@datalayer/agent-runtimes 1.5.9 → 1.5.11

package/lib/specs/appspecSchema.js

@@ -1114,6 +1114,24 @@ export const APPSPEC_SCHEMA = {
             title: 'AppPageOutput',
             type: 'object',
         },
+        AppPair: {
+            additionalProperties: false,
+            description: "One of a pair of examples, a PACT business and the personal agent that asks it\n(AGENT_PROTOCOLS PR-13, E-02; decided 2026-10-13).\n\nA personal agent's issuer is its own application's, known only once a copy\nexists: when a person has copied both of a pair, the Studio registers the\npersonal agent's copy with the business's copy (`pact.business.registered_agents`)\nand points the personal agent at the business's own domain.",
+            properties: {
+                id: {
+                    description: "The pair's id, the same on both of its applications",
+                    title: 'Id',
+                    type: 'string',
+                },
+                role: {
+                    $ref: '#/$defs/PairRole',
+                    description: '`business`, or `personal_agent`: the one that asks it',
+                },
+            },
+            required: ['id', 'role'],
+            title: 'AppPair',
+            type: 'object',
+        },
         AppPap: {
             additionalProperties: false,
             description: 'Personal Agent Protocol: the companies it works with, and whether it is one.\n\nA `pap` block names the profile it is written for (PAP_DATALAYER S-03): one\nDatalayer speaks, or it is refused in a sentence. An application without the\nblock has none.',
@@ -1652,6 +1670,41 @@ export const APPSPEC_SCHEMA = {
             title: 'AppScenario',
             type: 'object',
         },
+        AppSignedFetch: {
+            additionalProperties: false,
+            description: 'Signed fetch: the sites it reads pages of, signed with its Web Bot Auth key (AGENT_PROTOCOLS EX-11).',
+            properties: {
+                sites: {
+                    description: 'Sites, each by its exact domain: read with GET only, every request signed',
+                    items: {
+                        $ref: '#/$defs/AppSignedFetchSite',
+                    },
+                    title: 'Sites',
+                    type: 'array',
+                },
+            },
+            title: 'AppSignedFetch',
+            type: 'object',
+        },
+        AppSignedFetchSite: {
+            additionalProperties: false,
+            description: "A website the application reads pages of, each request signed (AGENT_PROTOCOLS EX-11).\n\nDecided 2026-10-13: a *signed fetch* names exact sites, an allow-list.\nDatalayer's gateway reads a page there with `GET` only, on its safe\negress path (public addresses only), each request signed with the\napplication's own Web Bot Auth key and recorded; reading is under the\napplication's Rules like any read. Named by its domain: no other host is\nreached, and no credential is ever part of a spec.",
+            properties: {
+                id: {
+                    description: 'Stable within the application: `example-verifier`',
+                    title: 'Id',
+                    type: 'string',
+                },
+                site: {
+                    description: "The site's domain, exactly: `verify.examples.datalayer.run`",
+                    title: 'Site',
+                    type: 'string',
+                },
+            },
+            required: ['id', 'site'],
+            title: 'AppSignedFetchSite',
+            type: 'object',
+        },
         AppSpaceGrant: {
             additionalProperties: false,
             description: 'A Space the application may reach.',
@@ -2360,6 +2413,12 @@ export const APPSPEC_SCHEMA = {
             title: 'Layout',
             type: 'string',
         },
+        PairRole: {
+            description: 'Which side of a pair of examples an application is (AGENT_PROTOCOLS PR-13).',
+            enum: ['business', 'personal_agent'],
+            title: 'PairRole',
+            type: 'string',
+        },
         PapAgents: {
             description: 'Which personal agents a company application accepts.',
             enum: ['any', 'registered'],
@@ -2567,7 +2626,7 @@ export const APPSPEC_SCHEMA = {
             type: 'array',
         },
         protocols: {
-            description: 'The agent protocols it speaks, ids of the protocols catalogue (AGENT_PROTOCOLS PS-02): its `pap`, `pact` and `a2a` blocks, and each merchant of `commerce`, are refused unless their protocol is listed, and a planned protocol only while it is not offered',
+            description: 'The agent protocols it speaks, ids of the protocols catalogue (AGENT_PROTOCOLS PS-02): its `pap`, `pact`, `signed_fetch` and `a2a` blocks, and each merchant of `commerce`, are refused unless their protocol is listed, and a planned protocol only while it is not offered',
             items: {
                 type: 'string',
             },
@@ -2594,6 +2653,22 @@ export const APPSPEC_SCHEMA = {
             $ref: '#/$defs/AppCommerce',
             description: 'UCP and ACP: merchants it shops at for each person',
         },
+        signed_fetch: {
+            $ref: '#/$defs/AppSignedFetch',
+            description: 'Web Bot Auth: the sites it reads pages of, GET only, each request signed with its key',
+        },
+        pair: {
+            anyOf: [
+                {
+                    $ref: '#/$defs/AppPair',
+                },
+                {
+                    type: 'null',
+                },
+            ],
+            default: null,
+            description: 'One of a pair of examples: a PACT business, or the personal agent that asks it',
+        },
         a2a: {
             $ref: '#/$defs/AppA2A',
             description: 'A2A: the extensions its Agent Card advertises',

package/lib/specs/protocols.js

@@ -162,7 +162,7 @@ export const WEB_BOT_AUTH_PROTOCOL_0_0_1 = {
     id: 'web-bot-auth',
     version: '0.0.1',
     name: 'Web Bot Auth',
-    description: 'Signed outbound requests (RFC 9421) and the key directory a website checks them against.',
+    description: 'Signed outbound requests (RFC 9421) and the key directory a website checks them against. In applications, every request to a company, business or merchant is signed, and a signed fetch reads pages at the sites an application names, GET only (decided 2026-10-13).',
     publisher: 'Cloudflare (IETF draft)',
     layer: 'identity',
     specUrl: 'https://datatracker.ietf.org/doc/draft-ietf-webbotauth-httpsig-protocol/',
@@ -173,7 +173,8 @@ export const WEB_BOT_AUTH_PROTOCOL_0_0_1 = {
         python: ['agent-runtimes'],
         typescript: ['@datalayer/agent-runtimes', 'web-bot-auth'],
     },
-    protocolTools: [],
+    protocolTools: ['signed-fetch'],
+    appspecBlock: 'signed_fetch',
 };
 export const PROTOCOL_CATALOGUE = {
     a2a: A2A_PROTOCOL_0_0_1,

package/lib/types/agentspecs.d.ts

@@ -156,7 +156,7 @@ export interface ProtocolSpec {
     /** Its tools' action-class tables (`agentspecs/protocol-tools`). */
     protocolTools: string[];
     /** The Appspec block it configures, if any: refused unless `protocols` lists it. */
-    appspecBlock?: 'pap' | 'pact' | 'a2a';
+    appspecBlock?: 'pap' | 'pact' | 'a2a' | 'signed_fetch';
 }
 /** A check a Frame requires of the output of work done under it. */
 export interface FrameGuardSpec {
@@ -630,6 +630,34 @@ export interface AppCommerceMerchantSpec {
 export interface AppCommerceSpec {
     merchants: AppCommerceMerchantSpec[];
 }
+/**
+ * A website the application reads pages of, each request signed with its
+ * own Web Bot Auth key (AGENT_PROTOCOLS EX-11, decided 2026-10-13): the
+ * gateway's `signed-fetch` toolset reads there with GET only. Never a
+ * credential.
+ */
+export interface AppSignedFetchSiteSpec {
+    /** Stable within the application: `example-verifier`. */
+    id: string;
+    /** The site's domain, exactly: `verify.examples.datalayer.run`. */
+    site: string;
+}
+/** Signed fetch: the exact sites it reads pages of, an allow-list. */
+export interface AppSignedFetchSpec {
+    sites: AppSignedFetchSiteSpec[];
+}
+/**
+ * One of a pair of examples, a PACT business and the personal agent that
+ * asks it (AGENT_PROTOCOLS PR-13; decided 2026-10-13): when a person has
+ * copied both, the Studio registers the personal agent's copy with the
+ * business's copy and points the personal agent there.
+ */
+export interface AppPairSpec {
+    /** The pair's id, the same on both of its applications. */
+    id: string;
+    /** Which side of the pair it is. */
+    role: 'business' | 'personal_agent';
+}
 /**
  * An A2A extension the application's Agent Card advertises, beside the
  * runtime's own (AGENT_PROTOCOLS PR-02). Its params are public: never a
@@ -1237,6 +1265,10 @@ export interface AppSpec {
     pact?: AppPactSpec;
     /** UCP and ACP: the merchants it shops at for each person (AGENT_PROTOCOLS PI-01). */
     commerce?: AppCommerceSpec;
+    /** Signed fetch: the sites it reads pages of, each request signed (AGENT_PROTOCOLS EX-11). */
+    signed_fetch?: AppSignedFetchSpec;
+    /** One of a pair of examples: a PACT business, or the personal agent that asks it (PR-13). */
+    pair?: AppPairSpec;
     /** A2A: the extensions its Agent Card advertises (AGENT_PROTOCOLS PR-02). */
     a2a?: AppA2ASpec;
     rules: AppRuleSpec[];

package/package.json

@@ -1,6 +1,6 @@
 {
     "name": "@datalayer/agent-runtimes",
-    "version": "1.5.9",
+    "version": "1.5.11",
     "type": "module",
     "workspaces": [
         ".",

package/scripts/codegen/generate_apps.py

@@ -156,8 +156,8 @@ def load_specs(specs_dir: Path) -> tuple[list[dict[str, Any]], dict[str, Any]]:
             mode="json", by_alias=True
         ):
             spec.pop("pap")
-        # PACT, commerce and A2A's extensions the same way (AGENT_PROTOCOLS PI-01, PR-02).
-        for block in ("pact", "commerce", "a2a"):
+        # PACT, commerce, signed fetch and A2A's extensions the same way (AGENT_PROTOCOLS PI-01, PR-02, EX-11).
+        for block in ("pact", "commerce", "signed_fetch", "a2a"):
             if block in spec and spec[block] == type(getattr(app, block))().model_dump(
                 mode="json", by_alias=True
             ):

package/scripts/codegen/generate_protocols.py

@@ -26,7 +26,7 @@ from versioning import ensure_spec_version, version_suffix
 
 LAYERS = ("transport", "consent", "identity", "commerce", "ui")
 STATUSES = ("shipped", "planned")
-BLOCKS = ("pap", "pact", "a2a")
+BLOCKS = ("pap", "pact", "a2a", "signed_fetch")
 
 
 def load_protocol_specs(specs_dir: Path) -> list[dict[str, Any]]: