@ggui-ai/iframe-runtime 0.14.0 → 0.16.0

package/dist/channel-transport.d.ts

@@ -17,7 +17,7 @@
  *     router runs a setInterval that fires `tools/call` against
  *     the parent MCP host (direct, no bridge). Works
  *     for any tool the agent has access to, including third-party
- *     MCP servers the local pod can't subscribe-for.
+ *     MCP servers the local server can't subscribe for.
  *
  * The dispatch decision is per-channel + per-render (each new render
  * brings a potentially-new contract; we re-run the routing). The
@@ -52,7 +52,7 @@
  * un-routed channel posture pre-1c, where any payload that landed on the
  * data frame was treated as authoritative).
  */
-import type { JsonObject, JsonValue, StreamSpec } from '@ggui-ai/protocol';
+import type { JsonObject, JsonValue, StreamSpec } from '@ggui-ai/protocol/wire';
 import type { WebSocketMessage } from '@ggui-ai/protocol/transport/websocket';
 import type { ChannelPollDegradedEvent, ChannelPollRecoveredEvent, ChannelTransportFallbackEvent, ChannelTransportPickedEvent, ChannelTransportResubscribedEvent } from './observability.js';
 import type { StreamBus } from './wire-config.js';
@@ -121,7 +121,7 @@ export type ToolsCallInvoker = (args: {
 export interface ChannelTransportRouterOptions {
     /** GguiSession id the router scopes channel_subscribe frames against. */
     readonly sessionId: string;
-    /** App (tenant) id paired with sessionId on the subscribe frame. */
+    /** App id paired with sessionId on the subscribe frame. */
     readonly appId: string;
     /**
      * Allowlist of `source.tool` names this server can subscribe-for

package/dist/channels/channel-payload.d.ts

@@ -11,7 +11,7 @@
  * extraction.
  */
 import type { ChannelHandler } from '@ggui-ai/live-channel';
-import type { ChannelErrorPayload, ChannelPayloadFrame } from '@ggui-ai/protocol';
+import type { ChannelErrorPayload, ChannelPayloadFrame } from '@ggui-ai/protocol/wire';
 import type { ChannelTransportRouter } from '../channel-transport.js';
 export interface ChannelRouterHandlerDeps {
     readonly getChannelTransport: () => ChannelTransportRouter;

package/dist/channels/data.d.ts

@@ -11,7 +11,7 @@
  * render, so the lookup is direct.
  */
 import type { ChannelHandler } from '@ggui-ai/live-channel';
-import type { GguiSession, StreamEnvelope } from '@ggui-ai/protocol';
+import type { GguiSession, StreamEnvelope } from '@ggui-ai/protocol/wire';
 import type { GguiSessionSeedInput } from '../types.js';
 import { type RendererValidatorContext } from '../validation.js';
 import type { StreamBus } from '../wire-config.js';

package/dist/channels/drain-ack.d.ts

@@ -6,7 +6,7 @@
  * frame arrives on the wire.
  */
 import type { ChannelHandler } from '@ggui-ai/live-channel';
-import type { DrainAckPayload } from '@ggui-ai/protocol';
+import type { DrainAckPayload } from '@ggui-ai/protocol/wire';
 export interface DrainAckHandlerDeps {
     readonly dispatch: (payload: DrainAckPayload) => void;
 }

package/dist/channels/props-update.d.ts

@@ -29,7 +29,7 @@
  * `PollingTransport` dispatches.
  */
 import type { ChannelHandler } from '@ggui-ai/live-channel';
-import type { PropsUpdatePayload, GguiSession } from '@ggui-ai/protocol';
+import type { PropsUpdatePayload, GguiSession } from '@ggui-ai/protocol/wire';
 import type { GguiSessionSeedInput } from '../types.js';
 export interface PropsUpdateHandlerDeps {
     /**

package/dist/channels/render-frame.d.ts

@@ -18,7 +18,7 @@
  * happens. The boot-without-renderer path remains testable.
  */
 import type { ChannelHandler } from '@ggui-ai/live-channel';
-import type { RenderPayload, GguiSession } from '@ggui-ai/protocol';
+import type { RenderPayload, GguiSession } from '@ggui-ai/protocol/wire';
 import type { ChannelTransportRouter } from '../channel-transport.js';
 import { type StatusRefs } from '../status-dom.js';
 export interface RenderHandlerDeps {

package/dist/compiled-validators.d.ts

@@ -12,7 +12,7 @@
  * {@link CompiledValidatorSet}.
  */
 import type { CompiledContractValidators } from '@ggui-ai/protocol/integrations/mcp-apps';
-import type { ValidateFunction } from '@ggui-ai/protocol';
+import type { ValidateFunction } from '@ggui-ai/protocol/wire';
 /**
  * Precompiled validators for the active render's contract, keyed to
  * match the four runtime-validated surfaces. `props` is a single

package/dist/connection.d.ts

@@ -1,20 +1,42 @@
 /**
- * The document's connection store (ggui#670) — the single in-document
- * external store behind `useRender().isConnected`.
+ * The document's connection state (ggui#670, ggui#843) — the in-document
+ * external store behind `useRender().isConnected`, seen from the runtime.
  *
- * One store per document, by design: the relay latch describes the
- * HOST, not the render, and every mount in this document shares the
- * host (there is exactly one boot per document; re-mounts inherit it).
- * The runtime is the only writer, through `transitionRelayLatch` in
- * `runtime.ts` — the latch's two edges are the only transitions. Lives
- * re-exported here so the runtime's writer sites name one local
- * module; the store itself is wire's package singleton (the wire docs
- * generator prints every WireConfig member into the prompt, so the
- * store is deliberately NOT a config member).
+ * One store per document, by design: the relay latch describes the HOST,
+ * not the render, and every mount in this document shares the host (there
+ * is exactly one boot per document; re-mounts inherit it). The runtime is
+ * the ONE writer, through `transitionRelayLatch` in `runtime.ts` — the
+ * latch's two edges are the only transitions — and it proves it by
+ * CLAIMING the writer: once, eagerly at boot (`resetRelayLatchForBoot`),
+ * under its own name, through `@ggui-ai/wire/internal`. Readers — the
+ * wire's `useRender()`, generated component code through the root barrel —
+ * hold the read view `connectionSource` and nothing else. (The wire docs
+ * generator prints every WireConfig member into the prompt, so the store
+ * is deliberately NOT a config member.)
+ *
+ * A second copy of the runtime in the same document — a second evaluation
+ * of the bundle — adopts the SAME store (wire anchors it on the document,
+ * not the module copy) and fails at boot, here, naming itself
+ * (`ConnectionWriterConflictError`, owner === attemptedBy): the error IS
+ * the detector for a duplicate bundle, and boot never continues with an
+ * unclaimed writer.
  *
  * Not a reserved stream channel: nothing on the wire can reach it
  * (SPEC §4.4 forbids renderer-authored `_ggui:*` deliveries, and a
  * registered-but-ungated channel would have been a forgery path — the
  * adversarial pass on ggui#670).
  */
-export { connectionStore } from '@ggui-ai/wire';
+import { type ConnectionWriter } from '@ggui-ai/wire/internal';
+export { connectionSource } from '@ggui-ai/wire';
+/**
+ * The runtime's claim on the document's connection writer — taken on first
+ * call and memoized for the document's life. Boot calls it first, so the
+ * claim (and any conflict) surfaces before the first transition.
+ */
+export declare function runtimeConnectionWriter(): ConnectionWriter;
+/**
+ * Test seam: release the runtime's claim and forget it, so a test can hand
+ * the document's writer to another party (a refusing-boot case) or boot a
+ * fresh module graph. Never called by the runtime itself.
+ */
+export declare function __resetRuntimeConnectionWriterForTest(): void;

package/dist/connection.js

@@ -1,20 +1,48 @@
 /**
- * The document's connection store (ggui#670) — the single in-document
- * external store behind `useRender().isConnected`.
+ * The document's connection state (ggui#670, ggui#843) — the in-document
+ * external store behind `useRender().isConnected`, seen from the runtime.
  *
- * One store per document, by design: the relay latch describes the
- * HOST, not the render, and every mount in this document shares the
- * host (there is exactly one boot per document; re-mounts inherit it).
- * The runtime is the only writer, through `transitionRelayLatch` in
- * `runtime.ts` — the latch's two edges are the only transitions. Lives
- * re-exported here so the runtime's writer sites name one local
- * module; the store itself is wire's package singleton (the wire docs
- * generator prints every WireConfig member into the prompt, so the
- * store is deliberately NOT a config member).
+ * One store per document, by design: the relay latch describes the HOST,
+ * not the render, and every mount in this document shares the host (there
+ * is exactly one boot per document; re-mounts inherit it). The runtime is
+ * the ONE writer, through `transitionRelayLatch` in `runtime.ts` — the
+ * latch's two edges are the only transitions — and it proves it by
+ * CLAIMING the writer: once, eagerly at boot (`resetRelayLatchForBoot`),
+ * under its own name, through `@ggui-ai/wire/internal`. Readers — the
+ * wire's `useRender()`, generated component code through the root barrel —
+ * hold the read view `connectionSource` and nothing else. (The wire docs
+ * generator prints every WireConfig member into the prompt, so the store
+ * is deliberately NOT a config member.)
+ *
+ * A second copy of the runtime in the same document — a second evaluation
+ * of the bundle — adopts the SAME store (wire anchors it on the document,
+ * not the module copy) and fails at boot, here, naming itself
+ * (`ConnectionWriterConflictError`, owner === attemptedBy): the error IS
+ * the detector for a duplicate bundle, and boot never continues with an
+ * unclaimed writer.
  *
  * Not a reserved stream channel: nothing on the wire can reach it
  * (SPEC §4.4 forbids renderer-authored `_ggui:*` deliveries, and a
  * registered-but-ungated channel would have been a forgery path — the
  * adversarial pass on ggui#670).
  */
-export { connectionStore } from '@ggui-ai/wire';
+import { claimConnectionWriter } from '@ggui-ai/wire/internal';
+export { connectionSource } from '@ggui-ai/wire';
+let writer;
+/**
+ * The runtime's claim on the document's connection writer — taken on first
+ * call and memoized for the document's life. Boot calls it first, so the
+ * claim (and any conflict) surfaces before the first transition.
+ */
+export function runtimeConnectionWriter() {
+    return (writer ??= claimConnectionWriter('iframe-runtime'));
+}
+/**
+ * Test seam: release the runtime's claim and forget it, so a test can hand
+ * the document's writer to another party (a refusing-boot case) or boot a
+ * fresh module graph. Never called by the runtime itself.
+ */
+export function __resetRuntimeConnectionWriterForTest() {
+    writer?.release();
+    writer = undefined;
+}

package/dist/context-observer.d.ts

@@ -43,7 +43,7 @@
  * `console.warn` and drop silently in production (per Q4 design lock).
  */
 import type { Context, ReactElement, ReactNode } from 'react';
-import type { JsonSchema } from '@ggui-ai/protocol';
+import type { JsonSchema } from '@ggui-ai/protocol/wire';
 import type { GguiContextRegistry } from './globals.js';
 /**
  * Wire-shape entry for a single contextSpec slot, mirrored from

package/dist/context-observer.js

@@ -1,4 +1,4 @@
-import { DEFAULT_CONTEXT_DEBOUNCE_MS } from '@ggui-ai/protocol';
+import { DEFAULT_CONTEXT_DEBOUNCE_MS } from '@ggui-ai/protocol/wire';
 import { validateContextValue } from './validation.js';
 /**
  * Module-level map keyed by `name` (the camelCase slot key, NOT the

package/dist/events-polling.d.ts

@@ -48,7 +48,7 @@
  * fallback, and live updates.
  */
 import type { RegistryPollingOptions } from '@ggui-ai/live-channel';
-import type { GguiRuntimePullInput } from '@ggui-ai/protocol';
+import type { GguiRuntimePullInput } from '@ggui-ai/protocol/wire';
 /**
  * Shared, monotonic event-ledger cursor for the failover ladder.
  *

package/dist/host-context-emitter.d.ts

@@ -16,7 +16,8 @@
  *      the host's `theme` updated but ggui doesn't project theme).
  *   4. Apply host theme + styles + fonts to the iframe DOM via the
  *      spec-canonical {@link applyDocumentTheme} /
- *      {@link applyHostStyleVariables} / {@link applyHostFonts} helpers
+ *      {@link applyHostStyleVariables} helper + this package's
+ *      `installHostFonts` (ggui#987 §5: replace-on-payload)
  *      from `@modelcontextprotocol/ext-apps`. Fires on EVERY raw
  *      `McpUiHostContext` the runtime observes (initial + change
  *      notifications). The application path is INDEPENDENT of the
@@ -53,7 +54,7 @@
  *     happens in one place.
  */
 import { type App } from '@modelcontextprotocol/ext-apps';
-import { type HostContextObservedPayload, type HostContextProjection } from '@ggui-ai/protocol';
+import { type HostContextObservedPayload, type HostContextProjection } from '@ggui-ai/protocol/wire';
 /**
  * Function the emitter calls to ship a `host_context_observed` envelope.
  * Wired by `bootProduction` to the live WS transport's `send` —
@@ -132,6 +133,26 @@ export declare function detach(_targetWindow?: Window): void;
  * @internal
  */
 export declare function _peekCurrent(): HostContextProjection | undefined;
+/**
+ * Which of the two theming fields a `host-context-changed` payload
+ * carried. `HostContextProjection` EXCLUDES `theme` and `styles` by
+ * design (they flow through ggui's own theming pipeline), so the
+ * projection's equality gate can never announce a theme flip — this is
+ * the trigger that can (ggui#987 §4: the host owns runtime mode and may
+ * flip it mid-session). The listener re-reads the App's pre-merged
+ * `getHostContext()` itself; the raw values are not forwarded.
+ */
+export interface HostThemeChange {
+    readonly theme: boolean;
+    readonly styles: boolean;
+}
+/**
+ * Subscribe to `host-context-changed` payloads that carry `theme` and/or
+ * `styles` — fired on the RAW payload, before and regardless of the
+ * projection's equality gate, once per payload. Returns an unsubscribe.
+ * `detach()` clears every theme subscriber with the rest of the state.
+ */
+export declare function subscribeThemeChange(listener: (change: HostThemeChange) => void): () => void;
 export declare function subscribeLocal(listener: (projection: HostContextProjection) => void): () => void;
 /**
  * Apply the host's `theme`, `styles.variables`, `styles.css.fonts`, and

package/dist/host-context-emitter.js

@@ -16,7 +16,8 @@
  *      the host's `theme` updated but ggui doesn't project theme).
  *   4. Apply host theme + styles + fonts to the iframe DOM via the
  *      spec-canonical {@link applyDocumentTheme} /
- *      {@link applyHostStyleVariables} / {@link applyHostFonts} helpers
+ *      {@link applyHostStyleVariables} helper + this package's
+ *      `installHostFonts` (ggui#987 §5: replace-on-payload)
  *      from `@modelcontextprotocol/ext-apps`. Fires on EVERY raw
  *      `McpUiHostContext` the runtime observes (initial + change
  *      notifications). The application path is INDEPENDENT of the
@@ -52,8 +53,9 @@
  *   - Future widening (echo more fields, debounce burst changes, etc.)
  *     happens in one place.
  */
-import { applyDocumentTheme, applyHostFonts, applyHostStyleVariables, } from '@modelcontextprotocol/ext-apps';
-import { hostContextProjectionsEqual, projectHostContext, } from '@ggui-ai/protocol';
+import { applyDocumentTheme, applyHostStyleVariables, } from '@modelcontextprotocol/ext-apps';
+import { installHostFonts } from './host-fonts.js';
+import { hostContextProjectionsEqual, projectHostContext, } from '@ggui-ai/protocol/wire';
 let state = null;
 // =============================================================================
 // Public surface
@@ -156,6 +158,7 @@ export function detach(_targetWindow = window) {
     // scenarios. Without this, a subscriber registered in test 1 leaks
     // into test 2's seed and fires against a stale closure.
     localSubscribers.clear();
+    themeSubscribers.clear();
 }
 /**
  * Test-only read of the current held projection. Production code
@@ -181,6 +184,19 @@ export function _peekCurrent() {
  * tests + the production mount can coexist.
  */
 const localSubscribers = new Set();
+const themeSubscribers = new Set();
+/**
+ * Subscribe to `host-context-changed` payloads that carry `theme` and/or
+ * `styles` — fired on the RAW payload, before and regardless of the
+ * projection's equality gate, once per payload. Returns an unsubscribe.
+ * `detach()` clears every theme subscriber with the rest of the state.
+ */
+export function subscribeThemeChange(listener) {
+    themeSubscribers.add(listener);
+    return () => {
+        themeSubscribers.delete(listener);
+    };
+}
 export function subscribeLocal(listener) {
     localSubscribers.add(listener);
     // Fire immediately if seed has already happened.
@@ -238,11 +254,14 @@ export function applyHostContextStyling(raw) {
     try {
         const fontsCss = ctx.styles?.css?.fonts;
         if (typeof fontsCss === 'string' && fontsCss.length > 0) {
-            applyHostFonts(fontsCss);
+            // Replace-on-payload under ONE style element (ggui#987 §5) — a
+            // host that changes fonts repaints; the reference helper's
+            // append-per-call would accumulate every payload ever announced.
+            installHostFonts(fontsCss);
         }
     }
     catch {
-        // applyHostFonts injects a <style> tag; jsdom may reject the
+        // installHostFonts writes a <style> tag; jsdom may reject the
         // operation under strict modes. Swallow.
     }
     // safeAreaInsets — the spec carries these for mobile chrome
@@ -290,6 +309,20 @@ function handleHostContextChangedMessage(raw) {
 function handleHostContextChangedParams(params) {
     if (state === null)
         return;
+    // The theming fields never reach the projection below — announce
+    // them here, on the raw payload, so a theme-only flip repaints
+    // (ggui#987 §4; the projection excludes theme/styles by design).
+    const change = { theme: 'theme' in params, styles: 'styles' in params };
+    if (change.theme || change.styles) {
+        for (const listener of themeSubscribers) {
+            try {
+                listener(change);
+            }
+            catch {
+                // A subscriber throwing must not stop the DOM apply + echo.
+            }
+        }
+    }
     // Apply spec-canonical theme/styles/fonts to the iframe DOM BEFORE
     // the WS-echo path. The DOM-apply path covers fields the projection
     // drops (theme, styles) so the LLM-generated UI inside the iframe

package/dist/host-fonts.d.ts

@@ -0,0 +1,10 @@
+/** The single `<style>` the host's faces live under. */
+export declare const HOST_FONTS_STYLE_ID = "ggui-host-fonts";
+/**
+ * Install (or replace) the host's `@font-face` rules. Idempotent on
+ * identical payloads; a different payload replaces the previous one
+ * wholesale. Arms the CSP-violation reporter on first use.
+ */
+export declare function installHostFonts(fontsCss: string): void;
+/** @internal — test isolation: drop the style, the report ledger, and the listener. */
+export declare function __resetHostFontsForTest(): void;

package/dist/host-fonts.js

@@ -0,0 +1,113 @@
+/**
+ * Host font installation (ggui#987 §5).
+ *
+ * An MCP Apps host may hand the card `@font-face` rules in
+ * `hostContext.styles.css.fonts`. The card installs them under ONE
+ * `<style id="ggui-host-fonts">`, REPLACING the previous payload on
+ * every `hostcontextchanged` — a host that switches fonts repaints, a
+ * host that re-announces the same fonts is a no-op. (The reference
+ * helper appends a fresh `<style>` per call, so a long-lived card
+ * accumulated every font the host ever announced.)
+ *
+ * The document's CSP decides whether a face's `src` may load. When it
+ * refuses one, the browser fires `securitypolicyviolation` with the
+ * `font-src` directive and the blocked URL (origin-stripped for
+ * cross-origin — hence the (family, host) key); the card reports it to
+ * the embedding host ONCE per (family, host) as `font-face-blocked`,
+ * so the operator sees the allowlist gap instead of a silent fallback.
+ */
+import { postObservabilityToParent } from './observability.js';
+/** The single `<style>` the host's faces live under. */
+export const HOST_FONTS_STYLE_ID = 'ggui-host-fonts';
+let installedFaces = [];
+const reported = new Set();
+let violationListener = null;
+function hostOf(url) {
+    try {
+        return new URL(url).host || undefined;
+    }
+    catch {
+        return undefined;
+    }
+}
+/** Parse `@font-face` blocks → (family, src hosts). Tolerant: a block
+ *  missing either is skipped, never thrown on. */
+function parseFaces(css) {
+    const faces = [];
+    for (const block of css.matchAll(/@font-face\s*\{([^}]*)\}/g)) {
+        const body = block[1] ?? '';
+        const familyMatch = /font-family\s*:\s*(["']?)([^;"']+)\1/i.exec(body);
+        if (familyMatch === null)
+            continue;
+        const family = (familyMatch[2] ?? '').trim();
+        const hosts = new Set();
+        const srcs = new Set();
+        for (const src of body.matchAll(/url\(\s*(["']?)([^)"']+)\1\s*\)/g)) {
+            const url = (src[2] ?? '').trim();
+            const host = hostOf(url);
+            if (host === undefined)
+                continue;
+            hosts.add(host);
+            srcs.add(url);
+        }
+        if (family.length > 0 && hosts.size > 0)
+            faces.push({ family, srcs, hosts });
+    }
+    return faces;
+}
+function onViolation(ev) {
+    const v = ev;
+    if (v.effectiveDirective !== 'font-src' || typeof v.blockedURI !== 'string')
+        return;
+    const host = hostOf(v.blockedURI);
+    if (host === undefined)
+        return;
+    // CSP strips a cross-origin `blockedURI` to its origin; a same-origin
+    // report carries the full URL. With a path in hand the report is
+    // ours only when it names one of OUR `src`s — another stylesheet's
+    // font on the same host is not this face's failure.
+    const carriesPath = /^[a-z][a-z0-9+.-]*:\/\/[^/]+\/./i.test(v.blockedURI);
+    for (const face of installedFaces) {
+        if (carriesPath ? !face.srcs.has(v.blockedURI) : !face.hosts.has(host))
+            continue;
+        const key = `${face.family}\u0000${host}`;
+        if (reported.has(key))
+            continue;
+        reported.add(key);
+        postObservabilityToParent({ kind: 'font-face-blocked', family: face.family, host });
+    }
+}
+/**
+ * Install (or replace) the host's `@font-face` rules. Idempotent on
+ * identical payloads; a different payload replaces the previous one
+ * wholesale. Arms the CSP-violation reporter on first use.
+ */
+export function installHostFonts(fontsCss) {
+    if (typeof document === 'undefined')
+        return;
+    let el = document.getElementById(HOST_FONTS_STYLE_ID);
+    if (el === null) {
+        el = document.createElement('style');
+        el.id = HOST_FONTS_STYLE_ID;
+        document.head.appendChild(el);
+    }
+    if (el.textContent !== fontsCss)
+        el.textContent = fontsCss;
+    installedFaces = parseFaces(fontsCss);
+    if (violationListener === null) {
+        violationListener = onViolation;
+        document.addEventListener('securitypolicyviolation', violationListener);
+    }
+}
+/** @internal — test isolation: drop the style, the report ledger, and the listener. */
+export function __resetHostFontsForTest() {
+    if (typeof document === 'undefined')
+        return;
+    document.getElementById(HOST_FONTS_STYLE_ID)?.remove();
+    installedFaces = [];
+    reported.clear();
+    if (violationListener !== null) {
+        document.removeEventListener('securitypolicyviolation', violationListener);
+        violationListener = null;
+    }
+}

package/dist/host-palette-bridge.js

@@ -37,19 +37,23 @@
  * flat semantic tokens).
  */
 const SPEC_TO_GGUI = {
-    '--color-background-primary': '--ggui-color-surface',
-    '--color-background-secondary': '--ggui-color-surfaceVariant',
-    '--color-background-tertiary': '--ggui-color-container',
-    '--color-background-danger': '--ggui-color-errorContainer',
-    '--color-text-primary': '--ggui-color-onSurface',
-    '--color-text-secondary': '--ggui-color-onSurfaceVariant',
-    '--color-text-tertiary': '--ggui-color-neutral-500',
-    '--color-text-danger': '--ggui-color-error-500',
-    '--color-text-success': '--ggui-color-success-500',
-    '--color-text-warning': '--ggui-color-warning-500',
-    '--color-text-info': '--ggui-color-info-500',
-    '--color-border-primary': '--ggui-color-outline',
-    '--color-border-secondary': '--ggui-color-outlineVariant',
+    // Surface-layering roles (ggui#987 §2.1): the host's primary background
+    // is the canvas a card sits on (`ground`), its secondary the card
+    // itself (`container`), its tertiary the recessed wells (`sunken`);
+    // primary text is the ink on both the canvas and the card.
+    '--color-background-primary': ['--ggui-color-ground'],
+    '--color-background-secondary': ['--ggui-color-container'],
+    '--color-background-tertiary': ['--ggui-color-sunken'],
+    '--color-background-danger': ['--ggui-color-errorContainer'],
+    '--color-text-primary': ['--ggui-color-onGround', '--ggui-color-onContainer'],
+    '--color-text-secondary': ['--ggui-color-onSunken'],
+    '--color-text-tertiary': ['--ggui-color-neutral-500'],
+    '--color-text-danger': ['--ggui-color-error-500'],
+    '--color-text-success': ['--ggui-color-success-500'],
+    '--color-text-warning': ['--ggui-color-warning-500'],
+    '--color-text-info': ['--ggui-color-info-500'],
+    '--color-border-primary': ['--ggui-color-outline'],
+    '--color-border-secondary': ['--ggui-color-outlineVariant'],
 };
 /**
  * Host palette values arrive over postMessage and are string-joined
@@ -93,14 +97,15 @@ export function mapHostPaletteToGguiVars(variables) {
         return undefined;
     const mapped = {};
     let count = 0;
-    for (const [specKey, gguiKey] of Object.entries(SPEC_TO_GGUI)) {
+    for (const [specKey, gguiKeys] of Object.entries(SPEC_TO_GGUI)) {
         const raw = variables[specKey];
         if (typeof raw !== 'string')
             continue;
         const value = raw.trim();
         if (!isSafeCssValue(value))
             continue;
-        mapped[gguiKey] = value;
+        for (const gguiKey of gguiKeys)
+            mapped[gguiKey] = value;
         count += 1;
     }
     return count > 0 ? mapped : undefined;