create-aimarket-agent 0.1.0__tar.gz

create_aimarket_agent-0.1.0/.gitignore

@@ -0,0 +1,5 @@
+.venv/
+__pycache__/
+.pytest_cache/
+dist/
+*.egg-info/

create_aimarket_agent-0.1.0/LICENSE

@@ -0,0 +1,9 @@
+MIT License
+
+Copyright (c) 2026 AICOM Contributors
+
+Permission is hereby granted, free of charge, to any person obtaining a copy of this software and associated documentation files (the "Software"), to deal in the Software without restriction, including without limitation the rights to use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies of the Software, and to permit persons to whom the Software is furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT.

create_aimarket_agent-0.1.0/PKG-INFO

@@ -0,0 +1,128 @@
+Metadata-Version: 2.4
+Name: create-aimarket-agent
+Version: 0.1.0
+Summary: Scaffold a minimal AIMarket Protocol v2 capability provider
+Project-URL: Documentation, https://github.com/alexar76/create-aimarket-agent#readme
+Project-URL: Issues, https://github.com/alexar76/create-aimarket-agent/issues
+Project-URL: Repository, https://github.com/alexar76/create-aimarket-agent
+License: MIT
+License-File: LICENSE
+Requires-Python: >=3.11
+Provides-Extra: dev
+Requires-Dist: build>=1.2; extra == 'dev'
+Requires-Dist: cryptography>=44; extra == 'dev'
+Requires-Dist: fastapi>=0.115; extra == 'dev'
+Requires-Dist: httpx>=0.27; extra == 'dev'
+Requires-Dist: pytest-cov>=5; extra == 'dev'
+Requires-Dist: pytest>=8; extra == 'dev'
+Description-Content-Type: text/markdown
+
+# create-aimarket-agent
+
+<p align="center">
+  <strong>From an empty directory to a signed AIMarket Protocol v2 provider.</strong><br>
+  A safe, deterministic project generator with tests, Docker packaging, and explicit publishing.
+</p>
+
+<!-- aicom-readme-badges -->
+<p align="center">
+  <a href="https://github.com/alexar76/create-aimarket-agent/actions/workflows/ci.yml"><img src="https://github.com/alexar76/create-aimarket-agent/actions/workflows/ci.yml/badge.svg" alt="CI" /></a>
+  <img src="https://img.shields.io/badge/python-%3E%3D3.11-3776AB" alt="Python >=3.11" />
+  <img src="https://img.shields.io/badge/tests-45%20passing-4c1" alt="45 tests passing" />
+  <img src="https://img.shields.io/badge/branch%20coverage-100%25-4c1" alt="100% branch coverage" />
+  <img src="https://img.shields.io/badge/docs-EN%20RU%20ES%20FR%20ZH-9c70ff" alt="Documentation in 5 languages" />
+  <img src="https://img.shields.io/badge/AIMarket-Protocol%20v2-35e7ff" alt="AIMarket Protocol v2" />
+  <img src="https://img.shields.io/badge/signing-Ed25519-8d83ff" alt="Ed25519 signing" />
+  <a href="https://github.com/alexar76/create-aimarket-agent/blob/main/LICENSE"><img src="https://raw.githubusercontent.com/alexar76/create-aimarket-agent/main/docs/badges/license.svg" alt="License: MIT" /></a>
+</p>
+<!-- /aicom-readme-badges -->
+
+<p align="center">
+  <a href="README.md"><b>English</b></a> ·
+  <a href="docs/README.ru.md">Русский</a> ·
+  <a href="docs/README.es.md">Español</a> ·
+  <a href="docs/README.fr.md">Français</a> ·
+  <a href="docs/README.zh.md">中文</a> ·
+  <a href="https://github.com/alexar76/aicom/blob/main/docs/localization-glossary.md">Localization glossary</a>
+</p>
+
+## Quick start
+
+```bash
+uvx create-aimarket-agent my-agent --kind tool --metis
+cd my-agent
+uv sync --extra dev
+uv run python configure_provider.py
+uv run pytest
+uv run python validate_manifest.py
+uv run python agent.py
+```
+
+The command, identifiers, flags, and generated filenames are stable in every language.
+
+## Generated repository
+
+| Path | Role |
+|---|---|
+| `agent.py` | FastAPI health and invoke endpoints |
+| `capability.json` | AIMarket Protocol v2 capability manifest |
+| `provider_signing.py` | Persistent Ed25519 identity and request-bound response signing |
+| `configure_provider.py` | Writes the public provider key into the manifest atomically |
+| `validate_manifest.py` | Fail-closed structural validation before publishing |
+| `test_agent.py` | API, request-bound signature, and request-size tests |
+| `Dockerfile` · `.dockerignore` | Non-root container packaging with persistent key volume |
+| `.github/workflows/test.yml` | Generated-project CI |
+
+## Security model
+
+- Scaffolding is atomic: a failed copy or replacement leaves no partial target repository.
+- Project names are allow-listed before they enter source or JSON files.
+- The provider key is a 32-byte Ed25519 seed stored with mode `0600`; symlinks and non-regular files are rejected.
+- Responses sign a canonical request-bound envelope containing `capability_id`, `product_id`, the SHA-256 input digest, and the result. This prevents replay across requests.
+- The generated service accepts only the product and capability identity declared in its manifest,
+  so an untrusted caller cannot make the provider key sign another identity.
+- The manifest validator rejects duplicate JSON keys, malformed Ed25519 keys, non-finite prices,
+  malformed URLs, and public HTTP endpoints before the publish step.
+- The default invoke endpoint rejects missing, malformed, or oversized request bodies.
+- Publishing is never automatic. Stake, publisher identity, trust policy, and Hub registration remain explicit operator actions.
+
+## Project kinds
+
+```bash
+create-aimarket-agent my-tool --kind tool
+create-aimarket-agent my-data --kind data-provider
+create-aimarket-agent my-orchestrator --kind orchestrator
+create-aimarket-agent my-agent --no-metis
+```
+
+## Docker
+
+The generated image runs as an unprivileged user, includes a health check, listens on
+`0.0.0.0:8080`, and stores the provider key in `/data/provider.key`.
+
+```bash
+docker build -t my-agent .
+docker run --read-only --tmpfs /tmp -p 127.0.0.1:8080:8080 -v my-agent-key:/data my-agent
+```
+
+Back up the provider key before publishing. Replacing it invalidates the `provider_pubkey`
+registered with the Hub. Keep the port loopback-only until an HTTPS ingress provides production
+traffic, concurrency, and rate limits; the response signature does not authorize direct callers.
+
+## Development of this generator
+
+```bash
+uv sync --extra dev
+uv run pytest
+uv build --wheel
+```
+
+## Localization contract
+
+Documentation is available in English, Russian, Spanish, French, and Chinese and follows the
+canonical [AICOM localization glossary](https://github.com/alexar76/aicom/blob/main/docs/localization-glossary.md).
+Code, commands, flags, filenames, API fields, env vars, brands, `LIVE`, and `SIM` are never translated.
+
+## License
+
+MIT — see [LICENSE](LICENSE).

create_aimarket_agent-0.1.0/README.md

@@ -0,0 +1,109 @@
+# create-aimarket-agent
+
+<p align="center">
+  <strong>From an empty directory to a signed AIMarket Protocol v2 provider.</strong><br>
+  A safe, deterministic project generator with tests, Docker packaging, and explicit publishing.
+</p>
+
+<!-- aicom-readme-badges -->
+<p align="center">
+  <a href="https://github.com/alexar76/create-aimarket-agent/actions/workflows/ci.yml"><img src="https://github.com/alexar76/create-aimarket-agent/actions/workflows/ci.yml/badge.svg" alt="CI" /></a>
+  <img src="https://img.shields.io/badge/python-%3E%3D3.11-3776AB" alt="Python >=3.11" />
+  <img src="https://img.shields.io/badge/tests-45%20passing-4c1" alt="45 tests passing" />
+  <img src="https://img.shields.io/badge/branch%20coverage-100%25-4c1" alt="100% branch coverage" />
+  <img src="https://img.shields.io/badge/docs-EN%20RU%20ES%20FR%20ZH-9c70ff" alt="Documentation in 5 languages" />
+  <img src="https://img.shields.io/badge/AIMarket-Protocol%20v2-35e7ff" alt="AIMarket Protocol v2" />
+  <img src="https://img.shields.io/badge/signing-Ed25519-8d83ff" alt="Ed25519 signing" />
+  <a href="https://github.com/alexar76/create-aimarket-agent/blob/main/LICENSE"><img src="https://raw.githubusercontent.com/alexar76/create-aimarket-agent/main/docs/badges/license.svg" alt="License: MIT" /></a>
+</p>
+<!-- /aicom-readme-badges -->
+
+<p align="center">
+  <a href="README.md"><b>English</b></a> ·
+  <a href="docs/README.ru.md">Русский</a> ·
+  <a href="docs/README.es.md">Español</a> ·
+  <a href="docs/README.fr.md">Français</a> ·
+  <a href="docs/README.zh.md">中文</a> ·
+  <a href="https://github.com/alexar76/aicom/blob/main/docs/localization-glossary.md">Localization glossary</a>
+</p>
+
+## Quick start
+
+```bash
+uvx create-aimarket-agent my-agent --kind tool --metis
+cd my-agent
+uv sync --extra dev
+uv run python configure_provider.py
+uv run pytest
+uv run python validate_manifest.py
+uv run python agent.py
+```
+
+The command, identifiers, flags, and generated filenames are stable in every language.
+
+## Generated repository
+
+| Path | Role |
+|---|---|
+| `agent.py` | FastAPI health and invoke endpoints |
+| `capability.json` | AIMarket Protocol v2 capability manifest |
+| `provider_signing.py` | Persistent Ed25519 identity and request-bound response signing |
+| `configure_provider.py` | Writes the public provider key into the manifest atomically |
+| `validate_manifest.py` | Fail-closed structural validation before publishing |
+| `test_agent.py` | API, request-bound signature, and request-size tests |
+| `Dockerfile` · `.dockerignore` | Non-root container packaging with persistent key volume |
+| `.github/workflows/test.yml` | Generated-project CI |
+
+## Security model
+
+- Scaffolding is atomic: a failed copy or replacement leaves no partial target repository.
+- Project names are allow-listed before they enter source or JSON files.
+- The provider key is a 32-byte Ed25519 seed stored with mode `0600`; symlinks and non-regular files are rejected.
+- Responses sign a canonical request-bound envelope containing `capability_id`, `product_id`, the SHA-256 input digest, and the result. This prevents replay across requests.
+- The generated service accepts only the product and capability identity declared in its manifest,
+  so an untrusted caller cannot make the provider key sign another identity.
+- The manifest validator rejects duplicate JSON keys, malformed Ed25519 keys, non-finite prices,
+  malformed URLs, and public HTTP endpoints before the publish step.
+- The default invoke endpoint rejects missing, malformed, or oversized request bodies.
+- Publishing is never automatic. Stake, publisher identity, trust policy, and Hub registration remain explicit operator actions.
+
+## Project kinds
+
+```bash
+create-aimarket-agent my-tool --kind tool
+create-aimarket-agent my-data --kind data-provider
+create-aimarket-agent my-orchestrator --kind orchestrator
+create-aimarket-agent my-agent --no-metis
+```
+
+## Docker
+
+The generated image runs as an unprivileged user, includes a health check, listens on
+`0.0.0.0:8080`, and stores the provider key in `/data/provider.key`.
+
+```bash
+docker build -t my-agent .
+docker run --read-only --tmpfs /tmp -p 127.0.0.1:8080:8080 -v my-agent-key:/data my-agent
+```
+
+Back up the provider key before publishing. Replacing it invalidates the `provider_pubkey`
+registered with the Hub. Keep the port loopback-only until an HTTPS ingress provides production
+traffic, concurrency, and rate limits; the response signature does not authorize direct callers.
+
+## Development of this generator
+
+```bash
+uv sync --extra dev
+uv run pytest
+uv build --wheel
+```
+
+## Localization contract
+
+Documentation is available in English, Russian, Spanish, French, and Chinese and follows the
+canonical [AICOM localization glossary](https://github.com/alexar76/aicom/blob/main/docs/localization-glossary.md).
+Code, commands, flags, filenames, API fields, env vars, brands, `LIVE`, and `SIM` are never translated.
+
+## License
+
+MIT — see [LICENSE](LICENSE).

create_aimarket_agent-0.1.0/pyproject.toml

@@ -0,0 +1,49 @@
+[project]
+name = "create-aimarket-agent"
+version = "0.1.0"
+description = "Scaffold a minimal AIMarket Protocol v2 capability provider"
+readme = "README.md"
+requires-python = ">=3.11"
+license = { text = "MIT" }
+dependencies = []
+
+[project.urls]
+Documentation = "https://github.com/alexar76/create-aimarket-agent#readme"
+Issues = "https://github.com/alexar76/create-aimarket-agent/issues"
+Repository = "https://github.com/alexar76/create-aimarket-agent"
+
+[project.optional-dependencies]
+dev = [
+    "build>=1.2",
+    "cryptography>=44",
+    "fastapi>=0.115",
+    "httpx>=0.27",
+    "pytest>=8",
+    "pytest-cov>=5",
+]
+
+[project.scripts]
+create-aimarket-agent = "create_aimarket_agent.cli:main"
+
+[build-system]
+requires = ["hatchling"]
+build-backend = "hatchling.build"
+
+[tool.hatch.build.targets.wheel]
+packages = ["src/create_aimarket_agent"]
+
+# Explicit sdist allow-list so hatchling does not walk up to the monorepo .gitignore
+# (and so template `.env.example` / nested scaffold files stay intentional package content).
+[tool.hatch.build.targets.sdist]
+include = [
+  "/src",
+  "/tests",
+  "/README.md",
+  "/LICENSE",
+  "/pyproject.toml",
+  "/.gitignore",
+]
+
+[tool.pytest.ini_options]
+testpaths = ["tests"]
+addopts = "--cov=create_aimarket_agent --cov-branch --cov-report=term-missing --cov-fail-under=95"

create_aimarket_agent-0.1.0/src/create_aimarket_agent/__init__.py

@@ -0,0 +1,4 @@
+"""AIMarket agent project scaffolder."""
+
+__version__ = "0.1.0"
+

create_aimarket_agent-0.1.0/src/create_aimarket_agent/cli.py

@@ -0,0 +1,99 @@
+from __future__ import annotations
+
+import argparse
+import re
+import shutil
+import sys
+import tempfile
+from importlib.resources import files
+from pathlib import Path
+
+KINDS = ("tool", "data-provider", "orchestrator")
+_SAFE_NAME = re.compile(r"^[A-Za-z0-9][A-Za-z0-9 ._-]{0,63}$")
+
+
+def slug(value: str) -> str:
+    clean = re.sub(r"[^a-z0-9]+", "-", value.strip().lower()).strip("-")
+    if not clean:
+        raise ValueError("project name must contain a letter or digit")
+    return clean
+
+
+def validate_name(value: str) -> str:
+    value = value.strip()
+    if not _SAFE_NAME.fullmatch(value):
+        raise ValueError(
+            "project name must be 1-64 characters and contain only letters, digits, spaces, dots, dashes, or underscores"
+        )
+    return value
+
+
+def scaffold(target: Path, *, name: str, kind: str, metis: bool) -> Path:
+    name = validate_name(name)
+    if kind not in KINDS:
+        raise ValueError(f"kind must be one of: {', '.join(KINDS)}")
+    target = target.resolve()
+    if target.exists():
+        raise FileExistsError(f"target already exists: {target}")
+    template = files("create_aimarket_agent").joinpath("templates/base")
+    target.parent.mkdir(parents=True, exist_ok=True)
+    stage_root = Path(tempfile.mkdtemp(prefix=f".{target.name}.tmp-", dir=target.parent))
+    staged = stage_root / target.name
+    replacements = {
+        "__PROJECT_NAME__": name,
+        "__PROJECT_SLUG__": slug(name),
+        "__AGENT_KIND__": kind,
+        "__METIS_ENABLED__": "true" if metis else "false",
+        "__METIS_PYTHON__": "True" if metis else "False",
+    }
+    try:
+        shutil.copytree(
+            str(template),
+            staged,
+            ignore=shutil.ignore_patterns("__pycache__", "*.pyc", "*.pyo"),
+        )
+        for path in staged.rglob("*"):
+            if path.is_file():
+                text = path.read_text(encoding="utf-8")
+                for old, new in replacements.items():
+                    text = text.replace(old, new)
+                path.write_text(text, encoding="utf-8")
+        if target.exists():
+            raise FileExistsError(f"target appeared while scaffolding: {target}")
+        staged.rename(target)
+    finally:
+        shutil.rmtree(stage_root, ignore_errors=True)
+    return target
+
+
+def parser() -> argparse.ArgumentParser:
+    p = argparse.ArgumentParser(prog="create-aimarket-agent")
+    p.add_argument("name", nargs="?", help="project name")
+    p.add_argument("--kind", choices=KINDS, default="tool")
+    p.add_argument("--metis", action=argparse.BooleanOptionalAction, default=True)
+    p.add_argument("--directory", type=Path, help="output directory")
+    return p
+
+
+def main(argv: list[str] | None = None) -> int:
+    args = parser().parse_args(argv)
+    name = args.name
+    if not name and sys.stdin.isatty():
+        name = input("Agent name: ").strip()
+    if not name:
+        parser().error("name is required")
+    try:
+        name = validate_name(name)
+        target = args.directory or Path.cwd() / slug(name)
+        scaffold(target, name=name, kind=args.kind, metis=args.metis)
+    except (ValueError, FileExistsError, OSError) as exc:
+        print(f"error: {exc}", file=sys.stderr)
+        return 2
+    print(f"Created {name} in {target}")
+    print(f"Next: cd {target} && uv sync --extra dev")
+    print("Then: uv run python configure_provider.py && uv run pytest && uv run python agent.py")
+    return 0
+
+
+if __name__ == "__main__":
+    raise SystemExit(main())

create_aimarket_agent-0.1.0/src/create_aimarket_agent/templates/base/.dockerignore

@@ -0,0 +1,11 @@
+.env
+.git
+.github
+.aimarket
+.venv
+__pycache__
+.pytest_cache
+.coverage
+build
+dist
+*.egg-info

create_aimarket_agent-0.1.0/src/create_aimarket_agent/templates/base/.env.example

@@ -0,0 +1,4 @@
+PORT=8080
+AIMARKET_HUB_URL=https://modelmarket.dev
+AIMARKET_METIS_URL=https://metis.modelmarket.dev
+AIMARKET_PROVIDER_KEY_FILE=.aimarket/provider.key

create_aimarket_agent-0.1.0/src/create_aimarket_agent/templates/base/.github/workflows/test.yml

@@ -0,0 +1,18 @@
+name: test
+on: [push, pull_request]
+permissions:
+  contents: read
+jobs:
+  test:
+    runs-on: ubuntu-latest
+    timeout-minutes: 10
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          persist-credentials: false
+      - uses: actions/setup-python@v5
+        with: {python-version: "3.12"}
+      - run: pip install -e '.[dev]'
+      - run: python configure_provider.py
+      - run: pytest -q
+      - run: python validate_manifest.py

create_aimarket_agent-0.1.0/src/create_aimarket_agent/templates/base/.gitignore

@@ -0,0 +1,5 @@
+.env
+.venv/
+__pycache__/
+.pytest_cache/
+.aimarket/

create_aimarket_agent-0.1.0/src/create_aimarket_agent/templates/base/Dockerfile

@@ -0,0 +1,15 @@
+FROM python:3.12-slim
+WORKDIR /app
+COPY . .
+RUN pip install --no-cache-dir .
+RUN mkdir -p /data && chown 65532:65532 /data
+ENV HOST=0.0.0.0 \
+    AIMARKET_PROVIDER_IDENTITY_FILE=/data/provider.key \
+    PYTHONDONTWRITEBYTECODE=1 \
+    PYTHONUNBUFFERED=1
+USER 65532:65532
+VOLUME ["/data"]
+EXPOSE 8080
+HEALTHCHECK --interval=30s --timeout=5s --start-period=10s --retries=3 \
+  CMD python -c "import urllib.request; urllib.request.urlopen('http://127.0.0.1:8080/health', timeout=3).read()"
+CMD ["python", "agent.py"]

create_aimarket_agent-0.1.0/src/create_aimarket_agent/templates/base/Makefile

@@ -0,0 +1,16 @@
+.PHONY: configure dev test validate publish-dry-run
+
+configure:
+	uv run python configure_provider.py
+
+dev: configure
+	uv run python agent.py
+
+test:
+	uv run pytest -q
+
+validate: configure
+	uv run python validate_manifest.py
+
+publish-dry-run: validate
+	@echo "Dry run only: aimarket publish capability.json --hub $${AIMARKET_HUB_URL:-http://127.0.0.1:9083}"

create_aimarket_agent-0.1.0/src/create_aimarket_agent/templates/base/README.md

@@ -0,0 +1,27 @@
+# __PROJECT_NAME__
+
+Generated AIMarket Protocol v2 `__AGENT_KIND__` provider.
+
+```bash
+uv sync --extra dev
+uv run python configure_provider.py
+uv run pytest
+uv run python agent.py
+make validate
+make publish-dry-run
+```
+
+Validate `capability.json`, then publish deliberately with the AIMarket Hub CLI. Never commit `.env`.
+
+The Ed25519 provider key lives in `.aimarket/provider.key` and is gitignored. Back it up: changing
+it after publish invalidates the `provider_pubkey` registered with the Hub. The provider accepts
+only the `product_id` and `capability_id` declared in `capability.json`; never replace that check
+with caller-selected signing identity. The validator rejects ambiguous JSON, malformed Ed25519
+keys, non-finite prices, and public HTTP invoke URLs.
+
+The Dockerfile is a development image; mount the same key as a secret before containerizing a
+published provider. Keep the container port private until an HTTPS ingress adds production traffic,
+concurrency, and rate limits. The generated endpoint authenticates its output with a signature; it
+does not authenticate or bill clients that bypass Hub.
+Responses use the replay-resistant AIMarket request-bound signature, covering the capability,
+product, SHA-256 of the exact input, and result. Keep those request fields when extending `agent.py`.

create_aimarket_agent-0.1.0/src/create_aimarket_agent/templates/base/agent.py

@@ -0,0 +1,81 @@
+"""Minimal AIMarket capability provider generated by create-aimarket-agent."""
+from __future__ import annotations
+
+import hmac
+import os
+from fastapi import FastAPI, Request
+from fastapi.responses import JSONResponse
+from pydantic import BaseModel, Field
+
+from provider_signing import ProviderSigner
+
+app = FastAPI(
+    title="__PROJECT_NAME__",
+    docs_url=None,
+    redoc_url=None,
+    openapi_url=None,
+)
+METIS_ENABLED = __METIS_PYTHON__
+SIGNER = ProviderSigner()
+PRODUCT_ID = "__PROJECT_SLUG__"
+CAPABILITY_ID = "__PROJECT_SLUG__.invoke@v1"
+
+
+class InvokeInput(BaseModel):
+    input: dict = Field(default_factory=dict)
+    product_id: str = Field(default=PRODUCT_ID, max_length=128)
+    capability_id: str = Field(default=CAPABILITY_ID, max_length=192)
+
+
+@app.middleware("http")
+async def request_boundary(request: Request, call_next):
+    response = None
+    if request.method == "POST" and request.url.path == "/invoke":
+        raw_length = request.headers.get("content-length")
+        try:
+            length = int(raw_length) if raw_length is not None else -1
+        except ValueError:
+            length = -1
+        if length < 0 or length > 1_048_576:
+            response = JSONResponse({"detail": "request body must be 0-1048576 bytes"}, status_code=413)
+    if response is None:
+        response = await call_next(request)
+    response.headers["Cache-Control"] = "no-store"
+    response.headers["X-Content-Type-Options"] = "nosniff"
+    response.headers["Referrer-Policy"] = "no-referrer"
+    response.headers["X-Frame-Options"] = "DENY"
+    return response
+
+
+@app.get("/health")
+def health() -> dict:
+    return {"ok": True, "agent": "__PROJECT_SLUG__", "kind": "__AGENT_KIND__",
+            "provider_pubkey": SIGNER.public_key_b64}
+
+
+@app.post("/invoke")
+def invoke(request: InvokeInput) -> JSONResponse:
+    # Identity belongs to capability.json, not to an untrusted caller. Allowing
+    # arbitrary identifiers here would turn this key into a signing oracle for
+    # another product or capability that happens to reuse the provider key.
+    if not hmac.compare_digest(request.product_id, PRODUCT_ID):
+        return JSONResponse({"detail": "product_id does not match this provider"}, status_code=400)
+    if not hmac.compare_digest(request.capability_id, CAPABILITY_ID):
+        return JSONResponse({"detail": "capability_id does not match this provider"}, status_code=400)
+    # Replace this deterministic example with your capability logic.
+    result = {"message": "Hello from __PROJECT_NAME__", "received": request.input,
+              "verification_requested": METIS_ENABLED}
+    return JSONResponse(
+        {"success": True, "result": result},
+        headers={"X-Provider-Signature": SIGNER.sign_result(
+            result,
+            capability_id=CAPABILITY_ID,
+            product_id=PRODUCT_ID,
+            input_payload=request.input,
+        )},
+    )
+
+
+if __name__ == "__main__":
+    import uvicorn
+    uvicorn.run(app, host=os.getenv("HOST", "127.0.0.1"), port=int(os.getenv("PORT", "8080")))

create_aimarket_agent-0.1.0/src/create_aimarket_agent/templates/base/capability.json

@@ -0,0 +1,13 @@
+{
+  "product_id": "__PROJECT_SLUG__",
+  "capability_id": "__PROJECT_SLUG__.invoke@v1",
+  "name": "__PROJECT_NAME__",
+  "description": "A generated AIMarket __AGENT_KIND__ capability",
+  "invoke_url": "http://127.0.0.1:8080/invoke",
+  "publisher_id": "community",
+  "provider_pubkey": "",
+  "price_per_call_usd": 0.001,
+  "input_schema": {"type": "object", "additionalProperties": true},
+  "output_schema": {"type": "object", "additionalProperties": true},
+  "verification": {"metis": __METIS_ENABLED__}
+}

create_aimarket_agent-0.1.0/src/create_aimarket_agent/templates/base/configure_provider.py

@@ -0,0 +1,22 @@
+from __future__ import annotations
+
+import json
+from pathlib import Path
+
+from provider_signing import ProviderSigner
+
+
+def main() -> int:
+    signer = ProviderSigner()
+    path = Path("capability.json")
+    manifest = json.loads(path.read_text(encoding="utf-8"))
+    manifest["provider_pubkey"] = signer.public_key_b64
+    temporary = path.with_suffix(".json.tmp")
+    temporary.write_text(json.dumps(manifest, ensure_ascii=False, indent=2) + "\n", encoding="utf-8")
+    temporary.replace(path)
+    print(f"provider identity ready: {signer.public_key_b64}")
+    return 0
+
+
+if __name__ == "__main__":
+    raise SystemExit(main())