governed runtime without implying unbounded provider control-plane ownership"
-    },
-    {
-      stage_index: 5,
-      stage_id: "prove",
-      posture: "proof_followthrough",
-      surface_ref: firstPath.followthrough_ref || null,
-      expected_outcome: "continue the execution result into xoonya proof followthrough and verification review surfaces"
-    },
-    {
-      stage_index: 6,
-      stage_id: "inspect",
-      posture: "public_runtime_and_proof_inspection",
-      surface_ref: "/v1/full-catalog/market-lanes/traces/summary",
-      expected_outcome: "inspect the bounded runtime trace and promotion posture that supports the named provider journey"
-    }
-  ].filter((entry) => Boolean(entry.surface_ref));
-}
-
-function buildJourney(providerId, profile, runtimePack) {
-  const firstPath = runtimePack.first_path || {};
-  const traceSummary = summarizeMarketLaneTracePack();
-  const promotionSummary = summarizeMarketLanePromotionPack();
-  const stages = buildJourneyStages(providerId, profile, runtimePack);
-  const firstRunReady = stages.some((entry) => entry.stage_id === "quote")
-    && stages.some((entry) => entry.stage_id === "execute");
-
-  return {
-    journey_id: `${providerId}.runtime_journey`,
-    provider_id: profile.provider_id,
-    provider_label: profile.provider_label,
-    journey_posture: profile.posture,
-    claim_status: profile.claim_status,
-    first_run_ready: firstRunReady,
-    quote_ready: stages.some((entry) => entry.stage_id === "quote"),
-    funded_execution_ready: Boolean(profile.revenue_ready),
-    proof_followthrough_ready: Boolean(profile.proof_followthrough_ready),
-    provider_live_anchor_ready: Boolean(profile.provider_live_anchor_ready),
-    first_party_callable_ready: Boolean(profile.first_party_callable_ready),
-    stage_count: stages.length,
-    stages,
-    primary_http_sequence: Array.isArray(firstPath.first_http_sequence) ? firstPath.first_http_sequence.slice() : [],
-    primary_cli_sequence: Array.isArray(firstPath.first_cli_sequence) ? firstPath.first_cli_sequence.slice() : [],
-    call_surfaces: uniqueSorted(profile.primary_call_surfaces),
-    supporting_surfaces: uniqueSorted([
-      ...(profile.supporting_surfaces || []),
-      "/v1/providers/summary",
-      "/v1/full-catalog/market-lanes/traces/summary",
-      "/v1/full-catalog/market-lanes/promotion/summary"
-    ]),
-    readiness_gates: {
-      first_run_ready: firstRunReady,
-      provider_live_anchor_ready: Boolean(profile.provider_live_anchor_ready),
-      funded_execution_ready: Boolean(profile.revenue_ready),
-      proof_followthrough_ready: Boolean(profile.proof_followthrough_ready),
-      trace_ready: Number(traceSummary.market_lane_trace_count || 0) >= 3,
-      promotion_ready: Number(promotionSummary.market_lane_promotion_count || 0) >= 3
-    },
-    claim_boundary: providerId === "openai_codex"
-      ? "claim_openai_codex_journey_only_for_the_listed_quote_fund_execute_prove_path_inside_xytara_not_as_external_provider_platform_control"
-      : "claim_claude_mcp_journey_only_for_the_listed_mcp_quote_fund_execute_prove_path_inside_xytara_not_as_unbounded_provider_or_framework_depth"
-  };
-}
-
-function buildProviderRuntimeJourneyPack() {
-  const providerPack = buildProviderLanePack();
-  const openaiProfile = getProviderProfileDetail("openai_codex");
-  const claudeProfile = getProviderProfileDetail("claude_mcp");
-  const openaiRuntimePack = buildPhase1OpenaiCodexRuntimePack();
-  const claudeRuntimePack = buildPhase1ClaudeMcpRuntimePack();
-  const journeys = [
-    buildJourney("openai_codex", openaiProfile, openaiRuntimePack),
-    buildJourney("claude_mcp", claudeProfile, claudeRuntimePack)
-  ];
-
-  return {
-    ok: true,
-    product: "xytara",
-    category: "machine-commerce-provider-runtime-journey-pack",
-    pack_version: "xytara-provider-runtime-journey-pack-v1",
-    posture: "named_provider_quote_fund_execute_prove_paths",
-    doctrine: "provider_journeys_make_first_run_and_revenue_paths_publicly_inspectable_without_overclaiming_unbounded_vendor_breadth",
-    journey_count: journeys.length,
-    first_run_ready_journey_count: journeys.filter((entry) => entry.first_run_ready).length,
-    revenue_ready_journey_count: journeys.filter((entry) => entry.funded_execution_ready).length,
-    proof_followthrough_journey_count: journeys.filter((entry) => entry.proof_followthrough_ready).length,
-    provider_live_anchor_journey_count: journeys.filter((entry) => entry.provider_live_anchor_ready).length,
-    stage_total_count: journeys.reduce((total, entry) => total + Number(entry.stage_count || 0), 0),
-    provider_profiles_summary: {
-      provider_profile_count: providerPack.provider_profile_count,
-      revenue_ready_profile_count: providerPack.revenue_ready_profile_count,
-      proof_followthrough_profile_count: providerPack.proof_followthrough_profile_count
-    },
-    journeys,
-    linked_surfaces: {
-      providers_ref: "/v1/providers",
-      providers_summary_ref: "/v1/providers/summary",
-      market_lane_trace_summary_ref: "/v1/full-catalog/market-lanes/traces/summary",
-      market_lane_promotion_summary_ref: "/v1/full-catalog/market-lanes/promotion/summary",
-      openai_codex_runtime_ref: "/v1/phases/phase-1/openai-codex/runtime/summary",
-      claude_mcp_runtime_ref: "/v1/phases/phase-1/claude-mcp/runtime/summary"
-    }
-  };
-}
-
-function summarizeProviderRuntimeJourneyPack() {
-  const pack = buildProviderRuntimeJourneyPack();
-  return {
-    ok: true,
-    product: pack.product,
-    category: "machine-commerce-provider-runtime-journey-summary",
-    summary_version: "xytara-provider-runtime-journey-summary-v1",
-    journey_count: pack.journey_count,
-    first_run_ready_journey_count: pack.first_run_ready_journey_count,
-    revenue_ready_journey_count: pack.revenue_ready_journey_count,
-    proof_followthrough_journey_count: pack.proof_followthrough_journey_count,
-    provider_live_anchor_journey_count: pack.provider_live_anchor_journey_count,
-    stage_total_count: pack.stage_total_count,
-    linked_surfaces: pack.linked_surfaces
-  };
-}
-
-function getProviderRuntimeJourneyDetail(providerId) {
-  const normalized = String(providerId || "").trim().toLowerCase();
-  return (buildProviderRuntimeJourneyPack().journeys || []).find((entry) => entry.provider_id === normalized) || null;
-}
-
-module.exports = {
-  buildProviderRuntimeJourneyPack,
-  summarizeProviderRuntimeJourneyPack,
-  getProviderRuntimeJourneyDetail
-};

package/lib/public_surface_policy_contract.js

@@ -1,111 +0,0 @@
-"use strict";
-
-const packageJson = require("../package.json");
-
-function buildPublicSurfacePolicyContractPack() {
-  return {
-    ok: true,
-    product: packageJson.name,
-    category: "naxytra-public-surface-policy-contract",
-    pack_version: "naxytra-public-surface-policy-contract-v1",
-    doctrine: "xytara_classifies_public_surfaces_before_listing_or_widening_them",
-    model_state: "core_now",
-    core_claim: "every public surface must declare discovery paid proof_review or operator_only policy before it is treated as part of the public stack",
-    surface_classes: [
-      {
-        surface_class: "discovery_only",
-        description: "public informational and machine-discoverable surfaces",
-        examples: [
-          "/health",
-          "/server.json",
-          "/.well-known/mcp-server.json",
-          "/.well-known/glama.json",
-          "/v1/agent-discovery-index",
-          "/v1/agent-discovery-index/summary"
-        ]
-      },
-      {
-        surface_class: "paid",
-        description: "machine work or runtime invocation surfaces",
-        examples: [
-          "POST /v1/commands/execute",
-          "POST /x402/commands/execute",
-          "POST /v1/mcp/tools/invoke",
-          "POST /x402/mcp/tools/invoke"
-        ]
-      },
-      {
-        surface_class: "proof_review",
-        description: "proof and evidence review surfaces",
-        examples: [
-          "/v1/proof-truth",
-          "/v1/proof-truth/summary",
-          "/v1/followthrough-truth",
-          "/v1/followthrough-truth/summary",
-          "/v1/receipts",
-          "/v1/receipts/:receipt_id"
-        ]
-      },
-      {
-        surface_class: "operator_only",
-        description: "internal control or mutable operator surfaces",
-        examples: [
-          "/v1/business-cockpit",
-          "/business-cockpit",
-          "/v1/operator-shell",
-          "/v1/agent-accounts"
-        ]
-      }
-    ],
-    enforcement_rules: [
-      "discovery_only_surfaces_must_not_require_payment",
-      "paid_surfaces_must_carry_payment_or_challenge_metadata_when_public",
-      "proof_review_surfaces_must_not_mutate_runtime_or_treasury_truth",
-      "operator_only_surfaces_must_not_be_listed_as_public_discovery",
-      "every_new_surface_must_choose_a_class_before_release"
-    ],
-    route_fields: [
-      "surface_path",
-      "surface_class",
-      "requires_payment",
-      "requires_operator_auth",
-      "proof_boundary",
-      "claim_boundary"
-    ],
-    linked_surfaces: {
-      discovery_index_ref: "/v1/agent-discovery-index",
-      discovery_index_summary_ref: "/v1/agent-discovery-index/summary",
-      proof_truth_ref: "/v1/proof-truth",
-      followthrough_truth_ref: "/v1/followthrough-truth",
-      operator_cockpit_ref: "/v1/business-cockpit"
-    },
-    claim_boundary: "claim_the_public_surface_policy_for_xytara_only_without_claiming_runtime_payment_or_proof_truth_beyond_the_listed_surfaces"
-  };
-}
-
-function summarizePublicSurfacePolicyContractPack() {
-  const pack = buildPublicSurfacePolicyContractPack();
-  return {
-    ok: true,
-    product: pack.product,
-    category: pack.category,
-    summary_version: "naxytra-public-surface-policy-contract-summary-v1",
-    pack_version: pack.pack_version,
-    model_state: pack.model_state,
-    surface_class_count: pack.surface_classes.length,
-    rule_count: pack.enforcement_rules.length,
-    route_field_count: pack.route_fields.length,
-    linked_surfaces: pack.linked_surfaces
-  };
-}
-
-function getPublicSurfaceClassDetail(surfaceClass) {
-  const normalized = String(surfaceClass || "").trim().toLowerCase();
-  return (buildPublicSurfacePolicyContractPack().surface_classes || []).find((entry) => entry.surface_class === normalized) || null;
-}
-
-module.exports = {
-  buildPublicSurfacePolicyContractPack,
-  summarizePublicSurfacePolicyContractPack,
-  getPublicSurfaceClassDetail
-};

package/lib/publish_plan.js

@@ -1,51 +0,0 @@
-"use strict";
-
-const packageJson = require("../package.json");
-
-function buildPublishPlan() {
-  return {
-    ok: true,
-    product: packageJson.name,
-    category: "machine-commerce-publish-plan",
-    version: packageJson.version,
-    commands: {
-      verify_release_candidate: "npm run verify:release-candidate",
-      pack_dry_run: "npm pack --dry-run --json",
-      publish: "npm publish --access public",
-      release_cli_check: "xytara-release --candidate --summary"
-    },
-    live_checks: [
-      "/v1/release-candidate/summary",
-      "/v1/release-center/summary",
-      "/v1/announcement-pack/summary",
-      "/v1/outreach-proof/summary"
-    ],
-    publish_sequence: [
-      "run the release-candidate verification",
-      "confirm the dry-run package contents",
-      "publish the npm package at public access",
-      "redeploy the live service surfaces",
-      "verify the release-candidate and release-center summaries live",
-      "run the first public machine proof path"
-    ]
-  };
-}
-
-function summarizePublishPlan() {
-  const plan = buildPublishPlan();
-  return {
-    ok: true,
-    product: plan.product,
-    category: plan.category,
-    version: plan.version,
-    command_count: Object.keys(plan.commands).length,
-    live_check_count: plan.live_checks.length,
-    publish_step_count: plan.publish_sequence.length,
-    publish_command: plan.commands.publish
-  };
-}
-
-module.exports = {
-  buildPublishPlan,
-  summarizePublishPlan
-};

package/lib/rate_limiter.js

@@ -1,81 +0,0 @@
-"use strict";
-
-// Minimal in-memory fixed-window rate limiter. Dependency-free.
-//
-// Used to gate expensive unauthenticated work (e.g. L402 invoice creation, which
-// makes an outbound call to a Lightning provider on every UNPAID request) so a
-// flood cannot amplify into unbounded cost. Two independent ceilings apply:
-//   - per key (typically client IP): `max` hits per `windowMs`
-//   - global (all keys combined):    `maxGlobal` hits per `windowMs`
-// A hit counts against both; exceeding either denies the request.
-//
-// Scope: single process. Horizontally-scaled deployments should front this with a
-// shared store (Redis) or an edge/proxy limiter; this module is the in-process
-// floor, not a distributed guarantee. Callers should still deploy behind the
-// platform's own rate limiting for defense in depth.
-
-function now() {
-  return Date.now();
-}
-
-function createRateLimiter(options) {
-  const opts = options || {};
-  const windowMs = Math.max(1000, Number(opts.windowMs) || 60000);
-  const max = Math.max(1, Number(opts.max) || 30);
-  const maxGlobal = Math.max(max, Number(opts.maxGlobal) || max * 20);
-  // Map<key, { count, resetAt }>
-  const buckets = new Map();
-  let global = { count: 0, resetAt: now() + windowMs };
-  let lastSweep = now();
-
-  function sweep(t) {
-    // Opportunistic cleanup so the Map cannot grow without bound.
-    if (t - lastSweep < windowMs) return;
-    lastSweep = t;
-    for (const [key, bucket] of buckets) {
-      if (bucket.resetAt <= t) buckets.delete(key);
-    }
-  }
-
-  function rollGlobal(t) {
-    if (global.resetAt <= t) global = { count: 0, resetAt: t + windowMs };
-  }
-
-  // Record one hit for `key` and report whether it is allowed. The hit is only
-  // counted when allowed, so a denied caller does not push its own reset further
-  // out (no self-inflicted lockout extension).
-  function check(key) {
-    const t = now();
-    sweep(t);
-    rollGlobal(t);
-    const k = String(key == null ? "" : key);
-    let bucket = buckets.get(k);
-    if (!bucket || bucket.resetAt <= t) {
-      bucket = { count: 0, resetAt: t + windowMs };
-      buckets.set(k, bucket);
-    }
-    if (global.count >= maxGlobal) {
-      return { allowed: false, scope: "global", remaining: 0, retryAfterMs: Math.max(0, global.resetAt - t) };
-    }
-    if (bucket.count >= max) {
-      return { allowed: false, scope: "key", remaining: 0, retryAfterMs: Math.max(0, bucket.resetAt - t) };
-    }
-    bucket.count += 1;
-    global.count += 1;
-    return {
-      allowed: true,
-      scope: null,
-      remaining: Math.max(0, max - bucket.count),
-      retryAfterMs: Math.max(0, bucket.resetAt - t)
-    };
-  }
-
-  function reset() {
-    buckets.clear();
-    global = { count: 0, resetAt: now() + windowMs };
-  }
-
-  return { check, reset, config: { windowMs, max, maxGlobal } };
-}
-
-module.exports = { createRateLimiter };

package/lib/record_queries.js

@@ -1,48 +0,0 @@
-"use strict";
-
-function listRecords(map, filters) {
-  const entries = Array.from(map.values());
-  const opts = filters || {};
-  let items = entries;
-  if (opts.status) items = items.filter((item) => item.status === opts.status);
-  if (opts.account_id) items = items.filter((item) => item.account_id === opts.account_id);
-  if (opts.quote_id) items = items.filter((item) => item.quote_id === opts.quote_id);
-  if (opts.transaction_id) items = items.filter((item) => item.transaction_id === opts.transaction_id);
-  if (opts.receipt_id) items = items.filter((item) => item.receipt_id === opts.receipt_id);
-  if (opts.settlement_id) items = items.filter((item) => item.settlement_id === opts.settlement_id);
-  if (opts.intent) items = items.filter((item) => item.intent === opts.intent);
-  if (opts.callback_url) items = items.filter((item) => item.callback_url === opts.callback_url);
-  if (opts.proof_ref) items = items.filter((item) => item.proof_ref === opts.proof_ref);
-  if (opts.payment_id) items = items.filter((item) => item.payment_id === opts.payment_id);
-  if (opts.currency) items = items.filter((item) => item.currency === opts.currency);
-  if (opts.settlement_adapter) {
-    items = items.filter((item) => item.settlement_adapter === opts.settlement_adapter || item.settlement_mode === opts.settlement_adapter);
-  }
-  if (opts.reason_code) items = items.filter((item) => item.reason_code === opts.reason_code);
-  if (opts.action_code) items = items.filter((item) => item.action_code === opts.action_code);
-  if (opts.assigned_owner) items = items.filter((item) => item.assigned_owner === opts.assigned_owner);
-  if (opts.actor_role) {
-    items = items.filter((item) => {
-      if (item && item.created_actor && item.created_actor.role === opts.actor_role) {
-        return true;
-      }
-      const history = Array.isArray(item && item.history) ? item.history : [];
-      return history.some((event) => event && event.actor && event.actor.role === opts.actor_role);
-    });
-  }
-  if (opts.context_source) {
-    items = items.filter((item) => {
-      if (item && item.created_context && item.created_context.source === opts.context_source) {
-        return true;
-      }
-      const history = Array.isArray(item && item.history) ? item.history : [];
-      return history.some((event) => event && event.context && event.context.source === opts.context_source);
-    });
-  }
-  const limit = Math.max(1, Math.min(Number(opts.limit || 20), 100));
-  return items.slice(0, limit);
-}
-
-module.exports = {
-  listRecords
-};

package/lib/release_candidate.js

@@ -1,50 +0,0 @@
-"use strict";
-
-const packageJson = require("../package.json");
-
-function buildReleaseCandidatePack() {
-  return {
-    ok: true,
-    product: packageJson.name,
-    category: "machine-commerce-release-candidate",
-    version: packageJson.version,
-    package_posture: {
-      publish_access: packageJson.publishConfig && packageJson.publishConfig.access ? packageJson.publishConfig.access : null,
-      engine: packageJson.engines && packageJson.engines.node ? packageJson.engines.node : null,
-      bin_count: Object.keys(packageJson.bin || {}).length,
-      published_file_count: Array.isArray(packageJson.files) ? packageJson.files.length : 0
-    },
-    rehearsal: {
-      clean_install_command: "npm install xytara",
-      dry_run_pack_command: "npm pack --dry-run --json",
-      release_check_command: "npm run verify:release-candidate",
-      first_release_view: "xytara-release --candidate --summary"
-    },
-    checklist: [
-      "run npm run verify:release-candidate",
-      "confirm npm pack --dry-run includes public docs and bin entrypoints",
-      "confirm release-center and announcement-pack summaries are live after deploy",
-      "confirm the first public proof path still succeeds",
-      "only then proceed to npm publish"
-    ]
-  };
-}
-
-function summarizeReleaseCandidatePack() {
-  const pack = buildReleaseCandidatePack();
-  return {
-    ok: true,
-    product: pack.product,
-    category: pack.category,
-    version: pack.version,
-    publish_access: pack.package_posture.publish_access,
-    bin_count: pack.package_posture.bin_count,
-    published_file_count: pack.package_posture.published_file_count,
-    checklist_count: pack.checklist.length
-  };
-}
-
-module.exports = {
-  buildReleaseCandidatePack,
-  summarizeReleaseCandidatePack
-};