@ggui-ai/protocol 0.13.0 → 0.15.0

package/dist/types/refusal-codes.js

@@ -0,0 +1,346 @@
+/**
+ * `PRE_GENERATION_REFUSAL_CODES` — the closed registry of refusal codes
+ * (ggui#786).
+ *
+ * A **pre-generation refusal** is a deployment declining a call BEFORE
+ * it does any work: no state read, nothing committed, no model spend.
+ * (The call has already passed the SDK's check against the declared
+ * `inputSchema`; the claim is nothing READ, not nothing validated.)
+ * It is a third outcome, not a failure — a failure describes work
+ * that ran and did not produce a result. The wire shape
+ * of a refused render lives in `../schemas/mcp.ts`
+ * (`renderRefusalSchema`); this file owns the NAMES.
+ *
+ * ## Why one file
+ *
+ * The registry is the anti-drift mechanism: one `code` namespace across
+ * every surface a deployment can refuse on, so two names can never mean
+ * the same state and one name can never mean two. Emitters read a row
+ * from here; they never mint a code literal of their own. A code that
+ * is not in this file fails the wire enum at the transport, loudly — a
+ * bug, never a wire state.
+ *
+ * ## The rules every row obeys
+ *
+ * - **Name the STATE, not the verb.** `subscription_exists`, not
+ *   `cannot_create_subscription`: the same state may refuse more than
+ *   one action later, and the code must not encode which.
+ * - **One state, one code.** Two codes never share a name; one code MAY
+ *   list several `surfaces` when a single state surfaces in more than
+ *   one place (`billing_mode_anomaly`).
+ * - **`retry` is defined from the CALLER's side.** `after-fix` — a
+ *   named party can act and the SAME call then succeeds; `next-period`
+ *   — time restores it at the next period boundary; `later` —
+ *   unbounded time (transient unavailability); `never` — no action by
+ *   the caller restores the call under this identity.
+ * - **`fixBy` names WHO acts.** REQUIRED on every `after-fix` row;
+ *   PERMITTED on a `later` row (naming the operator who restores a
+ *   surface that is transiently unavailable); FORBIDDEN on
+ *   `next-period` and `never` — time restores the first and nothing
+ *   restores the second, so naming a party would be a lie about who
+ *   can act. **An agent MUST NOT auto-retry an `after-fix` refusal
+ *   whose `fixBy` is not `caller`** — otherwise "retry after fix"
+ *   would mean "perform someone else's billing or policy decision on
+ *   their behalf". `caller` is the only value an agent may act on
+ *   itself.
+ * - **`emitter` is named.** A row whose emitter is unrecorded is the
+ *   drift the registry exists to prevent.
+ *
+ * ## Reading this file as a self-hoster
+ *
+ * Every `description` here ships to npm, and the render-gate subset
+ * reaches an agent as JSON-Schema metadata through `tools/list`. The
+ * wording is therefore written from the DEPLOYMENT-POLICY perspective
+ * ("the allowance this deployment configured for the app is
+ * exhausted"), never from an operator's internal vocabulary. A
+ * deployment that configures none of these policies emits none of these
+ * codes; the registry is the vocabulary, not a mandate.
+ */
+/**
+ * The surfaces a refusal code may be emitted on.
+ *
+ *   - `render-gate` — the pre-generation gate on the render/mutation
+ *     tools. These are the only codes that can appear in a refused
+ *     tool result's `refusal.code`.
+ *   - `owner-api` — an app owner's own billing mutations.
+ *   - `provisioning-api` — a tenant provisioning an app on behalf of
+ *     its own users.
+ *   - `mcp-endpoint` — the per-app MCP endpoint's authorization, on
+ *     any JSON-RPC request (`initialize` included). The refusal rides
+ *     the JSON-RPC error object's `data.refusal` (HTTP 403, error code
+ *     `-32003` `APP_NOT_FOUND`, message `App not found` — ggui#836); only the codes listed
+ *     here are ever typed there, and an authorization failure that is
+ *     NOT one of them stays a bare 403 by contract, so a client can
+ *     never learn which of the untyped arms it hit.
+ */
+export const REFUSAL_SURFACES = [
+    'render-gate',
+    'owner-api',
+    'provisioning-api',
+    'mcp-endpoint',
+];
+/** The closed `retry` vocabulary — see the file header for semantics. */
+export const REFUSAL_RETRIES = [
+    'after-fix',
+    'next-period',
+    'later',
+    'never',
+];
+/**
+ * Who can act on an `after-fix` refusal. Only `caller` is the agent
+ * itself — see the no-auto-retry rule in the file header.
+ */
+export const REFUSAL_FIX_BY = ['caller', 'owner', 'tenant', 'operator'];
+/**
+ * The registry is the ONLY list of refusal codes: {@link RefusalCode}
+ * is derived from the keys below, and this definer forces every row's
+ * `code` to equal its key at the type level. The `const` type parameter
+ * preserves each `surfaces` list as a literal tuple, which is what lets
+ * {@link PreGenerationRefusalCode} be derived per surface rather than
+ * written down a second time.
+ *
+ * Same posture as `defineModelRegistry` in `./llm.ts`.
+ */
+function defineRefusalRegistry(rows) {
+    return rows;
+}
+const REFUSAL_ROWS = /* @__PURE__ */ defineRefusalRegistry({
+    // ── render-gate ───────────────────────────────────────────────────
+    unsupported_provider: {
+        code: 'unsupported_provider',
+        surfaces: ['render-gate'],
+        retry: 'after-fix',
+        fixBy: 'owner',
+        emitter: "a deployment's generation gate, provider arm",
+        description: 'The provider behind the requested model is not one this deployment can fund for the app. The app owner picks a funded provider or configures the app with its own credentials.',
+    },
+    insufficient_credit: {
+        code: 'insufficient_credit',
+        surfaces: ['render-gate'],
+        retry: 'after-fix',
+        fixBy: 'owner',
+        emitter: "a deployment's generation gate, balance arm",
+        description: 'The balance this deployment funds the app from is exhausted. The app owner adds funds, after which the same call succeeds.',
+    },
+    hard_cap_exceeded: {
+        code: 'hard_cap_exceeded',
+        surfaces: ['render-gate'],
+        retry: 'next-period',
+        emitter: "a deployment's generation gate, cap arm",
+        description: 'The app reached the hard ceiling this deployment set for the current period. Nothing the caller or the owner does lifts it before the period rolls over.',
+    },
+    model_not_in_tier: {
+        code: 'model_not_in_tier',
+        surfaces: ['render-gate'],
+        retry: 'after-fix',
+        fixBy: 'caller',
+        emitter: "a deployment's generation gate, model arm",
+        description: 'The requested model is not among those the app is allowed to use. The caller picks an allowed model and retries — the one render-gate state an agent may act on itself.',
+    },
+    managed_default_cap_exceeded: {
+        code: 'managed_default_cap_exceeded',
+        surfaces: ['render-gate'],
+        retry: 'after-fix',
+        fixBy: 'tenant',
+        emitter: "a deployment's generation gate, delegated-policy arm",
+        description: 'The app is running on the default ceiling because the tenant that provisioned it has declared no policy of its own, and that ceiling is reached. The tenant declares an explicit policy for the app.',
+    },
+    app_policy_missing: {
+        code: 'app_policy_missing',
+        surfaces: ['render-gate'],
+        retry: 'after-fix',
+        fixBy: 'tenant',
+        emitter: "a deployment's generation gate, delegated-policy arm",
+        description: 'The app exists but carries no policy yet — the window between provisioning it and declaring what it may spend. The tenant declares the policy.',
+    },
+    billing_mode_anomaly: {
+        code: 'billing_mode_anomaly',
+        // ONE state on TWO surfaces: the same unreadable record refuses a
+        // provisioning call and a render. Two entries with one name would
+        // be the collision the namespace rule forbids; this is not one.
+        surfaces: ['provisioning-api', 'render-gate'],
+        retry: 'never',
+        emitter: "a deployment's provisioning guard and its generation gate, reading the same record",
+        description: 'The app record declares a funding mode this deployment does not recognise, or declares none at all. The value is reported as read and never coerced — an unreadable record is not a policy.',
+    },
+    app_canceled: {
+        code: 'app_canceled',
+        surfaces: ['render-gate'],
+        retry: 'after-fix',
+        fixBy: 'owner',
+        emitter: "a deployment's generation gate, plan-state arm",
+        description: "The app's plan has ended, so it renders nothing while the stored work is kept. The owner starts a new plan to restore rendering.",
+    },
+    trial_exhausted: {
+        code: 'trial_exhausted',
+        surfaces: ['render-gate'],
+        retry: 'after-fix',
+        fixBy: 'owner',
+        emitter: "a deployment's generation gate, trial arm",
+        description: 'The trial this deployment grants the app has used up its allotment. The owner starts a paid plan.',
+    },
+    trial_expired: {
+        code: 'trial_expired',
+        surfaces: ['render-gate'],
+        retry: 'after-fix',
+        fixBy: 'owner',
+        emitter: "a deployment's generation gate, trial arm",
+        description: "The app's trial window has closed. The owner starts a paid plan.",
+    },
+    issuer_rate_limited: {
+        code: 'issuer_rate_limited',
+        surfaces: ['render-gate'],
+        retry: 'later',
+        emitter: "the per-issuer render-rate cap's denial",
+        description: 'Calls arriving under this issuing identity are over the rate this deployment allows. Time restores it; retry shortly.',
+    },
+    app_rate_limited: {
+        code: 'app_rate_limited',
+        surfaces: ['render-gate'],
+        retry: 'later',
+        emitter: "the per-app render-rate cap's denial",
+        description: 'This app is rendering faster than the rate this deployment allows it. The cap is the app\u2019s own, not the issuing identity\u2019s \u2014 the two are separate states with separate codes. Time restores it; retry shortly.',
+    },
+    app_deprovisioned: {
+        code: 'app_deprovisioned',
+        surfaces: ['render-gate', 'mcp-endpoint'],
+        retry: 'never',
+        emitter: "the generation gate's owner-claim check, before any reservation or metering",
+        description: 'The app record has no owner claim any more \u2014 either the claim was removed, or the record names no issuing tenant at all. A record with no owner cannot be funded, so nothing renders under it and no caller action restores it.',
+    },
+    billing_path_missing: {
+        code: 'billing_path_missing',
+        surfaces: ['render-gate'],
+        retry: 'after-fix',
+        fixBy: 'owner',
+        emitter: "the generation gate's fall-through arm: a non-playground identity that resolves to no billing path (not a trial account, not a managed app, not a credit holder)",
+        description: 'The caller has no billing subject on this deployment, so nothing renders under it. The owner provisions one — a trial account, a managed policy, or credit. Unlike `billing_mode_anomaly` — an app record that exists and declares a funding mode this deployment cannot read — no record arm applies here: there is simply no subject to bill. A deployment MAY suppress this refusal by operator override; that switch is deployment policy, not a wire state.',
+    },
+    // ── owner-api ─────────────────────────────────────────────────────
+    subscription_exists: {
+        code: 'subscription_exists',
+        surfaces: ['owner-api'],
+        retry: 'after-fix',
+        fixBy: 'owner',
+        emitter: "a deployment's owner billing mutations",
+        description: "An active (non-canceled) plan exists on this app. It refuses starting another one AND deleting the app — the refusal's own `fix` names the next step for the action that was called.",
+    },
+    checkout_unavailable: {
+        code: 'checkout_unavailable',
+        surfaces: ['owner-api'],
+        retry: 'later',
+        fixBy: 'operator',
+        emitter: "a deployment's owner billing mutations",
+        description: 'The surface that starts a plan is unavailable on this deployment right now — unconfigured, or its provider is down. Only the operator can restore it.',
+    },
+    card_update_unavailable: {
+        code: 'card_update_unavailable',
+        surfaces: ['owner-api'],
+        retry: 'later',
+        fixBy: 'operator',
+        emitter: "a deployment's owner billing mutations",
+        description: 'The surface that updates a payment method is unavailable on this deployment right now. Only the operator can restore it.',
+    },
+    portal_unavailable: {
+        code: 'portal_unavailable',
+        surfaces: ['owner-api'],
+        retry: 'later',
+        fixBy: 'operator',
+        emitter: "a deployment's owner billing mutations",
+        description: "The self-service billing surface is unavailable on this deployment right now. Only the operator can restore it.",
+    },
+    no_subscription: {
+        code: 'no_subscription',
+        surfaces: ['owner-api'],
+        retry: 'after-fix',
+        fixBy: 'owner',
+        emitter: "a deployment's owner billing mutations",
+        description: 'A plan-management action was called on an app that has no plan. The owner starts a plan first.',
+    },
+    already_on_tier: {
+        code: 'already_on_tier',
+        surfaces: ['owner-api'],
+        retry: 'after-fix',
+        fixBy: 'owner',
+        emitter: "a deployment's owner billing mutations",
+        description: 'The plan requested is the one the app is already on. The owner picks a different plan.',
+    },
+    managed_app_no_checkout: {
+        code: 'managed_app_no_checkout',
+        surfaces: ['owner-api'],
+        retry: 'never',
+        emitter: "a deployment's owner billing mutations",
+        description: 'This app is funded by the tenant that provisioned it, so it has no owner-facing plan surface at all. No owner action creates one.',
+    },
+    managed_app_no_card_update: {
+        code: 'managed_app_no_card_update',
+        surfaces: ['owner-api'],
+        retry: 'never',
+        emitter: "a deployment's owner billing mutations",
+        description: 'This app is funded by the tenant that provisioned it, so it carries no owner payment method to update.',
+    },
+    managed_app_no_portal: {
+        code: 'managed_app_no_portal',
+        surfaces: ['owner-api'],
+        retry: 'never',
+        emitter: "a deployment's owner billing mutations",
+        description: 'This app is funded by the tenant that provisioned it, so it has no owner self-service billing surface.',
+    },
+    // ── provisioning-api ──────────────────────────────────────────────
+    owner_ref_mismatch: {
+        code: 'owner_ref_mismatch',
+        surfaces: ['provisioning-api'],
+        retry: 'after-fix',
+        fixBy: 'tenant',
+        emitter: "a deployment's provisioning guard",
+        description: "The owner reference the caller supplied is not the one recorded on this app. The refusal names the route and the app, never the recorded reference. The tenant re-derives the reference and retries.",
+    },
+    policy_version_stale: {
+        code: 'policy_version_stale',
+        surfaces: ['provisioning-api'],
+        retry: 'after-fix',
+        fixBy: 'tenant',
+        emitter: "a deployment's provisioning guard, policy-write arm",
+        description: "The policy write carries a version older than the one stored, so it would overwrite a newer decision. The refusal reports the stored version; the tenant re-derives from it and writes again.",
+    },
+});
+/** The registry consumers read. */
+export const PRE_GENERATION_REFUSAL_CODES = REFUSAL_ROWS;
+/**
+ * Identity helper that only accepts an EXHAUSTIVE tuple of one surface's
+ * codes: omit one and the parameter type collapses to `never`, so the
+ * call site is a compile error. A tuple is needed because a wire enum
+ * requires a literal, non-empty tuple — a runtime filter over the rows
+ * yields `string[]`, which cannot type an enum. This keeps every
+ * per-surface tuple derived-CHECKED rather than a second list.
+ */
+const exhaustiveCodesOn = () => (codes) => codes;
+/**
+ * Every render-gate code, as the literal tuple the wire enum
+ * (`renderRefusalSchema.code`) is built from. Order is the registry's.
+ */
+export const RENDER_GATE_REFUSAL_CODES = exhaustiveCodesOn()([
+    'unsupported_provider',
+    'insufficient_credit',
+    'hard_cap_exceeded',
+    'model_not_in_tier',
+    'managed_default_cap_exceeded',
+    'app_policy_missing',
+    'billing_mode_anomaly',
+    'billing_path_missing',
+    'app_canceled',
+    'trial_exhausted',
+    'trial_expired',
+    'issuer_rate_limited',
+    'app_rate_limited',
+    'app_deprovisioned',
+]);
+/**
+ * Every mcp-endpoint code, as the literal tuple the transport wire enum
+ * (`transportRefusalSchema.code`) is built from — the refusals a per-app
+ * MCP endpoint's authorization types on `error.data.refusal`
+ * (ggui#825). Order is the registry's.
+ */
+export const MCP_ENDPOINT_REFUSAL_CODES = exhaustiveCodesOn()([
+    'app_deprovisioned',
+]);

package/dist/types/render.d.ts

@@ -1,10 +1,11 @@
-import type { KNOWN_PERMISSION_NAMES } from '../validation/hygiene-rules';
-import type { PropsSpec, StreamSpec, ActionSpec, ContextSpec, ClientCapabilitiesSpec, GadgetDescriptor, JsonSchema, JsonObject } from './data-contract';
-import type { EndUserIdentity } from './auth';
-import type { HostContextProjection } from './host-context';
-import type { AppTheme } from '../schemas/app-theme';
-import type { RenderErrorCode } from '../schemas/mcp';
-import type { McpAppsGguiSession } from '../integrations/mcp-apps';
+import type { KNOWN_PERMISSION_NAMES } from '../validation/hygiene-rules.js';
+import type { PropsSpec, StreamSpec, ActionSpec, ContextSpec, ClientCapabilitiesSpec, GadgetDescriptor, JsonSchema, JsonObject } from './data-contract.js';
+import type { EndUserIdentity } from './auth.js';
+import type { HostContextProjection } from './host-context.js';
+import type { AppTheme } from '../schemas/app-theme.js';
+import type { z } from 'zod';
+import type { RenderErrorCode, gguiSessionStatusSchema } from '../schemas/mcp.js';
+import type { McpAppsGguiSession } from '../integrations/mcp-apps.js';
 /**
  * Recognised system-card kinds the runtime renders via built-in
  * components. The wire is open-ended (string), but new kinds without a
@@ -42,7 +43,7 @@ export type AdapterPermissions = {
  * in the earlier handshake collapse. The companion `ggui_close` tool
  * that wrote it was removed in the same slice.
  */
-export type GguiSessionStatus = 'active' | 'expired';
+export type GguiSessionStatus = z.infer<typeof gguiSessionStatusSchema>;
 /**
  * Common base for every {@link GguiSession} variant. Carries identity,
  * tenancy, lifecycle, and conversation-scoped context that every

package/dist/types/render.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"render.d.ts","sourceRoot":"","sources":["../../src/types/render.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,6BAA6B,CAAC;AAC1E,OAAO,KAAK,EACV,SAAS,EACT,UAAU,EACV,UAAU,EACV,WAAW,EACX,sBAAsB,EACtB,gBAAgB,EAChB,UAAU,EACV,UAAU,EACX,MAAM,iBAAiB,CAAC;AACzB,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,QAAQ,CAAC;AAC9C,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,gBAAgB,CAAC;AAC5D,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,sBAAsB,CAAC;AACrD,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,gBAAgB,CAAC;AAKtD,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,0BAA0B,CAAC;AA6BnE;;;;;GAKG;AACH,MAAM,MAAM,qBAAqB,GAC7B,gBAAgB,GAChB,gBAAgB,GAEhB,CAAC,MAAM,GAAG,EAAE,CAAC,CAAC;AAElB;;GAEG;AACH,MAAM,MAAM,gBAAgB,GAAG,SAAS,GAAG,QAAQ,GAAG,QAAQ,CAAC;AAE/D;;;;;;;GAOG;AACH,MAAM,MAAM,kBAAkB,GAAG;IAC/B,QAAQ,EAAE,CAAC,IAAI,CAAC,OAAO,sBAAsB,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,gBAAgB;CAC3E,CAAC;AAMF;;;;;;;;;;;;;;GAcG;AACH,MAAM,MAAM,iBAAiB,GAAG,QAAQ,GAAG,SAAS,CAAC;AAErD;;;;;;;;;;;;;GAaG;AACH,MAAM,WAAW,eAAe;IAC9B;kEAC8D;IAC9D,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;IACpB,0DAA0D;IAC1D,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB;iBACa;IACb,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;IACzB,wEAAwE;IACxE,QAAQ,CAAC,eAAe,CAAC,EAAE,eAAe,CAAC;IAC3C;;;;;;;;;;;;;;OAcG;IACH,QAAQ,CAAC,WAAW,CAAC,EAAE;QACrB,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;QAC1B,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;KAChC,CAAC;IACF;;;;;;OAMG;IACH,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC;IAC1B;;;;;;;;;;;;OAYG;IACH,QAAQ,CAAC,WAAW,CAAC,EAAE,qBAAqB,CAAC;IAC7C;;;;OAIG;IACH,QAAQ,CAAC,kBAAkB,CAAC,EAAE,kBAAkB,CAAC;IACjD,uEAAuE;IACvE,QAAQ,CAAC,MAAM,CAAC,EAAE,iBAAiB,CAAC;IACpC;wCACoC;IACpC,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;IAC/B;;;;;;;;;;OAUG;IACH,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC;IACxB,qCAAqC;IACrC,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,0CAA0C;IAC1C,QAAQ,CAAC,cAAc,EAAE,MAAM,CAAC;IAChC,mCAAmC;IACnC,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;CAC5B;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AACH,MAAM,MAAM,WAAW,CAAC,MAAM,GAAG,UAAU,IACvC,oBAAoB,CAAC,MAAM,CAAC,GAC5B,iBAAiB,GACjB,kBAAkB,CAAC;AAEvB;;;;;;;;GAQG;AACH,wBAAgB,oBAAoB,CAAC,MAAM,EAAE,WAAW,GAAG,OAAO,CAKjE;AAED;;;;GAIG;AACH,wBAAgB,sBAAsB,CACpC,MAAM,EAAE,WAAW,GAClB,eAAe,GAAG,SAAS,CAG7B;AAED;;;;;GAKG;AACH,MAAM,WAAW,oBAAoB,CAAC,MAAM,GAAG,UAAU,CAAE,SAAQ,eAAe;IAChF,+DAA+D;IAC/D,QAAQ,CAAC,IAAI,CAAC,EAAE,WAAW,CAAC;IAC5B,0CAA0C;IAC1C,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;IAC/B;qFACiF;IACjF,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC;IACxB,oEAAoE;IACpE,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;IACzB,4DAA4D;IAC5D,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAC;IAC9B;qDACiD;IACjD,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAC;IAC9B;gCAC4B;IAC5B,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC;IAC1B,2DAA2D;IAC3D,QAAQ,CAAC,MAAM,CAAC,EAAE,UAAU,CAAC;IAC7B,uDAAuD;IACvD,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC;IACxB;;;;;;;;;;;;;;OAcG;IACH,QAAQ,CAAC,SAAS,CAAC,EAAE,eAAe,CAAC;IACrC;qCACiC;IACjC,QAAQ,CAAC,UAAU,CAAC,EAAE,UAAU,CAAC;IACjC;+BAC2B;IAC3B,QAAQ,CAAC,SAAS,CAAC,EAAE,SAAS,CAAC;IAC/B;+BAC2B;IAC3B,QAAQ,CAAC,UAAU,CAAC,EAAE,UAAU,CAAC;IACjC;mDAC+C;IAC/C,QAAQ,CAAC,WAAW,CAAC,EAAE,WAAW,CAAC;IACnC;;;;;;;;;;OAUG;IACH,QAAQ,CAAC,kBAAkB,CAAC,EAAE,sBAAsB,CAAC;IACrD;;;;;OAKG;IACH,QAAQ,CAAC,iBAAiB,CAAC,EAAE,SAAS,gBAAgB,EAAE,CAAC;IACzD;;;;;;;;;;OAUG;IACH,QAAQ,CAAC,KAAK,CAAC,EAAE,QAAQ,CAAC;IAC1B;;;;;;;;;;;;;OAaG;IACH,QAAQ,CAAC,eAAe,CAAC,EAAE,UAAU,CAAC;CACvC;AAED;;;;;;;;;GASG;AACH,MAAM,WAAW,iBAAiB,CAAC,MAAM,SAAS,UAAU,GAAG,UAAU,CACvE,SAAQ,eAAe;IACvB,QAAQ,CAAC,IAAI,EAAE,QAAQ,CAAC;IACxB;;;;;OAKG;IACH,QAAQ,CAAC,IAAI,EAAE,qBAAqB,CAAC;IACrC,gDAAgD;IAChD,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC;IACxB,yEAAyE;IACzE,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAC;CAC/B;AAMD;;;;;;;GAOG;AACH,MAAM,WAAW,gBAAgB,CAAC,SAAS,GAAG,UAAU;IACtD,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC;IACvB,OAAO,EAAE,MAAM,CAAC;IAChB,SAAS,CAAC,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,SAAS,CAAA;KAAE,EAAE,CAAC;IAChD,SAAS,EAAE,MAAM,CAAC;CACnB"}
+{"version":3,"file":"render.d.ts","sourceRoot":"","sources":["../../src/types/render.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,6BAA6B,CAAC;AAC1E,OAAO,KAAK,EACV,SAAS,EACT,UAAU,EACV,UAAU,EACV,WAAW,EACX,sBAAsB,EACtB,gBAAgB,EAChB,UAAU,EACV,UAAU,EACX,MAAM,iBAAiB,CAAC;AACzB,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,QAAQ,CAAC;AAC9C,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,gBAAgB,CAAC;AAC5D,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,sBAAsB,CAAC;AACrD,OAAO,KAAK,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAE7B,OAAO,KAAK,EAAE,eAAe,EAAE,uBAAuB,EAAE,MAAM,gBAAgB,CAAC;AAK/E,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,0BAA0B,CAAC;AA6BnE;;;;;GAKG;AACH,MAAM,MAAM,qBAAqB,GAC7B,gBAAgB,GAChB,gBAAgB,GAEhB,CAAC,MAAM,GAAG,EAAE,CAAC,CAAC;AAElB;;GAEG;AACH,MAAM,MAAM,gBAAgB,GAAG,SAAS,GAAG,QAAQ,GAAG,QAAQ,CAAC;AAE/D;;;;;;;GAOG;AACH,MAAM,MAAM,kBAAkB,GAAG;IAC/B,QAAQ,EAAE,CAAC,IAAI,CAAC,OAAO,sBAAsB,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,gBAAgB;CAC3E,CAAC;AAMF;;;;;;;;;;;;;;GAcG;AACH,MAAM,MAAM,iBAAiB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,uBAAuB,CAAC,CAAC;AAExE;;;;;;;;;;;;;GAaG;AACH,MAAM,WAAW,eAAe;IAC9B;kEAC8D;IAC9D,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;IACpB,0DAA0D;IAC1D,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB;iBACa;IACb,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;IACzB,wEAAwE;IACxE,QAAQ,CAAC,eAAe,CAAC,EAAE,eAAe,CAAC;IAC3C;;;;;;;;;;;;;;OAcG;IACH,QAAQ,CAAC,WAAW,CAAC,EAAE;QACrB,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;QAC1B,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;KAChC,CAAC;IACF;;;;;;OAMG;IACH,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC;IAC1B;;;;;;;;;;;;OAYG;IACH,QAAQ,CAAC,WAAW,CAAC,EAAE,qBAAqB,CAAC;IAC7C;;;;OAIG;IACH,QAAQ,CAAC,kBAAkB,CAAC,EAAE,kBAAkB,CAAC;IACjD,uEAAuE;IACvE,QAAQ,CAAC,MAAM,CAAC,EAAE,iBAAiB,CAAC;IACpC;wCACoC;IACpC,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;IAC/B;;;;;;;;;;OAUG;IACH,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC;IACxB,qCAAqC;IACrC,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,0CAA0C;IAC1C,QAAQ,CAAC,cAAc,EAAE,MAAM,CAAC;IAChC,mCAAmC;IACnC,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;CAC5B;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AACH,MAAM,MAAM,WAAW,CAAC,MAAM,GAAG,UAAU,IACvC,oBAAoB,CAAC,MAAM,CAAC,GAC5B,iBAAiB,GACjB,kBAAkB,CAAC;AAEvB;;;;;;;;GAQG;AACH,wBAAgB,oBAAoB,CAAC,MAAM,EAAE,WAAW,GAAG,OAAO,CAKjE;AAED;;;;GAIG;AACH,wBAAgB,sBAAsB,CACpC,MAAM,EAAE,WAAW,GAClB,eAAe,GAAG,SAAS,CAG7B;AAED;;;;;GAKG;AACH,MAAM,WAAW,oBAAoB,CAAC,MAAM,GAAG,UAAU,CAAE,SAAQ,eAAe;IAChF,+DAA+D;IAC/D,QAAQ,CAAC,IAAI,CAAC,EAAE,WAAW,CAAC;IAC5B,0CAA0C;IAC1C,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;IAC/B;qFACiF;IACjF,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC;IACxB,oEAAoE;IACpE,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;IACzB,4DAA4D;IAC5D,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAC;IAC9B;qDACiD;IACjD,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAC;IAC9B;gCAC4B;IAC5B,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC;IAC1B,2DAA2D;IAC3D,QAAQ,CAAC,MAAM,CAAC,EAAE,UAAU,CAAC;IAC7B,uDAAuD;IACvD,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC;IACxB;;;;;;;;;;;;;;OAcG;IACH,QAAQ,CAAC,SAAS,CAAC,EAAE,eAAe,CAAC;IACrC;qCACiC;IACjC,QAAQ,CAAC,UAAU,CAAC,EAAE,UAAU,CAAC;IACjC;+BAC2B;IAC3B,QAAQ,CAAC,SAAS,CAAC,EAAE,SAAS,CAAC;IAC/B;+BAC2B;IAC3B,QAAQ,CAAC,UAAU,CAAC,EAAE,UAAU,CAAC;IACjC;mDAC+C;IAC/C,QAAQ,CAAC,WAAW,CAAC,EAAE,WAAW,CAAC;IACnC;;;;;;;;;;OAUG;IACH,QAAQ,CAAC,kBAAkB,CAAC,EAAE,sBAAsB,CAAC;IACrD;;;;;OAKG;IACH,QAAQ,CAAC,iBAAiB,CAAC,EAAE,SAAS,gBAAgB,EAAE,CAAC;IACzD;;;;;;;;;;OAUG;IACH,QAAQ,CAAC,KAAK,CAAC,EAAE,QAAQ,CAAC;IAC1B;;;;;;;;;;;;;OAaG;IACH,QAAQ,CAAC,eAAe,CAAC,EAAE,UAAU,CAAC;CACvC;AAED;;;;;;;;;GASG;AACH,MAAM,WAAW,iBAAiB,CAAC,MAAM,SAAS,UAAU,GAAG,UAAU,CACvE,SAAQ,eAAe;IACvB,QAAQ,CAAC,IAAI,EAAE,QAAQ,CAAC;IACxB;;;;;OAKG;IACH,QAAQ,CAAC,IAAI,EAAE,qBAAqB,CAAC;IACrC,gDAAgD;IAChD,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC;IACxB,yEAAyE;IACzE,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAC;CAC/B;AAMD;;;;;;;GAOG;AACH,MAAM,WAAW,gBAAgB,CAAC,SAAS,GAAG,UAAU;IACtD,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC;IACvB,OAAO,EAAE,MAAM,CAAC;IAChB,SAAS,CAAC,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,SAAS,CAAA;KAAE,EAAE,CAAC;IAChD,SAAS,EAAE,MAAM,CAAC;CACnB"}

package/dist/types/ui-generator.d.ts

@@ -1,4 +1,4 @@
-import type { DataContract, JsonObject, JsonSchema, JsonValue } from './data-contract';
+import type { DataContract, JsonObject, JsonSchema, JsonValue } from './data-contract.js';
 /**
  * Request to generate a UI component.
  * Generic `TContext` defaults to {@link JsonObject} for generator context hints.

package/dist/validation/ajv-runtime.d.ts

@@ -50,8 +50,8 @@ import type { ErrorObject, ValidateFunction } from 'ajv';
  * dependency — TS resolves the type transitively through this package.
  */
 export type { ValidateFunction } from 'ajv';
-import type { JsonSchema } from '../types/data-contract';
-import type { ContractViolation } from './contract-validator';
+import type { JsonSchema } from '../types/data-contract.js';
+import type { ContractViolation } from './contract-validator.js';
 /**
  * Recursively walk a JSON Schema and inject
  * `additionalProperties: false` at every object node. Authors who

package/dist/validation/contract-validator.d.ts

@@ -1,9 +1,9 @@
-import type { PropsSpec, StreamSpec, ActionSpec, ContextSpec, JsonSchema, JsonObject, DataContract } from '../types/data-contract';
-import type { ActionEnvelope } from '../types/events';
-import type { CompiledContractValidators } from '../integrations/mcp-apps';
-import type { ValidateFunction } from './ajv-runtime';
-export type { ValidateFunction } from './ajv-runtime';
-import { type ReservedChannelValidator } from './reserved-channels';
+import type { PropsSpec, StreamSpec, ActionSpec, ContextSpec, JsonSchema, JsonObject, DataContract } from '../types/data-contract.js';
+import type { ActionEnvelope } from '../types/events.js';
+import type { CompiledContractValidators } from '../integrations/mcp-apps.js';
+import type { ValidateFunction } from './ajv-runtime.js';
+export type { ValidateFunction } from './ajv-runtime.js';
+import { type ReservedChannelValidator } from './reserved-channels.js';
 export interface ContractViolation extends JsonObject {
     field: string;
     message: string;

package/dist/validation/cross-references.d.ts

@@ -15,8 +15,8 @@
  * declarative source of truth for every referenced tool). Violations
  * are author-recoverable at render time.
  */
-import type { DataContract, ActionSpec, StreamSpec, AgentCapabilitiesSpec } from '../types/data-contract';
-import type { ContractViolation } from './contract-validator';
+import type { DataContract, ActionSpec, StreamSpec, AgentCapabilitiesSpec } from '../types/data-contract.js';
+import type { ContractViolation } from './contract-validator.js';
 /**
  * Stable error code emitted when an `actionSpec[*].nextStep` value
  * does not resolve to a declared `agentCapabilities.tools[*]` key on

package/dist/validation/hygiene-rules.d.ts

@@ -41,7 +41,7 @@
  * set is wired into `lintContract` via `phaseHygiene`; consumers that
  * want strict gates layer their own assertions on top.
  */
-import type { DataContract, GadgetDescriptor } from '../types/data-contract';
+import type { DataContract, GadgetDescriptor } from '../types/data-contract.js';
 /**
  * Stable codes for hygiene rules. Each is a `LINT_*` rather than a
  * `CTR_*` — the convention: errors are `CTR_*`, warnings are `LINT_*`.

package/dist/validation/name-invariants.d.ts

@@ -35,8 +35,8 @@
  * Companion to {@link CrossReferenceError} in `./cross-references` —
  * the two modules ship the "phase 2: references" rule registry.
  */
-import type { DataContract } from '../types/data-contract';
-import type { ContractViolation } from './contract-validator';
+import type { DataContract } from '../types/data-contract.js';
+import type { ContractViolation } from './contract-validator.js';
 /**
  * Stable error code for collisions across the three inbound spec maps
  * (`actionSpec` / `streamSpec` / `contextSpec`). The boilerplate

package/dist/validation/reserved-channels.d.ts

@@ -31,7 +31,7 @@
  * file describes a NAMING POLICY that the contract-structure validator
  * enforces. Separate concerns — easier to audit the boundary.
  */
-import type { ValidationResult } from './contract-validator';
+import type { ValidationResult } from './contract-validator.js';
 /** Prefix that marks a channel as server-owned (reserved from agents). */
 export declare const RESERVED_CHANNEL_PREFIX = "_ggui:";
 /**

package/dist/validation/schema-compat-invariants.d.ts

@@ -42,8 +42,8 @@
  * they ship companion rule registries to cross-references and
  * name-invariants under the unified `lintContract` API.
  */
-import type { AgentCapabilitiesSpec, DataContract } from '../types/data-contract';
-import type { ContractViolation } from './contract-validator';
+import type { AgentCapabilitiesSpec, DataContract } from '../types/data-contract.js';
+import type { ContractViolation } from './contract-validator.js';
 /**
  * Stable error code for protocol-level schema-compatibility
  * violations on action ⊆ inputSchema or channel ⊇ outputSchema.

package/dist/validation/schema-meta-validation.d.ts

@@ -30,7 +30,7 @@
  * assertions for the same author-recoverable failure class; this
  * sits alongside them.
  */
-import type { DataContract } from '../types/data-contract';
+import type { DataContract } from '../types/data-contract.js';
 export interface SchemaMetaViolation {
     /** Path to the malformed schema field (e.g., `propsSpec.properties.todos.schema`). */
     field: string;