@datalayer/agent-runtimes 1.5.9 → 1.5.10

package/lib/apps/apps/appspec.d.ts

@@ -106,9 +106,9 @@ export declare function uiProblems(app: Pick<AppSpec, 'ui' | 'enabled'>): string
  * What is wrong with the protocols an application says it speaks
  * (AGENT_PROTOCOLS PS-02), as agentspecs says it: an id the catalogue does not
  * know or said twice, a planned protocol while it is offered, and a `pap`,
- * `pact` or `a2a` block configuring a protocol it does not list.
+ * `pact`, `a2a` or `signed_fetch` block configuring a protocol it does not list.
  */
-export declare function protocolsProblems(app: Pick<AppSpec, 'protocols' | 'enabled' | 'pap' | 'pact' | 'a2a' | 'commerce'>): string[];
+export declare function protocolsProblems(app: Pick<AppSpec, 'protocols' | 'enabled' | 'pap' | 'pact' | 'a2a' | 'commerce' | 'signed_fetch'>): string[];
 /**
  * An application as the document its file holds.
  *

package/lib/apps/apps/appspec.js

@@ -205,6 +205,8 @@ const KNOWN_KEYS = [
     'pap',
     'pact',
     'commerce',
+    'signed_fetch',
+    'pair',
     'a2a',
     'rules',
     'permissions',
@@ -443,6 +445,35 @@ function dumpCommerce(commerce) {
         }
         : {}).data)).data;
 }
+/** Signed fetch (AGENT_PROTOCOLS EX-11): the exact sites it reads pages of, each request signed. */
+function parseSignedFetch(data) {
+    return {
+        sites: records(data.sites).map(site => ({
+            id: text(site.id),
+            site: text(site.site),
+        })),
+    };
+}
+/** Signed fetch as its document says it, nothing at its default. */
+function dumpSignedFetch(signedFetch) {
+    if (!signedFetch)
+        return {};
+    return new Writer().list('sites', signedFetch.sites.map(site => new Writer()
+        .text('id', site.id, '\u0000')
+        .text('site', site.site, '\u0000').data)).data;
+}
+/** One of a pair of examples (AGENT_PROTOCOLS PR-13): its id and its side, or a problem. */
+function parsePair(data) {
+    const id = text(data.id);
+    const role = text(data.role);
+    if (!/^[a-z0-9](?:[a-z0-9-]*[a-z0-9])?$/.test(id)) {
+        return `A pair's id is lower-case letters, digits and hyphens: ${JSON.stringify(id)}.`;
+    }
+    if (role !== 'business' && role !== 'personal_agent') {
+        return `One of a pair is its business or its personal_agent, not ${JSON.stringify(role)}.`;
+    }
+    return { id, role };
+}
 /** PACT as its document says it, nothing at its default. */
 function dumpPact(pact) {
     if (!pact)
@@ -1047,6 +1078,18 @@ export function parseAppspec(document) {
     if (isData(data.commerce)) {
         app.commerce = parseCommerce(data.commerce);
     }
+    if (isData(data.signed_fetch)) {
+        app.signed_fetch = parseSignedFetch(data.signed_fetch);
+    }
+    if (isData(data.pair)) {
+        const pair = parsePair(data.pair);
+        if (typeof pair === 'string') {
+            problems.push(pair);
+        }
+        else {
+            app.pair = pair;
+        }
+    }
     if (isData(data.a2a)) {
         app.a2a = parseA2A(data.a2a);
     }
@@ -1081,7 +1124,7 @@ export function uiProblems(app) {
  * What is wrong with the protocols an application says it speaks
  * (AGENT_PROTOCOLS PS-02), as agentspecs says it: an id the catalogue does not
  * know or said twice, a planned protocol while it is offered, and a `pap`,
- * `pact` or `a2a` block configuring a protocol it does not list.
+ * `pact`, `a2a` or `signed_fetch` block configuring a protocol it does not list.
  */
 export function protocolsProblems(app) {
     const problems = [];
@@ -1105,6 +1148,7 @@ export function protocolsProblems(app) {
         pact: Boolean(app.pact &&
             (app.pact.connections.length > 0 || app.pact.business?.enabled)),
         a2a: Boolean(app.a2a && app.a2a.extensions.length > 0),
+        signed_fetch: Boolean(app.signed_fetch && app.signed_fetch.sites.length > 0),
     };
     for (const spec of Object.values(PROTOCOL_CATALOGUE)) {
         const block = spec.appspecBlock;
@@ -1386,6 +1430,8 @@ export function dumpAppspec(app) {
         .part('pap', dumpPap(app.pap))
         .part('pact', dumpPact(app.pact))
         .part('commerce', dumpCommerce(app.commerce))
+        .part('signed_fetch', dumpSignedFetch(app.signed_fetch))
+        .part('pair', app.pair ? { id: app.pair.id, role: app.pair.role } : {})
         .part('a2a', dumpA2A(app.a2a))
         .list('rules', app.rules.map(rule => ({
         action: rule.action,

package/lib/apps/embed/embeddedSecrets.d.ts

@@ -0,0 +1,16 @@
+/**
+ * What no file the embed ships may hold (PAP_DATALAYER B-02): the PAP SDK's
+ * emitted-bundle test (`src/__tests__/canaries.test.mjs`, `EMBEDDED_SECRETS`)
+ * extended to the embed, a browser artifact anybody's page loads. Its build
+ * fails on a file holding one (`vite.embed.config.ts`), naming the kind and
+ * the file, never what matched.
+ *
+ * Found 2026-10-13: the embed then served at datalayer.ai held the builder's
+ * Datalayer API key, because `import.meta.env` read whole (`env?.VITE_…`) is
+ * every `VITE_` variable of the environment it was built in.
+ *
+ * @module apps/embed/embeddedSecrets
+ */
+export declare const EMBEDDED_SECRETS: ReadonlyArray<readonly [string, RegExp]>;
+/** The kinds of secret a file's text holds, by name: empty when none. */
+export declare function secretsIn(text: string): string[];

package/lib/apps/embed/embeddedSecrets.js

@@ -0,0 +1,34 @@
+/*
+ * Copyright (c) 2025-2026 Datalayer, Inc.
+ * Distributed under the terms of the Modified BSD License.
+ */
+/**
+ * What no file the embed ships may hold (PAP_DATALAYER B-02): the PAP SDK's
+ * emitted-bundle test (`src/__tests__/canaries.test.mjs`, `EMBEDDED_SECRETS`)
+ * extended to the embed, a browser artifact anybody's page loads. Its build
+ * fails on a file holding one (`vite.embed.config.ts`), naming the kind and
+ * the file, never what matched.
+ *
+ * Found 2026-10-13: the embed then served at datalayer.ai held the builder's
+ * Datalayer API key, because `import.meta.env` read whole (`env?.VITE_…`) is
+ * every `VITE_` variable of the environment it was built in.
+ *
+ * @module apps/embed/embeddedSecrets
+ */
+export const EMBEDDED_SECRETS = [
+    // Key material after the header: a library may name the header to refuse it.
+    [
+        'a PEM private key',
+        /-----BEGIN [A-Z ]*PRIVATE KEY-----(?:\\n|\s)*[A-Za-z0-9+/=]{40,}/,
+    ],
+    ['a private JWK member', /["']d["']\s*:\s*["'][A-Za-z0-9_-]{32,}["']/],
+    [
+        'a compact JWT',
+        /eyJ[A-Za-z0-9_-]{10,}\.eyJ[A-Za-z0-9_-]{10,}\.[A-Za-z0-9_-]{10,}/,
+    ],
+    ['a Bearer or DPoP token', /(?:Bearer|DPoP) [A-Za-z0-9_-]{20,}/],
+];
+/** The kinds of secret a file's text holds, by name: empty when none. */
+export function secretsIn(text) {
+    return EMBEDDED_SECRETS.filter(([, pattern]) => pattern.test(text)).map(([kind]) => kind);
+}

package/lib/specs/actions.js

@@ -704,6 +704,12 @@ export const PROTOCOL_TOOL_CLASSES = {
             pap_disconnect: ['write'],
         },
     },
+    'signed-fetch': {
+        connection: 'signed-fetch',
+        tools: {
+            signed_fetch: ['read'],
+        },
+    },
     ucp: {
         connection: 'ucp',
         tools: {
@@ -793,8 +799,10 @@ export const APP_BEHAVIOURS = {
         'earthdata.search_earth_datagranules': 'do_it',
         'earthdata.search_earth_datasets': 'do_it',
     },
+    'errand-runner': {},
     'event-response': {},
     'exchange-desk': {},
+    'guest-desk': {},
     'inbox-triage': {
         'google-workspace.append_table_rows': 'leave_to_me',
         'google-workspace.batch_modify_gmail_message_labels': 'do_it',
@@ -981,6 +989,7 @@ export const APP_BEHAVIOURS = {
     'shop-concierge': {},
     'shopping-desk': {},
     'sign-in-desk': {},
+    'signed-reader': {},
     'supplier-comparison': {},
     'support-desk': {},
     'travel-desk': {},
@@ -1005,8 +1014,10 @@ export const APP_ESCALATIONS = {
     'data-quality': {},
     decide: {},
     'disaster-assessment': {},
+    'errand-runner': {},
     'event-response': {},
     'exchange-desk': {},
+    'guest-desk': {},
     'inbox-triage': {
         'google-workspace.batch_modify_gmail_message_labels': [
             {
@@ -1055,6 +1066,7 @@ export const APP_ESCALATIONS = {
     'shop-concierge': {},
     'shopping-desk': {},
     'sign-in-desk': {},
+    'signed-reader': {},
     'supplier-comparison': {},
     'support-desk': {},
     'travel-desk': {},

package/lib/specs/apps.d.ts

@@ -16,8 +16,10 @@ export declare const CUSTOMER_INTERVIEW_APP_0_0_1: AppSpec;
 export declare const DATA_QUALITY_APP_0_0_1: AppSpec;
 export declare const DECIDE_APP_0_0_1: AppSpec;
 export declare const DISASTER_ASSESSMENT_APP_0_0_1: AppSpec;
+export declare const ERRAND_RUNNER_APP_0_0_1: AppSpec;
 export declare const EVENT_RESPONSE_APP_0_0_1: AppSpec;
 export declare const EXCHANGE_DESK_APP_0_0_1: AppSpec;
+export declare const GUEST_DESK_APP_0_0_1: AppSpec;
 export declare const INBOX_TRIAGE_APP_0_0_1: AppSpec;
 export declare const LIVE_SHOP_CHAT_APP_0_0_1: AppSpec;
 export declare const MODEL_CHOICE_APP_0_0_1: AppSpec;
@@ -33,6 +35,7 @@ export declare const SHIP_OR_FIX_APP_0_0_1: AppSpec;
 export declare const SHOP_CONCIERGE_APP_0_0_1: AppSpec;
 export declare const SHOPPING_DESK_APP_0_0_1: AppSpec;
 export declare const SIGN_IN_DESK_APP_0_0_1: AppSpec;
+export declare const SIGNED_READER_APP_0_0_1: AppSpec;
 export declare const SUPPLIER_COMPARISON_APP_0_0_1: AppSpec;
 export declare const SUPPORT_DESK_APP_0_0_1: AppSpec;
 export declare const TRAVEL_DESK_APP_0_0_1: AppSpec;