@datalayer/agent-runtimes 1.5.7 → 1.5.9

package/lib/apps/apps/appspec.d.ts

@@ -24,7 +24,7 @@
  *
  * @module apps/apps/appspec
  */
-import type { AppAccent, AppThemeMode, AppThemeVariant, AppAssistantCharacter, AppEmbedMode, AppCustomComponentSpec, AppVoiceSpec, AppKind, AppLayout, AppPageOutputComponent, AppSpec } from '../../types/agentspecs';
+import type { AppAccent, AppThemeMode, AppThemeVariant, AppAssistantCharacter, AppEmbedMode, PapProfile, AppCustomComponentSpec, AppVoiceSpec, AppKind, AppLayout, AppPageOutputComponent, AppSpec } from '../../types/agentspecs';
 /** The version of the spec itself. */
 export declare const APP_SCHEMA = "loop.app/v1";
 /** The language an application's own words are in, unless it says (LOOP P-26). */
@@ -60,6 +60,15 @@ type Data = Record<string, unknown>;
 export declare function retentionDays(keepFor: string): number;
 /** An application with nothing said: what *Start blank* opens. */
 export declare function emptyAppspec(kind?: AppKind): AppSpec;
+/** The Personal Agent Protocol profiles Datalayer speaks, as agentspecs' `PAP_PROFILES` (PAP_DATALAYER S-03). */
+export declare const PAP_PROFILES: readonly PapProfile[];
+/** The profile a `pap` block is written for when the Studio or a builder starts one. */
+export declare const PAP_PROFILE: PapProfile;
+/**
+ * What is wrong with a `pap` block's profile, in agentspecs' sentence
+ * (`pap_profile_problem`); `undefined` when it is one Datalayer speaks.
+ */
+export declare function papProfileProblem(value: unknown): string | undefined;
 /** An application's voice (VOICE.md VO-41): off unless said. */
 export declare const DEFAULT_VOICE: AppVoiceSpec;
 /** What a page's output may be drawn with (LOOP P-05), and the property of each that shows its value. */

package/lib/apps/apps/appspec.js

@@ -248,6 +248,23 @@ function parseConnection(data) {
         only: texts(data.only),
     };
 }
+/** The Personal Agent Protocol profiles Datalayer speaks, as agentspecs' `PAP_PROFILES` (PAP_DATALAYER S-03). */
+export const PAP_PROFILES = ['draft-01'];
+/** The profile a `pap` block is written for when the Studio or a builder starts one. */
+export const PAP_PROFILE = PAP_PROFILES[PAP_PROFILES.length - 1];
+/**
+ * What is wrong with a `pap` block's profile, in agentspecs' sentence
+ * (`pap_profile_problem`); `undefined` when it is one Datalayer speaks.
+ */
+export function papProfileProblem(value) {
+    if (value === undefined || value === null || value === '') {
+        return `Its \`pap\` block names no Personal Agent Protocol profile: add \`profile: ${PAP_PROFILE}\`.`;
+    }
+    if (!PAP_PROFILES.includes(value)) {
+        return `This application asks for Personal Agent Protocol profile “${String(value)}”; Datalayer speaks ${PAP_PROFILES.join(' or ')}.`;
+    }
+    return undefined;
+}
 const PAP_INTERFACES = ['agent', 'openapi', 'mcp', 'web'];
 const PAP_SIGN_IN = ['direct', 'device', 'mediated'];
 const PAP_DEFAULT_INTERFACES = ['agent'];
@@ -265,6 +282,7 @@ const enumsOf = (value, allowed, otherwise) => {
 function parsePap(data) {
     const company = isData(data.company) ? data.company : {};
     return {
+        profile: data.profile,
         connections: records(data.connections).map(connection => ({
             id: text(connection.id),
             company: text(connection.company),
@@ -286,17 +304,53 @@ function parsePap(data) {
             operations: records(company.operations).map(operation => ({
                 action: text(operation.action),
                 tool: text(operation.tool),
+                ...(isData(operation.allows)
+                    ? { allows: parsePapStanding(operation.allows) }
+                    : {}),
                 summary: text(operation.summary),
                 userApprovalRequired: flag(operation.user_approval_required, true),
             })),
         },
     };
 }
+/** A standing permission an operation gives (PAP_DATALAYER R-07), as agentspecs reads it. */
+function parsePapStanding(data) {
+    return {
+        connection: text(data.connection),
+        action: oneOf(data.action, ['write', 'buy'], 'buy'),
+        limits: records(data.limits).map(limit => ({
+            path: text(limit.path),
+            ...(typeof limit.maximum === 'string'
+                ? { maximum: text(limit.maximum) }
+                : {}),
+            ...(typeof limit.allowed === 'string'
+                ? { allowed: text(limit.allowed) }
+                : {}),
+        })),
+        uses: text(data.uses),
+        days: text(data.days),
+    };
+}
+/** A standing permission as its document says it: every field, none has a default. */
+function dumpPapStanding(standing) {
+    return {
+        connection: standing.connection,
+        action: standing.action,
+        limits: standing.limits.map(limit => ({
+            path: limit.path,
+            ...(limit.maximum !== undefined ? { maximum: limit.maximum } : {}),
+            ...(limit.allowed !== undefined ? { allowed: limit.allowed } : {}),
+        })),
+        uses: standing.uses,
+        days: standing.days,
+    };
+}
 /** Personal Agent Protocol as its document says it, nothing at its default. */
 function dumpPap(pap) {
     if (!pap)
         return {};
     return new Writer()
+        .text('profile', pap.profile, '\u0000')
         .list('connections', pap.connections.map(connection => new Writer()
         .text('id', connection.id, '\u0000')
         .text('company', connection.company, '\u0000')
@@ -318,12 +372,23 @@ function dumpPap(pap) {
         .list('registered_agents', pap.company.registeredAgents)
         .list('operations', pap.company.operations.map(operation => new Writer()
         .text('action', operation.action, '\u0000')
-        .text('tool', operation.tool, '\u0000')
+        // An operation that allows a standing permission calls no tool (R-07).
+        .text('tool', operation.tool, operation.allows ? '' : '\u0000')
+        .present('allows', operation.allows
+        ? dumpPapStanding(operation.allows)
+        : undefined)
         .text('summary', operation.summary, '\u0000')
         .value('user_approval_required', operation.userApprovalRequired, true).data)).data).data;
 }
-/** PACT (AGENT_PROTOCOLS PI-01): the businesses it asks for each person. */
+/** PACT (AGENT_PROTOCOLS PI-01): the businesses it asks for each person, and as one (PR-13). */
 function parsePact(data) {
+    const business = isData(data.business) ? data.business : {};
+    const scopes = {};
+    if (isData(business.scopes)) {
+        for (const [scope, said] of Object.entries(business.scopes)) {
+            scopes[scope] = text(said);
+        }
+    }
     return {
         connections: records(data.connections).map(connection => ({
             id: text(connection.id),
@@ -332,6 +397,15 @@ function parsePact(data) {
             access: oneOf(connection.access, ['read', 'write'], 'read'),
             scopes: texts(connection.scopes),
         })),
+        business: {
+            enabled: flag(business.enabled, false),
+            brand: text(business.brand),
+            scopes,
+            registeredAgents: records(business.registered_agents).map(agent => ({
+                issuer: text(agent.issuer),
+                jwksUri: text(agent.jwks_uri),
+            })),
+        },
     };
 }
 /** Commerce (AGENT_PROTOCOLS PI-01): the merchants it shops at for each person. */
@@ -373,12 +447,26 @@ function dumpCommerce(commerce) {
 function dumpPact(pact) {
     if (!pact)
         return {};
-    return new Writer().list('connections', pact.connections.map(connection => new Writer()
+    const business = pact.business ?? {
+        enabled: false,
+        brand: '',
+        scopes: {},
+        registeredAgents: [],
+    };
+    return new Writer()
+        .list('connections', pact.connections.map(connection => new Writer()
         .text('id', connection.id, '\u0000')
         .text('brand', connection.brand, '\u0000')
         .text('audience', connection.audience, '\u0000')
         .value('access', connection.access, 'read')
-        .list('scopes', connection.scopes).data)).data;
+        .list('scopes', connection.scopes).data))
+        .part('business', new Writer()
+        .value('enabled', business.enabled, false)
+        .text('brand', business.brand)
+        .part('scopes', { ...business.scopes })
+        .list('registered_agents', business.registeredAgents.map(agent => new Writer()
+        .text('issuer', agent.issuer, '\u0000')
+        .text('jwks_uri', agent.jwksUri, '\u0000').data)).data).data;
 }
 /** A2A (AGENT_PROTOCOLS PR-02): the extensions its Agent Card advertises. */
 function parseA2A(data) {
@@ -942,8 +1030,16 @@ export function parseAppspec(document) {
     if (isData(data.decision)) {
         app.decision = parseDecision(data.decision);
     }
-    if (isData(data.pap)) {
-        app.pap = parsePap(data.pap);
+    // A `pap` block names a profile Datalayer speaks, or it is refused and not
+    // read (PAP_DATALAYER S-03); a block saying nothing is no block.
+    if (isData(data.pap) && Object.keys(data.pap).length > 0) {
+        const problem = papProfileProblem(data.pap.profile);
+        if (problem) {
+            problems.push(problem);
+        }
+        else {
+            app.pap = parsePap(data.pap);
+        }
     }
     if (isData(data.pact)) {
         app.pact = parsePact(data.pact);
@@ -1006,7 +1102,8 @@ export function protocolsProblems(app) {
     }
     const configured = {
         pap: Boolean(app.pap && (app.pap.connections.length > 0 || app.pap.company.enabled)),
-        pact: Boolean(app.pact && app.pact.connections.length > 0),
+        pact: Boolean(app.pact &&
+            (app.pact.connections.length > 0 || app.pact.business?.enabled)),
         a2a: Boolean(app.a2a && app.a2a.extensions.length > 0),
     };
     for (const spec of Object.values(PROTOCOL_CATALOGUE)) {

package/lib/apps/core/index.d.ts

@@ -710,7 +710,33 @@ export type LoopChatExtrasValue = {
      * every snapshot the chat receives, `undefined` included.
      */
     onUsage?: (snapshot: ContextSnapshotData | undefined) => void;
+    /**
+     * What the person types goes somewhere else than the agent, live.
+     *
+     * While set, the composer's placeholder is `says` and sending hands the
+     * words to `send`, never to the model or the runtime: a person talking with
+     * a company themselves in a Direct Conversation (PAP_DATALAYER P-08), their
+     * own words sent as theirs. A refusal `send` throws is said under the
+     * composer and the words stay where they were typed. Unset, the composer
+     * talks to the agent again.
+     */
+    sendInstead?: {
+        /** Where the words go, in the person's words, in place of the placeholder. */
+        says: string;
+        send: (text: string) => Promise<void>;
+    };
 };
+/**
+ * The words sent where the extras say instead of to the agent
+ * (`sendInstead`): `null` when they go to the agent as usual; else whether
+ * they were taken, and the refusal in a sentence when they were not.
+ */
+export declare function sendInstead(extras: Pick<LoopChatExtrasValue, 'sendInstead'>, message: string): Promise<{
+    sent: true;
+} | {
+    sent: false;
+    refused: string;
+} | null>;
 export type ChatExtrasContribution = {
     /** Stable id, for the registry and the graph. */
     id: string;

package/lib/apps/core/index.js

@@ -181,6 +181,26 @@ export { LoopA2uiComponent, } from './a2uiComponents';
 // Where the files of an application's folder are served (LOOP P-29): said
 // by the page side its package carries.
 export { LoopAppFiles } from './appFiles';
+/**
+ * The words sent where the extras say instead of to the agent
+ * (`sendInstead`): `null` when they go to the agent as usual; else whether
+ * they were taken, and the refusal in a sentence when they were not.
+ */
+export async function sendInstead(extras, message) {
+    if (!extras.sendInstead) {
+        return null;
+    }
+    try {
+        await extras.sendInstead.send(message);
+        return { sent: true };
+    }
+    catch (error) {
+        return {
+            sent: false,
+            refused: error instanceof Error ? error.message : String(error),
+        };
+    }
+}
 export const LoopChatExtras = defineContributionPoint('loop.chat.extras');
 export const LoopOpeningNotebook = defineContributionPoint('loop.notebook.opening');
 export const LoopOpeningDocument = defineContributionPoint('loop.document.opening');

package/lib/apps/plugins/chat/ChatView.js

@@ -42,7 +42,7 @@ import { BROWSER_CODE_TOOL, dataUrlBase64, givenFilesSentence, sandboxFileName,
 import { useConfig } from '../../../hooks/useConfig';
 import { useSkills, useSkillActions } from '../../../hooks/useSkills';
 import { AI_MODEL_CATALOGUE, isChatModel } from '../../../specs/models';
-import { LoopAgentBlueprint, LoopAgentGate, LoopChatComposer, LoopChatExtras, LoopChatHeader, LoopChatLayout, LoopChatSuggestion, LoopChatSurface, LoopChatTurn, LoopCommand, LoopFrontendTool, LoopRunProps, LoopSlots, agentServerOf, noRuntimeSaid, canOpenView, runForwardedProps, onPromptFocusRequest, onSurfaceRequest, useLoopPromptStore, } from '../../core';
+import { LoopAgentBlueprint, LoopAgentGate, LoopChatComposer, sendInstead, LoopChatExtras, LoopChatHeader, LoopChatLayout, LoopChatSuggestion, LoopChatSurface, LoopChatTurn, LoopCommand, LoopFrontendTool, LoopRunProps, LoopSlots, agentServerOf, noRuntimeSaid, canOpenView, runForwardedProps, onPromptFocusRequest, onSurfaceRequest, useLoopPromptStore, } from '../../core';
 import { messageText, turnWritersOf } from './turnState';
 import { isInactiveSurfaceContribution, orderToolContributions, toolsForChatView, } from './chatViewTools';
 import { agentBundleToolDefinitions, useAgentCommandTools, } from '../../../tools/adapters/commands';
@@ -486,11 +486,27 @@ export default function ChatView({ workspace }) {
          * place "the first prompt" means the same thing regardless of which one
          * a person or a host used.
          */
+        setTransient(null);
+        /*
+         * Words that go elsewhere than the agent (`sendInstead`, PAP_DATALAYER
+         * P-08): a Direct Conversation with a company, the person's own words
+         * sent as theirs. Neither a command nor a turn, and never the model's;
+         * refused, the words stay where they were typed and the reason is said.
+         */
+        const elsewhere = await sendInstead(chatExtrasRef.current, message);
+        if (elsewhere) {
+            if (elsewhere.sent) {
+                setDraft('');
+            }
+            else {
+                setTransient(elsewhere.refused);
+            }
+            return;
+        }
         if (!firstPromptFired.current) {
             firstPromptFired.current = true;
             inputPromptConfig?.firstPromptHook?.();
         }
-        setTransient(null);
         // The turn begins where the message goes out (`sendNow`): a command
         // the workspace runs is not one.
         const outcome = await workspace.submit(message);
@@ -1594,8 +1610,9 @@ export default function ChatView({ workspace }) {
         // send button into a stop — the person keeps a way out.
         isLoading: busy,
         onStop: () => workspace.viewControls.stop?.(),
-        // The reason where the typing would go, read before the person types.
-        placeholder: disabledReason ?? placeholder,
+        // The reason where the typing would go, read before the person types;
+        // where it goes when it goes elsewhere than the agent (P-08).
+        placeholder: disabledReason ?? chatExtras.sendInstead?.says ?? placeholder,
         typingSuggestions: suggestions.map(item => item.text),
         // The same openers behind the composer's suggestions control.
         suggestions: chatSuggestions,

package/lib/protocols/mcp/client.d.ts

@@ -0,0 +1,73 @@
+import type { Transport } from '@modelcontextprotocol/sdk/shared/transport.js';
+import type { CallToolResult, GetPromptResult, ReadResourceResult, Tool } from '@modelcontextprotocol/sdk/types.js';
+/** A listed tool as a client reads it. */
+export interface McpToolReading {
+    name: string;
+    title: string | null;
+    description: string | null;
+    /** Its parameters' names, sorted. */
+    parameters: string[];
+    /** Those it requires, sorted. */
+    required: string[];
+    /** Whether it says an output schema (answers structured content). */
+    structured: boolean;
+    readOnly: boolean;
+    destructive: boolean;
+    idempotent: boolean;
+    openWorld: boolean;
+}
+/** A tool's answer as a client reads it. */
+export interface McpCallReading {
+    isError: boolean;
+    /** Its text parts, joined by a newline. */
+    text: string;
+    structured: Record<string, unknown> | null;
+}
+/** A text resource's contents as a client reads them. */
+export interface McpResourceReading {
+    uri: string;
+    mimeType: string | null;
+    text: string;
+}
+/** A prompt's message as a client reads it. */
+export interface McpPromptReading {
+    role: 'user' | 'assistant';
+    text: string;
+}
+/** A listed tool: its parameters, whether it answers structured, its hints. */
+export declare function toolReading(tool: Tool): McpToolReading;
+/** A tool's answer: refused or not, its text parts joined, its structured content. */
+export declare function callReading(result: CallToolResult): McpCallReading;
+/** A resource's text contents; a binary one is refused, never decoded here. */
+export declare function resourceReading(result: ReadResourceResult): McpResourceReading[];
+/** A prompt's messages as text; a message of another kind is refused. */
+export declare function promptReading(result: GetPromptResult): McpPromptReading[];
+/** Where an `McpClient` connects: a Streamable HTTP endpoint, or any transport. */
+export type McpServerAddress = {
+    url: string;
+    /** Headers sent with every request (a bearer, for one). */
+    headers?: Record<string, string>;
+} | {
+    transport: Transport;
+};
+/**
+ * An MCP client: connects, lists and calls tools, reads resources, gets
+ * prompts, and answers each as the readings above. The SDK's `Client` does
+ * the protocol (the initialize handshake, the version negotiated, a
+ * structured answer checked against the tool's output schema).
+ */
+export declare class McpClient {
+    private readonly client;
+    private readonly agreed;
+    private constructor();
+    /** Connected to `server`, said to it as `name` at `version`. */
+    static connect(server: McpServerAddress, name?: string, version?: string): Promise<McpClient>;
+    /** The protocol version agreed with the server. */
+    get protocolVersion(): string;
+    /** Every tool the server lists, through its pages. */
+    listTools(): Promise<McpToolReading[]>;
+    callTool(name: string, args: Record<string, unknown>): Promise<McpCallReading>;
+    readResource(uri: string): Promise<McpResourceReading[]>;
+    getPrompt(name: string, args: Record<string, string>): Promise<McpPromptReading[]>;
+    close(): Promise<void>;
+}

package/lib/protocols/mcp/client.js

@@ -0,0 +1,136 @@
+/*
+ * Copyright (c) 2025-2026 Datalayer, Inc.
+ * Distributed under the terms of the Modified BSD License.
+ */
+/**
+ * An MCP client in TypeScript, on the official `@modelcontextprotocol/sdk`
+ * (AGENT_PROTOCOLS PR-51, decided 2026-10-13), and what it reads from a
+ * server's answers — the twin of `agent_runtimes.protocols.mcp.reading`.
+ *
+ * The readings are the plain shape both languages agree on, held to
+ * `agent_runtimes/protocols/mcp/fixtures/session.json` by the pytest and the
+ * vitest. A tool's missing annotations are read with the specification's
+ * defaults (`readOnlyHint` false, `destructiveHint` true, `idempotentHint`
+ * false, `openWorldHint` true), so a server that says nothing is never read
+ * as harmless; `destructiveHint` means something only when the tool is not
+ * read-only, so a read-only tool is never destructive.
+ *
+ * @module protocols/mcp/client
+ */
+import { Client } from '@modelcontextprotocol/sdk/client/index.js';
+import { StreamableHTTPClientTransport } from '@modelcontextprotocol/sdk/client/streamableHttp.js';
+const sorted = (values) => [...values].sort((a, b) => (a < b ? -1 : a > b ? 1 : 0));
+/** A listed tool: its parameters, whether it answers structured, its hints. */
+export function toolReading(tool) {
+    const hints = tool.annotations;
+    const readOnly = hints?.readOnlyHint === true;
+    return {
+        name: tool.name,
+        title: tool.title ?? null,
+        description: tool.description ?? null,
+        parameters: sorted(Object.keys(tool.inputSchema.properties ?? {})),
+        required: sorted(tool.inputSchema.required ?? []),
+        structured: tool.outputSchema !== undefined,
+        readOnly,
+        destructive: !readOnly && hints?.destructiveHint !== false,
+        idempotent: hints?.idempotentHint === true,
+        openWorld: hints?.openWorldHint !== false,
+    };
+}
+/** A tool's answer: refused or not, its text parts joined, its structured content. */
+export function callReading(result) {
+    return {
+        isError: result.isError === true,
+        text: result.content
+            .flatMap(part => (part.type === 'text' ? [part.text] : []))
+            .join('\n'),
+        structured: result.structuredContent ?? null,
+    };
+}
+/** A resource's text contents; a binary one is refused, never decoded here. */
+export function resourceReading(result) {
+    return result.contents.map(part => {
+        if (!('text' in part) || typeof part.text !== 'string') {
+            throw new Error(`${part.uri} is not text.`);
+        }
+        return { uri: part.uri, mimeType: part.mimeType ?? null, text: part.text };
+    });
+}
+/** A prompt's messages as text; a message of another kind is refused. */
+export function promptReading(result) {
+    return result.messages.map(message => {
+        if (message.content.type !== 'text') {
+            throw new Error(`A ${message.role} message is not text.`);
+        }
+        return { role: message.role, text: message.content.text };
+    });
+}
+/**
+ * An MCP client: connects, lists and calls tools, reads resources, gets
+ * prompts, and answers each as the readings above. The SDK's `Client` does
+ * the protocol (the initialize handshake, the version negotiated, a
+ * structured answer checked against the tool's output schema).
+ */
+export class McpClient {
+    client;
+    agreed;
+    constructor(client, agreed) {
+        this.client = client;
+        this.agreed = agreed;
+    }
+    /** Connected to `server`, said to it as `name` at `version`. */
+    static async connect(server, name = 'agent-runtimes', version = '1.0.0') {
+        const transport = 'transport' in server
+            ? server.transport
+            : new StreamableHTTPClientTransport(new URL(server.url), {
+                requestInit: server.headers
+                    ? { headers: server.headers }
+                    : undefined,
+            });
+        // The SDK hands the version agreed at initialize to the transport alone.
+        let agreed;
+        const setProtocolVersion = transport.setProtocolVersion?.bind(transport);
+        transport.setProtocolVersion = (protocolVersion) => {
+            agreed = protocolVersion;
+            setProtocolVersion?.(protocolVersion);
+        };
+        const client = new Client({ name, version });
+        await client.connect(transport);
+        return new McpClient(client, () => agreed);
+    }
+    /** The protocol version agreed with the server. */
+    get protocolVersion() {
+        const version = this.agreed();
+        if (!version) {
+            throw new Error('The MCP client is not connected.');
+        }
+        return version;
+    }
+    /** Every tool the server lists, through its pages. */
+    async listTools() {
+        const tools = [];
+        let cursor;
+        do {
+            const page = await this.client.listTools(cursor ? { cursor } : {});
+            tools.push(...page.tools.map(toolReading));
+            cursor = page.nextCursor;
+        } while (cursor);
+        return tools;
+    }
+    async callTool(name, args) {
+        const result = await this.client.callTool({ name, arguments: args });
+        if (!Array.isArray(result.content)) {
+            throw new Error(`${name} answered in the form before MCP 2024-11-05.`);
+        }
+        return callReading(result);
+    }
+    async readResource(uri) {
+        return resourceReading(await this.client.readResource({ uri }));
+    }
+    async getPrompt(name, args) {
+        return promptReading(await this.client.getPrompt({ name, arguments: args }));
+    }
+    async close() {
+        await this.client.close();
+    }
+}

package/lib/protocols/mcp/index.d.ts

@@ -2,3 +2,4 @@ export declare const MCP_PLUGIN = "agent-runtimes.protocols.mcp";
 /** The MCP specification version of the `@modelcontextprotocol/sdk` installed (1.32: `LATEST_PROTOCOL_VERSION`); Python's `mcp` 2.1 speaks 2026-07-28. */
 export declare const MCP_SPECIFICATION_VERSION = "2025-11-25";
 export declare const McpPlugin: import("@datalayer/reactor").ReactorPlugin<Record<string, never>, unknown, unknown>;
+export * from './client';

package/lib/protocols/mcp/index.js

@@ -7,7 +7,8 @@
  * declares no point yet: MCP's optional capabilities and extensions become
  * `mcp.extension.<name>` points when the MCP client and server read them
  * from contributions (AGENT_PROTOCOLS PR-01). The twin of
- * `agent_runtimes.protocols.mcp`.
+ * `agent_runtimes.protocols.mcp`. Its client, on the official
+ * `@modelcontextprotocol/sdk`, is `./client` (PR-51).
  *
  * @module protocols/mcp
  */
@@ -36,3 +37,4 @@ export const McpPlugin = definePlugin({
         }, { id: 'mcp', order: DEFAULT_ORDER }),
     ],
 });
+export * from './client';

package/lib/protocols/web-bot-auth/tap.d.ts

@@ -0,0 +1,56 @@
+import { type HttpSigner, type NonceStore } from './index';
+/** Draft until Visa confirms it. */
+export declare const TAP_STATUS = "draft";
+/** Where the profile was read, 2026-10-13. */
+export declare const TAP_SOURCES: readonly ["https://developer.visa.com/capabilities/trusted-agent-protocol/trusted-agent-protocol-specifications", "https://developer.visa.com/capabilities/trusted-agent-protocol/overview", "https://github.com/visa/trusted-agent-protocol"];
+/** Visa's key directory, as its page says it. */
+export declare const VISA_JWKS = "https://mcp.visa.com/.well-known/jwks";
+export declare const TAP_BROWSE_TAG = "agent-browser-auth";
+export declare const TAP_PAY_TAG = "agent-payer-auth";
+export type TapIntent = 'browse' | 'pay';
+export declare const TAP_TAGS: Record<TapIntent, string>;
+export declare const TAP_REQUIRED_COMPONENTS: readonly ["@authority", "@path"];
+export declare const TAP_REQUIRED_PARAMS: readonly ["created", "keyid", "alg", "expires", "nonce", "tag"];
+/** `alg` as Visa writes it. */
+export declare const TAP_ALG = "Ed25519";
+/** The longest window, and how long a nonce is remembered. */
+export declare const TAP_MAX_WINDOW_SECONDS: number;
+export interface TapSignOptions {
+    intent: TapIntent;
+    label?: string;
+    /** Covered: at least `@authority` and `@path` (the default). */
+    components?: string[];
+    /** Unix seconds; now by default. */
+    created?: number;
+    /** Seconds, at most 8 minutes (the default). */
+    lifetime?: number;
+    nonce?: string;
+}
+export interface TapSignedHeaders {
+    'Signature-Input': string;
+    Signature: string;
+}
+/** What verifying a TAP signature found; `reason` when it does not hold. */
+export interface TapVerification {
+    verified: boolean;
+    reason?: string;
+    intent?: TapIntent;
+    keyid?: string;
+    nonce?: string;
+}
+/** Sign one request as a TAP agent browsing or paying, under an Ed25519 key. */
+export declare function signTapRequest(request: {
+    method: string;
+    url: string;
+}, signer: HttpSigner, options: TapSignOptions): Promise<TapSignedHeaders>;
+/**
+ * Verify the TAP signature of one request against Ed25519 keys known by
+ * `keyid` (Visa's directory, or a registry's). A request with no TAP tag is
+ * no trusted agent's; the merchant decides what to do with it.
+ */
+export declare function verifyTapRequest(request: Request, keys: Map<string, JsonWebKey>, options: {
+    nonceStore: NonceStore;
+    now?: number;
+}): Promise<TapVerification>;
+/** The `keyid` of an Ed25519 public JWK, as a TAP key list is indexed when it says none. */
+export declare function tapKeys(jwks: JsonWebKey[]): Promise<Map<string, JsonWebKey>>;