@bluefly/openstandardagents 0.4.9 → 0.5.1

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (259) hide show
  1. package/.version.json +3 -3
  2. package/CHANGELOG.md +35 -4
  3. package/README.md +77 -62
  4. package/dist/.version.json +3 -3
  5. package/dist/adapters/a2a/a2a-protocol.js +4 -2
  6. package/dist/adapters/a2a/a2a-tool.js +4 -2
  7. package/dist/adapters/a2a/mcp-integration.d.ts +2 -1
  8. package/dist/adapters/a2a/mcp-integration.js +6 -3
  9. package/dist/adapters/browser/browser-exporter.d.ts +26 -0
  10. package/dist/adapters/browser/browser-exporter.js +73 -0
  11. package/dist/adapters/browser/browser-runner.d.ts +23 -0
  12. package/dist/adapters/browser/browser-runner.js +46 -0
  13. package/dist/adapters/browser/index.d.ts +9 -0
  14. package/dist/adapters/browser/index.js +9 -0
  15. package/dist/adapters/claude-code/adapter.js +2 -2
  16. package/dist/adapters/docker/generators.js +19 -19
  17. package/dist/adapters/docker/index.d.ts +2 -0
  18. package/dist/adapters/docker/index.js +2 -0
  19. package/dist/adapters/docker/openclaw-bridge.d.ts +57 -0
  20. package/dist/adapters/docker/openclaw-bridge.js +173 -0
  21. package/dist/adapters/drupal/generator.js +76 -76
  22. package/dist/adapters/drupal/index.d.ts +1 -0
  23. package/dist/adapters/drupal/index.js +2 -0
  24. package/dist/adapters/drupal/twig-renderer.d.ts +23 -0
  25. package/dist/adapters/drupal/twig-renderer.js +99 -0
  26. package/dist/adapters/gitlab/agent-generator.js +2 -1
  27. package/dist/adapters/openai-agents/adapter.js +2 -2
  28. package/dist/api/index.js +2 -1
  29. package/dist/api/routes/mcp.router.js +3 -1
  30. package/dist/api/routes/wizard.router.js +3 -1
  31. package/dist/cli/commands/agent/discover-type.command.js +1 -1
  32. package/dist/cli/commands/agent-card.command.js +37 -10
  33. package/dist/cli/commands/agents-sync.command.d.ts +2 -2
  34. package/dist/cli/commands/agents-sync.command.js +27 -17
  35. package/dist/cli/commands/catalog/config.js +1 -1
  36. package/dist/cli/commands/catalog/validate.command.js +2 -2
  37. package/dist/cli/commands/config.command.js +2 -2
  38. package/dist/cli/commands/daemon.command.js +32 -8
  39. package/dist/cli/commands/discover.d.ts +1 -1
  40. package/dist/cli/commands/discover.js +16 -8
  41. package/dist/cli/commands/economics.command.d.ts +9 -0
  42. package/dist/cli/commands/economics.command.js +113 -0
  43. package/dist/cli/commands/export.command.js +6 -3
  44. package/dist/cli/commands/mcp.command.js +3 -1
  45. package/dist/cli/commands/memory.command.d.ts +18 -0
  46. package/dist/cli/commands/memory.command.js +168 -0
  47. package/dist/cli/commands/publish.command.js +7 -4
  48. package/dist/cli/commands/serve-builder-routes.js +1 -1
  49. package/dist/cli/commands/usie-skills.command.d.ts +24 -0
  50. package/dist/cli/commands/usie-skills.command.js +297 -0
  51. package/dist/cli/commands/validate.command.js +8 -1
  52. package/dist/cli/commands/verify.d.ts +3 -3
  53. package/dist/cli/commands/verify.js +12 -6
  54. package/dist/cli/commands/workspace.command.d.ts +1 -0
  55. package/dist/cli/commands/workspace.command.js +28 -4
  56. package/dist/cli/index.js +12 -0
  57. package/dist/cli/schema-driven/schema-loader.js +5 -5
  58. package/dist/cli/workspace-validate.d.ts +23 -0
  59. package/dist/cli/workspace-validate.js +117 -0
  60. package/dist/data/platform-matrix.js +1 -4
  61. package/dist/generated/types.d.ts +97 -97
  62. package/dist/index.d.ts +2 -0
  63. package/dist/index.js +2 -0
  64. package/dist/mcp-server/index.js +658 -982
  65. package/dist/mesh/discovery-gkg.d.ts +26 -0
  66. package/dist/mesh/discovery-gkg.js +92 -0
  67. package/dist/messenger/Handler/AgentBatchHandler.js +3 -2
  68. package/dist/messenger/Handler/AgentExecutionHandler.js +6 -1
  69. package/dist/package.json +43 -14
  70. package/dist/sdks/shared/types.d.ts +1 -1
  71. package/dist/services/agent-card-generator.js +6 -2
  72. package/dist/services/daemon/audit-log.service.js +3 -1
  73. package/dist/services/daemon/execution.service.js +8 -4
  74. package/dist/services/daemon/fs-watcher.service.js +6 -7
  75. package/dist/services/daemon/pairing.service.js +2 -1
  76. package/dist/services/daemon/skill-aggregator.service.js +105 -21
  77. package/dist/services/daemon/sse-endpoints.js +1 -1
  78. package/dist/services/daemon/ws-server.js +10 -3
  79. package/dist/services/export/langchain/langchain-exporter.js +2 -2
  80. package/dist/services/export/langchain/memory-generator.js +2 -2
  81. package/dist/services/export/testing/test-generator.js +1 -1
  82. package/dist/services/governance/cedar-provider.js +12 -8
  83. package/dist/services/governance/cedar-validator.service.js +1 -1
  84. package/dist/services/mcp/bridge.service.js +40 -9
  85. package/dist/services/openapi-extensions-validation.d.ts +20 -0
  86. package/dist/services/openapi-extensions-validation.js +193 -0
  87. package/dist/services/release-automation/merge-request.service.d.ts +4 -4
  88. package/dist/services/release-automation/release-buttons.js +3 -3
  89. package/dist/services/release-automation/schemas/release.schema.d.ts +3 -3
  90. package/dist/services/runtime/openai.adapter.d.ts +46 -13
  91. package/dist/services/runtime/openai.adapter.js +169 -131
  92. package/dist/services/skill-registry.service.d.ts +1 -1
  93. package/dist/services/skills-pipeline/skills-research.service.js +47 -7
  94. package/dist/services/taxonomy-service.d.ts +3 -3
  95. package/dist/services/trust/trust.service.js +6 -4
  96. package/dist/services/validation-zod.service.js +3 -22
  97. package/dist/services/validators/index.d.ts +1 -0
  98. package/dist/services/validators/index.js +1 -0
  99. package/dist/services/validators/registry.d.ts +21 -0
  100. package/dist/services/validators/registry.js +42 -0
  101. package/dist/skills/test-skill/package.json +1 -1
  102. package/dist/spec/extensions/cognition.schema.json +87 -0
  103. package/dist/spec/extensions/role-manifest.md +188 -0
  104. package/dist/spec/layer4-economics/duadp-examples.json +44 -0
  105. package/dist/spec/v0.4/agent.schema.json +14 -0
  106. package/dist/spec/v0.4/extensions/mcp/README.md +1 -1
  107. package/dist/spec/v0.5/agent-builder-openapi.yaml +230 -0
  108. package/dist/spec/v0.5/agent.schema.json +34 -2
  109. package/dist/spec/v0.5/extensions/cognition/cognition.schema.json +78 -1
  110. package/dist/spec/v0.5/extensions/economics/context-pack.schema.json +91 -0
  111. package/dist/spec/v0.5/extensions/economics/execution-profile.schema.json +148 -0
  112. package/dist/spec/v0.5/extensions/economics/failure-semantics.schema.json +32 -0
  113. package/dist/spec/v0.5/extensions/economics/replay-packet.schema.json +120 -0
  114. package/dist/spec/v0.5/memory-hierarchy.yaml +120 -0
  115. package/dist/spec/v0.5/role.schema.json +268 -0
  116. package/dist/spec/v1/agent-card.schema.json +254 -0
  117. package/dist/types/cognition.zod.d.ts +312 -0
  118. package/dist/types/cognition.zod.js +223 -0
  119. package/dist/types/identity.zod.d.ts +5 -5
  120. package/dist/types/index.d.ts +54 -6
  121. package/dist/types/index.js +6 -2
  122. package/dist/types/personality.zod.d.ts +3 -3
  123. package/dist/types/role.d.ts +126 -0
  124. package/dist/types/role.js +38 -0
  125. package/dist/utils/http-client.d.ts +22 -0
  126. package/dist/utils/http-client.js +51 -0
  127. package/dist/utils/index.d.ts +3 -0
  128. package/dist/utils/index.js +3 -0
  129. package/dist/utils/proxy-resolver.d.ts +36 -0
  130. package/dist/utils/proxy-resolver.js +59 -0
  131. package/dist/utils/user-agent.d.ts +11 -0
  132. package/dist/utils/user-agent.js +17 -0
  133. package/dist/validation/validator.js +1 -1
  134. package/dist/validation/version-compliance.js +1 -1
  135. package/examples/agents/01-customer-support-bot/agent.ossa.yaml +24 -31
  136. package/examples/agents/05-sales-assistant/agent.ossa.yaml +35 -23
  137. package/examples/agents/07-research-assistant/agent.ossa.yaml +27 -21
  138. package/examples/agents/10-meeting-assistant/agent.ossa.yaml +27 -35
  139. package/examples/agents/security-audit-agent.ossa.yaml +234 -0
  140. package/examples/agentscope/react-assistant/README.md +1 -1
  141. package/examples/agentscope/react-assistant/agent.ossa.yaml +37 -33
  142. package/examples/drupal/content-moderator.ossa.yaml +2 -2
  143. package/examples/drupal/drupal-contributor-agent/.eslintrc.json +58 -0
  144. package/examples/drupal/drupal-contributor-agent/.prettierrc.json +10 -0
  145. package/examples/drupal/drupal-contributor-agent/package.json +55 -0
  146. package/examples/drupal/drupal-contributor-agent/src/core/index.ts +10 -0
  147. package/examples/drupal/drupal-contributor-agent/src/index.ts +17 -0
  148. package/examples/drupal/drupal-contributor-agent/src/types/index.ts +180 -0
  149. package/examples/drupal/drupal-contributor-agent/tsconfig.json +36 -0
  150. package/examples/drupal/drupal-contributor.ossa.yaml +247 -0
  151. package/examples/export/langchain/production-agent-with-memory/README.md +1 -1
  152. package/examples/export/langchain/production-agent-with-memory/agent.ossa.yaml +13 -23
  153. package/examples/export/langchain/production-agent-with-streaming/agent.ossa.yaml +1 -15
  154. package/examples/export/langchain/production-agent-with-tools/agent.ossa.yaml +28 -29
  155. package/examples/getting-started/01-minimal-agent.ossa.yaml +1 -1
  156. package/examples/getting-started/02-agent-with-tools.ossa.yaml +1 -1
  157. package/examples/getting-started/03-agent-with-safety.ossa.yaml +1 -1
  158. package/examples/getting-started/04-agent-with-messaging.ossa.yaml +1 -1
  159. package/examples/getting-started/05-workflow-composition.ossa.yaml +1 -1
  160. package/examples/getting-started/README.md +3 -3
  161. package/examples/getting-started/hello-world-complete.ossa.yaml +1 -1
  162. package/examples/gitlab-agents/gitlab-ci-agent.ossa.yaml +221 -0
  163. package/examples/hierarchical-agent.ossa.yaml +10 -53
  164. package/examples/kagent/ossa-kagent-anthropic.ossa.yaml +2 -25
  165. package/examples/kagent/ossa-kagent-mcp-tools.ossa.yaml +2 -30
  166. package/examples/kagent/ossa-kagent-multi-tool.ossa.yaml +2 -18
  167. package/examples/kagent/ossa-kagent-poc.ossa.yaml +2 -16
  168. package/examples/pipeline-agent.ossa.yaml +3 -3
  169. package/examples/platform-specific/claude-code-subagent.yaml +1 -1
  170. package/examples/platform-specific/cursor-coding-agent.yaml +1 -1
  171. package/examples/platform-specific/warp-terminal-agent.yaml +1 -1
  172. package/examples/production-ready/01-customer-support-bot/agent.ossa.yaml +24 -31
  173. package/examples/production-ready/05-sales-assistant/agent.ossa.yaml +35 -23
  174. package/examples/production-ready/07-research-assistant/agent.ossa.yaml +27 -19
  175. package/examples/production-ready/10-meeting-assistant/agent.ossa.yaml +27 -35
  176. package/examples/roles/drupal-developer.role.yaml +37 -0
  177. package/examples/roles/platform-operator.role.yaml +28 -0
  178. package/examples/roles/security-auditor.role.yaml +27 -0
  179. package/examples/swarm-agent.ossa.yaml +13 -51
  180. package/examples/team-agent.ossa.yaml +12 -61
  181. package/examples/team-lead-teammate.ossa.yaml +12 -17
  182. package/openapi/agent-cognition-sessions.yaml +580 -0
  183. package/openapi/agent-communication.yaml +260 -212
  184. package/openapi/agent-crud.yaml +237 -207
  185. package/openapi/agent-discovery.yaml +119 -81
  186. package/openapi/agent-identity.yaml +219 -187
  187. package/openapi/agent-taxonomy.yaml +95 -38
  188. package/openapi/agents-md-service.yaml +103 -30
  189. package/openapi/cli/openapi.yaml +147 -40
  190. package/openapi/core/ossa-core-api.openapi.yaml +327 -271
  191. package/openapi/core/ossa-registry-api.openapi.yaml +299 -236
  192. package/openapi/core/ossa-registry.openapi.yaml +299 -159
  193. package/openapi/core/unified-agent-gateway.openapi.yaml +234 -170
  194. package/openapi/daemon-api.openapi.yaml +323 -181
  195. package/openapi/dev-cli/openapi.yaml +137 -113
  196. package/openapi/github-sync.yaml +62 -19
  197. package/openapi/marketplace-plugin.openapi.yaml +539 -466
  198. package/openapi/ossa-api.openapi.yaml +354 -213
  199. package/openapi/ossa-cli-enhancements.openapi.yaml +109 -90
  200. package/openapi/ossa-cli.yaml +260 -184
  201. package/openapi/protocols/sse-streams.yaml +66 -74
  202. package/openapi/protocols/websocket-events.yaml +61 -54
  203. package/openapi/reference-implementations/aiflow-bridge-api.openapi.yaml +37 -20
  204. package/openapi/reference-implementations/compliance-agent-api.openapi.yaml +35 -23
  205. package/openapi/reference-implementations/crewai-agent-api.openapi.yaml +29 -18
  206. package/openapi/reference-implementations/critic-agent-api.openapi.yaml +45 -19
  207. package/openapi/reference-implementations/document-analyzer-api.openapi.yaml +30 -24
  208. package/openapi/reference-implementations/drupal-agent-api.openapi.yaml +101 -50
  209. package/openapi/reference-implementations/getting-started-hello-world-api.openapi.yaml +33 -22
  210. package/openapi/reference-implementations/gitlab-ml-recommender-api.openapi.yaml +20 -16
  211. package/openapi/reference-implementations/governor-agent-api.openapi.yaml +41 -23
  212. package/openapi/reference-implementations/helm-generator.openapi.yaml +88 -46
  213. package/openapi/reference-implementations/integrator-agent-api.openapi.yaml +30 -20
  214. package/openapi/reference-implementations/judge-agent-api.openapi.yaml +22 -16
  215. package/openapi/reference-implementations/k8s-troubleshooter-api.openapi.yaml +32 -18
  216. package/openapi/reference-implementations/langchain-agent-api.openapi.yaml +32 -21
  217. package/openapi/reference-implementations/monitor-agent-api.openapi.yaml +34 -21
  218. package/openapi/reference-implementations/orchestrator-agent-api.openapi.yaml +49 -27
  219. package/openapi/reference-implementations/quickstart-support-agent-api.openapi.yaml +27 -19
  220. package/openapi/reference-implementations/self-evolving-ecosystem.openapi.yaml +427 -293
  221. package/openapi/reference-implementations/worker-agent-api.openapi.yaml +34 -23
  222. package/openapi/reference-implementations/workflow-orchestrator-api.openapi.yaml +35 -21
  223. package/openapi/release-automation.openapi.yaml +48 -14
  224. package/openapi/schemas/common/agent.yaml +30 -29
  225. package/openapi/schemas/common/economics.yaml +98 -0
  226. package/openapi/schemas/common/errors.yaml +13 -3
  227. package/openapi/schemas/common/metadata.yaml +22 -7
  228. package/openapi/schemas/common/pagination.yaml +18 -6
  229. package/openapi/schemas/common/security.yaml +13 -5
  230. package/openapi/schemas/index.yaml +49 -42
  231. package/openapi/uadp-asyncapi.yaml +5 -3
  232. package/openapi/uadp-openapi.yaml +243 -165
  233. package/openapi/version-management.openapi.yaml +142 -135
  234. package/package.json +43 -14
  235. package/spec/extensions/cognition.schema.json +87 -0
  236. package/spec/extensions/role-manifest.md +188 -0
  237. package/spec/layer4-economics/duadp-examples.json +44 -0
  238. package/spec/v0.4/agent.schema.json +14 -0
  239. package/spec/v0.4/extensions/mcp/README.md +1 -1
  240. package/spec/v0.5/agent-builder-openapi.yaml +230 -0
  241. package/spec/v0.5/agent.schema.json +34 -2
  242. package/spec/v0.5/extensions/cognition/cognition.schema.json +78 -1
  243. package/spec/v0.5/extensions/economics/context-pack.schema.json +91 -0
  244. package/spec/v0.5/extensions/economics/execution-profile.schema.json +148 -0
  245. package/spec/v0.5/extensions/economics/failure-semantics.schema.json +32 -0
  246. package/spec/v0.5/extensions/economics/replay-packet.schema.json +120 -0
  247. package/spec/v0.5/memory-hierarchy.yaml +120 -0
  248. package/spec/v0.5/role.schema.json +268 -0
  249. package/spec/v1/agent-card.schema.json +254 -0
  250. package/dist/adapters/a2a/__tests__/mcp-integration.spec.d.ts +0 -5
  251. package/dist/adapters/a2a/__tests__/mcp-integration.spec.js +0 -268
  252. package/dist/adapters/a2a/__tests__/mcp-transport.spec.d.ts +0 -5
  253. package/dist/adapters/a2a/__tests__/mcp-transport.spec.js +0 -203
  254. package/dist/mcp-server/__tests__/mcp-server.spec.d.ts +0 -8
  255. package/dist/mcp-server/__tests__/mcp-server.spec.js +0 -557
  256. package/dist/validation/__tests__/error-codes.test.d.ts +0 -5
  257. package/dist/validation/__tests__/error-codes.test.js +0 -252
  258. package/dist/version-management/core/version-manager.test.d.ts +0 -2
  259. package/dist/version-management/core/version-manager.test.js +0 -210
@@ -34,7 +34,9 @@ let DaemonWebSocketServer = class DaemonWebSocketServer {
34
34
  server.on('upgrade', (request, socket, head) => {
35
35
  // Enforce localhost-only binding at the connection level
36
36
  const remoteAddr = request.socket.remoteAddress;
37
- if (remoteAddr !== '127.0.0.1' && remoteAddr !== '::1' && remoteAddr !== '::ffff:127.0.0.1') {
37
+ if (remoteAddr !== '127.0.0.1' &&
38
+ remoteAddr !== '::1' &&
39
+ remoteAddr !== '::ffff:127.0.0.1') {
38
40
  socket.write('HTTP/1.1 403 Forbidden\r\n\r\n');
39
41
  socket.destroy();
40
42
  return;
@@ -42,7 +44,10 @@ let DaemonWebSocketServer = class DaemonWebSocketServer {
42
44
  // Extract pairing token from Sec-WebSocket-Protocol header
43
45
  const protocols = request.headers['sec-websocket-protocol'];
44
46
  const token = typeof protocols === 'string'
45
- ? protocols.split(',').map(p => p.trim()).find(p => p.startsWith('pairing.'))
47
+ ? protocols
48
+ .split(',')
49
+ .map((p) => p.trim())
50
+ .find((p) => p.startsWith('pairing.'))
46
51
  : undefined;
47
52
  if (!token) {
48
53
  socket.write('HTTP/1.1 401 Unauthorized\r\n\r\n');
@@ -71,7 +76,9 @@ let DaemonWebSocketServer = class DaemonWebSocketServer {
71
76
  */
72
77
  sendToSession(sessionId, event) {
73
78
  const session = this.sessions.get(sessionId);
74
- if (session && session.authenticated && session.ws.readyState === WebSocket.OPEN) {
79
+ if (session &&
80
+ session.authenticated &&
81
+ session.ws.readyState === WebSocket.OPEN) {
75
82
  session.ws.send(JSON.stringify(event));
76
83
  }
77
84
  }
@@ -628,7 +628,7 @@ services:
628
628
  `;
629
629
  }
630
630
  else if (memoryBackend === 'postgres') {
631
- compose += ` - POSTGRES_URL=postgresql://postgres:postgres@postgres:5432/agent_memory
631
+ compose += ` - POSTGRES_URL=postgresql://postgres:\${POSTGRES_PASSWORD}@postgres:5432/agent_memory
632
632
  depends_on:
633
633
  - postgres
634
634
 
@@ -661,7 +661,7 @@ volumes:
661
661
  '',
662
662
  '# Memory Backend',
663
663
  'REDIS_URL=redis://localhost:6379',
664
- 'POSTGRES_URL=postgresql://postgres:postgres@localhost:5432/agent_memory',
664
+ 'POSTGRES_URL=postgresql://postgres:${POSTGRES_PASSWORD}@localhost:5432/agent_memory',
665
665
  '',
666
666
  '# API Configuration',
667
667
  'API_PORT=8000',
@@ -815,7 +815,7 @@ def _get_pg_pool():
815
815
 
816
816
  postgres_url = os.getenv(
817
817
  "POSTGRES_URL",
818
- "postgresql://postgres:postgres@localhost:5432/agent_memory"
818
+ "postgresql://postgres:your-password-here@localhost:5432/agent_memory"
819
819
  )
820
820
 
821
821
  if _pg_pool is None:
@@ -943,7 +943,7 @@ def get_memory(session_id: str = "default") -> ConversationBufferMemory:
943
943
 
944
944
  postgres_url = os.getenv(
945
945
  "POSTGRES_URL",
946
- "postgresql://postgres:postgres@localhost:5432/agent_memory"
946
+ "postgresql://postgres:your-password-here@localhost:5432/agent_memory"
947
947
  )
948
948
 
949
949
  message_history = PostgresChatMessageHistory(
@@ -2323,7 +2323,7 @@ class ${className}FunctionalTest extends BrowserTestBase {
2323
2323
 
2324
2324
  <php>
2325
2325
  <env name="SIMPLETEST_BASE_URL" value="http://localhost:8888"/>
2326
- <env name="SIMPLETEST_DB" value="mysql://drupal:drupal@localhost/drupal"/>
2326
+ <env name="SIMPLETEST_DB" value="mysql://drupal:\${DRUPAL_DB_PASSWORD}@localhost/drupal"/>
2327
2327
  <env name="BROWSERTEST_OUTPUT_DIRECTORY" value="sites/default/files/simpletest"/>
2328
2328
  </php>
2329
2329
  </phpunit>
@@ -36,7 +36,7 @@ export class CedarGovernanceProvider {
36
36
  return {
37
37
  compliant: issues.length === 0,
38
38
  issues,
39
- warnings
39
+ warnings,
40
40
  };
41
41
  }
42
42
  /**
@@ -51,7 +51,8 @@ export class CedarGovernanceProvider {
51
51
  const policies_evaluated = [];
52
52
  // Simulate Policy Evaluation Context
53
53
  const principalTier = context?.tier || 'tier_1_read';
54
- const isDestructive = action.toLowerCase().includes('delete') || action.toLowerCase().includes('write');
54
+ const isDestructive = action.toLowerCase().includes('delete') ||
55
+ action.toLowerCase().includes('write');
55
56
  policies_evaluated.push('policy_tier_bounds');
56
57
  // Sample Cedar constraint translation
57
58
  if (principalTier === 'tier_1_read' && isDestructive) {
@@ -62,14 +63,15 @@ export class CedarGovernanceProvider {
62
63
  // In a real integration, this would call the Cedar C++ binding or WASM module:
63
64
  // const cedarEval = await cedar.isAuthorized({ principal, action, resource, context });
64
65
  decision = 'ALLOW';
65
- reason = 'Allowed by default test policy matching principal and action scope.';
66
+ reason =
67
+ 'Allowed by default test policy matching principal and action scope.';
66
68
  }
67
69
  return {
68
70
  decision,
69
71
  reason,
70
72
  diagnostics: {
71
73
  policies_evaluated,
72
- }
74
+ },
73
75
  };
74
76
  }
75
77
  /**
@@ -78,7 +80,7 @@ export class CedarGovernanceProvider {
78
80
  async evaluateQualityGate(request) {
79
81
  const blocked_by = [];
80
82
  if (request.environment === 'production') {
81
- if (request.metrics.confidence_score < 0.90) {
83
+ if (request.metrics.confidence_score < 0.9) {
82
84
  blocked_by.push('Confidence score below production threshold (90%)');
83
85
  }
84
86
  if (request.metrics.vulnerability_count > 0) {
@@ -87,7 +89,7 @@ export class CedarGovernanceProvider {
87
89
  }
88
90
  else {
89
91
  // lower environments
90
- if (request.metrics.confidence_score < 0.70) {
92
+ if (request.metrics.confidence_score < 0.7) {
91
93
  blocked_by.push('Confidence score below development threshold (70%)');
92
94
  }
93
95
  }
@@ -97,8 +99,10 @@ export class CedarGovernanceProvider {
97
99
  blocked_by,
98
100
  policy_decision: {
99
101
  decision: decision === 'PASS' ? 'ALLOW' : 'DENY',
100
- reason: decision === 'PASS' ? 'Quality gate matched constraints.' : 'Metrics failed quality requirements.',
101
- }
102
+ reason: decision === 'PASS'
103
+ ? 'Quality gate matched constraints.'
104
+ : 'Metrics failed quality requirements.',
105
+ },
102
106
  };
103
107
  }
104
108
  }
@@ -5,7 +5,7 @@
5
5
  * This is OSSA's responsibility: schema definition + offline validation.
6
6
  * Runtime enforcement belongs to DUADP.
7
7
  */
8
- import { checkParsePolicySet, checkParseSchema, } from '@cedar-policy/cedar-wasm';
8
+ import { checkParsePolicySet, checkParseSchema, } from '@cedar-policy/cedar-wasm/nodejs';
9
9
  function extractErrors(answer) {
10
10
  if (answer.type === 'failure') {
11
11
  return answer.errors.map((e) => e.message ?? JSON.stringify(e));
@@ -55,7 +55,12 @@ let McpBridgeService = class McpBridgeService {
55
55
  if (!fs.existsSync(registryDir)) {
56
56
  fs.mkdirSync(registryDir, { recursive: true });
57
57
  }
58
- fs.writeFileSync(registryPath, yaml.dump({ generatedBy: 'ossa-mcp-bridge', apiVersion: getApiVersion(), updatedAt: new Date().toISOString(), servers }, { lineWidth: 120 }), 'utf8');
58
+ fs.writeFileSync(registryPath, yaml.dump({
59
+ generatedBy: 'ossa-mcp-bridge',
60
+ apiVersion: getApiVersion(),
61
+ updatedAt: new Date().toISOString(),
62
+ servers,
63
+ }, { lineWidth: 120 }), 'utf8');
59
64
  return registryPath;
60
65
  }
61
66
  saveToolManifest(workspaceDir, server) {
@@ -93,7 +98,11 @@ let McpBridgeService = class McpBridgeService {
93
98
  async discoverToolsViaSDK(command, args) {
94
99
  let client;
95
100
  try {
96
- const transport = new StdioClientTransport({ command, args, env: process.env });
101
+ const transport = new StdioClientTransport({
102
+ command,
103
+ args,
104
+ env: process.env,
105
+ });
97
106
  client = new Client({ name: 'ossa-mcp-bridge', version: '1.0.0' }, { capabilities: {} });
98
107
  await client.connect(transport);
99
108
  const { tools } = await client.listTools();
@@ -108,7 +117,9 @@ let McpBridgeService = class McpBridgeService {
108
117
  try {
109
118
  await client.close();
110
119
  }
111
- catch { /* swallow */ }
120
+ catch {
121
+ /* swallow */
122
+ }
112
123
  }
113
124
  }
114
125
  }
@@ -123,7 +134,8 @@ let McpBridgeService = class McpBridgeService {
123
134
  command: cfg.command,
124
135
  args: cfg.args,
125
136
  url: cfg.url,
126
- transport: cfg.transport ?? (cfg.command ? 'stdio' : 'sse'),
137
+ transport: cfg.transport ??
138
+ (cfg.command ? 'stdio' : 'sse'),
127
139
  }));
128
140
  }
129
141
  /**
@@ -159,7 +171,14 @@ let McpBridgeService = class McpBridgeService {
159
171
  for (const entry of newEntries) {
160
172
  this.saveToolManifest(dir, entry);
161
173
  }
162
- return { action: 'sync', source, serversFound: parsed.length, serversImported: newEntries.length, registryPath, servers: newEntries };
174
+ return {
175
+ action: 'sync',
176
+ source,
177
+ serversFound: parsed.length,
178
+ serversImported: newEntries.length,
179
+ registryPath,
180
+ servers: newEntries,
181
+ };
163
182
  }
164
183
  async list(workspaceDir) {
165
184
  const dir = path.resolve(workspaceDir);
@@ -175,13 +194,25 @@ let McpBridgeService = class McpBridgeService {
175
194
  const [serverName, method] = toolName.split('/');
176
195
  const server = servers.find((s) => s.name === serverName);
177
196
  if (!server) {
178
- return { allowed: false, reason: `"${serverName}" not in OSSA bridge registry. Run: ossa mcp bridge sync <source>` };
197
+ return {
198
+ allowed: false,
199
+ reason: `"${serverName}" not in OSSA bridge registry. Run: ossa mcp bridge sync <source>`,
200
+ };
179
201
  }
180
202
  // Verify the specific tool name if we have a tool list from SDK discovery
181
- if (server.tools && server.tools.length > 0 && method && !server.tools.includes(method)) {
182
- return { allowed: false, reason: `Tool "${method}" not found on server "${serverName}". Known tools: ${server.tools.join(', ')}` };
203
+ if (server.tools &&
204
+ server.tools.length > 0 &&
205
+ method &&
206
+ !server.tools.includes(method)) {
207
+ return {
208
+ allowed: false,
209
+ reason: `Tool "${method}" not found on server "${serverName}". Known tools: ${server.tools.join(', ')}`,
210
+ };
183
211
  }
184
- return { allowed: true, reason: `Agent "${agentId}" is authorized to call "${toolName}" via OSSA bridge.` };
212
+ return {
213
+ allowed: true,
214
+ reason: `Agent "${agentId}" is authorized to call "${toolName}" via OSSA bridge.`,
215
+ };
185
216
  }
186
217
  };
187
218
  McpBridgeService = __decorate([
@@ -0,0 +1,20 @@
1
+ import { type ErrorObject } from 'ajv';
2
+ export interface OpenApiExtensionsValidationWarning {
3
+ path: string;
4
+ message: string;
5
+ }
6
+ export interface OpenApiExtensionsSummary {
7
+ hasMetadata: boolean;
8
+ hasOssa: boolean;
9
+ hasAgent: boolean;
10
+ operationExtensions: number;
11
+ capabilitySchemaExtensions: number;
12
+ }
13
+ export interface OpenApiExtensionsValidationDetails {
14
+ valid: boolean;
15
+ errors: ErrorObject[];
16
+ warnings: OpenApiExtensionsValidationWarning[];
17
+ ossaExtensions: OpenApiExtensionsSummary;
18
+ }
19
+ export declare function validateOpenApiExtensionsDocument(openapiSpec: unknown): OpenApiExtensionsValidationDetails;
20
+ //# sourceMappingURL=openapi-extensions-validation.d.ts.map
@@ -0,0 +1,193 @@
1
+ import Ajv from 'ajv';
2
+ import addFormats from 'ajv-formats';
3
+ import { existsSync, readFileSync } from 'node:fs';
4
+ import { dirname, resolve } from 'node:path';
5
+ import { fileURLToPath } from 'node:url';
6
+ const currentFilePath = fileURLToPath(import.meta.url);
7
+ const currentDir = dirname(currentFilePath);
8
+ const SCHEMA_PATHS = [
9
+ resolve(currentDir, '../../spec/extensions/openapi/ossa-openapi-extensions.schema.json'),
10
+ resolve(currentDir, '../spec/extensions/openapi/ossa-openapi-extensions.schema.json'),
11
+ ];
12
+ let cachedValidator;
13
+ function getSchemaPath() {
14
+ const schemaPath = SCHEMA_PATHS.find((candidate) => existsSync(candidate));
15
+ if (!schemaPath) {
16
+ throw new Error(`OSSA OpenAPI extensions schema not found. Checked: ${SCHEMA_PATHS.join(', ')}`);
17
+ }
18
+ return schemaPath;
19
+ }
20
+ function getValidator() {
21
+ if (cachedValidator) {
22
+ return cachedValidator;
23
+ }
24
+ const schema = JSON.parse(readFileSync(getSchemaPath(), 'utf-8'));
25
+ const ajv = new Ajv({
26
+ allErrors: true,
27
+ strict: false,
28
+ validateFormats: true,
29
+ verbose: true,
30
+ });
31
+ addFormats(ajv);
32
+ cachedValidator = ajv.compile(schema);
33
+ return cachedValidator;
34
+ }
35
+ function countOperationExtensions(doc) {
36
+ let count = 0;
37
+ const paths = doc.paths;
38
+ if (!paths) {
39
+ return count;
40
+ }
41
+ const methods = [
42
+ 'get',
43
+ 'put',
44
+ 'post',
45
+ 'delete',
46
+ 'options',
47
+ 'head',
48
+ 'patch',
49
+ 'trace',
50
+ ];
51
+ for (const pathItem of Object.values(paths)) {
52
+ for (const method of methods) {
53
+ const operation = pathItem[method];
54
+ if (!operation) {
55
+ continue;
56
+ }
57
+ if (operation['x-ossa-capability'])
58
+ count++;
59
+ if (operation['x-ossa-autonomy'])
60
+ count++;
61
+ if (operation['x-ossa-constraints'])
62
+ count++;
63
+ if (operation['x-ossa-tools'])
64
+ count++;
65
+ if (operation['x-ossa-llm'])
66
+ count++;
67
+ }
68
+ }
69
+ return count;
70
+ }
71
+ function countCapabilitySchemaExtensions(doc) {
72
+ const components = doc.components;
73
+ if (!components?.schemas) {
74
+ return 0;
75
+ }
76
+ return Object.values(components.schemas).filter((schema) => schema &&
77
+ typeof schema === 'object' &&
78
+ 'x-ossa-capability-schema' in schema).length;
79
+ }
80
+ function generateWarnings(doc) {
81
+ const warnings = [];
82
+ if (!doc['x-ossa-metadata']) {
83
+ warnings.push({
84
+ path: '/',
85
+ message: 'Missing x-ossa-metadata extension. Consider adding OSSA metadata for compliance tracking.',
86
+ });
87
+ }
88
+ else {
89
+ const metadata = doc['x-ossa-metadata'];
90
+ if (!metadata.compliance) {
91
+ warnings.push({
92
+ path: '/x-ossa-metadata',
93
+ message: 'Missing compliance configuration. Consider adding compliance level and frameworks.',
94
+ });
95
+ }
96
+ if (!metadata.observability) {
97
+ warnings.push({
98
+ path: '/x-ossa-metadata',
99
+ message: 'Missing observability configuration. Consider enabling tracing, metrics, and logging.',
100
+ });
101
+ }
102
+ }
103
+ if (!doc['x-ossa']) {
104
+ warnings.push({
105
+ path: '/',
106
+ message: 'Missing x-ossa extension. Agent identification is recommended for OSSA compliance.',
107
+ });
108
+ }
109
+ const paths = doc.paths;
110
+ if (!paths) {
111
+ return warnings;
112
+ }
113
+ const methods = [
114
+ 'get',
115
+ 'put',
116
+ 'post',
117
+ 'delete',
118
+ 'options',
119
+ 'head',
120
+ 'patch',
121
+ 'trace',
122
+ ];
123
+ for (const [pathKey, pathItem] of Object.entries(paths)) {
124
+ for (const method of methods) {
125
+ const operation = pathItem[method];
126
+ if (!operation || !operation.operationId) {
127
+ continue;
128
+ }
129
+ if (!operation['x-ossa-capability']) {
130
+ warnings.push({
131
+ path: `/paths${pathKey}/${method}`,
132
+ message: `Operation ${operation.operationId} missing x-ossa-capability. Consider linking to an agent capability.`,
133
+ });
134
+ }
135
+ if (['post', 'put', 'patch', 'delete'].includes(method) &&
136
+ !operation['x-ossa-autonomy']) {
137
+ warnings.push({
138
+ path: `/paths${pathKey}/${method}`,
139
+ message: `Write operation ${operation.operationId} missing x-ossa-autonomy. Consider defining autonomy level.`,
140
+ });
141
+ }
142
+ }
143
+ }
144
+ return warnings;
145
+ }
146
+ export function validateOpenApiExtensionsDocument(openapiSpec) {
147
+ if (!openapiSpec || typeof openapiSpec !== 'object') {
148
+ return {
149
+ valid: false,
150
+ errors: [
151
+ {
152
+ instancePath: '',
153
+ schemaPath: '',
154
+ keyword: 'type',
155
+ params: { type: 'object' },
156
+ message: 'OpenAPI spec must be an object',
157
+ },
158
+ ],
159
+ warnings: [],
160
+ ossaExtensions: {
161
+ hasMetadata: false,
162
+ hasOssa: false,
163
+ hasAgent: false,
164
+ operationExtensions: 0,
165
+ capabilitySchemaExtensions: 0,
166
+ },
167
+ };
168
+ }
169
+ const doc = openapiSpec;
170
+ const validate = getValidator();
171
+ const valid = validate(doc);
172
+ return {
173
+ valid,
174
+ errors: valid
175
+ ? []
176
+ : (validate.errors || []).map((error) => ({
177
+ instancePath: error.instancePath || '',
178
+ schemaPath: error.schemaPath || '',
179
+ keyword: error.keyword || 'validation',
180
+ params: error.params || {},
181
+ message: error.message || 'Validation error',
182
+ })),
183
+ warnings: generateWarnings(doc),
184
+ ossaExtensions: {
185
+ hasMetadata: !!doc['x-ossa-metadata'],
186
+ hasOssa: !!doc['x-ossa'],
187
+ hasAgent: !!doc['x-agent'],
188
+ operationExtensions: countOperationExtensions(doc),
189
+ capabilitySchemaExtensions: countCapabilitySchemaExtensions(doc),
190
+ },
191
+ };
192
+ }
193
+ //# sourceMappingURL=openapi-extensions-validation.js.map
@@ -10,10 +10,10 @@ import { z } from 'zod';
10
10
  */
11
11
  declare const MergeRequestFilterSchema: z.ZodObject<{
12
12
  state: z.ZodOptional<z.ZodEnum<{
13
+ locked: "locked";
13
14
  closed: "closed";
14
15
  opened: "opened";
15
16
  merged: "merged";
16
- locked: "locked";
17
17
  }>>;
18
18
  page: z.ZodDefault<z.ZodNumber>;
19
19
  perPage: z.ZodDefault<z.ZodNumber>;
@@ -35,19 +35,19 @@ export declare class MergeRequestService extends BaseCrudService<MergeRequest, C
35
35
  title: z.ZodOptional<z.ZodString>;
36
36
  description: z.ZodOptional<z.ZodString>;
37
37
  state: z.ZodOptional<z.ZodEnum<{
38
+ locked: "locked";
38
39
  closed: "closed";
39
40
  opened: "opened";
40
41
  merged: "merged";
41
- locked: "locked";
42
42
  }>>;
43
43
  labels: z.ZodOptional<z.ZodArray<z.ZodString>>;
44
44
  }, z.core.$strip>;
45
45
  protected filterSchema: z.ZodObject<{
46
46
  state: z.ZodOptional<z.ZodEnum<{
47
+ locked: "locked";
47
48
  closed: "closed";
48
49
  opened: "opened";
49
50
  merged: "merged";
50
- locked: "locked";
51
51
  }>>;
52
52
  page: z.ZodDefault<z.ZodNumber>;
53
53
  perPage: z.ZodDefault<z.ZodNumber>;
@@ -59,10 +59,10 @@ export declare class MergeRequestService extends BaseCrudService<MergeRequest, C
59
59
  sourceBranch: z.ZodString;
60
60
  targetBranch: z.ZodString;
61
61
  state: z.ZodEnum<{
62
+ locked: "locked";
62
63
  closed: "closed";
63
64
  opened: "opened";
64
65
  merged: "merged";
65
- locked: "locked";
66
66
  }>;
67
67
  mergeStatus: z.ZodOptional<z.ZodEnum<{
68
68
  can_be_merged: "can_be_merged";
@@ -89,10 +89,10 @@ async function releaseToGitHub() {
89
89
  execSync(`gh release create ${tag} \
90
90
  --title "Release ${version}" \
91
91
  --notes "${releaseNotes}" \
92
- --repo blueflyio/openstandardagents`, { stdio: 'inherit' });
92
+ --repo $(CI_PROJECT_PATH)`, { stdio: 'inherit' });
93
93
  // 2. Upload artifacts
94
94
  execSync(`gh release upload ${tag} dist/*.tgz \
95
- --repo blueflyio/openstandardagents`, { stdio: 'inherit' });
95
+ --repo $(CI_PROJECT_PATH)`, { stdio: 'inherit' });
96
96
  console.log('✅ GitHub release successful');
97
97
  }
98
98
  async function deployWebsite() {
@@ -131,7 +131,7 @@ npm install openstandardagents@${version}
131
131
 
132
132
  ### 🔗 Links
133
133
  - [npm Package](https://www.npmjs.com/package/openstandardagents/v/${version})
134
- - [GitHub Release](https://github.com/blueflyio/openstandardagents/releases/tag/v${version})
134
+ - [GitHub Release](https://github.com/$(CI_PROJECT_PATH)/releases/tag/v${version})
135
135
  - [Documentation](https://openstandardagents.org/docs)
136
136
  - [Changelog](https://openstandardagents.org/docs/changelog)
137
137
 
@@ -32,10 +32,10 @@ export declare const MilestoneStateSchema: z.ZodEnum<{
32
32
  * Merge Request State
33
33
  */
34
34
  export declare const MergeRequestStateSchema: z.ZodEnum<{
35
+ locked: "locked";
35
36
  closed: "closed";
36
37
  opened: "opened";
37
38
  merged: "merged";
38
- locked: "locked";
39
39
  }>;
40
40
  /**
41
41
  * Merge Status
@@ -173,10 +173,10 @@ export declare const MergeRequestSchema: z.ZodObject<{
173
173
  sourceBranch: z.ZodString;
174
174
  targetBranch: z.ZodString;
175
175
  state: z.ZodEnum<{
176
+ locked: "locked";
176
177
  closed: "closed";
177
178
  opened: "opened";
178
179
  merged: "merged";
179
- locked: "locked";
180
180
  }>;
181
181
  mergeStatus: z.ZodOptional<z.ZodEnum<{
182
182
  can_be_merged: "can_be_merged";
@@ -211,10 +211,10 @@ export declare const UpdateMergeRequestRequestSchema: z.ZodObject<{
211
211
  title: z.ZodOptional<z.ZodString>;
212
212
  description: z.ZodOptional<z.ZodString>;
213
213
  state: z.ZodOptional<z.ZodEnum<{
214
+ locked: "locked";
214
215
  closed: "closed";
215
216
  opened: "opened";
216
217
  merged: "merged";
217
- locked: "locked";
218
218
  }>>;
219
219
  labels: z.ZodOptional<z.ZodArray<z.ZodString>>;
220
220
  }, z.core.$strip>;
@@ -25,7 +25,35 @@ export interface OssaManifest {
25
25
  config?: Record<string, unknown>;
26
26
  }>;
27
27
  };
28
+ economics?: {
29
+ execution_profile?: string;
30
+ token_class?: string;
31
+ compression_policy?: string;
32
+ token_sovereignty?: {
33
+ tokenization_boundary?: 'local' | 'provider' | 'hybrid';
34
+ context_retention?: string;
35
+ sovereign_embeddings?: boolean;
36
+ };
37
+ };
38
+ security?: {
39
+ tier?: string;
40
+ };
28
41
  extensions?: {
42
+ statemesh?: {
43
+ emits?: Array<{
44
+ schema: string;
45
+ ttl?: string;
46
+ projections_supported?: string[];
47
+ }>;
48
+ consumes?: Array<{
49
+ schema: string;
50
+ required_attestation?: boolean;
51
+ }>;
52
+ authority?: {
53
+ can_challenge?: string[];
54
+ can_merge?: boolean;
55
+ };
56
+ };
29
57
  openai_agents?: {
30
58
  model?: string;
31
59
  instructions?: string;
@@ -46,42 +74,47 @@ export interface ToolDefinition {
46
74
  name: string;
47
75
  description: string;
48
76
  parameters: Record<string, unknown>;
49
- handler?: (args: Record<string, unknown>) => Promise<string>;
77
+ handler?: (args: any) => Promise<string>;
50
78
  }
51
79
  export declare class OpenAIAdapter {
52
- private client;
53
80
  private manifest;
54
81
  private tools;
55
82
  private messages;
83
+ private apiKey?;
56
84
  constructor(manifest: OssaManifest, apiKey?: string);
57
85
  /**
58
86
  * Get the model to use from manifest
59
87
  */
60
- private getModel;
88
+ private getModelName;
61
89
  /**
62
90
  * Get system prompt from manifest
63
91
  */
64
92
  private getSystemPrompt;
65
- /**
66
- * Convert OSSA tools to OpenAI function calling format
67
- */
68
- private getOpenAITools;
69
93
  /**
70
94
  * Register a tool handler
71
95
  */
72
- registerToolHandler(name: string, handler: (args: Record<string, unknown>) => Promise<string>): void;
73
- /**
74
- * Execute a tool call
75
- */
76
- private executeTool;
96
+ registerToolHandler(name: string, handler: (args: any) => Promise<string>): void;
77
97
  /**
78
98
  * Initialize the conversation
79
99
  */
80
100
  initialize(): void;
81
101
  /**
82
- * Send a message and get a response
102
+ * Send a message and get a response using AI SDK ToolLoopAgent.
103
+ * Publishes StateClaims and ReplayPackets to ContractPlane.
83
104
  */
84
105
  chat(userMessage: string, options?: RunOptions): Promise<string>;
106
+ /**
107
+ * Resolves context packs via the State Plane.
108
+ */
109
+ private resolveContextPacks;
110
+ /**
111
+ * Publish a Replay Packet to ContractPlane.
112
+ */
113
+ private publishReplayPacket;
114
+ /**
115
+ * Publish a claim to the ContractPlane State Plane API
116
+ */
117
+ private publishStateClaim;
85
118
  /**
86
119
  * Get agent info
87
120
  */