@ggui-ai/protocol 0.13.0 → 0.15.0

package/dist/schemas/mcp.d.ts

@@ -24,42 +24,6 @@
  *     its handler imports {@link renderInputShape}.
  */
 import { z } from 'zod';
-export declare const viewportSchema: z.ZodObject<{
-    width: z.ZodNumber;
-    height: z.ZodNumber;
-}, z.core.$strip>;
-export declare const interfaceContextSchema: z.ZodObject<{
-    viewport: z.ZodObject<{
-        width: z.ZodNumber;
-        height: z.ZodNumber;
-    }, z.core.$strip>;
-    platform: z.ZodEnum<{
-        web: "web";
-        desktop: "desktop";
-        mobile: "mobile";
-    }>;
-    deviceType: z.ZodEnum<{
-        desktop: "desktop";
-        phone: "phone";
-        tablet: "tablet";
-    }>;
-    orientation: z.ZodEnum<{
-        portrait: "portrait";
-        landscape: "landscape";
-    }>;
-    devicePixelRatio: z.ZodOptional<z.ZodNumber>;
-    touchPrimary: z.ZodOptional<z.ZodBoolean>;
-    shellType: z.ZodOptional<z.ZodEnum<{
-        fullscreen: "fullscreen";
-        chat: "chat";
-        spatial: "spatial";
-    }>>;
-    colorScheme: z.ZodOptional<z.ZodEnum<{
-        light: "light";
-        dark: "dark";
-    }>>;
-    reducedMotion: z.ZodOptional<z.ZodBoolean>;
-}, z.core.$loose>;
 /**
  * `ggui_consume` input. The long-poll bound is SPEC §7.3: integer
  * seconds in `[0, 25]` — the cap dodges infrastructure kill windows
@@ -165,7 +129,7 @@ export declare const discoverInputSchema: z.ZodObject<{}, z.core.$strip>;
  */
 export declare const handshakeInputSchema: z.ZodObject<{
     intent: z.ZodString;
-    blueprintDraft: z.ZodType<import("..").BlueprintDraft, unknown, z.core.$ZodTypeInternals<import("..").BlueprintDraft, unknown>>;
+    blueprintDraft: z.ZodType<import("../index.js").BlueprintDraft, unknown, z.core.$ZodTypeInternals<import("../index.js").BlueprintDraft, unknown>>;
     forceCreate: z.ZodOptional<z.ZodBoolean>;
 }, z.core.$strict>;
 /**
@@ -206,7 +170,7 @@ export declare const handshakeOutputSchema: z.ZodObject<{
         update: "update";
         declined: "declined";
     }>;
-    suggestion: z.ZodType<import("..").HandshakeSuggestion, unknown, z.core.$ZodTypeInternals<import("..").HandshakeSuggestion, unknown>>;
+    suggestion: z.ZodType<import("../index.js").HandshakeSuggestion, unknown, z.core.$ZodTypeInternals<import("../index.js").HandshakeSuggestion, unknown>>;
     reason: z.ZodOptional<z.ZodString>;
     nextStep: z.ZodOptional<z.ZodObject<{
         tool: z.ZodLiteral<"ggui_render">;
@@ -269,9 +233,14 @@ export declare const renderInputShape: {
     /**
      * Typed `infra` envelope. Today carries one field (`model`); future
      * expansion (temperature, max_tokens, provider hints) lands here
-     * additively. `model` MUST be a provider-prefixed id
-     * (`provider/model-name`); a bound generator may also accept
-     * generator-specific prefixes for alternate transports.
+     * additively. `model` MUST parse as a model route in either wire form —
+     * canonical `provider:model` or LiteLLM `provider/model` (aliases resolve
+     * in both). The mechanism is `renderInputEnvelopeSchema`
+     * (`schemas/render-input-envelope.ts`), which the render handler parses
+     * BEFORE its pre-generation gate; this registered shape stays
+     * parser-free by design so a browser bundle never carries the route
+     * tables (ggui#818). A bound generator may also accept generator-specific
+     * prefixes for alternate transports.
      *
      * Strict — extra keys at `infra.*` are not silently dropped, so a
      * typo (`infra.modelId`) surfaces as a clear zod path instead of a
@@ -293,8 +262,8 @@ export declare const renderInputShape: {
      *     different variance resolves a distinct cached component.
      */
     readonly override: z.ZodOptional<z.ZodObject<{
-        contract: z.ZodOptional<z.ZodType<import("..").DataContract, unknown, z.core.$ZodTypeInternals<import("..").DataContract, unknown>>>;
-        variance: z.ZodOptional<z.ZodType<import("..").BlueprintVariance, unknown, z.core.$ZodTypeInternals<import("..").BlueprintVariance, unknown>>>;
+        contract: z.ZodOptional<z.ZodType<import("../index.js").DataContract, unknown, z.core.$ZodTypeInternals<import("../index.js").DataContract, unknown>>>;
+        variance: z.ZodOptional<z.ZodType<import("../index.js").BlueprintVariance, unknown, z.core.$ZodTypeInternals<import("../index.js").BlueprintVariance, unknown>>>;
     }, z.core.$strict>>;
 };
 export declare const renderInputSchema: z.ZodObject<{
@@ -305,8 +274,8 @@ export declare const renderInputSchema: z.ZodObject<{
         model: z.ZodOptional<z.ZodString>;
     }, z.core.$strict>>;
     override: z.ZodOptional<z.ZodObject<{
-        contract: z.ZodOptional<z.ZodType<import("..").DataContract, unknown, z.core.$ZodTypeInternals<import("..").DataContract, unknown>>>;
-        variance: z.ZodOptional<z.ZodType<import("..").BlueprintVariance, unknown, z.core.$ZodTypeInternals<import("..").BlueprintVariance, unknown>>>;
+        contract: z.ZodOptional<z.ZodType<import("../index.js").DataContract, unknown, z.core.$ZodTypeInternals<import("../index.js").DataContract, unknown>>>;
+        variance: z.ZodOptional<z.ZodType<import("../index.js").BlueprintVariance, unknown, z.core.$ZodTypeInternals<import("../index.js").BlueprintVariance, unknown>>>;
     }, z.core.$strict>>;
 }, z.core.$strip>;
 /**
@@ -380,6 +349,178 @@ export declare const renderErrorSchema: z.ZodObject<{
     }>;
     message: z.ZodString;
 }, z.core.$strip>;
+/**
+ * The three outcomes a `ggui_render` result can report (SPEC §7.1,
+ * ggui#786). A reader branches on this rather than guessing from which
+ * fields happen to be present:
+ *
+ *   - `rendered` — the render ran and produced an interface. The
+ *     identity fields (`sessionId`, `action`, `contractHash`,
+ *     `blueprintId`, `variantKey`, `cache`) are all present.
+ *   - `failed` — generation RAN and did not produce a component. The
+ *     error session IS committed, so the identity fields are present
+ *     and `error` carries the classification. The handshake is
+ *     consumed.
+ *   - `refused` — the deployment declined the call BEFORE it did any
+ *     work: no state read, nothing committed, no spend. (The SDK has
+ *     already checked the call against the declared `inputSchema` —
+ *     the claim is nothing READ, not nothing validated.) The identity
+ *     fields are structurally ABSENT and `refusal` carries the whole
+ *     story; the handshake is INTACT, so the same id is valid on a
+ *     retry.
+ *
+ * Declared HERE rather than in `types/mcp.ts` (which re-exports the
+ * inferred type) so `types/render.ts` can reference it without a
+ * type-only import cycle through `types/mcp.ts` — same convention as
+ * {@link renderErrorCodeSchema}.
+ */
+export declare const renderOutcomeSchema: z.ZodEnum<{
+    rendered: "rendered";
+    failed: "failed";
+    refused: "refused";
+}>;
+/** Canonical inferred type for {@link renderOutcomeSchema}. */
+export type RenderOutcome = z.infer<typeof renderOutcomeSchema>;
+export declare const renderRefusalSchema: z.ZodObject<{
+    handshake: z.ZodLiteral<"intact">;
+    balanceCentsAtCheck: z.ZodOptional<z.ZodNumber>;
+    message: z.ZodString;
+    fix: z.ZodString;
+    retry: z.ZodEnum<{
+        never: "never";
+        "after-fix": "after-fix";
+        "next-period": "next-period";
+        later: "later";
+    }>;
+    code: z.ZodEnum<{
+        unsupported_provider: "unsupported_provider";
+        insufficient_credit: "insufficient_credit";
+        hard_cap_exceeded: "hard_cap_exceeded";
+        model_not_in_tier: "model_not_in_tier";
+        managed_default_cap_exceeded: "managed_default_cap_exceeded";
+        app_policy_missing: "app_policy_missing";
+        billing_mode_anomaly: "billing_mode_anomaly";
+        app_canceled: "app_canceled";
+        trial_exhausted: "trial_exhausted";
+        trial_expired: "trial_expired";
+        issuer_rate_limited: "issuer_rate_limited";
+        app_rate_limited: "app_rate_limited";
+        app_deprovisioned: "app_deprovisioned";
+        billing_path_missing: "billing_path_missing";
+    }>;
+}, z.core.$strip>;
+/** The refusal marker, derived from {@link renderRefusalSchema}. */
+export type PreGenerationRefusal = z.infer<typeof renderRefusalSchema>;
+/**
+ * A refusal typed on the per-app MCP endpoint's authorization
+ * (ggui#825) — the registry projection WITHOUT the render-only fields:
+ * no `handshake` (nothing was handed), no `balanceCentsAtCheck`. Strict:
+ * a render-only field here is a bug, never a wire state. `code` draws
+ * from {@link MCP_ENDPOINT_REFUSAL_CODES} — today exactly
+ * `app_deprovisioned`, the one refusal with a tenant-side fix and
+ * therefore the one that MUST be legible where a deleted app and a bad
+ * credential would otherwise look alike.
+ */
+export declare const transportRefusalSchema: z.ZodObject<{
+    message: z.ZodString;
+    fix: z.ZodString;
+    retry: z.ZodEnum<{
+        never: "never";
+        "after-fix": "after-fix";
+        "next-period": "next-period";
+        later: "later";
+    }>;
+    code: z.ZodEnum<{
+        app_deprovisioned: "app_deprovisioned";
+    }>;
+}, z.core.$strict>;
+/** A refusal on the per-app MCP endpoint, derived from {@link transportRefusalSchema}. */
+export type TransportRefusal = z.infer<typeof transportRefusalSchema>;
+/**
+ * The JSON-RPC error object a per-app MCP endpoint answers with when it
+ * refuses a request for a typed reason (ggui#825, codes ruled in
+ * ggui#836): HTTP 403, `code` `-32003` (`APP_NOT_FOUND` — the endpoint
+ * no longer serves this app, the same reading ggui's embed host gives a
+ * proxy 403) and `message` `App not found`, plus `data.refusal`, which
+ * makes it legible. `data` is strict: it carries the refusal and nothing
+ * else. An authorization failure that is not a registry state answers
+ * HTTP 403 with `-32001` (`UNAUTHORIZED`) and NO `data` — the three
+ * untyped arms stay indistinguishable among themselves by contract:
+ * naming any of them would say which is true. A first-party server
+ * never chooses `-32000`: it is the SDK client's `ConnectionClosed`, so
+ * a bare 403 and a dropped socket would share a number.
+ */
+export declare const transportRefusalErrorSchema: z.ZodObject<{
+    code: z.ZodLiteral<-32003>;
+    message: z.ZodLiteral<"App not found">;
+    data: z.ZodObject<{
+        refusal: z.ZodObject<{
+            message: z.ZodString;
+            fix: z.ZodString;
+            retry: z.ZodEnum<{
+                never: "never";
+                "after-fix": "after-fix";
+                "next-period": "next-period";
+                later: "later";
+            }>;
+            code: z.ZodEnum<{
+                app_deprovisioned: "app_deprovisioned";
+            }>;
+        }, z.core.$strict>;
+    }, z.core.$strict>;
+}, z.core.$strict>;
+/** The typed-refusal JSON-RPC error object, derived from {@link transportRefusalErrorSchema}. */
+export type TransportRefusalError = z.infer<typeof transportRefusalErrorSchema>;
+/**
+ * The COMPLETE structuredContent of a refused tool result — the whole
+ * payload, not a slice of it. Strict on purpose: a refusal commits
+ * nothing, so ANY other key (a `sessionId`, a `resourceUri`, an
+ * `error`) means the projection leaked state that does not exist.
+ *
+ * Today `ggui_render` is the only tool that carries a refusing gate;
+ * {@link renderOutputSchema} delegates its refused arm here rather than
+ * restating the rules, so there is exactly ONE declaration of them.
+ *
+ * NOT reusable verbatim by a second refusing tool, despite the strict
+ * shape reading as generic: {@link renderRefusalSchema} REQUIRES
+ * `handshake: 'intact'`, and that field is render-only by
+ * construction — a mutation consumes no handshake, so it has nothing
+ * to report intact. A mutation arm therefore lands WITH its first
+ * emitter, sharing the facts this envelope carries (`code`, `message`,
+ * `fix`, `retry`, one closed registry) and carrying no `handshake`
+ * field at all (ggui#798).
+ */
+export declare const refusedOutputSchema: z.ZodObject<{
+    outcome: z.ZodLiteral<"refused">;
+    refusal: z.ZodObject<{
+        handshake: z.ZodLiteral<"intact">;
+        balanceCentsAtCheck: z.ZodOptional<z.ZodNumber>;
+        message: z.ZodString;
+        fix: z.ZodString;
+        retry: z.ZodEnum<{
+            never: "never";
+            "after-fix": "after-fix";
+            "next-period": "next-period";
+            later: "later";
+        }>;
+        code: z.ZodEnum<{
+            unsupported_provider: "unsupported_provider";
+            insufficient_credit: "insufficient_credit";
+            hard_cap_exceeded: "hard_cap_exceeded";
+            model_not_in_tier: "model_not_in_tier";
+            managed_default_cap_exceeded: "managed_default_cap_exceeded";
+            app_policy_missing: "app_policy_missing";
+            billing_mode_anomaly: "billing_mode_anomaly";
+            app_canceled: "app_canceled";
+            trial_exhausted: "trial_exhausted";
+            trial_expired: "trial_expired";
+            issuer_rate_limited: "issuer_rate_limited";
+            app_rate_limited: "app_rate_limited";
+            app_deprovisioned: "app_deprovisioned";
+            billing_path_missing: "billing_path_missing";
+        }>;
+    }, z.core.$strip>;
+}, z.core.$strict>;
 /**
  * Canonical failure codes for a `resources/read` on a render locator
  * (`ui://ggui/render/{sessionId}/{blueprintKey}`). Closed enum.
@@ -433,9 +574,10 @@ export declare const resourceReadErrorSchema: z.ZodObject<{
     detail: z.ZodOptional<z.ZodString>;
 }, z.core.$strip>;
 /**
- * Wire-output shape — `{sessionId, resourceUri?, action, contractHash,
- * cache, error?, nextStep?}`. `contractHash` (data-contract identity)
- * and `cache` (reuse outcome) are required wire fields on this schema.
+ * Wire-output shape. `outcome` is the discriminant and the only
+ * unconditionally required field; which of the others exist follows
+ * from it, per the THREE OUTCOMES section below — that section is the
+ * single summary of this shape, so do not restate it here.
  * The handler carries `shortCode`, `codeReady`, `handshakeId`,
  * `decision`, `contract`, `codeUrl`, `codeHash`
  * on its internal `RenderOutput` TS shape for telemetry / post-classify
@@ -449,29 +591,53 @@ export declare const resourceReadErrorSchema: z.ZodObject<{
  * `render-resource/...`). Leaving a dead URL on the wire had the model
  * hallucinating links that resolve nowhere.
  *
- * Failure envelope (SPEC §7.1): a failed/rejected generation returns
- * this same schema-conformant shape on an `isError: true` tool result —
- * `error` present, `resourceUri` absent (nothing mountable), no
- * `_meta` on the result. The error GguiSession is still committed, so
- * `sessionId` remains a live handle into the session channel.
+ * THREE OUTCOMES (SPEC §7.1, ggui#786). Every result carries
+ * {@link renderOutcomeSchema} on `outcome`, and the identity fields are
+ * present IFF something was committed — which is why they are optional
+ * at the schema level and pinned by the presence refinement below:
+ *
+ *   - `rendered` — identity fields present; `resourceUri` present iff
+ *     mountable; no `error`, no `refusal`.
+ *   - `failed` — generation ran and produced nothing. Identity fields
+ *     present (the error GguiSession IS committed, so `sessionId`
+ *     remains a live handle into the session channel), `error`
+ *     present, `resourceUri` absent, no `_meta` on the result. The
+ *     handshake is consumed.
+ *   - `refused` — the deployment declined before doing any work.
+ *     Identity fields ABSENT, `refusal` present, no `error`, no
+ *     `nextStep`, no `_meta`. Nothing was committed and the handshake
+ *     is intact. The refused arm's whole envelope is
+ *     {@link refusedOutputSchema}.
+ *
+ * The root stays ONE object with a discriminant field rather than a
+ * discriminated union: the MCP spec's `Tool.outputSchema` root MUST be
+ * a JSON Schema of type `object`, and the SDK registers zod raw shapes.
+ * TypeScript narrowing is via the guards at the bottom of this file
+ * ({@link isRenderedOutput} / {@link isFailedRenderOutput} /
+ * {@link isRefusedRenderOutput}), never a parallel union type.
  *
  * Post-Phase-B the `'compose'` action enum value is gone — there is no
  * stack of N renders to compose against.
  */
 export declare const renderOutputSchema: z.ZodObject<{
-    sessionId: z.ZodString;
+    outcome: z.ZodEnum<{
+        rendered: "rendered";
+        failed: "failed";
+        refused: "refused";
+    }>;
+    sessionId: z.ZodOptional<z.ZodString>;
     resourceUri: z.ZodOptional<z.ZodString>;
-    action: z.ZodEnum<{
+    action: z.ZodOptional<z.ZodEnum<{
         replace: "replace";
         create: "create";
         reuse: "reuse";
         update: "update";
         declined: "declined";
-    }>;
-    contractHash: z.ZodString;
-    blueprintId: z.ZodString;
-    variantKey: z.ZodString;
-    cache: z.ZodObject<{
+    }>>;
+    contractHash: z.ZodOptional<z.ZodString>;
+    blueprintId: z.ZodOptional<z.ZodString>;
+    variantKey: z.ZodOptional<z.ZodString>;
+    cache: z.ZodOptional<z.ZodObject<{
         hit: z.ZodBoolean;
         similarity: z.ZodOptional<z.ZodNumber>;
         cachedBlueprintId: z.ZodOptional<z.ZodString>;
@@ -481,7 +647,7 @@ export declare const renderOutputSchema: z.ZodObject<{
             cold: "cold";
         }>>;
         reason: z.ZodOptional<z.ZodString>;
-    }, z.core.$strip>;
+    }, z.core.$strip>>;
     error: z.ZodOptional<z.ZodObject<{
         code: z.ZodEnum<{
             PRODUCTION_FAILED: "PRODUCTION_FAILED";
@@ -492,6 +658,34 @@ export declare const renderOutputSchema: z.ZodObject<{
         }>;
         message: z.ZodString;
     }, z.core.$strip>>;
+    refusal: z.ZodOptional<z.ZodObject<{
+        handshake: z.ZodLiteral<"intact">;
+        balanceCentsAtCheck: z.ZodOptional<z.ZodNumber>;
+        message: z.ZodString;
+        fix: z.ZodString;
+        retry: z.ZodEnum<{
+            never: "never";
+            "after-fix": "after-fix";
+            "next-period": "next-period";
+            later: "later";
+        }>;
+        code: z.ZodEnum<{
+            unsupported_provider: "unsupported_provider";
+            insufficient_credit: "insufficient_credit";
+            hard_cap_exceeded: "hard_cap_exceeded";
+            model_not_in_tier: "model_not_in_tier";
+            managed_default_cap_exceeded: "managed_default_cap_exceeded";
+            app_policy_missing: "app_policy_missing";
+            billing_mode_anomaly: "billing_mode_anomaly";
+            app_canceled: "app_canceled";
+            trial_exhausted: "trial_exhausted";
+            trial_expired: "trial_expired";
+            issuer_rate_limited: "issuer_rate_limited";
+            app_rate_limited: "app_rate_limited";
+            app_deprovisioned: "app_deprovisioned";
+            billing_path_missing: "billing_path_missing";
+        }>;
+    }, z.core.$strip>>;
     nextStep: z.ZodOptional<z.ZodObject<{
         tool: z.ZodLiteral<"ggui_consume">;
         description: z.ZodString;
@@ -559,9 +753,10 @@ export declare const amendInputSchema: z.ZodDiscriminatedUnion<[z.ZodObject<{
     patch: z.ZodRecord<z.ZodString, z.ZodUnknown>;
 }, z.core.$strict>], "kind">;
 /**
- * Wire-output shape — minimal acknowledgement. The handler carries
- * `decision`, `contract`, `contractHash` on its internal `UpdateOutput`
- * TS shape — zod strips them before structuredContent serialization.
+ * Wire-output shape — minimal acknowledgement. This schema IS the
+ * handler's declared output: `ggui_update` registers `.shape` and its
+ * return type is `GguiUpdateOutput` (`z.infer` of this schema), so
+ * there is no second declaration to keep in step (ggui#798).
  *
  * Every REAL update (`updated: true`) mints a new history record and
  * its result carries the `ai.ggui/render` slice as a FULL bootable
@@ -571,6 +766,15 @@ export declare const amendInputSchema: z.ZodDiscriminatedUnion<[z.ZodObject<{
  * history when its higher-epoch `props_update` frame lands; the
  * in-place repaint over the live-channel ladder (WS / SSE / polling /
  * bridge-pull) is `ggui_amend`'s job.
+ *
+ * NO refusal arm (ggui#786): the pre-generation refusal envelope rides
+ * `ggui_render` only. There is no pre-state POLICY gate on the
+ * mutation tools today — nothing on this path can decline a call for
+ * deployment-policy reasons (a contract error still rejects a
+ * malformed mutation before any store read; that is a parse result,
+ * not a refusal) — and `handshake: 'intact'` would assert something
+ * meaningless on a tool that consumes no handshake. The arm lands with its first
+ * emitter (ggui#798), not as a mechanical port of the render one.
  */
 export declare const updateOutputSchema: z.ZodObject<{
     sessionId: z.ZodString;
@@ -587,6 +791,10 @@ export declare const updateOutputSchema: z.ZodObject<{
  * mints a record, so there is no pinned URI to return and no epoch
  * field — the history number is untouched by construction). The
  * mounted card receives the new props over the live channels.
+ *
+ * As with {@link updateOutputSchema}, this schema IS the handler's
+ * declared output — `ggui_amend` registers `.shape` and returns
+ * `GguiAmendOutput` (ggui#798).
  */
 export declare const amendOutputSchema: z.ZodObject<{
     sessionId: z.ZodString;
@@ -752,11 +960,6 @@ export declare const runtimePullOutputSchema: z.ZodUnion<readonly [z.ZodObject<{
     reason: z.ZodLiteral<"REPLAY_HORIZON_PASSED">;
     currentSequence: z.ZodNumber;
 }, z.core.$strip>]>;
-/**
- * Per-batch event cap on `ggui_runtime_telemetry` — a bounded
- * fire-and-forget diagnostic channel, never a data plane.
- */
-export declare const RUNTIME_TELEMETRY_MAX_EVENTS = 40;
 /**
  * `ggui_runtime_telemetry` input — the iframe runtime's transport
  * self-report (`_meta.ui.visibility: ['app']`, view-callable only).
@@ -796,4 +999,368 @@ export declare const runtimeTelemetryInputSchema: z.ZodObject<{
 export declare const runtimeTelemetryOutputSchema: z.ZodObject<{
     ok: z.ZodLiteral<true>;
 }, z.core.$strip>;
+type RenderOutputValue = z.infer<typeof renderOutputSchema>;
+/** Identity fields a committed render reports. */
+type CommittedRenderIdentity = Required<Pick<RenderOutputValue, 'sessionId' | 'action' | 'contractHash' | 'blueprintId' | 'variantKey' | 'cache'>>;
+/** A render that produced an interface — identity fields present. */
+export declare function isRenderedOutput(output: RenderOutputValue): output is RenderOutputValue & {
+    outcome: 'rendered';
+} & CommittedRenderIdentity;
+/**
+ * A generation that RAN and produced nothing. The error session is
+ * committed, so `sessionId` is a live handle and `error` classifies it.
+ */
+export declare function isFailedRenderOutput(output: RenderOutputValue): output is RenderOutputValue & {
+    outcome: 'failed';
+    error: z.infer<typeof renderErrorSchema>;
+} & CommittedRenderIdentity;
+/**
+ * A PRE-GENERATION refusal — nothing read and nothing committed, so
+ * every identity field is absent and `refusal` carries the state. (Not
+ * "nothing parsed": the SDK has already checked the call against the
+ * tool's declared `inputSchema` by the time a gate can refuse it.)
+ */
+export declare function isRefusedRenderOutput(output: RenderOutputValue): output is {
+    outcome: 'refused';
+    refusal: PreGenerationRefusal;
+};
+/** Display modes an MCP Apps host can render a view in (ext-apps vocabulary). */
+export declare const mcpUiDisplayModeSchema: z.ZodEnum<{
+    inline: "inline";
+    fullscreen: "fullscreen";
+    pip: "pip";
+}>;
+/**
+ * The host-context projection the iframe-runtime observes and `ggui_consume`
+ * echoes (`client.hostContext`). Every field optional: a host that never
+ * reports one leaves it absent — absent ⇒ the documented default.
+ */
+export declare const hostContextProjectionSchema: z.ZodObject<{
+    availableDisplayModes: z.ZodOptional<z.ZodArray<z.ZodEnum<{
+        inline: "inline";
+        fullscreen: "fullscreen";
+        pip: "pip";
+    }>>>;
+    currentDisplayMode: z.ZodOptional<z.ZodEnum<{
+        inline: "inline";
+        fullscreen: "fullscreen";
+        pip: "pip";
+    }>>;
+    containerDimensions: z.ZodOptional<z.ZodObject<{
+        width: z.ZodOptional<z.ZodNumber>;
+        maxWidth: z.ZodOptional<z.ZodNumber>;
+        height: z.ZodOptional<z.ZodNumber>;
+        maxHeight: z.ZodOptional<z.ZodNumber>;
+    }, z.core.$strip>>;
+    platform: z.ZodOptional<z.ZodEnum<{
+        web: "web";
+        desktop: "desktop";
+        mobile: "mobile";
+    }>>;
+    deviceCapabilities: z.ZodOptional<z.ZodObject<{
+        touch: z.ZodOptional<z.ZodBoolean>;
+        hover: z.ZodOptional<z.ZodBoolean>;
+    }, z.core.$strip>>;
+    locale: z.ZodOptional<z.ZodString>;
+    timeZone: z.ZodOptional<z.ZodString>;
+}, z.core.$strip>;
+/** `ggui_consume`'s `client` slice — what the runtime observed about its host. */
+export declare const clientObservationsSchema: z.ZodObject<{
+    hostContext: z.ZodOptional<z.ZodObject<{
+        availableDisplayModes: z.ZodOptional<z.ZodArray<z.ZodEnum<{
+            inline: "inline";
+            fullscreen: "fullscreen";
+            pip: "pip";
+        }>>>;
+        currentDisplayMode: z.ZodOptional<z.ZodEnum<{
+            inline: "inline";
+            fullscreen: "fullscreen";
+            pip: "pip";
+        }>>;
+        containerDimensions: z.ZodOptional<z.ZodObject<{
+            width: z.ZodOptional<z.ZodNumber>;
+            maxWidth: z.ZodOptional<z.ZodNumber>;
+            height: z.ZodOptional<z.ZodNumber>;
+            maxHeight: z.ZodOptional<z.ZodNumber>;
+        }, z.core.$strip>>;
+        platform: z.ZodOptional<z.ZodEnum<{
+            web: "web";
+            desktop: "desktop";
+            mobile: "mobile";
+        }>>;
+        deviceCapabilities: z.ZodOptional<z.ZodObject<{
+            touch: z.ZodOptional<z.ZodBoolean>;
+            hover: z.ZodOptional<z.ZodBoolean>;
+        }, z.core.$strip>>;
+        locale: z.ZodOptional<z.ZodString>;
+        timeZone: z.ZodOptional<z.ZodString>;
+    }, z.core.$strip>>;
+}, z.core.$strip>;
+/** One row of `ggui_list_sessions` — eight closed keys; nothing passes through. */
+export declare const gguiSessionSummaryWireSchema: z.ZodObject<{
+    sessionId: z.ZodString;
+    hostName: z.ZodOptional<z.ZodString>;
+    hostSessionId: z.ZodOptional<z.ZodString>;
+    createdAt: z.ZodString;
+    lastActivityAt: z.ZodString;
+    status: z.ZodString;
+    wsToken: z.ZodOptional<z.ZodString>;
+    wsTokenExpiresAt: z.ZodOptional<z.ZodString>;
+}, z.core.$strip>;
+/**
+ * The two states a GguiSession is in on the wire — the pair the consume
+ * loop exits on (`expired`). Owned here (ggui#817 part C2); the type is
+ * derived, never a second list.
+ */
+export declare const gguiSessionStatusSchema: z.ZodEnum<{
+    active: "active";
+    expired: "expired";
+}>;
+/**
+ * One drained row of `ggui_consume` — a user action that reached the
+ * pipe (ggui#817 part C2). Closed on the wire: an unknown key is
+ * stripped at the transport, a missing key refuses the row at the seam
+ * (`parsePendingEnvelope`), so a malformed pipe entry never ships to an
+ * agent typed as a good one.
+ */
+export declare const consumeEventEntrySchema: z.ZodObject<{
+    type: z.ZodLiteral<"action">;
+    sessionId: z.ZodString;
+    intent: z.ZodString;
+    actionData: z.ZodNullable<z.ZodType<import("../index.js").JsonValue, unknown, z.core.$ZodTypeInternals<import("../index.js").JsonValue, unknown>>>;
+    uiContext: z.ZodType<import("../index.js").JsonObject, unknown, z.core.$ZodTypeInternals<import("../index.js").JsonObject, unknown>>;
+    actionId: z.ZodString;
+    firedAt: z.ZodString;
+}, z.core.$strip>;
+/**
+ * `ggui_consume`'s output — the drained rows, the session's state, and the
+ * client's observations when the host sent any (ggui#817 part C2). The
+ * handler registers `.shape`; `tools/list` therefore advertises the entry
+ * vocabulary and the status enum instead of a free-form record and a free
+ * string.
+ */
+export declare const gguiConsumeOutputSchema: z.ZodObject<{
+    events: z.ZodArray<z.ZodObject<{
+        type: z.ZodLiteral<"action">;
+        sessionId: z.ZodString;
+        intent: z.ZodString;
+        actionData: z.ZodNullable<z.ZodType<import("../index.js").JsonValue, unknown, z.core.$ZodTypeInternals<import("../index.js").JsonValue, unknown>>>;
+        uiContext: z.ZodType<import("../index.js").JsonObject, unknown, z.core.$ZodTypeInternals<import("../index.js").JsonObject, unknown>>;
+        actionId: z.ZodString;
+        firedAt: z.ZodString;
+    }, z.core.$strip>>;
+    status: z.ZodEnum<{
+        active: "active";
+        expired: "expired";
+    }>;
+    client: z.ZodOptional<z.ZodObject<{
+        hostContext: z.ZodOptional<z.ZodObject<{
+            availableDisplayModes: z.ZodOptional<z.ZodArray<z.ZodEnum<{
+                inline: "inline";
+                fullscreen: "fullscreen";
+                pip: "pip";
+            }>>>;
+            currentDisplayMode: z.ZodOptional<z.ZodEnum<{
+                inline: "inline";
+                fullscreen: "fullscreen";
+                pip: "pip";
+            }>>;
+            containerDimensions: z.ZodOptional<z.ZodObject<{
+                width: z.ZodOptional<z.ZodNumber>;
+                maxWidth: z.ZodOptional<z.ZodNumber>;
+                height: z.ZodOptional<z.ZodNumber>;
+                maxHeight: z.ZodOptional<z.ZodNumber>;
+            }, z.core.$strip>>;
+            platform: z.ZodOptional<z.ZodEnum<{
+                web: "web";
+                desktop: "desktop";
+                mobile: "mobile";
+            }>>;
+            deviceCapabilities: z.ZodOptional<z.ZodObject<{
+                touch: z.ZodOptional<z.ZodBoolean>;
+                hover: z.ZodOptional<z.ZodBoolean>;
+            }, z.core.$strip>>;
+            locale: z.ZodOptional<z.ZodString>;
+            timeZone: z.ZodOptional<z.ZodString>;
+        }, z.core.$strip>>;
+    }, z.core.$strip>>;
+}, z.core.$strip>;
+/** `ggui_list_sessions`' output — the closed summary rows (ggui#817 part C2). */
+export declare const gguiListSessionsOutputSchema: z.ZodObject<{
+    sessions: z.ZodArray<z.ZodObject<{
+        sessionId: z.ZodString;
+        hostName: z.ZodOptional<z.ZodString>;
+        hostSessionId: z.ZodOptional<z.ZodString>;
+        createdAt: z.ZodString;
+        lastActivityAt: z.ZodString;
+        status: z.ZodString;
+        wsToken: z.ZodOptional<z.ZodString>;
+        wsTokenExpiresAt: z.ZodOptional<z.ZodString>;
+    }, z.core.$strip>>;
+}, z.core.$strip>;
+/**
+ * `ggui_emit`'s output (ggui#817 part C2): `accepted` at the boundary, and
+ * `seq` when the server keeps a stream buffer — seq-aware implementations
+ * stamp and return it so replay cursors can be built from the ack.
+ */
+export declare const gguiEmitOutputSchema: z.ZodObject<{
+    accepted: z.ZodBoolean;
+    seq: z.ZodOptional<z.ZodNumber>;
+}, z.core.$strip>;
+/**
+ * `ggui_get_session`'s wire: the store row's six base fields plus the mount
+ * variant — for EVERY session. An MCP-Apps mount is locator-only on the
+ * render object, but its store row carries the base fields, so the
+ * projection reads them from the row and the wire never fails on that
+ * variant. The locator itself is not on this wire (MCP-Apps resources have
+ * their own paths).
+ * `contextSnapshot` rides when a component (`render`) mount's row has one —
+ * never on an mcpApps mount.
+ */
+export declare const gguiGetSessionOutputSchema: z.ZodObject<{
+    variant: z.ZodEnum<{
+        render: "render";
+        mcpApps: "mcpApps";
+    }>;
+    id: z.ZodString;
+    appId: z.ZodString;
+    eventSequence: z.ZodNumber;
+    createdAt: z.ZodNumber;
+    lastActivityAt: z.ZodNumber;
+    expiresAt: z.ZodNumber;
+    contextSnapshot: z.ZodOptional<z.ZodType<import("../index.js").JsonObject, unknown, z.core.$ZodTypeInternals<import("../index.js").JsonObject, unknown>>>;
+}, z.core.$strip>;
+/** The three sequential gates of `ggui_protocol_validate_blueprint`. */
+export declare const blueprintValidationTierSchema: z.ZodEnum<{
+    compile: "compile";
+    selfCheck: "selfCheck";
+    runtime: "runtime";
+}>;
+export declare const blueprintValidationIssueSchema: z.ZodObject<{
+    tier: z.ZodEnum<{
+        compile: "compile";
+        selfCheck: "selfCheck";
+        runtime: "runtime";
+    }>;
+    code: z.ZodString;
+    message: z.ZodString;
+    fix: z.ZodOptional<z.ZodString>;
+}, z.core.$strip>;
+/** `ggui_protocol_validate_blueprint`'s result envelope: `failedAt` names the tier that stopped, or null. */
+export declare const blueprintValidationResultSchema: z.ZodObject<{
+    valid: z.ZodBoolean;
+    failedAt: z.ZodNullable<z.ZodEnum<{
+        compile: "compile";
+        selfCheck: "selfCheck";
+        runtime: "runtime";
+    }>>;
+    errors: z.ZodArray<z.ZodObject<{
+        tier: z.ZodEnum<{
+            compile: "compile";
+            selfCheck: "selfCheck";
+            runtime: "runtime";
+        }>;
+        code: z.ZodString;
+        message: z.ZodString;
+        fix: z.ZodOptional<z.ZodString>;
+    }, z.core.$strip>>;
+    warnings: z.ZodArray<z.ZodObject<{
+        tier: z.ZodEnum<{
+            compile: "compile";
+            selfCheck: "selfCheck";
+            runtime: "runtime";
+        }>;
+        code: z.ZodString;
+        message: z.ZodString;
+        fix: z.ZodOptional<z.ZodString>;
+    }, z.core.$strip>>;
+}, z.core.$strip>;
+/** A provider row — what `ggui_list_featured_blueprints` returns per blueprint. */
+export declare const blueprintEntryWireSchema: z.ZodObject<{
+    id: z.ZodString;
+    name: z.ZodString;
+    description: z.ZodOptional<z.ZodString>;
+    source: z.ZodType<import("../index.js").BlueprintSource, unknown, z.core.$ZodTypeInternals<import("../index.js").BlueprintSource, unknown>>;
+    updatedAt: z.ZodString;
+    tags: z.ZodOptional<z.ZodArray<z.ZodString>>;
+}, z.core.$strip>;
+export declare const gguiListFeaturedBlueprintsOutputSchema: z.ZodObject<{
+    blueprints: z.ZodArray<z.ZodObject<{
+        id: z.ZodString;
+        name: z.ZodString;
+        description: z.ZodOptional<z.ZodString>;
+        source: z.ZodType<import("../index.js").BlueprintSource, unknown, z.core.$ZodTypeInternals<import("../index.js").BlueprintSource, unknown>>;
+        updatedAt: z.ZodString;
+        tags: z.ZodOptional<z.ZodArray<z.ZodString>>;
+    }, z.core.$strip>>;
+    total: z.ZodNumber;
+}, z.core.$strip>;
+/** One `ggui_search_blueprints` hit — a scored row plus the registry-only keys. */
+export declare const gguiSearchBlueprintsResultSchema: z.ZodObject<{
+    id: z.ZodString;
+    name: z.ZodString;
+    description: z.ZodString;
+    category: z.ZodString;
+    props: z.ZodArray<z.ZodObject<{
+        name: z.ZodString;
+        type: z.ZodString;
+        required: z.ZodBoolean;
+        description: z.ZodString;
+    }, z.core.$strip>>;
+    callbacks: z.ZodArray<z.ZodString>;
+    featured: z.ZodBoolean;
+    relevance: z.ZodLiteral<"match">;
+    score: z.ZodNumber;
+    origin: z.ZodOptional<z.ZodLiteral<"registry">>;
+    artifactId: z.ZodOptional<z.ZodString>;
+    version: z.ZodOptional<z.ZodString>;
+    mcpTools: z.ZodOptional<z.ZodArray<z.ZodObject<{
+        server: z.ZodOptional<z.ZodString>;
+        tool: z.ZodString;
+    }, z.core.$strip>>>;
+    scopeVerification: z.ZodOptional<z.ZodEnum<{
+        verified: "verified";
+        unverified: "unverified";
+    }>>;
+}, z.core.$strip>;
+export declare const gguiSearchBlueprintsOutputSchema: z.ZodObject<{
+    results: z.ZodArray<z.ZodObject<{
+        id: z.ZodString;
+        name: z.ZodString;
+        description: z.ZodString;
+        category: z.ZodString;
+        props: z.ZodArray<z.ZodObject<{
+            name: z.ZodString;
+            type: z.ZodString;
+            required: z.ZodBoolean;
+            description: z.ZodString;
+        }, z.core.$strip>>;
+        callbacks: z.ZodArray<z.ZodString>;
+        featured: z.ZodBoolean;
+        relevance: z.ZodLiteral<"match">;
+        score: z.ZodNumber;
+        origin: z.ZodOptional<z.ZodLiteral<"registry">>;
+        artifactId: z.ZodOptional<z.ZodString>;
+        version: z.ZodOptional<z.ZodString>;
+        mcpTools: z.ZodOptional<z.ZodArray<z.ZodObject<{
+            server: z.ZodOptional<z.ZodString>;
+            tool: z.ZodString;
+        }, z.core.$strip>>>;
+        scopeVerification: z.ZodOptional<z.ZodEnum<{
+            verified: "verified";
+            unverified: "unverified";
+        }>>;
+    }, z.core.$strip>>;
+    total: z.ZodNumber;
+    query: z.ZodString;
+    degradedSources: z.ZodOptional<z.ZodArray<z.ZodObject<{
+        source: z.ZodLiteral<"registry">;
+        reason: z.ZodEnum<{
+            timeout: "timeout";
+            unreachable: "unreachable";
+            invalid_response: "invalid_response";
+        }>;
+    }, z.core.$strip>>>;
+}, z.core.$strip>;
+export {};
 //# sourceMappingURL=mcp.d.ts.map