[epistemedeus]

Valid object schemas containing format: "uri" are currently saved as description strings by offering create and offering update. The shared Ajv instance has no standard formats registered, and parseSchemaOrString catches compilation errors together with JSON syntax errors. Invalid object schemas can therefore also silently reach the API as strings.

Register ajv-formats as a direct runtime dependency and let object-schema compilation errors propagate. Validate requirements and deliverable flags before authentication or owner HTTP requests, then reuse those parsed values. Nonempty descriptions and existing scalar/array string behavior are preserved; format constraints remain in the submitted schema. The shared validator also serves interactive schema input and resource params.

Reproducible schema:

{
  "type": "object",
  "additionalProperties": false,
  "required": ["url"],
  "properties": {
    "url": { "type": "string", "format": "uri" },
    "method": { "type": "string", "enum": ["GET", "POST"], "default": "GET" }
  }
}

The new offline tests exercise the real Commander actions, shared compiler, AgentApi and ApiClient serialization with fake identity/configuration and HTTP. All four create/update and requirements/deliverable combinations send the URI schema as an object. The emitted schema accepts GET/POST, rejects missing URL, invalid URI, unsupported method and extra properties. Invalid schema objects and whitespace fail before any owner request; description, malformed-JSON text, scalar and array inputs retain their existing string behavior. The original source fails 19 of these 49 tests; the fix passes all 49.

Validation:

• npm ci --ignore-scripts --no-audit --no-fund
• npm run test:offering-schema (49 passed)
• npm run typecheck
• npm run build
• npm exec -- tsx scripts/tradeLoopSign.test.ts (3 passed)
• git diff --check

The lockfile update also fills its missing optional utf-8-validate peer entry so clean npm ci works. Tests use no live ACP endpoint or credentials.

---

Note

Medium Risk
Changes how offering requirements/deliverable flags are interpreted and validated before API calls; invalid object schemas now error instead of being saved as strings, which is correct but may break scripts that relied on the old silent fallback.

Overview
Fixes offering create / offering update so JSON object flags for requirements and deliverable are stored as schemas instead of silently falling back to plain strings when Ajv cannot compile them (e.g. format: "uri").

ajv-formats is added and wired in validateJsonSchema, enabling standard formats (uri, email, date-time, etc.). parseSchemaOrString now treats any parsed JSON object as an intended schema and surfaces compilation errors; invalid schemas and whitespace-only values fail before auth/owner HTTP. parseSchemaFlags centralizes flag parsing and runs at the start of create/update. Plain-text, malformed JSON, and scalar/array JSON inputs still behave as descriptions.

Adds npm run test:offering-schema with offline Commander/API tests (49 cases). README documents schema formats and early validation. Lockfile adds the missing optional utf-8-validate peer for clean npm ci.

^{Reviewed by Cursor Bugbot for commit 1472bfb. Bugbot is set up for automated code reviews on this repo. Configure here.}