xytara 3.9.0 → 3.9.2

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (2) hide show
  1. package/RELEASE_NOTES.md +4 -3
  2. package/package.json +1 -1
package/RELEASE_NOTES.md CHANGED
@@ -1,5 +1,6 @@
1
- `xytara` 3.9.0 announces every provider offer in MCP discovery and lets anyone verify a delegation proof in the browser.
1
+ `xytara` 3.9.2 says, for every paid resource in x402 discovery, how an unpaid call is answered and what the advertised `payTo` means, and sends the runtime's `PAYMENT-REQUIRED` header in standard base64.
2
2
 
3
- - **Provider offers in MCP discovery** — `GET /mcp/discovery` on the MCP executor now carries `provider_offers` (every active provider's offer, including task_ref-only offers that cannot be a named MCP tool, each flagged `listed_as_mcp_tool` and with its execute route), `provider_tools` (the offer names listed in `tools/list`), the catalog source and the provider quickstart link. The catalog is refreshed in the background on discovery reads.
4
- - **Delegation-log explorer** — `https://www.naxytra.com/console` gains a public section: the log head, the hash-only feed and the current checkpoint (with its external binding when bound), and an offline proof check that recomputes every event's SHA-256 over its JCS form, replays the chain to the head, matches the checkpoint's subject and verifies the checkpoint's Ed25519 signature against the runtime's published keys — in the tab, nothing sent anywhere (the ML-DSA-65 leg is not checked by browsers).
3
+ - **Payment transport per resource** — `resource_details[]` in the runtime's and the MCP executor's `/.well-known/x402` now carries `payment_transport`: `http-402` (HTTP 402 with a `PAYMENT-REQUIRED` header) or `mcp-tool-result` (x402 MCP transport: HTTP 200 with a payment-required tool result), plus a one-line `payment_transport_detail`. An indexer that probes only for HTTP 402 can tell a working MCP endpoint from an unpaid one.
4
+ - **What `payTo` means** — `payment.pay_to` states that `payTo` is naxytra's settlement address for every paid call, provider-run tools included: it identifies who receives the payment, not who ran the call. Each provider's share is paid out to its own address by a weekly sweep once at least $1.00 is owed, and the signed delivery receipt names the provider that executed the call.
5
+ - **`PAYMENT-REQUIRED` in standard base64** — the runtime encoded the header as base64url, which browser clients decoding with `atob()` reject. It is now standard base64, like `PAYMENT-RESPONSE` and the MCP executor; the verifier checks the encoding and that the header decodes to exactly the body's `payment_required`.
5
6
  - Client package (thin): unchanged.
package/package.json CHANGED
@@ -1,6 +1,6 @@
1
1
  {
2
2
  "name": "xytara",
3
- "version": "3.9.0",
3
+ "version": "3.9.2",
4
4
  "description": "Client for the hosted naxytra runtime: discover a capability, pay per call with x402 (gasless USDC on Base) or credits, get the deliverable and a signed delivery receipt you can verify offline. The runtime is a hosted service; this package is the client.",
5
5
  "main": "client.js",
6
6
  "exports": {