@ateam-ai-mobile/expo 0.1.19 → 0.1.21

package/dist/bootstrap.mjs

@@ -1,33 +1,37 @@
-import {
-  createDeviceProvider
-} from "./chunk-Z3P7RUCC.mjs";
 import {
   createExpoOAuthProvider
 } from "./chunk-L4V7OCJ3.mjs";
-import "./chunk-6JX222YX.mjs";
 import {
   createDeviceState,
   setupExpoProviders
-} from "./chunk-42FP5DTO.mjs";
-import "./chunk-6LXF3JVX.mjs";
+} from "./chunk-2ZQEQJQ6.mjs";
+import {
+  createAiLiveProvider
+} from "./chunk-JUBLG3PN.mjs";
 import {
   configureDeviceSync
-} from "./chunk-DE6Y4VRI.mjs";
-import "./chunk-FF6ZZZXH.mjs";
+} from "./chunk-GA7DS3PA.mjs";
+import {
+  createDeviceProvider
+} from "./chunk-OEX4OKYQ.mjs";
+import "./chunk-4BMWVN25.mjs";
+import "./chunk-6LXF3JVX.mjs";
+import "./chunk-WQK6PUBN.mjs";
+import "./chunk-BAZFMTCC.mjs";
 import {
   connectivity_exports,
   location_exports
-} from "./chunk-Z5AI2SXX.mjs";
-import "./chunk-KOXF2FZM.mjs";
+} from "./chunk-C62NQA4F.mjs";
 import "./chunk-XQSY6MHP.mjs";
+import "./chunk-KOXF2FZM.mjs";
 import "./chunk-7FWYEHN5.mjs";
 import "./chunk-J6XRNX7P.mjs";
-import "./chunk-4BMWVN25.mjs";
+import "./chunk-FF6ZZZXH.mjs";
 import "./chunk-WMJKH4XE.mjs";
 
 // src/bootstrap.ts
 import { initAdas, setAcsReachabilityReporter } from "@ateam-ai-mobile/core";
-import { setDeviceStateProvider, registerNativePlugin, registerPlatformDeviceTools } from "@ateam-ai-mobile/plugin-runtime";
+import { setDeviceStateProvider, registerNativePlugin, registerPlatformDeviceTools, setAiLiveProvider } from "@ateam-ai-mobile/plugin-runtime";
 import { setOAuthProvider, setUIActionNavigator, setPluginWebViewExtraHosts, setCallAudioProvider } from "@ateam-ai-mobile/ui";
 
 // src/audio/index.ts
@@ -71,6 +75,7 @@ function bootstrapExpoAdas(opts) {
   setDeviceStateProvider(
     createDeviceState({ connectivity: connectivity_exports, location: location_exports })
   );
+  setAiLiveProvider(createAiLiveProvider());
   registerPlatformDeviceTools();
   setUIActionNavigator(opts.navigateToPlugin);
   initAdas({

package/dist/bootstrap.mjs.map

@@ -1 +1 @@
-{"version":3,"sources":["../src/bootstrap.ts","../src/audio/index.ts"],"sourcesContent":["/**\n * bootstrapExpoAdas — the single, self-contained SDK bootstrap (R10).\n *\n * The final high-level entry point of the \"fat SDK / thin shell\" arc: it folds\n * the ~15 hand-wired seams the host used to assemble in its own adas.ts into ONE\n * call, so the shell stops manually assembling platform providers/collectors/\n * plugins. Internally it initializes, in the order the migrated code established:\n * the Expo providers (haptics/bundle cache/clipboard/attachment cache + the\n * device-primitive provider), the host-bundled native plugins, the plugin-WebView\n * allow-list, native OAuth, the ACS reachability reporter, the L3 DeviceState\n * engine (with the SDK's OWN collectors — the shell injects none), the plugin/\n * UI-action navigator, and finally the core config+token bridge (initAdas).\n *\n * The API is DERIVED from the host's migrated adas.ts, not invented. Everything\n * the host still owns is passed in as a small values-and-getters bag: endpoint\n * getters (the host owns the dev/prod switch), the identity/token bridge, its\n * branded Google client id, its host-bundled plugin resolvers, the native\n * WebView module from its build, and its router callback.\n *\n * A SUBPATH (`@ateam-ai-mobile/expo/bootstrap`), like /device and /oauth: it\n * statically pulls the optional expo native modules (via createDeviceProvider /\n * the device-state collectors / the OAuth provider), so it must not sit on the\n * package's main entry, which a host without those modules still has to build.\n *\n * The two physical reasoning paths stay DISTINCT and are wired as SEPARATE\n * statements — never a merged bridge: LOCAL (the local tool registry + device\n * state the plugin/voice runtime reads) and SERVER (the relay allow-list here;\n * the DeviceBridge relay runtime itself is started by the host lifecycle, out of\n * this module-load bootstrap's scope).\n */\nimport { initAdas, setAcsReachabilityReporter, type TokenProvider, type AdasUser, type AdasSession } from '@ateam-ai-mobile/core';\nimport { setDeviceStateProvider, registerNativePlugin, registerPlatformDeviceTools, type RegisteredPlugin } from '@ateam-ai-mobile/plugin-runtime';\nimport { setOAuthProvider, setUIActionNavigator, setPluginWebViewExtraHosts, setCallAudioProvider, type UIActionRoute } from '@ateam-ai-mobile/ui';\nimport { createCallAudioProvider } from './audio';\n\nimport { setupExpoProviders, type ExpoAttachmentCache } from './index';\nimport { createDeviceProvider } from './device/createDeviceProvider';\nimport { createDeviceState } from './device-state';\nimport { createExpoOAuthProvider } from './oauth/expoOAuth';\nimport * as deviceConnectivity from './device-bridge/collectors/connectivity';\nimport * as deviceLocation from './device-bridge/collectors/location';\nimport { configureDeviceSync } from './capabilities/config';\nimport type { SecureKv } from './device-bridge/deviceId';\n\n/** A host-bundled native plugin: one lazy resolver registered under one or more ids. */\nexport interface NativePluginRegistration {\n  resolver: () => Promise<RegisteredPlugin>;\n  ids: string[];\n}\n\nexport interface BootstrapExpoAdasOptions {\n  /**\n   * Endpoint GETTERS — the host owns the dev/prod env switch, so these are read\n   * live on every SDK request (never snapshotted). `core` is required; the rest\n   * are optional (voice/consumer-auth features light up when present).\n   */\n  urls: {\n    core: () => string;\n    voice?: () => string;\n    consumerAuth?: () => string;\n    /** Trusted extra host for plugin WebViews (the relay device-bridge auth flows). */\n    relay?: () => string;\n  };\n  /** The host's token bridge — outcome mapping (transient vs auth_failed) owned by the host. */\n  tokenProvider: TokenProvider;\n  /** Current user projection for chat routing (host reads its auth store). */\n  getUser: () => AdasUser | null;\n  /** Active tenant getter (signed-in tenant, falling back to the pre-auth pick). */\n  tenant?: () => string;\n  /** Adopt a freshly-minted session on tenant switch (host persists tenant-first, then logs in). */\n  onSession?: (session: AdasSession) => void | Promise<void>;\n  /** The host's bundled Google iOS client id, for the join/open-join OAuth path. */\n  googleIosClientId?: string;\n  /** Host-bundled native plugins (AuthWebView, ConnectionsPanel, …) — lazy resolvers. */\n  nativePlugins?: NativePluginRegistration[];\n  /** Native modules remote bundles may require() (e.g. react-native-webview) — from the host build. */\n  bundleModules?: Record<string, unknown>;\n  /** Pre-SDK AsyncStorage keys, so an existing install keeps its warm caches. */\n  storageKeys?: { attachmentIndex?: string; bundleIndex?: string };\n  /** Connectivity sink — the SDK reports fetch reachability up/down; the host feeds its banner. */\n  onReachabilityChange?: (up: boolean) => void;\n  /** Open the host's plugin screen for a UI-action chip (the host owns its router). */\n  navigateToPlugin: (route: UIActionRoute) => void;\n  /**\n   * Reachability probe URL for the device-primitive connectivity API. The host\n   * passes this EXPLICITLY (typically `${core}/health`) as a load-time snapshot —\n   * deliberately NOT derived from `urls.core()`, so a dev/E2E core override does\n   * not silently flow into the health probe (the asymmetry the host relied on).\n   */\n  reachabilityUrl?: string;\n  /**\n   * Device sync (the user's device permissions → the relay). Needs `urls.relay`.\n   * Leave it out and the capabilities store refuses to start the bridge, by name.\n   */\n  deviceSync?: {\n    /** The relay's shared key, sent as `Authorization: Bearer`. */\n    relayKey: string;\n    /** Secure storage for the install's device id (Keychain / Keystore). */\n    secureStorage: SecureKv;\n  };\n}\n\n/**\n * Wire the entire Expo-backed ADAS platform in one call. Run for its side effect\n * at module load, before the router mounts. Returns the attachment cache so the\n * host can hand it to anything that needs it (initAdas already received it).\n */\nexport function bootstrapExpoAdas(opts: BootstrapExpoAdasOptions): { attachmentCache: ExpoAttachmentCache } {\n  // Expo providers + the device-primitive implementation (props.device). The SDK\n  // owns createDeviceProvider; the shell injects only its reachability URL.\n  const { attachmentCache } = setupExpoProviders({\n    bundleModules: opts.bundleModules,\n    attachmentIndexKey: opts.storageKeys?.attachmentIndex,\n    bundleIndexKey: opts.storageKeys?.bundleIndex,\n    deviceProvider: createDeviceProvider({ reachabilityUrl: opts.reachabilityUrl }),\n  });\n\n  // Host-bundled native plugins: register each lazy resolver under its id aliases.\n  for (const plugin of opts.nativePlugins ?? []) {\n    for (const id of plugin.ids) registerNativePlugin(id, plugin.resolver);\n  }\n\n  // Plugin WebViews may navigate to the relay (device-bridge auth flows) —\n  // whitelist it alongside core/voice. Getter → live across env switches.\n  const relay = opts.urls.relay;\n  setPluginWebViewExtraHosts(() => (relay ? [relay()] : []));\n\n  // Device sync settings for the capabilities store — values only; the bootstrap\n  // loads no device-bridge code for this.\n  if (opts.deviceSync) {\n    if (!relay) throw new Error('bootstrapExpoAdas: deviceSync needs urls.relay');\n    configureDeviceSync({ relayUrl: relay, ...opts.deviceSync });\n  }\n\n  // Native OAuth for the relocated auth screens (the ONLY native OAuth wiring).\n  setOAuthProvider(createExpoOAuthProvider({ googleIosClientId: opts.googleIosClientId }));\n\n  // The voice call's device audio mode (echo cancellation on the loudspeaker).\n  setCallAudioProvider(createCallAudioProvider());\n\n  // ACS fetch outcomes feed the host's connectivity banner (any response = up,\n  // thrown fetch = down). The host's sink stays host-side (lazy, no load cycle).\n  if (opts.onReachabilityChange) {\n    const onReach = opts.onReachabilityChange;\n    setAcsReachabilityReporter({ up: () => onReach(true), down: () => onReach(false) });\n  }\n\n  // L3 DeviceState (props.deviceState) — the SEMANTIC layer, wired with the SDK's\n  // OWN device-bridge collectors. The shell injects none (the R10 payoff): an\n  // undeclared/unimplemented domain returns explicit `unknown`s, never a silent\n  // undefined. Kept a SEPARATE statement from the SERVER relay — the two\n  // reasoning paths never merge.\n  setDeviceStateProvider(\n    createDeviceState({ connectivity: deviceConnectivity, location: deviceLocation }),\n  );\n\n  // LOCAL device tools — register the static, host-owned platform tools\n  // (device.echo / device.ping) at load, so the device path answers even before\n  // any plugin bundle or sign-in: the platform tier deliberately does not depend\n  // on the thing being proved. A tenant's EXTERNAL device tools load on\n  // session-authenticated, which the host wires to its auth-session subscription\n  // via syncDeviceToolsForSession() — ambient, not voice-triggered.\n  registerPlatformDeviceTools();\n\n  // Plugin/UI-action chips delegate navigation to the host's router.\n  setUIActionNavigator(opts.navigateToPlugin);\n\n  // Core config + token bridge. URL getters (not snapshots) so the env switch\n  // flows through; identity/token bridge owned by the host.\n  initAdas({\n    coreUrl: opts.urls.core,\n    ...(opts.urls.voice ? { voiceUrl: opts.urls.voice } : {}),\n    ...(opts.urls.consumerAuth ? { consumerAuthUrl: opts.urls.consumerAuth } : {}),\n    ...(opts.onSession ? { onSession: opts.onSession } : {}),\n    ...(opts.tenant ? { tenant: opts.tenant } : {}),\n    getUser: opts.getUser,\n    tokenProvider: opts.tokenProvider,\n    attachmentCache,\n  });\n\n  return { attachmentCache };\n}\n","// Call audio mode for the voice call — see ios/AdaAudioModule.swift for why.\n//\n// requireOptionalNativeModule: on a binary WITHOUT the module (any build before\n// it shipped) this is null and the provider is a no-op, so an OTA carrying this\n// JS can never crash an older binary. Android: no module yet (its WebView echo\n// path is untouched).\nimport { requireOptionalNativeModule } from 'expo-modules-core';\nimport type { CallAudioProvider } from '@ateam-ai-mobile/ui';\n\ninterface AdaAudioNative {\n  beginVoiceCall(): boolean;\n  endVoiceCall(): boolean;\n}\n\nconst native = requireOptionalNativeModule<AdaAudioNative>('AdaAudio');\n\nexport function createCallAudioProvider(): CallAudioProvider | null {\n  if (!native) return null;\n  return {\n    beginCall: () => { native.beginVoiceCall(); },\n    endCall: () => { native.endVoiceCall(); },\n  };\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;AA8BA,SAAS,UAAU,kCAAuF;AAC1G,SAAS,wBAAwB,sBAAsB,mCAA0D;AACjH,SAAS,kBAAkB,sBAAsB,4BAA4B,4BAAgD;;;AC1B7H,SAAS,mCAAmC;AAQ5C,IAAM,SAAS,4BAA4C,UAAU;AAE9D,SAAS,0BAAoD;AAClE,MAAI,CAAC,OAAQ,QAAO;AACpB,SAAO;AAAA,IACL,WAAW,MAAM;AAAE,aAAO,eAAe;AAAA,IAAG;AAAA,IAC5C,SAAS,MAAM;AAAE,aAAO,aAAa;AAAA,IAAG;AAAA,EAC1C;AACF;;;ADqFO,SAAS,kBAAkB,MAA0E;AAG1G,QAAM,EAAE,gBAAgB,IAAI,mBAAmB;AAAA,IAC7C,eAAe,KAAK;AAAA,IACpB,oBAAoB,KAAK,aAAa;AAAA,IACtC,gBAAgB,KAAK,aAAa;AAAA,IAClC,gBAAgB,qBAAqB,EAAE,iBAAiB,KAAK,gBAAgB,CAAC;AAAA,EAChF,CAAC;AAGD,aAAW,UAAU,KAAK,iBAAiB,CAAC,GAAG;AAC7C,eAAW,MAAM,OAAO,IAAK,sBAAqB,IAAI,OAAO,QAAQ;AAAA,EACvE;AAIA,QAAM,QAAQ,KAAK,KAAK;AACxB,6BAA2B,MAAO,QAAQ,CAAC,MAAM,CAAC,IAAI,CAAC,CAAE;AAIzD,MAAI,KAAK,YAAY;AACnB,QAAI,CAAC,MAAO,OAAM,IAAI,MAAM,gDAAgD;AAC5E,wBAAoB,EAAE,UAAU,OAAO,GAAG,KAAK,WAAW,CAAC;AAAA,EAC7D;AAGA,mBAAiB,wBAAwB,EAAE,mBAAmB,KAAK,kBAAkB,CAAC,CAAC;AAGvF,uBAAqB,wBAAwB,CAAC;AAI9C,MAAI,KAAK,sBAAsB;AAC7B,UAAM,UAAU,KAAK;AACrB,+BAA2B,EAAE,IAAI,MAAM,QAAQ,IAAI,GAAG,MAAM,MAAM,QAAQ,KAAK,EAAE,CAAC;AAAA,EACpF;AAOA;AAAA,IACE,kBAAkB,EAAE,cAAc,sBAAoB,UAAU,iBAAe,CAAC;AAAA,EAClF;AAQA,8BAA4B;AAG5B,uBAAqB,KAAK,gBAAgB;AAI1C,WAAS;AAAA,IACP,SAAS,KAAK,KAAK;AAAA,IACnB,GAAI,KAAK,KAAK,QAAQ,EAAE,UAAU,KAAK,KAAK,MAAM,IAAI,CAAC;AAAA,IACvD,GAAI,KAAK,KAAK,eAAe,EAAE,iBAAiB,KAAK,KAAK,aAAa,IAAI,CAAC;AAAA,IAC5E,GAAI,KAAK,YAAY,EAAE,WAAW,KAAK,UAAU,IAAI,CAAC;AAAA,IACtD,GAAI,KAAK,SAAS,EAAE,QAAQ,KAAK,OAAO,IAAI,CAAC;AAAA,IAC7C,SAAS,KAAK;AAAA,IACd,eAAe,KAAK;AAAA,IACpB;AAAA,EACF,CAAC;AAED,SAAO,EAAE,gBAAgB;AAC3B;","names":[]}
+{"version":3,"sources":["../src/bootstrap.ts","../src/audio/index.ts"],"sourcesContent":["/**\n * bootstrapExpoAdas — the single, self-contained SDK bootstrap (R10).\n *\n * The final high-level entry point of the \"fat SDK / thin shell\" arc: it folds\n * the ~15 hand-wired seams the host used to assemble in its own adas.ts into ONE\n * call, so the shell stops manually assembling platform providers/collectors/\n * plugins. Internally it initializes, in the order the migrated code established:\n * the Expo providers (haptics/bundle cache/clipboard/attachment cache + the\n * device-primitive provider), the host-bundled native plugins, the plugin-WebView\n * allow-list, native OAuth, the ACS reachability reporter, the L3 DeviceState\n * engine (with the SDK's OWN collectors — the shell injects none), the plugin/\n * UI-action navigator, and finally the core config+token bridge (initAdas).\n *\n * The API is DERIVED from the host's migrated adas.ts, not invented. Everything\n * the host still owns is passed in as a small values-and-getters bag: endpoint\n * getters (the host owns the dev/prod switch), the identity/token bridge, its\n * branded Google client id, its host-bundled plugin resolvers, the native\n * WebView module from its build, and its router callback.\n *\n * A SUBPATH (`@ateam-ai-mobile/expo/bootstrap`), like /device and /oauth: it\n * statically pulls the optional expo native modules (via createDeviceProvider /\n * the device-state collectors / the OAuth provider), so it must not sit on the\n * package's main entry, which a host without those modules still has to build.\n *\n * The two physical reasoning paths stay DISTINCT and are wired as SEPARATE\n * statements — never a merged bridge: LOCAL (the local tool registry + device\n * state the plugin/voice runtime reads) and SERVER (the relay allow-list here;\n * the DeviceBridge relay runtime itself is started by the host lifecycle, out of\n * this module-load bootstrap's scope).\n */\nimport { initAdas, setAcsReachabilityReporter, type TokenProvider, type AdasUser, type AdasSession } from '@ateam-ai-mobile/core';\nimport { setDeviceStateProvider, registerNativePlugin, registerPlatformDeviceTools, setAiLiveProvider, type RegisteredPlugin } from '@ateam-ai-mobile/plugin-runtime';\nimport { setOAuthProvider, setUIActionNavigator, setPluginWebViewExtraHosts, setCallAudioProvider, type UIActionRoute } from '@ateam-ai-mobile/ui';\nimport { createCallAudioProvider } from './audio';\n\nimport { setupExpoProviders, type ExpoAttachmentCache } from './index';\nimport { createDeviceProvider } from './device/createDeviceProvider';\nimport { createAiLiveProvider } from './aiLive/provider';\nimport { createDeviceState } from './device-state';\nimport { createExpoOAuthProvider } from './oauth/expoOAuth';\nimport * as deviceConnectivity from './device-bridge/collectors/connectivity';\nimport * as deviceLocation from './device-bridge/collectors/location';\nimport { configureDeviceSync } from './capabilities/config';\nimport type { SecureKv } from './device-bridge/deviceId';\n\n/** A host-bundled native plugin: one lazy resolver registered under one or more ids. */\nexport interface NativePluginRegistration {\n  resolver: () => Promise<RegisteredPlugin>;\n  ids: string[];\n}\n\nexport interface BootstrapExpoAdasOptions {\n  /**\n   * Endpoint GETTERS — the host owns the dev/prod env switch, so these are read\n   * live on every SDK request (never snapshotted). `core` is required; the rest\n   * are optional (voice/consumer-auth features light up when present).\n   */\n  urls: {\n    core: () => string;\n    voice?: () => string;\n    consumerAuth?: () => string;\n    /** Trusted extra host for plugin WebViews (the relay device-bridge auth flows). */\n    relay?: () => string;\n  };\n  /** The host's token bridge — outcome mapping (transient vs auth_failed) owned by the host. */\n  tokenProvider: TokenProvider;\n  /** Current user projection for chat routing (host reads its auth store). */\n  getUser: () => AdasUser | null;\n  /** Active tenant getter (signed-in tenant, falling back to the pre-auth pick). */\n  tenant?: () => string;\n  /** Adopt a freshly-minted session on tenant switch (host persists tenant-first, then logs in). */\n  onSession?: (session: AdasSession) => void | Promise<void>;\n  /** The host's bundled Google iOS client id, for the join/open-join OAuth path. */\n  googleIosClientId?: string;\n  /** Host-bundled native plugins (AuthWebView, ConnectionsPanel, …) — lazy resolvers. */\n  nativePlugins?: NativePluginRegistration[];\n  /** Native modules remote bundles may require() (e.g. react-native-webview) — from the host build. */\n  bundleModules?: Record<string, unknown>;\n  /** Pre-SDK AsyncStorage keys, so an existing install keeps its warm caches. */\n  storageKeys?: { attachmentIndex?: string; bundleIndex?: string };\n  /** Connectivity sink — the SDK reports fetch reachability up/down; the host feeds its banner. */\n  onReachabilityChange?: (up: boolean) => void;\n  /** Open the host's plugin screen for a UI-action chip (the host owns its router). */\n  navigateToPlugin: (route: UIActionRoute) => void;\n  /**\n   * Reachability probe URL for the device-primitive connectivity API. The host\n   * passes this EXPLICITLY (typically `${core}/health`) as a load-time snapshot —\n   * deliberately NOT derived from `urls.core()`, so a dev/E2E core override does\n   * not silently flow into the health probe (the asymmetry the host relied on).\n   */\n  reachabilityUrl?: string;\n  /**\n   * Device sync (the user's device permissions → the relay). Needs `urls.relay`.\n   * Leave it out and the capabilities store refuses to start the bridge, by name.\n   */\n  deviceSync?: {\n    /** The relay's shared key, sent as `Authorization: Bearer`. */\n    relayKey: string;\n    /** Secure storage for the install's device id (Keychain / Keystore). */\n    secureStorage: SecureKv;\n  };\n}\n\n/**\n * Wire the entire Expo-backed ADAS platform in one call. Run for its side effect\n * at module load, before the router mounts. Returns the attachment cache so the\n * host can hand it to anything that needs it (initAdas already received it).\n */\nexport function bootstrapExpoAdas(opts: BootstrapExpoAdasOptions): { attachmentCache: ExpoAttachmentCache } {\n  // Expo providers + the device-primitive implementation (props.device). The SDK\n  // owns createDeviceProvider; the shell injects only its reachability URL.\n  const { attachmentCache } = setupExpoProviders({\n    bundleModules: opts.bundleModules,\n    attachmentIndexKey: opts.storageKeys?.attachmentIndex,\n    bundleIndexKey: opts.storageKeys?.bundleIndex,\n    deviceProvider: createDeviceProvider({ reachabilityUrl: opts.reachabilityUrl }),\n  });\n\n  // Host-bundled native plugins: register each lazy resolver under its id aliases.\n  for (const plugin of opts.nativePlugins ?? []) {\n    for (const id of plugin.ids) registerNativePlugin(id, plugin.resolver);\n  }\n\n  // Plugin WebViews may navigate to the relay (device-bridge auth flows) —\n  // whitelist it alongside core/voice. Getter → live across env switches.\n  const relay = opts.urls.relay;\n  setPluginWebViewExtraHosts(() => (relay ? [relay()] : []));\n\n  // Device sync settings for the capabilities store — values only; the bootstrap\n  // loads no device-bridge code for this.\n  if (opts.deviceSync) {\n    if (!relay) throw new Error('bootstrapExpoAdas: deviceSync needs urls.relay');\n    configureDeviceSync({ relayUrl: relay, ...opts.deviceSync });\n  }\n\n  // Native OAuth for the relocated auth screens (the ONLY native OAuth wiring).\n  setOAuthProvider(createExpoOAuthProvider({ googleIosClientId: opts.googleIosClientId }));\n\n  // The voice call's device audio mode (echo cancellation on the loudspeaker).\n  setCallAudioProvider(createCallAudioProvider());\n\n  // ACS fetch outcomes feed the host's connectivity banner (any response = up,\n  // thrown fetch = down). The host's sink stays host-side (lazy, no load cycle).\n  if (opts.onReachabilityChange) {\n    const onReach = opts.onReachabilityChange;\n    setAcsReachabilityReporter({ up: () => onReach(true), down: () => onReach(false) });\n  }\n\n  // L3 DeviceState (props.deviceState) — the SEMANTIC layer, wired with the SDK's\n  // OWN device-bridge collectors. The shell injects none (the R10 payoff): an\n  // undeclared/unimplemented domain returns explicit `unknown`s, never a silent\n  // undefined. Kept a SEPARATE statement from the SERVER relay — the two\n  // reasoning paths never merge.\n  setDeviceStateProvider(\n    createDeviceState({ connectivity: deviceConnectivity, location: deviceLocation }),\n  );\n\n  // props.aiLive — this phone's camera to the workspace's chosen AI. Each use still\n  // needs the plugin's `picturesToAi` AND the person's \"Camera pictures to AI\"\n  // (the capabilities store installs that half), both checked at start().\n  setAiLiveProvider(createAiLiveProvider());\n\n  // LOCAL device tools — register the static, host-owned platform tools\n  // (device.echo / device.ping) at load, so the device path answers even before\n  // any plugin bundle or sign-in: the platform tier deliberately does not depend\n  // on the thing being proved. A tenant's EXTERNAL device tools load on\n  // session-authenticated, which the host wires to its auth-session subscription\n  // via syncDeviceToolsForSession() — ambient, not voice-triggered.\n  registerPlatformDeviceTools();\n\n  // Plugin/UI-action chips delegate navigation to the host's router.\n  setUIActionNavigator(opts.navigateToPlugin);\n\n  // Core config + token bridge. URL getters (not snapshots) so the env switch\n  // flows through; identity/token bridge owned by the host.\n  initAdas({\n    coreUrl: opts.urls.core,\n    ...(opts.urls.voice ? { voiceUrl: opts.urls.voice } : {}),\n    ...(opts.urls.consumerAuth ? { consumerAuthUrl: opts.urls.consumerAuth } : {}),\n    ...(opts.onSession ? { onSession: opts.onSession } : {}),\n    ...(opts.tenant ? { tenant: opts.tenant } : {}),\n    getUser: opts.getUser,\n    tokenProvider: opts.tokenProvider,\n    attachmentCache,\n  });\n\n  return { attachmentCache };\n}\n","// Call audio mode for the voice call — see ios/AdaAudioModule.swift for why.\n//\n// requireOptionalNativeModule: on a binary WITHOUT the module (any build before\n// it shipped) this is null and the provider is a no-op, so an OTA carrying this\n// JS can never crash an older binary. Android: no module yet (its WebView echo\n// path is untouched).\nimport { requireOptionalNativeModule } from 'expo-modules-core';\nimport type { CallAudioProvider } from '@ateam-ai-mobile/ui';\n\ninterface AdaAudioNative {\n  beginVoiceCall(): boolean;\n  endVoiceCall(): boolean;\n}\n\nconst native = requireOptionalNativeModule<AdaAudioNative>('AdaAudio');\n\nexport function createCallAudioProvider(): CallAudioProvider | null {\n  if (!native) return null;\n  return {\n    beginCall: () => { native.beginVoiceCall(); },\n    endCall: () => { native.endVoiceCall(); },\n  };\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AA8BA,SAAS,UAAU,kCAAuF;AAC1G,SAAS,wBAAwB,sBAAsB,6BAA6B,yBAAgD;AACpI,SAAS,kBAAkB,sBAAsB,4BAA4B,4BAAgD;;;AC1B7H,SAAS,mCAAmC;AAQ5C,IAAM,SAAS,4BAA4C,UAAU;AAE9D,SAAS,0BAAoD;AAClE,MAAI,CAAC,OAAQ,QAAO;AACpB,SAAO;AAAA,IACL,WAAW,MAAM;AAAE,aAAO,eAAe;AAAA,IAAG;AAAA,IAC5C,SAAS,MAAM;AAAE,aAAO,aAAa;AAAA,IAAG;AAAA,EAC1C;AACF;;;ADsFO,SAAS,kBAAkB,MAA0E;AAG1G,QAAM,EAAE,gBAAgB,IAAI,mBAAmB;AAAA,IAC7C,eAAe,KAAK;AAAA,IACpB,oBAAoB,KAAK,aAAa;AAAA,IACtC,gBAAgB,KAAK,aAAa;AAAA,IAClC,gBAAgB,qBAAqB,EAAE,iBAAiB,KAAK,gBAAgB,CAAC;AAAA,EAChF,CAAC;AAGD,aAAW,UAAU,KAAK,iBAAiB,CAAC,GAAG;AAC7C,eAAW,MAAM,OAAO,IAAK,sBAAqB,IAAI,OAAO,QAAQ;AAAA,EACvE;AAIA,QAAM,QAAQ,KAAK,KAAK;AACxB,6BAA2B,MAAO,QAAQ,CAAC,MAAM,CAAC,IAAI,CAAC,CAAE;AAIzD,MAAI,KAAK,YAAY;AACnB,QAAI,CAAC,MAAO,OAAM,IAAI,MAAM,gDAAgD;AAC5E,wBAAoB,EAAE,UAAU,OAAO,GAAG,KAAK,WAAW,CAAC;AAAA,EAC7D;AAGA,mBAAiB,wBAAwB,EAAE,mBAAmB,KAAK,kBAAkB,CAAC,CAAC;AAGvF,uBAAqB,wBAAwB,CAAC;AAI9C,MAAI,KAAK,sBAAsB;AAC7B,UAAM,UAAU,KAAK;AACrB,+BAA2B,EAAE,IAAI,MAAM,QAAQ,IAAI,GAAG,MAAM,MAAM,QAAQ,KAAK,EAAE,CAAC;AAAA,EACpF;AAOA;AAAA,IACE,kBAAkB,EAAE,cAAc,sBAAoB,UAAU,iBAAe,CAAC;AAAA,EAClF;AAKA,oBAAkB,qBAAqB,CAAC;AAQxC,8BAA4B;AAG5B,uBAAqB,KAAK,gBAAgB;AAI1C,WAAS;AAAA,IACP,SAAS,KAAK,KAAK;AAAA,IACnB,GAAI,KAAK,KAAK,QAAQ,EAAE,UAAU,KAAK,KAAK,MAAM,IAAI,CAAC;AAAA,IACvD,GAAI,KAAK,KAAK,eAAe,EAAE,iBAAiB,KAAK,KAAK,aAAa,IAAI,CAAC;AAAA,IAC5E,GAAI,KAAK,YAAY,EAAE,WAAW,KAAK,UAAU,IAAI,CAAC;AAAA,IACtD,GAAI,KAAK,SAAS,EAAE,QAAQ,KAAK,OAAO,IAAI,CAAC;AAAA,IAC7C,SAAS,KAAK;AAAA,IACd,eAAe,KAAK;AAAA,IACpB;AAAA,EACF,CAAC;AAED,SAAO,EAAE,gBAAgB;AAC3B;","names":[]}

package/dist/capabilities/index.d.mts

@@ -41,6 +41,9 @@ interface CapabilityState {
 }
 interface CapabilitiesState {
     capabilities: CapabilityState[];
+    /** The "Camera pictures to AI" switch under Camera: the person's half of the
+     *  consent props.aiLive needs. Off until they turn it on (default no). */
+    picturesToAi: boolean;
     hasCompletedSetup: boolean;
     isLoading: boolean;
     bridgeRunning: boolean;
@@ -48,6 +51,8 @@ interface CapabilitiesState {
     initialize: () => Promise<void>;
     /** Toggle a capability on/off, persist, and update bridge if running */
     toggleCapability: (id: string, enabled: boolean) => Promise<void>;
+    /** Set and persist "Camera pictures to AI". The host asks first (PICTURES_TO_AI_ASK). */
+    setPicturesToAi: (on: boolean) => Promise<void>;
     /** Update OS permission state for a capability */
     setOsPermission: (id: string, state: PermissionState) => void;
     /** Mark initial setup as complete */
@@ -69,6 +74,40 @@ interface CapabilitiesState {
 }
 declare const useCapabilitiesStore: zustand.UseBoundStore<zustand.StoreApi<CapabilitiesState>>;
 
+/**
+ * "Camera pictures to AI" — the phone owner's half of a two-sided consent
+ * (owner decision 2026-10-25, amending "frames never leave the phone").
+ *
+ * A camera picture may go to an AI service off the phone only when the
+ * solution's developer declared `picturesToAi` in its manifest AND the person on
+ * this phone allowed it here. plugin-runtime's mayPicturesLeavePhone() checks
+ * both; this half is installed as its consent provider by the capabilities store.
+ *
+ * Moved from ateam-mobile (branch pictures-to-ai-switch, 9541f22) into the SDK
+ * with the store it belongs to. Pure, so tests run it under plain node.
+ */
+interface PicturesToAiInputs {
+    /** The switch under Camera in the host's "What Ada can access". */
+    picturesToAi: boolean;
+    capabilities: ReadonlyArray<{
+        id: string;
+        enabled: boolean;
+        osPermission: string;
+    }>;
+}
+/** Derived at read time, never stored: the switch is on AND the camera itself is
+ *  on and granted by the OS. Anything else answers no. */
+declare function picturesToAiAllowed(s: PicturesToAiInputs): boolean;
+/** What the person is told before allowing it. Apple guideline 5.1.2(i): say
+ *  where personal data goes before sharing it with an outside AI, and get
+ *  explicit permission first. */
+declare const PICTURES_TO_AI_ASK: {
+    readonly title: "Send camera pictures to AI?";
+    readonly message: string;
+    readonly allow: "Allow";
+    readonly cancel: "Not now";
+};
+
 /**
  * Device-sync settings the host provides once (bootstrapExpoAdas `deviceSync`,
  * or configureDeviceSync directly). Kept apart from the store so the bootstrap
@@ -109,4 +148,4 @@ interface CapabilityCardProps {
 /** One capability with its on/off switch and OS-permission badge. */
 declare function CapabilityCard({ capability, onToggle }: CapabilityCardProps): react_jsx_runtime.JSX.Element;
 
-export { CapabilitiesSetup, type CapabilitiesSetupProps, CapabilityCard, type CapabilityCardProps, type CapabilityState, type DeviceSyncConfig, configureDeviceSync, useCapabilitiesStore };
+export { CapabilitiesSetup, type CapabilitiesSetupProps, CapabilityCard, type CapabilityCardProps, type CapabilityState, type DeviceSyncConfig, PICTURES_TO_AI_ASK, configureDeviceSync, picturesToAiAllowed, useCapabilitiesStore };

package/dist/capabilities/index.d.ts

@@ -41,6 +41,9 @@ interface CapabilityState {
 }
 interface CapabilitiesState {
     capabilities: CapabilityState[];
+    /** The "Camera pictures to AI" switch under Camera: the person's half of the
+     *  consent props.aiLive needs. Off until they turn it on (default no). */
+    picturesToAi: boolean;
     hasCompletedSetup: boolean;
     isLoading: boolean;
     bridgeRunning: boolean;
@@ -48,6 +51,8 @@ interface CapabilitiesState {
     initialize: () => Promise<void>;
     /** Toggle a capability on/off, persist, and update bridge if running */
     toggleCapability: (id: string, enabled: boolean) => Promise<void>;
+    /** Set and persist "Camera pictures to AI". The host asks first (PICTURES_TO_AI_ASK). */
+    setPicturesToAi: (on: boolean) => Promise<void>;
     /** Update OS permission state for a capability */
     setOsPermission: (id: string, state: PermissionState) => void;
     /** Mark initial setup as complete */
@@ -69,6 +74,40 @@ interface CapabilitiesState {
 }
 declare const useCapabilitiesStore: zustand.UseBoundStore<zustand.StoreApi<CapabilitiesState>>;
 
+/**
+ * "Camera pictures to AI" — the phone owner's half of a two-sided consent
+ * (owner decision 2026-10-25, amending "frames never leave the phone").
+ *
+ * A camera picture may go to an AI service off the phone only when the
+ * solution's developer declared `picturesToAi` in its manifest AND the person on
+ * this phone allowed it here. plugin-runtime's mayPicturesLeavePhone() checks
+ * both; this half is installed as its consent provider by the capabilities store.
+ *
+ * Moved from ateam-mobile (branch pictures-to-ai-switch, 9541f22) into the SDK
+ * with the store it belongs to. Pure, so tests run it under plain node.
+ */
+interface PicturesToAiInputs {
+    /** The switch under Camera in the host's "What Ada can access". */
+    picturesToAi: boolean;
+    capabilities: ReadonlyArray<{
+        id: string;
+        enabled: boolean;
+        osPermission: string;
+    }>;
+}
+/** Derived at read time, never stored: the switch is on AND the camera itself is
+ *  on and granted by the OS. Anything else answers no. */
+declare function picturesToAiAllowed(s: PicturesToAiInputs): boolean;
+/** What the person is told before allowing it. Apple guideline 5.1.2(i): say
+ *  where personal data goes before sharing it with an outside AI, and get
+ *  explicit permission first. */
+declare const PICTURES_TO_AI_ASK: {
+    readonly title: "Send camera pictures to AI?";
+    readonly message: string;
+    readonly allow: "Allow";
+    readonly cancel: "Not now";
+};
+
 /**
  * Device-sync settings the host provides once (bootstrapExpoAdas `deviceSync`,
  * or configureDeviceSync directly). Kept apart from the store so the bootstrap
@@ -109,4 +148,4 @@ interface CapabilityCardProps {
 /** One capability with its on/off switch and OS-permission badge. */
 declare function CapabilityCard({ capability, onToggle }: CapabilityCardProps): react_jsx_runtime.JSX.Element;
 
-export { CapabilitiesSetup, type CapabilitiesSetupProps, CapabilityCard, type CapabilityCardProps, type CapabilityState, type DeviceSyncConfig, configureDeviceSync, useCapabilitiesStore };
+export { CapabilitiesSetup, type CapabilitiesSetupProps, CapabilityCard, type CapabilityCardProps, type CapabilityState, type DeviceSyncConfig, PICTURES_TO_AI_ASK, configureDeviceSync, picturesToAiAllowed, useCapabilitiesStore };

package/dist/capabilities/index.js

@@ -32,15 +32,18 @@ var capabilities_exports2 = {};
 __export(capabilities_exports2, {
   CapabilitiesSetup: () => CapabilitiesSetup,
   CapabilityCard: () => CapabilityCard,
+  PICTURES_TO_AI_ASK: () => PICTURES_TO_AI_ASK,
   configureDeviceSync: () => configureDeviceSync,
+  picturesToAiAllowed: () => picturesToAiAllowed,
   useCapabilitiesStore: () => useCapabilitiesStore
 });
 module.exports = __toCommonJS(capabilities_exports2);
 
 // src/capabilities/store.ts
 var import_zustand = require("zustand");
-var import_async_storage3 = __toESM(require("@react-native-async-storage/async-storage"));
+var import_async_storage4 = __toESM(require("@react-native-async-storage/async-storage"));
 var import_core = require("@ateam-ai-mobile/core");
+var import_plugin_runtime = require("@ateam-ai-mobile/plugin-runtime");
 
 // src/device-bridge/relay-client.ts
 var RelayClient = class {
@@ -1992,7 +1995,8 @@ function getDeviceSyncConfig() {
   return config;
 }
 
-// src/capabilities/store.ts
+// src/capabilities/choices.ts
+var import_async_storage3 = __toESM(require("@react-native-async-storage/async-storage"));
 var STORAGE_KEY = "ateam.capabilities";
 var SETUP_KEY = "ateam.capabilities.setup";
 var DEFAULT_ENABLED = {
@@ -2010,6 +2014,30 @@ var DEFAULT_ENABLED = {
   camera: false
 };
 var HIDDEN_FROM_UI = /* @__PURE__ */ new Set(["notifications"]);
+async function loadChoices() {
+  const setupDone = await import_async_storage3.default.getItem(SETUP_KEY);
+  const saved = await import_async_storage3.default.getItem(STORAGE_KEY);
+  return { setupDone: setupDone === "true", prefs: saved ? JSON.parse(saved) : {} };
+}
+function isEnabled(id, prefs) {
+  return prefs[id] ?? DEFAULT_ENABLED[id] ?? true;
+}
+
+// src/capabilities/picturesToAi.ts
+function picturesToAiAllowed(s) {
+  if (s.picturesToAi !== true) return false;
+  const camera = s.capabilities.find((c) => c.id === "camera");
+  return !!camera && camera.enabled === true && camera.osPermission === "granted";
+}
+var PICTURES_TO_AI_ASK = {
+  title: "Send camera pictures to AI?",
+  message: 'Solutions that ask for it may send pictures from your camera to an AI service (OpenAI or Anthropic) through A-Team, to understand what the camera sees. Only while such a solution is open, and "Sending to AI" shows while it does. You can turn this off here at any time.',
+  allow: "Allow",
+  cancel: "Not now"
+};
+
+// src/capabilities/store.ts
+var PICTURES_TO_AI_KEY = "ateam.capabilities.picturesToAi";
 var bridge = null;
 var bridgeOwner = null;
 var startQueue = Promise.resolve();
@@ -2104,12 +2132,15 @@ var useCapabilitiesStore = (0, import_zustand.create)((set, get) => {
   };
   return {
     capabilities: [],
+    picturesToAi: false,
     hasCompletedSetup: false,
     isLoading: true,
     bridgeRunning: false,
     initialize: async () => {
       try {
         builtInCapabilities = capabilities_exports.allBuiltIn().filter((c) => !HIDDEN_FROM_UI.has(c.id));
+        const { setupDone, prefs } = await loadChoices();
+        const picturesToAi = await import_async_storage4.default.getItem(PICTURES_TO_AI_KEY) === "true";
         const capStates = builtInCapabilities.map((cap) => ({
           id: cap.id,
           name: cap.name,
@@ -2117,21 +2148,16 @@ var useCapabilitiesStore = (0, import_zustand.create)((set, get) => {
           reason: cap.reason,
           icon: cap.icon || cap.id,
           requiresPermission: cap.requiresPermission,
-          enabled: DEFAULT_ENABLED[cap.id] ?? true,
+          enabled: isEnabled(cap.id, prefs),
           osPermission: cap.permissionState
         }));
-        const setupDone = await import_async_storage3.default.getItem(SETUP_KEY);
-        const saved = await import_async_storage3.default.getItem(STORAGE_KEY);
-        const prefs = saved ? JSON.parse(saved) : {};
         set({
-          capabilities: capStates.map((cap) => ({
-            ...cap,
-            enabled: prefs[cap.id] ?? cap.enabled
-          })),
-          hasCompletedSetup: setupDone === "true",
+          capabilities: capStates,
+          picturesToAi,
+          hasCompletedSetup: setupDone,
           isLoading: false
         });
-        console.log(`[Capabilities] Initialized ${capStates.length} capabilities from device-bridge (setup ${setupDone === "true" ? "done" : "pending"})`);
+        console.log(`[Capabilities] Initialized ${capStates.length} capabilities from device-bridge (setup ${setupDone ? "done" : "pending"})`);
       } catch (err) {
         console.error("[Capabilities] Initialize failed:", err);
         set({ isLoading: false });
@@ -2147,7 +2173,10 @@ var useCapabilitiesStore = (0, import_zustand.create)((set, get) => {
       for (const cap of get().capabilities) {
         prefs[cap.id] = cap.id === id ? enabled : cap.enabled;
       }
-      await import_async_storage3.default.setItem(STORAGE_KEY, JSON.stringify(prefs));
+      await import_async_storage4.default.setItem(STORAGE_KEY, JSON.stringify(prefs));
+      if (id === "camera" && !enabled && get().picturesToAi) {
+        await get().setPicturesToAi(false);
+      }
       if (bridge && get().bridgeRunning) {
         if (enabled) {
           const builtIn = builtInCapabilities.find((c) => c.id === id);
@@ -2167,6 +2196,10 @@ var useCapabilitiesStore = (0, import_zustand.create)((set, get) => {
         }
       }
     },
+    setPicturesToAi: async (on) => {
+      set({ picturesToAi: on });
+      await import_async_storage4.default.setItem(PICTURES_TO_AI_KEY, on ? "true" : "false");
+    },
     setOsPermission: (id, permState) => {
       set((s) => ({
         capabilities: s.capabilities.map(
@@ -2175,7 +2208,7 @@ var useCapabilitiesStore = (0, import_zustand.create)((set, get) => {
       }));
     },
     completeSetup: async () => {
-      await import_async_storage3.default.setItem(SETUP_KEY, "true");
+      await import_async_storage4.default.setItem(SETUP_KEY, "true");
       set({ hasCompletedSetup: true });
     },
     startBridge: () => {
@@ -2218,6 +2251,7 @@ var useCapabilitiesStore = (0, import_zustand.create)((set, get) => {
     }
   };
 });
+(0, import_plugin_runtime.setPicturesToAiConsentProvider)(() => picturesToAiAllowed(useCapabilitiesStore.getState()));
 
 // src/capabilities/CapabilitiesSetup.tsx
 var import_react = require("react");
@@ -2568,7 +2602,9 @@ var styles2 = import_react_native6.StyleSheet.create({
 0 && (module.exports = {
   CapabilitiesSetup,
   CapabilityCard,
+  PICTURES_TO_AI_ASK,
   configureDeviceSync,
+  picturesToAiAllowed,
   useCapabilitiesStore
 });
 //# sourceMappingURL=index.js.map