Plugin support matrix#

Each runtime plugin is its own crate, named leptoskit_plugin_<name>. The tables below say which part of each capability is implemented today and on which platforms. Every plugin is a partial port: it covers the subset named in its row, not every method of the Expo or Tauri module it is modelled on. A cell describes an implemented code path, not a promise that every device, OS version, or permission policy has been verified. Each crate's README and its Cargo runtime metadata define the exact operations.

To use a plugin in an app, see runtime plugins and automatic plugin registration.

The platform cells use four words:

• Auto: add the crate as a dependency of the platform's host package and list its name in native.plugins. The generated host registers it for you.
• Direct: the host or the browser calls the plugin's Rust API itself. The Wasm guest cannot reach it through the bridge.
• Manual: the host has to construct the handler with explicit configuration and register it.
• Unavailable: the platform has no implementation, even if a stub handler compiles.

Identity, system state and interaction#

Foreground services#

Authentication and location require app-owned Apple purpose strings where applicable. Android location and notification permission requests use the host's Activity permission broker; declaring manifest permissions alone does not grant access. Location stops pending acquisition on cancellation, close or native backgrounding. A browser read checks permission first, but revocation between that check and acquisition can still cause a prompt.

Notification acceptance does not prove that a visible banner appeared. Apple foreground presentation belongs to the host's notification delegate. Browser notifications require the browser's secure-context and user-gesture policy; service-worker-only delivery is outside this port.

Sharing and platform consent#

Runtime names are sharing, store-review and tracking-transparency. Review and sharing completion acknowledge only what the platform exposes. Caller cancellation cannot dismiss every OS flow or retract shared content; adapters retain exclusive ownership until terminal callbacks where necessary. ATT retains one process-wide request until Apple's completion, even after caller cancellation or scene backgrounding.

Tracking requires an app-owned NSUserTrackingUsageDescription; the CLI checks declared required keys before preparing iOS hosts. Google Play review contributes a validated, pinned Maven dependency to generated Android builds. Automated tests use injected Apple providers, controlled Google Play tasks and synthetic sharing content; they do not show real consent, review or sharing prompts.

Storage and networking#

Settings, SQLite and logging defer disk I/O until worker dispatch. Filesystem registration establishes its directory capability synchronously; subsequent file operations run on its worker. Cancellation discards their reply but cannot promise rollback of an already-started operation. Native private files default to a 64 MiB aggregate payload quota and 4096 file/directory entries, alongside a 1 MiB operation limit. Native SQLite defaults to a 64 MiB page quota and 1 MiB requests/results, and stops a statement whose working memory grows by more than 64 MiB. Temporary tables, views, indexes and triggers are refused because they would live in memory outside the page quota. Secure storage shares a 2560-byte encrypted record across at most 64 secrets, including names and framing; old per-key credentials remain readable and move into that budget when rewritten. Trusted hosts can configure these budgets. Quota exhaustion returns TooLarge; deletion frees capacity. Leave disk headroom for atomic file replacement and SQLite rollback journals. Settings documents remain bounded to 512 KiB. Logging defaults to four files of 1 MiB each, including the current file. Its files are guarded by exclusive advisory locks. Secure storage never substitutes plaintext files or browser storage for an unavailable credential service.

HTTP/WebSocket host factories require exact origins in native.plugin-options; no wildcard or implicit scope is granted. Origin policy covers every path and is not an IP firewall. Guest dependencies disable default browser features and enable guest; the CLI adds async-host only to native builds. HTTP returns ordinary error status codes as responses. WebSocket cancellation, unread open replies, revocation and shutdown retain ownership until resources are released. Browser policy and transport allocations still impose limits beyond the binary bridge.

Sensors and desktop host services#

The six sensor crates share leptoskit_sensor acquisition/codecs without merging their capability boundaries. Live sample requests stop acquisition on completion, cancellation, close or native backgrounding; one request per sensor may wait at a time. Browser permissions and iOS purpose strings remain necessary. Simulators and API availability checks do not establish physical sensor accuracy.

Pedometer keeps iOS interval counts distinct from Android cumulative boot counters; neither repeated observations nor a hardware availability check imply a complete daily total. Its iOS historical query cannot be cancelled at the OS level, so a timed-out caller releases its result but the plugin retains its Busy slot until the native callback returns. The application must explicitly supply NSMotionUsageDescription and Android ACTIVITY_RECOGNITION; automated fixtures do not request real activity access or read history.

Document import uses transient file access, bounded off-UI-thread reads and shared Rust reply storage. Native picker UI and user documents are outside automated synthetic tests. Orientation operates on the owning scene/activity, releases its policy on lifecycle changes and reports the presented interface separately from the requested policy. A pending lease is not proof of rotation; Android large-screen and Apple multitasking policy may override it.

Desktop services keep application ownership explicit. Arguments require the host to select disclosed values; shortcuts require a live platform event loop; window state requires an owned window and application persistence. Shell construction starts no process and fixes executable, argument policy, working directory, environment and limits. On macOS and Linux, each invocation owns a process group; on Windows, it owns a Job Object assigned before execution starts. Normal exit, limits, cancellation and shutdown terminate the container and wait for cleanup before returning capacity. The host must keep its async runtime alive through cleanup. Failed or interrupted cleanup retains the capacity slot. On Windows, an unobserved short-lived descendant can make cleanup uncertain and retain that slot. Unix commands that deliberately create a different process group or session require containment by the host, such as a Linux cgroup. These APIs do not acquire automatic registration merely by enabling guest.