xytara 3.9.9 → 3.9.11

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (2) hide show
  1. package/RELEASE_NOTES.md +4 -4
  2. package/package.json +1 -1
package/RELEASE_NOTES.md CHANGED
@@ -1,6 +1,6 @@
1
- `xytara` 3.9.9 makes the pay-per-call MCP server answer plain probes.
1
+ `xytara` 3.9.11 adds the stateless MCP protocol (2026-07-28) to the pay-per-call MCP server and makes provider-tool payments catalogable by the CDP Bazaar.
2
2
 
3
- - **`GET /mcp` without `Accept: text/event-stream`** (a health probe, an indexer, a browser) now returns `200` with a short JSON description of the endpoint: transport (`streamable-http`), how to call it (POST JSON-RPC), how payment is requested on that path, and links to the free discovery summary and `/.well-known/x402`. `HEAD` answers the same way. Indexers that check endpoints with a plain `GET` no longer list a working server as down. The same applies to `/mcp/http402`.
4
- - A `GET` asking for an event stream, and `DELETE`, still return `405` with `Allow: POST`, as the MCP Streamable HTTP transport specifies for a server without a server-initiated stream.
5
- - Neither answer asks for payment.
3
+ - **MCP 2026-07-28 (stateless, SEP-2575)** at `https://mcp.naxytra.com/mcp`: `server/discover` answers with the supported versions (`2026-07-28` first, then the handshake versions back to `2024-11-05`), the server capabilities, instructions and `serverInfo` (in result `_meta`, and top-level for SDKs built against the SEP as accepted). Requests that carry `io.modelcontextprotocol/protocolVersion` in `_meta` work without `initialize`, and the client is identified from `_meta` clientInfo. An unsupported version declared that way gets `-32022` with `supported` / `requested` and HTTP 400; an unknown method on a stateless request gets HTTP 404. Handshake clients (`initialize`) behave exactly as before, and the `MCP-Protocol-Version` header alone never changes that. CORS allows the `Mcp-Method` and `Mcp-Name` headers.
4
+ - **Bazaar for provider tools:** a paid call to an independent provider's tool now reaches the payment facilitator with the server's resource (priced at the offer the buyer paid) and discovery extension when the buyer's client leaves them out, as own tools already did. The signed authorization is unchanged.
5
+ - The daily buyer-journey report names the method and route for failures that carry no other detail, such as a runtime route that does not exist.
6
6
  - No change to pricing, payment, routing, the provider ledger or the client package.
package/package.json CHANGED
@@ -1,6 +1,6 @@
1
1
  {
2
2
  "name": "xytara",
3
- "version": "3.9.9",
3
+ "version": "3.9.11",
4
4
  "description": "Client for the hosted naxytra runtime: discover a capability, pay per call with x402 (gasless USDC on Base) or credits, get the deliverable and a signed delivery receipt you can verify offline. The runtime is a hosted service; this package is the client.",
5
5
  "main": "client.js",
6
6
  "exports": {