@ateam-ai-mobile/plugin-runtime 0.1.7 → 0.1.8

package/dist/index.js

@@ -395,7 +395,8 @@ function gatePluginNative(native, declared, pluginId) {
     // every method refuses by name. Both are better than the `undefined` this
     // used to be, which crashed with "cannot read properties of undefined".
     bluetooth: caps.bluetooth ? native.bluetooth : blocked("bluetooth"),
-    vision: caps.vision ? native.vision : blocked("vision")
+    vision: caps.vision ? native.vision : blocked("vision"),
+    maps: caps.maps ? native.maps : blocked("maps")
     // What this plugin DECLARED, carried on the object it already receives.
     //
     // It is how a COMPONENT can be capability-gated: <CameraPreview> is handed
@@ -455,7 +456,8 @@ var init_host = __esm({
       scanner: unavailable("scanner"),
       nfc: unavailable("nfc"),
       bluetooth: unavailable("bluetooth"),
-      vision: unavailable("vision")
+      vision: unavailable("vision"),
+      maps: unavailable("maps")
     };
     _pluginNative = noopNative;
     _cameraPreview = null;
@@ -814,6 +816,19 @@ function gateDeviceState(declared) {
   }
   return out;
 }
+function withoutSubscribe(state) {
+  if (!state) return state;
+  const out = {};
+  for (const domain of ALL_DOMAINS) {
+    const d = state[domain];
+    out[domain] = d && Object.assign(Object.create(d), {
+      subscribe() {
+        throw denial(domain, "a device tool call has no lifetime to own a subscription. Subscribe from the plugin UI, or read getSnapshot() within the call.");
+      }
+    });
+  }
+  return out;
+}
 function implementedStateDomains() {
   return ALL_DOMAINS.filter((d) => !!_provider[d]);
 }
@@ -839,6 +854,121 @@ var init_deviceStateHost = __esm({
   }
 });
 
+// src/voiceHost.ts
+function setVoiceProvider(provider) {
+  _provider2 = provider || null;
+}
+function implementedVoice() {
+  return !!_provider2;
+}
+function voiceDenial(why) {
+  const err = new Error(`voice: ${why}`);
+  err.code = "RESTRICTED";
+  return err;
+}
+function deniedVoice(why) {
+  const fail = () => {
+    throw voiceDenial(why);
+  };
+  return {
+    async start() {
+      return fail();
+    },
+    stop() {
+      fail();
+    },
+    setMuted() {
+      fail();
+    },
+    prompt() {
+      fail();
+    },
+    observe() {
+      fail();
+    },
+    getSnapshot() {
+      return {
+        state: "error",
+        sessionId: null,
+        muted: false,
+        speaking: false,
+        listening: false,
+        userSpeaking: false,
+        lastUserSpeechEndedAt: null,
+        lastDeviceTool: null,
+        authorizedSessionId: null,
+        lastError: why
+      };
+    },
+    subscribe() {
+      return fail();
+    },
+    transcript() {
+      return [];
+    }
+  };
+}
+function scopedVoice(provider, pluginId) {
+  return {
+    start: (opts) => provider.start(opts, pluginId),
+    stop: () => provider.stop(pluginId),
+    setMuted: (muted) => provider.setMuted(muted, pluginId),
+    prompt: (input) => provider.prompt(input, pluginId),
+    observe: (text) => provider.observe(text, pluginId),
+    getSnapshot: () => provider.getSnapshot(pluginId),
+    subscribe: (cb) => provider.subscribe(cb, pluginId),
+    transcript: () => provider.transcript(pluginId)
+  };
+}
+function gateVoice(declared, pluginId) {
+  if (!declared) {
+    return deniedVoice(
+      "not declared in this plugin's capabilities. Add `capabilities: { voice: true }` to use it."
+    );
+  }
+  if (!pluginId) {
+    return deniedVoice(
+      "no plugin identity \u2014 voice fails closed without a caller to scope the session to."
+    );
+  }
+  return _provider2 ? scopedVoice(_provider2, pluginId) : deniedVoice(
+    "no voice session in this build \u2014 the app has not mounted a VoiceSessionHost / called setVoiceProvider."
+  );
+}
+var _provider2;
+var init_voiceHost = __esm({
+  "src/voiceHost.ts"() {
+    "use strict";
+    _provider2 = null;
+  }
+});
+
+// src/pluginRuntime.ts
+function mergeCaps(decl) {
+  if (!decl) return void 0;
+  return { ...decl.native, ...decl.capabilities };
+}
+function resolvePluginGrants(src) {
+  const trusted = src.manifest ?? src.plugin ?? null;
+  const stateDomains = trusted?.stateDomains ? [...trusted.stateDomains] : void 0;
+  return { capabilities: mergeCaps(trusted), stateDomains };
+}
+function resolvePluginRuntimeProps(src) {
+  const { capabilities, stateDomains } = resolvePluginGrants(src);
+  const native = gatePluginNative(getPluginNative(), capabilities, src.pluginId);
+  const deviceState = gateDeviceState(stateDomains);
+  const voice = gateVoice(!!capabilities?.voice, src.pluginId);
+  return { device: native, native, deviceState, voice };
+}
+var init_pluginRuntime = __esm({
+  "src/pluginRuntime.ts"() {
+    "use strict";
+    init_host();
+    init_deviceStateHost();
+    init_voiceHost();
+  }
+});
+
 // src/bridge/native.ts
 function buildContext(pluginId, connectorId) {
   const user = (0, import_core2.getUser)();
@@ -1086,8 +1216,9 @@ function unregisterDeviceTools(pluginId) {
     if (entry.pluginId === pluginId) registry.delete(name);
   }
 }
-function hasDeviceTool(name) {
-  return registry.has(name);
+function hasDeviceTool(name, pluginId) {
+  const entry = registry.get(name);
+  return !!entry && (pluginId === void 0 || entry.pluginId === pluginId);
 }
 function listDeviceTools() {
   return Array.from(registry.entries()).map(([name, { pluginId, tool }]) => ({
@@ -1106,8 +1237,11 @@ async function callDeviceTool(name, args = {}, opts = {}) {
   let timer;
   try {
     const build = contextProvider || defaultContext;
+    const built = build(entry.pluginId, entry.capabilities, entry.stateDomains);
     const ctx = {
-      ...build(entry.pluginId, entry.capabilities, entry.stateDomains),
+      ...built,
+      // Whoever built the context, a call cannot own a subscription.
+      deviceState: withoutSubscribe(built.deviceState),
       signal: opts.signal
     };
     const result = await Promise.race([
@@ -2286,7 +2420,7 @@ var init_storage = __esm({
 });
 
 // src/bundles/bundleManager.ts
-var import_react9, import_react10, ReactNative, import_core9, ReactShim, PluginSDKShim, requireShim, CACHE_TTL, BundleManager, bundleManager;
+var import_react9, import_react10, ReactNative, import_core9, ReactShim, PluginSDKShim, requireShim, CACHE_TTL, hasComponent, hasTools, BundleManager, bundleManager;
 var init_bundleManager = __esm({
   "src/bundles/bundleManager.ts"() {
     "use strict";
@@ -2357,6 +2491,8 @@ var init_bundleManager = __esm({
       return {};
     };
     CACHE_TTL = 7 * 24 * 60 * 60 * 1e3;
+    hasComponent = (val) => !!val && typeof val === "object" && typeof val.Component === "function";
+    hasTools = (val) => !!val && typeof val === "object" && Array.isArray(val.tools) && val.tools.length > 0;
     BundleManager = class {
       constructor() {
         /** In-memory module cache: bundleUrl → evaluated module.exports. Holds ONE
@@ -2387,6 +2523,9 @@ var init_bundleManager = __esm({
          * of the previous tenant's tools.
          */
         this.registeredToolPluginIds = /* @__PURE__ */ new Set();
+        /** bundleUrl → the trusted declaration last recorded on its disk-cache entry
+         *  this session, so a memory hit with unchanged grants skips the index I/O. */
+        this.recordedDeclarations = /* @__PURE__ */ new Map();
         /**
          * Enforce the in-memory tenant boundary. Call at the top of every public load
          * path, BEFORE any cache read.
@@ -2432,6 +2571,7 @@ var init_bundleManager = __esm({
           }
         }
         this.registeredToolPluginIds.clear();
+        this.recordedDeclarations.clear();
         this.modules.clear();
         this.provenance.clear();
         this.inflight.clear();
@@ -2443,13 +2583,15 @@ var init_bundleManager = __esm({
       isStale(epoch, tenant) {
         return this.epoch !== epoch || (0, import_core9.getTenant)() !== tenant;
       }
-      /** Flip an existing provenance record to source:'memory' — a later serve of an
-       *  already-evaluated bundle came from the in-memory cache, not a fresh
-       *  download/disk read. No-op if nothing was recorded yet. */
-      markMemoryHit(bundleUrl) {
+      /** Record a memory serve: the running bytes are the already-evaluated module,
+       *  and `expected` is refreshed from the manifest hash the caller JUST passed —
+       *  so after a redeploy the record reads hash !== expected (STALE) instead of
+       *  the old in-sync pair. The ONE place both memory paths (load()'s early return
+       *  and loadModule's) record reuse. No-op if nothing was recorded yet. */
+      markMemoryHit(bundleUrl, expectedHash) {
         const prev = this.provenance.get(bundleUrl);
-        if (prev && prev.source !== "memory") {
-          this.provenance.set(bundleUrl, { ...prev, source: "memory" });
+        if (prev) {
+          this.provenance.set(bundleUrl, { ...prev, source: "memory", expected: expectedHash?.toLowerCase() ?? prev.expected });
         }
       }
       // ── Public API ──────────────────────────────────────────────
@@ -2461,13 +2603,21 @@ var init_bundleManager = __esm({
        * provided for any bundle the user has not previously verified — without
        * it, a tampered bundle is `eval`'d as JS with full RN runtime + every
        * native capability the manifest declares.
+       *
+       * `grants` is what the MANIFEST grants this plugin (resolvePluginGrants) — the
+       * only authority its device tools are registered under. Omitted (e.g. a
+       * prewarm from the slim plugin list) → the bundle is loaded but its tools are
+       * NOT registered: without the manifest there is nothing trusted to gate them
+       * on, and registering with nothing would downgrade a registration the
+       * manifest-driven tool loader already made.
        */
-      async load(pluginId, bundleUrl, version, expectedHash) {
+      async load(pluginId, bundleUrl, version, expectedHash, grants) {
         const tenant = this.requireTenant();
         const epoch = this.epoch;
         const cached = this.getComponentFromMemory(pluginId, bundleUrl);
         if (cached) {
-          this.markMemoryHit(bundleUrl);
+          this.markMemoryHit(bundleUrl, expectedHash);
+          if (grants) await this.commitTools(pluginId, bundleUrl, grants, tenant, epoch);
           return cached;
         }
         let modulePromise = this.inflight.get(bundleUrl);
@@ -2484,6 +2634,7 @@ var init_bundleManager = __esm({
         if (this.isStale(epoch, tenant)) {
           throw new Error("[BundleManager] tenant changed while loading \u2014 discarding (fail closed)");
         }
+        if (grants) await this.commitTools(pluginId, bundleUrl, grants, tenant, epoch);
         const component = this.getComponentFromMemory(pluginId, bundleUrl);
         if (!component) {
           throw new Error(
@@ -2498,8 +2649,14 @@ var init_bundleManager = __esm({
        * Same download, same integrity check, same evaluation as `load()`; the only
        * difference is that a bundle exporting tools and no `Component` is a success
        * here rather than "no component found". Returns the tool names registered.
+       *
+       * `grants` is REQUIRED: the tools are registered under `pluginId` with exactly
+       * what the manifest grants (see load()), never what the bundle claims.
        */
-      async loadTools(pluginId, bundleUrl, version, expectedHash) {
+      async loadTools(pluginId, bundleUrl, version, expectedHash, grants) {
+        if (!grants) {
+          throw new Error(`[BundleManager] loadTools(${pluginId}) needs the manifest's grants (resolvePluginGrants) \u2014 refusing to register tools on the bundle's own claim`);
+        }
         const tenant = this.requireTenant();
         const epoch = this.epoch;
         let modulePromise = this.inflight.get(bundleUrl);
@@ -2516,6 +2673,7 @@ var init_bundleManager = __esm({
         if (this.isStale(epoch, tenant)) {
           throw new Error("[BundleManager] tenant changed while loading tools \u2014 discarding (fail closed)");
         }
+        await this.commitTools(pluginId, bundleUrl, grants, tenant, epoch);
         const names = listDeviceTools().filter((t) => t.pluginId === pluginId).map((t) => t.name);
         if (names.length === 0) {
           console.warn(
@@ -2541,7 +2699,7 @@ var init_bundleManager = __esm({
             const it = queue.shift();
             if (!it) return;
             try {
-              await this.load(it.pluginId, it.bundleUrl, it.version, it.bundleHash);
+              await this.load(it.pluginId, it.bundleUrl, it.version, it.bundleHash, it.grants);
               okCount++;
             } catch (err) {
               failCount++;
@@ -2598,8 +2756,7 @@ var init_bundleManager = __esm({
           throw new Error("[BundleManager] tenant changed before load started \u2014 discarding (fail closed)");
         }
         if (this.modules.has(bundleUrl)) {
-          const prev = this.provenance.get(bundleUrl);
-          if (prev) this.provenance.set(bundleUrl, { ...prev, source: "memory", expected: expectedHash?.toLowerCase() ?? prev.expected });
+          this.markMemoryHit(bundleUrl, expectedHash);
           return;
         }
         const storage = getBundleStorage();
@@ -2666,30 +2823,90 @@ var init_bundleManager = __esm({
         console.log(
           `[BundleManager] RUNNING ${bundleUrl} v${version} sha=${(verifiedHash || "none").slice(0, 12)} (${servedFrom}${expectedLc && verifiedHash && expectedLc !== verifiedHash ? `, EXPECTED ${expectedLc.slice(0, 12)} \u2014 STALE` : ""})`
         );
-        this.registerToolsFromModule(mod, bundleUrl);
       }
       /**
-       * Pick up every `tools` section in an evaluated bundle and put it in the
-       * device tool registry. Runs for UI, hybrid and tools-only bundles alike: a
-       * plugin that ships both gets its tools registered without its UI mounting.
+       * Register THIS plugin's device tools under the TRUSTED declaration, then
+       * record that declaration on the disk-cache entry. Runs on every trusted load
+       * — memory hit included — so the grants in force are always the latest the
+       * manifest gave (a revoked grant stops applying on the next load, not the next
+       * app start). Callers run it only after their stale check.
        */
-      registerToolsFromModule(mod, bundleUrl) {
+      async commitTools(pluginId, bundleUrl, grants, tenant, epoch) {
+        const declaration = {
+          pluginId,
+          capabilities: grants.capabilities,
+          stateDomains: grants.stateDomains
+        };
+        this.registerToolsFromModule(this.modules.get(bundleUrl), declaration);
+        await this.recordTrustedDeclaration(bundleUrl, declaration, tenant, epoch);
+      }
+      /**
+       * Put the plugin's own `tools` section in the device tool registry — under the
+       * pluginId and grants the MANIFEST resolved, never the bundle's own `id`,
+       * `capabilities` or `stateDomains`. A bundle is code the manifest authorised
+       * by hash; what it may touch is the manifest's to say, same as its rendered
+       * surface (resolvePluginRuntimeProps). Its own `id` would also let it register
+       * as another plugin — including the host's platform tools, which a same-id
+       * re-registration replaces.
+       *
+       * Only this plugin's export (the same lookup the component uses) is
+       * registered. Another export's tools in the same bundle belong to another
+       * plugin and register when THAT plugin's manifest loads it.
+       */
+      registerToolsFromModule(mod, { pluginId, capabilities, stateDomains }) {
         if (!mod) return;
-        for (const key of Object.keys(mod)) {
-          const val = mod[key];
-          if (!val || typeof val !== "object" || !Array.isArray(val.tools) || val.tools.length === 0) {
-            continue;
-          }
-          const pluginId = typeof val.id === "string" ? val.id : `${bundleUrl}#${key}`;
-          try {
-            registerDeviceTools(pluginId, val.tools, val.capabilities, val.stateDomains);
-            this.registeredToolPluginIds.add(pluginId);
-          } catch (err) {
-            console.warn(
-              `[BundleManager] tool registration failed for ${pluginId}:`,
-              err instanceof Error ? err.message : String(err)
-            );
+        const own = this.findPluginExport(mod, pluginId, hasTools);
+        const others = Object.keys(mod).filter((k) => hasTools(mod[k]) && mod[k] !== own);
+        if (others.length > 0) {
+          console.warn(
+            `[BundleManager] ${pluginId}: not registering tools from export(s) ${others.join(", ")} \u2014 they are not this plugin's, and only their own manifest can grant them`
+          );
+        }
+        if (!own) return;
+        const ungranted = [
+          ...(Array.isArray(own.stateDomains) ? own.stateDomains : []).filter((d) => !stateDomains?.includes(d)),
+          ...Object.keys(own.capabilities || {}).filter((k) => own.capabilities[k] === true && !capabilities?.[k])
+        ];
+        if (ungranted.length > 0) {
+          console.warn(
+            `[BundleManager] ${pluginId}: bundle declares ${ungranted.join(", ")} but the manifest does not grant it \u2014 denied`
+          );
+        }
+        try {
+          registerDeviceTools(pluginId, own.tools, capabilities, stateDomains);
+          this.registeredToolPluginIds.add(pluginId);
+        } catch (err) {
+          console.warn(
+            `[BundleManager] tool registration failed for ${pluginId}:`,
+            err instanceof Error ? err.message : String(err)
+          );
+        }
+      }
+      /**
+       * Record the trusted declaration on this tenant's disk-cache entry for the
+       * bytes RUNNING — the recovery path (tools/loader loadFromDiskCache) has no
+       * manifest and re-registers with exactly this. Only onto an entry this tenant
+       * owns whose hash is the running hash: the grant was issued for these bytes,
+       * and those are the bytes recovery will evaluate. Best-effort — a lost write
+       * leaves no `trusted`, which recovery treats as fail closed.
+       */
+      async recordTrustedDeclaration(bundleUrl, declaration, tenant, epoch) {
+        const key = JSON.stringify(declaration);
+        if (this.recordedDeclarations.get(bundleUrl) === key) return;
+        try {
+          const storage = getBundleStorage();
+          const index = await storage.loadIndex();
+          const entry = index[bundleUrl];
+          const running = this.provenance.get(bundleUrl)?.hash;
+          if (!entry || entry.tenant !== tenant || !running || entry.bundleHash?.toLowerCase() !== running) return;
+          if (this.isStale(epoch, tenant)) return;
+          if (JSON.stringify(entry.trusted) !== key) {
+            index[bundleUrl] = { ...entry, trusted: declaration };
+            await storage.saveIndex(index);
           }
+          this.recordedDeclarations.set(bundleUrl, key);
+        } catch (err) {
+          console.warn("[BundleManager] could not record trusted declaration:", err);
         }
       }
       /**
@@ -2772,29 +2989,26 @@ var init_bundleManager = __esm({
         return materialized;
       }
       // ── Private: component extraction ───────────────────────────
+      /** Find a plugin component in a loaded module. */
+      getComponentFromMemory(pluginId, bundleUrl) {
+        return this.findPluginExport(this.modules.get(bundleUrl), pluginId, hasComponent);
+      }
       /**
-       * Find a plugin component in a loaded module.
-       * Handles: default export, direct key match, multi-plugin .id match.
+       * Find THIS plugin's export in a loaded module — the one lookup both the
+       * component and the device tools use, so a plugin's UI and its tools always
+       * come from the same export. `accept` says what the caller needs from it.
+       * Handles: direct key match, PascalCase key, default export, multi-plugin .id match.
        */
-      getComponentFromMemory(pluginId, bundleUrl) {
-        const mod = this.modules.get(bundleUrl);
+      findPluginExport(mod, pluginId, accept) {
         if (!mod) return null;
         const shortName = pluginId.includes(":") ? pluginId.split(":").pop() : pluginId;
-        if (mod[pluginId] && typeof mod[pluginId].Component === "function") {
-          return mod[pluginId];
-        }
+        if (accept(mod[pluginId])) return mod[pluginId];
         const pascal = shortName.replace(/(^|-)([a-z])/g, (_, __, c) => c.toUpperCase());
-        if (mod[pascal] && typeof mod[pascal] === "object" && typeof mod[pascal].Component === "function") {
-          return mod[pascal];
-        }
-        if (mod.default && typeof mod.default === "object" && typeof mod.default.Component === "function") {
-          return mod.default;
-        }
+        if (accept(mod[pascal])) return mod[pascal];
+        if (accept(mod.default)) return mod.default;
         for (const key of Object.keys(mod)) {
           const val = mod[key];
-          if (val && typeof val === "object" && val.id === shortName && typeof val.Component === "function") {
-            return val;
-          }
+          if (val && (val.id === pluginId || val.id === shortName) && accept(val)) return val;
         }
         return null;
       }
@@ -2853,7 +3067,8 @@ async function ensureDeviceToolsLoaded({ force = false } = {}) {
               m.id,
               bundleUrl,
               m.version || "1.0.0",
-              getNativeBundleHash(m) || void 0
+              getNativeBundleHash(m) || void 0,
+              resolvePluginGrants({ pluginId: m.id, manifest: m })
             );
           } catch (err) {
             console.warn(`[deviceTools] ${m.id} failed to load:`, err?.message || String(err));
@@ -2885,10 +3100,16 @@ async function loadFromDiskCache() {
     if (skipped > 0) {
       console.log(`[deviceTools] disk-cache recovery: ${mine.length} for "${tenant}", skipped ${skipped} not owned by it`);
     }
-    if (mine.length === 0) return [];
-    await Promise.all(mine.map(async (e) => {
+    const declared = mine.filter((e) => !!e.trusted?.pluginId);
+    if (declared.length < mine.length) {
+      console.log(
+        `[deviceTools] disk-cache recovery: skipped ${mine.length - declared.length} with no recorded manifest grant (fail closed)`
+      );
+    }
+    if (declared.length === 0) return [];
+    await Promise.all(declared.map(async (e) => {
       try {
-        await bundleManager.loadTools("cache:" + e.bundleUrl, e.bundleUrl, e.version, e.bundleHash);
+        await bundleManager.loadTools(e.trusted.pluginId, e.bundleUrl, e.version, e.bundleHash, e.trusted);
       } catch {
       }
     }));
@@ -2909,6 +3130,7 @@ var init_loader = __esm({
     init_bundleManager();
     init_registry();
     init_storage();
+    init_pluginRuntime();
     import_core10 = require("@ateam-ai-mobile/core");
     inflight = null;
     loadedOnce = false;
@@ -2991,6 +3213,7 @@ __export(index_exports, {
   registerService: () => registerService,
   registerTools: () => registerTools,
   resetDeviceToolLoader: () => resetDeviceToolLoader,
+  resolvePluginGrants: () => resolvePluginGrants,
   resolvePluginRuntimeProps: () => resolvePluginRuntimeProps,
   resolvePluginUrl: () => resolvePluginUrl,
   setBundleStorage: () => setBundleStorage,
@@ -3073,109 +3296,9 @@ function explainCapability(status) {
 
 // src/index.ts
 init_deviceStateHost();
-
-// src/voiceHost.ts
-var _provider2 = null;
-function setVoiceProvider(provider) {
-  _provider2 = provider || null;
-}
-function implementedVoice() {
-  return !!_provider2;
-}
-function voiceDenial(why) {
-  const err = new Error(`voice: ${why}`);
-  err.code = "RESTRICTED";
-  return err;
-}
-function deniedVoice(why) {
-  const fail = () => {
-    throw voiceDenial(why);
-  };
-  return {
-    async start() {
-      return fail();
-    },
-    stop() {
-      fail();
-    },
-    setMuted() {
-      fail();
-    },
-    prompt() {
-      fail();
-    },
-    observe() {
-      fail();
-    },
-    getSnapshot() {
-      return {
-        state: "error",
-        sessionId: null,
-        muted: false,
-        speaking: false,
-        listening: false,
-        userSpeaking: false,
-        lastUserSpeechEndedAt: null,
-        lastError: why
-      };
-    },
-    subscribe() {
-      return fail();
-    },
-    transcript() {
-      return [];
-    }
-  };
-}
-function scopedVoice(provider, pluginId) {
-  return {
-    start: (opts) => provider.start(opts, pluginId),
-    stop: () => provider.stop(pluginId),
-    setMuted: (muted) => provider.setMuted(muted, pluginId),
-    prompt: (input) => provider.prompt(input, pluginId),
-    observe: (text) => provider.observe(text, pluginId),
-    getSnapshot: () => provider.getSnapshot(pluginId),
-    subscribe: (cb) => provider.subscribe(cb, pluginId),
-    transcript: () => provider.transcript(pluginId)
-  };
-}
-function gateVoice(declared, pluginId) {
-  if (!declared) {
-    return deniedVoice(
-      "not declared in this plugin's capabilities. Add `capabilities: { voice: true }` to use it."
-    );
-  }
-  if (!pluginId) {
-    return deniedVoice(
-      "no plugin identity \u2014 voice fails closed without a caller to scope the session to."
-    );
-  }
-  return _provider2 ? scopedVoice(_provider2, pluginId) : deniedVoice(
-    "no voice session in this build \u2014 the app has not mounted a VoiceSessionHost / called setVoiceProvider."
-  );
-}
-
-// src/index.ts
+init_voiceHost();
 init_host();
-
-// src/pluginRuntime.ts
-init_host();
-init_deviceStateHost();
-function mergeCaps(decl) {
-  if (!decl) return void 0;
-  return { ...decl.native, ...decl.capabilities };
-}
-function resolvePluginRuntimeProps(src) {
-  const trusted = src.manifest ?? src.plugin ?? null;
-  const capabilities = mergeCaps(trusted);
-  const stateDomains = trusted?.stateDomains;
-  const native = gatePluginNative(getPluginNative(), capabilities, src.pluginId);
-  const deviceState = gateDeviceState(stateDomains);
-  const voice = gateVoice(!!capabilities?.voice, src.pluginId);
-  return { device: native, native, deviceState, voice };
-}
-
-// src/index.ts
+init_pluginRuntime();
 init_registry();
 init_loader();
 
@@ -3293,6 +3416,7 @@ init_native();
 var import_react11 = require("react");
 init_bundleManager();
 init_host();
+init_pluginRuntime();
 function extractBundleUrl(pluginId, manifest) {
   const render = manifest.render;
   if (!render || typeof render !== "object") return { url: null, source: "none" };
@@ -3330,6 +3454,8 @@ function usePlugin(pluginId, manifest) {
   const bundleHash = extractBundleHash(manifest);
   const componentId = extractComponentId(manifest);
   const lookupId = componentId || pluginId;
+  const grants = resolvePluginGrants({ pluginId, manifest });
+  const grantsKey = JSON.stringify(grants);
   if (ignoredUrl) {
     console.warn(`[usePlugin] ${pluginId}: IGNORED connector-injected bundleUrl="${ignoredUrl}". The host derives bundle URLs from pluginId via the canonical route.`);
   }
@@ -3352,7 +3478,7 @@ function usePlugin(pluginId, manifest) {
         }
         if (bundleUrl) {
           try {
-            const component = await bundleManager.load(pluginId, bundleUrl, version, bundleHash);
+            const component = await bundleManager.load(pluginId, bundleUrl, version, bundleHash, grants);
             if (cancelled) return;
             setPlugin(component);
             setLoading(false);
@@ -3389,7 +3515,7 @@ function usePlugin(pluginId, manifest) {
     return () => {
       cancelled = true;
     };
-  }, [pluginId, lookupId, bundleUrl, bundleHash, version]);
+  }, [pluginId, lookupId, bundleUrl, bundleHash, version, grantsKey]);
   return { plugin, loading, error, bundleMissing };
 }
 
@@ -3546,6 +3672,7 @@ init_SurfaceDispatcher();
   registerService,
   registerTools,
   resetDeviceToolLoader,
+  resolvePluginGrants,
   resolvePluginRuntimeProps,
   resolvePluginUrl,
   setBundleStorage,