@ateam-ai-mobile/plugin-runtime 0.1.7 → 0.1.9

package/src/hooks/usePlugin.ts

@@ -13,13 +13,19 @@
 import { useState, useEffect } from 'react';
 import { bundleManager } from '../bundles/bundleManager';
 import { nativePluginRegistry } from '../host';
-import type { RegisteredUIPlugin } from '../sdk/types';
+import { resolvePluginGrants } from '../pluginRuntime';
+import type { NativeCapabilities, RegisteredUIPlugin } from '../sdk/types';
+import type { DeviceBridgeDomain } from '../sdk/device-state';
+import { pluginBundleUrl } from '../bundles/bundleUrl';
 
 interface PluginManifestLike {
   version?: string;
   name?: string;
   render?: any;
   _connectorId?: string;
+  capabilities?: Record<string, unknown>;
+  native?: NativeCapabilities;
+  stateDomains?: DeviceBridgeDomain[];
 }
 
 interface UsePluginResult {
@@ -59,7 +65,7 @@ function extractBundleUrl(pluginId: string, manifest: PluginManifestLike): { url
   const hasNativeComponent = !!(render.reactNative?.component || render.component);
   if (hasNativeComponent) {
     return {
-      url: `/api/ui-plugins/${encodeURIComponent(pluginId)}/bundle.js`,
+      url: pluginBundleUrl(pluginId),
       source: injected ? 'ignored-explicit' : 'derived-default',
       ...(injected && { ignored: injected }),
     };
@@ -102,6 +108,11 @@ export function usePlugin(pluginId: string, manifest: PluginManifestLike): UsePl
   const bundleHash = extractBundleHash(manifest);
   const componentId = extractComponentId(manifest);
   const lookupId = componentId || pluginId;
+  // The manifest's grants — the authority for the bundle's device tools, the
+  // same one the renderer gates the component with. Keyed by value so a fresh
+  // manifest object with the same grants does not reload the plugin.
+  const grants = resolvePluginGrants({ pluginId, manifest });
+  const grantsKey = JSON.stringify(grants);
 
   if (ignoredUrl) {
     console.warn(`[usePlugin] ${pluginId}: IGNORED connector-injected bundleUrl="${ignoredUrl}". The host derives bundle URLs from pluginId via the canonical route.`);
@@ -132,7 +143,7 @@ export function usePlugin(pluginId: string, manifest: PluginManifestLike): UsePl
         // Path 2: Remote bundle (via global BundleManager)
         if (bundleUrl) {
           try {
-            const component = await bundleManager.load(pluginId, bundleUrl, version, bundleHash);
+            const component = await bundleManager.load(pluginId, bundleUrl, version, bundleHash, grants);
             if (cancelled) return;
             setPlugin(component);
             setLoading(false);
@@ -179,7 +190,7 @@ export function usePlugin(pluginId: string, manifest: PluginManifestLike): UsePl
     })();
 
     return () => { cancelled = true; };
-  }, [pluginId, lookupId, bundleUrl, bundleHash, version]);
+  }, [pluginId, lookupId, bundleUrl, bundleHash, version, grantsKey]);
 
   return { plugin, loading, error, bundleMissing };
 }

package/src/host.ts

@@ -50,6 +50,7 @@ const noopNative: PluginNative = {
   nfc: unavailable('nfc'),
   bluetooth: unavailable('bluetooth'),
   vision: unavailable('vision'),
+  maps: unavailable('maps'),
 };
 
 let _pluginNative: PluginNative = noopNative;
@@ -129,6 +130,7 @@ export function gatePluginNative(
     // used to be, which crashed with "cannot read properties of undefined".
     bluetooth: caps.bluetooth ? native.bluetooth : blocked('bluetooth'),
     vision: caps.vision ? native.vision : blocked('vision'),
+    maps: caps.maps ? native.maps : blocked('maps'),
     // What this plugin DECLARED, carried on the object it already receives.
     //
     // It is how a COMPONENT can be capability-gated: <CameraPreview> is handed

package/src/index.ts

@@ -19,38 +19,14 @@ export * from './sdk';
 
 // Device Bridge v2 — the SEMANTIC layer. `props.deviceState.*`: state names,
 // snapshots carrying freshness and confidence, and reads that say `unknown`
-// rather than throwing.
-//
-// Exported under its own path rather than star-exported into this namespace,
-// deliberately: the whole point of the layer is that a reader can tell at a
-// glance which one they are in, and merging both into one import undoes that.
+// rather than throwing. Its plugin-facing types and the isActionable /
+// explainCapability helpers come through `export * from './sdk'` above — the
+// plugin SDK is the one place they are listed, because it is the only module a
+// bundle can require. The whole layer is also available under its own path.
 export * as deviceStateV2 from './sdk/device-state';
-export type {
-  DeviceState,
-  DeviceBridgeDomain,
-  StateQuality,
-  Freshness,
-  Confidence,
-  VisualSnapshot,
-  SpatialSnapshot,
-  SpatialPoint,
-  SpatialIntent,
-  ActivitySnapshot,
-  EnvironmentSnapshot,
-  InteractionSnapshot,
-  CapabilitySnapshot,
-  CapabilityStatus,
-  DeviceContextSnapshot,
-  ConnectivitySnapshot,
-} from './sdk/device-state';
-// Device Bridge v2 runtime helpers (VALUES). `neverObserved` is the canonical
-// `unknown` freshness the engine's quality module derives from; the others were
-// already in the built types but missing from the source root export.
-export {
-  neverObserved,
-  isActionable,
-  explainCapability,
-} from './sdk/device-state';
+// The canonical `unknown` freshness the engine's quality module derives from —
+// an ENGINE value (the host's device-state domains), not a plugin one.
+export { neverObserved } from './sdk/device-state';
 
 // Device Bridge v2 host DI — the semantic counterpart of
 // setPluginNativeProvider. Separate module on purpose: the moment the two
@@ -86,11 +62,11 @@ export {
   registerBundleModules,
 } from './host';
 
-// The ONE runtime contract every renderer uses to gate a plugin's device surface
-// (device/native + deviceState) — so a plugin gets identical access on every
-// surface. See pluginRuntime.ts for why this is centralized.
-export { resolvePluginRuntimeProps } from './pluginRuntime';
-export type { PluginRuntimeProps, PluginRuntimeSource } from './pluginRuntime';
+// The ONE runtime contract that gates a plugin's device surface (device/native +
+// deviceState) — every renderer AND its device tools resolve grants through it,
+// so a plugin gets identical access on every surface and in its tools.
+export { resolvePluginRuntimeProps, resolvePluginGrants } from './pluginRuntime';
+export type { PluginRuntimeProps, PluginRuntimeSource, PluginGrants } from './pluginRuntime';
 
 // Device tools (plugin `tools/` sections — registered at bundle load)
 export {
@@ -121,7 +97,7 @@ export {
 export { bundleManager } from './bundles/bundleManager';
 export type { LoadedBundleInfo, LoadedBundleSource } from './bundles/bundleManager';
 export { setBundleStorage, MemoryBundleStorage } from './bundles/storage';
-export type { BundleStorage, BundleCacheEntry } from './bundles/storage';
+export type { BundleStorage, BundleCacheEntry, TrustedToolDeclaration } from './bundles/storage';
 
 // Bridge
 export { useNativeBridge, createNativeBridge } from './bridge/native';
@@ -143,6 +119,9 @@ export {
   getNativeBundleUrl,
   getNativeBundleHash,
 } from './api/plugins';
+// The one spelling of a plugin's bundle URL (MGAP-C8) — hosts that build or
+// compare one use this, never their own template.
+export { pluginBundleUrl } from './bundles/bundleUrl';
 export type { PluginSummary, PluginSurfaceMeta } from './api/plugins';
 export type { PluginManifest as PlatformPluginManifest } from './api/plugins';
 

package/src/pluginRuntime.ts

@@ -1,7 +1,7 @@
 /**
  * The ONE runtime contract that turns a plugin's declarations into its gated
  * device surface — `props.device` / `props.native` (L2) and `props.deviceState`
- * (L3) — for EVERY renderer, on EVERY surface.
+ * (L3) — for EVERY renderer, on EVERY surface, and for its device tools.
  *
  * WHY THIS EXISTS. Each renderer used to resolve this itself: the embedded route
  * gated both `native` and `deviceState`; the drawer/fullscreen renderer gated
@@ -29,11 +29,6 @@ export interface PluginRuntimeProps {
   voice: VoiceAPI;
 }
 
-/**
- * Where a plugin's declarations come from. TRUSTED source resolution lives here,
- * not in each caller: the server `manifest` wins, the loaded bundle's own default
- * export is the fallback.
- */
 /** One declaration source — either the server manifest or the registry entry. */
 interface PluginDeclaration {
   capabilities?: NativeCapabilities | Record<string, unknown>;
@@ -68,9 +63,18 @@ function mergeCaps(decl: PluginDeclaration | null | undefined): NativeCapabiliti
   return { ...(decl.native as any), ...(decl.capabilities as any) } as NativeCapabilities;
 }
 
+/** What a plugin is GRANTED — resolved from its one trusted source. The same
+ *  value gates its rendered surface and its device tools (the tool registry
+ *  receives it through bundleManager.load/loadTools). */
+export interface PluginGrants {
+  capabilities?: NativeCapabilities;
+  stateDomains?: DeviceBridgeDomain[];
+}
+
 /**
- * Turn a plugin's declarations into the gated { device, native, deviceState } it
- * receives — the SINGLE place this happens, so every surface is identical.
+ * Resolve a plugin's grants — the SINGLE place this happens, for every rendered
+ * surface AND for the device tools its bundle registers, so a plugin gets
+ * identical access through either.
  *
  * TRUST BOUNDARY. Exactly ONE source is authoritative: the server `manifest` for
  * a remote plugin, the registry `plugin` for a host-owned one. They are NEVER
@@ -80,10 +84,17 @@ function mergeCaps(decl: PluginDeclaration | null | undefined): NativeCapabiliti
  * not carry `stateDomains` for a remote plugin, the fix is Core passing it, not
  * trusting the bundle: Core already holds the solution's declaration.)
  */
-export function resolvePluginRuntimeProps(src: PluginRuntimeSource): PluginRuntimeProps {
+export function resolvePluginGrants(src: PluginRuntimeSource): PluginGrants {
   const trusted = src.manifest ?? src.plugin ?? null;
-  const capabilities = mergeCaps(trusted);
-  const stateDomains = trusted?.stateDomains;
+  // Copied, so the grant cannot change after the fact by mutating the source.
+  const stateDomains = trusted?.stateDomains ? [...trusted.stateDomains] : undefined;
+  return { capabilities: mergeCaps(trusted), stateDomains };
+}
+
+/** Turn a plugin's grants into the gated { device, native, deviceState, voice } it
+ *  receives on every rendered surface. */
+export function resolvePluginRuntimeProps(src: PluginRuntimeSource): PluginRuntimeProps {
+  const { capabilities, stateDomains } = resolvePluginGrants(src);
   const native = gatePluginNative(getPluginNative(), capabilities, src.pluginId);
   const deviceState = gateDeviceState(stateDomains);
   // Voice is a capability flag, gated the same way — the TRUSTED declaration

package/src/sdk/CameraPreview.tsx

@@ -1,6 +1,13 @@
 /**
  * CameraPreview — the plugin-facing way to SHOW the user what the camera sees.
  *
+ *   import { CameraPreview } from '@adas/plugin-sdk';
+ *   <CameraPreview native={native} />      // native = the plugin's own props.native
+ *
+ * '@adas/plugin-sdk' is the only SDK module a bundle can require. The same code
+ * is published as '@ateam-ai-mobile/plugin-runtime', but that is the host app's
+ * package: a bundle that requires it fails at evaluation, by name.
+ *
  * WHY THIS EXISTS RATHER THAN HANDING PLUGINS `expo-camera`.
  *
  * The design has exactly two doors to the device: `props.native.*` (mechanical

package/src/sdk/device-state.ts

@@ -1,10 +1,13 @@
 /**
- * @adas/device-state — Device Bridge v2, the SEMANTIC layer.
+ * Device state — Device Bridge v2, the SEMANTIC layer.
  *
- * Intended repo path:
+ * Repo path:
  *   packages/plugin-runtime/src/sdk/device-state.ts
- * Intended module specifier for plugin bundles:
- *   '@adas/device-state'   (NOT '@adas/plugin-sdk')
+ * Module specifier for plugin bundles:
+ *   '@adas/plugin-sdk' — the only SDK module a bundle can require. This file
+ *   once named '@adas/device-state' here (4110943); the require shim never
+ *   resolved it, so a bundle that imported it got `{}` and failed later. It is
+ *   now refused by name at evaluation (bundles/bundleModuleNames.ts).
  *
  * ─────────────────────────────────────────────────────────────────────────
  * WHICH LAYER AM I IN?
@@ -13,8 +16,9 @@
  *                         VERB names: takePhoto, getCurrent, scanBarcode,
  *                         readOnce, authenticate, pickImage.
  *                         Returns a BARE value. THROWS when it cannot.
- *                         Declared in the manifest as `native: { camera: true }`.
- *                         Lives in '@adas/plugin-sdk'.
+ *                         Declared in the manifest as `capabilities: { camera: true }`
+ *                         (the legacy `native: {}` field is still honoured).
+ *                         Its types are imported from '@adas/plugin-sdk'.
  *
  *   props.deviceState.*   SEMANTIC. "What is true right now, and how well do
  *                         we know it?"
@@ -23,7 +27,8 @@
  *                         and able to say `unknown` in every field.
  *                         A read NEVER throws for absence.
  *                         Declared in the manifest as `stateDomains: ['visual']`.
- *                         Lives in '@adas/device-state' (this file).
+ *                         Defined in this file; its types and helpers are
+ *                         imported from '@adas/plugin-sdk' too.
  *
  * The two containers are the discriminator. Every semantic call in a plugin
  * begins with the eight characters `deviceState.`; every mechanical call
@@ -163,17 +168,19 @@ export type RestrictionState =
  * never raw sensor streams." If you find yourself wanting an event per frame
  * or per GPS fix, you are in the wrong layer.
  */
-export interface StateEvent<TName extends string = string> {
+export interface StateEvent<TName extends string = string, TPayload = unknown> {
   domain: DeviceBridgeDomain;
   name: TName;
   /** Epoch ms. */
   timestamp: number;
   /**
    * OPEN: per-event payload schemas are not specified anywhere in the three
-   * design docs. Typed `unknown` rather than `any` so a consumer is forced to
-   * narrow it rather than read a field that may not exist.
+   * design docs. Defaults to `unknown` rather than `any` so a consumer is forced
+   * to narrow it rather than read a field that may not exist. A domain that
+   * decides its schemas (spatial — see `SpatialStateEvent`) passes `TPayload`,
+   * which is the freeze's own second parameter, dropped here until one did.
    */
-  payload?: unknown;
+  payload?: TPayload;
 }
 
 export interface Subscription {
@@ -192,7 +199,9 @@ export type StateListener<TName extends string = string> = (
  * connectivity, capability, interaction and environment only. Rather than mint
  * names those docs deliberately did not mint, their events are typed against
  * the naming RULE. A wrong-shaped name is a compile error; the specific
- * vocabulary stays open, as the docs left it.
+ * vocabulary stays open, as the docs left it — except where a DECISION closes
+ * it (spatial, see `SpatialEvent`), and that list is checked against the rule
+ * through `AssertConforming`.
  */
 export type ConformingEventName =
   | `${string}Changed`
@@ -202,6 +211,13 @@ export type ConformingEventName =
   | `${string}Unavailable`
   | `${string}StateStale`;
 
+/**
+ * A closed list of names, checked against the naming rule at compile time.
+ * Wrap a decided vocabulary in this and a name like `turnCompleted` stops
+ * compiling instead of reaching a plugin.
+ */
+export type AssertConforming<T extends ConformingEventName> = T;
+
 // ── Errors ────────────────────────────────────────────────────────────────
 
 /** FROZEN (API_FREEZE §12). */
@@ -373,12 +389,88 @@ export interface SpatialSnapshot {
   quality: StateQuality;
 }
 
+/**
+ * DECISION (not frozen) — the spatial event vocabulary. Six names, all ending
+ * in a suffix the naming rule allows, which `AssertConforming` enforces.
+ *
+ * Drawn from the architecture doc's spatial candidates (meaningful movement,
+ * meaningful turn, location quality degraded/recovered, state became stale)
+ * and named after the SNAPSHOT fields they report, so an event and a read use
+ * one vocabulary: `lastMeaningfulTurnChanged` is `changes.lastMeaningfulTurnDeg`
+ * changing. The names an earlier note floated (`turnCompleted`, `arrived`,
+ * `headingLost`) are rejected — the first two fail the rule, and "arrived" is a
+ * destination, which the vocabulary's Governance puts above Device Bridge.
+ */
+export type SpatialEvent = AssertConforming<
+  | 'movementStarted'
+  | 'movementStopped'
+  | 'lastMeaningfulTurnChanged'
+  | 'positionConfidenceChanged'
+  | 'positionChanged'
+  | 'spatialStateStale'
+>;
+
+/** A spatial event: the frozen envelope, with its payload always present. */
+type SpatialEventOf<TName extends SpatialEvent, TPayload> =
+  StateEvent<TName, TPayload> & { domain: 'spatial'; payload: TPayload };
+
+/**
+ * DECISION — what each spatial event carries. Only the facts of the
+ * transition, in the snapshot's own field names; everything else is one
+ * `getSnapshot()` away, which keeps two shapes of the same fact from drifting.
+ *
+ * `timestamp` on the envelope is when the transition was RECOGNISED. Where a
+ * hold delays that on purpose, `since` carries the true onset.
+ */
+export type SpatialStateEvent =
+  /** `movement.state` became `moving` and held (navigation: 3 s). */
+  | SpatialEventOf<'movementStarted', {
+      previous: 'stationary' | 'unknown';
+      speedMps: number | null;
+      bearingDeg: number | null;
+      since: number;
+    }>
+  /** `moving` → `stationary`, held (navigation: 5 s). Never fired on moving →
+   *  `unknown`: losing the speed is not evidence of stopping. */
+  | SpatialEventOf<'movementStopped', { previous: 'moving'; since: number }>
+  /** A new completed turn. Signed: positive = clockwise = right. */
+  | SpatialEventOf<'lastMeaningfulTurnChanged', { lastMeaningfulTurnDeg: number; timestamp: number }>
+  /** The GPS fix band (high ≤10 m, medium ≤50 m, else low) changed and held.
+   *  The fix alone — a compass calibration change is not a position event. */
+  | SpatialEventOf<'positionConfidenceChanged', {
+      level: ConfidenceLevel;
+      previous: ConfidenceLevel;
+      accuracyM: number | null;
+      direction: 'dropped' | 'recovered';
+    }>
+  /** Moved at least max(profile floor, 2 × accuracyM) from the last reported
+   *  position, so GPS jitter never fires it. The session's first fix fires
+   *  with `previous: null`. */
+  | SpatialEventOf<'positionChanged', {
+      position: SpatialPoint;
+      previous: SpatialPoint | null;
+      distanceM: number | null;
+    }>
+  /** `quality.freshness.state` became `stale`. Once; re-armed by a fresh read. */
+  | SpatialEventOf<'spatialStateStale', { observedAt: number | null; ageMs: number | null }>;
+
 export interface SpatialDomain {
   getSnapshot(): Promise<SpatialSnapshot>;
   start(options: StartOptions<SpatialIntent>): Promise<StateSession>;
   stop(sessionId?: string): Promise<void>;
-  /** OPEN: no frozen spatial event vocabulary; rule-conforming names only. */
-  subscribe(listener: StateListener<ConformingEventName>): Subscription;
+  /**
+   * DECISION: the six `SpatialEvent`s, typed per name — narrow on `e.name` and
+   * `e.payload` is that event's shape.
+   *
+   * Events flow only while a spatial session is open; subscribing opens no
+   * sensor. They are derived from the same snapshot `getSnapshot()` returns: a
+   * listener that re-reads inside the callback sees the snapshot its event came
+   * from. A state change must hold, on at least two fixes, before it fires.
+   *
+   * From a device tool's `ctx.deviceState` this refuses (RESTRICTED): a call
+   * has no lifetime to own the listener.
+   */
+  subscribe(listener: (event: SpatialStateEvent) => void): Subscription;
 }
 
 // ═════════════════════════════════════════════════════════════════════════
@@ -567,11 +659,20 @@ export type HumanActivity =
   | 'driving'
   | 'unknown';
 
-/** FROZEN. Independent of HumanActivity — walking+pocket, driving+mounted. */
+/**
+ * FROZEN. Independent of HumanActivity — walking+pocket, driving+mounted.
+ *
+ * What is returned TODAY: `handheld`, `table` and `unknown` only. Do not write
+ * a branch that waits for `pocket` or `mounted`; it will never run. A pocketed
+ * phone shows up in the Visual domain's frame quality (`obstructed: true` /
+ * `exposure: 'dark'`), not here.
+ */
 export type DevicePlacement =
   | 'handheld'
+  /** RESERVED — never returned until the proximity/light sensor is wired. */
   | 'pocket'
   | 'table'
+  /** RESERVED — never returned until Bluetooth/CarPlay mount context is wired. */
   | 'mounted'
   | 'unknown';
 
@@ -1213,8 +1314,10 @@ export interface DeviceToolContextV2Extension {
  *  - Multi-consumer session ownership / reference counting.
  *  - MediaHandle → bytes resolution, and expiry behaviour.
  *  - Whether `visual.capture()` may use a different intent from the session.
- *  - Event vocabularies for visual, activity, spatial, deviceContext.
- *  - Per-event payload schemas for every domain.
+ *  - Event vocabularies for visual, activity, deviceContext. (Spatial's is a
+ *    DECISION, recorded at `SpatialEvent`, not a reading of the docs.)
+ *  - Per-event payload schemas for every domain but spatial
+ *    (`SpatialStateEvent`, likewise a DECISION).
  *  - Background/foreground semantics for activity and connectivity (specified
  *    only for visual).
  *  - Numeric thresholds for fresh/aging/stale, and for "materially changed".

package/src/sdk/index.ts

@@ -35,6 +35,12 @@ export type {
   VisionLabel,
   VisionObject,
   VisionFrameQuality,
+  MapsAPI,
+  MapsCoordinate,
+  MapsAddress,
+  MapsPlace,
+  MapsRoute,
+  MapsRouteStep,
   BiometricsAPI,
   BiometricsAPIv2,
   NativeCapabilities,
@@ -48,6 +54,7 @@ export type {
   DeviceToolContext,
   DeviceToolDefinition,
   DeviceToolFn,
+  DeviceToolFailureReason,
 } from './types';
 
 // Voice — the live conversational SESSION surface (props.voice).
@@ -55,8 +62,11 @@ export type {
   VoiceAPI,
   VoiceState,
   VoiceSnapshot,
+  VoiceDeviceToolCall,
+  VoiceDeviceToolReason,
   VoiceTranscriptEntry,
   VoiceStartOptions,
+  VoicePersona,
   VoiceEvent,
   VoiceSubscription,
   VoiceCaller,
@@ -66,6 +76,37 @@ export type {
 // provider and its own surfaces call it as this caller. See VoiceSessionProvider.
 export { PLATFORM_VOICE_CALLER } from './voice';
 
+// Device state — the SEMANTIC layer: the types of what `props.deviceState`
+// returns, and the two pure helpers for reading a snapshot. They are here, in
+// the one module a bundle can require, because a bundle has no other SDK name
+// ('@adas/device-state' never resolved, and is refused by name). What keeps the
+// two layers apart is the CONTAINER a call starts with — `deviceState.` vs
+// `device.` — not the import line.
+export type {
+  DeviceState,
+  DeviceBridgeDomain,
+  StateQuality,
+  Freshness,
+  Confidence,
+  VisualSnapshot,
+  SpatialSnapshot,
+  SpatialPoint,
+  SpatialIntent,
+  SpatialEvent,
+  SpatialStateEvent,
+  StateEvent,
+  StateListener,
+  Subscription,
+  ActivitySnapshot,
+  EnvironmentSnapshot,
+  InteractionSnapshot,
+  CapabilitySnapshot,
+  CapabilityStatus,
+  DeviceContextSnapshot,
+  ConnectivitySnapshot,
+} from './device-state';
+export { isActionable, explainCapability } from './device-state';
+
 // RN primitives (plugins import from the SDK, not from react-native)
 export {
   View,

package/src/sdk/registration.ts

@@ -54,7 +54,8 @@ export function registerTools(
   id: string,
   config: {
     capabilities?: NativeCapabilities;
-    /** L3 DeviceState domains the tools may read via ctx.deviceState (e.g. ['visual']). */
+    /** L3 DeviceState domains the tools read via ctx.deviceState (e.g. ['visual']).
+     *  For a remote bundle the MANIFEST grants them — see RegisteredToolsPlugin. */
     stateDomains?: DeviceBridgeDomain[];
     tools: DeviceToolDefinition[];
   },