@ggui-ai/protocol 0.13.0 → 0.15.0

package/dist/schemas/data-contract.js

@@ -51,6 +51,7 @@
  * just to accept the contract and pass it to the generator.
  */
 import { z } from 'zod';
+import { PUBLIC_ENV_APP_KEY_RE } from './public-env-key.js';
 import { KNOWN_PERMISSION_NAMES } from '../validation/hygiene-rules.js';
 import { STDLIB_GADGETS_PACKAGE } from '../gadgets/stdlib-gadgets.js';
 import { COMPONENT_NAME_RE, HOOK_NAME_RE } from './gadget-name-grammar.js';
@@ -70,6 +71,8 @@ export const jsonValueSchema = z.lazy(() => z.union([
     // surface as `undefined` at runtime which JSON.stringify drops.
     z.record(z.string(), jsonValueSchema),
 ]));
+/** A JSON object — the protocol's `JsonObject`, never a bare `Record`. */
+export const jsonObjectSchema = z.record(z.string(), jsonValueSchema);
 /**
  * {@link JsonSchema} — JSON Schema draft-07 subset. Mirrors the
  * fields the TS interface enumerates. `additionalProperties` and
@@ -218,26 +221,6 @@ export const agentCapabilitiesSpecSchema = z
     tools: z.record(z.string(), agentToolEntrySchema),
 })
     .passthrough();
-/**
- * `App.publicEnv` key regex.
- *
- * Each key in `App.publicEnv` MUST match this pattern. The prefix is
- * the **security boundary** — operators can't accidentally stash
- * sensitive credentials under arbitrary names, and downstream consumers
- * (render gate, bootstrap projection, iframe shim) can rely on the
- * naming convention to mean "public-by-design".
- *
- * Rule: `GGUI_PUBLIC_APP_` prefix, then uppercase letters / digits /
- * underscores, at least one char after the prefix.
- *
- * `GGUI_PUBLIC_USER_*` keys are RESERVED for a future per-user
- * channel. The current regex rejects them so App-side config can't
- * pre-emptively use the namespace.
- *
- * Hoisted above `gadgetDescriptorSchema` so the wrapper's `requires`
- * array can reference it at schema-construction time (TDZ-safe).
- */
-export const PUBLIC_ENV_APP_KEY_RE = /^GGUI_PUBLIC_APP_[A-Z0-9_]+$/;
 /**
  * Single source of truth for the `requires[]` field shape on gadget
  * descriptors. The wire-permissive `gadgetDescriptorSchema`, the
@@ -251,9 +234,7 @@ export const PUBLIC_ENV_APP_KEY_RE = /^GGUI_PUBLIC_APP_[A-Z0-9_]+$/;
  * that declare a `requires` key must have a corresponding App-side
  * publicEnv value at render time (gate: `assertPublicEnvSatisfied`).
  */
-export const gadgetRequiresSchema = z
-    .array(z.string().regex(PUBLIC_ENV_APP_KEY_RE))
-    .readonly();
+export const gadgetRequiresSchema = z.array(z.string().regex(PUBLIC_ENV_APP_KEY_RE));
 /**
  * SRI hash format for gadget bundles. Registry install writes
  * `bundleSri` in this shape; iframe-runtime emits it verbatim into
@@ -432,7 +413,7 @@ const basePackageFieldsShape = {
     bundleSri: z.string().regex(BUNDLE_SRI_RE).optional(),
     styleUrl: z.url().optional(),
     // CSP `connect-src` feed — full URL shape on every entry.
-    connect: z.array(z.url()).readonly().optional(),
+    connect: z.array(z.url()).optional(),
     // Shared `gadgetRequiresSchema`.
     requires: gadgetRequiresSchema.optional(),
     // HTTPS URL of the package's `.d.ts`. The handler fetches it at
@@ -638,9 +619,7 @@ export const clientCapabilitiesSpecSchema = z
  *   - Defensive re-validation in the iframe-runtime slice-meta
  *     extractors (`parseMetaFromGlobal`, `parseMetaFromToolResult`).
  */
-export const appPublicEnvSchema = z
-    .record(z.string().regex(PUBLIC_ENV_APP_KEY_RE), z.string())
-    .readonly();
+export const appPublicEnvSchema = z.record(z.string().regex(PUBLIC_ENV_APP_KEY_RE), z.string());
 /**
  * {@link DataContract} — the unified four-spec contract surface
  * agents author on `story.contract` and that the generator

package/dist/schemas/interface-context.d.ts

@@ -0,0 +1,44 @@
+/**
+ * Interface-context schema — the client's viewport/platform snapshot every
+ * handshake and every `InvokeEvent` carries. Its own module (ggui#819) so
+ * the browser entry (`@ggui-ai/protocol/wire`) reaches it without the
+ * tool schemas that used to share its file.
+ */
+import { z } from 'zod';
+export declare const viewportSchema: z.ZodObject<{
+    width: z.ZodNumber;
+    height: z.ZodNumber;
+}, z.core.$strip>;
+export declare const interfaceContextSchema: z.ZodObject<{
+    viewport: z.ZodObject<{
+        width: z.ZodNumber;
+        height: z.ZodNumber;
+    }, z.core.$strip>;
+    platform: z.ZodEnum<{
+        web: "web";
+        desktop: "desktop";
+        mobile: "mobile";
+    }>;
+    deviceType: z.ZodEnum<{
+        desktop: "desktop";
+        tablet: "tablet";
+        phone: "phone";
+    }>;
+    orientation: z.ZodEnum<{
+        portrait: "portrait";
+        landscape: "landscape";
+    }>;
+    devicePixelRatio: z.ZodOptional<z.ZodNumber>;
+    touchPrimary: z.ZodOptional<z.ZodBoolean>;
+    shellType: z.ZodOptional<z.ZodEnum<{
+        fullscreen: "fullscreen";
+        chat: "chat";
+        spatial: "spatial";
+    }>>;
+    colorScheme: z.ZodOptional<z.ZodEnum<{
+        light: "light";
+        dark: "dark";
+    }>>;
+    reducedMotion: z.ZodOptional<z.ZodBoolean>;
+}, z.core.$loose>;
+//# sourceMappingURL=interface-context.d.ts.map

package/dist/schemas/interface-context.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"interface-context.d.ts","sourceRoot":"","sources":["../../src/schemas/interface-context.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AACH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,eAAO,MAAM,cAAc;;;iBAGzB,CAAC;AAEH,eAAO,MAAM,sBAAsB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;iBAUnB,CAAC"}

package/dist/schemas/interface-context.js

@@ -0,0 +1,22 @@
+/**
+ * Interface-context schema — the client's viewport/platform snapshot every
+ * handshake and every `InvokeEvent` carries. Its own module (ggui#819) so
+ * the browser entry (`@ggui-ai/protocol/wire`) reaches it without the
+ * tool schemas that used to share its file.
+ */
+import { z } from 'zod';
+export const viewportSchema = z.object({
+    width: z.number(),
+    height: z.number(),
+});
+export const interfaceContextSchema = z.object({
+    viewport: viewportSchema,
+    platform: z.enum(['web', 'mobile', 'desktop']),
+    deviceType: z.enum(['phone', 'tablet', 'desktop']),
+    orientation: z.enum(['portrait', 'landscape']),
+    devicePixelRatio: z.number().optional(),
+    touchPrimary: z.boolean().optional(),
+    shellType: z.enum(['chat', 'fullscreen', 'spatial']).optional(),
+    colorScheme: z.enum(['light', 'dark']).optional(),
+    reducedMotion: z.boolean().optional(),
+}).passthrough();

package/dist/schemas/invoke.d.ts

@@ -312,8 +312,8 @@ export declare const invokeRequestSchema: z.ZodObject<{
         }>;
         deviceType: z.ZodEnum<{
             desktop: "desktop";
-            phone: "phone";
             tablet: "tablet";
+            phone: "phone";
         }>;
         orientation: z.ZodEnum<{
             portrait: "portrait";

package/dist/schemas/invoke.js

@@ -12,7 +12,7 @@
  * and types for authoring.
  */
 import { z } from 'zod';
-import { interfaceContextSchema } from './mcp.js';
+import { interfaceContextSchema } from './interface-context.js';
 // ── Content blocks ────────────────────────────────────────────────────
 /** Plain text content — streamed via `text_delta` events. */
 export const textBlockSchema = z.object({