@bluefly/openstandardagents 0.4.4 → 0.4.6

package/dist/services/trust/trust.service.js

@@ -0,0 +1,199 @@
+/**
+ * OSSA Trust Verification Service
+ *
+ * Verifies agent `x-signature` blocks using:
+ *   - @noble/ed25519  for Ed25519 (default, fastest)
+ *   - jose            for JWT, JWK, VC, ECDSA, RSA-PSS (IETF-standard)
+ *   - did-resolver    for DID document resolution (did:web, did:key)
+ *   - json-canonicalize for RFC 8785 canonical form (payload that was signed)
+ *
+ * NO custom cryptographic primitives — only audited open-source libraries.
+ */
+import * as ed from '@noble/ed25519';
+// @noble/ed25519 v2 has internal SHA-512 — no separate import needed
+import { Resolver } from 'did-resolver';
+import { compactVerify, importJWK, importSPKI, jwtVerify } from 'jose';
+import { getResolver as webResolver } from 'web-did-resolver';
+// @ts-ignore — json-canonicalize is CJS
+import canonicalize from 'json-canonicalize';
+/** Build a DID resolver supporting did:web and did:key */
+const didResolver = new Resolver({ ...webResolver() });
+/**
+ * Canonicalize the agent manifest using RFC 8785 (json-canonicalize),
+ * then return the UTF-8 bytes. This is the payload that x-signature.value signs.
+ */
+export function canonicalManifestBytes(manifest) {
+    // Remove x-signature from the manifest before canonicalizing — it must not
+    // be part of the signed payload (same as JWT header exclusion)
+    const { metadata, ...rest } = manifest;
+    const meta = metadata;
+    const { 'x-signature': _sig, ...cleanMetadata } = meta ?? {};
+    const cleaned = { ...rest, metadata: cleanMetadata };
+    const canonical = canonicalize(cleaned);
+    return new TextEncoder().encode(canonical);
+}
+/**
+ * Verify an Ed25519 signature using @noble/ed25519.
+ * publicKey and value are expected as base64-encoded strings.
+ */
+async function verifyEd25519(payload, signatureB64, publicKeyB64) {
+    const sig = base64ToBytes(signatureB64);
+    const pub = base64ToBytes(publicKeyB64);
+    return ed.verifyAsync(sig, payload, pub);
+}
+/**
+ * Verify a compact JWT. The `value` field IS the JWT — publicKey is the JWK or PEM.
+ * Uses `jose` — handles RS256, ES256, EdDSA etc automatically.
+ */
+async function verifyJwt(jwt, publicKeyPemOrJwk) {
+    try {
+        let key;
+        try {
+            const jwk = JSON.parse(publicKeyPemOrJwk);
+            key = await importJWK(jwk);
+        }
+        catch {
+            key = await importSPKI(publicKeyPemOrJwk, 'RS256');
+        }
+        await jwtVerify(jwt, key);
+        return true;
+    }
+    catch {
+        return false;
+    }
+}
+/**
+ * Verify via a DID document.
+ * Resolves the DID (issuer field), finds the verification method,
+ * and verifies the Ed25519 or JWT signature against the resolved public key.
+ */
+async function verifyDid(payload, signature) {
+    if (!signature.issuer)
+        return false;
+    try {
+        const result = await didResolver.resolve(signature.issuer);
+        const doc = result.didDocument;
+        if (!doc?.verificationMethod?.length)
+            return false;
+        // Try each verification method in the DID document
+        for (const vm of doc.verificationMethod) {
+            if (vm.publicKeyBase64 || vm.publicKeyBase58 || vm.publicKeyJwk) {
+                const pubKeyB64 = vm.publicKeyBase64 ??
+                    (vm.publicKeyBase58 ? base58ToBase64(vm.publicKeyBase58) : null);
+                if (pubKeyB64) {
+                    const ok = await verifyEd25519(payload, signature.value, pubKeyB64);
+                    if (ok)
+                        return true;
+                }
+                if (vm.publicKeyJwk) {
+                    const keyStr = JSON.stringify(vm.publicKeyJwk);
+                    const ok = await verifyJwt(signature.value, keyStr);
+                    if (ok)
+                        return true;
+                }
+            }
+        }
+        return false;
+    }
+    catch {
+        return false;
+    }
+}
+/**
+ * Main entry point.
+ * Verifies an agent's x-signature block against its canonical manifest.
+ */
+export async function verifyAgentSignature(manifest, signature, agentId) {
+    const base = {
+        signatureType: signature.type,
+        issuer: signature.issuer,
+        verifiedAt: new Date().toISOString(),
+    };
+    // Require all three fields for any verification attempt
+    if (!signature.type || !signature.value || !signature.publicKey) {
+        return {
+            ...base,
+            verified: false,
+            tier: 'signed',
+            reason: 'x-signature present but missing required fields (type, value, or publicKey)',
+        };
+    }
+    try {
+        const payload = canonicalManifestBytes(manifest);
+        let verified = false;
+        switch (signature.type) {
+            case 'Ed25519':
+                verified = await verifyEd25519(payload, signature.value, signature.publicKey);
+                break;
+            case 'jwt':
+            case 'vc':
+                verified = await verifyJwt(signature.value, signature.publicKey);
+                break;
+            case 'did':
+                verified = await verifyDid(payload, signature);
+                break;
+            case 'ECDSA':
+            case 'RSA-PSS': {
+                // Use jose compact verification for asymmetric algorithms
+                try {
+                    const key = await importSPKI(signature.publicKey, signature.type === 'ECDSA' ? 'ES256' : 'PS256');
+                    await compactVerify(signature.value, key);
+                    verified = true;
+                }
+                catch {
+                    verified = false;
+                }
+                break;
+            }
+            default:
+                return {
+                    ...base,
+                    verified: false,
+                    tier: 'community',
+                    reason: `Unsupported signature type: ${signature.type}`,
+                };
+        }
+        return {
+            ...base,
+            verified,
+            tier: verified ? 'verified-signature' : 'signed',
+            reason: verified ? undefined : 'Signature verification failed — payload mismatch or invalid key',
+        };
+    }
+    catch (err) {
+        const message = err instanceof Error ? err.message : 'unknown';
+        return {
+            ...base,
+            verified: false,
+            tier: 'signed',
+            reason: `Verification error: ${message}`,
+        };
+    }
+}
+// ─── Utilities ──────────────────────────────────────────────
+function base64ToBytes(b64) {
+    const binary = atob(b64);
+    const bytes = new Uint8Array(binary.length);
+    for (let i = 0; i < binary.length; i++)
+        bytes[i] = binary.charCodeAt(i);
+    return bytes;
+}
+/**
+ * Decode base58 string to bytes and return as base64.
+ * Uses the standard base58 alphabet — no external package needed.
+ */
+function base58ToBase64(b58) {
+    const ALPHABET = '123456789ABCDEFGHJKLMNPQRSTUVWXYZabcdefghijkmnopqrstuvwxyz';
+    const alphabetMap = new Map(ALPHABET.split('').map((c, i) => [c, i]));
+    let value = BigInt(0);
+    for (const char of b58) {
+        const digit = alphabetMap.get(char);
+        if (digit === undefined)
+            throw new Error(`Invalid base58 character: ${char}`);
+        value = value * BigInt(58) + BigInt(digit);
+    }
+    const hex = value.toString(16).padStart(b58.length * 2, '0');
+    const bytes = Buffer.from(hex.length % 2 === 0 ? hex : '0' + hex, 'hex');
+    return bytes.toString('base64');
+}
+//# sourceMappingURL=trust.service.js.map

package/dist/services/validation.service.js

@@ -117,6 +117,23 @@ let ValidationService = class ValidationService {
                     })));
                 }
             }
+            // 5b. Validate separation of duties (role must not be in conflicts_with)
+            const sodErrors = [];
+            if (manifest && typeof manifest === 'object' && 'spec' in manifest) {
+                const spec = manifest.spec;
+                const separation = spec?.separation;
+                if (separation?.role &&
+                    Array.isArray(separation.conflicts_with) &&
+                    separation.conflicts_with.includes(separation.role)) {
+                    sodErrors.push({
+                        instancePath: '/spec/separation',
+                        schemaPath: '/spec/separation',
+                        keyword: 'separationOfDuties',
+                        params: {},
+                        message: `role "${separation.role}" cannot be in conflicts_with`,
+                    });
+                }
+            }
             // 6. Run platform-specific validators
             const platformResults = this.validatePlatformExtensions(manifest);
             const allErrors = [
@@ -130,12 +147,16 @@ let ValidationService = class ValidationService {
                         message: err.message || 'Validation error',
                     }))),
                 ...messagingErrors,
+                ...sodErrors,
                 ...platformResults.errors,
             ];
             const allWarnings = [...warnings, ...platformResults.warnings];
             // 7. Return structured result
             return {
-                valid: valid && platformResults.valid && messagingErrors.length === 0,
+                valid: valid &&
+                    platformResults.valid &&
+                    messagingErrors.length === 0 &&
+                    sodErrors.length === 0,
                 errors: allErrors,
                 warnings: allWarnings,
                 manifest: valid && platformResults.valid ? manifest : undefined,

package/dist/services/validators/a2a.validator.js

@@ -27,7 +27,7 @@ let A2AValidator = class A2AValidator {
         // @ts-expect-error - Ajv v8 API compatibility
         this.ajv = new Ajv({ allErrors: true, verbose: true });
         addFormats(this.ajv);
-        const schemaPath = path.resolve(__dirname, '../../../spec/v0.3/extensions/a2a/a2a.schema.json');
+        const schemaPath = path.resolve(__dirname, '../../../spec/v0.4/extensions/a2a/a2a.schema.json');
         const schema = JSON.parse(fs.readFileSync(schemaPath, 'utf-8'));
         this.validate = this.ajv.compile(schema);
     }

package/dist/services/validators/autogen.validator.js

@@ -16,7 +16,10 @@ import { injectable } from 'inversify';
 import Ajv from 'ajv';
 import addFormats from 'ajv-formats';
 import { readFileSync } from 'fs';
-import { join } from 'path';
+import { join, dirname } from 'path';
+import { fileURLToPath } from 'url';
+const VALIDATOR_DIR = dirname(fileURLToPath(import.meta.url));
+const PKG_ROOT = join(VALIDATOR_DIR, '..', '..', '..');
 let AutoGenValidator = class AutoGenValidator {
     ajv;
     validateAG2;
@@ -24,9 +27,7 @@ let AutoGenValidator = class AutoGenValidator {
         // @ts-expect-error - Ajv v8 API compatibility
         this.ajv = new Ajv({ allErrors: true, strict: false });
         addFormats(this.ajv);
-        // Load AG2 schema from spec/ directory (relative to project root)
-        // Works in both Jest (source tree) and production (project root with dist/)
-        const ag2SchemaPath = join(process.cwd(), 'spec/v0.3/extensions/ag2/ag2.schema.json');
+        const ag2SchemaPath = join(PKG_ROOT, 'spec/v0.4/extensions/ag2/ag2.schema.json');
         const ag2Schema = JSON.parse(readFileSync(ag2SchemaPath, 'utf-8'));
         this.validateAG2 = this.ajv.compile(ag2Schema);
     }

package/dist/services/validators/crewai.validator.js

@@ -16,7 +16,10 @@ import { injectable } from 'inversify';
 import Ajv from 'ajv';
 import addFormats from 'ajv-formats';
 import { readFileSync } from 'fs';
-import { join } from 'path';
+import { join, dirname } from 'path';
+import { fileURLToPath } from 'url';
+const VALIDATOR_DIR = dirname(fileURLToPath(import.meta.url));
+const PKG_ROOT = join(VALIDATOR_DIR, '..', '..', '..');
 let CrewAIValidator = class CrewAIValidator {
     ajv;
     validateCrewAI;
@@ -24,9 +27,7 @@ let CrewAIValidator = class CrewAIValidator {
         // @ts-expect-error - Ajv v8 API compatibility
         this.ajv = new Ajv({ allErrors: true, strict: false });
         addFormats(this.ajv);
-        // Load CrewAI schema from spec/ directory (relative to project root)
-        // Works in both Jest (source tree) and production (project root with dist/)
-        const crewaiSchemaPath = join(process.cwd(), 'spec/v0.3/extensions/crewai/crewai.schema.json');
+        const crewaiSchemaPath = join(PKG_ROOT, 'spec/v0.4/extensions/crewai/crewai.schema.json');
         const crewaiSchema = JSON.parse(readFileSync(crewaiSchemaPath, 'utf-8'));
         this.validateCrewAI = this.ajv.compile(crewaiSchema);
     }

package/dist/services/validators/kagent.validator.js

@@ -17,7 +17,10 @@ import { injectable } from 'inversify';
 import Ajv from 'ajv';
 import addFormats from 'ajv-formats';
 import { readFileSync } from 'fs';
-import { join } from 'path';
+import { join, dirname } from 'path';
+import { fileURLToPath } from 'url';
+const VALIDATOR_DIR = dirname(fileURLToPath(import.meta.url));
+const PKG_ROOT = join(VALIDATOR_DIR, '..', '..', '..');
 let KagentValidator = class KagentValidator {
     ajv;
     validateKagent;
@@ -25,9 +28,7 @@ let KagentValidator = class KagentValidator {
         // @ts-expect-error - Ajv v8 API compatibility
         this.ajv = new Ajv({ allErrors: true, strict: false });
         addFormats(this.ajv);
-        // Load Kagent schema from spec/ directory (relative to project root)
-        // Works in both Jest (source tree) and production (project root with dist/)
-        const kagentSchemaPath = join(process.cwd(), 'spec/v0.3/extensions/kagent/kagent.schema.json');
+        const kagentSchemaPath = join(PKG_ROOT, 'spec/v0.4/extensions/kagent/kagent.schema.json');
         const kagentSchema = JSON.parse(readFileSync(kagentSchemaPath, 'utf-8'));
         this.validateKagent = this.ajv.compile(kagentSchema);
     }

package/dist/services/validators/langchain.validator.js

@@ -16,7 +16,10 @@ import { injectable } from 'inversify';
 import Ajv from 'ajv';
 import addFormats from 'ajv-formats';
 import { readFileSync } from 'fs';
-import { join } from 'path';
+import { join, dirname } from 'path';
+import { fileURLToPath } from 'url';
+const VALIDATOR_DIR = dirname(fileURLToPath(import.meta.url));
+const PKG_ROOT = join(VALIDATOR_DIR, '..', '..', '..');
 let LangChainValidator = class LangChainValidator {
     ajv;
     validateLangChain;
@@ -24,9 +27,7 @@ let LangChainValidator = class LangChainValidator {
         // @ts-expect-error - Ajv v8 API compatibility
         this.ajv = new Ajv({ allErrors: true, strict: false });
         addFormats(this.ajv);
-        // Load LangChain schema from spec/ directory (relative to project root)
-        // Works in both Jest (source tree) and production (project root with dist/)
-        const langchainSchemaPath = join(process.cwd(), 'spec/v0.3/extensions/langchain/langchain.schema.json');
+        const langchainSchemaPath = join(PKG_ROOT, 'spec/v0.4/extensions/langchain/langchain.schema.json');
         const langchainSchema = JSON.parse(readFileSync(langchainSchemaPath, 'utf-8'));
         this.validateLangChain = this.ajv.compile(langchainSchema);
     }

package/dist/services/validators/langgraph.validator.js

@@ -16,7 +16,10 @@ import { injectable } from 'inversify';
 import Ajv from 'ajv';
 import addFormats from 'ajv-formats';
 import { readFileSync } from 'fs';
-import { join } from 'path';
+import { join, dirname } from 'path';
+import { fileURLToPath } from 'url';
+const VALIDATOR_DIR = dirname(fileURLToPath(import.meta.url));
+const PKG_ROOT = join(VALIDATOR_DIR, '..', '..', '..');
 let LangGraphValidator = class LangGraphValidator {
     ajv;
     validateLangGraph;
@@ -24,9 +27,7 @@ let LangGraphValidator = class LangGraphValidator {
         // @ts-expect-error - Ajv v8 API compatibility
         this.ajv = new Ajv({ allErrors: true, strict: false });
         addFormats(this.ajv);
-        // Load LangGraph schema from spec/ directory (relative to project root)
-        // Works in both Jest (source tree) and production (project root with dist/)
-        const langgraphSchemaPath = join(process.cwd(), 'spec/v0.3/extensions/langgraph/langgraph.schema.json');
+        const langgraphSchemaPath = join(PKG_ROOT, 'spec/v0.4/extensions/langgraph/langgraph.schema.json');
         const langgraphSchema = JSON.parse(readFileSync(langgraphSchemaPath, 'utf-8'));
         this.validateLangGraph = this.ajv.compile(langgraphSchema);
     }

package/dist/services/validators/mcp.validator.js

@@ -27,7 +27,7 @@ let MCPValidator = class MCPValidator {
         // @ts-expect-error - Ajv v8 API compatibility
         this.ajv = new Ajv({ allErrors: true, verbose: true });
         addFormats(this.ajv);
-        const schemaPath = path.resolve(__dirname, '../../../spec/v0.3/extensions/mcp/mcp.schema.json');
+        const schemaPath = path.resolve(__dirname, '../../../spec/v0.4/extensions/mcp/mcp.schema.json');
         const schema = JSON.parse(fs.readFileSync(schemaPath, 'utf-8'));
         this.validate = this.ajv.compile(schema);
     }

package/dist/services/version-detection.service.js

@@ -191,7 +191,10 @@ let VersionDetectionService = class VersionDetectionService {
             }
         }
         else {
-            // Major version migration: not supported yet, go direct
+            // Major version migration: step through minor .0 of each major
+            for (let major = source.major + 1; major < target.major; major++) {
+                path.push(`${major}.0.0`);
+            }
             path.push(targetVersion);
         }
         return path;

package/dist/services/wizard/prompts.js

@@ -21,13 +21,13 @@ export const corePrompts = [
         type: 'input',
         name: 'name',
         message: 'Agent ID (DNS-1123 format, lowercase alphanumeric with hyphens):',
-        default: 'my-agent',
+        default: 'agent-47',
         validate: (value) => {
             if (!value || value.trim().length === 0) {
                 return 'Agent ID is required';
             }
             if (!DNS1123_REGEX.test(value)) {
-                return 'Must be DNS-1123 compliant (e.g., "my-agent", "code-reviewer")';
+                return 'Must be DNS-1123 compliant (e.g., "agent-47", "code-reviewer")';
             }
             if (value.length > 253) {
                 return 'Must be 253 characters or less';
@@ -154,14 +154,30 @@ export const toolsPrompts = [
         name: 'tools',
         message: 'Select tools (space to select, enter to continue):',
         choices: [
-            { name: 'Search (web search capabilities)', value: 'search' },
-            { name: 'File Operations (read/write files)', value: 'file_ops' },
-            { name: 'Web (HTTP requests)', value: 'web' },
-            { name: 'Calculator (math operations)', value: 'calculator' },
-            { name: 'Database (query databases)', value: 'database' },
-            { name: 'API Calls (external APIs)', value: 'api' },
+            // Common Tools
+            { name: 'MCP (Model Context Protocol servers)', value: 'mcp' },
+            { name: 'Function (Local function calls)', value: 'function' },
+            { name: 'HTTP (HTTP endpoints)', value: 'http' },
+            { name: 'API (REST APIs)', value: 'api' },
+            { name: 'Browser (Puppeteer/Playwright automation)', value: 'browser' },
+            { name: 'Library (Reusable logic)', value: 'library' },
+            // Event-Driven Tools
+            { name: 'Webhook (Event triggers)', value: 'webhook' },
+            { name: 'Schedule (Cron triggers)', value: 'schedule' },
+            { name: 'Pipeline (CI/CD events)', value: 'pipeline' },
+            { name: 'Workflow (Status changes)', value: 'workflow' },
+            // Output Types
+            { name: 'Artifact (File outputs)', value: 'artifact' },
+            { name: 'Git Commit (Commit outputs)', value: 'git-commit' },
+            { name: 'CI Status (Pipeline status)', value: 'ci-status' },
+            { name: 'Comment (MR/issue comments)', value: 'comment' },
+            // Advanced Integration
+            { name: 'gRPC (gRPC services)', value: 'grpc' },
+            { name: 'Agent-to-Agent (A2A communication)', value: 'a2a' },
+            { name: 'Kubernetes (K8s API)', value: 'kubernetes' },
+            { name: 'Custom (Custom integration)', value: 'custom' },
         ],
-        default: ['search', 'file_ops'],
+        default: ['mcp', 'function'],
     },
     {
         type: 'list',

package/dist/services/wizard/wizard-state.service.d.ts

@@ -0,0 +1,111 @@
+/**
+ * WizardStateService — Headless wizard state machine
+ *
+ * Manages wizard sessions, step definitions, and state transitions
+ * with ZERO TUI/inquirer dependencies. CLI, REST API, and MCP server
+ * all consume this service.
+ */
+import { z } from 'zod';
+import { ValidationService } from '../validation.service.js';
+import type { OssaAgent } from '../../types/index.js';
+import type { AgentTemplate } from '../../cli/wizard/types.js';
+export type WizardMode = 'quick' | 'guided' | 'expert';
+export type WizardKind = 'Agent' | 'Skill' | 'MCPServer';
+export type FieldType = 'text' | 'select' | 'multiselect' | 'number' | 'boolean' | 'textarea';
+export interface FieldDefinition {
+    name: string;
+    type: FieldType;
+    label: string;
+    description?: string;
+    default?: unknown;
+    required?: boolean;
+    options?: Array<{
+        label: string;
+        value: string;
+        description?: string;
+    }>;
+    validation?: z.ZodSchema;
+}
+export interface StepDefinition {
+    id: string;
+    title: string;
+    description: string;
+    fields: FieldDefinition[];
+    validation: z.ZodSchema;
+    condition?: (session: WizardSession) => boolean;
+}
+/** API-safe step definition (no validation/condition). */
+export interface StepDefinitionApi {
+    id: string;
+    title: string;
+    description: string;
+    fields: FieldDefinitionApi[];
+}
+/** API-safe field definition (no validation). */
+export interface FieldDefinitionApi {
+    name: string;
+    type: FieldType;
+    label: string;
+    description?: string;
+    default?: unknown;
+    required?: boolean;
+    options?: Array<{
+        label: string;
+        value: string;
+        description?: string;
+    }>;
+}
+export interface WizardSession {
+    id: string;
+    currentStepIndex: number;
+    completedSteps: string[];
+    data: Record<string, unknown>;
+    manifest: Partial<OssaAgent>;
+    mode: WizardMode;
+    kind: WizardKind;
+    createdAt: number;
+    updatedAt: number;
+}
+export interface StepResult {
+    success: boolean;
+    session: WizardSession;
+    errors?: string[];
+    nextStep?: StepDefinition | null;
+}
+export interface WizardCompleteResult {
+    manifest: OssaAgent;
+    valid: boolean;
+    errors: string[];
+    warnings: string[];
+}
+export declare class WizardStateService {
+    private validationService;
+    private sessions;
+    private cleanupInterval;
+    constructor(validationService: ValidationService);
+    createSession(opts?: {
+        mode?: WizardMode;
+        kind?: WizardKind;
+        template?: string;
+    }): WizardSession;
+    getSession(id: string): WizardSession | null;
+    deleteSession(id: string): boolean;
+    getSteps(session: WizardSession): StepDefinition[];
+    /**
+     * Step definitions for API consumption (no session required).
+     * Strips validation and condition so response is JSON-serializable.
+     */
+    getStepDefinitions(kind?: WizardKind, mode?: WizardMode): StepDefinitionApi[];
+    private toStepDefinitionApi;
+    private toFieldDefinitionApi;
+    getCurrentStep(session: WizardSession): StepDefinition | null;
+    submitStep(session: WizardSession, stepId: string, data: Record<string, unknown>): StepResult;
+    undo(session: WizardSession): StepResult;
+    complete(session: WizardSession): Promise<WizardCompleteResult>;
+    getTemplates(): AgentTemplate[];
+    private getAllStepsForKind;
+    private buildManifest;
+    private buildTools;
+    private cleanupExpired;
+}
+//# sourceMappingURL=wizard-state.service.d.ts.map