@ateam-ai-mobile/plugin-runtime 0.1.0

package/src/bridge/types.ts

@@ -0,0 +1,268 @@
+/**
+ * Native Bridge SDK Types
+ *
+ * TypeScript interfaces for the bridge API exposed to dynamic connectors.
+ * Connectors use these types to interact with device capabilities.
+ */
+
+// ═══════════════════════════════════════════════════════════════════════════
+// CALENDAR
+// ═══════════════════════════════════════════════════════════════════════════
+
+export interface CalendarEvent {
+  id: string;
+  title: string;
+  date: string; // YYYY-MM-DD
+  start: string; // HH:MM
+  end: string; // HH:MM
+  location: string;
+  attendees: string[];
+  notes: string;
+}
+
+export interface CalendarTodayResult {
+  date: string; // YYYY-MM-DD
+  day_of_week: string; // "Monday"
+  events: CalendarEvent[];
+  count: number;
+}
+
+export interface CalendarUpcomingResult {
+  from: string;
+  days_ahead: number;
+  events: CalendarEvent[];
+  count: number;
+}
+
+export interface CalendarCreateParams {
+  title: string;
+  date: string; // YYYY-MM-DD
+  start_time: string; // HH:MM
+  end_time?: string; // HH:MM
+  location?: string;
+  attendees?: string[];
+  notes?: string;
+}
+
+export interface CalendarCreateResult {
+  event_id: string;
+}
+
+export interface CalendarRescheduleParams {
+  event_id: string;
+  new_date?: string;
+  new_start_time?: string;
+  new_end_time?: string;
+}
+
+// ═══════════════════════════════════════════════════════════════════════════
+// CONTACTS
+// ═══════════════════════════════════════════════════════════════════════════
+
+export interface Contact {
+  id: string;
+  name: string;
+  phone: string | null;
+  email: string | null;
+  relationship: string;
+  birthday: string | null; // YYYY-MM-DD
+  notes: string;
+}
+
+export interface ContactSearchResult {
+  contacts: Contact[];
+  count: number;
+}
+
+export interface Birthday {
+  name: string;
+  relationship: string;
+  birthday: string;
+  days_until: number;
+  is_today: boolean;
+}
+
+export interface BirthdayResult {
+  birthdays: Birthday[];
+  count: number;
+}
+
+// ═══════════════════════════════════════════════════════════════════════════
+// LOCATION
+// ═══════════════════════════════════════════════════════════════════════════
+
+export interface LocationResult {
+  lat: number;
+  lng: number;
+  place: string;
+  address: string;
+  type: string; // home, work, school, fitness, medical, other
+  timestamp: string;
+}
+
+// ═══════════════════════════════════════════════════════════════════════════
+// BATTERY
+// ═══════════════════════════════════════════════════════════════════════════
+
+export interface BatteryStatus {
+  ok: true;
+  timestamp: string;
+  battery: {
+    level: number; // 0-100
+    state: 'charging' | 'unplugged' | 'full';
+    low_power_mode: boolean;
+  };
+}
+
+// ═══════════════════════════════════════════════════════════════════════════
+// NETWORK
+// ═══════════════════════════════════════════════════════════════════════════
+
+export interface NetworkStatus {
+  type: 'wifi' | 'cellular' | 'none';
+  is_connected: boolean;
+  wifi_name?: string;
+  timestamp: string;
+}
+
+// ═══════════════════════════════════════════════════════════════════════════
+// NOTIFICATIONS
+// ═══════════════════════════════════════════════════════════════════════════
+
+export interface Notification {
+  id: string;
+  app: string;
+  title: string;
+  body: string;
+  timestamp: string;
+  sender: string | null;
+  priority: 'high' | 'medium' | 'low';
+  read: boolean;
+}
+
+export interface NotificationListResult {
+  notifications: Notification[];
+  total: number;
+  unread: number;
+}
+
+// ═══════════════════════════════════════════════════════════════════════════
+// SMS
+// ═══════════════════════════════════════════════════════════════════════════
+
+export interface SMSSendResult {
+  ok: boolean;
+  status: 'sent' | 'unknown' | 'cancelled';
+}
+
+// ═══════════════════════════════════════════════════════════════════════════
+// MAPS
+// ═══════════════════════════════════════════════════════════════════════════
+
+export interface MapsNavigateResult {
+  ok: boolean;
+  status: 'navigating' | 'error';
+}
+
+// ═══════════════════════════════════════════════════════════════════════════
+// HTTP
+// ═══════════════════════════════════════════════════════════════════════════
+
+export interface HttpResponse {
+  ok: boolean;
+  status: number;
+  data: any;
+  headers: Record<string, string>;
+}
+
+// ═══════════════════════════════════════════════════════════════════════════
+// PERMISSIONS
+// ═══════════════════════════════════════════════════════════════════════════
+
+export type PermissionState = 'granted' | 'denied' | 'not_requested';
+
+// ═══════════════════════════════════════════════════════════════════════════
+// DEVICE
+// ═══════════════════════════════════════════════════════════════════════════
+
+export interface DeviceInfo {
+  os: 'ios' | 'android';
+  version: string;
+}
+
+// ═══════════════════════════════════════════════════════════════════════════
+// BRIDGE API
+// ═══════════════════════════════════════════════════════════════════════════
+
+export interface Bridge {
+  calendar: {
+    getToday(): Promise<CalendarTodayResult>;
+    getUpcoming(days?: number): Promise<CalendarUpcomingResult>;
+    create(event: CalendarCreateParams): Promise<CalendarCreateResult>;
+    reschedule(params: CalendarRescheduleParams): Promise<{ ok: boolean }>;
+    cancel(event_id: string): Promise<{ ok: boolean }>;
+  };
+
+  contacts: {
+    search(query: string): Promise<ContactSearchResult>;
+    get(idOrName: string): Promise<Contact | null>;
+    getAll(): Promise<ContactSearchResult>;
+    birthdays(days?: number): Promise<BirthdayResult>;
+  };
+
+  location: {
+    getCurrent(): Promise<LocationResult>;
+  };
+
+  battery: {
+    getStatus(): Promise<BatteryStatus>;
+  };
+
+  network: {
+    getStatus(): Promise<NetworkStatus>;
+  };
+
+  notifications: {
+    list(): Promise<NotificationListResult>;
+  };
+
+  sms: {
+    isAvailable(): Promise<boolean>;
+    send(phone: string, message: string): Promise<SMSSendResult>;
+  };
+
+  maps: {
+    navigate(destination: string, mode?: 'driving' | 'transit' | 'walking'): Promise<MapsNavigateResult>;
+  };
+
+  http: {
+    get(url: string, headers?: Record<string, string>): Promise<HttpResponse>;
+    post(url: string, body: any, headers?: Record<string, string>): Promise<HttpResponse>;
+    put(url: string, body: any, headers?: Record<string, string>): Promise<HttpResponse>;
+    delete(url: string, body?: any, headers?: Record<string, string>): Promise<HttpResponse>;
+  };
+
+  storage: {
+    get(key: string): Promise<string | null>;
+    set(key: string, value: string): Promise<void>;
+    delete(key: string): Promise<void>;
+    keys(): Promise<string[]>;
+  };
+
+  permissions: {
+    check(capability: string): Promise<PermissionState>;
+    request(capability: string): Promise<boolean>;
+    getAll(): Promise<Record<string, PermissionState>>;
+  };
+
+  device: {
+    getDeviceId(): string;
+    getPlatform(): DeviceInfo;
+  };
+
+  log: {
+    info(message: string, data?: any): void;
+    warn(message: string, data?: any): void;
+    error(message: string, data?: any): void;
+  };
+}

package/src/bundles/bundleManager.ts

@@ -0,0 +1,396 @@
+/**
+ * Global Plugin Bundle Manager — singleton.
+ *
+ * ONE download per bundleUrl (deduplicates multi-plugin bundles); all plugin
+ * renderer instances share the same loaded modules. Persistence goes through
+ * the BundleStorage adapter (in-memory by default; @ateam-ai-mobile/expo provides disk).
+ *
+ * Usage:
+ *   const component = await bundleManager.load(pluginId, bundleUrl, version, hash);
+ *   // component = { id, type, Component, ... } (RegisteredUIPlugin)
+ */
+import React from 'react';
+import {
+  useState, useEffect, useCallback, useMemo, useRef,
+  useContext, useReducer, useLayoutEffect, useImperativeHandle, useDebugValue,
+} from 'react';
+import * as ReactNative from 'react-native';
+import { apiFetchRaw } from '@ateam-ai-mobile/core';
+import * as PluginSDKModule from '../sdk';
+import { resolveBundleModule } from '../host';
+import { sha256Hex } from '../utils/sha256';
+import { getBundleStorage, type BundleCacheEntry } from './storage';
+import type { RegisteredUIPlugin } from '../sdk/types';
+
+// ── Require shim ─────────────────────────────────────────────
+// Bundles are built with external: ['react', 'react-native', '@adas/plugin-sdk']
+// so they emit require() calls that this shim resolves at runtime. Anything
+// beyond the built-ins (react-native-webview, expo-linking, …) must be
+// registered by the host via registerBundleModules() — the host is the one
+// that actually has those modules installed.
+
+const ReactShim: any = {
+  __esModule: true,
+  default: React,
+  ...React,
+  // Explicitly include hooks (React 19 may not have them as own enumerable props)
+  useState, useEffect, useCallback, useMemo, useRef, useContext,
+  useReducer, useLayoutEffect, useImperativeHandle, useDebugValue,
+  createElement: React.createElement,
+  Fragment: React.Fragment,
+  Component: React.Component,
+  PureComponent: React.PureComponent,
+  createContext: React.createContext,
+  forwardRef: React.forwardRef,
+  memo: React.memo,
+  Children: React.Children,
+  cloneElement: React.cloneElement,
+  isValidElement: React.isValidElement,
+  createRef: React.createRef,
+  lazy: React.lazy,
+  Suspense: React.Suspense,
+};
+
+// Freeze PluginSDK shim to prevent bundle monkey-patching of register()
+const PluginSDKShim = Object.freeze({
+  ...PluginSDKModule,
+  PluginSDK: Object.freeze({
+    ...PluginSDKModule.PluginSDK,
+    register: PluginSDKModule.PluginSDK.register,
+  }),
+  register: PluginSDKModule.register,
+});
+
+const requireShim = (name: string) => {
+  if (name === 'react') return ReactShim;
+  if (name === 'react-native') return ReactNative;
+  if (name === '@adas/plugin-sdk') return PluginSDKShim;
+  const hostModule = resolveBundleModule(name);
+  if (hostModule !== undefined) return hostModule;
+  console.warn(`[BundleManager] Unknown module: ${name} — register it via registerBundleModules()`);
+  return {};
+};
+
+// ── Cache constants ──────────────────────────────────────────
+
+const CACHE_TTL = 7 * 24 * 60 * 60 * 1000; // 7 days
+
+// ── BundleManager singleton ──────────────────────────────────
+
+class BundleManager {
+  /** In-memory module cache: bundleUrl → evaluated module.exports */
+  private modules = new Map<string, any>();
+
+  /** In-flight download deduplication: bundleUrl → Promise */
+  private inflight = new Map<string, Promise<any>>();
+
+  // ── Public API ──────────────────────────────────────────────
+
+  /**
+   * Load a plugin component. Returns the RegisteredUIPlugin object.
+   * Handles: in-memory cache → disk cache → download → evaluate → extract.
+   *
+   * `expectedHash` (SHA-256 hex from cp.getContextPlugin manifest) MUST be
+   * provided for any bundle the user has not previously verified — without
+   * it, a tampered bundle is `eval`'d as JS with full RN runtime + every
+   * native capability the manifest declares.
+   */
+  async load(
+    pluginId: string,
+    bundleUrl: string,
+    version: string,
+    expectedHash?: string,
+  ): Promise<RegisteredUIPlugin> {
+    // 1. In-memory cache — instant
+    const cached = this.getComponentFromMemory(pluginId, bundleUrl);
+    if (cached) return cached;
+
+    // 2. Deduplicate in-flight downloads for same bundleUrl
+    let modulePromise = this.inflight.get(bundleUrl);
+    if (!modulePromise) {
+      modulePromise = this.loadModule(bundleUrl, version, expectedHash);
+      this.inflight.set(bundleUrl, modulePromise);
+      // Swallow rejection on the cleanup chain — the original `await` below
+      // still surfaces the error to the caller.
+      modulePromise.catch(() => {}).finally(() => this.inflight.delete(bundleUrl));
+    }
+
+    await modulePromise;
+
+    // 3. Extract component for this specific pluginId
+    const component = this.getComponentFromMemory(pluginId, bundleUrl);
+    if (!component) {
+      throw new Error(
+        `Bundle loaded from ${bundleUrl} but no component found for "${pluginId}". ` +
+        `Available exports: ${this.describeModule(this.modules.get(bundleUrl))}`
+      );
+    }
+
+    return component;
+  }
+
+  /**
+   * Prewarm: load every plugin bundle in the background after app boot, so a
+   * later open is instant (in-memory hit) instead of round-tripping the
+   * network. Errors are swallowed per-plugin — one bad bundle shouldn't
+   * block others. Concurrency capped at 3.
+   */
+  async prewarmAll(items: Array<{
+    pluginId: string;
+    bundleUrl: string;
+    version: string;
+    bundleHash?: string;
+  }>): Promise<void> {
+    const queue = [...items];
+    const concurrency = Math.min(3, queue.length);
+    const start = Date.now();
+    let okCount = 0;
+    let failCount = 0;
+
+    const worker = async () => {
+      while (queue.length > 0) {
+        const it = queue.shift();
+        if (!it) return;
+        try {
+          await this.load(it.pluginId, it.bundleUrl, it.version, it.bundleHash);
+          okCount++;
+        } catch (err) {
+          failCount++;
+          // Silent — preload is best-effort. Log for diagnostics only.
+          console.log(`[prewarm] ${it.pluginId}: ${err instanceof Error ? err.message : String(err)}`);
+        }
+      }
+    };
+
+    await Promise.all(Array.from({ length: concurrency }, worker));
+    console.log(`[prewarm] ${okCount} loaded, ${failCount} failed in ${Date.now() - start}ms`);
+  }
+
+  /**
+   * Clear all caches (in-memory + storage).
+   */
+  async clearAll(): Promise<void> {
+    this.modules.clear();
+    try {
+      await getBundleStorage().clearAll();
+    } catch (err) {
+      console.warn('[BundleManager] clearAll error:', err);
+    }
+  }
+
+  /**
+   * Clear cache for a specific plugin/bundle.
+   */
+  async clearPlugin(pluginId: string): Promise<void> {
+    const storage = getBundleStorage();
+    const index = await storage.loadIndex();
+    const entry = index[pluginId];
+    if (entry) {
+      this.modules.delete(entry.bundleUrl);
+      delete index[pluginId];
+      await storage.saveIndex(index);
+      try {
+        await storage.deleteBundle(entry.localPath);
+      } catch { /* ignore */ }
+    }
+  }
+
+  // ── Private: module loading pipeline ────────────────────────
+
+  private async loadModule(bundleUrl: string, version: string, expectedHash?: string): Promise<void> {
+    // Already in memory?
+    if (this.modules.has(bundleUrl)) return;
+
+    const storage = getBundleStorage();
+    const index = await storage.loadIndex();
+    const expectedLc = expectedHash ? expectedHash.toLowerCase() : null;
+
+    // Check disk cache. A cache hit is only valid when the cached SHA-256
+    // matches the manifest hash exactly — never trust a cached bundle
+    // without proof.
+    let content: string | null = null;
+    for (const entry of Object.values(index)) {
+      if (entry.bundleUrl === bundleUrl && entry.version === version) {
+        const age = Date.now() - entry.timestamp;
+        const hashOk = expectedLc && entry.bundleHash && entry.bundleHash.toLowerCase() === expectedLc;
+        if (age < CACHE_TTL && hashOk) {
+          content = await storage.readBundle(entry.localPath);
+          if (content) break;
+        }
+      }
+    }
+
+    // Download if not cached
+    if (!content) {
+      const downloaded = await this.download(bundleUrl, expectedLc);
+      content = downloaded.content;
+      // Save with verified hash
+      const safeName = bundleUrl.replace(/[^a-zA-Z0-9]/g, '_').slice(-80);
+      try {
+        const localPath = await storage.writeBundle(`${safeName}@${version}.js`, content);
+        index[bundleUrl] = {
+          localPath,
+          version,
+          timestamp: Date.now(),
+          bundleUrl,
+          bundleHash: downloaded.sha256,
+        } satisfies BundleCacheEntry;
+        await storage.saveIndex(index);
+      } catch (err) {
+        console.warn('[BundleManager] Cache write error:', err);
+      }
+    }
+
+    // Evaluate
+    const mod = this.evaluate(content, bundleUrl);
+    this.modules.set(bundleUrl, mod);
+  }
+
+  /**
+   * Download + integrity-verify a bundle. Refuses to return when:
+   *   - manifest hash and computed hash disagree
+   *   - server's `X-Bundle-SHA256` disagrees with manifest hash
+   *   - no expected hash AND no server hash header (cannot prove the bundle
+   *     wasn't tampered with — fail closed rather than trust the wire).
+   */
+  private async download(bundleUrl: string, expectedHash: string | null): Promise<{ content: string; sha256: string }> {
+    const cacheBust = `${bundleUrl}${bundleUrl.includes('?') ? '&' : '?'}t=${Date.now()}`;
+    const response = await apiFetchRaw(cacheBust);
+    if (!response.ok) {
+      const body = await response.text().catch(() => '');
+      throw new Error(`Download failed: ${response.status} ${response.statusText} — ${body.substring(0, 200)}`);
+    }
+
+    const content = await response.text();
+    if (content.length < 50 || content.trimStart().startsWith('<!')) {
+      throw new Error('Bundle content is empty or HTML — server may have returned an error page');
+    }
+
+    const headerHash = (response.headers.get('x-bundle-sha256') || '').toLowerCase();
+    const computed = sha256Hex(content);
+
+    if (expectedHash) {
+      if (computed !== expectedHash) {
+        throw new Error(
+          `Bundle integrity FAIL: expected sha256=${expectedHash.slice(0, 12)}... got ${computed.slice(0, 12)}.... Refusing to evaluate.`
+        );
+      }
+      if (headerHash && headerHash !== expectedHash) {
+        throw new Error(
+          `Bundle hash mismatch: manifest=${expectedHash.slice(0, 12)}... server=${headerHash.slice(0, 12)}.... Refusing to evaluate.`
+        );
+      }
+    } else if (headerHash) {
+      if (computed !== headerHash) {
+        throw new Error(
+          `Bundle body sha256 (${computed.slice(0, 12)}...) does not match server's X-Bundle-SHA256 (${headerHash.slice(0, 12)}...).`
+        );
+      }
+      console.warn(`[BundleManager] No manifest bundleHash — verified via X-Bundle-SHA256 header only`);
+    } else {
+      throw new Error(
+        `No bundleHash in manifest and no X-Bundle-SHA256 header from server. Refusing to evaluate untrusted bundle.`
+      );
+    }
+
+    return { content, sha256: computed };
+  }
+
+  private evaluate(content: string, bundleUrl: string): any {
+    // Strip __toESM wrapping — our shim already provides correct ESM objects.
+    // esbuild's __toESM + isNodeMode=1 double-wraps and breaks React 19 hooks.
+    let cleaned = content.replace(
+      /__toESM\(require\(("[^"]+")\)(?:,\s*\d+)?\)/g,
+      'require($1)',
+    );
+
+    // Strip __toCommonJS wrapper — it creates a getter-based Proxy that
+    // collapses all named exports to the same object in Hermes/JSC.
+    cleaned = cleaned.replace(
+      /module\.exports\s*=\s*__toCommonJS\((\w+)\)/g,
+      'module.exports = $1',
+    );
+
+    const mod: { exports: any } = { exports: {} };
+    try {
+      const factory = new Function(
+        'module', 'exports', 'require', '__filename', '__dirname',
+        cleaned,
+      );
+      factory(mod, mod.exports, requireShim, bundleUrl, 'adas-plugin-bundles');
+    } catch (err) {
+      throw new Error(`Bundle evaluation failed: ${err instanceof Error ? err.message : String(err)}`);
+    }
+
+    // Materialize getter-based exports into plain values.
+    // esbuild's __export uses Object.defineProperty getters which can
+    // misbehave in Hermes/JSC — force-resolve them now.
+    const raw = mod.exports;
+    const materialized: Record<string, any> = {};
+    for (const key of Object.getOwnPropertyNames(raw)) {
+      try {
+        materialized[key] = raw[key];
+      } catch { /* skip broken getters */ }
+    }
+    return materialized;
+  }
+
+  // ── Private: component extraction ───────────────────────────
+
+  /**
+   * Find a plugin component in a loaded module.
+   * Handles: default export, direct key match, multi-plugin .id match.
+   */
+  private getComponentFromMemory(pluginId: string, bundleUrl: string): RegisteredUIPlugin | null {
+    const mod = this.modules.get(bundleUrl);
+    if (!mod) return null;
+
+    const shortName = pluginId.includes(':') ? pluginId.split(':').pop()! : pluginId;
+
+    // 1. Direct key match (full pluginId as key)
+    if (mod[pluginId] && typeof mod[pluginId].Component === 'function') {
+      return mod[pluginId] as RegisteredUIPlugin;
+    }
+
+    // 2. PascalCase match from shortName (most reliable for combined bundles)
+    //    e.g., "memories-panel" → "MemoriesPanel"
+    const pascal = shortName.replace(/(^|-)([a-z])/g, (_: string, __: string, c: string) => c.toUpperCase());
+    if (mod[pascal] && typeof mod[pascal] === 'object' && typeof mod[pascal].Component === 'function') {
+      return mod[pascal] as RegisteredUIPlugin;
+    }
+
+    // 3. Default export (single-plugin bundles)
+    if (mod.default && typeof mod.default === 'object' && typeof mod.default.Component === 'function') {
+      return mod.default as RegisteredUIPlugin;
+    }
+
+    // 4. Match by .id field (last resort — can be unreliable in combined bundles)
+    for (const key of Object.keys(mod)) {
+      const val = mod[key];
+      if (
+        val &&
+        typeof val === 'object' &&
+        val.id === shortName &&
+        typeof val.Component === 'function'
+      ) {
+        return val as RegisteredUIPlugin;
+      }
+    }
+
+    return null;
+  }
+
+  private describeModule(mod: any): string {
+    if (!mod) return '(empty)';
+    return Object.keys(mod)
+      .map(k => {
+        const v = mod[k];
+        if (v && typeof v === 'object' && v.id) return `${k}(id="${v.id}")`;
+        return k;
+      })
+      .join(', ');
+  }
+}
+
+/** Singleton — shared across all plugin renderers */
+export const bundleManager = new BundleManager();