@ateam-ai-mobile/ui 0.1.7 → 0.1.9

package/dist/index.d.mts

@@ -3,7 +3,7 @@ import { Message, JobProgress, UIAction, AdasSession, TenantMembership, HandoffE
 import * as React$1 from 'react';
 import React__default, { ReactNode } from 'react';
 import * as _ateam_ai_mobile_plugin_runtime from '@ateam-ai-mobile/plugin-runtime';
-import { PluginSurfaceMeta, PlatformPluginManifest, VoiceState, VoiceTranscriptEntry, VoiceSessionProvider, VoiceStartOptions, VoiceCaller, VoiceSnapshot, VoiceEvent, VoiceSubscription } from '@ateam-ai-mobile/plugin-runtime';
+import { PluginSurfaceMeta, PlatformPluginManifest, VoiceState, VoiceTranscriptEntry, VoiceSessionProvider, VoiceDeviceToolCall, VoicePersona, VoiceStartOptions, VoiceCaller, VoiceSnapshot, VoiceEvent, VoiceSubscription } from '@ateam-ai-mobile/plugin-runtime';
 import * as zustand from 'zustand';
 
 interface AdasChatScreenProps {
@@ -382,6 +382,13 @@ declare function VoiceCallSheet({ visible, onClose, skillSlug }: Props): react_j
 
 type CallState = VoiceState;
 type TranscriptEntry = VoiceTranscriptEntry;
+/** A finished call, tagged with the session owner's pluginId when the tool is
+ *  that plugin's own; null when it is not (another solution's tool, the
+ *  platform's, an unregistered name, no name) — then only the platform sees it. */
+interface DeviceToolRecord {
+    owner: string | null;
+    call: VoiceDeviceToolCall;
+}
 interface InternalState {
     callState: CallState;
     sessionId: string | null;
@@ -394,6 +401,11 @@ interface InternalState {
     userSpeaking: boolean;
     /** Epoch ms of the last speaking:false, or null before the first utterance. */
     lastUserSpeechEndedAt: number | null;
+    /** This session's finished device-tool calls: the LATEST per owner tag (see
+     *  DeviceToolRecord), in the order they finished. The platform reads the last
+     *  one; the owning plugin reads its own (lastDeviceToolFor) — one store, both
+     *  views derived from it. */
+    deviceToolCalls: DeviceToolRecord[];
     /** The WebView should be mounted (a session is wanted / live). */
     mounted: boolean;
     /** The WebView source, computed ONCE at start() so state changes (transcript,
@@ -402,6 +414,9 @@ interface InternalState {
         uri: string;
     } | null;
     skillSlug?: string;
+    /** Per-call persona override ({ name, style }) — sent to the voice page on the
+     *  session URL and declared on POST /session; the server layers it. */
+    persona?: VoicePersona;
 }
 declare class VoiceSessionManager implements VoiceSessionProvider {
     private state;
@@ -419,6 +434,45 @@ declare class VoiceSessionManager implements VoiceSessionProvider {
      * conversation just because it declared voice.
      */
     private owner;
+    /** EVERY start() still in its pre-mount awaits (tool preload, token refresh).
+     *  The session is not 'connecting' yet, so a stop() arriving now would otherwise
+     *  be an idle no-op — and a start would then mount a call for a screen that has
+     *  already gone. A set, not one slot: two concurrent starts must BOTH be
+     *  cancellable. stop() cancels every pending start of its caller (the platform:
+     *  all of them); another plugin's stop cancels none. */
+    private pendingStarts;
+    /**
+     * The device-tool names Core ALLOWED for this voice session — Core's sanitized
+     * allowset, delivered to the phone in a `deviceToolAllowset` message.
+     * Authorization gates against THIS (necessary, alongside the registry's can-do).
+     *
+     * WHY (GPT gate 1, corrected): the phone only PROPOSES its available tools
+     * (sendDeviceToolList); CORE is the session authority and decides which are
+     * accepted (session.device_tools). Freezing the phone's own proposal would let
+     * a tool Core REJECTED still run locally. So the authz set is populated from
+     * Core's accepted set, never from listDeviceTools(). Until Core's set arrives
+     * this is null and every call FAILS CLOSED. Pinned once per session; the live
+     * registry (which drifts via lazy loads / host registration / tenant changes)
+     * never feeds it.
+     */
+    private frozenTools;
+    /** The voice `sessionId` the current allowset is BOUND to. Authorization
+     *  requires it to equal the active session's id (state.sessionId), so a stale
+     *  allowset from a previous/other session is refused. */
+    private frozenSessionId;
+    /** A CLEAN call (skills:'none') started by a plugin offers and runs ONLY that
+     *  plugin's own device tools — not other solutions' tools that happen to be
+     *  registered on the same phone. null = every registered tool (a normal call,
+     *  or the platform's). Set by every start(); like `owner`, kept after stop.
+     *  ONE identity: the caller is the TRUSTED manifest pluginId gateVoice stamps,
+     *  and the bundleManager registers a plugin's tools under that same id (never
+     *  the bundle's own short `id`), so exact equality is the whole check. */
+    private toolScope;
+    /** Bumped whenever a session begins or ends. A device-tool call remembers the
+     *  epoch it arrived in, and its outcome is recorded only if that session is
+     *  still the current one — a tool that finishes after hang-up (or after a new
+     *  call started) must not show up as the new session's last call. */
+    private sessionEpoch;
     /** The platform (built-in sheet, mic indicator, session host) sees and
      *  controls any session — it is the user's own surface. A plugin caller may
      *  only touch a session it owns. */
@@ -438,23 +492,57 @@ declare class VoiceSessionManager implements VoiceSessionProvider {
     prompt(input: string, caller?: VoiceCaller): void;
     /**
      * Stream a silent observation into the live session — tell the model without
-     * asking it to speak. The cheap, high-frequency channel (safe once or twice a
-     * second) behind a future props.voice.observe(); today the host uses it to run
-     * the real-device stream proof (VOICE_RT_STREAM_DEVICE_PROOF) before the gated
-     * plugin API is added. Owner-scoped like every other control.
+     * asking it to speak. The cheap channel behind the gated props.voice.observe();
+     * every item stays in the model's context for the call, so a caller sends only
+     * material changes. Owner-scoped like every other control.
      */
     observe(text: string, caller?: VoiceCaller): void;
     getSnapshot(caller?: VoiceCaller): VoiceSnapshot;
+    /** The snapshot for a caller that may access the session. Everything is the
+     *  session's, except `lastDeviceTool`, which is scoped to the caller's tools. */
     private realSnapshot;
+    /**
+     * The last finished device-tool call THIS caller may see. The platform (the
+     * user's own surface) sees every call. A plugin sees only calls to tools it
+     * registered — even on a session it owns, the model can call another
+     * solution's tool (a normal call offers every registered tool), and that
+     * tool's name and error are not this plugin's to read.
+     */
+    private lastDeviceToolFor;
     private foreignSnapshot;
     subscribe(cb: (event: VoiceEvent) => void, caller?: VoiceCaller): VoiceSubscription;
     transcript(caller?: VoiceCaller): TranscriptEntry[];
     private buildUri;
     /** Handle a postMessage from the WebView. `event` is the RN WebView event. */
     handleMessage(event: any): void;
-    /** Answer "what device tools do you have?" — the client is the authority. */
+    /**
+     * One device-tool call, arrival to outcome: validate → authorize → run. The
+     * answer goes back to the mini-app (the model reads it) AND becomes
+     * `lastDeviceTool` — the same object, recorded only once it is known, so a
+     * refused call never looks like one that ran.
+     */
+    private handleDeviceToolCall;
+    /**
+     * Final authorization = Core's frozen allowset ∩ the current valid local
+     * registry, bound to the ACTIVE session. All must hold:
+     *  - a Core allowset arrived and is bound to THIS session (frozenSessionId ===
+     *    the active state.sessionId) — a missing or stale/wrong-session allowset
+     *    fails closed;
+     *  - the tool is IN that allowset (Core approved it); AND
+     *  - the tool is STILL registered locally right now (removed-after-approval is
+     *    refused; a lazily-added tool Core never approved is refused) — and, on a
+     *    clean call, registered by the call's owner.
+     * No fallback to the live registry alone, ever.
+     */
+    private isToolAuthorized;
+    /** Answer the mini-app's pending device-tool request (a call's outcome, or the
+     *  tool list) — it resolves the request with this payload by correlationId. */
+    private postDeviceToolResult;
+    /** PROPOSE the phone's available tools — this is an offer to Core, not the
+     *  authorization set. Core sanitizes it and returns the accepted set in a
+     *  `deviceToolAllowset` message, which is what actually gates execution. */
     private sendDeviceToolList;
-    /** Run a device tool and post the outcome back into the WebView. */
+    /** Run an authorized device tool. Never throws: every failure is an answer. */
     private runDeviceTool;
     private setState;
     private appendTranscript;

package/dist/index.d.ts

@@ -3,7 +3,7 @@ import { Message, JobProgress, UIAction, AdasSession, TenantMembership, HandoffE
 import * as React$1 from 'react';
 import React__default, { ReactNode } from 'react';
 import * as _ateam_ai_mobile_plugin_runtime from '@ateam-ai-mobile/plugin-runtime';
-import { PluginSurfaceMeta, PlatformPluginManifest, VoiceState, VoiceTranscriptEntry, VoiceSessionProvider, VoiceStartOptions, VoiceCaller, VoiceSnapshot, VoiceEvent, VoiceSubscription } from '@ateam-ai-mobile/plugin-runtime';
+import { PluginSurfaceMeta, PlatformPluginManifest, VoiceState, VoiceTranscriptEntry, VoiceSessionProvider, VoiceDeviceToolCall, VoicePersona, VoiceStartOptions, VoiceCaller, VoiceSnapshot, VoiceEvent, VoiceSubscription } from '@ateam-ai-mobile/plugin-runtime';
 import * as zustand from 'zustand';
 
 interface AdasChatScreenProps {
@@ -382,6 +382,13 @@ declare function VoiceCallSheet({ visible, onClose, skillSlug }: Props): react_j
 
 type CallState = VoiceState;
 type TranscriptEntry = VoiceTranscriptEntry;
+/** A finished call, tagged with the session owner's pluginId when the tool is
+ *  that plugin's own; null when it is not (another solution's tool, the
+ *  platform's, an unregistered name, no name) — then only the platform sees it. */
+interface DeviceToolRecord {
+    owner: string | null;
+    call: VoiceDeviceToolCall;
+}
 interface InternalState {
     callState: CallState;
     sessionId: string | null;
@@ -394,6 +401,11 @@ interface InternalState {
     userSpeaking: boolean;
     /** Epoch ms of the last speaking:false, or null before the first utterance. */
     lastUserSpeechEndedAt: number | null;
+    /** This session's finished device-tool calls: the LATEST per owner tag (see
+     *  DeviceToolRecord), in the order they finished. The platform reads the last
+     *  one; the owning plugin reads its own (lastDeviceToolFor) — one store, both
+     *  views derived from it. */
+    deviceToolCalls: DeviceToolRecord[];
     /** The WebView should be mounted (a session is wanted / live). */
     mounted: boolean;
     /** The WebView source, computed ONCE at start() so state changes (transcript,
@@ -402,6 +414,9 @@ interface InternalState {
         uri: string;
     } | null;
     skillSlug?: string;
+    /** Per-call persona override ({ name, style }) — sent to the voice page on the
+     *  session URL and declared on POST /session; the server layers it. */
+    persona?: VoicePersona;
 }
 declare class VoiceSessionManager implements VoiceSessionProvider {
     private state;
@@ -419,6 +434,45 @@ declare class VoiceSessionManager implements VoiceSessionProvider {
      * conversation just because it declared voice.
      */
     private owner;
+    /** EVERY start() still in its pre-mount awaits (tool preload, token refresh).
+     *  The session is not 'connecting' yet, so a stop() arriving now would otherwise
+     *  be an idle no-op — and a start would then mount a call for a screen that has
+     *  already gone. A set, not one slot: two concurrent starts must BOTH be
+     *  cancellable. stop() cancels every pending start of its caller (the platform:
+     *  all of them); another plugin's stop cancels none. */
+    private pendingStarts;
+    /**
+     * The device-tool names Core ALLOWED for this voice session — Core's sanitized
+     * allowset, delivered to the phone in a `deviceToolAllowset` message.
+     * Authorization gates against THIS (necessary, alongside the registry's can-do).
+     *
+     * WHY (GPT gate 1, corrected): the phone only PROPOSES its available tools
+     * (sendDeviceToolList); CORE is the session authority and decides which are
+     * accepted (session.device_tools). Freezing the phone's own proposal would let
+     * a tool Core REJECTED still run locally. So the authz set is populated from
+     * Core's accepted set, never from listDeviceTools(). Until Core's set arrives
+     * this is null and every call FAILS CLOSED. Pinned once per session; the live
+     * registry (which drifts via lazy loads / host registration / tenant changes)
+     * never feeds it.
+     */
+    private frozenTools;
+    /** The voice `sessionId` the current allowset is BOUND to. Authorization
+     *  requires it to equal the active session's id (state.sessionId), so a stale
+     *  allowset from a previous/other session is refused. */
+    private frozenSessionId;
+    /** A CLEAN call (skills:'none') started by a plugin offers and runs ONLY that
+     *  plugin's own device tools — not other solutions' tools that happen to be
+     *  registered on the same phone. null = every registered tool (a normal call,
+     *  or the platform's). Set by every start(); like `owner`, kept after stop.
+     *  ONE identity: the caller is the TRUSTED manifest pluginId gateVoice stamps,
+     *  and the bundleManager registers a plugin's tools under that same id (never
+     *  the bundle's own short `id`), so exact equality is the whole check. */
+    private toolScope;
+    /** Bumped whenever a session begins or ends. A device-tool call remembers the
+     *  epoch it arrived in, and its outcome is recorded only if that session is
+     *  still the current one — a tool that finishes after hang-up (or after a new
+     *  call started) must not show up as the new session's last call. */
+    private sessionEpoch;
     /** The platform (built-in sheet, mic indicator, session host) sees and
      *  controls any session — it is the user's own surface. A plugin caller may
      *  only touch a session it owns. */
@@ -438,23 +492,57 @@ declare class VoiceSessionManager implements VoiceSessionProvider {
     prompt(input: string, caller?: VoiceCaller): void;
     /**
      * Stream a silent observation into the live session — tell the model without
-     * asking it to speak. The cheap, high-frequency channel (safe once or twice a
-     * second) behind a future props.voice.observe(); today the host uses it to run
-     * the real-device stream proof (VOICE_RT_STREAM_DEVICE_PROOF) before the gated
-     * plugin API is added. Owner-scoped like every other control.
+     * asking it to speak. The cheap channel behind the gated props.voice.observe();
+     * every item stays in the model's context for the call, so a caller sends only
+     * material changes. Owner-scoped like every other control.
      */
     observe(text: string, caller?: VoiceCaller): void;
     getSnapshot(caller?: VoiceCaller): VoiceSnapshot;
+    /** The snapshot for a caller that may access the session. Everything is the
+     *  session's, except `lastDeviceTool`, which is scoped to the caller's tools. */
     private realSnapshot;
+    /**
+     * The last finished device-tool call THIS caller may see. The platform (the
+     * user's own surface) sees every call. A plugin sees only calls to tools it
+     * registered — even on a session it owns, the model can call another
+     * solution's tool (a normal call offers every registered tool), and that
+     * tool's name and error are not this plugin's to read.
+     */
+    private lastDeviceToolFor;
     private foreignSnapshot;
     subscribe(cb: (event: VoiceEvent) => void, caller?: VoiceCaller): VoiceSubscription;
     transcript(caller?: VoiceCaller): TranscriptEntry[];
     private buildUri;
     /** Handle a postMessage from the WebView. `event` is the RN WebView event. */
     handleMessage(event: any): void;
-    /** Answer "what device tools do you have?" — the client is the authority. */
+    /**
+     * One device-tool call, arrival to outcome: validate → authorize → run. The
+     * answer goes back to the mini-app (the model reads it) AND becomes
+     * `lastDeviceTool` — the same object, recorded only once it is known, so a
+     * refused call never looks like one that ran.
+     */
+    private handleDeviceToolCall;
+    /**
+     * Final authorization = Core's frozen allowset ∩ the current valid local
+     * registry, bound to the ACTIVE session. All must hold:
+     *  - a Core allowset arrived and is bound to THIS session (frozenSessionId ===
+     *    the active state.sessionId) — a missing or stale/wrong-session allowset
+     *    fails closed;
+     *  - the tool is IN that allowset (Core approved it); AND
+     *  - the tool is STILL registered locally right now (removed-after-approval is
+     *    refused; a lazily-added tool Core never approved is refused) — and, on a
+     *    clean call, registered by the call's owner.
+     * No fallback to the live registry alone, ever.
+     */
+    private isToolAuthorized;
+    /** Answer the mini-app's pending device-tool request (a call's outcome, or the
+     *  tool list) — it resolves the request with this payload by correlationId. */
+    private postDeviceToolResult;
+    /** PROPOSE the phone's available tools — this is an offer to Core, not the
+     *  authorization set. Core sanitizes it and returns the accepted set in a
+     *  `deviceToolAllowset` message, which is what actually gates execution. */
     private sendDeviceToolList;
-    /** Run a device tool and post the outcome back into the WebView. */
+    /** Run an authorized device tool. Never throws: every failure is an answer. */
     private runDeviceTool;
     private setState;
     private appendTranscript;