@datalayer/agent-runtimes 1.3.105 → 1.3.108

package/lib/examples/PapCompanyDiscoveryExample.js

@@ -0,0 +1,23 @@
+import { jsx as _jsx } from "react/jsx-runtime";
+/*
+ * Copyright (c) 2025-2026 Datalayer, Inc.
+ * Distributed under the terms of the Modified BSD License.
+ */
+/** PAP company discovery mounted as a Reactor workspace plugin. */
+import { useMemo } from 'react';
+import { Box, setupPrimerPortals } from '@datalayer/primer-addons';
+import { LoopEmbed } from '../apps';
+import { definePapExamplePlugin } from '../apps/plugins/pap-example';
+import { ThemedProvider } from './utils/themedProvider';
+setupPrimerPortals();
+const PapCompanyPlugin = definePapExamplePlugin({
+    key: 'company-discovery',
+    title: 'PAP Company Discovery',
+    description: 'Verified company metadata reduced to a model-safe summary.',
+    load: () => import('./pap/PapCompanyDiscoveryView'),
+});
+const PapCompanyDiscoveryExample = () => {
+    const plugins = useMemo(() => [PapCompanyPlugin], []);
+    return (_jsx(ThemedProvider, { children: _jsx(Box, { height: "100vh", minHeight: 0, children: _jsx(LoopEmbed, { target: "browser", agentId: "loop-shell", defaultEditor: "none", showHeader: true, plugins: plugins }) }) }));
+};
+export default PapCompanyDiscoveryExample;

package/lib/examples/PapDpopProofExample.d.ts

@@ -0,0 +1,4 @@
+/** PAP DPoP proof creation mounted as a Reactor workspace plugin. */
+import React from 'react';
+declare const PapDpopProofExample: React.FC;
+export default PapDpopProofExample;

package/lib/examples/PapDpopProofExample.js

@@ -0,0 +1,23 @@
+import { jsx as _jsx } from "react/jsx-runtime";
+/*
+ * Copyright (c) 2025-2026 Datalayer, Inc.
+ * Distributed under the terms of the Modified BSD License.
+ */
+/** PAP DPoP proof creation mounted as a Reactor workspace plugin. */
+import { useMemo } from 'react';
+import { Box, setupPrimerPortals } from '@datalayer/primer-addons';
+import { LoopEmbed } from '../apps';
+import { definePapExamplePlugin } from '../apps/plugins/pap-example';
+import { ThemedProvider } from './utils/themedProvider';
+setupPrimerPortals();
+const PapDpopPlugin = definePapExamplePlugin({
+    key: 'dpop-proof',
+    title: 'PAP DPoP Proof',
+    description: 'Fresh request-bound proofs kept outside model and UI state.',
+    load: () => import('./pap/PapDpopProofView'),
+});
+const PapDpopProofExample = () => {
+    const plugins = useMemo(() => [PapDpopPlugin], []);
+    return (_jsx(ThemedProvider, { children: _jsx(Box, { height: "100vh", minHeight: 0, children: _jsx(LoopEmbed, { target: "browser", agentId: "loop-shell", defaultEditor: "none", showHeader: true, plugins: plugins }) }) }));
+};
+export default PapDpopProofExample;

package/lib/examples/PapGuidedJourneyExample.d.ts

@@ -0,0 +1,4 @@
+/** A narrative PAP interaction mounted as a Reactor workspace plugin. */
+import React from 'react';
+declare const PapGuidedJourneyExample: React.FC;
+export default PapGuidedJourneyExample;

package/lib/examples/PapGuidedJourneyExample.js

@@ -0,0 +1,23 @@
+import { jsx as _jsx } from "react/jsx-runtime";
+/*
+ * Copyright (c) 2025-2026 Datalayer, Inc.
+ * Distributed under the terms of the Modified BSD License.
+ */
+/** A narrative PAP interaction mounted as a Reactor workspace plugin. */
+import { useMemo } from 'react';
+import { Box, setupPrimerPortals } from '@datalayer/primer-addons';
+import { LoopEmbed } from '../apps';
+import { definePapExamplePlugin } from '../apps/plugins/pap-example';
+import { ThemedProvider } from './utils/themedProvider';
+setupPrimerPortals();
+const PapJourneyPlugin = definePapExamplePlugin({
+    key: 'guided-journey',
+    title: 'PAP Guided Journey',
+    description: 'A visual return journey across discovery, sign-in, and action.',
+    load: () => import('./pap/PapGuidedJourneyView'),
+});
+const PapGuidedJourneyExample = () => {
+    const plugins = useMemo(() => [PapJourneyPlugin], []);
+    return (_jsx(ThemedProvider, { children: _jsx(Box, { height: "100vh", minHeight: 0, children: _jsx(LoopEmbed, { target: "browser", agentId: "loop-shell", defaultEditor: "none", showHeader: true, plugins: plugins }) }) }));
+};
+export default PapGuidedJourneyExample;

package/lib/examples/PapSessionLifecycleExample.d.ts

@@ -0,0 +1,4 @@
+/** PAP signed-out Session lifecycle mounted as a Reactor workspace plugin. */
+import React from 'react';
+declare const PapSessionLifecycleExample: React.FC;
+export default PapSessionLifecycleExample;

package/lib/examples/PapSessionLifecycleExample.js

@@ -0,0 +1,23 @@
+import { jsx as _jsx } from "react/jsx-runtime";
+/*
+ * Copyright (c) 2025-2026 Datalayer, Inc.
+ * Distributed under the terms of the Modified BSD License.
+ */
+/** PAP signed-out Session lifecycle mounted as a Reactor workspace plugin. */
+import { useMemo } from 'react';
+import { Box, setupPrimerPortals } from '@datalayer/primer-addons';
+import { LoopEmbed } from '../apps';
+import { definePapExamplePlugin } from '../apps/plugins/pap-example';
+import { ThemedProvider } from './utils/themedProvider';
+setupPrimerPortals();
+const PapSessionPlugin = definePapExamplePlugin({
+    key: 'session-lifecycle',
+    title: 'PAP Session Lifecycle',
+    description: 'Start, nonce retry, and renewal with credentials host-owned.',
+    load: () => import('./pap/PapSessionLifecycleView'),
+});
+const PapSessionLifecycleExample = () => {
+    const plugins = useMemo(() => [PapSessionPlugin], []);
+    return (_jsx(ThemedProvider, { children: _jsx(Box, { height: "100vh", minHeight: 0, children: _jsx(LoopEmbed, { target: "browser", agentId: "loop-shell", defaultEditor: "none", showHeader: true, plugins: plugins }) }) }));
+};
+export default PapSessionLifecycleExample;

package/lib/examples/example-selector.js

@@ -7,6 +7,7 @@ const DISPLAY_NAME_EXCEPTIONS = [
     [/\bAg Ui\b/g, 'AG-UI'],
     [/\bA2 Ui\b/g, 'A2UI'],
     [/\bA2 A\b/g, 'A2A'],
+    [/\bPap\b/g, 'PAP'],
     [/\bCopilot Kit\b/g, 'CopilotKit'],
     [/\bGen Ui\b/g, 'Gen UI'],
     [/\bM C P\b/g, 'MCP'],
@@ -37,6 +38,8 @@ function inferTags(id) {
         tags.add('a2ui');
     if (id.startsWith('AgentA2A'))
         tags.add('a2a');
+    if (id.startsWith('Pap'))
+        tags.add('pap');
     if (id.includes('Notebook'))
         tags.add('notebook');
     if (id.includes('Lexical') || id.includes('Document'))
@@ -128,6 +131,12 @@ export const EXAMPLE_ENTRIES = [
     makeEntry('AgentSubagentsExample', () => import('./AgentSubagentsExample'), 'Multi-agent delegation with the in-repo subagents capability.'),
     makeEntry('AgentA2AExample', () => import('./AgentA2AExample'), 'Delegation to separate agents over the A2A protocol, launched locally or on Datalayer runtimes.'),
     makeEntry('AgentA2ATeamExample', () => import('./AgentA2ATeamExample'), 'Two applications as a team over A2A: Sales in the browser (@a2a-js/sdk) asks Accounting on a runtime (fasta2a, Odoo read only), each an Office Assistant character.'),
+    makeEntry('PapCompanyDiscoveryExample', () => import('./PapCompanyDiscoveryExample'), 'Validate a PAP company document and reduce it to the public capabilities safe for an agent or UI.'),
+    makeEntry('PapAgentIdentityExample', () => import('./PapAgentIdentityExample'), 'Verify personal-agent client metadata and signing policy without exposing JWK coordinates.'),
+    makeEntry('PapAuthorizationBoundaryExample', () => import('./PapAuthorizationBoundaryExample'), 'Generate real Session and Direct Sign-In security material while showing only safe policy status.'),
+    makeEntry('PapDpopProofExample', () => import('./PapDpopProofExample'), 'Create fresh request-bound DPoP proofs while withholding proof, token, nonce, identifiers, and key material.'),
+    makeEntry('PapSessionLifecycleExample', () => import('./PapSessionLifecycleExample'), 'Start, retry, and renew a signed-out PAP Session while credentials remain host-owned.'),
+    makeEntry('PapGuidedJourneyExample', () => import('./PapGuidedJourneyExample'), 'Follow a visual PAP return journey across discovery, signed-out conversation, Direct Sign-In, and an exact user-authorized result.'),
     makeEntry('AgentNotificationsExample', () => import('./AgentNotificationsExample'), 'Notifications and event routing example.'),
     makeEntry('AgentOutputsExample', () => import('./AgentOutputsExample'), 'Structured outputs and rendering patterns.'),
     makeEntry('AgentParametersExample', () => import('./AgentParametersExample'), 'Launch-time parameterized agent creation with JSON schema.'),

package/lib/examples/exampleGroups.d.ts

@@ -5,5 +5,5 @@
  *
  * @module examples/exampleGroups
  */
-export declare const EXAMPLE_GROUP_ORDER: readonly ["Apps", "Assistant", "A2UI", "A2A", "AG-UI", "Chat", "Document", "Notebook", "Capabilities", "Cell", "CopilotKit"];
+export declare const EXAMPLE_GROUP_ORDER: readonly ["Apps", "Assistant", "A2UI", "A2A", "Personal Agent Protocol", "AG-UI", "Chat", "Document", "Notebook", "Capabilities", "Cell", "CopilotKit"];
 export declare const getExampleGroup: (id: string) => string;

package/lib/examples/exampleGroups.js

@@ -14,6 +14,7 @@ export const EXAMPLE_GROUP_ORDER = [
     'Assistant',
     'A2UI',
     'A2A',
+    'Personal Agent Protocol',
     'AG-UI',
     'Chat',
     'Document',
@@ -36,6 +37,8 @@ export const getExampleGroup = (id) => {
     // Agents reached over the A2A protocol: their own category, after A2UI.
     if (id.startsWith('AgentA2A'))
         return 'A2A';
+    if (id.startsWith('Pap'))
+        return 'Personal Agent Protocol';
     if (id.startsWith('AgUi'))
         return 'AG-UI';
     if (id.startsWith('CopilotKit'))

package/lib/examples/index.d.ts

@@ -27,6 +27,12 @@ export { default as AgentCodemodeExample } from './AgentCodemodeExample';
 export { default as AgentCodeSandboxesExample } from './AgentCodeSandboxesExample';
 export { default as AgentDecideExample } from './AgentDecideExample';
 export { default as AgentA2ATeamExample } from './AgentA2ATeamExample';
+export { default as PapCompanyDiscoveryExample } from './PapCompanyDiscoveryExample';
+export { default as PapAgentIdentityExample } from './PapAgentIdentityExample';
+export { default as PapAuthorizationBoundaryExample } from './PapAuthorizationBoundaryExample';
+export { default as PapDpopProofExample } from './PapDpopProofExample';
+export { default as PapSessionLifecycleExample } from './PapSessionLifecycleExample';
+export { default as PapGuidedJourneyExample } from './PapGuidedJourneyExample';
 export { default as ScenesExample } from './ScenesExample';
 export { default as AgentEvalsExample } from './AgentEvalsExample';
 export { default as AgentGuardrailsExample } from './AgentGuardrailsExample';

package/lib/examples/index.js

@@ -33,6 +33,12 @@ export { default as AgentCodemodeExample } from './AgentCodemodeExample';
 export { default as AgentCodeSandboxesExample } from './AgentCodeSandboxesExample';
 export { default as AgentDecideExample } from './AgentDecideExample';
 export { default as AgentA2ATeamExample } from './AgentA2ATeamExample';
+export { default as PapCompanyDiscoveryExample } from './PapCompanyDiscoveryExample';
+export { default as PapAgentIdentityExample } from './PapAgentIdentityExample';
+export { default as PapAuthorizationBoundaryExample } from './PapAuthorizationBoundaryExample';
+export { default as PapDpopProofExample } from './PapDpopProofExample';
+export { default as PapSessionLifecycleExample } from './PapSessionLifecycleExample';
+export { default as PapGuidedJourneyExample } from './PapGuidedJourneyExample';
 export { default as ScenesExample } from './ScenesExample';
 export { default as AgentEvalsExample } from './AgentEvalsExample';
 export { default as AgentGuardrailsExample } from './AgentGuardrailsExample';

package/lib/examples/main.js

@@ -78,6 +78,15 @@ const ANONYMOUS_EXAMPLES = new Set([
     'DocumentPageAgent',
     // The decks plugin in a Loop; the agent and the decks both live in the page.
     'DecksAgent',
+    // PAP protocol examples are deterministic browser views. They validate
+    // fixtures and generate local Web Crypto material without allocating a
+    // runtime or authenticating to Datalayer.
+    'PapCompanyDiscoveryExample',
+    'PapAgentIdentityExample',
+    'PapAuthorizationBoundaryExample',
+    'PapDpopProofExample',
+    'PapSessionLifecycleExample',
+    'PapGuidedJourneyExample',
     // The floating assistant: the character, its balloon and its motions need
     // no runtime; a conversation does, and says so when there is none.
     'AssistantExample',

package/lib/examples/pap/PapAgentIdentityView.d.ts

@@ -0,0 +1,4 @@
+import React from 'react';
+/** Verify client metadata and JWKS while withholding public-key coordinates. */
+declare const PapAgentIdentityView: React.FC;
+export default PapAgentIdentityView;

package/lib/examples/pap/PapAgentIdentityView.js

@@ -0,0 +1,55 @@
+import { jsx as _jsx, jsxs as _jsxs } from "react/jsx-runtime";
+/*
+ * Copyright (c) 2025-2026 Datalayer, Inc.
+ * Distributed under the terms of the Modified BSD License.
+ */
+import { useState } from 'react';
+import { Box } from '@datalayer/primer-addons';
+import { Button, Text, TextInput } from '@primer/react';
+import { parseClientMetadata, parseJsonWebKeySet, } from '@datalayer/personal-agent-protocol';
+import { PapPersonalAgentCapability, } from '../../pap';
+import { PapExamplePage, PapResult } from './PapExamplePage';
+const SAMPLE_CLIENT_ID = 'https://assistant.example/agent.json';
+/** Verify client metadata and JWKS while withholding public-key coordinates. */
+const PapAgentIdentityView = () => {
+    const [clientId, setClientId] = useState(SAMPLE_CLIENT_ID);
+    const [summary, setSummary] = useState(null);
+    const [error, setError] = useState(null);
+    const inspect = async () => {
+        setError(null);
+        try {
+            const normalized = new URL(clientId.trim()).toString();
+            const capability = new PapPersonalAgentCapability({
+                identity: {
+                    fetchMetadata: async (requested) => parseClientMetadata({
+                        client_id: requested,
+                        client_name: 'Example Research Assistant',
+                        jwks_uri: `${new URL(requested).origin}/jwks.json`,
+                        redirect_uris: [`${new URL(requested).origin}/callback`],
+                        token_endpoint_auth_method: 'private_key_jwt',
+                        extensions: { memory: { version: '2' } },
+                    }),
+                    fetchJwks: async () => parseJsonWebKeySet({
+                        keys: [
+                            {
+                                kty: 'EC',
+                                crv: 'P-256',
+                                x: 'withheld-x-coordinate',
+                                y: 'withheld-y-coordinate',
+                                use: 'sig',
+                                alg: 'ES256',
+                            },
+                        ],
+                    }),
+                },
+            });
+            setSummary(await capability.inspectAgent(normalized));
+        }
+        catch (cause) {
+            setSummary(null);
+            setError(cause instanceof Error ? cause.message : String(cause));
+        }
+    };
+    return (_jsxs(PapExamplePage, { eyebrow: "PAP \u00B7 Personal-agent identity", title: "Verify who signs without exposing the key", description: "PAP binds client metadata to its HTTPS client ID and verifies its JWKS. Agent Runtimes keeps only identity and signing policy; coordinates and operational endpoints stay outside the UI and model boundary.", children: [_jsxs(Box, { display: "flex", flexDirection: "column", gap: 3, p: 3, border: "1px solid", borderColor: "border.default", borderRadius: 2, bg: "canvas.default", children: [_jsx(Text, { as: "label", sx: { fontWeight: 600 }, children: "Personal-agent client ID" }), _jsxs(Box, { display: "flex", gap: 2, children: [_jsx(TextInput, { block: true, value: clientId, "aria-label": "Personal-agent client ID", onChange: event => setClientId(event.target.value) }), _jsx(Button, { variant: "primary", onClick: () => void inspect(), children: "Verify sample" })] }), error ? _jsx(Text, { sx: { color: 'danger.fg' }, children: error }) : null] }), summary ? (_jsx(PapResult, { title: "Safe identity summary", value: summary })) : null] }));
+};
+export default PapAgentIdentityView;

package/lib/examples/pap/PapAuthorizationBoundaryView.d.ts

@@ -0,0 +1,4 @@
+import React from 'react';
+/** Generate real security material and reveal only its non-secret policy. */
+declare const PapAuthorizationBoundaryView: React.FC;
+export default PapAuthorizationBoundaryView;

package/lib/examples/pap/PapAuthorizationBoundaryView.js

@@ -0,0 +1,59 @@
+import { jsx as _jsx, jsxs as _jsxs } from "react/jsx-runtime";
+/*
+ * Copyright (c) 2025-2026 Datalayer, Inc.
+ * Distributed under the terms of the Modified BSD License.
+ */
+import { useState } from 'react';
+import { Box } from '@datalayer/primer-addons';
+import { Button, Text } from '@primer/react';
+import { buildDirectSignInRequest, buildSessionAssertionClaims, generatePairwiseUserId, } from '@datalayer/personal-agent-protocol';
+import { PapExamplePage, PapResult } from './PapExamplePage';
+/** Generate real security material and reveal only its non-secret policy. */
+const PapAuthorizationBoundaryView = () => {
+    const [summary, setSummary] = useState(null);
+    const [error, setError] = useState(null);
+    const generate = async () => {
+        setError(null);
+        try {
+            const clientId = 'https://assistant.example/agent.json';
+            const tokenEndpoint = 'https://shop.example/oauth/token';
+            const claims = buildSessionAssertionClaims({
+                clientId,
+                pairwiseUserId: generatePairwiseUserId(),
+                tokenEndpoint,
+            });
+            const request = await buildDirectSignInRequest({
+                authorizationEndpoint: 'https://shop.example/oauth/authorize',
+                issuer: 'https://shop.example',
+                clientId,
+                redirectUri: 'https://assistant.example/callback',
+                scopes: ['poppy:read', 'poppy:act'],
+            });
+            setSummary({
+                session: {
+                    issuerBoundToClient: claims.iss === clientId,
+                    audienceBoundToTokenEndpoint: claims.aud === tokenEndpoint,
+                    lifetimeSeconds: claims.exp - claims.iat,
+                    pairwiseSubjectWithheld: true,
+                    uniqueRequestIdWithheld: true,
+                    unsignedAssertionWithheld: true,
+                },
+                directSignIn: {
+                    requestedScopes: request.scopes,
+                    pkceMethod: 'S256',
+                    randomState: true,
+                    userOwnedBrowserRequired: true,
+                    authorizationUrlWithheld: true,
+                    stateWithheld: true,
+                    codeVerifierWithheld: true,
+                },
+            });
+        }
+        catch (cause) {
+            setSummary(null);
+            setError(cause instanceof Error ? cause.message : String(cause));
+        }
+    };
+    return (_jsxs(PapExamplePage, { eyebrow: "PAP \u00B7 Authorization boundary", title: "Generate secrets in the host; return policy to the agent", description: "This example creates a real pairwise Session identity, unique assertion ID, OAuth state and S256 PKCE verifier. None crosses the Reactor view boundary. Studio hands the authorization URL directly to a user-owned browser and stores tokens behind opaque references.", children: [_jsxs(Box, { display: "flex", alignItems: "center", justifyContent: "space-between", gap: 3, p: 3, border: "1px solid", borderColor: "border.default", borderRadius: 2, bg: "canvas.default", children: [_jsx(Text, { sx: { color: 'fg.muted' }, children: "Generate a fresh Session and Direct Sign-In request inside this host." }), _jsx(Button, { variant: "primary", onClick: () => void generate(), children: "Generate safely" })] }), error ? _jsx(Text, { sx: { color: 'danger.fg' }, children: error }) : null, summary ? (_jsx(PapResult, { title: "Model-safe boundary result", value: summary })) : null] }));
+};
+export default PapAuthorizationBoundaryView;

package/lib/examples/pap/PapCompanyDiscoveryView.d.ts

@@ -0,0 +1,4 @@
+import React from 'react';
+/** Verify a company fixture through the same safe capability used by agents. */
+declare const PapCompanyDiscoveryView: React.FC;
+export default PapCompanyDiscoveryView;

package/lib/examples/pap/PapCompanyDiscoveryView.js

@@ -0,0 +1,62 @@
+import { jsx as _jsx, jsxs as _jsxs } from "react/jsx-runtime";
+/*
+ * Copyright (c) 2025-2026 Datalayer, Inc.
+ * Distributed under the terms of the Modified BSD License.
+ */
+import { useState } from 'react';
+import { Box } from '@datalayer/primer-addons';
+import { Button, Text, TextInput } from '@primer/react';
+import { parseDiscoveryDocument, } from '@datalayer/personal-agent-protocol';
+import { PapPersonalAgentCapability } from '../../pap';
+import { PapExamplePage, PapResult } from './PapExamplePage';
+const SAMPLE_DOMAIN = 'shop.example';
+const sampleCompany = (domain) => ({
+    discoveryUrl: `https://${domain}/.well-known/poppy.json`,
+    document: parseDiscoveryDocument({
+        protocol_version: '0.1',
+        organization: { name: 'Example Shop', domain },
+        auth: {
+            issuer: `https://auth.${domain}`,
+            direct: { scopes: ['poppy:read'] },
+            custom_scopes: {},
+        },
+        agent: {
+            protocols: [{ type: 'a2a', endpoint: `https://${domain}/agent` }],
+        },
+        apis: [
+            {
+                type: 'openapi',
+                url: `https://${domain}/openapi.json`,
+                description: 'Read the catalogue',
+            },
+        ],
+        extensions: { operations: { version: '1' } },
+    }),
+});
+/** Verify a company fixture through the same safe capability used by agents. */
+const PapCompanyDiscoveryView = () => {
+    const [domain, setDomain] = useState(SAMPLE_DOMAIN);
+    const [summary, setSummary] = useState(null);
+    const [error, setError] = useState(null);
+    const inspect = async () => {
+        setError(null);
+        try {
+            const normalized = domain.trim().toLowerCase();
+            const capability = new PapPersonalAgentCapability({
+                discover: async (requested) => {
+                    if (requested !== normalized) {
+                        throw new Error('The requested domain changed during discovery.');
+                    }
+                    return sampleCompany(normalized);
+                },
+            });
+            setSummary(await capability.discoverCompany(normalized));
+        }
+        catch (cause) {
+            setSummary(null);
+            setError(cause instanceof Error ? cause.message : String(cause));
+        }
+    };
+    return (_jsxs(PapExamplePage, { eyebrow: "PAP \u00B7 Company discovery", title: "Discover capabilities, not credentials", description: "The PAP parser validates the discovery document; Agent Runtimes then projects it into a model-safe summary. Change the sample domain to see issuer and discovery binding move together.", children: [_jsxs(Box, { display: "flex", flexDirection: "column", gap: 3, p: 3, border: "1px solid", borderColor: "border.default", borderRadius: 2, bg: "canvas.default", children: [_jsx(Text, { as: "label", sx: { fontWeight: 600 }, children: "Company DNS domain" }), _jsxs(Box, { display: "flex", gap: 2, children: [_jsx(TextInput, { block: true, value: domain, "aria-label": "Company DNS domain", onChange: event => setDomain(event.target.value) }), _jsx(Button, { variant: "primary", onClick: () => void inspect(), children: "Validate sample" })] }), _jsx(Text, { sx: { color: 'fg.muted', fontSize: 1 }, children: "The sample uses an injected Reactor-compatible transport. Production replaces it with DNS-pinned HTTPS discovery." }), error ? _jsx(Text, { sx: { color: 'danger.fg' }, children: error }) : null] }), summary ? (_jsx(PapResult, { title: "Safe company summary", value: summary })) : null] }));
+};
+export default PapCompanyDiscoveryView;

package/lib/examples/pap/PapDpopProofView.d.ts

@@ -0,0 +1,4 @@
+import React from 'react';
+/** Create real device-held proofs while retaining only non-secret evidence. */
+declare const PapDpopProofView: React.FC;
+export default PapDpopProofView;

package/lib/examples/pap/PapDpopProofView.js

@@ -0,0 +1,57 @@
+import { jsx as _jsx, jsxs as _jsxs } from "react/jsx-runtime";
+/*
+ * Copyright (c) 2025-2026 Datalayer, Inc.
+ * Distributed under the terms of the Modified BSD License.
+ */
+import { useState } from 'react';
+import { Box } from '@datalayer/primer-addons';
+import { Button, Text } from '@primer/react';
+import { JoseDpopProofProvider, SecretValue, } from '@datalayer/personal-agent-protocol';
+import { PapExamplePage, PapResult } from './PapExamplePage';
+/** Create real device-held proofs while retaining only non-secret evidence. */
+const PapDpopProofView = () => {
+    const [summary, setSummary] = useState(null);
+    const [error, setError] = useState(null);
+    const createProofs = async () => {
+        setError(null);
+        try {
+            const keyPair = (await globalThis.crypto.subtle.generateKey({ name: 'ECDSA', namedCurve: 'P-256' }, false, ['sign', 'verify']));
+            const publicJwk = await globalThis.crypto.subtle.exportKey('jwk', keyPair.publicKey);
+            const provider = new JoseDpopProofProvider({
+                resolveKey: () => ({
+                    privateKey: keyPair.privateKey,
+                    publicJwk,
+                    algorithm: 'ES256',
+                }),
+            });
+            const request = {
+                method: 'POST',
+                url: 'https://api.company.example/orders?draft=true#editor',
+                tenantId: 'example-tenant',
+                subject: 'host-only-pairwise-subject',
+                issuer: 'https://company.example',
+                accessToken: new SecretValue('host-only-example-token'),
+                nonce: 'host-only-company-nonce',
+            };
+            const first = await provider.create(request);
+            const second = await provider.create(request);
+            setSummary({
+                algorithm: 'ES256',
+                freshProofPerRequest: first.reveal() !== second.reveal(),
+                methodBound: true,
+                urlBoundWithoutQueryOrFragment: true,
+                accessTokenBound: true,
+                nonceIncluded: true,
+                proofRedactedByDefault: first.toJSON() === '[REDACTED]',
+                proofWithheldFromUiState: true,
+                keyMaterialWithheldFromUiState: true,
+            });
+        }
+        catch (cause) {
+            setSummary(null);
+            setError(cause instanceof Error ? cause.message : String(cause));
+        }
+    };
+    return (_jsxs(PapExamplePage, { eyebrow: "PAP \u00B7 DPoP", title: "Create a fresh proof for every protected request", description: "This Reactor view creates non-exportable P-256 key material and real DPoP proofs in the browser host. Only policy evidence enters React state; proofs, tokens, nonces, identifiers and key material stay outside the agent and rendered UI. Server-side verification adds signature, request, token and replay checks.", children: [_jsxs(Box, { display: "flex", alignItems: "center", justifyContent: "space-between", gap: 3, p: 3, border: "1px solid", borderColor: "border.default", borderRadius: 2, bg: "canvas.default", children: [_jsx(Text, { sx: { color: 'fg.muted' }, children: "Generate two proofs for the same request without retaining either." }), _jsx(Button, { variant: "primary", onClick: () => void createProofs(), children: "Create safely" })] }), error ? _jsx(Text, { sx: { color: 'danger.fg' }, children: error }) : null, summary ? (_jsx(PapResult, { title: "Safe DPoP evidence", value: summary })) : null] }));
+};
+export default PapDpopProofView;

package/lib/examples/pap/PapExamplePage.d.ts

@@ -0,0 +1,14 @@
+import React from 'react';
+export interface PapExamplePageProps {
+    title: string;
+    eyebrow: string;
+    description: string;
+    children: React.ReactNode;
+    maxWidth?: number | string;
+}
+/** Shared visual frame for the protocol examples. */
+export declare const PapExamplePage: React.FC<PapExamplePageProps>;
+export declare const PapResult: React.FC<{
+    title: string;
+    value: unknown;
+}>;

package/lib/examples/pap/PapExamplePage.js

@@ -0,0 +1,6 @@
+import { jsx as _jsx, jsxs as _jsxs } from "react/jsx-runtime";
+import { Box } from '@datalayer/primer-addons';
+import { Heading, Label, Text } from '@primer/react';
+/** Shared visual frame for the protocol examples. */
+export const PapExamplePage = ({ title, eyebrow, description, children, maxWidth = 960, }) => (_jsx(Box, { height: "100%", overflow: "auto", bg: "canvas.subtle", p: 4, children: _jsxs(Box, { maxWidth: maxWidth, mx: "auto", display: "flex", flexDirection: "column", gap: 3, children: [_jsxs(Box, { display: "flex", flexDirection: "column", gap: 2, children: [_jsx(Box, { children: _jsx(Label, { variant: "accent", children: eyebrow }) }), _jsx(Heading, { as: "h1", sx: { fontSize: 4 }, children: title }), _jsx(Text, { sx: { color: 'fg.muted', maxWidth: 760 }, children: description })] }), children] }) }));
+export const PapResult = ({ title, value }) => (_jsxs(Box, { border: "1px solid", borderColor: "border.default", borderRadius: 2, bg: "canvas.default", p: 3, children: [_jsx(Heading, { as: "h2", sx: { fontSize: 2, mb: 2 }, children: title }), _jsx(Box, { as: "pre", m: 0, p: 3, overflow: "auto", borderRadius: 2, bg: "canvas.inset", sx: { fontSize: 1, lineHeight: 1.5 }, children: JSON.stringify(value, null, 2) })] }));

package/lib/examples/pap/PapGuidedJourneyView.d.ts

@@ -0,0 +1,4 @@
+import React from 'react';
+/** A five-step user, company, and wire-level PAP walkthrough. */
+declare const PapGuidedJourneyView: React.FC;
+export default PapGuidedJourneyView;