@bluefly/openstandardagents 0.4.8 → 0.4.9

package/dist/services/governance/cedar-validator.service.js

@@ -0,0 +1,88 @@
+/**
+ * Cedar Policy Validator Service
+ *
+ * Uses @cedar-policy/cedar-wasm to validate Cedar policies embedded in OSSA manifests.
+ * This is OSSA's responsibility: schema definition + offline validation.
+ * Runtime enforcement belongs to DUADP.
+ */
+import { checkParsePolicySet, checkParseSchema, } from '@cedar-policy/cedar-wasm';
+function extractErrors(answer) {
+    if (answer.type === 'failure') {
+        return answer.errors.map((e) => e.message ?? JSON.stringify(e));
+    }
+    return [];
+}
+/**
+ * Validate a single Cedar policy text for syntax correctness.
+ */
+export function validatePolicyText(policyText, policyId) {
+    const errors = [];
+    const warnings = [];
+    try {
+        const result = checkParsePolicySet({
+            staticPolicies: policyText,
+        });
+        errors.push(...extractErrors(result));
+    }
+    catch (e) {
+        errors.push(`Cedar WASM error: ${e instanceof Error ? e.message : String(e)}`);
+    }
+    return { valid: errors.length === 0, policyId, errors, warnings };
+}
+/**
+ * Validate a Cedar policy against a Cedar schema.
+ */
+export function validatePolicyWithSchema(policyText, schemaText, policyId) {
+    const errors = [];
+    const warnings = [];
+    // First validate schema itself
+    try {
+        const schemaResult = checkParseSchema(schemaText);
+        const schemaErrors = extractErrors(schemaResult);
+        if (schemaErrors.length > 0) {
+            errors.push(...schemaErrors.map((e) => `Schema error: ${e}`));
+            return { valid: false, policyId, errors, warnings };
+        }
+    }
+    catch (e) {
+        errors.push(`Cedar schema parse error: ${e instanceof Error ? e.message : String(e)}`);
+        return { valid: false, policyId, errors, warnings };
+    }
+    // Then validate policy syntax
+    try {
+        const result = checkParsePolicySet({
+            staticPolicies: policyText,
+        });
+        errors.push(...extractErrors(result));
+    }
+    catch (e) {
+        errors.push(`Cedar WASM error: ${e instanceof Error ? e.message : String(e)}`);
+    }
+    return { valid: errors.length === 0, policyId, errors, warnings };
+}
+/**
+ * Extract and validate all Cedar policies from an OSSA manifest.
+ */
+export function validateManifestCedarPolicies(manifest) {
+    const extensions = manifest.extensions;
+    const security = extensions?.security;
+    const cedarExt = security?.cedar;
+    if (!cedarExt || !cedarExt.policies || cedarExt.policies.length === 0) {
+        return { valid: true, policyCount: 0, results: [], hasSchema: false };
+    }
+    const results = [];
+    const hasSchema = !!cedarExt.schema_text;
+    for (const policy of cedarExt.policies) {
+        const result = hasSchema
+            ? validatePolicyWithSchema(policy.policy_text, cedarExt.schema_text, policy.id)
+            : validatePolicyText(policy.policy_text, policy.id);
+        results.push(result);
+    }
+    return {
+        valid: results.every((r) => r.valid),
+        policyCount: cedarExt.policies.length,
+        results,
+        hasSchema,
+    };
+}
+//# sourceMappingURL=cedar-validator.service.js.map

package/dist/services/mcp/bridge.service.d.ts

@@ -34,6 +34,7 @@ export declare class McpBridgeService {
     private getRegistryPath;
     private loadRegistry;
     private saveRegistry;
+    private saveToolManifest;
     /**
      * Use @modelcontextprotocol/sdk Client to connect to a stdio server and list its tools.
      * Returns an empty array if connection fails (non-fatal — import still proceeds).

package/dist/services/mcp/bridge.service.js

@@ -58,6 +58,34 @@ let McpBridgeService = class McpBridgeService {
         fs.writeFileSync(registryPath, yaml.dump({ generatedBy: 'ossa-mcp-bridge', apiVersion: getApiVersion(), updatedAt: new Date().toISOString(), servers }, { lineWidth: 120 }), 'utf8');
         return registryPath;
     }
+    saveToolManifest(workspaceDir, server) {
+        const toolsDir = path.join(workspaceDir, '.agents-workspace', 'tools');
+        if (!fs.existsSync(toolsDir)) {
+            fs.mkdirSync(toolsDir, { recursive: true });
+        }
+        const manifest = {
+            apiVersion: 'ossa.dev/v0.5',
+            kind: 'Tool',
+            metadata: {
+                name: server.name,
+                description: `Imported MCP server from ${server.source}`,
+                trust_tier: 'experimental',
+                created: server.importedAt,
+            },
+            spec: {
+                protocol: 'mcp',
+                endpoint: {
+                    transport: server.transport,
+                    command: server.command,
+                    args: server.args,
+                    url: server.url,
+                },
+                capabilities: server.tools ?? [],
+            },
+        };
+        const filePath = path.join(toolsDir, `${server.name}.yaml`);
+        fs.writeFileSync(filePath, yaml.dump(manifest, { lineWidth: -1 }), 'utf8');
+    }
     /**
      * Use @modelcontextprotocol/sdk Client to connect to a stdio server and list its tools.
      * Returns an empty array if connection fails (non-fatal — import still proceeds).
@@ -128,6 +156,9 @@ let McpBridgeService = class McpBridgeService {
         }
         const merged = [...existing, ...newEntries];
         const registryPath = this.saveRegistry(dir, merged);
+        for (const entry of newEntries) {
+            this.saveToolManifest(dir, entry);
+        }
         return { action: 'sync', source, serversFound: parsed.length, serversImported: newEntries.length, registryPath, servers: newEntries };
     }
     async list(workspaceDir) {

package/dist/services/skills-pipeline/skills-install.service.js

@@ -12,10 +12,10 @@ var __decorate = (this && this.__decorate) || function (decorators, target, key,
 var __metadata = (this && this.__metadata) || function (k, v) {
     if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
 };
-import { injectable } from 'inversify';
+import { Octokit } from '@octokit/rest';
 import * as fs from 'fs/promises';
+import { injectable } from 'inversify';
 import * as path from 'path';
-import { Octokit } from '@octokit/rest';
 /**
  * Parse GitHub URL into owner and repo.
  */

package/dist/services/skills-pipeline/skills-research.service.d.ts

@@ -59,28 +59,27 @@ export declare class SkillsResearchService {
      */
     private updateIndex;
     /**
-     * Fetch skills from a research source — dispatches by source type.
-     * Uses @octokit/rest SDK for GitHub and axios for npm registry.
+     * Fetch skills from a research source — dispatches by source type
      */
     private fetchFromSource;
     /**
      * Fetch skills from an awesome-list repo (e.g., awesome-claude-code)
-     * Uses Octokit SDK to fetch README.md and parses markdown links
+     * Parses the README.md for markdown links to skill repos/tools
      */
     private fetchFromAwesomeList;
     /**
      * Fetch skills from a showcase repo (e.g., claude-code-showcase)
-     * Uses Octokit SDK to list directories and read their READMEs
+     * Lists top-level directories and reads their README for metadata
      */
     private fetchFromShowcase;
     /**
      * Fetch skills from npm registry search
-     * Uses axios to search for packages with keyword "claude-skill" or "ossa-agent"
+     * Searches for packages with keyword "claude-skill" or "ossa-agent"
      */
     private fetchFromNpmRegistry;
     /**
      * Fetch skills from a generic GitHub repo
-     * Uses Octokit SDK to list YAML/MD files that look like agent definitions
+     * Lists YAML/MD files that look like agent definitions
      */
     private fetchFromGitHubRepo;
     /**
@@ -89,7 +88,6 @@ export declare class SkillsResearchService {
     private extractTriggersFromText;
     /**
      * Parse GitHub URL into owner/repo
-     * Logs parsing errors instead of silently swallowing them in catch blocks
      */
     private parseGitHubUrl;
     /**

package/dist/services/skills-pipeline/skills-research.service.js

@@ -58,53 +58,13 @@ const DEFAULT_SOURCES = [
  * Common English stop words to exclude from trigger extraction
  */
 const STOP_WORDS = new Set([
-    'the',
-    'and',
-    'for',
-    'are',
-    'but',
-    'not',
-    'you',
-    'all',
-    'can',
-    'her',
-    'was',
-    'one',
-    'our',
-    'out',
-    'has',
-    'have',
-    'with',
-    'this',
-    'that',
-    'from',
-    'they',
-    'been',
-    'said',
-    'each',
-    'which',
-    'their',
-    'will',
-    'other',
-    'about',
-    'many',
-    'then',
-    'them',
-    'these',
-    'some',
-    'would',
-    'make',
-    'like',
-    'into',
-    'could',
-    'time',
-    'very',
-    'when',
-    'come',
-    'made',
-    'use',
-    'using',
-    'used',
+    'the', 'and', 'for', 'are', 'but', 'not', 'you', 'all',
+    'can', 'her', 'was', 'one', 'our', 'out', 'has', 'have',
+    'with', 'this', 'that', 'from', 'they', 'been', 'said',
+    'each', 'which', 'their', 'will', 'other', 'about', 'many',
+    'then', 'them', 'these', 'some', 'would', 'make', 'like',
+    'into', 'could', 'time', 'very', 'when', 'come', 'made',
+    'use', 'using', 'used',
 ]);
 let SkillsResearchService = class SkillsResearchService {
     indexPath;
@@ -194,8 +154,7 @@ let SkillsResearchService = class SkillsResearchService {
         return deduped;
     }
     /**
-     * Fetch skills from a research source — dispatches by source type.
-     * Uses @octokit/rest SDK for GitHub and axios for npm registry.
+     * Fetch skills from a research source — dispatches by source type
      */
     async fetchFromSource(source) {
         switch (source.type) {
@@ -214,7 +173,7 @@ let SkillsResearchService = class SkillsResearchService {
     }
     /**
      * Fetch skills from an awesome-list repo (e.g., awesome-claude-code)
-     * Uses Octokit SDK to fetch README.md and parses markdown links
+     * Parses the README.md for markdown links to skill repos/tools
      */
     async fetchFromAwesomeList(source) {
         const { owner, repo } = this.parseGitHubUrl(source.url);
@@ -258,7 +217,7 @@ let SkillsResearchService = class SkillsResearchService {
     }
     /**
      * Fetch skills from a showcase repo (e.g., claude-code-showcase)
-     * Uses Octokit SDK to list directories and read their READMEs
+     * Lists top-level directories and reads their README for metadata
      */
     async fetchFromShowcase(source) {
         const { owner, repo } = this.parseGitHubUrl(source.url);
@@ -319,7 +278,7 @@ let SkillsResearchService = class SkillsResearchService {
     }
     /**
      * Fetch skills from npm registry search
-     * Uses axios to search for packages with keyword "claude-skill" or "ossa-agent"
+     * Searches for packages with keyword "claude-skill" or "ossa-agent"
      */
     async fetchFromNpmRegistry(source) {
         const skills = [];
@@ -362,7 +321,7 @@ let SkillsResearchService = class SkillsResearchService {
     }
     /**
      * Fetch skills from a generic GitHub repo
-     * Uses Octokit SDK to list YAML/MD files that look like agent definitions
+     * Lists YAML/MD files that look like agent definitions
      */
     async fetchFromGitHubRepo(source) {
         const { owner, repo } = this.parseGitHubUrl(source.url);
@@ -407,15 +366,11 @@ let SkillsResearchService = class SkillsResearchService {
     }
     /**
      * Parse GitHub URL into owner/repo
-     * Logs parsing errors instead of silently swallowing them in catch blocks
      */
     parseGitHubUrl(url) {
         const match = url.match(/github\.com\/([^/]+)\/([^/]+)/);
-        if (!match) {
-            // Log the specific parsing error before throwing
-            console.warn(`Failed to parse GitHub URL: ${url}`);
+        if (!match)
             throw new Error(`Invalid GitHub URL: ${url}`);
-        }
         return { owner: match[1], repo: match[2].replace(/\.git$/, '') };
     }
     /**

package/dist/services/trust/trust.service.d.ts

@@ -35,4 +35,13 @@ export declare function canonicalManifestBytes(manifest: Record<string, unknown>
  * Verifies an agent's x-signature block against its canonical manifest.
  */
 export declare function verifyAgentSignature(manifest: Record<string, unknown>, signature: XSignature, agentId?: string): Promise<TrustVerificationResult>;
+/**
+ * Sign an agent manifest using an Ed25519 private key.
+ *
+ * @param manifest The agent manifest to sign
+ * @param privateKeyHex The Ed25519 private key in hex format
+ * @param issuer Optional DID or identifier of the signer
+ * @returns The manifest with the appended x-signature block
+ */
+export declare function signAgentManifest(manifest: Record<string, unknown>, privateKeyHex: string, issuer?: string): Promise<Record<string, unknown>>;
 //# sourceMappingURL=trust.service.d.ts.map

package/dist/services/trust/trust.service.js

@@ -170,6 +170,41 @@ export async function verifyAgentSignature(manifest, signature, agentId) {
         };
     }
 }
+/**
+ * Sign an agent manifest using an Ed25519 private key.
+ *
+ * @param manifest The agent manifest to sign
+ * @param privateKeyHex The Ed25519 private key in hex format
+ * @param issuer Optional DID or identifier of the signer
+ * @returns The manifest with the appended x-signature block
+ */
+export async function signAgentManifest(manifest, privateKeyHex, issuer) {
+    const payload = canonicalManifestBytes(manifest);
+    // Use @noble/ed25519 to sign the payload
+    const sigBytes = await ed.signAsync(payload, privateKeyHex);
+    const pubBytes = await ed.getPublicKeyAsync(privateKeyHex);
+    // Convert to base64 for the signature block
+    const signatureB64 = Buffer.from(sigBytes).toString('base64');
+    const publicKeyB64 = Buffer.from(pubBytes).toString('base64');
+    const signature = {
+        type: 'Ed25519',
+        value: signatureB64,
+        publicKey: publicKeyB64,
+        timestamp: new Date().toISOString()
+    };
+    if (issuer) {
+        signature.issuer = issuer;
+    }
+    // Insert x-signature into metadata
+    const metadata = manifest.metadata || {};
+    return {
+        ...manifest,
+        metadata: {
+            ...metadata,
+            'x-signature': signature
+        }
+    };
+}
 // ─── Utilities ──────────────────────────────────────────────
 function base64ToBytes(b64) {
     const binary = atob(b64);

package/dist/services/validators/a2a.validator.js

@@ -42,8 +42,8 @@ let A2AValidator = class A2AValidator {
             }
         }
         if (a2aConfig.agent_card &&
-            !a2aConfig.agent_card.agent_uri?.startsWith('agent://')) {
-            errors.push('Agent URI must start with agent://');
+            !a2aConfig.agent_card.agent_uri?.startsWith('uadp://')) {
+            errors.push('Agent URI must start with uadp://');
         }
         if (a2aConfig.handoff_protocol && !a2aConfig.service_discovery?.enabled) {
             warnings.push('Handoff protocol configured without service discovery');

package/dist/skills/test-skill/package.json

@@ -31,6 +31,6 @@
   ],
   "ossa": {
     "type": "claude-skill",
-    "skillPath": "/var/folders/48/d86hncy50j93r_vzsv6knttr0000gn/T/ossa-export-test-1772826461079/test-skill"
+    "skillPath": "/var/folders/48/d86hncy50j93r_vzsv6knttr0000gn/T/ossa-export-test-1773084155160/test-skill"
   }
 }

package/dist/spec/uadp/README.md

@@ -367,7 +367,7 @@ A more complete implementation adds:
 
 Reference implementations:
 - **Drupal**: `ai_agents_marketplace` module (PHP)
-- **Express**: `@ossa/uadp-node` (TypeScript) — planned
+- **Express**: `@bluefly/duadp` (TypeScript) — planned
 - **Static**: GitHub Pages with JSON files — planned
 
 ## Appendix A: JSON Schemas

package/dist/spec/v0.4/agent-card.schema.json

@@ -8,8 +8,8 @@
   "properties": {
     "uri": {
       "type": "string",
-      "pattern": "^agent://",
-      "description": "Agent URI in the format agent://{namespace}/{name}"
+      "pattern": "^uadp://",
+      "description": "Agent URI in the format uadp://{namespace}/{name}"
     },
     "name": {
       "type": "string",

package/dist/spec/v0.4/agent.schema.json

@@ -60,6 +60,11 @@
     "extensions": {
       "type": "object",
       "description": "Framework-specific extensions (inherited from v0.4)",
+      "properties": {
+        "agentscope": {
+          "$ref": "#/definitions/AgentScopeExtension"
+        }
+      },
       "additionalProperties": true
     },
     "runtime": {
@@ -251,6 +256,7 @@
             "langchain",
             "crewai",
             "autogen",
+            "agentscope",
             "llamaindex",
             "haystack",
             "semantic-kernel",
@@ -363,6 +369,69 @@
       },
       "additionalProperties": false
     },
+    "AgentScopeExtension": {
+      "type": "object",
+      "description": "AgentScope framework-specific runtime configuration. AgentScope is a production-ready Python agent framework with ReAct agents, RL training, realtime voice, MCP/A2A support, and rich memory backends.",
+      "properties": {
+        "version": {
+          "type": "string",
+          "description": "AgentScope framework version (e.g., 1.0.16)",
+          "pattern": "^\\d+\\.\\d+\\.\\d+"
+        },
+        "agent_class": {
+          "type": "string",
+          "description": "Python agent class to instantiate",
+          "enum": ["ReActAgent", "UserAgent", "A2AAgent", "RealtimeAgent", "custom"],
+          "default": "ReActAgent"
+        },
+        "capabilities": {
+          "type": "array",
+          "items": {
+            "type": "string",
+            "enum": ["rl_training", "realtime_voice", "evaluation", "planning", "rag", "parallel_tool_calls", "meta_tools", "tts"]
+          },
+          "description": "AgentScope-specific capabilities enabled for this agent"
+        },
+        "memory_backend": {
+          "type": "string",
+          "enum": ["in_memory", "redis", "sqlalchemy", "mem0", "reme_personal", "reme_task", "reme_tool"],
+          "default": "in_memory",
+          "description": "Memory backend for working/long-term memory"
+        },
+        "orchestration": {
+          "type": "string",
+          "enum": ["msghub", "sequential_pipeline", "fanout_pipeline", "chatroom"],
+          "description": "Multi-agent orchestration pattern when used in composition"
+        },
+        "max_iters": {
+          "type": "integer",
+          "minimum": 1,
+          "maximum": 100,
+          "default": 10,
+          "description": "Maximum reasoning-acting loop iterations for ReActAgent"
+        },
+        "formatter": {
+          "type": "string",
+          "enum": ["openai", "anthropic", "gemini", "dashscope", "ollama", "deepseek", "a2a"],
+          "description": "Message formatter for the model provider"
+        },
+        "compression": {
+          "type": "object",
+          "properties": {
+            "enable": { "type": "boolean", "default": false },
+            "trigger_threshold": { "type": "integer", "description": "Token count to trigger compression" },
+            "keep_recent": { "type": "integer", "default": 3, "description": "Recent messages to preserve" }
+          },
+          "description": "Memory compression configuration"
+        },
+        "skill_dirs": {
+          "type": "array",
+          "items": { "type": "string" },
+          "description": "Paths to SKILL.md directories to register as agent skills"
+        }
+      },
+      "additionalProperties": false
+    },
     "Publisher": {
       "type": "object",
       "description": "Publisher information for agent attribution, trust, and contact. Enables trust chains when combined with PGP signatures.",

package/dist/spec/v0.4/extensions/a2a/a2a.schema.json

@@ -19,7 +19,7 @@
       "type": "object",
       "description": "Agent identity card for A2A",
       "properties": {
-        "agent_uri": { "type": "string", "pattern": "^agent://" },
+        "agent_uri": { "type": "string", "pattern": "^uadp://" },
         "capabilities": { "type": "array", "items": { "type": "string" } },
         "protocols": {
           "type": "array",

package/dist/spec/v0.5/agent-card.schema.json

@@ -22,7 +22,7 @@
     },
     "ossaVersion": {
       "type": "string",
-      "description": "OSSA specification version (e.g., ossa/v0.4.6)"
+      "description": "OSSA specification version (e.g., ossa/v0.4.7)"
     },
     "taxonomy": {
       "type": "object",