@ggui-ai/protocol 0.1.0-rc.1

package/dist/gadgets/stdlib-gadgets.js

@@ -0,0 +1,161 @@
+// packages/protocol/src/gadgets/stdlib-gadgets.ts
+//
+// `STDLIB_GADGETS` — the canonical list of browser-capability
+// gadget hooks shipped by the first-party `@ggui-ai/gadgets`
+// package. Each entry is a `GadgetDescriptor` declaration that an app
+// MAY use as-is (default `App.gadgets`) or filter / extend via
+// the per-app gadget list.
+//
+// **Why protocol owns this list:**
+//
+//   - The protocol layer is the source of truth for the four-spec
+//     surface (`DataContract.clientCapabilities.gadgets`). The list
+//     of available stdlib hooks is part of the contract surface
+//     agents reason about — so it belongs alongside the type
+//     definitions, not in the runtime package.
+//   - Descriptors are strings + JSON only — no runtime deps. The
+//     protocol package stays free of `@ggui-ai/gadgets` as
+//     a workspace dependency (which would create a cycle: protocol →
+//     gadgets → protocol).
+//
+// **Parity guarantee:** `@ggui-ai/gadgets` ships a cross-
+// package contract test (`stdlib-parity.test.ts`) that imports both
+// this list and the actual hook exports, then asserts the hook names
+// match exactly. Drift fails the test on CI; the protocol package
+// cannot ship a stale descriptor list without the runtime side
+// catching it.
+/**
+ * The first-party `@ggui-ai/gadgets` package name. Used as
+ * the default `package` for every entry in {@link STDLIB_GADGETS}
+ * and as the `DEFAULT_GADGET_PACKAGE` literal in the hygiene linter.
+ */
+export const STDLIB_GADGETS_PACKAGE = '@ggui-ai/gadgets';
+/**
+ * Pinned semver of the stdlib gadgets every descriptor declares on
+ * its `version` field. Mirrors
+ * `packages/gadgets/package.json#version`; a cross-package parity test
+ * in `@ggui-ai/gadgets` asserts the two stay in sync, so a release-time
+ * bump to the runtime package without updating this constant fails CI.
+ */
+export const STDLIB_GADGETS_VERSION = '0.1.0-rc.1';
+/**
+ * v1 catalog of stdlib gadget descriptors. Every entry's
+ * `package` defaults to {@link STDLIB_GADGETS_PACKAGE}; the
+ * `permission` field, where present, mirrors the Web Permissions API
+ * name and lines up with the hygiene linter's
+ * `KNOWN_PERMISSION_HOOKS` table.
+ *
+ * **Ordering:** alphabetical by hook name. Stable so consumers can
+ * diff the list across protocol minor bumps without false positives
+ * from re-ordering.
+ *
+ * **Shape note:** entries are typed `Readonly<GadgetDescriptor>` so
+ * downstream consumers (App.gadgets default-on-read, the LLM
+ * generator's catalog, the `ggui_list_gadgets` handler)
+ * can structurally clone without mutating the source. Callers that
+ * need a mutable copy should `structuredClone` explicitly.
+ */
+export const STDLIB_GADGETS = [
+    {
+        package: STDLIB_GADGETS_PACKAGE,
+        version: STDLIB_GADGETS_VERSION,
+        exports: [
+            {
+                hook: 'useCamera',
+                permission: 'camera',
+                description: 'Capture stills or live video from the device camera.',
+                usage: 'Mount when the intent names photo capture, QR / barcode scanning, video recording, or anything that requires a camera feed. The hook returns a stream once `start()` resolves; thread the resulting blob or stream URL into a contextSpec slot or an actionSpec payload to surface it to the agent.',
+                example: {
+                    call: 'const cam = useCamera();',
+                    returns: {
+                        status: 'ready',
+                        value: { stream: '<MediaStream>', kind: 'video' },
+                    },
+                },
+            },
+            {
+                hook: 'useClipboardPaste',
+                permission: 'clipboard-read',
+                description: 'Read the system clipboard contents on user gesture.',
+                usage: 'Mount when the intent involves importing copied content (paste-into-form, paste-image-to-upload, paste-link). The Permissions API requires a user gesture; gate `start()` behind a button click. Returned value lands in a contextSpec slot or an actionSpec payload.',
+                example: {
+                    call: 'const paste = useClipboardPaste();',
+                    returns: { status: 'ready', value: 'pasted clipboard text' },
+                },
+            },
+            {
+                hook: 'useClipboardWrite',
+                permission: 'clipboard-write',
+                description: 'Write to the system clipboard on user gesture.',
+                usage: 'Mount when the intent includes copying generated text, share links, codes, or transcripts to the system clipboard. Fire an actionSpec event so the agent observes the act (it does not see the written value — that stays component-local).',
+                example: {
+                    call: "const write = useClipboardWrite(); write.write('hello');",
+                    returns: { status: 'ready' },
+                },
+            },
+            {
+                hook: 'useFilePicker',
+                description: 'Open the native file picker and read selected files.',
+                usage: 'Mount when the intent names file upload, attachment selection, or document import. No permission required. The hook returns the picked files plus metadata; thread file refs / data URLs into a contextSpec slot or actionSpec payload.',
+                example: {
+                    call: 'const picker = useFilePicker({ accept: "image/*" });',
+                    returns: {
+                        status: 'ready',
+                        value: [{ name: 'photo.png', type: 'image/png', size: 12345 }],
+                    },
+                },
+            },
+            {
+                hook: 'useGeolocation',
+                permission: 'geolocation',
+                description: "Resolve the device's current geolocation.",
+                usage: 'Mount when the intent names "current location", maps, nearby search, location-aware UI. Browser prompts the user on `start()`; the hook returns coordinates once granted. Thread the resolved coords into a contextSpec slot so the agent observes the latest fix.',
+                example: {
+                    call: 'const geo = useGeolocation();',
+                    returns: {
+                        status: 'ready',
+                        value: { latitude: 37.7749, longitude: -122.4194, accuracy: 20 },
+                    },
+                },
+            },
+            {
+                hook: 'useMicrophone',
+                permission: 'microphone',
+                description: 'Capture audio from the device microphone.',
+                usage: 'Mount when the intent names voice memos, audio messages, dictation, voice-driven UI. Returns an audio stream / blob; thread it into an actionSpec payload at recording-stop, or into a contextSpec slot for live transcription pipelines.',
+                example: {
+                    call: 'const mic = useMicrophone();',
+                    returns: {
+                        status: 'ready',
+                        value: { stream: '<MediaStream>', kind: 'audio' },
+                    },
+                },
+            },
+            {
+                hook: 'useNotifications',
+                permission: 'notifications',
+                description: 'Show system / browser notifications to the user.',
+                usage: 'Mount when the intent involves alerting the user about something (reminders, completion of long tasks, incoming messages) and the UI may be in the background. Permission is prompted on first `start()`; the agent does NOT see notification dismissal directly — surface it via an actionSpec if needed.',
+                example: {
+                    call: "const notify = useNotifications(); notify.show({ title: 'Done' });",
+                    returns: { status: 'ready', value: { granted: true } },
+                },
+            },
+        ],
+    },
+];
+/**
+ * Hook-name index over {@link STDLIB_GADGETS}. Lazily
+ * constructed for callers that need O(1) "is hook X part of the
+ * stdlib?" checks (the hygiene linter, the per-app gadget validator,
+ * the `ggui_list_gadgets` handler).
+ *
+ * Frozen so accidental mutation is loud, not silent.
+ */
+export const STDLIB_GADGET_HOOKS = Object.freeze(new Set(STDLIB_GADGETS.flatMap((pkg) => pkg.exports)
+    // `GadgetExport` is a type-exclusive union (`hook?: never` on the
+    // component member), so `hook` is an optional key of both members
+    // and `'hook' in exp` no longer narrows. Discriminate by VALUE
+    // presence and collect only defined hook names.
+    .map((exp) => exp.hook)
+    .filter((hook) => hook !== undefined)));

package/dist/iframe-bridge.d.ts

@@ -0,0 +1,63 @@
+/**
+ * Event names used across the iframe bridge -- symmetric naming convention.
+ *
+ * Events prefixed with `ggui-` are `postMessage` types (cross-origin iframe boundary).
+ * Events prefixed with `ggui:` are `CustomEvent` names (same-origin, dispatched on `window`).
+ *
+ * The bridge has three directions:
+ * 1. **Agent to Component** (inbound): data, streams, progress
+ * 2. **Component to Agent** (outbound): user interactions (form submits, clicks)
+ * 3. **Component to Host** (outbound): rendering lifecycle (resize, success, error)
+ */
+export declare const BRIDGE_EVENTS: {
+    /** `postMessage` type for parent-to-iframe data delivery. The parent window posts this type; the iframe bridge script converts it to an `AGENT_DATA` CustomEvent. */
+    readonly AGENT_DATA_POST: "ggui-agent-data";
+    /** `CustomEvent` name dispatched on `window` when agent data arrives. Components listen for this to receive real-time data from the agent (chat messages, typing indicators, etc.). */
+    readonly AGENT_DATA: "ggui:agent-data";
+    /** `CustomEvent` name for streaming text chunks from the agent. Fired incrementally as the agent generates a response. */
+    readonly AGENT_STREAM: "ggui:agent-stream";
+    /** `CustomEvent` name for agent messages. Payload includes `type: 'thinking' | 'chat'`. Thinking messages show what the agent is doing; chat messages are final responses. */
+    readonly AGENT_MSG: "ggui:agent-msg";
+    /** `CustomEvent` name for UI generation log updates. Debug/devtools only — not displayed to end users. */
+    readonly AGENT_LOGS: "ggui:logs";
+    /** `postMessage` type for iframe-to-parent user interaction data. Carries form submissions and click events from generated components back to the host. */
+    readonly USER_DATA_POST: "ggui-user-data";
+    /** `CustomEvent` name dispatched on the parent window when user data arrives from the iframe. The host shell listens for this to forward events to the agent. */
+    readonly USER_DATA: "ggui:user-data";
+    /** `postMessage` type sent when a component's content size changes. Used by the host to auto-resize the iframe to fit content. */
+    readonly RESIZE: "ggui-resize";
+    /** `postMessage` type sent when a component renders successfully. The host uses this to hide loading indicators and show the component. */
+    readonly RENDER_SUCCESS: "ggui-render-success";
+    /** `postMessage` type sent when a component fails to render. The host uses this to show an error state instead of a blank iframe. */
+    readonly RENDER_ERROR: "ggui-render-error";
+};
+/**
+ * Srcdoc JS snippet: bridge agent data postMessages into CustomEvents inside iframe.
+ * Inject this into any srcdoc <script> so that components receive ggui:agent-data
+ * events when the parent forwards data via postMessage.
+ */
+export declare const SRCDOC_AGENT_DATA_BRIDGE = "\n  window.addEventListener(\"message\", function(event) {\n    if (event.data && event.data.type === \"ggui-agent-data\") {\n      window.dispatchEvent(new CustomEvent(\"ggui:agent-data\", { detail: event.data.payload }));\n    }\n  });";
+/**
+ * Srcdoc JS snippet: auto-report content height changes to parent.
+ *
+ * Uses a ResizeObserver on <html> to detect layout changes and posts
+ * a `ggui-resize` message with the current scrollHeight. Also fires
+ * an initial measurement on the next animation frame after injection.
+ *
+ * Inject this into any srcdoc or rendered page <script> so the parent
+ * can auto-size the iframe to fit content without scrollbars.
+ */
+export declare const SRCDOC_RESIZE_BRIDGE: string;
+/**
+ * Srcdoc JS snippet: universal interaction bridge inside iframe.
+ *
+ * Three layers of automatic event capture (no props.onSubmit needed):
+ *   1. Form submit intercept — captures <form> submissions with all field data
+ *   2. Interactive element clicks — buttons, [role="button"], links, [data-action]
+ *   3. Cursor-pointer fallback (approach C) — any styled-clickable div/span/card
+ *
+ * All layers skip if props.onSubmit already handled the event (__ggui_submitHandled).
+ * Click handler uses bubble phase so component handlers run first.
+ */
+export declare const SRCDOC_USER_DATA_BRIDGE = "\n  // Dedup: props.onSubmit sets __ggui_submitHandled = true synchronously.\n  // Both layers check this. We use a microtask to reset it so it stays\n  // true for ALL handlers in the same event cycle (click + submit).\n  function __ggui_wasHandled() {\n    if (!window.__ggui_submitHandled) return false;\n    // Reset via microtask \u2014 stays true for all sync handlers in this tick\n    Promise.resolve().then(function() { window.__ggui_submitHandled = false; });\n    return true;\n  }\n\n  // Layer 1: Form submit intercept (bubble phase \u2014 lets component onSubmit run first)\n  // Handles: <form> submit via enter key or submit-button click.\n  // Uses bubble phase so component's onSubmit (which may call props.onSubmit) fires first.\n  document.addEventListener(\"submit\", function(e) {\n    e.preventDefault();\n    if (__ggui_wasHandled()) return;\n    var form = e.target;\n    var data = {};\n    try { data = Object.fromEntries(new FormData(form)); } catch(_) {}\n    parent.postMessage({ type: \"ggui-user-data\", data: data }, \"*\");\n  });\n\n  // Layers 2+3: Universal click handler (bubble phase \u2014 runs after component handlers)\n  // Handles: buttons, [role=\"button\"], links, [data-action], cursor:pointer elements.\n  // Does NOT handle submit-type elements inside forms (Layer 1 handles those).\n  document.addEventListener(\"click\", function(e) {\n    if (__ggui_wasHandled()) return;\n    if (!e.target || !e.target.closest) return;\n\n    // Layer 2: Find the closest standard interactive element\n    var el = e.target.closest(\"button\")\n      || e.target.closest(\"[role='button']\")\n      || e.target.closest(\"a[href], a[data-action]\")\n      || e.target.closest(\"[data-action]\")\n      || e.target.closest(\"[data-ggui-action]\");\n\n    // Layer 3 (approach C): Fallback \u2014 walk up DOM looking for cursor:pointer\n    if (!el) {\n      var target = e.target;\n      var depth = 0;\n      while (target && target !== document.documentElement && depth < 6) {\n        if (target.nodeType === 1) {\n          try {\n            if (window.getComputedStyle(target).cursor === \"pointer\") {\n              el = target;\n              break;\n            }\n          } catch(_) {}\n        }\n        target = target.parentElement;\n        depth++;\n      }\n    }\n    if (!el) return;\n\n    // Skip submit-type elements inside forms \u2014 Layer 1 handles those.\n    // (click fires before submit, so we must yield to avoid double-fire)\n    // <button> defaults to type=\"submit\", so el.type === \"submit\" catches both\n    // <button> and <button type=\"submit\">. Only <button type=\"button\"> is excluded.\n    if (el.closest(\"form\") && el.type === \"submit\") return;\n\n    // Skip form control elements \u2014 these are data entry, not actions.\n    // Checkboxes, radios, inputs, selects get captured via form submit (Layer 1).\n    var tag = el.tagName;\n    if (tag === \"INPUT\" || tag === \"TEXTAREA\" || tag === \"SELECT\" || tag === \"LABEL\") return;\n\n    // For standalone interactive elements, post click event with label + data attributes\n    var data = { action: \"click\" };\n    var label = el.getAttribute(\"aria-label\")\n      || el.getAttribute(\"data-label\")\n      || el.innerText\n      || el.textContent;\n    if (label) data.label = label.trim().substring(0, 200);\n\n    // Spread data-* attributes into payload (data-action, data-value, etc.)\n    if (el.dataset) {\n      for (var key in el.dataset) {\n        if (el.dataset.hasOwnProperty(key)) data[key] = el.dataset[key];\n      }\n    }\n\n    parent.postMessage({ type: \"ggui-user-data\", data: data }, \"*\");\n  });";
+//# sourceMappingURL=iframe-bridge.d.ts.map

package/dist/iframe-bridge.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"iframe-bridge.d.ts","sourceRoot":"","sources":["../src/iframe-bridge.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AACH,eAAO,MAAM,aAAa;IAExB,qKAAqK;;IAErK,uLAAuL;;IAIvL,0HAA0H;;IAI1H,8KAA8K;;IAI9K,0GAA0G;;IAI1G,2JAA2J;;IAE3J,iKAAiK;;IAIjK,kIAAkI;;IAElI,2IAA2I;;IAE3I,qIAAqI;;CAE7H,CAAC;AAEX;;;;GAIG;AACH,eAAO,MAAM,wBAAwB,kPAK/B,CAAC;AAEP;;;;;;;;;GASG;AACH,eAAO,MAAM,oBAAoB,QAUzB,CAAC;AAET;;;;;;;;;;GAUG;AACH,eAAO,MAAM,uBAAuB,8lHAmF9B,CAAC"}

package/dist/iframe-bridge.js

@@ -0,0 +1,166 @@
+/**
+ * Event names used across the iframe bridge -- symmetric naming convention.
+ *
+ * Events prefixed with `ggui-` are `postMessage` types (cross-origin iframe boundary).
+ * Events prefixed with `ggui:` are `CustomEvent` names (same-origin, dispatched on `window`).
+ *
+ * The bridge has three directions:
+ * 1. **Agent to Component** (inbound): data, streams, progress
+ * 2. **Component to Agent** (outbound): user interactions (form submits, clicks)
+ * 3. **Component to Host** (outbound): rendering lifecycle (resize, success, error)
+ */
+export const BRIDGE_EVENTS = {
+    // === Agent → Component (inbound via ggui_emit) ===
+    /** `postMessage` type for parent-to-iframe data delivery. The parent window posts this type; the iframe bridge script converts it to an `AGENT_DATA` CustomEvent. */
+    AGENT_DATA_POST: 'ggui-agent-data',
+    /** `CustomEvent` name dispatched on `window` when agent data arrives. Components listen for this to receive real-time data from the agent (chat messages, typing indicators, etc.). */
+    AGENT_DATA: 'ggui:agent-data',
+    // === Agent → Component (inbound via streaming) ===
+    /** `CustomEvent` name for streaming text chunks from the agent. Fired incrementally as the agent generates a response. */
+    AGENT_STREAM: 'ggui:agent-stream',
+    // === Agent → Shell (inbound agent messages) ===
+    /** `CustomEvent` name for agent messages. Payload includes `type: 'thinking' | 'chat'`. Thinking messages show what the agent is doing; chat messages are final responses. */
+    AGENT_MSG: 'ggui:agent-msg',
+    // === Platform → Shell (inbound via generation logs) ===
+    /** `CustomEvent` name for UI generation log updates. Debug/devtools only — not displayed to end users. */
+    AGENT_LOGS: 'ggui:logs',
+    // === Component → Agent (outbound via user interaction) ===
+    /** `postMessage` type for iframe-to-parent user interaction data. Carries form submissions and click events from generated components back to the host. */
+    USER_DATA_POST: 'ggui-user-data',
+    /** `CustomEvent` name dispatched on the parent window when user data arrives from the iframe. The host shell listens for this to forward events to the agent. */
+    USER_DATA: 'ggui:user-data',
+    // === Component → Host (outbound via rendering lifecycle) ===
+    /** `postMessage` type sent when a component's content size changes. Used by the host to auto-resize the iframe to fit content. */
+    RESIZE: 'ggui-resize',
+    /** `postMessage` type sent when a component renders successfully. The host uses this to hide loading indicators and show the component. */
+    RENDER_SUCCESS: 'ggui-render-success',
+    /** `postMessage` type sent when a component fails to render. The host uses this to show an error state instead of a blank iframe. */
+    RENDER_ERROR: 'ggui-render-error',
+};
+/**
+ * Srcdoc JS snippet: bridge agent data postMessages into CustomEvents inside iframe.
+ * Inject this into any srcdoc <script> so that components receive ggui:agent-data
+ * events when the parent forwards data via postMessage.
+ */
+export const SRCDOC_AGENT_DATA_BRIDGE = `
+  window.addEventListener("message", function(event) {
+    if (event.data && event.data.type === "ggui-agent-data") {
+      window.dispatchEvent(new CustomEvent("ggui:agent-data", { detail: event.data.payload }));
+    }
+  });`;
+/**
+ * Srcdoc JS snippet: auto-report content height changes to parent.
+ *
+ * Uses a ResizeObserver on <html> to detect layout changes and posts
+ * a `ggui-resize` message with the current scrollHeight. Also fires
+ * an initial measurement on the next animation frame after injection.
+ *
+ * Inject this into any srcdoc or rendered page <script> so the parent
+ * can auto-size the iframe to fit content without scrollbars.
+ */
+export const SRCDOC_RESIZE_BRIDGE = `
+  (function() {
+    var resizeObserver = new ResizeObserver(function() {
+      parent.postMessage({ type: "${BRIDGE_EVENTS.RESIZE}", height: document.documentElement.scrollHeight }, "*");
+    });
+    resizeObserver.observe(document.documentElement);
+    // Initial measurement after first paint
+    requestAnimationFrame(function() {
+      parent.postMessage({ type: "${BRIDGE_EVENTS.RESIZE}", height: document.documentElement.scrollHeight }, "*");
+    });
+  })();`;
+/**
+ * Srcdoc JS snippet: universal interaction bridge inside iframe.
+ *
+ * Three layers of automatic event capture (no props.onSubmit needed):
+ *   1. Form submit intercept — captures <form> submissions with all field data
+ *   2. Interactive element clicks — buttons, [role="button"], links, [data-action]
+ *   3. Cursor-pointer fallback (approach C) — any styled-clickable div/span/card
+ *
+ * All layers skip if props.onSubmit already handled the event (__ggui_submitHandled).
+ * Click handler uses bubble phase so component handlers run first.
+ */
+export const SRCDOC_USER_DATA_BRIDGE = `
+  // Dedup: props.onSubmit sets __ggui_submitHandled = true synchronously.
+  // Both layers check this. We use a microtask to reset it so it stays
+  // true for ALL handlers in the same event cycle (click + submit).
+  function __ggui_wasHandled() {
+    if (!window.__ggui_submitHandled) return false;
+    // Reset via microtask — stays true for all sync handlers in this tick
+    Promise.resolve().then(function() { window.__ggui_submitHandled = false; });
+    return true;
+  }
+
+  // Layer 1: Form submit intercept (bubble phase — lets component onSubmit run first)
+  // Handles: <form> submit via enter key or submit-button click.
+  // Uses bubble phase so component's onSubmit (which may call props.onSubmit) fires first.
+  document.addEventListener("submit", function(e) {
+    e.preventDefault();
+    if (__ggui_wasHandled()) return;
+    var form = e.target;
+    var data = {};
+    try { data = Object.fromEntries(new FormData(form)); } catch(_) {}
+    parent.postMessage({ type: "ggui-user-data", data: data }, "*");
+  });
+
+  // Layers 2+3: Universal click handler (bubble phase — runs after component handlers)
+  // Handles: buttons, [role="button"], links, [data-action], cursor:pointer elements.
+  // Does NOT handle submit-type elements inside forms (Layer 1 handles those).
+  document.addEventListener("click", function(e) {
+    if (__ggui_wasHandled()) return;
+    if (!e.target || !e.target.closest) return;
+
+    // Layer 2: Find the closest standard interactive element
+    var el = e.target.closest("button")
+      || e.target.closest("[role='button']")
+      || e.target.closest("a[href], a[data-action]")
+      || e.target.closest("[data-action]")
+      || e.target.closest("[data-ggui-action]");
+
+    // Layer 3 (approach C): Fallback — walk up DOM looking for cursor:pointer
+    if (!el) {
+      var target = e.target;
+      var depth = 0;
+      while (target && target !== document.documentElement && depth < 6) {
+        if (target.nodeType === 1) {
+          try {
+            if (window.getComputedStyle(target).cursor === "pointer") {
+              el = target;
+              break;
+            }
+          } catch(_) {}
+        }
+        target = target.parentElement;
+        depth++;
+      }
+    }
+    if (!el) return;
+
+    // Skip submit-type elements inside forms — Layer 1 handles those.
+    // (click fires before submit, so we must yield to avoid double-fire)
+    // <button> defaults to type="submit", so el.type === "submit" catches both
+    // <button> and <button type="submit">. Only <button type="button"> is excluded.
+    if (el.closest("form") && el.type === "submit") return;
+
+    // Skip form control elements — these are data entry, not actions.
+    // Checkboxes, radios, inputs, selects get captured via form submit (Layer 1).
+    var tag = el.tagName;
+    if (tag === "INPUT" || tag === "TEXTAREA" || tag === "SELECT" || tag === "LABEL") return;
+
+    // For standalone interactive elements, post click event with label + data attributes
+    var data = { action: "click" };
+    var label = el.getAttribute("aria-label")
+      || el.getAttribute("data-label")
+      || el.innerText
+      || el.textContent;
+    if (label) data.label = label.trim().substring(0, 200);
+
+    // Spread data-* attributes into payload (data-action, data-value, etc.)
+    if (el.dataset) {
+      for (var key in el.dataset) {
+        if (el.dataset.hasOwnProperty(key)) data[key] = el.dataset[key];
+      }
+    }
+
+    parent.postMessage({ type: "ggui-user-data", data: data }, "*");
+  });`;

package/dist/index.d.ts

@@ -0,0 +1,62 @@
+export * from './version';
+export * from './types/auth';
+export * from './types/capabilities';
+export * from './types/events';
+export * from './types/region';
+export * from './types/session';
+export * from './types/thread';
+export * from './types/live-channel';
+export * from './types/ui-generator';
+export * from './types/mcp';
+export * from './schemas/mcp';
+export * from './schemas/invoke';
+export * from './schemas/data-contract';
+export { canonicalizeContracts, canonicalizeValue, } from './registry/canonicalize-contract';
+export { summarizeContract } from './registry/summarize-contract';
+export type { TextBlock, ToolUseBlock, ToolResultBlock, ContentBlock, TextDelta, InputJsonDelta, ContentBlockDeltaPayload, MessageStartEvent, ContentBlockStartEvent, ContentBlockDeltaEvent, ContentBlockStopEvent, MessageDeltaEvent, MessageStopEvent, PingEvent, ErrorEvent, InvokeEvent, InvokeErrorCode, InvokeTurn, InvokeRequest, } from './types/invoke';
+export * from './types/llm';
+export * from './types/openrouter-models';
+export * from './types/interface-context';
+export * from './types/host-context';
+export * from './types/canvas-lifecycle';
+export * from './types/data-bindings';
+export * from './types/feedback';
+export * from './types/data-contract';
+export * from './types/blueprint';
+export * from './schemas/blueprint';
+export * from './types/handshake-suggestion';
+export * from './schemas/handshake-suggestion';
+export * from './schemas/ops-blueprint';
+export * from './types/contract-inference';
+export * from './types/gadget';
+export * from './types/app-config';
+export * from './navigation/index';
+export * from './iframe-bridge';
+export * from './envelope-adapters';
+export * from './envelopes/builders';
+export * from './errors/version-mismatch';
+export * from './errors/unknown-permission-name';
+export * from './validation/contract-validator';
+export * from './validation/cross-references';
+export * from './validation/hygiene-rules';
+export * from './validation/lint-contract';
+export * from './validation/name-invariants';
+export * from './validation/schema-compat-invariants';
+export * from './validation/schema-meta-validation';
+export * from './validation/resolve-stream-channel';
+export * from './validation/reserved-channels';
+export * from './validation/sanitize-error';
+export * from './validation/schema-subset';
+export * from './validation/zod-to-json-schema';
+export * from './validation/ui-security';
+export * from './stream/stream-parser';
+export * from './bridge/invoke-agent';
+export * from './schema-learning/merge';
+export * from './schema-learning/derive-contract';
+export * from './screen-blueprints/index';
+export * from './types/credential';
+export { GGUI_AGENT_SYSTEM_PROMPT } from './recommended-prompts';
+export * from './types/mcp-proxy';
+export { STDLIB_GADGETS, STDLIB_GADGETS_PACKAGE, STDLIB_GADGETS_VERSION, STDLIB_GADGET_HOOKS, } from './gadgets/stdlib-gadgets';
+export { filterDescriptorsToContract, gadgetIdentityKey, gadgetExportName, listContractGadgets, } from './gadgets/resolve-contract-gadgets';
+//# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,cAAc,WAAW,CAAC;AAC1B,cAAc,cAAc,CAAC;AAC7B,cAAc,sBAAsB,CAAC;AACrC,cAAc,gBAAgB,CAAC;AAC/B,cAAc,gBAAgB,CAAC;AAC/B,cAAc,iBAAiB,CAAC;AAChC,cAAc,gBAAgB,CAAC;AAI/B,cAAc,sBAAsB,CAAC;AAOrC,cAAc,sBAAsB,CAAC;AACrC,cAAc,aAAa,CAAC;AAC5B,cAAc,eAAe,CAAC;AAC9B,cAAc,kBAAkB,CAAC;AACjC,cAAc,yBAAyB,CAAC;AAIxC,OAAO,EACL,qBAAqB,EACrB,iBAAiB,GAClB,MAAM,kCAAkC,CAAC;AAK1C,OAAO,EAAE,iBAAiB,EAAE,MAAM,+BAA+B,CAAC;AAMlE,YAAY,EAEV,SAAS,EACT,YAAY,EACZ,eAAe,EACf,YAAY,EAEZ,SAAS,EACT,cAAc,EACd,wBAAwB,EAExB,iBAAiB,EACjB,sBAAsB,EACtB,sBAAsB,EACtB,qBAAqB,EACrB,iBAAiB,EACjB,gBAAgB,EAChB,SAAS,EACT,UAAU,EACV,WAAW,EACX,eAAe,EAEf,UAAU,EACV,aAAa,GACd,MAAM,gBAAgB,CAAC;AACxB,cAAc,aAAa,CAAC;AAC5B,cAAc,2BAA2B,CAAC;AAC1C,cAAc,2BAA2B,CAAC;AAC1C,cAAc,sBAAsB,CAAC;AACrC,cAAc,0BAA0B,CAAC;AACzC,cAAc,uBAAuB,CAAC;AACtC,cAAc,kBAAkB,CAAC;AACjC,cAAc,uBAAuB,CAAC;AACtC,cAAc,mBAAmB,CAAC;AAClC,cAAc,qBAAqB,CAAC;AACpC,cAAc,8BAA8B,CAAC;AAC7C,cAAc,gCAAgC,CAAC;AAI/C,cAAc,yBAAyB,CAAC;AACxC,cAAc,4BAA4B,CAAC;AAC3C,cAAc,gBAAgB,CAAC;AAC/B,cAAc,oBAAoB,CAAC;AACnC,cAAc,oBAAoB,CAAC;AACnC,cAAc,iBAAiB,CAAC;AAChC,cAAc,qBAAqB,CAAC;AACpC,cAAc,sBAAsB,CAAC;AACrC,cAAc,2BAA2B,CAAC;AAC1C,cAAc,kCAAkC,CAAC;AACjD,cAAc,iCAAiC,CAAC;AAChD,cAAc,+BAA+B,CAAC;AAC9C,cAAc,4BAA4B,CAAC;AAC3C,cAAc,4BAA4B,CAAC;AAC3C,cAAc,8BAA8B,CAAC;AAC7C,cAAc,uCAAuC,CAAC;AACtD,cAAc,qCAAqC,CAAC;AACpD,cAAc,qCAAqC,CAAC;AACpD,cAAc,gCAAgC,CAAC;AAC/C,cAAc,6BAA6B,CAAC;AAC5C,cAAc,4BAA4B,CAAC;AAC3C,cAAc,iCAAiC,CAAC;AAChD,cAAc,0BAA0B,CAAC;AACzC,cAAc,wBAAwB,CAAC;AACvC,cAAc,uBAAuB,CAAC;AACtC,cAAc,yBAAyB,CAAC;AACxC,cAAc,mCAAmC,CAAC;AAClD,cAAc,2BAA2B,CAAC;AAC1C,cAAc,oBAAoB,CAAC;AACnC,OAAO,EAAE,wBAAwB,EAAE,MAAM,uBAAuB,CAAC;AACjE,cAAc,mBAAmB,CAAC;AAClC,OAAO,EACL,cAAc,EACd,sBAAsB,EACtB,sBAAsB,EACtB,mBAAmB,GACpB,MAAM,0BAA0B,CAAC;AAClC,OAAO,EACL,2BAA2B,EAC3B,iBAAiB,EACjB,gBAAgB,EAChB,mBAAmB,GACpB,MAAM,oCAAoC,CAAC"}

package/dist/index.js

@@ -0,0 +1,79 @@
+export * from './version.js';
+export * from './types/auth.js';
+export * from './types/capabilities.js';
+export * from './types/events.js';
+export * from './types/region.js';
+export * from './types/session.js';
+export * from './types/thread.js';
+// Live-channel contract payload types — SubscribePayload / AckPayload /
+// StreamEnvelope / GeneratePayload / etc. The WHAT each live-channel
+// message carries, independent of how the wire frames it.
+export * from './types/live-channel.js';
+// WebSocket transport envelope (WebSocketMessage / WebSocketMessageType
+// / ConnectionStatus) is NOT re-exported at root. Transport implementors
+// import it from the dedicated subpath: `@ggui-ai/protocol/transport/
+// websocket`. That keeps `@ggui-ai/protocol`'s root surface free of
+// wire-framing baggage — consumers that only need contract shapes don't
+// pay the transport types' weight.
+export * from './types/ui-generator.js';
+export * from './types/mcp.js';
+export * from './schemas/mcp.js';
+export * from './schemas/invoke.js';
+export * from './schemas/data-contract.js';
+// Registry-side helpers — pure utilities for computing the canonical
+// identity hash of a DataContract shape. Consumed by the Tier 1
+// exact-match path of the blueprint registry.
+export { canonicalizeContracts, canonicalizeValue, } from './registry/canonicalize-contract.js';
+// `blueprintKey` lives at `@ggui-ai/protocol/blueprint-key` (server-only).
+// It pulls in `node:crypto`, which browsers can't bundle. Same convention
+// as `./content-hash`. Server consumers import from the subpath:
+//   import { blueprintKey } from '@ggui-ai/protocol/blueprint-key';
+export { summarizeContract } from './registry/summarize-contract.js';
+export * from './types/llm.js';
+export * from './types/openrouter-models.js';
+export * from './types/interface-context.js';
+export * from './types/host-context.js';
+export * from './types/canvas-lifecycle.js';
+export * from './types/data-bindings.js';
+export * from './types/feedback.js';
+export * from './types/data-contract.js';
+export * from './types/blueprint.js';
+export * from './schemas/blueprint.js';
+export * from './types/handshake-suggestion.js';
+export * from './schemas/handshake-suggestion.js';
+// Operator-class blueprint tool schemas. Lives alongside the blueprint
+// type schemas so handlers + cloud pod + console + fixtures all import
+// the wire shape from one place.
+export * from './schemas/ops-blueprint.js';
+export * from './types/contract-inference.js';
+export * from './types/gadget.js';
+export * from './types/app-config.js';
+export * from './navigation/index.js';
+export * from './iframe-bridge.js';
+export * from './envelope-adapters.js';
+export * from './envelopes/builders.js';
+export * from './errors/version-mismatch.js';
+export * from './errors/unknown-permission-name.js';
+export * from './validation/contract-validator.js';
+export * from './validation/cross-references.js';
+export * from './validation/hygiene-rules.js';
+export * from './validation/lint-contract.js';
+export * from './validation/name-invariants.js';
+export * from './validation/schema-compat-invariants.js';
+export * from './validation/schema-meta-validation.js';
+export * from './validation/resolve-stream-channel.js';
+export * from './validation/reserved-channels.js';
+export * from './validation/sanitize-error.js';
+export * from './validation/schema-subset.js';
+export * from './validation/zod-to-json-schema.js';
+export * from './validation/ui-security.js';
+export * from './stream/stream-parser.js';
+export * from './bridge/invoke-agent.js';
+export * from './schema-learning/merge.js';
+export * from './schema-learning/derive-contract.js';
+export * from './screen-blueprints/index.js';
+export * from './types/credential.js';
+export { GGUI_AGENT_SYSTEM_PROMPT } from './recommended-prompts.js';
+export * from './types/mcp-proxy.js';
+export { STDLIB_GADGETS, STDLIB_GADGETS_PACKAGE, STDLIB_GADGETS_VERSION, STDLIB_GADGET_HOOKS, } from './gadgets/stdlib-gadgets.js';
+export { filterDescriptorsToContract, gadgetIdentityKey, gadgetExportName, listContractGadgets, } from './gadgets/resolve-contract-gadgets.js';