@farcaster/snap 1.5.0 → 1.5.2

package/dist/constants.d.ts

@@ -42,6 +42,7 @@ export declare const LIST_STYLE_VALUES: readonly ["ordered", "unordered", "plain
 export declare const DEFAULT_LIST_STYLE: "ordered";
 export declare const GRID_CELL_SIZE_VALUES: readonly ["auto", "square"];
 export declare const GRID_GAP_VALUES: readonly ["none", "small", "medium"];
+export declare const DEFAULT_GRID_GAP: "small";
 export declare const BUTTON_GROUP_STYLE: {
     readonly row: "row";
     readonly stack: "stack";
@@ -52,9 +53,18 @@ export declare const BUTTON_ACTION: {
     readonly post: "post";
     readonly link: "link";
     readonly mini_app: "mini_app";
-    readonly sdk: "sdk";
+    readonly client: "client";
 };
-export declare const BUTTON_ACTION_VALUES: readonly ["post", "link", "mini_app", "sdk"];
+export declare const BUTTON_ACTION_VALUES: readonly ["post", "link", "mini_app", "client"];
+export declare const CLIENT_ACTION: {
+    readonly view_cast: "view_cast";
+    readonly view_profile: "view_profile";
+    readonly compose_cast: "compose_cast";
+    readonly view_token: "view_token";
+    readonly send_token: "send_token";
+    readonly swap_token: "swap_token";
+};
+export declare const CLIENT_ACTION_VALUES: readonly ["view_cast", "view_profile", "compose_cast", "view_token", "send_token", "swap_token"];
 export declare const BUTTON_STYLE: {
     readonly primary: "primary";
     readonly secondary: "secondary";

package/dist/constants.js

@@ -57,6 +57,7 @@ export const LIST_STYLE_VALUES = ["ordered", "unordered", "plain"];
 export const DEFAULT_LIST_STYLE = "ordered";
 export const GRID_CELL_SIZE_VALUES = ["auto", "square"];
 export const GRID_GAP_VALUES = ["none", "small", "medium"];
+export const DEFAULT_GRID_GAP = "small";
 export const BUTTON_GROUP_STYLE = {
     row: "row",
     stack: "stack",
@@ -71,13 +72,29 @@ export const BUTTON_ACTION = {
     post: "post",
     link: "link",
     mini_app: "mini_app",
-    sdk: "sdk",
+    client: "client",
 };
 export const BUTTON_ACTION_VALUES = [
     BUTTON_ACTION.post,
     BUTTON_ACTION.link,
     BUTTON_ACTION.mini_app,
-    BUTTON_ACTION.sdk,
+    BUTTON_ACTION.client,
+];
+export const CLIENT_ACTION = {
+    view_cast: "view_cast",
+    view_profile: "view_profile",
+    compose_cast: "compose_cast",
+    view_token: "view_token",
+    send_token: "send_token",
+    swap_token: "swap_token",
+};
+export const CLIENT_ACTION_VALUES = [
+    CLIENT_ACTION.view_cast,
+    CLIENT_ACTION.view_profile,
+    CLIENT_ACTION.compose_cast,
+    CLIENT_ACTION.view_token,
+    CLIENT_ACTION.send_token,
+    CLIENT_ACTION.swap_token,
 ];
 export const BUTTON_STYLE = {
     primary: "primary",

package/dist/index.d.ts

@@ -1,4 +1,5 @@
-export { POST_GRID_TAP_KEY, PAGE_ROOT_TYPE, ELEMENT_TYPE, MEDIA_TYPE, DEFAULT_LIST_STYLE, DEFAULT_SLIDER_STEP, } from "./constants.js";
+export { POST_GRID_TAP_KEY, PAGE_ROOT_TYPE, ELEMENT_TYPE, MEDIA_TYPE, DEFAULT_LIST_STYLE, DEFAULT_SLIDER_STEP, CLIENT_ACTION, CLIENT_ACTION_VALUES, } from "./constants.js";
 export { DEFAULT_THEME_ACCENT, PALETTE_COLOR, PALETTE_COLOR_ACCENT, PALETTE_COLOR_VALUES, PALETTE_LIGHT_HEX, PALETTE_DARK_HEX, type PaletteColor, } from "./colors.js";
-export { ACTION_TYPE_GET, ACTION_TYPE_POST, snapResponseSchema, firstPageResponseSchema, payloadSchema, createDefaultDataStore, type Button, type Element, type Elements, type GroupChildElement, type SnapAction, type SnapPageElementInput, type SnapContext, type SnapResponse, type SnapHandlerResult, type SnapFunction, type SnapPayload, type DataStoreValue, type SnapDataStore, type SnapDataStoreOperations, } from "./schemas.js";
+export { ACTION_TYPE_GET, ACTION_TYPE_POST, snapResponseSchema, firstPageResponseSchema, payloadSchema, clientActionSchema, createDefaultDataStore, type Button, type Element, type Elements, type GroupChildElement, type ClientAction, type SnapAction, type SnapPageElementInput, type SnapContext, type SnapResponse, type SnapHandlerResult, type SnapFunction, type SnapPayload, type DataStoreValue, type SnapDataStore, type SnapDataStoreOperations, } from "./schemas.js";
 export { validateSnapResponse, validateFirstPageResponse, type ValidationResult, } from "./validator.js";
+export { type Middleware, useMiddleware } from "./middleware.js";

package/dist/index.js

@@ -1,4 +1,5 @@
-export { POST_GRID_TAP_KEY, PAGE_ROOT_TYPE, ELEMENT_TYPE, MEDIA_TYPE, DEFAULT_LIST_STYLE, DEFAULT_SLIDER_STEP, } from "./constants.js";
+export { POST_GRID_TAP_KEY, PAGE_ROOT_TYPE, ELEMENT_TYPE, MEDIA_TYPE, DEFAULT_LIST_STYLE, DEFAULT_SLIDER_STEP, CLIENT_ACTION, CLIENT_ACTION_VALUES, } from "./constants.js";
 export { DEFAULT_THEME_ACCENT, PALETTE_COLOR, PALETTE_COLOR_ACCENT, PALETTE_COLOR_VALUES, PALETTE_LIGHT_HEX, PALETTE_DARK_HEX, } from "./colors.js";
-export { ACTION_TYPE_GET, ACTION_TYPE_POST, snapResponseSchema, firstPageResponseSchema, payloadSchema, createDefaultDataStore, } from "./schemas.js";
+export { ACTION_TYPE_GET, ACTION_TYPE_POST, snapResponseSchema, firstPageResponseSchema, payloadSchema, clientActionSchema, createDefaultDataStore, } from "./schemas.js";
 export { validateSnapResponse, validateFirstPageResponse, } from "./validator.js";
+export { useMiddleware } from "./middleware.js";

package/dist/middleware.d.ts

@@ -0,0 +1,3 @@
+import { SnapFunction } from "./schemas.js";
+export type Middleware = (fn: SnapFunction) => SnapFunction;
+export declare function useMiddleware(fn: SnapFunction, middleware: Middleware[]): SnapFunction;

package/dist/middleware.js

@@ -0,0 +1,3 @@
+export function useMiddleware(fn, middleware) {
+    return middleware.reduce((acc, middleware) => middleware(acc), fn);
+}

package/dist/schemas.d.ts

@@ -1,13 +1,74 @@
 import { z } from "zod";
+export declare const clientActionSchema: z.ZodDiscriminatedUnion<[z.ZodObject<{
+    type: z.ZodLiteral<"view_cast">;
+    hash: z.ZodString;
+}, z.core.$strict>, z.ZodObject<{
+    type: z.ZodLiteral<"view_profile">;
+    fid: z.ZodNumber;
+}, z.core.$strict>, z.ZodObject<{
+    type: z.ZodLiteral<"compose_cast">;
+    text: z.ZodOptional<z.ZodString>;
+    embeds: z.ZodOptional<z.ZodArray<z.ZodString>>;
+    parent: z.ZodOptional<z.ZodObject<{
+        type: z.ZodLiteral<"cast">;
+        hash: z.ZodString;
+    }, z.core.$strict>>;
+    channelKey: z.ZodOptional<z.ZodString>;
+}, z.core.$strict>, z.ZodObject<{
+    type: z.ZodLiteral<"view_token">;
+    token: z.ZodString;
+}, z.core.$strict>, z.ZodObject<{
+    type: z.ZodLiteral<"send_token">;
+    token: z.ZodOptional<z.ZodString>;
+    amount: z.ZodOptional<z.ZodString>;
+    recipientFid: z.ZodOptional<z.ZodNumber>;
+    recipientAddress: z.ZodOptional<z.ZodString>;
+}, z.core.$strict>, z.ZodObject<{
+    type: z.ZodLiteral<"swap_token">;
+    sellToken: z.ZodOptional<z.ZodString>;
+    buyToken: z.ZodOptional<z.ZodString>;
+    sellAmount: z.ZodOptional<z.ZodString>;
+}, z.core.$strict>], "type">;
+export type ClientAction = z.infer<typeof clientActionSchema>;
 declare const buttonSchema: z.ZodObject<{
     label: z.ZodString;
     action: z.ZodEnum<{
         post: "post";
         link: "link";
         mini_app: "mini_app";
-        sdk: "sdk";
+        client: "client";
     }>;
-    target: z.ZodString;
+    target: z.ZodOptional<z.ZodString>;
+    client_action: z.ZodOptional<z.ZodDiscriminatedUnion<[z.ZodObject<{
+        type: z.ZodLiteral<"view_cast">;
+        hash: z.ZodString;
+    }, z.core.$strict>, z.ZodObject<{
+        type: z.ZodLiteral<"view_profile">;
+        fid: z.ZodNumber;
+    }, z.core.$strict>, z.ZodObject<{
+        type: z.ZodLiteral<"compose_cast">;
+        text: z.ZodOptional<z.ZodString>;
+        embeds: z.ZodOptional<z.ZodArray<z.ZodString>>;
+        parent: z.ZodOptional<z.ZodObject<{
+            type: z.ZodLiteral<"cast">;
+            hash: z.ZodString;
+        }, z.core.$strict>>;
+        channelKey: z.ZodOptional<z.ZodString>;
+    }, z.core.$strict>, z.ZodObject<{
+        type: z.ZodLiteral<"view_token">;
+        token: z.ZodString;
+    }, z.core.$strict>, z.ZodObject<{
+        type: z.ZodLiteral<"send_token">;
+        token: z.ZodOptional<z.ZodString>;
+        amount: z.ZodOptional<z.ZodString>;
+        recipientFid: z.ZodOptional<z.ZodNumber>;
+        recipientAddress: z.ZodOptional<z.ZodString>;
+    }, z.core.$strict>, z.ZodObject<{
+        type: z.ZodLiteral<"swap_token">;
+        sellToken: z.ZodOptional<z.ZodString>;
+        buyToken: z.ZodOptional<z.ZodString>;
+        sellAmount: z.ZodOptional<z.ZodString>;
+    }, z.core.$strict>], "type">>;
     style: z.ZodOptional<z.ZodEnum<{
         primary: "primary";
         secondary: "secondary";
@@ -230,7 +291,7 @@ declare const elementSchema: z.ZodDiscriminatedUnion<[z.ZodObject<{
         auto: "auto";
         square: "square";
     }>>;
-    gap: z.ZodOptional<z.ZodEnum<{
+    gap: z.ZodDefault<z.ZodEnum<{
         small: "small";
         medium: "medium";
         none: "none";
@@ -546,7 +607,7 @@ declare const elementsSchema: z.ZodObject<{
             auto: "auto";
             square: "square";
         }>>;
-        gap: z.ZodOptional<z.ZodEnum<{
+        gap: z.ZodDefault<z.ZodEnum<{
             small: "small";
             medium: "medium";
             none: "none";
@@ -885,7 +946,7 @@ export declare const snapResponseSchema: z.ZodObject<{
                     auto: "auto";
                     square: "square";
                 }>>;
-                gap: z.ZodOptional<z.ZodEnum<{
+                gap: z.ZodDefault<z.ZodEnum<{
                     small: "small";
                     medium: "medium";
                     none: "none";
@@ -1129,9 +1190,39 @@ export declare const snapResponseSchema: z.ZodObject<{
                 post: "post";
                 link: "link";
                 mini_app: "mini_app";
-                sdk: "sdk";
+                client: "client";
             }>;
-            target: z.ZodString;
+            target: z.ZodOptional<z.ZodString>;
+            client_action: z.ZodOptional<z.ZodDiscriminatedUnion<[z.ZodObject<{
+                type: z.ZodLiteral<"view_cast">;
+                hash: z.ZodString;
+            }, z.core.$strict>, z.ZodObject<{
+                type: z.ZodLiteral<"view_profile">;
+                fid: z.ZodNumber;
+            }, z.core.$strict>, z.ZodObject<{
+                type: z.ZodLiteral<"compose_cast">;
+                text: z.ZodOptional<z.ZodString>;
+                embeds: z.ZodOptional<z.ZodArray<z.ZodString>>;
+                parent: z.ZodOptional<z.ZodObject<{
+                    type: z.ZodLiteral<"cast">;
+                    hash: z.ZodString;
+                }, z.core.$strict>>;
+                channelKey: z.ZodOptional<z.ZodString>;
+            }, z.core.$strict>, z.ZodObject<{
+                type: z.ZodLiteral<"view_token">;
+                token: z.ZodString;
+            }, z.core.$strict>, z.ZodObject<{
+                type: z.ZodLiteral<"send_token">;
+                token: z.ZodOptional<z.ZodString>;
+                amount: z.ZodOptional<z.ZodString>;
+                recipientFid: z.ZodOptional<z.ZodNumber>;
+                recipientAddress: z.ZodOptional<z.ZodString>;
+            }, z.core.$strict>, z.ZodObject<{
+                type: z.ZodLiteral<"swap_token">;
+                sellToken: z.ZodOptional<z.ZodString>;
+                buyToken: z.ZodOptional<z.ZodString>;
+                sellAmount: z.ZodOptional<z.ZodString>;
+            }, z.core.$strict>], "type">>;
             style: z.ZodOptional<z.ZodEnum<{
                 primary: "primary";
                 secondary: "secondary";
@@ -1241,7 +1332,7 @@ export declare const firstPageResponseSchema: z.ZodObject<{
                     auto: "auto";
                     square: "square";
                 }>>;
-                gap: z.ZodOptional<z.ZodEnum<{
+                gap: z.ZodDefault<z.ZodEnum<{
                     small: "small";
                     medium: "medium";
                     none: "none";
@@ -1485,9 +1576,39 @@ export declare const firstPageResponseSchema: z.ZodObject<{
                 post: "post";
                 link: "link";
                 mini_app: "mini_app";
-                sdk: "sdk";
+                client: "client";
             }>;
-            target: z.ZodString;
+            target: z.ZodOptional<z.ZodString>;
+            client_action: z.ZodOptional<z.ZodDiscriminatedUnion<[z.ZodObject<{
+                type: z.ZodLiteral<"view_cast">;
+                hash: z.ZodString;
+            }, z.core.$strict>, z.ZodObject<{
+                type: z.ZodLiteral<"view_profile">;
+                fid: z.ZodNumber;
+            }, z.core.$strict>, z.ZodObject<{
+                type: z.ZodLiteral<"compose_cast">;
+                text: z.ZodOptional<z.ZodString>;
+                embeds: z.ZodOptional<z.ZodArray<z.ZodString>>;
+                parent: z.ZodOptional<z.ZodObject<{
+                    type: z.ZodLiteral<"cast">;
+                    hash: z.ZodString;
+                }, z.core.$strict>>;
+                channelKey: z.ZodOptional<z.ZodString>;
+            }, z.core.$strict>, z.ZodObject<{
+                type: z.ZodLiteral<"view_token">;
+                token: z.ZodString;
+            }, z.core.$strict>, z.ZodObject<{
+                type: z.ZodLiteral<"send_token">;
+                token: z.ZodOptional<z.ZodString>;
+                amount: z.ZodOptional<z.ZodString>;
+                recipientFid: z.ZodOptional<z.ZodNumber>;
+                recipientAddress: z.ZodOptional<z.ZodString>;
+            }, z.core.$strict>, z.ZodObject<{
+                type: z.ZodLiteral<"swap_token">;
+                sellToken: z.ZodOptional<z.ZodString>;
+                buyToken: z.ZodOptional<z.ZodString>;
+                sellAmount: z.ZodOptional<z.ZodString>;
+            }, z.core.$strict>], "type">>;
             style: z.ZodOptional<z.ZodEnum<{
                 primary: "primary";
                 secondary: "secondary";

package/dist/schemas.js

@@ -1,5 +1,5 @@
 import { z } from "zod";
-import { BUTTON_ACTION, BUTTON_ACTION_VALUES, BUTTON_GROUP_STYLE, BUTTON_GROUP_STYLE_VALUES, BUTTON_LAYOUT_VALUES, BUTTON_STYLE_VALUES, DEFAULT_BUTTON_LAYOUT, DEFAULT_LIST_STYLE, DEFAULT_SLIDER_STEP, EFFECT_VALUES, ELEMENT_TYPE, GRID_CELL_SIZE_VALUES, GRID_GAP_VALUES, GROUP_LAYOUT_VALUES, HEX_COLOR_6_RE, HTTP_PREFIX, HTTPS_PREFIX, IMAGE_ASPECT_VALUES, INTERACTIVE_ELEMENT_TYPES, LIMITS, LIST_STYLE_VALUES, MEDIA_ELEMENT_TYPES, PAGE_ROOT_TYPE, SLIDER_STEP_ALIGN_EPS, SPACER_SIZE, SPACER_SIZE_VALUES, SPEC_VERSION, TEXT_ALIGN_VALUES, TEXT_CONTENT_MAX, TEXT_STYLE, TEXT_STYLE_VALUES, } from "./constants.js";
+import { BUTTON_ACTION, BUTTON_ACTION_VALUES, CLIENT_ACTION, BUTTON_GROUP_STYLE, BUTTON_GROUP_STYLE_VALUES, BUTTON_LAYOUT_VALUES, BUTTON_STYLE_VALUES, DEFAULT_BUTTON_LAYOUT, DEFAULT_GRID_GAP, DEFAULT_LIST_STYLE, DEFAULT_SLIDER_STEP, EFFECT_VALUES, ELEMENT_TYPE, GRID_CELL_SIZE_VALUES, GRID_GAP_VALUES, GROUP_LAYOUT_VALUES, HEX_COLOR_6_RE, HTTP_PREFIX, HTTPS_PREFIX, IMAGE_ASPECT_VALUES, INTERACTIVE_ELEMENT_TYPES, LIMITS, LIST_STYLE_VALUES, MEDIA_ELEMENT_TYPES, PAGE_ROOT_TYPE, SLIDER_STEP_ALIGN_EPS, SPACER_SIZE, SPACER_SIZE_VALUES, SPEC_VERSION, TEXT_ALIGN_VALUES, TEXT_CONTENT_MAX, TEXT_STYLE, TEXT_STYLE_VALUES, } from "./constants.js";
 import { BAR_CHART_COLOR_VALUES, DEFAULT_THEME_ACCENT, PALETTE_COLOR_VALUES, PROGRESS_COLOR_VALUES, } from "./colors.js";
 /**
  * post/link/mini_app targets must be HTTPS in production; allow HTTP only for
@@ -29,25 +29,8 @@ const themeSchema = z
     accent: themeAccentSchema.default(DEFAULT_THEME_ACCENT),
 })
     .strict();
-const httpsUrl = z.string().refine((s) => s.startsWith(HTTPS_PREFIX), {
-    message: "URL must use HTTPS",
-});
-function hasAllowedMediaExtension(urlString, allowedExtensions) {
-    try {
-        const url = new URL(urlString);
-        if (url.protocol !== "https:")
-            return false;
-        const lowerPathname = url.pathname.toLowerCase();
-        return allowedExtensions.some((extension) => lowerPathname.endsWith(`.${extension}`));
-    }
-    catch {
-        return false;
-    }
-}
-const imageUrlSchema = z
-    .string()
-    .refine((s) => hasAllowedMediaExtension(s, ["jpg", "png", "gif", "webp"]), {
-    message: "image URL must use HTTPS and end with a supported extension (.jpg, .png, .gif, .webp)",
+const imageUrlSchema = z.string().refine((s) => s.startsWith(HTTPS_PREFIX), {
+    message: "image URL must use HTTPS",
 });
 const textAlignSchema = z.enum(TEXT_ALIGN_VALUES);
 const textElementSchema = z
@@ -153,7 +136,7 @@ const gridElementSchema = z
     rows: z.number().int().min(LIMITS.minGridRows).max(LIMITS.maxGridRows),
     cells: z.array(gridCellSchema),
     cellSize: z.enum(GRID_CELL_SIZE_VALUES).optional(),
-    gap: z.enum(GRID_GAP_VALUES).optional(),
+    gap: z.enum(GRID_GAP_VALUES).default(DEFAULT_GRID_GAP),
     interactive: z.boolean().optional(),
 })
     .superRefine((val, ctx) => {
@@ -301,24 +284,134 @@ const barChartElementSchema = z
 });
 const buttonActionSchema = z.enum(BUTTON_ACTION_VALUES);
 const buttonStyleSchema = z.enum(BUTTON_STYLE_VALUES);
+/* ------------------------------------------------------------------ */
+/*  Client action schemas                                              */
+/* ------------------------------------------------------------------ */
+const viewCastClientActionSchema = z
+    .object({
+    type: z.literal(CLIENT_ACTION.view_cast),
+    hash: z.string().min(1),
+})
+    .strict();
+const viewProfileClientActionSchema = z
+    .object({
+    type: z.literal(CLIENT_ACTION.view_profile),
+    fid: z.number().int().nonnegative(),
+})
+    .strict();
+const composeCastClientActionSchema = z
+    .object({
+    type: z.literal(CLIENT_ACTION.compose_cast),
+    text: z.string().optional(),
+    embeds: z
+        .array(z.string())
+        .max(2, { message: "compose_cast embeds: max 2 URLs" })
+        .optional(),
+    parent: z
+        .object({
+        type: z.literal("cast"),
+        hash: z.string().min(1),
+    })
+        .strict()
+        .optional(),
+    channelKey: z.string().optional(),
+})
+    .strict();
+const viewTokenClientActionSchema = z
+    .object({
+    type: z.literal(CLIENT_ACTION.view_token),
+    /** CAIP-19 asset ID (e.g. "eip155:8453/erc20:0x833589fCD6eDb6E08f4c7C32D4f71b54bdA02913") */
+    token: z.string().min(1),
+})
+    .strict();
+const sendTokenClientActionSchema = z
+    .object({
+    type: z.literal(CLIENT_ACTION.send_token),
+    /** CAIP-19 asset ID */
+    token: z.string().optional(),
+    /** Amount in raw token units (e.g. "1000000" for 1 USDC) */
+    amount: z.string().optional(),
+    recipientFid: z.number().int().nonnegative().optional(),
+    recipientAddress: z.string().optional(),
+})
+    .strict();
+const swapTokenClientActionSchema = z
+    .object({
+    type: z.literal(CLIENT_ACTION.swap_token),
+    /** CAIP-19 asset ID to sell */
+    sellToken: z.string().optional(),
+    /** CAIP-19 asset ID to buy */
+    buyToken: z.string().optional(),
+    /** Amount in raw token units */
+    sellAmount: z.string().optional(),
+})
+    .strict();
+export const clientActionSchema = z.discriminatedUnion("type", [
+    viewCastClientActionSchema,
+    viewProfileClientActionSchema,
+    composeCastClientActionSchema,
+    viewTokenClientActionSchema,
+    sendTokenClientActionSchema,
+    swapTokenClientActionSchema,
+]);
+/* ------------------------------------------------------------------ */
+/*  Button schema                                                      */
+/* ------------------------------------------------------------------ */
 const buttonSchema = z
     .object({
     label: z.string().min(1).max(LIMITS.maxButtonLabelChars),
     action: buttonActionSchema,
-    /** URL (HTTPS for post/link/mini_app) or SDK action id (e.g. cast:view:...) */
-    target: z.string().min(1),
+    /** URL target for post/link/mini_app buttons */
+    target: z.string().min(1).optional(),
+    /** Structured client action for client buttons */
+    client_action: clientActionSchema.optional(),
     style: buttonStyleSchema.optional(),
 })
     .superRefine((val, ctx) => {
-    if ((val.action === BUTTON_ACTION.post ||
-        val.action === BUTTON_ACTION.link ||
-        val.action === BUTTON_ACTION.mini_app) &&
-        !isSecureOrLoopbackHttpButtonTarget(val.target)) {
-        ctx.addIssue({
-            code: "custom",
-            message: `button target must use HTTPS (or http:// on localhost / 127.0.0.1 for development) for action "${val.action}" (received: ${val.target})`,
-            path: ["target"],
-        });
+    if (val.action === BUTTON_ACTION.client) {
+        // client buttons require client_action, must not have target
+        if (val.client_action === undefined) {
+            ctx.addIssue({
+                code: "custom",
+                message: `button with action "client" must include a "client_action" object`,
+                path: ["client_action"],
+            });
+        }
+        if (val.target !== undefined) {
+            ctx.addIssue({
+                code: "custom",
+                message: `button with action "client" must not include "target"`,
+                path: ["target"],
+            });
+        }
+    }
+    else {
+        // post/link/mini_app buttons require target, must not have client_action
+        if (val.target === undefined) {
+            ctx.addIssue({
+                code: "custom",
+                message: `button with action "${val.action}" must include a "target" URL`,
+                path: ["target"],
+            });
+        }
+        if (val.client_action !== undefined) {
+            ctx.addIssue({
+                code: "custom",
+                message: `button with action "${val.action}" must not include "client_action"`,
+                path: ["client_action"],
+            });
+        }
+        if (val.target &&
+            (val.action === BUTTON_ACTION.post ||
+                val.action === BUTTON_ACTION.link ||
+                val.action === BUTTON_ACTION.mini_app) &&
+            !isSecureOrLoopbackHttpButtonTarget(val.target)) {
+            ctx.addIssue({
+                code: "custom",
+                message: `button target must use HTTPS (or http:// on localhost / 127.0.0.1 for development) for action "${val.action}" (received: ${val.target})`,
+                path: ["target"],
+            });
+        }
     }
 });
 /** Child elements allowed inside `group` (no media, no nested group) */

package/dist/server/parseRequest.d.ts

@@ -21,6 +21,12 @@ export type ParseRequestOptions = {
      * When true, skip {@link verifyJFSRequestBody} (signature checks).
      */
     skipJFSVerification?: boolean;
+    /**
+     * Maximum allowed absolute difference between the request timestamp and the
+     * server clock, in seconds. Requests outside this window are rejected as
+     * potential replays. Defaults to 300 (5 minutes) when not provided.
+     */
+    maxSkewSeconds?: number;
 };
 export type ParseRequestResult = {
     success: true;

package/dist/server/parseRequest.js

@@ -1,7 +1,6 @@
 import { ACTION_TYPE_GET, ACTION_TYPE_POST, payloadSchema, } from "../schemas.js";
 import { decodePayload, verifyJFSRequestBody } from "./verify.js";
 import { z } from "zod";
-/** Default replay window per SPEC.md § Replay Protection (5 minutes). */
 const DEFAULT_SNAP_POST_MAX_SKEW_SECONDS = 300;
 const requestBodySchema = z.object({
     header: z.string(),
@@ -29,7 +28,7 @@ export async function parseRequest(request, options = {}) {
             action: { type: ACTION_TYPE_GET },
         };
     }
-    const maxSkew = DEFAULT_SNAP_POST_MAX_SKEW_SECONDS;
+    const maxSkew = options.maxSkewSeconds ?? DEFAULT_SNAP_POST_MAX_SKEW_SECONDS;
     const nowSec = Math.floor(Date.now() / 1000);
     const text = await request.text();
     let jsonBody;

package/dist/ui/button-group.d.ts

@@ -1,5 +1,5 @@
 import { z } from "zod";
-export declare const buttonGroupProps: z.ZodObject<{
+export declare const buttonGroupProps: z.ZodPipe<z.ZodObject<{
     name: z.ZodString;
     options: z.ZodArray<z.ZodString>;
     style: z.ZodOptional<z.ZodEnum<{
@@ -7,5 +7,13 @@ export declare const buttonGroupProps: z.ZodObject<{
         stack: "stack";
         grid: "grid";
     }>>;
-}, z.core.$strip>;
+}, z.core.$strip>, z.ZodTransform<{
+    style: "row" | "stack" | "grid";
+    name: string;
+    options: string[];
+}, {
+    name: string;
+    options: string[];
+    style?: "row" | "stack" | "grid" | undefined;
+}>>;
 export type ButtonGroupProps = z.infer<typeof buttonGroupProps>;

package/dist/ui/button-group.js

@@ -1,10 +1,18 @@
 import { z } from "zod";
-import { BUTTON_GROUP_STYLE_VALUES, LIMITS } from "../constants.js";
-export const buttonGroupProps = z.object({
+import { BUTTON_GROUP_STYLE, BUTTON_GROUP_STYLE_VALUES, LIMITS, } from "../constants.js";
+export const buttonGroupProps = z
+    .object({
     name: z.string().min(1),
     options: z
-        .array(z.string())
+        .array(z.string().max(LIMITS.maxButtonGroupOptionChars))
         .min(LIMITS.minButtonGroupOptions)
         .max(LIMITS.maxButtonGroupOptions),
     style: z.enum(BUTTON_GROUP_STYLE_VALUES).optional(),
-});
+})
+    .transform((val) => ({
+    ...val,
+    style: val.style ??
+        (val.options.length <= 3
+            ? BUTTON_GROUP_STYLE.row
+            : BUTTON_GROUP_STYLE.stack),
+}));

package/dist/ui/button.d.ts

@@ -5,9 +5,10 @@ export declare const actionButtonProps: z.ZodObject<{
         post: "post";
         link: "link";
         mini_app: "mini_app";
-        sdk: "sdk";
+        client: "client";
     }>;
-    target: z.ZodString;
+    target: z.ZodOptional<z.ZodString>;
+    client_action: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodUnknown>>;
     style: z.ZodOptional<z.ZodEnum<{
         primary: "primary";
         secondary: "secondary";
@@ -21,9 +22,10 @@ export declare const buttonProps: z.ZodObject<{
         post: "post";
         link: "link";
         mini_app: "mini_app";
-        sdk: "sdk";
+        client: "client";
     }>;
-    target: z.ZodString;
+    target: z.ZodOptional<z.ZodString>;
+    client_action: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodUnknown>>;
     style: z.ZodOptional<z.ZodEnum<{
         primary: "primary";
         secondary: "secondary";

package/dist/ui/button.js

@@ -3,7 +3,8 @@ import { BUTTON_ACTION_VALUES, BUTTON_STYLE_VALUES } from "../constants.js";
 export const actionButtonProps = z.object({
     label: z.string(),
     action: z.enum(BUTTON_ACTION_VALUES),
-    target: z.string(),
+    target: z.string().optional(),
+    client_action: z.record(z.string(), z.unknown()).optional(),
     style: z.enum(BUTTON_STYLE_VALUES).optional(),
 });
 /** Same schema as `actionButtonProps` (legacy export name). */

package/dist/ui/catalog.d.ts

@@ -69,7 +69,7 @@ export declare const snapJsonRenderCatalog: import("@json-render/core").Catalog<
         };
         Spacer: {
             props: z.ZodObject<{
-                size: z.ZodOptional<z.ZodEnum<{
+                size: z.ZodDefault<z.ZodEnum<{
                     small: "small";
                     medium: "medium";
                     large: "large";
@@ -155,7 +155,7 @@ export declare const snapJsonRenderCatalog: import("@json-render/core").Catalog<
             description: string;
         };
         ButtonGroup: {
-            props: z.ZodObject<{
+            props: z.ZodPipe<z.ZodObject<{
                 name: z.ZodString;
                 options: z.ZodArray<z.ZodString>;
                 style: z.ZodOptional<z.ZodEnum<{
@@ -163,14 +163,22 @@ export declare const snapJsonRenderCatalog: import("@json-render/core").Catalog<
                     stack: "stack";
                     grid: "grid";
                 }>>;
-            }, z.core.$strip>;
+            }, z.core.$strip>, z.ZodTransform<{
+                style: "row" | "stack" | "grid";
+                name: string;
+                options: string[];
+            }, {
+                name: string;
+                options: string[];
+                style?: "row" | "stack" | "grid" | undefined;
+            }>>;
             description: string;
         };
         Toggle: {
             props: z.ZodObject<{
                 name: z.ZodString;
                 label: z.ZodString;
-                value: z.ZodOptional<z.ZodBoolean>;
+                value: z.ZodDefault<z.ZodBoolean>;
             }, z.core.$strip>;
             description: string;
         };
@@ -209,7 +217,6 @@ export declare const snapJsonRenderCatalog: import("@json-render/core").Catalog<
             props: z.ZodObject<{
                 layout: z.ZodEnum<{
                     row: "row";
-                    grid: "grid";
                 }>;
             }, z.core.$strip>;
             description: string;
@@ -225,9 +232,10 @@ export declare const snapJsonRenderCatalog: import("@json-render/core").Catalog<
                     post: "post";
                     link: "link";
                     mini_app: "mini_app";
-                    sdk: "sdk";
+                    client: "client";
                 }>;
-                target: z.ZodString;
+                target: z.ZodOptional<z.ZodString>;
+                client_action: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodUnknown>>;
                 style: z.ZodOptional<z.ZodEnum<{
                     primary: "primary";
                     secondary: "secondary";
@@ -261,10 +269,10 @@ export declare const snapJsonRenderCatalog: import("@json-render/core").Catalog<
                 target: z.ZodString;
             }, z.core.$strip>;
         };
-        snap_sdk: {
+        snap_client: {
             description: string;
             params: z.ZodObject<{
-                target: z.ZodString;
+                client_action: z.ZodRecord<z.ZodString, z.ZodUnknown>;
             }, z.core.$strip>;
         };
     };

package/dist/ui/catalog.js

@@ -26,6 +26,9 @@ const snapPostParams = z.object({
 const snapTargetParams = z.object({
     target: z.string(),
 });
+const snapClientParams = z.object({
+    client_action: z.record(z.string(), z.unknown()),
+});
 /**
  * Basic catalog: one json-render component per snap element type, plus ActionButton for snap buttons.
  * Does not validate cross-field rules (media count, height budget); snap JSON still goes through `@farcaster/snap` validation.
@@ -90,7 +93,7 @@ export const snapJsonRenderCatalog = defineCatalog(snapJsonRenderSchema, {
         },
         ActionButton: {
             props: actionButtonProps,
-            description: "Snap action button: post (next page), link (browser), mini_app, sdk — target is HTTPS URL or SDK id.",
+            description: "Snap action button: post (next page), link (browser), mini_app, client — target is HTTPS URL or client_action object.",
         },
     },
     actions: {
@@ -106,9 +109,9 @@ export const snapJsonRenderCatalog = defineCatalog(snapJsonRenderSchema, {
             description: "Open `target` as an in-app Farcaster mini app.",
             params: snapTargetParams,
         },
-        snap_sdk: {
-            description: "Run a Farcaster client SDK action (cast:view, user:follow, …).",
-            params: snapTargetParams,
+        snap_client: {
+            description: "Trigger a Farcaster client action (view_cast, view_profile, compose_cast, …).",
+            params: snapClientParams,
         },
     },
 });

package/dist/ui/group.d.ts

@@ -2,7 +2,6 @@ import { z } from "zod";
 export declare const groupProps: z.ZodObject<{
     layout: z.ZodEnum<{
         row: "row";
-        grid: "grid";
     }>;
 }, z.core.$strip>;
 export type GroupProps = z.infer<typeof groupProps>;

package/dist/ui/group.js

@@ -1,4 +1,5 @@
 import { z } from "zod";
+import { GROUP_LAYOUT_VALUES } from "../constants.js";
 export const groupProps = z.object({
-    layout: z.enum(["row", "grid"]),
+    layout: z.enum(GROUP_LAYOUT_VALUES),
 });

package/dist/ui/schema.js

@@ -26,6 +26,6 @@ export const snapJsonRenderSchema = defineSchema((s) => ({
     defaultRules: [
         "You are generating auxiliary UI for a Farcaster Snap. Prefer components matching snap element types (Text, Image, ButtonGroup, …).",
         "Snap pages use a Stack root with at most 5 body children and 1 media element (Image or Grid); keep generated trees small.",
-        "Bottom-of-card snap buttons are ActionButton components; use actions post / link / mini_app / sdk per SPEC.md.",
+        "Bottom-of-card snap buttons are ActionButton components; use actions post / link / mini_app / client.",
     ],
 });

package/dist/ui/spacer.d.ts

@@ -1,6 +1,6 @@
 import { z } from "zod";
 export declare const spacerProps: z.ZodObject<{
-    size: z.ZodOptional<z.ZodEnum<{
+    size: z.ZodDefault<z.ZodEnum<{
         small: "small";
         medium: "medium";
         large: "large";

package/dist/ui/spacer.js

@@ -1,5 +1,5 @@
 import { z } from "zod";
-import { SPACER_SIZE_VALUES } from "../constants.js";
+import { SPACER_SIZE, SPACER_SIZE_VALUES } from "../constants.js";
 export const spacerProps = z.object({
-    size: z.enum(SPACER_SIZE_VALUES).optional(),
+    size: z.enum(SPACER_SIZE_VALUES).default(SPACER_SIZE.medium),
 });

package/dist/ui/toggle.d.ts

@@ -2,6 +2,6 @@ import { z } from "zod";
 export declare const toggleProps: z.ZodObject<{
     name: z.ZodString;
     label: z.ZodString;
-    value: z.ZodOptional<z.ZodBoolean>;
+    value: z.ZodDefault<z.ZodBoolean>;
 }, z.core.$strip>;
 export type ToggleProps = z.infer<typeof toggleProps>;

package/dist/ui/toggle.js

@@ -2,5 +2,5 @@ import { z } from "zod";
 export const toggleProps = z.object({
     name: z.string().min(1),
     label: z.string(),
-    value: z.boolean().optional(),
+    value: z.boolean().default(false),
 });

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@farcaster/snap",
-  "version": "1.5.0",
+  "version": "1.5.2",
   "description": "Farcaster Snaps 🫰",
   "repository": {
     "type": "git",

package/src/constants.ts

@@ -68,6 +68,8 @@ export const DEFAULT_LIST_STYLE = "ordered" as const;
 
 export const GRID_CELL_SIZE_VALUES = ["auto", "square"] as const;
 export const GRID_GAP_VALUES = ["none", "small", "medium"] as const;
+export const DEFAULT_GRID_GAP =
+  "small" as const satisfies (typeof GRID_GAP_VALUES)[number];
 
 export const BUTTON_GROUP_STYLE = {
   row: "row",
@@ -85,14 +87,32 @@ export const BUTTON_ACTION = {
   post: "post",
   link: "link",
   mini_app: "mini_app",
-  sdk: "sdk",
+  client: "client",
 } as const;
 
 export const BUTTON_ACTION_VALUES = [
   BUTTON_ACTION.post,
   BUTTON_ACTION.link,
   BUTTON_ACTION.mini_app,
-  BUTTON_ACTION.sdk,
+  BUTTON_ACTION.client,
+] as const;
+
+export const CLIENT_ACTION = {
+  view_cast: "view_cast",
+  view_profile: "view_profile",
+  compose_cast: "compose_cast",
+  view_token: "view_token",
+  send_token: "send_token",
+  swap_token: "swap_token",
+} as const;
+
+export const CLIENT_ACTION_VALUES = [
+  CLIENT_ACTION.view_cast,
+  CLIENT_ACTION.view_profile,
+  CLIENT_ACTION.compose_cast,
+  CLIENT_ACTION.view_token,
+  CLIENT_ACTION.send_token,
+  CLIENT_ACTION.swap_token,
 ] as const;
 
 export const BUTTON_STYLE = {

package/src/index.ts

@@ -5,6 +5,8 @@ export {
   MEDIA_TYPE,
   DEFAULT_LIST_STYLE,
   DEFAULT_SLIDER_STEP,
+  CLIENT_ACTION,
+  CLIENT_ACTION_VALUES,
 } from "./constants";
 export {
   DEFAULT_THEME_ACCENT,
@@ -21,11 +23,13 @@ export {
   snapResponseSchema,
   firstPageResponseSchema,
   payloadSchema,
+  clientActionSchema,
   createDefaultDataStore,
   type Button,
   type Element,
   type Elements,
   type GroupChildElement,
+  type ClientAction,
   type SnapAction,
   type SnapPageElementInput,
   type SnapContext,
@@ -42,3 +46,4 @@ export {
   validateFirstPageResponse,
   type ValidationResult,
 } from "./validator";
+export { type Middleware, useMiddleware } from "./middleware";

package/src/middleware.ts

@@ -0,0 +1,7 @@
+import { SnapFunction } from "./schemas";
+
+export type Middleware = (fn: SnapFunction) => SnapFunction;
+
+export function useMiddleware(fn: SnapFunction, middleware: Middleware[]) {
+  return middleware.reduce((acc, middleware) => middleware(acc), fn);
+}

package/src/schemas.ts

@@ -2,11 +2,13 @@ import { z } from "zod";
 import {
   BUTTON_ACTION,
   BUTTON_ACTION_VALUES,
+  CLIENT_ACTION,
   BUTTON_GROUP_STYLE,
   BUTTON_GROUP_STYLE_VALUES,
   BUTTON_LAYOUT_VALUES,
   BUTTON_STYLE_VALUES,
   DEFAULT_BUTTON_LAYOUT,
+  DEFAULT_GRID_GAP,
   DEFAULT_LIST_STYLE,
   DEFAULT_SLIDER_STEP,
   EFFECT_VALUES,
@@ -68,33 +70,10 @@ const themeSchema = z
   })
   .strict();
 
-const httpsUrl = z.string().refine((s) => s.startsWith(HTTPS_PREFIX), {
-  message: "URL must use HTTPS",
+const imageUrlSchema = z.string().refine((s) => s.startsWith(HTTPS_PREFIX), {
+  message: "image URL must use HTTPS",
 });
 
-function hasAllowedMediaExtension(
-  urlString: string,
-  allowedExtensions: string[],
-): boolean {
-  try {
-    const url = new URL(urlString);
-    if (url.protocol !== "https:") return false;
-    const lowerPathname = url.pathname.toLowerCase();
-    return allowedExtensions.some((extension) =>
-      lowerPathname.endsWith(`.${extension}`),
-    );
-  } catch {
-    return false;
-  }
-}
-
-const imageUrlSchema = z
-  .string()
-  .refine((s) => hasAllowedMediaExtension(s, ["jpg", "png", "gif", "webp"]), {
-    message:
-      "image URL must use HTTPS and end with a supported extension (.jpg, .png, .gif, .webp)",
-  });
-
 const textAlignSchema = z.enum(TEXT_ALIGN_VALUES);
 
 const textElementSchema = z
@@ -208,7 +187,7 @@ const gridElementSchema = z
     rows: z.number().int().min(LIMITS.minGridRows).max(LIMITS.maxGridRows),
     cells: z.array(gridCellSchema),
     cellSize: z.enum(GRID_CELL_SIZE_VALUES).optional(),
-    gap: z.enum(GRID_GAP_VALUES).optional(),
+    gap: z.enum(GRID_GAP_VALUES).default(DEFAULT_GRID_GAP),
     interactive: z.boolean().optional(),
   })
   .superRefine((val, ctx) => {
@@ -370,26 +349,146 @@ const buttonActionSchema = z.enum(BUTTON_ACTION_VALUES);
 
 const buttonStyleSchema = z.enum(BUTTON_STYLE_VALUES);
 
+/* ------------------------------------------------------------------ */
+/*  Client action schemas                                              */
+/* ------------------------------------------------------------------ */
+
+const viewCastClientActionSchema = z
+  .object({
+    type: z.literal(CLIENT_ACTION.view_cast),
+    hash: z.string().min(1),
+  })
+  .strict();
+
+const viewProfileClientActionSchema = z
+  .object({
+    type: z.literal(CLIENT_ACTION.view_profile),
+    fid: z.number().int().nonnegative(),
+  })
+  .strict();
+
+const composeCastClientActionSchema = z
+  .object({
+    type: z.literal(CLIENT_ACTION.compose_cast),
+    text: z.string().optional(),
+    embeds: z
+      .array(z.string())
+      .max(2, { message: "compose_cast embeds: max 2 URLs" })
+      .optional(),
+    parent: z
+      .object({
+        type: z.literal("cast"),
+        hash: z.string().min(1),
+      })
+      .strict()
+      .optional(),
+    channelKey: z.string().optional(),
+  })
+  .strict();
+
+const viewTokenClientActionSchema = z
+  .object({
+    type: z.literal(CLIENT_ACTION.view_token),
+    /** CAIP-19 asset ID (e.g. "eip155:8453/erc20:0x833589fCD6eDb6E08f4c7C32D4f71b54bdA02913") */
+    token: z.string().min(1),
+  })
+  .strict();
+
+const sendTokenClientActionSchema = z
+  .object({
+    type: z.literal(CLIENT_ACTION.send_token),
+    /** CAIP-19 asset ID */
+    token: z.string().optional(),
+    /** Amount in raw token units (e.g. "1000000" for 1 USDC) */
+    amount: z.string().optional(),
+    recipientFid: z.number().int().nonnegative().optional(),
+    recipientAddress: z.string().optional(),
+  })
+  .strict();
+
+const swapTokenClientActionSchema = z
+  .object({
+    type: z.literal(CLIENT_ACTION.swap_token),
+    /** CAIP-19 asset ID to sell */
+    sellToken: z.string().optional(),
+    /** CAIP-19 asset ID to buy */
+    buyToken: z.string().optional(),
+    /** Amount in raw token units */
+    sellAmount: z.string().optional(),
+  })
+  .strict();
+
+export const clientActionSchema = z.discriminatedUnion("type", [
+  viewCastClientActionSchema,
+  viewProfileClientActionSchema,
+  composeCastClientActionSchema,
+  viewTokenClientActionSchema,
+  sendTokenClientActionSchema,
+  swapTokenClientActionSchema,
+]);
+
+export type ClientAction = z.infer<typeof clientActionSchema>;
+
+/* ------------------------------------------------------------------ */
+/*  Button schema                                                      */
+/* ------------------------------------------------------------------ */
+
 const buttonSchema = z
   .object({
     label: z.string().min(1).max(LIMITS.maxButtonLabelChars),
     action: buttonActionSchema,
-    /** URL (HTTPS for post/link/mini_app) or SDK action id (e.g. cast:view:...) */
-    target: z.string().min(1),
+    /** URL target for post/link/mini_app buttons */
+    target: z.string().min(1).optional(),
+    /** Structured client action for client buttons */
+    client_action: clientActionSchema.optional(),
     style: buttonStyleSchema.optional(),
   })
   .superRefine((val, ctx) => {
-    if (
-      (val.action === BUTTON_ACTION.post ||
-        val.action === BUTTON_ACTION.link ||
-        val.action === BUTTON_ACTION.mini_app) &&
-      !isSecureOrLoopbackHttpButtonTarget(val.target)
-    ) {
-      ctx.addIssue({
-        code: "custom",
-        message: `button target must use HTTPS (or http:// on localhost / 127.0.0.1 for development) for action "${val.action}" (received: ${val.target})`,
-        path: ["target"],
-      });
+    if (val.action === BUTTON_ACTION.client) {
+      // client buttons require client_action, must not have target
+      if (val.client_action === undefined) {
+        ctx.addIssue({
+          code: "custom",
+          message: `button with action "client" must include a "client_action" object`,
+          path: ["client_action"],
+        });
+      }
+      if (val.target !== undefined) {
+        ctx.addIssue({
+          code: "custom",
+          message: `button with action "client" must not include "target"`,
+          path: ["target"],
+        });
+      }
+    } else {
+      // post/link/mini_app buttons require target, must not have client_action
+      if (val.target === undefined) {
+        ctx.addIssue({
+          code: "custom",
+          message: `button with action "${val.action}" must include a "target" URL`,
+          path: ["target"],
+        });
+      }
+      if (val.client_action !== undefined) {
+        ctx.addIssue({
+          code: "custom",
+          message: `button with action "${val.action}" must not include "client_action"`,
+          path: ["client_action"],
+        });
+      }
+      if (
+        val.target &&
+        (val.action === BUTTON_ACTION.post ||
+          val.action === BUTTON_ACTION.link ||
+          val.action === BUTTON_ACTION.mini_app) &&
+        !isSecureOrLoopbackHttpButtonTarget(val.target)
+      ) {
+        ctx.addIssue({
+          code: "custom",
+          message: `button target must use HTTPS (or http:// on localhost / 127.0.0.1 for development) for action "${val.action}" (received: ${val.target})`,
+          path: ["target"],
+        });
+      }
     }
   });
 
@@ -608,7 +707,9 @@ export function createDefaultDataStore(): SnapDataStore {
     set(_key: string, _value: DataStoreValue): Promise<never> {
       return Promise.reject(err);
     },
-    withLock<T>(_fn: (store: SnapDataStoreOperations) => Promise<T>): Promise<never> {
+    withLock<T>(
+      _fn: (store: SnapDataStoreOperations) => Promise<T>,
+    ): Promise<never> {
       return Promise.reject(err);
     },
   };

package/src/server/parseRequest.ts

@@ -7,7 +7,6 @@ import {
 import { decodePayload, verifyJFSRequestBody } from "./verify";
 import { z } from "zod";
 
-/** Default replay window per SPEC.md § Replay Protection (5 minutes). */
 const DEFAULT_SNAP_POST_MAX_SKEW_SECONDS = 300 as const;
 
 export type ParseRequestError =
@@ -37,6 +36,13 @@ export type ParseRequestOptions = {
    * When true, skip {@link verifyJFSRequestBody} (signature checks).
    */
   skipJFSVerification?: boolean;
+
+  /**
+   * Maximum allowed absolute difference between the request timestamp and the
+   * server clock, in seconds. Requests outside this window are rejected as
+   * potential replays. Defaults to 300 (5 minutes) when not provided.
+   */
+  maxSkewSeconds?: number;
 };
 
 export type ParseRequestResult =
@@ -75,7 +81,7 @@ export async function parseRequest(
     };
   }
 
-  const maxSkew = DEFAULT_SNAP_POST_MAX_SKEW_SECONDS;
+  const maxSkew = options.maxSkewSeconds ?? DEFAULT_SNAP_POST_MAX_SKEW_SECONDS;
   const nowSec = Math.floor(Date.now() / 1000);
 
   const text = await request.text();

package/src/ui/button-group.ts

@@ -1,13 +1,26 @@
 import { z } from "zod";
-import { BUTTON_GROUP_STYLE_VALUES, LIMITS } from "../constants.js";
+import {
+  BUTTON_GROUP_STYLE,
+  BUTTON_GROUP_STYLE_VALUES,
+  LIMITS,
+} from "../constants.js";
 
-export const buttonGroupProps = z.object({
-  name: z.string().min(1),
-  options: z
-    .array(z.string())
-    .min(LIMITS.minButtonGroupOptions)
-    .max(LIMITS.maxButtonGroupOptions),
-  style: z.enum(BUTTON_GROUP_STYLE_VALUES).optional(),
-});
+export const buttonGroupProps = z
+  .object({
+    name: z.string().min(1),
+    options: z
+      .array(z.string().max(LIMITS.maxButtonGroupOptionChars))
+      .min(LIMITS.minButtonGroupOptions)
+      .max(LIMITS.maxButtonGroupOptions),
+    style: z.enum(BUTTON_GROUP_STYLE_VALUES).optional(),
+  })
+  .transform((val) => ({
+    ...val,
+    style:
+      val.style ??
+      (val.options.length <= 3
+        ? BUTTON_GROUP_STYLE.row
+        : BUTTON_GROUP_STYLE.stack),
+  }));
 
 export type ButtonGroupProps = z.infer<typeof buttonGroupProps>;

package/src/ui/button.ts

@@ -4,7 +4,8 @@ import { BUTTON_ACTION_VALUES, BUTTON_STYLE_VALUES } from "../constants.js";
 export const actionButtonProps = z.object({
   label: z.string(),
   action: z.enum(BUTTON_ACTION_VALUES),
-  target: z.string(),
+  target: z.string().optional(),
+  client_action: z.record(z.string(), z.unknown()).optional(),
   style: z.enum(BUTTON_STYLE_VALUES).optional(),
 });
 

package/src/ui/catalog.ts

@@ -29,6 +29,10 @@ const snapTargetParams = z.object({
   target: z.string(),
 });
 
+const snapClientParams = z.object({
+  client_action: z.record(z.string(), z.unknown()),
+});
+
 /**
  * Basic catalog: one json-render component per snap element type, plus ActionButton for snap buttons.
  * Does not validate cross-field rules (media count, height budget); snap JSON still goes through `@farcaster/snap` validation.
@@ -102,7 +106,7 @@ export const snapJsonRenderCatalog = defineCatalog(snapJsonRenderSchema, {
     ActionButton: {
       props: actionButtonProps,
       description:
-        "Snap action button: post (next page), link (browser), mini_app, sdk — target is HTTPS URL or SDK id.",
+        "Snap action button: post (next page), link (browser), mini_app, client — target is HTTPS URL or client_action object.",
     },
   },
   actions: {
@@ -119,10 +123,10 @@ export const snapJsonRenderCatalog = defineCatalog(snapJsonRenderSchema, {
       description: "Open `target` as an in-app Farcaster mini app.",
       params: snapTargetParams,
     },
-    snap_sdk: {
+    snap_client: {
       description:
-        "Run a Farcaster client SDK action (cast:view, user:follow, …).",
-      params: snapTargetParams,
+        "Trigger a Farcaster client action (view_cast, view_profile, compose_cast, …).",
+      params: snapClientParams,
     },
   },
 });

package/src/ui/group.ts

@@ -1,7 +1,8 @@
 import { z } from "zod";
+import { GROUP_LAYOUT_VALUES } from "../constants.js";
 
 export const groupProps = z.object({
-  layout: z.enum(["row", "grid"]),
+  layout: z.enum(GROUP_LAYOUT_VALUES),
 });
 
 export type GroupProps = z.infer<typeof groupProps>;

package/src/ui/schema.ts

@@ -31,7 +31,7 @@ export const snapJsonRenderSchema = defineSchema(
     defaultRules: [
       "You are generating auxiliary UI for a Farcaster Snap. Prefer components matching snap element types (Text, Image, ButtonGroup, …).",
       "Snap pages use a Stack root with at most 5 body children and 1 media element (Image or Grid); keep generated trees small.",
-      "Bottom-of-card snap buttons are ActionButton components; use actions post / link / mini_app / sdk per SPEC.md.",
+      "Bottom-of-card snap buttons are ActionButton components; use actions post / link / mini_app / client.",
     ],
   },
 );

package/src/ui/spacer.ts

@@ -1,8 +1,8 @@
 import { z } from "zod";
-import { SPACER_SIZE_VALUES } from "../constants.js";
+import { SPACER_SIZE, SPACER_SIZE_VALUES } from "../constants.js";
 
 export const spacerProps = z.object({
-  size: z.enum(SPACER_SIZE_VALUES).optional(),
+  size: z.enum(SPACER_SIZE_VALUES).default(SPACER_SIZE.medium),
 });
 
 export type SpacerProps = z.infer<typeof spacerProps>;

package/src/ui/toggle.ts

@@ -3,7 +3,7 @@ import { z } from "zod";
 export const toggleProps = z.object({
   name: z.string().min(1),
   label: z.string(),
-  value: z.boolean().optional(),
+  value: z.boolean().default(false),
 });
 
 export type ToggleProps = z.infer<typeof toggleProps>;