@alia.onl/sdk 21.5.3 → 22.0.0

package/CHANGELOG.md

@@ -1,5 +1,14 @@
 # @alia.onl/sdk
 
+## 22.0.0
+
+Requires `@oxy.so/core >=7.1.0 <8` and `@oxy.so/services >=13.0.0 <14`.
+Text, dictation, speech and voice use the shared account transport. Account
+switches and sign-out invalidate pending work; websocket credentials are
+refreshed through the shared origin-bound getter before connecting. Own Oxy
+apps use their current account without app scopes or consent. External
+credentials retain their existing limits.
+
 ## 21.5.3
 
 ### Fixed

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@alia.onl/sdk",
-  "version": "21.5.3",
+  "version": "22.0.0",
   "description": "Alia AI chat SDK — the conversation runtime, chat UI, voice calls and dictation for Oxy apps",
   "main": "src/index.ts",
   "react-native": "src/index.ts",
@@ -42,8 +42,7 @@
     "test": "vitest run",
     "check:entries": "node scripts/check-entry-isolation.mjs",
     "check:entry-types": "node scripts/check-entry-types.mjs",
-    "render:avatar-still": "bun scripts/render-avatar-still.ts",
-    "prepublishOnly": "bun run typecheck && bun run test && bun run check:entries && bun run check:entry-types"
+    "render:avatar-still": "bun scripts/render-avatar-still.ts"
   },
   "dependencies": {
     "clsx": "^2.1.1",
@@ -56,8 +55,8 @@
     "react-native": "^0.86.0 || ^0.88.0",
     "@expo/vector-icons": "^15.1.1",
     "@oxy.so/bloom": ">=15.10.1 <16.0.0",
-    "@oxy.so/core": ">=3.0.0",
-    "@oxy.so/services": ">=12.1.0",
+    "@oxy.so/core": ">=7.1.0 <8",
+    "@oxy.so/services": ">=13.0.0 <14",
     "@tanstack/react-query": "^5.101",
     "@react-native-async-storage/async-storage": "^2.2.0",
     "expo-blur": "^57.0.0 || ^58.0.0",

package/src/components/AliaChatHeader.tsx

@@ -5,7 +5,10 @@ import {
   DropdownMenuItem,
   DropdownMenuTrigger,
 } from '@oxy.so/bloom/dropdown-menu';
-import { RiArrowLeftLine, RiDeleteBin6Line, RiMoreFill, RiShare2Line } from '@oxy.so/bloom/icons';
+import { RiArrowLeftLine } from '@oxy.so/bloom/icons/RiArrowLeftLine';
+import { RiDeleteBin6Line } from '@oxy.so/bloom/icons/RiDeleteBin6Line';
+import { RiMoreFill } from '@oxy.so/bloom/icons/RiMoreFill';
+import { RiShare2Line } from '@oxy.so/bloom/icons/RiShare2Line';
 import { PageHeader } from '@oxy.so/bloom/page-header';
 import { memo, type ReactNode } from 'react';
 import { useLabels } from '../lib/labels';

package/src/components/PlanPreviewCard.tsx

@@ -1,5 +1,5 @@
 import { Card, CardBody, CardHeader, CardTitle } from '@oxy.so/bloom/card';
-import { RiListCheck3 } from '@oxy.so/bloom/icons';
+import { RiListCheck3 } from '@oxy.so/bloom/icons/RiListCheck3';
 import { Item } from '@oxy.so/bloom/item';
 import { useTheme } from '@oxy.so/bloom/theme';
 import { Text } from '@oxy.so/bloom/typography';

package/src/hooks/useDictation.ts

@@ -29,6 +29,7 @@ import { DictationRecorderError, useDictationRecorder } from '../lib/dictation-r
 import { defaultSpeechLanguage } from '../lib/speech-language';
 import { VOICE_ERROR_MESSAGES, type VoiceErrorCode } from '../lib/speech-messages';
 import { ALIA_API_URL } from '../lib/origins';
+import { bindAudioSession } from '../lib/audio-session-binding';
 
 /** The remaining time is shown from here on. */
 const COUNTDOWN_FROM_MS = 30_000;
@@ -119,20 +120,16 @@ export function useDictation(options: UseDictationOptions = {}) {
 
   const transcribe = useCallback(
     async (clip: DictationClip): Promise<string | null> => {
-      const token = optionsRef.current.accessToken || oxyServices.session.accessToken || '';
-      if (token === '') {
-        failedClipRef.current = null;
-        if (mountedRef.current) setCanRetry(false);
-        report('not-authenticated');
-        return null;
-      }
+      const apiUrl = optionsRef.current.apiUrl || ALIA_API_URL;
+      const token = optionsRef.current.accessToken;
       setState('transcribing');
       const controller = new AbortController();
       abortRef.current = controller;
+      const linked = token ? null : bindAudioSession(oxyServices, apiUrl, () => controller.abort());
       try {
         const result = await requestTranscription({
-          apiUrl: optionsRef.current.apiUrl || ALIA_API_URL,
-          token,
+          apiUrl,
+          ...(linked ? { transport: linked } : { token: token ?? '' }),
           clip,
           language: optionsRef.current.lang ?? defaultSpeechLanguage(),
           signal: controller.signal,
@@ -155,6 +152,7 @@ export function useDictation(options: UseDictationOptions = {}) {
         report(code);
         return null;
       } finally {
+        linked?.dispose();
         if (abortRef.current === controller) abortRef.current = null;
       }
     },

package/src/hooks/useTTS.ts

@@ -8,6 +8,7 @@ import { createAudioLevelMeter } from '../lib/audio-level';
 import { loadExpoAudio } from '../lib/deferred/expo-audio';
 import { requestSpeechClip } from '../lib/speech-synthesis';
 import { ALIA_API_URL } from '../lib/origins';
+import { bindAudioSession } from '../lib/audio-session-binding';
 
 // ============== OPTIONS ==============
 
@@ -103,13 +104,6 @@ export function useTTS(options: UseTTSOptions = {}) {
   const playerRef = useRef<AudioPlayer | null>(null);
   const requestRef = useRef<AbortController | null>(null);
 
-  // ============== AUTH ==============
-
-  const getToken = useCallback((): string | null => {
-    if (options.accessToken) return options.accessToken;
-    return oxyServices.session.accessToken;
-  }, [options.accessToken, oxyServices]);
-
   const getTTSVoice = useCallback(() => {
     return voicePref === 'male' ? 'male' : 'female';
   }, [voicePref]);
@@ -238,6 +232,9 @@ export function useTTS(options: UseTTSOptions = {}) {
 
       const controller = new AbortController();
       requestRef.current = controller;
+      const linked = options.accessToken
+        ? null
+        : bindAudioSession(oxyServices, apiUrl, () => controller.abort());
       try {
         setActiveMessage(messageId);
         setPlaybackState('loading');
@@ -250,13 +247,9 @@ export function useTTS(options: UseTTSOptions = {}) {
          * `conversationId` (with the message id) files the clip under that
          * conversation, so deleting the conversation deletes it.
          */
-        const token = getToken();
-        if (!token) {
-          throw new Error('Not authenticated');
-        }
         const audioUrl = await requestSpeechClip({
           apiUrl,
-          token,
+          ...(linked ? { transport: linked } : { token: options.accessToken ?? '' }),
           model: voiceModel,
           input: text,
           voice: getTTSVoice(),
@@ -270,10 +263,13 @@ export function useTTS(options: UseTTSOptions = {}) {
         if (controller.signal.aborted) return;
         console.error('[TTS] Error:', e);
         setError(errorMessage(e, 'Failed to read aloud'));
+      } finally {
+        linked?.dispose();
       }
     },
     [
-      getToken,
+      options.accessToken,
+      oxyServices,
       apiUrl,
       voiceModel,
       getTTSVoice,

package/src/hooks/useVoiceRoom.ts

@@ -14,6 +14,7 @@
  * recognizer anywhere in a call.
  */
 
+import { bindAudioSession } from '../lib/audio-session-binding';
 import { useCallback, useEffect, useMemo, useRef, useState } from 'react';
 import { useOxy } from '@oxy.so/services/ui/client';
 import type { AgentState, RoomState, VoiceCallState, VoiceMessage } from '../types';
@@ -104,23 +105,24 @@ export function useVoiceRoom(options: UseVoiceRoomOptions = {}) {
   const levels = useMemo(() => new VoiceLevelChannel(), []);
   const [snapshot, setSnapshot] = useState<VoiceCallSnapshot>(IDLE);
   const callRef = useRef<VoiceCall | null>(null);
+  const sessionBindingRef = useRef<ReturnType<typeof bindAudioSession> | null>(null);
   const mountedRef = useRef(true);
   const optionsRef = useRef(options);
   optionsRef.current = options;
 
-  const getToken = useCallback((): string | null => {
-    const { accessToken } = optionsRef.current;
-    if (accessToken) return accessToken;
-    return oxyServices.session.accessToken ?? null;
-  }, [oxyServices]);
-
   const connect = useCallback(async () => {
     const live = callRef.current?.snapshot().state.kind;
     if (live !== undefined && live !== 'ended' && live !== 'error') return;
     const current = optionsRef.current;
+    sessionBindingRef.current?.dispose();
+    const apiUrl = current.apiUrl || ALIA_API_URL;
+    const binding = current.accessToken
+      ? null
+      : bindAudioSession(oxyServices, apiUrl, () => callRef.current?.hangUp());
+    sessionBindingRef.current = binding;
     const call = new VoiceCall({
-      apiUrl: current.apiUrl || ALIA_API_URL,
-      getToken,
+      apiUrl,
+      getToken: binding?.getToken ?? (() => optionsRef.current.accessToken ?? null),
       getAppAssertion,
       conversationId: current.conversationId ?? newConversationId(),
       ...(current.agentId === undefined ? {} : { agentId: current.agentId }),
@@ -130,19 +132,23 @@ export function useVoiceRoom(options: UseVoiceRoomOptions = {}) {
       openSocket: current.openSocket ?? openWebSocket,
       levels,
       onChange: (next) => {
-        if (mountedRef.current && callRef.current === call) setSnapshot(next);
+        if (callRef.current !== call) return;
+        if (next.state.kind === 'ended' || next.state.kind === 'error') binding?.dispose();
+        if (mountedRef.current) setSnapshot(next);
       },
       onMessagesSaved: (conversationId, ids) =>
         optionsRef.current.onMessagesSaved?.(conversationId, ids),
     });
     callRef.current = call;
     await call.start();
-  }, [getToken, getAppAssertion, levels]);
+  }, [oxyServices, getAppAssertion, levels]);
 
   /** Hang up and forget the call: the room is back to `disconnected`. */
   const disconnect = useCallback(() => {
     const call = callRef.current;
     callRef.current = null;
+    sessionBindingRef.current?.dispose();
+    sessionBindingRef.current = null;
     call?.hangUp();
     levels.reset();
     if (mountedRef.current) setSnapshot(IDLE);
@@ -160,6 +166,8 @@ export function useVoiceRoom(options: UseVoiceRoomOptions = {}) {
       mountedRef.current = false;
       const call = callRef.current;
       callRef.current = null;
+      sessionBindingRef.current?.dispose();
+      sessionBindingRef.current = null;
       call?.hangUp();
     };
   }, []);

package/src/lib/audio-request-auth.ts

@@ -0,0 +1,4 @@
+/** Own audio calls share Oxy's session transport; explicit external bearers remain supported. */
+export type AudioRequestAuthentication =
+  | { readonly transport: { fetch: typeof globalThis.fetch }; readonly token?: never }
+  | { readonly token: string; readonly transport?: never };

package/src/lib/audio-session-binding.ts

@@ -0,0 +1,27 @@
+import type { OxyServices } from '@oxy.so/core';
+
+/** Bind an audio operation to core's session context while allowing token rotation. */
+export function bindAudioSession(
+  oxy: Pick<OxyServices, 'createLinkedClient'>,
+  baseURL: string,
+  onInvalidated: () => void,
+) {
+  const linked = oxy.createLinkedClient({ baseURL });
+  const epoch = linked.client.getSessionEpoch();
+  let disposed = false;
+  const current = () => !disposed && linked.client.getSessionEpoch() === epoch;
+  const unsubscribe = linked.client.addTokenChangeListener(() => {
+    if (!current()) onInvalidated();
+  });
+  return {
+    fetch: linked.fetch,
+    getToken: (target: string, options?: { signal?: AbortSignal }) =>
+      current() ? linked.getAccessToken(target, options) : Promise.resolve(null),
+    dispose: () => {
+      if (disposed) return;
+      disposed = true;
+      unsubscribe();
+      linked.dispose();
+    },
+  };
+}

package/src/lib/dictation.ts

@@ -7,6 +7,7 @@
  * recognized on the device.
  */
 
+import type { AudioRequestAuthentication } from './audio-request-auth';
 import type { VoiceErrorCode } from './speech-messages';
 
 /** The longest clip one dictation may be. */
@@ -115,14 +116,13 @@ function fileNameFor(mediaType: string): string {
   }
 }
 
-export interface TranscriptionRequest {
+export type TranscriptionRequest = AudioRequestAuthentication & {
   readonly apiUrl: string;
-  readonly token: string;
   readonly clip: DictationClip;
   /** BCP-47. */
   readonly language: string;
   readonly signal?: AbortSignal;
-}
+};
 
 /**
  * Transcribe one clip.
@@ -148,14 +148,22 @@ export async function requestTranscription(
 
   let response: Response;
   try {
-    response = await fetch(`${request.apiUrl}/v1/audio/transcriptions`, {
-      method: 'POST',
-      headers: { Authorization: `Bearer ${request.token}` },
-      body: form,
-      ...(request.signal ? { signal: request.signal } : {}),
-    });
+    response = await (request.transport?.fetch ?? fetch)(
+      `${request.apiUrl}/v1/audio/transcriptions`,
+      {
+        method: 'POST',
+        headers: request.transport ? undefined : { Authorization: `Bearer ${request.token}` },
+        redirect: 'error',
+        credentials: 'omit',
+        body: form,
+        ...(request.signal ? { signal: request.signal } : {}),
+      },
+    );
   } catch (caught: unknown) {
     if ((caught as { name?: unknown } | null)?.name === 'AbortError') throw caught;
+    const code = (caught as { code?: unknown } | null)?.code;
+    if (code === 'AUTH_REQUIRED' || code === 'AUTH_SESSION_CHANGED')
+      throw new DictationError('Not authenticated', { code: 'NOT_AUTHENTICATED', status: null });
     throw new DictationError('The transcription request did not reach Alia', {
       code: null,
       status: null,

package/src/lib/speech-synthesis.ts

@@ -8,14 +8,14 @@
  * name ever appears on this side.
  */
 
+import type { AudioRequestAuthentication } from './audio-request-auth';
 import { createAudioLevelMeter } from './audio-level';
 import { loadExpoAudio } from './deferred/expo-audio';
 
 export type ProductVoice = 'male' | 'female';
 
-export interface SpeechClipRequest {
+export type SpeechClipRequest = AudioRequestAuthentication & {
   readonly apiUrl: string;
-  readonly token: string;
   /** A speech model; omitted, the server's own speech model answers. */
   readonly model?: string;
   readonly input: string;
@@ -29,7 +29,7 @@ export interface SpeechClipRequest {
   readonly conversationId?: string;
   readonly messageId?: string;
   readonly signal: AbortSignal;
-}
+};
 
 /**
  * The codes `/v1/audio/speech` answers a failure with, plus the two this side
@@ -127,12 +127,14 @@ function clipErrorFrom(status: number, body: unknown): SpeechClipError {
 export async function requestSpeechClip(request: SpeechClipRequest): Promise<string> {
   if (request.token === '')
     throw new SpeechClipError('Not authenticated', { status: null, code: 'NOT_AUTHENTICATED' });
-  const response = await fetch(`${request.apiUrl}/v1/audio/speech`, {
+  const response = await (request.transport?.fetch ?? fetch)(`${request.apiUrl}/v1/audio/speech`, {
     method: 'POST',
     signal: request.signal,
+    redirect: 'error',
+    credentials: 'omit',
     headers: {
       'Content-Type': 'application/json',
-      Authorization: `Bearer ${request.token}`,
+      ...(request.transport ? {} : { Authorization: `Bearer ${request.token}` }),
     },
     body: JSON.stringify({
       model: request.model,

package/src/lib/voice-call.ts

@@ -76,7 +76,10 @@ export interface VoiceCallSnapshot {
 export interface VoiceCallOptions {
   readonly apiUrl: string;
   /** The person's Oxy session token, read at connect and every few minutes. */
-  readonly getToken: () => string | null;
+  readonly getToken: (
+    target: string,
+    options?: { signal?: AbortSignal },
+  ) => string | null | Promise<string | null>;
   /**
    * The host's Oxy app assertion, sent with the first `auth` of each socket so
    * an agent Oxy confines to an app opens only there (ADR 0021). Absent: none.
@@ -138,6 +141,8 @@ export class VoiceCall {
   private resumeTimer: ReturnType<typeof setTimeout> | null = null;
   private tokenTimer: ReturnType<typeof setInterval> | null = null;
   private finished = false;
+  private readonly credentialAbort = new AbortController();
+  private refreshingToken = false;
 
   /** The three facts "listening" needs. */
   private ready = false;
@@ -172,11 +177,7 @@ export class VoiceCall {
   async start(): Promise<void> {
     if (this.state.kind !== 'idle') return;
     this.setState({ kind: 'connecting' });
-    const token = this.options.getToken();
-    if (token === null || token === '') {
-      this.fail('not-authenticated');
-      return;
-    }
+    if (!(await this.readToken()) || this.finished) return;
     const engine = this.options.createEngine();
     this.engine = engine;
     try {
@@ -187,9 +188,10 @@ export class VoiceCall {
       return;
     }
     if (this.finished) return;
-    this.openSocket(false);
+    await this.openSocket(false);
+    if (this.finished) return;
     this.tokenTimer = setInterval(
-      () => this.refreshToken(),
+      () => void this.refreshToken(),
       this.options.tokenRefreshMs ?? TOKEN_REFRESH_MS,
     );
   }
@@ -237,7 +239,8 @@ export class VoiceCall {
     };
   }
 
-  private openSocket(resuming: boolean): void {
+  private async openSocket(resuming: boolean): Promise<void> {
+    if (!(await this.readToken()) || this.finished) return;
     this.authenticated = false;
     let socket: VoiceSocket;
     try {
@@ -250,29 +253,7 @@ export class VoiceCall {
     socket.binaryType = 'arraybuffer';
     this.socket = socket;
     socket.onopen = () => {
-      const token = this.options.getToken();
-      if (token === null || token === '') {
-        this.fail('not-authenticated');
-        return;
-      }
-      this.lastToken = token;
-      const getAppAssertion = this.options.getAppAssertion;
-      if (getAppAssertion === undefined) {
-        socket.send(JSON.stringify({ type: 'auth', token } satisfies VoiceClientEvent));
-        return;
-      }
-      void getAppAssertion()
-        .catch(() => null)
-        .then((appAssertion) => {
-          if (this.socket !== socket || this.finished || socket.readyState !== OPEN) return;
-          socket.send(
-            JSON.stringify({
-              type: 'auth',
-              token,
-              ...(appAssertion ? { appAssertion } : {}),
-            } satisfies VoiceClientEvent),
-          );
-        });
+      void this.authenticateSocket(socket);
     };
     socket.onmessage = (event) => {
       if (this.socket !== socket || this.finished) return;
@@ -314,16 +295,59 @@ export class VoiceCall {
     if (this.resumeTimer !== null) clearTimeout(this.resumeTimer);
     this.resumeTimer = setTimeout(() => {
       this.resumeTimer = null;
-      if (!this.finished) this.openSocket(true);
+      if (!this.finished) void this.openSocket(true);
     }, this.options.resumeRetryMs ?? RESUME_RETRY_MS);
   }
 
-  private refreshToken(): void {
-    if (!this.authenticated || this.socket?.readyState !== OPEN) return;
-    const token = this.options.getToken();
-    if (token === null || token === '' || token === this.lastToken) return;
+  /** The shared session owns refresh and validates the actual socket destination. */
+  private async readToken(): Promise<string | null> {
+    try {
+      const token = await this.options.getToken(voiceSessionUrl(this.options.apiUrl), {
+        signal: this.credentialAbort.signal,
+      });
+      if (this.finished) return null;
+      if (!token) this.fail('not-authenticated');
+      return token || null;
+    } catch {
+      if (!this.finished) this.fail('not-authenticated');
+      return null;
+    }
+  }
+
+  private async authenticateSocket(socket: VoiceSocket): Promise<void> {
+    const assertion = await this.options.getAppAssertion?.().catch(() => null);
+    const token = await this.readToken();
+    if (!token || this.finished || this.socket !== socket || socket.readyState !== OPEN) return;
     this.lastToken = token;
-    this.send({ type: 'auth', token });
+    socket.send(
+      JSON.stringify({
+        type: 'auth',
+        token,
+        ...(assertion ? { appAssertion: assertion } : {}),
+      } satisfies VoiceClientEvent),
+    );
+  }
+
+  private async refreshToken(): Promise<void> {
+    if (this.refreshingToken || !this.authenticated || this.socket?.readyState !== OPEN) return;
+    const socket = this.socket;
+    this.refreshingToken = true;
+    try {
+      const token = await this.readToken();
+      if (
+        !token ||
+        this.finished ||
+        this.socket !== socket ||
+        !this.authenticated ||
+        socket.readyState !== OPEN
+      )
+        return;
+      if (token === this.lastToken) return;
+      this.lastToken = token;
+      this.send({ type: 'auth', token });
+    } finally {
+      this.refreshingToken = false;
+    }
   }
 
   private send(event: VoiceClientEvent): void {
@@ -564,6 +588,7 @@ export class VoiceCall {
   private finish(state: VoiceCallState): void {
     if (this.finished) return;
     this.finished = true;
+    this.credentialAbort.abort();
     if (this.resumeTimer !== null) clearTimeout(this.resumeTimer);
     if (this.tokenTimer !== null) clearInterval(this.tokenTimer);
     this.resumeTimer = null;

package/src/lib/work-log.ts

@@ -1,11 +1,9 @@
-import {
-  RiBookOpenLine,
-  RiFileTextLine,
-  RiGlobalLine,
-  RiSearchLine,
-  RiTerminalBoxLine,
-  RiToolsLine,
-} from '@oxy.so/bloom/icons';
+import { RiBookOpenLine } from '@oxy.so/bloom/icons/RiBookOpenLine';
+import { RiFileTextLine } from '@oxy.so/bloom/icons/RiFileTextLine';
+import { RiGlobalLine } from '@oxy.so/bloom/icons/RiGlobalLine';
+import { RiSearchLine } from '@oxy.so/bloom/icons/RiSearchLine';
+import { RiTerminalBoxLine } from '@oxy.so/bloom/icons/RiTerminalBoxLine';
+import { RiToolsLine } from '@oxy.so/bloom/icons/RiToolsLine';
 import type { TaskListChip, TaskListStep, TaskListTask } from '@oxy.so/bloom/task-list';
 import type { WebSearchBrand, WebSearchSource, WebSearchStep } from '@oxy.so/bloom/web-search';
 import type { ToolInvocation } from '../runtime/types';