xytara 3.1.9 → 3.1.11

package/.env.example

@@ -17,6 +17,7 @@ XYTARA_X402_TOPUP_UNITS=1000
 # The runtime mints a fresh CDP Bearer JWT per request when both are set.
 CDP_API_KEY_ID=
 CDP_API_KEY_SECRET=
+# (XYTARA_X402_CDP_KEY_ID / XYTARA_X402_CDP_KEY_SECRET are accepted as aliases for the two above)
 XYTARA_PAYMENT_MAX_AGE_SECONDS=300
 XYTARA_WALLET_REGISTRY_JSON=[]
 XYTARA_TREASURY_DESTINATION_ID=
@@ -24,6 +25,9 @@ XYTARA_TREASURY_DESTINATION_KIND=
 XYTARA_TREASURY_ACCOUNT_ID=
 XYTARA_TREASURY_EXTERNAL_REF=
 XYTARA_TREASURY_DESTINATIONS_JSON={}
+# optional file-backed alternatives to the two *_JSON values above (blank = use the JSON values)
+XYTARA_WALLET_REGISTRY_PATH=
+XYTARA_TREASURY_DESTINATIONS_PATH=
 XYTARA_BSV_TERANODE_NETWORK=mainnet
 XYTARA_BSV_TERANODE_RPC_URL=
 XYTARA_BSV_TERANODE_MODE=opreturn
@@ -37,6 +41,18 @@ XYTARA_BSV_TERANODE_SETTLEMENT_RUNTIME_MODE=mock
 # operator write surfaces fail closed until both tokens are set
 XYTARA_CREDIT_BRIDGE_BEARER_TOKEN=
 XYTARA_ACCOUNT_AUTH_BEARER_TOKEN=
+# commerce-bridge write surface (distinct from the credit bridge); also fails closed until set
+XYTARA_COMMERCE_BRIDGE_BEARER_TOKEN=
+# optional: require spend-proof binding on spend-credential use (blank = runtime default)
+XYTARA_REQUIRE_SPEND_PROOF_BINDING=
+# hosted-checkout webhook verification (blank = runtime defaults; set the secret before going live)
+XYTARA_CHECKOUT_WEBHOOK_SECRET=
+XYTARA_HOSTED_CHECKOUT_WEBHOOK_SECRET=
+XYTARA_CHECKOUT_WEBHOOK_VERIFICATION_REQUIRED=
+XYTARA_CHECKOUT_WEBHOOK_MAX_AGE_SECONDS=
+# optional commerce pack map / prep TTL overrides (blank = runtime defaults)
+XYTARA_COMMERCE_PACK_MAP_JSON=
+XYTARA_COMMERCE_PREP_TTL_MS=
 XYTARA_CALLBACK_DELIVERY_ENABLED=true
 XYTARA_CALLBACK_SIGNING_SECRET=
 XYTARA_CALLBACK_TIMEOUT_MS=5000
@@ -47,10 +63,52 @@ XYTARA_SETTLEMENT_REFRESH_INTERVAL_MS=1500
 XYTARA_RATE_LIMIT_ENABLED=true
 XYTARA_RATE_LIMIT_WINDOW_MS=60000
 XYTARA_RATE_LIMIT_MAX_REQUESTS=600
-XYTARA_EXTERNAL_EXECUTION_REQUIRED=false
+# optional: scope the rate limit per route instead of globally (blank = runtime default)
+XYTARA_RATE_LIMIT_ROUTE_SCOPED=
+XYTARA_REQUEST_TIMEOUT_MS=30000
+XYTARA_HEADERS_TIMEOUT_MS=15000
 XYTARA_EXECUTION_TARGETS_JSON=[]
+# External execution (env targets + registered providers). Cold-start ride-out retries ONLY on
+# not-processed signals (408/429/503, connection refused/DNS). The budget is the TOTAL wall-clock for
+# one buyer call across all retries AND failover candidates, kept inside the ~60s x402 authorization
+# window so a ridden-out call still settles. Per-target timeout_ms is capped at 30000 for the same reason.
+XYTARA_EXTERNAL_EXECUTION_RETRY_WINDOW_MS=45000
+XYTARA_EXTERNAL_EXECUTION_MAX_RETRIES=29
+XYTARA_EXTERNAL_EXECUTION_BUDGET_MS=50000
+# Open execution-provider network (lib/provider_registry.js): providers self-register an endpoint +
+# the capabilities they serve; the runtime routes paid calls to ACTIVE providers and splits revenue.
+# Registration FAILS CLOSED until the bearer is set, UNLESS open registration is turned on. Every
+# provider still lands pending until an operator activates it (the vetting gate). See the live
+# machine contract at GET /v1/provider-network/contract.
+XYTARA_PROVIDER_REGISTRY_BEARER_TOKEN=
+# 1 = permissionless self-registration (no bearer); still rate-limited + pending-capped.
+XYTARA_PROVIDER_OPEN_REGISTRATION=0
+XYTARA_PROVIDER_REGISTRATION_RATE_PER_MIN=5
+XYTARA_PROVIDER_REGISTRATION_RATE_GLOBAL_PER_MIN=60
+XYTARA_PROVIDER_MAX_PENDING=100
+# provider endpoint policy: strict (default when RENDER is set) = https only + no loopback/private/
+# link-local/metadata hosts, re-checked by DNS at dispatch; permissive (default locally) for dev/tests
+XYTARA_PROVIDER_ENDPOINT_POLICY=
+# cap on a provider's revenue share, basis points (10000 = 100%)
+XYTARA_PROVIDER_MAX_REVENUE_SHARE_BPS=10000
+# health/failover: consecutive failures -> unhealthy; cooldown before a half-open retry; max candidates tried
+XYTARA_PROVIDER_UNHEALTHY_THRESHOLD=3
+XYTARA_PROVIDER_UNHEALTHY_COOLDOWN_MS=60000
+XYTARA_PROVIDER_FAILOVER_MAX=3
+# routing reputation recency decay, factor in (0,1): fades older observations so recent performance
+# weighs more. 1 (default) = no decay (lifetime counts). e.g. 0.95 once the network has real history.
+XYTARA_PROVIDER_REPUTATION_DECAY=1
+# Provider payout auto-execution via an EXTERNAL signer (the runtime stays key-less). OFF unless the
+# URL is set; otherwise payouts are recorded and the operator sends + confirms them. See services/payout-signer.
+XYTARA_PAYOUT_SIGNER_URL=
+XYTARA_PAYOUT_SIGNER_BEARER=
+XYTARA_PAYOUT_SIGNER_TIMEOUT_MS=20000
 XYTARA_L402_ENABLED=false
 XYTARA_L402_SHARED_SECRET=
+# optional L402 tuning (blank = runtime defaults)
+XYTARA_L402_MAX_AGE_SECONDS=
+XYTARA_L402_INVOICE_RATE_PER_MIN=
+XYTARA_L402_INVOICE_RATE_GLOBAL_PER_MIN=
 XYTARA_BOLT_ENABLED=false
 XYTARA_BOLT_SHARED_SECRET=
 XYTARA_BOLT_NETWORK=mainnet
@@ -61,6 +119,8 @@ XYTARA_MPP_SHARED_SECRET=
 XYTARA_MPP_PROVIDER=stripe_tempo_compatible
 XYTARA_MPP_SETTLEMENT_FAMILY=cards_or_stablecoin_or_lightning
 XYTARA_MPP_MAX_AGE_SECONDS=300
+# optional minimum MPP amount in minor units (blank = runtime default)
+XYTARA_MPP_MIN_AMOUNT_MINOR=
 XYTARA_NETWORK_DNS_RESULT_ORDER=verbatim
 XYTARA_NETWORK_PREFERRED_IP_FAMILY=auto
 XYTARA_EXTERNAL_EXECUTION_IP_FAMILY=auto