@ggui-ai/iframe-runtime 0.1.0-rc.1

package/dist/context-observer.js

@@ -0,0 +1,312 @@
+import { DEFAULT_CONTEXT_DEBOUNCE_MS } from '@ggui-ai/protocol';
+import { validateContextValue } from './validation.js';
+/**
+ * Module-level map keyed by `name` (the camelCase slot key, NOT the
+ * PascalCase contextName) tracking the most-recently-emitted value
+ * per slot. Used by the reconnect re-emission path so a new mount
+ * after WS reopen seeds the LLM context with the last-known values.
+ *
+ * Exported for unit tests.
+ */
+export const contextSlotLastValues = new Map();
+/**
+ * Ensure a React Context is registered for `slot.contextName`. Idempotent —
+ * an entry already in the registry is REUSED (the LLM's destructured
+ * Context reference must remain stable across re-mounts). Only the
+ * absent case calls `react.createContext`.
+ *
+ * The Context value shape is `readonly [value, setter]` — same as
+ * `useState`, so the user-component's `useGguiContext` hook reads it
+ * via plain `useContext`. The setter stored at registration time is a
+ * no-op placeholder — each {@link SingleSlotProvider} mount overwrites
+ * it via the Provider's `value` prop.
+ *
+ * Returns the resolved slot with the live Context reference attached.
+ */
+export function ensureContext(registry, reactMod, slot) {
+    // The registry is typed as `Context<unknown>` at the boundary
+    // (open-ended — different slots have different value types). When
+    // we read OR create, the runtime invariant is that every entry is
+    // a `Context<readonly [unknown, (next: unknown) => void]>`.
+    const existing = registry[slot.contextName];
+    let contextRef;
+    if (existing !== undefined) {
+        contextRef = existing;
+    }
+    else {
+        contextRef = reactMod.createContext([slot.default, () => { }]);
+        contextRef.displayName = slot.contextName;
+        registry[slot.contextName] = contextRef;
+    }
+    return {
+        name: slot.name,
+        contextName: slot.contextName,
+        schema: slot.schema,
+        debounceMs: slot.debounceMs ?? DEFAULT_CONTEXT_DEBOUNCE_MS,
+        default: slot.default,
+        contextRef,
+    };
+}
+/**
+ * Install React Context objects for every entry in `slots` into
+ * `registry`. Returns the resolved slot list so callers can mount one
+ * SingleSlotProvider per entry. Idempotent — slots whose `contextName`
+ * is already in the registry reuse the existing Context.
+ */
+export function installContextRegistry(registry, reactMod, slots) {
+    const resolved = [];
+    for (const slot of slots) {
+        resolved.push(ensureContext(registry, reactMod, slot));
+        // Pre-seed the shared snapshot map with each slot's default
+        // value at boot. Snapshot posts (REPLACE semantics) need every
+        // declared slot present from the very first post; if a Provider's
+        // initial useEffect happens before another's, the early post would
+        // otherwise omit the un-fired slot and the host would track it as
+        // missing. Pre-seeding closes that race.
+        contextSlotLastValues.set(slot.name, slot.default);
+    }
+    return resolved;
+}
+/**
+ * Build a ContextSpec from the resolved slot list. Used internally by
+ * the SingleSlotProvider to validate values before posting
+ * ({@link validateContextValue} expects a ContextSpec; we hold
+ * resolved slots, so re-derive the spec shape on demand).
+ */
+function specFor(slot) {
+    return { [slot.name]: { schema: slot.schema } };
+}
+/**
+ * Post a context snapshot to BOTH destinations:
+ *   1. `ui/update-model-context` to the parent host (claude.ai et al)
+ *      — the existing path; agent's LLM reads these via
+ *      `read_widget_context` for in-turn awareness.
+ *   2. `tools/call` for `ggui_runtime_sync_context` — the server mirror.
+ *      Server stores the snapshot on the active StackItem; chat-
+ *      history rehydrate seeds `contextSlots[i].default` with the
+ *      snapshotted values, restoring the user's last-known state.
+ *
+ * Both posts are postMessage to the parent — fire-and-forget,
+ * non-blocking, naturally concurrent (queued back-to-back to the
+ * postMessage channel; the host receives them in order without
+ * blocking either delivery on the other). No explicit `Promise.all`
+ * is needed: postMessage isn't a promise-returning API; both calls
+ * return synchronously and the channel handles the ordering. This
+ * is the right primitive for a snapshot mirror — neither destination
+ * needs to wait for the other to ACK.
+ *
+ * Snapshot replaces an earlier per-slot delta format
+ * (`[ggui:context-slot] {slot,value}`). Empirical: claude.ai's host
+ * treats each `ui/update-model-context` post as a REPLACE of the
+ * widget's tracked context, not a per-slot merge. Server mirror
+ * matches: REPLACE-per-(sessionId, stackItemId), last-write-wins.
+ * Both destinations therefore stay structurally consistent.
+ *
+ * Server-mirror skipped when `identity` is undefined — dev/test code
+ * paths that don't supply a real bootstrap shouldn't pollute the
+ * server's store with synthetic ids.
+ */
+function postContextSnapshot(postToParent, snapshot, identity) {
+    // Destination 1: host. Always fires.
+    const text = `[ggui:context] ${JSON.stringify(snapshot)}`;
+    postToParent({
+        jsonrpc: '2.0',
+        id: Math.floor(Math.random() * 1e9),
+        method: 'ui/update-model-context',
+        params: {
+            content: [
+                {
+                    type: 'text',
+                    text,
+                },
+            ],
+        },
+    });
+    // Destination 2: server mirror. Skipped when identity is absent
+    // (dev / test paths without a real bootstrap). Both destinations
+    // are postMessage — the channel queues these back-to-back, no
+    // sequential dependency between them.
+    if (identity) {
+        postToParent({
+            jsonrpc: '2.0',
+            id: Math.floor(Math.random() * 1e9),
+            method: 'tools/call',
+            params: {
+                name: 'ggui_runtime_sync_context',
+                arguments: {
+                    sessionId: identity.sessionId,
+                    appId: identity.appId,
+                    stackItemId: identity.stackItemId,
+                    snapshot,
+                },
+            },
+        });
+    }
+}
+/**
+ * Build a snapshot object from the shared `contextSlotLastValues` map.
+ * Each post sees the full current state of every slot the runtime is
+ * tracking — including slots whose Providers haven't yet fired their
+ * initial `useEffect` (those entries come from the boot-time pre-seed
+ * in {@link installContextRegistry}).
+ */
+function buildSnapshot() {
+    const out = {};
+    for (const [slotName, value] of contextSlotLastValues) {
+        out[slotName] = value;
+    }
+    return out;
+}
+/**
+ * Build the `<SingleSlotProvider>` React component — owns one slot's
+ * useState + observer + Provider wrap. The runtime composes one of
+ * these per declared slot (via {@link createContextStateHost}).
+ *
+ * Built as a factory so the runtime can pass dependencies (`react`,
+ * `postToParent`, `consoleWarn`) without re-importing in this module
+ * — keeps the file pure and unit-testable.
+ *
+ * Exported because `__tests__/context-observer.test.ts` mounts it
+ * standalone to verify the value→post→Provider cycle.
+ */
+export function createSingleSlotProvider(deps) {
+    const { react, postToParent, consoleWarn, identity } = deps;
+    const SingleSlotProvider = (props) => {
+        const { slot, children } = props;
+        // Slot-owned state. Re-mounts re-seed from `slot.default` because
+        // a fresh useState begins at the seed; cross-mount state survival
+        // is NOT a contextSpec promise (the agent owns durable state via
+        // propsSpec / streamSpec — contextSpec is an ephemeral
+        // client-side reflection).
+        const [value, setValue] = react.useState(slot.default);
+        // Debounced post-on-change. The timer ref keeps a fluttering
+        // value (multiple changes inside the debounce window) coalesced
+        // to a single post.
+        const timerRef = react.useRef(null);
+        react.useEffect(() => {
+            if (timerRef.current !== null) {
+                clearTimeout(timerRef.current);
+                timerRef.current = null;
+            }
+            const post = () => {
+                // Validate against the slot's schema. Per Q4 design lock:
+                // dev `console.warn` + silent drop on mismatch.
+                const validation = validateContextValue(specFor(slot), slot.name, value);
+                if (!validation.valid) {
+                    if (consoleWarn !== undefined) {
+                        consoleWarn(`[ggui:context] slot '${slot.name}' value rejected:`, validation.violations);
+                    }
+                    return;
+                }
+                // Write to the shared map first, then post the FULL
+                // snapshot. Snapshot semantics give the host a complete +
+                // internally-consistent state at every post (claude.ai
+                // treats `ui/update-model-context` as REPLACE, so deltas
+                // wiped the un-mentioned slots).
+                contextSlotLastValues.set(slot.name, value);
+                postContextSnapshot(postToParent, buildSnapshot(), identity);
+            };
+            if (slot.debounceMs <= 0) {
+                // Immediate path — tests + step / tab switches use this.
+                post();
+            }
+            else {
+                timerRef.current = setTimeout(post, slot.debounceMs);
+            }
+            return () => {
+                if (timerRef.current !== null) {
+                    clearTimeout(timerRef.current);
+                    timerRef.current = null;
+                }
+            };
+        }, 
+        // `value` drives. `slot.name`/`slot.debounceMs` are stable across
+        // a slot's lifetime; listing them keeps exhaustive-deps quiet.
+        [value, slot.name, slot.debounceMs, slot.schema]);
+        // Provider passes the LIVE `[value, setValue]` tuple — overrides
+        // the placeholder seed registered in `ensureContext`. The user
+        // component's `useGguiContext` reads this exact tuple.
+        return react.createElement(slot.contextRef.Provider, 
+        // The runtime invariant: every Context registered under
+        // `globalThis.__ggui__.contexts` is `Context<readonly [unknown,
+        // setter]>`. The value passed here matches that shape. We
+        // construct a tuple via `as const` semantics inline.
+        { value: [value, setValue] }, children);
+    };
+    return SingleSlotProvider;
+}
+/**
+ * Build the `ContextStateHost` component — composes
+ * {@link createSingleSlotProvider} once per declared slot to nest
+ * Providers around the user's component.
+ *
+ * The composed shape is:
+ *
+ * ```tsx
+ * <SingleSlotProvider slot={slots[0]}>
+ *   <SingleSlotProvider slot={slots[1]}>
+ *     {userComponent}
+ *   </SingleSlotProvider>
+ * </SingleSlotProvider>
+ * ```
+ *
+ * Outermost Provider = first declared slot. Order doesn't affect
+ * `useGguiContext` lookups (each Context is independent), but it's
+ * stable for snapshot debugging.
+ *
+ * When `slots` is empty, the host renders children unchanged (no
+ * extra wrapper).
+ */
+export function createContextStateHost(deps) {
+    const SingleSlotProvider = createSingleSlotProvider(deps);
+    const ContextStateHost = (props) => {
+        const { slots, children } = props;
+        if (slots.length === 0) {
+            // Render children inside a no-op Fragment so the return type is
+            // ReactElement uniformly (children is ReactNode).
+            return deps.react.createElement(deps.react.Fragment, null, children);
+        }
+        // Compose right-to-left so slots[0] is the outermost Provider.
+        return slots.reduceRight((inner, slot) => deps.react.createElement(SingleSlotProvider, { key: slot.contextName, slot }, inner), 
+        // Initial accumulator must be a ReactElement so reduceRight's
+        // generic resolves; wrap children in a Fragment.
+        deps.react.createElement(deps.react.Fragment, null, children));
+    };
+    return ContextStateHost;
+}
+/**
+ * Walk {@link contextSlotLastValues} and re-post each entry to the
+ * parent, filtered to slot names that the new mount actually
+ * declares. Used by the re-mount path — when a fresh boot completes
+ * after the previous mount torn down, re-seed the LLM context with
+ * the LAST values from the previous mount.
+ *
+ * Filter behavior. An earlier version walked the whole map without
+ * filtering, which leaked stale values across contracts: a re-mount
+ * with a different `contextSpec` (different slot names) re-emitted
+ * entries the new contract didn't declare. The current signature takes
+ * the active slot names; entries whose key is NOT in the set get
+ * dropped from the map AND skipped on emit.
+ *
+ * Pass `undefined` to skip filtering (kept for tests that exercise the
+ * bare module). Runtime call sites pass the active slots so the leak
+ * path is closed by construction.
+ */
+export function reemitLastContextValues(postToParent, activeSlotNames, identity) {
+    if (activeSlotNames !== undefined) {
+        // Drain stale keys before re-emitting. Keep the map a faithful
+        // reflection of the active mount.
+        for (const key of Array.from(contextSlotLastValues.keys())) {
+            if (!activeSlotNames.has(key)) {
+                contextSlotLastValues.delete(key);
+            }
+        }
+    }
+    // Single snapshot post on reattach. An earlier version fired one
+    // delta per slot which then got REPLACE-wiped by the next-fired
+    // delta on the host side; the host ended up with only the
+    // LAST-fired slot. One snapshot delivers all slots atomically.
+    if (contextSlotLastValues.size > 0) {
+        postContextSnapshot(postToParent, buildSnapshot(), identity);
+    }
+}

package/dist/gadget-loader.d.ts

@@ -0,0 +1,118 @@
+/**
+ * `loadGadgetRegistry()` — composes the gadget-package registry the
+ * iframe runtime exposes to generated component code (GG.8.2 —
+ * per-package, not per-hook).
+ *
+ * The iframe-runtime's boot sequence calls this immediately before
+ * `installGlobalRegistry()` to compose the value that lands at
+ * `globalThis.__ggui__.gadgets`. The composition is:
+ *
+ *   - STDLIB seed: the whole `@ggui-ai/gadgets` module namespace
+ *     (pre-loaded so the 7 first-party browser-capability hooks
+ *     always work), stored under `registry['@ggui-ai/gadgets']`.
+ *   - PLUS one namespace per operator-registered package from the
+ *     bootstrap's `gadgets` field — dynamically imported here once per
+ *     package (target = `bundleUrl` if present else `package`) and
+ *     stored under the package-name key.
+ *
+ * Every export the package ships — hooks AND components — is reachable
+ * because the whole namespace is stored; the per-package data-URL shim
+ * the rewriter emits resolves `__ggui__.gadgets[package][export]`.
+ *
+ * When a registration carries `bundleSri` alongside `bundleUrl`, the
+ * loader routes through a `<link rel="modulepreload" integrity>` gate
+ * so the browser refuses execution on hash mismatch with the
+ * registry-served bytes. The integrity-less dynamic `import()` path is
+ * preserved for refs that don't publish bundles (in-tree packages,
+ * hand-authored ggui.json).
+ *
+ * Failure handling: a package that fails to load (network error,
+ * bad bundle, etc.) is logged and skipped — the rest of the registry
+ * still installs. The per-package shim's lazy thunks throw a clear
+ * "not loaded" error at call/render time instead of silently crashing
+ * inside React.
+ *
+ * STDLIB always wins: an operator-registered package named
+ * `@ggui-ai/gadgets` cannot shadow the STDLIB seed (defense-in-depth).
+ */
+import type { GadgetPackageRegistry, ModuleNamespace } from './globals.js';
+/**
+ * Minimal shape consumed by the loader — mirrors the protocol's
+ * `GguiBootstrapMeta.gadgets[*]` entry but typed locally so the loader
+ * is testable without dragging the protocol package into unit setups.
+ */
+export interface GadgetRegistration {
+    /** Bare npm package name — the registry key the loaded module
+     * namespace is stored under, and the bare-specifier load source when
+     * `bundleUrl` is absent. */
+    readonly package: string;
+    /** ggui-hosted ESM bundle URL — preferred load source when present. */
+    readonly bundleUrl?: string;
+    /** `sha384-<base64>` subresource-integrity hash. When present
+     * alongside `bundleUrl`, the loader injects a `<link
+     * rel="modulepreload" integrity>` to enforce hash-match on the
+     * registry-served bytes before the subsequent dynamic `import()`
+     * resolves. Absent → fall back to integrity-less dynamic
+     * `import()`. */
+    readonly bundleSri?: string;
+}
+/**
+ * Injectable dynamic-importer — production passes
+ * `(target) => import(target)`; tests pass a fake that returns a
+ * canned module from a Map. Keeping it injectable lets the unit
+ * tests pin the merge / collision / failure semantics without
+ * touching the network.
+ */
+export type DynamicImporter = (target: string) => Promise<ModuleNamespace>;
+/**
+ * Injectable SRI-aware bundle loader. The production path
+ * (`defaultIntegrityLoader`) emits a `<link rel="modulepreload"
+ * integrity="<sri>" crossorigin="anonymous" href="<url>">` element,
+ * waits for the preload to settle (or fail on hash mismatch), then
+ * resolves the bundle via a normal dynamic `import(url)` — the
+ * `import` call reuses the cached preload bytes, so the integrity
+ * gate has already executed by the time the module instantiates.
+ *
+ * Why preload + import rather than `<script type="module" integrity>`:
+ * a plain `<script type="module">` runs the bundle's top-level but
+ * its exports are NOT exposed on `globalThis`. The bundle would have
+ * to plant exports on a global by side effect — a contract we'd have
+ * to invent and document. `link rel="modulepreload"` reuses the same
+ * SRI primitive while keeping the import surface a standard module.
+ *
+ * Import-map integrity (Chrome 127+, draft) is the long-term answer
+ * — when it lands universally, we can drop the preload step and
+ * declare integrity on the import map. Until then, preload + import
+ * is the cross-browser path.
+ *
+ * Tests inject a fake to assert the emitted element shape without a
+ * real DOM round-trip.
+ */
+export type IntegrityLoader = (args: {
+    readonly url: string;
+    readonly integrity: string;
+    /** Package name — used only in diagnostic messages. */
+    readonly name: string;
+}) => Promise<ModuleNamespace>;
+interface LoaderLogger {
+    warn(...args: unknown[]): void;
+}
+/**
+ * Compose the runtime `gadgets` registry — package name → that
+ * package's loaded module namespace (GG.8.2).
+ *
+ * @param stdlibModule   Pre-imported `@ggui-ai/gadgets` module
+ *                       namespace. Lands at
+ *                       `registry['@ggui-ai/gadgets']` unconditionally.
+ * @param registrations  Bootstrap's resolved package catalog (one
+ *                       entry per operator-registered 3rd-party
+ *                       package).
+ * @param opts.importer  Override dynamic-import for tests.
+ * @param opts.logger    Override logger sink for tests.
+ */
+export declare function loadGadgetRegistry(stdlibModule: ModuleNamespace, registrations: readonly GadgetRegistration[], opts?: {
+    readonly importer?: DynamicImporter;
+    readonly integrityLoader?: IntegrityLoader;
+    readonly logger?: LoaderLogger;
+}): Promise<GadgetPackageRegistry>;
+export {};

package/dist/gadget-loader.js

@@ -0,0 +1,136 @@
+/**
+ * `loadGadgetRegistry()` — composes the gadget-package registry the
+ * iframe runtime exposes to generated component code (GG.8.2 —
+ * per-package, not per-hook).
+ *
+ * The iframe-runtime's boot sequence calls this immediately before
+ * `installGlobalRegistry()` to compose the value that lands at
+ * `globalThis.__ggui__.gadgets`. The composition is:
+ *
+ *   - STDLIB seed: the whole `@ggui-ai/gadgets` module namespace
+ *     (pre-loaded so the 7 first-party browser-capability hooks
+ *     always work), stored under `registry['@ggui-ai/gadgets']`.
+ *   - PLUS one namespace per operator-registered package from the
+ *     bootstrap's `gadgets` field — dynamically imported here once per
+ *     package (target = `bundleUrl` if present else `package`) and
+ *     stored under the package-name key.
+ *
+ * Every export the package ships — hooks AND components — is reachable
+ * because the whole namespace is stored; the per-package data-URL shim
+ * the rewriter emits resolves `__ggui__.gadgets[package][export]`.
+ *
+ * When a registration carries `bundleSri` alongside `bundleUrl`, the
+ * loader routes through a `<link rel="modulepreload" integrity>` gate
+ * so the browser refuses execution on hash mismatch with the
+ * registry-served bytes. The integrity-less dynamic `import()` path is
+ * preserved for refs that don't publish bundles (in-tree packages,
+ * hand-authored ggui.json).
+ *
+ * Failure handling: a package that fails to load (network error,
+ * bad bundle, etc.) is logged and skipped — the rest of the registry
+ * still installs. The per-package shim's lazy thunks throw a clear
+ * "not loaded" error at call/render time instead of silently crashing
+ * inside React.
+ *
+ * STDLIB always wins: an operator-registered package named
+ * `@ggui-ai/gadgets` cannot shadow the STDLIB seed (defense-in-depth).
+ */
+const defaultImporter = (target) => import(/* @vite-ignore */ target);
+const defaultIntegrityLoader = ({ url, integrity, name, }) => {
+    return new Promise((resolve, reject) => {
+        if (typeof document === 'undefined') {
+            reject(new Error(`[gadgets] SRI loader requires a document; cannot load '${name}' from '${url}' in this runtime.`));
+            return;
+        }
+        const link = document.createElement('link');
+        link.rel = 'modulepreload';
+        link.href = url;
+        link.integrity = integrity;
+        // crossorigin is REQUIRED for SRI on cross-origin resources (the
+        // browser otherwise can't read the response body to hash it).
+        // Same-origin requests ignore the attribute, so setting it
+        // unconditionally is safe.
+        link.crossOrigin = 'anonymous';
+        link.addEventListener('load', () => {
+            // Preload succeeded (network + integrity both passed). Now
+            // import the module by URL — the browser dedups to the
+            // already-verified bytes. Any subsequent dynamic-import for
+            // the same URL also hits the cache.
+            import(/* @vite-ignore */ url).then((mod) => resolve(mod), (err) => reject(err instanceof Error
+                ? err
+                : new Error(`[gadgets] post-preload import failed for '${name}' from '${url}'`)));
+        }, { once: true });
+        link.addEventListener('error', () => {
+            reject(new Error(`[gadgets] integrity-load failed for '${name}' from '${url}' (likely SRI mismatch or network failure)`));
+        }, { once: true });
+        document.head.appendChild(link);
+    });
+};
+/**
+ * Compose the runtime `gadgets` registry — package name → that
+ * package's loaded module namespace (GG.8.2).
+ *
+ * @param stdlibModule   Pre-imported `@ggui-ai/gadgets` module
+ *                       namespace. Lands at
+ *                       `registry['@ggui-ai/gadgets']` unconditionally.
+ * @param registrations  Bootstrap's resolved package catalog (one
+ *                       entry per operator-registered 3rd-party
+ *                       package).
+ * @param opts.importer  Override dynamic-import for tests.
+ * @param opts.logger    Override logger sink for tests.
+ */
+export async function loadGadgetRegistry(stdlibModule, registrations, opts = {}) {
+    const importer = opts.importer ?? defaultImporter;
+    const integrityLoader = opts.integrityLoader ?? defaultIntegrityLoader;
+    const logger = opts.logger ?? console;
+    // Seed with the STDLIB package namespace under its package key. A
+    // plain mutable record we populate; the return narrows back to the
+    // readonly `GadgetPackageRegistry` shape.
+    const registry = {
+        '@ggui-ai/gadgets': stdlibModule,
+    };
+    for (const entry of registrations) {
+        if (entry.package in registry) {
+            // STDLIB wins; a later duplicate registration for an
+            // already-loaded package is also skipped (first wins).
+            continue;
+        }
+        const target = entry.bundleUrl ?? entry.package;
+        if (target.length === 0) {
+            logger.warn(`[gadgets] package '${entry.package}' has an empty load target — skipping.`);
+            continue;
+        }
+        // Registry-published bundles carry an SRI hash. Route through the
+        // `<link rel="modulepreload" integrity>` gate so the browser
+        // refuses execution on hash mismatch. Falls back to dynamic
+        // `import()` when SRI is absent (in-tree packages, hand-authored
+        // ggui.json refs).
+        //
+        // Local hoist to thread the narrowed `bundleUrl` + `bundleSri`
+        // through the loader call without re-narrowing inside the ternary
+        // (the loader signature wants concrete strings, not unions).
+        const sriUrl = entry.bundleUrl !== undefined &&
+            typeof entry.bundleSri === 'string' &&
+            entry.bundleSri.length > 0
+            ? { url: entry.bundleUrl, integrity: entry.bundleSri }
+            : undefined;
+        try {
+            const mod = sriUrl !== undefined
+                ? await integrityLoader({
+                    url: sriUrl.url,
+                    integrity: sriUrl.integrity,
+                    name: entry.package,
+                })
+                : await importer(target);
+            // Store the whole module namespace under the package key — both
+            // hook and component exports become reachable through it.
+            registry[entry.package] = mod;
+        }
+        catch (err) {
+            logger.warn(`[gadgets] Failed to load package '${entry.package}' from '${target}':`, err);
+            // Continue with other registrations — one broken package must
+            // not block the whole iframe from booting.
+        }
+    }
+    return registry;
+}