@ateam-ai-mobile/ui 0.1.5 → 0.1.7

package/dist/index.d.mts

@@ -1,8 +1,9 @@
 import * as react_jsx_runtime from 'react/jsx-runtime';
-import { Message, JobProgress, UIAction, AdasSession, TenantMembership } from '@ateam-ai-mobile/core';
-import * as react from 'react';
-import react__default from 'react';
-import { PluginSurfaceMeta, PlatformPluginManifest } from '@ateam-ai-mobile/plugin-runtime';
+import { Message, JobProgress, UIAction, AdasSession, TenantMembership, HandoffExchangeResult, ConsumerSignInResult, InvitePreview, ConsumerCapabilityConfig } from '@ateam-ai-mobile/core';
+import * as React$1 from 'react';
+import React__default, { ReactNode } from 'react';
+import * as _ateam_ai_mobile_plugin_runtime from '@ateam-ai-mobile/plugin-runtime';
+import { PluginSurfaceMeta, PlatformPluginManifest, VoiceState, VoiceTranscriptEntry, VoiceSessionProvider, VoiceStartOptions, VoiceCaller, VoiceSnapshot, VoiceEvent, VoiceSubscription } from '@ateam-ai-mobile/plugin-runtime';
 import * as zustand from 'zustand';
 
 interface AdasChatScreenProps {
@@ -70,7 +71,7 @@ interface PluginRendererProps {
     /** Plugin manifest (from API) */
     manifest: any;
     /** Shared command buffer from parent — captures commands before plugin mounts */
-    commandBufferRef?: react__default.MutableRefObject<any[]>;
+    commandBufferRef?: React__default.MutableRefObject<any[]>;
     /** Engine-supplied props from sys.focusUiPlugin(id, props) — forwarded to
      *  the plugin Component as `PluginProps.props`. */
     props?: any;
@@ -126,7 +127,7 @@ declare function EmbeddedPluginWebView({ pluginId, manifest, commandBufferRef }:
 declare function usePluginBridge(pluginId: string, connectorId?: string, commandBufferRef?: React.MutableRefObject<any[]>, wsRef?: {
     current: WebSocket | null;
 }): {
-    webViewRef: react.RefObject<any>;
+    webViewRef: React$1.RefObject<any>;
     sendInit: () => void;
     handleMessage: (event: {
         nativeEvent: {
@@ -174,6 +175,203 @@ interface LightboxState {
 }
 declare const useLightboxStore: zustand.UseBoundStore<zustand.StoreApi<LightboxState>>;
 
+interface WorkspaceBannerProps {
+    /** Extra top inset (e.g. safe-area) so the banner clears the status bar. */
+    topInset?: number;
+}
+declare function WorkspaceBanner({ topInset }: WorkspaceBannerProps): react_jsx_runtime.JSX.Element | null;
+
+interface HandoffScreenProps {
+    /** The one-time handoff code the host captured from the deep link (null = nothing pending). */
+    code: string | null;
+    /**
+     * Adopt the handed-off tenant. AWAITED before onSignedIn so the host's active
+     * tenant is set before the session reads it (the exchange result carries the
+     * tenant the code was bound to). No-op is fine when the result has no tenant.
+     */
+    onAdoptTenant: (tenant: string) => void | Promise<void>;
+    /** Adopt the session JWT (host wires its authStore.login → core session + tenantConfirmed). */
+    onSignedIn: (jwt: string) => void | Promise<void>;
+    /** Clear the consumed single-use code so a relaunch never retries it. Called after success. */
+    onDone: () => void;
+    /** Back to sign in — the host toggles the pre-auth phase (not a router). */
+    onCancel: () => void;
+}
+declare function HandoffScreen({ code, onAdoptTenant, onSignedIn, onDone, onCancel }: HandoffScreenProps): react_jsx_runtime.JSX.Element;
+
+/**
+ * Handoff exchange — the pure, testable half of HandoffScreen (R9B).
+ *
+ * Kept JSX-free in its own module (like R6's runLogoutTeardown) so the
+ * security-sensitive error mapper and the adopt-before-sign-in ORDERING can be
+ * node-tested directly, without rendering the RN component.
+ */
+
+interface HandoffExchangeDeps {
+    /** Trade the one-time code for a session JWT (host injects core.exchangeHandoff). */
+    exchange: (code: string) => Promise<HandoffExchangeResult>;
+    /** Adopt the handed-off tenant (host's single tenant writer). */
+    onAdoptTenant: (tenant: string) => void | Promise<void>;
+    /** Adopt the session JWT. */
+    onSignedIn: (jwt: string) => void | Promise<void>;
+    /** Clear the consumed single-use code. */
+    onDone: () => void;
+}
+/**
+ * Run the handoff: exchange → (adopt tenant) → sign in → clear the code, in that
+ * exact order. The tenant adoption is AWAITED BEFORE onSignedIn so the host's
+ * active tenant is set before the session reads it — a cross-tenant handoff must
+ * never sign in under the wrong tenant. Throws on any failure (the caller maps it
+ * to a user-facing message); onSignedIn / onDone never run on the error path.
+ */
+declare function runHandoffExchange(code: string, deps: HandoffExchangeDeps): Promise<void>;
+/**
+ * Map the server's rejection to plainer copy. SECURITY: the exchange endpoint
+ * deliberately does NOT tell an anonymous caller whether a code was unknown (404)
+ * vs used/expired (410) — distinguishing them would confirm a real code to a
+ * replay attacker. So both collapse to ONE message; never promise "expired" vs
+ * "already used". 429 is the one safe-to-distinguish case (a rate-limit hint
+ * leaks nothing about code validity).
+ */
+declare function handoffErrorMessage(msg?: string): string;
+
+interface OpenJoinScreenProps {
+    /** Adopt the joined tenant (host's single ACTIVE_TENANT writer), awaited before sign-in. */
+    onAdoptTenant: (tenant: string) => void | Promise<void>;
+    /** Adopt the session JWT (host: authStore.login → core session + tenantConfirmed). */
+    onSignedIn: (jwt: string) => void | Promise<void>;
+    /** Back to sign in — the host toggles the pre-auth phase (not a router). */
+    onBack: () => void;
+}
+declare function OpenJoinScreen({ onAdoptTenant, onSignedIn, onBack }: OpenJoinScreenProps): react_jsx_runtime.JSX.Element;
+
+/**
+ * Open self-signup — the pure, testable half of OpenJoinScreen (R9B).
+ *
+ * JSX-free so the join ORDERING (join → adopt tenant → sign in) and the error
+ * mapper are node-testable without rendering. The native id_token acquisition
+ * happens in the component via getOAuthProvider(); the acquired token is passed
+ * in here, so this module stays pure and provider-free.
+ */
+
+interface OpenJoinDeps {
+    /** Exchange { tenant, id_token } for a session JWT (host injects core.openJoinWith*). */
+    join: (slug: string, idToken: string) => Promise<ConsumerSignInResult>;
+    /** Adopt the joined tenant (host's single ACTIVE_TENANT writer). */
+    onAdoptTenant: (tenant: string) => void | Promise<void>;
+    /** Adopt the session JWT. */
+    onSignedIn: (jwt: string) => void | Promise<void>;
+}
+/**
+ * Complete an open self-signup with an already-acquired id_token.
+ *
+ * Returns false WITHOUT side effects when idToken is null — the caller acquired
+ * no token (the user cancelled the native sheet, or it returned none), which is
+ * a silent no-op, never an error. Otherwise: join → adopt the joined tenant →
+ * sign in, in that order (the tenant is adopted only AFTER the server confirms
+ * the join, and BEFORE sign-in so the session reads the right tenant). Throws on
+ * a join failure (the caller maps it to a message); sign-in never runs then.
+ */
+declare function completeOpenJoin(slug: string, idToken: string | null, deps: OpenJoinDeps): Promise<boolean>;
+/**
+ * Map the server's open-join rejection to plainer copy. Unlike the handoff
+ * exchange, these ARE safe to distinguish — the caller already knows the tenant
+ * slug they typed, so "invite-only" / "no such team" leak nothing.
+ */
+declare function openJoinErrorMessage(msg?: string): string;
+
+interface JoinScreenProps {
+    /** The invite code the host captured from the deep link. */
+    code: string | null;
+    /** Adopt the session JWT (host: authStore.login → core session + tenantConfirmed). */
+    onSignedIn: (jwt: string) => void | Promise<void>;
+    /** Clear the consumed single-use invite so a relaunch never retries it. */
+    onDone: () => void;
+    /** Dismiss on a bad invite — the host toggles the pre-auth phase (not a router). */
+    onCancel: () => void;
+}
+declare function JoinScreen({ code, onSignedIn, onDone, onCancel }: JoinScreenProps): react_jsx_runtime.JSX.Element;
+
+/**
+ * Invite join — the pure, testable half of JoinScreen (R9B).
+ *
+ * JSX-free so the join ORDERING and the header derivation are node-testable
+ * without rendering. The native id_token acquisition happens in the component via
+ * getOAuthProvider(); the acquired token is passed in here.
+ */
+
+interface InviteJoinDeps {
+    /** Exchange { invite, id_token } for a tenant-scoped JWT (host injects core.joinWith*). */
+    join: (code: string, idToken: string) => Promise<ConsumerSignInResult>;
+    /** Clear the consumed single-use invite (host store). */
+    onDone: () => void;
+    /** Adopt the session JWT. */
+    onSignedIn: (jwt: string) => void | Promise<void>;
+}
+/**
+ * Complete an invite join with an already-acquired id_token.
+ *
+ * Returns false WITHOUT side effects when idToken is null (user cancelled the
+ * native sheet). Otherwise: join → clear the consumed invite → sign in, in that
+ * order (matching the app: the invite is cleared before sign-in so a relaunch
+ * never retries a burned code). Throws on a join failure; the invite is NOT
+ * cleared and sign-in never runs then, so the user can retry the same invite.
+ */
+declare function completeInviteJoin(code: string, idToken: string | null, deps: InviteJoinDeps): Promise<boolean>;
+/** The invite header copy. Role is optional — "Join <Org>?" when absent. */
+declare function inviteHeadline(preview: InvitePreview | null): string;
+
+interface LoginScreenProps {
+    /** The reactive pre-auth tenant pick (host: useSession().tenant). Re-fetches config on change. */
+    activeTenant: string;
+    /** The fallback tenant for the consumer-disabled self-heal guard (host: DEFAULT_TENANT). */
+    defaultTenant: string;
+    /** Reset to the default tenant + persist + bump activeTenant so this screen refetches. */
+    onConsumerDisabled: () => void | Promise<void>;
+    /** Adopt the session JWT (host: authStore.login → core session + tenantConfirmed). */
+    onSignedIn: (jwt: string) => void | Promise<void>;
+    /** Open the host's "join a team by name" (OpenJoin) sub-view. Link hidden when omitted. */
+    onJoinTeam?: () => void;
+}
+declare function LoginScreen({ activeTenant, defaultTenant, onConsumerDisabled, onSignedIn, onJoinTeam }: LoginScreenProps): react_jsx_runtime.JSX.Element;
+
+/**
+ * Login — the pure, testable half of LoginScreen (R9B).
+ *
+ * JSX-free so the tenant client-id derivation, the consumer-disabled self-heal
+ * decision, and the sign-in ordering are node-testable without rendering.
+ */
+
+/**
+ * The Google client ids to sign in with, from the tenant's consumer config.
+ * webClientId sets the id_token AUDIENCE the server verifies; iosClientId makes
+ * the native account picker show (missing → the SDK silently falls back to a web
+ * flow on iOS). Accepts the legacy single `client_id` as the web id.
+ */
+declare function googleClientIds(config: ConsumerCapabilityConfig): {
+    webClientId: string;
+    iosClientId: string;
+};
+/**
+ * Whether a failed config fetch should self-heal by falling back to the default
+ * tenant. A consumer-DISABLED tenant 404s with "capability not enabled"; rather
+ * than dead-end the user on red text we coerce back to the default and refetch.
+ * Guarded by currentTenant !== defaultTenant so we never loop on the default.
+ */
+declare function shouldRecoverToDefaultTenant(errorMsg: string | undefined, currentTenant: string, defaultTenant: string): boolean;
+interface ProviderSignInDeps {
+    /** Trade the provider id_token for a session JWT (host injects core.signInWith*). */
+    exchange: (idToken: string) => Promise<ConsumerSignInResult>;
+    /** Adopt the session JWT. */
+    onSignedIn: (jwt: string) => void | Promise<void>;
+}
+/**
+ * Complete a provider sign-in with an already-acquired id_token: exchange → sign
+ * in. Returns false WITHOUT side effects on a null token (user cancelled the
+ * native sheet). Throws on an exchange failure; sign-in never runs then.
+ */
+declare function completeProviderSignIn(idToken: string | null, deps: ProviderSignInDeps): Promise<boolean>;
+
 interface Props {
     visible: boolean;
     onClose: () => void;
@@ -182,38 +380,144 @@ interface Props {
 }
 declare function VoiceCallSheet({ visible, onClose, skillSlug }: Props): react_jsx_runtime.JSX.Element | null;
 
-interface TranscriptEntry {
-    role: 'user' | 'ai' | 'tool';
-    text: string;
-    ts: number;
+type CallState = VoiceState;
+type TranscriptEntry = VoiceTranscriptEntry;
+interface InternalState {
+    callState: CallState;
+    sessionId: string | null;
+    error: string | null;
+    transcript: TranscriptEntry[];
+    aiPartial: string;
+    userPartial: string;
+    muted: boolean;
+    /** User VAD, from the mini-app's speechActivity events. */
+    userSpeaking: boolean;
+    /** Epoch ms of the last speaking:false, or null before the first utterance. */
+    lastUserSpeechEndedAt: number | null;
+    /** The WebView should be mounted (a session is wanted / live). */
+    mounted: boolean;
+    /** The WebView source, computed ONCE at start() so state changes (transcript,
+     *  partials) never remount the WebView and drop the session. */
+    webViewSource: {
+        uri: string;
+    } | null;
+    skillSlug?: string;
+}
+declare class VoiceSessionManager implements VoiceSessionProvider {
+    private state;
+    private listeners;
+    private webView;
+    private pending;
+    /**
+     * WHO owns the one physical session. Set to the caller that started it from
+     * idle (a plugin's pluginId, or the PLATFORM symbol for the built-in sheet),
+     * and kept after stop until the next start reassigns it — so a plugin can read
+     * its own just-ended transcript but another plugin never can.
+     *
+     * ISOLATION (GPT blocker on 8881225): every access is scoped through this. A
+     * different plugin must not read, control, or attach to another plugin's live
+     * conversation just because it declared voice.
+     */
+    private owner;
+    /** The platform (built-in sheet, mic indicator, session host) sees and
+     *  controls any session — it is the user's own surface. A plugin caller may
+     *  only touch a session it owns. */
+    private canAccess;
+    private foreignError;
+    /** The offscreen WebView sets its ref here so the session can inject into it. */
+    setWebView(ref: {
+        injectJavaScript?: (js: string) => void;
+    } | null): void;
+    /** Whole state — the host reads `mounted` + `webViewSource` to decide what to
+     *  render, and every reader derives its snapshot from this. */
+    getInternal(): Readonly<InternalState>;
+    readonly injectedTrackHook = "\n(function() {\n  if (window._adaTrackHookInstalled) return;\n  window._adaTrackHookInstalled = true;\n  window._allAudioTracks = [];\n  window._adaPeerConnections = [];\n\n  function track(t) {\n    if (t && t.kind === 'audio' && window._allAudioTracks.indexOf(t) === -1) {\n      window._allAudioTracks.push(t);\n    }\n  }\n\n  try {\n    if (navigator.mediaDevices && navigator.mediaDevices.getUserMedia) {\n      const origGUM = navigator.mediaDevices.getUserMedia.bind(navigator.mediaDevices);\n      navigator.mediaDevices.getUserMedia = async function(constraints) {\n        const stream = await origGUM(constraints);\n        if (constraints && constraints.audio) {\n          try { stream.getAudioTracks().forEach(track); } catch (e) {}\n        }\n        return stream;\n      };\n    }\n  } catch (e) {}\n\n  try {\n    if (window.RTCPeerConnection) {\n      const origPC = window.RTCPeerConnection;\n      const origAddTrack = origPC.prototype.addTrack;\n      const origAddStream = origPC.prototype.addStream;\n      const origAddTransceiver = origPC.prototype.addTransceiver;\n\n      origPC.prototype.addTrack = function(t) {\n        if (t && t.kind === 'audio') track(t);\n        return origAddTrack.apply(this, arguments);\n      };\n      if (origAddStream) {\n        origPC.prototype.addStream = function(stream) {\n          try { stream.getAudioTracks().forEach(track); } catch (e) {}\n          return origAddStream.apply(this, arguments);\n        };\n      }\n      if (origAddTransceiver) {\n        origPC.prototype.addTransceiver = function(arg) {\n          if (arg && arg.kind === undefined && arg.track && arg.track.kind === 'audio') {\n            track(arg.track);\n          }\n          const tx = origAddTransceiver.apply(this, arguments);\n          try {\n            if (tx && tx.sender && tx.sender.track && tx.sender.track.kind === 'audio') track(tx.sender.track);\n          } catch (e) {}\n          return tx;\n        };\n      }\n    }\n  } catch (e) {}\n\n  window._adaSetMuted = function(muted) {\n    let n = 0;\n    if (Array.isArray(window._allAudioTracks)) {\n      window._allAudioTracks.forEach(function(t) {\n        try { t.enabled = !muted; n++; } catch (e) {}\n      });\n    }\n    return n;\n  };\n})(); true;\n";
+    start(opts?: VoiceStartOptions, caller?: VoiceCaller): Promise<VoiceSnapshot>;
+    stop(caller?: VoiceCaller): void;
+    setMuted(muted: boolean, caller?: VoiceCaller): void;
+    prompt(input: string, caller?: VoiceCaller): void;
+    /**
+     * Stream a silent observation into the live session — tell the model without
+     * asking it to speak. The cheap, high-frequency channel (safe once or twice a
+     * second) behind a future props.voice.observe(); today the host uses it to run
+     * the real-device stream proof (VOICE_RT_STREAM_DEVICE_PROOF) before the gated
+     * plugin API is added. Owner-scoped like every other control.
+     */
+    observe(text: string, caller?: VoiceCaller): void;
+    getSnapshot(caller?: VoiceCaller): VoiceSnapshot;
+    private realSnapshot;
+    private foreignSnapshot;
+    subscribe(cb: (event: VoiceEvent) => void, caller?: VoiceCaller): VoiceSubscription;
+    transcript(caller?: VoiceCaller): TranscriptEntry[];
+    private buildUri;
+    /** Handle a postMessage from the WebView. `event` is the RN WebView event. */
+    handleMessage(event: any): void;
+    /** Answer "what device tools do you have?" — the client is the authority. */
+    private sendDeviceToolList;
+    /** Run a device tool and post the outcome back into the WebView. */
+    private runDeviceTool;
+    private setState;
+    private appendTranscript;
+    private emit;
+    private waitForConnect;
+    private resolvePending;
+    private rejectPending;
+    /** TEST ONLY: reset the singleton to a clean idle state (mirrors the
+     *  __resetSessionSyncForTest precedent). Not part of any surface. */
+    __resetForTest(): void;
 }
-type CallState = 'idle' | 'connecting' | 'connected' | 'error';
+/** The one live session. Handed to setVoiceProvider(voiceSession) at startup. */
+declare const voiceSession: VoiceSessionManager;
+
 declare function useVoiceCall({ skillSlug }?: {
     skillSlug?: string;
 }): {
-    callState: CallState;
+    callState: _ateam_ai_mobile_plugin_runtime.VoiceState;
     sessionId: string | null;
     error: string | null;
-    transcript: TranscriptEntry[];
+    transcript: _ateam_ai_mobile_plugin_runtime.VoiceTranscriptEntry[];
     aiPartial: string;
     userPartial: string;
     muted: boolean;
-    startCall: () => Promise<void>;
+    startCall: (opts?: {
+        skillSlug?: string;
+    }) => Promise<_ateam_ai_mobile_plugin_runtime.VoiceSnapshot>;
     stopCall: () => void;
     toggleMute: () => void;
-    handleWebViewMessage: (event: any) => void;
-    getWebViewSource: () => {
-        uri: string;
-    };
-    webViewRef: react.RefObject<any>;
-    injectedTrackHook: string;
 };
 
+declare function VoiceSessionHost(): react_jsx_runtime.JSX.Element | null;
+
+declare function VoiceMicIndicator({ topInset }: {
+    topInset?: number;
+}): react_jsx_runtime.JSX.Element | null;
+
 /**
  * Host integration points for @ateam-ai-mobile/ui — same DI pattern as
  * @ateam-ai-mobile/plugin-runtime's host.ts. Everything has a safe default; the host
  * (or @ateam-ai-mobile/expo) wires real implementations at startup.
  */
+
+interface OAuthGoogleConfig {
+    webClientId?: string;
+    iosClientId?: string;
+}
+interface OAuthProvider {
+    /** Acquire a Google OIDC id_token. `cfg` present → tenant client ids; absent → host bundled id. Null on user-cancel. */
+    signInWithGoogle(cfg?: OAuthGoogleConfig): Promise<string | null>;
+    /** Acquire an Apple id_token. Null on user-cancel. */
+    signInWithApple(): Promise<string | null>;
+    /** AppleAuthentication.isAvailableAsync() (iOS 13+); resolves false everywhere else. Async so the screen probes in an effect, never renders a stale false. */
+    isAppleAvailable(): Promise<boolean>;
+    /** The real Apple HIG button as a slot — the screen decides WHEN to show it + supplies its layout `style`, the host supplies the native node + HIG chrome. */
+    renderAppleButton(props: {
+        onPress: () => void;
+        disabled: boolean;
+        style?: unknown;
+    }): ReactNode;
+}
+/** Register a native OAuth implementation (e.g. via @ateam-ai-mobile/expo). */
+declare function setOAuthProvider(oauth: OAuthProvider | null): void;
 interface ClipboardProvider {
     setString(text: string): Promise<void>;
 }
@@ -230,4 +534,4 @@ declare function setUIActionNavigator(navigate: UIActionNavigator | null): void;
 type ExtraHostsGetter = () => string[];
 declare function setPluginWebViewExtraHosts(getter: ExtraHostsGetter | null): void;
 
-export { AdasChatScreen, type AdasChatScreenProps, type CallState, ChatInput, type ClipboardProvider, DaySeparator, EmbeddedPluginWebView, JobProgressBar, Lightbox, MessageBubble, Plugin, PluginSurface, TableCardBlock, TenantPicker, type TenantPickerProps, type TranscriptEntry, TypingIndicator, type UIActionRoute, UIActionsRow, VoiceCallSheet, WidgetHost, WidgetWebView, buildPluginBridgeJS, openWidget, setClipboardProvider, setPluginWebViewExtraHosts, setUIActionNavigator, useLightboxStore, usePluginBridge, useVoiceCall, useWidgetHostStore };
+export { AdasChatScreen, type AdasChatScreenProps, type CallState, ChatInput, type ClipboardProvider, DaySeparator, EmbeddedPluginWebView, type HandoffExchangeDeps, HandoffScreen, type HandoffScreenProps, type InviteJoinDeps, JobProgressBar, JoinScreen, type JoinScreenProps, Lightbox, LoginScreen, type LoginScreenProps, MessageBubble, type OAuthGoogleConfig, type OAuthProvider, type OpenJoinDeps, OpenJoinScreen, type OpenJoinScreenProps, Plugin, PluginSurface, type ProviderSignInDeps, TableCardBlock, TenantPicker, type TenantPickerProps, type TranscriptEntry, TypingIndicator, type UIActionRoute, UIActionsRow, VoiceCallSheet, VoiceMicIndicator, VoiceSessionHost, WidgetHost, WidgetWebView, WorkspaceBanner, type WorkspaceBannerProps, buildPluginBridgeJS, completeInviteJoin, completeOpenJoin, completeProviderSignIn, googleClientIds, handoffErrorMessage, inviteHeadline, openJoinErrorMessage, openWidget, runHandoffExchange, setClipboardProvider, setOAuthProvider, setPluginWebViewExtraHosts, setUIActionNavigator, shouldRecoverToDefaultTenant, useLightboxStore, usePluginBridge, useVoiceCall, useWidgetHostStore, voiceSession };