@datalayer/agent-runtimes 1.5.8 → 1.5.10

package/lib/apps/apps/appspec.d.ts

@@ -106,9 +106,9 @@ export declare function uiProblems(app: Pick<AppSpec, 'ui' | 'enabled'>): string
  * What is wrong with the protocols an application says it speaks
  * (AGENT_PROTOCOLS PS-02), as agentspecs says it: an id the catalogue does not
  * know or said twice, a planned protocol while it is offered, and a `pap`,
- * `pact` or `a2a` block configuring a protocol it does not list.
+ * `pact`, `a2a` or `signed_fetch` block configuring a protocol it does not list.
  */
-export declare function protocolsProblems(app: Pick<AppSpec, 'protocols' | 'enabled' | 'pap' | 'pact' | 'a2a' | 'commerce'>): string[];
+export declare function protocolsProblems(app: Pick<AppSpec, 'protocols' | 'enabled' | 'pap' | 'pact' | 'a2a' | 'commerce' | 'signed_fetch'>): string[];
 /**
  * An application as the document its file holds.
  *

package/lib/apps/apps/appspec.js

@@ -205,6 +205,8 @@ const KNOWN_KEYS = [
     'pap',
     'pact',
     'commerce',
+    'signed_fetch',
+    'pair',
     'a2a',
     'rules',
     'permissions',
@@ -304,12 +306,47 @@ function parsePap(data) {
             operations: records(company.operations).map(operation => ({
                 action: text(operation.action),
                 tool: text(operation.tool),
+                ...(isData(operation.allows)
+                    ? { allows: parsePapStanding(operation.allows) }
+                    : {}),
                 summary: text(operation.summary),
                 userApprovalRequired: flag(operation.user_approval_required, true),
             })),
         },
     };
 }
+/** A standing permission an operation gives (PAP_DATALAYER R-07), as agentspecs reads it. */
+function parsePapStanding(data) {
+    return {
+        connection: text(data.connection),
+        action: oneOf(data.action, ['write', 'buy'], 'buy'),
+        limits: records(data.limits).map(limit => ({
+            path: text(limit.path),
+            ...(typeof limit.maximum === 'string'
+                ? { maximum: text(limit.maximum) }
+                : {}),
+            ...(typeof limit.allowed === 'string'
+                ? { allowed: text(limit.allowed) }
+                : {}),
+        })),
+        uses: text(data.uses),
+        days: text(data.days),
+    };
+}
+/** A standing permission as its document says it: every field, none has a default. */
+function dumpPapStanding(standing) {
+    return {
+        connection: standing.connection,
+        action: standing.action,
+        limits: standing.limits.map(limit => ({
+            path: limit.path,
+            ...(limit.maximum !== undefined ? { maximum: limit.maximum } : {}),
+            ...(limit.allowed !== undefined ? { allowed: limit.allowed } : {}),
+        })),
+        uses: standing.uses,
+        days: standing.days,
+    };
+}
 /** Personal Agent Protocol as its document says it, nothing at its default. */
 function dumpPap(pap) {
     if (!pap)
@@ -337,7 +374,11 @@ function dumpPap(pap) {
         .list('registered_agents', pap.company.registeredAgents)
         .list('operations', pap.company.operations.map(operation => new Writer()
         .text('action', operation.action, '\u0000')
-        .text('tool', operation.tool, '\u0000')
+        // An operation that allows a standing permission calls no tool (R-07).
+        .text('tool', operation.tool, operation.allows ? '' : '\u0000')
+        .present('allows', operation.allows
+        ? dumpPapStanding(operation.allows)
+        : undefined)
         .text('summary', operation.summary, '\u0000')
         .value('user_approval_required', operation.userApprovalRequired, true).data)).data).data;
 }
@@ -404,6 +445,35 @@ function dumpCommerce(commerce) {
         }
         : {}).data)).data;
 }
+/** Signed fetch (AGENT_PROTOCOLS EX-11): the exact sites it reads pages of, each request signed. */
+function parseSignedFetch(data) {
+    return {
+        sites: records(data.sites).map(site => ({
+            id: text(site.id),
+            site: text(site.site),
+        })),
+    };
+}
+/** Signed fetch as its document says it, nothing at its default. */
+function dumpSignedFetch(signedFetch) {
+    if (!signedFetch)
+        return {};
+    return new Writer().list('sites', signedFetch.sites.map(site => new Writer()
+        .text('id', site.id, '\u0000')
+        .text('site', site.site, '\u0000').data)).data;
+}
+/** One of a pair of examples (AGENT_PROTOCOLS PR-13): its id and its side, or a problem. */
+function parsePair(data) {
+    const id = text(data.id);
+    const role = text(data.role);
+    if (!/^[a-z0-9](?:[a-z0-9-]*[a-z0-9])?$/.test(id)) {
+        return `A pair's id is lower-case letters, digits and hyphens: ${JSON.stringify(id)}.`;
+    }
+    if (role !== 'business' && role !== 'personal_agent') {
+        return `One of a pair is its business or its personal_agent, not ${JSON.stringify(role)}.`;
+    }
+    return { id, role };
+}
 /** PACT as its document says it, nothing at its default. */
 function dumpPact(pact) {
     if (!pact)
@@ -1008,6 +1078,18 @@ export function parseAppspec(document) {
     if (isData(data.commerce)) {
         app.commerce = parseCommerce(data.commerce);
     }
+    if (isData(data.signed_fetch)) {
+        app.signed_fetch = parseSignedFetch(data.signed_fetch);
+    }
+    if (isData(data.pair)) {
+        const pair = parsePair(data.pair);
+        if (typeof pair === 'string') {
+            problems.push(pair);
+        }
+        else {
+            app.pair = pair;
+        }
+    }
     if (isData(data.a2a)) {
         app.a2a = parseA2A(data.a2a);
     }
@@ -1042,7 +1124,7 @@ export function uiProblems(app) {
  * What is wrong with the protocols an application says it speaks
  * (AGENT_PROTOCOLS PS-02), as agentspecs says it: an id the catalogue does not
  * know or said twice, a planned protocol while it is offered, and a `pap`,
- * `pact` or `a2a` block configuring a protocol it does not list.
+ * `pact`, `a2a` or `signed_fetch` block configuring a protocol it does not list.
  */
 export function protocolsProblems(app) {
     const problems = [];
@@ -1066,6 +1148,7 @@ export function protocolsProblems(app) {
         pact: Boolean(app.pact &&
             (app.pact.connections.length > 0 || app.pact.business?.enabled)),
         a2a: Boolean(app.a2a && app.a2a.extensions.length > 0),
+        signed_fetch: Boolean(app.signed_fetch && app.signed_fetch.sites.length > 0),
     };
     for (const spec of Object.values(PROTOCOL_CATALOGUE)) {
         const block = spec.appspecBlock;
@@ -1347,6 +1430,8 @@ export function dumpAppspec(app) {
         .part('pap', dumpPap(app.pap))
         .part('pact', dumpPact(app.pact))
         .part('commerce', dumpCommerce(app.commerce))
+        .part('signed_fetch', dumpSignedFetch(app.signed_fetch))
+        .part('pair', app.pair ? { id: app.pair.id, role: app.pair.role } : {})
         .part('a2a', dumpA2A(app.a2a))
         .list('rules', app.rules.map(rule => ({
         action: rule.action,

package/lib/apps/embed/embeddedSecrets.d.ts

@@ -0,0 +1,16 @@
+/**
+ * What no file the embed ships may hold (PAP_DATALAYER B-02): the PAP SDK's
+ * emitted-bundle test (`src/__tests__/canaries.test.mjs`, `EMBEDDED_SECRETS`)
+ * extended to the embed, a browser artifact anybody's page loads. Its build
+ * fails on a file holding one (`vite.embed.config.ts`), naming the kind and
+ * the file, never what matched.
+ *
+ * Found 2026-10-13: the embed then served at datalayer.ai held the builder's
+ * Datalayer API key, because `import.meta.env` read whole (`env?.VITE_…`) is
+ * every `VITE_` variable of the environment it was built in.
+ *
+ * @module apps/embed/embeddedSecrets
+ */
+export declare const EMBEDDED_SECRETS: ReadonlyArray<readonly [string, RegExp]>;
+/** The kinds of secret a file's text holds, by name: empty when none. */
+export declare function secretsIn(text: string): string[];

package/lib/apps/embed/embeddedSecrets.js

@@ -0,0 +1,34 @@
+/*
+ * Copyright (c) 2025-2026 Datalayer, Inc.
+ * Distributed under the terms of the Modified BSD License.
+ */
+/**
+ * What no file the embed ships may hold (PAP_DATALAYER B-02): the PAP SDK's
+ * emitted-bundle test (`src/__tests__/canaries.test.mjs`, `EMBEDDED_SECRETS`)
+ * extended to the embed, a browser artifact anybody's page loads. Its build
+ * fails on a file holding one (`vite.embed.config.ts`), naming the kind and
+ * the file, never what matched.
+ *
+ * Found 2026-10-13: the embed then served at datalayer.ai held the builder's
+ * Datalayer API key, because `import.meta.env` read whole (`env?.VITE_…`) is
+ * every `VITE_` variable of the environment it was built in.
+ *
+ * @module apps/embed/embeddedSecrets
+ */
+export const EMBEDDED_SECRETS = [
+    // Key material after the header: a library may name the header to refuse it.
+    [
+        'a PEM private key',
+        /-----BEGIN [A-Z ]*PRIVATE KEY-----(?:\\n|\s)*[A-Za-z0-9+/=]{40,}/,
+    ],
+    ['a private JWK member', /["']d["']\s*:\s*["'][A-Za-z0-9_-]{32,}["']/],
+    [
+        'a compact JWT',
+        /eyJ[A-Za-z0-9_-]{10,}\.eyJ[A-Za-z0-9_-]{10,}\.[A-Za-z0-9_-]{10,}/,
+    ],
+    ['a Bearer or DPoP token', /(?:Bearer|DPoP) [A-Za-z0-9_-]{20,}/],
+];
+/** The kinds of secret a file's text holds, by name: empty when none. */
+export function secretsIn(text) {
+    return EMBEDDED_SECRETS.filter(([, pattern]) => pattern.test(text)).map(([kind]) => kind);
+}

package/lib/protocols/mcp/client.d.ts

@@ -0,0 +1,73 @@
+import type { Transport } from '@modelcontextprotocol/sdk/shared/transport.js';
+import type { CallToolResult, GetPromptResult, ReadResourceResult, Tool } from '@modelcontextprotocol/sdk/types.js';
+/** A listed tool as a client reads it. */
+export interface McpToolReading {
+    name: string;
+    title: string | null;
+    description: string | null;
+    /** Its parameters' names, sorted. */
+    parameters: string[];
+    /** Those it requires, sorted. */
+    required: string[];
+    /** Whether it says an output schema (answers structured content). */
+    structured: boolean;
+    readOnly: boolean;
+    destructive: boolean;
+    idempotent: boolean;
+    openWorld: boolean;
+}
+/** A tool's answer as a client reads it. */
+export interface McpCallReading {
+    isError: boolean;
+    /** Its text parts, joined by a newline. */
+    text: string;
+    structured: Record<string, unknown> | null;
+}
+/** A text resource's contents as a client reads them. */
+export interface McpResourceReading {
+    uri: string;
+    mimeType: string | null;
+    text: string;
+}
+/** A prompt's message as a client reads it. */
+export interface McpPromptReading {
+    role: 'user' | 'assistant';
+    text: string;
+}
+/** A listed tool: its parameters, whether it answers structured, its hints. */
+export declare function toolReading(tool: Tool): McpToolReading;
+/** A tool's answer: refused or not, its text parts joined, its structured content. */
+export declare function callReading(result: CallToolResult): McpCallReading;
+/** A resource's text contents; a binary one is refused, never decoded here. */
+export declare function resourceReading(result: ReadResourceResult): McpResourceReading[];
+/** A prompt's messages as text; a message of another kind is refused. */
+export declare function promptReading(result: GetPromptResult): McpPromptReading[];
+/** Where an `McpClient` connects: a Streamable HTTP endpoint, or any transport. */
+export type McpServerAddress = {
+    url: string;
+    /** Headers sent with every request (a bearer, for one). */
+    headers?: Record<string, string>;
+} | {
+    transport: Transport;
+};
+/**
+ * An MCP client: connects, lists and calls tools, reads resources, gets
+ * prompts, and answers each as the readings above. The SDK's `Client` does
+ * the protocol (the initialize handshake, the version negotiated, a
+ * structured answer checked against the tool's output schema).
+ */
+export declare class McpClient {
+    private readonly client;
+    private readonly agreed;
+    private constructor();
+    /** Connected to `server`, said to it as `name` at `version`. */
+    static connect(server: McpServerAddress, name?: string, version?: string): Promise<McpClient>;
+    /** The protocol version agreed with the server. */
+    get protocolVersion(): string;
+    /** Every tool the server lists, through its pages. */
+    listTools(): Promise<McpToolReading[]>;
+    callTool(name: string, args: Record<string, unknown>): Promise<McpCallReading>;
+    readResource(uri: string): Promise<McpResourceReading[]>;
+    getPrompt(name: string, args: Record<string, string>): Promise<McpPromptReading[]>;
+    close(): Promise<void>;
+}

package/lib/protocols/mcp/client.js

@@ -0,0 +1,136 @@
+/*
+ * Copyright (c) 2025-2026 Datalayer, Inc.
+ * Distributed under the terms of the Modified BSD License.
+ */
+/**
+ * An MCP client in TypeScript, on the official `@modelcontextprotocol/sdk`
+ * (AGENT_PROTOCOLS PR-51, decided 2026-10-13), and what it reads from a
+ * server's answers — the twin of `agent_runtimes.protocols.mcp.reading`.
+ *
+ * The readings are the plain shape both languages agree on, held to
+ * `agent_runtimes/protocols/mcp/fixtures/session.json` by the pytest and the
+ * vitest. A tool's missing annotations are read with the specification's
+ * defaults (`readOnlyHint` false, `destructiveHint` true, `idempotentHint`
+ * false, `openWorldHint` true), so a server that says nothing is never read
+ * as harmless; `destructiveHint` means something only when the tool is not
+ * read-only, so a read-only tool is never destructive.
+ *
+ * @module protocols/mcp/client
+ */
+import { Client } from '@modelcontextprotocol/sdk/client/index.js';
+import { StreamableHTTPClientTransport } from '@modelcontextprotocol/sdk/client/streamableHttp.js';
+const sorted = (values) => [...values].sort((a, b) => (a < b ? -1 : a > b ? 1 : 0));
+/** A listed tool: its parameters, whether it answers structured, its hints. */
+export function toolReading(tool) {
+    const hints = tool.annotations;
+    const readOnly = hints?.readOnlyHint === true;
+    return {
+        name: tool.name,
+        title: tool.title ?? null,
+        description: tool.description ?? null,
+        parameters: sorted(Object.keys(tool.inputSchema.properties ?? {})),
+        required: sorted(tool.inputSchema.required ?? []),
+        structured: tool.outputSchema !== undefined,
+        readOnly,
+        destructive: !readOnly && hints?.destructiveHint !== false,
+        idempotent: hints?.idempotentHint === true,
+        openWorld: hints?.openWorldHint !== false,
+    };
+}
+/** A tool's answer: refused or not, its text parts joined, its structured content. */
+export function callReading(result) {
+    return {
+        isError: result.isError === true,
+        text: result.content
+            .flatMap(part => (part.type === 'text' ? [part.text] : []))
+            .join('\n'),
+        structured: result.structuredContent ?? null,
+    };
+}
+/** A resource's text contents; a binary one is refused, never decoded here. */
+export function resourceReading(result) {
+    return result.contents.map(part => {
+        if (!('text' in part) || typeof part.text !== 'string') {
+            throw new Error(`${part.uri} is not text.`);
+        }
+        return { uri: part.uri, mimeType: part.mimeType ?? null, text: part.text };
+    });
+}
+/** A prompt's messages as text; a message of another kind is refused. */
+export function promptReading(result) {
+    return result.messages.map(message => {
+        if (message.content.type !== 'text') {
+            throw new Error(`A ${message.role} message is not text.`);
+        }
+        return { role: message.role, text: message.content.text };
+    });
+}
+/**
+ * An MCP client: connects, lists and calls tools, reads resources, gets
+ * prompts, and answers each as the readings above. The SDK's `Client` does
+ * the protocol (the initialize handshake, the version negotiated, a
+ * structured answer checked against the tool's output schema).
+ */
+export class McpClient {
+    client;
+    agreed;
+    constructor(client, agreed) {
+        this.client = client;
+        this.agreed = agreed;
+    }
+    /** Connected to `server`, said to it as `name` at `version`. */
+    static async connect(server, name = 'agent-runtimes', version = '1.0.0') {
+        const transport = 'transport' in server
+            ? server.transport
+            : new StreamableHTTPClientTransport(new URL(server.url), {
+                requestInit: server.headers
+                    ? { headers: server.headers }
+                    : undefined,
+            });
+        // The SDK hands the version agreed at initialize to the transport alone.
+        let agreed;
+        const setProtocolVersion = transport.setProtocolVersion?.bind(transport);
+        transport.setProtocolVersion = (protocolVersion) => {
+            agreed = protocolVersion;
+            setProtocolVersion?.(protocolVersion);
+        };
+        const client = new Client({ name, version });
+        await client.connect(transport);
+        return new McpClient(client, () => agreed);
+    }
+    /** The protocol version agreed with the server. */
+    get protocolVersion() {
+        const version = this.agreed();
+        if (!version) {
+            throw new Error('The MCP client is not connected.');
+        }
+        return version;
+    }
+    /** Every tool the server lists, through its pages. */
+    async listTools() {
+        const tools = [];
+        let cursor;
+        do {
+            const page = await this.client.listTools(cursor ? { cursor } : {});
+            tools.push(...page.tools.map(toolReading));
+            cursor = page.nextCursor;
+        } while (cursor);
+        return tools;
+    }
+    async callTool(name, args) {
+        const result = await this.client.callTool({ name, arguments: args });
+        if (!Array.isArray(result.content)) {
+            throw new Error(`${name} answered in the form before MCP 2024-11-05.`);
+        }
+        return callReading(result);
+    }
+    async readResource(uri) {
+        return resourceReading(await this.client.readResource({ uri }));
+    }
+    async getPrompt(name, args) {
+        return promptReading(await this.client.getPrompt({ name, arguments: args }));
+    }
+    async close() {
+        await this.client.close();
+    }
+}

package/lib/protocols/mcp/index.d.ts

@@ -2,3 +2,4 @@ export declare const MCP_PLUGIN = "agent-runtimes.protocols.mcp";
 /** The MCP specification version of the `@modelcontextprotocol/sdk` installed (1.32: `LATEST_PROTOCOL_VERSION`); Python's `mcp` 2.1 speaks 2026-07-28. */
 export declare const MCP_SPECIFICATION_VERSION = "2025-11-25";
 export declare const McpPlugin: import("@datalayer/reactor").ReactorPlugin<Record<string, never>, unknown, unknown>;
+export * from './client';

package/lib/protocols/mcp/index.js

@@ -7,7 +7,8 @@
  * declares no point yet: MCP's optional capabilities and extensions become
  * `mcp.extension.<name>` points when the MCP client and server read them
  * from contributions (AGENT_PROTOCOLS PR-01). The twin of
- * `agent_runtimes.protocols.mcp`.
+ * `agent_runtimes.protocols.mcp`. Its client, on the official
+ * `@modelcontextprotocol/sdk`, is `./client` (PR-51).
  *
  * @module protocols/mcp
  */
@@ -36,3 +37,4 @@ export const McpPlugin = definePlugin({
         }, { id: 'mcp', order: DEFAULT_ORDER }),
     ],
 });
+export * from './client';

package/lib/protocols/web-bot-auth/tap.d.ts

@@ -0,0 +1,56 @@
+import { type HttpSigner, type NonceStore } from './index';
+/** Draft until Visa confirms it. */
+export declare const TAP_STATUS = "draft";
+/** Where the profile was read, 2026-10-13. */
+export declare const TAP_SOURCES: readonly ["https://developer.visa.com/capabilities/trusted-agent-protocol/trusted-agent-protocol-specifications", "https://developer.visa.com/capabilities/trusted-agent-protocol/overview", "https://github.com/visa/trusted-agent-protocol"];
+/** Visa's key directory, as its page says it. */
+export declare const VISA_JWKS = "https://mcp.visa.com/.well-known/jwks";
+export declare const TAP_BROWSE_TAG = "agent-browser-auth";
+export declare const TAP_PAY_TAG = "agent-payer-auth";
+export type TapIntent = 'browse' | 'pay';
+export declare const TAP_TAGS: Record<TapIntent, string>;
+export declare const TAP_REQUIRED_COMPONENTS: readonly ["@authority", "@path"];
+export declare const TAP_REQUIRED_PARAMS: readonly ["created", "keyid", "alg", "expires", "nonce", "tag"];
+/** `alg` as Visa writes it. */
+export declare const TAP_ALG = "Ed25519";
+/** The longest window, and how long a nonce is remembered. */
+export declare const TAP_MAX_WINDOW_SECONDS: number;
+export interface TapSignOptions {
+    intent: TapIntent;
+    label?: string;
+    /** Covered: at least `@authority` and `@path` (the default). */
+    components?: string[];
+    /** Unix seconds; now by default. */
+    created?: number;
+    /** Seconds, at most 8 minutes (the default). */
+    lifetime?: number;
+    nonce?: string;
+}
+export interface TapSignedHeaders {
+    'Signature-Input': string;
+    Signature: string;
+}
+/** What verifying a TAP signature found; `reason` when it does not hold. */
+export interface TapVerification {
+    verified: boolean;
+    reason?: string;
+    intent?: TapIntent;
+    keyid?: string;
+    nonce?: string;
+}
+/** Sign one request as a TAP agent browsing or paying, under an Ed25519 key. */
+export declare function signTapRequest(request: {
+    method: string;
+    url: string;
+}, signer: HttpSigner, options: TapSignOptions): Promise<TapSignedHeaders>;
+/**
+ * Verify the TAP signature of one request against Ed25519 keys known by
+ * `keyid` (Visa's directory, or a registry's). A request with no TAP tag is
+ * no trusted agent's; the merchant decides what to do with it.
+ */
+export declare function verifyTapRequest(request: Request, keys: Map<string, JsonWebKey>, options: {
+    nonceStore: NonceStore;
+    now?: number;
+}): Promise<TapVerification>;
+/** The `keyid` of an Ed25519 public JWK, as a TAP key list is indexed when it says none. */
+export declare function tapKeys(jwks: JsonWebKey[]): Promise<Map<string, JsonWebKey>>;