fix: add ajv-formats dep to suppress uri format warning

.changeset/fix-291-ajv-formats.md

@@ -0,0 +1,10 @@
+---
+"@wasmagent/agentbom-core": patch
+---
+
+fix: add ajv-formats dependency to suppress "unknown format uri ignored" warning (#291)
+
+Registers ajv-formats with the AJV 2020 instance so that the `uri` format keyword
+in the AgentBOM schema is enforced instead of being silently ignored.
+Previously, AJV logged "unknown format \"uri\" ignored" twice per `validateAgentBOM()`
+call, polluting startup logs in production.

packages/agentbom-core/package.json

@@ -25,7 +25,8 @@
   },
   "dependencies": {
     "@wasmagent/protocol": "^0.1.7",
-    "ajv": "^8.20.0"
+    "ajv": "^8.20.0",
+    "ajv-formats": "^3.0.1"
   },
   "devDependencies": {
     "@types/bun": "^1.3.14",

packages/agentbom-core/src/index.test.ts

@@ -92,6 +92,31 @@ describe("validateAgentBOM", () => {
     expect(result.errorDetails.length).toBeGreaterThan(0);
     expect(result.errorDetails[0].field).toBe("(root)");
   });
+
+  // Test for #291 — ajv-formats must be registered so that uri format validation
+  // works without emitting "unknown format "uri" ignored" warnings.
+  it("validates distribution.registry_uri as a URI format (ajv-formats registered)", () => {
+    // Valid URI — should pass
+    const validResult = validateAgentBOM({
+      ...VALID_AGENTBOM,
+      distribution: { registry_uri: "https://registry.example.com/agents" },
+    });
+    expect(validResult.valid).toBe(true);
+    expect(validResult.errors).toHaveLength(0);
+
+    // Invalid URI — should fail with a format error (not silently ignored)
+    const invalidResult = validateAgentBOM({
+      ...VALID_AGENTBOM,
+      distribution: { registry_uri: "not-a-valid-uri!!!" },
+    });
+    // With ajv-formats registered, AJV enforces the uri format constraint.
+    // Without it, the invalid uri would silently pass — that was the bug (#291).
+    expect(invalidResult.valid).toBe(false);
+    const formatErr = invalidResult.errorDetails.find(
+      (e) => e.keyword === "format" && e.field.includes("registry_uri"),
+    );
+    expect(formatErr).toBeDefined();
+  });
 });
 
 const BASE_BOM = {

packages/agentbom-core/src/index.ts

@@ -1,6 +1,7 @@
 import { getSchema } from "@wasmagent/protocol";
 import type { ErrorObject, ValidateFunction } from "ajv";
 import Ajv2020 from "ajv/dist/2020.js";
+import addFormats from "ajv-formats";
 
 export interface ValidationError {
   /** Dot-notation path to the offending field, e.g. "identity.agent_id". "(root)" for the document itself. */
@@ -25,6 +26,9 @@ let validateSchema: ValidateFunction | null = null;
 function getValidator(): ValidateFunction {
   if (validateSchema) return validateSchema;
   const ajv = new Ajv2020({ allErrors: true, strict: false });
+  // Register ajv-formats so that format keywords like "uri", "email", etc.
+  // are validated instead of silently ignored.
+  addFormats(ajv);
   const schema = getSchema("agentbom");
   validateSchema = ajv.compile(schema as import("ajv").AnySchema);
   if (!validateSchema) throw new Error("Failed to compile AgentBOM schema");