@ggui-ai/mcp-server-handlers 0.7.0 → 0.9.0

package/dist/renders/slice-meta-derivation.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"slice-meta-derivation.d.ts","sourceRoot":"","sources":["../../src/renders/slice-meta-derivation.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAoCG;AACH,OAAO,EAKL,KAAK,QAAQ,EACb,KAAK,gBAAgB,EACrB,KAAK,UAAU,EACf,KAAK,SAAS,EACd,KAAK,WAAW,EACjB,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EAEL,KAAK,0BAA0B,EAC/B,KAAK,sBAAsB,EAC5B,MAAM,yCAAyC,CAAC;AAEjD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgDG;AACH,wBAAgB,iBAAiB,CAC/B,KAAK,EAAE,OAAO,CACZ,IAAI,CACF,gBAAgB,EAChB,WAAW,GAAG,YAAY,GAAG,UAAU,GAAG,SAAS,GAAG,SAAS,CAChE,CACF,GACA;IAAE,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAA;CAAE,CAY7D;AAqED;;;;;;;;;;;;;;;;;;GAkBG;AACH,wBAAgB,kBAAkB,CAChC,IAAI,EAAE,WAAW,GAChB,aAAa,CAAC;IACf,IAAI,EAAE,MAAM,CAAC;IACb,WAAW,EAAE,MAAM,CAAC;IACpB,MAAM,EAAE,UAAU,CAAC;IACnB,OAAO,EAAE,SAAS,CAAC;IACnB,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB,CAAC,GAAG,SAAS,CA+Cb;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6BG;AACH,wBAAgB,uBAAuB,CACrC,IAAI,EAAE,WAAW,GAChB,SAAS,MAAM,EAAE,GAAG,SAAS,CA4B/B;AAED;;;;;;;;;GASG;AACH,wBAAgB,WAAW,CAAC,IAAI,EAAE,WAAW,GAAG,QAAQ,GAAG,SAAS,CAEnE;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAmCG;AACH,wBAAgB,mBAAmB,CACjC,IAAI,EAAE,WAAW,GAChB;IAAE,MAAM,EAAE,SAAS,MAAM,EAAE,CAAC;IAAC,KAAK,EAAE,SAAS,MAAM,EAAE,CAAC;IAAC,OAAO,EAAE,SAAS,MAAM,EAAE,CAAA;CAAE,GAAG,SAAS,CA+DjG;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAyCG;AACH,wBAAgB,4BAA4B,CAC1C,OAAO,EAAE,UAAU,CAAC,OAAO,mBAAmB,CAAC,GAC9C,MAAM,GAAG,SAAS,CAiBpB;AAED;;;;;;;;;;;;GAYG;AACH,wBAAgB,eAAe,CAAC,IAAI,EAAE,WAAW,GAAG,MAAM,GAAG,SAAS,CAOrE;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,MAAM,WAAW,cAAc;IAC7B,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,YAAY,CAAC,EAAE,aAAa,CAAC;QACpC,IAAI,EAAE,MAAM,CAAC;QACb,WAAW,EAAE,MAAM,CAAC;QACpB,MAAM,EAAE,UAAU,CAAC;QACnB,OAAO,EAAE,SAAS,CAAC;QACnB,UAAU,CAAC,EAAE,MAAM,CAAC;KACrB,CAAC,CAAC;IACH;;;;;;;;;;;;;;;;OAgBG;IACH,QAAQ,CAAC,iBAAiB,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IAC/C;;;;;;;;;;;OAWG;IACH,QAAQ,CAAC,qBAAqB,CAAC,EAAE,MAAM,CAAC;IACxC;;;;;;;;;;;;;;;OAeG;IACH,QAAQ,CAAC,OAAO,CAAC,EAAE,aAAa,CAAC;QAC/B,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;QACzB,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC;QAC5B;;;2BAGmB;QACnB,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC;KAC7B,CAAC,CAAC;IACH;;;;;;;;;;;OAWG;IACH,QAAQ,CAAC,KAAK,CAAC,EAAE,QAAQ,CAAC;CAS3B;AAED;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,wBAAgB,yBAAyB,CACvC,IAAI,EAAE,WAAW,EACjB,YAAY,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,GAAG,SAAS,GACzD,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,GAAG,SAAS,CA0B9C;AAED;;;;;;;;;;;;;;;;;;;GAmBG;AACH,wBAAgB,yBAAyB,CACvC,IAAI,EAAE,WAAW,GAChB,aAAa,CAAC;IACf,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC;CAC7B,CAAC,GAAG,SAAS,CAwCb;AAED;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,wBAAsB,oBAAoB,CACxC,IAAI,EAAE,WAAW,GAChB,OAAO,CACN;IACE,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;IAC9B,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;IAC9B,QAAQ,CAAC,UAAU,EAAE,0BAA0B,CAAC;CACjD,GACD,SAAS,CACZ,CAQA;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,gBAAgB,CAC9B,IAAI,EAAE,WAAW,GAChB,cAAc,CAgDhB;AAED;;;;;;;;;;GAUG;AACH,MAAM,WAAW,mBAAmB;IAClC;;;;;;;;;;;;;;;OAeG;IACH,QAAQ,CAAC,WAAW,CAAC,EAAE,CACrB,SAAS,EAAE,MAAM,EACjB,KAAK,EAAE,MAAM,KACV;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAC;QAAC,SAAS,EAAE,MAAM,CAAA;KAAE,CAAC;IACzD;;;;;;;;;;;;;;;;;OAiBG;IACH,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,GAAG,CAAC,MAAM,MAAM,GAAG,SAAS,CAAC,CAAC;IAC1D;;;;;;;OAOG;IACH,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC;IAC1B,6DAA6D;IAC7D,QAAQ,CAAC,SAAS,CAAC,EAAE,OAAO,GAAG,MAAM,CAAC;IACtC;;;;;;;;OAQG;IACH,QAAQ,CAAC,aAAa,CAAC,EAAE,MACrB;QACE,QAAQ,CAAC,EAAE,CAAC,EAAE,MAAM,CAAC;QACrB,QAAQ,CAAC,IAAI,CAAC,EAAE,OAAO,GAAG,MAAM,CAAC;KAClC,GACD,SAAS,CAAC;CACf;AAED;;;GAGG;AACH,MAAM,WAAW,eAAe;IAC9B,wEAAwE;IACxE,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B;;;OAGG;IACH,QAAQ,CAAC,UAAU,EAAE,OAAO,CAC1B,IAAI,CAAC,sBAAsB,EAAE,OAAO,GAAG,SAAS,GAAG,WAAW,CAAC,CAChE,CAAC;IACF,6DAA6D;IAC7D,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC;IAC1B,wDAAwD;IACxD,QAAQ,CAAC,SAAS,CAAC,EAAE,OAAO,GAAG,MAAM,CAAC;CACvC;AAED;;;;;;;;;;;;;;;;;;GAkBG;AACH,wBAAgB,uBAAuB,CACrC,IAAI,EAAE,mBAAmB,EACzB,IAAI,EAAE;IACJ,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,kEAAkE;IAClE,QAAQ,CAAC,aAAa,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;CAC7C,GACA,eAAe,CA8BjB"}
+{"version":3,"file":"slice-meta-derivation.d.ts","sourceRoot":"","sources":["../../src/renders/slice-meta-derivation.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAoCG;AACH,OAAO,EAKL,KAAK,QAAQ,EACb,KAAK,gBAAgB,EACrB,KAAK,UAAU,EACf,KAAK,SAAS,EACd,KAAK,WAAW,EACjB,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EAGL,KAAK,0BAA0B,EAC/B,KAAK,sBAAsB,EAC5B,MAAM,yCAAyC,CAAC;AAEjD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAoDG;AACH,wBAAgB,iBAAiB,CAC/B,KAAK,EAAE,OAAO,CACZ,IAAI,CACF,gBAAgB,EAChB,WAAW,GAAG,YAAY,GAAG,UAAU,GAAG,SAAS,GAAG,SAAS,CAChE,CACF,GACA;IAAE,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAA;CAAE,CAY7D;AA6ED;;;;GAIG;AACH,eAAO,MAAM,qBAAqB,sBAAsB,CAAC;AAEzD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAkCG;AACH,wBAAsB,wBAAwB,CAC5C,IAAI,EAAE,WAAW,EACjB,OAAO,CAAC,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,OAAO,CAAC,MAAM,CAAC,GACzC,OAAO,CAAC,WAAW,CAAC,CAoCtB;AAED;;;;;;;;;;;;;;;;;;GAkBG;AACH,wBAAgB,kBAAkB,CAChC,IAAI,EAAE,WAAW,GAChB,aAAa,CAAC;IACf,IAAI,EAAE,MAAM,CAAC;IACb,WAAW,EAAE,MAAM,CAAC;IACpB,MAAM,EAAE,UAAU,CAAC;IACnB,OAAO,EAAE,SAAS,CAAC;IACnB,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB,CAAC,GAAG,SAAS,CA+Cb;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6BG;AACH,wBAAgB,uBAAuB,CACrC,IAAI,EAAE,WAAW,GAChB,SAAS,MAAM,EAAE,GAAG,SAAS,CA4B/B;AAED;;;;;;;;;GASG;AACH,wBAAgB,WAAW,CAAC,IAAI,EAAE,WAAW,GAAG,QAAQ,GAAG,SAAS,CAEnE;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAmCG;AACH,wBAAgB,mBAAmB,CACjC,IAAI,EAAE,WAAW,GAChB;IAAE,MAAM,EAAE,SAAS,MAAM,EAAE,CAAC;IAAC,KAAK,EAAE,SAAS,MAAM,EAAE,CAAC;IAAC,OAAO,EAAE,SAAS,MAAM,EAAE,CAAA;CAAE,GAAG,SAAS,CA+DjG;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAyCG;AACH,wBAAgB,4BAA4B,CAC1C,OAAO,EAAE,UAAU,CAAC,OAAO,mBAAmB,CAAC,GAC9C,MAAM,GAAG,SAAS,CAiBpB;AAED;;;;;;;;;;;;GAYG;AACH,wBAAgB,eAAe,CAAC,IAAI,EAAE,WAAW,GAAG,MAAM,GAAG,SAAS,CAOrE;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,MAAM,WAAW,cAAc;IAC7B,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC;IACvB,8EAA8E;IAC9E,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC;IAC5B;;;;;;;;;;;OAWG;IACH,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,YAAY,CAAC,EAAE,aAAa,CAAC;QACpC,IAAI,EAAE,MAAM,CAAC;QACb,WAAW,EAAE,MAAM,CAAC;QACpB,MAAM,EAAE,UAAU,CAAC;QACnB,OAAO,EAAE,SAAS,CAAC;QACnB,UAAU,CAAC,EAAE,MAAM,CAAC;KACrB,CAAC,CAAC;IACH;;;;;;;;;;;;;;;;OAgBG;IACH,QAAQ,CAAC,iBAAiB,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IAC/C;;;;;;;;;;;OAWG;IACH,QAAQ,CAAC,qBAAqB,CAAC,EAAE,MAAM,CAAC;IACxC;;;;;;;;;;;;;;;OAeG;IACH,QAAQ,CAAC,OAAO,CAAC,EAAE,aAAa,CAAC;QAC/B,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;QACzB,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC;QAC5B;;;2BAGmB;QACnB,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC;KAC7B,CAAC,CAAC;IACH;;;;;;;;;;;OAWG;IACH,QAAQ,CAAC,KAAK,CAAC,EAAE,QAAQ,CAAC;CAS3B;AAED;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,wBAAgB,yBAAyB,CACvC,IAAI,EAAE,WAAW,EACjB,YAAY,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,GAAG,SAAS,GACzD,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,GAAG,SAAS,CA0B9C;AAED;;;;;;;;;;;;;;;;;;;GAmBG;AACH,wBAAgB,yBAAyB,CACvC,IAAI,EAAE,WAAW,GAChB,aAAa,CAAC;IACf,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC;CAC7B,CAAC,GAAG,SAAS,CAwCb;AAED;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,wBAAsB,oBAAoB,CACxC,IAAI,EAAE,WAAW,GAChB,OAAO,CACN;IACE,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;IAC9B,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;IAC9B,QAAQ,CAAC,UAAU,EAAE,0BAA0B,CAAC;CACjD,GACD,SAAS,CACZ,CAQA;AAED;;;;;;GAMG;AACH,eAAO,MAAM,kBAAkB,SAAU,CAAC;AAgB1C;;;;;;;;;;;GAWG;AACH;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAgB,6BAA6B,CAC3C,IAAI,EAAE,cAAc,GAAG,SAAS,GAC/B,IAAI,CACL,sBAAsB,EACtB,OAAO,GAAG,WAAW,GAAG,cAAc,GAAG,mBAAmB,GAAG,OAAO,GAAG,SAAS,CACnF,CAgBA;AAED,wBAAgB,gBAAgB,CAC9B,IAAI,EAAE,WAAW,GAChB,cAAc,CAsDhB;AAED;;;;;;;;;;GAUG;AACH,MAAM,WAAW,mBAAmB;IAClC;;;;;;;;;;;;;;;OAeG;IACH,QAAQ,CAAC,WAAW,CAAC,EAAE,CACrB,SAAS,EAAE,MAAM,EACjB,KAAK,EAAE,MAAM,KACV;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAC;QAAC,SAAS,EAAE,MAAM,CAAA;KAAE,CAAC;IACzD;;;;;;;;;;;;;;;;;OAiBG;IACH,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,GAAG,CAAC,MAAM,MAAM,GAAG,SAAS,CAAC,CAAC;IAC1D;;;;;;;OAOG;IACH,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC;IAC1B,6DAA6D;IAC7D,QAAQ,CAAC,SAAS,CAAC,EAAE,OAAO,GAAG,MAAM,CAAC;IACtC;;;;;;;;OAQG;IACH,QAAQ,CAAC,aAAa,CAAC,EAAE,MACrB;QACE,QAAQ,CAAC,EAAE,CAAC,EAAE,MAAM,CAAC;QACrB,QAAQ,CAAC,IAAI,CAAC,EAAE,OAAO,GAAG,MAAM,CAAC;KAClC,GACD,SAAS,CAAC;IACd;;;;;;;;;;;;;OAaG;IACH,QAAQ,CAAC,uBAAuB,CAAC,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,OAAO,CAAC,MAAM,CAAC,CAAC;IACpE;;;;;;;;;;;;;;;;;OAiBG;IACH,QAAQ,CAAC,iBAAiB,CAAC,EAAE,MAAM,GAAG,CAAC,MAAM,MAAM,GAAG,SAAS,CAAC,CAAC;CAClE;AAED;;;;;;;;GAQG;AACH,wBAAgB,oBAAoB,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAMtE;AAED;;;GAGG;AACH,MAAM,WAAW,eAAe;IAC9B,wEAAwE;IACxE,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B;;;OAGG;IACH,QAAQ,CAAC,UAAU,EAAE,OAAO,CAC1B,IAAI,CAAC,sBAAsB,EAAE,OAAO,GAAG,SAAS,GAAG,WAAW,CAAC,CAChE,CAAC;IACF;;;;;;OAMG;IACH,QAAQ,CAAC,WAAW,EAAE,OAAO,CAC3B,IAAI,CAAC,sBAAsB,EAAE,YAAY,GAAG,QAAQ,CAAC,CACtD,CAAC;IACF,6DAA6D;IAC7D,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC;IAC1B,wDAAwD;IACxD,QAAQ,CAAC,SAAS,CAAC,EAAE,OAAO,GAAG,MAAM,CAAC;CACvC;AAED;;;;;;;;;;;;;;;;;;GAkBG;AACH,wBAAgB,uBAAuB,CACrC,IAAI,EAAE,mBAAmB,EACzB,IAAI,EAAE;IACJ,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,kEAAkE;IAClE,QAAQ,CAAC,aAAa,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;CAC7C,GACA,eAAe,CAiDjB"}

package/dist/renders/slice-meta-derivation.js

@@ -36,7 +36,7 @@
  * the render.
  */
 import { bundleHostScheme, computeContractBundle, deriveContextDefault, DEFAULT_BUNDLE_HOST, } from '@ggui-ai/protocol';
-import { deriveContextName, } from '@ggui-ai/protocol/integrations/mcp-apps';
+import { composeSessionApiUrls, deriveContextName, } from '@ggui-ai/protocol/integrations/mcp-apps';
 /**
  * Resolve the canonical bundle URL + style URL for a gadget entry.
  *
@@ -48,9 +48,13 @@ import { deriveContextName, } from '@ggui-ai/protocol/integrations/mcp-apps';
  *      ships via a non-registry CDN (esm.sh, jsdelivr, …).
  *   2. `entry.bundleHost` + `entry.package` + `entry.version` —
  *      hostname resolution: server assembles
- *      `https://<bundleHost>/bundles/<scope>/<name>/<version>/bundle.js`
- *      (matches `@ggui-ai/registry-core`'s `bundleStorage.bundleUrl(…)`
- *      path layout — see `packages/registry-core/src/impls/memory-bundle-storage.ts`).
+ *      `https://<bundleHost>/bundles/public/<scope>/<name>/<version>/bundle.js`
+ *      — the PUBLIC prefix of `@ggui-ai/registry-core`'s
+ *      visibility-split `BundleStorage` layout (H1). Host composition
+ *      serves the anonymous render-time fetch, which only the public
+ *      prefix answers; private artifacts always arrive as explicit
+ *      `bundleUrl` values and are presign-rewritten at render-meta
+ *      time ({@link rewritePrivateBundleUrls}).
  *   3. Spec default `registry.ggui.ai` — applied when `entry.bundleHost`
  *      is absent but `package` + `version` are present (first-party
  *      hosted-registry default).
@@ -130,7 +134,15 @@ function resolveGadgetUrlsImpl(entry) {
         const host = typeof bundleHost === 'string' && bundleHost.length > 0
             ? bundleHost
             : DEFAULT_BUNDLE_HOST;
-        return `${bundleHostScheme(host)}://${host}/bundles/${pkg}/${version}/${file}`;
+        // H1 visibility split: bundleHost-tier composition serves the
+        // anonymous render-time fetch, which only the registry's PUBLIC
+        // prefix answers — the composed path carries the `public` segment
+        // (matches the visibility-split `BundleStorage` layout; pinned by
+        // the resolution-conformance catalog). Private artifacts reach
+        // the iframe via an explicit `bundleUrl` (presign-rewritten at
+        // render-meta time, see `rewritePrivateBundleUrls`), never via
+        // host composition.
+        return `${bundleHostScheme(host)}://${host}/bundles/public/${pkg}/${version}/${file}`;
     };
     const resolvedBundle = hasExplicitBundleUrl ? bundleUrl : computeFromHost('bundle.js');
     // When the operator explicitly sets `bundleUrl` (the escape-hatch
@@ -149,6 +161,78 @@ function resolveGadgetUrlsImpl(entry) {
         ...(resolvedStyle !== undefined ? { styleUrl: resolvedStyle } : {}),
     };
 }
+/**
+ * URL-path marker of the registry's PRIVATE bundle prefix (H1
+ * visibility split) — the substring {@link rewritePrivateBundleUrls}
+ * dispatches on.
+ */
+export const PRIVATE_BUNDLE_PREFIX = '/bundles/private/';
+/**
+ * H1 ruling 1b — rewrite a render item's PRIVATE gadget bundle URLs
+ * into fetchable equivalents at render-meta time.
+ *
+ * A private artifact's explicit `bundleUrl` / `styleUrl` / `typesUrl`
+ * point at the registry's `bundles/private/` prefix, which serves no
+ * anonymous request — the sandboxed iframe (which sends no
+ * credentials) could never load it. When a `presign` function is
+ * supplied, every descriptor URL containing
+ * {@link PRIVATE_BUNDLE_PREFIX} is replaced by `await presign(url)` —
+ * the hosted deployment presigns a short-lived object-storage URL via
+ * its pod task role. Everything else is untouched: public explicit
+ * URLs, bundleHost-composed URLs (which are public-prefix by
+ * construction, see {@link resolveGadgetUrls}), and descriptors with
+ * no URLs at all.
+ *
+ * **OSS default: passthrough.** Without `presign` the item is returned
+ * unchanged — the self-hosted story is same-origin: a self-hoster's
+ * iframe and registry share an origin, so its `/bundles/private/…`
+ * route can authenticate the fetch itself (cookie/session) or the
+ * operator simply publishes render-consumed gadgets public. No
+ * presigning infrastructure is required to run the OSS stack.
+ *
+ * MUST run BEFORE {@link deriveRenderMeta}: both the CSP origin
+ * allowlist (`deriveBundleOrigins`) and the iframe registrations
+ * (`deriveGadgetRegistrations`) read the descriptor URLs, so the
+ * rewritten (presigned) origin lands in `script-src`/`style-src`
+ * automatically and the iframe fetches exactly what the CSP allows.
+ * Zero iframe changes — the client sees an ordinary absolute URL.
+ *
+ * Purity note: `deriveRenderMeta` stays pure; this pre-pass is the
+ * ONLY projection stage that may perform I/O, and it returns a new
+ * item (never mutates) so the WeakMap-memoized URL resolution keys
+ * stay correct.
+ */
+export async function rewritePrivateBundleUrls(item, presign) {
+    if (presign === undefined)
+        return item;
+    if (item.type === 'mcpApps' || item.type === 'system')
+        return item;
+    const descriptors = item.gadgetDescriptors;
+    if (descriptors === undefined || descriptors.length === 0)
+        return item;
+    const maybePresign = async (url) => typeof url === 'string' && url.includes(PRIVATE_BUNDLE_PREFIX)
+        ? await presign(url)
+        : url;
+    let changed = false;
+    const rewritten = await Promise.all(descriptors.map(async (descriptor) => {
+        const bundleUrl = await maybePresign(descriptor.bundleUrl);
+        const styleUrl = await maybePresign(descriptor.styleUrl);
+        const typesUrl = await maybePresign(descriptor.typesUrl);
+        if (bundleUrl === descriptor.bundleUrl &&
+            styleUrl === descriptor.styleUrl &&
+            typesUrl === descriptor.typesUrl) {
+            return descriptor;
+        }
+        changed = true;
+        return {
+            ...descriptor,
+            ...(bundleUrl !== undefined ? { bundleUrl } : {}),
+            ...(styleUrl !== undefined ? { styleUrl } : {}),
+            ...(typesUrl !== undefined ? { typesUrl } : {}),
+        };
+    }));
+    return changed ? { ...item, gadgetDescriptors: rewritten } : item;
+}
 /**
  * Per-slot contextSpec data for an active render, derived to a
  * wire-friendly array. Returns `undefined` when no slots are declared.
@@ -601,17 +685,77 @@ export async function deriveContractBundle(item) {
         contextSpec: item.contextSpec,
     });
 }
+/**
+ * Ceiling on the base64 length {@link deriveRenderMeta} will inline as
+ * `codeB64` (256 KiB of base64 ≈ 192 KiB of source). Generated
+ * components run 5–50 KB; the cap exists so a pathological render
+ * cannot balloon every tool result and resource read it rides on.
+ * Over-cap renders keep their `codeUrl` / live-channel delivery.
+ */
+export const CODE_B64_MAX_CHARS = 262_144;
+/**
+ * Base64-encode a component render's compiled source for the inline
+ * `codeB64` channel. `undefined` for non-component variants, empty
+ * source, or over-cap source (see {@link CODE_B64_MAX_CHARS}).
+ */
+function deriveCodeB64(item) {
+    if (item.type === 'mcpApps' || item.type === 'system')
+        return undefined;
+    const code = item.componentCode;
+    if (typeof code !== 'string' || code.length === 0)
+        return undefined;
+    const encoded = Buffer.from(code, 'utf8').toString('base64');
+    if (encoded.length > CODE_B64_MAX_CHARS)
+        return undefined;
+    return encoded;
+}
 /**
  * Build the {@link RenderMetaView} for a render — the
  * single-entry-point projection function every bootstrap transport
  * SHOULD call. Composing transports take the view, spread it into
  * their own envelope alongside render/auth/runtime concerns. The
- * static-component code body itself is delivered via the render
- * handler's `codeUrl` channel (composed from `codeStore` + `codeBaseUrl`);
- * this projection only carries the wire-shape metadata.
+ * static-component code body is delivered via the render handler's
+ * `codeUrl` channel (composed from `codeStore` + `codeBaseUrl`) AND —
+ * for fetch-blocked hosts — inline via the size-capped `codeB64`
+ * field this projection carries.
  *
  * Pure. Same input → identical output, byte-for-byte.
  */
+/**
+ * Spread a {@link RenderMetaView}'s state + policy fields onto an
+ * `ai.ggui/render` slice literal — the ONE place the view→slice field
+ * list lives (#483 follow-up). Every slice emitter (ggui_render /
+ * ggui_update resultMeta, the resources/read shell, the /state route)
+ * MUST compose its envelope as `{ ...siteFields, ...spreadRenderMetaViewOntoSlice(view) }`
+ * instead of re-listing view fields: four emitters once re-spread the
+ * list by hand, and a field missing from one hand-copy is silently
+ * deleted for that transport (the `epoch` freeze-latch signal shipped
+ * exactly that way — probe 18). Mode discriminators (`kind`,
+ * `codeB64`/`codeUrl`) stay site-local on purpose: their mutual-
+ * exclusion logic differs per transport.
+ *
+ * Array fields are emitted only when non-empty (absent and `[]` are
+ * indistinguishable to every consumer's projection) and re-spread into
+ * fresh arrays so no emitter aliases the view's internals.
+ */
+export function spreadRenderMetaViewOntoSlice(view) {
+    if (view === undefined)
+        return {};
+    return {
+        ...(view.epoch !== undefined ? { epoch: view.epoch } : {}),
+        ...(view.propsJson !== undefined ? { propsJson: view.propsJson } : {}),
+        ...(view.contextSlots !== undefined && view.contextSlots.length > 0
+            ? { contextSlots: [...view.contextSlots] }
+            : {}),
+        ...(view.permissionsPolicy !== undefined && view.permissionsPolicy.length > 0
+            ? { permissionsPolicy: [...view.permissionsPolicy] }
+            : {}),
+        ...(view.theme !== undefined ? { theme: view.theme } : {}),
+        ...(view.gadgets !== undefined && view.gadgets.length > 0
+            ? { gadgets: [...view.gadgets] }
+            : {}),
+    };
+}
 export function deriveRenderMeta(item) {
     // MCP Apps items wire through their own shell — no projection here.
     if (item.type === 'mcpApps')
@@ -644,8 +788,14 @@ export function deriveRenderMeta(item) {
     // system cards theme via the SystemCardHost→ThemeProvider path, not
     // this slice, so `SystemGguiSession` never carries a `theme` sidecar.
     const theme = deriveTheme(item);
+    const codeB64 = deriveCodeB64(item);
     return {
+        // History head epoch (#483) — the mount reads this as its OWN
+        // epoch for the freeze latch. Always projected (0 default) so a
+        // frame can never mistake "absent" for "epoch 0 vs a live head".
+        epoch: item.epoch ?? 0,
         ...(propsJson !== undefined ? { propsJson } : {}),
+        ...(codeB64 !== undefined ? { codeB64 } : {}),
         ...(slots !== undefined ? { contextSlots: [...slots] } : {}),
         ...(permissionsPolicy !== undefined
             ? { permissionsPolicy: [...permissionsPolicy] }
@@ -657,6 +807,23 @@ export function deriveRenderMeta(item) {
         ...(theme !== undefined ? { theme } : {}),
     };
 }
+/**
+ * Flip a WebSocket URL's origin to its HTTP twin —
+ * `wss://host/ws` → `https://host`, `ws://host/ws` → `http://host`.
+ * The fallback base for {@link composeSessionApiUrls} when no
+ * explicit `sessionApiBaseUrl` is configured (same derivation the
+ * cloud pod uses for its oauth issuerUrl). Total: a malformed
+ * `wsUrl` returns `undefined` so slice assembly degrades to
+ * no-channel-URLs instead of throwing mid-resultMeta.
+ */
+export function wsOriginToHttpOrigin(wsUrl) {
+    try {
+        return new URL(wsUrl).origin.replace(/^ws/, 'http');
+    }
+    catch {
+        return undefined;
+    }
+}
 /**
  * Assemble the shared `ai.ggui/render` envelope base from the shared
  * deps. ONE implementation of the three formerly hand-mirrored
@@ -691,12 +858,27 @@ export function assembleRenderSliceBase(deps, call) {
             expiresAt: mintedTrio.expiresAt,
         }
         : {};
+    // Token-bearing session-API URL pair. Base resolution:
+    // explicit `sessionApiBaseUrl` dep (static or request-aware getter)
+    // wins; otherwise flip the minted trio's wsUrl origin ws→http (the
+    // session API is served on the WS origin for OSS defaults and the
+    // cloud pod's single ingress). No minted trio ⇒ `{}` — the URLs
+    // embed the token, so there is nothing honest to stamp.
+    const sessionApiBaseRaw = typeof deps.sessionApiBaseUrl === 'function'
+        ? deps.sessionApiBaseUrl()
+        : deps.sessionApiBaseUrl;
+    const sessionApiBase = sessionApiBaseRaw ??
+        (mintedTrio !== undefined ? wsOriginToHttpOrigin(mintedTrio.wsUrl) : undefined);
+    const channelUrls = mintedTrio !== undefined && sessionApiBase !== undefined
+        ? composeSessionApiUrls(sessionApiBase, call.sessionId, mintedTrio.token)
+        : {};
     const liveTheme = deps.themeProvider?.();
     const themeId = liveTheme?.id ?? call.renderThemeId ?? deps.themeId;
     const themeMode = liveTheme?.mode ?? deps.themeMode;
     return {
         runtimeUrl,
         authFields,
+        channelUrls,
         ...(themeId !== undefined ? { themeId } : {}),
         ...(themeMode !== undefined ? { themeMode } : {}),
     };

package/dist/renders/submit-action.d.ts

@@ -143,6 +143,15 @@ export interface GguiSubmitActionHandlerDeps {
      * is present and lets drain_ack dismiss the toast).
      */
     readonly activeConsumerRegistry?: ActiveConsumerRegistry;
+    /**
+     * Doorbell-race grace OVERRIDE, ms. When set, replaces the adaptive
+     * policy entirely (see the handler body): the registry is waited on
+     * for exactly this long before answering `consumerPresent: false`.
+     * Unset → adaptive: 2s when a consume is plausibly imminent (recent
+     * exit, or first poll of a <60s-old render), 150ms otherwise. Test
+     * hook / operator escape hatch.
+     */
+    readonly consumerGraceMs?: number;
     /**
      * Optional append-only event ledger. When wired, the handler
      * dual-writes every successful dispatch envelope to BOTH:

package/dist/renders/submit-action.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"submit-action.d.ts","sourceRoot":"","sources":["../../src/renders/submit-action.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4DG;AACH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAMxB,OAAO,EAEL,KAAK,sBAAsB,EAC5B,MAAM,0BAA0B,CAAC;AAClC,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AAOjD,QAAA,MAAM,WAAW;;;;;;;CAoCP,CAAC;AAEX,QAAA,MAAM,YAAY;IAChB,yGAAyG;;IAEzG;;;;;;;OAOG;;;;;IAEH,+CAA+C;;IAE/C;;;;;;;;;;;;;;;;OAgBG;;CAEK,CAAC;AAEX,UAAU,kBAAkB;IAC1B,QAAQ,CAAC,EAAE,EAAE,IAAI,CAAC;IAClB;;;;;OAKG;IACH,QAAQ,CAAC,eAAe,CAAC,EAAE,OAAO,CAAC;CACpC;AAED,UAAU,kBAAkB;IAC1B,QAAQ,CAAC,EAAE,EAAE,KAAK,CAAC;IACnB,QAAQ,CAAC,IAAI,EAAE,qBAAqB,GAAG,gBAAgB,CAAC;IACxD,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;CAC1B;AAED,KAAK,gBAAgB,GAAG,kBAAkB,GAAG,kBAAkB,CAAC;AAEhE;;;;;;;;;GASG;AACH,MAAM,WAAW,2BAA2B;IAC1C,QAAQ,CAAC,oBAAoB,CAAC,EAAE,OAAO,0BAA0B,EAAE,oBAAoB,CAAC;IACxF;;;;;;;OAOG;IACH,QAAQ,CAAC,sBAAsB,CAAC,EAAE,sBAAsB,CAAC;IACzD;;;;;;;;;;;;;;;;;;;;;;OAsBG;IACH,QAAQ,CAAC,WAAW,CAAC,EAAE,OAAO,0BAA0B,EAAE,gBAAgB,CAAC;IAC3E;;;;;OAKG;IACH,QAAQ,CAAC,MAAM,CAAC,EAAE;QAChB,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC,GAAG,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,KAAK,IAAI,CAAC;KACvE,CAAC;CACH;AAED,wBAAgB,6BAA6B,CAC3C,IAAI,GAAE,2BAAgC,GACrC,aAAa,CAAC,OAAO,WAAW,EAAE,OAAO,YAAY,EAAE,gBAAgB,CAAC,CAqK1E"}
+{"version":3,"file":"submit-action.d.ts","sourceRoot":"","sources":["../../src/renders/submit-action.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4DG;AACH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAMxB,OAAO,EAEL,KAAK,sBAAsB,EAC5B,MAAM,0BAA0B,CAAC;AAClC,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AAOjD,QAAA,MAAM,WAAW;;;;;;;CAoCP,CAAC;AAEX,QAAA,MAAM,YAAY;IAChB,yGAAyG;;IAEzG;;;;;;;OAOG;;;;;IAEH,+CAA+C;;IAE/C;;;;;;;;;;;;;;;;OAgBG;;CAEK,CAAC;AAEX,UAAU,kBAAkB;IAC1B,QAAQ,CAAC,EAAE,EAAE,IAAI,CAAC;IAClB;;;;;OAKG;IACH,QAAQ,CAAC,eAAe,CAAC,EAAE,OAAO,CAAC;CACpC;AAED,UAAU,kBAAkB;IAC1B,QAAQ,CAAC,EAAE,EAAE,KAAK,CAAC;IACnB,QAAQ,CAAC,IAAI,EAAE,qBAAqB,GAAG,gBAAgB,CAAC;IACxD,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;CAC1B;AAED,KAAK,gBAAgB,GAAG,kBAAkB,GAAG,kBAAkB,CAAC;AAEhE;;;;;;;;;GASG;AACH,MAAM,WAAW,2BAA2B;IAC1C,QAAQ,CAAC,oBAAoB,CAAC,EAAE,OAAO,0BAA0B,EAAE,oBAAoB,CAAC;IACxF;;;;;;;OAOG;IACH,QAAQ,CAAC,sBAAsB,CAAC,EAAE,sBAAsB,CAAC;IACzD;;;;;;;OAOG;IACH,QAAQ,CAAC,eAAe,CAAC,EAAE,MAAM,CAAC;IAClC;;;;;;;;;;;;;;;;;;;;;;OAsBG;IACH,QAAQ,CAAC,WAAW,CAAC,EAAE,OAAO,0BAA0B,EAAE,gBAAgB,CAAC;IAC3E;;;;;OAKG;IACH,QAAQ,CAAC,MAAM,CAAC,EAAE;QAChB,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC,GAAG,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,KAAK,IAAI,CAAC;KACvE,CAAC;CACH;AAED,wBAAgB,6BAA6B,CAC3C,IAAI,GAAE,2BAAgC,GACrC,aAAa,CAAC,OAAO,WAAW,EAAE,OAAO,YAAY,EAAE,gBAAgB,CAAC,CAwO1E"}

package/dist/renders/submit-action.js

@@ -250,10 +250,79 @@ export function createGguiSubmitActionHandler(deps = {}) {
                     // the pipe. When the seam isn't wired, the field is omitted
                     // and the iframe assumes a consumer is present (drain_ack
                     // will resolve the toast).
+                    //
+                    // GRACE WINDOW (doorbell race, observed live 2026-08-12):
+                    // clicks routinely land a few hundred ms BEFORE the agent's
+                    // next consume parks (live captures: 380ms and 371ms gaps).
+                    // Answering `false` at the click instant makes the iframe
+                    // ring the ui/message doorbell — and then the parked consume
+                    // drains the SAME event, so the agent handles it twice (once
+                    // from consume, once from the doorbell prompt). Instead of
+                    // deciding at the instant, poll the registry briefly: a
+                    // consumer parking inside the window drains this event and
+                    // the honest answer is `true`. A full-window miss means no
+                    // consume is coming this turn — `false`, ring away. The
+                    // extra latency applies ONLY to the no-consumer case and is
+                    // well under gesture-feedback tolerances.
                     if (deps.activeConsumerRegistry !== undefined) {
+                        const registry = deps.activeConsumerRegistry;
+                        // ADAPTIVE grace (2026-08-12 follow-up to the fixed
+                        // window): wait only when a consume is plausibly imminent,
+                        // judged from server-side facts — no environment guesses.
+                        //   - recent consumer exit (<10s): the agent is mid-loop
+                        //     (consume → act → consume); a re-poll is very likely
+                        //     → wait up to 2s.
+                        //   - no consumer EVER seen + render younger than 20s: the
+                        //     post-render FIRST poll is the classic 380ms race →
+                        //     wait up to 2s.
+                        //   - otherwise (idle card, agent long gone): 150ms —
+                        //     enough to absorb scheduling jitter, snappy enough
+                        //     that the doorbell (the only wake-up left) rings
+                        //     promptly.
+                        // `waitForConsumer` is event-driven: a consumer parking
+                        // mid-window flips the answer instantly, so the window is
+                        // a CEILING, not a fixed cost. `consumerGraceMs` overrides
+                        // the whole policy (test hook / operator escape).
+                        let graceMs = deps.consumerGraceMs;
+                        if (graceMs === undefined) {
+                            const sinceExit = registry.msSinceLastExit(env.sessionId);
+                            if (sinceExit !== undefined && sinceExit < 10_000) {
+                                graceMs = 2_000;
+                            }
+                            else if (sinceExit === undefined) {
+                                let renderAgeMs;
+                                if (deps.renderStore !== undefined) {
+                                    try {
+                                        const row = await deps.renderStore.get(env.sessionId);
+                                        const createdAt = row?.render.createdAt;
+                                        renderAgeMs =
+                                            typeof createdAt === 'number'
+                                                ? Math.max(0, Date.now() - createdAt)
+                                                : undefined;
+                                    }
+                                    catch {
+                                        // Best-effort age read — fall through to the
+                                        // fast-answer arm on store hiccups.
+                                    }
+                                }
+                                // 60s (was 20s): a live probe clicked 20.4s
+                                // post-render — 400ms past the old threshold — and
+                                // rang a duplicate doorbell while the first poll
+                                // parked 462ms later. Waiting 2s on a genuinely dead
+                                // card is cheap; a false ring is not.
+                                graceMs =
+                                    renderAgeMs !== undefined && renderAgeMs < 60_000
+                                        ? 2_000
+                                        : 150;
+                            }
+                            else {
+                                graceMs = 150;
+                            }
+                        }
+                        const present = await registry.waitForConsumer(env.sessionId, graceMs);
                         return {
                             ok: true,
-                            consumerPresent: deps.activeConsumerRegistry.hasActive(env.sessionId),
+                            consumerPresent: present,
                         };
                     }
                 }

package/dist/renders/update.d.ts

@@ -81,9 +81,18 @@ import { GguiSessionNotFoundError } from './errors.js';
  * handler awaits to surface unexpected errors via the structured logger
  * (best-effort delivery; thrown errors in the seam don't fail the tool
  * call).
+ *
+ * `epoch` is the history epoch of the commit this frame carries —
+ * `ggui_update` fans its freshly-advanced epoch, `ggui_amend` fans the
+ * unchanged head. The notifier MUST put it on the `props_update`
+ * payload verbatim: it is the freeze-latch signal (#483) that tells a
+ * lower-epoch mount it has been superseded. The mutation core passes
+ * the commit-time value so implementations never re-read the row (a
+ * re-read races a concurrent update and can stamp an amend's frame
+ * with a newer epoch, freezing the live head it belongs to).
  */
 export interface PropsUpdateNotifier {
-    sendPropsUpdate(sessionId: string, props: JsonObject): Promise<void>;
+    sendPropsUpdate(sessionId: string, props: JsonObject, epoch: number): Promise<void>;
 }
 /** Re-exported for callers that prefer to import the error from this module.
  *  These are the two typed failure shapes `ggui_update` throws:
@@ -113,7 +122,7 @@ export interface BillingGate {
          * different policies per call-site (e.g. update is free / render
          * triggers a credit charge).
          */
-        readonly tool: 'ggui_update' | 'ggui_render';
+        readonly tool: 'ggui_update' | 'ggui_amend' | 'ggui_render';
     }): Promise<void> | void;
 }
 /**
@@ -174,66 +183,48 @@ export interface GguiUpdateHandlerDeps extends RenderSliceMetaDeps {
      */
     readonly description?: string;
 }
-/**
- * Input raw-shape — discriminated on `kind`:
- *
- *   - `kind:'replace'` + `props` — full props replacement. The new
- *     map IS the new state.
- *   - `kind:'merge'` + `patch` — RFC 7396 JSON Merge Patch.
- *
- * Both validate the FINAL props (post-merge for `merge`) against the
- * render's `propsSpec`.
- */
 declare const inputSchema: {
-    /**
-     * Globally-unique render id. Optional on the wire so an in-process
-     * dispatcher (live-channel dispatch / threaded mount) can populate it
-     * via `HandlerContext.sessionId` instead. Required at the handler
-     * level — see the resolve step inside `handler`.
-     */
     readonly sessionId: z.ZodOptional<z.ZodString>;
-    /**
-     * Mode discriminator. `'replace'` requires `props`; `'merge'`
-     * requires `patch`. The narrowing step inside `handler` enforces
-     * both presence + mutual exclusion.
-     */
     readonly kind: z.ZodEnum<{
         replace: "replace";
         merge: "merge";
     }>;
-    /**
-     * Full new props map. Required when `kind === 'replace'`; rejected
-     * otherwise. Validated against the GguiSession's `propsSpec` after
-     * applying.
-     */
     readonly props: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodUnknown>>;
-    /**
-     * RFC 7396 JSON Merge Patch. Required when `kind === 'merge'`;
-     * rejected otherwise. The handler applies the patch to the existing
-     * props, then validates the merged result against `propsSpec`.
-     * `null` values in the patch DELETE the corresponding key.
-     */
     readonly patch: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodUnknown>>;
 };
 declare const outputSchema: {
     readonly sessionId: z.ZodString;
     readonly updated: z.ZodBoolean;
     /**
-     * Spec-canonical MCP-Apps entry-point — same `ui://ggui/render/{id}`
-     * URI `ggui_render` stamped on the initial mount. Updates carry it
-     * too so spec-compliant hosts can re-fetch the resource (returns the
-     * SAME shell HTML with refreshed `__GGUI_META__` baked in) and apply
-     * the props patch in-place. SDKs that strip `_meta` from tool_results
-     * (OpenAI Agents SDK, Google ADK) reach the URI via this LLM-visible
-     * field; SDKs that preserve `_meta` also see it on
-     * `_meta.ui.resourceUri`.
+     * The epoch-pinned URI of the NEW history record this update minted
+     * (`ui://ggui/render/{id}[/{key}]#{epoch}` — #483). On a no-op
+     * (`updated: false`) no record is minted and this is the bare
+     * live-head URI. SDKs that strip `_meta` from tool_results (OpenAI
+     * Agents SDK, Google ADK) reach the URI via this LLM-visible field;
+     * SDKs that preserve `_meta` also see it on `_meta.ui.resourceUri`.
      */
     readonly resourceUri: z.ZodString;
+    /**
+     * The session's head epoch after this call — advanced by one on a
+     * real update, unchanged on a no-op. `ggui_render` mints epoch 0;
+     * the row is the authority (#483).
+     */
+    readonly epoch: z.ZodNumber;
+    /**
+     * Present ONLY on a no-op: the patch validated and conformed but
+     * left props identical to the current state, so nothing was written,
+     * nothing changes on screen, and NO history record was minted.
+     * Model-visible by design — the common producer of a no-op is an LLM
+     * echoing existing props back, and this is its only feedback channel.
+     */
+    readonly warning: z.ZodOptional<z.ZodString>;
 };
 interface UpdateOutput {
     sessionId: string;
     updated: boolean;
     resourceUri: string;
+    epoch: number;
+    warning?: string;
 }
 /**
  * Build the OSS `ggui_update` handler. Handler is additive — declared

package/dist/renders/update.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"update.d.ts","sourceRoot":"","sources":["../../src/renders/update.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6DG;AACH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EACL,sBAAsB,EAEtB,KAAK,UAAU,EAEhB,MAAM,mBAAmB,CAAC;AAM3B,OAAO,KAAK,EACV,gBAAgB,EAChB,mBAAmB,EACpB,MAAM,0BAA0B,CAAC;AAClC,OAAO,KAAK,EAAE,cAAc,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AAMjE,OAAO,EAIL,KAAK,mBAAmB,EACzB,MAAM,4BAA4B,CAAC;AACpC,OAAO,EAAE,wBAAwB,EAAE,MAAM,aAAa,CAAC;AAGvD;;;;;;;;;;;;;;;GAeG;AACH,MAAM,WAAW,mBAAmB;IAClC,eAAe,CAAC,SAAS,EAAE,MAAM,EAAE,KAAK,EAAE,UAAU,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CACtE;AAED;;;wDAGwD;AACxD,OAAO,EAAE,wBAAwB,EAAE,sBAAsB,EAAE,CAAC;AAE5D;;;;;;;;;;;;;;GAcG;AACH,MAAM,WAAW,WAAW;IAC1B,QAAQ,CAAC,KAAK,EAAE;QACd,QAAQ,CAAC,GAAG,EAAE,cAAc,CAAC;QAC7B;;;;WAIG;QACH,QAAQ,CAAC,IAAI,EAAE,aAAa,GAAG,aAAa,CAAC;KAC9C,GAAG,OAAO,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC;CAC1B;AAED;;;;;;;;;;;;;;GAcG;AACH,MAAM,WAAW,qBAAsB,SAAQ,mBAAmB;IAChE,4EAA4E;IAC5E,QAAQ,CAAC,WAAW,EAAE,gBAAgB,CAAC;IACvC;;;;;;;;;;;;OAYG;IACH,QAAQ,CAAC,mBAAmB,CAAC,EAAE,mBAAmB,CAAC;IACnD;;;;;;;;;;OAUG;IACH,QAAQ,CAAC,mBAAmB,CAAC,EAAE,mBAAmB,CAAC;IACnD;;;;;OAKG;IACH,QAAQ,CAAC,WAAW,CAAC,EAAE,WAAW,CAAC;IACnC;;;;OAIG;IACH,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAC;CAO/B;AAED;;;;;;;;;GASG;AACH,QAAA,MAAM,WAAW;IACf;;;;;OAKG;;IAEH;;;;OAIG;;;;;IAEH;;;;OAIG;;IAEH;;;;;OAKG;;CAEK,CAAC;AAEX,QAAA,MAAM,YAAY;;;IAGhB;;;;;;;;;OASG;;CAEK,CAAC;AAEX,UAAU,YAAY;IACpB,SAAS,EAAE,MAAM,CAAC;IAClB,OAAO,EAAE,OAAO,CAAC;IACjB,WAAW,EAAE,MAAM,CAAC;CACrB;AAED;;;;;GAKG;AACH,wBAAgB,uBAAuB,CACrC,IAAI,EAAE,qBAAqB,GAC1B,aAAa,CAAC,OAAO,WAAW,EAAE,OAAO,YAAY,EAAE,YAAY,CAAC,CAsRtE"}
+{"version":3,"file":"update.d.ts","sourceRoot":"","sources":["../../src/renders/update.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6DG;AACH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EACL,sBAAsB,EAEtB,KAAK,UAAU,EAChB,MAAM,mBAAmB,CAAC;AAO3B,OAAO,KAAK,EACV,gBAAgB,EAChB,mBAAmB,EACpB,MAAM,0BAA0B,CAAC;AAClC,OAAO,KAAK,EAAE,cAAc,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AACjE,OAAO,EAKL,KAAK,mBAAmB,EACzB,MAAM,4BAA4B,CAAC;AACpC,OAAO,EAAE,wBAAwB,EAAE,MAAM,aAAa,CAAC;AAMvD;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,MAAM,WAAW,mBAAmB;IAClC,eAAe,CACb,SAAS,EAAE,MAAM,EACjB,KAAK,EAAE,UAAU,EACjB,KAAK,EAAE,MAAM,GACZ,OAAO,CAAC,IAAI,CAAC,CAAC;CAClB;AAED;;;wDAGwD;AACxD,OAAO,EAAE,wBAAwB,EAAE,sBAAsB,EAAE,CAAC;AAE5D;;;;;;;;;;;;;;GAcG;AACH,MAAM,WAAW,WAAW;IAC1B,QAAQ,CAAC,KAAK,EAAE;QACd,QAAQ,CAAC,GAAG,EAAE,cAAc,CAAC;QAC7B;;;;WAIG;QACH,QAAQ,CAAC,IAAI,EAAE,aAAa,GAAG,YAAY,GAAG,aAAa,CAAC;KAC7D,GAAG,OAAO,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC;CAC1B;AAED;;;;;;;;;;;;;;GAcG;AACH,MAAM,WAAW,qBAAsB,SAAQ,mBAAmB;IAChE,4EAA4E;IAC5E,QAAQ,CAAC,WAAW,EAAE,gBAAgB,CAAC;IACvC;;;;;;;;;;;;OAYG;IACH,QAAQ,CAAC,mBAAmB,CAAC,EAAE,mBAAmB,CAAC;IACnD;;;;;;;;;;OAUG;IACH,QAAQ,CAAC,mBAAmB,CAAC,EAAE,mBAAmB,CAAC;IACnD;;;;;OAKG;IACH,QAAQ,CAAC,WAAW,CAAC,EAAE,WAAW,CAAC;IACnC;;;;OAIG;IACH,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAC;CAO/B;AAMD,QAAA,MAAM,WAAW;;;;;;;;CAAsB,CAAC;AAExC,QAAA,MAAM,YAAY;;;IAGhB;;;;;;;OAOG;;IAEH;;;;OAIG;;IAEH;;;;;;OAMG;;CAEK,CAAC;AAEX,UAAU,YAAY;IACpB,SAAS,EAAE,MAAM,CAAC;IAClB,OAAO,EAAE,OAAO,CAAC;IACjB,WAAW,EAAE,MAAM,CAAC;IACpB,KAAK,EAAE,MAAM,CAAC;IACd,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB;AAED;;;;;GAKG;AACH,wBAAgB,uBAAuB,CACrC,IAAI,EAAE,qBAAqB,GAC1B,aAAa,CAAC,OAAO,WAAW,EAAE,OAAO,YAAY,EAAE,YAAY,CAAC,CAwJtE"}