@voicelayer/sdk 0.5.1 → 0.6.0

package/dist/{text-session-BbG3VG50.d.ts → text-session-CoyEcdmg.d.ts}

@@ -476,6 +476,14 @@ declare const ProcessSchemaDTO: z.ZodObject<{
          * worker (it holds the internal service token) never honours it.
          */
         allowPrivateNetwork: z.ZodOptional<z.ZodBoolean>;
+        /**
+         * Burn-down G-33: the model reads the caller's PII as tokens (`<PII_PHONE_1>`). `true` — this tool's arguments carry
+         * the caller's real values instead, when its URL fixes the host (publish refuses it on a host the call fills in).
+         * Absent — real values only when it signs in with a connection; otherwise the endpoint gets the tokens. `false` —
+         * always the tokens.
+         * (packages/sdk/test/tool-detokenise.test.ts)
+         */
+        sendRealValues: z.ZodOptional<z.ZodBoolean>;
     }, "strip", z.ZodTypeAny, {
         name: string;
         description: string;
@@ -486,6 +494,7 @@ declare const ProcessSchemaDTO: z.ZodObject<{
         headers?: Record<string, string> | undefined;
         connectionRef?: string | undefined;
         allowPrivateNetwork?: boolean | undefined;
+        sendRealValues?: boolean | undefined;
     }, {
         name: string;
         description: string;
@@ -496,6 +505,7 @@ declare const ProcessSchemaDTO: z.ZodObject<{
         headers?: Record<string, string> | undefined;
         connectionRef?: string | undefined;
         allowPrivateNetwork?: boolean | undefined;
+        sendRealValues?: boolean | undefined;
     }>, "many">>;
     displayName: z.ZodOptional<z.ZodString>;
     speech: z.ZodOptional<z.ZodObject<{
@@ -721,6 +731,7 @@ declare const ProcessSchemaDTO: z.ZodObject<{
         headers?: Record<string, string> | undefined;
         connectionRef?: string | undefined;
         allowPrivateNetwork?: boolean | undefined;
+        sendRealValues?: boolean | undefined;
     }[] | undefined;
     displayName?: string | undefined;
     program?: {
@@ -809,6 +820,7 @@ declare const ProcessSchemaDTO: z.ZodObject<{
         headers?: Record<string, string> | undefined;
         connectionRef?: string | undefined;
         allowPrivateNetwork?: boolean | undefined;
+        sendRealValues?: boolean | undefined;
     }[] | undefined;
     displayName?: string | undefined;
     program?: {
@@ -990,6 +1002,14 @@ declare const AgentDTO: z.ZodObject<{
              * worker (it holds the internal service token) never honours it.
              */
             allowPrivateNetwork: z.ZodOptional<z.ZodBoolean>;
+            /**
+             * Burn-down G-33: the model reads the caller's PII as tokens (`<PII_PHONE_1>`). `true` — this tool's arguments carry
+             * the caller's real values instead, when its URL fixes the host (publish refuses it on a host the call fills in).
+             * Absent — real values only when it signs in with a connection; otherwise the endpoint gets the tokens. `false` —
+             * always the tokens.
+             * (packages/sdk/test/tool-detokenise.test.ts)
+             */
+            sendRealValues: z.ZodOptional<z.ZodBoolean>;
         }, "strip", z.ZodTypeAny, {
             name: string;
             description: string;
@@ -1000,6 +1020,7 @@ declare const AgentDTO: z.ZodObject<{
             headers?: Record<string, string> | undefined;
             connectionRef?: string | undefined;
             allowPrivateNetwork?: boolean | undefined;
+            sendRealValues?: boolean | undefined;
         }, {
             name: string;
             description: string;
@@ -1010,6 +1031,7 @@ declare const AgentDTO: z.ZodObject<{
             headers?: Record<string, string> | undefined;
             connectionRef?: string | undefined;
             allowPrivateNetwork?: boolean | undefined;
+            sendRealValues?: boolean | undefined;
         }>, "many">>;
         displayName: z.ZodOptional<z.ZodString>;
         speech: z.ZodOptional<z.ZodObject<{
@@ -1235,6 +1257,7 @@ declare const AgentDTO: z.ZodObject<{
             headers?: Record<string, string> | undefined;
             connectionRef?: string | undefined;
             allowPrivateNetwork?: boolean | undefined;
+            sendRealValues?: boolean | undefined;
         }[] | undefined;
         displayName?: string | undefined;
         program?: {
@@ -1323,6 +1346,7 @@ declare const AgentDTO: z.ZodObject<{
             headers?: Record<string, string> | undefined;
             connectionRef?: string | undefined;
             allowPrivateNetwork?: boolean | undefined;
+            sendRealValues?: boolean | undefined;
         }[] | undefined;
         displayName?: string | undefined;
         program?: {
@@ -1433,6 +1457,7 @@ declare const AgentDTO: z.ZodObject<{
             headers?: Record<string, string> | undefined;
             connectionRef?: string | undefined;
             allowPrivateNetwork?: boolean | undefined;
+            sendRealValues?: boolean | undefined;
         }[] | undefined;
         displayName?: string | undefined;
         program?: {
@@ -1541,6 +1566,7 @@ declare const AgentDTO: z.ZodObject<{
             headers?: Record<string, string> | undefined;
             connectionRef?: string | undefined;
             allowPrivateNetwork?: boolean | undefined;
+            sendRealValues?: boolean | undefined;
         }[] | undefined;
         displayName?: string | undefined;
         program?: {
@@ -2154,6 +2180,18 @@ interface AgentEventEmitter {
     emit(event: AgentLifecycleEvent): void;
 }
 
+/** Where a tool's arguments go — what decides whether it gets the caller's real values or the call's tokens. */
+interface ToolDestination {
+    /** `code`: the agent's own code, in its own worker. `http`: a request to `host`. */
+    readonly kind: 'code' | 'http';
+    /** The host the request goes to when its URL fixes it; null when a placeholder picks it. Audited; never a value. */
+    readonly host?: string | null;
+    /** It signs in with a vault connection. */
+    readonly connection?: boolean;
+    /** Explicit: true — real values (an HTTP tool: only to a host its URL fixes); false — the tokens, whatever else holds. */
+    readonly sendRealValues?: boolean;
+}
+
 /** Primitive field types accepted in a process definition. */
 type ProcessFieldType = 'string' | 'string[]' | 'number' | 'boolean' | 'datetime' | 'email' | 'phone';
 interface ProcessField {
@@ -2300,6 +2338,11 @@ interface ConnectorInstance<TName extends string = string, TApi = unknown> {
     readonly api: TApi;
     /** If true, every method on `api` becomes an LLM-callable tool. */
     readonly expose?: boolean;
+    /**
+     * Its exposed tools get the caller's real values in place of the call's PII tokens (`<PII_PHONE_1>`) — a connector
+     * is your code. `false` keeps the tokens. (burn-down G-33 — test/tool-detokenise.test.ts)
+     */
+    readonly sendRealValues?: boolean;
 }
 type ComplianceTag = 'tcpa' | 'hipaa' | 'pci' | 'gdpr' | 'soc2';
 /**
@@ -2525,10 +2568,16 @@ interface EndCallPolicy {
 }
 type ShorthandPrimitive = 'string' | 'number' | 'boolean';
 type ToolInputShape = Record<string, ShorthandPrimitive> | z.ZodTypeAny;
+/** What the runtime tells a tool about the input it hands it (burn-down G-33). */
+interface ToolRunInfo {
+    /** The call's PII tokens in the input were swapped for the caller's real values: a request built from it is
+     *  sensitive — never let a redirect carry it to another origin (`httpTool` refuses one). */
+    readonly carriesRealValues: boolean;
+}
 interface ToolDefinition<I = unknown, R = unknown> {
     readonly description: string;
     readonly input: ToolInputShape;
-    readonly run: (input: I, ctx: AgentContext) => Promise<R> | R;
+    readonly run: (input: I, ctx: AgentContext, info?: ToolRunInfo) => Promise<R> | R;
     /**
      * Capability this tool requires. Action Guard hard-blocks the call if not
      * declared (PRD §B.5 — "no soft failures, ever"). Defaults to
@@ -2537,6 +2586,19 @@ interface ToolDefinition<I = unknown, R = unknown> {
      * for centralised policy.
      */
     readonly capability?: string;
+    /**
+     * The model reads the caller's PII as tokens (`<PII_PHONE_1>`); the platform swaps them back for the real values in a
+     * tool's arguments right before it runs, only where the destination is trusted (burn-down G-33). A code tool — this
+     * one, run in your worker — gets the real values by default; `false` keeps the tokens. An HTTP tool gets tokens
+     * unless it signs in with a vault connection or is `true` — and `true` counts only when its URL fixes the host.
+     * (test/tool-detokenise.test.ts)
+     */
+    readonly sendRealValues?: boolean;
+    /**
+     * Where the arguments go, for the trust rule above — set by the SDK's own builders (`httpTool`, dashboard registry
+     * tools, a flow's tools). Unset: the tool is your code.
+     */
+    readonly destination?: ToolDestination;
 }
 /**
  * Optional security adapters. The SDK always enforces the local-only synchronous
@@ -2792,6 +2854,8 @@ interface AgentToolSpec {
     readonly name: string;
     readonly description: string;
     readonly input: Record<string, 'string' | 'number' | 'boolean'>;
+    /** Where its arguments go — for the tool boundary's trust rule (burn-down G-33); never shown to the model. */
+    readonly destination?: ToolDestination;
 }
 interface AgentToolCall {
     readonly name: string;
@@ -2895,6 +2959,8 @@ type ToolExecutor = (req: {
     readonly input?: Record<string, unknown>;
     readonly auth?: 'connection';
     readonly connectionRef?: string;
+    /** The input holds the caller's real values (G-33): the executor refuses a redirect to another origin. */
+    readonly carriesRealValues?: boolean;
 }) => Promise<{
     readonly ok: boolean;
     readonly status: number;
@@ -2964,7 +3030,11 @@ type PlaybookResolver = (name: string) => Promise<{
  *  the server-side endpoint, so the URL/credential never reach this worker. */
 interface RegistryToolsResolver {
     catalog(): Promise<ReadonlyArray<AgentToolSpec>>;
-    run(name: string, args: Record<string, unknown>): Promise<{
+    run(name: string, args: Record<string, unknown>, 
+    /** carriesRealValues: the args hold the caller's real values (G-33) — the server refuses a cross-origin redirect. */
+    opts?: {
+        readonly carriesRealValues?: boolean;
+    }): Promise<{
         ok: boolean;
         status: number;
         data: unknown;
@@ -2974,6 +3044,13 @@ interface RegistryToolsResolver {
  *  interpreter can run inline. null when the referenced flow isn't found / unpublished
  *  (the subflow executor then degrades to a recorded no-op and advances). */
 type FlowResolver = (ref: string) => Promise<FlowProgram | null>;
+/** The tool boundary's rule for a graph tool step's inputs (G-33, #18): `params` as `destination` may receive them, and
+ *  whether they carry the caller's real values (the request then refuses a redirect to another origin). */
+type ToolInputsPolicy = (params: Record<string, unknown>, destination: ToolDestination) => {
+    readonly params: Record<string, unknown>;
+    readonly carriesRealValues: boolean;
+    readonly trusted: boolean;
+};
 /** Side-effect surface injected once by runFlowProgram. Every member is optional;
  *  a missing resolver makes its executor degrade to a recorded no-op (never throws,
  *  never blocks the call). Kept off AgentContext so the contract stays small and
@@ -2994,6 +3071,12 @@ interface GraphResolvers {
     readonly agentRunner?: AgentRunner;
     /** Name-referenced project tool registry (catalog + server-side execute). */
     readonly registryTools?: RegistryToolsResolver;
+    /** The tool boundary's rule for a graph tool step's inputs where the run has no SecurityPrimitive of its own (a flow
+     *  over text in the API — one destination, one treatment, on every surface: #18). A call's own guard wins. */
+    readonly toolInputs?: ToolInputsPolicy;
+    /** What the caller said, fed by the text driver on every caller message — the boundary tokenises for an untrusted
+     *  tool only values the caller said (`SecurityPrimitive.noteCallerText`, G-33 final review). */
+    readonly noteCallerText?: (text: string) => void;
 }
 
 /**
@@ -3161,4 +3244,4 @@ type RunLiveTextOptions = Omit<RunTextSessionOptions, 'onAgentText' | 'onAwaitIn
  *  interpreter blocks for the next message, or the flow ends. */
 declare function runLiveTextConversation(opts: RunLiveTextOptions): LiveTextConversation;
 
-export { NON_BUSY_STATES as $, AgentEnvironment as A, type DtmfHandler as B, type ConnectorInstance as C, type DtmfEvent as D, type EndCallControllerHandle as E, type EndCallInfo as F, type EndCallOutcome as G, type HandoffConfig as H, type EndCallPolicy as I, type EndCallTrigger as J, type EndpointingConfig as K, type LLMProvider as L, type ModelConfig as M, type FakeSessionAdapter as N, type FloorControlConfig as O, ProcessSchemaDTO as P, type InboundOptions as Q, type ReadinessProbe as R, type STTProvider as S, type TTSProvider as T, type InferProcessData as U, type VADProvider as V, type InterruptionConfig as W, LK_AGENT_STATE_MAP as X, type MemoryHandle as Y, type MemoryScope as Z, type MetricsEvent as _, type AgentLifecycleEvent as a, urlProbe as a$, type Participant as a0, ParticipantId as a1, type ParticipantKind as a2, type ParticipantSet as a3, type ParticipantsConfig as a4, type ProcessBackendAck as a5, type ProcessFieldType as a6, type ProcessSnapshot as a7, type ReadinessReport as a8, type ReadinessResult as a9, type TriggerAction as aA, type TriggerCondition as aB, type TtsVoiceConfig as aC, type TurnEvent as aD, type Unsubscribe as aE, type UserInputEvent as aF, type UserStateEvent as aG, type UserTurn as aH, VoiceLayerAuthError as aI, VoiceLayerError as aJ, VoiceLayerHttpError as aK, VoiceLayerNetworkError as aL, VoiceLayerValidationError as aM, applySpeechTurnHandling as aN, asyncProbe as aO, defineProcess as aP, dtmfCodeToDigit as aQ, dtmfDigitToCode as aR, duck as aS, envProbe as aT, mute as aU, normalizeState as aV, passthrough as aW, runProbes as aX, runTextSession as aY, runTextTranscript as aZ, transform as a_, type RespondOptions as aa, type Room as ab, type RouteEntry as ac, type RoutingRule as ad, type RoutingSnapshot as ae, type RunTextSessionOptions as af, type RunTextTranscriptOptions as ag, type SayOptions as ah, type SecurityConfig as ai, type SendDtmfOptions as aj, type SessionAdapter as ak, type SessionCapabilities as al, type SessionErrorEvent as am, type SessionEvent as an, type SessionEventMap as ao, type SessionFactory as ap, type SessionFactoryInput as aq, type SessionOutbound as ar, type SessionState as as, type ShorthandPrimitive as at, type SpeechResult as au, type SpeechTarget as av, type StateChangeEvent as aw, type TextSession as ax, type TextTranscriptResult as ay, type ToolInputShape as az, AgentDTO as b, type EmailResolver as b0, type FlowResolver as b1, type GraphResolvers as b2, type GraphTraceEvent as b3, type KnowledgeResolver as b4, type LiveTextConversation as b5, type LiveTurnResult as b6, type PlaybookLibraryEntry as b7, type PlaybookResolver as b8, type RegistryToolsResolver as b9, type RunLiveTextOptions as ba, dedupeConversationEmails as bb, denyPrivateNetwork as bc, privateNetworkOptInHonoured as bd, runLiveTextConversation as be, runWithOpenAIScope as bf, toPlaybookResolution as bg, type AgentEventEmitter as c, type AgentContext as d, type AgentConfig as e, type ProcessField as f, type ProviderFactory as g, type RealtimeProvider as h, type TurnDetectorProvider as i, type ProcessDefinition as j, type TriggerDefinition as k, type MemoryConfig as l, type ToolDefinition as m, type SpeechConfig as n, type ToolExecutor as o, type HostLookup as p, type AgentEventListener as q, type AgentTurnEvent as r, type AudioProfile as s, type AudioSurface as t, type CallInfo as u, type CallOutcomeSummary as v, type ChannelKind as w, type CompletionStrategy as x, type ComplianceTag as y, ConsultationPolicy as z };
+export { type MetricsEvent as $, AgentEnvironment as A, ConsultationPolicy as B, type ConnectorInstance as C, type DtmfEvent as D, type DtmfHandler as E, type EndCallControllerHandle as F, type EndCallInfo as G, type HandoffConfig as H, type EndCallOutcome as I, type EndCallPolicy as J, type EndCallTrigger as K, type LLMProvider as L, type ModelConfig as M, type EndpointingConfig as N, type FakeSessionAdapter as O, ProcessSchemaDTO as P, type FloorControlConfig as Q, type ReadinessProbe as R, type STTProvider as S, type ToolDefinition as T, type InboundOptions as U, type VADProvider as V, type InferProcessData as W, type InterruptionConfig as X, LK_AGENT_STATE_MAP as Y, type MemoryHandle as Z, type MemoryScope as _, type AgentLifecycleEvent as a, transform as a$, NON_BUSY_STATES as a0, type Participant as a1, ParticipantId as a2, type ParticipantKind as a3, type ParticipantSet as a4, type ParticipantsConfig as a5, type ProcessBackendAck as a6, type ProcessFieldType as a7, type ProcessSnapshot as a8, type ReadinessReport as a9, type ToolInputShape as aA, type TriggerAction as aB, type TriggerCondition as aC, type TtsVoiceConfig as aD, type TurnEvent as aE, type Unsubscribe as aF, type UserInputEvent as aG, type UserStateEvent as aH, type UserTurn as aI, VoiceLayerAuthError as aJ, VoiceLayerError as aK, VoiceLayerHttpError as aL, VoiceLayerNetworkError as aM, VoiceLayerValidationError as aN, applySpeechTurnHandling as aO, asyncProbe as aP, defineProcess as aQ, dtmfCodeToDigit as aR, dtmfDigitToCode as aS, duck as aT, envProbe as aU, mute as aV, normalizeState as aW, passthrough as aX, runProbes as aY, runTextSession as aZ, runTextTranscript as a_, type ReadinessResult as aa, type RespondOptions as ab, type Room as ac, type RouteEntry as ad, type RoutingRule as ae, type RoutingSnapshot as af, type RunTextSessionOptions as ag, type RunTextTranscriptOptions as ah, type SayOptions as ai, type SecurityConfig as aj, type SendDtmfOptions as ak, type SessionAdapter as al, type SessionCapabilities as am, type SessionErrorEvent as an, type SessionEvent as ao, type SessionEventMap as ap, type SessionFactory as aq, type SessionFactoryInput as ar, type SessionOutbound as as, type SessionState as at, type ShorthandPrimitive as au, type SpeechResult as av, type SpeechTarget as aw, type StateChangeEvent as ax, type TextSession as ay, type TextTranscriptResult as az, AgentDTO as b, urlProbe as b0, type EmailResolver as b1, type FlowResolver as b2, type GraphResolvers as b3, type GraphTraceEvent as b4, type KnowledgeResolver as b5, type LiveTextConversation as b6, type LiveTurnResult as b7, type PlaybookLibraryEntry as b8, type PlaybookResolver as b9, type RegistryToolsResolver as ba, type RunLiveTextOptions as bb, dedupeConversationEmails as bc, denyPrivateNetwork as bd, privateNetworkOptInHonoured as be, runLiveTextConversation as bf, runWithOpenAIScope as bg, toPlaybookResolution as bh, type AgentEventEmitter as c, type AgentConfig as d, type ProcessField as e, type ProviderFactory as f, type TTSProvider as g, type RealtimeProvider as h, type TurnDetectorProvider as i, type ProcessDefinition as j, type TriggerDefinition as k, type MemoryConfig as l, type SpeechConfig as m, type ToolExecutor as n, type AgentContext as o, type ToolRunInfo as p, type HostLookup as q, type AgentEventListener as r, type AgentTurnEvent as s, type AudioProfile as t, type AudioSurface as u, type CallInfo as v, type CallOutcomeSummary as w, type ChannelKind as x, type CompletionStrategy as y, type ComplianceTag as z };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@voicelayer/sdk",
-  "version": "0.5.1",
+  "version": "0.6.0",
   "description": "Official SDK for VoiceLayer — define, run, and orchestrate voice AI agents on the VoiceLayer control plane.",
   "license": "Apache-2.0",
   "author": "VoiceLayer",
@@ -78,17 +78,21 @@
     "tsup": "^8.5.1",
     "typescript": "^5.6.0",
     "vitest": "^4.1.5",
-    "@voicelayer/llm-client": "0.1.0",
     "@voicelayer/contracts": "0.1.0",
+    "@voicelayer/llm-client": "0.1.0",
     "@voicelayer/observability": "0.1.0",
     "@voicelayer/primitive-audio-experience": "0.1.0",
     "@voicelayer/primitive-audio-routing": "0.1.0",
-    "@voicelayer/primitive-process-schema": "0.1.0",
-    "@voicelayer/primitive-security": "0.1.0",
+    "@voicelayer/agents-plugin-assemblyai": "1.0.1",
+    "@voicelayer/agents-plugin-cartesia": "1.0.1",
     "@voicelayer/agents-plugin-deepgram": "1.0.1",
-    "@voicelayer/agents-plugin-openai": "1.0.1",
+    "@voicelayer/agents-plugin-elevenlabs": "1.0.1",
+    "@voicelayer/agents-plugin-google": "1.0.1",
+    "@voicelayer/primitive-security": "0.1.0",
     "@voicelayer/agents-plugin-livekit": "1.0.1",
-    "@voicelayer/agents-plugin-silero": "1.0.1"
+    "@voicelayer/agents-plugin-silero": "1.0.1",
+    "@voicelayer/primitive-process-schema": "0.1.0",
+    "@voicelayer/agents-plugin-openai": "1.0.1"
   },
   "scripts": {
     "typecheck": "tsc -b --pretty false",