@ggui-ai/dev-stack 0.2.0-alpha.3 → 0.3.0-rc.0

package/dist/index.d.ts

@@ -21,15 +21,13 @@
  * adapter seam.
  */
 export { LocalUiRegistry, type LocalUiRegistryOptions, type LocalBundleResult, type BundleErrorLocation, } from './local-registry/local-registry.js';
-export { discoverLocalUis, discoverFromGguiJsonPath, type DiscoveredUi, type DiscoveryIssue, type DiscoveryResult, type DiscoverOptions, } from '@ggui-ai/project-config/node';
-export { compileUiOnDemand, resolveEntryFile, COMPILED_BUNDLE_CONTENT_TYPE, type CompileResult, } from './local-registry/compile-ui.js';
+export { compileUiOnDemand, resolveEntryFile, COMPILED_BUNDLE_CONTENT_TYPE, SANDBOX_EXTERNALS, type CompileResult, } from './local-registry/compile-ui.js';
 export { createLocalWatcher, statOrNull, type LocalWatcher, type LocalWatcherOptions, type WatchListener, } from './local-registry/watcher.js';
 export { startDevServer, type DevServerOptions, type DevServerHandle, } from './dev-server/http.js';
 export { openEventStream, type SseOptions } from './dev-server/events.js';
 export { renderHubHtml, serveHubShell, type HubShellContext, } from './dev-server/hub.js';
 export { renderHubPreviewHtml, serveHubPreviewShell, serveHubPreviewBundle, resolveHubPreviewBundlePath, extractSelectedId, type HubPreviewShellContext, } from './dev-server/hub-preview.js';
 export { createSecurityPolicy, type CreatePolicyOptions, type DevServerSecurityPolicy, type PolicyOutcome, } from './dev-server/auth.js';
-export { startSandboxProxyServer, type SandboxProxyServerOptions, type SandboxProxyServerHandle, } from './dev-server/sandbox-proxy.js';
 export { runDev, GguiDevError, DEFAULT_DEV_PORT, DEFAULT_DEV_HOST, type DevOptions, type DevBootstrap, } from './run-dev.js';
 export { RuntimeSupervisor, DEFAULT_RUNTIME_BUFFER_SIZE, emptyRuntimeSnapshot, formatRuntimeEventLine, type RuntimeSupervisorOptions, type RuntimeStateSnapshot, type EmptyRuntimeStateSnapshot, type AnyRuntimeStateSnapshot, type RuntimeEventRecord, } from './runtime-supervisor.js';
 //# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;GAqBG;AAGH,OAAO,EACL,eAAe,EACf,KAAK,sBAAsB,EAC3B,KAAK,iBAAiB,EACtB,KAAK,mBAAmB,GACzB,MAAM,oCAAoC,CAAC;AAM5C,OAAO,EACL,gBAAgB,EAChB,wBAAwB,EACxB,KAAK,YAAY,EACjB,KAAK,cAAc,EACnB,KAAK,eAAe,EACpB,KAAK,eAAe,GACrB,MAAM,8BAA8B,CAAC;AAGtC,OAAO,EACL,iBAAiB,EACjB,gBAAgB,EAChB,4BAA4B,EAC5B,KAAK,aAAa,GACnB,MAAM,gCAAgC,CAAC;AAGxC,OAAO,EACL,kBAAkB,EAClB,UAAU,EACV,KAAK,YAAY,EACjB,KAAK,mBAAmB,EACxB,KAAK,aAAa,GACnB,MAAM,6BAA6B,CAAC;AAGrC,OAAO,EACL,cAAc,EACd,KAAK,gBAAgB,EACrB,KAAK,eAAe,GACrB,MAAM,sBAAsB,CAAC;AAG9B,OAAO,EAAE,eAAe,EAAE,KAAK,UAAU,EAAE,MAAM,wBAAwB,CAAC;AAG1E,OAAO,EACL,aAAa,EACb,aAAa,EACb,KAAK,eAAe,GACrB,MAAM,qBAAqB,CAAC;AAG7B,OAAO,EACL,oBAAoB,EACpB,oBAAoB,EACpB,qBAAqB,EACrB,2BAA2B,EAC3B,iBAAiB,EACjB,KAAK,sBAAsB,GAC5B,MAAM,6BAA6B,CAAC;AAGrC,OAAO,EACL,oBAAoB,EACpB,KAAK,mBAAmB,EACxB,KAAK,uBAAuB,EAC5B,KAAK,aAAa,GACnB,MAAM,sBAAsB,CAAC;AAK9B,OAAO,EACL,uBAAuB,EACvB,KAAK,yBAAyB,EAC9B,KAAK,wBAAwB,GAC9B,MAAM,+BAA+B,CAAC;AAGvC,OAAO,EACL,MAAM,EACN,YAAY,EACZ,gBAAgB,EAChB,gBAAgB,EAChB,KAAK,UAAU,EACf,KAAK,YAAY,GAClB,MAAM,cAAc,CAAC;AAKtB,OAAO,EACL,iBAAiB,EACjB,2BAA2B,EAC3B,oBAAoB,EACpB,sBAAsB,EACtB,KAAK,wBAAwB,EAC7B,KAAK,oBAAoB,EACzB,KAAK,yBAAyB,EAC9B,KAAK,uBAAuB,EAC5B,KAAK,kBAAkB,GACxB,MAAM,yBAAyB,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;GAqBG;AAGH,OAAO,EACL,eAAe,EACf,KAAK,sBAAsB,EAC3B,KAAK,iBAAiB,EACtB,KAAK,mBAAmB,GACzB,MAAM,oCAAoC,CAAC;AAG5C,OAAO,EACL,iBAAiB,EACjB,gBAAgB,EAChB,4BAA4B,EAC5B,iBAAiB,EACjB,KAAK,aAAa,GACnB,MAAM,gCAAgC,CAAC;AAGxC,OAAO,EACL,kBAAkB,EAClB,UAAU,EACV,KAAK,YAAY,EACjB,KAAK,mBAAmB,EACxB,KAAK,aAAa,GACnB,MAAM,6BAA6B,CAAC;AAGrC,OAAO,EACL,cAAc,EACd,KAAK,gBAAgB,EACrB,KAAK,eAAe,GACrB,MAAM,sBAAsB,CAAC;AAG9B,OAAO,EAAE,eAAe,EAAE,KAAK,UAAU,EAAE,MAAM,wBAAwB,CAAC;AAG1E,OAAO,EACL,aAAa,EACb,aAAa,EACb,KAAK,eAAe,GACrB,MAAM,qBAAqB,CAAC;AAG7B,OAAO,EACL,oBAAoB,EACpB,oBAAoB,EACpB,qBAAqB,EACrB,2BAA2B,EAC3B,iBAAiB,EACjB,KAAK,sBAAsB,GAC5B,MAAM,6BAA6B,CAAC;AAGrC,OAAO,EACL,oBAAoB,EACpB,KAAK,mBAAmB,EACxB,KAAK,uBAAuB,EAC5B,KAAK,aAAa,GACnB,MAAM,sBAAsB,CAAC;AAG9B,OAAO,EACL,MAAM,EACN,YAAY,EACZ,gBAAgB,EAChB,gBAAgB,EAChB,KAAK,UAAU,EACf,KAAK,YAAY,GAClB,MAAM,cAAc,CAAC;AAKtB,OAAO,EACL,iBAAiB,EACjB,2BAA2B,EAC3B,oBAAoB,EACpB,sBAAsB,EACtB,KAAK,wBAAwB,EAC7B,KAAK,oBAAoB,EACzB,KAAK,yBAAyB,EAC9B,KAAK,uBAAuB,EAC5B,KAAK,kBAAkB,GACxB,MAAM,yBAAyB,CAAC"}

package/dist/index.js

@@ -22,13 +22,8 @@
  */
 // Local UI registry
 export { LocalUiRegistry, } from './local-registry/local-registry.js';
-// Discovery — re-export from @ggui-ai/project-config/node for
-// consumers that have historically imported these symbols from the
-// dev-stack barrel. The canonical home is the schema-owner package;
-// dev-stack's `LocalUiRegistry` consumes the same helper directly.
-export { discoverLocalUis, discoverFromGguiJsonPath, } from '@ggui-ai/project-config/node';
 // Compile-on-demand
-export { compileUiOnDemand, resolveEntryFile, COMPILED_BUNDLE_CONTENT_TYPE, } from './local-registry/compile-ui.js';
+export { compileUiOnDemand, resolveEntryFile, COMPILED_BUNDLE_CONTENT_TYPE, SANDBOX_EXTERNALS, } from './local-registry/compile-ui.js';
 // Watcher
 export { createLocalWatcher, statOrNull, } from './local-registry/watcher.js';
 // HTTP dev server
@@ -41,10 +36,6 @@ export { renderHubHtml, serveHubShell, } from './dev-server/hub.js';
 export { renderHubPreviewHtml, serveHubPreviewShell, serveHubPreviewBundle, resolveHubPreviewBundlePath, extractSelectedId, } from './dev-server/hub-preview.js';
 // Auth / CORS policy
 export { createSecurityPolicy, } from './dev-server/auth.js';
-// MCP-Apps sandbox proxy — second HTTP server on a different origin
-// that serves `sandbox.html` for `<AppRenderer>`'s two-iframe
-// sandboxing pattern (R5; see ./dev-server/sandbox-proxy.ts).
-export { startSandboxProxyServer, } from './dev-server/sandbox-proxy.js';
 // Orchestration — the seam every local-dev host composes against.
 export { runDev, GguiDevError, DEFAULT_DEV_PORT, DEFAULT_DEV_HOST, } from './run-dev.js';
 // Runtime supervision — ring-buffered view of the supervised agent

package/dist/local-registry/compile-ui.d.ts

@@ -1,5 +1,13 @@
 import { type Message } from 'esbuild';
 import type { UiManifest } from '@ggui-ai/project-config';
+/**
+ * Packages the runtime renderer already resolves from its
+ * own bundle (via `@ggui-ai/design/module-loader`'s import-map).
+ * Keeping them out of the compiled bundle keeps the artifact small
+ * and lets the rendering host's in-tree React instance be shared
+ * across every rendered UI.
+ */
+export declare const SANDBOX_EXTERNALS: string[];
 /** Content type the compiled bundle is served with. Matches the
  * precompiled path for consistency. */
 export declare const COMPILED_BUNDLE_CONTENT_TYPE = "application/javascript+react";

package/dist/local-registry/compile-ui.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"compile-ui.d.ts","sourceRoot":"","sources":["../../src/local-registry/compile-ui.ts"],"names":[],"mappings":"AAoCA,OAAO,EAA4B,KAAK,OAAO,EAAE,MAAM,SAAS,CAAC;AACjE,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,yBAAyB,CAAC;AA6B1D;uCACuC;AACvC,eAAO,MAAM,4BAA4B,iCAAiC,CAAC;AAE3E,MAAM,WAAW,aAAa;IAC5B,gEAAgE;IAChE,WAAW,EAAE,MAAM,CAAC;IACpB,+DAA+D;IAC/D,YAAY,EAAE,MAAM,CAAC;IACrB,6EAA6E;IAC7E,QAAQ,EAAE,UAAU,CAAC;CACtB;AAED,MAAM,WAAW,SAAS;IACxB,IAAI,EAAE,IAAI,CAAC;IACX,oBAAoB;IACpB,IAAI,EAAE,MAAM,CAAC;IACb,iEAAiE;IACjE,KAAK,EAAE,MAAM,CAAC;IACd,6CAA6C;IAC7C,QAAQ,EAAE,OAAO,EAAE,CAAC;CACrB;AAED,MAAM,WAAW,mBAAmB;IAClC,IAAI,EAAE,eAAe,CAAC;IACtB;;;;OAIG;IACH,KAAK,EAAE,MAAM,EAAE,CAAC;CACjB;AAED,MAAM,WAAW,cAAc;IAC7B,IAAI,EAAE,SAAS,CAAC;IAChB,KAAK,EAAE,MAAM,CAAC;IACd,MAAM,EAAE,OAAO,EAAE,CAAC;IAClB,QAAQ,EAAE,OAAO,EAAE,CAAC;CACrB;AAED,MAAM,MAAM,aAAa,GAAG,SAAS,GAAG,mBAAmB,GAAG,cAAc,CAAC;AAE7E;;;;;;;;;;;GAWG;AACH,wBAAgB,gBAAgB,CAAC,MAAM,EAAE,aAAa,GAAG;IAAE,KAAK,EAAE,MAAM,CAAA;CAAE,GAAG;IAAE,KAAK,EAAE,MAAM,EAAE,CAAA;CAAE,CAkB/F;AAED;;;;;;;;;GASG;AACH,wBAAsB,iBAAiB,CAAC,MAAM,EAAE,aAAa,GAAG,OAAO,CAAC,aAAa,CAAC,CAqCrF"}
+{"version":3,"file":"compile-ui.d.ts","sourceRoot":"","sources":["../../src/local-registry/compile-ui.ts"],"names":[],"mappings":"AAqCA,OAAO,EAA4B,KAAK,OAAO,EAAE,MAAM,SAAS,CAAC;AACjE,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,yBAAyB,CAAC;AAE1D;;;;;;GAMG;AACH,eAAO,MAAM,iBAAiB,UAW7B,CAAC;AASF;uCACuC;AACvC,eAAO,MAAM,4BAA4B,iCAAiC,CAAC;AAE3E,MAAM,WAAW,aAAa;IAC5B,gEAAgE;IAChE,WAAW,EAAE,MAAM,CAAC;IACpB,+DAA+D;IAC/D,YAAY,EAAE,MAAM,CAAC;IACrB,6EAA6E;IAC7E,QAAQ,EAAE,UAAU,CAAC;CACtB;AAED,MAAM,WAAW,SAAS;IACxB,IAAI,EAAE,IAAI,CAAC;IACX,oBAAoB;IACpB,IAAI,EAAE,MAAM,CAAC;IACb,iEAAiE;IACjE,KAAK,EAAE,MAAM,CAAC;IACd,6CAA6C;IAC7C,QAAQ,EAAE,OAAO,EAAE,CAAC;CACrB;AAED,MAAM,WAAW,mBAAmB;IAClC,IAAI,EAAE,eAAe,CAAC;IACtB;;;;OAIG;IACH,KAAK,EAAE,MAAM,EAAE,CAAC;CACjB;AAED,MAAM,WAAW,cAAc;IAC7B,IAAI,EAAE,SAAS,CAAC;IAChB,KAAK,EAAE,MAAM,CAAC;IACd,MAAM,EAAE,OAAO,EAAE,CAAC;IAClB,QAAQ,EAAE,OAAO,EAAE,CAAC;CACrB;AAED,MAAM,MAAM,aAAa,GAAG,SAAS,GAAG,mBAAmB,GAAG,cAAc,CAAC;AAE7E;;;;;;;;;;;GAWG;AACH,wBAAgB,gBAAgB,CAAC,MAAM,EAAE,aAAa,GAAG;IAAE,KAAK,EAAE,MAAM,CAAA;CAAE,GAAG;IAAE,KAAK,EAAE,MAAM,EAAE,CAAA;CAAE,CAkB/F;AAED;;;;;;;;;GASG;AACH,wBAAsB,iBAAiB,CAAC,MAAM,EAAE,aAAa,GAAG,OAAO,CAAC,aAAa,CAAC,CAqCrF"}

package/dist/local-registry/compile-ui.js

@@ -2,10 +2,11 @@
  * Compile-on-demand for local `ggui dev` UIs.
  *
  * Resolves the authored TSX entry for a `ggui.ui.json` and runs
- * esbuild against it, producing an ESM bundle Studio can hand to
- * `DynamicComponent`. This replaces the "must pre-compile" state
- * the foundation slice left behind — `ggui dev` now feels like a
- * real dev server: start it, open Studio, see the render.
+ * esbuild against it, producing an ESM bundle an authoring UI can
+ * hand to `DynamicComponent`. This replaces the "must pre-compile"
+ * state the foundation slice left behind — `ggui dev` now feels
+ * like a real dev server: start it, open the authoring UI, see the
+ * render.
  *
  * Trust model:
  *
@@ -23,11 +24,11 @@
  *
  *   - esbuild `build` mode with bundle: true, so multi-file UIs
  *     work (import sibling helpers, theme tokens, wire hooks).
- *   - Sandbox externals match the runtime Studio renderer
+ *   - Sandbox externals match the runtime renderer
  *     (`DynamicComponent` in `@ggui-ai/react`). React, the design
  *     system, `@ggui-ai/wire`, and `@ggui-ai/react` stay external
- *     and resolve against the import map Studio provides at
- *     render time.
+ *     and resolve against the import map the rendering host
+ *     provides at render time.
  *   - No caching. Every request recompiles. esbuild TSX transform
  *     is ~50-200ms for a typical single-screen UI — fine for the
  *     dev loop. A watcher-driven cache lands with HMR, not here.
@@ -36,13 +37,13 @@ import { existsSync } from 'node:fs';
 import { dirname, isAbsolute, resolve } from 'node:path';
 import { build } from 'esbuild';
 /**
- * Packages the Studio runtime renderer already resolves from its
+ * Packages the runtime renderer already resolves from its
  * own bundle (via `@ggui-ai/design/module-loader`'s import-map).
  * Keeping them out of the compiled bundle keeps the artifact small
- * and lets Studio's in-tree React instance be shared across every
- * rendered UI.
+ * and lets the rendering host's in-tree React instance be shared
+ * across every rendered UI.
  */
-const SANDBOX_EXTERNALS = [
+export const SANDBOX_EXTERNALS = [
     'react',
     'react/*',
     'react-dom',

package/dist/local-registry/local-registry.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"local-registry.d.ts","sourceRoot":"","sources":["../../src/local-registry/local-registry.ts"],"names":[],"mappings":"AAmCA,OAAO,KAAK,EACV,QAAQ,EACR,eAAe,EACf,UAAU,EACV,sBAAsB,EACvB,MAAM,sBAAsB,CAAC;AAC9B,OAAO,EAGL,KAAK,cAAc,EACnB,KAAK,UAAU,EAChB,MAAM,8BAA8B,CAAC;AAOtC,OAAO,EAAyC,KAAK,aAAa,EAAE,MAAM,cAAc,CAAC;AAQzF,MAAM,WAAW,sBAAsB;IACrC,gEAAgE;IAChE,WAAW,EAAE,MAAM,CAAC;IACpB,2EAA2E;IAC3E,QAAQ,EAAE,UAAU,CAAC;CACtB;AAED;;;;;GAKG;AACH,MAAM,MAAM,iBAAiB,GACzB;IAAE,IAAI,EAAE,IAAI,CAAC;IAAC,MAAM,EAAE,QAAQ,CAAC;IAAC,MAAM,EAAE,aAAa,GAAG,UAAU,CAAA;CAAE,GACpE;IAAE,IAAI,EAAE,WAAW,CAAA;CAAE,GACrB;IAAE,IAAI,EAAE,eAAe,CAAC;IAAC,KAAK,EAAE,MAAM,EAAE,CAAA;CAAE,GAC1C;IACE,IAAI,EAAE,gBAAgB,CAAC;IACvB,KAAK,EAAE,MAAM,CAAC;IACd,MAAM,EAAE,KAAK,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,QAAQ,EAAE,mBAAmB,GAAG,IAAI,CAAA;KAAE,CAAC,CAAC;IACtE,QAAQ,EAAE,KAAK,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,QAAQ,EAAE,mBAAmB,GAAG,IAAI,CAAA;KAAE,CAAC,CAAC;CACzE,CAAC;AAEN,0DAA0D;AAC1D,MAAM,WAAW,mBAAmB;IAClC,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,EAAE,MAAM,CAAC;CAClB;AAED,qBAAa,eAAgB,YAAW,UAAU;IAChD,QAAQ,CAAC,YAAY,EAAE,sBAAsB,CAG3C;IAEF,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAS;IACrC,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAa;IACtC,OAAO,CAAC,WAAW,CAAmC;IACtD;oEACgE;IAChE,OAAO,CAAC,gBAAgB,CAA6B;IACrD,OAAO,CAAC,UAAU,CAAwB;IAC1C,OAAO,CAAC,MAAM,CAAS;IACvB,OAAO,CAAC,OAAO,CAA6B;gBAEhC,OAAO,EAAE,sBAAsB;IAK3C;;;;;OAKG;IACG,OAAO,IAAI,OAAO,CAAC;QAAE,OAAO,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,cAAc,EAAE,CAAA;KAAE,CAAC;IAkBvE;;;;;;;OAOG;IACH,SAAS,CAAC,QAAQ,EAAE,aAAa,GAAG,MAAM,IAAI;IAU9C,yDAAyD;IACnD,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC;IAO5B,OAAO,CAAC,aAAa;IAYrB,kEAAkE;IAClE,SAAS,IAAI,SAAS,cAAc,EAAE;IAIhC,IAAI,IAAI,OAAO,CAAC,eAAe,EAAE,CAAC;IAKlC,GAAG,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,eAAe,GAAG,SAAS,CAAC;IAMrD,SAAS,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,QAAQ,GAAG,SAAS,CAAC;IAK1D;;;;;OAKG;IACG,WAAW,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,iBAAiB,CAAC;YA0D3C,YAAY;CAK3B"}
+{"version":3,"file":"local-registry.d.ts","sourceRoot":"","sources":["../../src/local-registry/local-registry.ts"],"names":[],"mappings":"AAkCA,OAAO,KAAK,EACV,QAAQ,EACR,eAAe,EACf,UAAU,EACV,sBAAsB,EACvB,MAAM,sBAAsB,CAAC;AAC9B,OAAO,EAGL,KAAK,cAAc,EACnB,KAAK,UAAU,EAChB,MAAM,8BAA8B,CAAC;AAOtC,OAAO,EAAyC,KAAK,aAAa,EAAE,MAAM,cAAc,CAAC;AAQzF,MAAM,WAAW,sBAAsB;IACrC,gEAAgE;IAChE,WAAW,EAAE,MAAM,CAAC;IACpB,2EAA2E;IAC3E,QAAQ,EAAE,UAAU,CAAC;CACtB;AAED;;;;;GAKG;AACH,MAAM,MAAM,iBAAiB,GACzB;IAAE,IAAI,EAAE,IAAI,CAAC;IAAC,MAAM,EAAE,QAAQ,CAAC;IAAC,MAAM,EAAE,aAAa,GAAG,UAAU,CAAA;CAAE,GACpE;IAAE,IAAI,EAAE,WAAW,CAAA;CAAE,GACrB;IAAE,IAAI,EAAE,eAAe,CAAC;IAAC,KAAK,EAAE,MAAM,EAAE,CAAA;CAAE,GAC1C;IACE,IAAI,EAAE,gBAAgB,CAAC;IACvB,KAAK,EAAE,MAAM,CAAC;IACd,MAAM,EAAE,KAAK,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,QAAQ,EAAE,mBAAmB,GAAG,IAAI,CAAA;KAAE,CAAC,CAAC;IACtE,QAAQ,EAAE,KAAK,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,QAAQ,EAAE,mBAAmB,GAAG,IAAI,CAAA;KAAE,CAAC,CAAC;CACzE,CAAC;AAEN,0DAA0D;AAC1D,MAAM,WAAW,mBAAmB;IAClC,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,EAAE,MAAM,CAAC;CAClB;AAED,qBAAa,eAAgB,YAAW,UAAU;IAChD,QAAQ,CAAC,YAAY,EAAE,sBAAsB,CAE3C;IAEF,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAS;IACrC,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAa;IACtC,OAAO,CAAC,WAAW,CAAmC;IACtD;oEACgE;IAChE,OAAO,CAAC,gBAAgB,CAA6B;IACrD,OAAO,CAAC,UAAU,CAAwB;IAC1C,OAAO,CAAC,MAAM,CAAS;IACvB,OAAO,CAAC,OAAO,CAA6B;gBAEhC,OAAO,EAAE,sBAAsB;IAK3C;;;;;OAKG;IACG,OAAO,IAAI,OAAO,CAAC;QAAE,OAAO,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,cAAc,EAAE,CAAA;KAAE,CAAC;IAkBvE;;;;;;;OAOG;IACH,SAAS,CAAC,QAAQ,EAAE,aAAa,GAAG,MAAM,IAAI;IAU9C,yDAAyD;IACnD,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC;IAO5B,OAAO,CAAC,aAAa;IAYrB,kEAAkE;IAClE,SAAS,IAAI,SAAS,cAAc,EAAE;IAIhC,IAAI,IAAI,OAAO,CAAC,eAAe,EAAE,CAAC;IAKlC,GAAG,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,eAAe,GAAG,SAAS,CAAC;IAMrD,SAAS,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,QAAQ,GAAG,SAAS,CAAC;IAK1D;;;;;OAKG;IACG,WAAW,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,iBAAiB,CAAC;YA0D3C,YAAY;CAK3B"}

package/dist/local-registry/local-registry.js

@@ -4,13 +4,12 @@
  *
  * Scope (compile-on-demand slice, 2026-04-18):
  *
- *   - Read-only. `capabilities.writable === false`;
- *     `capabilities.observable === false`.
+ *   - Read-only — the `UiRegistry` contract has no write arm;
+ *     `capabilities.observable === true` (watcher-backed).
  *   - Manifest-backed. Discovery runs against `ggui.json` +
  *     `blueprints.include` globs via `./discovery.js` and is
  *     cached in memory. `refresh()` re-runs discovery on demand;
- *     file watching / `subscribe()` lands with a follow-up
- *     HMR slice.
+ *     `subscribe()` is watcher-backed (see `./watcher.ts`).
  *   - `getBundle(id)` resolution order:
  *       1. **Precompiled fast-path** — colocated `ggui.ui.js` or
  *          `ggui.ui.mjs` beside the manifest. Lets a project with
@@ -42,7 +41,6 @@ const BUNDLE_FILENAMES = ['ggui.ui.js', 'ggui.ui.mjs'];
 const BUNDLE_CONTENT_TYPE = 'application/javascript+react';
 export class LocalUiRegistry {
     capabilities = {
-        writable: false,
         observable: true,
     };
     projectRoot;

package/dist/local-registry/watcher.d.ts

@@ -2,8 +2,8 @@ import type { UiRegistryEvent } from '@ggui-ai/ui-registry';
 /**
  * Listener for raw events the watcher emits. Delivery is
  * at-least-once — consumers dedupe where needed (e.g. the SSE
- * handler just forwards; Studio's subscription logic bumps a
- * counter and doesn't care about dupes).
+ * handler just forwards; a subscribing UI bumps a counter and
+ * doesn't care about dupes).
  */
 export type WatchListener = (event: UiRegistryEvent) => void;
 export interface LocalWatcherOptions {

package/dist/local-registry/watcher.js

@@ -3,7 +3,7 @@
  *
  * Maps raw chokidar events to the contract's `UiRegistryEvent`
  * union (`added` / `changed` / `removed`). The watcher is scoped
- * to what actually affects what Studio can see:
+ * to what actually affects what a registry consumer can see:
  *
  *   - Any `ggui.ui.json` under the project tree → affects the
  *     manifest itself. A new one means `added`, a deletion

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ggui-ai/dev-stack",
-  "version": "0.2.0-alpha.3",
+  "version": "0.3.0-rc.0",
   "description": "Shared local dev engine for the ggui protocol: local UI registry discovery, compile-on-demand, filesystem watcher with SSE, and a read-only HTTP surface for dev tooling. Framework-neutral — agent runtime supervision plugs in via an adapter seam, so no agent SDK is hardcoded.",
   "keywords": [
     "ggui",
@@ -28,10 +28,9 @@
   "dependencies": {
     "chokidar": "^4.0.3",
     "esbuild": "^0.25.12",
-    "tinyglobby": "^0.2.16",
-    "@ggui-ai/agent-runtime": "0.2.0-alpha.3",
-    "@ggui-ai/ui-registry": "0.2.0-alpha.3",
-    "@ggui-ai/project-config": "0.2.0-alpha.3"
+    "@ggui-ai/agent-runtime": "0.3.0-rc.0",
+    "@ggui-ai/project-config": "0.3.0-rc.0",
+    "@ggui-ai/ui-registry": "0.3.0-rc.0"
   },
   "devDependencies": {
     "@types/node": "^24.0.0",
@@ -41,9 +40,9 @@
     "react-dom": "^19.0.0",
     "typescript": "^5.0.0",
     "vitest": "^3.0.0",
-    "@ggui-ai/design": "0.2.0-alpha.3",
-    "@ggui-ai/react": "0.2.0-alpha.3",
-    "@ggui-ai/wire": "0.2.0-alpha.3"
+    "@ggui-ai/design": "0.3.0-rc.0",
+    "@ggui-ai/react": "0.3.0-rc.0",
+    "@ggui-ai/wire": "0.3.0-rc.0"
   },
   "repository": {
     "type": "git",
@@ -62,7 +61,7 @@
   },
   "author": "ggui contributors <hello@ggui.ai>",
   "scripts": {
-    "build": "tsc -p tsconfig.build.json && node scripts/build-hub-preview.mjs",
+    "build": "rm -rf dist && tsc -p tsconfig.build.json && node scripts/build-hub-preview.mjs",
     "build:hub-preview": "node scripts/build-hub-preview.mjs",
     "dev": "tsc --watch",
     "typecheck": "tsc --noEmit && tsc -p hub-preview-client/tsconfig.json --noEmit",

package/dist/dev-server/sandbox-proxy.d.ts

@@ -1,46 +0,0 @@
-/**
- * Options for {@link startSandboxProxyServer}.
- */
-export interface SandboxProxyServerOptions {
-    /**
-     * Port to bind. `0` asks the OS for a free port — the chosen port
-     * is reflected in the returned `url`. Tests pass `0`; samples pass
-     * a fixed port so the AppRenderer config is static.
-     */
-    readonly port: number;
-    /**
-     * Bind address. Defaults to `127.0.0.1` — loopback-only. Pass
-     * `'0.0.0.0'` only if LAN access is required.
-     */
-    readonly host?: string;
-}
-/**
- * Handle to a running sandbox proxy server.
- */
-export interface SandboxProxyServerHandle {
-    /**
-     * Absolute URL the AppRenderer's `sandbox.url` prop should point at.
-     * Includes scheme, host, and port. Path is `/sandbox.html` — the
-     * spec-canonical sandbox entry point.
-     */
-    readonly url: string;
-    /** Actual bound port (resolved when `options.port` was `0`). */
-    readonly port: number;
-    /** Stops the server and releases the port. */
-    readonly close: () => Promise<void>;
-}
-/**
- * Start an HTTP server serving `sandbox.html` for use as
- * `<AppRenderer>`'s `sandbox.url`. The server has exactly two
- * behaviors:
- *
- *   - `GET /` and `GET /sandbox.html` → sandbox HTML + CSP header
- *     derived from `?csp=<urlencoded-json>` (mirrors upstream
- *     basic-host serve.ts).
- *   - Anything else → 404.
- *
- * Returns immediately once the server is listening; the handle's
- * `close()` releases the port.
- */
-export declare function startSandboxProxyServer(options: SandboxProxyServerOptions): Promise<SandboxProxyServerHandle>;
-//# sourceMappingURL=sandbox-proxy.d.ts.map

package/dist/dev-server/sandbox-proxy.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"sandbox-proxy.d.ts","sourceRoot":"","sources":["../../src/dev-server/sandbox-proxy.ts"],"names":[],"mappings":"AAoDA;;GAEG;AACH,MAAM,WAAW,yBAAyB;IACxC;;;;OAIG;IACH,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB;;;OAGG;IACH,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC;CACxB;AAED;;GAEG;AACH,MAAM,WAAW,wBAAwB;IACvC;;;;OAIG;IACH,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,gEAAgE;IAChE,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,8CAA8C;IAC9C,QAAQ,CAAC,KAAK,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC;CACrC;AAuKD;;;;;;;;;;;;GAYG;AACH,wBAAgB,uBAAuB,CACrC,OAAO,EAAE,yBAAyB,GACjC,OAAO,CAAC,wBAAwB,CAAC,CAuEnC"}

package/dist/dev-server/sandbox-proxy.js

@@ -1,270 +0,0 @@
-/**
- * `startSandboxProxyServer` — MCP-Apps spec-compliant sandbox proxy host
- * for `<AppRenderer>`.
- *
- * # Why this exists
- *
- * The MCP Apps spec (specification/2026-01-26/apps.mdx, double-iframe
- * sandbox architecture) mandates that the host and the sandbox iframe
- * live on DIFFERENT origins. The host wraps the sandbox iframe; the
- * sandbox iframe wraps the untrusted app HTML. Separating origins
- * means a compromise of the app cannot reach host APIs via
- * same-origin DOM access.
- *
- * `@mcp-ui/client`'s `<AppRenderer>` accepts a `sandbox: { url }` prop
- * pointing at a public URL serving `sandbox.html`. We ship that file +
- * its message-relay JS as a self-contained HTML string and serve it
- * over plain Node `http` on a separate port. Samples (and any consumer
- * of the dev-stack) boot this alongside their agent server.
- *
- * # Reference impl
- *
- * Adapted from
- * `github.com/modelcontextprotocol/ext-apps/examples/basic-host/`
- * (sandbox.html + src/sandbox.ts + serve.ts). Inlined into a single
- * HTML so the dev-stack doesn't need to bundle a static asset.
- *
- * # Security
- *
- *   - CSP set via HTTP headers per `?csp=<urlencoded-json>` query
- *     (tamper-proof; meta tags can be overridden by inline scripts).
- *   - Sanitizes CSP domain entries to block `;`, newlines, quotes,
- *     spaces — defends against directive injection.
- *   - Binds to `127.0.0.1` by default. Pass `host: '0.0.0.0'` only
- *     when LAN exposure is required.
- *
- * # Caller pattern
- *
- * ```ts
- * import { startSandboxProxyServer } from '@ggui-ai/dev-stack';
- * const proxy = await startSandboxProxyServer({ port: 7790 });
- * console.log('Sandbox proxy:', proxy.url);
- * // ... pass proxy.url to AppRenderer's sandbox.url prop ...
- * await proxy.close();
- * ```
- */
-import { createServer, } from 'node:http';
-/**
- * Reject CSP entries containing directive-injection characters
- * (`;`, newlines, quotes, spaces). Returns the kept entries.
- */
-function sanitizeCspDomains(domains) {
-    if (!domains)
-        return [];
-    return domains.filter((d) => typeof d === 'string' && !/[;\r\n'" ]/.test(d));
-}
-/**
- * Build the `Content-Security-Policy` header value from an
- * (already-sanitized) CSP record. Mirrors `serve.ts` in the upstream
- * basic-host example so behavior matches the spec reference.
- */
-function buildCspHeader(csp) {
-    const resourceDomains = sanitizeCspDomains(csp?.resourceDomains).join(' ');
-    const connectDomains = sanitizeCspDomains(csp?.connectDomains).join(' ');
-    const frameDomains = sanitizeCspDomains(csp?.frameDomains).join(' ');
-    const baseUriDomains = sanitizeCspDomains(csp?.baseUriDomains).join(' ');
-    const directives = [
-        "default-src 'self' 'unsafe-inline'",
-        `script-src 'self' 'unsafe-inline' 'unsafe-eval' blob: data: ${resourceDomains}`.trim(),
-        `style-src 'self' 'unsafe-inline' blob: data: ${resourceDomains}`.trim(),
-        `img-src 'self' data: blob: ${resourceDomains}`.trim(),
-        `font-src 'self' data: blob: ${resourceDomains}`.trim(),
-        `media-src 'self' data: blob: ${resourceDomains}`.trim(),
-        `connect-src 'self' ${connectDomains}`.trim(),
-        `worker-src 'self' blob: ${resourceDomains}`.trim(),
-        frameDomains.length > 0
-            ? `frame-src ${frameDomains}`
-            : "frame-src 'none'",
-        "object-src 'none'",
-        baseUriDomains.length > 0
-            ? `base-uri ${baseUriDomains}`
-            : "base-uri 'none'",
-    ];
-    return directives.join('; ');
-}
-/**
- * The self-contained sandbox.html body. Inlines the message-relay JS
- * from `examples/basic-host/src/sandbox.ts` so we ship one file and
- * don't need a build step. The script is a verbatim port that:
- *
- *   1. Asserts iframe isolation (throws if it can reach `window.top`).
- *   2. Creates an inner iframe sandboxed with `allow-scripts
- *      allow-same-origin allow-forms`.
- *   3. Intercepts `ui/notifications/sandbox-resource-ready` from the
- *      parent to write the app HTML into the inner iframe.
- *   4. Relays every other postMessage bidirectionally between parent
- *      and inner.
- *   5. Posts `ui/notifications/sandbox-proxy-ready` once attached.
- */
-const SANDBOX_HTML = `<!doctype html>
-<html>
-  <head>
-    <meta charset="utf-8" />
-    <meta name="color-scheme" content="light dark">
-    <title>ggui sandbox proxy</title>
-    <style>
-      html, body { margin: 0; height: 100vh; width: 100vw; background-color: transparent; }
-      body { display: flex; flex-direction: column; }
-      * { box-sizing: border-box; }
-      iframe {
-        background-color: transparent;
-        border: 0px none transparent;
-        padding: 0px;
-        overflow: hidden;
-        flex-grow: 1;
-        color-scheme: inherit;
-      }
-    </style>
-  </head>
-  <body>
-    <script>
-(function(){
-  'use strict';
-  if (window.self === window.top) {
-    throw new Error('This file is only to be used in an iframe sandbox.');
-  }
-  if (!document.referrer) {
-    throw new Error('No referrer, cannot validate embedding site.');
-  }
-  var EXPECTED_HOST_ORIGIN = new URL(document.referrer).origin;
-  var OWN_ORIGIN = new URL(window.location.href).origin;
-  // Security self-test: top access MUST throw (sandbox attribute strips same-origin).
-  try {
-    window.top.alert('If you see this, the sandbox is not setup securely.');
-    throw 'FAIL';
-  } catch (e) {
-    if (e === 'FAIL') {
-      throw new Error('The sandbox is not setup securely.');
-    }
-  }
-  // Inner iframe — the untrusted app HTML lands here.
-  var inner = document.createElement('iframe');
-  inner.style = 'width:100%; height:100%; border:none;';
-  inner.setAttribute('sandbox', 'allow-scripts allow-same-origin allow-forms');
-  document.body.appendChild(inner);
-  var RESOURCE_READY = 'ui/notifications/sandbox-resource-ready';
-  var PROXY_READY = 'ui/notifications/sandbox-proxy-ready';
-  window.addEventListener('message', function(event) {
-    if (event.source === window.parent) {
-      if (event.origin !== EXPECTED_HOST_ORIGIN) {
-        console.error('[Sandbox] Rejecting parent message from unexpected origin:', event.origin);
-        return;
-      }
-      if (event.data && event.data.method === RESOURCE_READY) {
-        var params = event.data.params || {};
-        var html = params.html;
-        var sandboxAttr = params.sandbox;
-        if (typeof sandboxAttr === 'string') {
-          inner.setAttribute('sandbox', sandboxAttr);
-        }
-        if (typeof html === 'string') {
-          var doc = inner.contentDocument || (inner.contentWindow && inner.contentWindow.document);
-          if (doc) {
-            doc.open();
-            doc.write(html);
-            doc.close();
-          } else {
-            inner.srcdoc = html;
-          }
-        }
-      } else {
-        if (inner && inner.contentWindow) {
-          inner.contentWindow.postMessage(event.data, '*');
-        }
-      }
-    } else if (event.source === inner.contentWindow) {
-      if (event.origin !== OWN_ORIGIN) {
-        console.error('[Sandbox] Rejecting inner message from unexpected origin:', event.origin);
-        return;
-      }
-      window.parent.postMessage(event.data, EXPECTED_HOST_ORIGIN);
-    }
-  });
-  window.parent.postMessage({
-    jsonrpc: '2.0',
-    method: PROXY_READY,
-    params: {},
-  }, EXPECTED_HOST_ORIGIN);
-})();
-    </script>
-  </body>
-</html>`;
-/**
- * Start an HTTP server serving `sandbox.html` for use as
- * `<AppRenderer>`'s `sandbox.url`. The server has exactly two
- * behaviors:
- *
- *   - `GET /` and `GET /sandbox.html` → sandbox HTML + CSP header
- *     derived from `?csp=<urlencoded-json>` (mirrors upstream
- *     basic-host serve.ts).
- *   - Anything else → 404.
- *
- * Returns immediately once the server is listening; the handle's
- * `close()` releases the port.
- */
-export function startSandboxProxyServer(options) {
-    const host = options.host ?? '127.0.0.1';
-    const server = createServer((req, res) => {
-        // Resolve URL relative to a synthetic base so we can use
-        // URL parsing (req.url is path+query only).
-        const url = new URL(req.url ?? '/', 'http://placeholder');
-        if (req.method === 'GET' &&
-            (url.pathname === '/' || url.pathname === '/sandbox.html')) {
-            let csp;
-            const cspParam = url.searchParams.get('csp');
-            if (cspParam !== null) {
-                try {
-                    const parsed = JSON.parse(cspParam);
-                    if (parsed !== null && typeof parsed === 'object') {
-                        csp = parsed;
-                    }
-                }
-                catch {
-                    // Ignore malformed CSP — fall through to the default
-                    // (`'self' 'unsafe-inline'`) header. Visible in the
-                    // browser's console as a CSP violation if the app loads
-                    // external resources.
-                }
-            }
-            res.setHeader('Content-Security-Policy', buildCspHeader(csp));
-            res.setHeader('Cache-Control', 'no-cache, no-store, must-revalidate');
-            res.setHeader('Pragma', 'no-cache');
-            res.setHeader('Expires', '0');
-            res.setHeader('Content-Type', 'text/html; charset=utf-8');
-            // CORS: AppRenderer fetches the sandbox HTML cross-origin
-            // (parent vs. sandbox-proxy origin); the browser still
-            // navigates the iframe even without explicit CORS, but the
-            // header is harmless and unblocks any future fetch() probes.
-            res.setHeader('Access-Control-Allow-Origin', '*');
-            res.statusCode = 200;
-            res.end(SANDBOX_HTML);
-            return;
-        }
-        res.statusCode = 404;
-        res.setHeader('Content-Type', 'text/plain; charset=utf-8');
-        res.end('sandbox proxy: only GET /sandbox.html is served here\n');
-    });
-    return new Promise((resolve, reject) => {
-        server.once('error', reject);
-        server.listen(options.port, host, () => {
-            const addr = server.address();
-            if (addr === null || typeof addr === 'string') {
-                reject(new Error(`startSandboxProxyServer: address() returned ${String(addr)}; expected AddressInfo`));
-                return;
-            }
-            const url = `http://${host}:${addr.port}/sandbox.html`;
-            resolve({
-                url,
-                port: addr.port,
-                close: () => new Promise((resolveClose, rejectClose) => {
-                    server.close((err) => {
-                        if (err)
-                            rejectClose(err);
-                        else
-                            resolveClose();
-                    });
-                }),
-            });
-        });
-    });
-}