@datalayer/agent-runtimes 1.3.104 → 1.3.106

package/lib/examples/pap/PapDpopProofView.d.ts

@@ -0,0 +1,4 @@
+import React from 'react';
+/** Create real device-held proofs while retaining only non-secret evidence. */
+declare const PapDpopProofView: React.FC;
+export default PapDpopProofView;

package/lib/examples/pap/PapDpopProofView.js

@@ -0,0 +1,57 @@
+import { jsx as _jsx, jsxs as _jsxs } from "react/jsx-runtime";
+/*
+ * Copyright (c) 2025-2026 Datalayer, Inc.
+ * Distributed under the terms of the Modified BSD License.
+ */
+import { useState } from 'react';
+import { Box } from '@datalayer/primer-addons';
+import { Button, Text } from '@primer/react';
+import { JoseDpopProofProvider, SecretValue, } from '@datalayer/personal-agent-protocol';
+import { PapExamplePage, PapResult } from './PapExamplePage';
+/** Create real device-held proofs while retaining only non-secret evidence. */
+const PapDpopProofView = () => {
+    const [summary, setSummary] = useState(null);
+    const [error, setError] = useState(null);
+    const createProofs = async () => {
+        setError(null);
+        try {
+            const keyPair = (await globalThis.crypto.subtle.generateKey({ name: 'ECDSA', namedCurve: 'P-256' }, false, ['sign', 'verify']));
+            const publicJwk = await globalThis.crypto.subtle.exportKey('jwk', keyPair.publicKey);
+            const provider = new JoseDpopProofProvider({
+                resolveKey: () => ({
+                    privateKey: keyPair.privateKey,
+                    publicJwk,
+                    algorithm: 'ES256',
+                }),
+            });
+            const request = {
+                method: 'POST',
+                url: 'https://api.company.example/orders?draft=true#editor',
+                tenantId: 'example-tenant',
+                subject: 'host-only-pairwise-subject',
+                issuer: 'https://company.example',
+                accessToken: new SecretValue('host-only-example-token'),
+                nonce: 'host-only-company-nonce',
+            };
+            const first = await provider.create(request);
+            const second = await provider.create(request);
+            setSummary({
+                algorithm: 'ES256',
+                freshProofPerRequest: first.reveal() !== second.reveal(),
+                methodBound: true,
+                urlBoundWithoutQueryOrFragment: true,
+                accessTokenBound: true,
+                nonceIncluded: true,
+                proofRedactedByDefault: first.toJSON() === '[REDACTED]',
+                proofWithheldFromUiState: true,
+                keyMaterialWithheldFromUiState: true,
+            });
+        }
+        catch (cause) {
+            setSummary(null);
+            setError(cause instanceof Error ? cause.message : String(cause));
+        }
+    };
+    return (_jsxs(PapExamplePage, { eyebrow: "PAP \u00B7 DPoP", title: "Create a fresh proof for every protected request", description: "This Reactor view creates non-exportable P-256 key material and real DPoP proofs in the browser host. Only policy evidence enters React state; proofs, tokens, nonces, identifiers and key material stay outside the agent and rendered UI. Server-side verification adds signature, request, token and replay checks.", children: [_jsxs(Box, { display: "flex", alignItems: "center", justifyContent: "space-between", gap: 3, p: 3, border: "1px solid", borderColor: "border.default", borderRadius: 2, bg: "canvas.default", children: [_jsx(Text, { sx: { color: 'fg.muted' }, children: "Generate two proofs for the same request without retaining either." }), _jsx(Button, { variant: "primary", onClick: () => void createProofs(), children: "Create safely" })] }), error ? _jsx(Text, { sx: { color: 'danger.fg' }, children: error }) : null, summary ? (_jsx(PapResult, { title: "Safe DPoP evidence", value: summary })) : null] }));
+};
+export default PapDpopProofView;

package/lib/examples/pap/PapExamplePage.d.ts

@@ -0,0 +1,14 @@
+import React from 'react';
+export interface PapExamplePageProps {
+    title: string;
+    eyebrow: string;
+    description: string;
+    children: React.ReactNode;
+    maxWidth?: number | string;
+}
+/** Shared visual frame for the protocol examples. */
+export declare const PapExamplePage: React.FC<PapExamplePageProps>;
+export declare const PapResult: React.FC<{
+    title: string;
+    value: unknown;
+}>;

package/lib/examples/pap/PapExamplePage.js

@@ -0,0 +1,6 @@
+import { jsx as _jsx, jsxs as _jsxs } from "react/jsx-runtime";
+import { Box } from '@datalayer/primer-addons';
+import { Heading, Label, Text } from '@primer/react';
+/** Shared visual frame for the protocol examples. */
+export const PapExamplePage = ({ title, eyebrow, description, children, maxWidth = 960, }) => (_jsx(Box, { height: "100%", overflow: "auto", bg: "canvas.subtle", p: 4, children: _jsxs(Box, { maxWidth: maxWidth, mx: "auto", display: "flex", flexDirection: "column", gap: 3, children: [_jsxs(Box, { display: "flex", flexDirection: "column", gap: 2, children: [_jsx(Box, { children: _jsx(Label, { variant: "accent", children: eyebrow }) }), _jsx(Heading, { as: "h1", sx: { fontSize: 4 }, children: title }), _jsx(Text, { sx: { color: 'fg.muted', maxWidth: 760 }, children: description })] }), children] }) }));
+export const PapResult = ({ title, value }) => (_jsxs(Box, { border: "1px solid", borderColor: "border.default", borderRadius: 2, bg: "canvas.default", p: 3, children: [_jsx(Heading, { as: "h2", sx: { fontSize: 2, mb: 2 }, children: title }), _jsx(Box, { as: "pre", m: 0, p: 3, overflow: "auto", borderRadius: 2, bg: "canvas.inset", sx: { fontSize: 1, lineHeight: 1.5 }, children: JSON.stringify(value, null, 2) })] }));

package/lib/examples/pap/PapGuidedJourneyView.d.ts

@@ -0,0 +1,4 @@
+import React from 'react';
+/** A five-step user, company, and wire-level PAP walkthrough. */
+declare const PapGuidedJourneyView: React.FC;
+export default PapGuidedJourneyView;

package/lib/examples/pap/PapGuidedJourneyView.js

@@ -0,0 +1,263 @@
+import { jsx as _jsx, jsxs as _jsxs, Fragment as _Fragment } from "react/jsx-runtime";
+/*
+ * Copyright (c) 2025-2026 Datalayer, Inc.
+ * Distributed under the terms of the Modified BSD License.
+ */
+import { useEffect, useState } from 'react';
+import { Box } from '@datalayer/primer-addons';
+import { Button, Heading, Label, Text } from '@primer/react';
+import { buildDirectSignInRequest, buildSessionAssertionClaims, parseDiscoveryDocument, } from '@datalayer/personal-agent-protocol';
+import { PapExamplePage } from './PapExamplePage';
+const conversationStart = [
+    {
+        speaker: 'user',
+        text: "My Trailhead jacket keeps the rain out, but it isn't warm enough. Can I return it?",
+    },
+    {
+        speaker: 'atlas',
+        text: "I'll ask Northstar Outfitters about a return and whether they have something warmer.",
+    },
+];
+const STEPS = [
+    {
+        title: 'Finding Northstar',
+        summary: "Atlas reads Northstar's public PAP document to learn how returns, authorization, and the company agent are exposed.",
+        channel: 'Discovery',
+        messages: conversationStart,
+        facts: [
+            { label: 'Publishes', value: 'poppy.json · draft 0.1' },
+            { label: 'Returns', value: 'Company conversation agent' },
+            { label: 'Sign-in', value: "Northstar's own page" },
+        ],
+        method: 'GET',
+        target: 'https://northstar.example/.well-known/poppy.json',
+        detailLabel: 'Atlas → northstar.example',
+        request: 'Accept: application/json',
+        response: `200 OK
+{
+  "protocol_version": "0.1",
+  "organization": { "name": "Northstar Outfitters" },
+  "auth": { "issuer": "https://auth.northstar.example" },
+  "agent": { "protocols": [{ "type": "poppy" }] }
+}`,
+    },
+    {
+        title: 'Starting signed out',
+        summary: 'Atlas opens a pairwise Session and can ask about the return before knowing who the user is. Northstar replies that order access needs sign-in.',
+        channel: 'Session + conversation',
+        messages: [
+            ...conversationStart,
+            {
+                speaker: 'company',
+                text: 'I can help with that. Please sign in so I can find the order.',
+            },
+        ],
+        facts: [
+            { label: 'Personal agent', value: 'Atlas' },
+            { label: 'Session', value: 'Signed out · pairwise' },
+            { label: 'Conversation', value: 'Waiting for sign-in' },
+        ],
+        method: 'POST',
+        target: 'https://auth.northstar.example/oauth/token',
+        detailLabel: 'Atlas → authorization server',
+        request: `Content-Type: application/x-www-form-urlencoded
+DPoP: [fresh host-only proof]
+
+grant_type=urn:ietf:params:oauth:grant-type:jwt-bearer
+assertion=[host-only session assertion]
+client_assertion=[host-only client assertion]`,
+        response: `200 OK
+{
+  "access_token": "[stored by host]",
+  "token_type": "DPoP",
+  "session_id": "[opaque reference]",
+  "signed_in": false
+}`,
+    },
+    {
+        title: 'The user signs in',
+        summary: "Atlas opens Northstar's authorization page. The user signs in there and grants order access. Atlas never sees the password.",
+        channel: 'Direct Sign-In',
+        phoneMode: 'signin',
+        messages: conversationStart,
+        facts: [
+            { label: 'User presence', value: 'Required' },
+            { label: 'Requested access', value: 'Orders: read and return' },
+            { label: 'Credentials', value: 'Visible only to Northstar' },
+        ],
+        method: 'GET',
+        target: 'https://auth.northstar.example/oauth/authorize',
+        detailLabel: 'Trusted browser handoff',
+        request: `response_type=code
+client_id=https://atlas.example/agent.json
+redirect_uri=https://atlas.example/oauth/callback
+scope=orders:read orders:return
+state=[single-use, host-only]
+code_challenge=[S256, host-only verifier]`,
+        response: `302 Found
+Location: https://atlas.example/oauth/callback
+  ?code=[single-use authorization code]
+  &state=[returned unchanged]`,
+    },
+    {
+        title: 'An offer comes back',
+        summary: 'The signed-in Session continues the same conversation. Northstar finds the order and offers an even exchange or a refund.',
+        channel: 'Conversation',
+        messages: [
+            ...conversationStart,
+            { speaker: 'company', text: 'Please sign in so I can find the order.' },
+            { speaker: 'user', text: "I'm signed in." },
+            { speaker: 'atlas', text: "Thanks. I'll continue the same request." },
+            {
+                speaker: 'company',
+                text: 'I can exchange it for the warmer Summit jacket at no extra cost, or issue a full refund.',
+            },
+        ],
+        facts: [
+            { label: 'Order', value: 'NS-48213' },
+            { label: 'Options', value: 'Even exchange · Full refund' },
+            { label: 'Status', value: "Waiting for the user's choice" },
+        ],
+        method: 'POST',
+        target: 'https://api.northstar.example/poppy/conversations/cnv_return/messages',
+        detailLabel: 'Atlas ↔ company agent',
+        request: `Authorization: DPoP [host-only Session Token]
+DPoP: [fresh proof]
+Content-Type: application/json
+
+{ "message_id": "msg_offer", "text": "The user has signed in." }`,
+        response: `200 OK
+{
+  "text": "Choose an even exchange or refund.",
+  "data": { "options": ["exchange", "refund"] },
+  "responder": { "type": "ai", "name": "Northstar" }
+}`,
+    },
+    {
+        title: 'The exchange is set',
+        summary: "Atlas passes on the user's exact choice. Northstar confirms the exchange and the conversation closes with a durable result.",
+        channel: 'Operation + result',
+        messages: [
+            ...conversationStart,
+            { speaker: 'company', text: 'Please sign in so I can find the order.' },
+            { speaker: 'user', text: "I'm signed in." },
+            {
+                speaker: 'company',
+                text: 'I can offer the warmer Summit jacket or a full refund.',
+            },
+            { speaker: 'user', text: "Let's do the exchange." },
+            {
+                speaker: 'atlas',
+                text: 'Done. The Summit jacket ships tomorrow. A prepaid return label is in your email.',
+            },
+        ],
+        facts: [
+            { label: 'Result', value: 'Exchange arranged' },
+            { label: 'Return code', value: 'NRT-7K4Q' },
+            { label: 'Conversation', value: 'Closed' },
+        ],
+        method: 'POST',
+        target: 'https://api.northstar.example/poppy/operations/op_exchange/confirm',
+        detailLabel: 'Exact user-authorized action',
+        request: `Authorization: DPoP [host-only Session Token]
+DPoP: [fresh proof]
+Idempotency-Key: msg_exchange_choice
+
+{ "revision": 1, "choice": "exchange" }`,
+        response: `200 OK
+{
+  "status": "succeeded",
+  "result": { "return_code": "NRT-7K4Q" },
+  "conversation_status": "closed"
+}`,
+    },
+];
+const speakerName = {
+    user: 'You',
+    atlas: 'Atlas',
+    company: 'Northstar',
+};
+const validateJourneyFixtures = async () => {
+    parseDiscoveryDocument({
+        protocol_version: '0.1',
+        organization: { name: 'Northstar Outfitters', domain: 'northstar.example' },
+        auth: {
+            issuer: 'https://auth.northstar.example',
+            direct: { scopes: ['orders:read', 'orders:return'] },
+            custom_scopes: {},
+        },
+        agent: {
+            protocols: [
+                {
+                    type: 'poppy',
+                    endpoint: 'https://api.northstar.example/poppy/conversations',
+                },
+            ],
+        },
+    });
+    buildSessionAssertionClaims({
+        clientId: 'https://atlas.example/agent.json',
+        pairwiseUserId: 'usr_host_only_journey',
+        tokenEndpoint: 'https://auth.northstar.example/oauth/token',
+    });
+    await buildDirectSignInRequest({
+        authorizationEndpoint: 'https://auth.northstar.example/oauth/authorize',
+        issuer: 'https://auth.northstar.example',
+        clientId: 'https://atlas.example/agent.json',
+        redirectUri: 'https://atlas.example/oauth/callback',
+        scopes: ['orders:read', 'orders:return'],
+    });
+};
+const ChatPhone = ({ step, onAuthorized }) => (_jsxs(Box, { width: "100%", maxWidth: 340, height: 560, mx: "auto", border: "10px solid", borderColor: "fg.default", borderRadius: 36, bg: "canvas.default", overflow: "hidden", boxShadow: "shadow.large", display: "flex", flexDirection: "column", children: [_jsxs(Box, { px: 3, py: 2, display: "flex", justifyContent: "space-between", borderBottom: "1px solid", borderColor: "border.default", children: [_jsx(Text, { sx: { fontSize: 0, fontWeight: 600 }, children: "9:41" }), _jsx(Text, { sx: { fontSize: 0, fontWeight: 600 }, children: "5G \u00B7 92%" })] }), step.phoneMode === 'signin' ? (_jsxs(Box, { flex: 1, display: "flex", flexDirection: "column", children: [_jsx(Box, { bg: "success.emphasis", color: "fg.onEmphasis", p: 3, children: _jsx(Text, { sx: { fontWeight: 700 }, children: "N \u00B7 Northstar Outfitters" }) }), _jsxs(Box, { p: 3, display: "flex", flexDirection: "column", gap: 3, children: [_jsx(Text, { sx: { fontSize: 0, color: 'fg.muted' }, children: "auth.northstar.example" }), _jsx(Heading, { as: "h2", sx: { fontSize: 3 }, children: "Let Atlas access your order?" }), _jsx(Text, { children: "Atlas can read order NS-48213 and arrange the return you requested." }), _jsxs(Box, { p: 3, bg: "canvas.subtle", borderRadius: 2, children: [_jsx(Text, { sx: { fontWeight: 600 }, children: "Requested access" }), _jsx(Text, { as: "p", sx: { mt: 1, color: 'fg.muted' }, children: "Read this order \u00B7 Arrange one return" })] }), _jsx(Button, { variant: "primary", block: true, onClick: onAuthorized, children: "Authorize Atlas" }), _jsx(Text, { textAlign: "center", sx: { fontSize: 0, color: 'fg.muted' }, children: "Passwords and account credentials stay with Northstar." })] })] })) : (_jsxs(_Fragment, { children: [_jsxs(Box, { px: 3, py: 2, display: "flex", gap: 2, alignItems: "center", children: [_jsx(Box, { width: 30, height: 30, borderRadius: "50%", bg: "accent.emphasis", color: "fg.onEmphasis", display: "flex", alignItems: "center", justifyContent: "center", fontWeight: 700, children: "A" }), _jsxs(Box, { children: [_jsx(Text, { as: "div", sx: { fontWeight: 700 }, children: "Atlas" }), _jsx(Text, { as: "div", sx: { fontSize: 0, color: 'fg.muted' }, children: "Your personal agent" })] })] }), _jsx(Box, { flex: 1, overflow: "auto", bg: "canvas.subtle", p: 2, display: "flex", flexDirection: "column", gap: 2, children: step.messages.map((message, index) => {
+                        const fromUser = message.speaker === 'user';
+                        return (_jsxs(Box, { alignSelf: fromUser ? 'flex-end' : 'flex-start', maxWidth: "88%", px: 2, py: 2, borderRadius: 3, color: fromUser ? 'fg.onEmphasis' : 'fg.default', bg: fromUser ? 'accent.emphasis' : 'canvas.default', border: fromUser ? 'none' : '1px solid', borderColor: "border.default", children: [!fromUser ? (_jsx(Text, { as: "div", sx: {
+                                        mb: 1,
+                                        fontSize: 0,
+                                        fontWeight: 700,
+                                        color: message.speaker === 'company'
+                                            ? 'success.fg'
+                                            : 'accent.fg',
+                                    }, children: speakerName[message.speaker] })) : null, _jsx(Text, { sx: { fontSize: 1 }, children: message.text })] }, `${message.speaker}-${index}`));
+                    }) })] }))] }));
+/** A five-step user, company, and wire-level PAP walkthrough. */
+const PapGuidedJourneyView = () => {
+    const [stepIndex, setStepIndex] = useState(0);
+    const [detailsOpen, setDetailsOpen] = useState(true);
+    const [fixtureState, setFixtureState] = useState('checking');
+    const step = STEPS[stepIndex] ?? STEPS[0];
+    useEffect(() => {
+        void validateJourneyFixtures()
+            .then(() => setFixtureState('valid'))
+            .catch(() => setFixtureState('invalid'));
+    }, []);
+    const go = (next) => {
+        setStepIndex(Math.max(0, Math.min(STEPS.length - 1, next)));
+    };
+    return (_jsxs(PapExamplePage, { eyebrow: "PAP \u00B7 Guided interaction", title: "A return, from first request to confirmed exchange", description: "Follow what the user experiences, what the company is allowed to see, and which PAP exchange moves the work forward. The story uses SDK-validated discovery, Session, and Direct Sign-In fixtures; protocol credentials are always represented as host-only placeholders.", maxWidth: 1180, children: [_jsxs(Box, { display: "flex", alignItems: "center", justifyContent: "space-between", gap: 2, flexWrap: "wrap", p: 3, bg: "canvas.default", border: "1px solid", borderColor: "border.default", borderRadius: 2, children: [_jsxs(Box, { children: [_jsx(Label, { variant: "accent", children: "Company agent \u00B7 Direct Sign-In" }), _jsx(Heading, { as: "h2", sx: { mt: 1, fontSize: 2 }, children: "The jacket is not warm enough" }), _jsx(Text, { sx: { color: 'fg.muted' }, children: "Atlas finds Northstar, keeps one Session, and asks before acting." })] }), _jsx(Label, { variant: fixtureState === 'valid' ? 'success' : 'secondary', children: fixtureState === 'valid'
+                            ? 'SDK fixtures validated'
+                            : fixtureState === 'invalid'
+                                ? 'Fixture validation failed'
+                                : 'Validating SDK fixtures…' })] }), _jsx(Box, { display: "flex", gap: 2, flexWrap: "wrap", "aria-label": "Journey steps", children: STEPS.map((candidate, index) => (_jsxs(Button, { variant: index === stepIndex ? 'primary' : 'default', onClick: () => go(index), children: [index + 1, ". ", candidate.channel] }, candidate.title))) }), _jsxs(Box, { display: "grid", sx: {
+                    gridTemplateColumns: [
+                        '1fr',
+                        'minmax(300px, 0.78fr) minmax(460px, 1.4fr)',
+                    ],
+                }, gap: 4, alignItems: "start", children: [_jsx(ChatPhone, { step: step, onAuthorized: () => go(stepIndex + 1) }), _jsxs(Box, { minHeight: 560, bg: "canvas.default", border: "1px solid", borderColor: "border.default", borderRadius: 2, overflow: "hidden", display: "flex", flexDirection: "column", children: [_jsxs(Box, { p: 3, borderBottom: "1px solid", borderColor: "border.default", children: [_jsxs(Text, { as: "div", sx: { fontSize: 0, color: 'fg.muted' }, children: ["Step ", stepIndex + 1, " of ", STEPS.length, " \u00B7 ", step.channel] }), _jsx(Heading, { as: "h2", sx: { mt: 1, fontSize: 3 }, children: step.title }), _jsx(Text, { as: "p", sx: { mt: 2, color: 'fg.muted' }, children: step.summary })] }), _jsxs(Box, { p: 3, display: "flex", flexDirection: "column", gap: 3, children: [_jsxs(Box, { display: "flex", gap: 2, alignItems: "center", children: [_jsx(Box, { width: 24, height: 24, borderRadius: 1, bg: "success.emphasis", color: "fg.onEmphasis", display: "flex", alignItems: "center", justifyContent: "center", fontWeight: 700, children: "N" }), _jsx(Text, { sx: { fontWeight: 700 }, children: "What Northstar sees" })] }), _jsx(Box, { border: "1px solid", borderColor: "border.default", borderRadius: 2, bg: "canvas.subtle", px: 3, children: step.facts.map(fact => (_jsxs(Box, { display: "flex", justifyContent: "space-between", gap: 3, py: 2, borderBottom: "1px solid", borderColor: "border.muted", sx: { '&:last-child': { borderBottom: 0 } }, children: [_jsx(Text, { sx: { color: 'fg.muted' }, children: fact.label }), _jsx(Text, { textAlign: "right", sx: { fontWeight: 600 }, children: fact.value })] }, fact.label))) }), _jsxs(Button, { variant: "invisible", sx: { alignSelf: 'flex-start', px: 0 }, onClick: () => setDetailsOpen(open => !open), children: ['{ }', " ", detailsOpen ? 'Hide' : 'Show', " protocol details"] }), detailsOpen ? (_jsxs(Box, { bg: "#0d1117", color: "#c9d1d9", borderRadius: 2, overflow: "hidden", children: [_jsxs(Box, { px: 3, py: 2, display: "flex", justifyContent: "space-between", gap: 2, borderBottom: "1px solid", borderColor: "#30363d", children: [_jsx(Text, { sx: { fontFamily: 'mono', fontSize: 0 }, children: step.detailLabel }), _jsx(Label, { variant: "secondary", children: step.channel })] }), _jsxs(Box, { p: 3, maxHeight: 270, overflow: "auto", children: [_jsxs(Text, { as: "div", sx: {
+                                                            fontFamily: 'mono',
+                                                            fontWeight: 700,
+                                                            color: '#ff7b72',
+                                                        }, children: [step.method, " ", step.target] }), _jsx(Box, { as: "pre", mt: 2, mb: 3, sx: {
+                                                            fontFamily: 'mono',
+                                                            fontSize: 0,
+                                                            whiteSpace: 'pre-wrap',
+                                                        }, children: step.request }), _jsx(Text, { as: "div", sx: {
+                                                            fontFamily: 'mono',
+                                                            fontWeight: 700,
+                                                            color: '#7ee787',
+                                                        }, children: "Response" }), _jsx(Box, { as: "pre", mt: 2, mb: 0, sx: {
+                                                            fontFamily: 'mono',
+                                                            fontSize: 0,
+                                                            whiteSpace: 'pre-wrap',
+                                                        }, children: step.response })] })] })) : null] })] })] }), _jsxs(Box, { display: "flex", alignItems: "center", justifyContent: "center", gap: 3, children: [_jsx(Button, { disabled: stepIndex === 0, onClick: () => go(stepIndex - 1), children: "Previous" }), _jsx(Box, { display: "flex", gap: 2, "aria-label": "Current step", children: STEPS.map((candidate, index) => (_jsx(Box, { as: "button", "aria-label": `Go to step ${index + 1}: ${candidate.title}`, width: 10, height: 10, p: 0, border: 0, borderRadius: "50%", bg: index === stepIndex ? 'fg.default' : 'border.default', sx: { cursor: 'pointer' }, onClick: () => go(index) }, candidate.title))) }), _jsx(Button, { variant: stepIndex === STEPS.length - 1 ? 'default' : 'primary', disabled: stepIndex === STEPS.length - 1, onClick: () => go(stepIndex + 1), children: "Next step" })] })] }));
+};
+export default PapGuidedJourneyView;

package/lib/examples/pap/PapSessionLifecycleView.d.ts

@@ -0,0 +1,4 @@
+import React from 'react';
+/** Exercise the real Session client and retain only safe lifecycle evidence. */
+declare const PapSessionLifecycleView: React.FC;
+export default PapSessionLifecycleView;

package/lib/examples/pap/PapSessionLifecycleView.js

@@ -0,0 +1,103 @@
+import { jsx as _jsx, jsxs as _jsxs } from "react/jsx-runtime";
+/*
+ * Copyright (c) 2025-2026 Datalayer, Inc.
+ * Distributed under the terms of the Modified BSD License.
+ */
+import { useState } from 'react';
+import { Box } from '@datalayer/primer-addons';
+import { contribution, definePlugin } from '@datalayer/reactor';
+import { Button, Text } from '@primer/react';
+import { DpopProofProviders, SecretValue, SessionClient, Signers, buildPapReactor, } from '@datalayer/personal-agent-protocol';
+import { PapExamplePage, PapResult } from './PapExamplePage';
+/** Exercise the real Session client and retain only safe lifecycle evidence. */
+const PapSessionLifecycleView = () => {
+    const [summary, setSummary] = useState(null);
+    const [error, setError] = useState(null);
+    const runLifecycle = async () => {
+        setError(null);
+        let calls = 0;
+        const forms = [];
+        const purposes = [];
+        const proofRequests = [];
+        const localFetch = async (_input, init) => {
+            calls += 1;
+            forms.push(new URLSearchParams(String(init?.body ?? '')));
+            if (calls === 1) {
+                return new Response(JSON.stringify({ error: 'use_dpop_nonce' }), {
+                    status: 400,
+                    headers: {
+                        'content-type': 'application/json',
+                        'DPoP-Nonce': 'host-only-company-nonce',
+                    },
+                });
+            }
+            return new Response(JSON.stringify({
+                access_token: `host-only-session-token-${calls}`,
+                token_type: 'DPoP',
+                expires_in: 300,
+                scope: 'poppy:read',
+                session_id: 'ses_example',
+                signed_in: false,
+            }), { status: 200, headers: { 'content-type': 'application/json' } });
+        };
+        const securityPlugin = definePlugin({
+            name: '@datalayer/loop-example-pap-session-security',
+            contributes: [
+                contribution(Signers, {
+                    async sign(_claims, options) {
+                        purposes.push(options.purpose);
+                        return new SecretValue(`host-only-${options.purpose}-${purposes.length}`);
+                    },
+                }, { id: 'example-signer' }),
+                contribution(DpopProofProviders, {
+                    async create(request) {
+                        proofRequests.push(request);
+                        return new SecretValue(`host-only-proof-${proofRequests.length}`);
+                    },
+                }, { id: 'example-dpop' }),
+            ],
+        });
+        const reactor = buildPapReactor({ fetch: localFetch }, [securityPlugin]);
+        try {
+            const client = new SessionClient({ reactor, fetch: localFetch });
+            const options = {
+                clientId: 'https://assistant.example/agent.json',
+                pairwiseUserId: 'usr_host_only_example',
+                issuer: 'https://company.example',
+                tokenEndpoint: 'https://company.example/oauth/token',
+                tenantId: 'example-tenant',
+            };
+            const started = await client.start(options);
+            const renewed = await client.renew({
+                ...options,
+                sessionId: started.sessionId,
+            });
+            setSummary({
+                startStatus: 'created',
+                renewStatus: 'renewed',
+                signedIn: false,
+                tokenType: 'DPoP',
+                scopes: renewed.scopes,
+                sameSession: started.sessionId === renewed.sessionId,
+                nonceRetry: proofRequests.length === 3 &&
+                    proofRequests[0]?.nonce === undefined &&
+                    proofRequests[1]?.nonce === 'host-only-company-nonce' &&
+                    proofRequests[2]?.nonce === undefined,
+                freshAssertions: purposes.length === 6,
+                freshProofs: proofRequests.length === 3,
+                renewalBoundToSession: forms.at(-1)?.has('session_id') === true,
+                sessionIdWithheld: true,
+                credentialsWithheld: true,
+            });
+        }
+        catch (cause) {
+            setSummary(null);
+            setError(cause instanceof Error ? cause.message : String(cause));
+        }
+        finally {
+            reactor.stop();
+        }
+    };
+    return (_jsxs(PapExamplePage, { eyebrow: "PAP \u00B7 Signed-out Session", title: "Start and renew without giving credentials to the agent", description: "This Reactor view drives the real PAP SessionClient against a deterministic company transport. It handles a DPoP nonce challenge, generates fresh assertions and proofs, and renews the same Session. Only lifecycle evidence enters React state.", children: [_jsxs(Box, { display: "flex", alignItems: "center", justifyContent: "space-between", gap: 3, p: 3, border: "1px solid", borderColor: "border.default", borderRadius: 2, bg: "canvas.default", children: [_jsx(Text, { sx: { color: 'fg.muted' }, children: "Exercise start, nonce retry, and renewal entirely inside this host." }), _jsx(Button, { variant: "primary", onClick: () => void runLifecycle(), children: "Run lifecycle" })] }), error ? _jsx(Text, { sx: { color: 'danger.fg' }, children: error }) : null, summary ? (_jsx(PapResult, { title: "Safe Session evidence", value: summary })) : null] }));
+};
+export default PapSessionLifecycleView;

package/lib/index.d.ts

@@ -3,6 +3,7 @@ export * from './client';
 export * from './collaboration';
 export * from './components';
 export * from './mcp';
+export * from './pap';
 export * from './stores';
 export * from './identity';
 export * from './config';

package/lib/index.js

@@ -7,6 +7,7 @@ export * from './client';
 export * from './collaboration';
 export * from './components';
 export * from './mcp';
+export * from './pap';
 export * from './stores';
 export * from './identity';
 export * from './config';

package/lib/pap/index.d.ts

@@ -0,0 +1,42 @@
+import { type DiscoveredCompany, type DiscoveryOptions, type JsonWebKeySet, type ClientMetadata, type IdentityRequestOptions } from '@datalayer/personal-agent-protocol';
+/** Verified public company capabilities safe for model and UI surfaces. */
+export interface PapCompanySummary {
+    readonly organization: string;
+    readonly domain: string;
+    readonly protocolVersion: string;
+    readonly issuer: string | null;
+    readonly signIn: readonly string[];
+    readonly interfaces: readonly string[];
+    readonly extensions: Readonly<Record<string, string>>;
+}
+/** Verified public personal-agent identity safe for model and UI surfaces. */
+export interface PapAgentIdentitySummary {
+    readonly clientId: string;
+    readonly clientName: string;
+    readonly redirectCount: number;
+    readonly signingAlgorithms: readonly string[];
+    readonly extensions: Readonly<Record<string, string>>;
+}
+type DiscoverCompany = (domain: string, options?: DiscoveryOptions) => Promise<DiscoveredCompany>;
+interface IdentityClient {
+    fetchMetadata(clientId: string, options?: IdentityRequestOptions): Promise<ClientMetadata>;
+    fetchJwks(clientId: string, options?: IdentityRequestOptions): Promise<JsonWebKeySet>;
+}
+export interface PapPersonalAgentCapabilityOptions {
+    readonly discover?: DiscoverCompany;
+    readonly identity?: IdentityClient;
+}
+/**
+ * Use PAP clients while enforcing Agent Runtimes' public-summary boundary.
+ *
+ * Authorization URLs, callback state, assertions, proofs, and tokens are not
+ * represented by this API. Those values remain in deterministic host
+ * services and cross runtime boundaries only as opaque references.
+ */
+export declare class PapPersonalAgentCapability {
+    #private;
+    constructor(options?: PapPersonalAgentCapabilityOptions);
+    discoverCompany(domain: string, options?: DiscoveryOptions): Promise<PapCompanySummary>;
+    inspectAgent(clientId: string, options?: IdentityRequestOptions): Promise<PapAgentIdentitySummary>;
+}
+export {};

package/lib/pap/index.js

@@ -0,0 +1,57 @@
+/*
+ * Copyright (c) 2025-2026 Datalayer, Inc.
+ * Distributed under the terms of the Modified BSD License.
+ */
+import { AgentIdentityClient, discoverCompany, } from '@datalayer/personal-agent-protocol';
+function extensionVersions(extensions) {
+    return Object.freeze(Object.fromEntries(Object.entries(extensions).map(([name, value]) => [name, value.version])));
+}
+/**
+ * Use PAP clients while enforcing Agent Runtimes' public-summary boundary.
+ *
+ * Authorization URLs, callback state, assertions, proofs, and tokens are not
+ * represented by this API. Those values remain in deterministic host
+ * services and cross runtime boundaries only as opaque references.
+ */
+export class PapPersonalAgentCapability {
+    #discover;
+    #identity;
+    constructor(options = {}) {
+        this.#discover = options.discover ?? discoverCompany;
+        this.#identity = options.identity ?? new AgentIdentityClient();
+    }
+    async discoverCompany(domain, options = {}) {
+        const company = await this.#discover(domain, options);
+        const { document } = company;
+        const signIn = ['direct', 'device', 'mediated'].filter(method => document.auth?.[method] !== undefined);
+        const interfaces = [
+            ...(document.agent?.protocols.map(protocol => `agent:${protocol.type}`) ??
+                []),
+            ...document.apis.map(api => `api:${api.type}`),
+            ...(document.web === undefined ? [] : ['web']),
+        ];
+        return Object.freeze({
+            organization: document.organization.name,
+            domain: document.organization.domain,
+            protocolVersion: document.protocol_version,
+            issuer: document.auth?.issuer ?? null,
+            signIn: Object.freeze(signIn),
+            interfaces: Object.freeze(interfaces),
+            extensions: extensionVersions(document.extensions),
+        });
+    }
+    async inspectAgent(clientId, options = {}) {
+        const metadata = await this.#identity.fetchMetadata(clientId, options);
+        const keys = await this.#identity.fetchJwks(clientId, options);
+        const signingAlgorithms = [
+            ...new Set(keys.keys.map(key => key.alg ?? (key.kty === 'EC' ? 'ES256' : 'RS256'))),
+        ].sort();
+        return Object.freeze({
+            clientId: metadata.client_id,
+            clientName: metadata.client_name,
+            redirectCount: metadata.redirect_uris.length,
+            signingAlgorithms: Object.freeze(signingAlgorithms),
+            extensions: extensionVersions(metadata.extensions),
+        });
+    }
+}