@ggui-ai/mcp-server 0.1.0-rc.3 → 0.2.0-alpha.3

package/dist/server.d.ts

@@ -37,32 +37,32 @@
  * handlers wired up. The `Logger.warn('dev_mode_auth_enabled')` fires
  * once at boot so operators see the shape they're running.
  */
-import { type Express, type Request } from 'express';
-import { Server as NodeHttpServer } from 'node:http';
-import type { McpServer } from '@modelcontextprotocol/sdk/server/mcp.js';
-import { type ThemeWriter, type ThemeFileUploader } from './console-theme-routes.js';
-import { type ZodRawShape } from 'zod';
-import type { AppMetadataStore, AuditSink, AuthAdapter, AuthResult, BlueprintProvider, BlueprintSearch, BlueprintSelector, BlueprintStore, ConnectorRegistry, CodeStore, EmbeddingProvider, GeneratorRegistry, KeyValueStore, PairingService, PendingEventConsumer, ProviderKeyStore, RateLimiter, SessionStore, SessionStreamBuffer, ShortCodeIndex, TelemetrySink, ThreadStore, VectorStore } from '@ggui-ai/mcp-server-core';
-import type { Blueprint } from '@ggui-ai/protocol';
-import type { DiscoveredPrimitiveCatalog, LoadedTheme } from '@ggui-ai/project-config/node';
-import type { OperatorConfig } from '@ggui-ai/project-config';
-import type { SharedHandler } from '@ggui-ai/mcp-server-handlers';
-import { type ThemeCatalogEntry } from '@ggui-ai/mcp-server-handlers/app-discovery';
-import { type AppsSource, type UserDefaultAppSource } from '@ggui-ai/mcp-server-handlers/ops-apps';
-import { type OrgsSource, type OrgInvitesSource } from '@ggui-ai/mcp-server-handlers/ops-orgs';
-import { type ConnectorKeysSource } from '@ggui-ai/mcp-server-handlers/ops-connector-keys';
-import { type CouponRedeemSource } from '@ggui-ai/mcp-server-handlers/ops-coupon';
-import type { UiRegistry } from '@ggui-ai/ui-registry';
-import { type ChannelNotifier, type GenerationCredentials, type GenerationDeps, type HandshakeNegotiator, type PropsUpdateNotifier, type ProvisionalPreviewDeps, type ProvisionalPreviewEmitter, type ProvisionalPreviewConfig, type ProvisionalPreviewOutcome } from '@ggui-ai/mcp-server-handlers/session-mutations';
-import { type ServerInfo } from './build-mcp.js';
-import { type OAuthConfig } from './oauth.js';
-import { type Logger } from './logger.js';
-import { type EmailSender, type MagicLinkStore } from './email-login.js';
-import { type McpInstructionsValue } from './instructions-presets.js';
-import { type ThreadOwnerResolver } from './thread-transport.js';
-import { type SessionChannelServer, type WiredActionRouter } from './session-channel.js';
-import { type McpServerMount, type McpService } from './mcp-mounts.js';
-import { type SchemaCompatMode } from './schema-compat.js';
+import type { AppMetadataStore, AuditSink, AuthAdapter, AuthResult, BlueprintProvider, BlueprintSearch, BlueprintSelector, BlueprintStore, CodeStore, ConnectorRegistry, EmbeddingProvider, GeneratorRegistry, KeyValueStore, PairingService, PendingEventConsumer, ProviderKeyStore, RateLimiter, RenderStore, SessionStreamBuffer, ShortCodeIndex, TelemetrySink, ThreadStore, VectorStore } from "@ggui-ai/mcp-server-core";
+import type { SharedHandler } from "@ggui-ai/mcp-server-handlers";
+import { type ThemeCatalogEntry } from "@ggui-ai/mcp-server-handlers/app-discovery";
+import type { OperatorConfig } from "@ggui-ai/project-config";
+import type { DiscoveredPrimitiveCatalog, LoadedTheme } from "@ggui-ai/project-config/node";
+import type { Blueprint } from "@ggui-ai/protocol";
+import type { McpServer } from "@modelcontextprotocol/sdk/server/mcp.js";
+import { type Express, type Request } from "express";
+import { Server as NodeHttpServer } from "node:http";
+import { type ZodRawShape } from "zod";
+import { type ThemeFileUploader, type ThemeWriter } from "./console-theme-routes.js";
+import { type AppsSource, type UserDefaultAppSource } from "@ggui-ai/mcp-server-handlers/ops-apps";
+import { type ConnectorKeysSource } from "@ggui-ai/mcp-server-handlers/ops-connector-keys";
+import { type CouponRedeemSource } from "@ggui-ai/mcp-server-handlers/ops-coupon";
+import { type OrgInvitesSource, type OrgsSource } from "@ggui-ai/mcp-server-handlers/ops-orgs";
+import { type ChannelNotifier, type GenerationCredentials, type GenerationDeps, type HandshakeNegotiator, type PropsUpdateNotifier, type ProvisionalPreviewConfig, type ProvisionalPreviewDeps, type ProvisionalPreviewEmitter, type ProvisionalPreviewOutcome } from "@ggui-ai/mcp-server-handlers/renders";
+import type { UiRegistry } from "@ggui-ai/ui-registry";
+import { type ServerInfo } from "./build-mcp.js";
+import { type EmailSender, type MagicLinkStore } from "./email-login.js";
+import { type McpInstructionsValue } from "./instructions-presets.js";
+import { type Logger } from "./logger.js";
+import { type McpServerMount, type McpService } from "./mcp-mounts.js";
+import { type OAuthConfig } from "./oauth.js";
+import { type RenderChannelServer, type WiredActionRouter } from "./render-channel.js";
+import { type SchemaCompatMode } from "./schema-compat.js";
+import { type ThreadOwnerResolver } from "./thread-transport.js";
 export declare function defaultHandlers(deps: {
     readonly embedding: EmbeddingProvider;
     readonly vectors: VectorStore;
@@ -93,24 +93,24 @@ export declare function defaultHandlers(deps: {
     readonly uiRegistry?: UiRegistry;
     /**
      * Handshake-state KV store. When bound, `ggui_handshake` is
-     * registered and the paired `ggui_push({handshakeId})` consume
+     * registered and the paired `ggui_render({handshakeId})` consume
      * path is enabled. Both handlers share the same instance so the
      * write + read sit on one source of truth.
      *
      * Absent = handshake handler is NOT registered AND
-     * `ggui_push({handshakeId})` falls back to a rejection shape.
+     * `ggui_render({handshakeId})` falls back to a rejection shape.
      */
     readonly handshake?: {
         readonly kvStore: KeyValueStore;
         /**
-         * Optional session store. When bound, `ggui_handshake` validates
-         * the wire `sessionId` against this store (existence + tenant
+         * Optional render store. When bound, `ggui_handshake` validates
+         * the wire render id against this store (existence + tenant
          * ownership) before negotiating. OSS sets this to the same store
-         * push uses so the handshake catches unknown / cross-tenant ids
-         * at the earliest boundary; cloud pods omit and validate at push
-         * time via their own DDB-backed path.
+         * the render-commit handler uses so the handshake catches unknown
+         * / cross-tenant ids at the earliest boundary; cloud pods omit and
+         * validate at render-commit time via their own DDB-backed path.
          */
-        readonly sessionStore?: SessionStore;
+        readonly renderStore?: RenderStore;
         /**
          * Optional negotiator binding. Absent = `ggui_handshake` stamps
          * `action: 'create'` + honest no-negotiator reason on the record
@@ -133,25 +133,18 @@ export declare function defaultHandlers(deps: {
          * subscribe-for vs. must iframe-poll directly. Returning
          * `undefined` omits the field (universal iframe-polling fallback).
          */
-        readonly serverCapabilities?: () => import('@ggui-ai/protocol').ServerCapabilities | undefined;
+        readonly serverCapabilities?: () => import("@ggui-ai/protocol").ServerCapabilities | undefined;
     };
     readonly push?: {
-        readonly sessionStore: SessionStore;
-        readonly renderBaseUrl: string;
+        readonly renderStore: RenderStore;
         /**
-         * Optional render-URL signer. Returns the query suffix to append
-         * to a minted URL (`sig=...&exp=...`, no leading `?` or `&`).
-         * Absent when `renderSigning: false` is set on boot.
-         * Mirrors the handler-side dep with the same name.
+         * Optional bootstrap-credential minter. When present, `ggui_render`
+         * (the renamed render-commit tool) results carry the
+         * `ai.ggui/render` slice meta. When absent, they don't —
+         * non-MCP-Apps hosts read `{renderId}` off structuredContent and
+         * resolve the render-resource themselves.
          */
-        readonly signRenderUrl?: (shortCode: string) => string;
-        /**
-         * Optional bootstrap-credential minter. When present, `ggui_push`
-         * results carry `_meta.ggui.bootstrap`. When absent, they don't —
-         * non-MCP-Apps hosts still get `structuredContent.url` as the
-         * fallback link.
-         */
-        readonly mintBootstrap?: (sessionId: string, appId: string) => {
+        readonly mintBootstrap?: (renderId: string, appId: string) => {
             wsUrl: string;
             token: string;
             expiresAt: string;
@@ -159,7 +152,7 @@ export declare function defaultHandlers(deps: {
         /**
          * URL of the renderer bundle the thin-shell HTML should fetch
          * (C8 — plan §C8). Padded onto
-         * {@link GguiBootstrapMeta.runtimeUrl} at `resultMeta` time.
+         * {@link McpAppAiGguiRenderMeta.runtimeUrl} at `resultMeta` time.
          * Same-origin default is `/_ggui/iframe-runtime.js`; hosted cloud
          * operators override to a CDN URL. Required when `mintBootstrap`
          * is set (the thin shell depends on it); otherwise ignored.
@@ -174,13 +167,13 @@ export declare function defaultHandlers(deps: {
         readonly runtimeUrl?: string | (() => string | undefined);
         /**
          * Theme preset id resolved from `ggui.json#theme`. Forwarded onto
-         * `_meta.ggui.bootstrap.themeId` in the `ggui_push` resultMeta so
-         * MCP Apps hosts (claude.ai, Claude Desktop) propagate the
-         * operator's theme into the iframe.
+         * the `ai.ggui/render.themeId` slice field in the `ggui_render`
+         * resultMeta so MCP Apps hosts (claude.ai, Claude Desktop)
+         * propagate the operator's theme into the iframe.
          */
         readonly themeId?: string;
         /** Theme color mode resolved from `ggui.json#theme.mode`. */
-        readonly themeMode?: 'light' | 'dark';
+        readonly themeMode?: "light" | "dark";
         /**
          * Live theme getter — resolved per-push. When set, supersedes
          * the static `themeId` / `themeMode` for every push's bootstrap.
@@ -192,7 +185,7 @@ export declare function defaultHandlers(deps: {
          */
         readonly themeProvider?: () => {
             readonly id?: string;
-            readonly mode?: 'light' | 'dark';
+            readonly mode?: "light" | "dark";
         } | undefined;
         /**
          * Optional connector registry — required for accepting
@@ -201,16 +194,16 @@ export declare function defaultHandlers(deps: {
          */
         readonly connectors?: ConnectorRegistry;
         /**
-         * Optional admission-control limiter. When present, `ggui_push`
+         * Optional admission-control limiter. When present, `ggui_render`
          * gates every call through `rateLimiter.check({key:
-         * 'ggui_push:<appId>', cost:1})` before doing any work; denial
+         * 'ggui_render:<appId>', cost:1})` before doing any work; denial
          * surfaces as a `RateLimitedError`. Omitted = unlimited (the
          * `NoopRateLimiter` server default).
          */
         readonly rateLimiter?: RateLimiter;
         /**
          * Optional shortCode → session binding index. When present,
-         * `ggui_push` records every minted `shortCode` so console's
+         * `ggui_render` records every minted `shortCode` so console's
          * `/s/<shortCode>` viewer (via the session-cookie endpoint) can
          * resolve it back to the right session. Absent = hosted cloud
          * flow (DynamoDB side-table owns lookups), or console not
@@ -218,83 +211,83 @@ export declare function defaultHandlers(deps: {
          */
         readonly shortCodeIndex?: ShortCodeIndex;
         /**
-         * Optional provisional-preview wiring. When present, `ggui_push`
+         * Optional provisional-preview wiring. When present, `ggui_render`
          * kicks off the configured emitter on every qualifying push (the
          * `evaluateProvisionalPreviewGate` predicate filters MCP Apps
          * pushes + storyless calls automatically). Absent = no preview
          * channel traffic.
          *
          * Constructed by `createGguiServer` from `opts.provisionalPreview`
-         * plus the late-bound `SessionChannelServer.sendToSession`
+         * plus the late-bound `RenderChannelServer.sendToSession`
          * closure; callers threading their own handler set can build
          * `ProvisionalPreviewDeps` directly.
          */
         readonly provisionalPreview?: ProvisionalPreviewDeps;
         /**
-         * Optional generation wiring. When present, `ggui_push` invokes
+         * Optional generation wiring. When present, `ggui_render` invokes
          * the supplied {@link UiGenerator} on every story-path call and
-         * appends the generated `StackItem` to the session before
-         * returning `codeReady: true`. Absent = push stays in
-         * placeholder mode (session + shortCode + preview still work,
-         * but no componentCode is produced).
+         * commits the generated `Render` before returning `codeReady:
+         * true`. Absent = push stays in placeholder mode (render +
+         * shortCode + preview still work, but no componentCode is
+         * produced).
          *
          * Callers compose the `GenerationDeps` directly via the
          * `@ggui-ai/mcp-server-handlers` export — `defaultHandlers`
-         * simply threads the bundle through to `createGguiPushHandler`.
+         * simply threads the bundle through to `createGguiRenderHandler`.
          */
         readonly generation?: GenerationDeps;
         /**
-         * Optional live-subscriber stack-push notifier.
-         * When present, every successful `appendStackItem` inside `ggui_push`
-         * fan-outs a `{type:'push', payload:{stackItem}}` live-channel frame to
-         * every live subscriber on the affected session. Forwarded as-is
-         * to `createGguiPushHandler`.
+         * Optional live-subscriber render-commit notifier.
+         * When present, every successful `renderStore.commit` inside `ggui_render`
+         * fan-outs a `{type:'render', payload:{render}}` live-channel frame to
+         * every live subscriber on the affected render. Forwarded as-is
+         * to `createGguiRenderHandler`.
          *
-         * Hosts without a session channel (programmatic embedding, Lambda
+         * Hosts without a render channel (programmatic embedding, Lambda
          * one-shot) leave this absent — there are no live subscribers to
-         * notify, and the push handler's own no-op-on-absent posture
+         * notify, and the render handler's own no-op-on-absent posture
          * keeps the path intact.
          */
         readonly channelNotifier?: ChannelNotifier;
         /**
          * Optional F4 schema compat check hook. When present,
-         * `ggui_push` invokes it immediately
-         * before every `appendStackItem` — if the pending StackItem's
+         * `ggui_render` invokes it immediately
+         * before every `renderStore.commit` — if the pending Render's
          * `actionSpec` / `streamSpec` references a tool whose schemas
          * disagree, the hook throws `SchemaCompatError` and the handler
-         * converts the rejection into an error stack-item + `codeReady:
-         * false`. Forwarded as-is to `createGguiPushHandler`.
+         * converts the rejection into an error render + `codeReady:
+         * false`. Forwarded as-is to `createGguiRenderHandler`.
          *
          * `createGguiServer` binds this closure against the composed
          * `handlers` list + `opts.schemaCompatCheck` (default `'reject'`)
          * automatically; callers composing their own push handler via
          * `defaultHandlers` wire the hook themselves.
          */
-        readonly checkStackItemContracts?: (shape: {
-            readonly actionSpec?: import('@ggui-ai/protocol').ActionSpec;
-            readonly streamSpec?: import('@ggui-ai/protocol').StreamSpec;
+        readonly checkRenderContracts?: (shape: {
+            readonly actionSpec?: import("@ggui-ai/protocol").ActionSpec;
+            readonly streamSpec?: import("@ggui-ai/protocol").StreamSpec;
         }) => void;
         /**
          * Optional content-addressable code store. When present together
-         * with {@link codeBaseUrl}, `ggui_push` writes generated
+         * with {@link codeBaseUrl}, `ggui_render` writes generated
          * componentCode to the store and surfaces `codeUrl` + `codeHash`
          * on the response — the sole static-component delivery channel
          * post-T3-1 (2026-05-13).
          *
-         * Absent: `ggui_push.resultMeta` omits `codeUrl`. The iframe boots
+         * Absent: `ggui_render.resultMeta` omits `codeUrl`. The iframe boots
          * via live-mode (wsUrl+token) and receives the stack item via the
-         * live-channel WS subscribe. `/r/<shortCode>` + `/api/bootstrap/<shortCode>`
+         * live-channel WS subscribe. `/r/<shortCode>` (HTML default; JSON branch on `Accept: application/json`)
          * routes ALSO mint `codeUrl` when `codeStore` is set — they derive
          * the base URL from `req.protocol + req.host` when `codeBaseUrl`
          * isn't explicit (works for local dev + tunnel deployments).
-         * Forwarded as-is to `createGguiPushHandler`.
+         * Forwarded as-is to `createGguiRenderHandler`.
          */
         readonly codeStore?: CodeStore;
         /**
          * Base URL the code-blob route resolves to. Required when
          * `codeStore` is present so the handler can compose
          * `<base>/code/<hash>.js`. Forwarded as-is to
-         * `createGguiPushHandler`.
+         * `createGguiRenderHandler`.
          */
         readonly codeBaseUrl?: string;
         /**
@@ -330,53 +323,55 @@ export declare function defaultHandlers(deps: {
          * `channelBootstrap.refresh` so the OSS factory's behavior matches
          * the cloud pod's tool-side composition.
          */
-        readonly bootstrapRefresh?: import('@ggui-ai/mcp-server-handlers/session-mutations').BootstrapRefreshSeam;
+        readonly bootstrapRefresh?: import("@ggui-ai/mcp-server-handlers/renders").WsTokenRefreshSeam;
     };
     /**
      * `ggui_update` wiring. When present, register the OSS update
-     * handler against the supplied SessionStore + optional live-channel
-     * props_update notifier. The handler reads sessionId / stackItemId
-     * from wire input today, but a future in-process dispatcher can
-     * populate them on the canonical context.
+     * handler against the supplied RenderStore + optional live-channel
+     * props_update notifier. The handler reads `renderId` from wire
+     * input today, but a future in-process dispatcher can populate it
+     * on the canonical context.
      *
      * Absent = `ggui_update` is NOT registered on this server. Hosts
      * that don't expose props mutation keep the smaller surface (e.g.,
      * static-blueprint demos, MCP-Apps-only deployments).
      */
     readonly update?: {
-        readonly sessionStore: SessionStore;
+        readonly renderStore: RenderStore;
         /**
          * Optional live-subscriber `props_update` notifier — typically a
-         * thin closure over `SessionChannelServer.sendPropsUpdate`.
+         * thin closure over `RenderChannelServer.sendPropsUpdate`.
          * Forwarded as-is to `createGguiUpdateHandler`. Hosts without a
-         * session channel leave this absent; the handler still persists
-         * via `sessionStore.appendStackItem` on every successful patch.
+         * render channel leave this absent; the handler still persists
+         * via `renderStore.commit` on every successful patch.
          */
         readonly propsUpdateNotifier?: PropsUpdateNotifier;
         /**
          * Bootstrap-credential minter (live trio). When wired, the
-         * `ggui_update` resultMeta emits `_meta.ggui.bootstrap` so MCP Apps
-         * hosts that re-post `ui/notifications/tool-result` via postMessage
-         * can re-apply patched props on the live mount without re-subscribing.
-         * Mirrors the same field on `push` deps; composing hosts wire both
-         * from the same minter.
+         * `ggui_update` resultMeta emits the `ai.ggui/render` slice
+         * so MCP Apps hosts that re-post
+         * `ui/notifications/tool-result` via postMessage can re-apply
+         * patched props on the live mount without re-subscribing. Mirrors
+         * the same field on `render` deps; composing hosts wire both from
+         * the same minter.
          */
-        readonly mintBootstrap?: (sessionId: string, appId: string) => {
+        readonly mintBootstrap?: (renderId: string, appId: string) => {
             wsUrl: string;
             token: string;
             expiresAt: string;
         };
-        /** Iframe-runtime bundle URL forwarded onto bootstrap.runtimeUrl.
+        /** Iframe-runtime bundle URL forwarded onto the
+         *  `ai.ggui/render.runtimeUrl` slice field.
          *  Function form mirrors push deps — see {@link BuildMcpDeps.push}. */
         readonly runtimeUrl?: string | (() => string | undefined);
-        /** Theme preset id forwarded onto bootstrap.themeId. */
+        /** Theme preset id forwarded onto the `ai.ggui/render.themeId` slice field. */
         readonly themeId?: string;
-        /** Theme color mode forwarded onto bootstrap.themeMode. */
-        readonly themeMode?: 'light' | 'dark';
+        /** Theme color mode forwarded onto the `ai.ggui/render.themeMode` slice field. */
+        readonly themeMode?: "light" | "dark";
         /** Live theme getter — overrides static themeId/themeMode per-update. */
         readonly themeProvider?: () => {
             readonly id?: string;
-            readonly mode?: 'light' | 'dark';
+            readonly mode?: "light" | "dark";
         } | undefined;
         /** Returns names of app-visible tools for bootstrap.appCallableTools. */
         readonly appCallableTools?: () => readonly string[];
@@ -389,19 +384,19 @@ export declare function defaultHandlers(deps: {
      * default; pass `consume.pendingEventConsumer` to override (e.g.,
      * SQLite-backed for persistent dev or a Dynamo adapter on cloud).
      *
-     * `defaultSessionTtlSeconds` controls the activity-bump TTL the
+     * `defaultRenderTtlSeconds` controls the activity-bump TTL the
      * handler forwards to `consumeAndClear` on every read. Falls back
      * to 1 day when omitted.
      */
     readonly consume?: {
         readonly pendingEventConsumer?: PendingEventConsumer;
-        readonly defaultSessionTtlSeconds?: number;
+        readonly defaultRenderTtlSeconds?: number;
     };
     /**
      * Stream channel wiring for `ggui_emit`. When `push` is bound, the
      * handler registers automatically; its `sendEnvelope` closes over
      * `stream.channelProvider`, a lazy getter that resolves the
-     * `SessionChannelServer` at emit time (the channel is constructed
+     * `RenderChannelServer` at emit time (the channel is constructed
      * AFTER `defaultHandlers` runs, so a static reference would always
      * be null on the OSS in-process boot).
      *
@@ -410,10 +405,10 @@ export declare function defaultHandlers(deps: {
      * cloud's `ggui_emit_accepted_no_receiver` posture.
      *
      * The getter pattern lets the OSS server bind once at boot, then
-     * mutate the cell after `createSessionChannelServer` runs.
+     * mutate the cell after `createRenderChannelServer` runs.
      */
     readonly stream?: {
-        readonly channelProvider?: () => SessionChannelServer | null;
+        readonly channelProvider?: () => RenderChannelServer | null;
     };
     /**
      * Structured-event logger threaded into handlers that emit
@@ -425,9 +420,10 @@ export declare function defaultHandlers(deps: {
     readonly logger?: Logger;
     /**
      * Operational-signal sink. Threaded into handlers that emit named
-     * events (`ggui_new_session` emits `session.created` /
-     * `session.create_failed`). Absent = NoopTelemetrySink semantic.
-     * Lossy + non-throwing per the {@link TelemetrySink} contract.
+     * events (`ggui_render` emits `ui.created` / `ui.committed`;
+     * `ggui_handshake` emits `handshake.minted`). Absent =
+     * NoopTelemetrySink semantic. Lossy + non-throwing per the
+     * {@link TelemetrySink} contract.
      */
     readonly telemetry?: TelemetrySink;
     /**
@@ -445,7 +441,7 @@ export declare function defaultHandlers(deps: {
     readonly appMetadataStore?: AppMetadataStore;
     /**
      * Global theme-catalog resolver consumed by `ggui_list_themes` AND by
-     * `ggui_new_session`'s opt-in `requestThemeList` projection. Returns
+     * `ggui_render`'s opt-in `requestThemeList` projection. Returns
      * the full registry every call (kept as a function so additions to
      * the catalog at runtime — e.g. operator-defined themes in a future
      * slice — surface without a server restart). When BOTH this and
@@ -503,7 +499,7 @@ export declare function defaultHandlers(deps: {
          * closure. When absent, the generate handler is NOT registered
          * (list/update/delete still register).
          */
-        readonly resolveLlm?: (ctx: import('@ggui-ai/mcp-server-handlers').HandlerContext) => Promise<GenerationCredentials | null> | GenerationCredentials | null;
+        readonly resolveLlm?: (ctx: import("@ggui-ai/mcp-server-handlers").HandlerContext) => Promise<GenerationCredentials | null> | GenerationCredentials | null;
         /**
          * BlueprintProvider passed to the generator (same instance
          * `defaultHandlers`'s blueprint search reads). Required when
@@ -570,7 +566,7 @@ export interface CreateGguiServerOptions {
      * dev, anything else including unset → prod). Pass an explicit
      * value to override the env in test fixtures and embedders.
      */
-    readonly mode?: 'dev' | 'prod';
+    readonly mode?: "dev" | "prod";
     /**
      * Shared handler set to expose. Defaults to the blueprint-read family
      * (search + list_featured + render). Pass your own list to add / remove
@@ -596,7 +592,7 @@ export interface CreateGguiServerOptions {
      * See `packages/mcp-server-handlers/src/types.ts`
      * (`SharedHandler.allowedFor`).
      */
-    readonly allowedKinds?: ReadonlyArray<'app' | 'user' | 'builder'>;
+    readonly allowedKinds?: ReadonlyArray<"app" | "user" | "builder">;
     /**
      * Auth adapter. Defaults to `InMemoryAuthAdapter({devAllowAll: true})`
      * — accepts any non-empty bearer token as the `builder` identity.
@@ -618,7 +614,7 @@ export interface CreateGguiServerOptions {
     /**
      * Per-app metadata source. When bound, threaded into
      * `defaultHandlers` so `ggui_list_gadgets`,
-     * `ggui_list_themes`, `ggui_new_session({themeId?})`, and the
+     * `ggui_list_themes`, `ggui_render({themeId?})`, and the
      * handshake's `app.gadgets` lookup all read from the same
      * store. The CLI binds an `InMemoryAppMetadataStore` seeded from
      * `ggui.json#theme.preset` (so every appId picks up the operator's
@@ -633,7 +629,7 @@ export interface CreateGguiServerOptions {
     /**
      * Global theme-catalog resolver. When bound alongside
      * `appMetadataStore`, registers `ggui_list_themes` and projects the
-     * same catalog into `ggui_new_session({requestThemeList: true})`
+     * same catalog into `ggui_render({requestThemeList: true})`
      * outputs. Read each call so additions to the registry at runtime
      * (operator-defined themes in a future slice) surface without a
      * restart.
@@ -767,9 +763,9 @@ export interface CreateGguiServerOptions {
      */
     readonly themeFileUploader?: ThemeFileUploader;
     /**
-     * Live-theme getter. When set, the `ggui_push` handler reads this
+     * Live-theme getter. When set, the `ggui_render` handler reads this
      * on every result-meta computation and embeds the returned `id` /
-     * `mode` into `_meta.ggui.bootstrap`. Pair with
+     * `mode` into the `ai.ggui/render` slice meta. Pair with
      * {@link onThemeConfigChange} so a console save updates the
      * shared state cell the closure reads from. The cell pattern
      * closes the parallel-state-stores bug where the push handler
@@ -782,7 +778,7 @@ export interface CreateGguiServerOptions {
      */
     readonly themeProvider?: () => {
         readonly id?: string;
-        readonly mode?: 'light' | 'dark';
+        readonly mode?: "light" | "dark";
     } | undefined;
     /**
      * Optional change notifier — fires when the operator's theme
@@ -800,11 +796,11 @@ export interface CreateGguiServerOptions {
      */
     readonly onThemeConfigChange?: (next: string | {
         preset: string;
-        mode?: 'light' | 'dark';
+        mode?: "light" | "dark";
         overrides?: Record<string, string>;
     } | {
         file: string;
-        mode?: 'light' | 'dark';
+        mode?: "light" | "dark";
     } | null) => void;
     /**
      * Map a resolved identity to the `appId` used by handlers for tenant
@@ -962,17 +958,17 @@ export interface CreateGguiServerOptions {
      * `'auth-adapter'`, the admin token is irrelevant — the route is
      * mounted whenever `providerKeys` is set.
      */
-    readonly providerKeysGate?: 'admin-token' | 'auth-adapter';
+    readonly providerKeysGate?: "admin-token" | "auth-adapter";
     /** Express body size limit. Defaults to `'4mb'`. */
     readonly bodyLimit?: string;
     /**
-     * Session store — backing plane for the live-channel session endpoint
-     * (and future OSS session-reading MCP tools). Defaults to
-     * `InMemorySessionStore`, which is fine for OSS zero-config / dev.
+     * Render store — backing plane for the live-channel render endpoint
+     * (and OSS render-reading MCP tools). Defaults to
+     * `InMemoryRenderStore`, which is fine for OSS zero-config / dev.
      * SQLite / Postgres / Redis adapters bind via the same interface
      * when they land.
      */
-    readonly sessionStore?: SessionStore;
+    readonly renderStore?: RenderStore;
     /**
      * Outbound stream replay buffer for the live-channel endpoint. Defaults
      * to a fresh `InMemorySessionStreamBuffer` — fine for OSS zero-config
@@ -994,7 +990,7 @@ export interface CreateGguiServerOptions {
      *
      * The live channel is where the live-contract enforcement point
      * lives. Enabling this makes the OSS server a second real consumer
-     * of the shared `@ggui-ai/mcp-server-handlers/session-mutations`
+     * of the shared `@ggui-ai/mcp-server-handlers/renders`
      * helpers.
      */
     readonly sessionChannel?: boolean | {
@@ -1012,7 +1008,7 @@ export interface CreateGguiServerOptions {
      *
      * Absent = agent-mediated behavior (canonical for MCP Apps hosts and
      * Claude Agent SDK consumers). Inbound actions land on the
-     * stackItemId-keyed pending-events pipe via `ggui_runtime_submit_action`
+     * renderId-keyed pending-events pipe via `ggui_runtime_submit_action`
      * and the agent's `ggui_consume` long-poll drains them. CLI
      * composition in `ggui serve` wires a router by default over the
      * same handler bundle `/mcp` uses, since that command runs WITHOUT
@@ -1025,7 +1021,7 @@ export interface CreateGguiServerOptions {
     /**
      * Per-call timeout for wired-tool invocations, in ms. Defaults to
      * `DEFAULT_WIRED_TOOL_TIMEOUT_MS` (30 s) when omitted. Forwarded
-     * verbatim to `createSessionChannelServer`.
+     * verbatim to `createRenderChannelServer`.
      */
     readonly wiredActionTimeoutMs?: number;
     /**
@@ -1043,20 +1039,39 @@ export interface CreateGguiServerOptions {
      * agrees with the server on which channels use WS fan-out.
      *
      * Only consulted when `sessionChannel` is enabled. Forwarded
-     * verbatim to `createSessionChannelServer` (see
-     * `SessionChannelOptions.streamWebSocketLocalTools`).
+     * verbatim to `createRenderChannelServer` (see
+     * `RenderChannelOptions.streamWebSocketLocalTools`).
+     */
+    readonly streamWebSocketLocalTools?: import("./render-channel.js").RenderChannelLocalToolsOptions;
+    /**
+     * Hook fired when the local subscriber count for `sessionId`
+     * transitions 0 → 1 on the live channel. Forwarded verbatim to
+     * `createRenderChannelServer`. Used by cloud adapters for per-session
+     * cross-pod pubsub channel scoping; OSS callers leave this undefined.
+     *
+     * Only consulted when `sessionChannel` is enabled. See
+     * `RenderChannelOptions.onFirstSubscriber` for the full contract.
+     */
+    readonly onFirstSubscriber?: (sessionId: string) => void;
+    /**
+     * Hook fired when the local subscriber count for `sessionId`
+     * transitions 1 → 0 on the live channel. Forwarded verbatim to
+     * `createRenderChannelServer`.
+     *
+     * Only consulted when `sessionChannel` is enabled. See
+     * `RenderChannelOptions.onLastSubscriberGone` for the full contract.
      */
-    readonly streamWebSocketLocalTools?: import('./session-channel.js').SessionChannelLocalToolsOptions;
+    readonly onLastSubscriberGone?: (sessionId: string) => void;
     /**
      * Override the sanitizer applied to the stringified original error
      * written into `ContractErrorPayload.error.causedBy`. Defaults to
      * `@ggui-ai/protocol::sanitizeCausedBy` when omitted — redacts
      * Bearer tokens, query-param secrets, common env-var dumps, and
      * truncates at 2 KB. Forwarded verbatim to
-     * `createSessionChannelServer`. See `SessionChannelOptions
+     * `createRenderChannelServer`. See `RenderChannelOptions
      * .sanitizeCausedBy` for the contract.
      */
-    readonly sanitizeCausedBy?: import('@ggui-ai/protocol').SanitizeCausedBy;
+    readonly sanitizeCausedBy?: import("@ggui-ai/protocol").SanitizeCausedBy;
     /**
      * Extra reserved-channel payload validators merged with the
      * server's default A2UI preview validator before being passed to
@@ -1073,11 +1088,11 @@ export interface CreateGguiServerOptions {
      * fall-through behavior on `_ggui:preview` without the adapter
      * running.
      */
-    readonly extraReservedValidators?: ReadonlyMap<string, import('@ggui-ai/protocol').ReservedChannelValidator>;
+    readonly extraReservedValidators?: ReadonlyMap<string, import("@ggui-ai/protocol").ReservedChannelValidator>;
     /**
      * Protocol-version handshake policy for the session channel. Forwarded
-     * verbatim to `createSessionChannelServer` (see
-     * `SessionChannelOptions.versionPolicy`). Defaults to `'reject'` —
+     * verbatim to `createRenderChannelServer` (see
+     * `RenderChannelOptions.versionPolicy`). Defaults to `'reject'` —
      * mismatched `SubscribePayload.supportedVersions` emits
      * UPGRADE_REQUIRED and closes the connection. Legacy opt-out
      * `'advisory'` keeps the connection open after the error frame for
@@ -1085,7 +1100,7 @@ export interface CreateGguiServerOptions {
      *
      * Only consulted when `sessionChannel` is enabled.
      */
-    readonly versionPolicy?: 'advisory' | 'reject';
+    readonly versionPolicy?: "advisory" | "reject";
     /**
      * Policy for the schema compat check. Checks that every
      * `actionSpec[name]` tool ref points at a tool whose
@@ -1110,7 +1125,7 @@ export interface CreateGguiServerOptions {
      *      endpoint (blueprint registration — fires when a manifest
      *      blueprint's pre-declared `actionSpec` / `streamSpec`
      *      references a tool mounted on this server).
-     *   2. The `ggui_push` generation path (push-time — defensive
+     *   2. The `ggui_render` generation path (render-time — defensive
      *      wiring for when the generator starts emitting
      *      actionSpec / streamSpec on its `UIGenerationResponse`;
      *      current generators emit only componentCode, but the
@@ -1158,32 +1173,29 @@ export interface CreateGguiServerOptions {
     /**
      * Enable the MCP Apps outbound delivery path on this server.
      *
-     *   - `false` / omitted (default): `ggui_push` is NOT registered;
-     *     `ui://ggui/session` is NOT served; `io.modelcontextprotocol/ui`
+     *   - `false` / omitted (default): `ggui_render` is NOT registered;
+     *     `ui://ggui/render` is NOT served; `io.modelcontextprotocol/ui`
      *     is NOT advertised. Server looks identical to the pre-MCP-Apps
      *     surface.
      *   - `true`: enable with sensible defaults. Requires
      *     `sessionChannel: true` so the iframe has a WebSocket to open;
-     *     throws at construction otherwise. `renderBaseUrl` defaults to
-     *     `"http://localhost/r/"` (dev-sensible; production operators
-     *     override).
-     *   - `{ renderBaseUrl?, shellHtml?, wsUrl? }`: explicit config.
+     *     throws at construction otherwise.
+     *   - `{ shellHtml?, wsUrl? }`: explicit config.
      *
      * When enabled, FOUR things happen on every fresh per-request
      * `McpServer`:
-     *   1. `ggui_push` tool is registered, carrying `_meta.ui.resourceUri:
-     *      "ui://ggui/session"` and `_meta.ui.visibility: ["model"]` on
+     *   1. `ggui_render` tool is registered, carrying `_meta.ui.resourceUri:
+     *      "ui://ggui/render"` and `_meta.ui.visibility: ["model"]` on
      *      its declaration.
-     *   2. `ui://ggui/session` is served via `resources/read`.
+     *   2. `ui://ggui/render` is served via `resources/read`.
      *   3. `io.modelcontextprotocol/ui` is advertised in the server's
      *      `initialize` capabilities (under `experimental`).
-     *   4. Each `ggui_push` result carries `_meta.ggui.bootstrap` (wsUrl
-     *      + short-TTL token + expiresAt). The session-channel server
-     *      accepts that token on `subscribe` and issues a longer-TTL
-     *      `sessionToken` in the ack for iframe reconnects.
+     *   4. Each `ggui_render` result carries the `ai.ggui/render` slice
+     *      with wsUrl + short-TTL token + expiresAt. The session-channel
+     *      server accepts that token on `subscribe` and issues a
+     *      longer-TTL `renderToken` in the ack for iframe reconnects.
      */
     readonly mcpApps?: boolean | {
-        readonly renderBaseUrl?: string;
         readonly shellHtml?: string;
         /**
          * External WebSocket URL the iframe should open, visible to
@@ -1196,11 +1208,11 @@ export interface CreateGguiServerOptions {
     /**
      * Iframe-runtime bundle mount (C8 — plan §C8).
      *
-     * The thin-shell HTML served from `ui://ggui/session` dynamic-
+     * The thin-shell HTML served from `ui://ggui/render` dynamic-
      * script-loads the renderer bundle from this URL. The server needs
      * to either (a) serve the bundle itself (default), or (b) publish
-     * the operator-owned URL on `_meta.ggui.bootstrap.runtimeUrl`
-     * so the shell knows where to look.
+     * the operator-owned URL on the `ai.ggui/render.runtimeUrl` slice
+     * field so the shell knows where to look.
      *
      *   - `true` / omitted (default when `mcpApps` is on): serve the
      *     bundle via `express.static` at `/_ggui/iframe-runtime.js` from the
@@ -1242,7 +1254,7 @@ export interface CreateGguiServerOptions {
      *
      * Ignored entirely when MCP Apps is disabled.
      */
-    readonly bootstrapSecret?: string;
+    readonly wsTokenSecret?: string;
     /**
      * Enable the pairing transport. Adds `POST /pair` (public, completes a
      * pairing handshake) and by default `POST /admin/pair/init` (builder-
@@ -1323,7 +1335,7 @@ export interface CreateGguiServerOptions {
          * right durability claim; the server doesn't inspect the store
          * instance to guess.
          */
-        readonly durability?: 'durable' | 'ephemeral';
+        readonly durability?: "durable" | "ephemeral";
     };
     readonly pairing?: boolean | {
         /**
@@ -1399,7 +1411,7 @@ export interface CreateGguiServerOptions {
     readonly audit?: AuditSink;
     /**
      * Admission-control limiter applied at the highest-cost handler
-     * ingress — today just `ggui_push`. Defaults to
+     * ingress — today just `ggui_render`. Defaults to
      * {@link NoopRateLimiter} (always allows). Per-handler wiring maps
      * denials from a `RateLimitedError` to HTTP 429 + `Retry-After` /
      * `X-RateLimit-*` headers at the transport boundary.
@@ -1441,44 +1453,6 @@ export interface CreateGguiServerOptions {
      * still mounts so operators can paste credentials in advance).
      */
     readonly publicBaseUrl?: string;
-    /**
-     * Render-URL signing config — capability-URL hardening.
-     *
-     * When set (default), every minted `/r/<code>` URL carries
-     * `?sig=<hmac>&exp=<unix>`. The gate on `/r/` + `/api/bootstrap/`
-     * verifies the sig + freshness before lookup; tampered or expired
-     * URLs return 410.
-     *
-     *   - `secret`: 32-byte hex key. When omitted, a fresh random key
-     *     is minted at boot — restart = every outstanding URL dies
-     *     (good for incident response, bad if you don't want it).
-     *     Pin a stable secret to survive restarts.
-     *   - `ttlSeconds`: URL lifetime. Defaults to 24h (86400s).
-     *   - Set `renderSigning: false` to disable the layer entirely
-     *     (`--no-render-signing`). URLs revert to the plain unsigned
-     *     form. Use for legacy hosts that strip query strings or
-     *     tooling that pre-records URLs.
-     */
-    readonly renderSigning?: false | {
-        readonly secret?: string;
-        readonly ttlSeconds?: number;
-    };
-    /**
-     * Per-shortCode rate-limit config. Defends `/r/` and
-     * `/api/bootstrap/` against brute-force scans.
-     *
-     *   - `windowSeconds` + `limit`: bucket size. Default 60s / 30 hits.
-     *   - `false`: disable rate limiting entirely (CI/test convenience).
-     *
-     * Rate-limit decision is per-shortCode (not per-peer) — cross-origin
-     * iframe hosts NAT every user through one proxy; per-peer limits
-     * would either rate-limit the whole host or accept every peer.
-     * See render-rate-limit.ts for the rationale.
-     */
-    readonly renderRateLimit?: false | {
-        readonly windowSeconds?: number;
-        readonly limit?: number;
-    };
     /**
      * Override path for `~/.ggui/oauth-providers.json`. Mainly for
      * tests + per-deployment isolation. Defaults to the home-relative
@@ -1578,7 +1552,7 @@ export interface CreateGguiServerOptions {
         readonly distDir?: string;
         /**
          * Enable the Slice-2 same-origin session-cookie flow
-         * (`POST /ggui/console/session-cookie` + session-channel
+         * (`POST /ggui/console/render-cookie` + session-channel
          * cookie-auth wiring). Defaults to OFF — the landing-page
          * static surface is useful on its own (pair-code display,
          * server identity); turning on the cookie flow is an
@@ -1593,7 +1567,7 @@ export interface CreateGguiServerOptions {
          * cookie endpoint resolves shortCode → sessionId by reading
          * it. Throws at construction if the index is absent.
          *
-         * The cookie signing secret is the same {@link bootstrapSecret}
+         * The cookie signing secret is the same {@link wsTokenSecret}
          * used by the MCP Apps bootstrap/session tokens — different
          * token `kind` claims make cross-kind confusion impossible
          * (see `console-auth.ts` isolation comment).
@@ -1683,7 +1657,7 @@ export interface CreateGguiServerOptions {
      * when `console.sessionCookie` is enabled (the cookie endpoint
      * looks up the posted shortCode to find the session to bind).
      *
-     * Pair this with a `push` handler so the agent's `ggui_push` writes
+     * Pair this with a `push` handler so the agent's `ggui_render` writes
      * the shortCode into the same index that console later reads.
      * See `defaultHandlers` for the wiring seam.
      */
@@ -1692,11 +1666,12 @@ export interface CreateGguiServerOptions {
      * Content-addressable code blob storage. When wired, this server
      * mounts `GET /code/<hash>.js` for the iframe runtime to fetch
      * compiled componentCode by content hash. The push handler writes
-     * to the store before emitting `_meta.ggui.bootstrap.codeUrl`.
+     * to the store before emitting `codeUrl` on the `ai.ggui/render`
+     * slice.
      *
      * Defaults: when omitted the route is NOT mounted; the push
-     * handler falls back to inline base64 `componentCode` on
-     * `_meta.ggui.bootstrap` (legacy delivery channel).
+     * handler falls back to inline base64 `componentCode` on the
+     * `ai.ggui/render` slice (legacy delivery channel).
      *
      * OSS dev wires `FileSystemCodeStore` (rooted at `~/.ggui/code-cache/`)
      * via `ggui-cli/buildMcpServerBackend`. Tests wire
@@ -1707,7 +1682,7 @@ export interface CreateGguiServerOptions {
      */
     readonly codeStore?: CodeStore;
     /**
-     * Provisional A2UI preview wiring for `ggui_push`. When the config
+     * Provisional A2UI preview wiring for `ggui_render`. When the config
      * flag is on, every qualifying component push kicks off the
      * supplied emitter; frames land on the reserved `_ggui:preview`
      * channel of the push's session.
@@ -1735,7 +1710,7 @@ export interface CreateGguiServerOptions {
          */
         readonly emitter: ProvisionalPreviewEmitter;
         /** Per-push predicate. See {@link ProvisionalPreviewConfig}. */
-        readonly isEnabledFor?: ProvisionalPreviewConfig['isEnabledFor'];
+        readonly isEnabledFor?: ProvisionalPreviewConfig["isEnabledFor"];
         /** Lifecycle observer. Fires sync — must not throw. */
         readonly onOutcome?: (outcome: ProvisionalPreviewOutcome) => void;
         /** Clock override for tests. Defaults to `Date.now`. */
@@ -1744,7 +1719,7 @@ export interface CreateGguiServerOptions {
     /**
      * Handshake preflight wiring. When `mcpApps` is enabled, the
      * server defaults to an `InMemoryKeyValueStore` + no negotiator:
-     * `ggui_handshake` is registered, `ggui_push({handshakeId})` is
+     * `ggui_handshake` is registered, `ggui_render({handshakeId})` is
      * consumable, and handshake records persist for 10 minutes before
      * single-use consumption.
      *
@@ -1757,16 +1732,16 @@ export interface CreateGguiServerOptions {
      *     in a hosted closed runtime) so handshake records carry a
      *     decision the paired push echoes as `structuredContent.decision`.
      *   - `false` — explicitly disable: `ggui_handshake` is NOT
-     *     registered and `ggui_push({handshakeId})` falls back to
+     *     registered and `ggui_render({handshakeId})` falls back to
      *     the rejection shape.
      *
      * Omitted entirely means "use the default in-memory store when
-     * `mcpApps` is on". That matches how `sessionStore` and
+     * `mcpApps` is on". That matches how `renderStore` and
      * `streamBuffer` default — no opt-in required for the OSS
      * first-run path.
      *
      * Requires `mcpApps` to be enabled — handshake is paired with
-     * `ggui_push`, which is only registered under MCP Apps. Throws
+     * `ggui_render`, which is only registered under MCP Apps. Throws
      * at construction when handshake is explicitly enabled without
      * MCP Apps.
      */
@@ -1783,14 +1758,14 @@ export interface CreateGguiServerOptions {
         readonly negotiator?: HandshakeNegotiator;
     };
     /**
-     * Generation wiring for the `ggui_push` story path. When present,
-     * every component push invokes the bound `UiGenerator` and
-     * appends the result as a real `StackItem` on the session.
-     * Absent = placeholder mode: `ggui_push` on the story path
-     * returns `codeReady: false` without writing componentCode.
+     * Generation wiring for the `ggui_render` story path. When present,
+     * every component push invokes the bound `UiGenerator` and commits
+     * the result as a real `Render`. Absent = placeholder mode:
+     * `ggui_render` on the story path returns `codeReady: false`
+     * without writing componentCode.
      *
      * Requires `mcpApps` to be enabled — generation attaches to
-     * `ggui_push`, which is only registered when MCP Apps is on.
+     * `ggui_render`, which is only registered when MCP Apps is on.
      * Throws at construction otherwise so a misconfigured server
      * doesn't silently drop the generator binding.
      *
@@ -1937,6 +1912,36 @@ export interface CreateGguiServerOptions {
     readonly opsCoupon?: {
         readonly coupons: CouponRedeemSource;
     };
+    /**
+     * Extra readiness checks merged into `GET /ggui/health`. Each check
+     * is a `{name, check}` pair; `check()` returns a boolean (or a
+     * Promise<boolean>) — `true` means "this dependency is ready".
+     *
+     * When ANY check returns `false` (or throws), `/ggui/health` answers
+     * `503 Service Unavailable` with `status: 'degraded'` + a `checks`
+     * map naming each failing dependency. The default `200 ok` shape is
+     * preserved when every check passes (and when the option is unset).
+     *
+     * Use this when an embedder wires a stateful external dependency
+     * (e.g. a pubsub subscriber connection, a vector-store reachability
+     * probe, a worker-pool health view) and wants its K8s readinessProbe
+     * to take the pod OUT OF SERVICE when that dependency fails. The
+     * sibling `/ggui/live` endpoint is unaffected — that is the K8s
+     * livenessProbe target and stays 200 regardless of readiness, so a
+     * transient upstream blip removes the pod from rotation without
+     * restarting the process. Wire the two probes separately:
+     *
+     *     livenessProbe:  { httpGet: { path: '/ggui/live',   port } }
+     *     readinessProbe: { httpGet: { path: '/ggui/health', port } }
+     *
+     * Each check MUST complete within ~1s; the server enforces a 1s
+     * per-check timeout so a hung dependency cannot block the probe.
+     * A timeout is treated as a failed check.
+     */
+    readonly readinessChecks?: ReadonlyArray<{
+        readonly name: string;
+        readonly check: () => boolean | Promise<boolean>;
+    }>;
 }
 export interface GguiServer {
     /**
@@ -1965,7 +1970,7 @@ export interface GguiServer {
      * composition with future mutation handlers that want to fan out
      * via `sessionChannel.sendToSession(sessionId, data)`.
      */
-    readonly sessionChannel: SessionChannelServer | null;
+    readonly sessionChannel: RenderChannelServer | null;
     /**
      * The pairing service bound to this server, when the `pairing` option
      * was enabled. `null` when pairing is disabled. In-process hosts