beddel 0.1.0 → 0.1.1

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (58) hide show
  1. package/CHANGELOG.md +32 -0
  2. package/LICENSE +21 -0
  3. package/README.md +357 -196
  4. package/dist/agents/agentRegistry.d.ts +14 -1
  5. package/dist/agents/agentRegistry.d.ts.map +1 -1
  6. package/dist/agents/agentRegistry.js +98 -1
  7. package/dist/agents/agentRegistry.js.map +1 -1
  8. package/dist/runtime/schemaCompiler.js +5 -4
  9. package/dist/runtime/schemaCompiler.js.map +1 -1
  10. package/package.json +5 -2
  11. package/src/agents/agentRegistry.ts +115 -2
  12. package/src/runtime/schemaCompiler.ts +5 -5
  13. package/dist/agents/formatter-agent.d.ts +0 -10
  14. package/dist/agents/formatter-agent.d.ts.map +0 -1
  15. package/dist/agents/formatter-agent.js +0 -49
  16. package/dist/agents/formatter-agent.js.map +0 -1
  17. package/dist/agents/genkit-agent.d.ts +0 -12
  18. package/dist/agents/genkit-agent.d.ts.map +0 -1
  19. package/dist/agents/genkit-agent.js +0 -119
  20. package/dist/agents/genkit-agent.js.map +0 -1
  21. package/dist/agents/i18n-messages.d.ts +0 -17
  22. package/dist/agents/i18n-messages.d.ts.map +0 -1
  23. package/dist/agents/i18n-messages.js +0 -92
  24. package/dist/agents/i18n-messages.js.map +0 -1
  25. package/dist/agents/index.d.ts +0 -10
  26. package/dist/agents/index.d.ts.map +0 -1
  27. package/dist/agents/index.js +0 -26
  28. package/dist/agents/index.js.map +0 -1
  29. package/dist/agents/pipeline.d.ts +0 -15
  30. package/dist/agents/pipeline.d.ts.map +0 -1
  31. package/dist/agents/pipeline.js +0 -45
  32. package/dist/agents/pipeline.js.map +0 -1
  33. package/dist/agents/schema-factory.d.ts +0 -40
  34. package/dist/agents/schema-factory.d.ts.map +0 -1
  35. package/dist/agents/schema-factory.js +0 -121
  36. package/dist/agents/schema-factory.js.map +0 -1
  37. package/dist/agents/translation-validators.d.ts +0 -26
  38. package/dist/agents/translation-validators.d.ts.map +0 -1
  39. package/dist/agents/translation-validators.js +0 -77
  40. package/dist/agents/translation-validators.js.map +0 -1
  41. package/dist/agents/translator-agents.d.ts +0 -184
  42. package/dist/agents/translator-agents.d.ts.map +0 -1
  43. package/dist/agents/translator-agents.js +0 -613
  44. package/dist/agents/translator-agents.js.map +0 -1
  45. package/dist/agents/types/translation.types.d.ts +0 -100
  46. package/dist/agents/types/translation.types.d.ts.map +0 -1
  47. package/dist/agents/types/translation.types.js +0 -3
  48. package/dist/agents/types/translation.types.js.map +0 -1
  49. package/dist/agents/validator-agent.d.ts +0 -42
  50. package/dist/agents/validator-agent.d.ts.map +0 -1
  51. package/dist/agents/validator-agent.js +0 -122
  52. package/dist/agents/validator-agent.js.map +0 -1
  53. package/dist/security/test-security.d.ts +0 -22
  54. package/dist/security/test-security.d.ts.map +0 -1
  55. package/dist/security/test-security.js +0 -154
  56. package/dist/security/test-security.js.map +0 -1
  57. package/tools/seed.ts +0 -365
  58. package/tools/test-endpoints.ts +0 -174
package/README.md CHANGED
@@ -1,147 +1,316 @@
1
- # Beddel: Secure, Declarative, and Extensible Agent Runtimes
1
+ # Beddel
2
+
3
+ **Secure, Declarative, and Extensible Agent Runtime**
2
4
 
3
5
  [![NPM Version](https://img.shields.io/npm/v/beddel.svg)](https://www.npmjs.com/package/beddel)
4
6
  [![License](https://img.shields.io/npm/l/beddel.svg)](https://github.com/botanarede/beddel-alpha/blob/main/LICENSE)
5
7
 
6
- **Repos:** código-fonte em `https://github.com/botanarede/beddel-alpha` e app de exemplo Next.js em `https://github.com/botanarede/beddel-alpha-example`.
7
-
8
- ## Usage Exemplo
8
+ Beddel is a security-first toolkit for building and running declarative YAML agents with enterprise-grade isolation, automatic schema validation, and extensible architecture.
9
9
 
10
- > Declaração YAML + interpretação segura para que quem visita o perfil do pacote no npm entenda o fluxo em poucos segundos.
10
+ ## Quick Start
11
11
 
12
12
  ```yaml
13
- # joker-agent.yaml
13
+ # agents/my-agent.yaml
14
14
  agent:
15
- id: joker
15
+ id: my-agent
16
+ version: 1.0.0
16
17
  protocol: beddel-declarative-protocol/v2.0
18
+
17
19
  metadata:
18
- name: Joker Agent
20
+ name: "My Custom Agent"
21
+ description: "A simple custom agent"
22
+ route: "/agents/my-agent"
23
+
19
24
  schema:
20
25
  input:
21
26
  type: "object"
22
- properties: {}
23
- required: []
27
+ properties:
28
+ message:
29
+ type: "string"
30
+ required: ["message"]
24
31
  output:
25
32
  type: "object"
26
33
  properties:
27
34
  response:
28
35
  type: "string"
29
36
  required: ["response"]
37
+
30
38
  logic:
31
39
  workflow:
32
- - name: generate-joke
33
- type: genkit-joke
40
+ - name: "process"
41
+ type: "genkit-joke"
34
42
  action:
35
- type: joke
36
- prompt: "Conte uma piada curta e original que funcione para qualquer público."
37
- result: jokerResult
43
+ type: "joke"
44
+ prompt: "{{message}}"
45
+ result: "result"
38
46
 
39
- - name: deliver-response
40
- type: output-generator
41
- action:
42
- type: generate
43
- output:
44
- response: "$jokerResult.texto"
47
+ output:
48
+ schema:
49
+ response: "$result.texto"
45
50
  ```
46
51
 
47
52
  ```typescript
48
- import {
49
- SecureYamlParser,
50
- DeclarativeAgentInterpreter,
51
- SecureYamlRuntime,
52
- IsolatedRuntimeManager,
53
- type ExecutionContext,
54
- } from "beddel";
55
- import { readFileSync } from "node:fs";
56
-
57
- const yamlManifest = readFileSync("joker-agent.yaml", "utf8");
58
-
59
- const parser = new SecureYamlParser({ filename: "joker-agent.yaml" });
60
- const manifest = parser.parseSecure(yamlManifest); // FAILSAFE_SCHEMA + depth/size limits
61
-
62
- const context: ExecutionContext = {
63
- logs: [],
64
- status: "running",
65
- output: null,
66
- log: console.log,
67
- setOutput: (output) => (context.output = output),
68
- setError: (err) => console.error(err),
69
- };
70
-
71
- const interpreter = new DeclarativeAgentInterpreter();
72
- const agentResult = await interpreter.interpret({
73
- yamlContent: yamlManifest,
74
- input: {},
75
- props: {
76
- gemini_api_key: process.env.GEMINI_API_KEY ?? "",
77
- },
78
- context,
79
- });
53
+ import { agentRegistry } from "beddel";
54
+
55
+ // Execute the agent
56
+ const result = await agentRegistry.executeAgent(
57
+ "my-agent.execute",
58
+ { message: "Hello world" },
59
+ { gemini_api_key: process.env.GEMINI_API_KEY },
60
+ context
61
+ );
62
+ ```
80
63
 
81
- const secureRuntime = new SecureYamlRuntime(new IsolatedRuntimeManager());
82
- const execution = await secureRuntime.parseYamlSecureRuntime(yamlManifest, {
83
- tenantId: "tenant-42",
84
- securityProfile: "tenant-isolated",
85
- validateSecurity: true,
86
- });
64
+ ## Installation
65
+
66
+ ```bash
67
+ npm install beddel
87
68
  ```
88
69
 
89
- - `SecureYamlParser` garante o parsing estritamente FAILSAFE com validação de profundidade, tamanho e UTF-8.
90
- - `DeclarativeAgentInterpreter` executa apenas steps declarativos (`output-generator`, `genkit-joke`, `genkit-translation`, `genkit-image`) e mantém toda a validação em Zod (sem `eval`/`Function`).
91
- - `SecureYamlRuntime` conecta parser, scanner e `isolated-vm` para entregar auditoria, limites de tempo/memória e perfis multi-tenant.
70
+ Requires Node.js 18+.
92
71
 
93
- Beddel is a security-first toolkit that combines:
72
+ ---
94
73
 
95
- - A hardened YAML parser that only exposes the YAML FAILSAFE schema.
96
- - Multiple execution strategies powered by `isolated-vm`.
97
- - Declarative agent utilities, compliance helpers, performance monitors, and Firebase multi-tenant orchestration.
74
+ ## Architecture Overview
98
75
 
99
- ### Declarative agents shipped with Gemini Flash helpers
76
+ ```
77
+ ┌─────────────────────────────────────────────────────────────────────┐
78
+ │ Beddel Runtime │
79
+ │ │
80
+ │ ┌──────────────────────────────────────────────────────────────┐ │
81
+ │ │ Agent Registry │ │
82
+ │ │ │ │
83
+ │ │ ┌─────────────────┐ ┌────────────────────────────────┐ │ │
84
+ │ │ │ Built-in │ │ Custom Agents │ │ │
85
+ │ │ │ Agents │ │ /agents/*.yaml │ │ │
86
+ │ │ │ │ │ │ │ │
87
+ │ │ │ • joker │ │ Automatically discovered │ │ │
88
+ │ │ │ • translator │ │ and registered at startup │ │ │
89
+ │ │ │ • image │ │ │ │ │
90
+ │ │ └─────────────────┘ └────────────────────────────────┘ │ │
91
+ │ │ │ │
92
+ │ │ Priority: Custom Agents > Built-in Agents │ │
93
+ │ └──────────────────────────────────────────────────────────────┘ │
94
+ │ │ │
95
+ │ ▼ │
96
+ │ ┌──────────────────────────────────────────────────────────────┐ │
97
+ │ │ Declarative Agent Interpreter │ │
98
+ │ │ │ │
99
+ │ │ • YAML Parsing (FAILSAFE schema) │ │
100
+ │ │ • Schema Validation (Zod) │ │
101
+ │ │ • Workflow Execution │ │
102
+ │ │ • Genkit Integration (Gemini Flash) │ │
103
+ │ └──────────────────────────────────────────────────────────────┘ │
104
+ │ │ │
105
+ │ ▼ │
106
+ │ ┌──────────────────────────────────────────────────────────────┐ │
107
+ │ │ Secure Runtime (isolated-vm) │ │
108
+ │ │ │ │
109
+ │ │ • Memory limits • V8 isolate │ │
110
+ │ │ • Execution timeouts • No Node.js access │ │
111
+ │ │ • Audit logging • Multi-tenant isolation │ │
112
+ │ └──────────────────────────────────────────────────────────────┘ │
113
+ └─────────────────────────────────────────────────────────────────────┘
114
+ ```
100
115
 
101
- The declarative runtime now exposes three Genkit-based helpers—`callGeminiFlashText`, `callGeminiFlashTranslation`, and `callGeminiFlashImage`—which proxy `generateText`/`generateImage` calls to `google("models/gemini-flash-latest")`. Each helper validates the presence of `props.gemini_api_key`, builds friendly prompts, and returns consistent metadata (`modelo_utilizado`, `tempo_processamento`, etc.).
116
+ ---
102
117
 
103
- | Agent | Method | Description | Inputs | Outputs | Required props |
104
- | --- | --- | --- | --- | --- | --- |
105
- | Joker Agent | `joker.execute` | Gera uma piada curta e original usando Gemini Flash. | — | `response` | `gemini_api_key` |
106
- | Translator Agent | `translator.execute` | Traduz textos via Gemini Flash com Genkit. | `texto`, `idioma_origem`, `idioma_destino` | `texto_traduzido`, `metadados` | `gemini_api_key` |
107
- | Image Generator Agent | `image.generate` | Cria imagens nos estilos `watercolor`, `neon` ou `sketch`. | `descricao`, `estilo`, `resolucao` | `image_url`, `image_base64`, `media_type`, `prompt_utilizado`, `metadados` | `gemini_api_key` |
118
+ ## Custom Agents
108
119
 
109
- > ⚠️ Todos os agentes embutidos dependem da prop `gemini_api_key`. Sem ela o runtime aborta a execução com uma mensagem amigável.
120
+ Beddel supports custom agents that you define in your application's `/agents` directory. Custom agents are automatically discovered and registered at startup.
110
121
 
111
- The code that backs this README lives under `packages/beddel/src` and is what the npm package exposes.
122
+ ### Directory Structure
112
123
 
113
- ## Package map
124
+ ```
125
+ your-app/
126
+ ├── agents/ # Custom agents directory
127
+ │ ├── my-agent.yaml # Simple agent
128
+ │ ├── calculator/
129
+ │ │ └── calculator.yaml # Agent in subdirectory
130
+ │ └── translator-custom/
131
+ │ └── translator-custom.yaml # Override built-in
132
+
133
+ └── packages/beddel/src/agents/ # Built-in agents (package)
134
+ ├── joker-agent.yaml
135
+ ├── translator-agent.yaml
136
+ └── image-agent.yaml
137
+ ```
114
138
 
115
- | Capability | Entry point / module | Notes |
116
- | --- | --- | --- |
117
- | Secure YAML parsing | `SecureYamlParser` (`src/parser/secure-yaml-parser.ts`) | FAILSAFE schema, depth/size limits, UTF-8 validation, sync + async helpers. |
118
- | Sandboxed execution | `IsolatedRuntimeManager`, `SimpleIsolatedRuntimeManager` (`src/runtime`) | Uses `isolated-vm` with configurable security profiles, pool management, metrics. |
119
- | Declarative YAML interpretation | `DeclarativeAgentInterpreter`, `AgentRegistry` (`src/runtime/declarativeAgentRuntime.ts`, `src/agents/agentRegistry.ts`) | Executes YAML agents with variables plus `output-generator`, `genkit-joke`, `genkit-translation` e `genkit-image` steps (Gemini Flash). |
120
- | Security posture | `SecurityScanner`, `ThreatDetectionEngine`, validation utilities (`src/security`) | Static scanning, scoring, and threat inference the rest of the package consumes. |
121
- | Compliance & audit | `GDPRCompliance`, `LGPDCompliance`, `AuditTrail`, `AuditService` (`src/compliance`, `src/audit`, `src/runtime/audit.ts`) | Hash-based logging, anonymization helpers, compliance verification. |
122
- | Performance & autoscaling | `PerformanceMonitor`, `AutoScaler`, benchmarking helpers (`src/performance`) | Track execution time/memory, raise violations, recommend scaling actions. |
123
- | Firebase multi-tenancy | `MultiTenantFirebaseManager` (`src/firebase/tenantManager.ts`) | Per-tenant app bootstrap, isolation policies, audit logging hooks. |
139
+ ### Agent Loading Flow
124
140
 
125
- Everything is re-exported via `src/index.ts`, so you can import from `beddel` directly.
141
+ ```
142
+ ┌─────────────────────────────────────────────────────────────┐
143
+ │ Agent Loading Sequence │
144
+ │ │
145
+ │ 1. AgentRegistry constructor() │
146
+ │ │ │
147
+ │ ├──▶ 2. registerBuiltinAgents() │
148
+ │ │ ├── joker.execute │
149
+ │ │ ├── translator.execute │
150
+ │ │ └── image.generate │
151
+ │ │ │
152
+ │ └──▶ 3. loadCustomAgents() │
153
+ │ │ │
154
+ │ └── Recursively scans /agents/**/*.yaml │
155
+ │ └── Registers each agent │
156
+ │ └── Custom agents override built-ins │
157
+ │ │
158
+ │ Priority: Custom Agents > Built-in Agents │
159
+ └─────────────────────────────────────────────────────────────┘
160
+ ```
126
161
 
127
- ## Installation
162
+ ### Creating a Custom Agent
128
163
 
129
- ```bash
130
- npm install beddel
164
+ 1. **Create the YAML file** in `/agents`:
165
+
166
+ ```yaml
167
+ # agents/greeting.yaml
168
+ agent:
169
+ id: greeting
170
+ version: 1.0.0
171
+ protocol: beddel-declarative-protocol/v2.0
172
+
173
+ metadata:
174
+ name: "Greeting Agent"
175
+ description: "Generates personalized greetings"
176
+ category: "utility"
177
+ route: "/agents/greeting"
178
+
179
+ schema:
180
+ input:
181
+ type: "object"
182
+ properties:
183
+ name:
184
+ type: "string"
185
+ minLength: 1
186
+ maxLength: 100
187
+ required: ["name"]
188
+
189
+ output:
190
+ type: "object"
191
+ properties:
192
+ greeting:
193
+ type: "string"
194
+ required: ["greeting"]
195
+
196
+ logic:
197
+ workflow:
198
+ - name: "generate-greeting"
199
+ type: "genkit-joke"
200
+ action:
201
+ type: "joke"
202
+ prompt: "Create a warm, friendly greeting for {{name}}"
203
+ result: "greetingResult"
204
+
205
+ output:
206
+ schema:
207
+ greeting: "$greetingResult.texto"
208
+ ```
209
+
210
+ 2. **The agent is automatically registered** when your application starts.
211
+
212
+ 3. **Execute via GraphQL or directly**:
213
+
214
+ ```graphql
215
+ mutation {
216
+ executeMethod(
217
+ methodName: "greeting.execute"
218
+ params: { name: "Alice" }
219
+ props: { gemini_api_key: "your-api-key" }
220
+ ) {
221
+ success
222
+ data
223
+ }
224
+ }
131
225
  ```
132
226
 
133
- Ensure Node.js 18+ (per `package.json`) and install optional peer dependencies you plan to use (e.g., `firebase-admin` is already included).
227
+ ### Overriding Built-in Agents
134
228
 
135
- ## Project-agnostic guarantees
229
+ Create a custom agent with the same route to override a built-in:
136
230
 
137
- - No upstream app files are required—the npm tarball only ships `dist/` and the audited TypeScript sources exported through `beddel`.
138
- - `ExecutionContext` and every runtime type live inside the package, de-coupling consumers from any upstream monorepo or example app internals.
139
- - No secrets, API tokens, or environment-specific constants are embedded in the code or build output; everything is configured via your own runtime props.
140
- - Optional tools (Firebase, Upstash, benchmarking scripts) are defensive helpers; you decide which ones to instantiate depending on project size.
231
+ ```yaml
232
+ # agents/joker-custom.yaml
233
+ agent:
234
+ id: joker
235
+ protocol: beddel-declarative-protocol/v2.0
236
+
237
+ metadata:
238
+ route: "/agents/joker" # Same route overrides built-in
239
+ # ... your custom implementation
240
+ ```
141
241
 
142
- ## Usage examples
242
+ ---
143
243
 
144
- ### Parse YAML with strict fail-safes
244
+ ## Built-in Agents
245
+
246
+ | Agent | Method | Description | Required Props |
247
+ |-------|--------|-------------|----------------|
248
+ | **Joker** | `joker.execute` | Generates short, original jokes | `gemini_api_key` |
249
+ | **Translator** | `translator.execute` | Translates text between languages | `gemini_api_key` |
250
+ | **Image Generator** | `image.generate` | Creates images (watercolor, neon, sketch) | `gemini_api_key` |
251
+
252
+ ### Joker Agent
253
+
254
+ ```typescript
255
+ const result = await agentRegistry.executeAgent(
256
+ "joker.execute",
257
+ {},
258
+ { gemini_api_key: "..." },
259
+ context
260
+ );
261
+ // Returns: { response: "Why did the..." }
262
+ ```
263
+
264
+ ### Translator Agent
265
+
266
+ ```typescript
267
+ const result = await agentRegistry.executeAgent(
268
+ "translator.execute",
269
+ {
270
+ texto: "Hello, world!",
271
+ idioma_origem: "en",
272
+ idioma_destino: "pt"
273
+ },
274
+ { gemini_api_key: "..." },
275
+ context
276
+ );
277
+ // Returns: { texto_traduzido: "Olá, mundo!", metadados: {...} }
278
+ ```
279
+
280
+ ### Image Generator Agent
281
+
282
+ ```typescript
283
+ const result = await agentRegistry.executeAgent(
284
+ "image.generate",
285
+ {
286
+ descricao: "A sunset over mountains",
287
+ estilo: "watercolor",
288
+ resolucao: "1024x1024"
289
+ },
290
+ { gemini_api_key: "..." },
291
+ context
292
+ );
293
+ // Returns: { image_url, image_base64, media_type, ... }
294
+ ```
295
+
296
+ ---
297
+
298
+ ## Core Components
299
+
300
+ ### Package Map
301
+
302
+ | Capability | Module | Description |
303
+ |------------|--------|-------------|
304
+ | **YAML Parsing** | `SecureYamlParser` | FAILSAFE schema, depth/size limits, UTF-8 validation |
305
+ | **Sandboxed Execution** | `IsolatedRuntimeManager` | `isolated-vm` with security profiles |
306
+ | **Agent Interpretation** | `DeclarativeAgentInterpreter` | Executes YAML agents with Genkit |
307
+ | **Agent Registry** | `AgentRegistry` | Manages built-in and custom agents |
308
+ | **Security** | `SecurityScanner`, `ThreatDetectionEngine` | Static scanning, scoring |
309
+ | **Compliance** | `GDPRCompliance`, `LGPDCompliance` | Audit, anonymization |
310
+ | **Performance** | `PerformanceMonitor`, `AutoScaler` | Metrics, scaling |
311
+ | **Multi-tenancy** | `MultiTenantFirebaseManager` | Firebase tenant isolation |
312
+
313
+ ### Secure YAML Parsing
145
314
 
146
315
  ```typescript
147
316
  import { SecureYamlParser } from "beddel";
@@ -151,147 +320,139 @@ const parser = new SecureYamlParser({
151
320
  filename: "agent-manifest",
152
321
  });
153
322
 
154
- const manifest = parser.parseSecure(`
155
- agent:
156
- id: joker
157
- schema:
158
- input: {}
159
- output: {}
160
- logic:
161
- workflow:
162
- - name: noop
163
- type: output-generator
164
- action:
165
- type: generate
166
- output:
167
- response: "lol"
168
- `);
169
-
170
- console.log(manifest.agent.id); // joker
323
+ const manifest = parser.parseSecure(yamlContent);
171
324
  ```
172
325
 
173
- Behind the scenes, `SecureYamlParser` enforces depth, size, UTF-8, and allowed primitive types before returning the parsed object.
174
-
175
- ### Execute JavaScript in an isolate
326
+ ### Sandboxed Execution
176
327
 
177
328
  ```typescript
178
329
  import { IsolatedRuntimeManager } from "beddel";
179
330
 
180
- const runtimeManager = new IsolatedRuntimeManager();
331
+ const runtime = new IsolatedRuntimeManager();
181
332
 
182
- const result = await runtimeManager.execute({
183
- code: `
184
- const secret = "sandboxed";
185
- ({ success: true, value: secret.length });
186
- `,
333
+ const result = await runtime.execute({
334
+ code: `({ value: 42 })`,
187
335
  securityProfile: "ultra-secure",
188
336
  timeout: 2000,
189
337
  });
338
+ ```
190
339
 
191
- if (!result.success) {
192
- throw result.error;
193
- }
340
+ ### Agent Registry API
194
341
 
195
- console.log(result.result); // { success: true, value: 9 }
196
- ```
342
+ ```typescript
343
+ import { agentRegistry } from "beddel";
197
344
 
198
- The manager bootstraps `isolated-vm` contexts, strips dangerous globals (`require`, `eval`, timers), enforces memory/time limits, records metrics, and can emit audit/security signals.
345
+ // Get all registered agents
346
+ const agents = agentRegistry.getAllAgents();
199
347
 
200
- ### Interpret a declarative YAML agent
348
+ // Get a specific agent
349
+ const agent = agentRegistry.getAgent("joker.execute");
201
350
 
202
- ```typescript
203
- import { DeclarativeAgentInterpreter } from "beddel";
204
- import { readFileSync } from "node:fs";
205
- import { join } from "node:path";
206
-
207
- const interpreter = new DeclarativeAgentInterpreter();
208
- const yamlContent = readFileSync(join(process.cwd(), "joker-agent.yaml"), "utf8");
209
-
210
- const result = await interpreter.interpret({
211
- yamlContent,
212
- input: {},
213
- props: {},
214
- context: {
215
- log: console.log,
216
- setError: console.error,
217
- },
218
- });
351
+ // Execute an agent
352
+ const result = await agentRegistry.executeAgent(
353
+ "joker.execute",
354
+ input,
355
+ props,
356
+ context
357
+ );
219
358
 
220
- console.log(result.response); // lol
359
+ // Load custom agents from a specific path
360
+ agentRegistry.loadCustomAgents("/path/to/custom/agents");
221
361
  ```
222
362
 
223
- Current interpreter capabilities:
363
+ ---
224
364
 
225
- - Validates protocol (`beddel-declarative-protocol/v2.0`), schema presence, workflow size.
226
- - Supports string/number/boolean/object variables and literal/variable references.
227
- - Executes `output-generator` workflow steps that map variables to response objects.
365
+ ## Schema Validation
228
366
 
229
- For projects that want auto-registration, instantiate `AgentRegistry` (bundled with the `joker` agent) and call `executeAgent("joker.execute", …)`.
367
+ All agents must declare `schema.input` and `schema.output` blocks. The runtime compiles these into Zod schemas and validates:
230
368
 
231
- ### Automatic schema validation
369
+ - **Before execution**: Input must match `schema.input`
370
+ - **After execution**: Output must match `schema.output`
232
371
 
233
- Every declarative agent must now declare `schema.input` and `schema.output` blocks that map directly to Zod primitives (`string`, `number`, `boolean`), objects (with `properties` + `required` arrays), and arrays (via `items`). The runtime compiles those YAML definitions into Zod schemas through the `DeclarativeSchemaCompiler`, caches the result per manifest, and runs validation twice per execution:
372
+ ```yaml
373
+ schema:
374
+ input:
375
+ type: "object"
376
+ properties:
377
+ name:
378
+ type: "string"
379
+ minLength: 1
380
+ maxLength: 100
381
+ age:
382
+ type: "number"
383
+ required: ["name"]
234
384
 
235
- - **Before workflow execution** – payloads that are missing required fields, contain unexpected properties (objects are `strict` by default), or provide the wrong primitive types raise a `DeclarativeSchemaValidationError` and call `ExecutionContext.setError`.
236
- - **Before returning output** – the workflow result must match `schema.output`; mismatches are rejected, the error propagates through the same structured exception, and oversize payloads (>1 MB) are blocked.
385
+ output:
386
+ type: "object"
387
+ properties:
388
+ greeting:
389
+ type: "string"
390
+ required: ["greeting"]
391
+ ```
237
392
 
238
- Authors can opt into arrays by adding `type: "array"` + an `items` definition, mark optional fields by omitting them from `required`, and set `additionalProperties: true` only when extra keys should be allowed. Errors surface in GraphQL responses (and logs) as `Input validation failed: …` or `Output validation failed: …`, making it obvious which path failed.
393
+ Supported types: `string`, `number`, `boolean`, `object`, `array`
239
394
 
240
- ### Parse + execute inside the secure runtime
395
+ ---
241
396
 
242
- Combine the parser, security scanner, and isolate manager through `SecureYamlRuntime`:
397
+ ## Security
243
398
 
244
- ```typescript
245
- import { SecureYamlRuntime, IsolatedRuntimeManager } from "beddel";
399
+ ### Multi-Layer Security Model
400
+
401
+ 1. **Parser Layer**: FAILSAFE schema, size limits, sanitization
402
+ 2. **Runtime Layer**: V8 isolate, memory limits, timeouts
403
+ 3. **Application Layer**: Authentication, rate limiting, tenant isolation
404
+
405
+ ### Security Profiles
246
406
 
247
- const runtime = new SecureYamlRuntime(new IsolatedRuntimeManager());
248
- const { success, result } = await runtime.parseYamlSecureRuntime(someYamlString, {
249
- tenantId: "tenant-123",
250
- securityProfile: "tenant-isolated",
251
- validateSecurity: true,
407
+ ```typescript
408
+ const result = await runtime.execute({
409
+ code: userCode,
410
+ securityProfile: "tenant-isolated", // ultra-secure | tenant-isolated
411
+ timeout: 5000,
412
+ memoryLimit: 128,
252
413
  });
253
414
  ```
254
415
 
255
- The helper performs pre-scan checks, runs within the requested profile, enforces performance targets, and produces audit hashes you can persist.
416
+ ---
256
417
 
257
- ## Architectural reference
418
+ ## Project Structure
258
419
 
259
- - `src/parser`: Secure YAML parsing primitives.
260
- - `src/runtime`: `IsolatedRuntimeManager`, `SimpleIsolatedRuntimeManager`, auditing utilities, declarative interpreter, monitoring, and security hooks.
261
- - `src/security`: Validation, scoring, threat detection, dashboards.
262
- - `src/compliance`: GDPR/LGPD tooling, anonymization, export helpers.
263
- - `src/performance`: Monitoring, autoscaling, streaming metrics.
264
- - `src/firebase`: Tenant isolation via Firebase Admin SDK.
265
- - `src/agents`: Registry helpers and sample `joker-agent.yaml`.
266
- - `src/integration`: Glue code that wires parsing + runtime + scanner.
420
+ ```
421
+ src/
422
+ ├── agents/ # Agent registry and built-in agents
423
+ │ ├── agentRegistry.ts # Agent management
424
+ │ ├── joker-agent.yaml # Built-in: Joker
425
+ │ ├── translator-agent.yaml
426
+ │ └── image-agent.yaml
427
+ ├── parser/ # Secure YAML parsing
428
+ ├── runtime/ # Execution environments
429
+ │ ├── isolatedRuntime.ts
430
+ │ ├── declarativeAgentRuntime.ts
431
+ │ └── schemaCompiler.ts
432
+ ├── security/ # Scanning and threat detection
433
+ ├── compliance/ # GDPR/LGPD utilities
434
+ ├── performance/ # Monitoring and autoscaling
435
+ ├── firebase/ # Multi-tenant management
436
+ └── index.ts # Public exports
437
+ ```
267
438
 
268
- Every module is documented inline with TypeScript types to make IDE discovery straightforward.
439
+ ---
269
440
 
270
- ## Development workflow
441
+ ## Development
271
442
 
272
443
  ```bash
273
- # Build the package
444
+ # Build
274
445
  pnpm --filter beddel build
275
446
 
276
- # Lint and test
277
- pnpm --filter beddel lint
447
+ # Test
278
448
  pnpm --filter beddel test
279
- ```
280
-
281
- When contributing, keep README + `AGENTS.md` synchronized with any new exports or behavioral changes in `src`.
282
-
283
- ## Docs/beddel roadmap coverage
284
449
 
285
- The product briefs under `docs/beddel` describe a richer future-state language/runtime. The current package intentionally ships a smaller, auditable subset. Notable gaps you will still find only in documentation:
286
-
287
- - **Advanced declarative language constructs** (`map-filter-reduce` pipelines, state machines, rule engines, temporal conditions, and loop semantics) are not implemented yet—the interpreter only supports literal variables and `output-generator` steps.
288
- - **Behavior marketplace & registry extensibility** (behaviors with versions, capabilities, restrictions, and monetization hooks) are not available. Only the bundled `joker` agent is registered by default.
289
- - **Automatic behavioral integrations and external API pipelines** (`integrations`, `decisions`, `behaviors` blocks described in `docs/beddel/brief.md`) have no runtime support.
290
- - **Marketplace/compliance automation flows** mentioned in the PRD (pre-built business behaviors, Firebase deployment recipes, global consent orchestration) are still roadmap items, even though compliance helpers exist as standalone utilities.
291
- - **High-level orchestration features** like parallel execution controls, resource policies (per-step concurrency, retry semantics), and auto-generated documentation have not been wired into the runtime.
450
+ # Lint
451
+ pnpm --filter beddel lint
452
+ ```
292
453
 
293
- Use this section as a living checklist whenever you pull features from `docs/beddel` into the actual codebase.
454
+ ---
294
455
 
295
456
  ## License
296
457
 
297
- This project is licensed under the MIT License. See the [LICENSE](LICENSE) file for details.
458
+ MIT License. See [LICENSE](LICENSE) for details.