@ggui-ai/mcp-server 0.2.0-alpha.4 → 0.4.0-rc.0

package/dist/ggui-session-channel.js

@@ -0,0 +1,262 @@
+/**
+ * OSS live channel — live render plane over WebSocket.
+ *
+ * The live channel is where the typed-channel contract is enforced on
+ * live traffic between the server and the user. It co-hosts on the
+ * same Express server as `/mcp` and reuses the
+ * `@ggui-ai/mcp-server-handlers/renders` helpers, so every
+ * deployment of this server family enforces the same contracts.
+ *
+ * Scope:
+ *
+ *   - `subscribe` → auth, resolve-or-create render, register subscriber,
+ *     reply `ack` with the render's current snapshot + sequence.
+ *   - `action` → inbound user action carried as an {@link ActionEnvelope}.
+ *     Gated through `assertActionContract` (payload, for data:submit).
+ *     Persisted to GguiSessionStore as a typed render event.
+ *   - `ping`/`pong` → heartbeat parity with hosted.
+ *   - `close`/socket-close → clean subscriber teardown.
+ *   - `sendToGguiSession(sessionId, data)` → outbound fan-out API for
+ *     mutation handlers (ggui_emit / connector `ctx.send`). Validated
+ *     through `assertStreamContract` before delivery.
+ *
+ * `props_update`: the agent-driven `ggui_update` handler calls
+ * `channel.sendPropsUpdate(sessionId, props)` (wired as its
+ * `propsUpdateNotifier`) to fan a `{type:'props_update'}` frame to
+ * live subscribers. Reaches the renderer's existing `props_update`
+ * branch in `iframe-runtime` and applies new props in-place.
+ *
+ * Not handled here:
+ *
+ *   - Pattern-B daemon-agent notification stream (GET /mcp SSE).
+ *   - Short-lived render-token mint/consume — that's ggui_render-gated.
+ *     Dev-mode auth (any bearer via existing AuthAdapter) matches the
+ *     `/mcp` endpoint's shape and is operator-replaceable.
+ *
+ * Module layout: this file owns the public surface (options, server
+ * interface, composer). The handler families live in
+ * `./ggui-session-channel/` as factories taking explicit typed deps:
+ *
+ *   - `outbound.ts` — send/fan-out primitives + the public fan-out
+ *     surfaces (`sendToGguiSession`, `sendPropsUpdate`, …).
+ *   - `subscriber-lifecycle.ts` — register / live-tail pump /
+ *     unregister + the 0↔1 subscriber-count hooks.
+ *   - `subscribe.ts` — upgrade-time identity resolution (bearer /
+ *     bootstrap / console cookie) + the `subscribe` handler.
+ *   - `action-ingress.ts` — `action` contract gate + ledger/pipe
+ *     dual-write + ack.
+ *   - `channel-subscriptions.ts` — `channel_subscribe` source-tool
+ *     polling loops.
+ *   - `socket-router.ts` — `connection` wiring with the per-socket
+ *     inbound ordering chain + the message-type dispatcher.
+ */
+import { InMemoryGguiSessionStreamBuffer, InProcessStreamFanout, } from "@ggui-ai/mcp-server-core/in-memory";
+import { WebSocketServer } from "ws";
+import { UnauthenticatedError } from "./auth.js";
+import { createActionIngress } from "./ggui-session-channel/action-ingress.js";
+import { createChannelSubscriptions, } from "./ggui-session-channel/channel-subscriptions.js";
+import { createOutbound } from "./ggui-session-channel/outbound.js";
+import { attachSocketRouter } from "./ggui-session-channel/socket-router.js";
+import { createSubscribeHandlers, } from "./ggui-session-channel/subscribe.js";
+import { createSubscriberLifecycle } from "./ggui-session-channel/subscriber-lifecycle.js";
+/** Default URL path for the channel endpoint. Operators can override. */
+export const DEFAULT_RENDER_CHANNEL_PATH = "/ws";
+/**
+ * Build an OSS live-channel server. The returned object is designed to be
+ * composed into `createGguiServer` — see `server.ts` for the wire-up.
+ */
+export function createGguiSessionChannelServer(opts) {
+    const path = opts.path ?? DEFAULT_RENDER_CHANNEL_PATH;
+    // Outbound stream buffer — owns seq assignment + bounded replay
+    // storage. Default is in-memory; operators swap via `opts.streamBuffer`.
+    const streamBuffer = opts.streamBuffer ?? new InMemoryGguiSessionStreamBuffer();
+    // Live-tail pub/sub. Default in-process; multi-process deployments
+    // bind a pubsub-backed StreamFanout via `opts.streamFanout`.
+    const streamFanout = opts.streamFanout ?? new InProcessStreamFanout();
+    // `noServer: true` means we own the upgrade wiring (see handleUpgrade);
+    // ws won't try to bind its own port.
+    const wss = new WebSocketServer({ noServer: true });
+    /**
+     * Flat set of all live WS subscribers. Replaces the per-render
+     * `subscribersByRender` Map — routing is now StreamFanout's job;
+     * this set tracks WS-specific bookkeeping (stats, shutdown-broadcast)
+     * that the seam can't see (and shouldn't).
+     */
+    const wsSubscribers = new Set();
+    /** ws → subscriber reverse index so socket-close can look up cheaply. */
+    const subscribersByWs = new WeakMap();
+    // Send / fan-out family — wire-write primitives shared by every
+    // handler module plus the public fan-out surfaces the returned
+    // object delegates to. See `ggui-session-channel/outbound.ts`.
+    const outbound = createOutbound({
+        logger: opts.logger,
+        renderStore: opts.renderStore,
+        streamBuffer,
+        streamFanout,
+        wsSubscribers,
+        extraReservedValidators: opts.extraReservedValidators,
+    });
+    const { send, sendError, sendChannelError } = outbound;
+    // Subscriber lifecycle family — registration, the live-tail pump
+    // loop, and symmetric teardown. Owns the per-render counter behind
+    // the onFirstSubscriber / onLastSubscriberGone hooks. See
+    // `ggui-session-channel/subscriber-lifecycle.ts`.
+    const { register, unregister } = createSubscriberLifecycle({
+        logger: opts.logger,
+        wsSubscribers,
+        subscribersByWs,
+        send,
+        onFirstSubscriber: opts.onFirstSubscriber,
+        onLastSubscriberGone: opts.onLastSubscriberGone,
+    });
+    // Channel-subscribe / source-poll family — `channel_subscribe`
+    // validation + the server-side polling loops. Resolves the
+    // streamWebSocketLocalTools allowlist + cadence once at composition.
+    // See `ggui-session-channel/channel-subscriptions.ts`.
+    const { handleChannelSubscribe, handleChannelUnsubscribe } = createChannelSubscriptions({
+        logger: opts.logger,
+        renderStore: opts.renderStore,
+        localTools: opts.streamWebSocketLocalTools,
+        subscribersByWs,
+        send,
+        sendChannelError,
+    });
+    // Action ingress + consume bridge — contract gate, ledger + pipe
+    // dual-write, ack. See `ggui-session-channel/action-ingress.ts`.
+    const { handleInboundAction } = createActionIngress({
+        logger: opts.logger,
+        renderStore: opts.renderStore,
+        pendingEventConsumer: opts.pendingEventConsumer,
+        send,
+        sendError,
+    });
+    // Subscribe / credential-path family — upgrade-time identity
+    // resolution (bearer / bootstrap / console cookie) + the
+    // `subscribe` handler. See `ggui-session-channel/subscribe.ts`.
+    const { resolveIdentityFromUpgrade, handleSubscribe } = createSubscribeHandlers({
+        logger: opts.logger,
+        auth: opts.auth,
+        renderStore: opts.renderStore,
+        streamBuffer,
+        streamFanout,
+        bootstrap: opts.bootstrap,
+        cookieAuth: opts.cookieAuth,
+        appIdFromIdentity: opts.appIdFromIdentity,
+        versionPolicy: opts.versionPolicy,
+        send,
+        sendError,
+        register,
+    });
+    // WS lifecycle / message routing — the `connection` handler with
+    // the per-socket inbound ordering chain, pre-subscribe identity +
+    // cookie bindings, and the type dispatcher routing frames to the
+    // handler families above. See `ggui-session-channel/socket-router.ts`.
+    attachSocketRouter(wss, {
+        logger: opts.logger,
+        renderStore: opts.renderStore,
+        subscribersByWs,
+        send,
+        sendError,
+        unregister,
+        handleSubscribe,
+        handleInboundAction,
+        handleChannelSubscribe,
+        handleChannelUnsubscribe,
+    });
+    return {
+        path,
+        handleUpgrade(req, socket, head) {
+            resolveIdentityFromUpgrade(req)
+                .then((identity) => {
+                // Stash identity on the request so the 'connection' handler
+                // can wire it onto the socket. This is the standard ws
+                // per-request piggyback pattern.
+                req.__gguiIdentity = identity;
+                wss.handleUpgrade(req, socket, head, (ws) => {
+                    // Expose `upgradeReq` for the connection handler.
+                    wss.emit("connection", ws, req);
+                });
+            })
+                .catch((err) => {
+                if (err instanceof UnauthenticatedError) {
+                    opts.logger.warn("render_channel_auth_failed", {
+                        reason: err.message,
+                    });
+                    socket.write("HTTP/1.1 401 Unauthorized\r\n" +
+                        "Connection: close\r\n" +
+                        "Content-Type: text/plain\r\n\r\n" +
+                        "Unauthorized: " +
+                        err.message +
+                        "\r\n");
+                }
+                else {
+                    opts.logger.error("render_channel_upgrade_failed", {
+                        error: String(err),
+                    });
+                    socket.write("HTTP/1.1 500 Internal Server Error\r\n" + "Connection: close\r\n\r\n");
+                }
+                socket.destroy();
+            });
+        },
+        // The five fan-out surfaces delegate to the outbound module —
+        // contracts documented on the interface above, impl decisions in
+        // `ggui-session-channel/outbound.ts`.
+        sendToGguiSession: outbound.sendToGguiSession,
+        notifyGguiSessionCommit: outbound.notifyGguiSessionCommit,
+        sendPropsUpdate: outbound.sendPropsUpdate,
+        sendDrainAck: outbound.sendDrainAck,
+        externalBroadcast: outbound.externalBroadcast,
+        get subscriberCount() {
+            return wsSubscribers.size;
+        },
+        get renderCount() {
+            // Distinct render count across live WS subscribers. With
+            // multi-tab clients, two subscribers may share a sessionId —
+            // dedupe before counting.
+            const renders = new Set();
+            for (const sub of wsSubscribers)
+                renders.add(sub.sessionId);
+            return renders.size;
+        },
+        async close() {
+            // Close every open socket + drain its StreamFanout subscription.
+            // `wss.close` terminates the server but not in-flight sockets,
+            // so walk them explicitly. Each `iter.return()` unregisters
+            // the subscriber from the seam (idempotent on the in-process impl).
+            //
+            // Close code 1012 ("Service Restart", RFC 6455 + IANA registry)
+            // signals to clients that the server is restarting and they
+            // should reconnect immediately rather than treat the close as
+            // permanent. The pod's K8s rolling update fits this exactly:
+            // a new pod is already accepting connections behind the same
+            // load balancer; iframe-runtime + console viewer should
+            // reconnect on next message instead of blinking "disconnected".
+            // Code 1001 (used previously) means "endpoint going away" with
+            // no reconnect hint — semantically inaccurate for the pod-roll
+            // case and the wrong signal for client reconnect logic.
+            const sessionIds = new Set();
+            for (const sub of wsSubscribers) {
+                sessionIds.add(sub.sessionId);
+                try {
+                    sub.ws.close(1012, "service_restart");
+                }
+                catch {
+                    /* best-effort */
+                }
+                void sub.iter.return?.();
+            }
+            wsSubscribers.clear();
+            // Defensive: also close any renders on the seam that no longer
+            // have local WS subscribers (e.g. orphaned renders from a partial
+            // unregister race). For InProcessStreamFanout this is a no-op
+            // when there are no subscribers; for hosted bindings it ensures
+            // the per-render pub/sub channel teardown fires.
+            await Promise.all(Array.from(sessionIds, (sessionId) => streamFanout.close(sessionId).catch(() => {
+                /* best-effort */
+            })));
+            await new Promise((resolve) => {
+                wss.close(() => resolve());
+            });
+        },
+    };
+}

package/dist/health-routes.d.ts

@@ -0,0 +1,76 @@
+/**
+ * Liveness / readiness / authenticated-probe routes.
+ *
+ *   GET /ggui/live       — process-alive probe (200 whenever the event
+ *                          loop can run a handler, regardless of
+ *                          readiness).
+ *   GET /ggui/health     — readiness probe; runs the operator-supplied
+ *                          readiness checks and reports per-check
+ *                          results, live-channel counts, and the
+ *                          thread-transport durability claim.
+ *   GET /ggui/auth-check — authenticated liveness. 204 when the bearer
+ *                          resolves via the configured AuthAdapter,
+ *                          401 otherwise (with `WWW-Authenticate` when
+ *                          OAuth is enabled).
+ *
+ * Why live and health are separate: K8s livenessProbe + readinessProbe
+ * have distinct semantics. Liveness asks "is the process alive?" and
+ * a failure tells the kubelet to RESTART the pod. Readiness asks "is
+ * the pod ready to receive traffic?" and a failure tells the service
+ * to STOP ROUTING. Tying both probes to a single endpoint that gates
+ * on dependency health (Redis, DDB, RAG) means a transient upstream
+ * blip kills the pod entirely instead of just removing it from
+ * rotation.
+ *
+ * Self-hoster wiring (K8s):
+ *
+ *   livenessProbe:  { httpGet: { path: '/ggui/live',   port } }
+ *   readinessProbe: { httpGet: { path: '/ggui/health', port } }
+ */
+import type { AuthAdapter } from "@ggui-ai/mcp-server-core";
+import type { Express } from "express";
+import type { ServerInfo } from "./build-mcp.js";
+import type { GguiSessionChannelServer } from "./ggui-session-channel.js";
+import type { Logger } from "./logger.js";
+interface MountOptions {
+    /** Express app to mount onto. */
+    readonly app: Express;
+    /** Server identity — `/ggui/health` reports name + version. */
+    readonly info: ServerInfo;
+    /** Registered tool count reported on `/ggui/health`. */
+    readonly toolCount: number;
+    /** Operator-supplied readiness checks (empty = always ready). */
+    readonly readinessChecks: ReadonlyArray<{
+        readonly name: string;
+        readonly check: () => boolean | Promise<boolean>;
+    }>;
+    /**
+     * Late-bound live-channel reference. The channel is constructed
+     * AFTER these routes mount (declaration-order in the composer), so
+     * the health route reads through a getter on every request.
+     */
+    readonly getChannel: () => GguiSessionChannelServer | null;
+    /**
+     * Thread-transport presence + durability claim. Absent when the
+     * server was booted without `threads:` (no persistent-chat routes
+     * mounted).
+     */
+    readonly threads?: {
+        readonly durability?: "durable" | "ephemeral";
+    };
+    /** Auth adapter `/ggui/auth-check` resolves bearers against. */
+    readonly auth: AuthAdapter;
+    /** Whether OAuth is enabled (adds `WWW-Authenticate` on 401). */
+    readonly oauthEnabled: boolean;
+    /** Operator-configured issuer URL override (OAuth). */
+    readonly oauthIssuerUrl?: string;
+    /** Structured logger for unexpected auth-check failures. */
+    readonly logger: Logger;
+}
+/**
+ * Mount `/ggui/live` + `/ggui/health` + `/ggui/auth-check` onto the
+ * express app. Returns nothing — the routes self-register.
+ */
+export declare function mountHealthRoutes(opts: MountOptions): void;
+export {};
+//# sourceMappingURL=health-routes.d.ts.map

package/dist/health-routes.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"health-routes.d.ts","sourceRoot":"","sources":["../src/health-routes.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AAEH,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,0BAA0B,CAAC;AAC5D,OAAO,KAAK,EAAE,OAAO,EAAqB,MAAM,SAAS,CAAC;AAE1D,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,gBAAgB,CAAC;AACjD,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,2BAA2B,CAAC;AAC1E,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,aAAa,CAAC;AAU1C,UAAU,YAAY;IACpB,iCAAiC;IACjC,QAAQ,CAAC,GAAG,EAAE,OAAO,CAAC;IACtB,+DAA+D;IAC/D,QAAQ,CAAC,IAAI,EAAE,UAAU,CAAC;IAC1B,wDAAwD;IACxD,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,iEAAiE;IACjE,QAAQ,CAAC,eAAe,EAAE,aAAa,CAAC;QACtC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;QACtB,QAAQ,CAAC,KAAK,EAAE,MAAM,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;KAClD,CAAC,CAAC;IACH;;;;OAIG;IACH,QAAQ,CAAC,UAAU,EAAE,MAAM,wBAAwB,GAAG,IAAI,CAAC;IAC3D;;;;OAIG;IACH,QAAQ,CAAC,OAAO,CAAC,EAAE;QAAE,QAAQ,CAAC,UAAU,CAAC,EAAE,SAAS,GAAG,WAAW,CAAA;KAAE,CAAC;IACrE,gEAAgE;IAChE,QAAQ,CAAC,IAAI,EAAE,WAAW,CAAC;IAC3B,iEAAiE;IACjE,QAAQ,CAAC,YAAY,EAAE,OAAO,CAAC;IAC/B,uDAAuD;IACvD,QAAQ,CAAC,cAAc,CAAC,EAAE,MAAM,CAAC;IACjC,4DAA4D;IAC5D,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;CACzB;AAED;;;GAGG;AACH,wBAAgB,iBAAiB,CAAC,IAAI,EAAE,YAAY,GAAG,IAAI,CAmH1D"}

package/dist/health-routes.js

@@ -0,0 +1,145 @@
+/**
+ * Liveness / readiness / authenticated-probe routes.
+ *
+ *   GET /ggui/live       — process-alive probe (200 whenever the event
+ *                          loop can run a handler, regardless of
+ *                          readiness).
+ *   GET /ggui/health     — readiness probe; runs the operator-supplied
+ *                          readiness checks and reports per-check
+ *                          results, live-channel counts, and the
+ *                          thread-transport durability claim.
+ *   GET /ggui/auth-check — authenticated liveness. 204 when the bearer
+ *                          resolves via the configured AuthAdapter,
+ *                          401 otherwise (with `WWW-Authenticate` when
+ *                          OAuth is enabled).
+ *
+ * Why live and health are separate: K8s livenessProbe + readinessProbe
+ * have distinct semantics. Liveness asks "is the process alive?" and
+ * a failure tells the kubelet to RESTART the pod. Readiness asks "is
+ * the pod ready to receive traffic?" and a failure tells the service
+ * to STOP ROUTING. Tying both probes to a single endpoint that gates
+ * on dependency health (Redis, DDB, RAG) means a transient upstream
+ * blip kills the pod entirely instead of just removing it from
+ * rotation.
+ *
+ * Self-hoster wiring (K8s):
+ *
+ *   livenessProbe:  { httpGet: { path: '/ggui/live',   port } }
+ *   readinessProbe: { httpGet: { path: '/ggui/health', port } }
+ */
+import { resolveIdentity, UnauthenticatedError } from "./auth.js";
+import { buildWwwAuthenticate, resolveIssuerUrl } from "./oauth.js";
+/**
+ * 1s per-check timeout — a hung dependency must not block the K8s
+ * liveness probe, which itself runs on a short period. A timeout is
+ * treated as a failed check; the dependency is degraded either way.
+ */
+const READINESS_CHECK_TIMEOUT_MS = 1_000;
+/**
+ * Mount `/ggui/live` + `/ggui/health` + `/ggui/auth-check` onto the
+ * express app. Returns nothing — the routes self-register.
+ */
+export function mountHealthRoutes(opts) {
+    const { app, info, toolCount, readinessChecks, getChannel, threads, auth, oauthEnabled, logger } = opts;
+    async function runReadinessChecks() {
+        if (readinessChecks.length === 0) {
+            return { allReady: true, results: {} };
+        }
+        const results = {};
+        let allReady = true;
+        await Promise.all(readinessChecks.map(async ({ name, check }) => {
+            try {
+                const ready = await Promise.race([
+                    Promise.resolve().then(() => check()),
+                    new Promise((resolve) => setTimeout(() => resolve(false), READINESS_CHECK_TIMEOUT_MS)),
+                ]);
+                results[name] = ready;
+                if (!ready)
+                    allReady = false;
+            }
+            catch {
+                results[name] = false;
+                allReady = false;
+            }
+        }));
+        return { allReady, results };
+    }
+    // No body needed for the kubelet's HTTP check (status code is the
+    // signal), but a tiny JSON keeps the endpoint debuggable from a
+    // shell. No `readinessChecks` invoked — keeping this probe cheap
+    // is the point; any heavier work belongs in `/ggui/health`.
+    app.get("/ggui/live", (_req, res) => {
+        res.status(200).json({ status: "alive", server: info.name });
+    });
+    app.get("/ggui/health", (_req, res) => {
+        void (async () => {
+            const { allReady, results } = await runReadinessChecks();
+            const body = {
+                status: allReady ? "ok" : "degraded",
+                server: info.name,
+                version: info.version,
+                tools: toolCount,
+            };
+            const channel = getChannel();
+            if (channel) {
+                body.channel = {
+                    path: channel.path,
+                    subscribers: channel.subscriberCount,
+                    renders: channel.renderCount,
+                };
+            }
+            // Thread-transport presence + durability claim. When present,
+            // `durability` is exactly what the caller declared — 'ephemeral'
+            // by default so Portal does not silently hide its non-durable
+            // caveat.
+            if (threads) {
+                body.threads = {
+                    enabled: true,
+                    durability: threads.durability ?? "ephemeral",
+                };
+            }
+            if (Object.keys(results).length > 0) {
+                body.checks = results;
+            }
+            res.status(allReady ? 200 : 503).json(body);
+        })();
+    });
+    /**
+     * Authenticated liveness probe.
+     *
+     * Identical auth semantics to `/mcp` (same AuthAdapter, same Bearer-
+     * parsing) but with a flat 204 / 401 response shape, no body, no
+     * render state. Designed for clients that need to distinguish
+     * "server is up but my token is stale" from "server is unreachable".
+     *
+     * A Settings → Servers probe in a host client is the canonical
+     * consumer: it hits `/ggui/health` first (open), then
+     * `/ggui/auth-check` with the pairing token, and reports
+     * `token-invalid` when the first succeeds but the second returns 401.
+     *
+     * No response body to keep the endpoint cheap — a 401 is the signal.
+     * We deliberately skip the MCP error envelope shape used by `/mcp`
+     * because this route is explicitly NOT part of the MCP wire.
+     */
+    app.get("/ggui/auth-check", async (req, res) => {
+        try {
+            await resolveIdentity(auth, req);
+            res.status(204).end();
+        }
+        catch (err) {
+            if (err instanceof UnauthenticatedError) {
+                if (oauthEnabled) {
+                    // Auth-check is universal-only — no per-app variant route is
+                    // mounted, so the WWW-Authenticate always points at the
+                    // universal resource metadata. Symmetric with the universal
+                    // /mcp handler's 401 behavior.
+                    res.setHeader("WWW-Authenticate", buildWwwAuthenticate(resolveIssuerUrl(req, opts.oauthIssuerUrl)));
+                }
+                res.status(401).end();
+                return;
+            }
+            logger.error("auth_check_unexpected_error", { error: String(err) });
+            res.status(500).end();
+        }
+    });
+}

package/dist/index.d.ts

@@ -26,31 +26,30 @@
  * The `ggui serve` CLI command boots this server with the OSS defaults.
  */
 export type { HandlerContext, SharedHandler } from '@ggui-ai/mcp-server-handlers';
-export type { GadgetDescriptor, McpUiDisplayMode, Render, SystemRender, } from '@ggui-ai/protocol';
-export type { GenerationCredentials, GenerationDeps, } from '@ggui-ai/mcp-server-handlers';
-export { NO_CREDENTIALS_SYSTEM_CARD_KIND, buildNoCredentialsRender, } from '@ggui-ai/mcp-server-handlers';
+export type { GadgetDescriptor, McpUiDisplayMode, GguiSession, SystemGguiSession, } from '@ggui-ai/protocol';
+export type { GenerationDeps } from '@ggui-ai/mcp-server-handlers';
+export { buildNoCredentialsGguiSession } from '@ggui-ai/mcp-server-handlers';
 export { createGguiServer, defaultHandlers } from './server.js';
 export type { CreateGguiServerOptions, GguiServer, } from './server.js';
 export { FileSystemCodeStore } from './code-store-fs.js';
 export type { FileSystemCodeStoreOptions } from './code-store-fs.js';
 export type { McpServerMount } from './mcp-mounts.js';
-export { composeWiredActionRouterFromMounts } from './mcp-mounts.js';
 export type { McpService, ServicePath } from './mcp-mounts.js';
 export { validateMcpServices, validateServicePath } from './mcp-mounts.js';
 export { composePreviewReservedValidator, mergeReservedValidators, } from './reserved-validators.js';
-export { checkRenderSchemaCompat, DEFAULT_SCHEMA_COMPAT_MODE, SchemaCompatError, } from './schema-compat.js';
-export type { SchemaCompatFinding, SchemaCompatMode, SchemaCompatReport, RenderContractShape, ToolSchemaRef, } from './schema-compat.js';
+export { checkRenderSchemaCompat, DEFAULT_SCHEMA_COMPAT_MODE, hasErrorFinding, SchemaCompatError, } from './schema-compat.js';
+export type { SchemaCompatFinding, SchemaCompatMode, SchemaCompatReport, GguiSessionContractShape, ToolSchemaRef, } from './schema-compat.js';
 export type { ServerInfo } from './build-mcp.js';
 export { UnauthenticatedError, DEFAULT_BUILDER_APP_ID, defaultAppIdFromIdentity, } from './auth.js';
 export { createConsoleLogger } from './logger.js';
 export type { Logger } from './logger.js';
-export { createRenderChannelServer, DEFAULT_RENDER_CHANNEL_PATH, DEFAULT_WIRED_TOOL_TIMEOUT_MS, } from './render-channel.js';
-export type { RenderChannelOptions, RenderChannelServer, WiredActionContext, WiredActionRouter, } from './render-channel.js';
+export { createGguiSessionChannelServer, DEFAULT_RENDER_CHANNEL_PATH, } from './ggui-session-channel.js';
+export type { GguiSessionChannelOptions, GguiSessionChannelServer, } from './ggui-session-channel.js';
 export { resolveStorageFromConfig } from './storage.js';
 export type { ResolveStorageFromConfigOptions, ResolvedStorageStores, } from './storage.js';
 export { DEFAULT_PAIRING_ADMIN_INIT_PATH, DEFAULT_PAIRING_PATH, mountPairingTransport, } from './pairing-transport.js';
 export type { PairingTransportOptions } from './pairing-transport.js';
-export { USER_SESSION_COOKIE_NAME, DEFAULT_USER_SESSION_TTL_SEC, cookieAuthMiddleware, extractUserSessionCookie, formatUserSessionCookieHeader, formatClearUserSessionCookieHeader, readUserSessionCookie, readUserSessionCookieFromHeaders, } from './user-session-auth.js';
+export { USER_SESSION_COOKIE_NAME, DEFAULT_USER_SESSION_TTL_SEC, cookieAuthMiddleware, extractUserSessionCookie, formatUserSessionCookieHeader, readUserSessionCookie, readUserSessionCookieFromHeaders, } from './user-session-auth.js';
 export type { FormatUserSessionCookieInput } from './user-session-auth.js';
 export { createPairLoginRateLimitMiddleware, resolveClientIp, } from './rate-limit-middleware.js';
 export type { PairLoginRateLimitOptions } from './rate-limit-middleware.js';
@@ -59,7 +58,7 @@ export type { CsrfMiddlewareOptions, MintCsrfTokenInput, MountCsrfTokenRouteOpti
 export { createSecurityHeadersMiddleware } from './security-headers-middleware.js';
 export type { SecurityHeadersMiddlewareOptions } from './security-headers-middleware.js';
 export { composeOAuthUserId, } from './oauth-login-types.js';
-export type { OAuthLoginProvider, AuthorizeUrlInput, ExchangeCodeInput, OAuthExchangeResult, OAuthProviderConfigRecord, OAuthAuthResult, } from './oauth-login-types.js';
+export type { OAuthLoginProvider, AuthorizeUrlInput, ExchangeCodeInput, OAuthExchangeResult, OAuthProviderConfigRecord, } from './oauth-login-types.js';
 export { DEFAULT_OAUTH_START_PATH, DEFAULT_OAUTH_CALLBACK_PATH, DEFAULT_OAUTH_PROVIDERS_LIST_PATH, OAUTH_PKCE_COOKIE_NAME, mountOAuthLoginRoutes, } from './oauth-login.js';
 export { DEFAULT_EMAIL_LOGIN_START_PATH, DEFAULT_EMAIL_LOGIN_VERIFY_PATH, DEFAULT_EMAIL_LOGIN_CONFIG_PATH, ConsoleEmailSender, InMemoryMagicLinkStore, mountEmailLoginRoutes, } from './email-login.js';
 export type { EmailSender, EmailMessage, MagicLinkStore, MagicLinkRecord, MintTokenInput, EmailLoginRoutesOptions, } from './email-login.js';
@@ -97,6 +96,6 @@ export type { DiscoveredPrimitiveCatalog } from '@ggui-ai/project-config/node';
 export type { LoadedTheme } from '@ggui-ai/project-config/node';
 export type { OperatorConfig } from '@ggui-ai/project-config';
 export type { ThemeWriter, ThemeFileUploader, } from './console-theme-routes.js';
-export type { LlmProvider, LlmRoute, LlmSelection, ProviderKeyRef, UiGenerateEvent, UiGenerateInput, UiGenerateResult, UiGenerator, GeneratorTier, GeneratorRegistry, GeneratorSlugParts, } from '@ggui-ai/mcp-server-core';
+export type { LlmProvider, LlmRoute, LlmSelection, ProviderKeyRef, UiGenerateInput, UiGenerateResult, UiGenerator, GeneratorTier, GeneratorRegistry, GeneratorSlugParts, } from '@ggui-ai/mcp-server-core';
 export { formatGeneratorSlug, isValidGeneratorSlug, parseGeneratorSlug, } from '@ggui-ai/mcp-server-core';
 //# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AAEH,YAAY,EAAE,cAAc,EAAE,aAAa,EAAE,MAAM,8BAA8B,CAAC;AAKlF,YAAY,EACV,gBAAgB,EAChB,gBAAgB,EAChB,MAAM,EACN,YAAY,GACb,MAAM,mBAAmB,CAAC;AAC3B,YAAY,EACV,qBAAqB,EACrB,cAAc,GACf,MAAM,8BAA8B,CAAC;AAKtC,OAAO,EACL,+BAA+B,EAC/B,wBAAwB,GACzB,MAAM,8BAA8B,CAAC;AACtC,OAAO,EAAE,gBAAgB,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AAChE,YAAY,EACV,uBAAuB,EACvB,UAAU,GACX,MAAM,aAAa,CAAC;AAIrB,OAAO,EAAE,mBAAmB,EAAE,MAAM,oBAAoB,CAAC;AACzD,YAAY,EAAE,0BAA0B,EAAE,MAAM,oBAAoB,CAAC;AAKrE,YAAY,EAAE,cAAc,EAAE,MAAM,iBAAiB,CAAC;AACtD,OAAO,EAAE,kCAAkC,EAAE,MAAM,iBAAiB,CAAC;AAMrE,YAAY,EAAE,UAAU,EAAE,WAAW,EAAE,MAAM,iBAAiB,CAAC;AAC/D,OAAO,EAAE,mBAAmB,EAAE,mBAAmB,EAAE,MAAM,iBAAiB,CAAC;AAO3E,OAAO,EACL,+BAA+B,EAC/B,uBAAuB,GACxB,MAAM,0BAA0B,CAAC;AAKlC,OAAO,EACL,uBAAuB,EACvB,0BAA0B,EAC1B,iBAAiB,GAClB,MAAM,oBAAoB,CAAC;AAC5B,YAAY,EACV,mBAAmB,EACnB,gBAAgB,EAChB,kBAAkB,EAClB,mBAAmB,EACnB,aAAa,GACd,MAAM,oBAAoB,CAAC;AAC5B,YAAY,EAAE,UAAU,EAAE,MAAM,gBAAgB,CAAC;AACjD,OAAO,EACL,oBAAoB,EACpB,sBAAsB,EACtB,wBAAwB,GACzB,MAAM,WAAW,CAAC;AACnB,OAAO,EAAE,mBAAmB,EAAE,MAAM,aAAa,CAAC;AAClD,YAAY,EAAE,MAAM,EAAE,MAAM,aAAa,CAAC;AAC1C,OAAO,EACL,yBAAyB,EACzB,2BAA2B,EAC3B,6BAA6B,GAC9B,MAAM,qBAAqB,CAAC;AAC7B,YAAY,EACV,oBAAoB,EACpB,mBAAmB,EACnB,kBAAkB,EAClB,iBAAiB,GAClB,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EAAE,wBAAwB,EAAE,MAAM,cAAc,CAAC;AACxD,YAAY,EACV,+BAA+B,EAC/B,qBAAqB,GACtB,MAAM,cAAc,CAAC;AACtB,OAAO,EACL,+BAA+B,EAC/B,oBAAoB,EACpB,qBAAqB,GACtB,MAAM,wBAAwB,CAAC;AAChC,YAAY,EAAE,uBAAuB,EAAE,MAAM,wBAAwB,CAAC;AAKtE,OAAO,EACL,wBAAwB,EACxB,4BAA4B,EAC5B,oBAAoB,EACpB,wBAAwB,EACxB,6BAA6B,EAC7B,kCAAkC,EAClC,qBAAqB,EACrB,gCAAgC,GACjC,MAAM,wBAAwB,CAAC;AAChC,YAAY,EAAE,4BAA4B,EAAE,MAAM,wBAAwB,CAAC;AAK3E,OAAO,EACL,kCAAkC,EAClC,eAAe,GAChB,MAAM,4BAA4B,CAAC;AACpC,YAAY,EAAE,yBAAyB,EAAE,MAAM,4BAA4B,CAAC;AAM5E,OAAO,EACL,gBAAgB,EAChB,yBAAyB,EACzB,uBAAuB,EACvB,oBAAoB,EACpB,aAAa,EACb,mBAAmB,GACpB,MAAM,sBAAsB,CAAC;AAC9B,YAAY,EACV,qBAAqB,EACrB,kBAAkB,EAClB,0BAA0B,GAC3B,MAAM,sBAAsB,CAAC;AAC9B,OAAO,EAAE,+BAA+B,EAAE,MAAM,kCAAkC,CAAC;AACnF,YAAY,EAAE,gCAAgC,EAAE,MAAM,kCAAkC,CAAC;AAKzF,OAAO,EACL,kBAAkB,GACnB,MAAM,wBAAwB,CAAC;AAChC,YAAY,EACV,kBAAkB,EAClB,iBAAiB,EACjB,iBAAiB,EACjB,mBAAmB,EACnB,yBAAyB,EACzB,eAAe,GAChB,MAAM,wBAAwB,CAAC;AAChC,OAAO,EACL,wBAAwB,EACxB,2BAA2B,EAC3B,iCAAiC,EACjC,sBAAsB,EACtB,qBAAqB,GACtB,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EACL,8BAA8B,EAC9B,+BAA+B,EAC/B,+BAA+B,EAC/B,kBAAkB,EAClB,sBAAsB,EACtB,qBAAqB,GACtB,MAAM,kBAAkB,CAAC;AAC1B,YAAY,EACV,WAAW,EACX,YAAY,EACZ,cAAc,EACd,eAAe,EACf,cAAc,EACd,uBAAuB,GACxB,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EAAE,iBAAiB,EAAE,MAAM,mBAAmB,CAAC;AACtD,YAAY,EAAE,wBAAwB,EAAE,MAAM,mBAAmB,CAAC;AAClE,OAAO,EAAE,eAAe,EAAE,MAAM,iBAAiB,CAAC;AAClD,YAAY,EAAE,sBAAsB,EAAE,MAAM,iBAAiB,CAAC;AAC9D,OAAO,EAAE,wBAAwB,EAAE,MAAM,4BAA4B,CAAC;AACtE,YAAY,EACV,eAAe,EACf,oBAAoB,EACpB,wBAAwB,GACzB,MAAM,4BAA4B,CAAC;AACpC,OAAO,EACL,wBAAwB,EACxB,sBAAsB,GACvB,MAAM,2BAA2B,CAAC;AACnC,YAAY,EACV,qBAAqB,EACrB,oBAAoB,GACrB,MAAM,2BAA2B,CAAC;AACnC,YAAY,EAAE,uBAAuB,EAAE,MAAM,kBAAkB,CAAC;AAChE,OAAO,EAAE,mBAAmB,EAAE,MAAM,6BAA6B,CAAC;AAClE,YAAY,EAAE,0BAA0B,EAAE,MAAM,6BAA6B,CAAC;AAC9E,OAAO,EAAE,mBAAmB,EAAE,MAAM,6BAA6B,CAAC;AAClE,YAAY,EAAE,0BAA0B,EAAE,MAAM,6BAA6B,CAAC;AAC9E,OAAO,EAAE,yBAAyB,EAAE,MAAM,4BAA4B,CAAC;AACvE,YAAY,EACV,mBAAmB,EACnB,0BAA0B,EAC1B,QAAQ,IAAI,2BAA2B,GACxC,MAAM,4BAA4B,CAAC;AACpC,OAAO,EACL,kCAAkC,EAClC,iCAAiC,GAClC,MAAM,sCAAsC,CAAC;AAC9C,YAAY,EAAE,mCAAmC,EAAE,MAAM,sCAAsC,CAAC;AAIhG,YAAY,EACV,oBAAoB,EACpB,OAAO,EACP,iBAAiB,EACjB,WAAW,EACX,cAAc,EACd,gBAAgB,GACjB,MAAM,0BAA0B,CAAC;AAClC,OAAO,EACL,wBAAwB,EACxB,oBAAoB,EACpB,8BAA8B,EAC9B,oBAAoB,GACrB,MAAM,uBAAuB,CAAC;AAC/B,YAAY,EACV,mBAAmB,EACnB,sBAAsB,GACvB,MAAM,uBAAuB,CAAC;AAO/B,OAAO,EAAE,sBAAsB,EAAE,MAAM,oCAAoC,CAAC;AAC5E,YAAY,EAAE,cAAc,EAAE,MAAM,0BAA0B,CAAC;AAS/D,OAAO,EAAE,mBAAmB,EAAE,MAAM,oCAAoC,CAAC;AACzE,YAAY,EAAE,0BAA0B,EAAE,MAAM,oCAAoC,CAAC;AAQrF,OAAO,EACL,sBAAsB,EACtB,kBAAkB,GACnB,MAAM,oCAAoC,CAAC;AAC5C,YAAY,EACV,6BAA6B,EAC7B,yBAAyB,GAC1B,MAAM,oCAAoC,CAAC;AAC5C,YAAY,EAAE,WAAW,EAAE,UAAU,EAAE,MAAM,0BAA0B,CAAC;AASxE,OAAO,EAAE,yBAAyB,EAAE,MAAM,oCAAoC,CAAC;AAC/E,YAAY,EACV,qBAAqB,EACrB,gCAAgC,GACjC,MAAM,oCAAoC,CAAC;AAC5C,YAAY,EAAE,iBAAiB,EAAE,MAAM,0BAA0B,CAAC;AAOlE,YAAY,EAAE,0BAA0B,EAAE,MAAM,8BAA8B,CAAC;AAU/E,YAAY,EAAE,WAAW,EAAE,MAAM,8BAA8B,CAAC;AAOhE,YAAY,EAAE,cAAc,EAAE,MAAM,yBAAyB,CAAC;AAU9D,YAAY,EACV,WAAW,EACX,iBAAiB,GAClB,MAAM,2BAA2B,CAAC;AAQnC,YAAY,EACV,WAAW,EACX,QAAQ,EACR,YAAY,EACZ,cAAc,EACd,eAAe,EACf,eAAe,EACf,gBAAgB,EAChB,WAAW,EACX,aAAa,EACb,iBAAiB,EACjB,kBAAkB,GACnB,MAAM,0BAA0B,CAAC;AAKlC,OAAO,EACL,mBAAmB,EACnB,oBAAoB,EACpB,kBAAkB,GACnB,MAAM,0BAA0B,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AAEH,YAAY,EAAE,cAAc,EAAE,aAAa,EAAE,MAAM,8BAA8B,CAAC;AAKlF,YAAY,EACV,gBAAgB,EAChB,gBAAgB,EAChB,WAAW,EACX,iBAAiB,GAClB,MAAM,mBAAmB,CAAC;AAC3B,YAAY,EAAE,cAAc,EAAE,MAAM,8BAA8B,CAAC;AAKnE,OAAO,EAAE,6BAA6B,EAAE,MAAM,8BAA8B,CAAC;AAC7E,OAAO,EAAE,gBAAgB,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AAChE,YAAY,EACV,uBAAuB,EACvB,UAAU,GACX,MAAM,aAAa,CAAC;AAIrB,OAAO,EAAE,mBAAmB,EAAE,MAAM,oBAAoB,CAAC;AACzD,YAAY,EAAE,0BAA0B,EAAE,MAAM,oBAAoB,CAAC;AAKrE,YAAY,EAAE,cAAc,EAAE,MAAM,iBAAiB,CAAC;AAMtD,YAAY,EAAE,UAAU,EAAE,WAAW,EAAE,MAAM,iBAAiB,CAAC;AAC/D,OAAO,EAAE,mBAAmB,EAAE,mBAAmB,EAAE,MAAM,iBAAiB,CAAC;AAO3E,OAAO,EACL,+BAA+B,EAC/B,uBAAuB,GACxB,MAAM,0BAA0B,CAAC;AAKlC,OAAO,EACL,uBAAuB,EACvB,0BAA0B,EAC1B,eAAe,EACf,iBAAiB,GAClB,MAAM,oBAAoB,CAAC;AAC5B,YAAY,EACV,mBAAmB,EACnB,gBAAgB,EAChB,kBAAkB,EAClB,wBAAwB,EACxB,aAAa,GACd,MAAM,oBAAoB,CAAC;AAC5B,YAAY,EAAE,UAAU,EAAE,MAAM,gBAAgB,CAAC;AACjD,OAAO,EACL,oBAAoB,EACpB,sBAAsB,EACtB,wBAAwB,GACzB,MAAM,WAAW,CAAC;AACnB,OAAO,EAAE,mBAAmB,EAAE,MAAM,aAAa,CAAC;AAClD,YAAY,EAAE,MAAM,EAAE,MAAM,aAAa,CAAC;AAC1C,OAAO,EACL,8BAA8B,EAC9B,2BAA2B,GAC5B,MAAM,2BAA2B,CAAC;AACnC,YAAY,EACV,yBAAyB,EACzB,wBAAwB,GACzB,MAAM,2BAA2B,CAAC;AACnC,OAAO,EAAE,wBAAwB,EAAE,MAAM,cAAc,CAAC;AACxD,YAAY,EACV,+BAA+B,EAC/B,qBAAqB,GACtB,MAAM,cAAc,CAAC;AACtB,OAAO,EACL,+BAA+B,EAC/B,oBAAoB,EACpB,qBAAqB,GACtB,MAAM,wBAAwB,CAAC;AAChC,YAAY,EAAE,uBAAuB,EAAE,MAAM,wBAAwB,CAAC;AAKtE,OAAO,EACL,wBAAwB,EACxB,4BAA4B,EAC5B,oBAAoB,EACpB,wBAAwB,EACxB,6BAA6B,EAC7B,qBAAqB,EACrB,gCAAgC,GACjC,MAAM,wBAAwB,CAAC;AAChC,YAAY,EAAE,4BAA4B,EAAE,MAAM,wBAAwB,CAAC;AAK3E,OAAO,EACL,kCAAkC,EAClC,eAAe,GAChB,MAAM,4BAA4B,CAAC;AACpC,YAAY,EAAE,yBAAyB,EAAE,MAAM,4BAA4B,CAAC;AAM5E,OAAO,EACL,gBAAgB,EAChB,yBAAyB,EACzB,uBAAuB,EACvB,oBAAoB,EACpB,aAAa,EACb,mBAAmB,GACpB,MAAM,sBAAsB,CAAC;AAC9B,YAAY,EACV,qBAAqB,EACrB,kBAAkB,EAClB,0BAA0B,GAC3B,MAAM,sBAAsB,CAAC;AAC9B,OAAO,EAAE,+BAA+B,EAAE,MAAM,kCAAkC,CAAC;AACnF,YAAY,EAAE,gCAAgC,EAAE,MAAM,kCAAkC,CAAC;AAKzF,OAAO,EACL,kBAAkB,GACnB,MAAM,wBAAwB,CAAC;AAChC,YAAY,EACV,kBAAkB,EAClB,iBAAiB,EACjB,iBAAiB,EACjB,mBAAmB,EACnB,yBAAyB,GAC1B,MAAM,wBAAwB,CAAC;AAChC,OAAO,EACL,wBAAwB,EACxB,2BAA2B,EAC3B,iCAAiC,EACjC,sBAAsB,EACtB,qBAAqB,GACtB,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EACL,8BAA8B,EAC9B,+BAA+B,EAC/B,+BAA+B,EAC/B,kBAAkB,EAClB,sBAAsB,EACtB,qBAAqB,GACtB,MAAM,kBAAkB,CAAC;AAC1B,YAAY,EACV,WAAW,EACX,YAAY,EACZ,cAAc,EACd,eAAe,EACf,cAAc,EACd,uBAAuB,GACxB,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EAAE,iBAAiB,EAAE,MAAM,mBAAmB,CAAC;AACtD,YAAY,EAAE,wBAAwB,EAAE,MAAM,mBAAmB,CAAC;AAClE,OAAO,EAAE,eAAe,EAAE,MAAM,iBAAiB,CAAC;AAClD,YAAY,EAAE,sBAAsB,EAAE,MAAM,iBAAiB,CAAC;AAC9D,OAAO,EAAE,wBAAwB,EAAE,MAAM,4BAA4B,CAAC;AACtE,YAAY,EACV,eAAe,EACf,oBAAoB,EACpB,wBAAwB,GACzB,MAAM,4BAA4B,CAAC;AACpC,OAAO,EACL,wBAAwB,EACxB,sBAAsB,GACvB,MAAM,2BAA2B,CAAC;AACnC,YAAY,EACV,qBAAqB,EACrB,oBAAoB,GACrB,MAAM,2BAA2B,CAAC;AACnC,YAAY,EAAE,uBAAuB,EAAE,MAAM,kBAAkB,CAAC;AAChE,OAAO,EAAE,mBAAmB,EAAE,MAAM,6BAA6B,CAAC;AAClE,YAAY,EAAE,0BAA0B,EAAE,MAAM,6BAA6B,CAAC;AAC9E,OAAO,EAAE,mBAAmB,EAAE,MAAM,6BAA6B,CAAC;AAClE,YAAY,EAAE,0BAA0B,EAAE,MAAM,6BAA6B,CAAC;AAC9E,OAAO,EAAE,yBAAyB,EAAE,MAAM,4BAA4B,CAAC;AACvE,YAAY,EACV,mBAAmB,EACnB,0BAA0B,EAC1B,QAAQ,IAAI,2BAA2B,GACxC,MAAM,4BAA4B,CAAC;AACpC,OAAO,EACL,kCAAkC,EAClC,iCAAiC,GAClC,MAAM,sCAAsC,CAAC;AAC9C,YAAY,EAAE,mCAAmC,EAAE,MAAM,sCAAsC,CAAC;AAIhG,YAAY,EACV,oBAAoB,EACpB,OAAO,EACP,iBAAiB,EACjB,WAAW,EACX,cAAc,EACd,gBAAgB,GACjB,MAAM,0BAA0B,CAAC;AAClC,OAAO,EACL,wBAAwB,EACxB,oBAAoB,EACpB,8BAA8B,EAC9B,oBAAoB,GACrB,MAAM,uBAAuB,CAAC;AAC/B,YAAY,EACV,mBAAmB,EACnB,sBAAsB,GACvB,MAAM,uBAAuB,CAAC;AAO/B,OAAO,EAAE,sBAAsB,EAAE,MAAM,oCAAoC,CAAC;AAC5E,YAAY,EAAE,cAAc,EAAE,MAAM,0BAA0B,CAAC;AAS/D,OAAO,EAAE,mBAAmB,EAAE,MAAM,oCAAoC,CAAC;AACzE,YAAY,EAAE,0BAA0B,EAAE,MAAM,oCAAoC,CAAC;AAQrF,OAAO,EACL,sBAAsB,EACtB,kBAAkB,GACnB,MAAM,oCAAoC,CAAC;AAC5C,YAAY,EACV,6BAA6B,EAC7B,yBAAyB,GAC1B,MAAM,oCAAoC,CAAC;AAC5C,YAAY,EAAE,WAAW,EAAE,UAAU,EAAE,MAAM,0BAA0B,CAAC;AASxE,OAAO,EAAE,yBAAyB,EAAE,MAAM,oCAAoC,CAAC;AAC/E,YAAY,EACV,qBAAqB,EACrB,gCAAgC,GACjC,MAAM,oCAAoC,CAAC;AAC5C,YAAY,EAAE,iBAAiB,EAAE,MAAM,0BAA0B,CAAC;AAOlE,YAAY,EAAE,0BAA0B,EAAE,MAAM,8BAA8B,CAAC;AAU/E,YAAY,EAAE,WAAW,EAAE,MAAM,8BAA8B,CAAC;AAOhE,YAAY,EAAE,cAAc,EAAE,MAAM,yBAAyB,CAAC;AAU9D,YAAY,EACV,WAAW,EACX,iBAAiB,GAClB,MAAM,2BAA2B,CAAC;AAQnC,YAAY,EACV,WAAW,EACX,QAAQ,EACR,YAAY,EACZ,cAAc,EACd,eAAe,EACf,gBAAgB,EAChB,WAAW,EACX,aAAa,EACb,iBAAiB,EACjB,kBAAkB,GACnB,MAAM,0BAA0B,CAAC;AAKlC,OAAO,EACL,mBAAmB,EACnB,oBAAoB,EACpB,kBAAkB,GACnB,MAAM,0BAA0B,CAAC"}

package/dist/index.js

@@ -25,40 +25,39 @@
  *
  * The `ggui serve` CLI command boots this server with the OSS defaults.
  */
-// No-credentials fallback helpers — re-exported so the OSS CLI can
+// No-credentials fallback helper — re-exported so the OSS CLI can
 // build the no-credentials card render (pointing at the resolved
 // `/settings` URL) without taking a direct `@ggui-ai/mcp-server-handlers`
 // dependency.
-export { NO_CREDENTIALS_SYSTEM_CARD_KIND, buildNoCredentialsRender, } from '@ggui-ai/mcp-server-handlers';
+export { buildNoCredentialsGguiSession } from '@ggui-ai/mcp-server-handlers';
 export { createGguiServer, defaultHandlers } from './server.js';
 // Content-addressable code delivery (2026-05-03). FileSystemCodeStore
 // is the OSS dev default; in-memory variant ships in
 // `@ggui-ai/mcp-server-core/in-memory` for tests + ephemeral runs.
 export { FileSystemCodeStore } from './code-store-fs.js';
-export { composeWiredActionRouterFromMounts } from './mcp-mounts.js';
 export { validateMcpServices, validateServicePath } from './mcp-mounts.js';
 // Reserved-channel payload validator composition.
 // `composePreviewReservedValidator` binds the A2UI adapter
 // for `_ggui:preview`; `mergeReservedValidators` layers caller-provided
 // extras on top. `createGguiServer` composes these automatically —
-// consumers that embed the session-channel server directly (via
-// `createSessionChannelServer`) wire them up manually.
+// consumers that embed the render-channel server directly (via
+// `createGguiSessionChannelServer`) wire them up manually.
 export { composePreviewReservedValidator, mergeReservedValidators, } from './reserved-validators.js';
 // Schema compatibility checker. Exposes the helper, the policy-mode
 // type, the canonical error, and the default mode constant. Consumers
 // embedding their own endpoint paths (custom hosted wrappers) can
 // reuse the helper directly.
-export { checkRenderSchemaCompat, DEFAULT_SCHEMA_COMPAT_MODE, SchemaCompatError, } from './schema-compat.js';
+export { checkRenderSchemaCompat, DEFAULT_SCHEMA_COMPAT_MODE, hasErrorFinding, SchemaCompatError, } from './schema-compat.js';
 export { UnauthenticatedError, DEFAULT_BUILDER_APP_ID, defaultAppIdFromIdentity, } from './auth.js';
 export { createConsoleLogger } from './logger.js';
-export { createRenderChannelServer, DEFAULT_RENDER_CHANNEL_PATH, DEFAULT_WIRED_TOOL_TIMEOUT_MS, } from './render-channel.js';
+export { createGguiSessionChannelServer, DEFAULT_RENDER_CHANNEL_PATH, } from './ggui-session-channel.js';
 export { resolveStorageFromConfig } from './storage.js';
 export { DEFAULT_PAIRING_ADMIN_INIT_PATH, DEFAULT_PAIRING_PATH, mountPairingTransport, } from './pairing-transport.js';
 // End-user browser-session cookie + login routes. Cookie + endpoints
 // are mounted automatically by `createGguiServer` when pairing is
 // enabled; re-exported here so embedders composing custom transports
 // can reuse the cookie shape directly.
-export { USER_SESSION_COOKIE_NAME, DEFAULT_USER_SESSION_TTL_SEC, cookieAuthMiddleware, extractUserSessionCookie, formatUserSessionCookieHeader, formatClearUserSessionCookieHeader, readUserSessionCookie, readUserSessionCookieFromHeaders, } from './user-session-auth.js';
+export { USER_SESSION_COOKIE_NAME, DEFAULT_USER_SESSION_TTL_SEC, cookieAuthMiddleware, extractUserSessionCookie, formatUserSessionCookieHeader, readUserSessionCookie, readUserSessionCookieFromHeaders, } from './user-session-auth.js';
 // Per-IP rate limit on `/pair`. Mounted automatically by
 // `createGguiServer` when pairing is enabled. Re-exported so hosted
 // bindings can swap in their own RateLimiter (Redis-backed,
@@ -87,7 +86,7 @@ export { githubLoginProvider } from './oauth-providers/github.js';
 export { createOAuthProvidersStore } from './oauth-providers-store.js';
 export { DEFAULT_ADMIN_OAUTH_PROVIDERS_PATH, mountAdminOAuthProvidersTransport, } from './admin-oauth-providers-transport.js';
 export { DEFAULT_BUILDER_OWNER_ID, DEFAULT_THREADS_PATH, defaultThreadOwnerFromIdentity, mountThreadTransport, } from './thread-transport.js';
-// Zero-config in-memory reference for the console shortCode → session
+// Zero-config in-memory reference for the console shortCode → render
 // lookup. Re-exported here (alongside `createGguiServer`) so CLI hosts
 // composing the OSS first-run path can pass one without taking a direct
 // dep on `@ggui-ai/mcp-server-core`. For durable deployments the

package/dist/instructions-presets.d.ts

@@ -54,9 +54,9 @@ export declare const MCP_INSTRUCTIONS_PRESETS: {
     readonly default: string;
     /**
      * Default protocol primer + the host-side action-routing detail
-     * (Pattern α direct dispatch vs Pattern β cross-server consent
-     * bridge). Pick when the operator wants the LLM to also reason
-     * about how the underlying tools/call envelopes flow.
+     * (submit_action relay → per-render pipe → `ggui_consume` drain).
+     * Pick when the operator wants the LLM to also reason about how
+     * the underlying tools/call envelopes flow.
      */
     readonly aggressive: string;
     /**