asystant_core 0.6.0

Typed local tools, protocol models and the OpenRouter and Claude Code providers for embedded assistants.

0.6.0

• Business APIs (business/, pure Dart): typed contracts of administrative APIs that an assistant can register and operate.
  • BusinessContract with dev/prod BusinessEndpoints and BusinessOperations whose BusinessFields are typed (BusinessFieldKind) and located (BusinessFieldLocation: path, query, body or header). BusinessContract.parse reads untrusted JSON into a Result; validateContract() checks addresses, headers, sign-in, profiles and operations.
  • Sign-in as data: BusinessAuthFlow lists BusinessAuthSteps (request, verify, password, totp, refresh) with the BusinessAuthInputs the person types (email, password, code, totp, text), fixed editable parameters (such as company_id and application_id), headers, the token path in the answer and renewal. Named constructors build the common flows (bearer, apiKey, emailCode, emailCodeTotp, emailPassword, emailPasswordTotp, aulaMasOperator, sstOperator).
  • Several BusinessCredentialProfiles per environment (for example admin and guest), each with its own session, keyed by BusinessCredentialScope.
  • BusinessSignIn runs a flow through a BusinessSignInPrompter and renews a session once at a time per scope; BusinessExecutor runs an operation, renews once on 401 and redacts the answer (BusinessRedaction).
  • Interfaces for the host: BusinessHttp (default BusinessHttpClient over package:http), BusinessCredentialStore and BusinessContractStore. Failures are BusinessFailure values, never exceptions.
  • Source documents: BusinessDocument keeps the document a business was registered from (such as its endpoints .md), BusinessDocumentStore stores one per business (InMemoryBusinessDocumentStore by default), and BusinessDocumentReading splits it at its Markdown headings and returns the sections that match a query, ranked by AsystantKnowledge and cut to a size.
  • Compatibility: BusinessEndpoint.fromJson also reads the first contract format, whose flat auth_kind and routes BusinessAuthFlow.fromLegacyJson turns into a flow.

0.5.2

• PrivateInputField.initialValue: pre-fills a private input field (its own last value, or a known public default). Never applies to PrivateInputKind.secret, .password, .code or .totp.
• Add PrivateInputKind.email: entered in clear like text, with an email keyboard, and pre-filled from initialValue. Exhaustive switches over PrivateInputKind need the new case.

0.5.1

• Add ToolContext.requestPrivateInput with typed, ephemeral fields for local tools. Values are returned only to the tool.

0.5.0

• Extend AsystantAttachmentPolicy with MIME types and host-supplied regular expressions for file names and text content.

0.4.0

• Add OpenAICompatibleProvider for user-supplied HTTPS Chat Completions endpoints. It shares the streaming and tool-call codec with OpenRouter while omitting OpenRouter-only request fields and metadata paths.
• Allow OpenRouterTransport to run in compatibility mode with an explicit preferred model; streamed inference requests do not follow redirects.

0.3.1

• Add ToolField.acceptsSecret to declare the only fields eligible for a private chat reference during local execution.
• Add an opt-in credential-content guard to AsystantAttachmentPolicy and a sensitiveContent attachment issue.

0.3.0

• ToolContext.reportProgress(fraction, label: ...): a long tool reports how far it has come (0 to 1, clamped; non-finite values ignored) with an optional short label for the person. The context forwards it to an optional onProgress (ToolProgressListener) given by whoever runs the tool; it never reaches the model and does nothing once the call is canceled.
• Local knowledge (RAG): AsystantKnowledge, a local index of KnowledgeDocuments (id, title, text, optional collection, tags and metadata) with put (add or replace by id), putAll, remove and clear. It ranks with BM25 over title, tags and text, normalized for Spanish and English (lower case, accents folded, stop words of both languages, light plural and gender stemming, prefix matching for query words of four letters or more), filters by collection and tags, and returns KnowledgeHits with the most relevant passage instead of the whole document. toJson / fromJson save and restore it; the app decides where. Lexical by design: no service, model or dependency, and deterministic.
• KnowledgeRetriever: the contract the search tool and apps depend on (search(KnowledgeQuery), collections), so a semantic or hybrid retriever can replace the lexical index later without changing the apps.
• KnowledgeSearchTool: an optional built-in, read-only tool (search_knowledge by default, configurable) that the model calls with query, an optional collection and limit, and that answers with compact JSON: id, title, collection, score and snippet per hit. It works the same with every provider.
• ToolOutcome.images: a tool can return images (PNG, JPEG, GIF, WebP bytes as AsystantAttachments) for the model to look at, such as a rendered frame for visual self-review. They are kept as the attachments of the tool's result message, next to the person's own attachments.
• AssistantTransport.supportsImageInput(model): a provider-neutral capability, false by default. A transport that cannot send images sends AsystantAttachment.imageUnavailableNote instead. Custom transports that send images override it.
• OpenRouterTransport: a tool's images follow its results as one user message after the last consecutive tool result, labelled with the call_id, because OpenRouter only accepts text in tool messages. Images for a model without image input are sent as the note.
• ClaudeCliTransport: stdin is now one --input-format stream-json user message, the transcript followed by base64 image blocks, so the person's images and a tool's images reach the model; previously images were only announced by name. ClaudeCliProtocol.input builds it. Tools, context, endsTurn, cancellation and the isolation flags are unchanged.
• ToolOutcome.endsTurn: a tool can end the person's turn (for example, a product approval that only the person can answer). The chat does not call the model again and answers the other calls of that response without running them.
• ToolOutcome.summary (a one-line account of what was done, shown instead of the preview title once the tool completes) and ToolOutcome.data (structured result for the host, never sent to the model).
• ToolField.options declares the accepted values of a string (schema enum), and ToolFieldKind.objects with ToolField.fields declares a list of objects with their own fields. Both providers send them in the tool schema.
• ToolRegistry.resolve explains what is wrong in the failure detail (unknown tool with the available ones, missing or unexpected argument, wrong type, a value outside its options), and treats null for an optional argument as absent.
• AssistantTransport.infer receives tools, the tools available for that request; both providers declare those instead of the ones registered at initialize when given. Custom transports must add the parameter.
• OpenRouterTransport replaces the former GatewayTransport and SessionSource: the host supplies an OpenRouterCredentialSource (for example a budget-limited key issued by asystant-api) and the transport talks to OpenRouter directly.
• Security: a cached OpenRouter key is bound to the identity it was issued for; after a login change the transport requests a new key instead of reusing the previous user's.
• ClaudeCliTransport: a desktop transport over the local Claude Code CLI, using the user's subscription without an API key. Tools are declared in the system prompt and returned as regular ToolCalls; the CLI's own tools, MCP servers and user customizations are disabled. Compiles on the web, where it reports the platform as unsupported.
• Providers: the sealed AsystantProvider, with OpenRouterProvider and ClaudeCodeProvider, is how an assistant chooses where answers come from. Each variant implements createTransport(); verify() and modelCatalog() work for any provider. Each provider lives in src/providers/<name>/ with everything it needs; adding one changes no other provider or common code (see "Adding a provider" in docs/public-api.md). Public imports are unchanged.
• AssistantTransport.verify() and AssistantTransport.modelCatalog(), with defaults that report them as unsupported, return the provider-neutral AsystantProviderStatus and AsystantModelCatalog.
• ClaudeCodeProvider / ClaudeCliTransport: verify() runs claude --version and claude auth status --json (no inference) and reports version, sign-in and plan, never the email; modelCatalog() reads the models and effort levels from claude --help, falling back to ClaudeCliCatalog.bundled. With no models, initialize offers that catalog (ClaudeCliTransport.defaultModels is replaced by ClaudeCliCatalog.bundledModels). New defaultModel. The CLI runs with its own directory first on PATH, so an npm install finds node from a Finder-launched app.
• ClaudeCliLauncher.run runs short commands that send no prompt; custom launchers must implement it.
• OpenRouterProvider / OpenRouterTransport: verify() checks the key with GET /api/v1/key (no inference); modelCatalog() lists the credential's allowed models.

0.2.0

• Deferred Flutter initialization: init() stores configuration; the mounted chat connects after its first frame. Headless clients await ensureInitialized() explicitly.
• Injectable application/context prompts and baseline safety guidance in SDK and gateway.
• Typed genUI bar/line charts, bounded numeric tool arguments and English golden previews.
• Initialization retry, concurrent setup deduplication and lifecycle cleanup.

0.1.0

• Initial MIT-licensed release.
• Typed local tools, explicit permissions and cancellation-aware execution.
• Session-backed gateway authentication and server-assigned model policies.
• English examples and integration guidance for the reference Rust API.
• Flutter-independent models, transport contracts and SSE gateway client.