asap-protocol 2.5.2__tar.gz → 2.5.4__tar.gz

{asap_protocol-2.5.2 → asap_protocol-2.5.4}/.gitignore

@@ -177,6 +177,8 @@ cython_debug/
 
 # Project specific
 !/.cursor/
+# Local Cursor slash-command workflows (dev process; keep on disk, do not commit)
+.cursor/commands/
 /drafts/
 /.claude/
 # Local agent state / tooling (ignore everywhere, not only repo root)

{asap_protocol-2.5.2 → asap_protocol-2.5.4}/CHANGELOG.md

@@ -7,10 +7,8 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
-### Follow-up (planned v2.5.3+)
+### Follow-up (planned v2.5.5+)
 
-- **Adapter Lab II** — enterprise/workflow adapters ([prd-v2.5.3-adapter-lab-ii.md](product/prd/prd-v2.5.3-adapter-lab-ii.md)).
-- **Distribution Loop** — homepage, templates, metrics ([prd-v2.5.4-distribution-loop.md](product/prd/prd-v2.5.4-distribution-loop.md)).
 - **Formal Spec & Interop** — RFC spec, introspection, privacy ([prd-v2.5.5-formal-spec-interop.md](product/prd/prd-v2.5.5-formal-spec-interop.md)).
 - `@asap-protocol/mcp-auth` HTTP/SSE middleware (deferred from v2.5.0 — see [2.5.0] TypeScript note and [typescript-mcp-auth-spike.md](engineering/tasks/v2.5.0/typescript-mcp-auth-spike.md)).
 - Collapse the dual `UsageMetrics`/`InMemoryMeteringStore` pair retained in S1 for API stability.
@@ -18,6 +16,82 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ---
 
+## [2.5.4] - 2026-07-18
+
+> **Status:** pending tag `v2.5.4` / PyPI publish (S5 prep). Merge → tag → publish runs after this train lands on `main` via `release/2.5.4`.
+
+**Distribution Loop** — homepage, thin starters, Build for agents guide, and maintainer
+telemetry ops (no public metrics UI). Scope:
+[prd-v2.5.4-distribution-loop.md](product/prd/prd-v2.5.4-distribution-loop.md).
+npm `@asap-protocol/*` packages remain at **2.4.1**.
+
+### Added
+
+- **Thin starters** under `examples/starters/`:
+  - `openapi-provider/` — OpenAPI → ASAP skills wrapper
+  - `typescript-consumer/` — `@asap-protocol/client` consumer smoke
+  - `mcp-auth-bridge/` — MCP Auth Bridge (`protect_server`) wrapper
+- **Build for agents guide** — [docs/guides/build-for-agents.md](docs/guides/build-for-agents.md)
+  (agent-first onboarding into the three starters).
+- **Homepage agent-first narrative** — hero / CTAs route to docs, starters, and
+  examples (marketplace browse/register remain secondary).
+- **Telemetry ops** — collector defaults expanded (npm ≥3 scoped packages,
+  PyPI ≥2); maintainer runbook; **no** public live metrics UI (PRD D4).
+
+### Security (deps)
+
+- Raise optional `[mcp]` floor to `mcp>=1.28.1` for **CVE-2026-52869**,
+  **CVE-2026-52870**, and **CVE-2026-59950**. See [SECURITY.md](SECURITY.md).
+
+### Migration
+
+- **v2.5.3 → v2.5.4**: See [migration guide](docs/migration.md#upgrading-from-v253-to-v254).
+  No breaking wire-protocol changes; adopt starters/guide as needed.
+
+---
+
+## [2.5.3] - 2026-07-14
+
+**Adapter Lab II** — workflow / enterprise adapters as **docs + examples** (no wire-format
+change). Scope: [prd-v2.5.3-adapter-lab-ii.md](product/prd/prd-v2.5.3-adapter-lab-ii.md).
+npm `@asap-protocol/*` packages remain at **2.4.1**. Tag [`v2.5.3`](https://github.com/adriannoes/asap-protocol/releases/tag/v2.5.3) · PyPI `asap-protocol==2.5.3`.
+
+### Added
+
+- **Workflow connectors**: OpenAPI → ASAP skills for n8n-/Activepieces-shaped workflow
+  HTTP APIs — [guide](docs/integrations/workflow-connectors.md) +
+  `examples/workflow_asap_connector/` (Compliance Harness v2 score **1.0**).
+- **Automation connector security**: production baseline for OpenAPI-backed connectors
+  ([guide](docs/guides/automation-connector-security.md)).
+- **Microsoft Agent Framework**: research / experimental interop guide
+  ([guide](docs/integrations/microsoft-agent-framework.md)); no .NET SDK / NuGet sample.
+- **NeMo Agent Toolkit**: experimental Path A stdio demo
+  ([guide](docs/integrations/nemo-agent-toolkit.md),
+  `examples/nemo_agent_toolkit_asap/`); Path C third-party plugin remains deferred.
+- **Docs / web surface**: MkDocs Adapters + Lab II nav; marketplace WhatsNew ribbon and
+  developer-experience CTAs for Lab II guides.
+
+### Fixed
+
+- **Invalid envelope JSON-RPC errors**: URN / structure validation failures return
+  JSON-safe `-32602` with `validation_errors` (no longer escalate to `-32603` when
+  Pydantic embeds `ValueError` in `ctx`).
+- **MCP Auth Bridge example client**: self-contained path captures the demo Agent JWT
+  from the spawned child stderr (cross-process paste no longer required).
+- **`ASAPClient.health_check`**: `base_url` defaults to the client's HTTP base URL.
+
+### Security (deps)
+
+- Override `setuptools>=83.0.0` for **PYSEC-2026-3447** (transitive build/tooling path).
+  See [SECURITY.md](SECURITY.md).
+
+### Migration
+
+- **v2.5.2 → v2.5.3**: See [migration guide](docs/migration.md#upgrading-from-v252-to-v253).
+  No breaking wire-protocol changes; adopt new guides/examples as needed.
+
+---
+
 ## [2.5.2] - 2026-07-08
 
 **Security & correctness follow-up** — operator API auth, tighter ingress

{asap_protocol-2.5.2 → asap_protocol-2.5.4}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: asap-protocol
-Version: 2.5.2
+Version: 2.5.4
 Summary: Async Simple Agent Protocol - A streamlined protocol for agent-to-agent communication
 Project-URL: Homepage, https://github.com/adriannoes/asap-protocol
 Project-URL: Documentation, https://adriannoes.github.io/asap-protocol
@@ -73,7 +73,7 @@ Requires-Dist: langchain-core>=1.3.3; extra == 'langchain'
 Provides-Extra: llamaindex
 Requires-Dist: llama-index-core>=0.10; extra == 'llamaindex'
 Provides-Extra: mcp
-Requires-Dist: mcp>=1.0.0; extra == 'mcp'
+Requires-Dist: mcp>=1.28.1; extra == 'mcp'
 Provides-Extra: openapi
 Requires-Dist: openapi-pydantic>=0.5; extra == 'openapi'
 Provides-Extra: openclaw
@@ -99,9 +99,9 @@ Description-Content-Type: text/markdown
 
 > A production-ready protocol for agent-to-agent communication and task coordination.
 
-**Quick Info**: [`v2.5.2`](https://github.com/adriannoes/asap-protocol/releases/tag/v2.5.2) | `Apache 2.0` | `Python 3.13+` | [Documentation](docs/index.md) | [Changelog](CHANGELOG.md)
+**Quick Info**: [`v2.5.3`](https://github.com/adriannoes/asap-protocol/releases/tag/v2.5.3) on PyPI · in-tree **v2.5.4** pending tag · PyPI [`asap-protocol`](https://pypi.org/project/asap-protocol/) | `Apache 2.0` | `Python 3.13+` | [Documentation](docs/index.md) | [Changelog](CHANGELOG.md)
 
-> 📦 **Install** — [`asap-protocol` on PyPI](https://pypi.org/project/asap-protocol/) (Python) · [`@asap-protocol/client` on npm](https://www.npmjs.com/package/@asap-protocol/client) (TypeScript)
+> 📦 **Install** — [`asap-protocol` **2.5.3** on PyPI](https://pypi.org/project/asap-protocol/) (Python; **2.5.4** pending publish) · [`@asap-protocol/client` on npm](https://www.npmjs.com/package/@asap-protocol/client) (TypeScript)
 
 🚀 **Live now** our [**agentic marketplace**](https://asap-protocol.com/) — browse agents, register yours, request verification.
 
@@ -148,24 +148,24 @@ ASAP meets agents where they run — optional Python extras, npm tool bridges, a
 
 | Runtime | Integrations | Docs |
 | --- | --- | --- |
-| **Python** | LangChain, CrewAI, LlamaIndex, PydanticAI, SmolAgents, OpenClaw (`pip install "asap-protocol[extra]"`); Vercel AI SDK router; MCP; MCP Auth Bridge; A2H | [OpenClaw](docs/guides/openclaw-integration.md) · [Vercel AI SDK](docs/guides/vercel-ai-sdk.md) · [MCP](docs/mcp-integration.md) · [MCP Auth Bridge](docs/adapters/mcp-auth-bridge.md) |
-| **TypeScript** (npm) | `@asap-protocol/client` (Vercel AI / OpenAI / Anthropic adapters), `@asap-protocol/mastra`, `@asap-protocol/openai-agents` | [TypeScript SDK](docs/sdks/typescript.md) · [Mastra](docs/integrations/mastra.md) · [OpenAI Agents](docs/integrations/openai-agents.md) |
+| **Python** | LangChain, CrewAI, LlamaIndex, PydanticAI, SmolAgents, OpenClaw (`pip install "asap-protocol[extra]"`); Vercel AI SDK router; MCP; MCP Auth Bridge; A2H; OpenAPI workflow connectors (Lab II) | [OpenClaw](docs/guides/openclaw-integration.md) · [Vercel AI SDK](docs/guides/vercel-ai-sdk.md) · [MCP](docs/mcp-integration.md) · [MCP Auth Bridge](docs/adapters/mcp-auth-bridge.md) · [Workflow connectors](docs/integrations/workflow-connectors.md) · [NeMo Agent Toolkit](docs/integrations/nemo-agent-toolkit.md) (experimental) |
+| **TypeScript** (npm) | `@asap-protocol/client` (Vercel AI / OpenAI / Anthropic adapters), `@asap-protocol/mastra`, `@asap-protocol/openai-agents` | [TypeScript SDK](docs/sdks/typescript.md) · [Mastra](docs/integrations/mastra.md) · [OpenAI Agents](docs/integrations/openai-agents.md) · [Microsoft Agent Framework](docs/integrations/microsoft-agent-framework.md) (research) |
 
 ## Installation
 
 We recommend using [uv](https://github.com/astral-sh/uv) for dependency management:
 
 ```bash
-uv add asap-protocol
+uv add asap-protocol  # latest on PyPI (currently 2.5.3; in-tree 2.5.4 pending publish)
 ```
 
 Or with pip:
 
 ```bash
-pip install asap-protocol
+pip install asap-protocol==2.5.3
 ```
 
-**TypeScript** (npm, **`2.4.1`** — unchanged for v2.5.2; `@asap-protocol/mcp-auth` HTTP middleware still deferred):
+**TypeScript** (npm, **`2.4.1`** — unchanged for v2.5.4; `@asap-protocol/mcp-auth` HTTP middleware still deferred):
 
 - [`@asap-protocol/client`](https://www.npmjs.com/package/@asap-protocol/client) — [SDK docs](docs/sdks/typescript.md)
 - [`@asap-protocol/mastra`](https://www.npmjs.com/package/@asap-protocol/mastra) — [docs](docs/integrations/mastra.md) · [demo](apps/example-mastra/README.md)
@@ -177,7 +177,7 @@ npm install @asap-protocol/mastra@2.4.1 @asap-protocol/client @mastra/core zod
 npm install @asap-protocol/openai-agents@2.4.1 @asap-protocol/client @openai/agents zod
 ```
 
-**Python v2.5.2** (security follow-up): `uv add asap-protocol` or `pip install asap-protocol==2.5.2` — see [Migration (v2.5.1 → v2.5.2)](docs/migration.md#upgrading-from-v251).
+**Python v2.5.4** (Distribution Loop) is **pending tag/PyPI** — see [Migration (v2.5.3 → v2.5.4)](docs/migration.md#upgrading-from-v253-to-v254). Start here: [Build for agents](docs/guides/build-for-agents.md) · [starters](examples/starters/README.md).
 
 ## Quick Start
 
@@ -265,6 +265,8 @@ High-level only — see **[Changelog](https://github.com/adriannoes/asap-protoco
 
 | Version | What shipped |
 | :-- | :-- |
+| **v2.5.4** | **Distribution Loop** — pending tag/PyPI · thin starters (`examples/starters/`), [Build for agents](docs/guides/build-for-agents.md), homepage agent-first CTAs, telemetry ops (no public metrics UI). See [CHANGELOG](CHANGELOG.md#254---2026-07-18), [PRD](product/prd/prd-v2.5.4-distribution-loop.md), and [Migration (v2.5.3 → v2.5.4)](docs/migration.md#upgrading-from-v253-to-v254) |
+| **v2.5.3** | **Adapter Lab II** — **[GitHub Release `v2.5.3`](https://github.com/adriannoes/asap-protocol/releases/tag/v2.5.3)** · workflow OpenAPI connectors + security guide, experimental MAF / NeMo guides, JSON-safe `-32602`, MCP example client DX. See [CHANGELOG](CHANGELOG.md#253---2026-07-14), [PRD](product/prd/prd-v2.5.3-adapter-lab-ii.md), and [Migration (v2.5.2 → v2.5.3)](docs/migration.md#upgrading-from-v252-to-v253) |
 | **v2.5.2** | **Security & correctness follow-up** — opt-in operator API auth, `extra="forbid"` ingress, Redis JTI replay, web distributed rate limits, v2.5.1 CR follow-ups (#245–#249), registry signed-manifest/400 fixes. See [CHANGELOG](CHANGELOG.md#252---2026-07-08), [PRD](product/prd/prd-v2.5.2-security-follow-up.md), and [Migration (v2.5.1 → v2.5.2)](docs/migration.md#upgrading-from-v251) |
 | **v2.5.1** | **Code quality patch** — behavior-preserving refactor (transport/server, client, websocket, SQLite storage, auth, integrations) + six correctness/security fixes (atomic `revoke_cascade`, `usage_events` DDL, unified Host-JWT verifier, **WS now enforces OAuth2**, OpenAPI handler cleanup, client `correlation_id` binding). Deprecated import paths removed in v2.6.0. See [CHANGELOG](CHANGELOG.md#251---2026-06-25) and [Migration (v2.5.0 → v2.5.1)](docs/migration.md#upgrading-from-v250-to-v251) |
 | **v2.5.0.1** | **Compliance publish** — **[GitHub Release `v2.5.0.1`](https://github.com/adriannoes/asap-protocol/releases/tag/v2.5.0.1)** · PyPI **`asap-compliance` 1.3.0** (`mcp-auth-bridge` profile; requires `asap-protocol>=2.5.0`). No `asap-protocol` API change. See [CHANGELOG](CHANGELOG.md#2501---2026-06-24) |
@@ -286,8 +288,7 @@ High-level only — see **[Changelog](https://github.com/adriannoes/asap-protoco
 
 The [agentic marketplace](https://asap-protocol.com/) and Lite Registry are live. The **v2.5.x train** focuses on interop and adoption:
 
-- **v2.5.3** — enterprise/workflow adapter spikes (Adapter Lab II)
-- **v2.5.4** — distribution loop (homepage templates, starter kits, adoption metrics)
+- **v2.5.5** — Formal Spec & Interop (RFC, introspection, privacy)
 - **`@asap-protocol/mcp-auth`** (npm) — HTTP/SSE MCP middleware
 - **Formal spec track** (v2.5.5) — introspection, privacy, cross-protocol interop on the path to v3.0 economy
 

{asap_protocol-2.5.2 → asap_protocol-2.5.4}/README.md

@@ -7,9 +7,9 @@
 
 > A production-ready protocol for agent-to-agent communication and task coordination.
 
-**Quick Info**: [`v2.5.2`](https://github.com/adriannoes/asap-protocol/releases/tag/v2.5.2) | `Apache 2.0` | `Python 3.13+` | [Documentation](docs/index.md) | [Changelog](CHANGELOG.md)
+**Quick Info**: [`v2.5.3`](https://github.com/adriannoes/asap-protocol/releases/tag/v2.5.3) on PyPI · in-tree **v2.5.4** pending tag · PyPI [`asap-protocol`](https://pypi.org/project/asap-protocol/) | `Apache 2.0` | `Python 3.13+` | [Documentation](docs/index.md) | [Changelog](CHANGELOG.md)
 
-> 📦 **Install** — [`asap-protocol` on PyPI](https://pypi.org/project/asap-protocol/) (Python) · [`@asap-protocol/client` on npm](https://www.npmjs.com/package/@asap-protocol/client) (TypeScript)
+> 📦 **Install** — [`asap-protocol` **2.5.3** on PyPI](https://pypi.org/project/asap-protocol/) (Python; **2.5.4** pending publish) · [`@asap-protocol/client` on npm](https://www.npmjs.com/package/@asap-protocol/client) (TypeScript)
 
 🚀 **Live now** our [**agentic marketplace**](https://asap-protocol.com/) — browse agents, register yours, request verification.
 
@@ -56,24 +56,24 @@ ASAP meets agents where they run — optional Python extras, npm tool bridges, a
 
 | Runtime | Integrations | Docs |
 | --- | --- | --- |
-| **Python** | LangChain, CrewAI, LlamaIndex, PydanticAI, SmolAgents, OpenClaw (`pip install "asap-protocol[extra]"`); Vercel AI SDK router; MCP; MCP Auth Bridge; A2H | [OpenClaw](docs/guides/openclaw-integration.md) · [Vercel AI SDK](docs/guides/vercel-ai-sdk.md) · [MCP](docs/mcp-integration.md) · [MCP Auth Bridge](docs/adapters/mcp-auth-bridge.md) |
-| **TypeScript** (npm) | `@asap-protocol/client` (Vercel AI / OpenAI / Anthropic adapters), `@asap-protocol/mastra`, `@asap-protocol/openai-agents` | [TypeScript SDK](docs/sdks/typescript.md) · [Mastra](docs/integrations/mastra.md) · [OpenAI Agents](docs/integrations/openai-agents.md) |
+| **Python** | LangChain, CrewAI, LlamaIndex, PydanticAI, SmolAgents, OpenClaw (`pip install "asap-protocol[extra]"`); Vercel AI SDK router; MCP; MCP Auth Bridge; A2H; OpenAPI workflow connectors (Lab II) | [OpenClaw](docs/guides/openclaw-integration.md) · [Vercel AI SDK](docs/guides/vercel-ai-sdk.md) · [MCP](docs/mcp-integration.md) · [MCP Auth Bridge](docs/adapters/mcp-auth-bridge.md) · [Workflow connectors](docs/integrations/workflow-connectors.md) · [NeMo Agent Toolkit](docs/integrations/nemo-agent-toolkit.md) (experimental) |
+| **TypeScript** (npm) | `@asap-protocol/client` (Vercel AI / OpenAI / Anthropic adapters), `@asap-protocol/mastra`, `@asap-protocol/openai-agents` | [TypeScript SDK](docs/sdks/typescript.md) · [Mastra](docs/integrations/mastra.md) · [OpenAI Agents](docs/integrations/openai-agents.md) · [Microsoft Agent Framework](docs/integrations/microsoft-agent-framework.md) (research) |
 
 ## Installation
 
 We recommend using [uv](https://github.com/astral-sh/uv) for dependency management:
 
 ```bash
-uv add asap-protocol
+uv add asap-protocol  # latest on PyPI (currently 2.5.3; in-tree 2.5.4 pending publish)
 ```
 
 Or with pip:
 
 ```bash
-pip install asap-protocol
+pip install asap-protocol==2.5.3
 ```
 
-**TypeScript** (npm, **`2.4.1`** — unchanged for v2.5.2; `@asap-protocol/mcp-auth` HTTP middleware still deferred):
+**TypeScript** (npm, **`2.4.1`** — unchanged for v2.5.4; `@asap-protocol/mcp-auth` HTTP middleware still deferred):
 
 - [`@asap-protocol/client`](https://www.npmjs.com/package/@asap-protocol/client) — [SDK docs](docs/sdks/typescript.md)
 - [`@asap-protocol/mastra`](https://www.npmjs.com/package/@asap-protocol/mastra) — [docs](docs/integrations/mastra.md) · [demo](apps/example-mastra/README.md)
@@ -85,7 +85,7 @@ npm install @asap-protocol/mastra@2.4.1 @asap-protocol/client @mastra/core zod
 npm install @asap-protocol/openai-agents@2.4.1 @asap-protocol/client @openai/agents zod
 ```
 
-**Python v2.5.2** (security follow-up): `uv add asap-protocol` or `pip install asap-protocol==2.5.2` — see [Migration (v2.5.1 → v2.5.2)](docs/migration.md#upgrading-from-v251).
+**Python v2.5.4** (Distribution Loop) is **pending tag/PyPI** — see [Migration (v2.5.3 → v2.5.4)](docs/migration.md#upgrading-from-v253-to-v254). Start here: [Build for agents](docs/guides/build-for-agents.md) · [starters](examples/starters/README.md).
 
 ## Quick Start
 
@@ -173,6 +173,8 @@ High-level only — see **[Changelog](https://github.com/adriannoes/asap-protoco
 
 | Version | What shipped |
 | :-- | :-- |
+| **v2.5.4** | **Distribution Loop** — pending tag/PyPI · thin starters (`examples/starters/`), [Build for agents](docs/guides/build-for-agents.md), homepage agent-first CTAs, telemetry ops (no public metrics UI). See [CHANGELOG](CHANGELOG.md#254---2026-07-18), [PRD](product/prd/prd-v2.5.4-distribution-loop.md), and [Migration (v2.5.3 → v2.5.4)](docs/migration.md#upgrading-from-v253-to-v254) |
+| **v2.5.3** | **Adapter Lab II** — **[GitHub Release `v2.5.3`](https://github.com/adriannoes/asap-protocol/releases/tag/v2.5.3)** · workflow OpenAPI connectors + security guide, experimental MAF / NeMo guides, JSON-safe `-32602`, MCP example client DX. See [CHANGELOG](CHANGELOG.md#253---2026-07-14), [PRD](product/prd/prd-v2.5.3-adapter-lab-ii.md), and [Migration (v2.5.2 → v2.5.3)](docs/migration.md#upgrading-from-v252-to-v253) |
 | **v2.5.2** | **Security & correctness follow-up** — opt-in operator API auth, `extra="forbid"` ingress, Redis JTI replay, web distributed rate limits, v2.5.1 CR follow-ups (#245–#249), registry signed-manifest/400 fixes. See [CHANGELOG](CHANGELOG.md#252---2026-07-08), [PRD](product/prd/prd-v2.5.2-security-follow-up.md), and [Migration (v2.5.1 → v2.5.2)](docs/migration.md#upgrading-from-v251) |
 | **v2.5.1** | **Code quality patch** — behavior-preserving refactor (transport/server, client, websocket, SQLite storage, auth, integrations) + six correctness/security fixes (atomic `revoke_cascade`, `usage_events` DDL, unified Host-JWT verifier, **WS now enforces OAuth2**, OpenAPI handler cleanup, client `correlation_id` binding). Deprecated import paths removed in v2.6.0. See [CHANGELOG](CHANGELOG.md#251---2026-06-25) and [Migration (v2.5.0 → v2.5.1)](docs/migration.md#upgrading-from-v250-to-v251) |
 | **v2.5.0.1** | **Compliance publish** — **[GitHub Release `v2.5.0.1`](https://github.com/adriannoes/asap-protocol/releases/tag/v2.5.0.1)** · PyPI **`asap-compliance` 1.3.0** (`mcp-auth-bridge` profile; requires `asap-protocol>=2.5.0`). No `asap-protocol` API change. See [CHANGELOG](CHANGELOG.md#2501---2026-06-24) |
@@ -194,8 +196,7 @@ High-level only — see **[Changelog](https://github.com/adriannoes/asap-protoco
 
 The [agentic marketplace](https://asap-protocol.com/) and Lite Registry are live. The **v2.5.x train** focuses on interop and adoption:
 
-- **v2.5.3** — enterprise/workflow adapter spikes (Adapter Lab II)
-- **v2.5.4** — distribution loop (homepage templates, starter kits, adoption metrics)
+- **v2.5.5** — Formal Spec & Interop (RFC, introspection, privacy)
 - **`@asap-protocol/mcp-auth`** (npm) — HTTP/SSE MCP middleware
 - **Formal spec track** (v2.5.5) — introspection, privacy, cross-protocol interop on the path to v3.0 economy
 

{asap_protocol-2.5.2 → asap_protocol-2.5.4}/pyproject.toml

@@ -1,6 +1,6 @@
 [project]
 name = "asap-protocol"
-version = "2.5.2"
+version = "2.5.4"
 description = "Async Simple Agent Protocol - A streamlined protocol for agent-to-agent communication"
 authors = [
     {name = "ASAP Protocol Contributors"}
@@ -84,7 +84,8 @@ webauthn = [
 ]
 # Framework integrations (Sprint E3 — PKG-003).
 mcp = [
-    "mcp>=1.0.0",
+    # Floor 1.28.1 for CVE-2026-52869 / CVE-2026-52870 / CVE-2026-59950.
+    "mcp>=1.28.1",
 ]
 langchain = [
     "langchain-core>=1.3.3",
@@ -127,7 +128,8 @@ Issues = "https://github.com/adriannoes/asap-protocol/issues"
 # - tinytag>=2.2.1 for CVE-2026-32889
 # - cryptography>=48.0.1 for GHSA-537c-gmf6-5ccf (CVE-2026-39892 / CVE-2026-34073 baseline at 46.0.7)
 # - requests>=2.33.0 for CVE-2026-25645 (extract_zipped_paths temp file)
-# - pillow>=12.2.0 for CVE-2026-40192 (transitive, e.g. pdf/vision stacks)
+# - pillow>=12.3.0 for PYSEC-2026-2253–2257 (prior: CVE-2026-40192 at >=12.2.0; transitive, e.g. pdf/vision stacks)
+# - click>=8.3.3 for PYSEC-2026-2132 (transitive, e.g. typer / uvicorn / mkdocs stacks)
 # - pytest>=9.0.3 for CVE-2025-71176 (dev)
 # - python-multipart>=0.0.31 for CVE-2026-53538–53540 (FastAPI stack; prior floor 0.0.27)
 # - starlette>=1.3.1 for CVE-2026-54282 / CVE-2026-54283 (FastAPI stack)
@@ -145,6 +147,7 @@ Issues = "https://github.com/adriannoes/asap-protocol/issues"
 # - joserfc>=1.6.7 for CVE-2026-48990 (JWT/JWS primitives; direct + override)
 # - python-engineio>=4.13.2 for CVE-2026-48802 / CVE-2026-48809 (transitive, locust stack)
 # - python-socketio>=5.16.2 for CVE-2026-48804 (transitive, locust stack)
+# - setuptools>=83.0.0 for PYSEC-2026-3447 (transitive build/tooling path)
 [tool.uv]
 override-dependencies = [
     "aiohttp>=3.14.0,<4",
@@ -153,7 +156,8 @@ override-dependencies = [
     "tinytag>=2.2.1",
     "cryptography>=48.0.1,<49",
     "requests>=2.33.0",
-    "pillow>=12.2.0",
+    "pillow>=12.3.0",
+    "click>=8.3.3",
     "pytest>=9.0.3",
     "python-multipart>=0.0.31",
     "starlette>=1.3.1",
@@ -172,6 +176,7 @@ override-dependencies = [
     "joserfc>=1.6.7,<2",
     "python-engineio>=4.13.2",
     "python-socketio>=5.16.2",
+    "setuptools>=83.0.0",
 ]
 
 [project.scripts]

{asap_protocol-2.5.2 → asap_protocol-2.5.4}/src/asap/__init__.py

@@ -8,7 +8,7 @@ from __future__ import annotations
 
 from typing import Any
 
-__version__ = "2.5.2"
+__version__ = "2.5.4"
 
 __all__ = ["__version__", "create_from_openapi"]
 

{asap_protocol-2.5.2 → asap_protocol-2.5.4}/src/asap/examples/README.md

@@ -8,7 +8,7 @@ Examples cover:
 
 - **Core flow**: Echo agent, coordinator, and a full demo (run_demo).
 - **Advanced patterns**: Multi-agent orchestration, long-running tasks with checkpoints, error recovery, MCP integration, state migration, auth, rate limiting.
-- **Concepts**: WebSocket (not implemented), streaming responses, multi-step workflows.
+- **Concepts**: WebSocket (`/asap/ws` on `create_app`), streaming responses (`streaming_agent`), multi-step workflows.
 
 Run any example from the repository root with:
 
@@ -97,16 +97,17 @@ Run agents individually:
 | **auth_patterns** | Bearer auth, custom token validators, OAuth2 concept (manifest + create_app) | `uv run python -m asap.examples.auth_patterns` |
 | **rate_limiting** | Per-sender and per-endpoint rate limit patterns (create_limiter, ASAP_RATE_LIMIT) | `uv run python -m asap.examples.rate_limiting` |
 
-### Concepts (no full implementation)
+### Concepts
 
 | Module | Description | Usage |
 |--------|-------------|--------|
-| **websocket_concept** | How WebSocket would work with ASAP (comments/pseudocode only) | `uv run python -m asap.examples.websocket_concept` |
+| **websocket_concept** | Educational notes; live transport is WebSocket `/asap/ws` (see `docs/transport.md`) | `uv run python -m asap.examples.websocket_concept` |
 
 ### Streaming and workflows
 
 | Module | Description | Usage |
 |--------|-------------|--------|
+| **streaming_agent** | Live agent with SSE `TaskStream` chunks over HTTP | `uv run python -m asap.examples.streaming_agent` |
 | **streaming_response** | Stream TaskUpdate progress chunks (simulated streaming) | `uv run python -m asap.examples.streaming_response [--chunks N]` |
 | **multi_step_workflow** | Multi-step pipeline: fetch → transform → summarize (WorkflowState, run_workflow) | `uv run python -m asap.examples.multi_step_workflow` |
 

{asap_protocol-2.5.2 → asap_protocol-2.5.4}/src/asap/transport/_request_handler.py

@@ -79,7 +79,38 @@ T = TypeVar("T")
 HandlerResult = tuple[T | None, JSONResponse | None]
 EnvelopeOrError = Union[JSONResponse, tuple[Envelope, str]]
 
-__all__ = ["ASAPRequestHandler", "_audit_log_operation", "_fallback_context"]
+__all__ = [
+    "ASAPRequestHandler",
+    "_audit_log_operation",
+    "_fallback_context",
+    "json_safe_validation_errors",
+]
+
+
+def json_safe_validation_errors(exc: ValidationError) -> list[dict[str, Any]]:
+    """Return Pydantic validation errors that are JSON-serializable.
+
+    ``ValidationError.errors()`` may embed non-JSON types in ``ctx`` (e.g. a
+    raw ``ValueError`` from a field validator). Putting that into
+    ``JSONResponse`` raises during Starlette encoding and the client sees
+    JSON-RPC ``-32603`` instead of ``-32602``.
+
+    Uses ``exc.json()`` so ``ctx`` values are stringified while locations and
+    messages stay intact.
+
+    Example:
+        >>> from pydantic import BaseModel, ValidationError
+        >>> class M(BaseModel):
+        ...     x: int
+        >>> try:
+        ...     M(x="bad")
+        ... except ValidationError as err:
+        ...     errs = json_safe_validation_errors(err)
+        >>> isinstance(errs[0]["loc"], list)
+        True
+    """
+    loaded: list[dict[str, Any]] = json.loads(exc.json())
+    return loaded
 
 
 def _fallback_context(start_time: float) -> RequestContext:
@@ -309,9 +340,10 @@ class ASAPRequestHandler:
             payload_type = envelope.payload_type
             return envelope, payload_type
         except ValidationError as e:
+            validation_errors = json_safe_validation_errors(e)
             log_data: dict[str, Any] = {
                 "error": "Invalid envelope structure",
-                "validation_errors": e.errors(),
+                "validation_errors": validation_errors,
             }
             if not is_debug_mode():
                 log_data = sanitize_for_logging(log_data)
@@ -322,7 +354,7 @@ class ASAPRequestHandler:
                 INVALID_PARAMS,
                 data={
                     "error": "Invalid envelope structure",
-                    "validation_errors": e.errors(),
+                    "validation_errors": validation_errors,
                 },
                 request_id=ctx.request_id,
             )
@@ -820,22 +852,22 @@ class ASAPRequestHandler:
             error_code = INVALID_REQUEST
             error_message = "Invalid JSON-RPC structure"
             if isinstance(e, ValidationError):
-                errors = e.errors()
+                validation_errors = json_safe_validation_errors(e)
                 # If params validation failed with dict_type error, use INVALID_PARAMS
-                for error in errors:
-                    if error.get("loc") == ("params",) and error.get("type") == "dict_type":
+                for error in validation_errors:
+                    if error.get("loc") == ["params"] and error.get("type") == "dict_type":
                         error_code = INVALID_PARAMS
                         error_message = "JSON-RPC 'params' must be an object"
                         break
+            else:
+                validation_errors = [
+                    {"type": "type_error", "loc": [], "msg": str(e), "input": None}
+                ]
 
             log_struct: dict[str, Any] = {
                 "error": error_message,
                 "error_type": type(e).__name__,
-                "validation_errors": (
-                    e.errors()
-                    if isinstance(e, ValidationError)
-                    else [{"type": "type_error", "loc": (), "msg": str(e), "input": None}]
-                ),
+                "validation_errors": validation_errors,
             }
             if not is_debug_mode():
                 log_struct = sanitize_for_logging(log_struct)
@@ -844,11 +876,7 @@ class ASAPRequestHandler:
                 error_code,
                 data={
                     "error": error_message,
-                    "validation_errors": (
-                        e.errors()
-                        if isinstance(e, ValidationError)
-                        else [{"type": "type_error", "loc": (), "msg": str(e), "input": None}]
-                    ),
+                    "validation_errors": validation_errors,
                 },
                 request_id=body.get("id") if isinstance(body, dict) else None,
             )

{asap_protocol-2.5.2 → asap_protocol-2.5.4}/src/asap/transport/client/_discovery.py

@@ -418,7 +418,7 @@ class _DiscoveryMixin:
                     url=sanitize_url(url),
                 ) from e
 
-    async def health_check(self, base_url: str) -> HealthStatus:
+    async def health_check(self, base_url: str | None = None) -> HealthStatus:
         """Check agent health/liveness at the given base URL.
 
         Fetches GET {base_url}/.well-known/asap/health and parses the
@@ -426,6 +426,7 @@ class _DiscoveryMixin:
 
         Args:
             base_url: Agent base URL (e.g. "https://agent.example.com").
+                Defaults to this client's HTTP base URL when omitted.
 
         Returns:
             HealthStatus with status, agent_id, version, uptime_seconds, etc.
@@ -437,10 +438,11 @@ class _DiscoveryMixin:
 
         Example:
             >>> async with ASAPClient("http://localhost:8000") as client:
-            ...     health = await client.health_check("https://other-agent.example.com")
+            ...     health = await client.health_check()
             ...     print(health.status, health.uptime_seconds)
         """
-        health_url = base_url.rstrip("/") + WELLKNOWN_HEALTH_PATH
+        resolved = self._http_base_url if base_url is None else base_url
+        health_url = resolved.rstrip("/") + WELLKNOWN_HEALTH_PATH
         if not self._client:
             raise ASAPConnectionError(
                 "Client not connected. Use 'async with' context.",