xytara 2.4.0 → 2.5.0

package/OPERATIONS_RUNBOOK.md

@@ -34,6 +34,7 @@ Run:
 ```bash
 npm run verify:examples
 npm run verify:release-candidate
+npm run verify:production-readiness
 ```
 
 ## Partner-facing checks

package/README.md

@@ -18,6 +18,22 @@ This repo is the hot-state commerce layer. It does not define base proof semanti
 
 The 10-phase public program is now complete. `xytara` is in terminal closeout posture rather than active milestone build posture.
 
+## One-Line After Install
+
+If you only run two commands after install, use:
+
+- `xytara start-here`
+- `xytara release --summary`
+
+If you want the shortest machine-readable discovery path, inspect:
+
+- `GET /v1/providers`
+- `GET /v1/frameworks`
+- `GET /v1/protocols`
+- `GET /v1/integration-matrix`
+- `GET /v1/telemetry`
+- `GET /v1/provenance`
+
 ## Start Here
 
 If you are new to the public stack, use this order:

package/RELEASE_NOTES.md

@@ -1,29 +1,29 @@
-# xytara 2.4.0 Release Notes
+# xytara 2.5.0 Release Notes
 
-`xytara` 2.4.0 is the foundation-convergence line for runtime wallet, authority, identity, trust, registry, and participation.
+`xytara` 2.5.0 is the adoption-surface line for contracts, providers, frameworks, protocols, payment lanes, settlement lanes, observability, provenance, artifact distribution, and rollout portability.
 
 Highlights:
 
-- direct one-line machine execution with `xytara-run`
-- first-class wallet / ledger / lifecycle / reserve / commit / reversal inspection
-- first-class authority bindings with scoped and bounded contract enforcement
-- first-class machine-identity bindings, review, rotation, and operator bundle surfaces
-- explicit capability-registry, pricing-policy, quote-policy, trust-input, and trust-layer packages
-- multi-operator and external network participation packages with bounded admission flows
-- credits-first reusable spend posture with durable runtime economics state
-- native settlement-aware runtime inspection and proof-compatible handoff into `xoonya`
-- partner-ready onboarding, launch docs, and public example paths remain in place
+- umbrella CLI entrypoint with `xytara start-here`, plus `xytara run` and `xytara release`
+- first-class public contract lanes for `OpenAPI`, `AsyncAPI`, and `CloudEvents`
+- first-class provider, framework, protocol, and integration-matrix discovery surfaces
+- surfaced runtime breadth across `MCP`, `A2A`, `A2C`, `x402`, `Stripe MPP`, stablecoins, major rails, treasury, and registry-backed integrations
+- surfaced framework and ecosystem breadth including `LangGraph`, `LangChain`, `AutoGen`, `Semantic Kernel`, `CrewAI`, and `LlamaIndex`
+- surfaced protocol and transport breadth including `ACP`, `gRPC`, `Kafka`, `NATS`, `MQTT`, `ROS2`, and webhook event bus posture
+- first-class observability, provenance, artifact-distribution, shared-signals, and feature-control lanes
+- clearer install-and-use posture for humans, developers, and agents without widening the native runtime core
+- existing wallet / authority / identity / trust / capability / pricing / participation foundations remain in place
 
 Recommended first checks:
 
 1. `npm install xytara`
-2. `xytara-release --candidate --summary`
+2. `xytara start-here`
 3. `npm run verify:release-candidate`
 4. `node examples/partner_launch_walkthrough.js`
-5. inspect `/v1/economics/accounts/:account_id/wallet-ledger-bundle`
-6. inspect `/v1/economics/accounts/:account_id/authority-bundle`
-7. inspect `/v1/economics/accounts/:account_id/machine-identity-operator-bundle`
-8. inspect `/v1/capability-registry/package`
+5. inspect `/v1/providers`, `/v1/frameworks`, `/v1/protocols`, and `/v1/integration-matrix`
+6. inspect `/v1/mcp`, `/v1/a2a`, `/v1/a2c`, `/v1/x402`, and `/v1/settlement`
+7. inspect `/v1/telemetry`, `/v1/provenance`, `/v1/artifact-distribution`, `/v1/shared-signals`, and `/v1/feature-control`
+8. inspect `/v1/economics/accounts/:account_id/wallet-ledger-bundle`
 9. inspect `/v1/economics/accounts/:account_id/network-participation-package`
 
 Recommended first docs:

package/SERVICE_CONTRACT.md

@@ -7,6 +7,60 @@ This file freezes the public service contract for `xytara`.
 Core routes:
 
 - `GET /health`
+- `GET /openapi.json`
+- `GET /v1/openapi`
+- `GET /v1/openapi/summary`
+- `GET /asyncapi.json`
+- `GET /v1/asyncapi`
+- `GET /v1/asyncapi/summary`
+- `GET /cloudevents.json`
+- `GET /v1/cloudevents`
+- `GET /v1/cloudevents/summary`
+- `GET /v1/auth-profiles`
+- `GET /v1/auth-profiles/summary`
+- `GET /v1/identity-interop`
+- `GET /v1/identity-interop/summary`
+- `GET /v1/providers`
+- `GET /v1/providers/summary`
+- `GET /v1/frameworks`
+- `GET /v1/frameworks/summary`
+- `GET /v1/protocols`
+- `GET /v1/protocols/summary`
+- `GET /v1/integration-matrix`
+- `GET /v1/integration-matrix/summary`
+- `GET /v1/mcp`
+- `GET /v1/mcp/summary`
+- `GET /v1/mcp/tools`
+- `GET /v1/a2a`
+- `GET /v1/a2a/summary`
+- `GET /v1/a2c`
+- `GET /v1/a2c/summary`
+- `GET /v1/x402`
+- `GET /v1/x402/summary`
+- `GET /v1/settlement`
+- `GET /v1/settlement/summary`
+- `GET /v1/stripe-mpp`
+- `GET /v1/stripe-mpp/summary`
+- `GET /v1/stablecoins`
+- `GET /v1/stablecoins/summary`
+- `GET /v1/major-rails`
+- `GET /v1/major-rails/summary`
+- `GET /v1/treasury`
+- `GET /v1/treasury/summary`
+- `GET /v1/erc8004`
+- `GET /v1/erc8004/summary`
+- `GET /v1/event-systems`
+- `GET /v1/event-systems/summary`
+- `GET /v1/telemetry`
+- `GET /v1/telemetry/summary`
+- `GET /v1/provenance`
+- `GET /v1/provenance/summary`
+- `GET /v1/artifact-distribution`
+- `GET /v1/artifact-distribution/summary`
+- `GET /v1/shared-signals`
+- `GET /v1/shared-signals/summary`
+- `GET /v1/feature-control`
+- `GET /v1/feature-control/summary`
 - `GET /v1/catalog`
 - `GET /v1/catalog/summary`
 - `GET /v1/catalog/task?ref=<task_ref_or_alias>`
@@ -15,6 +69,11 @@ Core routes:
 - `GET /v1/credit-packs`
 - `GET /v1/credit-packs/summary`
 - `GET /v1/credit-pack?ref=<pack_id>`
+- `GET /v1/integrations`
+- `GET /v1/integrations/summary`
+- `GET /v1/integrations/classes`
+- `GET /v1/integrations/protocols`
+- `GET /v1/integrations/settlement-modes`
 - `GET /v1/account-auth/spend-credentials`
 - `POST /v1/account-auth/spend-credentials`
 - `GET /v1/account-auth/spend-credentials/:credential_id`
@@ -26,6 +85,22 @@ Core routes:
 Operational note:
 
 - for production acceptance, `POST /x402/commands/execute` and `POST /x402/mcp/tools/invoke` should normally run with `XYTARA_PAYMENT_VERIFICATION_MODE=local_signed` or a stronger verifier mode
+- `GET /v1/identity-interop` exposes how native authority and machine identity map to `JWT`, `DID/VC`, and `SD-JWT VC` interop lanes without replacing the native runtime authority model
+- `GET /v1/x402` exposes the first-class quote -> challenge -> pay -> execute lane for paid machine execution
+- `GET /v1/settlement` exposes the settlement family map across native BSV/Teranode, EVM/Base/USDC, and the major-rails family
+- `GET /v1/stripe-mpp` exposes the hosted-checkout and external-funding entry lane without making provider-specific checkout semantics the center of the stack
+- `GET /v1/stablecoins` exposes the current USDC/Base runtime family and marks Circle Nanopayments/CCTP as adapter-ready extensions instead of pretending they are already core first-party rails
+- `GET /v1/major-rails` exposes Solana plus the Antelope/Proton XPR/Metal family as one practical non-default settlement lane
+- `GET /v1/treasury` exposes the treasury-connectivity posture and the internal reserve doctrine of BSV/Teranode plus DAI/USDC, with Monero retained only as an optional hidden privacy reserve
+- `GET /v1/providers` exposes the OpenAI Codex and Claude/MCP family as first-class provider entry lanes
+- `GET /v1/frameworks` exposes LangGraph, LangChain, AutoGen, and Semantic Kernel as the primary runtime framework lanes, with CrewAI and LlamaIndex surfaced as registry-backed framework breadth
+- `GET /v1/protocols` exposes the canonical protocol and transport family across MCP, A2A, A2C, ACP, gRPC, Kafka, NATS, MQTT, ROS2, and webhook-event-bus posture
+- `GET /v1/integration-matrix` exposes the canonical public view across providers, frameworks, protocols, payments, settlement families, and registry-backed integrations
+- `GET /v1/telemetry` exposes the OpenTelemetry-aligned observability posture across runtime traces, metrics, logs, and event carry
+- `GET /v1/provenance` exposes the SLSA-aligned release and execution provenance posture for runtime trust and adoption
+- `GET /v1/artifact-distribution` exposes OCI-style artifact distribution posture for adapters, submission bundles, registry snapshots, and release artifacts
+- `GET /v1/shared-signals` exposes OpenID Shared Signals and CAEP-aligned risk and identity event exchange posture without replacing native runtime decisions
+- `GET /v1/feature-control` exposes OpenFeature/OFREP-aligned rollout and policy portability posture across pricing, authority, identity, trust, and release gates
 - accepted payments then flow into payment-ledger, treasury-summary, rail-summary, and reconciliation surfaces
 - the default first-party settlement posture is now `bsv_teranode`, and `x402` challenge quotes carry native BSV/Teranode settlement hints when that default path is in use
 - in production, `POST /v1/credit-bridge/grants` should normally require `authorization: Bearer <token>` backed by `XYTARA_CREDIT_BRIDGE_BEARER_TOKEN`

package/START_HERE.md

@@ -47,12 +47,46 @@ npm run verify:all
 
 This is the production-confidence check for the published package surface.
 
+If you are evaluating a real deployment that will use grants, credits, entitlements, or usage meters, also run:
+
+```bash
+npm run verify:production-readiness
+```
+
+That gate is stricter than local verification and expects runtime persistence to be configured through `XYTARA_STATE_FILE` on persistent disk or `XYTARA_SUPABASE_*`.
+
 ## 4. Read The Durable Contract
 
 For long-term product understanding, read:
 
 - [FINAL_CONTRACT.md](C:/Users/Yoga/Desktop/workspace/vscode_workspace_public/naxytra/xytara/FINAL_CONTRACT.md)
 - [SERVICE_CONTRACT.md](C:/Users/Yoga/Desktop/workspace/vscode_workspace_public/naxytra/xytara/SERVICE_CONTRACT.md)
+- `GET /openapi.json`
+- `GET /asyncapi.json`
+- `GET /cloudevents.json`
+- `GET /v1/auth-profiles`
+- `GET /v1/identity-interop`
+- `GET /v1/providers`
+- `GET /v1/frameworks`
+- `GET /v1/protocols`
+- `GET /v1/integration-matrix`
+- `GET /v1/telemetry`
+- `GET /v1/provenance`
+- `GET /v1/artifact-distribution`
+- `GET /v1/shared-signals`
+- `GET /v1/feature-control`
+- `GET /v1/mcp`
+- `GET /v1/a2a`
+- `GET /v1/a2c`
+- `GET /v1/x402`
+- `GET /v1/settlement`
+- `GET /v1/stripe-mpp`
+- `GET /v1/stablecoins`
+- `GET /v1/major-rails`
+- `GET /v1/treasury`
+- `GET /v1/erc8004`
+- `GET /v1/event-systems`
+- `GET /v1/integrations`
 - [PROGRAM_STATUS.md](C:/Users/Yoga/Desktop/workspace/vscode_workspace_public/naxytra/xytara/PROGRAM_STATUS.md)
 - [OPERATOR_START_HERE.md](C:/Users/Yoga/Desktop/workspace/vscode_workspace_public/naxytra/xytara/OPERATOR_START_HERE.md)
 - [OPERATIONS_RUNBOOK.md](C:/Users/Yoga/Desktop/workspace/vscode_workspace_public/naxytra/xytara/OPERATIONS_RUNBOOK.md)
@@ -83,6 +117,12 @@ It is:
 
 discover -> preview/quote -> execute -> inspect -> hand off to `xoonya`
 
+If you want the shortest CLI-first read of the package after install, use:
+
+- `xytara start-here`
+- `xytara release --summary`
+- `xytara run --help`
+
 ## 7. If You Are Operating The Closed Program
 
 Use:

package/bin/xytara.js

@@ -0,0 +1,55 @@
+#!/usr/bin/env node
+"use strict";
+
+const path = require("path");
+const { spawnSync } = require("child_process");
+
+function printUsage() {
+  process.stdout.write([
+    "Usage: xytara <command> [options]",
+    "",
+    "Commands:",
+    "  release [args]    Open the release/adoption/reporting surface",
+    "  run [args]        Execute the paid runtime command path",
+    "  start-here        Print the shortest first-run path",
+    "  help              Show this help message",
+    "",
+    "Fastest first run:",
+    "  xytara start-here",
+    "  xytara release --summary",
+    "  xytara run --help"
+  ].join("\n"));
+}
+
+function printStartHere() {
+  process.stdout.write([
+    "xytara start-here",
+    "",
+    "1. xytara release --summary",
+    "2. node examples/quickstart.js",
+    "3. npm run verify:all",
+    "4. Inspect /v1/providers, /v1/frameworks, /v1/protocols, /v1/integration-matrix",
+    "5. Continue into MCP/A2A/A2C/x402/settlement lanes as needed"
+  ].join("\n"));
+}
+
+function delegate(scriptName, args) {
+  const scriptPath = path.join(__dirname, scriptName);
+  const result = spawnSync(process.execPath, [scriptPath, ...args], { stdio: "inherit" });
+  process.exitCode = typeof result.status === "number" ? result.status : 1;
+}
+
+const [command, ...rest] = process.argv.slice(2);
+
+if (!command || command === "help" || command === "--help" || command === "-h") {
+  printUsage();
+} else if (command === "start-here" || command === "--start-here") {
+  printStartHere();
+} else if (command === "release") {
+  delegate("xytara-release.js", rest);
+} else if (command === "run") {
+  delegate("xytara-run.js", rest);
+} else {
+  printUsage();
+  process.exitCode = 1;
+}

package/index.js

@@ -94,7 +94,7 @@ const {
 } = require("./integrations/registry");
 
 const COMMERCE_SDK_NAME = "xytara";
-const COMMERCE_SDK_VERSION = "2.2.0";
+const COMMERCE_SDK_VERSION = "2.5.0";
 const COMMERCE_API_VERSION = "v1";
 
 function createClient(options) {

package/lib/a2a_lane_contract.js

@@ -0,0 +1,104 @@
+"use strict";
+
+const {
+  buildPrecommitInteractionPackCatalog,
+  buildInteractionSpinePathCatalog,
+  buildTransactionClassPackCatalog,
+  summarizePrecommitInteractionPacks,
+  summarizeInteractionSpinePaths,
+  summarizeTransactionClassPacks,
+  buildDefaultTransactionCenter,
+  summarizeDefaultTransactionCenter
+} = require("./catalog_contract");
+
+function buildA2ALanePack() {
+  const center = buildDefaultTransactionCenter();
+  const centerSummary = summarizeDefaultTransactionCenter();
+  const precommitCatalog = buildPrecommitInteractionPackCatalog();
+  const spineCatalog = buildInteractionSpinePathCatalog();
+  const classCatalog = buildTransactionClassPackCatalog();
+  const precommitPacks = Array.isArray(precommitCatalog.packs) ? precommitCatalog.packs : [];
+  const spinePaths = Array.isArray(spineCatalog.paths) ? spineCatalog.paths : [];
+  const classPacks = Array.isArray(classCatalog.class_packs) ? classCatalog.class_packs : [];
+
+  const readinessPack = precommitPacks.find((entry) => entry.precommit_pack_ref === "precommit.a2a.settlement.readiness") || null;
+  const settlementSpine = spinePaths.find((entry) => entry.spine_path_ref === "spine.a2a.settlement") || null;
+  const committedClass = classPacks.find((entry) => entry.class_pack_ref === "transaction.admission.settlement") || null;
+
+  return {
+    product: "xytara",
+    category: "machine-commerce-a2a-lane-pack",
+    pack_version: "xytara-a2a-lane-pack-v1",
+    lane_state: "first_party_a2a_present",
+    default_protocol: "a2a",
+    default_payment_protocol: centerSummary.default_payment_protocol,
+    default_settlement_mode: centerSummary.default_settlement_mode,
+    default_transaction_center: center,
+    readiness_pack: readinessPack,
+    settlement_spine: settlementSpine,
+    committed_class_pack: committedClass,
+    precommit_summary: summarizePrecommitInteractionPacks(),
+    spine_summary: summarizeInteractionSpinePaths(),
+    class_summary: summarizeTransactionClassPacks(),
+    first_run_flows: [
+      {
+        flow_ref: "precommit.a2a.settlement.readiness",
+        recommended_reason: "best first A2A readiness and negotiation view",
+        example_surfaces: {
+          negotiate_ref: "/v1/a2a/negotiate",
+          admission_preview_ref: "/v1/admission/preview",
+          commit_ref: "/v1/a2a/commit"
+        }
+      },
+      {
+        flow_ref: "spine.a2a.settlement",
+        recommended_reason: "best first full A2A settlement path",
+        example_surfaces: {
+          flow_ref: "/v1/a2a",
+          settlement_flow_ref: "/v1/a2a/flows/settlement",
+          cross_zone_preview_ref: "/v1/coordination-center/cross-zone-preview"
+        }
+      }
+    ],
+    supported_surfaces: {
+      negotiate_ref: "/v1/a2a/negotiate",
+      commit_ref: "/v1/a2a/commit",
+      settlement_flow_ref: "/v1/a2a/flows/settlement",
+      admission_preview_ref: "/v1/admission/preview",
+      handshake_preview_ref: "/v1/coordination-center/handshake-preview",
+      cross_zone_preview_ref: "/v1/coordination-center/cross-zone-preview",
+      auth_profile_ref: "/v1/auth-profiles",
+      openapi_ref: "/openapi.json",
+      asyncapi_ref: "/asyncapi.json",
+      cloudevents_ref: "/cloudevents.json"
+    },
+    recommended_sequence: [
+      "preview_counterparty_and_task_pack_intent",
+      "negotiate_a2a",
+      "preview_admission_posture",
+      "commit_a2a",
+      "run_settlement_spine_or_committed_class",
+      "inspect_transaction_and_proof_followthrough"
+    ]
+  };
+}
+
+function summarizeA2ALanePack() {
+  const pack = buildA2ALanePack();
+  return {
+    product: "xytara",
+    category: "machine-commerce-a2a-lane-pack-summary",
+    summary_version: "xytara-a2a-lane-pack-summary-v1",
+    lane_state: pack.lane_state,
+    default_payment_protocol: pack.default_payment_protocol,
+    default_settlement_mode: pack.default_settlement_mode,
+    first_run_flow_count: pack.first_run_flows.length,
+    settlement_spine_ref: pack.settlement_spine ? pack.settlement_spine.spine_path_ref : null,
+    linked_surfaces: pack.supported_surfaces
+  };
+}
+
+module.exports = {
+  buildA2ALanePack,
+  summarizeA2ALanePack
+};

package/lib/a2c_lane_contract.js

@@ -0,0 +1,111 @@
+"use strict";
+
+const {
+  buildDefaultTransactionTaskPackCatalog,
+  buildDefaultTransactionGuidedLoopCatalog,
+  buildPrecommitInteractionPackCatalog,
+  buildInteractionSpinePathCatalog,
+  summarizeDefaultTransactionTaskPacks,
+  summarizeDefaultTransactionGuidedLoops,
+  summarizePrecommitInteractionPacks,
+  summarizeInteractionSpinePaths,
+  buildDefaultTransactionCenter,
+  summarizeDefaultTransactionCenter
+} = require("./catalog_contract");
+
+function buildA2CLanePack() {
+  const center = buildDefaultTransactionCenter();
+  const centerSummary = summarizeDefaultTransactionCenter();
+  const taskPackCatalog = buildDefaultTransactionTaskPackCatalog();
+  const guidedLoopCatalog = buildDefaultTransactionGuidedLoopCatalog();
+  const precommitCatalog = buildPrecommitInteractionPackCatalog();
+  const spineCatalog = buildInteractionSpinePathCatalog();
+
+  const taskPacks = Array.isArray(taskPackCatalog.packs) ? taskPackCatalog.packs : [];
+  const guidedLoops = Array.isArray(guidedLoopCatalog.loops) ? guidedLoopCatalog.loops : [];
+  const precommitPacks = Array.isArray(precommitCatalog.packs) ? precommitCatalog.packs : [];
+  const spinePaths = Array.isArray(spineCatalog.paths) ? spineCatalog.paths : [];
+
+  const defaultTaskPack = taskPacks.find((entry) => entry.pack_ref === "default.a2c.tooling.run") || null;
+  const defaultGuidedLoop = guidedLoops.find((entry) => entry.loop_ref === "default.a2c.tooling.loop") || null;
+  const readinessPack = precommitPacks.find((entry) => entry.precommit_pack_ref === "precommit.a2c.tooling.readiness") || null;
+  const toolingSpine = spinePaths.find((entry) => entry.spine_path_ref === "spine.a2c.tooling") || null;
+
+  return {
+    product: "xytara",
+    category: "machine-commerce-a2c-lane-pack",
+    pack_version: "xytara-a2c-lane-pack-v1",
+    lane_state: "first_party_a2c_present",
+    default_protocol: "a2c",
+    default_payment_protocol: centerSummary.default_payment_protocol,
+    default_settlement_mode: centerSummary.default_settlement_mode,
+    default_transaction_center: center,
+    default_task_pack: defaultTaskPack,
+    default_guided_loop: defaultGuidedLoop,
+    readiness_pack: readinessPack,
+    tooling_spine: toolingSpine,
+    task_pack_summary: summarizeDefaultTransactionTaskPacks(),
+    guided_loop_summary: summarizeDefaultTransactionGuidedLoops(),
+    precommit_summary: summarizePrecommitInteractionPacks(),
+    spine_summary: summarizeInteractionSpinePaths(),
+    first_run_flows: [
+      {
+        flow_ref: "precommit.a2c.tooling.readiness",
+        recommended_reason: "best first A2C readiness and session-preview path",
+        example_surfaces: {
+          session_open_ref: "/v1/a2c/sessions/open",
+          pack_preview_ref: "/v1/a2c/packs/preview",
+          admission_preview_ref: "/v1/admission/preview"
+        }
+      },
+      {
+        flow_ref: "default.a2c.tooling.run",
+        recommended_reason: "best first committed A2C-to-MCP tooling path",
+        example_surfaces: {
+          lane_ref: "/v1/a2c",
+          tooling_flow_ref: "/v1/a2c/flows/tooling",
+          mcp_lane_ref: "/v1/mcp"
+        }
+      }
+    ],
+    supported_surfaces: {
+      session_open_ref: "/v1/a2c/sessions/open",
+      pack_preview_ref: "/v1/a2c/packs/preview",
+      tooling_flow_ref: "/v1/a2c/flows/tooling",
+      admission_preview_ref: "/v1/admission/preview",
+      mcp_lane_ref: "/v1/mcp",
+      auth_profile_ref: "/v1/auth-profiles",
+      openapi_ref: "/openapi.json",
+      asyncapi_ref: "/asyncapi.json",
+      cloudevents_ref: "/cloudevents.json"
+    },
+    recommended_sequence: [
+      "open_a2c_session",
+      "preview_a2c_pack",
+      "inspect_admission_posture",
+      "run_default_a2c_tooling_flow",
+      "invoke_the_underlying_mcp_tool_path",
+      "inspect_transaction_and_proof_followthrough"
+    ]
+  };
+}
+
+function summarizeA2CLanePack() {
+  const pack = buildA2CLanePack();
+  return {
+    product: "xytara",
+    category: "machine-commerce-a2c-lane-pack-summary",
+    summary_version: "xytara-a2c-lane-pack-summary-v1",
+    lane_state: pack.lane_state,
+    default_payment_protocol: pack.default_payment_protocol,
+    default_settlement_mode: pack.default_settlement_mode,
+    first_run_flow_count: pack.first_run_flows.length,
+    default_task_pack_ref: pack.default_task_pack ? pack.default_task_pack.pack_ref : null,
+    linked_surfaces: pack.supported_surfaces
+  };
+}
+
+module.exports = {
+  buildA2CLanePack,
+  summarizeA2CLanePack
+};

package/lib/artifact_distribution_lane_contract.js

@@ -0,0 +1,54 @@
+"use strict";
+
+function buildArtifactDistributionLanePack() {
+  return {
+    product: "xytara",
+    category: "machine-commerce-artifact-distribution-lane-pack",
+    pack_version: "xytara-artifact-distribution-lane-pack-v1",
+    lane_state: "first_party_artifact_distribution_lane_present",
+    posture: "oci_style_distribution_and_export_lane",
+    standards: ["oci_artifacts", "oras_style_distribution"],
+    artifact_families: ["adapter_packs", "submission_bundles", "registry_snapshots", "release_artifacts"],
+    supported_surfaces: {
+      integrations_ref: "/v1/integrations",
+      integration_snapshot_ref: "/v1/integrations/review/registry-snapshot",
+      adapter_pack_ref: "/v1/adapter-pack",
+      release_center_ref: "/v1/release-center",
+      release_pack_ref: "/v1/release-pack"
+    },
+    first_run_flows: [
+      {
+        flow_ref: "artifact_distribution_alignment",
+        recommended_reason: "best path for teams that want portable adapter, registry, and release artifacts instead of ad hoc zip-and-doc distribution",
+        sequence: [
+          "inspect_artifact_distribution_lane_summary",
+          "inspect_adapter_and_registry_export_surfaces",
+          "treat_release_and_submission bundles as distribution-ready artifacts",
+          "publish_or_transfer_artifacts through standard registries later without changing canonical shapes"
+        ]
+      }
+    ],
+    guardrails: [
+      "artifact portability should preserve canonical bundle shapes instead of inventing a second artifact model",
+      "distribution posture should remain subordinate to runtime, proof, and integration truth"
+    ]
+  };
+}
+
+function summarizeArtifactDistributionLanePack() {
+  const pack = buildArtifactDistributionLanePack();
+  return {
+    product: "xytara",
+    category: "machine-commerce-artifact-distribution-lane-pack-summary",
+    summary_version: "xytara-artifact-distribution-lane-pack-summary-v1",
+    lane_state: pack.lane_state,
+    standard_count: pack.standards.length,
+    artifact_family_count: pack.artifact_families.length,
+    linked_surfaces: pack.supported_surfaces
+  };
+}
+
+module.exports = {
+  buildArtifactDistributionLanePack,
+  summarizeArtifactDistributionLanePack
+};