@ggui-ai/protocol 0.1.0-rc.1

package/dist/types/blueprint.d.ts

@@ -0,0 +1,206 @@
+/**
+ * `Blueprint` — the variant-unit between a `DataContract` and the
+ * generated UI code that renders it.
+ *
+ * Multiple `Blueprint` records MAY share `(appId, contractHash)`; they
+ * differ on `generator` and/or {@link BlueprintVariance}. The selector
+ * picks one at runtime (an LLM-driven pick layered atop the
+ * deterministic fallback ladder; see
+ * {@link BlueprintSelector} in `@ggui-ai/mcp-server-core`).
+ *
+ * Locked decisions:
+ *
+ *   - **Storage shape: S3 + DDB pointer.** Production adapters store
+ *     code body in S3 at a content-hashed key and persist
+ *     `codeS3Url + codeHash` on the metadata row. DDB's 400KB per-item
+ *     limit precludes inline storage — typical generated code is
+ *     5-30KB but advanced-generator iterative-loop output routinely
+ *     exceeds it. OSS in-memory adapter skips S3 (in-process
+ *     `Map<codeHash, string>`).
+ *   - **Tenancy.** Scoped per `(appId, contractHash)`. Different apps'
+ *     contract may coincidentally hash the same; their blueprints
+ *     must never cross-pollinate. The DDB primary key is
+ *     `blueprintId`; the lookup GSI is `blueprintsByAppAndContract`.
+ *   - **`contract` field.** The contract shape is content-keyed by
+ *     `contractHash` (RFC 8785 / `blueprintKey`), so any two
+ *     blueprints with the same `contractHash` agree on it
+ *     byte-for-byte after canonicalization. The embedded `contract`
+ *     copy is a read-time convenience for callers that have the
+ *     blueprint row in hand and don't want a second lookup — NOT a
+ *     source-of-truth divergence. Implementations MAY denormalize
+ *     freely; consumers MUST treat `contractHash` as authoritative.
+ */
+import type { DataContract, JsonObject } from './data-contract.js';
+/**
+ * Per-axis weights for the {@link BlueprintSearch} multi-axis scoring
+ * algorithm. Each weight is a non-negative number; the final score is
+ * the weighted sum divided by the sum-of-weights so the output stays
+ * in `[0, 1]` regardless of how operators tune the dial.
+ *
+ * Wire shape: lives on
+ * {@link BlueprintSearchConfig.weights}, which lives on the per-app
+ * {@link AppBlueprintSearchConfig}. Default values:
+ * `{hash: 1.0, embed: 0.4, struct: 0.3, variance: 0.2, intent: 0.1}` —
+ * the embed + struct axes dominate by design (a structurally-similar
+ * contract is the strongest semantic match short of an exact hash).
+ */
+export interface BlueprintSearchWeights {
+    /** Exact `contractHash` equality. Short-circuit weight — when a
+     *  match exists on this axis, the search returns `score: 1.0`
+     *  immediately without consulting the others. */
+    readonly hash: number;
+    /** Cosine similarity between query + candidate `contractEmbedding`. */
+    readonly embed: number;
+    /** Structural fingerprint Jaccard — actionNames, streamChannels,
+     *  propsKeys, contextKeys overlap. */
+    readonly struct: number;
+    /** Variance-tag overlap — persona equality + aesthetic equality +
+     *  context-key Jaccard, averaged. */
+    readonly variance: number;
+    /** Intent-keyword Jaccard against the blueprint's stored
+     *  `seedPrompt + persona` tokens. */
+    readonly intent: number;
+}
+/**
+ * Per-app blueprint-search configuration. All fields optional — the
+ * server applies the global default when absent.
+ *
+ * Wire shape: lives on the per-app `App` record
+ * in `@ggui-ai/mcp-server-core` as `App.blueprintSearchConfig?`. The
+ * cloud DDB adapter carries it as an optional map column with
+ * default-on-read.
+ */
+export interface AppBlueprintSearchConfig {
+    /** Per-axis weight overrides. Falls back to
+     *  `DEFAULT_BLUEPRINT_SEARCH_WEIGHTS`. */
+    readonly weights?: Partial<BlueprintSearchWeights>;
+    /** Score gate for `origin: 'cache'` routing in the three-step
+     *  handshake. Defaults to `0.85`. */
+    readonly threshold?: number;
+    /** Maximum results returned per call. Defaults to `5`. */
+    readonly topK?: number;
+}
+/**
+ * Per-blueprint variance tags. Free-form at v1 — a `PersonaRegistry`
+ * may follow if the tag set stabilizes around recurring patterns.
+ *
+ * The LLM-driven selector reads `persona` + `context` + `seedPrompt`
+ * to pick the best fit for the current request's `intent` + `hint`.
+ */
+export interface BlueprintVariance {
+    /**
+     * Free-form persona tag (e.g. `'minimalist'`, `'data-dense'`,
+     * `'mobile-first'`). Operator-authored.
+     */
+    readonly persona?: string;
+    /**
+     * Free-form aesthetic tag (e.g. `'glassmorphic'`, `'brutalist'`,
+     * `'editorial'`). Distinct from persona — persona names the user
+     * mental model; aesthetic names the visual treatment. Cold-gen
+     * prompts surface this as a styling directive; the variant selector
+     * weights it alongside persona when ranking cached variants.
+     */
+    readonly aesthetic?: string;
+    /**
+     * Small structured signal carried alongside the persona. Typed as
+     * {@link JsonObject} so any JSON-safe shape rides through.
+     */
+    readonly context?: JsonObject;
+    /**
+     * The raw operator prompt that produced this variant. Round-trip
+     * input for the LLM selector + audit trail.
+     */
+    readonly seedPrompt?: string;
+}
+/**
+ * The variant-unit. See file-level docstring for the locked decisions
+ * this shape encodes.
+ */
+export interface Blueprint {
+    /** Stable, unique blueprint id (e.g. `bp-<uuid>`). Primary key. */
+    readonly blueprintId: string;
+    /**
+     * Canonical RFC 8785 (JCS) hash of the contract shape — same
+     * function as `blueprintKey(contract)`. Groups variants under one
+     * key.
+     */
+    readonly contractHash: string;
+    /** Tenancy scope. Composite secondary key with `contractHash`. */
+    readonly appId: string;
+    /**
+     * S3 URL (`s3://<bucket>/<key>`) of the generated code body when
+     * cached. Absent → blueprint is pending generation; push branches
+     * on this to decide cache-hit vs gen-and-persist. OSS in-memory
+     * adapters MAY use a non-S3 sentinel (or just leave this absent
+     * and rely on `codeHash` to look up code body inline).
+     */
+    readonly codeS3Url?: string;
+    /**
+     * Content hash of the generated code body. Present iff
+     * {@link codeS3Url} is present (or the in-memory equivalent).
+     */
+    readonly codeHash?: string;
+    /**
+     * Slug of the {@link UiGenerator} that produced this variant
+     * (e.g. `'ui-gen-default-haiku-4-5'`). The server's `GeneratorRegistry`
+     * is the authority for which slugs exist on a given deployment.
+     */
+    readonly generator: string;
+    /**
+     * Optional 0-1 validator score from the advanced generator's
+     * iterative loop. Sub-threshold variants are stored but not selected
+     * by default; the operator UI can promote them.
+     */
+    readonly validatorScore?: number;
+    /**
+     * Variance tags driving the LLM selector. See
+     * {@link BlueprintVariance}.
+     */
+    readonly variance: BlueprintVariance;
+    /**
+     * Operator-pinned default flag. The deterministic fallback ladder
+     * picks this variant first when present; the LLM selector defers to
+     * it when ambiguous.
+     *
+     * Encoded as `true | undefined` (never `false`) — only one variant
+     * per `(appId, contractHash)` carries the flag, and the store
+     * enforces the invariant on `setOperatorDefault`. Absent ≡ not
+     * the default.
+     */
+    readonly isOperatorDefault?: true;
+    /** ISO-8601 timestamp the row was first inserted. */
+    readonly createdAt: string;
+    /**
+     * `'agent'` when the standard handshake → push flow minted the
+     * blueprint; `'operator'` when an explicit `ggui_ops_generate_blueprint`
+     * call created it.
+     */
+    readonly createdBy: 'agent' | 'operator';
+    /**
+     * Read-cache copy of the contract shape. See file-level docstring
+     * for why this is a denormalization, not a source-of-truth
+     * divergence. Consumers MUST treat {@link contractHash} as
+     * authoritative for identity comparison.
+     */
+    readonly contract: DataContract;
+    /**
+     * Embedding vector of the canonical-JSON-stringified contract,
+     * computed by {@link EmbeddingProvider} at
+     * {@link BlueprintStore.put} time when a provider is wired. Read
+     * by {@link BlueprintSearch} on the embed axis (cosine similarity
+     * vs. the search-time embedding of the query contract). Absent
+     * when the store was constructed without a provider; the search
+     * still works — the embed axis simply contributes zero and the
+     * other axes (hash, structural, variance, intent) carry the
+     * decision.
+     *
+     * Length MUST equal the provider's declared `dimensions`. SHOULD be
+     * L2-normalized so dot product == cosine.
+     * Implementations that swap providers across deployments are
+     * expected to re-embed; comparing vectors across provider ids is
+     * a category error (different basis), and the search layer
+     * defends by treating dimension mismatch as embed-axis zero.
+     */
+    readonly contractEmbedding?: readonly number[];
+}
+//# sourceMappingURL=blueprint.d.ts.map

package/dist/types/blueprint.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"blueprint.d.ts","sourceRoot":"","sources":["../../src/types/blueprint.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+BG;AACH,OAAO,KAAK,EAAE,YAAY,EAAE,UAAU,EAAE,MAAM,oBAAoB,CAAC;AAEnE;;;;;;;;;;;;GAYG;AACH,MAAM,WAAW,sBAAsB;IACrC;;qDAEiD;IACjD,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,uEAAuE;IACvE,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB;0CACsC;IACtC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB;yCACqC;IACrC,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B;yCACqC;IACrC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;CACzB;AAED;;;;;;;;GAQG;AACH,MAAM,WAAW,wBAAwB;IACvC;8CAC0C;IAC1C,QAAQ,CAAC,OAAO,CAAC,EAAE,OAAO,CAAC,sBAAsB,CAAC,CAAC;IACnD;yCACqC;IACrC,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC;IAC5B,0DAA0D;IAC1D,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC;CACxB;AAED;;;;;;GAMG;AACH,MAAM,WAAW,iBAAiB;IAChC;;;OAGG;IACH,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC;IAC1B;;;;;;OAMG;IACH,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC;IAC5B;;;OAGG;IACH,QAAQ,CAAC,OAAO,CAAC,EAAE,UAAU,CAAC;IAC9B;;;OAGG;IACH,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAC;CAC9B;AAED;;;GAGG;AACH,MAAM,WAAW,SAAS;IACxB,mEAAmE;IACnE,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B;;;;OAIG;IACH,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;IAC9B,kEAAkE;IAClE,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB;;;;;;OAMG;IACH,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC;IAC5B;;;OAGG;IACH,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAC3B;;;;OAIG;IACH,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B;;;;OAIG;IACH,QAAQ,CAAC,cAAc,CAAC,EAAE,MAAM,CAAC;IACjC;;;OAGG;IACH,QAAQ,CAAC,QAAQ,EAAE,iBAAiB,CAAC;IACrC;;;;;;;;;OASG;IACH,QAAQ,CAAC,iBAAiB,CAAC,EAAE,IAAI,CAAC;IAClC,qDAAqD;IACrD,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B;;;;OAIG;IACH,QAAQ,CAAC,SAAS,EAAE,OAAO,GAAG,UAAU,CAAC;IACzC;;;;;OAKG;IACH,QAAQ,CAAC,QAAQ,EAAE,YAAY,CAAC;IAChC;;;;;;;;;;;;;;;;;OAiBG;IACH,QAAQ,CAAC,iBAAiB,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;CAChD"}

package/dist/types/blueprint.js

@@ -0,0 +1 @@
+export {};

package/dist/types/canvas-lifecycle.d.ts

@@ -0,0 +1,105 @@
+/**
+ * Canvas-mode lifecycle envelopes.
+ *
+ * Carried over the reserved `_ggui:lifecycle` channel via `data`
+ * WebSocket messages. The server emits at four lifecycle moments;
+ * canvas iframes consume (via the animator host) to drive their
+ * pill state machine:
+ *
+ *   - `handshake_started` / `handshake_completed`: bracket each
+ *     `ggui_handshake` call so the animator can render "negotiating"
+ *     during the gap.
+ *   - `push_started`: emitted at the gen gate of `ggui_push`, before
+ *     the final `push` envelope lands. Drives the animator's
+ *     `constructing` state. The eventual `push` envelope (existing
+ *     wire type) signals completion → animator transitions to
+ *     `content`.
+ *   - `consume_polling`: signals that `ggui_consume` opened a long-
+ *     poll. The animator's `listening` state. The complementary
+ *     "close" signal is the existing `drain_ack` envelope (consume
+ *     drained an action) — no separate "closed" lifecycle kind is
+ *     needed.
+ *
+ * Discriminated on `kind`. Adding a kind is a protocol-version bump,
+ * not a silent extension — keeps the union closed so producers and
+ * consumers agree on the surface.
+ *
+ * Every variant extends `JsonObject` so producers can hand the
+ * payload directly to JsonValue-typed transport seams without an
+ * unsafe cast.
+ *
+ * Boundary discipline:
+ *   - This module describes ENVELOPE SHAPES carried on a reserved
+ *     channel. It does NOT describe the animator state machine that
+ *     consumes them (lives in `@ggui-ai/iframe-runtime/canvas/animator`).
+ *   - This module is `data` only — no functions, no reducers. Pure
+ *     types so the protocol bundle stays tiny.
+ */
+import type { JsonObject } from './data-contract';
+/**
+ * Emitted when the server starts processing a `ggui_handshake` call.
+ * Animator transitions from current state into `handshake` (or its
+ * `content`-substate equivalent).
+ */
+export interface HandshakeStartedPayload extends JsonObject {
+    readonly kind: 'handshake_started';
+    readonly handshakeId: string;
+    /** Agent's intent string — animator may surface this as a label. */
+    readonly intent: string;
+}
+/**
+ * Emitted when the server finishes a `ggui_handshake` call. Animator
+ * either drops back to `ready`/`content` (no gen expected) or
+ * pre-warms to `constructing` if `genExpected: true` so the
+ * transition from handshake → constructing doesn't flicker.
+ */
+export interface HandshakeCompletedPayload extends JsonObject {
+    readonly kind: 'handshake_completed';
+    readonly handshakeId: string;
+    /** Negotiator outcome — informational; animator may surface. */
+    readonly outcome: 'accepted' | 'amended' | 'declined' | 'cached';
+    /**
+     * Whether a cold gen is about to follow this handshake. When true,
+     * the canvas may pre-warm the `constructing` state to suppress a
+     * `handshake → ready → constructing` flicker.
+     */
+    readonly genExpected: boolean;
+}
+/**
+ * Emitted when the server starts a `ggui_push` cold-gen (or
+ * blueprint-cache hit). The eventual `push` envelope on the existing
+ * wire signals completion.
+ */
+export interface PushStartedPayload extends JsonObject {
+    readonly kind: 'push_started';
+    /** The stack-item id the eventual `push` envelope will carry. */
+    readonly stackItemId: string;
+    /** Echoed for the animator label ("Building: <intent>"). */
+    readonly intent: string;
+}
+/**
+ * Emitted when `ggui_consume` opens a long-poll (after the action
+ * pipe is found empty). Animator transitions to `listening`. The
+ * complementary "close" signal is the existing `drain_ack` envelope.
+ */
+export interface ConsumePollingPayload extends JsonObject {
+    readonly kind: 'consume_polling';
+    /**
+     * Always `'open'` today — the closing transition is signaled
+     * by the existing `drain_ack` envelope (action consumed) and by the
+     * absence of further `consume_polling` for the same stack item.
+     * Reserved as a discriminator field rather than implicit so future
+     * `'closed'` / `'timeout'` variants can layer in without a wire
+     * shape change.
+     */
+    readonly state: 'open';
+    /** Stack item id whose action pipe is being polled. */
+    readonly stackItemId: string;
+}
+/**
+ * Closed discriminated union of every canvas-mode lifecycle payload.
+ * New kinds bump the protocol version; consumers narrow on `kind`
+ * with exhaustive switch.
+ */
+export type CanvasLifecyclePayload = HandshakeStartedPayload | HandshakeCompletedPayload | PushStartedPayload | ConsumePollingPayload;
+//# sourceMappingURL=canvas-lifecycle.d.ts.map

package/dist/types/canvas-lifecycle.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"canvas-lifecycle.d.ts","sourceRoot":"","sources":["../../src/types/canvas-lifecycle.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAoCG;AAEH,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,iBAAiB,CAAC;AAElD;;;;GAIG;AACH,MAAM,WAAW,uBAAwB,SAAQ,UAAU;IACzD,QAAQ,CAAC,IAAI,EAAE,mBAAmB,CAAC;IACnC,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,oEAAoE;IACpE,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;CACzB;AAED;;;;;GAKG;AACH,MAAM,WAAW,yBAA0B,SAAQ,UAAU;IAC3D,QAAQ,CAAC,IAAI,EAAE,qBAAqB,CAAC;IACrC,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,gEAAgE;IAChE,QAAQ,CAAC,OAAO,EAAE,UAAU,GAAG,SAAS,GAAG,UAAU,GAAG,QAAQ,CAAC;IACjE;;;;OAIG;IACH,QAAQ,CAAC,WAAW,EAAE,OAAO,CAAC;CAC/B;AAED;;;;GAIG;AACH,MAAM,WAAW,kBAAmB,SAAQ,UAAU;IACpD,QAAQ,CAAC,IAAI,EAAE,cAAc,CAAC;IAC9B,iEAAiE;IACjE,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,4DAA4D;IAC5D,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;CACzB;AAED;;;;GAIG;AACH,MAAM,WAAW,qBAAsB,SAAQ,UAAU;IACvD,QAAQ,CAAC,IAAI,EAAE,iBAAiB,CAAC;IACjC;;;;;;;OAOG;IACH,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,uDAAuD;IACvD,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;CAC9B;AAED;;;;GAIG;AACH,MAAM,MAAM,sBAAsB,GAC9B,uBAAuB,GACvB,yBAAyB,GACzB,kBAAkB,GAClB,qBAAqB,CAAC"}

package/dist/types/canvas-lifecycle.js

@@ -0,0 +1,38 @@
+/**
+ * Canvas-mode lifecycle envelopes.
+ *
+ * Carried over the reserved `_ggui:lifecycle` channel via `data`
+ * WebSocket messages. The server emits at four lifecycle moments;
+ * canvas iframes consume (via the animator host) to drive their
+ * pill state machine:
+ *
+ *   - `handshake_started` / `handshake_completed`: bracket each
+ *     `ggui_handshake` call so the animator can render "negotiating"
+ *     during the gap.
+ *   - `push_started`: emitted at the gen gate of `ggui_push`, before
+ *     the final `push` envelope lands. Drives the animator's
+ *     `constructing` state. The eventual `push` envelope (existing
+ *     wire type) signals completion → animator transitions to
+ *     `content`.
+ *   - `consume_polling`: signals that `ggui_consume` opened a long-
+ *     poll. The animator's `listening` state. The complementary
+ *     "close" signal is the existing `drain_ack` envelope (consume
+ *     drained an action) — no separate "closed" lifecycle kind is
+ *     needed.
+ *
+ * Discriminated on `kind`. Adding a kind is a protocol-version bump,
+ * not a silent extension — keeps the union closed so producers and
+ * consumers agree on the surface.
+ *
+ * Every variant extends `JsonObject` so producers can hand the
+ * payload directly to JsonValue-typed transport seams without an
+ * unsafe cast.
+ *
+ * Boundary discipline:
+ *   - This module describes ENVELOPE SHAPES carried on a reserved
+ *     channel. It does NOT describe the animator state machine that
+ *     consumes them (lives in `@ggui-ai/iframe-runtime/canvas/animator`).
+ *   - This module is `data` only — no functions, no reducers. Pure
+ *     types so the protocol bundle stays tiny.
+ */
+export {};

package/dist/types/capabilities.d.ts

@@ -0,0 +1,40 @@
+/**
+ * Component capability permissions and quality metadata.
+ *
+ * Components run in a sandboxed context with all capabilities denied by default.
+ * Capabilities can be granted by the app developer (per-app) or by the end-user (per-session).
+ */
+/**
+ * Software capabilities that can be granted to sandboxed components.
+ *
+ * Hardware access flows through gadget hooks (`clientCapabilities.gadgets`)
+ * — each gadget descriptor declares a `permission` that threads to the
+ * iframe's `Permissions-Policy` header. There is no separate
+ * `adapters[]` model.
+ */
+export type ComponentCapability = 'network' | 'storage' | 'dom' | 'eval' | 'navigation' | 'device';
+/**
+ * Capability permissions for a component.
+ * Default posture: all capabilities denied (granted: []).
+ */
+export interface CapabilityPermissions {
+    /** Capabilities this component is allowed to use. Default: [] (all denied) */
+    granted: ComponentCapability[];
+}
+/**
+ * Quality evaluation metadata attached to produced components.
+ * Producers MAY attach quality scores. Renderers MAY display quality indicators.
+ */
+export interface QualityMetadata {
+    evaluationRounds: number;
+    finalScore: number;
+    dimensions: {
+        completeness: number;
+        visualPolish: number;
+        interactivity: number;
+        accessibility: number;
+        codeQuality: number;
+    };
+    passed: boolean;
+}
+//# sourceMappingURL=capabilities.d.ts.map

package/dist/types/capabilities.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"capabilities.d.ts","sourceRoot":"","sources":["../../src/types/capabilities.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAMH;;;;;;;GAOG;AACH,MAAM,MAAM,mBAAmB,GAC3B,SAAS,GACT,SAAS,GACT,KAAK,GACL,MAAM,GACN,YAAY,GACZ,QAAQ,CAAC;AAEb;;;GAGG;AACH,MAAM,WAAW,qBAAqB;IACpC,8EAA8E;IAC9E,OAAO,EAAE,mBAAmB,EAAE,CAAC;CAChC;AAMD;;;GAGG;AACH,MAAM,WAAW,eAAe;IAC9B,gBAAgB,EAAE,MAAM,CAAC;IACzB,UAAU,EAAE,MAAM,CAAC;IACnB,UAAU,EAAE;QACV,YAAY,EAAE,MAAM,CAAC;QACrB,YAAY,EAAE,MAAM,CAAC;QACrB,aAAa,EAAE,MAAM,CAAC;QACtB,aAAa,EAAE,MAAM,CAAC;QACtB,WAAW,EAAE,MAAM,CAAC;KACrB,CAAC;IACF,MAAM,EAAE,OAAO,CAAC;CACjB"}

package/dist/types/capabilities.js

@@ -0,0 +1,19 @@
+/**
+ * Component capability permissions and quality metadata.
+ *
+ * Components run in a sandboxed context with all capabilities denied by default.
+ * Capabilities can be granted by the app developer (per-app) or by the end-user (per-session).
+ */
+export {};
+// =============================================================================
+// Hardware grant model
+// =============================================================================
+//
+// Hardware-capability hooks (camera, microphone, geolocation, etc.) flow
+// through the gadget catalog at `DataContract.clientCapabilities.gadgets`.
+// Each gadget descriptor declares a `permission` field whose value is the
+// Web Permissions API name (`KNOWN_PERMISSION_NAMES`); the server projects
+// every declared permission onto the iframe's `Permissions-Policy` header.
+//
+// There is no `adapters[]` allow-list (voice / camera / location /
+// bluetooth). Per-gadget permission threading IS the grant model.