@datalayer/agent-runtimes 1.5.26 → 1.5.28

package/lib/apps/apps/AppKept.js

@@ -4,6 +4,7 @@ import { contribution, definePlugin, signal } from '@datalayer/reactor';
 import { useContributions, useSignalValue } from '@datalayer/reactor/react';
 import { LoopChatTurn, LoopPromptPanel } from '../core';
 import { beforeFirstMessage } from './kept';
+import { ASSISTANT_CLEARANCE_VAR } from '../../chat/assistant/clearance';
 export const APP_KEPT_PLUGIN_NAME = '@datalayer/loop-plugin-app-kept';
 /* A signal to read when no chat contributed a turn: the hook needs one. */
 const NO_TURN = signal({ id: 0, status: 'idle' });
@@ -13,7 +14,10 @@ export function AppKept({ says }) {
     if (!beforeFirstMessage(turn)) {
         return null;
     }
-    return (_jsx("div", { role: "note", style: { padding: '4px 8px' }, children: _jsx(Text, { sx: { fontSize: 0, color: 'fg.muted' }, children: says }) }));
+    return (
+    // Clear of the floating assistant in its corner, at a phone's width too
+    // (REVIEWS Q-08).
+    _jsx("div", { role: "note", style: { padding: `4px var(${ASSISTANT_CLEARANCE_VAR}, 8px) 4px 8px` }, children: _jsx(Text, { sx: { fontSize: 0, color: 'fg.muted' }, children: says }) }));
 }
 /**
  * The plugin, for one application: what it keeps, under its prompt. Made

package/lib/apps/embed/element.js

@@ -70,7 +70,7 @@ import { parseAppspec } from '../apps/appspec';
 import { readAppspecYaml } from '../apps/yaml';
 import { AppEmbed, embedAssistantCharacter } from './AppEmbed';
 import { WINDOW_NOT_YET } from './embedSession';
-import { EMBED_HOST_VARIABLES, EMBED_OBSERVED_ATTRIBUTES, EMBED_TAG, EmbedAttributeError, adoptPropertiesSetEarly, embedLookOf, inlineHeightOf, languageOf, resumeOf, runnable, } from './embedConfig';
+import { EMBED_HOST_VARIABLES, EMBED_OBSERVED_ATTRIBUTES, EMBED_TAG, EMBED_TOKEN_NAMES_NO_DEPLOYMENT, EmbedAttributeError, adoptPropertiesSetEarly, embedLookOf, embedTokenDeployment, inlineHeightOf, languageOf, resumeOf, runnable, } from './embedConfig';
 import { embedShadowCss } from './embedTheme';
 import { DEFAULT_API, readVisitorApp } from './visitorApp';
 export { runnable };
@@ -164,9 +164,15 @@ export async function readEmbeddedApp({ api, origin, app, token, fetcher = fetch
         return { kind: 'frame', src: frameSrcOf(origin, app, token) };
     }
     const spec = runnable(parseAppspec(definition.spec));
-    return spec.kind === 'decision'
-        ? { kind: 'frame', src: frameSrcOf(origin, app, token) }
-        : { kind: 'spec', app: spec };
+    if (spec.kind === 'decision') {
+        return { kind: 'frame', src: frameSrcOf(origin, app, token) };
+    }
+    // The visit runs the deployment its token names, and no other (VOICE.md
+    // decision 16): a token naming none is refused before anything is drawn.
+    if (!embedTokenDeployment(token)) {
+        return { kind: 'said', text: EMBED_TOKEN_NAMES_NO_DEPLOYMENT };
+    }
+    return { kind: 'spec', app: spec };
 }
 /** The script that is running, when it is a script tag. */
 function currentScriptUrl() {

package/lib/apps/embed/embedConfig.d.ts

@@ -25,7 +25,7 @@ export declare const EMBED_STYLESHEET_PATH = "/embed/datalayer-app.css";
 export declare const EMBED_ATTRIBUTES: {
     readonly app: "The application’s id on Datalayer.";
     readonly origin: "Where Datalayer is; the origin the script was loaded from by default.";
-    readonly token: "An embed token for an application that is not public, issued to your server for each visit.";
+    readonly token: "An embed token for an application that is not public, issued to your server for each visit; it names the embedded deployment the visit runs, which nothing else on the page names.";
     readonly spec: "The address of an Appspec (YAML or JSON) to run, in place of `app`.";
     readonly mode: "inline, bubble, panel or assistant; the Appspec’s `deployment.embedded.mode` by default, then inline.";
     readonly accent: "green, rose, sky, lime, sun or violet; the Appspec’s `interface.accent` by default, else the theme’s own colours.";
@@ -39,6 +39,15 @@ export declare const EMBED_ATTRIBUTES: {
     readonly 'user-token': "A token your server signed with the deployment’s secret, naming your user (HS256: sub, name, exp at most an hour away): what an application that says user: signed opens its session with.";
 };
 export type EmbedAttribute = keyof typeof EMBED_ATTRIBUTES;
+/**
+ * The deployment an embed token names (VOICE.md decision 16): the embedded
+ * deployment its owner's server asked it for. Read without vouching for it —
+ * the services that take the token verify it — and the only place the
+ * element learns its deployment: it takes no attribute for one.
+ */
+export declare function embedTokenDeployment(token: string): string | undefined;
+/** What an embed token naming no deployment is told (VOICE.md decision 16). */
+export declare const EMBED_TOKEN_NAMES_NO_DEPLOYMENT = "datalayer-app: the embed token names no deployment. Your server asks for one naming the application\u2019s embedded deployment: POST \u2026/api/spacer/v1/apps/<id>/embed-token with {\"deployment\": \"<its uid>\"}.";
 /** Every attribute the element watches. */
 export declare const EMBED_OBSERVED_ATTRIBUTES: EmbedAttribute[];
 /**

package/lib/apps/embed/embedConfig.js

@@ -16,7 +16,7 @@ export const EMBED_STYLESHEET_PATH = '/embed/datalayer-app.css';
 export const EMBED_ATTRIBUTES = {
     app: 'The application’s id on Datalayer.',
     origin: 'Where Datalayer is; the origin the script was loaded from by default.',
-    token: 'An embed token for an application that is not public, issued to your server for each visit.',
+    token: 'An embed token for an application that is not public, issued to your server for each visit; it names the embedded deployment the visit runs, which nothing else on the page names.',
     spec: 'The address of an Appspec (YAML or JSON) to run, in place of `app`.',
     mode: 'inline, bubble, panel or assistant; the Appspec’s `deployment.embedded.mode` by default, then inline.',
     accent: 'green, rose, sky, lime, sun or violet; the Appspec’s `interface.accent` by default, else the theme’s own colours.',
@@ -29,6 +29,30 @@ export const EMBED_ATTRIBUTES = {
     language: 'The language the visitor reads the application in, as BCP 47 tags it (fr, pt-BR): its translation into it, and the chat’s own words; the visitor’s browser’s by default.',
     'user-token': 'A token your server signed with the deployment’s secret, naming your user (HS256: sub, name, exp at most an hour away): what an application that says user: signed opens its session with.',
 };
+/**
+ * The deployment an embed token names (VOICE.md decision 16): the embedded
+ * deployment its owner's server asked it for. Read without vouching for it —
+ * the services that take the token verify it — and the only place the
+ * element learns its deployment: it takes no attribute for one.
+ */
+export function embedTokenDeployment(token) {
+    const payload = token.split('.')[1];
+    if (!payload) {
+        return undefined;
+    }
+    try {
+        const base64 = payload.replace(/-/g, '+').replace(/_/g, '/');
+        const claims = JSON.parse(atob(base64.padEnd(base64.length + ((4 - (base64.length % 4)) % 4), '=')));
+        return typeof claims.deployment_uid === 'string' && claims.deployment_uid
+            ? claims.deployment_uid
+            : undefined;
+    }
+    catch {
+        return undefined;
+    }
+}
+/** What an embed token naming no deployment is told (VOICE.md decision 16). */
+export const EMBED_TOKEN_NAMES_NO_DEPLOYMENT = 'datalayer-app: the embed token names no deployment. Your server asks for one naming the application’s embedded deployment: POST …/api/spacer/v1/apps/<id>/embed-token with {"deployment": "<its uid>"}.';
 /** Every attribute the element watches. */
 export const EMBED_OBSERVED_ATTRIBUTES = Object.keys(EMBED_ATTRIBUTES);
 /**

package/lib/apps/plugins/chat/ChatView.js

@@ -1321,9 +1321,9 @@ export default function ChatView({ workspace }) {
     /*
      * Its voice asked of the speech service as this chat speaks to its runtime
      * (VOICE.md VO-37, VO-19): the host's token, else this one — a visitor's,
-     * an embed's or the person's — and the deployment it runs.
+     * an embed's or the person's; an embed's names its deployment (decision 16).
      */
-    const askedVoice = useMemo(() => voiceAskedAs(config?.voice, iamToken || undefined, deploymentUid), [config?.voice, iamToken, deploymentUid]);
+    const askedVoice = useMemo(() => voiceAskedAs(config?.voice, iamToken || undefined), [config?.voice, iamToken]);
     /*
      * A deployment's runtime, and the visitors', answer only the application's
      * own routes (OwnRoutesOnly, PAP_DATALAYER's release gates): its chat calls

package/lib/chat/assistant/AssistantStage.js

@@ -7,6 +7,7 @@ import { Dialog, Text } from '@primer/react';
 import { assistantCharacter } from './characters';
 import { BalloonHistoryLarge, SpeechBalloon, } from './SpeechBalloon';
 import { conversationHeaderText } from './BalloonParts';
+import { ASSISTANT_CLEARANCE_VAR } from './clearance';
 import { AssistantContextMenu, LONG_PRESS_MS, opensContextMenu, } from './AssistantContextMenu';
 import { BalloonExpandContext, ExpandedVisual, focusExpanded, } from './BalloonVisual';
 import { SpriteCharacter } from './SpriteCharacter';
@@ -405,6 +406,22 @@ export function AssistantStage({ character, state, size = 88, place, stageRef, o
         telling ||
         detailing !== null ||
         stayPut);
+    // What it covers in its corner, for a line written under a prompt there
+    // (REVIEWS Q-08).
+    const cornerRight = place.left === undefined && place.top === undefined
+        ? pixels(place.right)
+        : undefined;
+    const cornerBottom = pixels(place.bottom);
+    useEffect(() => {
+        if (aside || cornerRight === undefined || cornerBottom === undefined) {
+            return;
+        }
+        const root = document.documentElement;
+        root.style.setProperty(ASSISTANT_CLEARANCE_VAR, `${cornerRight + size}px`);
+        return () => {
+            root.style.removeProperty(ASSISTANT_CLEARANCE_VAR);
+        };
+    }, [aside, cornerRight, cornerBottom, size]);
     useMouth(stageRef, mouthLevel, state === 'speaking');
     // A decision being asked, or its answer, keeps the balloon up.
     const [deciding, setDeciding] = useState(false);

package/lib/chat/assistant/clearance.d.ts

@@ -0,0 +1,10 @@
+/**
+ * What the floating assistant covers from the right edge of the window while
+ * it stands in a bottom corner, as a CSS length on the document: a line
+ * written under a prompt there (what an application keeps, R-31) leaves it
+ * free, so that the character never stands over its words at a phone's width
+ * (REVIEWS Q-08). Unset when it stands anywhere else, steps aside or is gone.
+ *
+ * @module chat/assistant/clearance
+ */
+export declare const ASSISTANT_CLEARANCE_VAR = "--assistant-clearance";

package/lib/chat/assistant/clearance.js

@@ -0,0 +1,14 @@
+/*
+ * Copyright (c) 2025-2026 Datalayer, Inc.
+ * Distributed under the terms of the Modified BSD License.
+ */
+/**
+ * What the floating assistant covers from the right edge of the window while
+ * it stands in a bottom corner, as a CSS length on the document: a line
+ * written under a prompt there (what an application keeps, R-31) leaves it
+ * free, so that the character never stands over its words at a phone's width
+ * (REVIEWS Q-08). Unset when it stands anywhere else, steps aside or is gone.
+ *
+ * @module chat/assistant/clearance
+ */
+export const ASSISTANT_CLEARANCE_VAR = '--assistant-clearance';