@ateam-ai-mobile/plugin-runtime 0.1.7 → 0.1.8

package/dist/{chunk-PKDQLNBL.mjs → chunk-RXR6M623.mjs}

@@ -511,7 +511,8 @@ var noopNative = {
   scanner: unavailable("scanner"),
   nfc: unavailable("nfc"),
   bluetooth: unavailable("bluetooth"),
-  vision: unavailable("vision")
+  vision: unavailable("vision"),
+  maps: unavailable("maps")
 };
 var _pluginNative = noopNative;
 function setPluginNativeProvider(native) {
@@ -553,7 +554,8 @@ function gatePluginNative(native, declared, pluginId) {
     // every method refuses by name. Both are better than the `undefined` this
     // used to be, which crashed with "cannot read properties of undefined".
     bluetooth: caps.bluetooth ? native.bluetooth : blocked("bluetooth"),
-    vision: caps.vision ? native.vision : blocked("vision")
+    vision: caps.vision ? native.vision : blocked("vision"),
+    maps: caps.maps ? native.maps : blocked("maps")
     // What this plugin DECLARED, carried on the object it already receives.
     //
     // It is how a COMPONENT can be capability-gated: <CameraPreview> is handed
@@ -2104,6 +2106,19 @@ function gateDeviceState(declared) {
   }
   return out;
 }
+function withoutSubscribe(state) {
+  if (!state) return state;
+  const out = {};
+  for (const domain of ALL_DOMAINS) {
+    const d = state[domain];
+    out[domain] = d && Object.assign(Object.create(d), {
+      subscribe() {
+        throw denial(domain, "a device tool call has no lifetime to own a subscription. Subscribe from the plugin UI, or read getSnapshot() within the call.");
+      }
+    });
+  }
+  return out;
+}
 function implementedStateDomains() {
   return ALL_DOMAINS.filter((d) => !!_provider[d]);
 }
@@ -2149,8 +2164,9 @@ function unregisterDeviceTools(pluginId) {
     if (entry.pluginId === pluginId) registry.delete(name);
   }
 }
-function hasDeviceTool(name) {
-  return registry.has(name);
+function hasDeviceTool(name, pluginId) {
+  const entry = registry.get(name);
+  return !!entry && (pluginId === void 0 || entry.pluginId === pluginId);
 }
 function listDeviceTools() {
   return Array.from(registry.entries()).map(([name, { pluginId, tool }]) => ({
@@ -2169,8 +2185,11 @@ async function callDeviceTool(name, args = {}, opts = {}) {
   let timer;
   try {
     const build = contextProvider || defaultContext;
+    const built = build(entry.pluginId, entry.capabilities, entry.stateDomains);
     const ctx = {
-      ...build(entry.pluginId, entry.capabilities, entry.stateDomains),
+      ...built,
+      // Whoever built the context, a call cannot own a subscription.
+      deviceState: withoutSubscribe(built.deviceState),
       signal: opts.signal
     };
     const result = await Promise.race([
@@ -2248,6 +2267,8 @@ var requireShim = (name) => {
   return {};
 };
 var CACHE_TTL = 7 * 24 * 60 * 60 * 1e3;
+var hasComponent = (val) => !!val && typeof val === "object" && typeof val.Component === "function";
+var hasTools = (val) => !!val && typeof val === "object" && Array.isArray(val.tools) && val.tools.length > 0;
 var BundleManager = class {
   constructor() {
     /** In-memory module cache: bundleUrl → evaluated module.exports. Holds ONE
@@ -2278,6 +2299,9 @@ var BundleManager = class {
      * of the previous tenant's tools.
      */
     this.registeredToolPluginIds = /* @__PURE__ */ new Set();
+    /** bundleUrl → the trusted declaration last recorded on its disk-cache entry
+     *  this session, so a memory hit with unchanged grants skips the index I/O. */
+    this.recordedDeclarations = /* @__PURE__ */ new Map();
     /**
      * Enforce the in-memory tenant boundary. Call at the top of every public load
      * path, BEFORE any cache read.
@@ -2323,6 +2347,7 @@ var BundleManager = class {
       }
     }
     this.registeredToolPluginIds.clear();
+    this.recordedDeclarations.clear();
     this.modules.clear();
     this.provenance.clear();
     this.inflight.clear();
@@ -2334,13 +2359,15 @@ var BundleManager = class {
   isStale(epoch, tenant) {
     return this.epoch !== epoch || getTenant2() !== tenant;
   }
-  /** Flip an existing provenance record to source:'memory' — a later serve of an
-   *  already-evaluated bundle came from the in-memory cache, not a fresh
-   *  download/disk read. No-op if nothing was recorded yet. */
-  markMemoryHit(bundleUrl) {
+  /** Record a memory serve: the running bytes are the already-evaluated module,
+   *  and `expected` is refreshed from the manifest hash the caller JUST passed —
+   *  so after a redeploy the record reads hash !== expected (STALE) instead of
+   *  the old in-sync pair. The ONE place both memory paths (load()'s early return
+   *  and loadModule's) record reuse. No-op if nothing was recorded yet. */
+  markMemoryHit(bundleUrl, expectedHash) {
     const prev = this.provenance.get(bundleUrl);
-    if (prev && prev.source !== "memory") {
-      this.provenance.set(bundleUrl, { ...prev, source: "memory" });
+    if (prev) {
+      this.provenance.set(bundleUrl, { ...prev, source: "memory", expected: expectedHash?.toLowerCase() ?? prev.expected });
     }
   }
   // ── Public API ──────────────────────────────────────────────
@@ -2352,13 +2379,21 @@ var BundleManager = class {
    * provided for any bundle the user has not previously verified — without
    * it, a tampered bundle is `eval`'d as JS with full RN runtime + every
    * native capability the manifest declares.
+   *
+   * `grants` is what the MANIFEST grants this plugin (resolvePluginGrants) — the
+   * only authority its device tools are registered under. Omitted (e.g. a
+   * prewarm from the slim plugin list) → the bundle is loaded but its tools are
+   * NOT registered: without the manifest there is nothing trusted to gate them
+   * on, and registering with nothing would downgrade a registration the
+   * manifest-driven tool loader already made.
    */
-  async load(pluginId, bundleUrl, version, expectedHash) {
+  async load(pluginId, bundleUrl, version, expectedHash, grants) {
     const tenant = this.requireTenant();
     const epoch = this.epoch;
     const cached = this.getComponentFromMemory(pluginId, bundleUrl);
     if (cached) {
-      this.markMemoryHit(bundleUrl);
+      this.markMemoryHit(bundleUrl, expectedHash);
+      if (grants) await this.commitTools(pluginId, bundleUrl, grants, tenant, epoch);
       return cached;
     }
     let modulePromise = this.inflight.get(bundleUrl);
@@ -2375,6 +2410,7 @@ var BundleManager = class {
     if (this.isStale(epoch, tenant)) {
       throw new Error("[BundleManager] tenant changed while loading \u2014 discarding (fail closed)");
     }
+    if (grants) await this.commitTools(pluginId, bundleUrl, grants, tenant, epoch);
     const component = this.getComponentFromMemory(pluginId, bundleUrl);
     if (!component) {
       throw new Error(
@@ -2389,8 +2425,14 @@ var BundleManager = class {
    * Same download, same integrity check, same evaluation as `load()`; the only
    * difference is that a bundle exporting tools and no `Component` is a success
    * here rather than "no component found". Returns the tool names registered.
+   *
+   * `grants` is REQUIRED: the tools are registered under `pluginId` with exactly
+   * what the manifest grants (see load()), never what the bundle claims.
    */
-  async loadTools(pluginId, bundleUrl, version, expectedHash) {
+  async loadTools(pluginId, bundleUrl, version, expectedHash, grants) {
+    if (!grants) {
+      throw new Error(`[BundleManager] loadTools(${pluginId}) needs the manifest's grants (resolvePluginGrants) \u2014 refusing to register tools on the bundle's own claim`);
+    }
     const tenant = this.requireTenant();
     const epoch = this.epoch;
     let modulePromise = this.inflight.get(bundleUrl);
@@ -2407,6 +2449,7 @@ var BundleManager = class {
     if (this.isStale(epoch, tenant)) {
       throw new Error("[BundleManager] tenant changed while loading tools \u2014 discarding (fail closed)");
     }
+    await this.commitTools(pluginId, bundleUrl, grants, tenant, epoch);
     const names = listDeviceTools().filter((t) => t.pluginId === pluginId).map((t) => t.name);
     if (names.length === 0) {
       console.warn(
@@ -2432,7 +2475,7 @@ var BundleManager = class {
         const it = queue.shift();
         if (!it) return;
         try {
-          await this.load(it.pluginId, it.bundleUrl, it.version, it.bundleHash);
+          await this.load(it.pluginId, it.bundleUrl, it.version, it.bundleHash, it.grants);
           okCount++;
         } catch (err) {
           failCount++;
@@ -2489,8 +2532,7 @@ var BundleManager = class {
       throw new Error("[BundleManager] tenant changed before load started \u2014 discarding (fail closed)");
     }
     if (this.modules.has(bundleUrl)) {
-      const prev = this.provenance.get(bundleUrl);
-      if (prev) this.provenance.set(bundleUrl, { ...prev, source: "memory", expected: expectedHash?.toLowerCase() ?? prev.expected });
+      this.markMemoryHit(bundleUrl, expectedHash);
       return;
     }
     const storage = getBundleStorage();
@@ -2557,30 +2599,90 @@ var BundleManager = class {
     console.log(
       `[BundleManager] RUNNING ${bundleUrl} v${version} sha=${(verifiedHash || "none").slice(0, 12)} (${servedFrom}${expectedLc && verifiedHash && expectedLc !== verifiedHash ? `, EXPECTED ${expectedLc.slice(0, 12)} \u2014 STALE` : ""})`
     );
-    this.registerToolsFromModule(mod, bundleUrl);
   }
   /**
-   * Pick up every `tools` section in an evaluated bundle and put it in the
-   * device tool registry. Runs for UI, hybrid and tools-only bundles alike: a
-   * plugin that ships both gets its tools registered without its UI mounting.
+   * Register THIS plugin's device tools under the TRUSTED declaration, then
+   * record that declaration on the disk-cache entry. Runs on every trusted load
+   * — memory hit included — so the grants in force are always the latest the
+   * manifest gave (a revoked grant stops applying on the next load, not the next
+   * app start). Callers run it only after their stale check.
    */
-  registerToolsFromModule(mod, bundleUrl) {
+  async commitTools(pluginId, bundleUrl, grants, tenant, epoch) {
+    const declaration = {
+      pluginId,
+      capabilities: grants.capabilities,
+      stateDomains: grants.stateDomains
+    };
+    this.registerToolsFromModule(this.modules.get(bundleUrl), declaration);
+    await this.recordTrustedDeclaration(bundleUrl, declaration, tenant, epoch);
+  }
+  /**
+   * Put the plugin's own `tools` section in the device tool registry — under the
+   * pluginId and grants the MANIFEST resolved, never the bundle's own `id`,
+   * `capabilities` or `stateDomains`. A bundle is code the manifest authorised
+   * by hash; what it may touch is the manifest's to say, same as its rendered
+   * surface (resolvePluginRuntimeProps). Its own `id` would also let it register
+   * as another plugin — including the host's platform tools, which a same-id
+   * re-registration replaces.
+   *
+   * Only this plugin's export (the same lookup the component uses) is
+   * registered. Another export's tools in the same bundle belong to another
+   * plugin and register when THAT plugin's manifest loads it.
+   */
+  registerToolsFromModule(mod, { pluginId, capabilities, stateDomains }) {
     if (!mod) return;
-    for (const key of Object.keys(mod)) {
-      const val = mod[key];
-      if (!val || typeof val !== "object" || !Array.isArray(val.tools) || val.tools.length === 0) {
-        continue;
-      }
-      const pluginId = typeof val.id === "string" ? val.id : `${bundleUrl}#${key}`;
-      try {
-        registerDeviceTools(pluginId, val.tools, val.capabilities, val.stateDomains);
-        this.registeredToolPluginIds.add(pluginId);
-      } catch (err) {
-        console.warn(
-          `[BundleManager] tool registration failed for ${pluginId}:`,
-          err instanceof Error ? err.message : String(err)
-        );
+    const own = this.findPluginExport(mod, pluginId, hasTools);
+    const others = Object.keys(mod).filter((k) => hasTools(mod[k]) && mod[k] !== own);
+    if (others.length > 0) {
+      console.warn(
+        `[BundleManager] ${pluginId}: not registering tools from export(s) ${others.join(", ")} \u2014 they are not this plugin's, and only their own manifest can grant them`
+      );
+    }
+    if (!own) return;
+    const ungranted = [
+      ...(Array.isArray(own.stateDomains) ? own.stateDomains : []).filter((d) => !stateDomains?.includes(d)),
+      ...Object.keys(own.capabilities || {}).filter((k) => own.capabilities[k] === true && !capabilities?.[k])
+    ];
+    if (ungranted.length > 0) {
+      console.warn(
+        `[BundleManager] ${pluginId}: bundle declares ${ungranted.join(", ")} but the manifest does not grant it \u2014 denied`
+      );
+    }
+    try {
+      registerDeviceTools(pluginId, own.tools, capabilities, stateDomains);
+      this.registeredToolPluginIds.add(pluginId);
+    } catch (err) {
+      console.warn(
+        `[BundleManager] tool registration failed for ${pluginId}:`,
+        err instanceof Error ? err.message : String(err)
+      );
+    }
+  }
+  /**
+   * Record the trusted declaration on this tenant's disk-cache entry for the
+   * bytes RUNNING — the recovery path (tools/loader loadFromDiskCache) has no
+   * manifest and re-registers with exactly this. Only onto an entry this tenant
+   * owns whose hash is the running hash: the grant was issued for these bytes,
+   * and those are the bytes recovery will evaluate. Best-effort — a lost write
+   * leaves no `trusted`, which recovery treats as fail closed.
+   */
+  async recordTrustedDeclaration(bundleUrl, declaration, tenant, epoch) {
+    const key = JSON.stringify(declaration);
+    if (this.recordedDeclarations.get(bundleUrl) === key) return;
+    try {
+      const storage = getBundleStorage();
+      const index = await storage.loadIndex();
+      const entry = index[bundleUrl];
+      const running = this.provenance.get(bundleUrl)?.hash;
+      if (!entry || entry.tenant !== tenant || !running || entry.bundleHash?.toLowerCase() !== running) return;
+      if (this.isStale(epoch, tenant)) return;
+      if (JSON.stringify(entry.trusted) !== key) {
+        index[bundleUrl] = { ...entry, trusted: declaration };
+        await storage.saveIndex(index);
       }
+      this.recordedDeclarations.set(bundleUrl, key);
+    } catch (err) {
+      console.warn("[BundleManager] could not record trusted declaration:", err);
     }
   }
   /**
@@ -2663,29 +2765,26 @@ var BundleManager = class {
     return materialized;
   }
   // ── Private: component extraction ───────────────────────────
+  /** Find a plugin component in a loaded module. */
+  getComponentFromMemory(pluginId, bundleUrl) {
+    return this.findPluginExport(this.modules.get(bundleUrl), pluginId, hasComponent);
+  }
   /**
-   * Find a plugin component in a loaded module.
-   * Handles: default export, direct key match, multi-plugin .id match.
+   * Find THIS plugin's export in a loaded module — the one lookup both the
+   * component and the device tools use, so a plugin's UI and its tools always
+   * come from the same export. `accept` says what the caller needs from it.
+   * Handles: direct key match, PascalCase key, default export, multi-plugin .id match.
    */
-  getComponentFromMemory(pluginId, bundleUrl) {
-    const mod = this.modules.get(bundleUrl);
+  findPluginExport(mod, pluginId, accept) {
     if (!mod) return null;
     const shortName = pluginId.includes(":") ? pluginId.split(":").pop() : pluginId;
-    if (mod[pluginId] && typeof mod[pluginId].Component === "function") {
-      return mod[pluginId];
-    }
+    if (accept(mod[pluginId])) return mod[pluginId];
     const pascal = shortName.replace(/(^|-)([a-z])/g, (_, __, c) => c.toUpperCase());
-    if (mod[pascal] && typeof mod[pascal] === "object" && typeof mod[pascal].Component === "function") {
-      return mod[pascal];
-    }
-    if (mod.default && typeof mod.default === "object" && typeof mod.default.Component === "function") {
-      return mod.default;
-    }
+    if (accept(mod[pascal])) return mod[pascal];
+    if (accept(mod.default)) return mod.default;
     for (const key of Object.keys(mod)) {
       const val = mod[key];
-      if (val && typeof val === "object" && val.id === shortName && typeof val.Component === "function") {
-        return val;
-      }
+      if (val && (val.id === pluginId || val.id === shortName) && accept(val)) return val;
     }
     return null;
   }
@@ -2700,6 +2799,107 @@ var BundleManager = class {
 };
 var bundleManager = new BundleManager();
 
+// src/voiceHost.ts
+var _provider2 = null;
+function setVoiceProvider(provider) {
+  _provider2 = provider || null;
+}
+function implementedVoice() {
+  return !!_provider2;
+}
+function voiceDenial(why) {
+  const err = new Error(`voice: ${why}`);
+  err.code = "RESTRICTED";
+  return err;
+}
+function deniedVoice(why) {
+  const fail = () => {
+    throw voiceDenial(why);
+  };
+  return {
+    async start() {
+      return fail();
+    },
+    stop() {
+      fail();
+    },
+    setMuted() {
+      fail();
+    },
+    prompt() {
+      fail();
+    },
+    observe() {
+      fail();
+    },
+    getSnapshot() {
+      return {
+        state: "error",
+        sessionId: null,
+        muted: false,
+        speaking: false,
+        listening: false,
+        userSpeaking: false,
+        lastUserSpeechEndedAt: null,
+        lastDeviceTool: null,
+        authorizedSessionId: null,
+        lastError: why
+      };
+    },
+    subscribe() {
+      return fail();
+    },
+    transcript() {
+      return [];
+    }
+  };
+}
+function scopedVoice(provider, pluginId) {
+  return {
+    start: (opts) => provider.start(opts, pluginId),
+    stop: () => provider.stop(pluginId),
+    setMuted: (muted) => provider.setMuted(muted, pluginId),
+    prompt: (input) => provider.prompt(input, pluginId),
+    observe: (text) => provider.observe(text, pluginId),
+    getSnapshot: () => provider.getSnapshot(pluginId),
+    subscribe: (cb) => provider.subscribe(cb, pluginId),
+    transcript: () => provider.transcript(pluginId)
+  };
+}
+function gateVoice(declared, pluginId) {
+  if (!declared) {
+    return deniedVoice(
+      "not declared in this plugin's capabilities. Add `capabilities: { voice: true }` to use it."
+    );
+  }
+  if (!pluginId) {
+    return deniedVoice(
+      "no plugin identity \u2014 voice fails closed without a caller to scope the session to."
+    );
+  }
+  return _provider2 ? scopedVoice(_provider2, pluginId) : deniedVoice(
+    "no voice session in this build \u2014 the app has not mounted a VoiceSessionHost / called setVoiceProvider."
+  );
+}
+
+// src/pluginRuntime.ts
+function mergeCaps(decl) {
+  if (!decl) return void 0;
+  return { ...decl.native, ...decl.capabilities };
+}
+function resolvePluginGrants(src) {
+  const trusted = src.manifest ?? src.plugin ?? null;
+  const stateDomains = trusted?.stateDomains ? [...trusted.stateDomains] : void 0;
+  return { capabilities: mergeCaps(trusted), stateDomains };
+}
+function resolvePluginRuntimeProps(src) {
+  const { capabilities, stateDomains } = resolvePluginGrants(src);
+  const native = gatePluginNative(getPluginNative(), capabilities, src.pluginId);
+  const deviceState = gateDeviceState(stateDomains);
+  const voice = gateVoice(!!capabilities?.voice, src.pluginId);
+  return { device: native, native, deviceState, voice };
+}
+
 // src/tools/loader.ts
 import { getTenant as getTenant3 } from "@ateam-ai-mobile/core";
 var inflight = null;
@@ -2740,7 +2940,8 @@ async function ensureDeviceToolsLoaded({ force = false } = {}) {
               m.id,
               bundleUrl,
               m.version || "1.0.0",
-              getNativeBundleHash(m) || void 0
+              getNativeBundleHash(m) || void 0,
+              resolvePluginGrants({ pluginId: m.id, manifest: m })
             );
           } catch (err) {
             console.warn(`[deviceTools] ${m.id} failed to load:`, err?.message || String(err));
@@ -2772,10 +2973,16 @@ async function loadFromDiskCache() {
     if (skipped > 0) {
       console.log(`[deviceTools] disk-cache recovery: ${mine.length} for "${tenant}", skipped ${skipped} not owned by it`);
     }
-    if (mine.length === 0) return [];
-    await Promise.all(mine.map(async (e) => {
+    const declared = mine.filter((e) => !!e.trusted?.pluginId);
+    if (declared.length < mine.length) {
+      console.log(
+        `[deviceTools] disk-cache recovery: skipped ${mine.length - declared.length} with no recorded manifest grant (fail closed)`
+      );
+    }
+    if (declared.length === 0) return [];
+    await Promise.all(declared.map(async (e) => {
       try {
-        await bundleManager.loadTools("cache:" + e.bundleUrl, e.bundleUrl, e.version, e.bundleHash);
+        await bundleManager.loadTools(e.trusted.pluginId, e.bundleUrl, e.version, e.bundleHash, e.trusted);
       } catch {
       }
     }));
@@ -2839,6 +3046,11 @@ export {
   setDeviceStateProvider,
   gateDeviceState,
   implementedStateDomains,
+  setVoiceProvider,
+  implementedVoice,
+  gateVoice,
+  resolvePluginGrants,
+  resolvePluginRuntimeProps,
   useNativeBridge,
   createNativeBridge,
   setDeviceToolContextProvider,
@@ -2870,4 +3082,4 @@ export {
   ensureDeviceToolsLoaded,
   resetDeviceToolLoader
 };
-//# sourceMappingURL=chunk-PKDQLNBL.mjs.map
+//# sourceMappingURL=chunk-RXR6M623.mjs.map