xytara 3.9.4 → 3.9.6

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (2) hide show
  1. package/RELEASE_NOTES.md +4 -4
  2. package/package.json +1 -1
package/RELEASE_NOTES.md CHANGED
@@ -1,6 +1,6 @@
1
- `xytara` 3.9.4 keeps the signed bytes of every anchored attestation fetchable, across restarts and deploys.
1
+ `xytara` 3.9.6 prepares native BSV settlement for the end of the Teranode-hosted ARC instance (2026-11-30).
2
2
 
3
- - **Attestation archive** — `POST /v1/attestations/archive { attestation }` stores an attestation durably and `GET /v1/attestations/:id` returns it byte-identical. Anyone may submit one, because only naxytra's own records are accepted: the signature must verify against the runtime's published keys (for its own attestations) or the MCP executor's published keys (for the executor's), and the attestation must carry an external anchoring binding (`ctp/1`). A delegation-log checkpoint is restored into the checkpoint store only if its head is a real head of this runtime's log, and a restored older checkpoint never replaces the current one.
4
- - **MCP executor** — every attestation it issues with an external binding is archived on the runtime as it is issued. `GET /attestations/<id>` serves from memory, and falls back to the archive when the in-memory copy is gone (re-verified against the executor's own keys; the response says `source: "archive"`). `/health` reports archive counters.
5
- - **Verifiers** — the delegation-log verifier covers the archive (own signed and anchored records only; idempotent; tampered, forged, foreign-issuer and fake-head records refused; executor keys); the executor verifier archives a bound attestation through a real runtime, wipes its in-memory copy, and gets it back byte-identical.
3
+ - **Keyless broadcast endpoints** — `XYTARA_BSV_ARC_RPC_KEYLESS=1` declares that the broadcast endpoint needs no API key, as with the public BSV Broadcaster instances (ARC's successor, same `POST /tx { rawTx }` request and `202 { txid }` answer). Readiness then reports `settlement_transport_auth: "keyless_endpoint"` instead of a missing-key blocker; without the declaration a missing key in arc mode is still a blocker. Readiness now names the auth state (`api_key`, `keyless_endpoint`, `missing`, `not_applicable`).
4
+ - **Runbook** — the BSV runbook lists what depends on the hosted ARC instance (native BSV settlement submission only; x402 on Base, BOLT and settlement observation do not) and the cutover environment.
5
+ - **Verifiers** — a keyless submission to a mock broadcaster (ARC-shaped body, no auth header, 202 read as submitted) and the three readiness states.
6
6
  - Client package (thin): unchanged.
package/package.json CHANGED
@@ -1,6 +1,6 @@
1
1
  {
2
2
  "name": "xytara",
3
- "version": "3.9.4",
3
+ "version": "3.9.6",
4
4
  "description": "Client for the hosted naxytra runtime: discover a capability, pay per call with x402 (gasless USDC on Base) or credits, get the deliverable and a signed delivery receipt you can verify offline. The runtime is a hosted service; this package is the client.",
5
5
  "main": "client.js",
6
6
  "exports": {