asap-protocol 2.2.1__tar.gz → 2.4.0__tar.gz

{asap_protocol-2.2.1 → asap_protocol-2.4.0}/.gitignore

@@ -178,21 +178,46 @@ cython_debug/
 # Project specific
 !/.cursor/
 /drafts/
-# Strategy docs (private — do not commit)
-.cursor/product-specs/strategy/
+/.claude/
+# Local agent state / tooling (ignore everywhere, not only repo root)
+.agents/
+# Strategic and commercial planning (private - do not commit)
+product/strategy/
+product/private/
+product/private-roadmap/
+product/prd/private/
+engineering/code-review/private/
+# Tactical PRDs outside private/ (patch train); single-digit and double-digit patch (e.g. v2.3.10)
+product/prd/prd-v2.3.[1-9]-*.md
+product/prd/prd-v2.3.[1-9][0-9]-*.md
+engineering/private/
+engineering/tasks/private/
+engineering/tasks/v2.3.[1-9]*/
 node_modules/
+# Next.js build output (examples and apps)
+.next/
+# tshy generated tsconfig fragments (regenerated on build)
+.tshy/
 .pnpm-store/
 .github/wiki/
 
 # Next.js app lib (do not ignore; root lib/ is for Python)
 !apps/web/src/lib/
 !apps/web/src/lib/**
+!apps/example-mastra/src/lib/
+!apps/example-mastra/src/lib/**
 
 # Benchmark and cache artifacts
 .benchmarks/
 .uv-cache/
 
+# TypeScript incremental build info (local / IDE)
+*.tsbuildinfo
+
 # ESLint report (generated)
 eslint-report.json
 .vercel
 .env*.local
+
+# Local weekly telemetry outputs (snapshots + dashboard; CI uses artifacts)
+private/telemetry/

{asap_protocol-2.2.1 → asap_protocol-2.4.0}/CHANGELOG.md

@@ -7,6 +7,162 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+### Security
+
+- **OAuth2 middleware**: Validate JWT `iss` and `aud` when `ASAP_AUTH_ISSUER` / `ASAP_AUTH_AUDIENCE` (or `OAuth2Config.expected_issuer` / `expected_audience`) are set; refactored validation through `validate_jwt()` in `asap.auth.jwks`.
+- **Identity binding**: Fail-closed when `manifest_id` is configured but neither custom claim nor `ASAP_AUTH_SUBJECT_MAP` allowlist matches (403 instead of warn-and-pass).
+- **Web app (`apps/web`)**: Block open redirects on E2E fixture login routes via `resolveRedirectUrl`; harden SSRF on `/api/health-check` (127.0.0.0/8, DNS resolve4/6); Zod validation on API query params; rate-limit unit tests.
+
+### Fixed
+
+- **CI security (`pip-audit`)**: Bumped transitive pins (`langchain-core`, `langsmith`, `python-multipart`, `urllib3`, `pip`, `smolagents`) and adjusted documented `--ignore-vuln` flags (pygments + **smolagents** CVEs with no PyPI fix yet; pip ≥26.1 clears prior pip ignore). See [SECURITY.md](SECURITY.md).
+- **FastAPI / Starlette**: Raised `fastapi` floor to `>=0.136.1` so `starlette>=1.0.1` resolves **PYSEC-2026-161** (Host header path injection) without a `pip-audit` ignore.
+
+### Follow-up (not in this release)
+
+- `extra="forbid"` on ingress payload models (`TaskRequestConfig`, `CommonMetadata`)
+- Opt-in protection for operator APIs (`/usage`, `/sla`, `/audit`)
+- Redis-backed `JtiReplayCache` and distributed Next.js rate limits
+- Bump optional `pydantic-ai` extra (CVE-2026-46678)
+
+---
+
+## [2.4.0] - 2026-05-24
+
+**Edge-AI discovery** — Optional structured hardware and inference capability
+advertising on manifests, mirrored to the Lite Registry, marketplace filters, and
+TypeScript discovery types. Wire protocol and existing manifests remain
+backward compatible.
+
+### Added
+
+- **feat(discovery): hardware and inference capability advertising**
+  - **Manifest schema** (`schemas/entities/manifest.schema.json`): optional
+    `capabilities.hardware` (`class`, `model`, `io`) and `capabilities.inference`
+    (`modes`, `local_models` with optional self-reported throughput); closed enums;
+    `additionalProperties: false` on nested objects. Example:
+    `schemas/examples/shellclaw-jetson-capabilities.json`.
+  - **Pydantic models** (`HardwareCapability`, `InferenceCapability`,
+    `LocalModelInfo`; enums `HardwareClass`, `HardwareIoType`, `InferenceMode`).
+  - **Registry mirror**: `RegistryEntry.hardware_class`, `inference_modes`,
+    `hardware_io`; `derive_registry_hardware_fields()` applied in
+    `auto_registration` and `process_registration` when a signed manifest is
+    loaded.
+  - **Discovery helpers**: `find_by_hardware_class`, `find_by_inference_mode`,
+    `find_by_io` in `asap.discovery.registry`.
+  - **Marketplace (web)**: Browse sidebar filters and agent detail blocks for
+    hardware class, inference mode, and I/O; register docs and IssueOps template
+    note manifest-derived fields.
+  - **TypeScript SDK** (`@asap-protocol/client@2.4.0`): optional hardware fields
+    on `RegistryEntry` with parsers in `discovery.ts`.
+  - **Docs**: `docs/transport.md`, `docs/registry/auto-registration.md`,
+    `docs/examples/registry-shellclaw.md`; fixtures under `tests/fixtures/`.
+  - **ShellClaw marketplace onboarding (S0)**: Guide
+    [docs/guides/shellclaw-registry.md](docs/guides/shellclaw-registry.md)
+    (`online_check: false`, static manifest URLs, IssueOps path); validation
+    fixtures `tests/fixtures/registry/shellclaw-v1.0-entry.json`.
+
+### Changed
+
+- **Tags vs structured fields**: `tags` (e.g. `cuda`, `jetson`) remain valid;
+  registrants may migrate to structured `hardware` / `inference` when ready.
+
+### Community feedback
+
+- Track enum and field feedback on GitHub: [#176](https://github.com/adriannoes/asap-protocol/issues/176).
+
+---
+
+## [2.3.1] - 2026-05-20
+
+**Adapter Lab I** — TypeScript-only patch: two new framework adapters on npm and
+additive exports on `@asap-protocol/client`. Python `asap-protocol` core is
+unchanged; no wire-protocol or migration work required for existing deployments.
+
+### Added
+
+- **`@asap-protocol/mastra@2.3.1`**: Expose ASAP capabilities as Mastra
+  `createTool` definitions, optional `createAsapMastraAgent` wrapper, and
+  streaming bridge. See [docs/integrations/mastra.md](docs/integrations/mastra.md).
+  ```bash
+  npm install @asap-protocol/mastra @asap-protocol/client @mastra/core zod
+  ```
+- **`@asap-protocol/openai-agents@2.3.1`**: Expose ASAP capabilities as OpenAI
+  Agents SDK `tool()` definitions, remote-agent handoff helpers, and streaming
+  bridge. See [docs/integrations/openai-agents.md](docs/integrations/openai-agents.md).
+  ```bash
+  npm install @asap-protocol/openai-agents @asap-protocol/client @openai/agents zod
+  ```
+- **Examples**: `apps/example-mastra` and `apps/example-openai-agents` (Compliance
+  Harness v2 score 1.0 against the loopback provider).
+
+### Changed
+
+- **`@asap-protocol/client@2.3.1`**: Additive exports for adapter authors —
+  public `@asap-protocol/client/adapters/shared`, `jsonSchemaForCapabilityOutput`,
+  execution types, and envelope helpers. Non-breaking; existing `@2.3.0` consumers
+  remain compatible.
+- **CI security (`pip-audit`)**: Bumped transitive pins (`idna>=3.15`,
+  `markdown>=3.10.2`, `pymdown-extensions>=10.21.3`) and documented `--ignore-vuln`
+  flags for advisories with no PyPI fix yet (`PYSEC-2026-89`, `PYSEC-2025-183`,
+  `PYSEC-2024-271`). See [SECURITY.md](SECURITY.md).
+
+### Known limitations
+
+- Adapter packages peer on pre-1.0 framework releases (`@mastra/core@^1.5.0`,
+  `@openai/agents@^0.11.0`). Pin peers in production until those ecosystems
+  stabilize semver.
+
+### Migration
+
+- **v2.3.0 → v2.3.1**: Additive release — install new packages only if you adopt
+  Mastra or OpenAI Agents SDK integrations. See
+  [migration guide](docs/migration.md#upgrading-from-v230-to-v231).
+
+### Skipped (TS-only patch)
+
+- **Python PyPI / Docker**: No changes to `asap-protocol` Python core (`2.3.0`
+  remains current on PyPI). Tag `v2.3.1` ships npm adapters only; any Docker
+  image retagged by CI is unchanged bytecode — do not treat it as a Python upgrade.
+
+---
+
+## [2.3.0] - 2026-05-04
+
+**Adoption Multiplier** — OpenAPI-derived agents, first-class TypeScript, lean
+registry auto-registration, runtime capability escalation, and opt-in
+`WWW-Authenticate: ASAP` discovery challenges. Wire JSON-RPC and envelope
+schemas remain backward compatible with v2.2.x.
+
+### Added
+
+- **OpenAPI Adapter (Python)**: `asap.adapters.openapi.create_from_openapi` maps
+  OpenAPI 3.x operations to ASAP capabilities; optional `[openapi]` extra.
+  See [docs/adapters/openapi.md](docs/adapters/openapi.md).
+- **Official TypeScript client**: npm package `@asap-protocol/client` with
+  discovery, capability helpers, streaming consumer, and optional adapters for
+  Vercel AI SDK, OpenAI, and Anthropic (`packages/typescript/client/`).
+- **Auto-Registration**: `POST /registry/agents` for Compliance Harness–gated
+  Lite Registry submissions (optional `registry_auto_registration` on
+  `create_app`). See [docs/registry/auto-registration.md](docs/registry/auto-registration.md).
+- **Capability escalation**: `POST /asap/agent/request-capability` plus Python
+  `ASAPClient.request_capability` / TypeScript client support for approval
+  flows without re-registering the agent.
+- **ASAP HTTP challenge**: `WWW-Authenticate: ASAP` with `discovery=` manifest
+  URL on selected 401/403 responses; clients can record discovery metadata from
+  the challenge header.
+
+### Changed
+
+- **Reference server**: New optional routers and middleware wiring are
+  **opt-in** behind constructor flags — existing deployments keep v2.2.x
+  behavior until they enable OpenAPI surfaces, auto-registration, escalation
+  routes, or challenge middleware.
+
+### Security
+
+- **Dependency sweep (pre-tag)**: `uv run pip-audit --ignore-vuln CVE-2026-4539 --ignore-vuln CVE-2026-3219` (after `uv sync` per [SECURITY.md](SECURITY.md)) reported **no known vulnerabilities** (same ignores as CI). **`apps/web`**: `npm audit` (2026-05-04) still reports **moderate** `postcss` via `next@16.2.4` (GHSA-qx2v-qp2m-jg93); upstream fix may require a newer Next.js line — track before treating web audits as fully clean.
+
 ---
 
 ## [2.2.1] - 2026-04-21

{asap_protocol-2.2.1 → asap_protocol-2.4.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: asap-protocol
-Version: 2.2.1
+Version: 2.4.0
 Summary: Async Simple Agent Protocol - A streamlined protocol for agent-to-agent communication
 Project-URL: Homepage, https://github.com/adriannoes/asap-protocol
 Project-URL: Documentation, https://adriannoes.github.io/asap-protocol
@@ -24,7 +24,7 @@ Requires-Dist: aiosqlite>=0.20
 Requires-Dist: authlib<2,>=1.6.11
 Requires-Dist: brotli>=1.2.0
 Requires-Dist: cryptography<47,>=46.0.7
-Requires-Dist: fastapi>=0.128.0
+Requires-Dist: fastapi>=0.136.1
 Requires-Dist: httpx[http2]>=0.28.1
 Requires-Dist: jcs>=0.2.0
 Requires-Dist: joserfc<2,>=1.6.3
@@ -46,6 +46,7 @@ Requires-Dist: websockets>=12.0
 Provides-Extra: crewai
 Requires-Dist: crewai>=0.80; extra == 'crewai'
 Provides-Extra: dev
+Requires-Dist: asgi-lifespan>=2.1.0; extra == 'dev'
 Requires-Dist: brotli>=1.1.0; extra == 'dev'
 Requires-Dist: mypy>=1.19.1; extra == 'dev'
 Requires-Dist: pip-audit>=2.7; extra == 'dev'
@@ -62,13 +63,15 @@ Provides-Extra: docs
 Requires-Dist: ghp-import>=2.1.0; extra == 'docs'
 Requires-Dist: mkdocs-material>=9.5; extra == 'docs'
 Requires-Dist: mkdocstrings[python]>=0.27; extra == 'docs'
-Requires-Dist: pymdown-extensions>=10.21; extra == 'docs'
+Requires-Dist: pymdown-extensions>=10.21.3; extra == 'docs'
 Provides-Extra: langchain
-Requires-Dist: langchain-core>=0.2; extra == 'langchain'
+Requires-Dist: langchain-core>=1.3.3; extra == 'langchain'
 Provides-Extra: llamaindex
 Requires-Dist: llama-index-core>=0.10; extra == 'llamaindex'
 Provides-Extra: mcp
 Requires-Dist: mcp>=1.0.0; extra == 'mcp'
+Provides-Extra: openapi
+Requires-Dist: openapi-pydantic>=0.5; extra == 'openapi'
 Provides-Extra: openclaw
 Requires-Dist: openclaw-sdk>=2.0; extra == 'openclaw'
 Provides-Extra: pydanticai
@@ -76,7 +79,9 @@ Requires-Dist: pydantic-ai>=0.2; extra == 'pydanticai'
 Provides-Extra: redis
 Requires-Dist: redis>=5.0.0; extra == 'redis'
 Provides-Extra: smolagents
-Requires-Dist: smolagents>=1.0; extra == 'smolagents'
+Requires-Dist: smolagents>=1.24.0; extra == 'smolagents'
+Provides-Extra: telemetry
+Requires-Dist: pypistats>=1.11.0; extra == 'telemetry'
 Provides-Extra: webauthn
 Requires-Dist: webauthn<3,>=2.6; extra == 'webauthn'
 Description-Content-Type: text/markdown
@@ -90,9 +95,11 @@ Description-Content-Type: text/markdown
 
 > A production-ready protocol for agent-to-agent communication and task coordination.
 
-**Quick Info**: `v2.2.1` | `Apache 2.0` | `Python 3.13+` | [Documentation](https://github.com/adriannoes/asap-protocol/blob/main/docs/index.md) | [PyPI](https://pypi.org/project/asap-protocol/) | [Changelog](https://github.com/adriannoes/asap-protocol/blob/main/CHANGELOG.md)
+**Quick Info**: `v2.4.0` (PyPI) · **npm TS [`2.4.0`](https://github.com/adriannoes/asap-protocol/releases/tag/v2.4.0)** | `Apache 2.0` | `Python 3.13+` | [Documentation](https://github.com/adriannoes/asap-protocol/blob/main/docs/index.md) | **[PyPI `asap-protocol`](https://pypi.org/project/asap-protocol/)** | **[npm `@asap-protocol/client`](https://www.npmjs.com/package/@asap-protocol/client)** | [Changelog](https://github.com/adriannoes/asap-protocol/blob/main/CHANGELOG.md)
 
-> 🚀 **Live now** our [**agentic marketplace**](https://asap-protocol.vercel.app/) — browse agents, register yours, request verification.
+> 📦 Install the ASAP **Python SDK / protocol** from **`https://pypi.org/project/asap-protocol/`** — package name **`asap-protocol`** on [PyPI](https://pypi.org/project/asap-protocol/).
+
+> 🚀 **Live now** our [**agentic marketplace**](https://asap-protocol.com/) — browse agents, register yours, request verification.
 
 ## Why ASAP?
 
@@ -103,7 +110,7 @@ Building multi-agent systems today suffers from three core technical challenges
 
 **ASAP** provides a production-ready communication layer that simplifies these complexities. It's ideal for **multi-agent orchestration**, **stateful workflows** (persistence, resumability), **MCP support** and **production systems** requiring high-performance, type-safe agent communication. 
 
-For simple point-to-point communication, a basic HTTP API might suffice; ASAP shines when you need orchestration, state management and multi-agent coordination. See the [spec](https://github.com/adriannoes/asap-protocol/blob/main/.cursor/product-specs/strategy/v0-original-specs.md) for details.
+For simple point-to-point communication, a basic HTTP API might suffice; ASAP shines when you need orchestration, state management and multi-agent coordination. See the [documentation](https://github.com/adriannoes/asap-protocol/blob/main/docs/index.md) for the current protocol overview and features.
 
 ### Key Features
 
@@ -115,6 +122,9 @@ For simple point-to-point communication, a basic HTTP API might suffice; ASAP sh
 - **Security** — Bearer auth, OAuth2/JWT, Ed25519 signed manifests, optional mTLS, replay prevention, HTTPS, rate limiting. [Security Model](https://github.com/adriannoes/asap-protocol/blob/main/docs/security/v1.1-security-model.md) (trust limits, Custom Claims).
 - **Identity & capabilities (v2.2, WebAuthn real in v2.2.1)** — Per-runtime Host/Agent JWTs, capability grants with constraints (`max`, `min`, `in`, `not_in`), approval flows (device authorization / CIBA-style), real WebAuthn attestation/assertion for high-risk registration (opt-in via `asap-protocol[webauthn]`).
 - **Streaming & wire protocol (v2.2)** — `POST /asap/stream` (SSE / `TaskStream`), JSON-RPC 2.0 batch on `POST /asap`, `ASAP-Version` negotiation, tamper-evident audit logging, Compliance Harness v2.
+- **Adoption Multiplier (v2.3.0)** — OpenAPI → ASAP via `create_from_openapi` (`[openapi]` extra), official **`@asap-protocol/client`** on npm (Vercel AI / OpenAI / Anthropic adapters), optional **Auto-Registration** (`POST /registry/agents`), **capability escalation**, and **ASAP `WWW-Authenticate`** discovery challenges. All opt-in; wire protocol unchanged. See [docs/index.md](docs/index.md) and [docs/migration.md](docs/migration.md).
+- **Edge-AI discovery (v2.4.0)** — Optional `manifest.capabilities.hardware` + `inference`, Lite Registry mirror, marketplace browse filters, and `@asap-protocol/client@2.4.0` discovery types. Wire protocol unchanged. See [Migration (v2.3.x → v2.4.0)](docs/migration.md#upgrading-from-v23x-to-v240) and [ShellClaw registry guide](docs/guides/shellclaw-registry.md).
+- **Framework adapters (v2.3.1+, npm)** — **`@asap-protocol/mastra`** and **`@asap-protocol/openai-agents`** expose ASAP capabilities as Mastra tools and OpenAI Agents SDK `tool()` definitions. See [Migration (v2.3.0 → v2.3.1)](docs/migration.md#upgrading-from-v230-to-v231).
 - **Economics** — Usage metering, delegation tokens, SLA framework with breach alerts.
 
 ### 🆕 Framework Ecosystem
@@ -134,7 +144,19 @@ Or with pip:
 pip install asap-protocol
 ```
 
-📦 **Available on [PyPI](https://pypi.org/project/asap-protocol/)** — for reproducible environments, prefer `uv` when possible.
+**npm** (TypeScript / JavaScript — [`@asap-protocol/client`](https://www.npmjs.com/package/@asap-protocol/client), **`2.4.0`**). The `latest` dist-tag matches **`npm view @asap-protocol/client version`**.
+
+**npm** Mastra [**`@asap-protocol/mastra@2.4.0`**](https://www.npmjs.com/package/@asap-protocol/mastra) bridges ASAP capabilities onto **`@mastra/core`** tools; docs: [`docs/integrations/mastra.md`](docs/integrations/mastra.md), demo: [`apps/example-mastra/README.md`](apps/example-mastra/README.md).
+
+**npm** OpenAI Agents SDK [**`@asap-protocol/openai-agents@2.4.0`**](https://www.npmjs.com/package/@asap-protocol/openai-agents) exposes ASAP capabilities as **`@openai/agents`** `tool()` definitions — **not** the Chat Completions helper [`adapters/openai`](packages/typescript/client/src/adapters/openai.ts); docs: [`docs/integrations/openai-agents.md`](docs/integrations/openai-agents.md), demo: [`apps/example-openai-agents/README.md`](apps/example-openai-agents/README.md).
+
+```bash
+npm install @asap-protocol/client@2.4.0
+npm install @asap-protocol/mastra@2.4.0 @asap-protocol/client @mastra/core zod
+npm install @asap-protocol/openai-agents@2.4.0 @asap-protocol/client @openai/agents zod
+```
+
+📦 **Canonical listing:** **[https://pypi.org/project/asap-protocol/](https://pypi.org/project/asap-protocol/)** — package **`asap-protocol`** (`pip install asap-protocol`). Prefer `uv` for reproducible environments when possible.
 
 ## Quick Start
 
@@ -177,6 +199,7 @@ See [Compliance Testing Guide](https://github.com/adriannoes/asap-protocol/blob/
 
 **Learn**
 - [Docs](https://github.com/adriannoes/asap-protocol/blob/main/docs/index.md) | [API Reference](https://github.com/adriannoes/asap-protocol/blob/main/docs/api-reference.md)
+- [TypeScript client SDK](https://github.com/adriannoes/asap-protocol/blob/main/docs/sdks/typescript.md) — `@asap-protocol/client` (identity, capabilities, streaming, adapters)
 - [Tutorials](https://github.com/adriannoes/asap-protocol/tree/main/docs/tutorials) — First agent to production checklist
 - [Migration from A2A/MCP](https://github.com/adriannoes/asap-protocol/blob/main/docs/migration.md)
 - [Raw Fetch (non-Python)](https://github.com/adriannoes/asap-protocol/blob/main/docs/raw-fetch.md) — Fetch registry.json and revoked_agents.json with curl/fetch; implement your own client.
@@ -189,11 +212,11 @@ See [Compliance Testing Guide](https://github.com/adriannoes/asap-protocol/blob/
 
 **Decisions & Operations**
 - [ADRs](https://github.com/adriannoes/asap-protocol/tree/main/docs/adr) — 19 Architecture Decision Records
-- [Tech Stack](https://github.com/adriannoes/asap-protocol/blob/main/.cursor/dev-planning/architecture/tech-stack-decisions.md) — Rationale for Python, Pydantic, Next.js choices
+- [Tech Stack](https://github.com/adriannoes/asap-protocol/blob/main/engineering/architecture/tech-stack-decisions.md) — Rationale for Python, Pydantic, Next.js choices
 - [Deployment](https://github.com/adriannoes/asap-protocol/blob/main/docs/deployment/kubernetes.md) | [Troubleshooting](https://github.com/adriannoes/asap-protocol/blob/main/docs/troubleshooting.md)
 
 **Release**
-- [Changelog](https://github.com/adriannoes/asap-protocol/blob/main/CHANGELOG.md) | [PyPI](https://pypi.org/project/asap-protocol/)
+- [Changelog](https://github.com/adriannoes/asap-protocol/blob/main/CHANGELOG.md) | **[PyPI listing](https://pypi.org/project/asap-protocol/)** — `https://pypi.org/project/asap-protocol/` (install: `pip install asap-protocol`)
 
 ## CLI
 
@@ -213,20 +236,25 @@ See the [CLI reference](docs/cli.md) for `compliance-check` and `audit export` f
 
 ## Version History
 
-- **v1.1** adds OAuth2, WebSocket, Discovery (well-known + Lite Registry), State Storage (SQLite) and Webhooks.
-- **v1.2** adds Ed25519 signed manifests, trust levels, optional mTLS and the [Compliance Harness](https://github.com/adriannoes/asap-protocol/blob/main/asap-compliance/README.md).
-- **v1.3** adds delegation commands (`asap delegation create`, `asap delegation revoke`).
-- **v2.0** adds the Lean Marketplace Web App (Next.js), Lite Registry on GitHub Pages, IssueOps registration, OAuth sign-in for developers, and Verified Badge flow.
-- **v2.1** adds the Consumer SDK (`MarketClient`), optional framework extras (LangChain, CrewAI, LlamaIndex, SmolAgents, OpenClaw, …), and registry UX improvements on PyPI.
-- **v2.1.1** is a patch release: JWT algorithm allowlist, SQLite async bridging, optional Redis-backed rate limits, SSRF hardening in the web app, and related reliability fixes (see [Changelog](https://github.com/adriannoes/asap-protocol/blob/main/CHANGELOG.md)).
-- **v2.2** adds per-runtime agent identity, capability-based authorization, SSE streaming (`POST /asap/stream`), `ASAP-Version` negotiation, JSON-RPC batch requests, tamper-evident audit logging, async state stores, and Compliance Harness v2.
-- **v2.2.1** closes the SELF-002 follow-up with **real WebAuthn** attestation/assertion via the opt-in `asap-protocol[webauthn]` extra, ships the `asap compliance-check` and `asap audit export` CLIs, promotes the client SDK `ResolvedAgent.run()` to a typed contract (raises `TypeError` on protocol violation), introduces the `asap.economics.audit.AuditChainBroken` exception for scripted tamper handling, and pins upper bounds on security-sensitive deps (`cryptography`, `authlib`, `joserfc`, `pyjwt`, `webauthn`, `pydantic`) — see [dependency policy](https://github.com/adriannoes/asap-protocol/blob/main/SECURITY.md#dependency-policy) and full notes in the [Changelog](https://github.com/adriannoes/asap-protocol/blob/main/CHANGELOG.md).
-
-For a structured index of per-version features, see the [docs index](https://github.com/adriannoes/asap-protocol/blob/main/docs/index.md#v11-features-api-reference--guides).
+High-level only — see **[Changelog](https://github.com/adriannoes/asap-protocol/blob/main/CHANGELOG.md)** and the **[docs index](https://github.com/adriannoes/asap-protocol/blob/main/docs/index.md#v11-features-api-reference--guides)** for full notes.
+
+| Version | What shipped |
+| :-- | :-- |
+| **v2.4.0** | **Edge-AI discovery** — **[GitHub Release `v2.4.0`](https://github.com/adriannoes/asap-protocol/releases/tag/v2.4.0)** · optional `hardware` / `inference` manifest fields, registry mirror, marketplace filters, **`@asap-protocol/client@2.4.0`**, ShellClaw onboarding docs. See [CHANGELOG](https://github.com/adriannoes/asap-protocol/blob/main/CHANGELOG.md#240---2026-05-24) and [Migration (v2.3.x → v2.4.0)](https://github.com/adriannoes/asap-protocol/blob/main/docs/migration.md#upgrading-from-v23x-to-v240) |
+| **v2.3.1** | **npm TS patch** — **[GitHub Release `v2.3.1`](https://github.com/adriannoes/asap-protocol/releases/tag/v2.3.1)** · **`@asap-protocol/mastra`**, **`@asap-protocol/openai-agents`**, **`@asap-protocol/client@2.3.1`** (additive adapter exports). Python **2.3.0** unchanged. See [CHANGELOG](https://github.com/adriannoes/asap-protocol/blob/main/CHANGELOG.md#231---2026-05-20) and [Migration (v2.3.0 → v2.3.1)](https://github.com/adriannoes/asap-protocol/blob/main/docs/migration.md#upgrading-from-v230-to-v231) |
+| **v2.3.0** | **OpenAPI Adapter** (`[openapi]`) · **TypeScript client** (`@asap-protocol/client`) · **Auto-Registration** · **Capability escalation** · **ASAP HTTP challenge** — see [CHANGELOG](https://github.com/adriannoes/asap-protocol/blob/main/CHANGELOG.md#230---2026-05-04) and [Migration](https://github.com/adriannoes/asap-protocol/blob/main/docs/migration.md#upgrading-from-v22x-to-v230) |
+| **v2.2.1** | Opt-in **WebAuthn** (`asap-protocol[webauthn]`) · `asap compliance-check` & `asap audit export` · stricter `ResolvedAgent.run()` · `AuditChainBroken` · [pinned security deps](https://github.com/adriannoes/asap-protocol/blob/main/SECURITY.md#dependency-policy) |
+| **v2.2** | Per-runtime identity & capability auth · SSE `POST /asap/stream` · `ASAP-Version` · JSON-RPC batch · tamper-evident audit · async state stores · Compliance Harness v2 |
+| **v2.1.1** | Patch: JWT allowlist · SQLite async bridge · optional Redis rate limits · web SSRF hardening |
+| **v2.1** | `MarketClient` · framework extras (LangChain, CrewAI, LlamaIndex, …) · registry UX |
+| **v2.0** | Marketplace web app · Lite Registry (GitHub Pages) · IssueOps · OAuth · verification flow |
+| **v1.3** | `asap delegation create` / `revoke` |
+| **v1.2** | Ed25519 manifests · trust levels · optional mTLS · [Compliance Harness](https://github.com/adriannoes/asap-protocol/blob/main/asap-compliance/README.md) |
+| **v1.1** | OAuth2 · WebSocket · discovery (well-known + Lite Registry) · SQLite state · webhooks |
 
 ## 🔭 What's Next?
 
-ASAP is evolving toward an **Agent Marketplace** — an open ecosystem where AI agents discover, trust and collaborate autonomously. See our [vision document](https://github.com/adriannoes/asap-protocol/blob/main/.cursor/product-specs/strategy/vision-agent-marketplace.md) for the full roadmap.
+ASAP is evolving toward an **Agent Marketplace** — an open ecosystem where AI agents discover, trust and collaborate autonomously. See the [ADR index](https://github.com/adriannoes/asap-protocol/blob/main/product/decision-records/README.md) and [v2.0 roadmap PRD](https://github.com/adriannoes/asap-protocol/blob/main/product/prd/prd-v2.0-roadmap.md). Detailed long-term strategy narratives are maintained privately (not shipped in this repository).
 
 ## Contributing
 
@@ -236,10 +264,22 @@ Every contribution, from bug reports to feature suggestions, documentation impro
 
 Check out our [contributing guidelines](https://github.com/adriannoes/asap-protocol/blob/main/CONTRIBUTING.md) to get started. It's easier than you think! 🚀
 
+## Contact
+
+For **general questions** about the protocol, the marketplace, partnerships, or press (not security vulnerabilities — use [SECURITY.md](https://github.com/adriannoes/asap-protocol/blob/main/SECURITY.md) for those):
+
+- **Email:** [info@asap-protocol.com](mailto:info@asap-protocol.com)
+
+You can also use [GitHub Discussions](https://github.com/adriannoes/asap-protocol/discussions) or [Issues](https://github.com/adriannoes/asap-protocol/issues) for public project topics.
+
+## Privacy
+
+See [PRIVACY.md](PRIVACY.md) for how the public site and maintainer telemetry use aggregate metrics (including Vercel Web Analytics) without collecting agent IDs or end-user PII in repository outputs.
+
 ## License
 
 This project is licensed under the Apache 2.0 License - see the [license](https://github.com/adriannoes/asap-protocol/blob/main/LICENSE) file for details.
 
 ---
 
-**Built with [Cursor](https://cursor.com/) and [Claude Code](https://claude.com/claude-code)** — primarily Claude Opus 4.7 (1M context) with Cursor Composer 1.5, Gemini 3.1 Pro, and Kimi K2.5 as collaborators.
+**Built with [Cursor](https://cursor.com/)** using Opus 4.6/4.7, Composer 1.5/2.0, Gemini 3.1 Pro and Kimi K2.5.

{asap_protocol-2.2.1 → asap_protocol-2.4.0}/README.md

@@ -7,9 +7,11 @@
 
 > A production-ready protocol for agent-to-agent communication and task coordination.
 
-**Quick Info**: `v2.2.1` | `Apache 2.0` | `Python 3.13+` | [Documentation](https://github.com/adriannoes/asap-protocol/blob/main/docs/index.md) | [PyPI](https://pypi.org/project/asap-protocol/) | [Changelog](https://github.com/adriannoes/asap-protocol/blob/main/CHANGELOG.md)
+**Quick Info**: `v2.4.0` (PyPI) · **npm TS [`2.4.0`](https://github.com/adriannoes/asap-protocol/releases/tag/v2.4.0)** | `Apache 2.0` | `Python 3.13+` | [Documentation](https://github.com/adriannoes/asap-protocol/blob/main/docs/index.md) | **[PyPI `asap-protocol`](https://pypi.org/project/asap-protocol/)** | **[npm `@asap-protocol/client`](https://www.npmjs.com/package/@asap-protocol/client)** | [Changelog](https://github.com/adriannoes/asap-protocol/blob/main/CHANGELOG.md)
 
-> 🚀 **Live now** our [**agentic marketplace**](https://asap-protocol.vercel.app/) — browse agents, register yours, request verification.
+> 📦 Install the ASAP **Python SDK / protocol** from **`https://pypi.org/project/asap-protocol/`** — package name **`asap-protocol`** on [PyPI](https://pypi.org/project/asap-protocol/).
+
+> 🚀 **Live now** our [**agentic marketplace**](https://asap-protocol.com/) — browse agents, register yours, request verification.
 
 ## Why ASAP?
 
@@ -20,7 +22,7 @@ Building multi-agent systems today suffers from three core technical challenges
 
 **ASAP** provides a production-ready communication layer that simplifies these complexities. It's ideal for **multi-agent orchestration**, **stateful workflows** (persistence, resumability), **MCP support** and **production systems** requiring high-performance, type-safe agent communication. 
 
-For simple point-to-point communication, a basic HTTP API might suffice; ASAP shines when you need orchestration, state management and multi-agent coordination. See the [spec](https://github.com/adriannoes/asap-protocol/blob/main/.cursor/product-specs/strategy/v0-original-specs.md) for details.
+For simple point-to-point communication, a basic HTTP API might suffice; ASAP shines when you need orchestration, state management and multi-agent coordination. See the [documentation](https://github.com/adriannoes/asap-protocol/blob/main/docs/index.md) for the current protocol overview and features.
 
 ### Key Features
 
@@ -32,6 +34,9 @@ For simple point-to-point communication, a basic HTTP API might suffice; ASAP sh
 - **Security** — Bearer auth, OAuth2/JWT, Ed25519 signed manifests, optional mTLS, replay prevention, HTTPS, rate limiting. [Security Model](https://github.com/adriannoes/asap-protocol/blob/main/docs/security/v1.1-security-model.md) (trust limits, Custom Claims).
 - **Identity & capabilities (v2.2, WebAuthn real in v2.2.1)** — Per-runtime Host/Agent JWTs, capability grants with constraints (`max`, `min`, `in`, `not_in`), approval flows (device authorization / CIBA-style), real WebAuthn attestation/assertion for high-risk registration (opt-in via `asap-protocol[webauthn]`).
 - **Streaming & wire protocol (v2.2)** — `POST /asap/stream` (SSE / `TaskStream`), JSON-RPC 2.0 batch on `POST /asap`, `ASAP-Version` negotiation, tamper-evident audit logging, Compliance Harness v2.
+- **Adoption Multiplier (v2.3.0)** — OpenAPI → ASAP via `create_from_openapi` (`[openapi]` extra), official **`@asap-protocol/client`** on npm (Vercel AI / OpenAI / Anthropic adapters), optional **Auto-Registration** (`POST /registry/agents`), **capability escalation**, and **ASAP `WWW-Authenticate`** discovery challenges. All opt-in; wire protocol unchanged. See [docs/index.md](docs/index.md) and [docs/migration.md](docs/migration.md).
+- **Edge-AI discovery (v2.4.0)** — Optional `manifest.capabilities.hardware` + `inference`, Lite Registry mirror, marketplace browse filters, and `@asap-protocol/client@2.4.0` discovery types. Wire protocol unchanged. See [Migration (v2.3.x → v2.4.0)](docs/migration.md#upgrading-from-v23x-to-v240) and [ShellClaw registry guide](docs/guides/shellclaw-registry.md).
+- **Framework adapters (v2.3.1+, npm)** — **`@asap-protocol/mastra`** and **`@asap-protocol/openai-agents`** expose ASAP capabilities as Mastra tools and OpenAI Agents SDK `tool()` definitions. See [Migration (v2.3.0 → v2.3.1)](docs/migration.md#upgrading-from-v230-to-v231).
 - **Economics** — Usage metering, delegation tokens, SLA framework with breach alerts.
 
 ### 🆕 Framework Ecosystem
@@ -51,7 +56,19 @@ Or with pip:
 pip install asap-protocol
 ```
 
-📦 **Available on [PyPI](https://pypi.org/project/asap-protocol/)** — for reproducible environments, prefer `uv` when possible.
+**npm** (TypeScript / JavaScript — [`@asap-protocol/client`](https://www.npmjs.com/package/@asap-protocol/client), **`2.4.0`**). The `latest` dist-tag matches **`npm view @asap-protocol/client version`**.
+
+**npm** Mastra [**`@asap-protocol/mastra@2.4.0`**](https://www.npmjs.com/package/@asap-protocol/mastra) bridges ASAP capabilities onto **`@mastra/core`** tools; docs: [`docs/integrations/mastra.md`](docs/integrations/mastra.md), demo: [`apps/example-mastra/README.md`](apps/example-mastra/README.md).
+
+**npm** OpenAI Agents SDK [**`@asap-protocol/openai-agents@2.4.0`**](https://www.npmjs.com/package/@asap-protocol/openai-agents) exposes ASAP capabilities as **`@openai/agents`** `tool()` definitions — **not** the Chat Completions helper [`adapters/openai`](packages/typescript/client/src/adapters/openai.ts); docs: [`docs/integrations/openai-agents.md`](docs/integrations/openai-agents.md), demo: [`apps/example-openai-agents/README.md`](apps/example-openai-agents/README.md).
+
+```bash
+npm install @asap-protocol/client@2.4.0
+npm install @asap-protocol/mastra@2.4.0 @asap-protocol/client @mastra/core zod
+npm install @asap-protocol/openai-agents@2.4.0 @asap-protocol/client @openai/agents zod
+```
+
+📦 **Canonical listing:** **[https://pypi.org/project/asap-protocol/](https://pypi.org/project/asap-protocol/)** — package **`asap-protocol`** (`pip install asap-protocol`). Prefer `uv` for reproducible environments when possible.
 
 ## Quick Start
 
@@ -94,6 +111,7 @@ See [Compliance Testing Guide](https://github.com/adriannoes/asap-protocol/blob/
 
 **Learn**
 - [Docs](https://github.com/adriannoes/asap-protocol/blob/main/docs/index.md) | [API Reference](https://github.com/adriannoes/asap-protocol/blob/main/docs/api-reference.md)
+- [TypeScript client SDK](https://github.com/adriannoes/asap-protocol/blob/main/docs/sdks/typescript.md) — `@asap-protocol/client` (identity, capabilities, streaming, adapters)
 - [Tutorials](https://github.com/adriannoes/asap-protocol/tree/main/docs/tutorials) — First agent to production checklist
 - [Migration from A2A/MCP](https://github.com/adriannoes/asap-protocol/blob/main/docs/migration.md)
 - [Raw Fetch (non-Python)](https://github.com/adriannoes/asap-protocol/blob/main/docs/raw-fetch.md) — Fetch registry.json and revoked_agents.json with curl/fetch; implement your own client.
@@ -106,11 +124,11 @@ See [Compliance Testing Guide](https://github.com/adriannoes/asap-protocol/blob/
 
 **Decisions & Operations**
 - [ADRs](https://github.com/adriannoes/asap-protocol/tree/main/docs/adr) — 19 Architecture Decision Records
-- [Tech Stack](https://github.com/adriannoes/asap-protocol/blob/main/.cursor/dev-planning/architecture/tech-stack-decisions.md) — Rationale for Python, Pydantic, Next.js choices
+- [Tech Stack](https://github.com/adriannoes/asap-protocol/blob/main/engineering/architecture/tech-stack-decisions.md) — Rationale for Python, Pydantic, Next.js choices
 - [Deployment](https://github.com/adriannoes/asap-protocol/blob/main/docs/deployment/kubernetes.md) | [Troubleshooting](https://github.com/adriannoes/asap-protocol/blob/main/docs/troubleshooting.md)
 
 **Release**
-- [Changelog](https://github.com/adriannoes/asap-protocol/blob/main/CHANGELOG.md) | [PyPI](https://pypi.org/project/asap-protocol/)
+- [Changelog](https://github.com/adriannoes/asap-protocol/blob/main/CHANGELOG.md) | **[PyPI listing](https://pypi.org/project/asap-protocol/)** — `https://pypi.org/project/asap-protocol/` (install: `pip install asap-protocol`)
 
 ## CLI
 
@@ -130,20 +148,25 @@ See the [CLI reference](docs/cli.md) for `compliance-check` and `audit export` f
 
 ## Version History
 
-- **v1.1** adds OAuth2, WebSocket, Discovery (well-known + Lite Registry), State Storage (SQLite) and Webhooks.
-- **v1.2** adds Ed25519 signed manifests, trust levels, optional mTLS and the [Compliance Harness](https://github.com/adriannoes/asap-protocol/blob/main/asap-compliance/README.md).
-- **v1.3** adds delegation commands (`asap delegation create`, `asap delegation revoke`).
-- **v2.0** adds the Lean Marketplace Web App (Next.js), Lite Registry on GitHub Pages, IssueOps registration, OAuth sign-in for developers, and Verified Badge flow.
-- **v2.1** adds the Consumer SDK (`MarketClient`), optional framework extras (LangChain, CrewAI, LlamaIndex, SmolAgents, OpenClaw, …), and registry UX improvements on PyPI.
-- **v2.1.1** is a patch release: JWT algorithm allowlist, SQLite async bridging, optional Redis-backed rate limits, SSRF hardening in the web app, and related reliability fixes (see [Changelog](https://github.com/adriannoes/asap-protocol/blob/main/CHANGELOG.md)).
-- **v2.2** adds per-runtime agent identity, capability-based authorization, SSE streaming (`POST /asap/stream`), `ASAP-Version` negotiation, JSON-RPC batch requests, tamper-evident audit logging, async state stores, and Compliance Harness v2.
-- **v2.2.1** closes the SELF-002 follow-up with **real WebAuthn** attestation/assertion via the opt-in `asap-protocol[webauthn]` extra, ships the `asap compliance-check` and `asap audit export` CLIs, promotes the client SDK `ResolvedAgent.run()` to a typed contract (raises `TypeError` on protocol violation), introduces the `asap.economics.audit.AuditChainBroken` exception for scripted tamper handling, and pins upper bounds on security-sensitive deps (`cryptography`, `authlib`, `joserfc`, `pyjwt`, `webauthn`, `pydantic`) — see [dependency policy](https://github.com/adriannoes/asap-protocol/blob/main/SECURITY.md#dependency-policy) and full notes in the [Changelog](https://github.com/adriannoes/asap-protocol/blob/main/CHANGELOG.md).
-
-For a structured index of per-version features, see the [docs index](https://github.com/adriannoes/asap-protocol/blob/main/docs/index.md#v11-features-api-reference--guides).
+High-level only — see **[Changelog](https://github.com/adriannoes/asap-protocol/blob/main/CHANGELOG.md)** and the **[docs index](https://github.com/adriannoes/asap-protocol/blob/main/docs/index.md#v11-features-api-reference--guides)** for full notes.
+
+| Version | What shipped |
+| :-- | :-- |
+| **v2.4.0** | **Edge-AI discovery** — **[GitHub Release `v2.4.0`](https://github.com/adriannoes/asap-protocol/releases/tag/v2.4.0)** · optional `hardware` / `inference` manifest fields, registry mirror, marketplace filters, **`@asap-protocol/client@2.4.0`**, ShellClaw onboarding docs. See [CHANGELOG](https://github.com/adriannoes/asap-protocol/blob/main/CHANGELOG.md#240---2026-05-24) and [Migration (v2.3.x → v2.4.0)](https://github.com/adriannoes/asap-protocol/blob/main/docs/migration.md#upgrading-from-v23x-to-v240) |
+| **v2.3.1** | **npm TS patch** — **[GitHub Release `v2.3.1`](https://github.com/adriannoes/asap-protocol/releases/tag/v2.3.1)** · **`@asap-protocol/mastra`**, **`@asap-protocol/openai-agents`**, **`@asap-protocol/client@2.3.1`** (additive adapter exports). Python **2.3.0** unchanged. See [CHANGELOG](https://github.com/adriannoes/asap-protocol/blob/main/CHANGELOG.md#231---2026-05-20) and [Migration (v2.3.0 → v2.3.1)](https://github.com/adriannoes/asap-protocol/blob/main/docs/migration.md#upgrading-from-v230-to-v231) |
+| **v2.3.0** | **OpenAPI Adapter** (`[openapi]`) · **TypeScript client** (`@asap-protocol/client`) · **Auto-Registration** · **Capability escalation** · **ASAP HTTP challenge** — see [CHANGELOG](https://github.com/adriannoes/asap-protocol/blob/main/CHANGELOG.md#230---2026-05-04) and [Migration](https://github.com/adriannoes/asap-protocol/blob/main/docs/migration.md#upgrading-from-v22x-to-v230) |
+| **v2.2.1** | Opt-in **WebAuthn** (`asap-protocol[webauthn]`) · `asap compliance-check` & `asap audit export` · stricter `ResolvedAgent.run()` · `AuditChainBroken` · [pinned security deps](https://github.com/adriannoes/asap-protocol/blob/main/SECURITY.md#dependency-policy) |
+| **v2.2** | Per-runtime identity & capability auth · SSE `POST /asap/stream` · `ASAP-Version` · JSON-RPC batch · tamper-evident audit · async state stores · Compliance Harness v2 |
+| **v2.1.1** | Patch: JWT allowlist · SQLite async bridge · optional Redis rate limits · web SSRF hardening |
+| **v2.1** | `MarketClient` · framework extras (LangChain, CrewAI, LlamaIndex, …) · registry UX |
+| **v2.0** | Marketplace web app · Lite Registry (GitHub Pages) · IssueOps · OAuth · verification flow |
+| **v1.3** | `asap delegation create` / `revoke` |
+| **v1.2** | Ed25519 manifests · trust levels · optional mTLS · [Compliance Harness](https://github.com/adriannoes/asap-protocol/blob/main/asap-compliance/README.md) |
+| **v1.1** | OAuth2 · WebSocket · discovery (well-known + Lite Registry) · SQLite state · webhooks |
 
 ## 🔭 What's Next?
 
-ASAP is evolving toward an **Agent Marketplace** — an open ecosystem where AI agents discover, trust and collaborate autonomously. See our [vision document](https://github.com/adriannoes/asap-protocol/blob/main/.cursor/product-specs/strategy/vision-agent-marketplace.md) for the full roadmap.
+ASAP is evolving toward an **Agent Marketplace** — an open ecosystem where AI agents discover, trust and collaborate autonomously. See the [ADR index](https://github.com/adriannoes/asap-protocol/blob/main/product/decision-records/README.md) and [v2.0 roadmap PRD](https://github.com/adriannoes/asap-protocol/blob/main/product/prd/prd-v2.0-roadmap.md). Detailed long-term strategy narratives are maintained privately (not shipped in this repository).
 
 ## Contributing
 
@@ -153,10 +176,22 @@ Every contribution, from bug reports to feature suggestions, documentation impro
 
 Check out our [contributing guidelines](https://github.com/adriannoes/asap-protocol/blob/main/CONTRIBUTING.md) to get started. It's easier than you think! 🚀
 
+## Contact
+
+For **general questions** about the protocol, the marketplace, partnerships, or press (not security vulnerabilities — use [SECURITY.md](https://github.com/adriannoes/asap-protocol/blob/main/SECURITY.md) for those):
+
+- **Email:** [info@asap-protocol.com](mailto:info@asap-protocol.com)
+
+You can also use [GitHub Discussions](https://github.com/adriannoes/asap-protocol/discussions) or [Issues](https://github.com/adriannoes/asap-protocol/issues) for public project topics.
+
+## Privacy
+
+See [PRIVACY.md](PRIVACY.md) for how the public site and maintainer telemetry use aggregate metrics (including Vercel Web Analytics) without collecting agent IDs or end-user PII in repository outputs.
+
 ## License
 
 This project is licensed under the Apache 2.0 License - see the [license](https://github.com/adriannoes/asap-protocol/blob/main/LICENSE) file for details.
 
 ---
 
-**Built with [Cursor](https://cursor.com/) and [Claude Code](https://claude.com/claude-code)** — primarily Claude Opus 4.7 (1M context) with Cursor Composer 1.5, Gemini 3.1 Pro, and Kimi K2.5 as collaborators.
+**Built with [Cursor](https://cursor.com/)** using Opus 4.6/4.7, Composer 1.5/2.0, Gemini 3.1 Pro and Kimi K2.5.