create-aimarket-agent 0.1.0__py3-none-any.whl

create_aimarket_agent/__init__.py

@@ -0,0 +1,4 @@
+"""AIMarket agent project scaffolder."""
+
+__version__ = "0.1.0"
+

create_aimarket_agent/cli.py

@@ -0,0 +1,99 @@
+from __future__ import annotations
+
+import argparse
+import re
+import shutil
+import sys
+import tempfile
+from importlib.resources import files
+from pathlib import Path
+
+KINDS = ("tool", "data-provider", "orchestrator")
+_SAFE_NAME = re.compile(r"^[A-Za-z0-9][A-Za-z0-9 ._-]{0,63}$")
+
+
+def slug(value: str) -> str:
+    clean = re.sub(r"[^a-z0-9]+", "-", value.strip().lower()).strip("-")
+    if not clean:
+        raise ValueError("project name must contain a letter or digit")
+    return clean
+
+
+def validate_name(value: str) -> str:
+    value = value.strip()
+    if not _SAFE_NAME.fullmatch(value):
+        raise ValueError(
+            "project name must be 1-64 characters and contain only letters, digits, spaces, dots, dashes, or underscores"
+        )
+    return value
+
+
+def scaffold(target: Path, *, name: str, kind: str, metis: bool) -> Path:
+    name = validate_name(name)
+    if kind not in KINDS:
+        raise ValueError(f"kind must be one of: {', '.join(KINDS)}")
+    target = target.resolve()
+    if target.exists():
+        raise FileExistsError(f"target already exists: {target}")
+    template = files("create_aimarket_agent").joinpath("templates/base")
+    target.parent.mkdir(parents=True, exist_ok=True)
+    stage_root = Path(tempfile.mkdtemp(prefix=f".{target.name}.tmp-", dir=target.parent))
+    staged = stage_root / target.name
+    replacements = {
+        "__PROJECT_NAME__": name,
+        "__PROJECT_SLUG__": slug(name),
+        "__AGENT_KIND__": kind,
+        "__METIS_ENABLED__": "true" if metis else "false",
+        "__METIS_PYTHON__": "True" if metis else "False",
+    }
+    try:
+        shutil.copytree(
+            str(template),
+            staged,
+            ignore=shutil.ignore_patterns("__pycache__", "*.pyc", "*.pyo"),
+        )
+        for path in staged.rglob("*"):
+            if path.is_file():
+                text = path.read_text(encoding="utf-8")
+                for old, new in replacements.items():
+                    text = text.replace(old, new)
+                path.write_text(text, encoding="utf-8")
+        if target.exists():
+            raise FileExistsError(f"target appeared while scaffolding: {target}")
+        staged.rename(target)
+    finally:
+        shutil.rmtree(stage_root, ignore_errors=True)
+    return target
+
+
+def parser() -> argparse.ArgumentParser:
+    p = argparse.ArgumentParser(prog="create-aimarket-agent")
+    p.add_argument("name", nargs="?", help="project name")
+    p.add_argument("--kind", choices=KINDS, default="tool")
+    p.add_argument("--metis", action=argparse.BooleanOptionalAction, default=True)
+    p.add_argument("--directory", type=Path, help="output directory")
+    return p
+
+
+def main(argv: list[str] | None = None) -> int:
+    args = parser().parse_args(argv)
+    name = args.name
+    if not name and sys.stdin.isatty():
+        name = input("Agent name: ").strip()
+    if not name:
+        parser().error("name is required")
+    try:
+        name = validate_name(name)
+        target = args.directory or Path.cwd() / slug(name)
+        scaffold(target, name=name, kind=args.kind, metis=args.metis)
+    except (ValueError, FileExistsError, OSError) as exc:
+        print(f"error: {exc}", file=sys.stderr)
+        return 2
+    print(f"Created {name} in {target}")
+    print(f"Next: cd {target} && uv sync --extra dev")
+    print("Then: uv run python configure_provider.py && uv run pytest && uv run python agent.py")
+    return 0
+
+
+if __name__ == "__main__":
+    raise SystemExit(main())

create_aimarket_agent/templates/base/.dockerignore

@@ -0,0 +1,11 @@
+.env
+.git
+.github
+.aimarket
+.venv
+__pycache__
+.pytest_cache
+.coverage
+build
+dist
+*.egg-info

create_aimarket_agent/templates/base/.env.example

@@ -0,0 +1,4 @@
+PORT=8080
+AIMARKET_HUB_URL=https://modelmarket.dev
+AIMARKET_METIS_URL=https://metis.modelmarket.dev
+AIMARKET_PROVIDER_KEY_FILE=.aimarket/provider.key

create_aimarket_agent/templates/base/.github/workflows/test.yml

@@ -0,0 +1,18 @@
+name: test
+on: [push, pull_request]
+permissions:
+  contents: read
+jobs:
+  test:
+    runs-on: ubuntu-latest
+    timeout-minutes: 10
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          persist-credentials: false
+      - uses: actions/setup-python@v5
+        with: {python-version: "3.12"}
+      - run: pip install -e '.[dev]'
+      - run: python configure_provider.py
+      - run: pytest -q
+      - run: python validate_manifest.py

create_aimarket_agent/templates/base/.gitignore

@@ -0,0 +1,5 @@
+.env
+.venv/
+__pycache__/
+.pytest_cache/
+.aimarket/

create_aimarket_agent/templates/base/Dockerfile

@@ -0,0 +1,15 @@
+FROM python:3.12-slim
+WORKDIR /app
+COPY . .
+RUN pip install --no-cache-dir .
+RUN mkdir -p /data && chown 65532:65532 /data
+ENV HOST=0.0.0.0 \
+    AIMARKET_PROVIDER_IDENTITY_FILE=/data/provider.key \
+    PYTHONDONTWRITEBYTECODE=1 \
+    PYTHONUNBUFFERED=1
+USER 65532:65532
+VOLUME ["/data"]
+EXPOSE 8080
+HEALTHCHECK --interval=30s --timeout=5s --start-period=10s --retries=3 \
+  CMD python -c "import urllib.request; urllib.request.urlopen('http://127.0.0.1:8080/health', timeout=3).read()"
+CMD ["python", "agent.py"]

create_aimarket_agent/templates/base/Makefile

@@ -0,0 +1,16 @@
+.PHONY: configure dev test validate publish-dry-run
+
+configure:
+	uv run python configure_provider.py
+
+dev: configure
+	uv run python agent.py
+
+test:
+	uv run pytest -q
+
+validate: configure
+	uv run python validate_manifest.py
+
+publish-dry-run: validate
+	@echo "Dry run only: aimarket publish capability.json --hub $${AIMARKET_HUB_URL:-http://127.0.0.1:9083}"

create_aimarket_agent/templates/base/README.md

@@ -0,0 +1,27 @@
+# __PROJECT_NAME__
+
+Generated AIMarket Protocol v2 `__AGENT_KIND__` provider.
+
+```bash
+uv sync --extra dev
+uv run python configure_provider.py
+uv run pytest
+uv run python agent.py
+make validate
+make publish-dry-run
+```
+
+Validate `capability.json`, then publish deliberately with the AIMarket Hub CLI. Never commit `.env`.
+
+The Ed25519 provider key lives in `.aimarket/provider.key` and is gitignored. Back it up: changing
+it after publish invalidates the `provider_pubkey` registered with the Hub. The provider accepts
+only the `product_id` and `capability_id` declared in `capability.json`; never replace that check
+with caller-selected signing identity. The validator rejects ambiguous JSON, malformed Ed25519
+keys, non-finite prices, and public HTTP invoke URLs.
+
+The Dockerfile is a development image; mount the same key as a secret before containerizing a
+published provider. Keep the container port private until an HTTPS ingress adds production traffic,
+concurrency, and rate limits. The generated endpoint authenticates its output with a signature; it
+does not authenticate or bill clients that bypass Hub.
+Responses use the replay-resistant AIMarket request-bound signature, covering the capability,
+product, SHA-256 of the exact input, and result. Keep those request fields when extending `agent.py`.

create_aimarket_agent/templates/base/agent.py

@@ -0,0 +1,81 @@
+"""Minimal AIMarket capability provider generated by create-aimarket-agent."""
+from __future__ import annotations
+
+import hmac
+import os
+from fastapi import FastAPI, Request
+from fastapi.responses import JSONResponse
+from pydantic import BaseModel, Field
+
+from provider_signing import ProviderSigner
+
+app = FastAPI(
+    title="__PROJECT_NAME__",
+    docs_url=None,
+    redoc_url=None,
+    openapi_url=None,
+)
+METIS_ENABLED = __METIS_PYTHON__
+SIGNER = ProviderSigner()
+PRODUCT_ID = "__PROJECT_SLUG__"
+CAPABILITY_ID = "__PROJECT_SLUG__.invoke@v1"
+
+
+class InvokeInput(BaseModel):
+    input: dict = Field(default_factory=dict)
+    product_id: str = Field(default=PRODUCT_ID, max_length=128)
+    capability_id: str = Field(default=CAPABILITY_ID, max_length=192)
+
+
+@app.middleware("http")
+async def request_boundary(request: Request, call_next):
+    response = None
+    if request.method == "POST" and request.url.path == "/invoke":
+        raw_length = request.headers.get("content-length")
+        try:
+            length = int(raw_length) if raw_length is not None else -1
+        except ValueError:
+            length = -1
+        if length < 0 or length > 1_048_576:
+            response = JSONResponse({"detail": "request body must be 0-1048576 bytes"}, status_code=413)
+    if response is None:
+        response = await call_next(request)
+    response.headers["Cache-Control"] = "no-store"
+    response.headers["X-Content-Type-Options"] = "nosniff"
+    response.headers["Referrer-Policy"] = "no-referrer"
+    response.headers["X-Frame-Options"] = "DENY"
+    return response
+
+
+@app.get("/health")
+def health() -> dict:
+    return {"ok": True, "agent": "__PROJECT_SLUG__", "kind": "__AGENT_KIND__",
+            "provider_pubkey": SIGNER.public_key_b64}
+
+
+@app.post("/invoke")
+def invoke(request: InvokeInput) -> JSONResponse:
+    # Identity belongs to capability.json, not to an untrusted caller. Allowing
+    # arbitrary identifiers here would turn this key into a signing oracle for
+    # another product or capability that happens to reuse the provider key.
+    if not hmac.compare_digest(request.product_id, PRODUCT_ID):
+        return JSONResponse({"detail": "product_id does not match this provider"}, status_code=400)
+    if not hmac.compare_digest(request.capability_id, CAPABILITY_ID):
+        return JSONResponse({"detail": "capability_id does not match this provider"}, status_code=400)
+    # Replace this deterministic example with your capability logic.
+    result = {"message": "Hello from __PROJECT_NAME__", "received": request.input,
+              "verification_requested": METIS_ENABLED}
+    return JSONResponse(
+        {"success": True, "result": result},
+        headers={"X-Provider-Signature": SIGNER.sign_result(
+            result,
+            capability_id=CAPABILITY_ID,
+            product_id=PRODUCT_ID,
+            input_payload=request.input,
+        )},
+    )
+
+
+if __name__ == "__main__":
+    import uvicorn
+    uvicorn.run(app, host=os.getenv("HOST", "127.0.0.1"), port=int(os.getenv("PORT", "8080")))

create_aimarket_agent/templates/base/capability.json

@@ -0,0 +1,13 @@
+{
+  "product_id": "__PROJECT_SLUG__",
+  "capability_id": "__PROJECT_SLUG__.invoke@v1",
+  "name": "__PROJECT_NAME__",
+  "description": "A generated AIMarket __AGENT_KIND__ capability",
+  "invoke_url": "http://127.0.0.1:8080/invoke",
+  "publisher_id": "community",
+  "provider_pubkey": "",
+  "price_per_call_usd": 0.001,
+  "input_schema": {"type": "object", "additionalProperties": true},
+  "output_schema": {"type": "object", "additionalProperties": true},
+  "verification": {"metis": __METIS_ENABLED__}
+}

create_aimarket_agent/templates/base/configure_provider.py

@@ -0,0 +1,22 @@
+from __future__ import annotations
+
+import json
+from pathlib import Path
+
+from provider_signing import ProviderSigner
+
+
+def main() -> int:
+    signer = ProviderSigner()
+    path = Path("capability.json")
+    manifest = json.loads(path.read_text(encoding="utf-8"))
+    manifest["provider_pubkey"] = signer.public_key_b64
+    temporary = path.with_suffix(".json.tmp")
+    temporary.write_text(json.dumps(manifest, ensure_ascii=False, indent=2) + "\n", encoding="utf-8")
+    temporary.replace(path)
+    print(f"provider identity ready: {signer.public_key_b64}")
+    return 0
+
+
+if __name__ == "__main__":
+    raise SystemExit(main())

create_aimarket_agent/templates/base/provider_signing.py

@@ -0,0 +1,77 @@
+from __future__ import annotations
+
+import base64
+import hashlib
+import json
+import os
+import stat
+from pathlib import Path
+
+from cryptography.hazmat.primitives.asymmetric.ed25519 import Ed25519PrivateKey
+
+
+class ProviderSigner:
+    def __init__(self) -> None:
+        self.path = Path(
+            os.getenv(
+                "AIMARKET_PROVIDER_KEY_FILE",
+                os.getenv("AIMARKET_PROVIDER_IDENTITY_FILE", ".aimarket/provider.key"),
+            )
+        )
+        if self.path.parent.exists() and self.path.parent.is_symlink():
+            raise RuntimeError(f"provider key directory {self.path.parent} must not be a link")
+        self.path.parent.mkdir(parents=True, exist_ok=True, mode=0o700)
+        if self.path.exists():
+            seed = self._read_existing_seed()
+        else:
+            seed = Ed25519PrivateKey.generate().private_bytes_raw()
+            flags = os.O_WRONLY | os.O_CREAT | os.O_EXCL | getattr(os, "O_NOFOLLOW", 0)
+            descriptor = os.open(self.path, flags, 0o600)
+            with os.fdopen(descriptor, "wb") as handle:
+                handle.write(seed)
+        self.private = Ed25519PrivateKey.from_private_bytes(seed)
+
+    def _read_existing_seed(self) -> bytes:
+        path_info = self.path.lstat()
+        if self.path.is_symlink() or not stat.S_ISREG(path_info.st_mode):
+            raise RuntimeError(f"provider key {self.path} must be a regular file, not a link")
+        flags = os.O_RDONLY | getattr(os, "O_NOFOLLOW", 0)
+        try:
+            descriptor = os.open(self.path, flags)
+        except OSError as exc:
+            raise RuntimeError(f"provider key {self.path} could not be opened safely") from exc
+        with os.fdopen(descriptor, "rb") as handle:
+            opened_info = os.fstat(handle.fileno())
+            if (
+                not stat.S_ISREG(opened_info.st_mode)
+                or (opened_info.st_dev, opened_info.st_ino) != (path_info.st_dev, path_info.st_ino)
+            ):
+                raise RuntimeError(f"provider key {self.path} changed while it was being opened")
+            os.fchmod(handle.fileno(), 0o600)
+            seed = handle.read(33)
+        if len(seed) != 32:
+            raise RuntimeError(f"provider key {self.path} is corrupted; expected 32 bytes")
+        return seed
+
+    @property
+    def public_key_b64(self) -> str:
+        return base64.b64encode(self.private.public_key().public_bytes_raw()).decode()
+
+    def sign_result(
+        self, result: dict, *, capability_id: str, product_id: str, input_payload: dict
+    ) -> str:
+        input_json = json.dumps(
+            input_payload or {}, sort_keys=True, separators=(",", ":"), ensure_ascii=False
+        )
+        canonical = json.dumps(
+            {
+                "capability_id": capability_id,
+                "product_id": product_id,
+                "input_sha256": hashlib.sha256(input_json.encode()).hexdigest(),
+                "result": result,
+            },
+            sort_keys=True,
+            separators=(",", ":"),
+            ensure_ascii=False,
+        )
+        return base64.b64encode(self.private.sign(canonical.encode())).decode()

create_aimarket_agent/templates/base/pyproject.toml

@@ -0,0 +1,18 @@
+[project]
+name = "__PROJECT_SLUG__"
+version = "0.1.0"
+requires-python = ">=3.11"
+dependencies = ["cryptography>=44", "fastapi>=0.115", "uvicorn>=0.30"]
+
+[project.optional-dependencies]
+dev = ["httpx>=0.27", "pytest>=8"]
+
+[build-system]
+requires = ["setuptools>=77"]
+build-backend = "setuptools.build_meta"
+
+[tool.setuptools]
+py-modules = ["agent", "provider_signing", "configure_provider", "validate_manifest"]
+
+[tool.pytest.ini_options]
+testpaths = ["."]

create_aimarket_agent/templates/base/test_agent.py

@@ -0,0 +1,73 @@
+import base64
+import hashlib
+import json
+
+from cryptography.hazmat.primitives.asymmetric.ed25519 import Ed25519PublicKey
+from fastapi.testclient import TestClient
+from agent import app
+
+
+def test_health_and_invoke():
+    client = TestClient(app)
+    assert client.get("/health").json()["ok"] is True
+    payload = {
+        "input": {"hello": "world"},
+        "product_id": "__PROJECT_SLUG__",
+        "capability_id": "__PROJECT_SLUG__.invoke@v1",
+    }
+    response = client.post("/invoke", json=payload)
+    body = response.json()
+    assert body["success"] is True
+    assert body["result"]["received"] == {"hello": "world"}
+    signature = base64.b64decode(response.headers["x-provider-signature"], validate=True)
+    input_json = json.dumps(payload["input"], sort_keys=True, separators=(",", ":"), ensure_ascii=False)
+    canonical = json.dumps({
+        "capability_id": payload["capability_id"],
+        "product_id": payload["product_id"],
+        "input_sha256": hashlib.sha256(input_json.encode()).hexdigest(),
+        "result": body["result"],
+    }, sort_keys=True, separators=(",", ":"), ensure_ascii=False)
+    public_key = base64.b64decode(client.get("/health").json()["provider_pubkey"], validate=True)
+    Ed25519PublicKey.from_public_bytes(public_key).verify(signature, canonical.encode())
+    assert response.headers["cache-control"] == "no-store"
+    assert response.headers["x-content-type-options"] == "nosniff"
+    assert response.headers["x-frame-options"] == "DENY"
+
+
+def test_signature_is_bound_to_request_input():
+    client = TestClient(app)
+    first = client.post("/invoke", json={"input": {"hello": "world"}})
+    second = client.post("/invoke", json={"input": {"hello": "another-world"}})
+    assert first.headers["x-provider-signature"] != second.headers["x-provider-signature"]
+
+
+def test_provider_identity_cannot_be_selected_by_the_caller():
+    client = TestClient(app)
+    assert client.post("/invoke", json={"product_id": "another-product"}).status_code == 400
+    assert client.post("/invoke", json={"capability_id": "another.invoke@v1"}).status_code == 400
+
+
+def test_unused_framework_documentation_routes_are_closed():
+    client = TestClient(app)
+    assert client.get("/docs").status_code == 404
+    assert client.get("/openapi.json").status_code == 404
+
+
+def test_invalid_payload_is_not_cached():
+    response = TestClient(app).post("/invoke", json={"product_id": "x" * 129})
+    assert response.status_code == 422
+    assert response.headers["cache-control"] == "no-store"
+
+
+def test_oversized_invoke_is_rejected():
+    response = TestClient(app).post("/invoke", content=b"x" * 1_048_577)
+    assert response.status_code == 413
+
+
+def test_invalid_content_length_is_rejected():
+    response = TestClient(app).post(
+        "/invoke",
+        content=b"{}",
+        headers={"content-type": "application/json", "content-length": "invalid"},
+    )
+    assert response.status_code == 413

create_aimarket_agent/templates/base/validate_manifest.py

@@ -0,0 +1,145 @@
+from __future__ import annotations
+
+import base64
+import binascii
+import ipaddress
+import json
+import math
+import re
+from pathlib import Path
+from urllib.parse import urlsplit
+
+
+MANIFEST = Path("capability.json")
+MAX_MANIFEST_BYTES = 65_536
+SAFE_ID = re.compile(r"[A-Za-z0-9][A-Za-z0-9._-]{0,127}")
+CAPABILITY_ID = re.compile(r"[A-Za-z0-9][A-Za-z0-9._-]*@[vV]\d+")
+PUBLISHER_ID = re.compile(r"[A-Za-z0-9][A-Za-z0-9._:-]{0,127}")
+RESERVED_PUBLISHER_PREFIXES = ("tx-consumed:", "unverified-dev-credit")
+
+
+def fail(message: str) -> None:
+    raise SystemExit(message)
+
+
+def unique_object(pairs):
+    result = {}
+    for key, value in pairs:
+        if key in result:
+            fail(f"capability.json contains duplicate key: {key}")
+        result[key] = value
+    return result
+
+
+def read_manifest() -> dict:
+    try:
+        info = MANIFEST.lstat()
+    except OSError as exc:
+        fail(f"cannot inspect capability.json: {exc}")
+    if MANIFEST.is_symlink() or not MANIFEST.is_file():
+        fail("capability.json must be a regular file, not a link")
+    if info.st_size > MAX_MANIFEST_BYTES:
+        fail(f"capability.json exceeds {MAX_MANIFEST_BYTES} bytes")
+    try:
+        data = json.loads(MANIFEST.read_text(encoding="utf-8"), object_pairs_hook=unique_object)
+    except (OSError, UnicodeError, json.JSONDecodeError, RecursionError) as exc:
+        fail(f"capability.json is not valid bounded UTF-8 JSON: {exc}")
+    if not isinstance(data, dict):
+        fail("capability.json must contain one JSON object")
+    return data
+
+
+def finite_number(data: dict, key: str, *, minimum: float, maximum: float) -> float:
+    value = data.get(key)
+    if isinstance(value, bool):
+        fail(f"{key} must be a finite number between {minimum} and {maximum}")
+    try:
+        number = float(value)
+    except (TypeError, ValueError):
+        fail(f"{key} must be a finite number between {minimum} and {maximum}")
+    if not math.isfinite(number) or not minimum <= number <= maximum:
+        fail(f"{key} must be a finite number between {minimum} and {maximum}")
+    return number
+
+
+def validate_invoke_url(raw: object) -> None:
+    if not isinstance(raw, str):
+        fail("invoke_url must be an absolute http(s) URL")
+    try:
+        url = urlsplit(raw.strip())
+        _ = url.port  # Force validation of malformed/out-of-range ports.
+    except ValueError as exc:
+        fail(f"invoke_url is malformed: {exc}")
+    if url.scheme not in {"http", "https"} or not url.hostname:
+        fail("invoke_url must be an absolute http(s) URL")
+    if url.username or url.password:
+        fail("invoke_url must not contain credentials")
+    if url.query or url.fragment:
+        fail("invoke_url must not contain a query string or fragment")
+    hostname = url.hostname.casefold()
+    is_loopback = hostname == "localhost"
+    try:
+        is_loopback = is_loopback or ipaddress.ip_address(hostname).is_loopback
+    except ValueError:
+        pass
+    if url.scheme != "https" and not is_loopback:
+        fail("public invoke_url must use HTTPS; HTTP is allowed only for loopback development")
+
+
+def main() -> int:
+    data = read_manifest()
+    required = (
+        "product_id",
+        "capability_id",
+        "name",
+        "invoke_url",
+        "publisher_id",
+        "provider_pubkey",
+        "price_per_call_usd",
+        "input_schema",
+        "output_schema",
+    )
+    missing = [key for key in required if data.get(key) in (None, "")]
+    if missing:
+        fail(f"missing required fields: {', '.join(missing)}")
+
+    if not isinstance(data["product_id"], str) or not SAFE_ID.fullmatch(data["product_id"]):
+        fail("product_id must be alphanumeric (dots, dashes, underscores allowed), max 128 chars")
+    if not isinstance(data["capability_id"], str) or not CAPABILITY_ID.fullmatch(data["capability_id"]):
+        fail("capability_id must look like my.tool@v1")
+    if not isinstance(data["name"], str) or not 1 <= len(data["name"].strip()) <= 128:
+        fail("name must contain 1-128 characters")
+
+    publisher_id = data["publisher_id"]
+    if not isinstance(publisher_id, str) or not PUBLISHER_ID.fullmatch(publisher_id):
+        fail("publisher_id must be a stable 1-128 character identifier")
+    if publisher_id.startswith(RESERVED_PUBLISHER_PREFIXES):
+        fail("publisher_id uses a reserved Hub bookkeeping prefix")
+
+    validate_invoke_url(data["invoke_url"])
+    finite_number(data, "price_per_call_usd", minimum=0.0, maximum=1000.0)
+    if "p50_latency_ms" in data:
+        finite_number(data, "p50_latency_ms", minimum=0.0, maximum=86_400_000.0)
+    if "success_rate_30d" in data:
+        finite_number(data, "success_rate_30d", minimum=0.0, maximum=1.0)
+
+    for key in ("input_schema", "output_schema"):
+        schema = data[key]
+        if not isinstance(schema, dict):
+            fail(f"{key} must be a JSON object")
+        if schema.get("type") != "object":
+            fail(f"{key}.type must be object")
+
+    try:
+        provider_key = base64.b64decode(str(data["provider_pubkey"]), validate=True)
+    except (ValueError, binascii.Error):
+        fail("provider_pubkey must be canonical base64")
+    if len(provider_key) != 32:
+        fail("provider_pubkey must encode exactly 32 Ed25519 public-key bytes")
+
+    print("capability.json is structurally ready for AIMarket Hub publish")
+    return 0
+
+
+if __name__ == "__main__":
+    raise SystemExit(main())

create_aimarket_agent-0.1.0.dist-info/METADATA

@@ -0,0 +1,128 @@
+Metadata-Version: 2.4
+Name: create-aimarket-agent
+Version: 0.1.0
+Summary: Scaffold a minimal AIMarket Protocol v2 capability provider
+Project-URL: Documentation, https://github.com/alexar76/create-aimarket-agent#readme
+Project-URL: Issues, https://github.com/alexar76/create-aimarket-agent/issues
+Project-URL: Repository, https://github.com/alexar76/create-aimarket-agent
+License: MIT
+License-File: LICENSE
+Requires-Python: >=3.11
+Provides-Extra: dev
+Requires-Dist: build>=1.2; extra == 'dev'
+Requires-Dist: cryptography>=44; extra == 'dev'
+Requires-Dist: fastapi>=0.115; extra == 'dev'
+Requires-Dist: httpx>=0.27; extra == 'dev'
+Requires-Dist: pytest-cov>=5; extra == 'dev'
+Requires-Dist: pytest>=8; extra == 'dev'
+Description-Content-Type: text/markdown
+
+# create-aimarket-agent
+
+<p align="center">
+  <strong>From an empty directory to a signed AIMarket Protocol v2 provider.</strong><br>
+  A safe, deterministic project generator with tests, Docker packaging, and explicit publishing.
+</p>
+
+<!-- aicom-readme-badges -->
+<p align="center">
+  <a href="https://github.com/alexar76/create-aimarket-agent/actions/workflows/ci.yml"><img src="https://github.com/alexar76/create-aimarket-agent/actions/workflows/ci.yml/badge.svg" alt="CI" /></a>
+  <img src="https://img.shields.io/badge/python-%3E%3D3.11-3776AB" alt="Python >=3.11" />
+  <img src="https://img.shields.io/badge/tests-45%20passing-4c1" alt="45 tests passing" />
+  <img src="https://img.shields.io/badge/branch%20coverage-100%25-4c1" alt="100% branch coverage" />
+  <img src="https://img.shields.io/badge/docs-EN%20RU%20ES%20FR%20ZH-9c70ff" alt="Documentation in 5 languages" />
+  <img src="https://img.shields.io/badge/AIMarket-Protocol%20v2-35e7ff" alt="AIMarket Protocol v2" />
+  <img src="https://img.shields.io/badge/signing-Ed25519-8d83ff" alt="Ed25519 signing" />
+  <a href="https://github.com/alexar76/create-aimarket-agent/blob/main/LICENSE"><img src="https://raw.githubusercontent.com/alexar76/create-aimarket-agent/main/docs/badges/license.svg" alt="License: MIT" /></a>
+</p>
+<!-- /aicom-readme-badges -->
+
+<p align="center">
+  <a href="README.md"><b>English</b></a> ·
+  <a href="docs/README.ru.md">Русский</a> ·
+  <a href="docs/README.es.md">Español</a> ·
+  <a href="docs/README.fr.md">Français</a> ·
+  <a href="docs/README.zh.md">中文</a> ·
+  <a href="https://github.com/alexar76/aicom/blob/main/docs/localization-glossary.md">Localization glossary</a>
+</p>
+
+## Quick start
+
+```bash
+uvx create-aimarket-agent my-agent --kind tool --metis
+cd my-agent
+uv sync --extra dev
+uv run python configure_provider.py
+uv run pytest
+uv run python validate_manifest.py
+uv run python agent.py
+```
+
+The command, identifiers, flags, and generated filenames are stable in every language.
+
+## Generated repository
+
+| Path | Role |
+|---|---|
+| `agent.py` | FastAPI health and invoke endpoints |
+| `capability.json` | AIMarket Protocol v2 capability manifest |
+| `provider_signing.py` | Persistent Ed25519 identity and request-bound response signing |
+| `configure_provider.py` | Writes the public provider key into the manifest atomically |
+| `validate_manifest.py` | Fail-closed structural validation before publishing |
+| `test_agent.py` | API, request-bound signature, and request-size tests |
+| `Dockerfile` · `.dockerignore` | Non-root container packaging with persistent key volume |
+| `.github/workflows/test.yml` | Generated-project CI |
+
+## Security model
+
+- Scaffolding is atomic: a failed copy or replacement leaves no partial target repository.
+- Project names are allow-listed before they enter source or JSON files.
+- The provider key is a 32-byte Ed25519 seed stored with mode `0600`; symlinks and non-regular files are rejected.
+- Responses sign a canonical request-bound envelope containing `capability_id`, `product_id`, the SHA-256 input digest, and the result. This prevents replay across requests.
+- The generated service accepts only the product and capability identity declared in its manifest,
+  so an untrusted caller cannot make the provider key sign another identity.
+- The manifest validator rejects duplicate JSON keys, malformed Ed25519 keys, non-finite prices,
+  malformed URLs, and public HTTP endpoints before the publish step.
+- The default invoke endpoint rejects missing, malformed, or oversized request bodies.
+- Publishing is never automatic. Stake, publisher identity, trust policy, and Hub registration remain explicit operator actions.
+
+## Project kinds
+
+```bash
+create-aimarket-agent my-tool --kind tool
+create-aimarket-agent my-data --kind data-provider
+create-aimarket-agent my-orchestrator --kind orchestrator
+create-aimarket-agent my-agent --no-metis
+```
+
+## Docker
+
+The generated image runs as an unprivileged user, includes a health check, listens on
+`0.0.0.0:8080`, and stores the provider key in `/data/provider.key`.
+
+```bash
+docker build -t my-agent .
+docker run --read-only --tmpfs /tmp -p 127.0.0.1:8080:8080 -v my-agent-key:/data my-agent
+```
+
+Back up the provider key before publishing. Replacing it invalidates the `provider_pubkey`
+registered with the Hub. Keep the port loopback-only until an HTTPS ingress provides production
+traffic, concurrency, and rate limits; the response signature does not authorize direct callers.
+
+## Development of this generator
+
+```bash
+uv sync --extra dev
+uv run pytest
+uv build --wheel
+```
+
+## Localization contract
+
+Documentation is available in English, Russian, Spanish, French, and Chinese and follows the
+canonical [AICOM localization glossary](https://github.com/alexar76/aicom/blob/main/docs/localization-glossary.md).
+Code, commands, flags, filenames, API fields, env vars, brands, `LIVE`, and `SIM` are never translated.
+
+## License
+
+MIT — see [LICENSE](LICENSE).

create_aimarket_agent-0.1.0.dist-info/RECORD

@@ -0,0 +1,21 @@
+create_aimarket_agent/__init__.py,sha256=a3hVErWOI8xlZ919MlT0i1zi8BnS9KD3rUJjmK4F0q0,65
+create_aimarket_agent/cli.py,sha256=WMhT53kCbWiLUVy6N3AN4XihOI1WfbN_6C44BU2J4_4,3480
+create_aimarket_agent/templates/base/.dockerignore,sha256=L2U65N_3GNGvPw8vrY3n_EXIz4tXfuNSGql2DRih6d0,92
+create_aimarket_agent/templates/base/.env.example,sha256=n1vI7J0hLF-zZI2YmB4NTbZ01A6P2HGlBquW-gDDEks,150
+create_aimarket_agent/templates/base/.gitignore,sha256=UMQI127xBnYS8xS2wwbJ-fk-FdNjCJGvMmfyrn7Au2s,51
+create_aimarket_agent/templates/base/Dockerfile,sha256=qhr3gzGsl0EoCkUsXN-HuAMIF99mVkrdw4tspDnoE9w,514
+create_aimarket_agent/templates/base/Makefile,sha256=2dPtuBw4xyiW9cAY6tcM44Q_hZTtzv-y-hnl83yWeZc,356
+create_aimarket_agent/templates/base/README.md,sha256=ZrEksAf94rKQqLvkKzZQOomPwBF55tC6i9DfC3_1kOQ,1311
+create_aimarket_agent/templates/base/agent.py,sha256=X4s-9C1qOl3L8sHprVAGKlXLg_ervcQ-96MC2YWuXKQ,3033
+create_aimarket_agent/templates/base/capability.json,sha256=bcJW_7hF4q36UGMmrS7oGZ5I9l4VoZm4M7ntxoBsql4,505
+create_aimarket_agent/templates/base/configure_provider.py,sha256=yNSBGTgKRYFKbvjHjz_aXf315GIp7Ocjst7YerU3rLw,630
+create_aimarket_agent/templates/base/provider_signing.py,sha256=RelBQ_CagtB1J7nCd8veT78apXYZ1reXUwpZRart74c,3129
+create_aimarket_agent/templates/base/pyproject.toml,sha256=jqR_v-ampGkB_g1DwFsAA7GIdIlaFvkJGMHfSyy29eo,456
+create_aimarket_agent/templates/base/test_agent.py,sha256=AJi2exDGnRjy2zerh7iYAhBSJKrWsXgmqfX3ZYBDbyI,2931
+create_aimarket_agent/templates/base/validate_manifest.py,sha256=pclbnQzlpDqpo2GMbA6LfNJqkyYaJ3AIpc2iUhOI9IQ,5401
+create_aimarket_agent/templates/base/.github/workflows/test.yml,sha256=8Dk4cul0DNP5714U4e2_CJqRzd90ATRMrQWNf0hR2RU,447
+create_aimarket_agent-0.1.0.dist-info/METADATA,sha256=rTSCbvdAnvy2Q-NU7ZQjbv_9DdJIwR2-BHGY7BAUzCM,5735
+create_aimarket_agent-0.1.0.dist-info/WHEEL,sha256=qtCwoSJWgHk21S1Kb4ihdzI2rlJ1ZKaIurTj_ngOhyQ,87
+create_aimarket_agent-0.1.0.dist-info/entry_points.txt,sha256=QWlRLMJna5icJZQA1K-da6zlBlnMnqAHmI40W9_rWik,73
+create_aimarket_agent-0.1.0.dist-info/licenses/LICENSE,sha256=fxsRdr6-VWt-7ybEuLwV-2l0amNFfK0HNh1NrqUDKjU,816
+create_aimarket_agent-0.1.0.dist-info/RECORD,,

create_aimarket_agent-0.1.0.dist-info/WHEEL

@@ -0,0 +1,4 @@
+Wheel-Version: 1.0
+Generator: hatchling 1.27.0
+Root-Is-Purelib: true
+Tag: py3-none-any

create_aimarket_agent-0.1.0.dist-info/entry_points.txt

@@ -0,0 +1,2 @@
+[console_scripts]
+create-aimarket-agent = create_aimarket_agent.cli:main

create_aimarket_agent-0.1.0.dist-info/licenses/LICENSE

@@ -0,0 +1,9 @@
+MIT License
+
+Copyright (c) 2026 AICOM Contributors
+
+Permission is hereby granted, free of charge, to any person obtaining a copy of this software and associated documentation files (the "Software"), to deal in the Software without restriction, including without limitation the rights to use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies of the Software, and to permit persons to whom the Software is furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT.