xytara 3.2.0 → 3.2.1

package/RELEASE_NOTES.md

@@ -1,9 +1,8 @@
-`xytara` 3.2.0 turns the npm package into a thin client for the hosted naxytra runtime. The runtime is a hosted service; this package is the client. The server is not distributed.
+`xytara` 3.2.1 makes paying plug-and-play for every kind of client.
 
-- **What the package now contains** — `client.js` (the entry), the buyer-side `CommerceClient`, the delivery-receipt verifier, the `xytara` / `xytara-run` CLIs, two offline verification scripts, and the docs. Nothing else: no server, no payment or settlement engine, no routing, no state store, no fixtures, adapters, integrations or operator tooling.
-- **`require("xytara")` is now the client surface** — `CommerceClient` and the commerce helpers as before, plus `verifyDeliveryReceipt`, `canonicalize`, `hashCanonical`, `keyRef`, `verificationRecipe`, `RECEIPT_VERSION`, the x402 header helpers `encodeX402PaymentHeader` / `decodeX402Header`, an `endpoints` constant (runtime, mcp, website) and `version`. An `exports` map keeps `xytara`, `xytara/client`, `xytara/lib/commerce_client`, `xytara/lib/delivery_receipt_verify`, `xytara/bin/*` and `xytara/package.json` resolvable.
-- **Delivery-receipt verification stands alone** — the verification side of `naxytra-delivery-receipt/1` (JCS canonical form, hashes, key refs, verifier, recipe) ships as `lib/delivery_receipt_verify.js`; issuing and signing stay in the hosted runtime and MCP executor.
-- **CLI** — `xytara release` is no longer part of the package (it prints a notice and exits 2); `xytara-release` is gone from `bin`. `xytara start-here`, `xytara first-run` and `xytara-run` are unchanged.
-- **Release gate** — `npm run verify:release-candidate` now runs with Node built-ins only, asserts the published tarball contains exactly the thin client file list, and runs `scripts/verify_client.js`: an offline check of the package surface, receipt verification (genuine, tampered, stripped, unsigned, untrusted key), the paid command path against a local stub of the runtime (discover, 402 challenge with x402 accepts, paid 200 with a signed receipt), and the CLIs. It also runs inside an installed `node_modules/xytara`.
-- **Docs** — README and START_HERE rewritten for the client: hosted endpoints, pricing ($0.01 USDC per call on Base mainnet, $0.001 on Base Sepolia, credits $1.00 = 400), a `CommerceClient` walk-through from discover to a verified receipt, and the public MCP integration guide. Self-hosting text, `npm start` and `.env.example` are gone.
-- Published through npm trusted publishing (GitHub OIDC) — no npm token involved.
+- **Free daily allowance** — every caller of the MCP server gets 20 free tool calls per UTC day, no key or wallet needed; each result reports the remaining allowance in `_meta["naxytra.com/allowance"]`.
+- **Spend-key mode** — a prepaid spend credential (`Authorization: Bearer xytara_spend_…`, `X-Naxytra-Key`, or `?key=` on the MCP URL for clients that cannot set headers) pays 3 credits per call from the runtime; failed calls are never debited, and a retried debit with the same id is never charged twice. The self-serve top-up ($1.00 USDC on Base = 400 credits) returns the key.
+- **Balance endpoint** — `GET /v1/credits/balance` with the spend credential; browser-callable (CORS) so the buy and setup pages can show it.
+- **Hosted-deploy hardening** — the credit lifecycle routes (reserve, release, reverse) now require the account's spend credential or the operator token; a bare account id is never authority.
+- **Payment-required results** now explain the allowance, the two ways to continue (spend key or x402) and the price. The server card no longer says "no API keys".
+- Client package (thin): unchanged surface; the MCP server itself is not distributed.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "xytara",
-  "version": "3.2.0",
+  "version": "3.2.1",
   "description": "Client for the hosted naxytra runtime: discover a capability, pay per call with x402 (gasless USDC on Base) or credits, get the deliverable and a signed delivery receipt you can verify offline. The runtime is a hosted service; this package is the client.",
   "main": "client.js",
   "exports": {