@ateam-ai-mobile/expo 0.1.19 → 0.1.21

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@ateam-ai-mobile/expo",
-  "version": "0.1.19",
-  "description": "Expo-backed providers for the ADAS SDK — haptics, bundle disk cache, attachment cache, device bridge.",
+  "version": "0.1.21",
+  "description": "Expo-backed providers for the ADAS SDK \u2014 haptics, bundle disk cache, attachment cache, device bridge.",
   "main": "dist/index.js",
   "types": "dist/index.d.ts",
   "scripts": {
@@ -9,9 +9,9 @@
     "build": "tsup"
   },
   "dependencies": {
-    "@ateam-ai-mobile/core": "0.1.19",
-    "@ateam-ai-mobile/plugin-runtime": "0.1.19",
-    "@ateam-ai-mobile/ui": "0.1.19",
+    "@ateam-ai-mobile/core": "0.1.21",
+    "@ateam-ai-mobile/plugin-runtime": "0.1.21",
+    "@ateam-ai-mobile/ui": "0.1.21",
     "zustand": "^5.0.0"
   },
   "peerDependencies": {
@@ -40,7 +40,8 @@
     "expo-task-manager": "*",
     "expo-web-browser": "*",
     "react": ">=18",
-    "react-native": "*"
+    "react-native": "*",
+    "@react-native-firebase/messaging": "*"
   },
   "peerDependenciesMeta": {
     "@react-native-google-signin/google-signin": {
@@ -99,6 +100,9 @@
     },
     "expo-modules-core": {
       "optional": true
+    },
+    "@react-native-firebase/messaging": {
+      "optional": true
     }
   },
   "exports": {
@@ -132,6 +136,12 @@
       "import": "./dist/vision/index.mjs",
       "require": "./dist/vision/index.js"
     },
+    "./ai-live": {
+      "react-native": "./src/aiLive/provider.ts",
+      "types": "./dist/aiLive/provider.d.ts",
+      "import": "./dist/aiLive/provider.mjs",
+      "require": "./dist/aiLive/provider.js"
+    },
     "./maps": {
       "react-native": "./src/maps/index.ts",
       "types": "./dist/maps/index.d.ts",
@@ -161,6 +171,18 @@
       "types": "./dist/capabilities/index.d.ts",
       "import": "./dist/capabilities/index.mjs",
       "require": "./dist/capabilities/index.js"
+    },
+    "./push": {
+      "react-native": "./src/push/index.ts",
+      "types": "./dist/push/index.d.ts",
+      "import": "./dist/push/index.mjs",
+      "require": "./dist/push/index.js"
+    },
+    "./silent-push": {
+      "react-native": "./src/push/silentSync.ts",
+      "types": "./dist/push/silentSync.d.ts",
+      "import": "./dist/push/silentSync.mjs",
+      "require": "./dist/push/silentSync.js"
     }
   },
   "module": "dist/index.mjs",

package/src/aiLive/provider.ts

@@ -0,0 +1,242 @@
+/**
+ * The AI live provider: this phone's camera → the workspace's live session → the chosen AI,
+ * and what the AI saw back to the screen. Installed by the host once at startup:
+ *   import { createAiLiveProvider } from '@ateam-ai-mobile/expo/ai-live';
+ *   setAiLiveProvider(createAiLiveProvider());
+ * A plugin reaches it only through props.aiLive,
+ * whose gate (plugin-runtime aiLiveHost) has already checked the two-sided consent.
+ *
+ * One camera, one sender: while one screen sends, another's start() is refused by name.
+ *
+ * start():
+ *  1. the live session: reuse the one running (an admin may have started it on the AI Models
+ *     page) or start one for the phone with a capped money slice (PHONE_SLICE_USD), and remember
+ *     that this phone started it, so stop() ends only what it began;
+ *  2. the camera: the screen's held visual session on the requested camera;
+ *  3. Core's stream endpoint (/ws/stream, kind "ai-models.live"), the login in the subprotocol;
+ *  4. once Core says "opened": one picture per slot at the TESTED rate and size (the session's
+ *     `camera`), from the newest fresh frame, as a JPEG made by native (jpegById). A slot with no
+ *     fresh frame, or while the socket is still busy, sends nothing and still takes its sequence
+ *     number, so Core reports it as a gap;
+ *  5. {"event":"episode"} from Core → the screen's onEpisode callbacks.
+ */
+import { getCoreWsUrl, getTenant, getToken, mcpToolCall, unwrapMcpResult } from '@ateam-ai-mobile/core';
+import type { AiLiveEpisode, AiLiveProvider, AiLiveSnapshot, AiLiveStartOptions, DeviceState, Subscription } from '@ateam-ai-mobile/plugin-runtime';
+import { jpegById as nativeJpegById } from '../vision';
+import { CLOSE_MESSAGE, STREAM_PATH, SUBPROTOCOL, base64ToBytes, describeClose, encodeFrame, openMessage, parseServerEvent } from './streamProtocol';
+
+/** The most one phone session may spend (owner decision 2026-10-29), held from the AI Models budget. */
+export const PHONE_SLICE_USD = 0.5;
+export const LIVE_KIND = 'ai-models.live';
+/** A frame older than this is not "what the camera sees now" and is not sent. */
+const FRESH_MS = 3000;
+/** Bytes still waiting in the socket above which a slot is skipped rather than queued. */
+const MAX_BUFFERED = 512 * 1024;
+const DEFAULT_CAMERA = { fps: 1, maxPx: 768 };
+
+type Visual = DeviceState['visual'];
+
+export interface AiLiveDeps {
+  callCp(method: string, params?: Record<string, unknown>): Promise<any>;
+  WebSocketImpl: any;
+  wsBase(): string;
+  token(): string | null;
+  tenant(): string | null;
+  jpegById(id: string, maxSide: number, quality: number): Promise<string>;
+  now(): number;
+  setInterval(fn: () => void, ms: number): any;
+  clearInterval(handle: any): void;
+}
+
+const SESSION_UP = new Set(['starting', 'running', 'degraded']);
+
+async function defaultCallCp(method: string, params: Record<string, unknown> = {}): Promise<any> {
+  const res = await mcpToolCall('cp.ai_models_api', { method, params });
+  if (res?.error) throw new Error(res.error.message || 'AI Models refused the request');
+  const out = unwrapMcpResult(res?.result);
+  if (res?.result?.isError) throw new Error(typeof out === 'string' ? out : out?.message || out?.error || 'AI Models refused the request');
+  if (out && typeof out === 'object' && out.ok === false) throw new Error(out.message || out.error || 'AI Models refused the request');
+  return out;
+}
+
+export const defaultAiLiveDeps = (): AiLiveDeps => ({
+  callCp: defaultCallCp,
+  WebSocketImpl: (globalThis as any).WebSocket,
+  wsBase: getCoreWsUrl,
+  token: getToken,
+  tenant: getTenant,
+  jpegById: nativeJpegById,
+  now: Date.now,
+  setInterval: (fn, ms) => setInterval(fn, ms),
+  clearInterval: (h) => clearInterval(h),
+});
+
+const idle = (): AiLiveSnapshot => ({ state: 'idle', camera: null, sent: 0, skipped: 0, lastEpisode: null, lastError: null });
+
+export function createAiLiveProvider(overrides: Partial<AiLiveDeps> = {}): AiLiveProvider {
+  const deps: AiLiveDeps = { ...defaultAiLiveDeps(), ...overrides };
+  let owner: string | null = null;           // the screen sending now
+  let snap: AiLiveSnapshot = idle();
+  let ws: any = null;
+  let loop: any = null;
+  let visual: Visual | null = null;
+  let startedSession = false;                 // this phone started the live session, so it stops it
+  let closingOnPurpose = false;
+  let seq = 0;
+  let busy = false;
+  // Which session a slot belongs to. A slot awaits the camera and the JPEG maker; when the screen
+  // stops (or another starts) meanwhile, that slot's picture must go nowhere, not into the next one.
+  let gen = 0;
+  let lastFrameId: string | null = null;
+  let camera = DEFAULT_CAMERA;
+  let lastOwner: string | null = null;      // whose the current snapshot is (it outlives a stop)
+  // Each screen hears only its own session: callbacks are kept per holder.
+  const episodeCbs = new Map<string, Set<(ev: AiLiveEpisode) => void>>();
+  const snapCbs = new Map<string, Set<(s: AiLiveSnapshot) => void>>();
+  const sendingCbs = new Set<() => void>();
+  let wasSending = false;
+  const add = <T>(m: Map<string, Set<T>>, who: string, cb: T): Subscription => {
+    let set = m.get(who);
+    if (!set) { set = new Set(); m.set(who, set); }
+    set.add(cb);
+    return { unsubscribe: () => { set!.delete(cb); } };
+  };
+
+  const set = (patch: Partial<AiLiveSnapshot>) => {
+    snap = { ...snap, ...patch };
+    for (const cb of (lastOwner && snapCbs.get(lastOwner)) || []) { try { cb(snap); } catch { /* a listener's error is its own */ } }
+    const sending = snap.state === 'starting' || snap.state === 'sending';
+    if (sending !== wasSending) { wasSending = sending; for (const cb of sendingCbs) { try { cb(); } catch { /* idem */ } } }
+  };
+
+  function stopTimers() {
+    if (loop != null) { deps.clearInterval(loop); loop = null; }
+  }
+
+  async function slot() {
+    const mySeq = seq++;                        // every slot takes a number, sent or not
+    const g = gen;
+    const sock = ws;
+    const current = () => g === gen && ws === sock && sock?.readyState === 1;
+    if (busy || !current()) { set({ skipped: snap.skipped + 1 }); return; }
+    if ((sock.bufferedAmount || 0) > MAX_BUFFERED) { set({ skipped: snap.skipped + 1 }); return; }
+    busy = true;
+    try {
+      const v = await visual!.getSnapshot();
+      if (!current()) return;
+      const f: any = v?.latest;
+      const id = f?.handle?.id;
+      const t = Number(f?.timestamp);
+      if (!id || id === lastFrameId || !(deps.now() - t < FRESH_MS)) { set({ skipped: snap.skipped + 1 }); return; }
+      const b64 = await deps.jpegById(id, camera.maxPx, 0.7);
+      if (!current()) return;
+      const frame = encodeFrame({ seq: mySeq, tCapture: t, payload: base64ToBytes(b64) });
+      sock.send(frame.buffer);
+      lastFrameId = id;
+      set({ sent: snap.sent + 1 });
+    } catch (e: any) {
+      if (g === gen) set({ skipped: snap.skipped + 1, lastError: String(e?.message || e) });
+    } finally {
+      if (g === gen) busy = false;
+    }
+  }
+
+  function openSocket(): Promise<void> {
+    return new Promise((resolve, reject) => {
+      const token = deps.token();
+      const tenant = deps.tenant();
+      if (!token || !tenant) { reject(new Error('not signed in to a workspace')); return; }
+      const url = `${deps.wsBase()}${STREAM_PATH}?tenant=${encodeURIComponent(tenant)}`;
+      let opened = false;
+      const sock = new deps.WebSocketImpl(url, [SUBPROTOCOL, `adas.bearer.${token}`]);
+      ws = sock;
+      sock.binaryType = 'arraybuffer';
+      sock.onopen = () => { try { sock.send(openMessage(LIVE_KIND)); } catch (e) { reject(e); } };
+      sock.onmessage = (m: any) => {
+        const ev = parseServerEvent(m?.data);
+        if (!ev) return;
+        if (ev.event === 'opened' && !opened) { opened = true; resolve(); return; }
+        if (ev.event === 'episode' && ev.data && typeof ev.data === 'object') {
+          const episode = ev.data as AiLiveEpisode;
+          set({ lastEpisode: episode });
+          for (const cb of (owner && episodeCbs.get(owner)) || []) { try { cb(episode); } catch { /* a listener's error is its own */ } }
+        }
+      };
+      sock.onerror = () => { /* the close that follows says why */ };
+      sock.onclose = (c: any) => {
+        const why = describeClose(Number(c?.code), c?.reason);
+        if (!opened) { reject(new Error(why)); return; }
+        if (closingOnPurpose || ws !== sock) return;
+        void teardown('error', why);
+      };
+    });
+  }
+
+  async function teardown(state: 'stopped' | 'error', lastError: string | null) {
+    const hadSession = startedSession;
+    startedSession = false;
+    gen++;
+    stopTimers();
+    const sock = ws;
+    ws = null;
+    closingOnPurpose = true;
+    try { if (sock && sock.readyState === 1) sock.send(CLOSE_MESSAGE); } catch { /* closing anyway */ }
+    try { sock?.close?.(); } catch { /* already closed */ }
+    closingOnPurpose = false;
+    const v = visual;
+    visual = null;
+    try { await v?.stop?.(); } catch { /* the camera hold is released by the gate too */ }
+    if (hadSession) { try { await deps.callCp('liveStop'); } catch { /* the session ends by itself when no picture arrives */ } }
+    owner = null;
+    set({ state, lastError });
+  }
+
+  return {
+    async start(opts: AiLiveStartOptions, who: string, ctx: { visual: Visual }) {
+      if (owner && owner !== who) throw Object.assign(new Error('aiLive: another screen is sending to AI right now. Close it first.'), { code: 'CONFLICT' });
+      if (owner === who) return snap;
+      const cam = opts?.camera === 'front' ? 'front' : 'back';
+      if (opts?.camera && opts.camera !== 'front' && opts.camera !== 'back') throw new Error(`aiLive: unknown camera "${String(opts.camera)}" — use "front" or "back"`);
+      owner = who;
+      lastOwner = who;
+      visual = ctx.visual;
+      gen++; seq = 0; lastFrameId = null; busy = false;
+      snap = { ...idle(), camera: cam };
+      set({ state: 'starting' });
+      try {
+        let session = (await deps.callCp('liveStatus'))?.session;
+        if (!SESSION_UP.has(session?.state)) {
+          session = (await deps.callCp('liveStart', { source: 'phone', budgetSliceUsd: PHONE_SLICE_USD }))?.session;
+          startedSession = true;
+        }
+        const c = session?.camera;
+        camera = c && Number(c.fps) > 0 && Number(c.maxPx) > 0 ? { fps: Number(c.fps), maxPx: Number(c.maxPx) } : DEFAULT_CAMERA;
+        await visual.start({ intent: 'stream', facing: cam } as any);
+        await openSocket();
+        loop = deps.setInterval(() => { void slot(); }, Math.max(200, Math.round(1000 / camera.fps)));
+        set({ state: 'sending' });
+        return snap;
+      } catch (e: any) {
+        await teardown('error', String(e?.message || e));
+        throw e;
+      }
+    },
+    async stop(who: string) {
+      if (owner !== who) return;
+      await teardown('stopped', null);
+    },
+    getSnapshot: (who: string) => (lastOwner === who ? snap : idle()),
+    onEpisode: (cb, who) => add(episodeCbs, who, cb),
+    subscribe: (cb, who) => add(snapCbs, who, cb),
+    forget(who: string) {
+      episodeCbs.delete(who);
+      snapCbs.delete(who);
+      if (lastOwner === who && owner === null) { lastOwner = null; snap = idle(); }
+    },
+    isSending: () => snap.state === 'starting' || snap.state === 'sending',
+    subscribeSending(cb) {
+      sendingCbs.add(cb);
+      return { unsubscribe: () => { sendingCbs.delete(cb); } } as Subscription;
+    },
+  };
+}

package/src/aiLive/streamProtocol.ts

@@ -0,0 +1,90 @@
+/**
+ * The wire protocol of Core's binary stream endpoint (/ws/stream), for the AI live sender.
+ *
+ * A PORT of Core's `packages/media-stream/src/index.js` (@ateam-ai/media-stream, not on npm
+ * yet), limited to what a sender needs. The frame bytes are pinned by
+ * tests/aiLiveStreamProtocol.test.mjs against the layout that file documents, so a drift is
+ * a red test, not a silent mismatch. DEAD — replace with an import of @ateam-ai/media-stream
+ * once Core publishes it.
+ *
+ * Frame envelope (bytes): 0 version (1) · 1 flags · 2-5 seq uint32 BE (one per sampling slot
+ * of the SENDER, taken or skipped) · 6-13 tCapture float64 BE (ms since the epoch) · 14- payload.
+ */
+export const STREAM_PATH = '/ws/stream';
+export const SUBPROTOCOL = 'adas.v1';
+export const HEADER_BYTES = 14;
+const ENVELOPE_VERSION = 1;
+
+export const CLOSE = Object.freeze({
+  AUTH_MISSING: 4001,
+  AUTH_FAILED: 4002,
+  NO_SUCH_WORKSPACE: 4003,
+  NOT_ENTITLED: 4004,
+  BAD_REQUEST: 4400,
+  UNKNOWN_KIND: 4404,
+  TIMEOUT: 4408,
+  OVER_LIMIT: 4429,
+  TOO_BIG: 1009,
+  CONSUMER_FAILING: 1011,
+});
+
+export function encodeFrame({ seq, tCapture, payload }: { seq: number; tCapture: number; payload: Uint8Array }): Uint8Array {
+  const out = new Uint8Array(HEADER_BYTES + payload.length);
+  const v = new DataView(out.buffer);
+  v.setUint8(0, ENVELOPE_VERSION);
+  v.setUint8(1, 0);
+  v.setUint32(2, seq >>> 0, false);
+  v.setFloat64(6, tCapture, false);
+  out.set(payload, HEADER_BYTES);
+  return out;
+}
+
+export function openMessage(kind: string): string {
+  return JSON.stringify({ type: 'open', kind });
+}
+
+export const CLOSE_MESSAGE = JSON.stringify({ type: 'close' });
+
+/** A server text frame → { event, data }, or null for anything that is not an event. */
+export function parseServerEvent(text: unknown): { event: string; data: any } | null {
+  if (typeof text !== 'string') return null;
+  try {
+    const m = JSON.parse(text);
+    return m && typeof m.event === 'string' ? { event: m.event, data: m.data } : null;
+  } catch {
+    return null;
+  }
+}
+
+const WHY: Record<number, string> = {
+  [CLOSE.AUTH_MISSING]: 'The login or the workspace was missing. Sign in again and try once more.',
+  [CLOSE.AUTH_FAILED]: 'The login was refused. Sign in again and try once more.',
+  [CLOSE.NO_SUCH_WORKSPACE]: 'This workspace was not found.',
+  [CLOSE.NOT_ENTITLED]: 'This workspace may not stream right now.',
+  [CLOSE.TIMEOUT]: 'The connection to the AI timed out.',
+  [CLOSE.OVER_LIMIT]: 'Too many cameras are sending to this workspace. Stop another one first.',
+  [CLOSE.TOO_BIG]: 'A picture was too big to send.',
+  [CLOSE.CONSUMER_FAILING]: 'The AI stopped taking pictures. Check the live session in AI Models.',
+};
+
+/** A close as one plain sentence: the server's own words for a refused open. */
+export function describeClose(code: number, reason?: string): string {
+  if (code === CLOSE.BAD_REQUEST && reason) return reason;
+  return WHY[code] || (reason ? reason : `The connection to the AI closed (${code}).`);
+}
+
+const B64 = 'ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/';
+const B64_INDEX = (() => { const t = new Int16Array(256).fill(-1); for (let i = 0; i < 64; i++) t[B64.charCodeAt(i)] = i; return t; })();
+
+/** Base64 (the native module's JPEG) → bytes. Ignores padding and line breaks. */
+export function base64ToBytes(b64: string): Uint8Array {
+  const clean = b64.replace(/[^A-Za-z0-9+/]/g, '');
+  const out = new Uint8Array(Math.floor((clean.length * 3) / 4));
+  let o = 0, acc = 0, bits = 0;
+  for (let i = 0; i < clean.length; i++) {
+    acc = (acc << 6) | B64_INDEX[clean.charCodeAt(i)];
+    bits += 6;
+    if (bits >= 8) { bits -= 8; out[o++] = (acc >> bits) & 0xff; }
+  }
+  return o === out.length ? out : out.subarray(0, o);
+}

package/src/bootstrap.ts

@@ -29,12 +29,13 @@
  * this module-load bootstrap's scope).
  */
 import { initAdas, setAcsReachabilityReporter, type TokenProvider, type AdasUser, type AdasSession } from '@ateam-ai-mobile/core';
-import { setDeviceStateProvider, registerNativePlugin, registerPlatformDeviceTools, type RegisteredPlugin } from '@ateam-ai-mobile/plugin-runtime';
+import { setDeviceStateProvider, registerNativePlugin, registerPlatformDeviceTools, setAiLiveProvider, type RegisteredPlugin } from '@ateam-ai-mobile/plugin-runtime';
 import { setOAuthProvider, setUIActionNavigator, setPluginWebViewExtraHosts, setCallAudioProvider, type UIActionRoute } from '@ateam-ai-mobile/ui';
 import { createCallAudioProvider } from './audio';
 
 import { setupExpoProviders, type ExpoAttachmentCache } from './index';
 import { createDeviceProvider } from './device/createDeviceProvider';
+import { createAiLiveProvider } from './aiLive/provider';
 import { createDeviceState } from './device-state';
 import { createExpoOAuthProvider } from './oauth/expoOAuth';
 import * as deviceConnectivity from './device-bridge/collectors/connectivity';
@@ -154,6 +155,11 @@ export function bootstrapExpoAdas(opts: BootstrapExpoAdasOptions): { attachmentC
     createDeviceState({ connectivity: deviceConnectivity, location: deviceLocation }),
   );
 
+  // props.aiLive — this phone's camera to the workspace's chosen AI. Each use still
+  // needs the plugin's `picturesToAi` AND the person's "Camera pictures to AI"
+  // (the capabilities store installs that half), both checked at start().
+  setAiLiveProvider(createAiLiveProvider());
+
   // LOCAL device tools — register the static, host-owned platform tools
   // (device.echo / device.ping) at load, so the device path answers even before
   // any plugin bundle or sign-in: the platform tier deliberately does not depend

package/src/capabilities/choices.ts

@@ -0,0 +1,65 @@
+/**
+ * The user's device-sharing choices as saved — the one reader, used by the
+ * capabilities store and by a silent-push background sync, which must share
+ * only what the user turned on (it loads this file, not the store).
+ */
+import AsyncStorage from '@react-native-async-storage/async-storage';
+
+// The keys the app used before the SDK owned them — existing installs keep their choices.
+export const STORAGE_KEY = 'ateam.capabilities';
+export const SETUP_KEY = 'ateam.capabilities.setup';
+
+// Default enabled state per capability (first-time only)
+const DEFAULT_ENABLED: Record<string, boolean> = {
+  calendar: true,
+  contacts: true,
+  location: true,
+  battery: true,
+  connectivity: true,
+  health: true,
+  mood: true,
+  // Opt-IN: the camera is more invasive than the sync collectors and should not
+  // prompt every user for camera access on first launch. It lights up only when
+  // the user turns it on (which then requests the OS permission), so a solution
+  // that wants a camera preview asks the user to enable it.
+  camera: false,
+};
+
+// Capabilities hidden from the user-facing list — the bridge never registers
+// them. The host's push-notifications toggle is the single user control; the
+// notifications collector is internal plumbing and shouldn't surface as a
+// separate switch.
+export const HIDDEN_FROM_UI = new Set(['notifications']);
+
+export interface SavedChoices {
+  setupDone: boolean;
+  /** The user's saved toggles; a capability missing here has its default. */
+  prefs: Record<string, boolean>;
+}
+
+/** Read the saved choices. Throws on a corrupt save — callers decide what that means. */
+export async function loadChoices(): Promise<SavedChoices> {
+  const setupDone = await AsyncStorage.getItem(SETUP_KEY);
+  const saved = await AsyncStorage.getItem(STORAGE_KEY);
+  return { setupDone: setupDone === 'true', prefs: saved ? JSON.parse(saved) : {} };
+}
+
+/** Whether the user's choices turn this capability on. */
+export function isEnabled(id: string, prefs: Record<string, boolean>): boolean {
+  return prefs[id] ?? DEFAULT_ENABLED[id] ?? true;
+}
+
+/**
+ * The domains among `domains` this device may sync now: setup done, shown to
+ * the user, and turned on. Anything unreadable → none.
+ */
+export async function sharedDomains(domains: string[]): Promise<string[]> {
+  let choices: SavedChoices;
+  try {
+    choices = await loadChoices();
+  } catch {
+    return [];
+  }
+  if (!choices.setupDone) return [];
+  return domains.filter((d) => !HIDDEN_FROM_UI.has(d) && isEnabled(d, choices.prefs));
+}

package/src/capabilities/config.ts

@@ -16,10 +16,11 @@ export interface DeviceSyncConfig {
 
 // Module-private on purpose: plugin bundles run in the same JS context, so the
 // relay key and the secure-storage reader must not sit anywhere they can reach.
-// (The CJS build gives the bootstrap and capabilities entries each their own
-// copy of this file; a require() host calls configureDeviceSync from
-// '@ateam-ai-mobile/expo/capabilities' instead of the bootstrap option. Metro
-// uses the source and the ESM build shares one copy.)
+// (The CJS build gives the bootstrap, capabilities and silent-push entries each
+// their own copy of this file; a require() host calls configureDeviceSync from
+// '@ateam-ai-mobile/expo/capabilities' instead of the bootstrap option, and its
+// silent-push sync finds no config and skips. Metro uses the source and the ESM
+// build shares one copy.)
 let config: DeviceSyncConfig | null = null;
 
 export function configureDeviceSync(next: DeviceSyncConfig): void {

package/src/capabilities/index.ts

@@ -13,6 +13,8 @@
  * because the device bridge statically pulls the optional expo modules.
  */
 export { useCapabilitiesStore } from './store';
+// "Camera pictures to AI": the person's half of the consent props.aiLive needs, and what to tell them first.
+export { picturesToAiAllowed, PICTURES_TO_AI_ASK } from './picturesToAi';
 export type { CapabilityState } from './store';
 export { configureDeviceSync } from './config';
 export type { DeviceSyncConfig } from './config';

package/src/capabilities/picturesToAi.ts

@@ -0,0 +1,40 @@
+/**
+ * "Camera pictures to AI" — the phone owner's half of a two-sided consent
+ * (owner decision 2026-10-25, amending "frames never leave the phone").
+ *
+ * A camera picture may go to an AI service off the phone only when the
+ * solution's developer declared `picturesToAi` in its manifest AND the person on
+ * this phone allowed it here. plugin-runtime's mayPicturesLeavePhone() checks
+ * both; this half is installed as its consent provider by the capabilities store.
+ *
+ * Moved from ateam-mobile (branch pictures-to-ai-switch, 9541f22) into the SDK
+ * with the store it belongs to. Pure, so tests run it under plain node.
+ */
+
+export interface PicturesToAiInputs {
+  /** The switch under Camera in the host's "What Ada can access". */
+  picturesToAi: boolean;
+  capabilities: ReadonlyArray<{ id: string; enabled: boolean; osPermission: string }>;
+}
+
+/** Derived at read time, never stored: the switch is on AND the camera itself is
+ *  on and granted by the OS. Anything else answers no. */
+export function picturesToAiAllowed(s: PicturesToAiInputs): boolean {
+  if (s.picturesToAi !== true) return false;
+  const camera = s.capabilities.find((c) => c.id === 'camera');
+  return !!camera && camera.enabled === true && camera.osPermission === 'granted';
+}
+
+/** What the person is told before allowing it. Apple guideline 5.1.2(i): say
+ *  where personal data goes before sharing it with an outside AI, and get
+ *  explicit permission first. */
+export const PICTURES_TO_AI_ASK = {
+  title: 'Send camera pictures to AI?',
+  message:
+    'Solutions that ask for it may send pictures from your camera to an AI service ' +
+    '(OpenAI or Anthropic) through A-Team, to understand what the camera sees. ' +
+    'Only while such a solution is open, and "Sending to AI" shows while it does. ' +
+    'You can turn this off here at any time.',
+  allow: 'Allow',
+  cancel: 'Not now',
+} as const;