@datalayer/agent-runtimes 1.3.112 → 1.3.114

package/lib/apps/apps/appspec.js

@@ -196,6 +196,8 @@ const KNOWN_KEYS = [
     'contents',
     'connections',
     'pap',
+    'pact',
+    'a2a',
     'rules',
     'permissions',
     'interface',
@@ -312,6 +314,50 @@ function dumpPap(pap) {
         .text('summary', operation.summary, '\u0000')
         .value('user_approval_required', operation.userApprovalRequired, true).data)).data).data;
 }
+/** PACT (AGENT_PROTOCOLS PI-01): the businesses it asks for each person. */
+function parsePact(data) {
+    return {
+        connections: records(data.connections).map(connection => ({
+            id: text(connection.id),
+            brand: text(connection.brand),
+            audience: text(connection.audience),
+            access: oneOf(connection.access, ['read', 'write'], 'read'),
+            scopes: texts(connection.scopes),
+        })),
+    };
+}
+/** PACT as its document says it, nothing at its default. */
+function dumpPact(pact) {
+    if (!pact)
+        return {};
+    return new Writer().list('connections', pact.connections.map(connection => new Writer()
+        .text('id', connection.id, '\u0000')
+        .text('brand', connection.brand, '\u0000')
+        .text('audience', connection.audience, '\u0000')
+        .value('access', connection.access, 'read')
+        .list('scopes', connection.scopes).data)).data;
+}
+/** A2A (AGENT_PROTOCOLS PR-02): the extensions its Agent Card advertises. */
+function parseA2A(data) {
+    return {
+        extensions: records(data.extensions).map(extension => ({
+            uri: text(extension.uri),
+            description: text(extension.description),
+            required: flag(extension.required, false),
+            params: isData(extension.params) ? { ...extension.params } : {},
+        })),
+    };
+}
+/** A2A as its document says it, nothing at its default. */
+function dumpA2A(a2a) {
+    if (!a2a)
+        return {};
+    return new Writer().list('extensions', a2a.extensions.map(extension => new Writer()
+        .text('uri', extension.uri, '\u0000')
+        .text('description', extension.description)
+        .value('required', extension.required, false)
+        .part('params', extension.params).data)).data;
+}
 function parseRule(data) {
     return {
         action: text(data.action),
@@ -842,6 +888,12 @@ export function parseAppspec(document) {
     if (isData(data.pap)) {
         app.pap = parsePap(data.pap);
     }
+    if (isData(data.pact)) {
+        app.pact = parsePact(data.pact);
+    }
+    if (isData(data.a2a)) {
+        app.a2a = parseA2A(data.a2a);
+    }
     return { app, problems };
 }
 // --- writing --------------------------------------------------------------------------
@@ -1097,6 +1149,8 @@ export function dumpAppspec(app) {
         .value('as', connection.as, 'owner')
         .list('only', connection.only).data))
         .part('pap', dumpPap(app.pap))
+        .part('pact', dumpPact(app.pact))
+        .part('a2a', dumpA2A(app.a2a))
         .list('rules', app.rules.map(rule => ({
         action: rule.action,
         // One target is written alone when it is a class, as a person would.

package/lib/protocols/agentic-commerce/index.d.ts

@@ -19,15 +19,11 @@ import { AGENTIC_COMMERCE_VERSION } from './models';
 export { AGENTIC_COMMERCE_VERSION };
 export declare const DISCOVERY_PATH = "/.well-known/acp.json";
 export declare const AGENTIC_COMMERCE_PLUGIN = "agent-runtimes.protocols.agentic-commerce";
-/** Each operation's action class (F-10), for Rules (R-05). */
-export declare const AGENTIC_COMMERCE_ACTION_CLASSES: {
-    readonly proposeCompletion: "read";
-    readonly getCheckout: "read";
-    readonly createCheckout: "write";
-    readonly updateCheckout: "write";
-    readonly cancelCheckout: "write";
-    readonly complete: "buy";
-};
+/**
+ * Each operation's action class (F-10), for Rules (R-05): agentspecs'
+ * `protocol-tools/agentic-commerce.yaml` (AGENT_PROTOCOLS PR-54).
+ */
+export declare const AGENTIC_COMMERCE_ACTION_CLASSES: Record<string, import("../../types").ActionClass>;
 export declare class AgenticCommerceError extends Error {
 }
 type Json = Record<string, any>;

package/lib/protocols/agentic-commerce/index.js

@@ -17,21 +17,17 @@
  * @module protocols/agentic-commerce
  */
 import { contribution, defineContributionPoint, definePlugin, } from '@datalayer/reactor';
-import { InMemoryProposalStore, digest, } from '../commerce';
+import { InMemoryProposalStore, digest, operationClasses, } from '../commerce';
 import { DEFAULT_ORDER, ProtocolDescriptions, firstContribution, } from '../core';
 import { AGENTIC_COMMERCE_VERSION } from './models';
 export { AGENTIC_COMMERCE_VERSION };
 export const DISCOVERY_PATH = '/.well-known/acp.json';
 export const AGENTIC_COMMERCE_PLUGIN = 'agent-runtimes.protocols.agentic-commerce';
-/** Each operation's action class (F-10), for Rules (R-05). */
-export const AGENTIC_COMMERCE_ACTION_CLASSES = {
-    proposeCompletion: 'read',
-    getCheckout: 'read',
-    createCheckout: 'write',
-    updateCheckout: 'write',
-    cancelCheckout: 'write',
-    complete: 'buy',
-};
+/**
+ * Each operation's action class (F-10), for Rules (R-05): agentspecs'
+ * `protocol-tools/agentic-commerce.yaml` (AGENT_PROTOCOLS PR-54).
+ */
+export const AGENTIC_COMMERCE_ACTION_CLASSES = operationClasses('agentic-commerce');
 export class AgenticCommerceError extends Error {
 }
 export const AgenticCommerceApprovers = defineContributionPoint('agentic_commerce.approver');

package/lib/protocols/commerce.d.ts

@@ -1,14 +1,13 @@
+import type { ActionClass } from '../types/agentspecs';
+type Json = Record<string, any>;
 /**
- * What every commerce protocol shares (AGENT_PROTOCOLS §3, one approval
- * model) — the twin of `agent_runtimes.protocols.commerce`. A purchase over
- * UCP or the Agentic Commerce Protocol is an exact, revisioned
- * {@link CheckoutProposal}, approved by the person through the host's
- * {@link CheckoutApprover} (contributed to each plugin's `<protocol>.approver`),
- * and completed once ({@link ProposalStore}).
- *
- * @module protocols/commerce
+ * Each operation's action class (F-10) for Rules (R-05), as agentspecs
+ * classes a protocol's tools (`protocol-tools/<protocol>.yaml`,
+ * AGENT_PROTOCOLS PR-54), named as the TypeScript client names them
+ * (`complete_checkout` → `completeCheckout`). A commerce operation does one
+ * thing: one with several classes, or none, throws rather than guess.
  */
-type Json = Record<string, any>;
+export declare function operationClasses(protocol: string): Record<string, ActionClass>;
 /** One exact purchase, proposed to a person before it is made. */
 export interface CheckoutProposal {
     id: string;

package/lib/protocols/commerce.js

@@ -2,6 +2,35 @@
  * Copyright (c) 2025-2026 Datalayer, Inc.
  * Distributed under the terms of the Modified BSD License.
  */
+/**
+ * What every commerce protocol shares (AGENT_PROTOCOLS §3, one approval
+ * model) — the twin of `agent_runtimes.protocols.commerce`. A purchase over
+ * UCP or the Agentic Commerce Protocol is an exact, revisioned
+ * {@link CheckoutProposal}, approved by the person through the host's
+ * {@link CheckoutApprover} (contributed to each plugin's `<protocol>.approver`),
+ * and completed once ({@link ProposalStore}).
+ *
+ * @module protocols/commerce
+ */
+import { PROTOCOL_TOOL_CLASSES } from '../specs/actions';
+/**
+ * Each operation's action class (F-10) for Rules (R-05), as agentspecs
+ * classes a protocol's tools (`protocol-tools/<protocol>.yaml`,
+ * AGENT_PROTOCOLS PR-54), named as the TypeScript client names them
+ * (`complete_checkout` → `completeCheckout`). A commerce operation does one
+ * thing: one with several classes, or none, throws rather than guess.
+ */
+export function operationClasses(protocol) {
+    const out = {};
+    for (const [name, classes] of Object.entries(PROTOCOL_TOOL_CLASSES[protocol].tools)) {
+        if (classes.length !== 1) {
+            throw new Error(`${protocol} ${name} is classed ${classes}: one class each`);
+        }
+        out[name.replace(/_([a-z])/g, (_, c) => c.toUpperCase())] =
+            classes[0];
+    }
+    return out;
+}
 /** A proposal in words, for the person and the model: never a credential. */
 export function proposalSummary(proposal) {
     const items = proposal.lines

package/lib/protocols/pact/index.d.ts

@@ -133,6 +133,8 @@ export declare class PactPersonalAgent {
     }): Promise<Reply | StepUp>;
     private verifyReceipt;
     requestSignIn(user: string, scopes: string[]): Promise<SignIn>;
+    /** Ask once whether the person approved: the scopes granted, or `undefined` while pending. */
+    pollSignIn(user: string, signIn: SignIn): Promise<string[] | undefined>;
     /** Poll until the person approved; the scopes they actually granted. */
     finishSignIn(user: string, signIn: SignIn, intervalMs?: number, attempts?: number): Promise<string[]>;
 }

package/lib/protocols/pact/index.js

@@ -315,42 +315,48 @@ export class PactPersonalAgent {
             reference,
         };
     }
-    /** Poll until the person approved; the scopes they actually granted. */
-    async finishSignIn(user, signIn, intervalMs = 5000, attempts = 120) {
+    /** Ask once whether the person approved: the scopes granted, or `undefined` while pending. */
+    async pollSignIn(user, signIn) {
         const card = this.card;
         const deviceCode = this.pending.get(signIn.reference);
         if (!deviceCode) {
             throw new PactError('no sign-in pending under this reference');
         }
+        const answer = await this.fetch(card.delegation.tokenUrl, {
+            method: 'POST',
+            headers: {
+                Authorization: `Bearer ${await this.jwt(user)}`,
+                'Content-Type': 'application/x-www-form-urlencoded',
+            },
+            body: new URLSearchParams({
+                grant_type: DEVICE_CODE_GRANT,
+                device_code: deviceCode,
+                client_id: this.options.issuer,
+            }).toString(),
+        });
+        const body = await answer.json();
+        if (body.error === 'authorization_pending' || body.error === 'slow_down') {
+            return undefined;
+        }
+        if (body.error) {
+            this.pending.delete(signIn.reference);
+            throw new PactError(`the sign-in ended: ${body.error}`);
+        }
+        const granted = String(body.scope ?? '')
+            .split(' ')
+            .filter(Boolean);
+        await this.delegations().put(card.interfaceUrl, user, body.access_token, granted);
+        this.pending.delete(signIn.reference);
+        return granted;
+    }
+    /** Poll until the person approved; the scopes they actually granted. */
+    async finishSignIn(user, signIn, intervalMs = 5000, attempts = 120) {
         for (let i = 0; i < attempts; i++) {
-            const answer = await this.fetch(card.delegation.tokenUrl, {
-                method: 'POST',
-                headers: {
-                    Authorization: `Bearer ${await this.jwt(user)}`,
-                    'Content-Type': 'application/x-www-form-urlencoded',
-                },
-                body: new URLSearchParams({
-                    grant_type: DEVICE_CODE_GRANT,
-                    device_code: deviceCode,
-                    client_id: this.options.issuer,
-                }).toString(),
-            });
-            const body = await answer.json();
-            if (body.error === 'authorization_pending' ||
-                body.error === 'slow_down') {
-                await new Promise(resolve => setTimeout(resolve, intervalMs));
-                continue;
+            const granted = await this.pollSignIn(user, signIn);
+            if (granted) {
+                return granted;
             }
-            if (body.error) {
-                this.pending.delete(signIn.reference);
-                throw new PactError(`the sign-in ended: ${body.error}`);
-            }
-            const granted = String(body.scope ?? '')
-                .split(' ')
-                .filter(Boolean);
-            await this.delegations().put(card.interfaceUrl, user, body.access_token, granted);
-            this.pending.delete(signIn.reference);
-            return granted;
+            await new Promise(resolve => setTimeout(resolve, intervalMs));
         }
         throw new PactError('the person did not sign in in time');
     }

package/lib/protocols/ucp/index.d.ts

@@ -18,16 +18,11 @@ export declare const SHOPPING_SERVICE = "dev.ucp.shopping";
 export declare const CHECKOUT_CAPABILITY = "dev.ucp.shopping.checkout";
 export declare const PROFILE_PATH = "/.well-known/ucp";
 export declare const UCP_PLUGIN = "agent-runtimes.protocols.ucp";
-/** Each operation's action class (F-10), for Rules (R-05). */
-export declare const UCP_ACTION_CLASSES: {
-    readonly search: "read";
-    readonly proposeCompletion: "read";
-    readonly getCheckout: "read";
-    readonly createCheckout: "write";
-    readonly updateCheckout: "write";
-    readonly cancelCheckout: "write";
-    readonly complete: "buy";
-};
+/**
+ * Each operation's action class (F-10), for Rules (R-05): agentspecs'
+ * `protocol-tools/ucp.yaml` (AGENT_PROTOCOLS PR-54).
+ */
+export declare const UCP_ACTION_CLASSES: Record<string, import("../../types").ActionClass>;
 export { InMemoryProposalStore, proposalSummary, type CheckoutApprover, type CheckoutProposal, type ProposalStore, } from '../commerce';
 export declare class UcpError extends Error {
 }

package/lib/protocols/ucp/index.js

@@ -17,23 +17,18 @@
  */
 import { contribution, defineContributionPoint, definePlugin, } from '@datalayer/reactor';
 import { ExtendedCheckoutResponseSchema } from '@ucp-js/sdk';
-import { InMemoryProposalStore, digest, } from '../commerce';
+import { InMemoryProposalStore, digest, operationClasses, } from '../commerce';
 import { DEFAULT_ORDER, ProtocolDescriptions, firstContribution, } from '../core';
 export const UCP_VERSION = '2026-08-25';
 export const SHOPPING_SERVICE = 'dev.ucp.shopping';
 export const CHECKOUT_CAPABILITY = 'dev.ucp.shopping.checkout';
 export const PROFILE_PATH = '/.well-known/ucp';
 export const UCP_PLUGIN = 'agent-runtimes.protocols.ucp';
-/** Each operation's action class (F-10), for Rules (R-05). */
-export const UCP_ACTION_CLASSES = {
-    search: 'read',
-    proposeCompletion: 'read',
-    getCheckout: 'read',
-    createCheckout: 'write',
-    updateCheckout: 'write',
-    cancelCheckout: 'write',
-    complete: 'buy',
-};
+/**
+ * Each operation's action class (F-10), for Rules (R-05): agentspecs'
+ * `protocol-tools/ucp.yaml` (AGENT_PROTOCOLS PR-54).
+ */
+export const UCP_ACTION_CLASSES = operationClasses('ucp');
 export { InMemoryProposalStore, proposalSummary, } from '../commerce';
 export class UcpError extends Error {
 }

package/lib/protocols/web-bot-auth/index.js

@@ -122,7 +122,7 @@ export async function signRequest(request, signer, options) {
         label,
         nonce: options.nonce ?? generateNonce(),
         signatureAgentKey: label,
-        additionalComponents: (options.components ?? ['@method', '@path']).filter(name => name !== '@authority'),
+        additionalComponents: (options.components ?? ['@method', '@path', '@query']).filter(name => name !== '@authority'),
     });
     return {
         'Signature-Agent': agentHeader,

package/lib/specs/actions.d.ts

@@ -17,6 +17,14 @@ export declare const BACKEND_TOOL_ACTIONS: Record<string, ActionClass[]>;
  * names were read off the running server; absent when nobody looked.
  */
 export declare const SERVER_ACTIONS: Record<string, ServerActionsSpec>;
+/**
+ * What each agent protocol's tools do, by protocol id: the prefix its
+ * connections take (`pap:<domain>`) and each tool's classes (PR-54).
+ */
+export declare const PROTOCOL_TOOL_CLASSES: Record<string, {
+    connection: string;
+    tools: Record<string, ActionClass[]>;
+}>;
 /**
  * What each application of the catalogue does about each classed tool of the
  * servers it connects to, as agentspecs decides it. What the rules engine has

package/lib/specs/actions.js

@@ -663,6 +663,60 @@ export const SERVER_ACTIONS = {
         signs: {},
     },
 };
+/**
+ * What each agent protocol's tools do, by protocol id: the prefix its
+ * connections take (`pap:<domain>`) and each tool's classes (PR-54).
+ */
+export const PROTOCOL_TOOL_CLASSES = {
+    'agentic-commerce': {
+        connection: 'acp',
+        tools: {
+            propose_completion: ['read'],
+            get_checkout: ['read'],
+            create_checkout: ['write'],
+            update_checkout: ['write'],
+            cancel_checkout: ['write'],
+            complete: ['buy'],
+        },
+    },
+    pact: {
+        connection: 'pact',
+        tools: {
+            pact_brand: ['read'],
+            pact_ask: ['read'],
+            pact_sign_in: ['read'],
+            pact_sign_in_status: ['read'],
+            pact_ask_for_person: ['write'],
+            pact_disconnect: ['write'],
+        },
+    },
+    pap: {
+        connection: 'pap',
+        tools: {
+            pap_company: ['read'],
+            pap_ask: ['read'],
+            pap_sign_in: ['read'],
+            pap_sign_in_status: ['read'],
+            pap_read: ['read'],
+            pap_mcp_tools: ['read'],
+            pap_mcp_call: ['write'],
+            pap_confirm: ['write', 'buy'],
+            pap_disconnect: ['write'],
+        },
+    },
+    ucp: {
+        connection: 'ucp',
+        tools: {
+            search: ['read'],
+            propose_completion: ['read'],
+            get_checkout: ['read'],
+            create_checkout: ['write'],
+            update_checkout: ['write'],
+            cancel_checkout: ['write'],
+            complete: ['buy'],
+        },
+    },
+};
 /**
  * What each application of the catalogue does about each classed tool of the
  * servers it connects to, as agentspecs decides it. What the rules engine has
@@ -922,6 +976,7 @@ export const APP_BEHAVIOURS = {
     'ship-or-fix': {},
     'supplier-comparison': {},
     'support-desk': {},
+    'travel-desk': {},
     'web-research': {
         'tavily.tavily_crawl': 'do_it',
         'tavily.tavily_extract': 'do_it',
@@ -988,5 +1043,6 @@ export const APP_ESCALATIONS = {
     'ship-or-fix': {},
     'supplier-comparison': {},
     'support-desk': {},
+    'travel-desk': {},
     'web-research': {},
 };

package/lib/specs/apps.d.ts

@@ -28,6 +28,7 @@ export declare const SALES_APP_0_0_1: AppSpec;
 export declare const SHIP_OR_FIX_APP_0_0_1: AppSpec;
 export declare const SUPPLIER_COMPARISON_APP_0_0_1: AppSpec;
 export declare const SUPPORT_DESK_APP_0_0_1: AppSpec;
+export declare const TRAVEL_DESK_APP_0_0_1: AppSpec;
 export declare const WEB_RESEARCH_APP_0_0_1: AppSpec;
 export declare const APP_CATALOGUE: Record<string, AppSpec>;
 /** An application, by `id` or `id:version`, or undefined. */