xytara 3.9.1 → 3.9.3

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (2) hide show
  1. package/RELEASE_NOTES.md +5 -4
  2. package/package.json +1 -1
package/RELEASE_NOTES.md CHANGED
@@ -1,6 +1,7 @@
1
- `xytara` 3.9.1 gives the runtime host its own x402 discovery entry and advertises an honest price range wherever one URL carries calls at different prices.
1
+ `xytara` 3.9.3 keeps every delegation-log checkpoint retrievable, so a checkpoint anchored elsewhere by its digest can always be fetched and checked.
2
2
 
3
- - **Runtime `/.well-known/x402`** — the runtime host (`/.well-known/x402`, alias `/.well-known/x402.json`) now serves a discovery entry for its own paid routes only (`/x402/commands/execute`, `/x402/mcp/tools/invoke`, `/x402/credits/topup`), with the configured accepts, a link to its OpenAPI document and the provider-network contract. It answers 404 when the runtime takes no x402 payments.
4
- - **Price range in discovery** — on the runtime entry and the MCP executor's `/.well-known/x402`, each payment option keeps `amount` (the cheapest call) and adds `maxAmount`, plus `minAmount` when some calls cost less, in the shape the x402 discovery working group is converging on. The MCP executor's range spans the standard and attesting tools and widens to any listed provider tool's own price; the runtime's widens to active provider offers. The live payment-required challenge stays authoritative for each call.
5
- - **Verifiers** — the MCP executor verifier checks that the `PAYMENT-REQUIRED` header and the challenge body carry identical terms on `/mcp` and `/mcp/http402`; the runtime state-guard verifier exits on failure instead of holding `verify:all` open.
3
+ - **Durable checkpoints** — every checkpoint the runtime issues is stored in the durable runtime state. While the log head and the external binding are unchanged, the stored checkpoint is served again instead of being re-signed, so a restart or a deploy no longer replaces it (it is re-signed only if its signing keys are no longer published).
4
+ - **Checkpoints by id** — `GET /v1/delegation-log/checkpoints` lists every issued checkpoint, newest first (id, `attestation_sha256`, head, binding tag, time; digests only), and `GET /v1/delegation-log/checkpoints/:id` returns one byte-identical, verifiable with the published keys. `GET /v1/delegation-log/checkpoint` still returns the current one.
5
+ - **Anchoring record** — `scripts/record_delegation_checkpoint.js` now points the anchoring party at the checkpoint's permanent by-id URL.
6
+ - **Verifier** — the delegation-log verifier runs two real server processes on one state file and checks that the unchanged head is served the same checkpoint after the restart and that it stays fetchable by id; the state-guard verifier checks the new collection is declared.
6
7
  - Client package (thin): unchanged.
package/package.json CHANGED
@@ -1,6 +1,6 @@
1
1
  {
2
2
  "name": "xytara",
3
- "version": "3.9.1",
3
+ "version": "3.9.3",
4
4
  "description": "Client for the hosted naxytra runtime: discover a capability, pay per call with x402 (gasless USDC on Base) or credits, get the deliverable and a signed delivery receipt you can verify offline. The runtime is a hosted service; this package is the client.",
5
5
  "main": "client.js",
6
6
  "exports": {