@bluefly/openstandardagents 0.4.6 → 0.4.9

package/dist/cli/commands/verify.js

@@ -7,59 +7,86 @@
  *   ossa verify did:ossa:blueflyio:agent-123 --card ./agent-card.yaml
  *   ossa verify did:ossa:blueflyio:agent-123 --json
  */
-import { Command } from 'commander';
+import { DuadpClient, resolveGaid } from '@bluefly/duadp';
 import chalk from 'chalk';
-import axios from 'axios';
+import { Command } from 'commander';
 import * as fs from 'fs';
 import * as yaml from 'yaml';
 import { addRegistryOptions, resolveRegistryUrl, } from '../utils/standard-options.js';
 /**
- * Agent Protocol Client for DID resolution
+ * Agent Protocol Client for DID resolution using UADP
  */
 class AgentProtocolClient {
-    baseUrl;
-    token;
+    client;
     constructor(config) {
-        this.baseUrl = config?.baseUrl || process.env.OSSA_REGISTRY_URL || '';
-        this.token =
-            config?.apiKey ||
-                process.env.AGENT_PROTOCOL_TOKEN ||
-                process.env.GITLAB_PRIVATE_TOKEN;
+        const baseUrl = config?.baseUrl || process.env.OSSA_REGISTRY_URL || 'https://registry.openstandardagents.org';
+        this.client = new DuadpClient(baseUrl, {
+            token: config?.apiKey || process.env.AGENT_PROTOCOL_TOKEN || process.env.GITLAB_PRIVATE_TOKEN,
+        });
     }
     /**
      * Resolve a GAID to its DID document
      */
     async resolveDID(gaid) {
         try {
-            const headers = {
-                'Content-Type': 'application/json',
-            };
-            if (this.token) {
-                headers['Authorization'] = `Bearer ${this.token}`;
-            }
-            const response = await axios.get(`${this.baseUrl}/api/v1/agents/resolve/${encodeURIComponent(gaid)}`, {
-                headers,
-                timeout: 30000,
-            });
-            return response.data;
-        }
-        catch (error) {
-            if (axios.isAxiosError(error)) {
-                if (error.response?.status === 404) {
-                    throw new Error(`Agent not found: ${gaid}`);
-                }
-                else if (error.response?.status === 401) {
-                    throw new Error('Authentication failed. Set AGENT_PROTOCOL_TOKEN environment variable.');
+            // 1. If it's a URI, resolve directly
+            if (gaid.startsWith('uadp://') || gaid.startsWith('uadp://')) {
+                const resolution = await resolveGaid(gaid, { token: this.client['token'] });
+                if (resolution.kind === 'agents') {
+                    const agent = await resolution.client.getAgent(resolution.name);
+                    return this.mapToDIDResult(agent, gaid);
                 }
-                else if (error.code === 'ECONNREFUSED') {
-                    throw new Error(`Cannot connect to agent-protocol service at ${this.baseUrl}. ` +
-                        `Set AGENT_PROTOCOL_URL to the correct endpoint.`);
+                else {
+                    throw new Error(`Expected an agent URI, but got kind: ${resolution.kind}`);
                 }
-                throw new Error(`DID resolution failed: ${error.response?.data?.message || error.message}`);
             }
-            throw error;
+            // 2. Otherwise use WebFinger to resolve the DID/GAID string
+            const wfResponse = await this.client.resolveGaid(gaid);
+            // We expect the webfinger response to return JRD+JSON containing the agent profile link
+            const agentLink = wfResponse.links?.find((l) => l.rel === 'http://openstandardagents.org/rels/profile');
+            if (!agentLink || !agentLink.href) {
+                throw new Error(`WebFinger resolution missing agent profile link for ${gaid}`);
+            }
+            // Fetch the agent profile from the href
+            // If the href is a fully qualified URL we could fetch it, but usually it's on the same node
+            const url = new URL(agentLink.href, this.client.baseUrl);
+            const res = await fetch(url.toString());
+            if (!res.ok)
+                throw new Error(`Failed to fetch mapped agent: ${res.statusText}`);
+            const agent = await res.json();
+            return this.mapToDIDResult(agent, gaid);
+        }
+        catch (error) {
+            throw new Error(`DID resolution failed: ${error.message}`);
         }
     }
+    mapToDIDResult(agent, originalGaid) {
+        const tier = agent.security?.tier;
+        let trustLevel = 0.5;
+        if (tier === 'tier_4_system_admin')
+            trustLevel = 1.0;
+        else if (tier === 'tier_3_write_elevated')
+            trustLevel = 0.8;
+        else if (tier === 'tier_2_write_limited')
+            trustLevel = 0.6;
+        else if (tier === 'tier_1_read')
+            trustLevel = 0.4;
+        return {
+            gaid: originalGaid,
+            did: agent.metadata?.annotations?.['ossa.org/gaid'] || originalGaid,
+            name: agent.metadata?.name || 'unknown',
+            organization: agent.metadata?.identity?.namespace || 'community',
+            trustTier: tier || 'unverified',
+            trustLevel,
+            verified: !!agent.metadata?.identity?.publisher?.pgp_key,
+            capabilities: (agent.spec?.capabilities || []).map((c) => typeof c === 'string' ? c : c.name),
+            endpoints: agent.endpoints,
+            publicKey: agent.metadata?.identity?.publisher?.pgp_key,
+            signature: agent.metadata?.identity?.signature,
+            createdAt: agent.metadata?.created_at,
+            updatedAt: agent.metadata?.updated_at,
+        };
+    }
 }
 /**
  * Load agent card from file

package/dist/cli/commands/wizard-api-first.command.js

@@ -991,6 +991,12 @@ class APIFirstWizard {
             this.generateLlmsTxt(directory);
         }
         printSuccess('All files generated successfully');
+        console.log('');
+        console.log('Next steps:');
+        console.log(`  1. Validate: ossa validate ${outputPath}`);
+        console.log(`  2. Score:    ossa lifecycle score ${outputPath}`);
+        console.log(`  3. Export:   ossa export ${outputPath} --platform docker`);
+        console.log(`  4. Register: ossa lifecycle duadp-register <name>`);
     }
     generateAgentsMd(directory) {
         const agentsMdPath = path.join(directory, 'AGENTS.md');

package/dist/cli/commands/wizard.command.js

@@ -825,7 +825,13 @@ export const wizardCommand = new Command('wizard')
         }
         if (useDirectory) {
             console.log(chalk.gray(`  ${stepNum}. Register: ossa workspace discover`));
+            stepNum++;
         }
+        console.log(chalk.gray(`  ${stepNum}. Score: ossa lifecycle score ${outputPath}`));
+        stepNum++;
+        console.log(chalk.gray(`  ${stepNum}. Publish to DUADP: ossa lifecycle duadp-register <name>`));
+        stepNum++;
+        console.log(chalk.gray(`  ${stepNum}. Export to platform: ossa export ${outputPath} --platform docker`));
         rl.close();
         process.exit(0);
     }

package/dist/cli/commands/workspace.command.js

@@ -10,6 +10,7 @@
  *   ossa workspace sync          - Sync registry with discovered agents
  *   ossa workspace publish       - POST discovery to a registry API (e.g. mesh /api/v1/discovery)
  */
+import { DuadpClient } from '@bluefly/duadp';
 import chalk from 'chalk';
 import { Command } from 'commander';
 import * as fs from 'fs';
@@ -504,22 +505,22 @@ workspaceCommand
     }
 });
 // ============================================================================
-// Subcommand: workspace publish (POST to registry/mesh discovery API)
+// Subcommand: workspace publish (POST to UADP registry)
 // ============================================================================
 workspaceCommand
     .command('publish')
-    .description('POST workspace discovery to a registry API (e.g. mesh /api/v1/discovery). Run "ossa workspace discover" first.')
-    .option('--registry-url <url>', 'Registry base URL (e.g. https://your-registry.example.com). Default: MESH_URL or AGENT_REGISTRY_URL env. POSTs to <url>/api/v1/discovery')
+    .description('Publish all discovered workspace agents to a UADP registry. Run "ossa workspace discover" first.')
+    .option('--registry-url <url>', 'Registry base URL (e.g. https://skills.sh). Default: OSSA_REGISTRY_URL env.')
+    .option('--token <token>', 'Authentication token for publishing. Default: AGENT_PROTOCOL_TOKEN env.')
     .option('--discover', 'Run workspace discover first if registry is missing')
     .action(async (options) => {
     try {
         const registryUrl = options.registryUrl ||
+            process.env.OSSA_REGISTRY_URL ||
             process.env.MESH_URL ||
-            process.env.AGENT_REGISTRY_URL;
-        if (!registryUrl) {
-            console.error(chalk.red('Missing --registry-url or MESH_URL / AGENT_REGISTRY_URL'));
-            process.exit(1);
-        }
+            process.env.AGENT_REGISTRY_URL ||
+            'https://registry.openstandardagents.org';
+        const token = options.token || process.env.AGENT_PROTOCOL_TOKEN || process.env.GITLAB_PRIVATE_TOKEN;
         const cwd = process.cwd();
         const registryPath = path.resolve(cwd, getDefaultWorkspaceDir(), getWorkspaceRegistryPath());
         if (!fs.existsSync(registryPath)) {
@@ -542,33 +543,36 @@ workspaceCommand
         }
         const content = fs.readFileSync(registryPath, 'utf-8');
         const registry = yaml.parse(content);
-        const agents = registry.agents || [];
-        const workspaceName = registry.metadata?.name || 'workspace';
-        const scannedAt = new Date().toISOString();
-        const payload = {
-            source_id: workspaceName,
-            workspace: { name: workspaceName, scanned_at: scannedAt },
-            projects: agents.map((p) => ({
-                name: p.project ?? p.path,
-                path: p.path ?? `./${p.project ?? ''}`,
-                agents: p.agents ?? [],
-            })),
-        };
-        const base = registryUrl.replace(/\/$/, '');
-        const url = `${base}/api/v1/discovery`;
-        const res = await fetch(url, {
-            method: 'POST',
-            headers: { 'Content-Type': 'application/json' },
-            body: JSON.stringify(payload),
-        });
-        if (res.ok || res.status === 202) {
-            console.log(chalk.green('Published to registry: ') +
-                base +
-                ` (${payload.projects.length} projects)`);
+        const projects = registry.agents || [];
+        let totalPublished = 0;
+        let totalFailed = 0;
+        const client = new DuadpClient(registryUrl, { token });
+        console.log(chalk.blue(`Publishing workspace agents to ${registryUrl}...`));
+        console.log(chalk.gray('─'.repeat(50)));
+        for (const project of projects) {
+            const projectPath = path.resolve(cwd, project.path || '.');
+            for (const agentRef of project.agents || []) {
+                const manifestPath = path.resolve(projectPath, agentRef.manifest);
+                if (!fs.existsSync(manifestPath)) {
+                    console.log(chalk.yellow(`  ⚠ Skipping ${agentRef.name} (Manifest not found: ${manifestPath})`));
+                    continue;
+                }
+                try {
+                    const agentManifest = yaml.parse(fs.readFileSync(manifestPath, 'utf-8'));
+                    await client.publishAgent(agentManifest);
+                    console.log(chalk.green(`  ✓ Published `) + agentRef.name);
+                    totalPublished++;
+                }
+                catch (e) {
+                    console.log(chalk.red(`  ✗ Failed to publish `) + agentRef.name + `: ${e.message}`);
+                    totalFailed++;
+                }
+            }
         }
-        else {
-            const text = await res.text();
-            console.error(chalk.red('Publish failed: ') + res.status + ' ' + text);
+        console.log(chalk.gray('─'.repeat(50)));
+        console.log(chalk.green(`Successfully published ${totalPublished} agent(s).`));
+        if (totalFailed > 0) {
+            console.log(chalk.red(`${totalFailed} agent(s) failed to publish.`));
             process.exit(1);
         }
         process.exit(0);
@@ -578,48 +582,44 @@ workspaceCommand
     }
 });
 // ============================================================================
-// Subcommand: workspace list-remote (GET from registry/mesh discovery API)
+// Subcommand: workspace list-remote (GET from UADP registry)
 // ============================================================================
 workspaceCommand
     .command('list-remote')
-    .description('List agents from a registry API (GET /api/v1/discovery). No local workspace required.')
-    .requiredOption('--registry-url <url>', 'Registry base URL (e.g. https://your-registry.example.com)')
+    .description('List agents from a UADP registry API. No local workspace required.')
+    .option('--registry-url <url>', 'Registry base URL (e.g. https://skills.sh). Default: OSSA_REGISTRY_URL env.')
     .option('--json', 'Output raw JSON')
+    .option('--limit <limit>', 'Max number of agents to fetch', '50')
     .action(async (options) => {
     try {
-        const base = options.registryUrl.replace(/\/$/, '');
-        const res = await fetch(`${base}/api/v1/discovery`);
-        if (!res.ok) {
-            console.error(chalk.red('Registry request failed: ') +
-                res.status +
-                ' ' +
-                (await res.text()));
-            process.exit(1);
-        }
-        const data = (await res.json());
+        const registryUrl = options.registryUrl ||
+            process.env.OSSA_REGISTRY_URL ||
+            'https://registry.openstandardagents.org';
+        const client = new DuadpClient(registryUrl);
+        const res = await client.listAgents({ limit: parseInt(options.limit || '50', 10) });
         if (options.json) {
-            console.log(JSON.stringify(data, null, 2));
+            console.log(JSON.stringify(res, null, 2));
             process.exit(0);
         }
-        const projects = data.projects ?? [];
-        const total = projects.reduce((n, p) => n + (p.agents?.length ?? 0), 0);
-        console.log(chalk.blue('Registry: ') + base);
-        console.log(chalk.gray('Sources: ') +
-            (data.sources?.length ?? 0) +
-            '  ' +
-            chalk.gray('Agents: ') +
-            total);
-        for (const p of projects) {
-            const projName = p.project_name ?? p.name ?? p.project_path ?? p.path ?? '?';
-            for (const a of p.agents ?? []) {
-                const label = typeof a === 'string'
-                    ? a
-                    : (a.name ??
-                        a.path ??
-                        '?');
-                console.log('  ' + projName + ' / ' + label);
+        const agents = res.data || [];
+        console.log(chalk.blue('Registry: ') + registryUrl);
+        console.log(chalk.gray('Total Agents: ' + agents.length));
+        console.log(chalk.gray('─'.repeat(50)));
+        for (const a of agents) {
+            const agent = a;
+            console.log(`\n  ${chalk.cyan(agent.metadata?.name || 'unknown')}`);
+            if (agent.metadata?.identity?.namespace) {
+                console.log(chalk.gray(`    Namespace: ${agent.metadata.identity.namespace}`));
+            }
+            if (agent.metadata?.description) {
+                console.log(chalk.gray(`    Description: ${agent.metadata.description}`));
+            }
+            const caps = agent.spec?.capabilities || [];
+            if (caps.length > 0) {
+                console.log(chalk.gray(`    Capabilities: ${caps.map((c) => typeof c === 'string' ? c : c.name).join(', ')}`));
             }
         }
+        console.log('');
         process.exit(0);
     }
     catch (error) {

package/dist/cli/index.js

@@ -39,6 +39,7 @@ import { lintCommand } from './commands/lint.command.js';
 import { llmsTxtCommand } from './commands/llms-txt.command.js';
 import { migrateBatchCommand } from './commands/migrate-batch.command.js';
 import { migrateCommand } from './commands/migrate.command.js';
+import { policyCommand } from './commands/policy.command.js';
 import { publishCommand } from './commands/publish.command.js';
 import { quickstartCommand } from './commands/quickstart.command.js';
 import { registryCommand } from './commands/registry.command.js';
@@ -46,6 +47,7 @@ import { runCommand } from './commands/run.command.js';
 import { scaffoldCommand } from './commands/scaffold.command.js';
 import { schemaCommand } from './commands/schema.command.js';
 import { searchCommand } from './commands/search.command.js';
+import { signCommand } from './commands/sign.command.js';
 import { standardizeCommand } from './commands/standardize.command.js';
 import { testCommand } from './commands/test.command.js';
 import { updateCommand } from './commands/update.command.js';
@@ -71,6 +73,8 @@ import { workspaceCommand } from './commands/workspace.command.js';
 import { frameworkCommand } from './commands/framework.command.js';
 import { langchainCommand } from './commands/langchain.command.js';
 import { langflowCommand } from './commands/langflow.command.js';
+// Lifecycle & curation commands
+import { createLifecycleCommand } from './commands/lifecycle.command.js';
 // Additional commands (previously unregistered)
 import { agentWizardCommand } from './commands/agent-wizard.command.js';
 import { docsCommand } from './commands/docs.command.js';
@@ -80,11 +84,11 @@ import { knowledgeCommandGroup } from './commands/knowledge.command.js';
 import { platformsCommand } from './commands/platforms.command.js';
 // Note: knowledge-index and knowledge-query are subcommands within knowledgeCommandGroup
 import { createAuditCommand } from './commands/audit.js';
+import { daemonCommand } from './commands/daemon.command.js';
 import { devCommand } from './commands/dev.command.js';
 import { estimateCommand } from './commands/estimate.command.js';
 import { migrateLangchainCommand } from './commands/migrate-langchain.command.js';
 import { releaseCommand } from './commands/release.command.js';
-import { daemonCommand } from './commands/daemon.command.js';
 import { serveCommand } from './commands/serve.command.js';
 import { syncCommand } from './commands/sync.command.js';
 import { upgradeCommand } from './commands/upgrade.command.js';
@@ -210,11 +214,12 @@ program.addCommand(publishCommand);
 program.addCommand(installCommand);
 program.addCommand(updateCommand);
 program.addCommand(searchCommand);
-// --- Deployment ---
+// --- Deployment & Lifecycle ---
 program.addCommand(deployCommand);
 program.addCommand(statusCommand);
 program.addCommand(rollbackCommand);
 program.addCommand(stopCommand);
+program.addCommand(createLifecycleCommand());
 // --- Documentation ---
 program.addCommand(agentsMdCommand);
 program.addCommand(llmsTxtCommand);
@@ -232,6 +237,8 @@ program.addCommand(conformanceCommand);
 program.addCommand(complianceCommand);
 program.addCommand(governanceCommand);
 program.addCommand(contractCommand);
+program.addCommand(signCommand);
+program.addCommand(policyCommand);
 // --- Advanced (hidden from main --help, still fully accessible) ---
 for (const cmd of [
     quickstartCommand,
@@ -275,9 +282,10 @@ program.addHelpText('after', `
   Dev:        generate, daemon, dev, serve, run, test
   Distribute: publish, install, update, search
   Deploy:     deploy, status, rollback, stop
+  Lifecycle:  lifecycle (score, review, approve, reject, deprecate, archive, catalog, duadp-sync)
   Docs:       agents-md, llms-txt, docs
   Skills:     skills, template
-  Compliance: conformance, compliance, governance, contract
+  Compliance: conformance, compliance, governance, contract, policy
   More:       platforms (matrix: GitLab, Drupal, kagent, OpenAI, Claude, etc.),
               quickstart, import, enhance, registry, migrate-batch, langchain, langflow.
 `);

package/dist/cli/utils/standard-options.js

@@ -158,7 +158,7 @@ export function addStandardValidationOptions(command) {
  * 2. OSSA_REGISTRY_URL environment variable
  * 3. Default: OSSA_REGISTRY_URL env var (empty if not set)
  */
-export const DEFAULT_REGISTRY_URL = process.env.OSSA_REGISTRY_URL || '';
+export const DEFAULT_REGISTRY_URL = process.env.OSSA_REGISTRY_URL || 'https://uadp.blueflyagents.com';
 export function addRegistryOptions(command) {
     return command
         .option('--registry <url>', 'Agent registry URL (env: OSSA_REGISTRY_URL)')

package/dist/confidence/index.d.ts

@@ -0,0 +1,67 @@
+/**
+ * OSSA SDK — Confidence Scoring Module
+ * @package @bluefly/openstandardagents
+ *
+ * Canonical confidence gate implementation for the OSSA platform.
+ * Referenced by: duadp, workflow-engine, social-gate, any Cedar quality gate consumer.
+ *
+ * Research basis:
+ *   - Cedar Policies for AI Agent Governance (OSSA Research, 2026-03-09)
+ *   - NIST AI RMF 1.0, MEASURE 2.5: AI system performance evaluated using metrics
+ *   - LangChain State of Agent Engineering 2026: 57% orgs run agents in prod;
+ *     quality is primary barrier (32% of respondents)
+ *   - Confidence-Informed Self-Consistency (CISC): 46% fewer reasoning paths
+ *     with equal accuracy (Xiong et al., 2024)
+ */
+export type ConfidenceAction = 'proceed' | 'human_review' | 'reject';
+export interface ConfidenceVerdict {
+    action: ConfidenceAction;
+    confidence: number;
+    reason: string;
+    /** Set on human_review — trust tier to downgrade to while review pending */
+    degraded_tier?: string;
+}
+export interface DeployGateContext {
+    confidence_score: number;
+    test_coverage: number;
+    security_score: number;
+    vulnerability_count: number;
+    day_of_week: string;
+    human_approved: boolean;
+}
+/**
+ * Gate an agent action based on model confidence score.
+ *
+ * @param confidence  [0–100] confidence score. 0 means not provided — skip gate.
+ * @param trustTier   OSSA trust tier of the resource being published/acted on.
+ * @param validationPassed  Whether OSSA schema validation succeeded.
+ */
+export declare function confidenceGate(confidence: number, trustTier?: string, validationPassed?: boolean): ConfidenceVerdict;
+/**
+ * Convert token log-probabilities to an integer [0–100] confidence score.
+ * Uses mean of exp(logprob) across all tokens.
+ *
+ * Caveat: Even high-performing LLMs show minimal confidence variation between
+ * correct/incorrect answers — domain-specific calibration is recommended
+ * (LangChain State of Agent Engineering 2026, p. 14).
+ */
+export declare function logprobsToConfidence(logprobs: number[]): number;
+/**
+ * Estimate confidence via self-consistency voting.
+ * Samples multiple model outputs and uses agreement rate as confidence proxy.
+ *
+ * @param responses  Array of sampled model outputs (strings).
+ * @returns  [0–100] confidence based on modal agreement rate.
+ */
+export declare function selfConsistencyConfidence(responses: string[]): number;
+/**
+ * Build the Cedar context object for the `deploy` action quality gate.
+ * Reads from CI artifact metrics; pass overrides when calling from tests.
+ */
+export declare function buildDeployGateContext(overrides?: Partial<DeployGateContext>): DeployGateContext;
+/**
+ * Extract confidence score from an OSSA resource payload.
+ * Checks metadata.confidence_score, spec.confidence_score, extensions.confidence_score.
+ */
+export declare function extractConfidenceScore(resource: Record<string, unknown>): number;
+//# sourceMappingURL=index.d.ts.map

package/dist/confidence/index.js

@@ -0,0 +1,130 @@
+/**
+ * OSSA SDK — Confidence Scoring Module
+ * @package @bluefly/openstandardagents
+ *
+ * Canonical confidence gate implementation for the OSSA platform.
+ * Referenced by: duadp, workflow-engine, social-gate, any Cedar quality gate consumer.
+ *
+ * Research basis:
+ *   - Cedar Policies for AI Agent Governance (OSSA Research, 2026-03-09)
+ *   - NIST AI RMF 1.0, MEASURE 2.5: AI system performance evaluated using metrics
+ *   - LangChain State of Agent Engineering 2026: 57% orgs run agents in prod;
+ *     quality is primary barrier (32% of respondents)
+ *   - Confidence-Informed Self-Consistency (CISC): 46% fewer reasoning paths
+ *     with equal accuracy (Xiong et al., 2024)
+ */
+// ---------------------------------------------------------------------------
+// Three-tier confidence routing
+// Thresholds: ≥90 auto-approve, 50–89 human review, <50 reject
+// Source: Cedar Policies for AI Agent Governance (OSSA Research 2026)
+// ---------------------------------------------------------------------------
+/**
+ * Gate an agent action based on model confidence score.
+ *
+ * @param confidence  [0–100] confidence score. 0 means not provided — skip gate.
+ * @param trustTier   OSSA trust tier of the resource being published/acted on.
+ * @param validationPassed  Whether OSSA schema validation succeeded.
+ */
+export function confidenceGate(confidence, trustTier = 'community', validationPassed = false) {
+    if (confidence === 0) {
+        return { action: 'proceed', confidence, reason: 'no-model-confidence-provided' };
+    }
+    if (confidence >= 90) {
+        return { action: 'proceed', confidence, reason: 'high-confidence-auto-approve' };
+    }
+    if (confidence >= 50) {
+        const isHighTrust = ['verified', 'official'].includes(trustTier);
+        if (isHighTrust) {
+            return {
+                action: 'human_review',
+                confidence,
+                reason: 'medium-confidence-requires-review-for-high-trust-tier',
+                degraded_tier: 'signed',
+            };
+        }
+        return { action: 'proceed', confidence, reason: 'medium-confidence-acceptable-for-tier' };
+    }
+    if (validationPassed) {
+        return {
+            action: 'human_review',
+            confidence,
+            reason: 'low-confidence-but-validation-passed',
+            degraded_tier: 'community',
+        };
+    }
+    return { action: 'reject', confidence, reason: 'low-confidence-and-validation-failed' };
+}
+// ---------------------------------------------------------------------------
+// Logprob → confidence conversion
+// Source: "log probability analysis" section — Cedar Policies OSSA Research 2026
+// ---------------------------------------------------------------------------
+/**
+ * Convert token log-probabilities to an integer [0–100] confidence score.
+ * Uses mean of exp(logprob) across all tokens.
+ *
+ * Caveat: Even high-performing LLMs show minimal confidence variation between
+ * correct/incorrect answers — domain-specific calibration is recommended
+ * (LangChain State of Agent Engineering 2026, p. 14).
+ */
+export function logprobsToConfidence(logprobs) {
+    if (!logprobs?.length)
+        return 0;
+    const avgProb = logprobs.reduce((s, lp) => s + Math.exp(lp), 0) / logprobs.length;
+    return Math.round(Math.min(1, Math.max(0, avgProb)) * 100);
+}
+// ---------------------------------------------------------------------------
+// Self-consistency confidence scoring
+// Source: CISC method (Xiong et al. 2024) — 46% fewer paths, equal accuracy
+// ---------------------------------------------------------------------------
+/**
+ * Estimate confidence via self-consistency voting.
+ * Samples multiple model outputs and uses agreement rate as confidence proxy.
+ *
+ * @param responses  Array of sampled model outputs (strings).
+ * @returns  [0–100] confidence based on modal agreement rate.
+ */
+export function selfConsistencyConfidence(responses) {
+    if (!responses?.length)
+        return 0;
+    const freq = {};
+    for (const r of responses) {
+        const normalized = r.trim().toLowerCase();
+        freq[normalized] = (freq[normalized] || 0) + 1;
+    }
+    const maxCount = Math.max(...Object.values(freq));
+    return Math.round((maxCount / responses.length) * 100);
+}
+// ---------------------------------------------------------------------------
+// Cedar deploy-gate context builder
+// ---------------------------------------------------------------------------
+/**
+ * Build the Cedar context object for the `deploy` action quality gate.
+ * Reads from CI artifact metrics; pass overrides when calling from tests.
+ */
+export function buildDeployGateContext(overrides = {}) {
+    const days = ['Sunday', 'Monday', 'Tuesday', 'Wednesday', 'Thursday', 'Friday', 'Saturday'];
+    return {
+        confidence_score: overrides.confidence_score ?? 0,
+        test_coverage: overrides.test_coverage ?? 0,
+        security_score: overrides.security_score ?? 0,
+        vulnerability_count: overrides.vulnerability_count ?? 0,
+        day_of_week: overrides.day_of_week ?? days[new Date().getDay()],
+        human_approved: overrides.human_approved ?? false,
+    };
+}
+// ---------------------------------------------------------------------------
+// Resource confidence extractor
+// ---------------------------------------------------------------------------
+/**
+ * Extract confidence score from an OSSA resource payload.
+ * Checks metadata.confidence_score, spec.confidence_score, extensions.confidence_score.
+ */
+export function extractConfidenceScore(resource) {
+    const meta = resource.metadata;
+    const spec = resource.spec;
+    const ext = resource.extensions;
+    const raw = meta?.confidence_score ?? spec?.confidence_score ?? ext?.confidence_score ?? 0;
+    const n = typeof raw === 'number' ? raw : parseInt(String(raw), 10);
+    return isNaN(n) ? 0 : Math.min(100, Math.max(0, n));
+}
+//# sourceMappingURL=index.js.map

package/dist/config/cli-config.d.ts

@@ -0,0 +1,33 @@
+/**
+ * OSSA CLI config file (e.g. ~/.ossa/config.json).
+ * Values here override defaults; process.env overrides config file.
+ * Use: ossa config set SKILLS_PATH /path/to/skills
+ */
+export type ConfigRecord = Record<string, string>;
+/**
+ * Config file path (for display).
+ */
+export declare function getConfigPath(): string;
+/**
+ * Get a config value. Resolution: process.env[key] then config file.
+ */
+export declare function getConfigValue(key: string): string | undefined;
+/**
+ * Set a config value (writes to config file). Does not set process.env.
+ */
+export declare function setConfigValue(key: string, value: string): void;
+/**
+ * Remove a key from the config file.
+ */
+export declare function unsetConfigValue(key: string): boolean;
+/**
+ * List all keys and values from the config file (not env).
+ */
+export declare function listConfig(): ConfigRecord;
+/** Known keys documented in `ossa config --help`. */
+export declare const KNOWN_KEYS: readonly ["SKILLS_PATH", "BLUEFLY_SKILLS_MARKETPLACE", "BLUEFLY_SKILLS_CATALOG", "BLUEFLY_SKILLS_PATH", "OSSA_WEBAGENTS_API_URL", "OSSA_CONFIG_PATH", "MCP_URL", "GITLAB_URL", "GITLAB_TOKEN"];
+/**
+ * Default directory for skills add/list. Resolution: config SKILLS_PATH, then env SKILLS_PATH/BLUEFLY_SKILLS_PATH, then ~/.claude/skills.
+ */
+export declare function getSkillsPathDefault(): string;
+//# sourceMappingURL=cli-config.d.ts.map