voicebot_flutter 0.2.1

Drop-in voice and text store assistant for Flutter apps. The same VoiceBot assistant that runs as the web widget, native in your app over WebSocket + PCM16.

0.2.1

CI/CD + pub.dev OIDC automated publishing; pubspec metadata (homepage/repository) + api base -> api.monoverse.tech.

Store compliance (VOIC-52 / T9).

• Added docs/STORE_SUBMISSION.md — copy-paste App Store + Play Store checklist for merchants embedding the SDK (mic string, privacy manifest, Apple 5.1.2 third-party-AI disclosure, export/encryption, RECORD_AUDIO, Play Data safety, GenAI policy, foreground-only note).
• ios/Resources/PrivacyInfo.xcprivacy now declares NSPrivacyCollectedDataTypeAudioData (App Functionality, not linked, not tracking). Native code audited: no required-reason APIs used (flutter_secure_storage uses the Keychain, which is not a required-reason API and ships its own manifest), so NSPrivacyAccessedAPITypes stays empty. README + example mic string aligned to the third-party-AI disclosure.

0.2.0

Auth model corrected to web-parity + Mode B + context enrichment (VOIC-44 / VOIC-49).

• Auth (breaking): MobileIssueTokenProvider (Mode A) now signs with the EXACT PROTOCOL §1 canonical preimage HMAC_SHA256(secret, "{METHOD}\n{path}\n{ts}\n{nonce}\n{sha256hex(body)}").hex() and sends X-VoiceBot-{Tenant-Id,Timestamp,Nonce,Signature} + X-VoiceBot-App-Id (timestamp = epoch seconds). The default signer is now the real HMAC-SHA256 (crypto added as a direct dep); still injectable for hardware-key delegation. AppCredential reshaped to {tenantId, appId, sharedSecret} (mirror the web key). JsonPoster.body is now List<int> (raw signed bytes).
• Auth — Mode B: new PublishableKeyTokenProvider calling POST /api/v1/mobile/issue-token-public with {api_key:"vb_pk_…", app_id, attestation?, lang?}.
• Context enrichment (no backend change): session.updateContext(AppContext) → client_context frame and session.sendCartEvent(CartEvent) → cart_event frame (PROTOCOL §10). New zero-PII AppContext (screen/route/product/category/locale/custom) and CartEvent / CartLineItem types. Retained context auto-re-sends on resume.
• New exported HMAC helpers: buildSignaturePreimage, computeSignature, defaultHmacSigner, IssueTokenSigner.
• README rewritten into a full SDK landing page; tests expanded to 55.

0.1.0

First milestone (VOIC-43 / VOIC-44 / VOIC-46 / VOIC-48): headless core + text path

• native-audio scaffolding.

• Headless core: VoicebotClient.init, VoicebotSession sealed state machine (connecting → ready → streaming → reconnecting → ended/failed).
• WsTransport ported from the web widget ws-client.ts: exponential backoff, ~25s heartbeat ping, fatal-close-code set {4400, 4401, 4403, 4503, 1008, 1011}, reconnect capped at 3 attempts (VOIC-44 AC).
• Protocol codec for all docs/PROTOCOL.md envelopes (user_text, action_ack, binary uplink; ready / session_state / transcript / turn_complete / barge_in / tool_call / action / error inbound).
• ToolHandlerRegistry with registerToolHandler + registerDeepLinkMap; unregistered tool auto-replies {success: false, error: "no_handler"}.
• AudioSource engine-agnostic PCM16 in/out interface (VOIC-44 boundary) plus a native PlatformAudioSource backed by AVAudioEngine (iOS) / AudioRecord (Android).
• Lifecycle: minimize() (UI-only, keeps WS) vs endSession() (sends end, tears down).
• Stream-based events: transcripts, audio state, tool calls, actions, status, errors.
• Native scaffolding: iOS Swift (AVAudioEngine + AVAudioConverter + .voiceChat AEC, 24 kHz scheduled-buffer playback, interruption/route observers) and Android Kotlin (AudioRecord VOICE_COMMUNICATION + AcousticEchoCanceler, AudioTrack 24 kHz, audio-focus/device callbacks). Device-tuning TODOs marked inline.