@ggui-ai/iframe-runtime 0.2.0-alpha.4 → 0.4.0-rc.0

package/dist/wire-config.d.ts

@@ -1,112 +1,65 @@
 /**
  * Per-render `WireConfig` factory for the renderer iframe.
  *
- * The renderer iframe mounts EXACTLY ONE {@link Render} per iframe
+ * The renderer iframe mounts EXACTLY ONE {@link GguiSession} per iframe
  * post-render-identity-collapse (2026-05-27). There is no per-item
  * scoping factory anymore — the WireConfig is built once at boot,
- * keyed by the bootstrap's `renderId`, and the active render's
+ * keyed by the bootstrap's `sessionId`, and the active render's
  * `actionSpec` is wired in via the {@link buildRootWireConfig}'s
- * `getCurrentRender` thunk.
+ * `getCurrentGguiSession` thunk.
  *
- * Outbound dispatch uses `buildActionEnvelope` (from
- * `@ggui-ai/wire`) + `validateOutboundActionEnvelope` + a direct
- * `manager.send({type:'action', payload})`.
- *
- * The `WireConfig` shape lives in `@ggui-ai/wire`. This module
- * implements against that interface.
+ * The envelope-build → validate → emit pipeline and the bus-backed
+ * subscribe seam live in `@ggui-ai/wire`'s shared `buildWireConfig`
+ * (one implementation for every first-party renderer — see the MCP
+ * Apps Compliance principle). This module is the iframe-side adapter:
+ * it injects the CSP-safe precompiled outbound validator, the
+ * ProtocolError dual-emission policy, and the tools/call-vs-WS
+ * dispatch transport.
  */
-import type { ActionEnvelope, Render, StreamEnvelope } from '@ggui-ai/protocol';
-import type { RenderSeedInput } from './types.js';
-import { ClientContractViolationError, type WireConfig } from '@ggui-ai/wire';
+import type { ActionEnvelope, GguiSession } from '@ggui-ai/protocol';
+import type { GguiSessionSeedInput } from './types.js';
+import { ClientContractViolationError, StreamBus, type WireConfig } from '@ggui-ai/wire';
 import type { WebSocketMessage } from '@ggui-ai/protocol/transport/websocket';
 /**
  * Outbound send surface — the minimal shape wire-config calls on the
  * WS transport. Pre-B3b this read off `Pick<RendererWebSocketManager,
  * 'send'>`; post-B3b the WS lives inside `@ggui-ai/live-channel`,
- * but wire-config doesn't import the gadget directly — it consumes
+ * but wire-config doesn't import the library directly — it consumes
  * the shape via this local type so tests can stub `{send: vi.fn()}`
  * without dragging in the live-channel types.
  *
- * Frames sent here are always `{type: 'action', payload: ...}` or
- * `{type: 'feedback', payload: ...}` envelopes — wire-config never
- * sends transport-layer frames (`ping`, `subscribe`).
+ * Frames sent here are always `{type: 'action', payload: ...}`
+ * envelopes — wire-config never sends transport-layer frames
+ * (`ping`, `subscribe`).
  */
 export interface RendererSendSurface {
     readonly send: (message: WebSocketMessage) => void;
 }
 import { type ProtocolErrorEmitter } from './protocol-error.js';
-import type { ObservabilityEmitter } from './observability.js';
-/**
- * Tiny fan-out bus keyed by channel name. `subscribe.ts`'s inbound-
- * message handler pushes validated `data` envelopes here; wire's
- * `useStream(channel)` subscribes per-component via the config's
- * `subscribe()` method.
- *
- * Late-subscriber replay for reserved channels:
- *
- *   The renderer iframe boots in a strict ordering:
- *   `subscribe()` → first `ack` → render stack items → mount
- *   `mountProvisional` → it then calls `streamBus.subscribe('_ggui:
- *   preview', …)`. Server-side replay frames for `_ggui:preview` (the
- *   provisional A2UI preamble fired during the agent's `ggui_render`
- *   BEFORE the user's browser navigated to the viewer) arrive over the
- *   WS in the window between ack-resolve and the provisional mount —
- *   they hit `emit()` before any listener has subscribed. Without a
- *   bounded reserved-channel ring, those frames vanish and the preview
- *   surface stays stuck on the spinner.
- *
- *   Server-owned `_ggui:*` channels are buffered in a per-channel ring
- *   capped at {@link RESERVED_CHANNEL_REPLAY_MAX}. New subscribers
- *   receive the buffered envelopes synchronously before the unsubscribe
- *   handle returns — same mental model as the server-side
- *   `SessionStreamBuffer.replay(...)` walk over reserved channels at
- *   ack time, but mirrored at the inner bus boundary so the host
- *   transport stays portable (Claude Desktop / ChatGPT / Cursor /
- *   `<McpAppIframe>` all behave the same).
- *
- *   Agent-declared (non-reserved) channels are NOT buffered here. Their
- *   replay is the server's job — the renderer's `subscribe()` handshake
- *   pulls history per `streamSpec.replay` policy when reconnecting with
- *   `fromSeq`. Buffering them at this layer would double-count and
- *   change the semantics of agent contracts.
- *
- * No observable mutation outside the renderer boundary — the bus is
- * internal plumbing.
- */
-export declare class StreamBus {
-    private listeners;
-    /**
-     * Per-channel bounded ring of envelopes for reserved (`_ggui:*`)
-     * channels only. FIFO eviction at `RESERVED_CHANNEL_REPLAY_MAX`.
-     * Replayed to every new subscriber for that channel.
-     */
-    private reservedReplay;
-    subscribe(channel: string, listener: (env: StreamEnvelope) => void): () => void;
-    emit(envelope: StreamEnvelope): void;
-}
+export { StreamBus };
 export interface BuildRootWireConfigOptions {
-    readonly renderId: string;
+    readonly sessionId: string;
     readonly appId: string;
     /**
-     * Read the currently-mounted {@link Render}. The config's `dispatch`
+     * Read the currently-mounted {@link GguiSession}. The config's `dispatch`
      * resolves the active render's `actionSpec` through this thunk so
-     * the `tool` + outbound validator stay coherent across props_update
-     * patches (which replace the render reference) without rebuilding
-     * the WireConfig.
+     * the outbound validator stays coherent across props_update patches
+     * (which replace the render reference) without rebuilding the
+     * WireConfig.
      */
-    readonly getCurrentRender: () => Render | RenderSeedInput | null;
-    /** Handle to the renderer's WS manager; used for outbound `action` + `feedback` frames. */
+    readonly getCurrentGguiSession: () => GguiSession | GguiSessionSeedInput | null;
+    /** Handle to the renderer's WS manager; used for outbound `action` frames. */
     readonly manager: RendererSendSurface;
     /** Shared bus for inbound stream deliveries. */
     readonly streamBus: StreamBus;
     /**
      * Optional sink for contract violations. Default: tagged
      * `console.warn`. Tests inject a recorder. Matches
-     * `GguiSession.onError` semantics on the client-contract path.
+     * `GguiRender.onError` semantics on the client-contract path.
      *
      * Prefer {@link onProtocolError} for new integrations — it receives
      * the widened {@link ProtocolError} union that covers every error
-     * the renderer classifies (transport, auth, protocol, contract,
+     * the renderer classifies (transport, auth, protocol,
      * bootstrap, version, unknown). The narrow `onContractViolation`
      * sink stays for in-renderer tests that assert the raw class shape;
      * every violation is ALSO forwarded through `onProtocolError` so
@@ -117,64 +70,48 @@ export interface BuildRootWireConfigOptions {
      * Optional sink for every typed {@link ProtocolError} the renderer
      * classifies. Default: {@link defaultProtocolErrorEmitter}
      * (`console.warn` with a grep-friendly tag). The `<McpAppIframe>`
-     * host wrapper wires this to its `onError` prop; session-bound
-     * variants are ALSO mirrored to the `_ggui:contract-error` WS
-     * envelope.
+     * host wrapper wires this to its `onError` prop.
      *
      * The emitter fires for CLIENT-side contract violations (via
      * `fromClientContractViolation`). Other sites (subscribe failures,
-     * upgrade-required, transport errors, server-emitted
-     * contract-error envelopes) plumb through the same emitter without
-     * a shape change.
+     * upgrade-required, transport errors) plumb through the same
+     * emitter without a shape change.
      */
     readonly onProtocolError?: ProtocolErrorEmitter;
-    /**
-     * Optional {@link ObservabilityEmitter} sink. Fires a
-     * `wired-tool-invoked` event every time {@link dispatchByItem}
-     * successfully sends a wired-action envelope (i.e. the ctx's
-     * resolved `tool` is populated AND outbound validation passed).
-     *
-     * The event is client-side — `dispatchedAt` records when the
-     * envelope left the renderer, NOT when the server's router
-     * completed the tool. The SERVER independently emits a
-     * `wired-tool.invoked` telemetry event on its own sink for
-     * operational metrics; the two surfaces are deliberately separate
-     * (host inspector vs operator telemetry).
-     */
-    readonly onObserve?: ObservabilityEmitter;
     /**
      * Optional outbound action sink. When provided, REPLACES the
      * default WS-frame send (`manager.send({type:'action', payload})`).
      *
      * The WS live-channel exists for streamSpec subscriptions (inbound
-     * `ggui_emit` fanout + `props_update` + `push` + `data` + `feedback`
-     * + `drain_ack` + `channel_payload`). Outbound user actions belong
-     * on a different pipe — per MCP-Apps spec §401, the iframe relays
+     * `ggui_emit` fanout + `props_update` + `render` + `data`
+     * + `drain_ack` + `channel_payload`). For an MCP-Apps embed, user
+     * actions belong on the host relay: per spec §401 the iframe relays
      * `tools/call:ggui_runtime_submit_action` through the host (the
      * `_meta.ui.visibility:['app']` channel), and the server's MCP
      * handler appends to `pendingEventConsumer` so `ggui_consume`
-     * wakes the agent.
+     * wakes the agent. A cross-host iframe cannot assume a reachable
+     * WS endpoint at all, so production MCP-Apps callers MUST supply
+     * this option.
      *
-     * The default `manager.send({type:'action'})` path writes to the
-     * session ledger only — it has no downstream consumer in OSS (no
-     * `wiredActionRouter`, no bridge to `pendingEventConsumer`).
-     * Production callers MUST supply this option to reach the agent.
+     * The default WS-frame send reaches the agent only on servers whose
+     * live channel bridges WS `data:submit` actions onto the same
+     * pending-events pipe (first-party `createGguiServer` does — see
+     * `GguiSessionChannelOptions.pendingEventConsumer`); it remains the
+     * seam tests and direct-WS callers exercise.
      *
      * Called AFTER outbound validation passes. Receives the validated
      * {@link ActionEnvelope}; caller extracts payload.action +
      * payload.data + slice meta to route via the host's tools/call
      * relay (see iframe-runtime's `routeDispatch`).
-     *
-     * Tests omit this opt to exercise the legacy WS-frame path.
      */
     readonly onDispatchEnvelope?: (envelope: ActionEnvelope) => void;
 }
 /**
  * Build the per-render `WireConfig` for the iframe runtime.
  * Bootstraps the renderer's outbound emission + inbound subscription
- * seams. Returns a `WireConfig` keyed by the bootstrap's `renderId`;
+ * seams. Returns a `WireConfig` keyed by the bootstrap's `sessionId`;
  * the active render's `actionSpec` is resolved through the
- * {@link BuildRootWireConfigOptions.getCurrentRender} thunk on every
+ * {@link BuildRootWireConfigOptions.getCurrentGguiSession} thunk on every
  * dispatch so props_update patches don't require rebuilding the
  * config.
  *

package/dist/wire-config.js

@@ -1,133 +1,16 @@
-import { ClientContractViolationError, buildActionEnvelope, } from '@ggui-ai/wire';
+import { buildWireConfig, StreamBus, } from '@ggui-ai/wire';
 import { validateOutboundActionEnvelope } from './validation.js';
 import { defaultProtocolErrorEmitter, fromClientContractViolation, } from './protocol-error.js';
-// =============================================================================
-// StreamBus — the in-renderer bridge between inbound `data` frames
-// and per-component `useStream(channel)` subscribers.
-// =============================================================================
-/**
- * Reserved-channel namespace prefix (mirror of
- * `@ggui-ai/protocol::RESERVED_CHANNEL_PREFIX`). Inlined to avoid
- * widening the protocol import surface here — the constant is
- * load-bearing for the late-subscriber replay rule below; equality
- * with the protocol export is locked by the StreamBus tests.
- */
-const RESERVED_CHANNEL_PREFIX = '_ggui:';
-/**
- * Per-channel ring cap for late-subscriber replay on reserved channels.
- * Mirrors the server-side `DEFAULT_SESSION_STREAM_BUFFER_MAX` posture:
- * bounded so a long-lived iframe can't grow memory unbounded if a
- * reserved channel emits in a hot loop.
- *
- * 256 is enough headroom for the deterministic A2UI emitter (one frame
- * per fragment, ~5–15 frames per push) plus several refresh cycles, and
- * still fits comfortably in memory.
- */
-const RESERVED_CHANNEL_REPLAY_MAX = 256;
-/**
- * Tiny fan-out bus keyed by channel name. `subscribe.ts`'s inbound-
- * message handler pushes validated `data` envelopes here; wire's
- * `useStream(channel)` subscribes per-component via the config's
- * `subscribe()` method.
- *
- * Late-subscriber replay for reserved channels:
- *
- *   The renderer iframe boots in a strict ordering:
- *   `subscribe()` → first `ack` → render stack items → mount
- *   `mountProvisional` → it then calls `streamBus.subscribe('_ggui:
- *   preview', …)`. Server-side replay frames for `_ggui:preview` (the
- *   provisional A2UI preamble fired during the agent's `ggui_render`
- *   BEFORE the user's browser navigated to the viewer) arrive over the
- *   WS in the window between ack-resolve and the provisional mount —
- *   they hit `emit()` before any listener has subscribed. Without a
- *   bounded reserved-channel ring, those frames vanish and the preview
- *   surface stays stuck on the spinner.
- *
- *   Server-owned `_ggui:*` channels are buffered in a per-channel ring
- *   capped at {@link RESERVED_CHANNEL_REPLAY_MAX}. New subscribers
- *   receive the buffered envelopes synchronously before the unsubscribe
- *   handle returns — same mental model as the server-side
- *   `SessionStreamBuffer.replay(...)` walk over reserved channels at
- *   ack time, but mirrored at the inner bus boundary so the host
- *   transport stays portable (Claude Desktop / ChatGPT / Cursor /
- *   `<McpAppIframe>` all behave the same).
- *
- *   Agent-declared (non-reserved) channels are NOT buffered here. Their
- *   replay is the server's job — the renderer's `subscribe()` handshake
- *   pulls history per `streamSpec.replay` policy when reconnecting with
- *   `fromSeq`. Buffering them at this layer would double-count and
- *   change the semantics of agent contracts.
- *
- * No observable mutation outside the renderer boundary — the bus is
- * internal plumbing.
- */
-export class StreamBus {
-    listeners = new Map();
-    /**
-     * Per-channel bounded ring of envelopes for reserved (`_ggui:*`)
-     * channels only. FIFO eviction at `RESERVED_CHANNEL_REPLAY_MAX`.
-     * Replayed to every new subscriber for that channel.
-     */
-    reservedReplay = new Map();
-    subscribe(channel, listener) {
-        let bucket = this.listeners.get(channel);
-        if (bucket === undefined) {
-            bucket = new Set();
-            this.listeners.set(channel, bucket);
-        }
-        bucket.add(listener);
-        // Replay buffered reserved-channel envelopes BEFORE returning the
-        // unsubscribe handle so the new listener is fully caught up by the
-        // time `subscribe()` returns. Order matches arrival order at
-        // `emit()` (FIFO ring).
-        if (channel.startsWith(RESERVED_CHANNEL_PREFIX)) {
-            const ring = this.reservedReplay.get(channel);
-            if (ring !== undefined) {
-                for (const env of ring) {
-                    listener(env);
-                }
-            }
-        }
-        return () => {
-            const current = this.listeners.get(channel);
-            if (current === undefined)
-                return;
-            current.delete(listener);
-            if (current.size === 0)
-                this.listeners.delete(channel);
-        };
-    }
-    emit(envelope) {
-        if (envelope.channel.startsWith(RESERVED_CHANNEL_PREFIX)) {
-            let ring = this.reservedReplay.get(envelope.channel);
-            if (ring === undefined) {
-                ring = [];
-                this.reservedReplay.set(envelope.channel, ring);
-            }
-            ring.push(envelope);
-            if (ring.length > RESERVED_CHANNEL_REPLAY_MAX) {
-                // FIFO drop — keeps the most recent
-                // `RESERVED_CHANNEL_REPLAY_MAX` frames. Late subscribers may
-                // miss the createSurface fragment if the ring overflows (would
-                // render as Spinner-stuck), but that's an upper-bound contract
-                // on a bounded buffer, not a silent failure mode in practice.
-                ring.shift();
-            }
-        }
-        const bucket = this.listeners.get(envelope.channel);
-        if (bucket === undefined)
-            return;
-        for (const listener of bucket) {
-            listener(envelope);
-        }
-    }
-}
+// `StreamBus` (and its bounded reserved-channel replay ring) was
+// hoisted into `@ggui-ai/wire` so `<GguiRender>` and this runtime share
+// one implementation. Re-exported for the runtime's internal modules.
+export { StreamBus };
 /**
  * Build the per-render `WireConfig` for the iframe runtime.
  * Bootstraps the renderer's outbound emission + inbound subscription
- * seams. Returns a `WireConfig` keyed by the bootstrap's `renderId`;
+ * seams. Returns a `WireConfig` keyed by the bootstrap's `sessionId`;
  * the active render's `actionSpec` is resolved through the
- * {@link BuildRootWireConfigOptions.getCurrentRender} thunk on every
+ * {@link BuildRootWireConfigOptions.getCurrentGguiSession} thunk on every
  * dispatch so props_update patches don't require rebuilding the
  * config.
  *
@@ -137,13 +20,7 @@ export class StreamBus {
  * indirection collapsed to a single `WireConfig`.
  */
 export function buildRootWireConfig(opts) {
-    const clientSeqBox = { current: 0 };
-    function nextSeq() {
-        clientSeqBox.current += 1;
-        return clientSeqBox.current;
-    }
     const emitProtocolError = opts.onProtocolError ?? defaultProtocolErrorEmitter;
-    const emitObserve = opts.onObserve ?? (() => { });
     function surfaceViolation(err) {
         // Dual emission — the narrow `onContractViolation` sink stays
         // for in-renderer tests that assert the raw class shape; the
@@ -156,7 +33,7 @@ export function buildRootWireConfig(opts) {
         else if (opts.onProtocolError === undefined) {
             // No caller-supplied sink at all → operator-visible fallback so
             // dev consoles see the violation. Matches
-            // `GguiSession.surfaceContractViolation`'s console.warn posture.
+            // `GguiRender.surfaceContractViolation`'s console.warn posture.
             // eslint-disable-next-line no-console
             console.warn('[ggui:contract] ' + err.message, {
                 direction: err.direction,
@@ -165,93 +42,50 @@ export function buildRootWireConfig(opts) {
         }
         emitProtocolError(fromClientContractViolation(err));
     }
-    return {
+    return buildWireConfig({
         app: { appId: opts.appId, appName: opts.appId },
-        render: { renderId: opts.renderId, isConnected: true },
+        render: { sessionId: opts.sessionId, isConnected: true },
         auth: { isAuthenticated: false },
-        dispatch: (actionName, data) => {
-            // Resolve the active render's actionSpec on every dispatch.
-            // Per-render lifecycle: props_update patches replace the render
-            // reference; reading through the thunk keeps the tool binding
-            // + outbound validator coherent without rebuilding the config.
-            const currentRender = opts.getCurrentRender();
-            const activeActionSpec = currentRender !== null &&
+        // Resolve the active render's actionSpec on every dispatch.
+        // Per-render lifecycle: props_update patches replace the render
+        // reference; reading through the thunk keeps the outbound
+        // validator coherent without rebuilding the config.
+        getActiveActionSpec: () => {
+            const currentRender = opts.getCurrentGguiSession();
+            return currentRender !== null &&
                 currentRender.type !== 'mcpApps' &&
                 currentRender.type !== 'system'
                 ? currentRender.actionSpec
                 : undefined;
-            const entry = activeActionSpec?.[actionName];
-            const tool = entry?.nextStep;
-            const envelope = buildActionEnvelope({
-                renderId: opts.renderId,
-                type: 'data:submit',
-                payload: {
-                    action: actionName,
-                    data: data,
-                    ...(tool ? { tool } : {}),
-                },
-                clientSeq: nextSeq(),
-            });
-            const result = validateOutboundActionEnvelope(activeActionSpec, envelope);
-            if (!result.valid) {
-                surfaceViolation(new ClientContractViolationError('outbound-action', result.violations));
-                return;
-            }
+        },
+        // The iframe's precompiled-validator variant — the dispatch never
+        // trips the iframe's no-`unsafe-eval` CSP.
+        validateEnvelope: validateOutboundActionEnvelope,
+        onViolation: surfaceViolation,
+        emitEnvelope: (envelope) => {
             if (opts.onDispatchEnvelope !== undefined) {
                 // Spec-canonical path — the iframe-runtime's LIVE-mode boot
                 // wires this to `routeDispatch`, which postMessages
                 // `tools/call:ggui_runtime_submit_action` through the MCP-Apps
                 // host relay. The default WS-frame send below is retained for
-                // tests + legacy callers that don't relay tools/call.
+                // tests + direct-WS callers that don't relay tools/call.
                 opts.onDispatchEnvelope(envelope);
             }
             else {
                 sendActionEnvelope(opts.manager, envelope);
             }
-            // Observability: a wired-tool dispatch is a `data:submit` whose
-            // resolved action has a `tool` binding. Plain agent-routed actions
-            // (no `tool` on the actionSpec) fire a `dispatch` activity row in
-            // the console via the session-side ring buffer; only wired tools
-            // get this observability event. The server separately emits the
-            // operational telemetry variant on its TelemetrySink.
-            if (tool !== undefined) {
-                emitObserve({
-                    kind: 'wired-tool-invoked',
-                    toolName: tool,
-                    actionName,
-                    dispatchedAt: new Date().toISOString(),
-                });
-            }
-        },
-        subscribe: (channelName, handler) => {
-            return opts.streamBus.subscribe(channelName, (env) => {
-                // `WireConfig<DataContract>.subscribe`'s handler expects a
-                // `StreamDelivery<unknown>`; the bus ships the raw envelope
-                // payload unmodified. The type-level `unknown` narrowing
-                // lives on the caller's generic boundary (useStream /
-                // useContract).
-                handler({
-                    payload: env.payload,
-                    mode: env.mode,
-                    ...(env.complete !== undefined ? { complete: env.complete } : {}),
-                });
-            });
         },
-        // `callWiredTool` is retired — `agentTools` is now a catalog the
-        // AGENT invokes; the component never reaches the underlying tool
-        // from inside the renderer. Cross-refs surface via
-        // `actionSpec[*].nextStep` (event metadata) and
-        // `streamSpec[*].source.tool` (channel data source).
-    };
+        streamBus: opts.streamBus,
+    });
 }
 // =============================================================================
 // Outbound envelope emission
 // =============================================================================
 /**
  * Send a validated action envelope over the live channel. The WS frame shape
- * is `{type:'action', payload: envelope}` — matches today's
- * `useWebSocket.sendAction` exactly, so wire-emitted dispatches from
- * the renderer are byte-equivalent to `GguiSession`-emitted ones.
+ * is `{type:'action', payload: envelope}` — matches `useWebSocket.sendAction`
+ * exactly, so wire-emitted dispatches from the renderer are
+ * byte-equivalent to `GguiRender`-emitted ones.
  */
 function sendActionEnvelope(manager, envelope) {
     manager.send({ type: 'action', payload: envelope });

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ggui-ai/iframe-runtime",
-  "version": "0.2.0-alpha.4",
+  "version": "0.4.0-rc.0",
   "description": "The iframe-local ggui runtime: a self-contained ESM bundle that boots inside an MCP Apps host iframe, runs the protocol-version handshake, opens the live-channel WebSocket, and mounts the rendered UI. Bundles React, ReactDOM, and the ggui design system so generated component code has a single seam to read from.",
   "keywords": [
     "ggui",
@@ -28,9 +28,6 @@
       "types": "./dist/server.d.ts",
       "import": "./dist/server.js",
       "default": "./dist/server.js"
-    },
-    "./runtime.js": {
-      "default": "./dist/iframe-runtime.js"
     }
   },
   "dependencies": {
@@ -38,14 +35,18 @@
     "qrcode-generator": "^2.0.4",
     "react": "^19.0.0",
     "react-dom": "^19.0.0",
-    "@ggui-ai/live-channel": "0.2.0-alpha.4",
-    "@ggui-ai/preview-a2ui": "0.2.0-alpha.4",
-    "@ggui-ai/gadgets": "0.2.0-alpha.4",
-    "@ggui-ai/design": "0.2.0-alpha.4",
-    "@ggui-ai/protocol": "0.2.0-alpha.4",
-    "@ggui-ai/wire": "0.2.0-alpha.4"
+    "@ggui-ai/live-channel": "0.4.0-rc.0",
+    "@ggui-ai/preview-a2ui": "0.4.0-rc.0",
+    "@ggui-ai/design": "0.4.0-rc.0",
+    "@ggui-ai/gadgets": "0.4.0-rc.0",
+    "@ggui-ai/protocol": "0.4.0-rc.0",
+    "@ggui-ai/wire": "0.4.0-rc.0"
+  },
+  "peerDependencies": {
+    "@modelcontextprotocol/sdk": "^1.27.0"
   },
   "devDependencies": {
+    "@modelcontextprotocol/sdk": "^1.27.0",
     "@testing-library/react": "^16.0.0",
     "@types/node": "^24.0.0",
     "@types/react": "^19.0.0",
@@ -54,7 +55,7 @@
     "jsdom": "^24.0.0",
     "tsx": "^4.21.0",
     "typescript": "^5.0.0",
-    "vitest": "^3.0.0"
+    "vitest": "^3.2.6"
   },
   "repository": {
     "type": "git",
@@ -73,8 +74,9 @@
   },
   "author": "ggui contributors <hello@ggui.ai>",
   "scripts": {
-    "build": "node esbuild.config.mjs && tsc -p tsconfig.types.json && pnpm run check:bundle-size",
+    "build": "rm -rf dist && node esbuild.config.mjs && tsc -p tsconfig.types.json && pnpm run check:bundle-size",
     "check:bundle-size": "tsx scripts/check-bundle-size.ts",
+    "check:bundle-size:self-test": "tsx scripts/check-bundle-size.ts --self-test",
     "typecheck": "tsc --noEmit",
     "test": "vitest run",
     "test:watch": "vitest"

package/dist/channels/feedback.d.ts

@@ -1,14 +0,0 @@
-/**
- * `feedback` channel handler — no-op stub.
- *
- * Legacy `feedback` frame: older servers emitted this as the round-trip
- * half of the retired `tool:<name>` client-tool RPC path. Silently
- * ignored under the `clientCapabilities` reframe; kept as a recognized
- * type until the WS message union drops `'feedback'`. Registering a
- * no-op handler is what keeps the registry's dispatch from logging
- * "no handler for type 'feedback'" warnings — the silence is
- * intentional, the handler documents that.
- */
-import type { ChannelHandler } from '@ggui-ai/live-channel';
-import type { JsonObject } from '@ggui-ai/protocol';
-export declare function createFeedbackHandler(): ChannelHandler<JsonObject>;

package/dist/channels/feedback.js

@@ -1,19 +0,0 @@
-/**
- * `feedback` channel handler — no-op stub.
- *
- * Legacy `feedback` frame: older servers emitted this as the round-trip
- * half of the retired `tool:<name>` client-tool RPC path. Silently
- * ignored under the `clientCapabilities` reframe; kept as a recognized
- * type until the WS message union drops `'feedback'`. Registering a
- * no-op handler is what keeps the registry's dispatch from logging
- * "no handler for type 'feedback'" warnings — the silence is
- * intentional, the handler documents that.
- */
-export function createFeedbackHandler() {
-    return {
-        type: 'feedback',
-        onMessage: () => {
-            /* no-op — legacy stub */
-        },
-    };
-}