@wix/himalaya-cli 0.1308.0 → 0.1310.0

package/templates/yoga-studio-owner/himalaya.content.json

@@ -1,5 +1,175 @@
 {
   "name": "__HIMI_APP_NAME__",
+  "screens": {
+    "himi_owner_lite_account": {
+      "displayName": "Account"
+    },
+    "himi_owner_lite_analytics": {
+      "displayName": "Analytics Overview"
+    },
+    "himi_owner_lite_analytics_measure": {
+      "displayName": "Analytics Metric Details"
+    },
+    "himi_owner_lite_analytics_report": {
+      "displayName": "Build a report"
+    },
+    "himi_owner_lite_appointments": {
+      "displayName": "Appointments"
+    },
+    "himi_owner_lite_aria": {
+      "displayName": "Aria"
+    },
+    "himi_owner_lite_aria_history": {
+      "displayName": "Aria History"
+    },
+    "himi_owner_lite_ask": {
+      "displayName": "Ask the studio"
+    },
+    "himi_owner_lite_booking": {
+      "displayName": "Booking"
+    },
+    "himi_owner_lite_brief": {
+      "displayName": "Today at the studio"
+    },
+    "himi_owner_lite_drawer": {
+      "displayName": "Menu"
+    },
+    "himi_owner_lite_event": {
+      "displayName": "Workshop"
+    },
+    "himi_owner_lite_event_form": {
+      "displayName": "Event Form"
+    },
+    "himi_owner_lite_events": {
+      "displayName": "Events"
+    },
+    "himi_owner_lite_home": {
+      "displayName": "Business Dashboard"
+    },
+    "himi_owner_lite_manage": {
+      "displayName": "Studio"
+    },
+    "himi_owner_lite_module_badges": {
+      "displayName": "Module Badges"
+    },
+    "himi_owner_lite_module_contacts": {
+      "displayName": "Module Contacts"
+    },
+    "himi_owner_lite_module_coupons": {
+      "displayName": "Module Coupons"
+    },
+    "himi_owner_lite_module_donationCampaigns": {
+      "displayName": "Module Donation Campaigns"
+    },
+    "himi_owner_lite_module_forms": {
+      "displayName": "Module Forms"
+    },
+    "himi_owner_lite_module_giftCards": {
+      "displayName": "Module Gift Cards"
+    },
+    "himi_owner_lite_module_groups": {
+      "displayName": "Module Groups"
+    },
+    "himi_owner_lite_module_invoices": {
+      "displayName": "Module Invoices"
+    },
+    "himi_owner_lite_module_members": {
+      "displayName": "Module Members"
+    },
+    "himi_owner_lite_module_plans": {
+      "displayName": "Module Plans"
+    },
+    "himi_owner_lite_module_portfolio": {
+      "displayName": "Module Portfolio"
+    },
+    "himi_owner_lite_module_programs": {
+      "displayName": "Module Programs"
+    },
+    "himi_owner_lite_module_reservations": {
+      "displayName": "Module Reservations"
+    },
+    "himi_owner_lite_module_reviews": {
+      "displayName": "Module Reviews"
+    },
+    "himi_owner_lite_module_subscriptions": {
+      "displayName": "Module Subscriptions"
+    },
+    "himi_owner_lite_overview": {
+      "displayName": "Overview"
+    },
+    "himi_owner_lite_post": {
+      "displayName": "Journal entry"
+    },
+    "himi_owner_lite_post_form": {
+      "displayName": "Post Form"
+    },
+    "himi_owner_lite_post_new": {
+      "displayName": "Post New"
+    },
+    "himi_owner_lite_posts": {
+      "displayName": "Posts"
+    },
+    "himi_owner_lite_record_badges": {
+      "displayName": "Record Badges"
+    },
+    "himi_owner_lite_record_contacts": {
+      "displayName": "Record Contacts"
+    },
+    "himi_owner_lite_record_coupons": {
+      "displayName": "Record Coupons"
+    },
+    "himi_owner_lite_record_donationCampaigns": {
+      "displayName": "Record Donation Campaigns"
+    },
+    "himi_owner_lite_record_forms": {
+      "displayName": "Record Forms"
+    },
+    "himi_owner_lite_record_giftCards": {
+      "displayName": "Record Gift Cards"
+    },
+    "himi_owner_lite_record_groups": {
+      "displayName": "Record Groups"
+    },
+    "himi_owner_lite_record_invoices": {
+      "displayName": "Record Invoices"
+    },
+    "himi_owner_lite_record_members": {
+      "displayName": "Record Members"
+    },
+    "himi_owner_lite_record_plans": {
+      "displayName": "Record Plans"
+    },
+    "himi_owner_lite_record_portfolio": {
+      "displayName": "Record Portfolio"
+    },
+    "himi_owner_lite_record_programs": {
+      "displayName": "Record Programs"
+    },
+    "himi_owner_lite_record_reservations": {
+      "displayName": "Record Reservations"
+    },
+    "himi_owner_lite_record_reviews": {
+      "displayName": "Record Reviews"
+    },
+    "himi_owner_lite_record_subscriptions": {
+      "displayName": "Record Subscriptions"
+    },
+    "himi_owner_lite_search": {
+      "displayName": "Search records"
+    },
+    "himi_owner_lite_service": {
+      "displayName": "Class"
+    },
+    "himi_owner_lite_service_form": {
+      "displayName": "Service Form"
+    },
+    "himi_owner_lite_services": {
+      "displayName": "Services"
+    },
+    "himi_owner_lite_sites": {
+      "displayName": "Sites"
+    }
+  },
   "icon": "icon.png",
   "target": "prod",
   "shell": "owner-lite"

package/templates/yoga-studio-owner/tier5-src/_shared/aria-chat.ts

@@ -69,7 +69,7 @@ import {
   type AriaAttachmentChip,
   type AriaAttachmentOutcome,
 } from "./aria-attachments.js";
-import { runClientToolExchange, type AriaClientTools } from "./aria-client-tools.js";
+import { runClientToolExchange, type AriaClientTools, type ConsentMemory } from "./aria-client-tools.js";
 import { proseOfParts, scanEnvelopes, stripHidden } from "./aria-widgets.js";
 import { isWebUrl, stripMarkdown } from "./aria-widget-model.js";
 import {
@@ -90,6 +90,8 @@ import { MENTION_PAGE_SIZE, allowlisted, emptyMentionModel, mentionView,
   type MentionItemRow, type MentionLabels, type MentionModel, type MentionProvider, type MentionView } from "./aria-mentions.js";
 import { isTransportFailure, ownerTransportFailureText } from "./owner-load-error.js";
 import { LOCAL_ID_PREFIX, createRowMemo, mintLocalId, transcriptKeys, type RowMemo } from "./aria-hot-path.js";
+import { ariaMessageRowId } from "./aria-row-id.js";
+export { ariaMessageRowId } from "./aria-row-id.js";
 import { createLiveReply } from "./aria-stream.js";
 import { calendarDay, formatClock, formatDateMedium, formatMonthDay } from "./engine-intl.js";
 
@@ -281,6 +283,35 @@ export interface AriaChatState {
   attachments: AriaAttachmentChip[];
   /** Collapses the composer's attachment strip while it is empty. */
   attachmentsHidden: boolean;
+  /** Transcript scroll — the transcript scroll policy's SEND TOKEN (`transcriptScroll.sendPath`).
+   *  A new value is a send: the host pins `scrollAnchor` near the top and re-arms
+   *  following. Empty on the empty state, so a fresh chat rests at the top. */
+  scrollSend: string;
+  /** Transcript scroll — the component id of the turn to pin (`transcriptScroll.anchorPath`):
+   *  the newest USER row while a pin is wanted, else empty. Derived in `gated`,
+   *  because the row changes identity mid-turn — the optimistic local id is replaced
+   *  by the server's — and the host must follow it without reading a new send. */
+  scrollAnchor: string;
+  /** The last send named a turn to pin (a question), as opposed to "show the latest"
+   *  (a resumed conversation). */
+  _pinActive: boolean;
+  /** The character. The idle hero sits on the empty state, beside the prompt
+   *  cards and gone with them; on the status line she THINKS while a turn is out with
+   *  no reply text yet, and TALKS while the reply is being written. Derived in
+   *  `gated`, in the `hiddenPath` polarity. */
+  heroHidden: boolean;
+  charThinkingHidden: boolean;
+  charTalkingHidden: boolean;
+  /** The status row holds the character AND a Spacer, so unlike a bare
+   *  `collapseWhenEmpty` text it never collapses on its own — with no status and no
+   *  character it would still cost the screen a stack gap. True when it has nothing
+   *  to show. */
+  statusHidden: boolean;
+  /** Collapses the 8pt gap above the prompt cards while they show — the empty state,
+   *  which is tight on a phone — and keeps it through every reply turn, where the
+   *  (empty) prompt list's gap is part of the spacing under a reply. Always
+   *  `!heroHidden`. */
+  promptsGapHidden: boolean;
   /** The quick replies the service suggested after the LATEST turn — short
    *  answers the owner can send with one tap. They arrive only on the realtime
    *  stream, a moment after the reply finishes, so a screen with no stream never
@@ -523,6 +554,11 @@ export interface AriaChatOptions {
   greeting: Resolvable<string>;
   prompts: Resolvable<AriaPromptChip[]>;
   labels?: AriaChatLabels;
+  /** The screen this machine paints. Supplying it names the pinned turn for the
+   *  transcript scroll (`scrollAnchor` = `ariaMessageRowId(screenId, id)`,
+   *  the id the screen builder stamps on every message row). Omitted, nothing is
+   *  pinned: the send token alone still makes the host follow the reply. */
+  screenId?: string;
   origin?: string;
   assistantId?: string;
   /** Namespace for the local recent-conversation list. Partitioned by site when
@@ -986,6 +1022,39 @@ function lastReply(s: { messages: AriaBubble[] }): AriaBubble | undefined {
   return last && last.notUser && last.id !== GREETING_ID ? last : undefined;
 }
 
+/** The next send token: `t1`, `t2`, … A counter carried IN the state rather than
+ *  in the worker, so a worker rebuilt over persisted state never re-issues the
+ *  token the host last saw — an equal token is "no send", by design. */
+export function nextScrollToken(prev: string): string {
+  const n = /^t(\d+)$/.exec(prev)?.[1];
+  return `t${(n ? Number(n) : 0) + 1}`;
+}
+
+/** No conversation to follow: the empty state rests at the top. */
+const SCROLL_RESET = { scrollSend: "", _pinActive: false } as const;
+
+/** A conversation put on screen whole (resumed from History, or rehydrated): open
+ *  at its latest turn with nothing pinned. A greeting alone is the empty state. */
+function openedAtLatest(s: { scrollSend: string }, messages: AriaBubble[]): { scrollSend: string; _pinActive: boolean } {
+  return messages.some((b) => b.role === "USER")
+    ? { scrollSend: nextScrollToken(s.scrollSend), _pinActive: false }
+    : SCROLL_RESET;
+}
+
+/** The newest owner turn, or undefined. */
+function newestUserBubble(messages: AriaBubble[]): AriaBubble | undefined {
+  for (let i = messages.length - 1; i >= 0; i--) if (messages[i].role === "USER") return messages[i];
+  return undefined;
+}
+
+/** Has the reply to the newest owner turn started to appear? An assistant row with
+ *  words AFTER that turn — while the turn is still out, that is the agent writing. */
+function replyStarted(messages: AriaBubble[]): boolean {
+  if (!messages.some((b) => b.role === "USER")) return false;
+  const last = messages[messages.length - 1];
+  return !!last && last.role !== "USER" && last.id !== GREETING_ID && !!String(last.content ?? "").trim();
+}
+
 /** Chips are visible only before the owner has said anything. */
 function promptsFor(msgs: AriaBubble[], prompts: AriaPromptChip[]): AriaPromptChip[] {
   return msgs.some((b) => b.role === "USER") ? [] : prompts;
@@ -1620,6 +1689,8 @@ export function createAriaChat(o: AriaChatOptions): AriaChatCore {
     listening: false, micHidden: !o.dictation, listeningHidden: true,
     widget: NO_WIDGET, mention: mentionViewNow,
     attachments: [], attachmentsHidden: true,
+    scrollSend: "", scrollAnchor: "", _pinActive: false,
+    heroHidden: true, charThinkingHidden: true, charTalkingHidden: true, statusHidden: true, promptsGapHidden: false,
     quickReplies: [], quickRepliesHidden: true, _realtime: "off",
   };
 
@@ -2020,6 +2091,34 @@ export function createAriaChat(o: AriaChatOptions): AriaChatCore {
     return { confirm: (ask) => t.confirm({ message: consentBody(ask.message) }), userAgent: t.userAgent };
   };
 
+  /** The owner's consent approvals, by conversation: the native Aria app's
+   *  `ConsentPolicy`, scoped the way the native app scopes it.
+   *
+   *  - Per CONVERSATION and per `consentKey`. A key approved in one conversation
+   *    is asked again in another, and a new chat is a new conversation.
+   *  - Per BUSINESS too. The native policy lives in a chat session that is rebuilt
+   *    for every identity × business, so the site is part of the key here: an
+   *    approval never carries across a site switch.
+   *  - In memory only. Nothing is written to storage, nothing expires, and there
+   *    is nothing to revoke it with. It is gone when the session that holds it
+   *    goes: for native that is sign-out, a business switch or the app quitting,
+   *    and here it is the worker being torn down.
+   *
+   *  Only approvals are recorded, and only after an explicit Confirm
+   *  (`answerClientTool`). */
+  const consentApprovals = new Map<string, Set<string>>();
+  const consentMemoryFor = (site: string, convId: string): ConsentMemory => {
+    const scope = `${site}\n${convId}`;
+    return {
+      approved: (key) => consentApprovals.get(scope)?.has(key) ?? false,
+      remember: (key) => {
+        const keys = consentApprovals.get(scope) ?? new Set<string>();
+        keys.add(key);
+        consentApprovals.set(scope, keys);
+      },
+    };
+  };
+
   /** Answer the client tools a send's response asked for, WITHOUT holding the
    *  send open.
    *
@@ -2033,7 +2132,7 @@ export function createAriaChat(o: AriaChatOptions): AriaChatCore {
    *  the composer — can be reached while the owner is being asked. The epoch
    *  check still guards the result: if the turn has moved on regardless, the
    *  answer is not sent (`runClientToolExchange`, "abandoned"). */
-  function startToolExchange(convId: string, first: SendMessageResponse): void {
+  function startToolExchange(convId: string, site: string, first: SendMessageResponse): void {
     if (!functionCallsOf(first).length) return;
     const seq = turnSeq;
     const current = () => turnSeq === seq;
@@ -2049,6 +2148,7 @@ export function createAriaChat(o: AriaChatOptions): AriaChatCore {
     noteRows(first);
     mine.done = runClientToolExchange(first, {
       host: toolHost(),
+      memory: consentMemoryFor(site, convId),
       callsOf: functionCallsOf,
       beforeSend: async () => {
         const now = await assistantRowsNow(convId);
@@ -2507,6 +2607,9 @@ export function createAriaChat(o: AriaChatOptions): AriaChatCore {
       // reason a scrollback widget keeps its prose and loses its controls.
       widget: NO_WIDGET,
       ...retireDictation(),
+      // Transcript scroll — a send: the host pins this question near the top and lets the
+      // reply grow into the space beneath it.
+      scrollSend: nextScrollToken(s.scrollSend), _pinActive: true,
     };
     inFlightSend = content;
     // Held outside the try so a FAILED send still reports the conversation it
@@ -2672,7 +2775,7 @@ export function createAriaChat(o: AriaChatOptions): AriaChatCore {
       const sent: AriaChatState = { ...marked, _abortId: abortId, _turnId: abortId };
       inFlightSend = null;
       // After the second bump, so the exchange is keyed to THIS turn's epoch.
-      startToolExchange(convId, answer);
+      startToolExchange(convId, site, answer);
       if (o.poll) {
         // Return NOW. The host owns the clock from here; `tick` merges the
         // reply in when it lands.
@@ -2799,12 +2902,28 @@ export function createAriaChat(o: AriaChatOptions): AriaChatCore {
     const listening = s.listening === true;
     const micHidden = !o.dictation || dictationAvailable === false || listening;
     const listeningHidden = !listening;
-    // And the transcript list: hidden while empty, so it costs its stack no gap.
+    // The transcript scroll + the character, derived here for the reason the gates above
+    // are: one exit every action passes through, so no reducer can leave a stale
+    // anchor pointing at a row that has since been replaced, or a character still
+    // thinking after the reply landed.
+    const pinRow = s._pinActive && o.screenId ? newestUserBubble(s.messages) : undefined;
+    const scrollAnchor = pinRow ? ariaMessageRowId(o.screenId!, pinRow.id) : "";
+    const inFlight = turnInFlight(s);
+    const talking = inFlight && replyStarted(s.messages);
+    const charThinkingHidden = !(inFlight && !talking);
+    const charTalkingHidden = !talking;
+    const heroHidden = !(s.prompts && s.prompts.length > 0);
+    const promptsGapHidden = !heroHidden;
     const messagesHidden = s.messages.length === 0;
+    const statusHidden = !s.statusText && charThinkingHidden && charTalkingHidden;
     const actioned = s.stopHidden === hidden && s.replyActionsHidden === replyActionsHidden
-      && s.micHidden === micHidden && s.listeningHidden === listeningHidden && s.messagesHidden === messagesHidden
+      && s.micHidden === micHidden && s.listeningHidden === listeningHidden
+      && s.scrollAnchor === scrollAnchor && s.charThinkingHidden === charThinkingHidden
+      && s.charTalkingHidden === charTalkingHidden && s.heroHidden === heroHidden && s.messagesHidden === messagesHidden
+      && s.statusHidden === statusHidden && s.promptsGapHidden === promptsGapHidden
       ? s
-      : { ...s, stopHidden: hidden, replyActionsHidden, micHidden, listeningHidden, messagesHidden };
+      : { ...s, stopHidden: hidden, replyActionsHidden, micHidden, listeningHidden,
+          scrollAnchor, charThinkingHidden, charTalkingHidden, heroHidden, messagesHidden, statusHidden, promptsGapHidden };
     // The attachment projection rides the same exit, for the same reason: one
     // place that every action's result passes through, so no reducer can hand
     // back a stale copy of the chips. Seeded first, so the very first action of
@@ -3013,7 +3132,9 @@ export function createAriaChat(o: AriaChatOptions): AriaChatCore {
           // shown at once; a note carried over would say "Copied" beside an
           // answer from a different conversation that nobody copied.
           return leaving(await withWidgetItems({ ...s, status: "ready", _convId: resumeId, _siteId: site, _pending: "", statusText: "", error: "", copyNote: "",
-            messages: resumed, ...observed(raw, s.widget), prompts: promptsFor(resumed, promptList()) }));
+            messages: resumed, ...observed(raw, s.widget), prompts: promptsFor(resumed, promptList()),
+            // Transcript scroll — open a resumed conversation at its latest turn, pinning nothing.
+            ...openedAtLatest(s, resumed) }));
         } catch { /* expired or unreachable — fall through to a fresh one */ }
       }
       // Opening a screen runs `load` more than once — the bundle self-kicks at
@@ -3042,15 +3163,18 @@ export function createAriaChat(o: AriaChatOptions): AriaChatCore {
         // here, and a chip pack that localizes beside a greeting that does not
         // is the visible half of the same bug.
         const messages = isGreetingOnly(s.messages) ? greetingOnly() : withSpoken(s.messages);
-        return { ...s, status: "ready", messages, prompts: promptsFor(messages, promptList()) };
+        // Transcript scroll — a conversation rehydrated with no send token (state persisted
+        // before tokens existed) still opens at its latest turn.
+        const opened = s.scrollSend || isGreetingOnly(messages) ? {} : openedAtLatest(s, messages);
+        return { ...s, status: "ready", messages, prompts: promptsFor(messages, promptList()), ...opened };
       }
       try {
         return leaving({ ...s, status: "ready", _convId: await createOnce(site), _siteId: site, _pending: "", statusText: "",
-          messages: greetingOnly(), ...observed([]), prompts: promptList() });
+          messages: greetingOnly(), ...observed([]), prompts: promptList(), ...SCROLL_RESET });
       } catch (e) {
         // Even if create fails, show the greeting; submit retries the create.
         return leaving({ ...s, status: "ready", _convId: "", _siteId: site, _pending: "", ...failureSlots(e, unavailableText),
-          messages: greetingOnly(), ...observed([]), prompts: promptList() });
+          messages: greetingOnly(), ...observed([]), prompts: promptList(), ...SCROLL_RESET });
       }
     },
 
@@ -3142,11 +3266,11 @@ export function createAriaChat(o: AriaChatOptions): AriaChatCore {
         // previous one, which reads as ➕ having done nothing.
         turnSeq += 1;
         return slow({ ...s, ...retired, status: "ready", _convId: conversationIdOf(res), _siteId: site, input: "", statusText: "", error: "",
-          _pending: "", _abortId: "", _turnId: "", copyNote: "", messages: greetingOnly(), ...observed([]), prompts: promptList(), ok: false });
+          _pending: "", _abortId: "", _turnId: "", copyNote: "", messages: greetingOnly(), ...observed([]), prompts: promptList(), ok: false, ...SCROLL_RESET });
       } catch (e) {
         turnSeq += 1;   // see above — a failed create commits state too
         return slow({ ...s, ...retired, status: "ready", _convId: "", _siteId: site, input: "", ...failureSlots(e, unavailableText),
-          _pending: "", _abortId: "", _turnId: "", copyNote: "", messages: greetingOnly(), ...observed([]), prompts: promptList(), ok: false });
+          _pending: "", _abortId: "", _turnId: "", copyNote: "", messages: greetingOnly(), ...observed([]), prompts: promptList(), ok: false, ...SCROLL_RESET });
       }
     },
 

package/templates/yoga-studio-owner/tier5-src/_shared/aria-client-tools.ts

@@ -21,11 +21,16 @@
 //      * approval needs an explicit tap. Anything else — a dismissal, a host with
 //        nothing to ask with, a presenter that threw — is NOT consent; the first
 //        is answered as a refusal and the others as a failure, never as a yes.
-//      * NO remembered consent. The native app can auto-approve a `consentKey`
-//        it has seen approved in the same conversation. That is a convenience,
-//        and one that turns a single yes into a standing grant the agent can
-//        re-use on a different action under the same key. It has to be argued for
-//        on its own; it is not inherited here.
+//      * an approval is remembered exactly as the native Aria app remembers it,
+//        and no further: per conversation, keyed by the call's `consentKey`,
+//        approvals only (a refusal is asked again), held in memory only, with no
+//        expiry, and gone with the session that holds it. A call without a
+//        `consentKey` — or with an empty or blank one, where the native clients
+//        are laxer — is never remembered. A remembered approval is answered
+//        without asking and says so on the wire (`rememberedConsent: true`), so
+//        the agent can tell a fresh tap from a standing one. The memory itself
+//        is the caller's (`ConsentMemory`): this file reads and writes it, but
+//        what counts as "the same conversation" is the caller's to say.
 //      * the BUTTONS are ours. The agent may suggest `approveText`/`denyText`, and
 //        they are ignored: an approve button labelled "Cancel" is how a model that
 //        cannot forge the tap gets the owner to make it.
@@ -58,6 +63,26 @@ export interface ClientToolCall {
   params: Record<string, unknown>;
 }
 
+/** Approvals already given, by `consentKey`, in ONE conversation: the native
+ *  app's `ConsentPolicy`. The caller hands in the memory of the conversation the
+ *  call belongs to; this module never decides the scope. */
+export interface ConsentMemory {
+  /** Was `consentKey` approved earlier in this conversation? */
+  approved: (consentKey: string) => boolean;
+  /** Record an approval. Called only after an explicit Confirm. */
+  remember: (consentKey: string) => void;
+}
+
+/** The key a consent call can be remembered under, or `undefined` when it has
+ *  none. Both native clients accept any string here, the empty one included
+ *  (`params["consentKey"] as? String`). We do not: an empty or blank key names
+ *  no action at all, and remembering it would let one approval wave through
+ *  every later keyless-in-all-but-name request in the conversation. */
+export function consentKeyOf(call: ClientToolCall): string | undefined {
+  const k = call.params.consentKey;
+  return typeof k === "string" && k.trim() !== "" ? k : undefined;
+}
+
 /** What the host must provide to run the built-ins. Omit it and every call is
  *  answered "not found" — honest, and it unblocks the agent. */
 export interface AriaClientTools {
@@ -123,8 +148,14 @@ export function failedResult(call: { id?: string; name?: string }, message: stri
 
 /** The owner's answer. A refusal is still a SUCCESSFUL tool run — the tool's job
  *  was to ask, and it did; the model replies to the refusal. */
-export function consentResult(call: ClientToolCall, approved: boolean): FunctionCallResult {
-  return { ...addressOf(call), success: true, widgetResponse: JSON.stringify({ ...call.params, userConsent: approved }) };
+export function consentResult(call: ClientToolCall, approved: boolean, remembered = false): FunctionCallResult {
+  // `rememberedConsent` is written only when it is true, which is the native
+  // clients' exact payload: a fresh answer is byte-for-byte what it was before.
+  // It is OURS to set: one the agent put in the call's own arguments is dropped,
+  // so a fresh tap can never go out claiming to be a standing approval.
+  const { rememberedConsent: _agentSupplied, ...params } = call.params;
+  const payload = { ...params, userConsent: approved, ...(remembered ? { rememberedConsent: true } : {}) };
+  return { ...addressOf(call), success: true, widgetResponse: JSON.stringify(payload) };
 }
 
 export function knowledgeResult(call: ClientToolCall, userAgent: string): FunctionCallResult {
@@ -134,11 +165,21 @@ export function knowledgeResult(call: ClientToolCall, userAgent: string): Functi
 /** Answer ONE call. Never rejects: every outcome, including a host that threw,
  *  becomes a result the agent can read, because an unanswered call is a turn
  *  that never ends. */
-export async function answerClientTool(call: FunctionCall, host: AriaClientTools | undefined): Promise<FunctionCallResult> {
+export async function answerClientTool(
+  call: FunctionCall,
+  host: AriaClientTools | undefined,
+  memory?: ConsentMemory,
+): Promise<FunctionCallResult> {
   const parsed = parseClientToolCall(call);
   if (!parsed) return failedResult(call && typeof call === "object" ? call : {}, "arguments are not a JSON object");
   if (!host) return notFoundResult(parsed);
   if (parsed.toolId === CONSENT_TOOL) {
+    const key = consentKeyOf(parsed);
+    // The memory is checked before the owner is asked. A key approved earlier in
+    // this conversation is answered without a second question, as the native
+    // `ConsentCoordinator.request` does: it checks its policy first and returns
+    // `remembered: true` without showing anything.
+    if (key !== undefined && memory?.approved(key)) return consentResult(parsed, true, true);
     const message = typeof parsed.params.message === "string" ? parsed.params.message : "";
     let approved: boolean;
     try {
@@ -150,6 +191,10 @@ export async function answerClientTool(call: FunctionCall, host: AriaClientTools
     } catch (e) {
       return failedResult(parsed, `the owner could not be asked (${String((e as Error)?.message ?? e)})`);
     }
+    // Recorded the moment the owner taps Confirm, as the native coordinator's
+    // `resolve` records it: before the result is sent, so it holds even for a
+    // turn that is then abandoned. A refusal is never recorded; it is asked again.
+    if (approved && key !== undefined) memory?.remember(key);
     return consentResult(parsed, approved);
   }
   if (parsed.toolId === KNOWLEDGE_TOOL) {
@@ -182,6 +227,9 @@ export type ClientToolOutcome =
 
 export interface ClientToolExchange {
   host?: AriaClientTools;
+  /** The approvals of the conversation this exchange runs in. Omit it and every
+   *  consent is asked. */
+  memory?: ConsentMemory;
   /** The calls a response is waiting on — `functionCallsOf` from the chat client. */
   callsOf: (res: SendMessageResponse) => FunctionCall[];
   /** Send one round of results; resolves with the service's next response. */
@@ -222,7 +270,7 @@ export async function runClientToolExchange(first: SendMessageResponse, x: Clien
     if (!x.stillCurrent()) return "abandoned";
     if (calls.length > 1) throw clientToolError(`the assistant asked for ${calls.length} client tools at once`);
     if (rounds >= max) throw clientToolError(`the assistant asked for more than ${max} client tools in one turn`);
-    const result = await answerClientTool(calls[0], x.host);
+    const result = await answerClientTool(calls[0], x.host, x.memory);
     if (!x.stillCurrent()) return "abandoned";
     if (x.beforeSend) {
       await x.beforeSend();

package/templates/yoga-studio-owner/tier5-src/_shared/aria-row-id.ts

@@ -0,0 +1,14 @@
+// The id a message row carries, written ONCE for both halves of Aria: the screen
+// builder (aria-chat-screen.ts) stamps it on the row template as
+// `ariaMessageRowId(screenId, "$item.id")`, and the worker (aria-chat.ts) names the row
+// the screen's `transcriptScroll` should pin as `ariaMessageRowId(screenId, bubble.id)`.
+// A row renamed on one side and not the other would pin nothing, silently — so neither
+// side spells the format itself.
+//
+// Its own module, not a member of aria-chat.ts, because the screen builder runs on the
+// server that builds descriptors and must not pull the whole conversation machine (and
+// its SDK imports) in to read one template string.
+
+export function ariaMessageRowId(screenId: string, bubbleId: string): string {
+  return `${screenId}.msg_${bubbleId}`;
+}

package/templates/yoga-studio-owner/tier5-src/himi-owner-lite-aria/index.ts

@@ -186,6 +186,9 @@ const core = createAriaChat({
   // rejected by the descriptor validator, so omitting this is the correct
   // behaviour there and the card degrades to prose.
   subtree: { slotId: WIDGET_SUBTREE_SLOT, service: SERVICE },
+  // Transcript scroll: names the row the transcript scroll pins on a send. Must be the
+  // descriptor's screen id — the row ids are `<screenId>.msg_<bubble id>`.
+  screenId: "himi_owner_lite_aria",
   greeting: () => copyParam(
     "ownerAria.greeting",
     "Hi, I'm Aria, your business and web design expert.\nI'm here to help you complete tasks, answer questions, create content and guide you to useful features.",