asap-protocol 2.2.0__tar.gz → 2.3.0__tar.gz

{asap_protocol-2.2.0 → asap_protocol-2.3.0}/.gitignore

@@ -178,9 +178,25 @@ cython_debug/
 # Project specific
 !/.cursor/
 /drafts/
-# Strategy docs (private — do not commit)
-.cursor/product-specs/strategy/
+/.claude/
+# Local agent state / tooling (ignore everywhere, not only repo root)
+.agents/
+# Strategic and commercial planning (private - do not commit)
+product/strategy/
+product/private/
+product/private-roadmap/
+product/prd/private/
+# Tactical PRDs outside private/ (patch train); single-digit and double-digit patch (e.g. v2.3.10)
+product/prd/prd-v2.3.[1-9]-*.md
+product/prd/prd-v2.3.[1-9][0-9]-*.md
+engineering/private/
+engineering/tasks/private/
+engineering/tasks/v2.3.[1-9]*/
 node_modules/
+# Next.js build output (examples and apps)
+.next/
+# tshy generated tsconfig fragments (regenerated on build)
+.tshy/
 .pnpm-store/
 .github/wiki/
 
@@ -192,5 +208,10 @@ node_modules/
 .benchmarks/
 .uv-cache/
 
+# TypeScript incremental build info (local / IDE)
+*.tsbuildinfo
+
 # ESLint report (generated)
 eslint-report.json
+.vercel
+.env*.local

{asap_protocol-2.2.0 → asap_protocol-2.3.0}/CHANGELOG.md

@@ -7,8 +7,153 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+---
+
+## [2.3.0] - 2026-05-04
+
+**Adoption Multiplier** — OpenAPI-derived agents, first-class TypeScript, lean
+registry auto-registration, runtime capability escalation, and opt-in
+`WWW-Authenticate: ASAP` discovery challenges. Wire JSON-RPC and envelope
+schemas remain backward compatible with v2.2.x.
+
 ### Added
-- Future changes will be documented here.
+
+- **OpenAPI Adapter (Python)**: `asap.adapters.openapi.create_from_openapi` maps
+  OpenAPI 3.x operations to ASAP capabilities; optional `[openapi]` extra.
+  See [docs/adapters/openapi.md](docs/adapters/openapi.md).
+- **Official TypeScript client**: npm package `@asap-protocol/client` with
+  discovery, capability helpers, streaming consumer, and optional adapters for
+  Vercel AI SDK, OpenAI, and Anthropic (`packages/typescript/client/`).
+- **Auto-Registration**: `POST /registry/agents` for Compliance Harness–gated
+  Lite Registry submissions (optional `registry_auto_registration` on
+  `create_app`). See [docs/registry/auto-registration.md](docs/registry/auto-registration.md).
+- **Capability escalation**: `POST /asap/agent/request-capability` plus Python
+  `ASAPClient.request_capability` / TypeScript client support for approval
+  flows without re-registering the agent.
+- **ASAP HTTP challenge**: `WWW-Authenticate: ASAP` with `discovery=` manifest
+  URL on selected 401/403 responses; clients can record discovery metadata from
+  the challenge header.
+
+### Changed
+
+- **Reference server**: New optional routers and middleware wiring are
+  **opt-in** behind constructor flags — existing deployments keep v2.2.x
+  behavior until they enable OpenAPI surfaces, auto-registration, escalation
+  routes, or challenge middleware.
+
+### Security
+
+- **Dependency sweep (pre-tag)**: `uv run pip-audit --ignore-vuln CVE-2026-4539 --ignore-vuln CVE-2026-3219` (after `uv sync` per [SECURITY.md](SECURITY.md)) reported **no known vulnerabilities** (same ignores as CI). **`apps/web`**: `npm audit` (2026-05-04) still reports **moderate** `postcss` via `next@16.2.4` (GHSA-qx2v-qp2m-jg93); upstream fix may require a newer Next.js line — track before treating web audits as fully clean.
+
+---
+
+## [2.2.1] - 2026-04-21
+
+Patch release: optional WebAuthn verification, compliance and audit CLIs, docs,
+and CI baselines.
+
+### Added
+
+- **WebAuthn (optional extra)**: `asap-protocol[webauthn]` enables real
+  registration/assertion verification when `ASAP_WEBAUTHN_RP_ID` and
+  `ASAP_WEBAUTHN_ORIGIN` are set; otherwise behavior matches v2.2.0. See
+  [v2.2.0 → v2.2.1 migration](docs/migration.md#upgrading-from-v220-to-v221).
+- **`asap compliance-check`**: Runs Compliance Harness v2 against an agent
+  `HTTP(S)` base URL; `--output {text,json}`, `--exit-on-fail`, `--timeout`,
+  `--asap-version`. Documented in [docs/cli.md](docs/cli.md) and
+  [docs/ci-compliance.md](docs/ci-compliance.md) (Actions example with
+  `--exit-on-fail`).
+- **`asap audit export`**: Exports hash-chained audit rows from SQLite or an
+  in-memory store; `--verify-chain` fails on tampering. Documented in
+  [docs/cli.md](docs/cli.md#asap-audit-export) and [docs/audit.md](docs/audit.md).
+- **`apps/example-agent`**: Minimal installable example; CI runs Harness v2 and
+  fails on score < 1.0 (regression guard).
+
+### Security
+
+- **`python-dotenv`**: `tool.uv.override-dependencies` pins **≥ 1.2.2** (CVE-2026-28684)
+  on transitive installs.
+- **`apps/web`**: Dependency updates closing npm audit findings (Next.js 16.2.4;
+  `micromatch` subtree forced to `picomatch` ≥ 2.3.2).
+
+### Changed
+
+- **CLI package layout**: Typer subcommands live under `asap.cli` / `src/asap/cli/`
+  (replacing the monolithic `cli.py` module); `asap` console script unchanged.
+- **`ResolvedAgent.run()`**: Tightens the contract from "tri-branch dict[str, Any]" to
+  "the TaskResponse.result dict, or empty dict if result is None". A protocol violation
+  (server responds with anything other than a TaskResponse envelope) now raises
+  `TypeError` so it surfaces at the call site instead of silently coercing into a dict.
+  Return type annotation remains `dict[str, Any]`; no caller API change. Closes the
+  deferred follow-up from v2.1 PR-73 review.
+- **Dependency pins**: `cryptography`, `authlib`, `joserfc`, `pyjwt`, `webauthn` (extra),
+  and `pydantic` now carry explicit upper bounds to the next major version so breaking
+  upstream releases can't auto-install. Policy + bump procedure documented in
+  [SECURITY.md §Dependency policy](SECURITY.md#dependency-policy).
+- **ID generation**: `asap.state.stores.sqlite`, `asap.economics.storage`,
+  `asap.economics.sla`, and `asap.integrations.a2h` now generate entity IDs through
+  `asap.models.ids.generate_id()` (ULID) instead of ad-hoc `uuid.uuid4()`. The
+  slowapi storage-URI suffix in `asap.transport.rate_limit` remains `uuid.uuid4().hex`
+  because it is a backend namespace, not a domain identifier; an inline comment
+  documents the distinction.
+- **`asap.economics.storage` aggregate dispatch**: The six-branch `cast(list[UsageAggregate], ...)`
+  clusters in `InMemoryMeteringStorage.aggregate` and `SQLiteMeteringStorage.aggregate` are
+  consolidated into a single `_dispatch_aggregate(events, group_by)` helper. Eight
+  scattered casts become three, all documented in one place.
+- **`asap.transport.server` helper types**: `_validate_envelope` and `_dispatch_to_handler`
+  now return a discriminable `EnvelopeOrError = JSONResponse | tuple[Envelope, str]`
+  union instead of `tuple[Envelope | None, JSONResponse | str]`. Callers narrow via
+  `isinstance(result, JSONResponse)` and no longer need `cast()` at the three call
+  sites. Internal-only refactor; public API unchanged.
+- **`WebAuthnVerifierImpl.start_webauthn_*`**: Returns the full
+  `PublicKeyCredentialCreation/RequestOptions` dict from
+  `webauthn.helpers.options_to_json_dict` (previously a bare base64url
+  challenge). Integrators building a browser adapter get `rp`, `user`,
+  `pubKeyCredParams`, `allowCredentials`, and `userVerification` out of the
+  box and no longer need to hand-assemble the options envelope.
+- **`default_webauthn_verifier()`**: The returned verifier is now cached
+  per-process (keyed by `extra_installed / rp_id / origin`). Pending
+  WebAuthn challenges persist across requests when the defensive fallback in
+  `agent_routes._webauthn_verifier` is hit — previously each fallback call
+  rebuilt an empty `InMemoryWebAuthnCredentialStore`, silently discarding
+  any `start_webauthn_assertion` state. Tests can reset the cache with
+  `asap.auth.self_auth.reset_default_webauthn_verifier_cache()`.
+
+### Fixed
+
+- **Swallowed exceptions in `finish_webauthn_assertion`**: Bare
+  `except Exception:` blocks now catch the specific
+  `InvalidAuthenticationResponse` / `ValueError` / `TypeError` classes and
+  emit structured warnings (`asap.webauthn.assertion.invalid`,
+  `.malformed_challenge`, `.challenge_mismatch`, `.unknown_credential`)
+  via `asap.observability.get_logger` so SIEM rules can detect
+  cloned-authenticator and replay patterns.
+- **`WebAuthnCeremonyError` payload**: Public `detail` is now a stable,
+  PII-free identifier (`webauthn_registration_state_missing`,
+  `webauthn_registration_verification_failed`). `host_id` and the upstream
+  library reason are logged internally instead of leaking into the error
+  surface.
+- **`audit export --verify-chain`**: Replaces fragile string-matching on
+  `"AUDIT_CHAIN_BROKEN"` with a dedicated `asap.economics.audit.AuditChainBroken`
+  exception. Invalid `--since` / `--until` ISO-8601 values now surface as
+  `typer.BadParameter` instead of an unhandled traceback.
+- **CSV export determinism**: `asap audit export --format csv` now writes
+  rows with `lineterminator="\n"` for reproducible diffs on Linux CI.
+- **Test fixtures**: `tests/cli/test_compliance_check.py` uvicorn fixtures
+  now stop the server cooperatively via `server.should_exit = True` +
+  `thread.join`, preventing the leaked-socket flakes flagged under
+  `pytest-xdist` on long suites.
+
+### Known limitations
+
+- **No reference HTTP enrollment route** for the WebAuthn registration
+  ceremony. `WebAuthnVerifierImpl.start_webauthn_registration` /
+  `.finish_webauthn_registration` are Python-only helpers in v2.2.1;
+  integrators must expose their own adapter route (see
+  [docs/security/self-authorization-prevention.md](docs/security/self-authorization-prevention.md#known-limitation-no-reference-http-enrollment-route-in-v221)).
+  A first-class `POST /asap/agent/webauthn/register/{begin,finish}` is
+  tracked for v2.3 (Adoption Multiplier), where new endpoint surface area
+  is permitted.
 
 ---
 

{asap_protocol-2.2.0 → asap_protocol-2.3.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: asap-protocol
-Version: 2.2.0
+Version: 2.3.0
 Summary: Async Simple Agent Protocol - A streamlined protocol for agent-to-agent communication
 Project-URL: Homepage, https://github.com/adriannoes/asap-protocol
 Project-URL: Documentation, https://adriannoes.github.io/asap-protocol
@@ -21,13 +21,13 @@ Classifier: Topic :: System :: Distributed Computing
 Classifier: Typing :: Typed
 Requires-Python: >=3.13
 Requires-Dist: aiosqlite>=0.20
-Requires-Dist: authlib>=1.6.9
+Requires-Dist: authlib<2,>=1.6.11
 Requires-Dist: brotli>=1.2.0
-Requires-Dist: cryptography>=46.0.7
+Requires-Dist: cryptography<47,>=46.0.7
 Requires-Dist: fastapi>=0.128.0
 Requires-Dist: httpx[http2]>=0.28.1
 Requires-Dist: jcs>=0.2.0
-Requires-Dist: joserfc>=1.6.3
+Requires-Dist: joserfc<2,>=1.6.3
 Requires-Dist: jsonschema>=4.23.0
 Requires-Dist: limits>=3.0
 Requires-Dist: opentelemetry-api>=1.20
@@ -36,7 +36,7 @@ Requires-Dist: opentelemetry-instrumentation-fastapi>=0.41
 Requires-Dist: opentelemetry-instrumentation-httpx>=0.41
 Requires-Dist: opentelemetry-sdk>=1.20
 Requires-Dist: packaging>=25.0
-Requires-Dist: pydantic>=2.12.5
+Requires-Dist: pydantic<3,>=2.12.5
 Requires-Dist: python-ulid>=3.0
 Requires-Dist: structlog>=24.1
 Requires-Dist: typer>=0.21.1
@@ -69,6 +69,8 @@ Provides-Extra: llamaindex
 Requires-Dist: llama-index-core>=0.10; extra == 'llamaindex'
 Provides-Extra: mcp
 Requires-Dist: mcp>=1.0.0; extra == 'mcp'
+Provides-Extra: openapi
+Requires-Dist: openapi-pydantic>=0.5; extra == 'openapi'
 Provides-Extra: openclaw
 Requires-Dist: openclaw-sdk>=2.0; extra == 'openclaw'
 Provides-Extra: pydanticai
@@ -77,6 +79,8 @@ Provides-Extra: redis
 Requires-Dist: redis>=5.0.0; extra == 'redis'
 Provides-Extra: smolagents
 Requires-Dist: smolagents>=1.0; extra == 'smolagents'
+Provides-Extra: webauthn
+Requires-Dist: webauthn<3,>=2.6; extra == 'webauthn'
 Description-Content-Type: text/markdown
 
 # ASAP: Async Simple Agent Protocol
@@ -88,9 +92,11 @@ Description-Content-Type: text/markdown
 
 > A production-ready protocol for agent-to-agent communication and task coordination.
 
-**Quick Info**: `v2.1.1` | `Apache 2.0` | `Python 3.13+` | [Documentation](https://github.com/adriannoes/asap-protocol/blob/main/docs/index.md) | [PyPI](https://pypi.org/project/asap-protocol/) | [Changelog](https://github.com/adriannoes/asap-protocol/blob/main/CHANGELOG.md)
+**Quick Info**: `v2.3.0` | `Apache 2.0` | `Python 3.13+` | [Documentation](https://github.com/adriannoes/asap-protocol/blob/main/docs/index.md) | **[PyPI `asap-protocol`](https://pypi.org/project/asap-protocol/)** | **[npm `@asap-protocol/client`](https://www.npmjs.com/package/@asap-protocol/client)** | [Changelog](https://github.com/adriannoes/asap-protocol/blob/main/CHANGELOG.md)
 
-> 🚀 **Live now** our [**agentic marketplace**](https://asap-protocol.vercel.app/) — Browse agents, register yours, request verification.
+> 📦 Install the ASAP **Python SDK / protocol** from **`https://pypi.org/project/asap-protocol/`** — package name **`asap-protocol`** on [PyPI](https://pypi.org/project/asap-protocol/).
+
+> 🚀 **Live now** our [**agentic marketplace**](https://asap-protocol.com/) — browse agents, register yours, request verification.
 
 ## Why ASAP?
 
@@ -101,7 +107,7 @@ Building multi-agent systems today suffers from three core technical challenges
 
 **ASAP** provides a production-ready communication layer that simplifies these complexities. It's ideal for **multi-agent orchestration**, **stateful workflows** (persistence, resumability), **MCP support** and **production systems** requiring high-performance, type-safe agent communication. 
 
-For simple point-to-point communication, a basic HTTP API might suffice; ASAP shines when you need orchestration, state management and multi-agent coordination. See the [spec](https://github.com/adriannoes/asap-protocol/blob/main/.cursor/product-specs/strategy/v0-original-specs.md) for details.
+For simple point-to-point communication, a basic HTTP API might suffice; ASAP shines when you need orchestration, state management and multi-agent coordination. See the [documentation](https://github.com/adriannoes/asap-protocol/blob/main/docs/index.md) for the current protocol overview and features.
 
 ### Key Features
 
@@ -111,6 +117,9 @@ For simple point-to-point communication, a basic HTTP API might suffice; ASAP sh
 - **MCP integration** — Tool execution and coordination in a single envelope.
 - **Observable** — `trace_id` and `correlation_id` for debugging.
 - **Security** — Bearer auth, OAuth2/JWT, Ed25519 signed manifests, optional mTLS, replay prevention, HTTPS, rate limiting. [Security Model](https://github.com/adriannoes/asap-protocol/blob/main/docs/security/v1.1-security-model.md) (trust limits, Custom Claims).
+- **Identity & capabilities (v2.2, WebAuthn real in v2.2.1)** — Per-runtime Host/Agent JWTs, capability grants with constraints (`max`, `min`, `in`, `not_in`), approval flows (device authorization / CIBA-style), real WebAuthn attestation/assertion for high-risk registration (opt-in via `asap-protocol[webauthn]`).
+- **Streaming & wire protocol (v2.2)** — `POST /asap/stream` (SSE / `TaskStream`), JSON-RPC 2.0 batch on `POST /asap`, `ASAP-Version` negotiation, tamper-evident audit logging, Compliance Harness v2.
+- **Adoption Multiplier (v2.3.0)** — OpenAPI → ASAP via `create_from_openapi` (`[openapi]` extra), official **`@asap-protocol/client`** on npm (Vercel AI / OpenAI / Anthropic adapters), optional **Auto-Registration** (`POST /registry/agents`), **capability escalation**, and **ASAP `WWW-Authenticate`** discovery challenges. All opt-in; wire protocol unchanged. See [docs/index.md](docs/index.md) and [docs/migration.md](docs/migration.md).
 - **Economics** — Usage metering, delegation tokens, SLA framework with breach alerts.
 
 ### 🆕 Framework Ecosystem
@@ -130,7 +139,13 @@ Or with pip:
 pip install asap-protocol
 ```
 
-📦 **Available on [PyPI](https://pypi.org/project/asap-protocol/)** — for reproducible environments, prefer `uv` when possible.
+**npm** (TypeScript / JavaScript — [`@asap-protocol/client`](https://www.npmjs.com/package/@asap-protocol/client), aligned with protocol **v2.3.0**):
+
+```bash
+npm install @asap-protocol/client
+```
+
+📦 **Canonical listing:** **[https://pypi.org/project/asap-protocol/](https://pypi.org/project/asap-protocol/)** — package **`asap-protocol`** (`pip install asap-protocol`). Prefer `uv` for reproducible environments when possible.
 
 ## Quick Start
 
@@ -173,6 +188,7 @@ See [Compliance Testing Guide](https://github.com/adriannoes/asap-protocol/blob/
 
 **Learn**
 - [Docs](https://github.com/adriannoes/asap-protocol/blob/main/docs/index.md) | [API Reference](https://github.com/adriannoes/asap-protocol/blob/main/docs/api-reference.md)
+- [TypeScript client SDK](https://github.com/adriannoes/asap-protocol/blob/main/docs/sdks/typescript.md) — `@asap-protocol/client` (identity, capabilities, streaming, adapters)
 - [Tutorials](https://github.com/adriannoes/asap-protocol/tree/main/docs/tutorials) — First agent to production checklist
 - [Migration from A2A/MCP](https://github.com/adriannoes/asap-protocol/blob/main/docs/migration.md)
 - [Raw Fetch (non-Python)](https://github.com/adriannoes/asap-protocol/blob/main/docs/raw-fetch.md) — Fetch registry.json and revoked_agents.json with curl/fetch; implement your own client.
@@ -184,36 +200,48 @@ See [Compliance Testing Guide](https://github.com/adriannoes/asap-protocol/blob/
 - [Observability](https://github.com/adriannoes/asap-protocol/blob/main/docs/observability.md) | [Testing](https://github.com/adriannoes/asap-protocol/blob/main/docs/testing.md)
 
 **Decisions & Operations**
-- [ADRs](https://github.com/adriannoes/asap-protocol/tree/main/docs/adr) — 17 Architecture Decision Records
-- [Tech Stack](https://github.com/adriannoes/asap-protocol/blob/main/.cursor/dev-planning/architecture/tech-stack-decisions.md) — Rationale for Python, Pydantic, Next.js choices
+- [ADRs](https://github.com/adriannoes/asap-protocol/tree/main/docs/adr) — 19 Architecture Decision Records
+- [Tech Stack](https://github.com/adriannoes/asap-protocol/blob/main/engineering/architecture/tech-stack-decisions.md) — Rationale for Python, Pydantic, Next.js choices
 - [Deployment](https://github.com/adriannoes/asap-protocol/blob/main/docs/deployment/kubernetes.md) | [Troubleshooting](https://github.com/adriannoes/asap-protocol/blob/main/docs/troubleshooting.md)
 
 **Release**
-- [Changelog](https://github.com/adriannoes/asap-protocol/blob/main/CHANGELOG.md) | [PyPI](https://pypi.org/project/asap-protocol/)
+- [Changelog](https://github.com/adriannoes/asap-protocol/blob/main/CHANGELOG.md) | **[PyPI listing](https://pypi.org/project/asap-protocol/)** — `https://pypi.org/project/asap-protocol/` (install: `pip install asap-protocol`)
 
 ## CLI
 
-- **v1.1** adds OAuth2, WebSocket, Discovery (well-known + Lite Registry), State Storage (SQLite) and Webhooks. 
-- **v1.2** adds Ed25519 signed manifests, trust levels, optional mTLS and the [Compliance Harness](https://github.com/adriannoes/asap-protocol/blob/main/asap-compliance/README.md). 
-- **v1.3** adds delegation commands (`asap delegation create`, `asap delegation revoke`).
-
 ```bash
 asap --version                                    # Show version
 asap list-schemas                                 # List all available schemas
 asap export-schemas                               # Export JSON schemas to file
+asap compliance-check --url https://agent.example # Compliance Harness v2 (HTTP(S))
+asap audit export --store memory --format json    # Export audit log (stdout)
 asap keys generate -o key.pem                     # Generate Ed25519 keypair
 asap manifest sign -k key.pem manifest.json       # Sign manifest
 asap manifest verify signed.json                  # Verify signature
 asap manifest info signed.json                    # Show trust level
 ```
 
-See [CLI reference](https://github.com/adriannoes/asap-protocol/blob/main/docs/guides/identity-signing.md) or run `asap --help`.
+See the [CLI reference](docs/cli.md) for `compliance-check` and `audit export` flag details, the [CI compliance gate](docs/ci-compliance.md) for wiring `compliance-check` into GitHub Actions, the [audit export guide](docs/audit.md), [Identity Signing](docs/guides/identity-signing.md), or run `asap --help` for the full command surface.
 
-See [docs index](https://github.com/adriannoes/asap-protocol/blob/main/docs/index.md#v11-features-api-reference--guides) and [Identity Signing](https://github.com/adriannoes/asap-protocol/blob/main/docs/guides/identity-signing.md) for details.
+## Version History
+
+High-level only — see **[Changelog](https://github.com/adriannoes/asap-protocol/blob/main/CHANGELOG.md)** and the **[docs index](https://github.com/adriannoes/asap-protocol/blob/main/docs/index.md#v11-features-api-reference--guides)** for full notes.
+
+| Version | What shipped |
+| :-- | :-- |
+| **v2.3.0** | **OpenAPI Adapter** (`[openapi]`) · **TypeScript client** (`@asap-protocol/client`) · **Auto-Registration** · **Capability escalation** · **ASAP HTTP challenge** — see [CHANGELOG](https://github.com/adriannoes/asap-protocol/blob/main/CHANGELOG.md#230---2026-05-04) and [Migration](https://github.com/adriannoes/asap-protocol/blob/main/docs/migration.md#upgrading-from-v22x-to-v230) |
+| **v2.2.1** | Opt-in **WebAuthn** (`asap-protocol[webauthn]`) · `asap compliance-check` & `asap audit export` · stricter `ResolvedAgent.run()` · `AuditChainBroken` · [pinned security deps](https://github.com/adriannoes/asap-protocol/blob/main/SECURITY.md#dependency-policy) |
+| **v2.2** | Per-runtime identity & capability auth · SSE `POST /asap/stream` · `ASAP-Version` · JSON-RPC batch · tamper-evident audit · async state stores · Compliance Harness v2 |
+| **v2.1.1** | Patch: JWT allowlist · SQLite async bridge · optional Redis rate limits · web SSRF hardening |
+| **v2.1** | `MarketClient` · framework extras (LangChain, CrewAI, LlamaIndex, …) · registry UX |
+| **v2.0** | Marketplace web app · Lite Registry (GitHub Pages) · IssueOps · OAuth · verification flow |
+| **v1.3** | `asap delegation create` / `revoke` |
+| **v1.2** | Ed25519 manifests · trust levels · optional mTLS · [Compliance Harness](https://github.com/adriannoes/asap-protocol/blob/main/asap-compliance/README.md) |
+| **v1.1** | OAuth2 · WebSocket · discovery (well-known + Lite Registry) · SQLite state · webhooks |
 
 ## 🔭 What's Next?
 
-ASAP is evolving toward an **Agent Marketplace** — an open ecosystem where AI agents discover, trust and collaborate autonomously. See our [vision document](https://github.com/adriannoes/asap-protocol/blob/main/.cursor/product-specs/strategy/vision-agent-marketplace.md) for the full roadmap.
+ASAP is evolving toward an **Agent Marketplace** — an open ecosystem where AI agents discover, trust and collaborate autonomously. See the [ADR index](https://github.com/adriannoes/asap-protocol/blob/main/product/decision-records/README.md) and [v2.0 roadmap PRD](https://github.com/adriannoes/asap-protocol/blob/main/product/prd/prd-v2.0-roadmap.md). Detailed long-term strategy narratives are maintained privately (not shipped in this repository).
 
 ## Contributing
 
@@ -223,10 +251,18 @@ Every contribution, from bug reports to feature suggestions, documentation impro
 
 Check out our [contributing guidelines](https://github.com/adriannoes/asap-protocol/blob/main/CONTRIBUTING.md) to get started. It's easier than you think! 🚀
 
+## Contact
+
+For **general questions** about the protocol, the marketplace, partnerships, or press (not security vulnerabilities — use [SECURITY.md](https://github.com/adriannoes/asap-protocol/blob/main/SECURITY.md) for those):
+
+- **Email:** [info@asap-protocol.com](mailto:info@asap-protocol.com)
+
+You can also use [GitHub Discussions](https://github.com/adriannoes/asap-protocol/discussions) or [Issues](https://github.com/adriannoes/asap-protocol/issues) for public project topics.
+
 ## License
 
 This project is licensed under the Apache 2.0 License - see the [license](https://github.com/adriannoes/asap-protocol/blob/main/LICENSE) file for details.
 
 ---
 
-**Built with [Cursor](https://cursor.com/)** using Composer 1.5, Claude Opus 4.6, Gemini 3.1 Pro and Kimi K2.5.
+**Built with [Cursor](https://cursor.com/)** using Opus 4.6/4.7, Composer 1.5/2.0, Gemini 3.1 Pro and Kimi K2.5.

{asap_protocol-2.2.0 → asap_protocol-2.3.0}/README.md

@@ -7,9 +7,11 @@
 
 > A production-ready protocol for agent-to-agent communication and task coordination.
 
-**Quick Info**: `v2.1.1` | `Apache 2.0` | `Python 3.13+` | [Documentation](https://github.com/adriannoes/asap-protocol/blob/main/docs/index.md) | [PyPI](https://pypi.org/project/asap-protocol/) | [Changelog](https://github.com/adriannoes/asap-protocol/blob/main/CHANGELOG.md)
+**Quick Info**: `v2.3.0` | `Apache 2.0` | `Python 3.13+` | [Documentation](https://github.com/adriannoes/asap-protocol/blob/main/docs/index.md) | **[PyPI `asap-protocol`](https://pypi.org/project/asap-protocol/)** | **[npm `@asap-protocol/client`](https://www.npmjs.com/package/@asap-protocol/client)** | [Changelog](https://github.com/adriannoes/asap-protocol/blob/main/CHANGELOG.md)
 
-> 🚀 **Live now** our [**agentic marketplace**](https://asap-protocol.vercel.app/) — Browse agents, register yours, request verification.
+> 📦 Install the ASAP **Python SDK / protocol** from **`https://pypi.org/project/asap-protocol/`** — package name **`asap-protocol`** on [PyPI](https://pypi.org/project/asap-protocol/).
+
+> 🚀 **Live now** our [**agentic marketplace**](https://asap-protocol.com/) — browse agents, register yours, request verification.
 
 ## Why ASAP?
 
@@ -20,7 +22,7 @@ Building multi-agent systems today suffers from three core technical challenges
 
 **ASAP** provides a production-ready communication layer that simplifies these complexities. It's ideal for **multi-agent orchestration**, **stateful workflows** (persistence, resumability), **MCP support** and **production systems** requiring high-performance, type-safe agent communication. 
 
-For simple point-to-point communication, a basic HTTP API might suffice; ASAP shines when you need orchestration, state management and multi-agent coordination. See the [spec](https://github.com/adriannoes/asap-protocol/blob/main/.cursor/product-specs/strategy/v0-original-specs.md) for details.
+For simple point-to-point communication, a basic HTTP API might suffice; ASAP shines when you need orchestration, state management and multi-agent coordination. See the [documentation](https://github.com/adriannoes/asap-protocol/blob/main/docs/index.md) for the current protocol overview and features.
 
 ### Key Features
 
@@ -30,6 +32,9 @@ For simple point-to-point communication, a basic HTTP API might suffice; ASAP sh
 - **MCP integration** — Tool execution and coordination in a single envelope.
 - **Observable** — `trace_id` and `correlation_id` for debugging.
 - **Security** — Bearer auth, OAuth2/JWT, Ed25519 signed manifests, optional mTLS, replay prevention, HTTPS, rate limiting. [Security Model](https://github.com/adriannoes/asap-protocol/blob/main/docs/security/v1.1-security-model.md) (trust limits, Custom Claims).
+- **Identity & capabilities (v2.2, WebAuthn real in v2.2.1)** — Per-runtime Host/Agent JWTs, capability grants with constraints (`max`, `min`, `in`, `not_in`), approval flows (device authorization / CIBA-style), real WebAuthn attestation/assertion for high-risk registration (opt-in via `asap-protocol[webauthn]`).
+- **Streaming & wire protocol (v2.2)** — `POST /asap/stream` (SSE / `TaskStream`), JSON-RPC 2.0 batch on `POST /asap`, `ASAP-Version` negotiation, tamper-evident audit logging, Compliance Harness v2.
+- **Adoption Multiplier (v2.3.0)** — OpenAPI → ASAP via `create_from_openapi` (`[openapi]` extra), official **`@asap-protocol/client`** on npm (Vercel AI / OpenAI / Anthropic adapters), optional **Auto-Registration** (`POST /registry/agents`), **capability escalation**, and **ASAP `WWW-Authenticate`** discovery challenges. All opt-in; wire protocol unchanged. See [docs/index.md](docs/index.md) and [docs/migration.md](docs/migration.md).
 - **Economics** — Usage metering, delegation tokens, SLA framework with breach alerts.
 
 ### 🆕 Framework Ecosystem
@@ -49,7 +54,13 @@ Or with pip:
 pip install asap-protocol
 ```
 
-📦 **Available on [PyPI](https://pypi.org/project/asap-protocol/)** — for reproducible environments, prefer `uv` when possible.
+**npm** (TypeScript / JavaScript — [`@asap-protocol/client`](https://www.npmjs.com/package/@asap-protocol/client), aligned with protocol **v2.3.0**):
+
+```bash
+npm install @asap-protocol/client
+```
+
+📦 **Canonical listing:** **[https://pypi.org/project/asap-protocol/](https://pypi.org/project/asap-protocol/)** — package **`asap-protocol`** (`pip install asap-protocol`). Prefer `uv` for reproducible environments when possible.
 
 ## Quick Start
 
@@ -92,6 +103,7 @@ See [Compliance Testing Guide](https://github.com/adriannoes/asap-protocol/blob/
 
 **Learn**
 - [Docs](https://github.com/adriannoes/asap-protocol/blob/main/docs/index.md) | [API Reference](https://github.com/adriannoes/asap-protocol/blob/main/docs/api-reference.md)
+- [TypeScript client SDK](https://github.com/adriannoes/asap-protocol/blob/main/docs/sdks/typescript.md) — `@asap-protocol/client` (identity, capabilities, streaming, adapters)
 - [Tutorials](https://github.com/adriannoes/asap-protocol/tree/main/docs/tutorials) — First agent to production checklist
 - [Migration from A2A/MCP](https://github.com/adriannoes/asap-protocol/blob/main/docs/migration.md)
 - [Raw Fetch (non-Python)](https://github.com/adriannoes/asap-protocol/blob/main/docs/raw-fetch.md) — Fetch registry.json and revoked_agents.json with curl/fetch; implement your own client.
@@ -103,36 +115,48 @@ See [Compliance Testing Guide](https://github.com/adriannoes/asap-protocol/blob/
 - [Observability](https://github.com/adriannoes/asap-protocol/blob/main/docs/observability.md) | [Testing](https://github.com/adriannoes/asap-protocol/blob/main/docs/testing.md)
 
 **Decisions & Operations**
-- [ADRs](https://github.com/adriannoes/asap-protocol/tree/main/docs/adr) — 17 Architecture Decision Records
-- [Tech Stack](https://github.com/adriannoes/asap-protocol/blob/main/.cursor/dev-planning/architecture/tech-stack-decisions.md) — Rationale for Python, Pydantic, Next.js choices
+- [ADRs](https://github.com/adriannoes/asap-protocol/tree/main/docs/adr) — 19 Architecture Decision Records
+- [Tech Stack](https://github.com/adriannoes/asap-protocol/blob/main/engineering/architecture/tech-stack-decisions.md) — Rationale for Python, Pydantic, Next.js choices
 - [Deployment](https://github.com/adriannoes/asap-protocol/blob/main/docs/deployment/kubernetes.md) | [Troubleshooting](https://github.com/adriannoes/asap-protocol/blob/main/docs/troubleshooting.md)
 
 **Release**
-- [Changelog](https://github.com/adriannoes/asap-protocol/blob/main/CHANGELOG.md) | [PyPI](https://pypi.org/project/asap-protocol/)
+- [Changelog](https://github.com/adriannoes/asap-protocol/blob/main/CHANGELOG.md) | **[PyPI listing](https://pypi.org/project/asap-protocol/)** — `https://pypi.org/project/asap-protocol/` (install: `pip install asap-protocol`)
 
 ## CLI
 
-- **v1.1** adds OAuth2, WebSocket, Discovery (well-known + Lite Registry), State Storage (SQLite) and Webhooks. 
-- **v1.2** adds Ed25519 signed manifests, trust levels, optional mTLS and the [Compliance Harness](https://github.com/adriannoes/asap-protocol/blob/main/asap-compliance/README.md). 
-- **v1.3** adds delegation commands (`asap delegation create`, `asap delegation revoke`).
-
 ```bash
 asap --version                                    # Show version
 asap list-schemas                                 # List all available schemas
 asap export-schemas                               # Export JSON schemas to file
+asap compliance-check --url https://agent.example # Compliance Harness v2 (HTTP(S))
+asap audit export --store memory --format json    # Export audit log (stdout)
 asap keys generate -o key.pem                     # Generate Ed25519 keypair
 asap manifest sign -k key.pem manifest.json       # Sign manifest
 asap manifest verify signed.json                  # Verify signature
 asap manifest info signed.json                    # Show trust level
 ```
 
-See [CLI reference](https://github.com/adriannoes/asap-protocol/blob/main/docs/guides/identity-signing.md) or run `asap --help`.
+See the [CLI reference](docs/cli.md) for `compliance-check` and `audit export` flag details, the [CI compliance gate](docs/ci-compliance.md) for wiring `compliance-check` into GitHub Actions, the [audit export guide](docs/audit.md), [Identity Signing](docs/guides/identity-signing.md), or run `asap --help` for the full command surface.
 
-See [docs index](https://github.com/adriannoes/asap-protocol/blob/main/docs/index.md#v11-features-api-reference--guides) and [Identity Signing](https://github.com/adriannoes/asap-protocol/blob/main/docs/guides/identity-signing.md) for details.
+## Version History
+
+High-level only — see **[Changelog](https://github.com/adriannoes/asap-protocol/blob/main/CHANGELOG.md)** and the **[docs index](https://github.com/adriannoes/asap-protocol/blob/main/docs/index.md#v11-features-api-reference--guides)** for full notes.
+
+| Version | What shipped |
+| :-- | :-- |
+| **v2.3.0** | **OpenAPI Adapter** (`[openapi]`) · **TypeScript client** (`@asap-protocol/client`) · **Auto-Registration** · **Capability escalation** · **ASAP HTTP challenge** — see [CHANGELOG](https://github.com/adriannoes/asap-protocol/blob/main/CHANGELOG.md#230---2026-05-04) and [Migration](https://github.com/adriannoes/asap-protocol/blob/main/docs/migration.md#upgrading-from-v22x-to-v230) |
+| **v2.2.1** | Opt-in **WebAuthn** (`asap-protocol[webauthn]`) · `asap compliance-check` & `asap audit export` · stricter `ResolvedAgent.run()` · `AuditChainBroken` · [pinned security deps](https://github.com/adriannoes/asap-protocol/blob/main/SECURITY.md#dependency-policy) |
+| **v2.2** | Per-runtime identity & capability auth · SSE `POST /asap/stream` · `ASAP-Version` · JSON-RPC batch · tamper-evident audit · async state stores · Compliance Harness v2 |
+| **v2.1.1** | Patch: JWT allowlist · SQLite async bridge · optional Redis rate limits · web SSRF hardening |
+| **v2.1** | `MarketClient` · framework extras (LangChain, CrewAI, LlamaIndex, …) · registry UX |
+| **v2.0** | Marketplace web app · Lite Registry (GitHub Pages) · IssueOps · OAuth · verification flow |
+| **v1.3** | `asap delegation create` / `revoke` |
+| **v1.2** | Ed25519 manifests · trust levels · optional mTLS · [Compliance Harness](https://github.com/adriannoes/asap-protocol/blob/main/asap-compliance/README.md) |
+| **v1.1** | OAuth2 · WebSocket · discovery (well-known + Lite Registry) · SQLite state · webhooks |
 
 ## 🔭 What's Next?
 
-ASAP is evolving toward an **Agent Marketplace** — an open ecosystem where AI agents discover, trust and collaborate autonomously. See our [vision document](https://github.com/adriannoes/asap-protocol/blob/main/.cursor/product-specs/strategy/vision-agent-marketplace.md) for the full roadmap.
+ASAP is evolving toward an **Agent Marketplace** — an open ecosystem where AI agents discover, trust and collaborate autonomously. See the [ADR index](https://github.com/adriannoes/asap-protocol/blob/main/product/decision-records/README.md) and [v2.0 roadmap PRD](https://github.com/adriannoes/asap-protocol/blob/main/product/prd/prd-v2.0-roadmap.md). Detailed long-term strategy narratives are maintained privately (not shipped in this repository).
 
 ## Contributing
 
@@ -142,10 +166,18 @@ Every contribution, from bug reports to feature suggestions, documentation impro
 
 Check out our [contributing guidelines](https://github.com/adriannoes/asap-protocol/blob/main/CONTRIBUTING.md) to get started. It's easier than you think! 🚀
 
+## Contact
+
+For **general questions** about the protocol, the marketplace, partnerships, or press (not security vulnerabilities — use [SECURITY.md](https://github.com/adriannoes/asap-protocol/blob/main/SECURITY.md) for those):
+
+- **Email:** [info@asap-protocol.com](mailto:info@asap-protocol.com)
+
+You can also use [GitHub Discussions](https://github.com/adriannoes/asap-protocol/discussions) or [Issues](https://github.com/adriannoes/asap-protocol/issues) for public project topics.
+
 ## License
 
 This project is licensed under the Apache 2.0 License - see the [license](https://github.com/adriannoes/asap-protocol/blob/main/LICENSE) file for details.
 
 ---
 
-**Built with [Cursor](https://cursor.com/)** using Composer 1.5, Claude Opus 4.6, Gemini 3.1 Pro and Kimi K2.5.
+**Built with [Cursor](https://cursor.com/)** using Opus 4.6/4.7, Composer 1.5/2.0, Gemini 3.1 Pro and Kimi K2.5.

{asap_protocol-2.2.0 → asap_protocol-2.3.0}/pyproject.toml

@@ -1,6 +1,6 @@
 [project]
 name = "asap-protocol"
-version = "2.2.0"
+version = "2.3.0"
 description = "Async Simple Agent Protocol - A streamlined protocol for agent-to-agent communication"
 authors = [
     {name = "ASAP Protocol Contributors"}
@@ -22,14 +22,15 @@ classifiers = [
 
 dependencies = [
     "aiosqlite>=0.20",
-    "cryptography>=46.0.7",
+    # Upper-bound majors per SECURITY.md dependency policy.
+    "cryptography>=46.0.7,<47",
     "jcs>=0.2.0",
     "jsonschema>=4.23.0",
-    "pydantic>=2.12.5",
+    "pydantic>=2.12.5,<3",
     "fastapi>=0.128.0",
     "httpx[http2]>=0.28.1",
-    "authlib>=1.6.9",
-    "joserfc>=1.6.3",
+    "authlib>=1.6.11,<2",
+    "joserfc>=1.6.3,<2",
     "uvicorn>=0.34",
     "python-ulid>=3.0",
     "packaging>=25.0",
@@ -72,6 +73,10 @@ dns-sd = [
 redis = [
     "redis>=5.0.0",
 ]
+# Optional WebAuthn (real attestation/assertion when extra installed).
+webauthn = [
+    "webauthn>=2.6,<3",
+]
 # Framework integrations (Sprint E3 — PKG-003).
 mcp = [
     "mcp>=1.0.0",
@@ -94,6 +99,10 @@ pydanticai = [
 openclaw = [
     "openclaw-sdk>=2.0",
 ]
+# OpenAPI 3.x spec parsing for asap.adapters.openapi (Sprint S1).
+openapi = [
+    "openapi-pydantic>=0.5",
+]
 
 [project.urls]
 Homepage = "https://github.com/adriannoes/asap-protocol"
@@ -113,18 +122,20 @@ Issues = "https://github.com/adriannoes/asap-protocol/issues"
 # - python-multipart>=0.0.26 for CVE-2026-40347 (FastAPI stack)
 # - pygments>=2.20.0 for CVE-2026-4539
 # - langsmith>=0.7.31 for GHSA-rr7j-v2q5-chgv
+# - python-dotenv>=1.2.2 for CVE-2026-28684 (transitive, e.g. pydantic-settings / uvicorn stacks)
 [tool.uv]
 override-dependencies = [
-    "pyjwt>=2.12.0",
+    "pyjwt>=2.12.0,<3",
     "pyasn1>=0.6.3",
     "tinytag>=2.2.1",
-    "cryptography>=46.0.7",
+    "cryptography>=46.0.7,<47",
     "requests>=2.33.0",
     "pillow>=12.2.0",
     "pytest>=9.0.3",
     "python-multipart>=0.0.26",
     "pygments>=2.20.0",
     "langsmith>=0.7.31",
+    "python-dotenv>=1.2.2",
 ]
 
 [project.scripts]
@@ -178,12 +189,13 @@ ignore = [
 [tool.ruff.lint.per-file-ignores]
 "scripts/**" = ["T201"]
 "src/asap/examples/**" = ["T201", "ASYNC210"]
+"examples/**" = ["T201"]
 "benchmarks/**" = ["T201"]
 "tests/**" = ["B008"]
 "src/asap/transport/usage_api.py" = ["B008"]
 "src/asap/transport/delegation_api.py" = ["B008"]
 "src/asap/transport/sla_api.py" = ["B008"]
-"src/asap/cli.py" = ["B008"]
+"src/asap/cli/__init__.py" = ["B008"]
 
 [tool.ruff.format]
 quote-style = "double"

asap_protocol-2.3.0/src/asap/__init__.py

@@ -0,0 +1,22 @@
+"""ASAP: Async Simple Agent Protocol.
+
+A streamlined, scalable, asynchronous protocol for agent-to-agent communication
+and task coordination.
+"""
+
+from __future__ import annotations
+
+from typing import Any
+
+__version__ = "2.3.0"
+
+__all__ = ["__version__", "create_from_openapi"]
+
+
+def __getattr__(name: str) -> Any:
+    if name == "create_from_openapi":
+        from asap.adapters.openapi import create_from_openapi as exported
+
+        return exported
+    msg = f"module {__name__!r} has no attribute {name!r}"
+    raise AttributeError(msg)

asap_protocol-2.3.0/src/asap/adapters/__init__.py

@@ -0,0 +1 @@
+"""ASAP protocol adapters (third-party wire formats → ASAP capabilities)."""