@datalayer/agent-runtimes 1.3.104 → 1.3.106

package/lib/apps/apps/appspec.js

@@ -694,6 +694,15 @@ export function parseAppspec(document) {
                 expect: text(testCase.expect),
                 // Decided by its code (LOOP P-06), when it names the function.
                 ...(text(testCase.code) ? { code: text(testCase.code) } : {}),
+                // Given files with what it is asked, when it is.
+                ...(records(testCase.files).length
+                    ? {
+                        files: records(testCase.files).map(file => ({
+                            name: text(file.name),
+                            text: text(file.text),
+                        })),
+                    }
+                    : {}),
             })),
             verified: {
                 live: texts(verified.live),
@@ -1012,6 +1021,14 @@ export function dumpAppspec(app) {
         ask: testCase.ask,
         expect: testCase.expect,
         ...(testCase.code ? { code: testCase.code } : {}),
+        ...(testCase.files?.length
+            ? {
+                files: testCase.files.map(file => ({
+                    name: file.name,
+                    text: file.text,
+                })),
+            }
+            : {}),
     })))
         .part('verified', new Writer()
         .list('live', app.tests.verified.live)

package/lib/apps/apps/checks.js

@@ -1033,6 +1033,10 @@ export function documentShapeProblems(document) {
         records(tests.cases, 'tests.cases', (item, where) => {
             required(item, 'ask', where);
             required(item, 'expect', where);
+            records(item.files, `${where}.files`, (file, at) => {
+                required(file, 'name', at);
+                required(file, 'text', at);
+            });
         });
     });
     mapping(d.record, 'record', record => {

package/lib/apps/plugins/pap-example/index.d.ts

@@ -0,0 +1,23 @@
+/**
+ * The mould for Personal Agent Protocol gallery examples.
+ *
+ * Each example is a Reactor plugin contributing one lazy workspace view. PAP
+ * therefore enters the Loop through the same extension boundary as A2A,
+ * A2UI, editors and runtime capacities—not through a page-specific switch.
+ *
+ * @module apps/plugins/pap-example
+ */
+import type { ComponentType } from 'react';
+import { type ReactorPlugin } from '@datalayer/reactor';
+import { type LoopViewProps } from '../../core';
+export type PapExamplePluginOptions = {
+    key: string;
+    title: string;
+    description: string;
+    load: () => Promise<{
+        default: ComponentType<LoopViewProps>;
+    }>;
+};
+/** Define one PAP workspace view as a Reactor plugin. */
+export declare function definePapExamplePlugin(options: PapExamplePluginOptions): ReactorPlugin<Record<string, never>, unknown, unknown>;
+export default definePapExamplePlugin;

package/lib/apps/plugins/pap-example/index.js

@@ -0,0 +1,25 @@
+/*
+ * Copyright (c) 2025-2026 Datalayer, Inc.
+ * Distributed under the terms of the Modified BSD License.
+ */
+import { contribution, definePlugin, } from '@datalayer/reactor';
+import { LoopViewType } from '../../core';
+/** Define one PAP workspace view as a Reactor plugin. */
+export function definePapExamplePlugin(options) {
+    return definePlugin({
+        name: `@datalayer/loop-plugin-pap-example-${options.key}`,
+        displayName: options.title,
+        description: options.description,
+        octicon: 'shield-lock',
+        emoji: '🔐',
+        contributes: [
+            contribution(LoopViewType, {
+                viewType: `pap-example-${options.key}`,
+                title: options.title,
+                order: -10,
+                load: options.load,
+            }, { id: `pap-example-${options.key}`, order: -10 }),
+        ],
+    });
+}
+export default definePapExamplePlugin;

package/lib/components/inspector/a2aSpans.js

@@ -63,6 +63,11 @@ export function pressedAction(message) {
 }
 const FAILED_STATES = /FAILED|REJECTED|CANCELED/;
 /** Records what came back for one request onto its span. */
+/** A text cut at `length` characters, its line breaks kept. */
+function clipped(text, length) {
+    const trimmed = text.trim();
+    return trimmed.length > length ? `${trimmed.slice(0, length - 1)}…` : trimmed;
+}
 class ResponseRecorder {
     options;
     span;
@@ -217,7 +222,9 @@ class ResponseRecorder {
         this.span.addEvent('a2a.artifact_update', {
             ...chunk.attributes,
             'a2a.artifact.chunks': chunk.events.length,
-            'a2a.message.text': chunk.text ? shortLine(chunk.text, 2000) : undefined,
+            // Its words as they came — a table's rows, a list's lines — cut at
+            // 2000 characters, not run into one line: the transcript draws them.
+            'a2a.message.text': chunk.text ? clipped(chunk.text, 2000) : undefined,
             'a2a.event': jsonAttribute(chunk.events.length === 1 ? chunk.events[0] : chunk.events),
         });
     }

package/lib/components/teams/SceneTranscript.js

@@ -3,6 +3,7 @@ import { useMemo, useState } from 'react';
 import { Button, Text } from '@primer/react';
 import { Box } from '@datalayer/primer-addons';
 import { useOtelLiveSpans } from '@datalayer/core/lib/otel/live';
+import { ChatMarkdown } from '../../chat/messages/ChatMarkdown';
 import { lineHeading, timeText, transcriptOfSpans, transcriptText, } from './sceneTranscript';
 /** The transcript of a tracer's spans, kept current as they change. */
 export function useSceneTranscript(tracer, members) {
@@ -32,9 +33,13 @@ export function SceneTranscript({ lines, emptyText = 'What the scene says and do
                                 fontSize: 0,
                                 pt: '2px',
                                 whiteSpace: 'nowrap',
-                            }, dateTime: new Date(line.at).toISOString(), children: timeText(line.at) }), _jsxs(Box, { minWidth: 0, overflowWrap: "anywhere", children: [_jsxs(Text, { sx: { fontWeight: 600 }, children: [lineHeading(line), ": "] }), _jsxs(Text, { sx: {
-                                        fontFamily: line.kind === 'called' ? 'mono' : undefined,
+                            }, dateTime: new Date(line.at).toISOString(), children: timeText(line.at) }), line.kind === 'called' ? (_jsxs(Box, { minWidth: 0, overflowWrap: "anywhere", children: [_jsxs(Text, { sx: { fontWeight: 600 }, children: [lineHeading(line), ": "] }), _jsxs(Text, { sx: {
+                                        fontFamily: 'mono',
                                         color: line.failed ? 'danger.fg' : undefined,
-                                    }, children: [line.text, line.open ? '…' : '', line.failed ? ' (failed)' : ''] })] })] }, line.key))) })), copy && lines.length > 0 && (_jsx(Box, { mt: 2, children: _jsx(Button, { size: "small", onClick: () => void onCopy(), "data-transcript-copy": "", children: copied ? 'Copied' : 'Copy as text' }) }))] }));
+                                    }, children: [line.text, line.open ? '…' : '', line.failed ? ' (failed)' : ''] })] })) : (
+                        // Words, drawn as the chat draws a message (`ChatMarkdown`):
+                        // a table, a list or a code block an answer gives reads as
+                        // one, not as its markdown run into one line (2026-10-10).
+                        _jsxs(Box, { minWidth: 0, overflowWrap: "anywhere", children: [_jsxs(Text, { sx: { fontWeight: 600 }, children: [lineHeading(line), ": "] }), _jsx(Box, { sx: { color: line.failed ? 'danger.fg' : undefined }, children: _jsx(ChatMarkdown, { text: `${line.text}${line.open ? '…' : ''}${line.failed ? ' (failed)' : ''}`, density: "compact" }) })] }))] }, line.key))) })), copy && lines.length > 0 && (_jsx(Box, { mt: 2, children: _jsx(Button, { size: "small", onClick: () => void onCopy(), "data-transcript-copy": "", children: copied ? 'Copied' : 'Copy as text' }) }))] }));
 }
 export default SceneTranscript;

package/lib/examples/PapAgentIdentityExample.d.ts

@@ -0,0 +1,4 @@
+/** PAP personal-agent identity mounted as a Reactor workspace plugin. */
+import React from 'react';
+declare const PapAgentIdentityExample: React.FC;
+export default PapAgentIdentityExample;

package/lib/examples/PapAgentIdentityExample.js

@@ -0,0 +1,23 @@
+import { jsx as _jsx } from "react/jsx-runtime";
+/*
+ * Copyright (c) 2025-2026 Datalayer, Inc.
+ * Distributed under the terms of the Modified BSD License.
+ */
+/** PAP personal-agent identity mounted as a Reactor workspace plugin. */
+import { useMemo } from 'react';
+import { Box, setupPrimerPortals } from '@datalayer/primer-addons';
+import { LoopEmbed } from '../apps';
+import { definePapExamplePlugin } from '../apps/plugins/pap-example';
+import { ThemedProvider } from './utils/themedProvider';
+setupPrimerPortals();
+const PapIdentityPlugin = definePapExamplePlugin({
+    key: 'agent-identity',
+    title: 'PAP Agent Identity',
+    description: 'Verified client and signing policy without JWK coordinates.',
+    load: () => import('./pap/PapAgentIdentityView'),
+});
+const PapAgentIdentityExample = () => {
+    const plugins = useMemo(() => [PapIdentityPlugin], []);
+    return (_jsx(ThemedProvider, { children: _jsx(Box, { height: "100vh", minHeight: 0, children: _jsx(LoopEmbed, { target: "browser", agentId: "loop-shell", defaultEditor: "none", showHeader: true, plugins: plugins }) }) }));
+};
+export default PapAgentIdentityExample;

package/lib/examples/PapAuthorizationBoundaryExample.d.ts

@@ -0,0 +1,4 @@
+/** PAP Session and Direct Sign-In boundaries as a Reactor workspace plugin. */
+import React from 'react';
+declare const PapAuthorizationBoundaryExample: React.FC;
+export default PapAuthorizationBoundaryExample;

package/lib/examples/PapAuthorizationBoundaryExample.js

@@ -0,0 +1,23 @@
+import { jsx as _jsx } from "react/jsx-runtime";
+/*
+ * Copyright (c) 2025-2026 Datalayer, Inc.
+ * Distributed under the terms of the Modified BSD License.
+ */
+/** PAP Session and Direct Sign-In boundaries as a Reactor workspace plugin. */
+import { useMemo } from 'react';
+import { Box, setupPrimerPortals } from '@datalayer/primer-addons';
+import { LoopEmbed } from '../apps';
+import { definePapExamplePlugin } from '../apps/plugins/pap-example';
+import { ThemedProvider } from './utils/themedProvider';
+setupPrimerPortals();
+const PapAuthorizationPlugin = definePapExamplePlugin({
+    key: 'authorization-boundary',
+    title: 'PAP Authorization Boundary',
+    description: 'Real Session and PKCE material kept outside model context.',
+    load: () => import('./pap/PapAuthorizationBoundaryView'),
+});
+const PapAuthorizationBoundaryExample = () => {
+    const plugins = useMemo(() => [PapAuthorizationPlugin], []);
+    return (_jsx(ThemedProvider, { children: _jsx(Box, { height: "100vh", minHeight: 0, children: _jsx(LoopEmbed, { target: "browser", agentId: "loop-shell", defaultEditor: "none", showHeader: true, plugins: plugins }) }) }));
+};
+export default PapAuthorizationBoundaryExample;

package/lib/examples/PapCompanyDiscoveryExample.d.ts

@@ -0,0 +1,4 @@
+/** PAP company discovery mounted as a Reactor workspace plugin. */
+import React from 'react';
+declare const PapCompanyDiscoveryExample: React.FC;
+export default PapCompanyDiscoveryExample;

package/lib/examples/PapCompanyDiscoveryExample.js

@@ -0,0 +1,23 @@
+import { jsx as _jsx } from "react/jsx-runtime";
+/*
+ * Copyright (c) 2025-2026 Datalayer, Inc.
+ * Distributed under the terms of the Modified BSD License.
+ */
+/** PAP company discovery mounted as a Reactor workspace plugin. */
+import { useMemo } from 'react';
+import { Box, setupPrimerPortals } from '@datalayer/primer-addons';
+import { LoopEmbed } from '../apps';
+import { definePapExamplePlugin } from '../apps/plugins/pap-example';
+import { ThemedProvider } from './utils/themedProvider';
+setupPrimerPortals();
+const PapCompanyPlugin = definePapExamplePlugin({
+    key: 'company-discovery',
+    title: 'PAP Company Discovery',
+    description: 'Verified company metadata reduced to a model-safe summary.',
+    load: () => import('./pap/PapCompanyDiscoveryView'),
+});
+const PapCompanyDiscoveryExample = () => {
+    const plugins = useMemo(() => [PapCompanyPlugin], []);
+    return (_jsx(ThemedProvider, { children: _jsx(Box, { height: "100vh", minHeight: 0, children: _jsx(LoopEmbed, { target: "browser", agentId: "loop-shell", defaultEditor: "none", showHeader: true, plugins: plugins }) }) }));
+};
+export default PapCompanyDiscoveryExample;

package/lib/examples/PapDpopProofExample.d.ts

@@ -0,0 +1,4 @@
+/** PAP DPoP proof creation mounted as a Reactor workspace plugin. */
+import React from 'react';
+declare const PapDpopProofExample: React.FC;
+export default PapDpopProofExample;

package/lib/examples/PapDpopProofExample.js

@@ -0,0 +1,23 @@
+import { jsx as _jsx } from "react/jsx-runtime";
+/*
+ * Copyright (c) 2025-2026 Datalayer, Inc.
+ * Distributed under the terms of the Modified BSD License.
+ */
+/** PAP DPoP proof creation mounted as a Reactor workspace plugin. */
+import { useMemo } from 'react';
+import { Box, setupPrimerPortals } from '@datalayer/primer-addons';
+import { LoopEmbed } from '../apps';
+import { definePapExamplePlugin } from '../apps/plugins/pap-example';
+import { ThemedProvider } from './utils/themedProvider';
+setupPrimerPortals();
+const PapDpopPlugin = definePapExamplePlugin({
+    key: 'dpop-proof',
+    title: 'PAP DPoP Proof',
+    description: 'Fresh request-bound proofs kept outside model and UI state.',
+    load: () => import('./pap/PapDpopProofView'),
+});
+const PapDpopProofExample = () => {
+    const plugins = useMemo(() => [PapDpopPlugin], []);
+    return (_jsx(ThemedProvider, { children: _jsx(Box, { height: "100vh", minHeight: 0, children: _jsx(LoopEmbed, { target: "browser", agentId: "loop-shell", defaultEditor: "none", showHeader: true, plugins: plugins }) }) }));
+};
+export default PapDpopProofExample;

package/lib/examples/PapGuidedJourneyExample.d.ts

@@ -0,0 +1,4 @@
+/** A narrative PAP interaction mounted as a Reactor workspace plugin. */
+import React from 'react';
+declare const PapGuidedJourneyExample: React.FC;
+export default PapGuidedJourneyExample;

package/lib/examples/PapGuidedJourneyExample.js

@@ -0,0 +1,23 @@
+import { jsx as _jsx } from "react/jsx-runtime";
+/*
+ * Copyright (c) 2025-2026 Datalayer, Inc.
+ * Distributed under the terms of the Modified BSD License.
+ */
+/** A narrative PAP interaction mounted as a Reactor workspace plugin. */
+import { useMemo } from 'react';
+import { Box, setupPrimerPortals } from '@datalayer/primer-addons';
+import { LoopEmbed } from '../apps';
+import { definePapExamplePlugin } from '../apps/plugins/pap-example';
+import { ThemedProvider } from './utils/themedProvider';
+setupPrimerPortals();
+const PapJourneyPlugin = definePapExamplePlugin({
+    key: 'guided-journey',
+    title: 'PAP Guided Journey',
+    description: 'A visual return journey across discovery, sign-in, and action.',
+    load: () => import('./pap/PapGuidedJourneyView'),
+});
+const PapGuidedJourneyExample = () => {
+    const plugins = useMemo(() => [PapJourneyPlugin], []);
+    return (_jsx(ThemedProvider, { children: _jsx(Box, { height: "100vh", minHeight: 0, children: _jsx(LoopEmbed, { target: "browser", agentId: "loop-shell", defaultEditor: "none", showHeader: true, plugins: plugins }) }) }));
+};
+export default PapGuidedJourneyExample;

package/lib/examples/PapSessionLifecycleExample.d.ts

@@ -0,0 +1,4 @@
+/** PAP signed-out Session lifecycle mounted as a Reactor workspace plugin. */
+import React from 'react';
+declare const PapSessionLifecycleExample: React.FC;
+export default PapSessionLifecycleExample;

package/lib/examples/PapSessionLifecycleExample.js

@@ -0,0 +1,23 @@
+import { jsx as _jsx } from "react/jsx-runtime";
+/*
+ * Copyright (c) 2025-2026 Datalayer, Inc.
+ * Distributed under the terms of the Modified BSD License.
+ */
+/** PAP signed-out Session lifecycle mounted as a Reactor workspace plugin. */
+import { useMemo } from 'react';
+import { Box, setupPrimerPortals } from '@datalayer/primer-addons';
+import { LoopEmbed } from '../apps';
+import { definePapExamplePlugin } from '../apps/plugins/pap-example';
+import { ThemedProvider } from './utils/themedProvider';
+setupPrimerPortals();
+const PapSessionPlugin = definePapExamplePlugin({
+    key: 'session-lifecycle',
+    title: 'PAP Session Lifecycle',
+    description: 'Start, nonce retry, and renewal with credentials host-owned.',
+    load: () => import('./pap/PapSessionLifecycleView'),
+});
+const PapSessionLifecycleExample = () => {
+    const plugins = useMemo(() => [PapSessionPlugin], []);
+    return (_jsx(ThemedProvider, { children: _jsx(Box, { height: "100vh", minHeight: 0, children: _jsx(LoopEmbed, { target: "browser", agentId: "loop-shell", defaultEditor: "none", showHeader: true, plugins: plugins }) }) }));
+};
+export default PapSessionLifecycleExample;

package/lib/examples/example-selector.js

@@ -7,6 +7,7 @@ const DISPLAY_NAME_EXCEPTIONS = [
     [/\bAg Ui\b/g, 'AG-UI'],
     [/\bA2 Ui\b/g, 'A2UI'],
     [/\bA2 A\b/g, 'A2A'],
+    [/\bPap\b/g, 'PAP'],
     [/\bCopilot Kit\b/g, 'CopilotKit'],
     [/\bGen Ui\b/g, 'Gen UI'],
     [/\bM C P\b/g, 'MCP'],
@@ -37,6 +38,8 @@ function inferTags(id) {
         tags.add('a2ui');
     if (id.startsWith('AgentA2A'))
         tags.add('a2a');
+    if (id.startsWith('Pap'))
+        tags.add('pap');
     if (id.includes('Notebook'))
         tags.add('notebook');
     if (id.includes('Lexical') || id.includes('Document'))
@@ -128,6 +131,12 @@ export const EXAMPLE_ENTRIES = [
     makeEntry('AgentSubagentsExample', () => import('./AgentSubagentsExample'), 'Multi-agent delegation with the in-repo subagents capability.'),
     makeEntry('AgentA2AExample', () => import('./AgentA2AExample'), 'Delegation to separate agents over the A2A protocol, launched locally or on Datalayer runtimes.'),
     makeEntry('AgentA2ATeamExample', () => import('./AgentA2ATeamExample'), 'Two applications as a team over A2A: Sales in the browser (@a2a-js/sdk) asks Accounting on a runtime (fasta2a, Odoo read only), each an Office Assistant character.'),
+    makeEntry('PapCompanyDiscoveryExample', () => import('./PapCompanyDiscoveryExample'), 'Validate a PAP company document and reduce it to the public capabilities safe for an agent or UI.'),
+    makeEntry('PapAgentIdentityExample', () => import('./PapAgentIdentityExample'), 'Verify personal-agent client metadata and signing policy without exposing JWK coordinates.'),
+    makeEntry('PapAuthorizationBoundaryExample', () => import('./PapAuthorizationBoundaryExample'), 'Generate real Session and Direct Sign-In security material while showing only safe policy status.'),
+    makeEntry('PapDpopProofExample', () => import('./PapDpopProofExample'), 'Create fresh request-bound DPoP proofs while withholding proof, token, nonce, identifiers, and key material.'),
+    makeEntry('PapSessionLifecycleExample', () => import('./PapSessionLifecycleExample'), 'Start, retry, and renew a signed-out PAP Session while credentials remain host-owned.'),
+    makeEntry('PapGuidedJourneyExample', () => import('./PapGuidedJourneyExample'), 'Follow a visual PAP return journey across discovery, signed-out conversation, Direct Sign-In, and an exact user-authorized result.'),
     makeEntry('AgentNotificationsExample', () => import('./AgentNotificationsExample'), 'Notifications and event routing example.'),
     makeEntry('AgentOutputsExample', () => import('./AgentOutputsExample'), 'Structured outputs and rendering patterns.'),
     makeEntry('AgentParametersExample', () => import('./AgentParametersExample'), 'Launch-time parameterized agent creation with JSON schema.'),

package/lib/examples/exampleGroups.d.ts

@@ -5,5 +5,5 @@
  *
  * @module examples/exampleGroups
  */
-export declare const EXAMPLE_GROUP_ORDER: readonly ["Apps", "Assistant", "A2UI", "A2A", "AG-UI", "Chat", "Document", "Notebook", "Capabilities", "Cell", "CopilotKit"];
+export declare const EXAMPLE_GROUP_ORDER: readonly ["Apps", "Assistant", "A2UI", "A2A", "Personal Agent Protocol", "AG-UI", "Chat", "Document", "Notebook", "Capabilities", "Cell", "CopilotKit"];
 export declare const getExampleGroup: (id: string) => string;

package/lib/examples/exampleGroups.js

@@ -14,6 +14,7 @@ export const EXAMPLE_GROUP_ORDER = [
     'Assistant',
     'A2UI',
     'A2A',
+    'Personal Agent Protocol',
     'AG-UI',
     'Chat',
     'Document',
@@ -36,6 +37,8 @@ export const getExampleGroup = (id) => {
     // Agents reached over the A2A protocol: their own category, after A2UI.
     if (id.startsWith('AgentA2A'))
         return 'A2A';
+    if (id.startsWith('Pap'))
+        return 'Personal Agent Protocol';
     if (id.startsWith('AgUi'))
         return 'AG-UI';
     if (id.startsWith('CopilotKit'))

package/lib/examples/index.d.ts

@@ -27,6 +27,12 @@ export { default as AgentCodemodeExample } from './AgentCodemodeExample';
 export { default as AgentCodeSandboxesExample } from './AgentCodeSandboxesExample';
 export { default as AgentDecideExample } from './AgentDecideExample';
 export { default as AgentA2ATeamExample } from './AgentA2ATeamExample';
+export { default as PapCompanyDiscoveryExample } from './PapCompanyDiscoveryExample';
+export { default as PapAgentIdentityExample } from './PapAgentIdentityExample';
+export { default as PapAuthorizationBoundaryExample } from './PapAuthorizationBoundaryExample';
+export { default as PapDpopProofExample } from './PapDpopProofExample';
+export { default as PapSessionLifecycleExample } from './PapSessionLifecycleExample';
+export { default as PapGuidedJourneyExample } from './PapGuidedJourneyExample';
 export { default as ScenesExample } from './ScenesExample';
 export { default as AgentEvalsExample } from './AgentEvalsExample';
 export { default as AgentGuardrailsExample } from './AgentGuardrailsExample';

package/lib/examples/index.js

@@ -33,6 +33,12 @@ export { default as AgentCodemodeExample } from './AgentCodemodeExample';
 export { default as AgentCodeSandboxesExample } from './AgentCodeSandboxesExample';
 export { default as AgentDecideExample } from './AgentDecideExample';
 export { default as AgentA2ATeamExample } from './AgentA2ATeamExample';
+export { default as PapCompanyDiscoveryExample } from './PapCompanyDiscoveryExample';
+export { default as PapAgentIdentityExample } from './PapAgentIdentityExample';
+export { default as PapAuthorizationBoundaryExample } from './PapAuthorizationBoundaryExample';
+export { default as PapDpopProofExample } from './PapDpopProofExample';
+export { default as PapSessionLifecycleExample } from './PapSessionLifecycleExample';
+export { default as PapGuidedJourneyExample } from './PapGuidedJourneyExample';
 export { default as ScenesExample } from './ScenesExample';
 export { default as AgentEvalsExample } from './AgentEvalsExample';
 export { default as AgentGuardrailsExample } from './AgentGuardrailsExample';

package/lib/examples/main.js

@@ -78,6 +78,15 @@ const ANONYMOUS_EXAMPLES = new Set([
     'DocumentPageAgent',
     // The decks plugin in a Loop; the agent and the decks both live in the page.
     'DecksAgent',
+    // PAP protocol examples are deterministic browser views. They validate
+    // fixtures and generate local Web Crypto material without allocating a
+    // runtime or authenticating to Datalayer.
+    'PapCompanyDiscoveryExample',
+    'PapAgentIdentityExample',
+    'PapAuthorizationBoundaryExample',
+    'PapDpopProofExample',
+    'PapSessionLifecycleExample',
+    'PapGuidedJourneyExample',
     // The floating assistant: the character, its balloon and its motions need
     // no runtime; a conversation does, and says so when there is none.
     'AssistantExample',

package/lib/examples/pap/PapAgentIdentityView.d.ts

@@ -0,0 +1,4 @@
+import React from 'react';
+/** Verify client metadata and JWKS while withholding public-key coordinates. */
+declare const PapAgentIdentityView: React.FC;
+export default PapAgentIdentityView;

package/lib/examples/pap/PapAgentIdentityView.js

@@ -0,0 +1,55 @@
+import { jsx as _jsx, jsxs as _jsxs } from "react/jsx-runtime";
+/*
+ * Copyright (c) 2025-2026 Datalayer, Inc.
+ * Distributed under the terms of the Modified BSD License.
+ */
+import { useState } from 'react';
+import { Box } from '@datalayer/primer-addons';
+import { Button, Text, TextInput } from '@primer/react';
+import { parseClientMetadata, parseJsonWebKeySet, } from '@datalayer/personal-agent-protocol';
+import { PapPersonalAgentCapability, } from '../../pap';
+import { PapExamplePage, PapResult } from './PapExamplePage';
+const SAMPLE_CLIENT_ID = 'https://assistant.example/agent.json';
+/** Verify client metadata and JWKS while withholding public-key coordinates. */
+const PapAgentIdentityView = () => {
+    const [clientId, setClientId] = useState(SAMPLE_CLIENT_ID);
+    const [summary, setSummary] = useState(null);
+    const [error, setError] = useState(null);
+    const inspect = async () => {
+        setError(null);
+        try {
+            const normalized = new URL(clientId.trim()).toString();
+            const capability = new PapPersonalAgentCapability({
+                identity: {
+                    fetchMetadata: async (requested) => parseClientMetadata({
+                        client_id: requested,
+                        client_name: 'Example Research Assistant',
+                        jwks_uri: `${new URL(requested).origin}/jwks.json`,
+                        redirect_uris: [`${new URL(requested).origin}/callback`],
+                        token_endpoint_auth_method: 'private_key_jwt',
+                        extensions: { memory: { version: '2' } },
+                    }),
+                    fetchJwks: async () => parseJsonWebKeySet({
+                        keys: [
+                            {
+                                kty: 'EC',
+                                crv: 'P-256',
+                                x: 'withheld-x-coordinate',
+                                y: 'withheld-y-coordinate',
+                                use: 'sig',
+                                alg: 'ES256',
+                            },
+                        ],
+                    }),
+                },
+            });
+            setSummary(await capability.inspectAgent(normalized));
+        }
+        catch (cause) {
+            setSummary(null);
+            setError(cause instanceof Error ? cause.message : String(cause));
+        }
+    };
+    return (_jsxs(PapExamplePage, { eyebrow: "PAP \u00B7 Personal-agent identity", title: "Verify who signs without exposing the key", description: "PAP binds client metadata to its HTTPS client ID and verifies its JWKS. Agent Runtimes keeps only identity and signing policy; coordinates and operational endpoints stay outside the UI and model boundary.", children: [_jsxs(Box, { display: "flex", flexDirection: "column", gap: 3, p: 3, border: "1px solid", borderColor: "border.default", borderRadius: 2, bg: "canvas.default", children: [_jsx(Text, { as: "label", sx: { fontWeight: 600 }, children: "Personal-agent client ID" }), _jsxs(Box, { display: "flex", gap: 2, children: [_jsx(TextInput, { block: true, value: clientId, "aria-label": "Personal-agent client ID", onChange: event => setClientId(event.target.value) }), _jsx(Button, { variant: "primary", onClick: () => void inspect(), children: "Verify sample" })] }), error ? _jsx(Text, { sx: { color: 'danger.fg' }, children: error }) : null] }), summary ? (_jsx(PapResult, { title: "Safe identity summary", value: summary })) : null] }));
+};
+export default PapAgentIdentityView;

package/lib/examples/pap/PapAuthorizationBoundaryView.d.ts

@@ -0,0 +1,4 @@
+import React from 'react';
+/** Generate real security material and reveal only its non-secret policy. */
+declare const PapAuthorizationBoundaryView: React.FC;
+export default PapAuthorizationBoundaryView;

package/lib/examples/pap/PapAuthorizationBoundaryView.js

@@ -0,0 +1,59 @@
+import { jsx as _jsx, jsxs as _jsxs } from "react/jsx-runtime";
+/*
+ * Copyright (c) 2025-2026 Datalayer, Inc.
+ * Distributed under the terms of the Modified BSD License.
+ */
+import { useState } from 'react';
+import { Box } from '@datalayer/primer-addons';
+import { Button, Text } from '@primer/react';
+import { buildDirectSignInRequest, buildSessionAssertionClaims, generatePairwiseUserId, } from '@datalayer/personal-agent-protocol';
+import { PapExamplePage, PapResult } from './PapExamplePage';
+/** Generate real security material and reveal only its non-secret policy. */
+const PapAuthorizationBoundaryView = () => {
+    const [summary, setSummary] = useState(null);
+    const [error, setError] = useState(null);
+    const generate = async () => {
+        setError(null);
+        try {
+            const clientId = 'https://assistant.example/agent.json';
+            const tokenEndpoint = 'https://shop.example/oauth/token';
+            const claims = buildSessionAssertionClaims({
+                clientId,
+                pairwiseUserId: generatePairwiseUserId(),
+                tokenEndpoint,
+            });
+            const request = await buildDirectSignInRequest({
+                authorizationEndpoint: 'https://shop.example/oauth/authorize',
+                issuer: 'https://shop.example',
+                clientId,
+                redirectUri: 'https://assistant.example/callback',
+                scopes: ['poppy:read', 'poppy:act'],
+            });
+            setSummary({
+                session: {
+                    issuerBoundToClient: claims.iss === clientId,
+                    audienceBoundToTokenEndpoint: claims.aud === tokenEndpoint,
+                    lifetimeSeconds: claims.exp - claims.iat,
+                    pairwiseSubjectWithheld: true,
+                    uniqueRequestIdWithheld: true,
+                    unsignedAssertionWithheld: true,
+                },
+                directSignIn: {
+                    requestedScopes: request.scopes,
+                    pkceMethod: 'S256',
+                    randomState: true,
+                    userOwnedBrowserRequired: true,
+                    authorizationUrlWithheld: true,
+                    stateWithheld: true,
+                    codeVerifierWithheld: true,
+                },
+            });
+        }
+        catch (cause) {
+            setSummary(null);
+            setError(cause instanceof Error ? cause.message : String(cause));
+        }
+    };
+    return (_jsxs(PapExamplePage, { eyebrow: "PAP \u00B7 Authorization boundary", title: "Generate secrets in the host; return policy to the agent", description: "This example creates a real pairwise Session identity, unique assertion ID, OAuth state and S256 PKCE verifier. None crosses the Reactor view boundary. Studio hands the authorization URL directly to a user-owned browser and stores tokens behind opaque references.", children: [_jsxs(Box, { display: "flex", alignItems: "center", justifyContent: "space-between", gap: 3, p: 3, border: "1px solid", borderColor: "border.default", borderRadius: 2, bg: "canvas.default", children: [_jsx(Text, { sx: { color: 'fg.muted' }, children: "Generate a fresh Session and Direct Sign-In request inside this host." }), _jsx(Button, { variant: "primary", onClick: () => void generate(), children: "Generate safely" })] }), error ? _jsx(Text, { sx: { color: 'danger.fg' }, children: error }) : null, summary ? (_jsx(PapResult, { title: "Model-safe boundary result", value: summary })) : null] }));
+};
+export default PapAuthorizationBoundaryView;

package/lib/examples/pap/PapCompanyDiscoveryView.d.ts

@@ -0,0 +1,4 @@
+import React from 'react';
+/** Verify a company fixture through the same safe capability used by agents. */
+declare const PapCompanyDiscoveryView: React.FC;
+export default PapCompanyDiscoveryView;

package/lib/examples/pap/PapCompanyDiscoveryView.js

@@ -0,0 +1,62 @@
+import { jsx as _jsx, jsxs as _jsxs } from "react/jsx-runtime";
+/*
+ * Copyright (c) 2025-2026 Datalayer, Inc.
+ * Distributed under the terms of the Modified BSD License.
+ */
+import { useState } from 'react';
+import { Box } from '@datalayer/primer-addons';
+import { Button, Text, TextInput } from '@primer/react';
+import { parseDiscoveryDocument, } from '@datalayer/personal-agent-protocol';
+import { PapPersonalAgentCapability } from '../../pap';
+import { PapExamplePage, PapResult } from './PapExamplePage';
+const SAMPLE_DOMAIN = 'shop.example';
+const sampleCompany = (domain) => ({
+    discoveryUrl: `https://${domain}/.well-known/poppy.json`,
+    document: parseDiscoveryDocument({
+        protocol_version: '0.1',
+        organization: { name: 'Example Shop', domain },
+        auth: {
+            issuer: `https://auth.${domain}`,
+            direct: { scopes: ['poppy:read'] },
+            custom_scopes: {},
+        },
+        agent: {
+            protocols: [{ type: 'a2a', endpoint: `https://${domain}/agent` }],
+        },
+        apis: [
+            {
+                type: 'openapi',
+                url: `https://${domain}/openapi.json`,
+                description: 'Read the catalogue',
+            },
+        ],
+        extensions: { operations: { version: '1' } },
+    }),
+});
+/** Verify a company fixture through the same safe capability used by agents. */
+const PapCompanyDiscoveryView = () => {
+    const [domain, setDomain] = useState(SAMPLE_DOMAIN);
+    const [summary, setSummary] = useState(null);
+    const [error, setError] = useState(null);
+    const inspect = async () => {
+        setError(null);
+        try {
+            const normalized = domain.trim().toLowerCase();
+            const capability = new PapPersonalAgentCapability({
+                discover: async (requested) => {
+                    if (requested !== normalized) {
+                        throw new Error('The requested domain changed during discovery.');
+                    }
+                    return sampleCompany(normalized);
+                },
+            });
+            setSummary(await capability.discoverCompany(normalized));
+        }
+        catch (cause) {
+            setSummary(null);
+            setError(cause instanceof Error ? cause.message : String(cause));
+        }
+    };
+    return (_jsxs(PapExamplePage, { eyebrow: "PAP \u00B7 Company discovery", title: "Discover capabilities, not credentials", description: "The PAP parser validates the discovery document; Agent Runtimes then projects it into a model-safe summary. Change the sample domain to see issuer and discovery binding move together.", children: [_jsxs(Box, { display: "flex", flexDirection: "column", gap: 3, p: 3, border: "1px solid", borderColor: "border.default", borderRadius: 2, bg: "canvas.default", children: [_jsx(Text, { as: "label", sx: { fontWeight: 600 }, children: "Company DNS domain" }), _jsxs(Box, { display: "flex", gap: 2, children: [_jsx(TextInput, { block: true, value: domain, "aria-label": "Company DNS domain", onChange: event => setDomain(event.target.value) }), _jsx(Button, { variant: "primary", onClick: () => void inspect(), children: "Validate sample" })] }), _jsx(Text, { sx: { color: 'fg.muted', fontSize: 1 }, children: "The sample uses an injected Reactor-compatible transport. Production replaces it with DNS-pinned HTTPS discovery." }), error ? _jsx(Text, { sx: { color: 'danger.fg' }, children: error }) : null] }), summary ? (_jsx(PapResult, { title: "Safe company summary", value: summary })) : null] }));
+};
+export default PapCompanyDiscoveryView;