@xema/omni-protocol 0.1.50 → 0.1.52

package/dist/validation.js

@@ -956,6 +956,12 @@ function validateTaskInto(task, context, path, into) {
     validateTaskAttributes(task.attributes, `${path}.attributes`, into);
     validateHandlingHistory(task.handlingHistory, `${path}.handlingHistory`, into);
     validateOnCall(task.onCall, context.channel, `${path}.onCall`, into);
+    // The room is who is on the call now, and a task outlives its call by the whole of wrap-up: a
+    // task whose call has ended -- completing, or media ended -- carries nobody, or the last thing the
+    // wire said about the call stays true for ever. Empty and absent both say nobody.
+    if (Array.isArray(task.onCall) && task.onCall.length > 0 && (task.phase === "completing" || task.media === "ended")) {
+        into.add("task.onCall.ended", `${path}.onCall`, `the call has ended (${task.phase === "completing" ? "the task is completing" : "its media ended"}) and onCall still names people on it: the room is who is on the call now, and now nobody is`);
+    }
     validateTaskMedia(task.media, context.channel, `${path}.media`, into);
     validateLeadAssist(task.leadAssist, context.channel, `${path}.leadAssist`, into);
     validateAssisting(task.assisting, context.channel, `${path}.assisting`, into);
@@ -1796,6 +1802,16 @@ export function validateTaskCommand(command, task, path = "command") {
     }
     if (!isPlainObject(task))
         return into.violations;
+    // The task the command is held to has to be one the wire published. A host's own mapping of it,
+    // handed in for want of the original, is not, and checking a command against it would be
+    // checking against a task nobody has -- so the task is validated first, and a command is held
+    // only to a task that stands.
+    const published = new Collector();
+    validateTaskInto(task, { channel: channel ?? "voice" }, `${path}.task`, published);
+    if (published.violations.length > 0) {
+        into.add("command.task", `${path}.task`, `the task the command is held to is not one the wire published (${published.violations.map(v => v.rule).join(", ")}): pass the task as the provider sent it, or validate the command's shape alone`);
+        return into.violations;
+    }
     // What the task has to offer or be in for the command to be issuable.
     const capabilities = isPlainObject(task.capabilities) ? task.capabilities : {};
     const offered = (name) => {

package/guide.md

@@ -2994,6 +2994,26 @@ the platform added itself carries none. `held: true` is presence as claim. A sna
 after a transfer reads the room from here rather than inferring it from a sequence of outcomes it
 never saw.
 
+**`onCall` is who is on the call now, and a task outlives its call.** Wrap-up is not an ending:
+the task is alive, the agent is working, and nothing arrives to say the call ended until they
+dispose. So the room must not be the last word about a call that has ended. Once the call is over
+-- the task `completing`, or its `media` ended -- `onCall` is empty, or absent only where the
+provider never publishes the room at all, and a task carrying people on a call that has ended is
+refused (`task.onCall.ended`). Empty says nobody is on the call; absent says the provider does not
+say who is, which is a different claim, so a provider that publishes the room publishes one last
+change: the empty room.
+
+**A field that describes the present is cleared by the transition that ends it.** `onCall`,
+`previewEndsAt` and `atDeadline` are three instances of one shape, and there will be more: each
+describes a state that is true now, and each is carried past the moment it stops being true by the
+most natural implementation there is, building the next task by spreading the last one. The
+provider's own state looks right, the claim on the wire is stale, and only the host sees it. An
+adapter that builds each transition from what is true after it, rather than from what was true
+before, needs none of these rules named. Two agents were
+once shown on calls for the better part of an hour while callers queued, because the last message
+describing the room live was never followed by one saying it had emptied, and every consumer that
+derived anything from it was wrong in a way that looked like its own bug.
+
 **A dialled entry is listed from the moment the dial is placed, not from the answer.** The entry is
 what makes `transfer` `cancel` issuable and what `conference` `remove` names, and a destination the
 agent cannot call off while it rings is a parked customer with no way back -- which is the very case
@@ -3887,7 +3907,13 @@ declared:
 | Everything else | Its own named capability. |
 
 `validateTaskCommand(command, task)` holds a command to this table at runtime, both ways: the
-capability it needs, the phase it belongs to, and the state that has to stand.
+capability it needs, the phase it belongs to, and the state that has to stand. The task it wants
+is the one the provider published, not a host's own mapping of it: a host that keeps only its
+mapped shape has nothing honest to pass, and then checks shape alone, which is still worth doing
+-- it names a command the wire never had -- but is not the table. Keeping the published task
+beside the mapped one is what the full check costs a host; an adapter has it for free. The
+validator holds a command only to a task that stands: a task handed in that is not one the wire
+published is named (`command.task`) rather than checked against.
 
 Declining or rejecting a pending offer ends it without accepting or completing it. The provider
 confirms the end with `task-ended` and a `cancelled` outcome.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@xema/omni-protocol",
-  "version": "0.1.50",
+  "version": "0.1.52",
   "description": "The Omni protocol: the contract every provider adapter implements",
   "type": "module",
   "license": "MIT",