@ateam-ai-mobile/plugin-runtime 0.1.7 → 0.1.9

package/dist/index.js

@@ -75,6 +75,66 @@ var init_voice = __esm({
   }
 });
 
+// src/sdk/device-state.ts
+var device_state_exports = {};
+__export(device_state_exports, {
+  DeviceBridgeError: () => DeviceBridgeError,
+  explainCapability: () => explainCapability,
+  isActionable: () => isActionable,
+  neverObserved: () => neverObserved
+});
+function isActionable(quality, budget) {
+  const { freshness, confidence } = quality;
+  if (freshness.state === "unknown" || freshness.state === "stale") return false;
+  if (freshness.ageMs === null || freshness.ageMs > budget.maxAgeMs) return false;
+  if (budget.minConfidence) {
+    const have = CONFIDENCE_ORDER[confidence?.level ?? "unknown"];
+    if (have < CONFIDENCE_ORDER[budget.minConfidence]) return false;
+  }
+  return true;
+}
+function neverObserved() {
+  return { state: "unknown", observedAt: null, ageMs: null };
+}
+function explainCapability(status) {
+  if (status.support === "unsupported") return "this device does not have it";
+  if (status.permission === "denied") return "permission was denied";
+  if (status.permission === "restricted") return "permission is restricted";
+  if (status.permission === "notDetermined") return "permission has not been asked for yet";
+  if (status.permission === "limited") return "only limited access was granted";
+  if (status.restriction === "policyRestricted") return "this plugin did not declare it";
+  if (status.restriction === "backgroundRestricted") return "the app is in the background";
+  if (status.restriction === "lowPowerRestricted") return "the device is in low-power mode";
+  if (status.availability === "busy") return "it is in use by something else";
+  if (status.availability === "temporarilyUnavailable") return "it is temporarily unavailable";
+  if (status.availability === "unavailable") return "it is unavailable";
+  if (status.support === "unknown" || status.availability === "unknown") {
+    return "its state could not be determined";
+  }
+  return null;
+}
+var DeviceBridgeError, CONFIDENCE_ORDER;
+var init_device_state = __esm({
+  "src/sdk/device-state.ts"() {
+    "use strict";
+    DeviceBridgeError = class extends Error {
+      constructor(code, message, opts) {
+        super(message);
+        this.name = "DeviceBridgeError";
+        this.code = code;
+        this.domain = opts?.domain;
+        this.recoverable = opts?.recoverable;
+      }
+    };
+    CONFIDENCE_ORDER = {
+      unknown: 0,
+      low: 1,
+      medium: 2,
+      high: 3
+    };
+  }
+});
+
 // src/sdk/primitives.ts
 var import_react_native;
 var init_primitives = __esm({
@@ -395,7 +455,8 @@ function gatePluginNative(native, declared, pluginId) {
     // every method refuses by name. Both are better than the `undefined` this
     // used to be, which crashed with "cannot read properties of undefined".
     bluetooth: caps.bluetooth ? native.bluetooth : blocked("bluetooth"),
-    vision: caps.vision ? native.vision : blocked("vision")
+    vision: caps.vision ? native.vision : blocked("vision"),
+    maps: caps.maps ? native.maps : blocked("maps")
     // What this plugin DECLARED, carried on the object it already receives.
     //
     // It is how a COMPONENT can be capability-gated: <CameraPreview> is handed
@@ -455,7 +516,8 @@ var init_host = __esm({
       scanner: unavailable("scanner"),
       nfc: unavailable("nfc"),
       bluetooth: unavailable("bluetooth"),
-      vision: unavailable("vision")
+      vision: unavailable("vision"),
+      maps: unavailable("maps")
     };
     _pluginNative = noopNative;
     _cameraPreview = null;
@@ -664,6 +726,8 @@ __export(sdk_exports, {
   TextInput: () => import_react_native.TextInput,
   TouchableOpacity: () => import_react_native.TouchableOpacity,
   View: () => import_react_native.View,
+  explainCapability: () => explainCapability,
+  isActionable: () => isActionable,
   register: () => register,
   registerService: () => registerService,
   registerTools: () => registerTools,
@@ -678,6 +742,7 @@ var init_sdk = __esm({
     init_registration();
     init_registration();
     init_voice();
+    init_device_state();
     init_primitives();
     init_components();
     init_CameraPreview();
@@ -814,6 +879,19 @@ function gateDeviceState(declared) {
   }
   return out;
 }
+function withoutSubscribe(state) {
+  if (!state) return state;
+  const out = {};
+  for (const domain of ALL_DOMAINS) {
+    const d = state[domain];
+    out[domain] = d && Object.assign(Object.create(d), {
+      subscribe() {
+        throw denial(domain, "a device tool call has no lifetime to own a subscription. Subscribe from the plugin UI, or read getSnapshot() within the call.");
+      }
+    });
+  }
+  return out;
+}
 function implementedStateDomains() {
   return ALL_DOMAINS.filter((d) => !!_provider[d]);
 }
@@ -839,6 +917,121 @@ var init_deviceStateHost = __esm({
   }
 });
 
+// src/voiceHost.ts
+function setVoiceProvider(provider) {
+  _provider2 = provider || null;
+}
+function implementedVoice() {
+  return !!_provider2;
+}
+function voiceDenial(why) {
+  const err = new Error(`voice: ${why}`);
+  err.code = "RESTRICTED";
+  return err;
+}
+function deniedVoice(why) {
+  const fail = () => {
+    throw voiceDenial(why);
+  };
+  return {
+    async start() {
+      return fail();
+    },
+    stop() {
+      fail();
+    },
+    setMuted() {
+      fail();
+    },
+    prompt() {
+      fail();
+    },
+    observe() {
+      fail();
+    },
+    getSnapshot() {
+      return {
+        state: "error",
+        sessionId: null,
+        muted: false,
+        speaking: false,
+        listening: false,
+        userSpeaking: false,
+        lastUserSpeechEndedAt: null,
+        lastDeviceTool: null,
+        authorizedSessionId: null,
+        lastError: why
+      };
+    },
+    subscribe() {
+      return fail();
+    },
+    transcript() {
+      return [];
+    }
+  };
+}
+function scopedVoice(provider, pluginId) {
+  return {
+    start: (opts) => provider.start(opts, pluginId),
+    stop: () => provider.stop(pluginId),
+    setMuted: (muted) => provider.setMuted(muted, pluginId),
+    prompt: (input) => provider.prompt(input, pluginId),
+    observe: (text) => provider.observe(text, pluginId),
+    getSnapshot: () => provider.getSnapshot(pluginId),
+    subscribe: (cb) => provider.subscribe(cb, pluginId),
+    transcript: () => provider.transcript(pluginId)
+  };
+}
+function gateVoice(declared, pluginId) {
+  if (!declared) {
+    return deniedVoice(
+      "not declared in this plugin's capabilities. Add `capabilities: { voice: true }` to use it."
+    );
+  }
+  if (!pluginId) {
+    return deniedVoice(
+      "no plugin identity \u2014 voice fails closed without a caller to scope the session to."
+    );
+  }
+  return _provider2 ? scopedVoice(_provider2, pluginId) : deniedVoice(
+    "no voice session in this build \u2014 the app has not mounted a VoiceSessionHost / called setVoiceProvider."
+  );
+}
+var _provider2;
+var init_voiceHost = __esm({
+  "src/voiceHost.ts"() {
+    "use strict";
+    _provider2 = null;
+  }
+});
+
+// src/pluginRuntime.ts
+function mergeCaps(decl) {
+  if (!decl) return void 0;
+  return { ...decl.native, ...decl.capabilities };
+}
+function resolvePluginGrants(src) {
+  const trusted = src.manifest ?? src.plugin ?? null;
+  const stateDomains = trusted?.stateDomains ? [...trusted.stateDomains] : void 0;
+  return { capabilities: mergeCaps(trusted), stateDomains };
+}
+function resolvePluginRuntimeProps(src) {
+  const { capabilities, stateDomains } = resolvePluginGrants(src);
+  const native = gatePluginNative(getPluginNative(), capabilities, src.pluginId);
+  const deviceState = gateDeviceState(stateDomains);
+  const voice = gateVoice(!!capabilities?.voice, src.pluginId);
+  return { device: native, native, deviceState, voice };
+}
+var init_pluginRuntime = __esm({
+  "src/pluginRuntime.ts"() {
+    "use strict";
+    init_host();
+    init_deviceStateHost();
+    init_voiceHost();
+  }
+});
+
 // src/bridge/native.ts
 function buildContext(pluginId, connectorId) {
   const user = (0, import_core2.getUser)();
@@ -1086,8 +1279,9 @@ function unregisterDeviceTools(pluginId) {
     if (entry.pluginId === pluginId) registry.delete(name);
   }
 }
-function hasDeviceTool(name) {
-  return registry.has(name);
+function hasDeviceTool(name, pluginId) {
+  const entry = registry.get(name);
+  return !!entry && (pluginId === void 0 || entry.pluginId === pluginId);
 }
 function listDeviceTools() {
   return Array.from(registry.entries()).map(([name, { pluginId, tool }]) => ({
@@ -1106,8 +1300,11 @@ async function callDeviceTool(name, args = {}, opts = {}) {
   let timer;
   try {
     const build = contextProvider || defaultContext;
+    const built = build(entry.pluginId, entry.capabilities, entry.stateDomains);
     const ctx = {
-      ...build(entry.pluginId, entry.capabilities, entry.stateDomains),
+      ...built,
+      // Whoever built the context, a call cannot own a subscription.
+      deviceState: withoutSubscribe(built.deviceState),
       signal: opts.signal
     };
     const result = await Promise.race([
@@ -1144,6 +1341,26 @@ var init_registry = __esm({
   }
 });
 
+// src/bundles/bundleUrl.ts
+function pluginBundleUrl(pluginId) {
+  return `/api/ui-plugins/${encodeURIComponent(pluginId)}/bundle.js`;
+}
+function isPluginBundleUrl(url, pluginId) {
+  if (typeof url !== "string") return false;
+  const canonical = pluginBundleUrl(pluginId);
+  if (url === canonical) return true;
+  try {
+    return decodeURIComponent(url) === decodeURIComponent(canonical);
+  } catch {
+    return false;
+  }
+}
+var init_bundleUrl = __esm({
+  "src/bundles/bundleUrl.ts"() {
+    "use strict";
+  }
+});
+
 // src/api/plugins.ts
 function supportsNative(manifest) {
   const mode = manifest.render?.mode;
@@ -1155,12 +1372,9 @@ function getNativeComponentId(manifest) {
   return null;
 }
 function getNativeBundleUrl(manifest) {
-  const direct = manifest.bundleUrl;
-  if (direct) return direct;
   const render = manifest.render;
-  if (render.mode === "react-native") return render.bundleUrl || null;
-  if (render.mode === "adaptive") return render.reactNative?.bundleUrl || null;
-  return null;
+  const declared = manifest.bundleUrl || (render?.mode === "react-native" ? render.bundleUrl : null) || (render?.mode === "adaptive" ? render.reactNative?.bundleUrl : null);
+  return declared && manifest.id ? pluginBundleUrl(manifest.id) : null;
 }
 function getNativeBundleHash(manifest) {
   const direct = manifest.bundleHash;
@@ -1250,6 +1464,7 @@ var init_plugins = __esm({
     "use strict";
     import_core3 = require("@ateam-ai-mobile/core");
     import_core4 = require("@ateam-ai-mobile/core");
+    init_bundleUrl();
   }
 });
 
@@ -2078,6 +2293,20 @@ var init_SurfaceDispatcher = __esm({
   }
 });
 
+// src/bundles/bundleModuleNames.ts
+function sdkModuleRefusal(name) {
+  if (name === PLUGIN_SDK_MODULE) return null;
+  if (!name.startsWith("@ateam-ai-mobile/") && !name.startsWith("@adas/")) return null;
+  return `a plugin bundle required '${name}', which does not exist inside a bundle. Import from '${PLUGIN_SDK_MODULE}' instead \u2014 it is the only SDK module a bundle can require (values and types alike), and the one to keep external when building. '@ateam-ai-mobile/*' are the host app's packages, not the plugin's.`;
+}
+var PLUGIN_SDK_MODULE;
+var init_bundleModuleNames = __esm({
+  "src/bundles/bundleModuleNames.ts"() {
+    "use strict";
+    PLUGIN_SDK_MODULE = "@adas/plugin-sdk";
+  }
+});
+
 // src/utils/sha256.ts
 function sha256Hex(message) {
   const utf8 = unescape(encodeURIComponent(message));
@@ -2244,6 +2473,22 @@ function selectOwnedCacheEntries(entries, tenant) {
   if (!tenant) return [];
   return (entries || []).filter((e) => !!e && e.tenant === tenant);
 }
+async function loadCacheIndex(storage = getBundleStorage()) {
+  const index = await storage.loadIndex() || {};
+  for (const [key, entry] of Object.entries(index)) {
+    const pluginId = entry?.trusted?.pluginId;
+    if (!pluginId) continue;
+    const canonical = pluginBundleUrl(pluginId);
+    if (key === canonical) continue;
+    if (!isPluginBundleUrl(key, pluginId) || !isPluginBundleUrl(entry.bundleUrl, pluginId)) continue;
+    delete index[key];
+    const held = index[canonical];
+    if (!held || (entry.timestamp ?? 0) > (held.timestamp ?? 0)) {
+      index[canonical] = { ...entry, bundleUrl: canonical };
+    }
+  }
+  return index;
+}
 function setBundleStorage(storage) {
   _storage = storage;
 }
@@ -2254,6 +2499,7 @@ var MemoryBundleStorage, _storage;
 var init_storage = __esm({
   "src/bundles/storage.ts"() {
     "use strict";
+    init_bundleUrl();
     MemoryBundleStorage = class {
       constructor() {
         this.index = {};
@@ -2286,7 +2532,10 @@ var init_storage = __esm({
 });
 
 // src/bundles/bundleManager.ts
-var import_react9, import_react10, ReactNative, import_core9, ReactShim, PluginSDKShim, requireShim, CACHE_TTL, BundleManager, bundleManager;
+function bundleKey(pluginId, bundleUrl) {
+  return isPluginBundleUrl(bundleUrl, pluginId) ? pluginBundleUrl(pluginId) : bundleUrl;
+}
+var import_react9, import_react10, ReactNative, import_core9, ReactShim, PluginSDKShim, requireShim, CACHE_TTL, hasComponent, hasTools, BundleManager, bundleManager;
 var init_bundleManager = __esm({
   "src/bundles/bundleManager.ts"() {
     "use strict";
@@ -2301,9 +2550,11 @@ var init_bundleManager = __esm({
     init_store();
     init_SurfaceDispatcher();
     init_host();
+    init_bundleModuleNames();
     init_sha256();
     init_integrity();
     init_storage();
+    init_bundleUrl();
     init_registry();
     ReactShim = {
       __esModule: true,
@@ -2350,13 +2601,17 @@ var init_bundleManager = __esm({
     requireShim = (name) => {
       if (name === "react") return ReactShim;
       if (name === "react-native") return ReactNative;
-      if (name === "@adas/plugin-sdk") return PluginSDKShim;
+      if (name === PLUGIN_SDK_MODULE) return PluginSDKShim;
+      const refusal = sdkModuleRefusal(name);
+      if (refusal) throw new Error(`[BundleManager] ${refusal}`);
       const hostModule = resolveBundleModule(name);
       if (hostModule !== void 0) return hostModule;
       console.warn(`[BundleManager] Unknown module: ${name} \u2014 register it via registerBundleModules()`);
       return {};
     };
     CACHE_TTL = 7 * 24 * 60 * 60 * 1e3;
+    hasComponent = (val) => !!val && typeof val === "object" && typeof val.Component === "function";
+    hasTools = (val) => !!val && typeof val === "object" && Array.isArray(val.tools) && val.tools.length > 0;
     BundleManager = class {
       constructor() {
         /** In-memory module cache: bundleUrl → evaluated module.exports. Holds ONE
@@ -2387,6 +2642,9 @@ var init_bundleManager = __esm({
          * of the previous tenant's tools.
          */
         this.registeredToolPluginIds = /* @__PURE__ */ new Set();
+        /** bundleUrl → the trusted declaration last recorded on its disk-cache entry
+         *  this session, so a memory hit with unchanged grants skips the index I/O. */
+        this.recordedDeclarations = /* @__PURE__ */ new Map();
         /**
          * Enforce the in-memory tenant boundary. Call at the top of every public load
          * path, BEFORE any cache read.
@@ -2432,6 +2690,7 @@ var init_bundleManager = __esm({
           }
         }
         this.registeredToolPluginIds.clear();
+        this.recordedDeclarations.clear();
         this.modules.clear();
         this.provenance.clear();
         this.inflight.clear();
@@ -2443,13 +2702,15 @@ var init_bundleManager = __esm({
       isStale(epoch, tenant) {
         return this.epoch !== epoch || (0, import_core9.getTenant)() !== tenant;
       }
-      /** Flip an existing provenance record to source:'memory' — a later serve of an
-       *  already-evaluated bundle came from the in-memory cache, not a fresh
-       *  download/disk read. No-op if nothing was recorded yet. */
-      markMemoryHit(bundleUrl) {
+      /** Record a memory serve: the running bytes are the already-evaluated module,
+       *  and `expected` is refreshed from the manifest hash the caller JUST passed —
+       *  so after a redeploy the record reads hash !== expected (STALE) instead of
+       *  the old in-sync pair. The ONE place both memory paths (load()'s early return
+       *  and loadModule's) record reuse. No-op if nothing was recorded yet. */
+      markMemoryHit(bundleUrl, expectedHash) {
         const prev = this.provenance.get(bundleUrl);
-        if (prev && prev.source !== "memory") {
-          this.provenance.set(bundleUrl, { ...prev, source: "memory" });
+        if (prev) {
+          this.provenance.set(bundleUrl, { ...prev, source: "memory", expected: expectedHash?.toLowerCase() ?? prev.expected });
         }
       }
       // ── Public API ──────────────────────────────────────────────
@@ -2461,13 +2722,22 @@ var init_bundleManager = __esm({
        * provided for any bundle the user has not previously verified — without
        * it, a tampered bundle is `eval`'d as JS with full RN runtime + every
        * native capability the manifest declares.
+       *
+       * `grants` is what the MANIFEST grants this plugin (resolvePluginGrants) — the
+       * only authority its device tools are registered under. Omitted (e.g. a
+       * prewarm from the slim plugin list) → the bundle is loaded but its tools are
+       * NOT registered: without the manifest there is nothing trusted to gate them
+       * on, and registering with nothing would downgrade a registration the
+       * manifest-driven tool loader already made.
        */
-      async load(pluginId, bundleUrl, version, expectedHash) {
+      async load(pluginId, bundleUrl, version, expectedHash, grants) {
+        bundleUrl = bundleKey(pluginId, bundleUrl);
         const tenant = this.requireTenant();
         const epoch = this.epoch;
         const cached = this.getComponentFromMemory(pluginId, bundleUrl);
         if (cached) {
-          this.markMemoryHit(bundleUrl);
+          this.markMemoryHit(bundleUrl, expectedHash);
+          if (grants) await this.commitTools(pluginId, bundleUrl, grants, tenant, epoch);
           return cached;
         }
         let modulePromise = this.inflight.get(bundleUrl);
@@ -2484,6 +2754,7 @@ var init_bundleManager = __esm({
         if (this.isStale(epoch, tenant)) {
           throw new Error("[BundleManager] tenant changed while loading \u2014 discarding (fail closed)");
         }
+        if (grants) await this.commitTools(pluginId, bundleUrl, grants, tenant, epoch);
         const component = this.getComponentFromMemory(pluginId, bundleUrl);
         if (!component) {
           throw new Error(
@@ -2498,8 +2769,15 @@ var init_bundleManager = __esm({
        * Same download, same integrity check, same evaluation as `load()`; the only
        * difference is that a bundle exporting tools and no `Component` is a success
        * here rather than "no component found". Returns the tool names registered.
+       *
+       * `grants` is REQUIRED: the tools are registered under `pluginId` with exactly
+       * what the manifest grants (see load()), never what the bundle claims.
        */
-      async loadTools(pluginId, bundleUrl, version, expectedHash) {
+      async loadTools(pluginId, bundleUrl, version, expectedHash, grants) {
+        if (!grants) {
+          throw new Error(`[BundleManager] loadTools(${pluginId}) needs the manifest's grants (resolvePluginGrants) \u2014 refusing to register tools on the bundle's own claim`);
+        }
+        bundleUrl = bundleKey(pluginId, bundleUrl);
         const tenant = this.requireTenant();
         const epoch = this.epoch;
         let modulePromise = this.inflight.get(bundleUrl);
@@ -2516,6 +2794,7 @@ var init_bundleManager = __esm({
         if (this.isStale(epoch, tenant)) {
           throw new Error("[BundleManager] tenant changed while loading tools \u2014 discarding (fail closed)");
         }
+        await this.commitTools(pluginId, bundleUrl, grants, tenant, epoch);
         const names = listDeviceTools().filter((t) => t.pluginId === pluginId).map((t) => t.name);
         if (names.length === 0) {
           console.warn(
@@ -2541,7 +2820,7 @@ var init_bundleManager = __esm({
             const it = queue.shift();
             if (!it) return;
             try {
-              await this.load(it.pluginId, it.bundleUrl, it.version, it.bundleHash);
+              await this.load(it.pluginId, it.bundleUrl, it.version, it.bundleHash, it.grants);
               okCount++;
             } catch (err) {
               failCount++;
@@ -2569,11 +2848,12 @@ var init_bundleManager = __esm({
        */
       async clearPlugin(pluginId) {
         const storage = getBundleStorage();
-        const index = await storage.loadIndex();
-        const entry = index[pluginId];
+        const index = await loadCacheIndex(storage);
+        const bundleUrl = pluginBundleUrl(pluginId);
+        const entry = index[bundleUrl];
         if (entry) {
-          this.modules.delete(entry.bundleUrl);
-          delete index[pluginId];
+          this.modules.delete(bundleUrl);
+          delete index[bundleUrl];
           await storage.saveIndex(index);
           try {
             await storage.deleteBundle(entry.localPath);
@@ -2598,12 +2878,11 @@ var init_bundleManager = __esm({
           throw new Error("[BundleManager] tenant changed before load started \u2014 discarding (fail closed)");
         }
         if (this.modules.has(bundleUrl)) {
-          const prev = this.provenance.get(bundleUrl);
-          if (prev) this.provenance.set(bundleUrl, { ...prev, source: "memory", expected: expectedHash?.toLowerCase() ?? prev.expected });
+          this.markMemoryHit(bundleUrl, expectedHash);
           return;
         }
         const storage = getBundleStorage();
-        const index = await storage.loadIndex();
+        const index = await loadCacheIndex(storage);
         const expectedLc = expectedHash ? expectedHash.toLowerCase() : null;
         let content = null;
         let verifiedHash = null;
@@ -2666,30 +2945,90 @@ var init_bundleManager = __esm({
         console.log(
           `[BundleManager] RUNNING ${bundleUrl} v${version} sha=${(verifiedHash || "none").slice(0, 12)} (${servedFrom}${expectedLc && verifiedHash && expectedLc !== verifiedHash ? `, EXPECTED ${expectedLc.slice(0, 12)} \u2014 STALE` : ""})`
         );
-        this.registerToolsFromModule(mod, bundleUrl);
       }
       /**
-       * Pick up every `tools` section in an evaluated bundle and put it in the
-       * device tool registry. Runs for UI, hybrid and tools-only bundles alike: a
-       * plugin that ships both gets its tools registered without its UI mounting.
+       * Register THIS plugin's device tools under the TRUSTED declaration, then
+       * record that declaration on the disk-cache entry. Runs on every trusted load
+       * — memory hit included — so the grants in force are always the latest the
+       * manifest gave (a revoked grant stops applying on the next load, not the next
+       * app start). Callers run it only after their stale check.
        */
-      registerToolsFromModule(mod, bundleUrl) {
+      async commitTools(pluginId, bundleUrl, grants, tenant, epoch) {
+        const declaration = {
+          pluginId,
+          capabilities: grants.capabilities,
+          stateDomains: grants.stateDomains
+        };
+        this.registerToolsFromModule(this.modules.get(bundleUrl), declaration);
+        await this.recordTrustedDeclaration(bundleUrl, declaration, tenant, epoch);
+      }
+      /**
+       * Put the plugin's own `tools` section in the device tool registry — under the
+       * pluginId and grants the MANIFEST resolved, never the bundle's own `id`,
+       * `capabilities` or `stateDomains`. A bundle is code the manifest authorised
+       * by hash; what it may touch is the manifest's to say, same as its rendered
+       * surface (resolvePluginRuntimeProps). Its own `id` would also let it register
+       * as another plugin — including the host's platform tools, which a same-id
+       * re-registration replaces.
+       *
+       * Only this plugin's export (the same lookup the component uses) is
+       * registered. Another export's tools in the same bundle belong to another
+       * plugin and register when THAT plugin's manifest loads it.
+       */
+      registerToolsFromModule(mod, { pluginId, capabilities, stateDomains }) {
         if (!mod) return;
-        for (const key of Object.keys(mod)) {
-          const val = mod[key];
-          if (!val || typeof val !== "object" || !Array.isArray(val.tools) || val.tools.length === 0) {
-            continue;
-          }
-          const pluginId = typeof val.id === "string" ? val.id : `${bundleUrl}#${key}`;
-          try {
-            registerDeviceTools(pluginId, val.tools, val.capabilities, val.stateDomains);
-            this.registeredToolPluginIds.add(pluginId);
-          } catch (err) {
-            console.warn(
-              `[BundleManager] tool registration failed for ${pluginId}:`,
-              err instanceof Error ? err.message : String(err)
-            );
+        const own = this.findPluginExport(mod, pluginId, hasTools);
+        const others = Object.keys(mod).filter((k) => hasTools(mod[k]) && mod[k] !== own);
+        if (others.length > 0) {
+          console.warn(
+            `[BundleManager] ${pluginId}: not registering tools from export(s) ${others.join(", ")} \u2014 they are not this plugin's, and only their own manifest can grant them`
+          );
+        }
+        if (!own) return;
+        const ungranted = [
+          ...(Array.isArray(own.stateDomains) ? own.stateDomains : []).filter((d) => !stateDomains?.includes(d)),
+          ...Object.keys(own.capabilities || {}).filter((k) => own.capabilities[k] === true && !capabilities?.[k])
+        ];
+        if (ungranted.length > 0) {
+          console.warn(
+            `[BundleManager] ${pluginId}: bundle declares ${ungranted.join(", ")} but the manifest does not grant it \u2014 denied`
+          );
+        }
+        try {
+          registerDeviceTools(pluginId, own.tools, capabilities, stateDomains);
+          this.registeredToolPluginIds.add(pluginId);
+        } catch (err) {
+          console.warn(
+            `[BundleManager] tool registration failed for ${pluginId}:`,
+            err instanceof Error ? err.message : String(err)
+          );
+        }
+      }
+      /**
+       * Record the trusted declaration on this tenant's disk-cache entry for the
+       * bytes RUNNING — the recovery path (tools/loader loadFromDiskCache) has no
+       * manifest and re-registers with exactly this. Only onto an entry this tenant
+       * owns whose hash is the running hash: the grant was issued for these bytes,
+       * and those are the bytes recovery will evaluate. Best-effort — a lost write
+       * leaves no `trusted`, which recovery treats as fail closed.
+       */
+      async recordTrustedDeclaration(bundleUrl, declaration, tenant, epoch) {
+        const key = JSON.stringify(declaration);
+        if (this.recordedDeclarations.get(bundleUrl) === key) return;
+        try {
+          const storage = getBundleStorage();
+          const index = await loadCacheIndex(storage);
+          const entry = index[bundleUrl];
+          const running = this.provenance.get(bundleUrl)?.hash;
+          if (!entry || entry.tenant !== tenant || !running || entry.bundleHash?.toLowerCase() !== running) return;
+          if (this.isStale(epoch, tenant)) return;
+          if (JSON.stringify(entry.trusted) !== key) {
+            index[bundleUrl] = { ...entry, trusted: declaration };
+            await storage.saveIndex(index);
           }
+          this.recordedDeclarations.set(bundleUrl, key);
+        } catch (err) {
+          console.warn("[BundleManager] could not record trusted declaration:", err);
         }
       }
       /**
@@ -2772,29 +3111,26 @@ var init_bundleManager = __esm({
         return materialized;
       }
       // ── Private: component extraction ───────────────────────────
+      /** Find a plugin component in a loaded module. */
+      getComponentFromMemory(pluginId, bundleUrl) {
+        return this.findPluginExport(this.modules.get(bundleUrl), pluginId, hasComponent);
+      }
       /**
-       * Find a plugin component in a loaded module.
-       * Handles: default export, direct key match, multi-plugin .id match.
+       * Find THIS plugin's export in a loaded module — the one lookup both the
+       * component and the device tools use, so a plugin's UI and its tools always
+       * come from the same export. `accept` says what the caller needs from it.
+       * Handles: direct key match, PascalCase key, default export, multi-plugin .id match.
        */
-      getComponentFromMemory(pluginId, bundleUrl) {
-        const mod = this.modules.get(bundleUrl);
+      findPluginExport(mod, pluginId, accept) {
         if (!mod) return null;
         const shortName = pluginId.includes(":") ? pluginId.split(":").pop() : pluginId;
-        if (mod[pluginId] && typeof mod[pluginId].Component === "function") {
-          return mod[pluginId];
-        }
+        if (accept(mod[pluginId])) return mod[pluginId];
         const pascal = shortName.replace(/(^|-)([a-z])/g, (_, __, c) => c.toUpperCase());
-        if (mod[pascal] && typeof mod[pascal] === "object" && typeof mod[pascal].Component === "function") {
-          return mod[pascal];
-        }
-        if (mod.default && typeof mod.default === "object" && typeof mod.default.Component === "function") {
-          return mod.default;
-        }
+        if (accept(mod[pascal])) return mod[pascal];
+        if (accept(mod.default)) return mod.default;
         for (const key of Object.keys(mod)) {
           const val = mod[key];
-          if (val && typeof val === "object" && val.id === shortName && typeof val.Component === "function") {
-            return val;
-          }
+          if (val && (val.id === pluginId || val.id === shortName) && accept(val)) return val;
         }
         return null;
       }
@@ -2853,7 +3189,8 @@ async function ensureDeviceToolsLoaded({ force = false } = {}) {
               m.id,
               bundleUrl,
               m.version || "1.0.0",
-              getNativeBundleHash(m) || void 0
+              getNativeBundleHash(m) || void 0,
+              resolvePluginGrants({ pluginId: m.id, manifest: m })
             );
           } catch (err) {
             console.warn(`[deviceTools] ${m.id} failed to load:`, err?.message || String(err));
@@ -2872,7 +3209,7 @@ async function ensureDeviceToolsLoaded({ force = false } = {}) {
 }
 async function loadFromDiskCache() {
   try {
-    const index = await getBundleStorage().loadIndex();
+    const index = await loadCacheIndex(getBundleStorage());
     const entries = Object.values(index || {});
     if (entries.length === 0) return [];
     const tenant = (0, import_core10.getTenant)();
@@ -2885,10 +3222,16 @@ async function loadFromDiskCache() {
     if (skipped > 0) {
       console.log(`[deviceTools] disk-cache recovery: ${mine.length} for "${tenant}", skipped ${skipped} not owned by it`);
     }
-    if (mine.length === 0) return [];
-    await Promise.all(mine.map(async (e) => {
+    const declared = mine.filter((e) => !!e.trusted?.pluginId);
+    if (declared.length < mine.length) {
+      console.log(
+        `[deviceTools] disk-cache recovery: skipped ${mine.length - declared.length} with no recorded manifest grant (fail closed)`
+      );
+    }
+    if (declared.length === 0) return [];
+    await Promise.all(declared.map(async (e) => {
       try {
-        await bundleManager.loadTools("cache:" + e.bundleUrl, e.bundleUrl, e.version, e.bundleHash);
+        await bundleManager.loadTools(e.trusted.pluginId, e.bundleUrl, e.version, e.bundleHash, e.trusted);
       } catch {
       }
     }));
@@ -2909,6 +3252,7 @@ var init_loader = __esm({
     init_bundleManager();
     init_registry();
     init_storage();
+    init_pluginRuntime();
     import_core10 = require("@ateam-ai-mobile/core");
     inflight = null;
     loadedOnce = false;
@@ -2983,6 +3327,7 @@ __export(index_exports, {
   listPlugins: () => listPlugins,
   nativePluginRegistry: () => nativePluginRegistry,
   neverObserved: () => neverObserved,
+  pluginBundleUrl: () => pluginBundleUrl,
   register: () => register,
   registerBundleModules: () => registerBundleModules,
   registerDeviceTools: () => registerDeviceTools,
@@ -2991,6 +3336,7 @@ __export(index_exports, {
   registerService: () => registerService,
   registerTools: () => registerTools,
   resetDeviceToolLoader: () => resetDeviceToolLoader,
+  resolvePluginGrants: () => resolvePluginGrants,
   resolvePluginRuntimeProps: () => resolvePluginRuntimeProps,
   resolvePluginUrl: () => resolvePluginUrl,
   setBundleStorage: () => setBundleStorage,
@@ -3016,166 +3362,12 @@ __export(index_exports, {
 });
 module.exports = __toCommonJS(index_exports);
 init_sdk();
-
-// src/sdk/device-state.ts
-var device_state_exports = {};
-__export(device_state_exports, {
-  DeviceBridgeError: () => DeviceBridgeError,
-  explainCapability: () => explainCapability,
-  isActionable: () => isActionable,
-  neverObserved: () => neverObserved
-});
-var DeviceBridgeError = class extends Error {
-  constructor(code, message, opts) {
-    super(message);
-    this.name = "DeviceBridgeError";
-    this.code = code;
-    this.domain = opts?.domain;
-    this.recoverable = opts?.recoverable;
-  }
-};
-var CONFIDENCE_ORDER = {
-  unknown: 0,
-  low: 1,
-  medium: 2,
-  high: 3
-};
-function isActionable(quality, budget) {
-  const { freshness, confidence } = quality;
-  if (freshness.state === "unknown" || freshness.state === "stale") return false;
-  if (freshness.ageMs === null || freshness.ageMs > budget.maxAgeMs) return false;
-  if (budget.minConfidence) {
-    const have = CONFIDENCE_ORDER[confidence?.level ?? "unknown"];
-    if (have < CONFIDENCE_ORDER[budget.minConfidence]) return false;
-  }
-  return true;
-}
-function neverObserved() {
-  return { state: "unknown", observedAt: null, ageMs: null };
-}
-function explainCapability(status) {
-  if (status.support === "unsupported") return "this device does not have it";
-  if (status.permission === "denied") return "permission was denied";
-  if (status.permission === "restricted") return "permission is restricted";
-  if (status.permission === "notDetermined") return "permission has not been asked for yet";
-  if (status.permission === "limited") return "only limited access was granted";
-  if (status.restriction === "policyRestricted") return "this plugin did not declare it";
-  if (status.restriction === "backgroundRestricted") return "the app is in the background";
-  if (status.restriction === "lowPowerRestricted") return "the device is in low-power mode";
-  if (status.availability === "busy") return "it is in use by something else";
-  if (status.availability === "temporarilyUnavailable") return "it is temporarily unavailable";
-  if (status.availability === "unavailable") return "it is unavailable";
-  if (status.support === "unknown" || status.availability === "unknown") {
-    return "its state could not be determined";
-  }
-  return null;
-}
-
-// src/index.ts
+init_device_state();
+init_device_state();
 init_deviceStateHost();
-
-// src/voiceHost.ts
-var _provider2 = null;
-function setVoiceProvider(provider) {
-  _provider2 = provider || null;
-}
-function implementedVoice() {
-  return !!_provider2;
-}
-function voiceDenial(why) {
-  const err = new Error(`voice: ${why}`);
-  err.code = "RESTRICTED";
-  return err;
-}
-function deniedVoice(why) {
-  const fail = () => {
-    throw voiceDenial(why);
-  };
-  return {
-    async start() {
-      return fail();
-    },
-    stop() {
-      fail();
-    },
-    setMuted() {
-      fail();
-    },
-    prompt() {
-      fail();
-    },
-    observe() {
-      fail();
-    },
-    getSnapshot() {
-      return {
-        state: "error",
-        sessionId: null,
-        muted: false,
-        speaking: false,
-        listening: false,
-        userSpeaking: false,
-        lastUserSpeechEndedAt: null,
-        lastError: why
-      };
-    },
-    subscribe() {
-      return fail();
-    },
-    transcript() {
-      return [];
-    }
-  };
-}
-function scopedVoice(provider, pluginId) {
-  return {
-    start: (opts) => provider.start(opts, pluginId),
-    stop: () => provider.stop(pluginId),
-    setMuted: (muted) => provider.setMuted(muted, pluginId),
-    prompt: (input) => provider.prompt(input, pluginId),
-    observe: (text) => provider.observe(text, pluginId),
-    getSnapshot: () => provider.getSnapshot(pluginId),
-    subscribe: (cb) => provider.subscribe(cb, pluginId),
-    transcript: () => provider.transcript(pluginId)
-  };
-}
-function gateVoice(declared, pluginId) {
-  if (!declared) {
-    return deniedVoice(
-      "not declared in this plugin's capabilities. Add `capabilities: { voice: true }` to use it."
-    );
-  }
-  if (!pluginId) {
-    return deniedVoice(
-      "no plugin identity \u2014 voice fails closed without a caller to scope the session to."
-    );
-  }
-  return _provider2 ? scopedVoice(_provider2, pluginId) : deniedVoice(
-    "no voice session in this build \u2014 the app has not mounted a VoiceSessionHost / called setVoiceProvider."
-  );
-}
-
-// src/index.ts
+init_voiceHost();
 init_host();
-
-// src/pluginRuntime.ts
-init_host();
-init_deviceStateHost();
-function mergeCaps(decl) {
-  if (!decl) return void 0;
-  return { ...decl.native, ...decl.capabilities };
-}
-function resolvePluginRuntimeProps(src) {
-  const trusted = src.manifest ?? src.plugin ?? null;
-  const capabilities = mergeCaps(trusted);
-  const stateDomains = trusted?.stateDomains;
-  const native = gatePluginNative(getPluginNative(), capabilities, src.pluginId);
-  const deviceState = gateDeviceState(stateDomains);
-  const voice = gateVoice(!!capabilities?.voice, src.pluginId);
-  return { device: native, native, deviceState, voice };
-}
-
-// src/index.ts
+init_pluginRuntime();
 init_registry();
 init_loader();
 
@@ -3293,6 +3485,8 @@ init_native();
 var import_react11 = require("react");
 init_bundleManager();
 init_host();
+init_pluginRuntime();
+init_bundleUrl();
 function extractBundleUrl(pluginId, manifest) {
   const render = manifest.render;
   if (!render || typeof render !== "object") return { url: null, source: "none" };
@@ -3300,7 +3494,7 @@ function extractBundleUrl(pluginId, manifest) {
   const hasNativeComponent = !!(render.reactNative?.component || render.component);
   if (hasNativeComponent) {
     return {
-      url: `/api/ui-plugins/${encodeURIComponent(pluginId)}/bundle.js`,
+      url: pluginBundleUrl(pluginId),
       source: injected ? "ignored-explicit" : "derived-default",
       ...injected && { ignored: injected }
     };
@@ -3330,6 +3524,8 @@ function usePlugin(pluginId, manifest) {
   const bundleHash = extractBundleHash(manifest);
   const componentId = extractComponentId(manifest);
   const lookupId = componentId || pluginId;
+  const grants = resolvePluginGrants({ pluginId, manifest });
+  const grantsKey = JSON.stringify(grants);
   if (ignoredUrl) {
     console.warn(`[usePlugin] ${pluginId}: IGNORED connector-injected bundleUrl="${ignoredUrl}". The host derives bundle URLs from pluginId via the canonical route.`);
   }
@@ -3352,7 +3548,7 @@ function usePlugin(pluginId, manifest) {
         }
         if (bundleUrl) {
           try {
-            const component = await bundleManager.load(pluginId, bundleUrl, version, bundleHash);
+            const component = await bundleManager.load(pluginId, bundleUrl, version, bundleHash, grants);
             if (cancelled) return;
             setPlugin(component);
             setLoading(false);
@@ -3389,7 +3585,7 @@ function usePlugin(pluginId, manifest) {
     return () => {
       cancelled = true;
     };
-  }, [pluginId, lookupId, bundleUrl, bundleHash, version]);
+  }, [pluginId, lookupId, bundleUrl, bundleHash, version, grantsKey]);
   return { plugin, loading, error, bundleMissing };
 }
 
@@ -3465,6 +3661,7 @@ function useRemotePlugins(solutionId) {
 
 // src/index.ts
 init_plugins();
+init_bundleUrl();
 init_SurfaceDrawer();
 init_SurfaceCard();
 init_SurfaceFullscreen();
@@ -3538,6 +3735,7 @@ init_SurfaceDispatcher();
   listPlugins,
   nativePluginRegistry,
   neverObserved,
+  pluginBundleUrl,
   register,
   registerBundleModules,
   registerDeviceTools,
@@ -3546,6 +3744,7 @@ init_SurfaceDispatcher();
   registerService,
   registerTools,
   resetDeviceToolLoader,
+  resolvePluginGrants,
   resolvePluginRuntimeProps,
   resolvePluginUrl,
   setBundleStorage,