@datalayer/agent-runtimes 1.5.55 → 1.5.57

package/lib/apps/plugins/pap-sign-in/PapSignInCard.js

@@ -55,9 +55,15 @@ export function PapSignInCard({ context, send, }) {
     };
     // Who the person signs in at: the company itself for a Direct Sign-In (P-04), the page's host otherwise.
     const named = read.company ?? read.host;
+    // The company that asks, by name and domain, beside the page (PAP 0.2 §4.6, §4.7).
+    const org = read.organization;
     const title = read.mode === 'mediated'
-        ? PAP_SIGN_IN_WORDS.mediatedTitle(read.host)
-        : PAP_SIGN_IN_WORDS.title(named);
+        ? org
+            ? PAP_SIGN_IN_WORDS.mediatedTitleFor(org.name, org.domain, read.host)
+            : PAP_SIGN_IN_WORDS.mediatedTitle(read.host)
+        : org && read.mode === 'device'
+            ? PAP_SIGN_IN_WORDS.titleFor(org.name, org.domain, read.host)
+            : PAP_SIGN_IN_WORDS.title(named);
     return (_jsxs(Box, { as: "section", "aria-label": title, my: 2, p: 3, border: "1px solid", borderColor: "border.default", borderRadius: 2, bg: "canvas.subtle", maxWidth: 480, children: [_jsx(Heading, { as: "h4", sx: { fontSize: 2, mb: 1 }, children: title }), _jsx(Text, { as: "p", sx: { mt: 0, mb: 2, color: 'fg.muted', fontSize: 1 }, children: read.mode === 'device'
                     ? PAP_SIGN_IN_WORDS.device
                     : read.mode === 'mediated'

package/lib/examples/pap/PapAuthorizationBoundaryView.js

@@ -16,11 +16,12 @@ const PapAuthorizationBoundaryView = () => {
         setError(null);
         try {
             const clientId = 'https://assistant.example/agent.json';
-            const tokenEndpoint = 'https://shop.example/oauth/token';
+            // PAP 0.2 §4.2: the assertion names the company's issuer, not its token endpoint.
+            const issuer = 'https://shop.example';
             const claims = buildSessionAssertionClaims({
                 clientId,
                 pairwiseUserId: generatePairwiseUserId(),
-                tokenEndpoint,
+                issuer,
             });
             const request = await buildDirectSignInRequest({
                 authorizationEndpoint: 'https://shop.example/oauth/authorize',
@@ -32,7 +33,7 @@ const PapAuthorizationBoundaryView = () => {
             setSummary({
                 session: {
                     issuerBoundToClient: claims.iss === clientId,
-                    audienceBoundToTokenEndpoint: claims.aud === tokenEndpoint,
+                    audienceBoundToIssuer: claims.aud === issuer,
                     lifetimeSeconds: claims.exp - claims.iat,
                     pairwiseSubjectWithheld: true,
                     uniqueRequestIdWithheld: true,

package/lib/examples/pap/PapCompanyDiscoveryView.js

@@ -13,7 +13,7 @@ const SAMPLE_DOMAIN = 'shop.example';
 const sampleCompany = (domain) => ({
     discoveryUrl: `https://${domain}/.well-known/poppy.json`,
     document: parseDiscoveryDocument({
-        protocol_version: '0.1',
+        protocol_version: '0.2',
         organization: { name: 'Example Shop', domain },
         auth: {
             issuer: `https://auth.${domain}`,

package/lib/examples/pap/PapGuidedJourneyView.js

@@ -28,7 +28,7 @@ const STEPS = [
         channel: 'Discovery',
         messages: conversationStart,
         facts: [
-            { label: 'Publishes', value: 'poppy.json · draft 0.1' },
+            { label: 'Publishes', value: 'poppy.json · draft 0.2' },
             { label: 'Returns', value: 'Company conversation agent' },
             { label: 'Sign-in', value: "Northstar's own page" },
         ],
@@ -38,7 +38,7 @@ const STEPS = [
         request: 'Accept: application/json',
         response: `200 OK
 {
-  "protocol_version": "0.1",
+  "protocol_version": "0.2",
   "organization": { "name": "Northstar Outfitters" },
   "auth": { "issuer": "https://auth.northstar.example" },
   "agent": { "protocols": [{ "type": "poppy" }] }
@@ -224,7 +224,7 @@ const companyReply = (response) => {
  */
 const runJourney = async () => {
     parseDiscoveryDocument({
-        protocol_version: '0.1',
+        protocol_version: '0.2',
         organization: { name: 'Northstar Outfitters', domain: 'northstar.example' },
         auth: {
             issuer: 'https://auth.northstar.example',
@@ -243,7 +243,7 @@ const runJourney = async () => {
     buildSessionAssertionClaims({
         clientId: 'https://atlas.example/agent.json',
         pairwiseUserId: 'usr_host_only_journey',
-        tokenEndpoint: 'https://auth.northstar.example/oauth/token',
+        issuer: 'https://auth.northstar.example',
     });
     await buildDirectSignInRequest({
         authorizationEndpoint: 'https://auth.northstar.example/oauth/authorize',

package/lib/examples/pap/traces/account-tokens.json

@@ -3,7 +3,7 @@
     "title": "Account Tokens",
     "description": "Refresh, rotation, narrowing, re-consent, and revocation of the Account Token Atlas holds for Ada at Manzanita, which never leaves the host's vault.",
     "generator": "examples/personal-agent-protocol/traces/generate.py",
-    "sdk": "personal-agent-protocol 0.16.0",
+    "sdk": "personal-agent-protocol 0.25.0",
     "parties": [
         {
             "id": "user",
@@ -90,7 +90,7 @@
                             "content-type": "application/json"
                         },
                         "body": {
-                            "protocol_version": "0.1",
+                            "protocol_version": "0.2",
                             "organization": {
                                 "name": "Manzanita Outfitters",
                                 "domain": "manzanita.example"
@@ -147,6 +147,9 @@
                             "web": {
                                 "browser_session_endpoint": "https://manzanita.example/poppy/browser-session"
                             },
+                            "feedback": {
+                                "endpoint": "https://manzanita.example/poppy/feedback"
+                            },
                             "extensions": {
                                 "operations": {
                                     "version": "1",

package/lib/examples/pap/traces/conversation-control.json

@@ -3,7 +3,7 @@
     "title": "Conversation control",
     "description": "A Direct Conversation under an open one, a handoff to a person at Manzanita, and closing, through the real ConversationClient.",
     "generator": "examples/personal-agent-protocol/traces/generate.py",
-    "sdk": "personal-agent-protocol 0.16.0",
+    "sdk": "personal-agent-protocol 0.25.0",
     "parties": [
         {
             "id": "user",
@@ -90,7 +90,7 @@
                             "content-type": "application/json"
                         },
                         "body": {
-                            "protocol_version": "0.1",
+                            "protocol_version": "0.2",
                             "organization": {
                                 "name": "Manzanita Outfitters",
                                 "domain": "manzanita.example"
@@ -147,6 +147,9 @@
                             "web": {
                                 "browser_session_endpoint": "https://manzanita.example/poppy/browser-session"
                             },
+                            "feedback": {
+                                "endpoint": "https://manzanita.example/poppy/feedback"
+                            },
                             "extensions": {
                                 "operations": {
                                     "version": "1",

package/lib/examples/pap/traces/conversation-streaming.json

@@ -3,7 +3,7 @@
     "title": "Conversation streaming",
     "description": "Atlas reads a Manzanita conversation over Server-Sent Events: display-only text deltas, complete message events, and a resume from Last-Event-ID.",
     "generator": "examples/personal-agent-protocol/traces/generate.py",
-    "sdk": "personal-agent-protocol 0.16.0",
+    "sdk": "personal-agent-protocol 0.25.0",
     "parties": [
         {
             "id": "user",
@@ -90,7 +90,7 @@
                             "content-type": "application/json"
                         },
                         "body": {
-                            "protocol_version": "0.1",
+                            "protocol_version": "0.2",
                             "organization": {
                                 "name": "Manzanita Outfitters",
                                 "domain": "manzanita.example"
@@ -147,6 +147,9 @@
                             "web": {
                                 "browser_session_endpoint": "https://manzanita.example/poppy/browser-session"
                             },
+                            "feedback": {
+                                "endpoint": "https://manzanita.example/poppy/feedback"
+                            },
                             "extensions": {
                                 "operations": {
                                     "version": "1",

package/lib/examples/pap/traces/mediated-sign-in.json

@@ -3,7 +3,7 @@
     "title": "Mediated Sign-In",
     "description": "Ada signs in to Manzanita without leaving Atlas: the host's protected input collects the fields Manzanita declares and sends them to Manzanita's endpoint, once.",
     "generator": "examples/personal-agent-protocol/traces/generate.py",
-    "sdk": "personal-agent-protocol 0.16.0",
+    "sdk": "personal-agent-protocol 0.25.0",
     "parties": [
         {
             "id": "user",
@@ -90,7 +90,7 @@
                             "content-type": "application/json"
                         },
                         "body": {
-                            "protocol_version": "0.1",
+                            "protocol_version": "0.2",
                             "organization": {
                                 "name": "Manzanita Outfitters",
                                 "domain": "manzanita.example"
@@ -147,6 +147,9 @@
                             "web": {
                                 "browser_session_endpoint": "https://manzanita.example/poppy/browser-session"
                             },
+                            "feedback": {
+                                "endpoint": "https://manzanita.example/poppy/feedback"
+                            },
                             "extensions": {
                                 "operations": {
                                     "version": "1",

package/lib/examples/pap/traces/operations.json

@@ -3,7 +3,7 @@
     "title": "Operations",
     "description": "Manzanita proposes an exchange; Atlas confirms only the exact revision Ada approved, at most once.",
     "generator": "examples/personal-agent-protocol/traces/generate.py",
-    "sdk": "personal-agent-protocol 0.16.0",
+    "sdk": "personal-agent-protocol 0.25.0",
     "parties": [
         {
             "id": "user",
@@ -90,7 +90,7 @@
                             "content-type": "application/json"
                         },
                         "body": {
-                            "protocol_version": "0.1",
+                            "protocol_version": "0.2",
                             "organization": {
                                 "name": "Manzanita Outfitters",
                                 "domain": "manzanita.example"
@@ -147,6 +147,9 @@
                             "web": {
                                 "browser_session_endpoint": "https://manzanita.example/poppy/browser-session"
                             },
+                            "feedback": {
+                                "endpoint": "https://manzanita.example/poppy/feedback"
+                            },
                             "extensions": {
                                 "operations": {
                                     "version": "1",

package/lib/examples/pap/traces/two-companies.json

@@ -1,9 +1,9 @@
 {
     "slug": "two-companies",
     "title": "Two companies working together",
-    "description": "Ledgerly, an accounting firm, is a PAP company to Ada's agent Atlas and a PAP personal agent at Northwind Bank for her. Every approval is an Operation. This is composition: draft 0.1 defines no company-to-company protocol.",
+    "description": "Ledgerly, an accounting firm, is a PAP company to Ada's agent Atlas and a PAP personal agent at Northwind Bank for her. Every approval is an Operation. This is composition: draft 0.2 defines no company-to-company protocol.",
     "generator": "examples/personal-agent-protocol/traces/generate.py",
-    "sdk": "personal-agent-protocol 0.16.0",
+    "sdk": "personal-agent-protocol 0.25.0",
     "parties": [
         {
             "id": "user",
@@ -120,7 +120,7 @@
                             "content-type": "application/json"
                         },
                         "body": {
-                            "protocol_version": "0.1",
+                            "protocol_version": "0.2",
                             "organization": {
                                 "name": "Ledgerly",
                                 "domain": "ledgerly.example"
@@ -146,6 +146,9 @@
                                     }
                                 ]
                             },
+                            "feedback": {
+                                "endpoint": "https://ledgerly.example/poppy/feedback"
+                            },
                             "extensions": {
                                 "operations": {
                                     "version": "1",
@@ -643,7 +646,7 @@
                             "content-type": "application/json"
                         },
                         "body": {
-                            "protocol_version": "0.1",
+                            "protocol_version": "0.2",
                             "organization": {
                                 "name": "Northwind Bank",
                                 "domain": "northwind.example"
@@ -669,6 +672,9 @@
                                     }
                                 ]
                             },
+                            "feedback": {
+                                "endpoint": "https://northwind.example/poppy/feedback"
+                            },
                             "extensions": {
                                 "operations": {
                                     "version": "1",

package/lib/examples/pap/traces/user-with-a-company.json

@@ -3,7 +3,7 @@
     "title": "A user with a company",
     "description": "Ada asks her personal agent, Atlas, to exchange a jacket at Manzanita Outfitters. Both sides are the PAP Python SDK's demo world: real keys and proofs over in-process HTTP, recorded and redacted.",
     "generator": "examples/personal-agent-protocol/traces/generate.py",
-    "sdk": "personal-agent-protocol 0.16.0",
+    "sdk": "personal-agent-protocol 0.25.0",
     "parties": [
         {
             "id": "user",
@@ -95,7 +95,7 @@
                             "content-type": "application/json"
                         },
                         "body": {
-                            "protocol_version": "0.1",
+                            "protocol_version": "0.2",
                             "organization": {
                                 "name": "Manzanita Outfitters",
                                 "domain": "manzanita.example"
@@ -152,6 +152,9 @@
                             "web": {
                                 "browser_session_endpoint": "https://manzanita.example/poppy/browser-session"
                             },
+                            "feedback": {
+                                "endpoint": "https://manzanita.example/poppy/feedback"
+                            },
                             "extensions": {
                                 "operations": {
                                     "version": "1",

package/lib/portable/signIn.d.ts

@@ -28,6 +28,15 @@ export type PapSignInWaiting = {
      * which sends the person on to the company and takes them back only from it.
      */
     company?: string;
+    /**
+     * The company that asks, by name and domain (PAP draft 0.2 §4.6, §4.7): the
+     * SDK names it on every Device and Mediated Sign-In, and the card shows both
+     * with the link, so a company cannot pass off another's page as its own.
+     */
+    organization?: {
+        name: string;
+        domain: string;
+    };
     /** The code to enter, for `device`. */
     code?: string;
     /** Where the company sent a code, for `mediated`, when it did. */
@@ -43,10 +52,14 @@ export type PapSignInWaiting = {
 /** What the card says. */
 export declare const PAP_SIGN_IN_WORDS: {
     readonly title: (host: string) => string;
+    /** A Device Sign-In, with the company that asks named (PAP 0.2 §4.6). */
+    readonly titleFor: (name: string, domain: string, host: string) => string;
     readonly direct: "Open the company’s page through Datalayer, sign in there, and this conversation goes on once you are back.";
     readonly device: "Open the company’s page and enter this code there.";
     /** `mediated`: the page is Datalayer's, which names the company and asks what it asks. */
     readonly mediatedTitle: (host: string) => string;
+    /** A Mediated Sign-In, with the company that asks named (PAP 0.2 §4.7). */
+    readonly mediatedTitleFor: (name: string, domain: string, host: string) => string;
     readonly mediated: "Open this page: it names the company and asks what the company needs. Type it there, never in this conversation.";
     readonly sentTo: (to: string) => string;
     readonly needs: (scopes: string[]) => string;

package/lib/portable/signIn.js

@@ -5,10 +5,14 @@
 /** What the card says. */
 export const PAP_SIGN_IN_WORDS = {
     title: (host) => `Sign in at ${host}`,
+    /** A Device Sign-In, with the company that asks named (PAP 0.2 §4.6). */
+    titleFor: (name, domain, host) => `Sign in to ${name} (${domain}) at ${host}`,
     direct: 'Open the company’s page through Datalayer, sign in there, and this conversation goes on once you are back.',
     device: 'Open the company’s page and enter this code there.',
     /** `mediated`: the page is Datalayer's, which names the company and asks what it asks. */
     mediatedTitle: (host) => `Sign in through ${host}`,
+    /** A Mediated Sign-In, with the company that asks named (PAP 0.2 §4.7). */
+    mediatedTitleFor: (name, domain, host) => `Sign in to ${name} (${domain}) through ${host}`,
     mediated: 'Open this page: it names the company and asks what the company needs. Type it there, never in this conversation.',
     sentTo: (to) => `The company sent a code to ${to}.`,
     needs: (scopes) => `It needs: ${scopes.join(', ')}.`,
@@ -125,6 +129,17 @@ export function readPapSignIn(result) {
     const company = typeof data.company === 'string' && DOMAIN.test(data.company)
         ? data.company
         : '';
+    // The company that asks, as the SDK names it (organization_name, organization_domain).
+    const organizationName = typeof data.organization_name === 'string'
+        ? data.organization_name.trim().slice(0, 200)
+        : '';
+    const organizationDomain = typeof data.organization_domain === 'string' &&
+        DOMAIN.test(data.organization_domain.toLowerCase())
+        ? data.organization_domain.toLowerCase()
+        : '';
+    const organization = organizationName && organizationDomain
+        ? { name: organizationName, domain: organizationDomain }
+        : undefined;
     // What the company said it needs: scope tokens only, anything else not shown.
     const needs = Array.isArray(data.needs)
         ? data.needs.filter((scope) => typeof scope === 'string' && SCOPE.test(scope))
@@ -134,6 +149,7 @@ export function readPapSignIn(result) {
         open: url.toString(),
         host: url.hostname,
         ...(company ? { company } : {}),
+        ...(organization ? { organization } : {}),
         ...(typeof data.code === 'string' && data.code ? { code: data.code } : {}),
         ...(data.mode === 'mediated' &&
             typeof data.sent_to === 'string' &&

package/lib/protocols/pap/index.d.ts

@@ -1,4 +1,4 @@
 export declare const PAP_PLUGIN = "agent-runtimes.protocols.pap";
 /** The PAP draft the SDK implements (its `PROTOCOL_PROFILE`; Python reads it from the SDK). */
-export declare const PAP_PROTOCOL_PROFILE = "0.1";
+export declare const PAP_PROTOCOL_PROFILE = "0.2";
 export declare const PapPlugin: import("@datalayer/reactor").ReactorPlugin<Record<string, never>, unknown, unknown>;

package/lib/protocols/pap/index.js

@@ -18,7 +18,7 @@ import { contribution, definePlugin } from '@datalayer/reactor';
 import { DEFAULT_ORDER, ProtocolDescriptions } from '../core';
 export const PAP_PLUGIN = 'agent-runtimes.protocols.pap';
 /** The PAP draft the SDK implements (its `PROTOCOL_PROFILE`; Python reads it from the SDK). */
-export const PAP_PROTOCOL_PROFILE = '0.1';
+export const PAP_PROTOCOL_PROFILE = '0.2';
 export const PapPlugin = definePlugin({
     name: PAP_PLUGIN,
     version: '1.0.0',
@@ -32,7 +32,7 @@ export const PapPlugin = definePlugin({
             version: PAP_PROTOCOL_PROFILE,
             roles: ['personal-agent', 'company'],
             status: 'implemented',
-            specification: 'https://personalagentprotocol.org/docs/spec',
+            specification: 'https://personalagentprotocol.org/docs/0.2/spec',
             plugin: PAP_PLUGIN,
             catalogue: 'pap',
             points: [],

package/lib/specs/protocols.js

@@ -113,8 +113,8 @@ export const PAP_PROTOCOL_0_0_1 = {
     description: "A person's agent working with a company for them — signed out, then signed in at the company, its changes confirmed by the person — and an application being a company personal agents reach.",
     publisher: 'Sierra, Meta',
     layer: 'consent',
-    specUrl: 'https://poppy.md',
-    specVersion: 'draft 0.1',
+    specUrl: 'https://personalagentprotocol.org',
+    specVersion: 'draft 0.2',
     status: 'shipped',
     connects: "Companies, as a person's agent there, or being one",
     packages: {

package/package.json

@@ -1,6 +1,6 @@
 {
     "name": "@datalayer/agent-runtimes",
-    "version": "1.5.55",
+    "version": "1.5.57",
     "type": "module",
     "workspaces": [
         ".",
@@ -161,7 +161,7 @@
         "@datalayer/lexical-loro": "^1.0.6",
         "@datalayer/primer-addons": "^1.0.40",
         "@datalayer/primer-rjsf": "^1.0.3",
-        "@datalayer/personal-agent-protocol": "^0.24.0",
+        "@datalayer/personal-agent-protocol": "^0.25.0",
         "@datalayer/reactor": "^1.3.0",
         "@datalayer/reactor-commands": "^1.0.4",
         "@datalayer/reactor-manager": "^1.0.4",