@ggui-ai/mcp-server-handlers 0.7.0 → 0.8.0

package/dist/blueprints/index.d.ts

@@ -23,8 +23,8 @@
  * on top when wrapping these into its tool-handler shape (a wider
  * `SharedHandler<ToolContext>` re-export).
  */
-export { createSearchBlueprintsHandler, MIN_SIMILARITY_SCORE, MANIFEST_EXACT_NAME_SCORE, MANIFEST_SUBSTRING_SCORE, } from './search-blueprints.js';
-export type { SearchBlueprintsDeps } from './search-blueprints.js';
+export { createSearchBlueprintsHandler, DEFAULT_REGISTRY_SEARCH_TIMEOUT_MS, MIN_SIMILARITY_SCORE, MANIFEST_EXACT_NAME_SCORE, MANIFEST_SUBSTRING_SCORE, } from './search-blueprints.js';
+export type { SearchBlueprintsDeps, SearchBlueprintsRegistrySource, } from './search-blueprints.js';
 export { createListFeaturedBlueprintsHandler } from './list-featured-blueprints.js';
 export type { ListFeaturedBlueprintsDeps, ListFeaturedBlueprintsOutput, } from './list-featured-blueprints.js';
 export { createRenderBlueprintHandler } from './render-blueprint.js';

package/dist/blueprints/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/blueprints/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AAEH,OAAO,EACL,6BAA6B,EAC7B,oBAAoB,EACpB,yBAAyB,EACzB,wBAAwB,GACzB,MAAM,wBAAwB,CAAC;AAChC,YAAY,EAAE,oBAAoB,EAAE,MAAM,wBAAwB,CAAC;AACnE,OAAO,EAAE,mCAAmC,EAAE,MAAM,+BAA+B,CAAC;AACpF,YAAY,EACV,0BAA0B,EAC1B,4BAA4B,GAC7B,MAAM,+BAA+B,CAAC;AACvC,OAAO,EAAE,4BAA4B,EAAE,MAAM,uBAAuB,CAAC;AACrE,YAAY,EAAE,mBAAmB,EAAE,MAAM,uBAAuB,CAAC;AACjE,OAAO,EAAE,8BAA8B,EAAE,MAAM,yBAAyB,CAAC;AACzE,OAAO,EAAE,oCAAoC,EAAE,MAAM,gCAAgC,CAAC;AACtF,OAAO,EAAE,oCAAoC,EAAE,MAAM,gCAAgC,CAAC;AACtF,OAAO,EAAE,oCAAoC,EAAE,MAAM,gCAAgC,CAAC;AACtF,OAAO,EAAE,uCAAuC,EAAE,MAAM,oCAAoC,CAAC;AAC7F,OAAO,EAAE,iCAAiC,EAAE,MAAM,6BAA6B,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/blueprints/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AAEH,OAAO,EACL,6BAA6B,EAC7B,kCAAkC,EAClC,oBAAoB,EACpB,yBAAyB,EACzB,wBAAwB,GACzB,MAAM,wBAAwB,CAAC;AAChC,YAAY,EACV,oBAAoB,EACpB,8BAA8B,GAC/B,MAAM,wBAAwB,CAAC;AAChC,OAAO,EAAE,mCAAmC,EAAE,MAAM,+BAA+B,CAAC;AACpF,YAAY,EACV,0BAA0B,EAC1B,4BAA4B,GAC7B,MAAM,+BAA+B,CAAC;AACvC,OAAO,EAAE,4BAA4B,EAAE,MAAM,uBAAuB,CAAC;AACrE,YAAY,EAAE,mBAAmB,EAAE,MAAM,uBAAuB,CAAC;AACjE,OAAO,EAAE,8BAA8B,EAAE,MAAM,yBAAyB,CAAC;AACzE,OAAO,EAAE,oCAAoC,EAAE,MAAM,gCAAgC,CAAC;AACtF,OAAO,EAAE,oCAAoC,EAAE,MAAM,gCAAgC,CAAC;AACtF,OAAO,EAAE,oCAAoC,EAAE,MAAM,gCAAgC,CAAC;AACtF,OAAO,EAAE,uCAAuC,EAAE,MAAM,oCAAoC,CAAC;AAC7F,OAAO,EAAE,iCAAiC,EAAE,MAAM,6BAA6B,CAAC"}

package/dist/blueprints/index.js

@@ -23,7 +23,7 @@
  * on top when wrapping these into its tool-handler shape (a wider
  * `SharedHandler<ToolContext>` re-export).
  */
-export { createSearchBlueprintsHandler, MIN_SIMILARITY_SCORE, MANIFEST_EXACT_NAME_SCORE, MANIFEST_SUBSTRING_SCORE, } from './search-blueprints.js';
+export { createSearchBlueprintsHandler, DEFAULT_REGISTRY_SEARCH_TIMEOUT_MS, MIN_SIMILARITY_SCORE, MANIFEST_EXACT_NAME_SCORE, MANIFEST_SUBSTRING_SCORE, } from './search-blueprints.js';
 export { createListFeaturedBlueprintsHandler } from './list-featured-blueprints.js';
 export { createRenderBlueprintHandler } from './render-blueprint.js';
 export { createValidateBlueprintHandler } from './validate-blueprint.js';

package/dist/blueprints/search-blueprints.d.ts

@@ -2,8 +2,8 @@
  * ggui_search_blueprints — search across every discoverable blueprint
  * on this server.
  *
- * Two sources are consulted in parallel, then merged + de-duplicated
- * by id:
+ * Up to three sources are consulted in parallel, then merged +
+ * de-duplicated by id:
  *
  *   1. **Manifest source** (optional `BlueprintProvider`) — authored
  *      UIs declared in `ggui.json#blueprints.include`. Matched by
@@ -19,6 +19,11 @@
  *      producer that has written into the scope. Continues to honor
  *      `MIN_SIMILARITY_SCORE`.
  *
+ *   3. **Registry source** (optional, opt-in via deps.registry) —
+ *      bounded public /search call for published blueprint
+ *      candidates; appended after local hits, degrades typed on
+ *      failure.
+ *
  * When both sources return the same id (a manifest blueprint that
  * also has a cached generation), the manifest entry wins — its
  * metadata is the source of truth and its name/description don't
@@ -26,8 +31,12 @@
  * max of the two so a lexical OR semantic hit keeps the entry in
  * the top band.
  *
- * The merge stays under the `limit` request by taking the top-N
- * after sort. `total` reflects pre-trim matches.
+ * The local merge (manifest + semantic) is trimmed to the top-N
+ * after sort, so it stays within `limit`. Registry candidates are
+ * bounded by the same `limit` on their own request and append AFTER
+ * that trim rather than sharing its budget, so the final `results`
+ * count can reach up to 2×`limit`. `total` reflects the pre-trim
+ * local match count plus the appended registry count.
  *
  * ## Why merge vs. a dedicated tool
  *
@@ -38,8 +47,8 @@
  * the split the server already knows how to make.
  *
  * Pure over `@ggui-ai/mcp-server-core`'s seams. No AWS imports. No
- * config loading. The hosted server's logger wrapper decorates this
- * when composing.
+ * config loading. A composing host may wrap this with its own
+ * logging when assembling the server.
  */
 import { z } from 'zod';
 import type { BlueprintProvider, EmbeddingProvider, VectorStore } from '@ggui-ai/mcp-server-core';
@@ -65,6 +74,30 @@ export declare const MANIFEST_EXACT_NAME_SCORE = 1;
  * stronger signal.
  */
 export declare const MANIFEST_SUBSTRING_SCORE = 0.7;
+/**
+ * Default budget for the registry `/search` round-trip. The registry
+ * source is advisory — a slow registry must never stall the local
+ * sources past this bound. Operator-overridable per-deps.
+ */
+export declare const DEFAULT_REGISTRY_SEARCH_TIMEOUT_MS = 3000;
+/**
+ * Registry-backed discovery source configuration. Presence of this
+ * object on `SearchBlueprintsDeps` ACTIVATES the source (opt-in —
+ * a zero-config server never makes an outbound registry request).
+ */
+export interface SearchBlueprintsRegistrySource {
+    /**
+     * Registry host (`host[:port]`). Absent = `DEFAULT_BUNDLE_HOST`.
+     * Scheme derives via `bundleHostScheme` — http for loopback,
+     * https otherwise (the same resolution the gadget bundleHost
+     * uses).
+     */
+    readonly host?: string;
+    /** Fetch budget in ms. Default `DEFAULT_REGISTRY_SEARCH_TIMEOUT_MS`. */
+    readonly timeoutMs?: number;
+    /** Injectable fetch for tests. Defaults to the global fetch. */
+    readonly fetch?: typeof fetch;
+}
 export interface SearchBlueprintsDeps {
     readonly embedding: EmbeddingProvider;
     readonly vectors: VectorStore;
@@ -74,29 +107,48 @@ export interface SearchBlueprintsDeps {
      * included in the search results alongside the semantic
      * `VectorStore` matches.
      *
-     * Omitted = semantic-only behavior (the pre-merge default). The
-     * hosted server historically ran without a manifest provider on
-     * this handler; OSS `createGguiServer` constructs a
-     * `ManifestBlueprintProvider` at boot and threads it through.
+     * Omitted = semantic-only behavior (the pre-merge default) — a
+     * composing host can run without a manifest provider bound to this
+     * handler. This package's own `createGguiServer` constructs a
+     * `ManifestBlueprintProvider` at boot and threads it through by
+     * default.
      */
     readonly blueprints?: BlueprintProvider;
+    /**
+     * Optional registry discovery source. When bound, the handler
+     * queries the registry's public `/search` for published blueprint
+     * candidates and appends them after the local sources. Omitted =
+     * no outbound registry traffic (the zero-config default).
+     */
+    readonly registry?: SearchBlueprintsRegistrySource;
 }
 declare const inputSchema: {
     readonly query: z.ZodString;
     readonly limit: z.ZodOptional<z.ZodNumber>;
+    readonly tool: z.ZodOptional<z.ZodString>;
+    readonly server: z.ZodOptional<z.ZodString>;
 };
 declare const outputSchema: {
     results: z.ZodArray<z.ZodRecord<z.ZodString, z.ZodUnknown>>;
     total: z.ZodNumber;
     query: z.ZodString;
+    degradedSources: z.ZodOptional<z.ZodArray<z.ZodObject<{
+        source: z.ZodLiteral<"registry">;
+        reason: z.ZodEnum<{
+            unreachable: "unreachable";
+            timeout: "timeout";
+            invalid_response: "invalid_response";
+        }>;
+    }, z.core.$strip>>>;
 };
 /**
  * Build a search-blueprints handler bound to concrete `embedding` +
  * `vectors` implementations (required) + an optional manifest
  * `BlueprintProvider`. Tests inject in-memory fakes from
  * `@ggui-ai/mcp-server-core/in-memory`; production hosts bind to
- * AWS Bedrock + S3 Vectors for the semantic source and a
- * `ManifestBlueprintProvider` for the manifest source.
+ * their own operator-configured embedding + vector-store providers
+ * for the semantic source and a `ManifestBlueprintProvider` for the
+ * manifest source.
  */
 export declare function createSearchBlueprintsHandler(deps: SearchBlueprintsDeps): SharedHandler<typeof inputSchema, typeof outputSchema, GguiSearchBlueprintsOutput>;
 export {};

package/dist/blueprints/search-blueprints.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"search-blueprints.d.ts","sourceRoot":"","sources":["../../src/blueprints/search-blueprints.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA0CG;AACH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,KAAK,EAEV,iBAAiB,EACjB,iBAAiB,EACjB,WAAW,EACZ,MAAM,0BAA0B,CAAC;AAClC,OAAO,EAGL,KAAK,0BAA0B,EAChC,MAAM,mBAAmB,CAAC;AAC3B,OAAO,KAAK,EAAkB,aAAa,EAAE,MAAM,aAAa,CAAC;AAEjE;;;GAGG;AACH,eAAO,MAAM,oBAAoB,MAAM,CAAC;AAExC;;;;GAIG;AACH,eAAO,MAAM,yBAAyB,IAAM,CAAC;AAE7C;;;;;;;GAOG;AACH,eAAO,MAAM,wBAAwB,MAAM,CAAC;AAE5C,MAAM,WAAW,oBAAoB;IACnC,QAAQ,CAAC,SAAS,EAAE,iBAAiB,CAAC;IACtC,QAAQ,CAAC,OAAO,EAAE,WAAW,CAAC;IAC9B;;;;;;;;;;OAUG;IACH,QAAQ,CAAC,UAAU,CAAC,EAAE,iBAAiB,CAAC;CACzC;AAID,QAAA,MAAM,WAAW;;;CAA6B,CAAC;AAE/C,QAAA,MAAM,YAAY;;;;CAUjB,CAAC;AAKF;;;;;;;GAOG;AACH,wBAAgB,6BAA6B,CAC3C,IAAI,EAAE,oBAAoB,GACzB,aAAa,CAAC,OAAO,WAAW,EAAE,OAAO,YAAY,EAAE,0BAA0B,CAAC,CA4CpF"}
+{"version":3,"file":"search-blueprints.d.ts","sourceRoot":"","sources":["../../src/blueprints/search-blueprints.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAmDG;AACH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,KAAK,EAEV,iBAAiB,EACjB,iBAAiB,EACjB,WAAW,EACZ,MAAM,0BAA0B,CAAC;AAClC,OAAO,EAKL,KAAK,0BAA0B,EAChC,MAAM,mBAAmB,CAAC;AAC3B,OAAO,KAAK,EAAkB,aAAa,EAAE,MAAM,aAAa,CAAC;AAEjE;;;GAGG;AACH,eAAO,MAAM,oBAAoB,MAAM,CAAC;AAExC;;;;GAIG;AACH,eAAO,MAAM,yBAAyB,IAAM,CAAC;AAE7C;;;;;;;GAOG;AACH,eAAO,MAAM,wBAAwB,MAAM,CAAC;AAE5C;;;;GAIG;AACH,eAAO,MAAM,kCAAkC,OAAO,CAAC;AAEvD;;;;GAIG;AACH,MAAM,WAAW,8BAA8B;IAC7C;;;;;OAKG;IACH,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC;IACvB,wEAAwE;IACxE,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC;IAC5B,gEAAgE;IAChE,QAAQ,CAAC,KAAK,CAAC,EAAE,OAAO,KAAK,CAAC;CAC/B;AAED,MAAM,WAAW,oBAAoB;IACnC,QAAQ,CAAC,SAAS,EAAE,iBAAiB,CAAC;IACtC,QAAQ,CAAC,OAAO,EAAE,WAAW,CAAC;IAC9B;;;;;;;;;;;OAWG;IACH,QAAQ,CAAC,UAAU,CAAC,EAAE,iBAAiB,CAAC;IACxC;;;;;OAKG;IACH,QAAQ,CAAC,QAAQ,CAAC,EAAE,8BAA8B,CAAC;CACpD;AAID,QAAA,MAAM,WAAW;;;;;CAA6B,CAAC;AAE/C,QAAA,MAAM,YAAY;;;;;;;;;;;;CAkBjB,CAAC;AAKF;;;;;;;;GAQG;AACH,wBAAgB,6BAA6B,CAC3C,IAAI,EAAE,oBAAoB,GACzB,aAAa,CAAC,OAAO,WAAW,EAAE,OAAO,YAAY,EAAE,0BAA0B,CAAC,CAyDpF"}

package/dist/blueprints/search-blueprints.js

@@ -2,8 +2,8 @@
  * ggui_search_blueprints — search across every discoverable blueprint
  * on this server.
  *
- * Two sources are consulted in parallel, then merged + de-duplicated
- * by id:
+ * Up to three sources are consulted in parallel, then merged +
+ * de-duplicated by id:
  *
  *   1. **Manifest source** (optional `BlueprintProvider`) — authored
  *      UIs declared in `ggui.json#blueprints.include`. Matched by
@@ -19,6 +19,11 @@
  *      producer that has written into the scope. Continues to honor
  *      `MIN_SIMILARITY_SCORE`.
  *
+ *   3. **Registry source** (optional, opt-in via deps.registry) —
+ *      bounded public /search call for published blueprint
+ *      candidates; appended after local hits, degrades typed on
+ *      failure.
+ *
  * When both sources return the same id (a manifest blueprint that
  * also has a cached generation), the manifest entry wins — its
  * metadata is the source of truth and its name/description don't
@@ -26,8 +31,12 @@
  * max of the two so a lexical OR semantic hit keeps the entry in
  * the top band.
  *
- * The merge stays under the `limit` request by taking the top-N
- * after sort. `total` reflects pre-trim matches.
+ * The local merge (manifest + semantic) is trimmed to the top-N
+ * after sort, so it stays within `limit`. Registry candidates are
+ * bounded by the same `limit` on their own request and append AFTER
+ * that trim rather than sharing its budget, so the final `results`
+ * count can reach up to 2×`limit`. `total` reflects the pre-trim
+ * local match count plus the appended registry count.
  *
  * ## Why merge vs. a dedicated tool
  *
@@ -38,11 +47,11 @@
  * the split the server already knows how to make.
  *
  * Pure over `@ggui-ai/mcp-server-core`'s seams. No AWS imports. No
- * config loading. The hosted server's logger wrapper decorates this
- * when composing.
+ * config loading. A composing host may wrap this with its own
+ * logging when assembling the server.
  */
 import { z } from 'zod';
-import { flatToBlueprintSource, searchBlueprintsInputShape, } from '@ggui-ai/protocol';
+import { bundleHostScheme, DEFAULT_BUNDLE_HOST, flatToBlueprintSource, searchBlueprintsInputShape, } from '@ggui-ai/protocol';
 /**
  * Matches the hosted `MIN_SIMILARITY_SCORE`. Below this is noise —
  * callers that want stricter matching post-filter by `score`.
@@ -63,6 +72,12 @@ export const MANIFEST_EXACT_NAME_SCORE = 1.0;
  * stronger signal.
  */
 export const MANIFEST_SUBSTRING_SCORE = 0.7;
+/**
+ * Default budget for the registry `/search` round-trip. The registry
+ * source is advisory — a slow registry must never stall the local
+ * sources past this bound. Operator-overridable per-deps.
+ */
+export const DEFAULT_REGISTRY_SEARCH_TIMEOUT_MS = 3000;
 // Canonical SSoT shape — authored once in `@ggui-ai/protocol`
 // (`schemas/mcp.ts`).
 const inputSchema = searchBlueprintsInputShape;
@@ -76,32 +91,42 @@ const outputSchema = {
     results: z.array(z.record(z.string(), z.unknown())),
     total: z.number().int().nonnegative(),
     query: z.string(),
+    degradedSources: z
+        .array(z.object({
+        source: z.literal('registry'),
+        reason: z.enum(['unreachable', 'timeout', 'invalid_response']),
+    }))
+        .optional(),
 };
 /**
  * Build a search-blueprints handler bound to concrete `embedding` +
  * `vectors` implementations (required) + an optional manifest
  * `BlueprintProvider`. Tests inject in-memory fakes from
  * `@ggui-ai/mcp-server-core/in-memory`; production hosts bind to
- * AWS Bedrock + S3 Vectors for the semantic source and a
- * `ManifestBlueprintProvider` for the manifest source.
+ * their own operator-configured embedding + vector-store providers
+ * for the semantic source and a `ManifestBlueprintProvider` for the
+ * manifest source.
  */
 export function createSearchBlueprintsHandler(deps) {
     return {
         name: 'ggui_search_blueprints',
         title: 'Search blueprints',
         audience: ['agent'],
-        description: "Search this app's blueprints — both manifest-declared UIs (ggui.json#blueprints.include) and any previously cached generations. Matches by name/description against the manifest source and by cosine similarity against the semantic vector index. Returns entries ordered by score (descending). The agent can decide to reuse a match or generate from scratch.",
+        description: "Search this app's blueprints — manifest-declared UIs (ggui.json#blueprints.include), previously cached generations, and, when a registry is configured, published blueprint candidates from the artifact registry. Local sources match by name/description and cosine similarity; registry candidates are advisory matches appended after local results, labeled origin 'registry'. Optional tool/server filters narrow registry candidates to artifacts declaring those MCP tool bindings. The agent can decide to reuse a match or generate from scratch; installing a registry candidate remains a human/operator act.",
         inputSchema,
         outputSchema,
         async handler(rawInput, ctx) {
-            const { query, limit = 10 } = z.object(inputSchema).parse(rawInput);
-            // Fan out both sources in parallel. The manifest source is a
+            const { query, limit = 10, tool, server } = z
+                .object(inputSchema)
+                .parse(rawInput);
+            // Fan out all sources in parallel. The manifest source is a
             // pure metadata read (cheap); the semantic source is one
-            // `embed` + one `query` round-trip. Running them concurrently
-            // keeps handler latency close to the slower of the two.
-            const [semantic, manifest] = await Promise.all([
+            // `embed` + one `query` round-trip; the registry source is a
+            // bounded HTTP call that degrades typed instead of throwing.
+            const [semantic, manifest, registry] = await Promise.all([
                 searchSemantic(deps, ctx.appId, query, limit),
                 searchManifest(deps.blueprints, query, limit),
+                searchRegistry(deps.registry, { query, tool, server, limit }, ctx.signal),
             ]);
             // Merge + dedupe by id. Manifest entries win on collision —
             // their metadata is author-curated and cannot drift against a
@@ -117,7 +142,15 @@ export function createSearchBlueprintsHandler(deps) {
             }
             const merged = Array.from(byId.values()).sort((a, b) => b.score - a.score);
             const trimmed = merged.slice(0, limit);
-            return { results: trimmed, total: merged.length, query };
+            // Registry candidates append AFTER the local sources (advisory
+            // per the discovery design §3) and never displace a local id.
+            const registryHits = registry.hits.filter((hit) => !byId.has(hit.id));
+            return {
+                results: [...trimmed, ...registryHits],
+                total: merged.length + registryHits.length,
+                query,
+                ...(registry.degraded ? { degradedSources: [registry.degraded] } : {}),
+            };
         },
     };
 }
@@ -222,3 +255,120 @@ function toManifestHit(entry, queryLower) {
 function asString(value) {
     return typeof value === 'string' ? value : '';
 }
+/**
+ * Wire subset of the registry `GET /search` response this handler
+ * consumes. Local on purpose: this package does not depend on the
+ * registry server implementation, and zod's default strip semantics
+ * keep the guard forward-compatible with response additions.
+ */
+const registrySearchEntrySchema = z.object({
+    artifactId: z.string().min(1),
+    latestVersion: z.string().min(1),
+    kind: z.string(),
+    description: z.string().optional(),
+    mcpTools: z.array(z.object({ server: z.string().optional(), tool: z.string() })).optional(),
+    scopeVerification: z.enum(['verified', 'unverified']).optional(),
+});
+const registrySearchResponseSchema = z.object({
+    results: z.array(registrySearchEntrySchema),
+});
+/**
+ * Registry-source branch: bounded public `/search` call. Inactive
+ * (empty hits, no degradation) when no registry source is
+ * configured. Never throws — every failure mode maps onto the typed
+ * `degraded` indication so the merged tool result always succeeds.
+ */
+async function searchRegistry(registry, filters, signal) {
+    if (!registry)
+        return { hits: [] };
+    // Operator-override-then-default host resolution — the same
+    // precedence + scheme rule as gadget bundleHost (`DEFAULT_BUNDLE_HOST`
+    // + `bundleHostScheme` from `@ggui-ai/protocol`).
+    const host = typeof registry.host === 'string' && registry.host.length > 0
+        ? registry.host
+        : DEFAULT_BUNDLE_HOST;
+    const params = new URLSearchParams();
+    params.set('q', filters.query);
+    // This tool's kind scope is blueprints; gadget discovery is served
+    // by the registry HTTP surface directly.
+    params.set('kind', 'blueprint');
+    if (filters.tool !== undefined)
+        params.set('tool', filters.tool);
+    if (filters.server !== undefined)
+        params.set('server', filters.server);
+    params.set('limit', String(filters.limit));
+    const url = `${bundleHostScheme(host)}://${host}/search?${params.toString()}`;
+    const timeoutMs = registry.timeoutMs ?? DEFAULT_REGISTRY_SEARCH_TIMEOUT_MS;
+    const signals = [AbortSignal.timeout(timeoutMs)];
+    if (signal)
+        signals.push(signal);
+    const fetchImpl = registry.fetch ?? fetch;
+    let res;
+    try {
+        res = await fetchImpl(url, {
+            method: 'GET',
+            headers: { accept: 'application/json' },
+            signal: AbortSignal.any(signals),
+        });
+    }
+    catch (err) {
+        const reason = err instanceof Error && err.name === 'TimeoutError' ? 'timeout' : 'unreachable';
+        return { hits: [], degraded: { source: 'registry', reason } };
+    }
+    if (!res.ok) {
+        // Undici doesn't return the socket to the pool until the body is
+        // consumed or canceled. We never read this body (non-2xx), so
+        // cancel it explicitly — a rejecting cancel() must still surface
+        // the already-typed degradation, not throw past this branch.
+        try {
+            await res.body?.cancel();
+        }
+        catch {
+            // Deliberately swallowed — see comment above.
+        }
+        return {
+            hits: [],
+            degraded: { source: 'registry', reason: 'invalid_response' },
+        };
+    }
+    let body;
+    try {
+        body = await res.json();
+    }
+    catch {
+        return {
+            hits: [],
+            degraded: { source: 'registry', reason: 'invalid_response' },
+        };
+    }
+    const parsed = registrySearchResponseSchema.safeParse(body);
+    if (!parsed.success) {
+        return {
+            hits: [],
+            degraded: { source: 'registry', reason: 'invalid_response' },
+        };
+    }
+    return { hits: parsed.data.results.map(toRegistryHit) };
+}
+function toRegistryHit(entry) {
+    return {
+        id: `${entry.artifactId}@${entry.latestVersion}`,
+        name: entry.artifactId,
+        description: entry.description ?? '',
+        category: entry.kind,
+        // Registry search rows carry no contract details — honest empties.
+        props: [],
+        callbacks: [],
+        featured: false,
+        relevance: 'match',
+        // The registry source computes no similarity. Entries always
+        // append AFTER the score-sorted local sources, so this value
+        // carries no ranking weight; 0 is the honest "not measured".
+        score: 0,
+        origin: 'registry',
+        artifactId: entry.artifactId,
+        version: entry.latestVersion,
+        ...(entry.mcpTools ? { mcpTools: entry.mcpTools } : {}),
+        ...(entry.scopeVerification ? { scopeVerification: entry.scopeVerification } : {}),
+    };
+}

package/dist/renders/code-delivery-events.d.ts

@@ -1,31 +1,27 @@
 /**
  * Named events for the content-addressable code-delivery channel.
  *
- * `codeUrl` is the only STATIC delivery surface a COMPILED-COMPONENT
- * envelope has. Nothing sits behind it: a bootstrap mounts on
- * `codeUrl`, on a system-card `kind`, or on the live trio (`wsUrl` +
- * `wsToken`); `kind` is static too, but it belongs to system cards,
- * which never reach this channel. An envelope carrying none of the
- * three reads to a host as "not a mountable ggui render". So a failed
- * `codeUrl` mint is not absorbed by a second static channel; what
- * happens next is deployment-shaped:
+ * `codeUrl` is the CACHE-ADDRESSABLE static delivery surface of a
+ * COMPILED-COMPONENT envelope — since #471 it is no longer the only
+ * static one: `deriveRenderMeta` also stamps the size-capped inline
+ * `codeB64` twin, independent of this channel's store. A failed
+ * `codeUrl` mint therefore usually IS absorbed by the inline channel;
+ * what it still costs is deployment-shaped:
  *
- *   - A deployment that mints live-channel credentials still mounts.
- *     The slice keeps `wsUrl` + `wsToken`, the iframe subscribes, and
- *     the WS delivers the render body. The cost is the
- *     zero-round-trip first paint, not the render.
- *   - A host that resolves the render's `resourceUri` re-mints
- *     `codeUrl` against the same store at READ time, so a transient
- *     fault costs it nothing and a persistent one surfaces there as a
- *     read error rather than a blank card.
- *   - A deployment with neither loses the mount for that one
- *     envelope.
+ *   - Every under-cap compiled render keeps mounting via `codeB64`
+ *     (and, when minted, the live trio). The loss is the browser-
+ *     cacheable content-addressable URL — repeat renders of the same
+ *     bytes re-ship them inline instead of hitting HTTP cache.
+ *   - An OVER-CAP render (no `codeB64`) falls back to exactly the
+ *     pre-#471 posture: live trio mounts it; a host that resolves
+ *     `resourceUri` re-mints `codeUrl` at READ time; a deployment
+ *     with neither loses the mount for that one envelope.
  *
- * None of the three is distinguishable from the wire — the render
- * reports success either way — which is why the failure is emitted
- * under a name instead of swallowed. The event carries whether a live
- * channel is wired, because that is the difference between "slower
- * first paint" and "this envelope cannot mount".
+ * None of this is distinguishable from the wire — the render reports
+ * success either way — which is why the failure is emitted under a
+ * name instead of swallowed. The event carries whether a live channel
+ * is wired; combined with the render's size class it separates
+ * "slower / uncacheable delivery" from "this envelope cannot mount".
  */
 /**
  * Every event this module can emit. Closed union — a new emitter picks
@@ -33,7 +29,7 @@
  * compile error rather than an alert filter that quietly stops
  * matching.
  */
-export type CodeDeliveryEvent = 'render_code_write_failed';
+export type CodeDeliveryEvent = 'render_code_write_failed' | 'render_code_b64_over_cap';
 /**
  * The event names as values, so every emitter — in this package or a
  * storage backend elsewhere — spells them from one place.
@@ -41,10 +37,17 @@ export type CodeDeliveryEvent = 'render_code_write_failed';
 export declare const CODE_DELIVERY_EVENTS: {
     /**
      * The `codeUrl` mint failed for a render envelope. That envelope
-     * carries no static delivery channel; see the module docstring for
-     * what survives.
+     * loses the cache-addressable static channel; see the module
+     * docstring for what survives.
      */
     readonly renderCodeWriteFailed: "render_code_write_failed";
+    /**
+     * A compiled render's source exceeded the inline `codeB64` cap, so
+     * the slice was emitted WITHOUT the fetch-free channel. On hosts
+     * whose iframe CSP blocks fetches AND WebSockets, that render
+     * cannot paint — the omission must be visible, not silent.
+     */
+    readonly renderCodeB64OverCap: "render_code_b64_over_cap";
 };
 /**
  * What an emitter knows at the point the mint failed.
@@ -58,9 +61,11 @@ export interface RenderCodeWriteFailure {
      * Whether this deployment mints live-channel credentials.
      *
      * `true` ⇒ the render still mounts over the WS subscribe; the loss
-     * is the instant first paint. `false` ⇒ this envelope has no mount
-     * mode at all, and only a host that resolves `resourceUri` will
-     * still produce a card.
+     * is the instant first paint. `false` ⇒ the envelope mounts only
+     * through the inline `codeB64` channel (present for every under-cap
+     * compiled render, independent of this store); an OVER-CAP render
+     * with `false` here truly has no mount mode, and only a host that
+     * resolves `resourceUri` will still produce a card.
      */
     readonly liveChannelWired: boolean;
     /** Whatever the store threw. Unshaped by construction. */
@@ -73,4 +78,15 @@ export interface RenderCodeWriteFailure {
  * committed must not fail because its delivery-channel telemetry did.
  */
 export declare function reportRenderCodeWriteFailed(failure: RenderCodeWriteFailure): void;
+/**
+ * Emit {@link CODE_DELIVERY_EVENTS.renderCodeB64OverCap}.
+ *
+ * Never throws — same posture as the write-failure emitter above.
+ */
+export declare function reportRenderCodeB64OverCap(over: {
+    readonly sessionId: string;
+    readonly appId: string;
+    /** UTF-8 byte length of the compiled source that exceeded the cap. */
+    readonly sourceBytes: number;
+}): void;
 //# sourceMappingURL=code-delivery-events.d.ts.map

package/dist/renders/code-delivery-events.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"code-delivery-events.d.ts","sourceRoot":"","sources":["../../src/renders/code-delivery-events.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AAEH;;;;;GAKG;AACH,MAAM,MAAM,iBAAiB,GAAG,0BAA0B,CAAC;AAE3D;;;GAGG;AACH,eAAO,MAAM,oBAAoB;IAC/B;;;;OAIG;;CAEiD,CAAC;AAEvD;;GAEG;AACH,MAAM,WAAW,sBAAsB;IACrC,qDAAqD;IACrD,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,sEAAsE;IACtE,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB;;;;;;;OAOG;IACH,QAAQ,CAAC,gBAAgB,EAAE,OAAO,CAAC;IACnC,0DAA0D;IAC1D,QAAQ,CAAC,KAAK,EAAE,OAAO,CAAC;CACzB;AAED;;;;;GAKG;AACH,wBAAgB,2BAA2B,CACzC,OAAO,EAAE,sBAAsB,GAC9B,IAAI,CAgBN"}
+{"version":3,"file":"code-delivery-events.d.ts","sourceRoot":"","sources":["../../src/renders/code-delivery-events.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AAEH;;;;;GAKG;AACH,MAAM,MAAM,iBAAiB,GACzB,0BAA0B,GAC1B,0BAA0B,CAAC;AAE/B;;;GAGG;AACH,eAAO,MAAM,oBAAoB;IAC/B;;;;OAIG;;IAEH;;;;;OAKG;;CAEiD,CAAC;AAEvD;;GAEG;AACH,MAAM,WAAW,sBAAsB;IACrC,qDAAqD;IACrD,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,sEAAsE;IACtE,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB;;;;;;;;;OASG;IACH,QAAQ,CAAC,gBAAgB,EAAE,OAAO,CAAC;IACnC,0DAA0D;IAC1D,QAAQ,CAAC,KAAK,EAAE,OAAO,CAAC;CACzB;AAED;;;;;GAKG;AACH,wBAAgB,2BAA2B,CACzC,OAAO,EAAE,sBAAsB,GAC9B,IAAI,CAgBN;AAED;;;;GAIG;AACH,wBAAgB,0BAA0B,CAAC,IAAI,EAAE;IAC/C,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,sEAAsE;IACtE,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;CAC9B,GAAG,IAAI,CAUP"}

package/dist/renders/code-delivery-events.js

@@ -1,31 +1,27 @@
 /**
  * Named events for the content-addressable code-delivery channel.
  *
- * `codeUrl` is the only STATIC delivery surface a COMPILED-COMPONENT
- * envelope has. Nothing sits behind it: a bootstrap mounts on
- * `codeUrl`, on a system-card `kind`, or on the live trio (`wsUrl` +
- * `wsToken`); `kind` is static too, but it belongs to system cards,
- * which never reach this channel. An envelope carrying none of the
- * three reads to a host as "not a mountable ggui render". So a failed
- * `codeUrl` mint is not absorbed by a second static channel; what
- * happens next is deployment-shaped:
+ * `codeUrl` is the CACHE-ADDRESSABLE static delivery surface of a
+ * COMPILED-COMPONENT envelope — since #471 it is no longer the only
+ * static one: `deriveRenderMeta` also stamps the size-capped inline
+ * `codeB64` twin, independent of this channel's store. A failed
+ * `codeUrl` mint therefore usually IS absorbed by the inline channel;
+ * what it still costs is deployment-shaped:
  *
- *   - A deployment that mints live-channel credentials still mounts.
- *     The slice keeps `wsUrl` + `wsToken`, the iframe subscribes, and
- *     the WS delivers the render body. The cost is the
- *     zero-round-trip first paint, not the render.
- *   - A host that resolves the render's `resourceUri` re-mints
- *     `codeUrl` against the same store at READ time, so a transient
- *     fault costs it nothing and a persistent one surfaces there as a
- *     read error rather than a blank card.
- *   - A deployment with neither loses the mount for that one
- *     envelope.
+ *   - Every under-cap compiled render keeps mounting via `codeB64`
+ *     (and, when minted, the live trio). The loss is the browser-
+ *     cacheable content-addressable URL — repeat renders of the same
+ *     bytes re-ship them inline instead of hitting HTTP cache.
+ *   - An OVER-CAP render (no `codeB64`) falls back to exactly the
+ *     pre-#471 posture: live trio mounts it; a host that resolves
+ *     `resourceUri` re-mints `codeUrl` at READ time; a deployment
+ *     with neither loses the mount for that one envelope.
  *
- * None of the three is distinguishable from the wire — the render
- * reports success either way — which is why the failure is emitted
- * under a name instead of swallowed. The event carries whether a live
- * channel is wired, because that is the difference between "slower
- * first paint" and "this envelope cannot mount".
+ * None of this is distinguishable from the wire — the render reports
+ * success either way — which is why the failure is emitted under a
+ * name instead of swallowed. The event carries whether a live channel
+ * is wired; combined with the render's size class it separates
+ * "slower / uncacheable delivery" from "this envelope cannot mount".
  */
 /**
  * The event names as values, so every emitter — in this package or a
@@ -34,10 +30,17 @@
 export const CODE_DELIVERY_EVENTS = {
     /**
      * The `codeUrl` mint failed for a render envelope. That envelope
-     * carries no static delivery channel; see the module docstring for
-     * what survives.
+     * loses the cache-addressable static channel; see the module
+     * docstring for what survives.
      */
     renderCodeWriteFailed: 'render_code_write_failed',
+    /**
+     * A compiled render's source exceeded the inline `codeB64` cap, so
+     * the slice was emitted WITHOUT the fetch-free channel. On hosts
+     * whose iframe CSP blocks fetches AND WebSockets, that render
+     * cannot paint — the omission must be visible, not silent.
+     */
+    renderCodeB64OverCap: 'render_code_b64_over_cap',
 };
 /**
  * Emit {@link CODE_DELIVERY_EVENTS.renderCodeWriteFailed}.
@@ -58,3 +61,17 @@ export function reportRenderCodeWriteFailed(failure) {
         errorName: failure.cause instanceof Error ? failure.cause.name : undefined,
     }));
 }
+/**
+ * Emit {@link CODE_DELIVERY_EVENTS.renderCodeB64OverCap}.
+ *
+ * Never throws — same posture as the write-failure emitter above.
+ */
+export function reportRenderCodeB64OverCap(over) {
+    // eslint-disable-next-line no-console -- structured single-line event for log-pipeline pickup
+    console.warn(JSON.stringify({
+        msg: CODE_DELIVERY_EVENTS.renderCodeB64OverCap,
+        sessionId: over.sessionId,
+        appId: over.appId,
+        sourceBytes: over.sourceBytes,
+    }));
+}

package/dist/renders/index.d.ts

@@ -68,7 +68,7 @@ export { buildCacheReuseResult, buildCreateFallback, decideHandshake, type Bluep
 export { installToCache, type InstallToCacheInput } from "./install-to-cache.js";
 export { createInstalledBlueprintsProvider, type CreateInstalledBlueprintsProviderOptions, type InstalledBlueprintCacheIssue, type CompileResult as InstalledBlueprintCompileResult, type InstalledBlueprintEntry, type InstalledBlueprintsProvider, } from "./installed-blueprints-provider.js";
 export { createInMemoryProvisionalPreviewRegistry, evaluateProvisionalPreviewGate, finalizeProvisionalPreview, kickoffProvisionalPreview, PreviewAbortError, PROVISIONAL_PREVIEW_CHANNEL, runProvisionalPreview, type ProvisionalPreviewConfig, type ProvisionalPreviewContext, type ProvisionalPreviewDeps, type ProvisionalPreviewEmit, type ProvisionalPreviewEmitter, type ProvisionalPreviewGate, type ProvisionalPreviewGateInput, type ProvisionalPreviewHandle, type ProvisionalPreviewOutcome, type ProvisionalPreviewRegistry, type ProvisionalPreviewRunContext, type ProvisionalPreviewSkipReason, } from "./provisional-preview.js";
-export { assembleRenderSliceBase, deriveBundleOrigins, deriveContextSlots, deriveContractBundle, derivePropsJson, derivePublicEnvProjection, deriveRenderMeta, resolveGadgetUrls, type RenderMetaView, type RenderSliceBase, type RenderSliceMetaDeps, } from "./slice-meta-derivation.js";
+export { assembleRenderSliceBase, deriveBundleOrigins, deriveContextSlots, deriveContractBundle, derivePropsJson, derivePublicEnvProjection, deriveRenderMeta, rewritePrivateBundleUrls, PRIVATE_BUNDLE_PREFIX, resolveGadgetUrls, type RenderMetaView, type RenderSliceBase, type RenderSliceMetaDeps, } from "./slice-meta-derivation.js";
 export type { SeedPoolSource } from "./seed-pool-source.js";
 export { buildSeedPool, type BuildSeedPoolOptions } from "./build-seed-pool.js";
 export { listRegistryBlueprintsForExport, type ExportableBlueprint } from './export-registry.js';

package/dist/renders/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/renders/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgCG;AACH,OAAO,EACL,qBAAqB,EACrB,KAAK,0BAA0B,EAC/B,KAAK,2BAA2B,EAChC,KAAK,iBAAiB,GACvB,MAAM,+BAA+B,CAAC;AACvC,OAAO,EAAE,oBAAoB,EAAE,MAAM,6BAA6B,CAAC;AACnE,OAAO,EACL,6BAA6B,EAC7B,yBAAyB,GAC1B,MAAM,wCAAwC,CAAC;AAChD,OAAO,EACL,uBAAuB,EACvB,2BAA2B,EAC3B,yBAAyB,EACzB,wBAAwB,EACxB,0BAA0B,EAC1B,KAAK,oBAAoB,EACzB,KAAK,qBAAqB,GAC3B,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EAAE,qBAAqB,EAAE,MAAM,uBAAuB,CAAC;AAC9D,OAAO,EAAE,mBAAmB,EAAE,MAAM,4BAA4B,CAAC;AACjE,OAAO,EACL,wBAAwB,EACxB,uBAAuB,EACvB,2BAA2B,EAC3B,KAAK,kBAAkB,GACxB,MAAM,wBAAwB,CAAC;AAChC,OAAO,EAAE,oBAAoB,EAAE,MAAM,6BAA6B,CAAC;AACnE,OAAO,EACL,4BAA4B,EAC5B,sBAAsB,EACtB,0BAA0B,EAC1B,mBAAmB,EACnB,iBAAiB,EACjB,eAAe,EACf,iBAAiB,EACjB,wBAAwB,EACxB,KAAK,mBAAmB,EACxB,KAAK,kBAAkB,EACvB,KAAK,eAAe,EACpB,KAAK,cAAc,EACnB,KAAK,0BAA0B,GAChC,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EACL,wBAAwB,EACxB,KAAK,aAAa,EAClB,KAAK,gBAAgB,EACrB,KAAK,sBAAsB,EAC3B,KAAK,gBAAgB,GACtB,MAAM,cAAc,CAAC;AACtB,OAAO,EACL,wBAAwB,EACxB,KAAK,mBAAmB,GACzB,MAAM,iCAAiC,CAAC;AACzC,OAAO,EACL,qBAAqB,EACrB,KAAK,SAAS,EACd,KAAK,aAAa,EAClB,KAAK,gBAAgB,GACtB,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EACL,mCAAmC,EACnC,KAAK,0BAA0B,GAChC,MAAM,2BAA2B,CAAC;AACnC,OAAO,EACL,gCAAgC,EAChC,KAAK,wBAAwB,GAC9B,MAAM,kCAAkC,CAAC;AAC1C,OAAO,EAAE,uBAAuB,EAAE,oBAAoB,EAAE,wBAAwB,EAAE,MAAM,aAAa,CAAC;AACtG,OAAO,EACL,oBAAoB,EACpB,yBAAyB,EACzB,mBAAmB,EACnB,KAAK,mBAAmB,EACxB,KAAK,oBAAoB,EACzB,KAAK,kBAAkB,GACxB,MAAM,uBAAuB,CAAC;AAG/B,OAAO,EACL,2BAA2B,EAC3B,uBAAuB,EACvB,qBAAqB,EACrB,KAAK,uBAAuB,EAC5B,KAAK,wBAAwB,GAC9B,MAAM,2BAA2B,CAAC;AAKnC,OAAO,EACL,oBAAoB,EACpB,2BAA2B,EAC3B,KAAK,iBAAiB,EACtB,KAAK,sBAAsB,GAC5B,MAAM,2BAA2B,CAAC;AACnC,OAAO,EACL,2BAA2B,EAC3B,KAAK,yBAAyB,EAC9B,KAAK,yBAAyB,GAC/B,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EACL,YAAY,EACZ,KAAK,gBAAgB,EACrB,KAAK,oBAAoB,EACzB,KAAK,uBAAuB,EAC5B,KAAK,cAAc,EACnB,KAAK,kBAAkB,GACxB,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EACL,6BAA6B,EAC7B,KAAK,2BAA2B,EAChC,KAAK,sBAAsB,GAC5B,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EACL,6BAA6B,EAC7B,+BAA+B,GAChC,MAAM,0BAA0B,CAAC;AAClC,OAAO,EACL,qBAAqB,EACrB,mBAAmB,EACnB,iBAAiB,EACjB,mBAAmB,EACnB,KAAK,qBAAqB,EAC1B,KAAK,iBAAiB,EACtB,KAAK,gBAAgB,GACtB,MAAM,yBAAyB,CAAC;AACjC,OAAO,EACL,+BAA+B,EAC/B,KAAK,6BAA6B,EAClC,KAAK,wBAAwB,EAC7B,KAAK,eAAe,EACpB,KAAK,eAAe,EACpB,KAAK,kBAAkB,GACxB,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EACL,uBAAuB,EACvB,KAAK,eAAe,EACpB,KAAK,qBAAqB,EAC1B,KAAK,cAAc,EACnB,KAAK,qBAAqB,EAC1B,KAAK,0BAA0B,GAChC,MAAM,aAAa,CAAC;AACrB,OAAO,EACL,aAAa,EACb,8BAA8B,EAC9B,0BAA0B,EAC1B,kBAAkB,EAClB,oBAAoB,EACpB,mBAAmB,EACnB,kBAAkB,EAClB,6BAA6B,EAC7B,8BAA8B,EAC9B,kBAAkB,EAClB,KAAK,iBAAiB,EACtB,KAAK,sBAAsB,EAC3B,KAAK,WAAW,EAChB,KAAK,kBAAkB,EACvB,KAAK,YAAY,EACjB,KAAK,mBAAmB,EACxB,KAAK,yBAAyB,EAC9B,KAAK,iBAAiB,GACvB,MAAM,wBAAwB,CAAC;AAChC,OAAO,EACL,qBAAqB,EACrB,KAAK,mBAAmB,EACxB,KAAK,sBAAsB,GAC5B,MAAM,aAAa,CAAC;AACrB,OAAO,EAAE,6BAA6B,EAAE,MAAM,oBAAoB,CAAC;AACnE,OAAO,EACL,4BAA4B,EAC5B,KAAK,gCAAgC,GACtC,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EACL,uBAAuB,EACvB,KAAK,WAAW,EAChB,KAAK,qBAAqB,EAC1B,KAAK,mBAAmB,GACzB,MAAM,aAAa,CAAC;AAKrB,OAAO,EACL,cAAc,EACd,KAAK,iBAAiB,EACtB,KAAK,kBAAkB,EACvB,KAAK,oBAAoB,EACzB,KAAK,kBAAkB,EACvB,KAAK,qBAAqB,GAC3B,MAAM,wBAAwB,CAAC;AAChC,OAAO,EACL,sBAAsB,EACtB,qBAAqB,EACrB,eAAe,EACf,eAAe,EACf,kBAAkB,EAClB,yBAAyB,EACzB,cAAc,EACd,kBAAkB,EAClB,iBAAiB,EACjB,KAAK,SAAS,EACd,KAAK,kBAAkB,EACvB,KAAK,cAAc,EACnB,KAAK,aAAa,EAClB,KAAK,qBAAqB,EAC1B,KAAK,iBAAiB,EACtB,KAAK,sBAAsB,EAC3B,KAAK,wBAAwB,GAC9B,MAAM,yBAAyB,CAAC;AACjC,OAAO,EACL,sBAAsB,EACtB,0BAA0B,EAC1B,sBAAsB,EACtB,wBAAwB,EACxB,sBAAsB,EACtB,kBAAkB,EAClB,mBAAmB,EACnB,KAAK,wBAAwB,EAC7B,KAAK,mBAAmB,EACxB,KAAK,yBAAyB,EAC9B,KAAK,eAAe,EACpB,KAAK,oBAAoB,EACzB,KAAK,qBAAqB,GAC3B,MAAM,gBAAgB,CAAC;AACxB,OAAO,EACL,qBAAqB,EACrB,mBAAmB,EACnB,eAAe,EACf,KAAK,aAAa,EAClB,KAAK,oBAAoB,EACzB,KAAK,wBAAwB,GAC9B,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EAAE,cAAc,EAAE,KAAK,mBAAmB,EAAE,MAAM,uBAAuB,CAAC;AACjF,OAAO,EACL,iCAAiC,EACjC,KAAK,wCAAwC,EAC7C,KAAK,4BAA4B,EACjC,KAAK,aAAa,IAAI,+BAA+B,EACrD,KAAK,uBAAuB,EAC5B,KAAK,2BAA2B,GACjC,MAAM,oCAAoC,CAAC;AAC5C,OAAO,EACL,wCAAwC,EACxC,8BAA8B,EAC9B,0BAA0B,EAC1B,yBAAyB,EACzB,iBAAiB,EACjB,2BAA2B,EAC3B,qBAAqB,EACrB,KAAK,wBAAwB,EAC7B,KAAK,yBAAyB,EAC9B,KAAK,sBAAsB,EAC3B,KAAK,sBAAsB,EAC3B,KAAK,yBAAyB,EAC9B,KAAK,sBAAsB,EAC3B,KAAK,2BAA2B,EAChC,KAAK,wBAAwB,EAC7B,KAAK,yBAAyB,EAC9B,KAAK,0BAA0B,EAC/B,KAAK,4BAA4B,EACjC,KAAK,4BAA4B,GAClC,MAAM,0BAA0B,CAAC;AAOlC,OAAO,EACL,uBAAuB,EACvB,mBAAmB,EACnB,kBAAkB,EAClB,oBAAoB,EACpB,eAAe,EACf,yBAAyB,EACzB,gBAAgB,EAChB,iBAAiB,EACjB,KAAK,cAAc,EACnB,KAAK,eAAe,EACpB,KAAK,mBAAmB,GACzB,MAAM,4BAA4B,CAAC;AACpC,YAAY,EAAE,cAAc,EAAE,MAAM,uBAAuB,CAAC;AAC5D,OAAO,EAAE,aAAa,EAAE,KAAK,oBAAoB,EAAE,MAAM,sBAAsB,CAAC;AAChF,OAAO,EAAE,+BAA+B,EAAE,KAAK,mBAAmB,EAAE,MAAM,sBAAsB,CAAC;AAKjG,OAAO,EACL,sBAAsB,EACtB,KAAK,2BAA2B,EAChC,KAAK,mBAAmB,EACxB,KAAK,0BAA0B,EAC/B,KAAK,2BAA2B,EAChC,KAAK,wBAAwB,EAC7B,KAAK,8BAA8B,GACpC,MAAM,sBAAsB,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/renders/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgCG;AACH,OAAO,EACL,qBAAqB,EACrB,KAAK,0BAA0B,EAC/B,KAAK,2BAA2B,EAChC,KAAK,iBAAiB,GACvB,MAAM,+BAA+B,CAAC;AACvC,OAAO,EAAE,oBAAoB,EAAE,MAAM,6BAA6B,CAAC;AACnE,OAAO,EACL,6BAA6B,EAC7B,yBAAyB,GAC1B,MAAM,wCAAwC,CAAC;AAChD,OAAO,EACL,uBAAuB,EACvB,2BAA2B,EAC3B,yBAAyB,EACzB,wBAAwB,EACxB,0BAA0B,EAC1B,KAAK,oBAAoB,EACzB,KAAK,qBAAqB,GAC3B,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EAAE,qBAAqB,EAAE,MAAM,uBAAuB,CAAC;AAC9D,OAAO,EAAE,mBAAmB,EAAE,MAAM,4BAA4B,CAAC;AACjE,OAAO,EACL,wBAAwB,EACxB,uBAAuB,EACvB,2BAA2B,EAC3B,KAAK,kBAAkB,GACxB,MAAM,wBAAwB,CAAC;AAChC,OAAO,EAAE,oBAAoB,EAAE,MAAM,6BAA6B,CAAC;AACnE,OAAO,EACL,4BAA4B,EAC5B,sBAAsB,EACtB,0BAA0B,EAC1B,mBAAmB,EACnB,iBAAiB,EACjB,eAAe,EACf,iBAAiB,EACjB,wBAAwB,EACxB,KAAK,mBAAmB,EACxB,KAAK,kBAAkB,EACvB,KAAK,eAAe,EACpB,KAAK,cAAc,EACnB,KAAK,0BAA0B,GAChC,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EACL,wBAAwB,EACxB,KAAK,aAAa,EAClB,KAAK,gBAAgB,EACrB,KAAK,sBAAsB,EAC3B,KAAK,gBAAgB,GACtB,MAAM,cAAc,CAAC;AACtB,OAAO,EACL,wBAAwB,EACxB,KAAK,mBAAmB,GACzB,MAAM,iCAAiC,CAAC;AACzC,OAAO,EACL,qBAAqB,EACrB,KAAK,SAAS,EACd,KAAK,aAAa,EAClB,KAAK,gBAAgB,GACtB,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EACL,mCAAmC,EACnC,KAAK,0BAA0B,GAChC,MAAM,2BAA2B,CAAC;AACnC,OAAO,EACL,gCAAgC,EAChC,KAAK,wBAAwB,GAC9B,MAAM,kCAAkC,CAAC;AAC1C,OAAO,EAAE,uBAAuB,EAAE,oBAAoB,EAAE,wBAAwB,EAAE,MAAM,aAAa,CAAC;AACtG,OAAO,EACL,oBAAoB,EACpB,yBAAyB,EACzB,mBAAmB,EACnB,KAAK,mBAAmB,EACxB,KAAK,oBAAoB,EACzB,KAAK,kBAAkB,GACxB,MAAM,uBAAuB,CAAC;AAG/B,OAAO,EACL,2BAA2B,EAC3B,uBAAuB,EACvB,qBAAqB,EACrB,KAAK,uBAAuB,EAC5B,KAAK,wBAAwB,GAC9B,MAAM,2BAA2B,CAAC;AAKnC,OAAO,EACL,oBAAoB,EACpB,2BAA2B,EAC3B,KAAK,iBAAiB,EACtB,KAAK,sBAAsB,GAC5B,MAAM,2BAA2B,CAAC;AACnC,OAAO,EACL,2BAA2B,EAC3B,KAAK,yBAAyB,EAC9B,KAAK,yBAAyB,GAC/B,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EACL,YAAY,EACZ,KAAK,gBAAgB,EACrB,KAAK,oBAAoB,EACzB,KAAK,uBAAuB,EAC5B,KAAK,cAAc,EACnB,KAAK,kBAAkB,GACxB,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EACL,6BAA6B,EAC7B,KAAK,2BAA2B,EAChC,KAAK,sBAAsB,GAC5B,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EACL,6BAA6B,EAC7B,+BAA+B,GAChC,MAAM,0BAA0B,CAAC;AAClC,OAAO,EACL,qBAAqB,EACrB,mBAAmB,EACnB,iBAAiB,EACjB,mBAAmB,EACnB,KAAK,qBAAqB,EAC1B,KAAK,iBAAiB,EACtB,KAAK,gBAAgB,GACtB,MAAM,yBAAyB,CAAC;AACjC,OAAO,EACL,+BAA+B,EAC/B,KAAK,6BAA6B,EAClC,KAAK,wBAAwB,EAC7B,KAAK,eAAe,EACpB,KAAK,eAAe,EACpB,KAAK,kBAAkB,GACxB,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EACL,uBAAuB,EACvB,KAAK,eAAe,EACpB,KAAK,qBAAqB,EAC1B,KAAK,cAAc,EACnB,KAAK,qBAAqB,EAC1B,KAAK,0BAA0B,GAChC,MAAM,aAAa,CAAC;AACrB,OAAO,EACL,aAAa,EACb,8BAA8B,EAC9B,0BAA0B,EAC1B,kBAAkB,EAClB,oBAAoB,EACpB,mBAAmB,EACnB,kBAAkB,EAClB,6BAA6B,EAC7B,8BAA8B,EAC9B,kBAAkB,EAClB,KAAK,iBAAiB,EACtB,KAAK,sBAAsB,EAC3B,KAAK,WAAW,EAChB,KAAK,kBAAkB,EACvB,KAAK,YAAY,EACjB,KAAK,mBAAmB,EACxB,KAAK,yBAAyB,EAC9B,KAAK,iBAAiB,GACvB,MAAM,wBAAwB,CAAC;AAChC,OAAO,EACL,qBAAqB,EACrB,KAAK,mBAAmB,EACxB,KAAK,sBAAsB,GAC5B,MAAM,aAAa,CAAC;AACrB,OAAO,EAAE,6BAA6B,EAAE,MAAM,oBAAoB,CAAC;AACnE,OAAO,EACL,4BAA4B,EAC5B,KAAK,gCAAgC,GACtC,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EACL,uBAAuB,EACvB,KAAK,WAAW,EAChB,KAAK,qBAAqB,EAC1B,KAAK,mBAAmB,GACzB,MAAM,aAAa,CAAC;AAKrB,OAAO,EACL,cAAc,EACd,KAAK,iBAAiB,EACtB,KAAK,kBAAkB,EACvB,KAAK,oBAAoB,EACzB,KAAK,kBAAkB,EACvB,KAAK,qBAAqB,GAC3B,MAAM,wBAAwB,CAAC;AAChC,OAAO,EACL,sBAAsB,EACtB,qBAAqB,EACrB,eAAe,EACf,eAAe,EACf,kBAAkB,EAClB,yBAAyB,EACzB,cAAc,EACd,kBAAkB,EAClB,iBAAiB,EACjB,KAAK,SAAS,EACd,KAAK,kBAAkB,EACvB,KAAK,cAAc,EACnB,KAAK,aAAa,EAClB,KAAK,qBAAqB,EAC1B,KAAK,iBAAiB,EACtB,KAAK,sBAAsB,EAC3B,KAAK,wBAAwB,GAC9B,MAAM,yBAAyB,CAAC;AACjC,OAAO,EACL,sBAAsB,EACtB,0BAA0B,EAC1B,sBAAsB,EACtB,wBAAwB,EACxB,sBAAsB,EACtB,kBAAkB,EAClB,mBAAmB,EACnB,KAAK,wBAAwB,EAC7B,KAAK,mBAAmB,EACxB,KAAK,yBAAyB,EAC9B,KAAK,eAAe,EACpB,KAAK,oBAAoB,EACzB,KAAK,qBAAqB,GAC3B,MAAM,gBAAgB,CAAC;AACxB,OAAO,EACL,qBAAqB,EACrB,mBAAmB,EACnB,eAAe,EACf,KAAK,aAAa,EAClB,KAAK,oBAAoB,EACzB,KAAK,wBAAwB,GAC9B,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EAAE,cAAc,EAAE,KAAK,mBAAmB,EAAE,MAAM,uBAAuB,CAAC;AACjF,OAAO,EACL,iCAAiC,EACjC,KAAK,wCAAwC,EAC7C,KAAK,4BAA4B,EACjC,KAAK,aAAa,IAAI,+BAA+B,EACrD,KAAK,uBAAuB,EAC5B,KAAK,2BAA2B,GACjC,MAAM,oCAAoC,CAAC;AAC5C,OAAO,EACL,wCAAwC,EACxC,8BAA8B,EAC9B,0BAA0B,EAC1B,yBAAyB,EACzB,iBAAiB,EACjB,2BAA2B,EAC3B,qBAAqB,EACrB,KAAK,wBAAwB,EAC7B,KAAK,yBAAyB,EAC9B,KAAK,sBAAsB,EAC3B,KAAK,sBAAsB,EAC3B,KAAK,yBAAyB,EAC9B,KAAK,sBAAsB,EAC3B,KAAK,2BAA2B,EAChC,KAAK,wBAAwB,EAC7B,KAAK,yBAAyB,EAC9B,KAAK,0BAA0B,EAC/B,KAAK,4BAA4B,EACjC,KAAK,4BAA4B,GAClC,MAAM,0BAA0B,CAAC;AAOlC,OAAO,EACL,uBAAuB,EACvB,mBAAmB,EACnB,kBAAkB,EAClB,oBAAoB,EACpB,eAAe,EACf,yBAAyB,EACzB,gBAAgB,EAChB,wBAAwB,EACxB,qBAAqB,EACrB,iBAAiB,EACjB,KAAK,cAAc,EACnB,KAAK,eAAe,EACpB,KAAK,mBAAmB,GACzB,MAAM,4BAA4B,CAAC;AACpC,YAAY,EAAE,cAAc,EAAE,MAAM,uBAAuB,CAAC;AAC5D,OAAO,EAAE,aAAa,EAAE,KAAK,oBAAoB,EAAE,MAAM,sBAAsB,CAAC;AAChF,OAAO,EAAE,+BAA+B,EAAE,KAAK,mBAAmB,EAAE,MAAM,sBAAsB,CAAC;AAKjG,OAAO,EACL,sBAAsB,EACtB,KAAK,2BAA2B,EAChC,KAAK,mBAAmB,EACxB,KAAK,0BAA0B,EAC/B,KAAK,2BAA2B,EAChC,KAAK,wBAAwB,EAC7B,KAAK,8BAA8B,GACpC,MAAM,sBAAsB,CAAC"}

package/dist/renders/index.js

@@ -83,7 +83,7 @@ export { createInMemoryProvisionalPreviewRegistry, evaluateProvisionalPreviewGat
 // Exported so any server can run the same projections off the
 // resolved render without duplicating the actionSpec / contextSpec
 // walks.
-export { assembleRenderSliceBase, deriveBundleOrigins, deriveContextSlots, deriveContractBundle, derivePropsJson, derivePublicEnvProjection, deriveRenderMeta, resolveGadgetUrls, } from "./slice-meta-derivation.js";
+export { assembleRenderSliceBase, deriveBundleOrigins, deriveContextSlots, deriveContractBundle, derivePropsJson, derivePublicEnvProjection, deriveRenderMeta, rewritePrivateBundleUrls, PRIVATE_BUNDLE_PREFIX, resolveGadgetUrls, } from "./slice-meta-derivation.js";
 export { buildSeedPool } from "./build-seed-pool.js";
 export { listRegistryBlueprintsForExport } from './export-registry.js';
 // The render-identity event registry. Exported because storage backends

package/dist/renders/render.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"render.d.ts","sourceRoot":"","sources":["../../src/renders/render.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8CG;AAGH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAEL,KAAK,iBAAiB,EAEtB,KAAK,YAAY,EAGjB,KAAK,WAAW,EAGjB,MAAM,mBAAmB,CAAC;AAM3B,OAAO,KAAK,EACV,gBAAgB,EAChB,iBAAiB,EACjB,aAAa,EACb,YAAY,EACZ,oBAAoB,EACpB,cAAc,EACd,WAAW,EACX,mBAAmB,EACnB,gBAAgB,EAChB,cAAc,EAGd,WAAW,EACZ,MAAM,0BAA0B,CAAC;AAElC,OAAO,EAGL,KAAK,cAAc,EACnB,KAAK,cAAc,EACnB,KAAK,aAAa,EACnB,MAAM,aAAa,CAAC;AAOrB,OAAO,EAIL,KAAK,sBAAsB,EAC5B,MAAM,0BAA0B,CAAC;AAClC,OAAO,KAAK,EACV,mBAAmB,EAEpB,MAAM,uBAAuB,CAAC;AAI/B,OAAO,KAAK,EAAE,2BAA2B,EAAE,MAAM,oCAAoC,CAAC;AACtF,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,uBAAuB,CAAC;AAY3D,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,qBAAqB,CAAC;AAErD,OAAO,EAQL,KAAK,gBAAgB,EAErB,KAAK,WAAW,EAEjB,MAAM,mBAAmB,CAAC;AAQ3B,OAAO,EAML,KAAK,mBAAmB,EACzB,MAAM,4BAA4B,CAAC;AAEpC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAmCG;AACH,MAAM,WAAW,cAAc;IAC7B;+CAC2C;IAC3C,QAAQ,CAAC,WAAW,EAAE,WAAW,CAAC;IAClC;;;;;;OAMG;IACH,QAAQ,CAAC,UAAU,EAAE,CACnB,GAAG,EAAE,cAAc,KAChB,OAAO,CAAC,qBAAqB,GAAG,IAAI,CAAC,GAAG,qBAAqB,GAAG,IAAI,CAAC;IAC1E;;;;;OAKG;IACH,QAAQ,CAAC,UAAU,EAAE,iBAAiB,CAAC;IACvC;;;;;;;;;;;;;;;;;;;;;;;;;;;;OA4BG;IACH,QAAQ,CAAC,KAAK,CAAC,EAAE,mBAAmB,CAAC;IAErC;;;;;;;;;;;;OAYG;IACH,QAAQ,CAAC,SAAS,CAAC,EAAE,SAAS,aAAa,EAAE,CAAC;IAE9C;;;;;;;;OAQG;IACH,QAAQ,CAAC,gBAAgB,CAAC,EAAE,CAC1B,GAAG,EAAE,cAAc,KAChB,SAAS,GAAG,IAAI,GAAG,OAAO,CAAC,SAAS,GAAG,IAAI,CAAC,CAAC;IAElD;;;;;;;;;;;;OAYG;IACH,QAAQ,CAAC,mBAAmB,CAAC,EAAE,2BAA2B,CAAC;IAE3D;;;;;;;;;;;;;;;;;;;;;;;;;OAyBG;IACH,QAAQ,CAAC,eAAe,CAAC,EAAE,CACzB,GAAG,EAAE,cAAc,EACnB,KAAK,EAAE;QACL,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;QACxB,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;QAC3B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;KACzB,KACE,WAAW,GAAG,IAAI,GAAG,OAAO,CAAC,WAAW,GAAG,IAAI,CAAC,CAAC;CACvD;AAED;;;;GAIG;AACH,MAAM,WAAW,qBAAqB;IACpC,QAAQ,CAAC,SAAS,EAAE,YAAY,CAAC;IACjC,QAAQ,CAAC,WAAW,EAAE,cAAc,CAAC;CACtC;AAED;;;;;;;;;GASG;AACH,MAAM,WAAW,0BAA0B;IACzC,QAAQ,CAAC,GAAG,EAAE,cAAc,CAAC;IAC7B,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,gFAAgF;IAChF,QAAQ,CAAC,QAAQ,EAAE,YAAY,CAAC;IAChC,kDAAkD;IAClD,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;IAC9B;;;;;OAKG;IACH,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,sEAAsE;IACtE,QAAQ,CAAC,MAAM,EAAE,gBAAgB,CAAC,QAAQ,CAAC,CAAC;IAC5C,uDAAuD;IACvD,QAAQ,CAAC,SAAS,EAAE,OAAO,CAAC;IAC5B;;;;OAIG;IACH,QAAQ,CAAC,QAAQ,EAAE,OAAO,CAAC;CAC5B;AAED;;;;;;;;GAQG;AACH,MAAM,WAAW,qBAAsB,SAAQ,mBAAmB;IAChE,2EAA2E;IAC3E,QAAQ,CAAC,WAAW,EAAE,gBAAgB,CAAC;IACvC;;;;;;;OAOG;IACH,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAC;IAC9B;;;;;;;;;;;;;OAaG;IACH,QAAQ,CAAC,gBAAgB,CAAC,EAAE,gBAAgB,CAAC;IAC7C;;;;;;;;;OASG;IACH,QAAQ,CAAC,oBAAoB,CAAC,EAAE,oBAAoB,CAAC;IAIrD;;;;;;;;;;;;;;;;;;;OAmBG;IACH,QAAQ,CAAC,yBAAyB,CAAC,EAAE,MAAM,SAAS,MAAM,EAAE,GAAG,SAAS,CAAC;IAEzE;;;;;;OAMG;IACH,QAAQ,CAAC,kBAAkB,CAAC,EAAE,sBAAsB,CAAC;IAErD;;;;;;;;;;;;;;;;;;;;;;OAsBG;IACH,QAAQ,CAAC,WAAW,CAAC,EAAE,WAAW,CAAC;IAEnC;;;;;;;;;;;;;OAaG;IACH,QAAQ,CAAC,cAAc,CAAC,EAAE,cAAc,CAAC;IAEzC;;;;;;;;;;;;;;;;;OAiBG;IACH,QAAQ,CAAC,mBAAmB,CAAC,EAAE,mBAAmB,CAAC;IAEnD;;;;;;;;;;;;;OAaG;IACH,QAAQ,CAAC,cAAc,CAAC,EAAE,aAAa,CAAC;IAExC;;;;;;;;;;;;;;;;;;;OAmBG;IACH,QAAQ,CAAC,UAAU,CAAC,EAAE,cAAc,CAAC;IAErC;;;;;;;;;;;;;;;;;;;;;;;;;;;;OA4BG;IACH,QAAQ,CAAC,oBAAoB,CAAC,EAAE,CAC9B,KAAK,EAAE;QACL,QAAQ,CAAC,UAAU,CAAC,EAAE,OAAO,mBAAmB,EAAE,UAAU,CAAC;QAC7D,QAAQ,CAAC,UAAU,CAAC,EAAE,OAAO,mBAAmB,EAAE,UAAU,CAAC;QAC7D,QAAQ,CAAC,iBAAiB,CAAC,EAAE;YAAE,QAAQ,CAAC,KAAK,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAA;SAAE,CAAC;KACrF,KACE,IAAI,CAAC;IAEV;;;;;;;;;;;;;;;;;;;;;;;OAuBG;IACH,QAAQ,CAAC,eAAe,CAAC,EAAE,eAAe,CAAC;IAE3C;;;;;;;;;OASG;IACH,QAAQ,CAAC,gBAAgB,CAAC,EAAE,OAAO,gBAAgB,EAAE,oBAAoB,CAAC;IAE1E;;;;;;;;;;;;;;;;;;;;;;;;;;OA0BG;IACH,QAAQ,CAAC,SAAS,CAAC,EAAE,OAAO,0BAA0B,EAAE,SAAS,CAAC;IAElE;;;;;;;;;OASG;IACH,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAC;IAE9B;;;;;;;;;;;;;;OAcG;IACH,QAAQ,CAAC,iBAAiB,CAAC,EAAE,CAC3B,GAAG,EAAE,cAAc,EACnB,QAAQ,EAAE,OAAO,KACd,OAAO,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC;IAE1B;;;;;;;;;;;;;;;OAeG;IACH,QAAQ,CAAC,eAAe,CAAC,EAAE,CACzB,IAAI,EAAE,0BAA0B,KAC7B,OAAO,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC;IAE1B;;;;;;;;;;;;;;;;;;;;OAoBG;IACH,QAAQ,CAAC,SAAS,CAAC,EAAE,CACnB,KAAK,EAAE,IAAI,CACT,OAAO,0BAA0B,EAAE,eAAe,EAClD,KAAK,GAAG,aAAa,CACtB,EACD,GAAG,EAAE,cAAc,KAChB,OAAO,CAAC,OAAO,0BAA0B,EAAE,gBAAgB,CAAC,CAAC;IAElE;;;;;;;;;;OAUG;IACH,QAAQ,CAAC,gBAAgB,CAAC,EAAE,MAAM,MAAM,CAAC;CAC1C;AAED;;;;;;;;;;;;;;GAcG;AACH,MAAM,WAAW,eAAe;IAC9B,uBAAuB,CACrB,SAAS,EAAE,MAAM,EACjB,MAAM,EAAE,WAAW,EACnB,SAAS,CAAC,EAAE,MAAM,GACjB,IAAI,CAAC;CACT;AAED;;;;;;;;;;;;;;;;GAgBG;AAMH,QAAA,MAAM,WAAW;;;;;;;;;;;CAAmB,CAAC;AAErC;;;;;;;;;;;;;;;;GAgBG;AACH;;;;;GAKG;AACH,QAAA,MAAM,YAAY;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAA2B,CAAC;AAE9C;;;;;;;;;;;;;GAaG;AACH,KAAK,YAAY,GAAG,gBAAgB,GAAG;IACrC,WAAW,EAAE,MAAM,CAAC;IAEpB,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,EAAE,OAAO,CAAC;IACnB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB,CAAC;AAEF;;;;;;;GAOG;AACH,KAAK,mBAAmB,GAAG,gBAAgB,GAAG;IAC5C,KAAK,EAAE,WAAW,CAAC;IAEnB,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,EAAE,KAAK,CAAC;IACjB,WAAW,CAAC,EAAE,MAAM,CAAC;CACtB,CAAC;AAqEF;;;;;;;;;;;;;GAaG;AACH,wBAAgB,uBAAuB,CACrC,IAAI,EAAE,qBAAqB,GAC1B,aAAa,CACd,OAAO,WAAW,EAClB,OAAO,YAAY,EACnB,YAAY,GAAG,cAAc,CAAC,mBAAmB,CAAC,CACnD,CAw7CA"}
+{"version":3,"file":"render.d.ts","sourceRoot":"","sources":["../../src/renders/render.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8CG;AAGH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAEL,KAAK,iBAAiB,EAEtB,KAAK,YAAY,EAGjB,KAAK,WAAW,EAGjB,MAAM,mBAAmB,CAAC;AAM3B,OAAO,KAAK,EACV,gBAAgB,EAChB,iBAAiB,EACjB,aAAa,EACb,YAAY,EACZ,oBAAoB,EACpB,cAAc,EACd,WAAW,EACX,mBAAmB,EACnB,gBAAgB,EAChB,cAAc,EAGd,WAAW,EACZ,MAAM,0BAA0B,CAAC;AAElC,OAAO,EAGL,KAAK,cAAc,EACnB,KAAK,cAAc,EACnB,KAAK,aAAa,EACnB,MAAM,aAAa,CAAC;AAOrB,OAAO,EAIL,KAAK,sBAAsB,EAC5B,MAAM,0BAA0B,CAAC;AAClC,OAAO,KAAK,EACV,mBAAmB,EAEpB,MAAM,uBAAuB,CAAC;AAO/B,OAAO,KAAK,EAAE,2BAA2B,EAAE,MAAM,oCAAoC,CAAC;AACtF,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,uBAAuB,CAAC;AAY3D,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,qBAAqB,CAAC;AAErD,OAAO,EAQL,KAAK,gBAAgB,EAErB,KAAK,WAAW,EAEjB,MAAM,mBAAmB,CAAC;AAQ3B,OAAO,EAOL,KAAK,mBAAmB,EACzB,MAAM,4BAA4B,CAAC;AAEpC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAmCG;AACH,MAAM,WAAW,cAAc;IAC7B;+CAC2C;IAC3C,QAAQ,CAAC,WAAW,EAAE,WAAW,CAAC;IAClC;;;;;;OAMG;IACH,QAAQ,CAAC,UAAU,EAAE,CACnB,GAAG,EAAE,cAAc,KAChB,OAAO,CAAC,qBAAqB,GAAG,IAAI,CAAC,GAAG,qBAAqB,GAAG,IAAI,CAAC;IAC1E;;;;;OAKG;IACH,QAAQ,CAAC,UAAU,EAAE,iBAAiB,CAAC;IACvC;;;;;;;;;;;;;;;;;;;;;;;;;;;;OA4BG;IACH,QAAQ,CAAC,KAAK,CAAC,EAAE,mBAAmB,CAAC;IAErC;;;;;;;;;;;;OAYG;IACH,QAAQ,CAAC,SAAS,CAAC,EAAE,SAAS,aAAa,EAAE,CAAC;IAE9C;;;;;;;;OAQG;IACH,QAAQ,CAAC,gBAAgB,CAAC,EAAE,CAC1B,GAAG,EAAE,cAAc,KAChB,SAAS,GAAG,IAAI,GAAG,OAAO,CAAC,SAAS,GAAG,IAAI,CAAC,CAAC;IAElD;;;;;;;;;;;;OAYG;IACH,QAAQ,CAAC,mBAAmB,CAAC,EAAE,2BAA2B,CAAC;IAE3D;;;;;;;;;;;;;;;;;;;;;;;;;OAyBG;IACH,QAAQ,CAAC,eAAe,CAAC,EAAE,CACzB,GAAG,EAAE,cAAc,EACnB,KAAK,EAAE;QACL,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;QACxB,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;QAC3B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;KACzB,KACE,WAAW,GAAG,IAAI,GAAG,OAAO,CAAC,WAAW,GAAG,IAAI,CAAC,CAAC;CACvD;AAED;;;;GAIG;AACH,MAAM,WAAW,qBAAqB;IACpC,QAAQ,CAAC,SAAS,EAAE,YAAY,CAAC;IACjC,QAAQ,CAAC,WAAW,EAAE,cAAc,CAAC;CACtC;AAED;;;;;;;;;GASG;AACH,MAAM,WAAW,0BAA0B;IACzC,QAAQ,CAAC,GAAG,EAAE,cAAc,CAAC;IAC7B,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,gFAAgF;IAChF,QAAQ,CAAC,QAAQ,EAAE,YAAY,CAAC;IAChC,kDAAkD;IAClD,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;IAC9B;;;;;OAKG;IACH,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,sEAAsE;IACtE,QAAQ,CAAC,MAAM,EAAE,gBAAgB,CAAC,QAAQ,CAAC,CAAC;IAC5C,uDAAuD;IACvD,QAAQ,CAAC,SAAS,EAAE,OAAO,CAAC;IAC5B;;;;OAIG;IACH,QAAQ,CAAC,QAAQ,EAAE,OAAO,CAAC;CAC5B;AAED;;;;;;;;GAQG;AACH,MAAM,WAAW,qBAAsB,SAAQ,mBAAmB;IAChE,2EAA2E;IAC3E,QAAQ,CAAC,WAAW,EAAE,gBAAgB,CAAC;IACvC;;;;;;;OAOG;IACH,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAC;IAC9B;;;;;;;;;;;;;OAaG;IACH,QAAQ,CAAC,gBAAgB,CAAC,EAAE,gBAAgB,CAAC;IAC7C;;;;;;;;;OASG;IACH,QAAQ,CAAC,oBAAoB,CAAC,EAAE,oBAAoB,CAAC;IAIrD;;;;;;;;;;;;;;;;;;;OAmBG;IACH,QAAQ,CAAC,yBAAyB,CAAC,EAAE,MAAM,SAAS,MAAM,EAAE,GAAG,SAAS,CAAC;IAEzE;;;;;;OAMG;IACH,QAAQ,CAAC,kBAAkB,CAAC,EAAE,sBAAsB,CAAC;IAErD;;;;;;;;;;;;;;;;;;;;;;OAsBG;IACH,QAAQ,CAAC,WAAW,CAAC,EAAE,WAAW,CAAC;IAEnC;;;;;;;;;;;;;OAaG;IACH,QAAQ,CAAC,cAAc,CAAC,EAAE,cAAc,CAAC;IAEzC;;;;;;;;;;;;;;;;;OAiBG;IACH,QAAQ,CAAC,mBAAmB,CAAC,EAAE,mBAAmB,CAAC;IAEnD;;;;;;;;;;;;;OAaG;IACH,QAAQ,CAAC,cAAc,CAAC,EAAE,aAAa,CAAC;IAExC;;;;;;;;;;;;;;;;;;;OAmBG;IACH,QAAQ,CAAC,UAAU,CAAC,EAAE,cAAc,CAAC;IAErC;;;;;;;;;;;;;;;;;;;;;;;;;;;;OA4BG;IACH,QAAQ,CAAC,oBAAoB,CAAC,EAAE,CAC9B,KAAK,EAAE;QACL,QAAQ,CAAC,UAAU,CAAC,EAAE,OAAO,mBAAmB,EAAE,UAAU,CAAC;QAC7D,QAAQ,CAAC,UAAU,CAAC,EAAE,OAAO,mBAAmB,EAAE,UAAU,CAAC;QAC7D,QAAQ,CAAC,iBAAiB,CAAC,EAAE;YAAE,QAAQ,CAAC,KAAK,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAA;SAAE,CAAC;KACrF,KACE,IAAI,CAAC;IAEV;;;;;;;;;;;;;;;;;;;;;;;OAuBG;IACH,QAAQ,CAAC,eAAe,CAAC,EAAE,eAAe,CAAC;IAE3C;;;;;;;;;OASG;IACH,QAAQ,CAAC,gBAAgB,CAAC,EAAE,OAAO,gBAAgB,EAAE,oBAAoB,CAAC;IAE1E;;;;;;;;;;;;;;;;;;;;;;;;;;OA0BG;IACH,QAAQ,CAAC,SAAS,CAAC,EAAE,OAAO,0BAA0B,EAAE,SAAS,CAAC;IAElE;;;;;;;;;OASG;IACH,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAC;IAE9B;;;;;;;;;;;;;;OAcG;IACH,QAAQ,CAAC,iBAAiB,CAAC,EAAE,CAC3B,GAAG,EAAE,cAAc,EACnB,QAAQ,EAAE,OAAO,KACd,OAAO,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC;IAE1B;;;;;;;;;;;;;;;OAeG;IACH,QAAQ,CAAC,eAAe,CAAC,EAAE,CACzB,IAAI,EAAE,0BAA0B,KAC7B,OAAO,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC;IAE1B;;;;;;;;;;;;;;;;;;;;OAoBG;IACH,QAAQ,CAAC,SAAS,CAAC,EAAE,CACnB,KAAK,EAAE,IAAI,CACT,OAAO,0BAA0B,EAAE,eAAe,EAClD,KAAK,GAAG,aAAa,CACtB,EACD,GAAG,EAAE,cAAc,KAChB,OAAO,CAAC,OAAO,0BAA0B,EAAE,gBAAgB,CAAC,CAAC;IAElE;;;;;;;;;;OAUG;IACH,QAAQ,CAAC,gBAAgB,CAAC,EAAE,MAAM,MAAM,CAAC;CAC1C;AAED;;;;;;;;;;;;;;GAcG;AACH,MAAM,WAAW,eAAe;IAC9B,uBAAuB,CACrB,SAAS,EAAE,MAAM,EACjB,MAAM,EAAE,WAAW,EACnB,SAAS,CAAC,EAAE,MAAM,GACjB,IAAI,CAAC;CACT;AAED;;;;;;;;;;;;;;;;GAgBG;AAMH,QAAA,MAAM,WAAW;;;;;;;;;;;CAAmB,CAAC;AAErC;;;;;;;;;;;;;;;;GAgBG;AACH;;;;;GAKG;AACH,QAAA,MAAM,YAAY;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAA2B,CAAC;AAE9C;;;;;;;;;;;;;GAaG;AACH,KAAK,YAAY,GAAG,gBAAgB,GAAG;IACrC,WAAW,EAAE,MAAM,CAAC;IAEpB,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,EAAE,OAAO,CAAC;IACnB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB,CAAC;AAEF;;;;;;;GAOG;AACH,KAAK,mBAAmB,GAAG,gBAAgB,GAAG;IAC5C,KAAK,EAAE,WAAW,CAAC;IAEnB,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,EAAE,KAAK,CAAC;IACjB,WAAW,CAAC,EAAE,MAAM,CAAC;CACtB,CAAC;AAqEF;;;;;;;;;;;;;GAaG;AACH,wBAAgB,uBAAuB,CACrC,IAAI,EAAE,qBAAqB,GAC1B,aAAa,CACd,OAAO,WAAW,EAClB,OAAO,YAAY,EACnB,YAAY,GAAG,cAAc,CAAC,mBAAmB,CAAC,CACnD,CAo9CA"}

package/dist/renders/render.js

@@ -53,7 +53,7 @@ import { handlerFailure, isHandlerFailure, } from '../types.js';
 import { consumeHandshakeRecord, peekHandshakeRecord, HandshakeNotFoundError, } from './handshake.js';
 import { evaluateProvisionalPreviewGate, finalizeProvisionalPreview, kickoffProvisionalPreview, } from './provisional-preview.js';
 import { assertNoDuplicateGadgetHooks } from './assert-no-duplicate-gadget-hooks.js';
-import { reportRenderCodeWriteFailed } from './code-delivery-events.js';
+import { reportRenderCodeB64OverCap, reportRenderCodeWriteFailed, } from './code-delivery-events.js';
 import { writeRenderIdentity } from './render-identity.js';
 import { findBlueprintExact, readBlueprintById, registerBlueprint, } from './blueprint-registry.js';
 import { assertGadgetsRegistered, filterDescriptorsToContract, } from './assert-gadgets.js';
@@ -64,7 +64,7 @@ import { validatePropsData, ContractViolationError, validateContract, renderInpu
 import { emitCacheTraceEvent, newCacheTraceId, truncateCacheTraceIntent, } from './cache-trace-sink.js';
 import { emitPayloadTraceEvent } from './payload-trace-sink.js';
 import { isVisibleToCaller } from './tenancy.js';
-import { assembleRenderSliceBase, deriveRenderMeta, derivePublicEnvProjection, deriveContractBundle, } from './slice-meta-derivation.js';
+import { assembleRenderSliceBase, deriveRenderMeta, derivePublicEnvProjection, deriveContractBundle, rewritePrivateBundleUrls, } from './slice-meta-derivation.js';
 /**
  * Input raw-shape.
  *
@@ -1340,7 +1340,25 @@ export function createGguiRenderHandler(deps) {
                     lastSequence = stored.eventSequence;
                 }
                 if (top) {
-                    view = deriveRenderMeta(top);
+                    // H1 ruling 1b — presign-rewrite PRIVATE bundle URLs before
+                    // projection so CSP origins + iframe registrations both see
+                    // the fetchable (presigned) URL. Passthrough when the
+                    // deployment wires no presigner (OSS same-origin story).
+                    view = deriveRenderMeta(await rewritePrivateBundleUrls(top, deps.presignPrivateBundleUrl));
+                    // Over-cap inline-channel omission is a named event, not a
+                    // silent degrade: on a host whose iframe CSP blocks fetches
+                    // AND WebSockets, a slice without `codeB64` cannot paint.
+                    if (top.type !== 'mcpApps' &&
+                        top.type !== 'system' &&
+                        typeof top.componentCode === 'string' &&
+                        top.componentCode.length > 0 &&
+                        view.codeB64 === undefined) {
+                        reportRenderCodeB64OverCap({
+                            sessionId: output.sessionId,
+                            appId: ctx.appId,
+                            sourceBytes: Buffer.byteLength(top.componentCode, 'utf8'),
+                        });
+                    }
                     // Project the App's publicEnv down to the union of declared
                     // wrappers' `requires`.
                     if (deps.appMetadataStore) {
@@ -1468,6 +1486,12 @@ export function createGguiRenderHandler(deps) {
                 ...(outputWithCode.codeHash
                     ? { codeHash: outputWithCode.codeHash }
                     : {}),
+                // Inline compiled source (size-capped, projected by
+                // `deriveRenderMeta`). Coexists with codeUrl: fetch-capable
+                // hosts keep the cache-addressable URL, fetch-blocked hosts
+                // (iframe CSP without connect-src/script-src to this server)
+                // decode the inline bytes. Never emitted alongside `kind`.
+                ...(view.codeB64 !== undefined ? { codeB64: view.codeB64 } : {}),
             };
             const uiMeta = {
                 resourceUri: perCallResourceUri,

package/dist/renders/slice-meta-derivation.d.ts

@@ -48,9 +48,13 @@ import { type CompiledContractValidators, type McpAppAiGguiRenderMeta } from '@g
  *      ships via a non-registry CDN (esm.sh, jsdelivr, …).
  *   2. `entry.bundleHost` + `entry.package` + `entry.version` —
  *      hostname resolution: server assembles
- *      `https://<bundleHost>/bundles/<scope>/<name>/<version>/bundle.js`
- *      (matches `@ggui-ai/registry-core`'s `bundleStorage.bundleUrl(…)`
- *      path layout — see `packages/registry-core/src/impls/memory-bundle-storage.ts`).
+ *      `https://<bundleHost>/bundles/public/<scope>/<name>/<version>/bundle.js`
+ *      — the PUBLIC prefix of `@ggui-ai/registry-core`'s
+ *      visibility-split `BundleStorage` layout (H1). Host composition
+ *      serves the anonymous render-time fetch, which only the public
+ *      prefix answers; private artifacts always arrive as explicit
+ *      `bundleUrl` values and are presign-rewritten at render-meta
+ *      time ({@link rewritePrivateBundleUrls}).
  *   3. Spec default `registry.ggui.ai` — applied when `entry.bundleHost`
  *      is absent but `package` + `version` are present (first-party
  *      hosted-registry default).
@@ -90,6 +94,48 @@ export declare function resolveGadgetUrls(entry: Partial<Pick<GadgetDescriptor,
     readonly bundleUrl?: string;
     readonly styleUrl?: string;
 };
+/**
+ * URL-path marker of the registry's PRIVATE bundle prefix (H1
+ * visibility split) — the substring {@link rewritePrivateBundleUrls}
+ * dispatches on.
+ */
+export declare const PRIVATE_BUNDLE_PREFIX = "/bundles/private/";
+/**
+ * H1 ruling 1b — rewrite a render item's PRIVATE gadget bundle URLs
+ * into fetchable equivalents at render-meta time.
+ *
+ * A private artifact's explicit `bundleUrl` / `styleUrl` / `typesUrl`
+ * point at the registry's `bundles/private/` prefix, which serves no
+ * anonymous request — the sandboxed iframe (which sends no
+ * credentials) could never load it. When a `presign` function is
+ * supplied, every descriptor URL containing
+ * {@link PRIVATE_BUNDLE_PREFIX} is replaced by `await presign(url)` —
+ * the hosted deployment presigns a short-lived object-storage URL via
+ * its pod task role. Everything else is untouched: public explicit
+ * URLs, bundleHost-composed URLs (which are public-prefix by
+ * construction, see {@link resolveGadgetUrls}), and descriptors with
+ * no URLs at all.
+ *
+ * **OSS default: passthrough.** Without `presign` the item is returned
+ * unchanged — the self-hosted story is same-origin: a self-hoster's
+ * iframe and registry share an origin, so its `/bundles/private/…`
+ * route can authenticate the fetch itself (cookie/session) or the
+ * operator simply publishes render-consumed gadgets public. No
+ * presigning infrastructure is required to run the OSS stack.
+ *
+ * MUST run BEFORE {@link deriveRenderMeta}: both the CSP origin
+ * allowlist (`deriveBundleOrigins`) and the iframe registrations
+ * (`deriveGadgetRegistrations`) read the descriptor URLs, so the
+ * rewritten (presigned) origin lands in `script-src`/`style-src`
+ * automatically and the iframe fetches exactly what the CSP allows.
+ * Zero iframe changes — the client sees an ordinary absolute URL.
+ *
+ * Purity note: `deriveRenderMeta` stays pure; this pre-pass is the
+ * ONLY projection stage that may perform I/O, and it returns a new
+ * item (never mutates) so the WeakMap-memoized URL resolution keys
+ * stay correct.
+ */
+export declare function rewritePrivateBundleUrls(item: GguiSession, presign?: (url: string) => Promise<string>): Promise<GguiSession>;
 /**
  * Per-slot contextSpec data for an active render, derived to a
  * wire-friendly array. Returns `undefined` when no slots are declared.
@@ -277,6 +323,19 @@ export declare function derivePropsJson(item: GguiSession): string | undefined;
 export interface RenderMetaView {
     readonly kind?: string;
     readonly propsJson?: string;
+    /**
+     * Base64-encoded compiled component source — the fetch-free static
+     * delivery channel for hosts whose iframe CSP forbids cross-origin
+     * fetches (no `connect-src`/`script-src` to this server). Distinct
+     * from the 2026-05-13-retired raw-ESM `componentCode` field: this is
+     * base64 (inline-embedding-safe), consumed by the iframe-runtime's
+     * seed builder which PREFERS it over `codeUrl` and never fetches.
+     * Omitted when the source exceeds {@link CODE_B64_MAX_CHARS}
+     * (over-cap renders keep the codeUrl / live channels) and for
+     * system-card renders. Each transport spreads it explicitly, like
+     * every other view field.
+     */
+    readonly codeB64?: string;
     readonly contextSlots?: ReadonlyArray<{
         name: string;
         contextName: string;
@@ -432,14 +491,23 @@ export declare function deriveContractBundle(item: GguiSession): Promise<{
     readonly bundleSource: string;
     readonly validators: CompiledContractValidators;
 } | undefined>;
+/**
+ * Ceiling on the base64 length {@link deriveRenderMeta} will inline as
+ * `codeB64` (256 KiB of base64 ≈ 192 KiB of source). Generated
+ * components run 5–50 KB; the cap exists so a pathological render
+ * cannot balloon every tool result and resource read it rides on.
+ * Over-cap renders keep their `codeUrl` / live-channel delivery.
+ */
+export declare const CODE_B64_MAX_CHARS = 262144;
 /**
  * Build the {@link RenderMetaView} for a render — the
  * single-entry-point projection function every bootstrap transport
  * SHOULD call. Composing transports take the view, spread it into
  * their own envelope alongside render/auth/runtime concerns. The
- * static-component code body itself is delivered via the render
- * handler's `codeUrl` channel (composed from `codeStore` + `codeBaseUrl`);
- * this projection only carries the wire-shape metadata.
+ * static-component code body is delivered via the render handler's
+ * `codeUrl` channel (composed from `codeStore` + `codeBaseUrl`) AND —
+ * for fetch-blocked hosts — inline via the size-capped `codeB64`
+ * field this projection carries.
  *
  * Pure. Same input → identical output, byte-for-byte.
  */
@@ -520,6 +588,21 @@ export interface RenderSliceMetaDeps {
         readonly id?: string;
         readonly mode?: 'light' | 'dark';
     } | undefined;
+    /**
+     * H1 ruling 1b — presigner for PRIVATE gadget bundle URLs, applied
+     * via {@link rewritePrivateBundleUrls} before the render projection
+     * so a private artifact's `bundles/private/…` URLs become
+     * short-lived fetchable equivalents (and their origin lands in the
+     * CSP allowlist). Injected at the deployment boundary: the hosted
+     * pod supplies an object-storage presigner running on its task
+     * role; leaving it unset (the OSS default) passes URLs through
+     * unchanged — the self-hosted same-origin story needs no presigning.
+     *
+     * Consumed by the full-envelope projection (`ggui_render`); the
+     * `ggui_update` slice subset carries no gadget URLs or CSP, so it
+     * never presigns.
+     */
+    readonly presignPrivateBundleUrl?: (url: string) => Promise<string>;
 }
 /**
  * Envelope-base fields assembled from {@link RenderSliceMetaDeps} —

package/dist/renders/slice-meta-derivation.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"slice-meta-derivation.d.ts","sourceRoot":"","sources":["../../src/renders/slice-meta-derivation.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAoCG;AACH,OAAO,EAKL,KAAK,QAAQ,EACb,KAAK,gBAAgB,EACrB,KAAK,UAAU,EACf,KAAK,SAAS,EACd,KAAK,WAAW,EACjB,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EAEL,KAAK,0BAA0B,EAC/B,KAAK,sBAAsB,EAC5B,MAAM,yCAAyC,CAAC;AAEjD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgDG;AACH,wBAAgB,iBAAiB,CAC/B,KAAK,EAAE,OAAO,CACZ,IAAI,CACF,gBAAgB,EAChB,WAAW,GAAG,YAAY,GAAG,UAAU,GAAG,SAAS,GAAG,SAAS,CAChE,CACF,GACA;IAAE,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAA;CAAE,CAY7D;AAqED;;;;;;;;;;;;;;;;;;GAkBG;AACH,wBAAgB,kBAAkB,CAChC,IAAI,EAAE,WAAW,GAChB,aAAa,CAAC;IACf,IAAI,EAAE,MAAM,CAAC;IACb,WAAW,EAAE,MAAM,CAAC;IACpB,MAAM,EAAE,UAAU,CAAC;IACnB,OAAO,EAAE,SAAS,CAAC;IACnB,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB,CAAC,GAAG,SAAS,CA+Cb;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6BG;AACH,wBAAgB,uBAAuB,CACrC,IAAI,EAAE,WAAW,GAChB,SAAS,MAAM,EAAE,GAAG,SAAS,CA4B/B;AAED;;;;;;;;;GASG;AACH,wBAAgB,WAAW,CAAC,IAAI,EAAE,WAAW,GAAG,QAAQ,GAAG,SAAS,CAEnE;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAmCG;AACH,wBAAgB,mBAAmB,CACjC,IAAI,EAAE,WAAW,GAChB;IAAE,MAAM,EAAE,SAAS,MAAM,EAAE,CAAC;IAAC,KAAK,EAAE,SAAS,MAAM,EAAE,CAAC;IAAC,OAAO,EAAE,SAAS,MAAM,EAAE,CAAA;CAAE,GAAG,SAAS,CA+DjG;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAyCG;AACH,wBAAgB,4BAA4B,CAC1C,OAAO,EAAE,UAAU,CAAC,OAAO,mBAAmB,CAAC,GAC9C,MAAM,GAAG,SAAS,CAiBpB;AAED;;;;;;;;;;;;GAYG;AACH,wBAAgB,eAAe,CAAC,IAAI,EAAE,WAAW,GAAG,MAAM,GAAG,SAAS,CAOrE;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,MAAM,WAAW,cAAc;IAC7B,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,YAAY,CAAC,EAAE,aAAa,CAAC;QACpC,IAAI,EAAE,MAAM,CAAC;QACb,WAAW,EAAE,MAAM,CAAC;QACpB,MAAM,EAAE,UAAU,CAAC;QACnB,OAAO,EAAE,SAAS,CAAC;QACnB,UAAU,CAAC,EAAE,MAAM,CAAC;KACrB,CAAC,CAAC;IACH;;;;;;;;;;;;;;;;OAgBG;IACH,QAAQ,CAAC,iBAAiB,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IAC/C;;;;;;;;;;;OAWG;IACH,QAAQ,CAAC,qBAAqB,CAAC,EAAE,MAAM,CAAC;IACxC;;;;;;;;;;;;;;;OAeG;IACH,QAAQ,CAAC,OAAO,CAAC,EAAE,aAAa,CAAC;QAC/B,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;QACzB,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC;QAC5B;;;2BAGmB;QACnB,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC;KAC7B,CAAC,CAAC;IACH;;;;;;;;;;;OAWG;IACH,QAAQ,CAAC,KAAK,CAAC,EAAE,QAAQ,CAAC;CAS3B;AAED;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,wBAAgB,yBAAyB,CACvC,IAAI,EAAE,WAAW,EACjB,YAAY,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,GAAG,SAAS,GACzD,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,GAAG,SAAS,CA0B9C;AAED;;;;;;;;;;;;;;;;;;;GAmBG;AACH,wBAAgB,yBAAyB,CACvC,IAAI,EAAE,WAAW,GAChB,aAAa,CAAC;IACf,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC;CAC7B,CAAC,GAAG,SAAS,CAwCb;AAED;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,wBAAsB,oBAAoB,CACxC,IAAI,EAAE,WAAW,GAChB,OAAO,CACN;IACE,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;IAC9B,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;IAC9B,QAAQ,CAAC,UAAU,EAAE,0BAA0B,CAAC;CACjD,GACD,SAAS,CACZ,CAQA;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,gBAAgB,CAC9B,IAAI,EAAE,WAAW,GAChB,cAAc,CAgDhB;AAED;;;;;;;;;;GAUG;AACH,MAAM,WAAW,mBAAmB;IAClC;;;;;;;;;;;;;;;OAeG;IACH,QAAQ,CAAC,WAAW,CAAC,EAAE,CACrB,SAAS,EAAE,MAAM,EACjB,KAAK,EAAE,MAAM,KACV;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAC;QAAC,SAAS,EAAE,MAAM,CAAA;KAAE,CAAC;IACzD;;;;;;;;;;;;;;;;;OAiBG;IACH,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,GAAG,CAAC,MAAM,MAAM,GAAG,SAAS,CAAC,CAAC;IAC1D;;;;;;;OAOG;IACH,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC;IAC1B,6DAA6D;IAC7D,QAAQ,CAAC,SAAS,CAAC,EAAE,OAAO,GAAG,MAAM,CAAC;IACtC;;;;;;;;OAQG;IACH,QAAQ,CAAC,aAAa,CAAC,EAAE,MACrB;QACE,QAAQ,CAAC,EAAE,CAAC,EAAE,MAAM,CAAC;QACrB,QAAQ,CAAC,IAAI,CAAC,EAAE,OAAO,GAAG,MAAM,CAAC;KAClC,GACD,SAAS,CAAC;CACf;AAED;;;GAGG;AACH,MAAM,WAAW,eAAe;IAC9B,wEAAwE;IACxE,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B;;;OAGG;IACH,QAAQ,CAAC,UAAU,EAAE,OAAO,CAC1B,IAAI,CAAC,sBAAsB,EAAE,OAAO,GAAG,SAAS,GAAG,WAAW,CAAC,CAChE,CAAC;IACF,6DAA6D;IAC7D,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC;IAC1B,wDAAwD;IACxD,QAAQ,CAAC,SAAS,CAAC,EAAE,OAAO,GAAG,MAAM,CAAC;CACvC;AAED;;;;;;;;;;;;;;;;;;GAkBG;AACH,wBAAgB,uBAAuB,CACrC,IAAI,EAAE,mBAAmB,EACzB,IAAI,EAAE;IACJ,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,kEAAkE;IAClE,QAAQ,CAAC,aAAa,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;CAC7C,GACA,eAAe,CA8BjB"}
+{"version":3,"file":"slice-meta-derivation.d.ts","sourceRoot":"","sources":["../../src/renders/slice-meta-derivation.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAoCG;AACH,OAAO,EAKL,KAAK,QAAQ,EACb,KAAK,gBAAgB,EACrB,KAAK,UAAU,EACf,KAAK,SAAS,EACd,KAAK,WAAW,EACjB,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EAEL,KAAK,0BAA0B,EAC/B,KAAK,sBAAsB,EAC5B,MAAM,yCAAyC,CAAC;AAEjD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAoDG;AACH,wBAAgB,iBAAiB,CAC/B,KAAK,EAAE,OAAO,CACZ,IAAI,CACF,gBAAgB,EAChB,WAAW,GAAG,YAAY,GAAG,UAAU,GAAG,SAAS,GAAG,SAAS,CAChE,CACF,GACA;IAAE,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAA;CAAE,CAY7D;AA6ED;;;;GAIG;AACH,eAAO,MAAM,qBAAqB,sBAAsB,CAAC;AAEzD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAkCG;AACH,wBAAsB,wBAAwB,CAC5C,IAAI,EAAE,WAAW,EACjB,OAAO,CAAC,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,OAAO,CAAC,MAAM,CAAC,GACzC,OAAO,CAAC,WAAW,CAAC,CAoCtB;AAED;;;;;;;;;;;;;;;;;;GAkBG;AACH,wBAAgB,kBAAkB,CAChC,IAAI,EAAE,WAAW,GAChB,aAAa,CAAC;IACf,IAAI,EAAE,MAAM,CAAC;IACb,WAAW,EAAE,MAAM,CAAC;IACpB,MAAM,EAAE,UAAU,CAAC;IACnB,OAAO,EAAE,SAAS,CAAC;IACnB,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB,CAAC,GAAG,SAAS,CA+Cb;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6BG;AACH,wBAAgB,uBAAuB,CACrC,IAAI,EAAE,WAAW,GAChB,SAAS,MAAM,EAAE,GAAG,SAAS,CA4B/B;AAED;;;;;;;;;GASG;AACH,wBAAgB,WAAW,CAAC,IAAI,EAAE,WAAW,GAAG,QAAQ,GAAG,SAAS,CAEnE;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAmCG;AACH,wBAAgB,mBAAmB,CACjC,IAAI,EAAE,WAAW,GAChB;IAAE,MAAM,EAAE,SAAS,MAAM,EAAE,CAAC;IAAC,KAAK,EAAE,SAAS,MAAM,EAAE,CAAC;IAAC,OAAO,EAAE,SAAS,MAAM,EAAE,CAAA;CAAE,GAAG,SAAS,CA+DjG;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAyCG;AACH,wBAAgB,4BAA4B,CAC1C,OAAO,EAAE,UAAU,CAAC,OAAO,mBAAmB,CAAC,GAC9C,MAAM,GAAG,SAAS,CAiBpB;AAED;;;;;;;;;;;;GAYG;AACH,wBAAgB,eAAe,CAAC,IAAI,EAAE,WAAW,GAAG,MAAM,GAAG,SAAS,CAOrE;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,MAAM,WAAW,cAAc;IAC7B,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC;IAC5B;;;;;;;;;;;OAWG;IACH,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,YAAY,CAAC,EAAE,aAAa,CAAC;QACpC,IAAI,EAAE,MAAM,CAAC;QACb,WAAW,EAAE,MAAM,CAAC;QACpB,MAAM,EAAE,UAAU,CAAC;QACnB,OAAO,EAAE,SAAS,CAAC;QACnB,UAAU,CAAC,EAAE,MAAM,CAAC;KACrB,CAAC,CAAC;IACH;;;;;;;;;;;;;;;;OAgBG;IACH,QAAQ,CAAC,iBAAiB,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IAC/C;;;;;;;;;;;OAWG;IACH,QAAQ,CAAC,qBAAqB,CAAC,EAAE,MAAM,CAAC;IACxC;;;;;;;;;;;;;;;OAeG;IACH,QAAQ,CAAC,OAAO,CAAC,EAAE,aAAa,CAAC;QAC/B,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;QACzB,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC;QAC5B;;;2BAGmB;QACnB,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC;KAC7B,CAAC,CAAC;IACH;;;;;;;;;;;OAWG;IACH,QAAQ,CAAC,KAAK,CAAC,EAAE,QAAQ,CAAC;CAS3B;AAED;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,wBAAgB,yBAAyB,CACvC,IAAI,EAAE,WAAW,EACjB,YAAY,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,GAAG,SAAS,GACzD,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,GAAG,SAAS,CA0B9C;AAED;;;;;;;;;;;;;;;;;;;GAmBG;AACH,wBAAgB,yBAAyB,CACvC,IAAI,EAAE,WAAW,GAChB,aAAa,CAAC;IACf,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC;CAC7B,CAAC,GAAG,SAAS,CAwCb;AAED;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,wBAAsB,oBAAoB,CACxC,IAAI,EAAE,WAAW,GAChB,OAAO,CACN;IACE,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;IAC9B,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;IAC9B,QAAQ,CAAC,UAAU,EAAE,0BAA0B,CAAC;CACjD,GACD,SAAS,CACZ,CAQA;AAED;;;;;;GAMG;AACH,eAAO,MAAM,kBAAkB,SAAU,CAAC;AAgB1C;;;;;;;;;;;GAWG;AACH,wBAAgB,gBAAgB,CAC9B,IAAI,EAAE,WAAW,GAChB,cAAc,CAkDhB;AAED;;;;;;;;;;GAUG;AACH,MAAM,WAAW,mBAAmB;IAClC;;;;;;;;;;;;;;;OAeG;IACH,QAAQ,CAAC,WAAW,CAAC,EAAE,CACrB,SAAS,EAAE,MAAM,EACjB,KAAK,EAAE,MAAM,KACV;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAC;QAAC,SAAS,EAAE,MAAM,CAAA;KAAE,CAAC;IACzD;;;;;;;;;;;;;;;;;OAiBG;IACH,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,GAAG,CAAC,MAAM,MAAM,GAAG,SAAS,CAAC,CAAC;IAC1D;;;;;;;OAOG;IACH,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC;IAC1B,6DAA6D;IAC7D,QAAQ,CAAC,SAAS,CAAC,EAAE,OAAO,GAAG,MAAM,CAAC;IACtC;;;;;;;;OAQG;IACH,QAAQ,CAAC,aAAa,CAAC,EAAE,MACrB;QACE,QAAQ,CAAC,EAAE,CAAC,EAAE,MAAM,CAAC;QACrB,QAAQ,CAAC,IAAI,CAAC,EAAE,OAAO,GAAG,MAAM,CAAC;KAClC,GACD,SAAS,CAAC;IACd;;;;;;;;;;;;;OAaG;IACH,QAAQ,CAAC,uBAAuB,CAAC,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,OAAO,CAAC,MAAM,CAAC,CAAC;CACrE;AAED;;;GAGG;AACH,MAAM,WAAW,eAAe;IAC9B,wEAAwE;IACxE,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B;;;OAGG;IACH,QAAQ,CAAC,UAAU,EAAE,OAAO,CAC1B,IAAI,CAAC,sBAAsB,EAAE,OAAO,GAAG,SAAS,GAAG,WAAW,CAAC,CAChE,CAAC;IACF,6DAA6D;IAC7D,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC;IAC1B,wDAAwD;IACxD,QAAQ,CAAC,SAAS,CAAC,EAAE,OAAO,GAAG,MAAM,CAAC;CACvC;AAED;;;;;;;;;;;;;;;;;;GAkBG;AACH,wBAAgB,uBAAuB,CACrC,IAAI,EAAE,mBAAmB,EACzB,IAAI,EAAE;IACJ,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,kEAAkE;IAClE,QAAQ,CAAC,aAAa,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;CAC7C,GACA,eAAe,CA8BjB"}

package/dist/renders/slice-meta-derivation.js

@@ -48,9 +48,13 @@ import { deriveContextName, } from '@ggui-ai/protocol/integrations/mcp-apps';
  *      ships via a non-registry CDN (esm.sh, jsdelivr, …).
  *   2. `entry.bundleHost` + `entry.package` + `entry.version` —
  *      hostname resolution: server assembles
- *      `https://<bundleHost>/bundles/<scope>/<name>/<version>/bundle.js`
- *      (matches `@ggui-ai/registry-core`'s `bundleStorage.bundleUrl(…)`
- *      path layout — see `packages/registry-core/src/impls/memory-bundle-storage.ts`).
+ *      `https://<bundleHost>/bundles/public/<scope>/<name>/<version>/bundle.js`
+ *      — the PUBLIC prefix of `@ggui-ai/registry-core`'s
+ *      visibility-split `BundleStorage` layout (H1). Host composition
+ *      serves the anonymous render-time fetch, which only the public
+ *      prefix answers; private artifacts always arrive as explicit
+ *      `bundleUrl` values and are presign-rewritten at render-meta
+ *      time ({@link rewritePrivateBundleUrls}).
  *   3. Spec default `registry.ggui.ai` — applied when `entry.bundleHost`
  *      is absent but `package` + `version` are present (first-party
  *      hosted-registry default).
@@ -130,7 +134,15 @@ function resolveGadgetUrlsImpl(entry) {
         const host = typeof bundleHost === 'string' && bundleHost.length > 0
             ? bundleHost
             : DEFAULT_BUNDLE_HOST;
-        return `${bundleHostScheme(host)}://${host}/bundles/${pkg}/${version}/${file}`;
+        // H1 visibility split: bundleHost-tier composition serves the
+        // anonymous render-time fetch, which only the registry's PUBLIC
+        // prefix answers — the composed path carries the `public` segment
+        // (matches the visibility-split `BundleStorage` layout; pinned by
+        // the resolution-conformance catalog). Private artifacts reach
+        // the iframe via an explicit `bundleUrl` (presign-rewritten at
+        // render-meta time, see `rewritePrivateBundleUrls`), never via
+        // host composition.
+        return `${bundleHostScheme(host)}://${host}/bundles/public/${pkg}/${version}/${file}`;
     };
     const resolvedBundle = hasExplicitBundleUrl ? bundleUrl : computeFromHost('bundle.js');
     // When the operator explicitly sets `bundleUrl` (the escape-hatch
@@ -149,6 +161,78 @@ function resolveGadgetUrlsImpl(entry) {
         ...(resolvedStyle !== undefined ? { styleUrl: resolvedStyle } : {}),
     };
 }
+/**
+ * URL-path marker of the registry's PRIVATE bundle prefix (H1
+ * visibility split) — the substring {@link rewritePrivateBundleUrls}
+ * dispatches on.
+ */
+export const PRIVATE_BUNDLE_PREFIX = '/bundles/private/';
+/**
+ * H1 ruling 1b — rewrite a render item's PRIVATE gadget bundle URLs
+ * into fetchable equivalents at render-meta time.
+ *
+ * A private artifact's explicit `bundleUrl` / `styleUrl` / `typesUrl`
+ * point at the registry's `bundles/private/` prefix, which serves no
+ * anonymous request — the sandboxed iframe (which sends no
+ * credentials) could never load it. When a `presign` function is
+ * supplied, every descriptor URL containing
+ * {@link PRIVATE_BUNDLE_PREFIX} is replaced by `await presign(url)` —
+ * the hosted deployment presigns a short-lived object-storage URL via
+ * its pod task role. Everything else is untouched: public explicit
+ * URLs, bundleHost-composed URLs (which are public-prefix by
+ * construction, see {@link resolveGadgetUrls}), and descriptors with
+ * no URLs at all.
+ *
+ * **OSS default: passthrough.** Without `presign` the item is returned
+ * unchanged — the self-hosted story is same-origin: a self-hoster's
+ * iframe and registry share an origin, so its `/bundles/private/…`
+ * route can authenticate the fetch itself (cookie/session) or the
+ * operator simply publishes render-consumed gadgets public. No
+ * presigning infrastructure is required to run the OSS stack.
+ *
+ * MUST run BEFORE {@link deriveRenderMeta}: both the CSP origin
+ * allowlist (`deriveBundleOrigins`) and the iframe registrations
+ * (`deriveGadgetRegistrations`) read the descriptor URLs, so the
+ * rewritten (presigned) origin lands in `script-src`/`style-src`
+ * automatically and the iframe fetches exactly what the CSP allows.
+ * Zero iframe changes — the client sees an ordinary absolute URL.
+ *
+ * Purity note: `deriveRenderMeta` stays pure; this pre-pass is the
+ * ONLY projection stage that may perform I/O, and it returns a new
+ * item (never mutates) so the WeakMap-memoized URL resolution keys
+ * stay correct.
+ */
+export async function rewritePrivateBundleUrls(item, presign) {
+    if (presign === undefined)
+        return item;
+    if (item.type === 'mcpApps' || item.type === 'system')
+        return item;
+    const descriptors = item.gadgetDescriptors;
+    if (descriptors === undefined || descriptors.length === 0)
+        return item;
+    const maybePresign = async (url) => typeof url === 'string' && url.includes(PRIVATE_BUNDLE_PREFIX)
+        ? await presign(url)
+        : url;
+    let changed = false;
+    const rewritten = await Promise.all(descriptors.map(async (descriptor) => {
+        const bundleUrl = await maybePresign(descriptor.bundleUrl);
+        const styleUrl = await maybePresign(descriptor.styleUrl);
+        const typesUrl = await maybePresign(descriptor.typesUrl);
+        if (bundleUrl === descriptor.bundleUrl &&
+            styleUrl === descriptor.styleUrl &&
+            typesUrl === descriptor.typesUrl) {
+            return descriptor;
+        }
+        changed = true;
+        return {
+            ...descriptor,
+            ...(bundleUrl !== undefined ? { bundleUrl } : {}),
+            ...(styleUrl !== undefined ? { styleUrl } : {}),
+            ...(typesUrl !== undefined ? { typesUrl } : {}),
+        };
+    }));
+    return changed ? { ...item, gadgetDescriptors: rewritten } : item;
+}
 /**
  * Per-slot contextSpec data for an active render, derived to a
  * wire-friendly array. Returns `undefined` when no slots are declared.
@@ -601,14 +685,39 @@ export async function deriveContractBundle(item) {
         contextSpec: item.contextSpec,
     });
 }
+/**
+ * Ceiling on the base64 length {@link deriveRenderMeta} will inline as
+ * `codeB64` (256 KiB of base64 ≈ 192 KiB of source). Generated
+ * components run 5–50 KB; the cap exists so a pathological render
+ * cannot balloon every tool result and resource read it rides on.
+ * Over-cap renders keep their `codeUrl` / live-channel delivery.
+ */
+export const CODE_B64_MAX_CHARS = 262_144;
+/**
+ * Base64-encode a component render's compiled source for the inline
+ * `codeB64` channel. `undefined` for non-component variants, empty
+ * source, or over-cap source (see {@link CODE_B64_MAX_CHARS}).
+ */
+function deriveCodeB64(item) {
+    if (item.type === 'mcpApps' || item.type === 'system')
+        return undefined;
+    const code = item.componentCode;
+    if (typeof code !== 'string' || code.length === 0)
+        return undefined;
+    const encoded = Buffer.from(code, 'utf8').toString('base64');
+    if (encoded.length > CODE_B64_MAX_CHARS)
+        return undefined;
+    return encoded;
+}
 /**
  * Build the {@link RenderMetaView} for a render — the
  * single-entry-point projection function every bootstrap transport
  * SHOULD call. Composing transports take the view, spread it into
  * their own envelope alongside render/auth/runtime concerns. The
- * static-component code body itself is delivered via the render
- * handler's `codeUrl` channel (composed from `codeStore` + `codeBaseUrl`);
- * this projection only carries the wire-shape metadata.
+ * static-component code body is delivered via the render handler's
+ * `codeUrl` channel (composed from `codeStore` + `codeBaseUrl`) AND —
+ * for fetch-blocked hosts — inline via the size-capped `codeB64`
+ * field this projection carries.
  *
  * Pure. Same input → identical output, byte-for-byte.
  */
@@ -644,8 +753,10 @@ export function deriveRenderMeta(item) {
     // system cards theme via the SystemCardHost→ThemeProvider path, not
     // this slice, so `SystemGguiSession` never carries a `theme` sidecar.
     const theme = deriveTheme(item);
+    const codeB64 = deriveCodeB64(item);
     return {
         ...(propsJson !== undefined ? { propsJson } : {}),
+        ...(codeB64 !== undefined ? { codeB64 } : {}),
         ...(slots !== undefined ? { contextSlots: [...slots] } : {}),
         ...(permissionsPolicy !== undefined
             ? { permissionsPolicy: [...permissionsPolicy] }

package/dist/renders/update.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"update.d.ts","sourceRoot":"","sources":["../../src/renders/update.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6DG;AACH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EACL,sBAAsB,EAEtB,KAAK,UAAU,EAEhB,MAAM,mBAAmB,CAAC;AAM3B,OAAO,KAAK,EACV,gBAAgB,EAChB,mBAAmB,EACpB,MAAM,0BAA0B,CAAC;AAClC,OAAO,KAAK,EAAE,cAAc,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AAMjE,OAAO,EAIL,KAAK,mBAAmB,EACzB,MAAM,4BAA4B,CAAC;AACpC,OAAO,EAAE,wBAAwB,EAAE,MAAM,aAAa,CAAC;AAGvD;;;;;;;;;;;;;;;GAeG;AACH,MAAM,WAAW,mBAAmB;IAClC,eAAe,CAAC,SAAS,EAAE,MAAM,EAAE,KAAK,EAAE,UAAU,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CACtE;AAED;;;wDAGwD;AACxD,OAAO,EAAE,wBAAwB,EAAE,sBAAsB,EAAE,CAAC;AAE5D;;;;;;;;;;;;;;GAcG;AACH,MAAM,WAAW,WAAW;IAC1B,QAAQ,CAAC,KAAK,EAAE;QACd,QAAQ,CAAC,GAAG,EAAE,cAAc,CAAC;QAC7B;;;;WAIG;QACH,QAAQ,CAAC,IAAI,EAAE,aAAa,GAAG,aAAa,CAAC;KAC9C,GAAG,OAAO,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC;CAC1B;AAED;;;;;;;;;;;;;;GAcG;AACH,MAAM,WAAW,qBAAsB,SAAQ,mBAAmB;IAChE,4EAA4E;IAC5E,QAAQ,CAAC,WAAW,EAAE,gBAAgB,CAAC;IACvC;;;;;;;;;;;;OAYG;IACH,QAAQ,CAAC,mBAAmB,CAAC,EAAE,mBAAmB,CAAC;IACnD;;;;;;;;;;OAUG;IACH,QAAQ,CAAC,mBAAmB,CAAC,EAAE,mBAAmB,CAAC;IACnD;;;;;OAKG;IACH,QAAQ,CAAC,WAAW,CAAC,EAAE,WAAW,CAAC;IACnC;;;;OAIG;IACH,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAC;CAO/B;AAED;;;;;;;;;GASG;AACH,QAAA,MAAM,WAAW;IACf;;;;;OAKG;;IAEH;;;;OAIG;;;;;IAEH;;;;OAIG;;IAEH;;;;;OAKG;;CAEK,CAAC;AAEX,QAAA,MAAM,YAAY;;;IAGhB;;;;;;;;;OASG;;CAEK,CAAC;AAEX,UAAU,YAAY;IACpB,SAAS,EAAE,MAAM,CAAC;IAClB,OAAO,EAAE,OAAO,CAAC;IACjB,WAAW,EAAE,MAAM,CAAC;CACrB;AAED;;;;;GAKG;AACH,wBAAgB,uBAAuB,CACrC,IAAI,EAAE,qBAAqB,GAC1B,aAAa,CAAC,OAAO,WAAW,EAAE,OAAO,YAAY,EAAE,YAAY,CAAC,CAsRtE"}
+{"version":3,"file":"update.d.ts","sourceRoot":"","sources":["../../src/renders/update.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6DG;AACH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EACL,sBAAsB,EAEtB,KAAK,UAAU,EAEhB,MAAM,mBAAmB,CAAC;AAM3B,OAAO,KAAK,EACV,gBAAgB,EAChB,mBAAmB,EACpB,MAAM,0BAA0B,CAAC;AAClC,OAAO,KAAK,EAAE,cAAc,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AAMjE,OAAO,EAIL,KAAK,mBAAmB,EACzB,MAAM,4BAA4B,CAAC;AACpC,OAAO,EAAE,wBAAwB,EAAE,MAAM,aAAa,CAAC;AAGvD;;;;;;;;;;;;;;;GAeG;AACH,MAAM,WAAW,mBAAmB;IAClC,eAAe,CAAC,SAAS,EAAE,MAAM,EAAE,KAAK,EAAE,UAAU,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CACtE;AAED;;;wDAGwD;AACxD,OAAO,EAAE,wBAAwB,EAAE,sBAAsB,EAAE,CAAC;AAE5D;;;;;;;;;;;;;;GAcG;AACH,MAAM,WAAW,WAAW;IAC1B,QAAQ,CAAC,KAAK,EAAE;QACd,QAAQ,CAAC,GAAG,EAAE,cAAc,CAAC;QAC7B;;;;WAIG;QACH,QAAQ,CAAC,IAAI,EAAE,aAAa,GAAG,aAAa,CAAC;KAC9C,GAAG,OAAO,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC;CAC1B;AAED;;;;;;;;;;;;;;GAcG;AACH,MAAM,WAAW,qBAAsB,SAAQ,mBAAmB;IAChE,4EAA4E;IAC5E,QAAQ,CAAC,WAAW,EAAE,gBAAgB,CAAC;IACvC;;;;;;;;;;;;OAYG;IACH,QAAQ,CAAC,mBAAmB,CAAC,EAAE,mBAAmB,CAAC;IACnD;;;;;;;;;;OAUG;IACH,QAAQ,CAAC,mBAAmB,CAAC,EAAE,mBAAmB,CAAC;IACnD;;;;;OAKG;IACH,QAAQ,CAAC,WAAW,CAAC,EAAE,WAAW,CAAC;IACnC;;;;OAIG;IACH,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAC;CAO/B;AAED;;;;;;;;;GASG;AACH,QAAA,MAAM,WAAW;IACf;;;;;OAKG;;IAEH;;;;OAIG;;;;;IAEH;;;;OAIG;;IAEH;;;;;OAKG;;CAEK,CAAC;AAEX,QAAA,MAAM,YAAY;;;IAGhB;;;;;;;;;OASG;;CAEK,CAAC;AAEX,UAAU,YAAY;IACpB,SAAS,EAAE,MAAM,CAAC;IAClB,OAAO,EAAE,OAAO,CAAC;IACjB,WAAW,EAAE,MAAM,CAAC;CACrB;AAED;;;;;GAKG;AACH,wBAAgB,uBAAuB,CACrC,IAAI,EAAE,qBAAqB,GAC1B,aAAa,CAAC,OAAO,WAAW,EAAE,OAAO,YAAY,EAAE,YAAY,CAAC,CA0RtE"}

package/dist/renders/update.js

@@ -322,12 +322,15 @@ export function createGguiUpdateHandler(deps) {
          * `_meta` (the structuredContent reply is the source of truth).
          */
         resultMeta: async (output, _input, ctx) => {
-            // Load the just-patched render only to derive the projected
-            // propsJson. The other view fields (componentCode / kind /
-            // contextSlots / permissionsPolicy / compiledValidators) are
+            // Load the just-patched render to derive the projected propsJson
+            // AND the inline `codeB64`. The remaining view fields
+            // (contextSlots / permissionsPolicy / compiledValidators) are
             // mount-time invariants — the initial render already shipped
             // them, and `ggui_update` patches `props` only, never the
-            // contract specs.
+            // contract specs. `codeB64` rides updates deliberately: on a
+            // fetch-blocked host the iframe repaints by re-seeding from the
+            // tool-result meta, and a seed needs a static-content channel —
+            // propsJson alone projects to nothing mountable.
             let view = {};
             let renderThemeId;
             // `lastSequence` — monotonic event-ledger cursor stamped on every
@@ -376,6 +379,7 @@ export function createGguiUpdateHandler(deps) {
                     : {}),
                 ...(lastSequence !== undefined ? { lastSequence } : {}),
                 ...(view.propsJson !== undefined ? { propsJson: view.propsJson } : {}),
+                ...(view.codeB64 !== undefined ? { codeB64: view.codeB64 } : {}),
             };
             return toMcpAppEnvelope(render);
         },

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ggui-ai/mcp-server-handlers",
-  "version": "0.7.0",
+  "version": "0.8.0",
   "description": "MCP tool handler logic for the ggui protocol. Pure over @ggui-ai/mcp-server-core seams and consumed by @ggui-ai/mcp-server. Never imports AWS, HTTP transports, or CLI concerns.",
   "keywords": [
     "ggui",
@@ -69,17 +69,17 @@
   },
   "dependencies": {
     "zod": "^4.3.6",
-    "@ggui-ai/mcp-server-core": "0.7.0",
-    "@ggui-ai/negotiator": "0.7.0",
-    "@ggui-ai/protocol": "0.7.0",
-    "@ggui-ai/ui-gen": "0.7.0",
-    "@ggui-ai/ui-registry": "0.7.0"
+    "@ggui-ai/protocol": "0.8.0",
+    "@ggui-ai/negotiator": "0.8.0",
+    "@ggui-ai/mcp-server-core": "0.8.0",
+    "@ggui-ai/ui-gen": "0.8.0",
+    "@ggui-ai/ui-registry": "0.8.0"
   },
   "devDependencies": {
     "@types/node": "^22.0.0",
     "typescript": "^5.0.0",
     "vitest": "^3.2.6",
-    "@ggui-ai/protocol-conformance": "0.7.0"
+    "@ggui-ai/protocol-conformance": "0.8.0"
   },
   "repository": {
     "type": "git",