@guideai/react-native 0.1.0 → 0.2.0

package/README.md

@@ -24,6 +24,33 @@ GuideAI.configure({
 });
 ```
 
+### What else your API needs
+
+Declare it once in the dashboard (**Copilot Tools → your API → Supplied by your app**), then supply the values:
+
+```ts
+GuideAI.configure({
+  …,
+  getRequestHeaders: async () => ({ 'device-id': await getDeviceId() }),   // declared headers
+  toolContext: { course: openCourseId },   // declared values; or GuideAI.setToolContext(…) later
+});
+```
+
+- **Headers:** sent on every call the assistant makes to your API, never to GuideAI. Only names declared in Copilot Tools are sent, and the app's value wins over anything the model sets. `Authorization` comes from `getAuthToken`, never from here.
+- **Values:** each one fills the API inputs it's declared to fill (app key `course` fills `content_id`), so the assistant never asks the user for them.
+
+The dashboard shows the exact snippet for your declarations.
+
+### Local or staging GuideAI
+
+Production is the default. Point a development build somewhere else with `baseUrl`:
+
+```ts
+GuideAI.configure({ …, baseUrl: __DEV__ ? 'http://localhost:8000' : undefined });
+```
+
+Use `http://10.0.2.2:8000` from an Android emulator.
+
 `userProfile` is a few facts the agent pitches answers to (level, curriculum, language). Update it after login with `GuideAI.setUserProfile(profile)`.
 
 `getAuthToken` is read before every turn and may be async. The assistant calls your endpoints (the site's Copilot toolset) from the device with that token, so your API enforces the user's access exactly as it does for your own screens. A `401` asks `onAuthExpired` once and repeats the call. The token is sent only to your API, never to GuideAI, unless the toolset has `forward_user_token` switched on.

package/dist/index.cjs

@@ -1,6 +1,6 @@
 "use strict";
 Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
-const useOnboarding = require("./useOnboarding-C7eFhp2o.cjs");
+const useOnboarding = require("./useOnboarding-DWkCW5v0.cjs");
 const jsxRuntime = require("react/jsx-runtime");
 const React = require("react");
 function GuideAIScreen({

package/dist/index.d.ts

@@ -342,6 +342,9 @@ interface OnboardingLauncher {
 interface OnboardingAppearance {
     template: 'classic' | 'minimal' | 'bold';
     accent_color: string;
+    /** Optional checklist surface and text colours; missing values use the SDK theme. */
+    background_color?: string | null;
+    text_color?: string | null;
     /** Missing means the default card; position missing means left. */
     layout?: 'card' | 'modal' | 'side';
     position?: 'left' | 'right';
@@ -471,7 +474,8 @@ interface KVStore {
 }
 /**
  * Where a host keeps credentials the copilot may read, named by the
- * source a site configured (`localStorage`, `sessionStorage`, `cookie`).
+ * source a site configured (`localStorage`, `sessionStorage`, `cookie`),
+ * or `app` for values the host app hands over itself (declared headers).
  *
  * Returns null for a source this platform does not have. A mobile app has
  * no cookie jar, and saying so plainly is better than returning an empty
@@ -479,6 +483,15 @@ interface KVStore {
  */
 interface CredentialSource {
     read(source: string, key: string): string | null;
+    /**
+     * The signed-in user's bearer token, when the host hands it over itself.
+     *
+     * A native app keeps its token where it chooses (SecureStore,
+     * AsyncStorage), not in a store the site's dashboard can name. When this
+     * returns a token it wins over the configured storage lookup for a
+     * `bearer` toolset; null falls back to that lookup.
+     */
+    authToken?(): string | null;
 }
 
 /**
@@ -639,6 +652,12 @@ declare class CopilotHarness {
         distinct_id?: string;
     }): void;
     setToolContext(values: Record<string, string> | undefined): void;
+    /**
+     * The app's tool inputs as the API names them. A value declared in Copilot
+     * Tools as filling other inputs (app key `course` fills `content_id`) is
+     * sent under those names too; one the app set by that name already wins.
+     */
+    private contextForTools;
     /** Whether copilot action tools are available for this site. */
     isEnabled(): boolean;
     /**
@@ -726,6 +745,12 @@ declare class CopilotHarness {
     private hasAnyLocalTools;
     private canExecuteTool;
     private executeLocalTool;
+    /**
+     * An MCP tool, after the user approved it: we cannot call it — it is
+     * reached from GuideAI's network with a secret the client never holds —
+     * so the backend runs it, told who the user is by their token.
+     */
+    private executeOnServer;
     private executeLocalToolBatch;
     private _formatToolResult;
     private _readFormatToolResultStream;
@@ -755,6 +780,12 @@ interface SyncNativeStore {
 
 /** Returns the signed-in user's token, or null when signed out. May be async. */
 type AuthTokenGetter = () => string | null | undefined | Promise<string | null | undefined>;
+/**
+ * Values for the headers the site's toolset declares as supplied by the app
+ * (Copilot Tools → "Supplied by your app"). May be async. Only declared
+ * names are ever sent.
+ */
+type RequestHeadersGetter = () => Record<string, string> | null | undefined | Promise<Record<string, string> | null | undefined>;
 
 /** What a host says about one control on screen. */
 interface DeclaredElement {
@@ -820,8 +851,8 @@ interface GuideAIConfig {
      */
     origin?: string;
     /**
-     * Where the GuideAI backend lives. Defaults to the hosted service, so
-     * only self-hosted deployments set it.
+     * Where the GuideAI backend lives. Defaults to production; set it to test
+     * against a local or staging GuideAI (`http://localhost:8000`).
      */
     baseUrl?: string;
     /**
@@ -856,6 +887,20 @@ interface GuideAIConfig {
      * Omitted: getAuthToken() is asked again.
      */
     onAuthExpired?: AuthTokenGetter;
+    /**
+     * Values for the headers your toolset declares in Copilot Tools as
+     * "Supplied by your app" — a device id, a tenant: `async () => ({
+     * 'device-id': id })`. Read before every turn; sent only to your API,
+     * never to GuideAI, and only for declared names.
+     */
+    getRequestHeaders?: RequestHeadersGetter;
+    /**
+     * Values the app knows right now — the course open on screen: `{ course:
+     * '42' }`. Each fills the API inputs of the same name, or those the
+     * toolset declares it fills (Copilot Tools → "Supplied by your app").
+     * Change it with GuideAI.setToolContext().
+     */
+    toolContext?: Record<string, string>;
     /**
      * Facts about the signed-in user for the agent to pitch answers to —
      * `{ age: 12, class: 'JSS1', country: 'Nigeria', language: 'en' }`.
@@ -880,6 +925,8 @@ type GuideAIUserProfile = Record<string, string | number | boolean | Array<strin
 declare function configure(config: GuideAIConfig): void;
 /** Call after login so chat and the checklist use the same person. */
 declare function identify(userId: string | null): void;
+/** Replace the tool inputs the app knows now (e.g. when another course opens). */
+declare function setToolContext(values: Record<string, string> | null): void;
 /** Replace what the agent knows about the user (after login, or a profile edit). */
 declare function setUserProfile(profile: GuideAIUserProfile | null): void;
 /** Whether configure() has run. Lets a host render its own fallback. */
@@ -890,6 +937,7 @@ declare const GuideAI: {
     configure: typeof configure;
     identify: typeof identify;
     setUserProfile: typeof setUserProfile;
+    setToolContext: typeof setToolContext;
     isConfigured: typeof isConfigured;
     reset: typeof reset;
 };
@@ -1040,4 +1088,4 @@ declare function useOnboarding(): {
 };
 
 export { GuideAI, GuideAIScreen, useGuideAI, useGuideAIElement, useOnboarding };
-export type { AuthTokenGetter, DeclaredElement, ElementHandlers, GuideAIConfig, HeadlessImage as GuideAIImage, GuideAIMessage, GuideAIScreenProps, GuideAIUserProfile, GuideAIVoiceRecording, GuideAIVoiceResult, NavigationRefLike, OnboardingState, OnboardingStepState, SyncNativeStore, UseGuideAIElementOptions, UseGuideAIResult };
+export type { AuthTokenGetter, DeclaredElement, ElementHandlers, GuideAIConfig, HeadlessImage as GuideAIImage, GuideAIMessage, GuideAIScreenProps, GuideAIUserProfile, GuideAIVoiceRecording, GuideAIVoiceResult, NavigationRefLike, OnboardingState, OnboardingStepState, RequestHeadersGetter, SyncNativeStore, UseGuideAIElementOptions, UseGuideAIResult };

package/dist/index.mjs

@@ -1,5 +1,5 @@
-import { u as useGuideAIRuntime, S as ScreenRegistry, R as RegistryContext, a as useScreenRegistry } from "./useOnboarding-DhVtf0U2.js";
-import { G, b, c } from "./useOnboarding-DhVtf0U2.js";
+import { u as useGuideAIRuntime, S as ScreenRegistry, R as RegistryContext, a as useScreenRegistry } from "./useOnboarding-DAEGoYSs.js";
+import { G, b, c } from "./useOnboarding-DAEGoYSs.js";
 import { jsx } from "react/jsx-runtime";
 import { useMemo, useEffect, useRef } from "react";
 function GuideAIScreen({

package/dist/ui.cjs

@@ -3,7 +3,7 @@ Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
 const jsxRuntime = require("react/jsx-runtime");
 const React = require("react");
 const reactNative = require("react-native");
-const useOnboarding = require("./useOnboarding-C7eFhp2o.cjs");
+const useOnboarding = require("./useOnboarding-DWkCW5v0.cjs");
 function parseInline(text) {
   const spans = [];
   const pattern = /(`[^`]+`)|(\*\*[^*]+\*\*)|(__[^_]+__)|(\*[^*\n]+\*)|(_[^_\n]+_)|(\[[^\]]+\]\([^)]+\))/g;

package/dist/ui.mjs

@@ -1,7 +1,7 @@
 import { jsx, jsxs, Fragment } from "react/jsx-runtime";
 import React, { useRef, useState, useEffect, useCallback, useMemo, useContext, createContext } from "react";
 import { View, StyleSheet, Text, ScrollView, Linking, KeyboardAvoidingView, Pressable, Alert, FlatList, ActivityIndicator, TextInput, Platform, StatusBar, Animated, Easing, Dimensions, PanResponder, Modal } from "react-native";
-import { r as requireConfigured, b as useGuideAI, c as useOnboarding, E as EP } from "./useOnboarding-DhVtf0U2.js";
+import { r as requireConfigured, b as useGuideAI, c as useOnboarding, E as EP } from "./useOnboarding-DAEGoYSs.js";
 function parseInline(text) {
   const spans = [];
   const pattern = /(`[^`]+`)|(\*\*[^*]+\*\*)|(__[^_]+__)|(\*[^*\n]+\*)|(_[^_\n]+_)|(\[[^\]]+\]\([^)]+\))/g;

package/dist/{useOnboarding-DhVtf0U2.js → useOnboarding-DAEGoYSs.js}

@@ -83,7 +83,7 @@ function describeToolCall(toolCall) {
   const ownScope = /\s+(me|self|current|mine)$/.test(noun);
   if (ownScope) noun = `your ${noun.replace(/\s+(me|self|current|mine)$/, "")}`;
   if (SELF_DESCRIBING.test(noun) || ownScope) return `${verb} ${noun}`;
-  const singular = noun.replace(new RegExp("([a-z])(?<!s|u|i)s$"), "$1");
+  const singular = noun.replace(/([a-z])(?<!s|u|i)s$/, "$1");
   return `${verb} ${singular} information`;
 }
 function describeToolBatch(toolCalls) {
@@ -651,8 +651,11 @@ class ToolExecutor {
   }
   /** Read the user's auth token from the configured browser storage. */
   getAuthToken() {
+    var _a, _b;
     if (this.authConfig.type === "none") return null;
     try {
+      const supplied = this.authConfig.type === "bearer" ? (_b = (_a = this.credentials).authToken) == null ? void 0 : _b.call(_a) : null;
+      if (supplied) return supplied;
       let raw = null;
       const storageKey = this.authConfig.key;
       if (storageKey && this.authConfig.source) {
@@ -838,6 +841,7 @@ class ToolExecutor {
     });
   }
   _buildHeaders(toolCall) {
+    var _a;
     const headers = {
       "Content-Type": "application/json",
       Accept: "application/json"
@@ -884,6 +888,16 @@ class ToolExecutor {
         mergeHeader(name, value);
       }
     }
+    for (const declared of (_a = this.authConfig.app_headers) != null ? _a : []) {
+      if (!(declared == null ? void 0 : declared.name)) continue;
+      let value = null;
+      try {
+        value = this.credentials.read("app", declared.name);
+      } catch {
+        value = null;
+      }
+      mergeHeader(declared.name, value);
+    }
     return headers;
   }
   _resolveHeaderValue(value) {
@@ -1026,6 +1040,7 @@ const EP = {
   guidesRecord: () => _j([..._v, "guides", "record"]),
   events: () => _j([..._v, "events"]),
   chatAsk: () => _j([..._v, "chat", "ask"]),
+  chatExecuteTool: () => _j([..._v, "chat", "execute-tool"]),
   onboardingCurrent: (userId) => `${_j([..._v, "onboarding", "current"])}?user_id=${encodeURIComponent(userId)}`,
   onboardingObserve: () => _j([..._v, "onboarding", "observe"]),
   onboardingDismiss: () => _j([..._v, "onboarding", "dismiss"]),
@@ -1083,6 +1098,9 @@ const MAX_CHAIN_ROUNDS = 5;
 const MAX_TOTAL_TOOL_CALLS = 10;
 const MAX_REPAIR_ROUNDS = 1;
 const REPAIRABLE_ERROR_TYPES = /* @__PURE__ */ new Set(["validation", "client", "not_found"]);
+function isServerTool(toolCall) {
+  return (toolCall.method || "").toUpperCase() === "MCP";
+}
 class CopilotHarness {
   /**
    * @param tools  How this platform actually touches the screen. Defaults to
@@ -1166,6 +1184,24 @@ class CopilotHarness {
   setToolContext(values) {
     this.toolContext = values && Object.keys(values).length > 0 ? values : void 0;
   }
+  /**
+   * The app's tool inputs as the API names them. A value declared in Copilot
+   * Tools as filling other inputs (app key `course` fills `content_id`) is
+   * sent under those names too; one the app set by that name already wins.
+   */
+  contextForTools() {
+    var _a, _b, _c, _d;
+    if (!this.toolContext) return void 0;
+    const out = { ...this.toolContext };
+    for (const input of (_c = (_b = (_a = this.activeTools) == null ? void 0 : _a.auth_config) == null ? void 0 : _b.app_inputs) != null ? _c : []) {
+      const value = (input == null ? void 0 : input.key) ? this.toolContext[input.key] : void 0;
+      if (value === void 0) continue;
+      for (const name of (_d = input.fills) != null ? _d : []) {
+        if (name && !(name in out)) out[name] = value;
+      }
+    }
+    return out;
+  }
   /** Whether copilot action tools are available for this site. */
   isEnabled() {
     return this.tools.definitions().length > 0 || this.activeTools !== null && this.activeTools.tools.length > 0;
@@ -1180,8 +1216,7 @@ class CopilotHarness {
    * 5. For non-tool queries, returns JSON response directly
    */
   async processMessage(question, pageUrl, pageSnapshot, chatMode, onStatus, onTextDelta, onToolCallEvent, abortSignal, userContext, onboardingUserId) {
-    var _a2, _b2, _c2;
-    var _a, _b, _c, _d, _e, _f, _g, _h;
+    var _a, _b, _c, _d, _e, _f, _g, _h, _i, _j2, _k;
     const inputCheck = this.validator.validateUserInput(question);
     if (!inputCheck.valid) {
       return this._errorResponse(inputCheck.error || "Invalid input.");
@@ -1196,10 +1231,10 @@ class CopilotHarness {
     });
     const conversationHistory = this.memory.getRecentForLLM(10);
     const mayForwardToken = ((_b = (_a = this.activeTools) == null ? void 0 : _a.auth_config) == null ? void 0 : _b.forward_user_token) === true;
-    const userToken = mayForwardToken ? (_a2 = (_c = this.toolExecutor) == null ? void 0 : _c.getAuthToken()) != null ? _a2 : null : null;
+    const userToken = mayForwardToken ? (_d = (_c = this.toolExecutor) == null ? void 0 : _c.getAuthToken()) != null ? _d : null : null;
     let analytics = {};
     try {
-      analytics = (_b2 = (_e = (_d = this.config).analyticsIds) == null ? void 0 : _e.call(_d)) != null ? _b2 : {};
+      analytics = (_g = (_f = (_e = this.config).analyticsIds) == null ? void 0 : _f.call(_e)) != null ? _g : {};
     } catch {
     }
     const requestBody = {
@@ -1209,8 +1244,8 @@ class CopilotHarness {
       distinct_id: analytics.distinct_id || void 0,
       page_snapshot: pageSnapshot,
       chat_mode: chatMode || "guidance",
-      assistant_label: ((_f = this.config.assistantLabel) == null ? void 0 : _f.trim()) || void 0,
-      delegate_instruction: ((_g = this.config.delegationInstruction) == null ? void 0 : _g.trim().slice(0, 1e3)) || void 0,
+      assistant_label: ((_h = this.config.assistantLabel) == null ? void 0 : _h.trim()) || void 0,
+      delegate_instruction: ((_i = this.config.delegationInstruction) == null ? void 0 : _i.trim().slice(0, 1e3)) || void 0,
       conversation_history: conversationHistory,
       stream: this.api.supportsStreaming,
       user_token: userToken || void 0,
@@ -1218,8 +1253,8 @@ class CopilotHarness {
       client_tools: chatMode === "assistant" ? this.tools.definitions() : void 0,
       user_context: userContext,
       onboarding_user_id: onboardingUserId,
-      tool_context: this.toolContext,
-      client_capabilities: ((_h = this.config.clientCapabilities) == null ? void 0 : _h.length) ? this.config.clientCapabilities : void 0
+      tool_context: this.contextForTools(),
+      client_capabilities: ((_j2 = this.config.clientCapabilities) == null ? void 0 : _j2.length) ? this.config.clientCapabilities : void 0
     };
     let rawResponse;
     try {
@@ -1259,7 +1294,7 @@ class CopilotHarness {
     const harnessResponse = this._handleJsonResponse(response, chatMode);
     if (harnessResponse.autoExecuteToolCall && harnessResponse.pendingToolCall) {
       return this._executePendingToolCall(
-        (_c2 = harnessResponse.pendingToolCalls) != null ? _c2 : [harnessResponse.pendingToolCall],
+        (_k = harnessResponse.pendingToolCalls) != null ? _k : [harnessResponse.pendingToolCall],
         sanitizedQuestion,
         onStatus,
         onTextDelta,
@@ -1584,8 +1619,7 @@ class CopilotHarness {
     return result.trim();
   }
   _parseStreamedResponse(response) {
-    var _a2;
-    var _a, _b, _c, _d;
+    var _a, _b, _c, _d, _e;
     const respCheck = this.validator.validateResponse(response);
     const answer = respCheck.sanitized || response.answer || "";
     if ((_a = response.tool_call) == null ? void 0 : _a.requires_confirm) {
@@ -1615,7 +1649,7 @@ class CopilotHarness {
     let toolResult;
     if (response.tool_result) {
       toolResult = {
-        success: (_a2 = response.tool_result.success) != null ? _a2 : true,
+        success: (_c = response.tool_result.success) != null ? _c : true,
         data: response.tool_result.data,
         error: response.tool_result.error,
         status: response.tool_result.status
@@ -1635,10 +1669,10 @@ class CopilotHarness {
       escalation: response.escalation || void 0,
       demo: response.demo || void 0,
       point: response.point || void 0,
-      actions: ((_c = response.actions) == null ? void 0 : _c.length) ? response.actions : void 0,
+      actions: ((_d = response.actions) == null ? void 0 : _d.length) ? response.actions : void 0,
       payment: response.payment || void 0,
       coach: response.coach || void 0,
-      quickReplies: ((_d = response.quick_replies) == null ? void 0 : _d.length) ? response.quick_replies : void 0
+      quickReplies: ((_e = response.quick_replies) == null ? void 0 : _e.length) ? response.quick_replies : void 0
     };
   }
   /**
@@ -1666,14 +1700,13 @@ class CopilotHarness {
     return plan;
   }
   _handleJsonResponse(response, chatMode, toolResult) {
-    var _a2;
-    var _a, _b, _c;
+    var _a, _b, _c, _d;
     const respCheck = this.validator.validateResponse(response);
     if (!respCheck.valid) {
       return this._errorResponse(respCheck.error || "Invalid server response.");
     }
     const answer = respCheck.sanitized || response.answer;
-    const plan = (_a2 = this._announcePlan(response.plan)) != null ? _a2 : this.currentPlan;
+    const plan = (_a = this._announcePlan(response.plan)) != null ? _a : this.currentPlan;
     if (response.tool_call && response.tool_call.requires_confirm) {
       return {
         mode: "answer",
@@ -1690,7 +1723,7 @@ class CopilotHarness {
         answer,
         plan,
         pendingToolCall: response.tool_call,
-        pendingToolCalls: ((_a = response.tool_calls) == null ? void 0 : _a.length) ? response.tool_calls : [response.tool_call],
+        pendingToolCalls: ((_b = response.tool_calls) == null ? void 0 : _b.length) ? response.tool_calls : [response.tool_call],
         autoExecuteToolCall: true,
         autoExecute: false
       };
@@ -1718,10 +1751,10 @@ class CopilotHarness {
       escalation: response.escalation || void 0,
       demo: response.demo || void 0,
       point: response.point || void 0,
-      actions: ((_b = response.actions) == null ? void 0 : _b.length) ? response.actions : void 0,
+      actions: ((_c = response.actions) == null ? void 0 : _c.length) ? response.actions : void 0,
       payment: response.payment || void 0,
       coach: response.coach || void 0,
-      quickReplies: ((_c = response.quick_replies) == null ? void 0 : _c.length) ? response.quick_replies : void 0
+      quickReplies: ((_d = response.quick_replies) == null ? void 0 : _d.length) ? response.quick_replies : void 0
     };
     this.memory.addMessage({
       role: "assistant",
@@ -1756,7 +1789,7 @@ class CopilotHarness {
         tool_history: toolHistory,
         tools_remaining: budget == null ? void 0 : budget.toolsRemaining,
         force_answer: (_a = budget == null ? void 0 : budget.forceAnswer) != null ? _a : false,
-        tool_context: this.toolContext,
+        tool_context: this.contextForTools(),
         client_tools: this.tools.definitions()
       }
     );
@@ -1935,12 +1968,14 @@ class CopilotHarness {
     return !!this.toolExecutor || this.tools.definitions().length > 0;
   }
   canExecuteTool(toolCall) {
+    if (isServerTool(toolCall)) return true;
     if (this.tools.canExecute(toolCall.tool)) {
       return this.tools.canExecuteCall(toolCall);
     }
     return !!this.toolExecutor;
   }
   executeLocalTool(toolCall) {
+    if (isServerTool(toolCall)) return this.executeOnServer(toolCall);
     if (this.tools.canExecute(toolCall.tool)) {
       return this.tools.execute(toolCall);
     }
@@ -1951,6 +1986,30 @@ class CopilotHarness {
       error_type: "tool_unavailable"
     });
   }
+  /**
+   * An MCP tool, after the user approved it: we cannot call it — it is
+   * reached from GuideAI's network with a secret the client never holds —
+   * so the backend runs it, told who the user is by their token.
+   */
+  async executeOnServer(toolCall) {
+    var _a, _b;
+    try {
+      return await this.api.post(EP.chatExecuteTool(), {
+        tool: toolCall.tool,
+        method: toolCall.method,
+        path: toolCall.path,
+        params: toolCall.params,
+        body: toolCall.body,
+        user_token: (_b = (_a = this.toolExecutor) == null ? void 0 : _a.getAuthToken()) != null ? _b : void 0
+      });
+    } catch (error) {
+      return {
+        success: false,
+        error: error instanceof Error ? error.message : "The tool could not be run.",
+        error_type: "tool_unavailable"
+      };
+    }
+  }
   executeLocalToolBatch(toolCalls, onComplete) {
     return Promise.all(toolCalls.map(async (toolCall) => {
       const result = await this.executeLocalTool(toolCall);
@@ -2348,6 +2407,7 @@ class RNCredentialSource {
     this.storage = storage;
     this.session = session;
     this.hostToken = null;
+    this.appValues = /* @__PURE__ */ new Map();
   }
   /**
    * Set by the runtime from `getAuthToken()` before every turn, so the
@@ -2359,12 +2419,20 @@ class RNCredentialSource {
   authToken() {
     return this.hostToken;
   }
+  /** Set from `getRequestHeaders()` before every turn. */
+  setAppValues(values) {
+    this.appValues = new Map(Object.entries(values).map(([k, v]) => [k.toLowerCase(), v]));
+  }
   read(source, key) {
+    var _a;
     switch (source) {
       case "localStorage":
         return this.storage.getItem(key);
       case "sessionStorage":
         return this.session.getItem(key);
+      // A header the toolset declares as supplied by the app.
+      case "app":
+        return (_a = this.appValues.get(key.toLowerCase())) != null ? _a : null;
       // No cookie jar on a device. Saying so is the honest answer.
       case "cookie":
         return null;
@@ -2378,6 +2446,7 @@ function rnPlatform(options = {}) {
   const session = new MemoryStore();
   return { storage, session, credentials: new RNCredentialSource(storage, session) };
 }
+const RESERVED_HEADERS = /* @__PURE__ */ new Set(["authorization", "host", "content-length", "cookie"]);
 class HostAuth {
   constructor(credentials, options = {}) {
     this.credentials = credentials;
@@ -2390,9 +2459,24 @@ class HostAuth {
   current() {
     return this.credentials.authToken();
   }
-  /** Read the host's token now. Never throws: a failed read is "signed out". */
+  /** Read the host's token and extra headers now. Never throws. */
   async refresh() {
     var _a;
+    if (this.options.getRequestHeaders) {
+      let raw = null;
+      try {
+        raw = await this.options.getRequestHeaders();
+      } catch (error) {
+        console.warn("[GuideAI] getRequestHeaders failed; sending none:", error);
+      }
+      const clean = {};
+      for (const [name, value] of Object.entries(raw != null ? raw : {})) {
+        if (/^[A-Za-z0-9-]{1,64}$/.test(name) && !RESERVED_HEADERS.has(name.toLowerCase()) && typeof value === "string" && value && !/[\r\n]/.test(value)) {
+          clean[name] = value;
+        }
+      }
+      this.credentials.setAppValues(clean);
+    }
     if (!this.options.getAuthToken) return null;
     let token = null;
     try {
@@ -3159,7 +3243,7 @@ ${text}`);
   console.log(`${"═".repeat(60)}
 `);
 }
-const DEFAULT_BASE_URL = "https://api.guideai.dev";
+const DEFAULT_BASE_URL = "https://cdn.3guideai.com";
 let configured = null;
 function configure(config) {
   var _a, _b, _c, _d, _e, _f;
@@ -3173,7 +3257,11 @@ function configure(config) {
   const runtime = new GuideAIRuntime({
     requestOrigin: config.origin,
     store: config.store,
-    auth: { getAuthToken: config.getAuthToken, onAuthExpired: config.onAuthExpired },
+    auth: {
+      getAuthToken: config.getAuthToken,
+      onAuthExpired: config.onAuthExpired,
+      getRequestHeaders: config.getRequestHeaders
+    },
     navigation: config.navigation ? navigationBridge(
       typeof config.navigation === "function" ? config.navigation : () => config.navigation
     ) : void 0
@@ -3194,6 +3282,7 @@ function configure(config) {
     debug ? traceTransport(runtime.transport) : runtime.transport,
     runtime.credentials
   );
+  if (config.toolContext) harness.setToolContext(config.toolContext);
   configured = {
     runtime,
     harness,
@@ -3207,6 +3296,10 @@ function identify(userId) {
   if (!configured) throw new Error("Call GuideAI.configure() before identify().");
   configured.visitorId = (userId == null ? void 0 : userId.trim()) || null;
 }
+function setToolContext(values) {
+  if (!configured) throw new Error("Call GuideAI.configure() before setToolContext().");
+  configured.harness.setToolContext(values != null ? values : void 0);
+}
 function setUserProfile(profile) {
   if (!configured) throw new Error("Call GuideAI.configure() before setUserProfile().");
   configured.profile = profile;
@@ -3225,7 +3318,7 @@ function isConfigured() {
 function reset() {
   configured = null;
 }
-const GuideAI = { configure, identify, setUserProfile, isConfigured, reset };
+const GuideAI = { configure, identify, setUserProfile, setToolContext, isConfigured, reset };
 const AUDIO_TYPES = {
   m4a: "audio/m4a",
   mp4: "audio/mp4",
@@ -3496,4 +3589,4 @@ export {
   requireConfigured as r,
   useGuideAIRuntime as u
 };
-//# sourceMappingURL=useOnboarding-DhVtf0U2.js.map
+//# sourceMappingURL=useOnboarding-DAEGoYSs.js.map