@ateam-ai-mobile/plugin-runtime 0.1.7 → 0.1.9

package/dist/{chunk-PKDQLNBL.mjs → chunk-SICFDA5K.mjs}

@@ -7,6 +7,23 @@ var __export = (target, all) => {
 // src/api/plugins.ts
 import { apiFetch } from "@ateam-ai-mobile/core";
 import { getCoreApiUrl } from "@ateam-ai-mobile/core";
+
+// src/bundles/bundleUrl.ts
+function pluginBundleUrl(pluginId) {
+  return `/api/ui-plugins/${encodeURIComponent(pluginId)}/bundle.js`;
+}
+function isPluginBundleUrl(url, pluginId) {
+  if (typeof url !== "string") return false;
+  const canonical = pluginBundleUrl(pluginId);
+  if (url === canonical) return true;
+  try {
+    return decodeURIComponent(url) === decodeURIComponent(canonical);
+  } catch {
+    return false;
+  }
+}
+
+// src/api/plugins.ts
 function supportsNative(manifest) {
   const mode = manifest.render?.mode;
   return mode === "react-native" || mode === "adaptive";
@@ -17,12 +34,9 @@ function getNativeComponentId(manifest) {
   return null;
 }
 function getNativeBundleUrl(manifest) {
-  const direct = manifest.bundleUrl;
-  if (direct) return direct;
   const render = manifest.render;
-  if (render.mode === "react-native") return render.bundleUrl || null;
-  if (render.mode === "adaptive") return render.reactNative?.bundleUrl || null;
-  return null;
+  const declared = manifest.bundleUrl || (render?.mode === "react-native" ? render.bundleUrl : null) || (render?.mode === "adaptive" ? render.reactNative?.bundleUrl : null);
+  return declared && manifest.id ? pluginBundleUrl(manifest.id) : null;
 }
 function getNativeBundleHash(manifest) {
   const direct = manifest.bundleHash;
@@ -155,6 +169,8 @@ __export(sdk_exports, {
   TextInput: () => TextInput,
   TouchableOpacity: () => TouchableOpacity,
   View: () => View,
+  explainCapability: () => explainCapability,
+  isActionable: () => isActionable,
   register: () => register,
   registerService: () => registerService,
   registerTools: () => registerTools,
@@ -197,6 +213,60 @@ function registerService(id, config) {
 // src/sdk/voice.ts
 var PLATFORM_VOICE_CALLER = /* @__PURE__ */ Symbol("adas.voice.platform");
 
+// src/sdk/device-state.ts
+var device_state_exports = {};
+__export(device_state_exports, {
+  DeviceBridgeError: () => DeviceBridgeError,
+  explainCapability: () => explainCapability,
+  isActionable: () => isActionable,
+  neverObserved: () => neverObserved
+});
+var DeviceBridgeError = class extends Error {
+  constructor(code, message, opts) {
+    super(message);
+    this.name = "DeviceBridgeError";
+    this.code = code;
+    this.domain = opts?.domain;
+    this.recoverable = opts?.recoverable;
+  }
+};
+var CONFIDENCE_ORDER = {
+  unknown: 0,
+  low: 1,
+  medium: 2,
+  high: 3
+};
+function isActionable(quality, budget) {
+  const { freshness, confidence } = quality;
+  if (freshness.state === "unknown" || freshness.state === "stale") return false;
+  if (freshness.ageMs === null || freshness.ageMs > budget.maxAgeMs) return false;
+  if (budget.minConfidence) {
+    const have = CONFIDENCE_ORDER[confidence?.level ?? "unknown"];
+    if (have < CONFIDENCE_ORDER[budget.minConfidence]) return false;
+  }
+  return true;
+}
+function neverObserved() {
+  return { state: "unknown", observedAt: null, ageMs: null };
+}
+function explainCapability(status) {
+  if (status.support === "unsupported") return "this device does not have it";
+  if (status.permission === "denied") return "permission was denied";
+  if (status.permission === "restricted") return "permission is restricted";
+  if (status.permission === "notDetermined") return "permission has not been asked for yet";
+  if (status.permission === "limited") return "only limited access was granted";
+  if (status.restriction === "policyRestricted") return "this plugin did not declare it";
+  if (status.restriction === "backgroundRestricted") return "the app is in the background";
+  if (status.restriction === "lowPowerRestricted") return "the device is in low-power mode";
+  if (status.availability === "busy") return "it is in use by something else";
+  if (status.availability === "temporarilyUnavailable") return "it is temporarily unavailable";
+  if (status.availability === "unavailable") return "it is unavailable";
+  if (status.support === "unknown" || status.availability === "unknown") {
+    return "its state could not be determined";
+  }
+  return null;
+}
+
 // src/sdk/primitives.ts
 import {
   View,
@@ -511,7 +581,8 @@ var noopNative = {
   scanner: unavailable("scanner"),
   nfc: unavailable("nfc"),
   bluetooth: unavailable("bluetooth"),
-  vision: unavailable("vision")
+  vision: unavailable("vision"),
+  maps: unavailable("maps")
 };
 var _pluginNative = noopNative;
 function setPluginNativeProvider(native) {
@@ -553,7 +624,8 @@ function gatePluginNative(native, declared, pluginId) {
     // every method refuses by name. Both are better than the `undefined` this
     // used to be, which crashed with "cannot read properties of undefined".
     bluetooth: caps.bluetooth ? native.bluetooth : blocked("bluetooth"),
-    vision: caps.vision ? native.vision : blocked("vision")
+    vision: caps.vision ? native.vision : blocked("vision"),
+    maps: caps.maps ? native.maps : blocked("maps")
     // What this plugin DECLARED, carried on the object it already receives.
     //
     // It is how a COMPONENT can be capability-gated: <CameraPreview> is handed
@@ -1561,6 +1633,14 @@ function SurfaceDispatcher() {
   ] });
 }
 
+// src/bundles/bundleModuleNames.ts
+var PLUGIN_SDK_MODULE = "@adas/plugin-sdk";
+function sdkModuleRefusal(name) {
+  if (name === PLUGIN_SDK_MODULE) return null;
+  if (!name.startsWith("@ateam-ai-mobile/") && !name.startsWith("@adas/")) return null;
+  return `a plugin bundle required '${name}', which does not exist inside a bundle. Import from '${PLUGIN_SDK_MODULE}' instead \u2014 it is the only SDK module a bundle can require (values and types alike), and the one to keep external when building. '@ateam-ai-mobile/*' are the host app's packages, not the plugin's.`;
+}
+
 // src/utils/sha256.ts
 var K = new Uint32Array([
   1116352408,
@@ -1715,6 +1795,22 @@ function selectOwnedCacheEntries(entries, tenant) {
   if (!tenant) return [];
   return (entries || []).filter((e) => !!e && e.tenant === tenant);
 }
+async function loadCacheIndex(storage = getBundleStorage()) {
+  const index = await storage.loadIndex() || {};
+  for (const [key, entry] of Object.entries(index)) {
+    const pluginId = entry?.trusted?.pluginId;
+    if (!pluginId) continue;
+    const canonical = pluginBundleUrl(pluginId);
+    if (key === canonical) continue;
+    if (!isPluginBundleUrl(key, pluginId) || !isPluginBundleUrl(entry.bundleUrl, pluginId)) continue;
+    delete index[key];
+    const held = index[canonical];
+    if (!held || (entry.timestamp ?? 0) > (held.timestamp ?? 0)) {
+      index[canonical] = { ...entry, bundleUrl: canonical };
+    }
+  }
+  return index;
+}
 var MemoryBundleStorage = class {
   constructor() {
     this.index = {};
@@ -2104,6 +2200,19 @@ function gateDeviceState(declared) {
   }
   return out;
 }
+function withoutSubscribe(state) {
+  if (!state) return state;
+  const out = {};
+  for (const domain of ALL_DOMAINS) {
+    const d = state[domain];
+    out[domain] = d && Object.assign(Object.create(d), {
+      subscribe() {
+        throw denial(domain, "a device tool call has no lifetime to own a subscription. Subscribe from the plugin UI, or read getSnapshot() within the call.");
+      }
+    });
+  }
+  return out;
+}
 function implementedStateDomains() {
   return ALL_DOMAINS.filter((d) => !!_provider[d]);
 }
@@ -2149,8 +2258,9 @@ function unregisterDeviceTools(pluginId) {
     if (entry.pluginId === pluginId) registry.delete(name);
   }
 }
-function hasDeviceTool(name) {
-  return registry.has(name);
+function hasDeviceTool(name, pluginId) {
+  const entry = registry.get(name);
+  return !!entry && (pluginId === void 0 || entry.pluginId === pluginId);
 }
 function listDeviceTools() {
   return Array.from(registry.entries()).map(([name, { pluginId, tool }]) => ({
@@ -2169,8 +2279,11 @@ async function callDeviceTool(name, args = {}, opts = {}) {
   let timer;
   try {
     const build = contextProvider || defaultContext;
+    const built = build(entry.pluginId, entry.capabilities, entry.stateDomains);
     const ctx = {
-      ...build(entry.pluginId, entry.capabilities, entry.stateDomains),
+      ...built,
+      // Whoever built the context, a call cannot own a subscription.
+      deviceState: withoutSubscribe(built.deviceState),
       signal: opts.signal
     };
     const result = await Promise.race([
@@ -2196,6 +2309,9 @@ function clearDeviceTools() {
 }
 
 // src/bundles/bundleManager.ts
+function bundleKey(pluginId, bundleUrl) {
+  return isPluginBundleUrl(bundleUrl, pluginId) ? pluginBundleUrl(pluginId) : bundleUrl;
+}
 var ReactShim = {
   __esModule: true,
   default: React2,
@@ -2241,13 +2357,17 @@ var PluginSDKShim = Object.freeze({
 var requireShim = (name) => {
   if (name === "react") return ReactShim;
   if (name === "react-native") return ReactNative;
-  if (name === "@adas/plugin-sdk") return PluginSDKShim;
+  if (name === PLUGIN_SDK_MODULE) return PluginSDKShim;
+  const refusal = sdkModuleRefusal(name);
+  if (refusal) throw new Error(`[BundleManager] ${refusal}`);
   const hostModule = resolveBundleModule(name);
   if (hostModule !== void 0) return hostModule;
   console.warn(`[BundleManager] Unknown module: ${name} \u2014 register it via registerBundleModules()`);
   return {};
 };
 var CACHE_TTL = 7 * 24 * 60 * 60 * 1e3;
+var hasComponent = (val) => !!val && typeof val === "object" && typeof val.Component === "function";
+var hasTools = (val) => !!val && typeof val === "object" && Array.isArray(val.tools) && val.tools.length > 0;
 var BundleManager = class {
   constructor() {
     /** In-memory module cache: bundleUrl → evaluated module.exports. Holds ONE
@@ -2278,6 +2398,9 @@ var BundleManager = class {
      * of the previous tenant's tools.
      */
     this.registeredToolPluginIds = /* @__PURE__ */ new Set();
+    /** bundleUrl → the trusted declaration last recorded on its disk-cache entry
+     *  this session, so a memory hit with unchanged grants skips the index I/O. */
+    this.recordedDeclarations = /* @__PURE__ */ new Map();
     /**
      * Enforce the in-memory tenant boundary. Call at the top of every public load
      * path, BEFORE any cache read.
@@ -2323,6 +2446,7 @@ var BundleManager = class {
       }
     }
     this.registeredToolPluginIds.clear();
+    this.recordedDeclarations.clear();
     this.modules.clear();
     this.provenance.clear();
     this.inflight.clear();
@@ -2334,13 +2458,15 @@ var BundleManager = class {
   isStale(epoch, tenant) {
     return this.epoch !== epoch || getTenant2() !== tenant;
   }
-  /** Flip an existing provenance record to source:'memory' — a later serve of an
-   *  already-evaluated bundle came from the in-memory cache, not a fresh
-   *  download/disk read. No-op if nothing was recorded yet. */
-  markMemoryHit(bundleUrl) {
+  /** Record a memory serve: the running bytes are the already-evaluated module,
+   *  and `expected` is refreshed from the manifest hash the caller JUST passed —
+   *  so after a redeploy the record reads hash !== expected (STALE) instead of
+   *  the old in-sync pair. The ONE place both memory paths (load()'s early return
+   *  and loadModule's) record reuse. No-op if nothing was recorded yet. */
+  markMemoryHit(bundleUrl, expectedHash) {
     const prev = this.provenance.get(bundleUrl);
-    if (prev && prev.source !== "memory") {
-      this.provenance.set(bundleUrl, { ...prev, source: "memory" });
+    if (prev) {
+      this.provenance.set(bundleUrl, { ...prev, source: "memory", expected: expectedHash?.toLowerCase() ?? prev.expected });
     }
   }
   // ── Public API ──────────────────────────────────────────────
@@ -2352,13 +2478,22 @@ var BundleManager = class {
    * provided for any bundle the user has not previously verified — without
    * it, a tampered bundle is `eval`'d as JS with full RN runtime + every
    * native capability the manifest declares.
+   *
+   * `grants` is what the MANIFEST grants this plugin (resolvePluginGrants) — the
+   * only authority its device tools are registered under. Omitted (e.g. a
+   * prewarm from the slim plugin list) → the bundle is loaded but its tools are
+   * NOT registered: without the manifest there is nothing trusted to gate them
+   * on, and registering with nothing would downgrade a registration the
+   * manifest-driven tool loader already made.
    */
-  async load(pluginId, bundleUrl, version, expectedHash) {
+  async load(pluginId, bundleUrl, version, expectedHash, grants) {
+    bundleUrl = bundleKey(pluginId, bundleUrl);
     const tenant = this.requireTenant();
     const epoch = this.epoch;
     const cached = this.getComponentFromMemory(pluginId, bundleUrl);
     if (cached) {
-      this.markMemoryHit(bundleUrl);
+      this.markMemoryHit(bundleUrl, expectedHash);
+      if (grants) await this.commitTools(pluginId, bundleUrl, grants, tenant, epoch);
       return cached;
     }
     let modulePromise = this.inflight.get(bundleUrl);
@@ -2375,6 +2510,7 @@ var BundleManager = class {
     if (this.isStale(epoch, tenant)) {
       throw new Error("[BundleManager] tenant changed while loading \u2014 discarding (fail closed)");
     }
+    if (grants) await this.commitTools(pluginId, bundleUrl, grants, tenant, epoch);
     const component = this.getComponentFromMemory(pluginId, bundleUrl);
     if (!component) {
       throw new Error(
@@ -2389,8 +2525,15 @@ var BundleManager = class {
    * Same download, same integrity check, same evaluation as `load()`; the only
    * difference is that a bundle exporting tools and no `Component` is a success
    * here rather than "no component found". Returns the tool names registered.
+   *
+   * `grants` is REQUIRED: the tools are registered under `pluginId` with exactly
+   * what the manifest grants (see load()), never what the bundle claims.
    */
-  async loadTools(pluginId, bundleUrl, version, expectedHash) {
+  async loadTools(pluginId, bundleUrl, version, expectedHash, grants) {
+    if (!grants) {
+      throw new Error(`[BundleManager] loadTools(${pluginId}) needs the manifest's grants (resolvePluginGrants) \u2014 refusing to register tools on the bundle's own claim`);
+    }
+    bundleUrl = bundleKey(pluginId, bundleUrl);
     const tenant = this.requireTenant();
     const epoch = this.epoch;
     let modulePromise = this.inflight.get(bundleUrl);
@@ -2407,6 +2550,7 @@ var BundleManager = class {
     if (this.isStale(epoch, tenant)) {
       throw new Error("[BundleManager] tenant changed while loading tools \u2014 discarding (fail closed)");
     }
+    await this.commitTools(pluginId, bundleUrl, grants, tenant, epoch);
     const names = listDeviceTools().filter((t) => t.pluginId === pluginId).map((t) => t.name);
     if (names.length === 0) {
       console.warn(
@@ -2432,7 +2576,7 @@ var BundleManager = class {
         const it = queue.shift();
         if (!it) return;
         try {
-          await this.load(it.pluginId, it.bundleUrl, it.version, it.bundleHash);
+          await this.load(it.pluginId, it.bundleUrl, it.version, it.bundleHash, it.grants);
           okCount++;
         } catch (err) {
           failCount++;
@@ -2460,11 +2604,12 @@ var BundleManager = class {
    */
   async clearPlugin(pluginId) {
     const storage = getBundleStorage();
-    const index = await storage.loadIndex();
-    const entry = index[pluginId];
+    const index = await loadCacheIndex(storage);
+    const bundleUrl = pluginBundleUrl(pluginId);
+    const entry = index[bundleUrl];
     if (entry) {
-      this.modules.delete(entry.bundleUrl);
-      delete index[pluginId];
+      this.modules.delete(bundleUrl);
+      delete index[bundleUrl];
       await storage.saveIndex(index);
       try {
         await storage.deleteBundle(entry.localPath);
@@ -2489,12 +2634,11 @@ var BundleManager = class {
       throw new Error("[BundleManager] tenant changed before load started \u2014 discarding (fail closed)");
     }
     if (this.modules.has(bundleUrl)) {
-      const prev = this.provenance.get(bundleUrl);
-      if (prev) this.provenance.set(bundleUrl, { ...prev, source: "memory", expected: expectedHash?.toLowerCase() ?? prev.expected });
+      this.markMemoryHit(bundleUrl, expectedHash);
       return;
     }
     const storage = getBundleStorage();
-    const index = await storage.loadIndex();
+    const index = await loadCacheIndex(storage);
     const expectedLc = expectedHash ? expectedHash.toLowerCase() : null;
     let content = null;
     let verifiedHash = null;
@@ -2557,30 +2701,90 @@ var BundleManager = class {
     console.log(
       `[BundleManager] RUNNING ${bundleUrl} v${version} sha=${(verifiedHash || "none").slice(0, 12)} (${servedFrom}${expectedLc && verifiedHash && expectedLc !== verifiedHash ? `, EXPECTED ${expectedLc.slice(0, 12)} \u2014 STALE` : ""})`
     );
-    this.registerToolsFromModule(mod, bundleUrl);
   }
   /**
-   * Pick up every `tools` section in an evaluated bundle and put it in the
-   * device tool registry. Runs for UI, hybrid and tools-only bundles alike: a
-   * plugin that ships both gets its tools registered without its UI mounting.
+   * Register THIS plugin's device tools under the TRUSTED declaration, then
+   * record that declaration on the disk-cache entry. Runs on every trusted load
+   * — memory hit included — so the grants in force are always the latest the
+   * manifest gave (a revoked grant stops applying on the next load, not the next
+   * app start). Callers run it only after their stale check.
+   */
+  async commitTools(pluginId, bundleUrl, grants, tenant, epoch) {
+    const declaration = {
+      pluginId,
+      capabilities: grants.capabilities,
+      stateDomains: grants.stateDomains
+    };
+    this.registerToolsFromModule(this.modules.get(bundleUrl), declaration);
+    await this.recordTrustedDeclaration(bundleUrl, declaration, tenant, epoch);
+  }
+  /**
+   * Put the plugin's own `tools` section in the device tool registry — under the
+   * pluginId and grants the MANIFEST resolved, never the bundle's own `id`,
+   * `capabilities` or `stateDomains`. A bundle is code the manifest authorised
+   * by hash; what it may touch is the manifest's to say, same as its rendered
+   * surface (resolvePluginRuntimeProps). Its own `id` would also let it register
+   * as another plugin — including the host's platform tools, which a same-id
+   * re-registration replaces.
+   *
+   * Only this plugin's export (the same lookup the component uses) is
+   * registered. Another export's tools in the same bundle belong to another
+   * plugin and register when THAT plugin's manifest loads it.
    */
-  registerToolsFromModule(mod, bundleUrl) {
+  registerToolsFromModule(mod, { pluginId, capabilities, stateDomains }) {
     if (!mod) return;
-    for (const key of Object.keys(mod)) {
-      const val = mod[key];
-      if (!val || typeof val !== "object" || !Array.isArray(val.tools) || val.tools.length === 0) {
-        continue;
-      }
-      const pluginId = typeof val.id === "string" ? val.id : `${bundleUrl}#${key}`;
-      try {
-        registerDeviceTools(pluginId, val.tools, val.capabilities, val.stateDomains);
-        this.registeredToolPluginIds.add(pluginId);
-      } catch (err) {
-        console.warn(
-          `[BundleManager] tool registration failed for ${pluginId}:`,
-          err instanceof Error ? err.message : String(err)
-        );
+    const own = this.findPluginExport(mod, pluginId, hasTools);
+    const others = Object.keys(mod).filter((k) => hasTools(mod[k]) && mod[k] !== own);
+    if (others.length > 0) {
+      console.warn(
+        `[BundleManager] ${pluginId}: not registering tools from export(s) ${others.join(", ")} \u2014 they are not this plugin's, and only their own manifest can grant them`
+      );
+    }
+    if (!own) return;
+    const ungranted = [
+      ...(Array.isArray(own.stateDomains) ? own.stateDomains : []).filter((d) => !stateDomains?.includes(d)),
+      ...Object.keys(own.capabilities || {}).filter((k) => own.capabilities[k] === true && !capabilities?.[k])
+    ];
+    if (ungranted.length > 0) {
+      console.warn(
+        `[BundleManager] ${pluginId}: bundle declares ${ungranted.join(", ")} but the manifest does not grant it \u2014 denied`
+      );
+    }
+    try {
+      registerDeviceTools(pluginId, own.tools, capabilities, stateDomains);
+      this.registeredToolPluginIds.add(pluginId);
+    } catch (err) {
+      console.warn(
+        `[BundleManager] tool registration failed for ${pluginId}:`,
+        err instanceof Error ? err.message : String(err)
+      );
+    }
+  }
+  /**
+   * Record the trusted declaration on this tenant's disk-cache entry for the
+   * bytes RUNNING — the recovery path (tools/loader loadFromDiskCache) has no
+   * manifest and re-registers with exactly this. Only onto an entry this tenant
+   * owns whose hash is the running hash: the grant was issued for these bytes,
+   * and those are the bytes recovery will evaluate. Best-effort — a lost write
+   * leaves no `trusted`, which recovery treats as fail closed.
+   */
+  async recordTrustedDeclaration(bundleUrl, declaration, tenant, epoch) {
+    const key = JSON.stringify(declaration);
+    if (this.recordedDeclarations.get(bundleUrl) === key) return;
+    try {
+      const storage = getBundleStorage();
+      const index = await loadCacheIndex(storage);
+      const entry = index[bundleUrl];
+      const running = this.provenance.get(bundleUrl)?.hash;
+      if (!entry || entry.tenant !== tenant || !running || entry.bundleHash?.toLowerCase() !== running) return;
+      if (this.isStale(epoch, tenant)) return;
+      if (JSON.stringify(entry.trusted) !== key) {
+        index[bundleUrl] = { ...entry, trusted: declaration };
+        await storage.saveIndex(index);
       }
+      this.recordedDeclarations.set(bundleUrl, key);
+    } catch (err) {
+      console.warn("[BundleManager] could not record trusted declaration:", err);
     }
   }
   /**
@@ -2663,29 +2867,26 @@ var BundleManager = class {
     return materialized;
   }
   // ── Private: component extraction ───────────────────────────
+  /** Find a plugin component in a loaded module. */
+  getComponentFromMemory(pluginId, bundleUrl) {
+    return this.findPluginExport(this.modules.get(bundleUrl), pluginId, hasComponent);
+  }
   /**
-   * Find a plugin component in a loaded module.
-   * Handles: default export, direct key match, multi-plugin .id match.
+   * Find THIS plugin's export in a loaded module — the one lookup both the
+   * component and the device tools use, so a plugin's UI and its tools always
+   * come from the same export. `accept` says what the caller needs from it.
+   * Handles: direct key match, PascalCase key, default export, multi-plugin .id match.
    */
-  getComponentFromMemory(pluginId, bundleUrl) {
-    const mod = this.modules.get(bundleUrl);
+  findPluginExport(mod, pluginId, accept) {
     if (!mod) return null;
     const shortName = pluginId.includes(":") ? pluginId.split(":").pop() : pluginId;
-    if (mod[pluginId] && typeof mod[pluginId].Component === "function") {
-      return mod[pluginId];
-    }
+    if (accept(mod[pluginId])) return mod[pluginId];
     const pascal = shortName.replace(/(^|-)([a-z])/g, (_, __, c) => c.toUpperCase());
-    if (mod[pascal] && typeof mod[pascal] === "object" && typeof mod[pascal].Component === "function") {
-      return mod[pascal];
-    }
-    if (mod.default && typeof mod.default === "object" && typeof mod.default.Component === "function") {
-      return mod.default;
-    }
+    if (accept(mod[pascal])) return mod[pascal];
+    if (accept(mod.default)) return mod.default;
     for (const key of Object.keys(mod)) {
       const val = mod[key];
-      if (val && typeof val === "object" && val.id === shortName && typeof val.Component === "function") {
-        return val;
-      }
+      if (val && (val.id === pluginId || val.id === shortName) && accept(val)) return val;
     }
     return null;
   }
@@ -2700,6 +2901,107 @@ var BundleManager = class {
 };
 var bundleManager = new BundleManager();
 
+// src/voiceHost.ts
+var _provider2 = null;
+function setVoiceProvider(provider) {
+  _provider2 = provider || null;
+}
+function implementedVoice() {
+  return !!_provider2;
+}
+function voiceDenial(why) {
+  const err = new Error(`voice: ${why}`);
+  err.code = "RESTRICTED";
+  return err;
+}
+function deniedVoice(why) {
+  const fail = () => {
+    throw voiceDenial(why);
+  };
+  return {
+    async start() {
+      return fail();
+    },
+    stop() {
+      fail();
+    },
+    setMuted() {
+      fail();
+    },
+    prompt() {
+      fail();
+    },
+    observe() {
+      fail();
+    },
+    getSnapshot() {
+      return {
+        state: "error",
+        sessionId: null,
+        muted: false,
+        speaking: false,
+        listening: false,
+        userSpeaking: false,
+        lastUserSpeechEndedAt: null,
+        lastDeviceTool: null,
+        authorizedSessionId: null,
+        lastError: why
+      };
+    },
+    subscribe() {
+      return fail();
+    },
+    transcript() {
+      return [];
+    }
+  };
+}
+function scopedVoice(provider, pluginId) {
+  return {
+    start: (opts) => provider.start(opts, pluginId),
+    stop: () => provider.stop(pluginId),
+    setMuted: (muted) => provider.setMuted(muted, pluginId),
+    prompt: (input) => provider.prompt(input, pluginId),
+    observe: (text) => provider.observe(text, pluginId),
+    getSnapshot: () => provider.getSnapshot(pluginId),
+    subscribe: (cb) => provider.subscribe(cb, pluginId),
+    transcript: () => provider.transcript(pluginId)
+  };
+}
+function gateVoice(declared, pluginId) {
+  if (!declared) {
+    return deniedVoice(
+      "not declared in this plugin's capabilities. Add `capabilities: { voice: true }` to use it."
+    );
+  }
+  if (!pluginId) {
+    return deniedVoice(
+      "no plugin identity \u2014 voice fails closed without a caller to scope the session to."
+    );
+  }
+  return _provider2 ? scopedVoice(_provider2, pluginId) : deniedVoice(
+    "no voice session in this build \u2014 the app has not mounted a VoiceSessionHost / called setVoiceProvider."
+  );
+}
+
+// src/pluginRuntime.ts
+function mergeCaps(decl) {
+  if (!decl) return void 0;
+  return { ...decl.native, ...decl.capabilities };
+}
+function resolvePluginGrants(src) {
+  const trusted = src.manifest ?? src.plugin ?? null;
+  const stateDomains = trusted?.stateDomains ? [...trusted.stateDomains] : void 0;
+  return { capabilities: mergeCaps(trusted), stateDomains };
+}
+function resolvePluginRuntimeProps(src) {
+  const { capabilities, stateDomains } = resolvePluginGrants(src);
+  const native = gatePluginNative(getPluginNative(), capabilities, src.pluginId);
+  const deviceState = gateDeviceState(stateDomains);
+  const voice = gateVoice(!!capabilities?.voice, src.pluginId);
+  return { device: native, native, deviceState, voice };
+}
+
 // src/tools/loader.ts
 import { getTenant as getTenant3 } from "@ateam-ai-mobile/core";
 var inflight = null;
@@ -2740,7 +3042,8 @@ async function ensureDeviceToolsLoaded({ force = false } = {}) {
               m.id,
               bundleUrl,
               m.version || "1.0.0",
-              getNativeBundleHash(m) || void 0
+              getNativeBundleHash(m) || void 0,
+              resolvePluginGrants({ pluginId: m.id, manifest: m })
             );
           } catch (err) {
             console.warn(`[deviceTools] ${m.id} failed to load:`, err?.message || String(err));
@@ -2759,7 +3062,7 @@ async function ensureDeviceToolsLoaded({ force = false } = {}) {
 }
 async function loadFromDiskCache() {
   try {
-    const index = await getBundleStorage().loadIndex();
+    const index = await loadCacheIndex(getBundleStorage());
     const entries = Object.values(index || {});
     if (entries.length === 0) return [];
     const tenant = getTenant3();
@@ -2772,10 +3075,16 @@ async function loadFromDiskCache() {
     if (skipped > 0) {
       console.log(`[deviceTools] disk-cache recovery: ${mine.length} for "${tenant}", skipped ${skipped} not owned by it`);
     }
-    if (mine.length === 0) return [];
-    await Promise.all(mine.map(async (e) => {
+    const declared = mine.filter((e) => !!e.trusted?.pluginId);
+    if (declared.length < mine.length) {
+      console.log(
+        `[deviceTools] disk-cache recovery: skipped ${mine.length - declared.length} with no recorded manifest grant (fail closed)`
+      );
+    }
+    if (declared.length === 0) return [];
+    await Promise.all(declared.map(async (e) => {
       try {
-        await bundleManager.loadTools("cache:" + e.bundleUrl, e.bundleUrl, e.version, e.bundleHash);
+        await bundleManager.loadTools(e.trusted.pluginId, e.bundleUrl, e.version, e.bundleHash, e.trusted);
       } catch {
       }
     }));
@@ -2790,11 +3099,14 @@ function resetDeviceToolLoader() {
 }
 
 export {
-  __export,
   register,
   registerTools,
   registerService,
   PLATFORM_VOICE_CALLER,
+  isActionable,
+  neverObserved,
+  explainCapability,
+  device_state_exports,
   View,
   Text,
   ScrollView,
@@ -2839,6 +3151,11 @@ export {
   setDeviceStateProvider,
   gateDeviceState,
   implementedStateDomains,
+  setVoiceProvider,
+  implementedVoice,
+  gateVoice,
+  resolvePluginGrants,
+  resolvePluginRuntimeProps,
   useNativeBridge,
   createNativeBridge,
   setDeviceToolContextProvider,
@@ -2848,6 +3165,7 @@ export {
   listDeviceTools,
   callDeviceTool,
   clearDeviceTools,
+  pluginBundleUrl,
   supportsNative,
   getNativeComponentId,
   getNativeBundleUrl,
@@ -2870,4 +3188,4 @@ export {
   ensureDeviceToolsLoaded,
   resetDeviceToolLoader
 };
-//# sourceMappingURL=chunk-PKDQLNBL.mjs.map
+//# sourceMappingURL=chunk-SICFDA5K.mjs.map