xytara 3.2.0 → 3.2.2

package/RELEASE_NOTES.md

@@ -1,9 +1,5 @@
-`xytara` 3.2.0 turns the npm package into a thin client for the hosted naxytra runtime. The runtime is a hosted service; this package is the client. The server is not distributed.
+`xytara` 3.2.2 adds a per-request opt-out from the MCP server's free allowance and repairs the registry publish.
 
-- **What the package now contains** — `client.js` (the entry), the buyer-side `CommerceClient`, the delivery-receipt verifier, the `xytara` / `xytara-run` CLIs, two offline verification scripts, and the docs. Nothing else: no server, no payment or settlement engine, no routing, no state store, no fixtures, adapters, integrations or operator tooling.
-- **`require("xytara")` is now the client surface** — `CommerceClient` and the commerce helpers as before, plus `verifyDeliveryReceipt`, `canonicalize`, `hashCanonical`, `keyRef`, `verificationRecipe`, `RECEIPT_VERSION`, the x402 header helpers `encodeX402PaymentHeader` / `decodeX402Header`, an `endpoints` constant (runtime, mcp, website) and `version`. An `exports` map keeps `xytara`, `xytara/client`, `xytara/lib/commerce_client`, `xytara/lib/delivery_receipt_verify`, `xytara/bin/*` and `xytara/package.json` resolvable.
-- **Delivery-receipt verification stands alone** — the verification side of `naxytra-delivery-receipt/1` (JCS canonical form, hashes, key refs, verifier, recipe) ships as `lib/delivery_receipt_verify.js`; issuing and signing stay in the hosted runtime and MCP executor.
-- **CLI** — `xytara release` is no longer part of the package (it prints a notice and exits 2); `xytara-release` is gone from `bin`. `xytara start-here`, `xytara first-run` and `xytara-run` are unchanged.
-- **Release gate** — `npm run verify:release-candidate` now runs with Node built-ins only, asserts the published tarball contains exactly the thin client file list, and runs `scripts/verify_client.js`: an offline check of the package surface, receipt verification (genuine, tampered, stripped, unsigned, untrusted key), the paid command path against a local stub of the runtime (discover, 402 challenge with x402 accepts, paid 200 with a signed receipt), and the CLIs. It also runs inside an installed `node_modules/xytara`.
-- **Docs** — README and START_HERE rewritten for the client: hosted endpoints, pricing ($0.01 USDC per call on Base mainnet, $0.001 on Base Sepolia, credits $1.00 = 400), a `CommerceClient` walk-through from discover to a verified receipt, and the public MCP integration guide. Self-hosting text, `npm start` and `.env.example` are gone.
-- Published through npm trusted publishing (GitHub OIDC) — no npm token involved.
+- **`X-Naxytra-Allowance: off`** (or `?allowance=off` on the MCP URL) skips the free daily allowance for that request, so x402-native clients, payment-flow tests and release probes get deterministic pay-per-call behaviour (the payment-required result). Opting out never spends the allowance.
+- The MCP registry publish workflow now waits for the live deploy without tripping on transient errors and probes the payment challenge with the allowance switched off.
+- Client package (thin): unchanged surface.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "xytara",
-  "version": "3.2.0",
+  "version": "3.2.2",
   "description": "Client for the hosted naxytra runtime: discover a capability, pay per call with x402 (gasless USDC on Base) or credits, get the deliverable and a signed delivery receipt you can verify offline. The runtime is a hosted service; this package is the client.",
   "main": "client.js",
   "exports": {