@ggui-ai/mcp-server 0.1.0-rc.3 → 0.2.0-alpha.1

package/dist/llm-backed-negotiator.js

@@ -39,7 +39,7 @@
  *
  * One LLM call per handshake (when creds resolve). Operators
  * concerned about cost can either (a) skip handshake and call
- * `ggui_push` directly with `{story}`, or (b) bind a different
+ * `ggui_render` directly with `{story}`, or (b) bind a different
  * negotiator (e.g., the cache-backed one for read-only cache
  * lookups) via `createGguiServer({handshake: {negotiator: ...}})`.
  *
@@ -50,11 +50,11 @@
  * same `negotiate()` pipeline, just with degraded RAG when local
  * infrastructure isn't bound.
  */
-import { negotiate } from '@ggui-ai/negotiator';
-import { DEFAULT_GENERATOR_SLUG, matchBlueprint, } from '@ggui-ai/mcp-server-handlers/session-mutations';
-import { createHash, randomUUID } from 'node:crypto';
-import { blueprintKey } from '@ggui-ai/protocol/blueprint-key';
-import { selectAdapter } from '@ggui-ai/ui-gen/providers';
+import { DEFAULT_GENERATOR_SLUG, matchBlueprint, } from "@ggui-ai/mcp-server-handlers/renders";
+import { negotiate } from "@ggui-ai/negotiator";
+import { blueprintKey } from "@ggui-ai/protocol/blueprint-key";
+import { selectAdapter } from "@ggui-ai/ui-gen/providers";
+import { createHash, randomUUID } from "node:crypto";
 /**
  * Operational error classifier — mirrors the cloud helper. Bugs
  * surface; provider failures + network blips degrade to a "create"
@@ -96,12 +96,23 @@ function isOperationalError(err) {
  */
 export function buildLlmCaller(selection, providerKey) {
     const adapter = selectAdapter(selection.provider);
-    const isAnthropic = selection.provider === 'anthropic';
+    const isAnthropic = selection.provider === "anthropic";
+    // `selection` IS an `LlmRoute & {inference params}` — the typed
+    // discriminated union means `selection.model` is already in the
+    // wire-canonical form the provider SDK expects. No LiteLLM-prefix
+    // strip happens here; if one were ever needed again, the validator
+    // belongs at the route construction boundary (`parseAnyLlmRoute`),
+    // not at the SDK-call site. This is what eliminates the #22 / #42
+    // bug class structurally. We pass `selection` itself as the `route`
+    // — re-constructing an object literal would widen the typed
+    // discriminator and lose the (provider, model) pairing TS needs to
+    // narrow against `LlmRoute`'s union.
+    const route = selection;
     const caller = {
         async call(systemPrompt, userMessage, maxTokens) {
             const result = await adapter.complete({
                 apiKey: providerKey.key,
-                model: selection.model,
+                route,
                 systemPrompt,
                 userPrompt: userMessage,
                 ...(maxTokens !== undefined ? { maxTokens } : {}),
@@ -147,7 +158,7 @@ async function anthropicCallStructured(args) {
         // paraphrase via canonical-key normalisation rather than relying
         // on temperature=0.
         system: args.systemPrompt,
-        messages: [{ role: 'user', content: args.userMessage }],
+        messages: [{ role: "user", content: args.userMessage }],
         tools: [
             {
                 name: args.tool.name,
@@ -158,26 +169,26 @@ async function anthropicCallStructured(args) {
         // Forced tool use — model MUST emit exactly this tool. Without
         // this the model can drift to a text reply and synth/rerank
         // both lose their structured guarantee.
-        tool_choice: { type: 'tool', name: args.tool.name },
+        tool_choice: { type: "tool", name: args.tool.name },
     };
-    const response = await fetch('https://api.anthropic.com/v1/messages', {
-        method: 'POST',
+    const response = await fetch("https://api.anthropic.com/v1/messages", {
+        method: "POST",
         headers: {
-            'x-api-key': args.apiKey,
-            'anthropic-version': '2023-06-01',
-            'content-type': 'application/json',
+            "x-api-key": args.apiKey,
+            "anthropic-version": "2023-06-01",
+            "content-type": "application/json",
         },
         body: JSON.stringify(body),
     });
     if (!response.ok) {
-        const text = await response.text().catch(() => '');
+        const text = await response.text().catch(() => "");
         throw new Error(`anthropic tool-use HTTP ${response.status}: ${text.slice(0, 500)}`);
     }
     const json = (await response.json());
     // Find the tool_use block. With `tool_choice: {type:'tool'}` the
     // model is forced to emit exactly one; defensively scan in case the
     // shape ever shifts.
-    const toolUse = json.content?.find((block) => block.type === 'tool_use' && block.name === args.tool.name);
+    const toolUse = json.content?.find((block) => block.type === "tool_use" && block.name === args.tool.name);
     if (!toolUse || toolUse.input === undefined) {
         throw new Error(`anthropic tool-use response missing tool_use block for "${args.tool.name}"`);
     }
@@ -189,17 +200,17 @@ function buildCreateFallback(draftContract, reason, _estimatedLatencyMs) {
     // agent's draft. Gen-pending; no codeHash; provisional blueprintId.
     const contractHash = blueprintKey(draftContract);
     const suggestion = {
-        origin: 'agent',
+        origin: "agent",
         rationale: reason,
         blueprintMeta: {
             blueprintId: `bp_${randomUUID()}`,
             contractHash,
-            generator: 'ui-gen-default-haiku-4-5',
+            generator: "ui-gen-default-haiku-4-5",
             variance: {},
         },
     };
     return {
-        action: 'create',
+        action: "create",
         reason,
         suggestion,
         effectiveContract: draftContract,
@@ -217,7 +228,7 @@ function buildCreateFallback(draftContract, reason, _estimatedLatencyMs) {
 export function createLlmBackedHandshakeNegotiator(deps) {
     const estimatedLatencyMs = deps.estimatedGenerationLatencyMs ?? DEFAULT_GEN_LATENCY_MS;
     return {
-        async decide({ intent, blueprintDraft, gadgets, ctx, sessionId }) {
+        async decide({ intent, blueprintDraft, gadgets, ctx }) {
             const draftContract = blueprintDraft.contract;
             // Handshake-time exact-key fast path. Runs BEFORE the BYOK
             // creds resolve + LLM synth — a cache hit needs neither the
@@ -225,7 +236,7 @@ export function createLlmBackedHandshakeNegotiator(deps) {
             // draft canonical-key-equals a registered blueprint, return
             // `origin: 'cache'` with the matched blueprint's contract +
             // componentCode hash so the paired push.accept short-circuits
-            // straight into commitCachedStackItem.
+            // straight into commitCachedRender.
             //
             // No-match (or any throw) falls through to today's synth path
             // — the negotiator stays useful when the registry is cold,
@@ -235,21 +246,17 @@ export function createLlmBackedHandshakeNegotiator(deps) {
                 try {
                     const matchDeps = {
                         registry: deps.cache,
-                        ...(deps.installedBlueprints
-                            ? { installedBlueprints: deps.installedBlueprints }
-                            : {}),
+                        ...(deps.installedBlueprints ? { installedBlueprints: deps.installedBlueprints } : {}),
                     };
                     const matchResult = await matchBlueprint(matchDeps, ctx.appId, {
                         intent,
                         contract: draftContract,
                     });
-                    if (matchResult.strategy === 'exact-key') {
+                    if (matchResult.strategy === "exact-key") {
                         const matched = matchResult.blueprint;
-                        const codeHash = createHash('sha256')
-                            .update(matched.componentCode)
-                            .digest('hex');
+                        const codeHash = createHash("sha256").update(matched.componentCode).digest("hex");
                         const suggestion = {
-                            origin: 'cache',
+                            origin: "cache",
                             rationale: matchResult.reason,
                             blueprintMeta: {
                                 blueprintId: matched.id,
@@ -261,7 +268,7 @@ export function createLlmBackedHandshakeNegotiator(deps) {
                             },
                         };
                         return {
-                            action: 'reuse',
+                            action: "reuse",
                             reason: matchResult.reason,
                             suggestion,
                             effectiveContract: matched.contract,
@@ -286,7 +293,7 @@ export function createLlmBackedHandshakeNegotiator(deps) {
             }
             const creds = await deps.resolveLlm(ctx);
             if (!creds) {
-                return buildCreateFallback(draftContract, 'no-creds: no BYOK credentials resolved for the configured provider; ggui_push will surface the same error and the handshake stays a no-op create.', estimatedLatencyMs);
+                return buildCreateFallback(draftContract, "no-creds: no BYOK credentials resolved for the configured provider; ggui_render will surface the same error and the handshake stays a no-op create.", estimatedLatencyMs);
             }
             try {
                 const llm = buildLlmCaller(creds.selection, creds.providerKey);
@@ -295,14 +302,16 @@ export function createLlmBackedHandshakeNegotiator(deps) {
                 const result = await negotiate({ llm }, {
                     agent: {
                         prompt: synthPrompt,
-                        ...(declaredAgentTools.length > 0
-                            ? { agentTools: declaredAgentTools }
-                            : {}),
+                        ...(declaredAgentTools.length > 0 ? { agentTools: declaredAgentTools } : {}),
                         ...(gadgets !== undefined ? { gadgets } : {}),
                     },
                     config: {
                         appId: ctx.appId,
-                        sessionId: sessionId ?? 'handshake',
+                        // Handshake runs ahead of any concrete render — no renderId
+                        // is bound yet. The negotiator only uses `renderId` to key
+                        // its optional `readRenderState` callback, which the OSS
+                        // path doesn't wire here, so a stable placeholder works.
+                        renderId: "handshake",
                         includeSharedPool: false,
                     },
                 });
@@ -318,53 +327,53 @@ export function createLlmBackedHandshakeNegotiator(deps) {
                 let suggestion;
                 if (blueprintId) {
                     suggestion = {
-                        origin: 'cache',
+                        origin: "cache",
                         rationale: decision.reasoning ?? `cache match (${blueprintId})`,
                         blueprintMeta: {
                             blueprintId,
                             contractHash,
-                            generator: 'ui-gen-default-haiku-4-5',
+                            generator: "ui-gen-default-haiku-4-5",
                             variance: {},
                         },
                     };
                 }
                 else if (contractHash === draftHash) {
                     suggestion = {
-                        origin: 'agent',
-                        rationale: decision.reasoning ?? 'novel-but-clean contract',
+                        origin: "agent",
+                        rationale: decision.reasoning ?? "novel-but-clean contract",
                         blueprintMeta: {
                             blueprintId: `bp_${randomUUID()}`,
                             contractHash,
-                            generator: 'ui-gen-default-haiku-4-5',
+                            generator: "ui-gen-default-haiku-4-5",
                             variance: {},
                         },
                     };
                 }
                 else {
                     suggestion = {
-                        origin: 'synth',
-                        rationale: decision.reasoning ?? 'synth amended contract',
+                        origin: "synth",
+                        rationale: decision.reasoning ?? "synth amended contract",
                         blueprintMeta: {
                             blueprintId: `bp_${randomUUID()}`,
                             contractHash,
-                            generator: 'ui-gen-default-haiku-4-5',
+                            generator: "ui-gen-default-haiku-4-5",
                             variance: {},
                         },
                         amendments: {
                             contractDiff: [
                                 {
-                                    op: 'replace',
-                                    path: '',
+                                    op: "replace",
+                                    path: "",
                                     value: contract,
                                 },
                             ],
-                            reasoning: decision.reasoning ?? 'negotiator-amended contract',
+                            reasoning: decision.reasoning ?? "negotiator-amended contract",
                         },
                     };
                 }
                 return {
-                    action: blueprintId ? 'reuse' : 'create',
-                    reason: decision.reasoning ?? 'negotiated',
+                    action: blueprintId ? "reuse" : "create",
+                    reason: decision.reasoning ?? "negotiated",
                     suggestion,
                     effectiveContract: contract,
                 };
@@ -373,8 +382,8 @@ export function createLlmBackedHandshakeNegotiator(deps) {
                 if (!isOperationalError(err))
                     throw err;
                 const message = err instanceof Error ? err.message : String(err);
-                const errorClass = err instanceof Error ? err.name : 'unknown';
-                return buildCreateFallback(draftContract, `negotiator-degraded: ${errorClass} during decision LLM call — ${message}. Falling back to bare-create; the paired ggui_push will still generate the UI.`, estimatedLatencyMs);
+                const errorClass = err instanceof Error ? err.name : "unknown";
+                return buildCreateFallback(draftContract, `negotiator-degraded: ${errorClass} during decision LLM call — ${message}. Falling back to bare-create; the paired ggui_render will still generate the UI.`, estimatedLatencyMs);
             }
         },
         // LLM-driven variant selection. Reads each candidate's
@@ -390,11 +399,11 @@ export function createLlmBackedHandshakeNegotiator(deps) {
         // variant-selector caller owns the fallback path itself.
         async selectVariant({ candidates, context, ctx }) {
             if (candidates.length === 0) {
-                throw new Error('selectVariant: empty candidates list — orchestration should short-circuit before calling');
+                throw new Error("selectVariant: empty candidates list — orchestration should short-circuit before calling");
             }
             const creds = await deps.resolveLlm(ctx);
             if (!creds) {
-                throw new Error('selectVariant: no BYOK credentials resolved; orchestration falls through to deterministic ladder');
+                throw new Error("selectVariant: no BYOK credentials resolved; orchestration falls through to deterministic ladder");
             }
             const llm = buildLlmCaller(creds.selection, creds.providerKey);
             return runVariantSelectionLlm(llm, candidates, context);
@@ -430,8 +439,8 @@ The request context carries the same fields. Match on:
 Honor operator pins (isOperatorDefault: true) unless variance.persona / variance.aesthetic on the request clearly contradicts the pinned variant — that's the only case where you should override the pin.
 
 Calibrate confidence honestly. Return high (≥ 0.7) only when a clear best match exists. Return low (< 0.6) when signals are weak — the orchestration falls back to a deterministic ladder in that case. The fallback is safe; over-confident picks are NOT.`;
-const VARIANT_SELECTION_TOOL_NAME = 'select_variant';
-const VARIANT_SELECTION_TOOL_DESCRIPTION = 'Pick the variant that best fits the request context. Return the chosen blueprintId, a calibrated 0-1 confidence, and a one-sentence reason citing the matching axes (persona / aesthetic / context / seedPrompt / pin / validator).';
+const VARIANT_SELECTION_TOOL_NAME = "select_variant";
+const VARIANT_SELECTION_TOOL_DESCRIPTION = "Pick the variant that best fits the request context. Return the chosen blueprintId, a calibrated 0-1 confidence, and a one-sentence reason citing the matching axes (persona / aesthetic / context / seedPrompt / pin / validator).";
 /**
  * JSON Schema for the structured-output tool call. Forces the model
  * to emit `{blueprintId, confidence, reason}` — no free-text prose.
@@ -439,24 +448,24 @@ const VARIANT_SELECTION_TOOL_DESCRIPTION = 'Pick the variant that best fits the
  * path parses the same shape from regex-extracted JSON.
  */
 const VARIANT_SELECTION_TOOL_SCHEMA = {
-    type: 'object',
+    type: "object",
     properties: {
         blueprintId: {
-            type: 'string',
-            description: 'One of the candidate blueprintIds shown in the request. Echo exactly — must match a candidate.',
+            type: "string",
+            description: "One of the candidate blueprintIds shown in the request. Echo exactly — must match a candidate.",
         },
         confidence: {
-            type: 'number',
+            type: "number",
             minimum: 0,
             maximum: 1,
-            description: 'Calibrated confidence in this pick on [0, 1]. Use < 0.6 when signals are weak; the orchestration falls back to a deterministic ladder.',
+            description: "Calibrated confidence in this pick on [0, 1]. Use < 0.6 when signals are weak; the orchestration falls back to a deterministic ladder.",
         },
         reason: {
-            type: 'string',
-            description: 'One-sentence rationale citing the matching axes (persona, aesthetic, context, seedPrompt, validator, pin).',
+            type: "string",
+            description: "One-sentence rationale citing the matching axes (persona, aesthetic, context, seedPrompt, validator, pin).",
         },
     },
-    required: ['blueprintId', 'confidence', 'reason'],
+    required: ["blueprintId", "confidence", "reason"],
 };
 /**
  * Build the user-message payload for the variant-selection prompt.
@@ -471,20 +480,12 @@ export function buildVariantSelectionUserMessage(candidates, context) {
     const projectedCandidates = candidates.map((c) => ({
         blueprintId: c.blueprintId,
         generator: c.generator,
-        ...(c.validatorScore !== undefined
-            ? { validatorScore: c.validatorScore }
-            : {}),
+        ...(c.validatorScore !== undefined ? { validatorScore: c.validatorScore } : {}),
         ...(c.isOperatorDefault === true ? { isOperatorDefault: true } : {}),
         variance: {
-            ...(c.variance.persona !== undefined
-                ? { persona: c.variance.persona }
-                : {}),
-            ...(c.variance.context !== undefined
-                ? { context: c.variance.context }
-                : {}),
-            ...(c.variance.seedPrompt !== undefined
-                ? { seedPrompt: c.variance.seedPrompt }
-                : {}),
+            ...(c.variance.persona !== undefined ? { persona: c.variance.persona } : {}),
+            ...(c.variance.context !== undefined ? { context: c.variance.context } : {}),
+            ...(c.variance.seedPrompt !== undefined ? { seedPrompt: c.variance.seedPrompt } : {}),
         },
     }));
     const requestProjection = {
@@ -510,14 +511,14 @@ export function buildVariantSelectionUserMessage(candidates, context) {
             : {}),
     };
     return [
-        'CANDIDATES:',
+        "CANDIDATES:",
         JSON.stringify(projectedCandidates, null, 2),
-        '',
-        'REQUEST:',
+        "",
+        "REQUEST:",
         JSON.stringify(requestProjection, null, 2),
-        '',
-        'Pick the variant that best fits the REQUEST. Echo the blueprintId exactly, surface calibrated confidence, give a one-sentence rationale.',
-    ].join('\n');
+        "",
+        "Pick the variant that best fits the REQUEST. Echo the blueprintId exactly, surface calibrated confidence, give a one-sentence rationale.",
+    ].join("\n");
 }
 /**
  * Run the LLM call + decode. Anthropic path uses `callStructured`
@@ -556,24 +557,24 @@ async function runVariantSelectionLlm(llm, candidates, context) {
  *   `VariantSelectionResult.reason` for telemetry.
  */
 export function parseVariantSelectionResponse(raw) {
-    if (raw === null || typeof raw !== 'object') {
-        throw new Error('variant-selection: response is not an object');
+    if (raw === null || typeof raw !== "object") {
+        throw new Error("variant-selection: response is not an object");
     }
     const obj = raw;
-    const blueprintId = obj['blueprintId'];
-    const confidence = obj['confidence'];
-    const reason = obj['reason'];
-    if (typeof blueprintId !== 'string' || blueprintId.length === 0) {
-        throw new Error('variant-selection: blueprintId missing or non-string');
+    const blueprintId = obj["blueprintId"];
+    const confidence = obj["confidence"];
+    const reason = obj["reason"];
+    if (typeof blueprintId !== "string" || blueprintId.length === 0) {
+        throw new Error("variant-selection: blueprintId missing or non-string");
     }
-    if (typeof confidence !== 'number' ||
+    if (typeof confidence !== "number" ||
         !Number.isFinite(confidence) ||
         confidence < 0 ||
         confidence > 1) {
         throw new Error(`variant-selection: confidence missing or out of range: ${JSON.stringify(confidence)}`);
     }
-    if (typeof reason !== 'string') {
-        throw new Error('variant-selection: reason missing or non-string');
+    if (typeof reason !== "string") {
+        throw new Error("variant-selection: reason missing or non-string");
     }
     return { blueprintId, confidence, reason };
 }

package/dist/mcp-apps-inbound.d.ts

@@ -27,13 +27,13 @@
  * A can NEVER call tools on connector B.
  */
 import type { Express } from 'express';
-import { type ConnectorRegistry, type SessionStore } from '@ggui-ai/mcp-server-core';
+import { type ConnectorRegistry, type RenderStore } from '@ggui-ai/mcp-server-core';
 import type { Logger } from './logger.js';
 /** Default mount path for the MCP Apps inbound routes. */
 export declare const DEFAULT_MCP_APPS_INBOUND_PATH = "/mcp-apps";
 export interface McpAppsInboundOptions {
     readonly connectors: ConnectorRegistry;
-    readonly sessionStore: SessionStore;
+    readonly renderStore: RenderStore;
     readonly logger: Logger;
     /** Override for the mount path prefix. Defaults to `/mcp-apps`. */
     readonly path?: string;
@@ -69,7 +69,7 @@ export declare class ToolsListCache {
  * Register the MCP Apps inbound proxy routes on an Express app.
  *
  *   GET  /mcp-apps/resource?session=<id>&item=<id>
- *     Fetches the referenced McpAppsStackItem's `source.resourceUri`
+ *     Fetches the referenced McpAppsRender's `source.resourceUri`
  *     via resources/read on the source MCP server. Returns the HTML
  *     with the MIME declared by the source (typically
  *     `text/html;profile=mcp-app`) and spec-canonical CSP headers.

package/dist/mcp-apps-inbound.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"mcp-apps-inbound.d.ts","sourceRoot":"","sources":["../src/mcp-apps-inbound.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AAEH,OAAO,KAAK,EAAE,OAAO,EAAqB,MAAM,SAAS,CAAC;AAG1D,OAAO,EACL,KAAK,iBAAiB,EAEtB,KAAK,YAAY,EAClB,MAAM,0BAA0B,CAAC;AAGlC,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,aAAa,CAAC;AAE1C,0DAA0D;AAC1D,eAAO,MAAM,6BAA6B,cAAc,CAAC;AAEzD,MAAM,WAAW,qBAAqB;IACpC,QAAQ,CAAC,UAAU,EAAE,iBAAiB,CAAC;IACvC,QAAQ,CAAC,YAAY,EAAE,YAAY,CAAC;IACpC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,mEAAmE;IACnE,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC;CACxB;AAED;;;;;GAKG;AACH,UAAU,cAAc;IACtB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,UAAU,EAAE,aAAa,CAAC,OAAO,GAAG,KAAK,CAAC,CAAC;CACrD;AAED,MAAM,WAAW,mBAAmB;IAClC,QAAQ,CAAC,MAAM,EAAE,WAAW,CAAC,MAAM,EAAE,cAAc,CAAC,CAAC;IACrD,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;CAC5B;AAED;;;;GAIG;AACH,qBAAa,cAAc;IAEb,OAAO,CAAC,QAAQ,CAAC,KAAK;IADlC,OAAO,CAAC,QAAQ,CAAC,GAAG,CAA0C;gBACjC,KAAK,GAAE,MAAe;IAEnD,GAAG,CAAC,WAAW,EAAE,MAAM,GAAG,mBAAmB,GAAG,IAAI;IAUpD,GAAG,CAAC,WAAW,EAAE,MAAM,EAAE,KAAK,EAAE,QAAQ,CAAC,cAAc,CAAC,GAAG,mBAAmB;IAQ9E,UAAU,CAAC,WAAW,EAAE,MAAM,GAAG,IAAI;CAGtC;AAwDD;;;;;;;;;;;;;;;GAeG;AACH,wBAAgB,qBAAqB,CACnC,GAAG,EAAE,OAAO,EACZ,IAAI,EAAE,qBAAqB,GAC1B,cAAc,CAsIhB"}
+{"version":3,"file":"mcp-apps-inbound.d.ts","sourceRoot":"","sources":["../src/mcp-apps-inbound.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AAEH,OAAO,KAAK,EAAE,OAAO,EAAqB,MAAM,SAAS,CAAC;AAG1D,OAAO,EACL,KAAK,iBAAiB,EAEtB,KAAK,WAAW,EACjB,MAAM,0BAA0B,CAAC;AAGlC,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,aAAa,CAAC;AAE1C,0DAA0D;AAC1D,eAAO,MAAM,6BAA6B,cAAc,CAAC;AAEzD,MAAM,WAAW,qBAAqB;IACpC,QAAQ,CAAC,UAAU,EAAE,iBAAiB,CAAC;IACvC,QAAQ,CAAC,WAAW,EAAE,WAAW,CAAC;IAClC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,mEAAmE;IACnE,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC;CACxB;AAED;;;;;GAKG;AACH,UAAU,cAAc;IACtB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,UAAU,EAAE,aAAa,CAAC,OAAO,GAAG,KAAK,CAAC,CAAC;CACrD;AAED,MAAM,WAAW,mBAAmB;IAClC,QAAQ,CAAC,MAAM,EAAE,WAAW,CAAC,MAAM,EAAE,cAAc,CAAC,CAAC;IACrD,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;CAC5B;AAED;;;;GAIG;AACH,qBAAa,cAAc;IAEb,OAAO,CAAC,QAAQ,CAAC,KAAK;IADlC,OAAO,CAAC,QAAQ,CAAC,GAAG,CAA0C;gBACjC,KAAK,GAAE,MAAe;IAEnD,GAAG,CAAC,WAAW,EAAE,MAAM,GAAG,mBAAmB,GAAG,IAAI;IAUpD,GAAG,CAAC,WAAW,EAAE,MAAM,EAAE,KAAK,EAAE,QAAQ,CAAC,cAAc,CAAC,GAAG,mBAAmB;IAQ9E,UAAU,CAAC,WAAW,EAAE,MAAM,GAAG,IAAI;CAGtC;AA6DD;;;;;;;;;;;;;;;GAeG;AACH,wBAAgB,qBAAqB,CACnC,GAAG,EAAE,OAAO,EACZ,IAAI,EAAE,qBAAqB,GAC1B,cAAc,CAsIhB"}

package/dist/mcp-apps-inbound.js

@@ -28,7 +28,7 @@
  */
 import { Client } from '@modelcontextprotocol/sdk/client/index.js';
 import { StreamableHTTPClientTransport } from '@modelcontextprotocol/sdk/client/streamableHttp.js';
-import { isMcpAppsStackItem } from '@ggui-ai/protocol/integrations/mcp-apps';
+import { isMcpAppsRender } from '@ggui-ai/protocol/integrations/mcp-apps';
 /** Default mount path for the MCP Apps inbound routes. */
 export const DEFAULT_MCP_APPS_INBOUND_PATH = '/mcp-apps';
 /**
@@ -97,24 +97,29 @@ function readVisibility(toolDecl) {
     return out.length > 0 ? out : ['model'];
 }
 /**
- * Resolve `{session, item}` from the ggui session store to a
- * {@link McpAppsStackItem}. Returns null if session or item is missing
- * or the target is not an mcpApps variant.
+ * Resolve `{render}` from the ggui render store to a
+ * {@link McpAppsRender}. Returns null if the render is missing or is
+ * not an mcpApps variant.
+ *
+ * Phase B: a render IS the addressable unit — no per-item lookup inside
+ * a stack vessel — so the render id alone resolves the McpAppsRender
+ * directly. The `itemId` parameter is preserved on the wire-facing
+ * query string for callsite stability but ignored when it matches the
+ * renderId (which is the only valid value post-collapse).
  */
-async function resolveMcpAppsItem(store, sessionId, itemId) {
-    const session = await store.get(sessionId);
-    if (!session)
+async function resolveMcpAppsItem(store, renderId, _itemId) {
+    const stored = await store.get(renderId);
+    if (!stored)
         return null;
-    const entry = session.stack.find((e) => e.id === itemId);
-    if (!entry || !isMcpAppsStackItem(entry))
+    if (!isMcpAppsRender(stored.render))
         return null;
-    return entry;
+    return stored.render;
 }
 /**
  * Register the MCP Apps inbound proxy routes on an Express app.
  *
  *   GET  /mcp-apps/resource?session=<id>&item=<id>
- *     Fetches the referenced McpAppsStackItem's `source.resourceUri`
+ *     Fetches the referenced McpAppsRender's `source.resourceUri`
  *     via resources/read on the source MCP server. Returns the HTML
  *     with the MIME declared by the source (typically
  *     `text/html;profile=mcp-app`) and spec-canonical CSP headers.
@@ -130,15 +135,15 @@ export function installMcpAppsInbound(app, opts) {
     const path = opts.path ?? DEFAULT_MCP_APPS_INBOUND_PATH;
     const cache = new ToolsListCache();
     app.get(`${path}/resource`, async (req, res) => {
-        const sessionId = typeof req.query.session === 'string' ? req.query.session : '';
-        const itemId = typeof req.query.item === 'string' ? req.query.item : '';
-        if (!sessionId || !itemId) {
-            res.status(400).type('text/plain').send('Missing ?session and/or ?item');
+        const renderId = typeof req.query.render === 'string' ? req.query.render : '';
+        const itemId = typeof req.query.item === 'string' ? req.query.item : renderId;
+        if (!renderId) {
+            res.status(400).type('text/plain').send('Missing ?render');
             return;
         }
-        const item = await resolveMcpAppsItem(opts.sessionStore, sessionId, itemId);
+        const item = await resolveMcpAppsItem(opts.renderStore, renderId, itemId);
         if (!item) {
-            res.status(404).type('text/plain').send('Stack item not found');
+            res.status(404).type('text/plain').send('Render not found');
             return;
         }
         const connector = await opts.connectors.get(item.source.connectorId);
@@ -169,7 +174,7 @@ export function installMcpAppsInbound(app, opts) {
         }
         catch (err) {
             opts.logger.error('mcp_apps_resource_proxy_failed', {
-                sessionId,
+                renderId,
                 itemId,
                 connectorId: item.source.connectorId,
                 error: String(err),
@@ -183,14 +188,14 @@ export function installMcpAppsInbound(app, opts) {
     });
     app.post(`${path}/tools-call`, async (req, res) => {
         const body = (req.body ?? {});
-        const sessionId = typeof body.session === 'string' ? body.session : '';
-        const itemId = typeof body.item === 'string' ? body.item : '';
+        const renderId = typeof body.render === 'string' ? body.render : '';
+        const itemId = typeof body.item === 'string' ? body.item : renderId;
         const toolName = typeof body.tool === 'string' ? body.tool : '';
-        if (!sessionId || !itemId || !toolName) {
+        if (!renderId || !toolName) {
             res.status(400).json({ error: 'missing_fields' });
             return;
         }
-        const item = await resolveMcpAppsItem(opts.sessionStore, sessionId, itemId);
+        const item = await resolveMcpAppsItem(opts.renderStore, renderId, itemId);
         if (!item) {
             res.status(404).json({ error: 'item_not_found' });
             return;
@@ -239,7 +244,7 @@ export function installMcpAppsInbound(app, opts) {
         }
         catch (err) {
             opts.logger.error('mcp_apps_tools_call_proxy_failed', {
-                sessionId,
+                renderId,
                 itemId,
                 connectorId: item.source.connectorId,
                 toolName,