@ateam-ai-mobile/ui 0.1.9 → 0.1.10

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ateam-ai-mobile/ui",
-  "version": "0.1.9",
+  "version": "0.1.10",
   "description": "Prebuilt ADAS chat experience for React Native — full-screen chat, chips, widget views. Built on @ateam-ai-mobile/core + @ateam-ai-mobile/plugin-runtime.",
   "main": "dist/index.js",
   "types": "dist/index.d.ts",
@@ -9,8 +9,8 @@
     "build": "tsup"
   },
   "dependencies": {
-    "@ateam-ai-mobile/core": "0.1.9",
-    "@ateam-ai-mobile/plugin-runtime": "0.1.9",
+    "@ateam-ai-mobile/core": "0.1.10",
+    "@ateam-ai-mobile/plugin-runtime": "0.1.10",
     "zustand": "^5.0.0"
   },
   "peerDependencies": {

package/src/auth/HandoffScreen.tsx

@@ -9,8 +9,6 @@
  *
  * Everything host-specific is injected:
  *   - `code`          the deep-link code (capture + parsing stay host-side)
- *   - `onAdoptTenant` the host's SINGLE tenant writer, AWAITED before onSignedIn
- *                     so ACTIVE_TENANT can't drift on a cross-tenant handoff
  *   - `onSignedIn`    session adoption (host: authStore.login → core session +
  *                     the shell-only tenantConfirmed / phase gate)
  *   - `onDone`        clear the consumed single-use code (host store) after success
@@ -31,12 +29,6 @@ const fontFam = Platform.OS === 'ios' ? 'SF Pro Rounded' : undefined;
 export interface HandoffScreenProps {
   /** The one-time handoff code the host captured from the deep link (null = nothing pending). */
   code: string | null;
-  /**
-   * Adopt the handed-off tenant. AWAITED before onSignedIn so the host's active
-   * tenant is set before the session reads it (the exchange result carries the
-   * tenant the code was bound to). No-op is fine when the result has no tenant.
-   */
-  onAdoptTenant: (tenant: string) => void | Promise<void>;
   /** Adopt the session JWT (host wires its authStore.login → core session + tenantConfirmed). */
   onSignedIn: (jwt: string) => void | Promise<void>;
   /** Clear the consumed single-use code so a relaunch never retries it. Called after success. */
@@ -45,7 +37,7 @@ export interface HandoffScreenProps {
   onCancel: () => void;
 }
 
-export default function HandoffScreen({ code, onAdoptTenant, onSignedIn, onDone, onCancel }: HandoffScreenProps) {
+export default function HandoffScreen({ code, onSignedIn, onDone, onCancel }: HandoffScreenProps) {
   const [err, setErr] = useState<string | null>(null);
   // Exchange each code AT MOST ONCE. A single-use code exchanged twice
   // (StrictMode/fast-refresh double-invoke) burns itself: the first call wins and
@@ -57,9 +49,9 @@ export default function HandoffScreen({ code, onAdoptTenant, onSignedIn, onDone,
   useEffect(() => {
     if (!code || startedForRef.current === code) return;
     startedForRef.current = code;
-    runHandoffExchange(code, { exchange: exchangeHandoff, onAdoptTenant, onSignedIn, onDone })
+    runHandoffExchange(code, { exchange: exchangeHandoff, onSignedIn, onDone })
       .catch((e: any) => setErr(handoffErrorMessage(e?.message)));
-  }, [code, onAdoptTenant, onSignedIn, onDone]);
+  }, [code, onSignedIn, onDone]);
 
   return (
     <View style={styles.container}>

package/src/auth/LoginScreen.tsx

@@ -8,9 +8,12 @@
  * client ids are baked into the SDK.
  *
  * Host-injected seams:
- *   - activeTenant      the reactive pre-auth tenant pick (re-fetches the config)
- *   - defaultTenant     the fallback for the consumer-disabled self-heal guard
- *   - onConsumerDisabled  reset to the default tenant + persist + re-trigger
+ *   - activeTenant      the reactive pre-auth team (re-fetches the config);
+ *                       '' → the screen asks for the team
+ *   - onPickTenant      the user named a team ("Use a different team", or no
+ *                       team yet): the host stores it as its signed-out pick
+ *   - onConsumerDisabled  the team has no consumer sign-in: the host clears its
+ *                       pick; the screen asks for another team
  *   - onSignedIn        session adoption (host: authStore.login)
  *   - onJoinTeam?       open the host's "join a team by name" (OpenJoin) sub-view
  *
@@ -19,20 +22,21 @@
  * to signInWithGoogle. The host wraps this in its own SafeAreaView.
  */
 import { useEffect, useMemo, useState } from 'react';
-import { View, Text, Pressable, StyleSheet, Platform, ActivityIndicator } from 'react-native';
+import { View, Text, Pressable, StyleSheet, Platform, ActivityIndicator, TextInput } from 'react-native';
 import { fetchConsumerConfig, signInWithGoogle, signInWithApple, ada, type ConsumerCapabilityConfig } from '@ateam-ai-mobile/core';
 import { AdaOrb } from '@ateam-ai-mobile/plugin-runtime';
 import { getOAuthProvider } from '../providers';
-import { googleClientIds, shouldRecoverToDefaultTenant, completeProviderSignIn } from './login';
+import { googleClientIds, isConsumerDisabled, completeProviderSignIn } from './login';
 
 const fontFam = Platform.OS === 'ios' ? 'SF Pro Rounded' : undefined;
 
 export interface LoginScreenProps {
-  /** The reactive pre-auth tenant pick (host: useSession().tenant). Re-fetches config on change. */
+  /** The reactive pre-auth team (host: useSession().tenant). Re-fetches config on change.
+   *  '' → the screen asks for the team. */
   activeTenant: string;
-  /** The fallback tenant for the consumer-disabled self-heal guard (host: DEFAULT_TENANT). */
-  defaultTenant: string;
-  /** Reset to the default tenant + persist + bump activeTenant so this screen refetches. */
+  /** The user named a team to sign in to: the host stores it as its signed-out pick. */
+  onPickTenant: (tenant: string) => void | Promise<void>;
+  /** The team has no consumer sign-in: the host clears its pick (the screen asks for another). */
   onConsumerDisabled: () => void | Promise<void>;
   /** Adopt the session JWT (host: authStore.login → core session + tenantConfirmed). */
   onSignedIn: (jwt: string) => void | Promise<void>;
@@ -40,27 +44,37 @@ export interface LoginScreenProps {
   onJoinTeam?: () => void;
 }
 
-export default function LoginScreen({ activeTenant, defaultTenant, onConsumerDisabled, onSignedIn, onJoinTeam }: LoginScreenProps) {
+export default function LoginScreen({ activeTenant, onPickTenant, onConsumerDisabled, onSignedIn, onJoinTeam }: LoginScreenProps) {
   const [config, setConfig] = useState<ConsumerCapabilityConfig | null>(null);
   const [error, setError] = useState<string | null>(null);
+  // The team whose config said "no consumer sign-in", kept across the host
+  // clearing its pick so the ask-for-team view can say why it is back.
+  const [disabledTeam, setDisabledTeam] = useState<string | null>(null);
+  // "Use a different team" — or the current team can't sign in.
+  const [askTeam, setAskTeam] = useState(false);
+  const askingTeam = !activeTenant || askTeam;
+  const pick = async (tenant: string) => { setAskTeam(false); setDisabledTeam(null); await onPickTenant(tenant); };
 
   useEffect(() => {
     setConfig(null);
     setError(null);
+    if (!activeTenant) return;
     fetchConsumerConfig()
       .then(setConfig)
       .catch(async err => {
         const msg = err?.message || 'Failed to load sign-in config';
         // A consumer-disabled tenant 404s with "capability not enabled". Don't
-        // dead-end on red text — the host resets to the default tenant and bumps
-        // activeTenant, which re-runs this effect (the login screen self-heals).
-        if (shouldRecoverToDefaultTenant(msg, activeTenant, defaultTenant)) {
+        // dead-end on red text — ask for another team (and the host clears its
+        // pick). Asking here, not re-fetching, so a disabled fallback can't loop.
+        if (isConsumerDisabled(msg)) {
+          setDisabledTeam(activeTenant);
+          setAskTeam(true);
           await onConsumerDisabled();
           return;
         }
         setError(msg);
       });
-  }, [activeTenant, defaultTenant, onConsumerDisabled]);
+  }, [activeTenant, onConsumerDisabled]);
 
   return (
     <View style={styles.container}>
@@ -71,9 +85,15 @@ export default function LoginScreen({ activeTenant, defaultTenant, onConsumerDis
       </View>
 
       <View style={styles.buttonSection}>
-        {!config && !error && <ActivityIndicator color={ada.ink} />}
-        {!!error && <Text style={styles.errorText}>{error}</Text>}
-        {!!config && <SignInButtons config={config} onSignedIn={onSignedIn} />}
+        {askingTeam && <TeamField notice={disabledTeam} onPick={pick} />}
+        {!askingTeam && !config && !error && <ActivityIndicator color={ada.ink} />}
+        {!askingTeam && !!error && <Text style={styles.errorText}>{error}</Text>}
+        {!askingTeam && !!config && <SignInButtons config={config} onSignedIn={onSignedIn} />}
+        {!askingTeam && (
+          <Pressable onPress={() => setAskTeam(true)} hitSlop={8} style={{ paddingVertical: 4 }}>
+            <Text style={styles.joinLink}>Use a different team</Text>
+          </Pressable>
+        )}
         {onJoinTeam && (
           <Pressable onPress={onJoinTeam} hitSlop={8} style={{ paddingVertical: 8 }}>
             <Text style={styles.joinLink}>Join a team by name</Text>
@@ -85,6 +105,33 @@ export default function LoginScreen({ activeTenant, defaultTenant, onConsumerDis
   );
 }
 
+/** Ask which team to sign in to. Signing in needs the team's own consumer
+ *  config (its client ids). */
+function TeamField({ notice, onPick }: { notice: string | null; onPick: (tenant: string) => void | Promise<void> }) {
+  const [team, setTeam] = useState('');
+  const slug = team.trim().toLowerCase();
+  const submit = () => { if (slug) void onPick(slug); };
+  return (
+    <>
+      {!!notice && <Text style={styles.errorText}>“{notice}” doesn't have app sign-in. Try another team.</Text>}
+      <TextInput
+        style={styles.teamInput}
+        value={team}
+        onChangeText={setTeam}
+        placeholder="your team (e.g. acme)"
+        placeholderTextColor={ada.inkMuted}
+        autoCapitalize="none"
+        autoCorrect={false}
+        returnKeyType="go"
+        onSubmitEditing={submit}
+      />
+      <Pressable style={[styles.signInBtn, !slug && styles.signInBtnDisabled]} onPress={submit} disabled={!slug}>
+        <Text style={styles.signInText}>Continue</Text>
+      </Pressable>
+    </>
+  );
+}
+
 function SignInButtons({ config, onSignedIn }: { config: ConsumerCapabilityConfig; onSignedIn: (jwt: string) => void | Promise<void> }) {
   const [busy, setBusy] = useState(false);
   const [error, setError] = useState<string | null>(null);
@@ -175,6 +222,10 @@ const styles = StyleSheet.create({
   signInGlyph: { fontSize: 18, fontWeight: '700', color: ada.paper, fontFamily: fontFam },
   signInText: { fontSize: 16, fontWeight: '600', color: ada.paper, letterSpacing: -0.2, fontFamily: fontFam },
   appleBtn: { width: '100%', height: 52 },
+  teamInput: {
+    width: '100%', backgroundColor: ada.paperSoft, borderWidth: 1, borderColor: ada.border, borderRadius: 14,
+    paddingHorizontal: 16, paddingVertical: 14, fontSize: 16, color: ada.ink,
+  },
   errorText: { fontSize: 13, color: '#c43d3d', textAlign: 'center', paddingHorizontal: 16 },
   disclaimer: { fontSize: 12, color: ada.inkMuted, textAlign: 'center', marginTop: 8, lineHeight: 18, fontFamily: fontFam },
   joinLink: { fontSize: 14, fontWeight: '600', color: ada.orangeDeep, textAlign: 'center', fontFamily: fontFam },

package/src/auth/OpenJoinScreen.tsx

@@ -9,8 +9,8 @@
  * Native id_token acquisition + the Apple HIG button come from the host-wired
  * OAuthProvider (setOAuthProvider). With no cfg passed to signInWithGoogle, the
  * provider uses the host's BUNDLED Google client id (this screen carries no
- * tenant config). Everything host-specific — session, the single ACTIVE_TENANT
- * writer, the back transition, the SafeAreaView — is injected.
+ * tenant config). Everything host-specific — session, the back transition, the
+ * SafeAreaView — is injected. The joined tenant is the JWT's own claim.
  */
 import { useEffect, useState } from 'react';
 import { View, Text, Pressable, StyleSheet, ActivityIndicator, Platform, TextInput } from 'react-native';
@@ -22,15 +22,13 @@ import { completeOpenJoin, openJoinErrorMessage } from './openJoin';
 const fontFam = Platform.OS === 'ios' ? 'SF Pro Rounded' : undefined;
 
 export interface OpenJoinScreenProps {
-  /** Adopt the joined tenant (host's single ACTIVE_TENANT writer), awaited before sign-in. */
-  onAdoptTenant: (tenant: string) => void | Promise<void>;
   /** Adopt the session JWT (host: authStore.login → core session + tenantConfirmed). */
   onSignedIn: (jwt: string) => void | Promise<void>;
   /** Back to sign in — the host toggles the pre-auth phase (not a router). */
   onBack: () => void;
 }
 
-export default function OpenJoinScreen({ onAdoptTenant, onSignedIn, onBack }: OpenJoinScreenProps) {
+export default function OpenJoinScreen({ onSignedIn, onBack }: OpenJoinScreenProps) {
   const [team, setTeam] = useState('');
   const [busy, setBusy] = useState(false);
   const [err, setErr] = useState<string | null>(null);
@@ -54,7 +52,7 @@ export default function OpenJoinScreen({ onAdoptTenant, onSignedIn, onBack }: Op
     setErr(null); setBusy(true);
     try {
       const idToken = await acquire(oauth);
-      await completeOpenJoin(slug, idToken, { join, onAdoptTenant, onSignedIn });
+      await completeOpenJoin(slug, idToken, { join, onSignedIn });
     } catch (e: any) {
       setErr(openJoinErrorMessage(e?.message));
     } finally {

package/src/auth/handoffExchange.ts

@@ -2,7 +2,7 @@
  * Handoff exchange — the pure, testable half of HandoffScreen (R9B).
  *
  * Kept JSX-free in its own module (like R6's runLogoutTeardown) so the
- * security-sensitive error mapper and the adopt-before-sign-in ORDERING can be
+ * security-sensitive error mapper and the sign-in-before-clear ORDERING can be
  * node-tested directly, without rendering the RN component.
  */
 import type { HandoffExchangeResult } from '@ateam-ai-mobile/core';
@@ -10,8 +10,6 @@ import type { HandoffExchangeResult } from '@ateam-ai-mobile/core';
 export interface HandoffExchangeDeps {
   /** Trade the one-time code for a session JWT (host injects core.exchangeHandoff). */
   exchange: (code: string) => Promise<HandoffExchangeResult>;
-  /** Adopt the handed-off tenant (host's single tenant writer). */
-  onAdoptTenant: (tenant: string) => void | Promise<void>;
   /** Adopt the session JWT. */
   onSignedIn: (jwt: string) => void | Promise<void>;
   /** Clear the consumed single-use code. */
@@ -19,15 +17,14 @@ export interface HandoffExchangeDeps {
 }
 
 /**
- * Run the handoff: exchange → (adopt tenant) → sign in → clear the code, in that
- * exact order. The tenant adoption is AWAITED BEFORE onSignedIn so the host's
- * active tenant is set before the session reads it — a cross-tenant handoff must
- * never sign in under the wrong tenant. Throws on any failure (the caller maps it
- * to a user-facing message); onSignedIn / onDone never run on the error path.
+ * Run the handoff: exchange → sign in → clear the code, in that exact order. The
+ * handed-off tenant is the JWT's own `tenant` claim (getTenant() reads it), so a
+ * cross-tenant handoff is scoped correctly with nothing for the host to store.
+ * Throws on any failure (the caller maps it to a user-facing message);
+ * onSignedIn / onDone never run on the error path.
  */
 export async function runHandoffExchange(code: string, deps: HandoffExchangeDeps): Promise<void> {
   const res = await deps.exchange(code);
-  if (res.tenant) await deps.onAdoptTenant(res.tenant);
   await deps.onSignedIn(res.jwt);
   deps.onDone();
 }

package/src/auth/login.ts

@@ -21,17 +21,12 @@ export function googleClientIds(config: ConsumerCapabilityConfig): { webClientId
 }
 
 /**
- * Whether a failed config fetch should self-heal by falling back to the default
- * tenant. A consumer-DISABLED tenant 404s with "capability not enabled"; rather
- * than dead-end the user on red text we coerce back to the default and refetch.
- * Guarded by currentTenant !== defaultTenant so we never loop on the default.
+ * Whether a failed config fetch means the picked tenant has no consumer sign-in
+ * ("capability not enabled" 404). The host then clears its pick and shows its
+ * team picker — it never falls back to a default tenant.
  */
-export function shouldRecoverToDefaultTenant(
-  errorMsg: string | undefined,
-  currentTenant: string,
-  defaultTenant: string,
-): boolean {
-  return /capability not enabled/i.test(errorMsg || '') && currentTenant !== defaultTenant;
+export function isConsumerDisabled(errorMsg: string | undefined): boolean {
+  return /capability not enabled/i.test(errorMsg || '');
 }
 
 export interface ProviderSignInDeps {

package/src/auth/openJoin.ts

@@ -1,7 +1,7 @@
 /**
  * Open self-signup — the pure, testable half of OpenJoinScreen (R9B).
  *
- * JSX-free so the join ORDERING (join → adopt tenant → sign in) and the error
+ * JSX-free so the join ORDERING (join → sign in) and the error
  * mapper are node-testable without rendering. The native id_token acquisition
  * happens in the component via getOAuthProvider(); the acquired token is passed
  * in here, so this module stays pure and provider-free.
@@ -11,8 +11,6 @@ import type { ConsumerSignInResult } from '@ateam-ai-mobile/core';
 export interface OpenJoinDeps {
   /** Exchange { tenant, id_token } for a session JWT (host injects core.openJoinWith*). */
   join: (slug: string, idToken: string) => Promise<ConsumerSignInResult>;
-  /** Adopt the joined tenant (host's single ACTIVE_TENANT writer). */
-  onAdoptTenant: (tenant: string) => void | Promise<void>;
   /** Adopt the session JWT. */
   onSignedIn: (jwt: string) => void | Promise<void>;
 }
@@ -22,10 +20,10 @@ export interface OpenJoinDeps {
  *
  * Returns false WITHOUT side effects when idToken is null — the caller acquired
  * no token (the user cancelled the native sheet, or it returned none), which is
- * a silent no-op, never an error. Otherwise: join → adopt the joined tenant →
- * sign in, in that order (the tenant is adopted only AFTER the server confirms
- * the join, and BEFORE sign-in so the session reads the right tenant). Throws on
- * a join failure (the caller maps it to a message); sign-in never runs then.
+ * a silent no-op, never an error. Otherwise: join → sign in. The joined tenant
+ * is the returned JWT's own `tenant` claim (getTenant() reads it), so there is
+ * nothing for the host to store. Throws on a join failure (the caller maps it to
+ * a message); sign-in never runs then.
  */
 export async function completeOpenJoin(
   slug: string,
@@ -34,7 +32,6 @@ export async function completeOpenJoin(
 ): Promise<boolean> {
   if (!idToken) return false;
   const consumer = await deps.join(slug, idToken);
-  await deps.onAdoptTenant(slug);
   await deps.onSignedIn(consumer.jwt);
   return true;
 }

package/src/index.ts

@@ -60,7 +60,7 @@ export { completeInviteJoin, inviteHeadline } from './auth/inviteJoin';
 export type { InviteJoinDeps } from './auth/inviteJoin';
 export { default as LoginScreen } from './auth/LoginScreen';
 export type { LoginScreenProps } from './auth/LoginScreen';
-export { googleClientIds, shouldRecoverToDefaultTenant, completeProviderSignIn } from './auth/login';
+export { googleClientIds, isConsumerDisabled, completeProviderSignIn } from './auth/login';
 export type { ProviderSignInDeps } from './auth/login';
 
 // Voice (requires `voiceUrl` in the initAdas() config)

package/src/plugin/EmbeddedPluginWebView.tsx

@@ -1,4 +1,4 @@
-import { useState, useMemo, useCallback } from 'react';
+import { useState, useMemo, useCallback, useEffect } from 'react';
 import { View, Text, ActivityIndicator, StyleSheet, Platform } from 'react-native';
 import { WebView } from 'react-native-webview';
 import { getConfig, getCoreApiUrl, getVoiceApiUrl, getTenant, getToken, ada } from '@ateam-ai-mobile/core';
@@ -28,6 +28,9 @@ export default function EmbeddedPluginWebView({ pluginId, manifest, commandBuffe
   const { webViewRef, sendInit, handleMessage } = usePluginBridge(pluginId, manifest._connectorId, commandBufferRef);
 
   const url = resolvePluginUrl(manifest, tenant || undefined);
+  // An error belongs to the URL that produced it: a new URL (a fresh signature,
+  // a corrected tenant) gets a fresh load instead of the old error forever.
+  useEffect(() => { setError(null); }, [url]);
   const bridgeJS = buildPluginBridgeJS(token || '', tenant || '');
 
   // Hosts the plugin may navigate to — derived from the SDK config plus any