@datalayer/agent-runtimes 1.3.114 → 1.5.0

package/lib/config/AgentConfiguration.d.ts

@@ -29,7 +29,7 @@ export interface LibraryAgentspec {
     welcomeDocument?: string | null;
     sandboxVariant?: string | null;
     protocol?: string | null;
-    uiPlugin?: string | null;
+    ui?: string | null;
     trigger?: Record<string, unknown> | null;
     modelConfig?: Record<string, unknown> | null;
     mcpServerTools?: Array<Record<string, unknown>> | null;

package/lib/examples/ProtocolSignedRequestsExample.d.ts

@@ -0,0 +1,10 @@
+/**
+ * Signed requests (Web Bot Auth) in the browser (AGENT_PROTOCOLS EX-10): a
+ * key generated in the page signs one request; the page shows the three
+ * headers, the signature base the key signed, and what a website's check
+ * finds — verified, then the same request replayed and one with its path
+ * changed, both refused. The key never leaves the page and is never shown.
+ */
+import React from 'react';
+declare const ProtocolSignedRequestsExample: React.FC;
+export default ProtocolSignedRequestsExample;

package/lib/examples/ProtocolSignedRequestsExample.js

@@ -0,0 +1,41 @@
+import { jsx as _jsx, jsxs as _jsxs, Fragment as _Fragment } from "react/jsx-runtime";
+/*
+ * Copyright (c) 2025-2026 Datalayer, Inc.
+ * Distributed under the terms of the Modified BSD License.
+ */
+/**
+ * Signed requests (Web Bot Auth) in the browser (AGENT_PROTOCOLS EX-10): a
+ * key generated in the page signs one request; the page shows the three
+ * headers, the signature base the key signed, and what a website's check
+ * finds — verified, then the same request replayed and one with its path
+ * changed, both refused. The key never leaves the page and is never shown.
+ */
+import { useCallback, useEffect, useState } from 'react';
+import { Box, setupPrimerPortals } from '@datalayer/primer-addons';
+import { Button, Flash, Heading, Label, Text } from '@primer/react';
+import { ThemedProvider } from './utils/themedProvider';
+import { signedRequestDemo, } from './protocols/signedRequestsDemo';
+setupPrimerPortals();
+const Mono = ({ children, label, }) => (_jsxs(Box, { mb: 3, children: [_jsx(Text, { as: "div", sx: { fontWeight: 'semibold', fontSize: 1, mb: 1 }, children: label }), _jsx(Box, { as: "pre", p: 2, m: 0, bg: "canvas.subtle", borderRadius: 2, sx: { fontSize: 0, whiteSpace: 'pre-wrap', overflowWrap: 'anywhere' }, children: children })] }));
+const OUTCOME_VARIANT = {
+    verified: 'success',
+    invalid: 'danger',
+    unverified: 'attention',
+};
+const ProtocolSignedRequestsExample = () => {
+    const [demo, setDemo] = useState(null);
+    const [error, setError] = useState('');
+    const run = useCallback(() => {
+        setError('');
+        signedRequestDemo()
+            .then(setDemo)
+            .catch(failure => setError(String(failure?.message ?? failure)));
+    }, []);
+    useEffect(run, [run]);
+    return (_jsx(ThemedProvider, { children: _jsxs(Box, { p: 4, maxWidth: 880, mx: "auto", children: [_jsx(Heading, { as: "h2", sx: { fontSize: 3, mb: 1 }, children: "Signed requests" }), _jsx(Text, { as: "p", sx: { color: 'fg.muted', mt: 0 }, children: "Web Bot Auth (draft-ietf-webbotauth-httpsig-protocol-00): a key generated in this page signs a request to a shop; the shop checks it against the agent's key directory. The private key is never shown." }), _jsx(Button, { onClick: run, sx: { mb: 3 }, children: "Sign again with a new key" }), error ? _jsx(Flash, { variant: "danger", children: error }) : null, demo ? (_jsxs(_Fragment, { children: [_jsxs(Mono, { label: "Request", children: ["GET ", demo.url] }), _jsx(Mono, { label: "Signature-Agent", children: demo.headers['Signature-Agent'] }), _jsx(Mono, { label: "Signature-Input", children: demo.headers['Signature-Input'] }), _jsx(Mono, { label: "Signature", children: demo.headers.Signature }), _jsx(Mono, { label: "Signature base (what the key signed)", children: demo.base }), _jsx(Mono, { label: "Public key in the directory (keyid: its thumbprint)", children: JSON.stringify(demo.publicJwk, null, 2) }), _jsx(Box, { display: "grid", gap: 2, children: [
+                                ['The shop checks it', demo.verified],
+                                ['The same request again', demo.replayed],
+                                ['Its path changed', demo.tampered],
+                            ].map(([what, found]) => (_jsxs(Box, { display: "flex", gap: 2, alignItems: "baseline", children: [_jsx(Label, { variant: OUTCOME_VARIANT[found.outcome], children: found.outcome }), _jsxs(Text, { sx: { fontSize: 1 }, children: [what, found.reason ? `: ${found.reason}` : ''] })] }, what))) })] })) : null] }) }));
+};
+export default ProtocolSignedRequestsExample;

package/lib/examples/ProtocolUcpCheckoutExample.d.ts

@@ -0,0 +1,10 @@
+/**
+ * A UCP checkout approved as a card (AGENT_PROTOCOLS EX-10, after EX-04):
+ * the UCP client buys from *Example Store*, the local test merchant running
+ * in the page. The exact purchase is proposed; completing it asks the
+ * approver — the card below — once; approving buys once, and the same
+ * proposal is refused after. The test payment's token is never shown.
+ */
+import React from 'react';
+declare const ProtocolUcpCheckoutExample: React.FC;
+export default ProtocolUcpCheckoutExample;

package/lib/examples/ProtocolUcpCheckoutExample.js

@@ -0,0 +1,59 @@
+import { jsx as _jsx, jsxs as _jsxs } from "react/jsx-runtime";
+/*
+ * Copyright (c) 2025-2026 Datalayer, Inc.
+ * Distributed under the terms of the Modified BSD License.
+ */
+/**
+ * A UCP checkout approved as a card (AGENT_PROTOCOLS EX-10, after EX-04):
+ * the UCP client buys from *Example Store*, the local test merchant running
+ * in the page. The exact purchase is proposed; completing it asks the
+ * approver — the card below — once; approving buys once, and the same
+ * proposal is refused after. The test payment's token is never shown.
+ */
+import { useMemo, useRef, useState } from 'react';
+import { Box, setupPrimerPortals } from '@datalayer/primer-addons';
+import { Button, Flash, Heading, Text } from '@primer/react';
+import { ThemedProvider } from './utils/themedProvider';
+import { buy, proposeTea, ucpCheckoutDemo } from './protocols/ucpCheckoutDemo';
+setupPrimerPortals();
+const ProtocolUcpCheckoutExample = () => {
+    const answer = useRef(null);
+    const [asking, setAsking] = useState(false);
+    const demo = useMemo(() => ucpCheckoutDemo(() => new Promise(resolve => {
+        answer.current = resolve;
+        setAsking(true);
+    })), []);
+    const [proposal, setProposal] = useState(null);
+    const [said, setSaid] = useState([]);
+    const [working, setWorking] = useState(false);
+    const propose = async () => {
+        setWorking(true);
+        try {
+            setProposal(await proposeTea(demo));
+        }
+        catch (error) {
+            setSaid(s => [
+                ...s,
+                { ok: false, says: String(error.message) },
+            ]);
+        }
+        finally {
+            setWorking(false);
+        }
+    };
+    const complete = async () => {
+        if (!proposal)
+            return;
+        setWorking(true);
+        const outcome = await buy(demo, proposal.proposal);
+        setSaid(s => [...s, outcome]);
+        setWorking(false);
+    };
+    const decide = (approved) => {
+        setAsking(false);
+        answer.current?.(approved);
+        answer.current = null;
+    };
+    return (_jsx(ThemedProvider, { children: _jsxs(Box, { p: 4, maxWidth: 720, mx: "auto", children: [_jsx(Heading, { as: "h2", sx: { fontSize: 3, mb: 1 }, children: "UCP checkout" }), _jsx(Text, { as: "p", sx: { color: 'fg.muted', mt: 0 }, children: "Universal Commerce Protocol 2026-08-25, against Example Store, a test merchant running in this page. Nothing is bought without the card below, and a proposal buys once." }), _jsxs(Box, { display: "flex", gap: 2, mb: 3, flexWrap: "wrap", children: [_jsx(Button, { onClick: propose, disabled: working || asking, children: "Propose 2 \u00D7 Sencha green tea" }), _jsx(Button, { variant: "primary", onClick: complete, disabled: !proposal || working, children: "Complete the purchase" })] }), proposal && asking ? (_jsxs(Box, { p: 3, mb: 3, border: "1px solid", borderColor: "attention.emphasis", borderRadius: 2, role: "dialog", "aria-label": "Approve this purchase", children: [_jsx(Text, { as: "p", sx: { fontWeight: 'semibold', mt: 0 }, children: "Approve this purchase?" }), _jsx(Text, { as: "p", children: proposal.says }), _jsxs(Text, { as: "p", sx: { color: 'fg.muted', fontSize: 0 }, children: ["Revision ", proposal.proposal.revision.slice(0, 12), "\u2026 \u2014 if the basket changes, it is proposed again."] }), _jsxs(Box, { display: "flex", gap: 2, children: [_jsx(Button, { variant: "primary", onClick: () => decide(true), children: "Approve" }), _jsx(Button, { onClick: () => decide(false), children: "Decline" })] })] })) : proposal ? (_jsxs(Text, { as: "p", sx: { fontSize: 1 }, children: ["Proposed: ", proposal.says] })) : null, said.map((each, index) => (_jsx(Flash, { variant: each.ok ? 'success' : 'warning', sx: { mb: 2 }, children: each.says }, index))), _jsxs(Text, { as: "p", sx: { color: 'fg.muted', fontSize: 0 }, children: ["Orders at the store: ", demo.orders.length] })] }) }));
+};
+export default ProtocolUcpCheckoutExample;

package/lib/examples/example-selector.js

@@ -131,6 +131,8 @@ export const EXAMPLE_ENTRIES = [
     makeEntry('AgentSubagentsExample', () => import('./AgentSubagentsExample'), 'Multi-agent delegation with the in-repo subagents capability.'),
     makeEntry('AgentA2AExample', () => import('./AgentA2AExample'), 'Delegation to separate agents over the A2A protocol, launched locally or on Datalayer runtimes.'),
     makeEntry('AgentA2ATeamExample', () => import('./AgentA2ATeamExample'), 'Two applications as a team over A2A: Sales in the browser (@a2a-js/sdk) asks Accounting on a runtime (fasta2a, Odoo read only), each an Office Assistant character.'),
+    makeEntry('ProtocolSignedRequestsExample', () => import('./ProtocolSignedRequestsExample'), 'Web Bot Auth in the browser: a key made in the page signs a request — its three headers and the signature base — verified, then a replay and a changed path refused.'),
+    makeEntry('ProtocolUcpCheckoutExample', () => import('./ProtocolUcpCheckoutExample'), 'A UCP checkout at a test store in the page: the exact purchase proposed, approved on a card once, bought once.'),
     makeEntry('PapCompanyDiscoveryExample', () => import('./PapCompanyDiscoveryExample'), 'Validate a PAP company document and reduce it to the public capabilities safe for an agent or UI.'),
     makeEntry('PapAgentIdentityExample', () => import('./PapAgentIdentityExample'), 'Verify personal-agent client metadata and signing policy without exposing JWK coordinates.'),
     makeEntry('PapAuthorizationBoundaryExample', () => import('./PapAuthorizationBoundaryExample'), 'Generate real Session and Direct Sign-In security material while showing only safe policy status.'),

package/lib/examples/exampleGroups.d.ts

@@ -5,5 +5,5 @@
  *
  * @module examples/exampleGroups
  */
-export declare const EXAMPLE_GROUP_ORDER: readonly ["Apps", "Assistant", "A2UI", "A2A", "Personal Agent Protocol", "AG-UI", "Chat", "Document", "Notebook", "Capabilities", "Cell", "CopilotKit"];
+export declare const EXAMPLE_GROUP_ORDER: readonly ["Apps", "Assistant", "A2UI", "A2A", "Personal Agent Protocol", "Agent protocols", "AG-UI", "Chat", "Document", "Notebook", "Capabilities", "Cell", "CopilotKit"];
 export declare const getExampleGroup: (id: string) => string;

package/lib/examples/exampleGroups.js

@@ -15,6 +15,7 @@ export const EXAMPLE_GROUP_ORDER = [
     'A2UI',
     'A2A',
     'Personal Agent Protocol',
+    'Agent protocols',
     'AG-UI',
     'Chat',
     'Document',
@@ -39,6 +40,9 @@ export const getExampleGroup = (id) => {
         return 'A2A';
     if (id.startsWith('Pap'))
         return 'Personal Agent Protocol';
+    // The other agent protocols' examples: signed requests, commerce (AGENT_PROTOCOLS EX-10).
+    if (id.startsWith('Protocol'))
+        return 'Agent protocols';
     if (id.startsWith('AgUi'))
         return 'AG-UI';
     if (id.startsWith('CopilotKit'))

package/lib/examples/index.d.ts

@@ -27,6 +27,8 @@ export { default as AgentCodemodeExample } from './AgentCodemodeExample';
 export { default as AgentCodeSandboxesExample } from './AgentCodeSandboxesExample';
 export { default as AgentDecideExample } from './AgentDecideExample';
 export { default as AgentA2ATeamExample } from './AgentA2ATeamExample';
+export { default as ProtocolSignedRequestsExample } from './ProtocolSignedRequestsExample';
+export { default as ProtocolUcpCheckoutExample } from './ProtocolUcpCheckoutExample';
 export { default as PapCompanyDiscoveryExample } from './PapCompanyDiscoveryExample';
 export { default as PapAgentIdentityExample } from './PapAgentIdentityExample';
 export { default as PapAuthorizationBoundaryExample } from './PapAuthorizationBoundaryExample';

package/lib/examples/index.js

@@ -33,6 +33,8 @@ export { default as AgentCodemodeExample } from './AgentCodemodeExample';
 export { default as AgentCodeSandboxesExample } from './AgentCodeSandboxesExample';
 export { default as AgentDecideExample } from './AgentDecideExample';
 export { default as AgentA2ATeamExample } from './AgentA2ATeamExample';
+export { default as ProtocolSignedRequestsExample } from './ProtocolSignedRequestsExample';
+export { default as ProtocolUcpCheckoutExample } from './ProtocolUcpCheckoutExample';
 export { default as PapCompanyDiscoveryExample } from './PapCompanyDiscoveryExample';
 export { default as PapAgentIdentityExample } from './PapAgentIdentityExample';
 export { default as PapAuthorizationBoundaryExample } from './PapAuthorizationBoundaryExample';

package/lib/examples/protocols/signedRequestsDemo.d.ts

@@ -0,0 +1,27 @@
+/**
+ * The *Signed requests* gallery example's work (AGENT_PROTOCOLS EX-10): a
+ * fresh Ed25519 key generated in the page, one request signed with it
+ * (`signRequest`), the three headers and the signature base the signer was
+ * handed, then the request verified against the key's directory — and the
+ * same request replayed, and one with its path changed, both refused.
+ *
+ * The key never leaves the page and is never shown: only its public JWK and
+ * thumbprint are. No network: the directory is read from memory.
+ *
+ * @module examples/protocols/signedRequestsDemo
+ */
+import { type PublicJwk, type SignedHeaders, type Verification } from '../../protocols/web-bot-auth';
+export interface SignedRequestDemo {
+    /** The key's thumbprint, the `keyid` of the signature. */
+    keyid: string;
+    publicJwk: PublicJwk;
+    url: string;
+    headers: SignedHeaders;
+    /** The signature base, exactly as the signer signed it. */
+    base: string;
+    verified: Verification;
+    replayed: Verification;
+    tampered: Verification;
+}
+/** Sign one request with a fresh key, and verify it three ways. */
+export declare function signedRequestDemo(url?: string, agent?: string): Promise<SignedRequestDemo>;

package/lib/examples/protocols/signedRequestsDemo.js

@@ -0,0 +1,59 @@
+/*
+ * Copyright (c) 2025-2026 Datalayer, Inc.
+ * Distributed under the terms of the Modified BSD License.
+ */
+/**
+ * The *Signed requests* gallery example's work (AGENT_PROTOCOLS EX-10): a
+ * fresh Ed25519 key generated in the page, one request signed with it
+ * (`signRequest`), the three headers and the signature base the signer was
+ * handed, then the request verified against the key's directory — and the
+ * same request replayed, and one with its path changed, both refused.
+ *
+ * The key never leaves the page and is never shown: only its public JWK and
+ * thumbprint are. No network: the directory is read from memory.
+ *
+ * @module examples/protocols/signedRequestsDemo
+ */
+import { InMemoryNonceStore, generateLocalSigner, keyResolver, signRequest, verifyRequest, } from '../../protocols/web-bot-auth';
+/** A signer that keeps what it was asked to sign: the signature base. */
+function recording(signer) {
+    const bases = [];
+    return {
+        keyid: signer.keyid,
+        algorithm: signer.algorithm,
+        bases,
+        async sign(data) {
+            bases.push(new TextDecoder().decode(data));
+            return signer.sign(data);
+        },
+    };
+}
+/** Sign one request with a fresh key, and verify it three ways. */
+export async function signedRequestDemo(url = 'https://shop.example/products?q=tea', agent = 'https://agent.example') {
+    const { signer, publicJwk } = await generateLocalSigner();
+    const keeping = recording(signer);
+    const headers = await signRequest(new Request(url), keeping, { agent });
+    // The shop finds the agent's keys in its directory: here, in memory.
+    const resolver = keyResolver({
+        directory: { keys: async () => [publicJwk] },
+    });
+    const nonceStore = new InMemoryNonceStore();
+    const sent = (to) => new Request(to, { headers: { ...headers } });
+    const verified = await verifyRequest(sent(url), resolver, { nonceStore });
+    const replayed = await verifyRequest(sent(url), resolver, { nonceStore });
+    const changed = new URL(url);
+    changed.pathname = '/checkout';
+    const tampered = await verifyRequest(sent(changed.toString()), resolver, {
+        nonceStore: new InMemoryNonceStore(),
+    });
+    return {
+        keyid: signer.keyid,
+        publicJwk,
+        url,
+        headers,
+        base: keeping.bases[0] ?? '',
+        verified,
+        replayed,
+        tampered,
+    };
+}

package/lib/examples/protocols/ucpCheckoutDemo.d.ts

@@ -0,0 +1,36 @@
+/**
+ * The *UCP checkout* gallery example's work (AGENT_PROTOCOLS EX-10, after
+ * EX-04): the UCP client buying from *Example Store*, the local test
+ * merchant running in the page (`protocols/ucp/merchant`). A checkout is
+ * proposed as an exact, revisioned purchase; completing it asks the host's
+ * approver — the page's card — once, and the proposal is spent whatever the
+ * answer. The payment is the test handler's; its token is never shown.
+ *
+ * @module examples/protocols/ucpCheckoutDemo
+ */
+import { type ReactorPlatform } from '@datalayer/reactor';
+import { UcpClient, type CheckoutProposal } from '../../protocols/ucp';
+export declare const STORE = "https://store.example";
+export declare const AGENT_PROFILE = "https://agent.example/.well-known/ucp";
+/** The test payment's token: held by the host, never in a summary or a proposal. */
+export declare const TEST_TOKEN = "tok_test_gallery_never_shown";
+export interface UcpCheckoutDemo {
+    client: UcpClient;
+    reactor: ReactorPlatform;
+    orders: Array<{
+        order: string;
+        checkout: string;
+    }>;
+}
+/** The client, the store, and a host whose approver is `decide`. */
+export declare function ucpCheckoutDemo(decide: (proposal: CheckoutProposal) => Promise<boolean>): UcpCheckoutDemo;
+/** Find the tea, put `quantity` in a checkout with the buyer's email, and propose it. */
+export declare function proposeTea(demo: UcpCheckoutDemo, quantity?: number, email?: string): Promise<{
+    proposal: CheckoutProposal;
+    says: string;
+}>;
+/** Complete the proposal: the approver is asked; the order, or why not. */
+export declare function buy(demo: UcpCheckoutDemo, proposal: CheckoutProposal): Promise<{
+    ok: boolean;
+    says: string;
+}>;

package/lib/examples/protocols/ucpCheckoutDemo.js

@@ -0,0 +1,68 @@
+/*
+ * Copyright (c) 2025-2026 Datalayer, Inc.
+ * Distributed under the terms of the Modified BSD License.
+ */
+/**
+ * The *UCP checkout* gallery example's work (AGENT_PROTOCOLS EX-10, after
+ * EX-04): the UCP client buying from *Example Store*, the local test
+ * merchant running in the page (`protocols/ucp/merchant`). A checkout is
+ * proposed as an exact, revisioned purchase; completing it asks the host's
+ * approver — the page's card — once, and the proposal is spent whatever the
+ * answer. The payment is the test handler's; its token is never shown.
+ *
+ * @module examples/protocols/ucpCheckoutDemo
+ */
+import { contribution, definePlugin, } from '@datalayer/reactor';
+import { buildProtocolsReactor } from '../../protocols/agentProtocols';
+import { UcpApprovers, UcpClient, UcpPaymentInstruments, checkoutSummary, proposalSummary, } from '../../protocols/ucp';
+import { EXAMPLE_STORE_HANDLER_ID, exampleStore, } from '../../protocols/ucp/merchant';
+export const STORE = 'https://store.example';
+export const AGENT_PROFILE = 'https://agent.example/.well-known/ucp';
+/** The test payment's token: held by the host, never in a summary or a proposal. */
+export const TEST_TOKEN = 'tok_test_gallery_never_shown';
+/** The client, the store, and a host whose approver is `decide`. */
+export function ucpCheckoutDemo(decide) {
+    const store = exampleStore(STORE);
+    const host = definePlugin({
+        name: 'gallery-host',
+        contributes: [
+            contribution(UcpApprovers, { approve: decide }, { id: 'person', order: 10 }),
+            contribution(UcpPaymentInstruments, {
+                instrument: async () => ({
+                    id: 'pi_1',
+                    handler_id: EXAMPLE_STORE_HANDLER_ID,
+                    type: 'card',
+                    credential: { type: 'PAYMENT_GATEWAY', token: TEST_TOKEN },
+                }),
+            }, { id: 'custody', order: 10 }),
+        ],
+    });
+    return {
+        client: new UcpClient(STORE, AGENT_PROFILE, store.fetch),
+        reactor: buildProtocolsReactor([host]),
+        orders: store.orders,
+    };
+}
+/** Find the tea, put `quantity` in a checkout with the buyer's email, and propose it. */
+export async function proposeTea(demo, quantity = 2, email = 'ana@example.com') {
+    const [product] = await demo.client.search('sencha');
+    const created = await demo.client.createCheckout([
+        { id: product.id, quantity },
+    ]);
+    await demo.client.updateCheckout(created.id, { buyer: { email } });
+    const proposal = await demo.client.proposeCompletion(created.id);
+    return { proposal, says: proposalSummary(proposal) };
+}
+/** Complete the proposal: the approver is asked; the order, or why not. */
+export async function buy(demo, proposal) {
+    try {
+        const done = checkoutSummary(await demo.client.complete(proposal, demo.reactor));
+        return {
+            ok: true,
+            says: `Bought: order ${done.order?.id}, ${done.status}.`,
+        };
+    }
+    catch (error) {
+        return { ok: false, says: `Not bought: ${error.message}.` };
+    }
+}

package/lib/protocols/AGUIAdapter.d.ts

@@ -7,6 +7,8 @@ import type { ProtocolAdapterConfig } from '../types';
 import type { ChatMessage } from '../types/messages';
 import type { ToolDefinition, ToolExecutionResult } from '../types/tools';
 import { BaseProtocolAdapter } from './BaseProtocolAdapter';
+/** What the page says when a run's stream closes before the run said how it ended. */
+export declare const RUN_CUT_SHORT = "The run stopped before it finished, without an answer or an error: send it again.";
 /**
  * AG-UI specific configuration
  */
@@ -110,6 +112,11 @@ export declare class AGUIAdapter extends BaseProtocolAdapter {
      * Parse SSE stream from AG-UI response
      */
     private parseSSEStream;
+    /**
+     * A `reactor.ui` op on the run stream: refused, and said as an error. The
+     * ops come over the conversation's ui socket (REACTOR_UI RU-W).
+     */
+    private refuseUiOnRun;
     /**
      * Handle individual AG-UI events
      *

package/lib/protocols/AGUIAdapter.js

@@ -5,6 +5,9 @@
 import { generateMessageId, createAssistantMessage } from '../types/messages';
 import { agUiRefusal, refusalBody } from './agUiRefusal';
 import { BaseProtocolAdapter } from './BaseProtocolAdapter';
+import { AGUI_NAME } from '@datalayer/reactor/ui';
+/** What the page says when a run's stream closes before the run said how it ended. */
+export const RUN_CUT_SHORT = 'The run stopped before it finished, without an answer or an error: send it again.';
 /**
  * AG-UI protocol adapter
  * Uses HTTP POST with SSE streaming for responses
@@ -426,11 +429,20 @@ export class AGUIAdapter extends BaseProtocolAdapter {
             });
         }
         this._streamParsingDepth++;
+        // Whether the run said how it ended. A stream that closes without
+        // RUN_FINISHED or RUN_ERROR is a run cut short — by the runtime, a proxy
+        // or the network — and the page says so instead of waiting for an answer
+        // that is not coming (a Preview gave no answer for minutes, 2026-10-12).
+        let ended = false;
         try {
             while (true) {
                 const { done, value } = await reader.read();
-                if (done)
+                if (done) {
+                    if (!ended) {
+                        throw new Error(RUN_CUT_SHORT);
+                    }
                     break;
+                }
                 buffer += decoder.decode(value, { stream: true });
                 const lines = buffer.split('\n');
                 buffer = lines.pop() || '';
@@ -444,6 +456,10 @@ export class AGUIAdapter extends BaseProtocolAdapter {
                         const data = line.slice(6);
                         try {
                             const event = JSON.parse(data);
+                            const kind = event.type;
+                            if (kind === 'RUN_FINISHED' || kind === 'RUN_ERROR') {
+                                ended = true;
+                            }
                             this.handleAGUIEvent(event, {
                                 getCurrentMessageId: () => currentMessageId,
                                 setCurrentMessageId: id => {
@@ -483,6 +499,17 @@ export class AGUIAdapter extends BaseProtocolAdapter {
             }
         }
     }
+    /**
+     * A `reactor.ui` op on the run stream: refused, and said as an error. The
+     * ops come over the conversation's ui socket (REACTOR_UI RU-W).
+     */
+    refuseUiOnRun() {
+        this.emit({
+            type: 'error',
+            error: new Error('A reactor.ui op came on the run stream: it comes over the ui socket (REACTOR_UI RU-W).'),
+            timestamp: new Date(),
+        });
+    }
     /**
      * Handle individual AG-UI events
      *
@@ -684,14 +711,27 @@ export class AGUIAdapter extends BaseProtocolAdapter {
                 });
                 break;
             }
+            case 'ACTIVITY_SNAPSHOT':
+            case 'ACTIVITY_DELTA': {
+                // `reactor.ui` ops come over the conversation's ui socket, never
+                // the run stream (REACTOR_UI RU-W): one here is refused. Any other
+                // activity is nobody's here.
+                if (event.activityType === AGUI_NAME) {
+                    this.refuseUiOnRun();
+                }
+                break;
+            }
             case 'CUSTOM': {
                 const name = event.name;
-                const value = event.value;
+                if (name === AGUI_NAME) {
+                    this.refuseUiOnRun();
+                    break;
+                }
                 this.emit({
                     type: 'activity',
                     activity: {
                         type: name || 'custom',
-                        data: value,
+                        data: event.value,
                     },
                     timestamp: new Date(),
                 });

package/lib/protocols/a2a/index.js

@@ -56,6 +56,7 @@ export const A2APlugin = definePlugin({
             status: 'implemented',
             specification: 'https://a2a-protocol.org/latest/specification/',
             plugin: A2A_PLUGIN,
+            catalogue: 'a2a',
             points: EXTENSION_POINTS.map(point => point.id),
         }, { id: 'a2a', order: DEFAULT_ORDER }),
         contribution(A2AOrchestrationExtensions, orchestration, {

package/lib/protocols/agentic-commerce/index.js

@@ -59,6 +59,7 @@ export const AgenticCommercePlugin = definePlugin({
             status: 'partial',
             specification: `https://github.com/agentic-commerce-protocol/agentic-commerce-protocol/tree/main/spec/${AGENTIC_COMMERCE_VERSION}`,
             plugin: AGENTIC_COMMERCE_PLUGIN,
+            catalogue: 'acp',
             points: POINTS.map(point => point.id),
         }, { id: 'agentic_commerce', order: DEFAULT_ORDER }),
     ],

package/lib/protocols/core.d.ts

@@ -26,6 +26,12 @@ export interface ProtocolDescription {
     status: 'implemented' | 'partial' | 'planned';
     specification: string;
     plugin: string;
+    /**
+     * Its id in the agentspecs protocols catalogue (`agentspecs/protocols`,
+     * AGENT_PROTOCOLS PS-01): `web-bot-auth`, `acp`… — how Studio reads a
+     * runtime's answer against the catalogue (PR-50).
+     */
+    catalogue: string;
     /** The contribution points its plugin declares, its extensions' included. */
     points: string[];
 }

package/lib/protocols/mcp/index.js

@@ -31,6 +31,7 @@ export const McpPlugin = definePlugin({
             status: 'implemented',
             specification: 'https://modelcontextprotocol.io/specification',
             plugin: MCP_PLUGIN,
+            catalogue: 'mcp',
             points: [],
         }, { id: 'mcp', order: DEFAULT_ORDER }),
     ],

package/lib/protocols/pact/index.js

@@ -69,6 +69,7 @@ export const PactPlugin = definePlugin({
             status: 'partial',
             specification: 'https://github.com/openpactprotocol/openpactprotocol/blob/main/docs/spec.md',
             plugin: PACT_PLUGIN,
+            catalogue: 'pact',
             points: POINTS.map(point => point.id),
         }, { id: 'pact', order: DEFAULT_ORDER }),
         contribution(PactDelegatedProfiles, { grantType: DEVICE_CODE_GRANT }, { id: 'device-code', order: DEFAULT_ORDER }),

package/lib/protocols/ucp/index.js

@@ -64,6 +64,7 @@ export const UcpPlugin = definePlugin({
             status: 'partial',
             specification: `https://ucp.dev/${UCP_VERSION}/specification/overview`,
             plugin: UCP_PLUGIN,
+            catalogue: 'ucp',
             points: UCP_POINTS.map(point => point.id),
         }, { id: 'ucp', order: DEFAULT_ORDER }),
     ],

package/lib/protocols/ucp/merchant.d.ts

@@ -0,0 +1,15 @@
+/** The store's products, as the Python store lists them. */
+export declare const EXAMPLE_STORE_CATALOG: Record<string, {
+    title: string;
+    price: number;
+}>;
+/** The one payment handler it takes, and the prefix of its test tokens. */
+export declare const EXAMPLE_STORE_HANDLER_ID = "test_pay_1";
+/** The store: its `fetch`, and the orders it took. */
+export declare function exampleStore(base?: string): {
+    fetch: typeof fetch;
+    orders: Array<{
+        order: string;
+        checkout: string;
+    }>;
+};