@ggui-ai/protocol 0.14.0 → 0.15.0

package/dist/envelope-adapters.d.ts

@@ -1,17 +1,4 @@
-/**
- * Envelope adapters — storage-side helpers for the consume pipe.
- *
- * `PendingEvent.envelope` carries the per-gesture {@link ConsumeEventEntry}
- * row written by `submit_action`'s `kind:"dispatch"` branch. Storage is
- * single-shaped (the same shape `ggui_consume` returns verbatim on drain).
- *
- * The only bounded adapter that lives here now is
- * {@link parsePendingEnvelope} — a shape-neutral reader for stored
- * `PendingEvent.envelope` values that may arrive as raw objects or as
- * JSON strings, depending on how the deployment's storage layer
- * serializes rows.
- */
-import type { ConsumeEventEntry } from './types/mcp';
+import type { ConsumeEventEntry } from './types/mcp.js';
 /**
  * Parse a {@link PendingEvent.envelope} that may arrive as either a raw
  * object or a JSON-stringified object, depending on how the

package/dist/envelope-adapters.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"envelope-adapters.d.ts","sourceRoot":"","sources":["../src/envelope-adapters.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AACH,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,aAAa,CAAC;AAErD;;;;;;;;GAQG;AACH,wBAAgB,oBAAoB,CAClC,MAAM,EAAE,iBAAiB,GAAG,MAAM,GACjC,iBAAiB,CAGnB"}
+{"version":3,"file":"envelope-adapters.d.ts","sourceRoot":"","sources":["../src/envelope-adapters.ts"],"names":[],"mappings":"AAcA,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,aAAa,CAAC;AAErD;;;;;;;;GAQG;AACH,wBAAgB,oBAAoB,CAClC,MAAM,EAAE,iBAAiB,GAAG,MAAM,GACjC,iBAAiB,CAKnB"}

package/dist/envelope-adapters.js

@@ -1,3 +1,17 @@
+/**
+ * Envelope adapters — storage-side helpers for the consume pipe.
+ *
+ * `PendingEvent.envelope` carries the per-gesture {@link ConsumeEventEntry}
+ * row written by `submit_action`'s `kind:"dispatch"` branch. Storage is
+ * single-shaped (the same shape `ggui_consume` returns verbatim on drain).
+ *
+ * The only bounded adapter that lives here now is
+ * {@link parsePendingEnvelope} — a shape-neutral reader for stored
+ * `PendingEvent.envelope` values that may arrive as raw objects or as
+ * JSON strings, depending on how the deployment's storage layer
+ * serializes rows.
+ */
+import { consumeEventEntrySchema } from './schemas/mcp.js';
 /**
  * Parse a {@link PendingEvent.envelope} that may arrive as either a raw
  * object or a JSON-stringified object, depending on how the
@@ -10,5 +24,7 @@
 export function parsePendingEnvelope(stored) {
     if (typeof stored !== 'string')
         return stored;
-    return JSON.parse(stored);
+    // Parsed, never cast (ggui#817 part C2): a malformed pipe entry refuses
+    // here, at the seam, instead of shipping to the agent typed as good.
+    return consumeEventEntrySchema.parse(JSON.parse(stored));
 }

package/dist/envelopes/render-refusal.d.ts

@@ -0,0 +1,49 @@
+/**
+ * SPEC §7.1's REFUSED arm as one primitive (ggui#803 leg 9).
+ *
+ * A render gate that refuses before generation answers with a tool
+ * RESULT — never a throw, never a JSON-RPC error — carrying four facts:
+ *
+ *   1. `isError: true` — the call did not render.
+ *   2. `content[0].text` = `<code>: <message> <fix>` — a courtesy line
+ *      for the model; the code LEADS so the state is visible without
+ *      parsing, but `structuredContent.refusal.code` is the mechanism.
+ *   3. `structuredContent` = `{ outcome: 'refused', refusal }` — the
+ *      refusal verbatim, the whole payload being
+ *      {@link refusedOutputSchema}.
+ *   4. No `_meta` — nothing was read, no handshake consumed, nothing
+ *      committed, so there is no identity to carry.
+ *
+ * Parties: every server that projects a pre-generation refusal — the
+ * shipping `ggui_render` handler and the protocol reference server
+ * both build the result HERE, so the facts have one source. Failure
+ * mode: a projection that drifts from these facts fails the
+ * conformance kit's `refusal-envelope` catalog; the violation is
+ * observed by the handler's and the reference server's conformance
+ * suites, which grade this function through each of them.
+ *
+ * The text deliberately shares nothing with a FAILED render's text:
+ * that one says the handshakeId "is consumed", which is false for a
+ * refusal — the same id is valid on a retry. The two texts are
+ * contradictory by construction and must never be one builder.
+ */
+import type { z } from 'zod';
+import type { PreGenerationRefusal, refusedOutputSchema } from '../schemas/mcp.js';
+/** The refused arm's `structuredContent` — derived from the schema, never restated. */
+export type RefusedRenderOutput = z.infer<typeof refusedOutputSchema>;
+/** The tool result a render gate answers a pre-generation refusal with. */
+export interface RenderRefusalResult {
+    readonly isError: true;
+    readonly content: readonly [{
+        readonly type: 'text';
+        readonly text: string;
+    }];
+    readonly structuredContent: RefusedRenderOutput;
+}
+/**
+ * Project a {@link PreGenerationRefusal} onto the §7.1 refused tool
+ * result. Pure and synchronous: the deterministic projection is the
+ * whole obligation.
+ */
+export declare function projectRenderRefusal(refusal: PreGenerationRefusal): RenderRefusalResult;
+//# sourceMappingURL=render-refusal.d.ts.map

package/dist/envelopes/render-refusal.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"render-refusal.d.ts","sourceRoot":"","sources":["../../src/envelopes/render-refusal.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AACH,OAAO,KAAK,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAE7B,OAAO,KAAK,EAAE,oBAAoB,EAAE,mBAAmB,EAAE,MAAM,mBAAmB,CAAC;AAEnF,uFAAuF;AACvF,MAAM,MAAM,mBAAmB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,mBAAmB,CAAC,CAAC;AAEtE,2EAA2E;AAC3E,MAAM,WAAW,mBAAmB;IAClC,QAAQ,CAAC,OAAO,EAAE,IAAI,CAAC;IACvB,QAAQ,CAAC,OAAO,EAAE,SAAS,CAAC;QAAE,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IAC9E,QAAQ,CAAC,iBAAiB,EAAE,mBAAmB,CAAC;CACjD;AAED;;;;GAIG;AACH,wBAAgB,oBAAoB,CAAC,OAAO,EAAE,oBAAoB,GAAG,mBAAmB,CAMvF"}

package/dist/envelopes/render-refusal.js

@@ -0,0 +1,12 @@
+/**
+ * Project a {@link PreGenerationRefusal} onto the §7.1 refused tool
+ * result. Pure and synchronous: the deterministic projection is the
+ * whole obligation.
+ */
+export function projectRenderRefusal(refusal) {
+    return {
+        isError: true,
+        content: [{ type: 'text', text: `${refusal.code}: ${refusal.message} ${refusal.fix}` }],
+        structuredContent: { outcome: 'refused', refusal },
+    };
+}

package/dist/gadgets/resolve-app-gadgets.d.ts

@@ -1,4 +1,4 @@
-import type { GadgetDescriptor } from '../types/data-contract';
+import type { GadgetDescriptor } from '../types/data-contract.js';
 /**
  * Resolve an app's effective gadget set from its three sources, in
  * ascending precedence: the first-party stdlib package is the

package/dist/gadgets/stdlib-gadgets.d.ts

@@ -1,4 +1,4 @@
-import type { GadgetDescriptor } from '../types/data-contract';
+import type { GadgetDescriptor } from '../types/data-contract.js';
 /**
  * The first-party `@ggui-ai/gadgets` package name. Used as
  * the default `package` for every entry in {@link STDLIB_GADGETS}
@@ -12,7 +12,7 @@ export declare const STDLIB_GADGETS_PACKAGE = "@ggui-ai/gadgets";
  * in `@ggui-ai/gadgets` asserts the two stay in sync, so a release-time
  * bump to the runtime package without updating this constant fails CI.
  */
-export declare const STDLIB_GADGETS_VERSION = "0.14.0";
+export declare const STDLIB_GADGETS_VERSION = "0.15.0";
 /**
  * v1 catalog of stdlib gadget descriptors. Every entry's
  * `package` defaults to {@link STDLIB_GADGETS_PACKAGE}; the

package/dist/gadgets/stdlib-gadgets.js

@@ -39,7 +39,7 @@ export const STDLIB_GADGETS_PACKAGE = '@ggui-ai/gadgets';
  * in `@ggui-ai/gadgets` asserts the two stay in sync, so a release-time
  * bump to the runtime package without updating this constant fails CI.
  */
-export const STDLIB_GADGETS_VERSION = '0.14.0';
+export const STDLIB_GADGETS_VERSION = '0.15.0';
 /**
  * v1 catalog of stdlib gadget descriptors. Every entry's
  * `package` defaults to {@link STDLIB_GADGETS_PACKAGE}; the

package/dist/index.d.ts

@@ -1,65 +1,69 @@
-export * from "./version";
-export * from "./types/auth";
-export * from "./types/events";
-export * from "./types/render";
-export * from "./types/ggui-session-event";
-export * from "./types/thread";
-export * from "./types/live-channel";
-export * from "./types/ui-generator";
-export * from "./types/mcp";
-export * from "./schemas/mcp";
-export * from "./schemas/render-input-envelope";
-export type { DeepReadonly } from "./types/readonly";
-export * from "./schemas/invoke";
-export * from "./schemas/data-contract";
-export * from "./schemas/app-theme";
-export { canonicalizeContracts, canonicalizeValue } from "./registry/canonicalize-contract";
-export { summarizeContract } from "./registry/summarize-contract";
-export { buildEnforcedPropsSchema, canonicalPropsSchemaBytes, classifyPropsSchemaProfile, GRAMMAR_SAFE_FORMATS, GRAMMAR_SAFE_KEYWORDS, type PropsSchemaProfile, } from "./validation/enforced-props-schema";
-export type { TextBlock, ToolUseBlock, ToolResultBlock, ContentBlock, InvokeEvent, InvokeErrorCode, InvokeTurn, } from "./types/invoke";
-export * from "./types/llm";
-export * from "./types/refusal-codes";
-export * from "./types/llm-route";
-export * from "./types/interface-context";
-export * from "./types/host-context";
-export * from "./types/lifecycle";
-export * from "./types/data-contract";
-export * from "./types/blueprint";
-export * from "./types/blueprint-source";
-export * from "./types/portable-blueprint";
-export * from "./schemas/blueprint";
-export * from "./types/handshake-suggestion";
-export * from "./schemas/handshake-suggestion";
-export * from "./schemas/ops-blueprint";
-export * from "./types/contract-inference";
-export * from "./types/gadget";
-export * from "./types/app-config";
+export * from "./version.js";
+export * from "./types/auth.js";
+export * from "./types/events.js";
+export * from "./types/render.js";
+export * from "./types/ggui-session-event.js";
+export * from "./types/thread.js";
+export * from "./types/live-channel.js";
+export * from "./types/ui-generator.js";
+export * from "./types/mcp.js";
+export * from "./schemas/mcp.js";
+export * from "./schemas/interface-context.js";
+export * from "./schemas/runtime-telemetry-limits.js";
+export * from "./schemas/public-env-key.js";
+export * from "./schemas/render-input-envelope.js";
+export type { DeepReadonly } from "./types/readonly.js";
+export * from "./schemas/invoke.js";
+export * from "./schemas/data-contract.js";
+export * from "./schemas/app-theme.js";
+export { canonicalizeContracts, canonicalizeValue } from "./registry/canonicalize-contract.js";
+export { summarizeContract } from "./registry/summarize-contract.js";
+export { buildEnforcedPropsSchema, canonicalPropsSchemaBytes, classifyPropsSchemaProfile, GRAMMAR_SAFE_FORMATS, GRAMMAR_SAFE_KEYWORDS, type PropsSchemaProfile, } from "./validation/enforced-props-schema.js";
+export type { TextBlock, ToolUseBlock, ToolResultBlock, ContentBlock, InvokeEvent, InvokeErrorCode, InvokeTurn, } from "./types/invoke.js";
+export * from "./types/llm.js";
+export * from "./types/refusal-codes.js";
+export * from "./types/llm-route.js";
+export * from "./types/interface-context.js";
+export * from "./types/host-context.js";
+export * from "./types/lifecycle.js";
+export * from "./types/data-contract.js";
+export * from "./types/blueprint.js";
+export * from "./types/blueprint-source.js";
+export * from "./types/portable-blueprint.js";
+export * from "./schemas/blueprint.js";
+export * from "./types/handshake-suggestion.js";
+export * from "./schemas/handshake-suggestion.js";
+export * from "./schemas/ops-blueprint.js";
+export * from "./types/contract-inference.js";
+export * from "./types/gadget.js";
+export * from "./types/app-config.js";
 export { composeOAuthUserId } from "./types/oauth-user-id.js";
-export * from "./iframe-bridge";
-export * from "./envelope-adapters";
-export * from "./envelopes/builders";
-export * from "./errors/version-mismatch";
-export * from "./errors/unknown-permission-name";
-export * from "./errors/resource-read";
-export * from "./validation/contract-validator";
-export * from "./validation/cross-references";
-export * from "./validation/is-record";
-export * from "./validation/hygiene-rules";
-export * from "./validation/lint-contract";
-export * from "./validation/name-invariants";
-export * from "./validation/schema-compat-invariants";
-export * from "./validation/schema-meta-validation";
-export * from "./validation/resolve-stream-channel";
-export * from "./validation/reserved-channels";
-export * from "./validation/sanitize-error";
-export * from "./validation/schema-subset";
-export * from "./validation/zod-to-json-schema";
-export * from "./validation/ui-security";
-export * from "./schema-learning/merge";
-export * from "./schema-learning/derive-contract";
-export * from "./screen-blueprints/index";
-export { GGUI_AGENT_SYSTEM_PROMPT } from "./recommended-prompts";
-export { STDLIB_GADGETS, STDLIB_GADGETS_PACKAGE, STDLIB_GADGETS_VERSION, STDLIB_GADGET_HOOKS, } from "./gadgets/stdlib-gadgets";
-export { resolveAppGadgets } from './gadgets/resolve-app-gadgets';
-export { filterDescriptorsToContract, gadgetIdentityKey, gadgetExportName, listContractGadgets, } from "./gadgets/resolve-contract-gadgets";
+export * from "./iframe-bridge.js";
+export * from "./envelope-adapters.js";
+export * from "./envelopes/builders.js";
+export * from "./envelopes/render-refusal.js";
+export * from "./errors/version-mismatch.js";
+export * from "./errors/unknown-permission-name.js";
+export * from "./errors/resource-read.js";
+export * from "./validation/contract-validator.js";
+export * from "./validation/cross-references.js";
+export * from "./validation/is-record.js";
+export * from "./validation/hygiene-rules.js";
+export * from "./validation/lint-contract.js";
+export * from "./validation/name-invariants.js";
+export * from "./validation/schema-compat-invariants.js";
+export * from "./validation/schema-meta-validation.js";
+export * from "./validation/resolve-stream-channel.js";
+export * from "./validation/reserved-channels.js";
+export * from "./validation/sanitize-error.js";
+export * from "./validation/schema-subset.js";
+export * from "./validation/zod-to-json-schema.js";
+export * from "./validation/ui-security.js";
+export * from "./schema-learning/merge.js";
+export * from "./schema-learning/derive-contract.js";
+export * from "./screen-blueprints/index.js";
+export { GGUI_AGENT_SYSTEM_PROMPT } from "./recommended-prompts.js";
+export { STDLIB_GADGETS, STDLIB_GADGETS_PACKAGE, STDLIB_GADGETS_VERSION, STDLIB_GADGET_HOOKS, } from "./gadgets/stdlib-gadgets.js";
+export { resolveAppGadgets } from './gadgets/resolve-app-gadgets.js';
+export { filterDescriptorsToContract, gadgetIdentityKey, gadgetExportName, listContractGadgets, } from "./gadgets/resolve-contract-gadgets.js";
 //# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,cAAc,WAAW,CAAC;AAC1B,cAAc,cAAc,CAAC;AAC7B,cAAc,gBAAgB,CAAC;AAC/B,cAAc,gBAAgB,CAAC;AAC/B,cAAc,4BAA4B,CAAC;AAC3C,cAAc,gBAAgB,CAAC;AAI/B,cAAc,sBAAsB,CAAC;AAOrC,cAAc,sBAAsB,CAAC;AACrC,cAAc,aAAa,CAAC;AAC5B,cAAc,eAAe,CAAC;AAC9B,cAAc,iCAAiC,CAAC;AAChD,YAAY,EAAE,YAAY,EAAE,MAAM,kBAAkB,CAAC;AACrD,cAAc,kBAAkB,CAAC;AACjC,cAAc,yBAAyB,CAAC;AAIxC,cAAc,qBAAqB,CAAC;AAIpC,OAAO,EAAE,qBAAqB,EAAE,iBAAiB,EAAE,MAAM,kCAAkC,CAAC;AAK5F,OAAO,EAAE,iBAAiB,EAAE,MAAM,+BAA+B,CAAC;AAOlE,OAAO,EACL,wBAAwB,EACxB,yBAAyB,EACzB,0BAA0B,EAC1B,oBAAoB,EACpB,qBAAqB,EACrB,KAAK,kBAAkB,GACxB,MAAM,oCAAoC,CAAC;AAM5C,YAAY,EAEV,SAAS,EACT,YAAY,EACZ,eAAe,EACf,YAAY,EAEZ,WAAW,EACX,eAAe,EAEf,UAAU,GACX,MAAM,gBAAgB,CAAC;AACxB,cAAc,aAAa,CAAC;AAK5B,cAAc,uBAAuB,CAAC;AACtC,cAAc,mBAAmB,CAAC;AAClC,cAAc,2BAA2B,CAAC;AAC1C,cAAc,sBAAsB,CAAC;AACrC,cAAc,mBAAmB,CAAC;AAClC,cAAc,uBAAuB,CAAC;AACtC,cAAc,mBAAmB,CAAC;AAClC,cAAc,0BAA0B,CAAC;AACzC,cAAc,4BAA4B,CAAC;AAC3C,cAAc,qBAAqB,CAAC;AACpC,cAAc,8BAA8B,CAAC;AAC7C,cAAc,gCAAgC,CAAC;AAI/C,cAAc,yBAAyB,CAAC;AACxC,cAAc,4BAA4B,CAAC;AAC3C,cAAc,gBAAgB,CAAC;AAC/B,cAAc,oBAAoB,CAAC;AAKnC,OAAO,EAAE,kBAAkB,EAAE,MAAM,0BAA0B,CAAC;AAC9D,cAAc,iBAAiB,CAAC;AAChC,cAAc,qBAAqB,CAAC;AACpC,cAAc,sBAAsB,CAAC;AACrC,cAAc,2BAA2B,CAAC;AAC1C,cAAc,kCAAkC,CAAC;AAGjD,cAAc,wBAAwB,CAAC;AACvC,cAAc,iCAAiC,CAAC;AAChD,cAAc,+BAA+B,CAAC;AAC9C,cAAc,wBAAwB,CAAC;AACvC,cAAc,4BAA4B,CAAC;AAC3C,cAAc,4BAA4B,CAAC;AAC3C,cAAc,8BAA8B,CAAC;AAC7C,cAAc,uCAAuC,CAAC;AACtD,cAAc,qCAAqC,CAAC;AACpD,cAAc,qCAAqC,CAAC;AACpD,cAAc,gCAAgC,CAAC;AAC/C,cAAc,6BAA6B,CAAC;AAC5C,cAAc,4BAA4B,CAAC;AAC3C,cAAc,iCAAiC,CAAC;AAChD,cAAc,0BAA0B,CAAC;AACzC,cAAc,yBAAyB,CAAC;AACxC,cAAc,mCAAmC,CAAC;AAClD,cAAc,2BAA2B,CAAC;AAC1C,OAAO,EAAE,wBAAwB,EAAE,MAAM,uBAAuB,CAAC;AACjE,OAAO,EACL,cAAc,EACd,sBAAsB,EACtB,sBAAsB,EACtB,mBAAmB,GACpB,MAAM,0BAA0B,CAAC;AAClC,OAAO,EAAE,iBAAiB,EAAE,MAAM,+BAA+B,CAAC;AAClE,OAAO,EACL,2BAA2B,EAC3B,iBAAiB,EACjB,gBAAgB,EAChB,mBAAmB,GACpB,MAAM,oCAAoC,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,cAAc,WAAW,CAAC;AAC1B,cAAc,cAAc,CAAC;AAC7B,cAAc,gBAAgB,CAAC;AAC/B,cAAc,gBAAgB,CAAC;AAC/B,cAAc,4BAA4B,CAAC;AAC3C,cAAc,gBAAgB,CAAC;AAI/B,cAAc,sBAAsB,CAAC;AAOrC,cAAc,sBAAsB,CAAC;AACrC,cAAc,aAAa,CAAC;AAC5B,cAAc,eAAe,CAAC;AAC9B,cAAc,6BAA6B,CAAC;AAC5C,cAAc,oCAAoC,CAAC;AACnD,cAAc,0BAA0B,CAAC;AACzC,cAAc,iCAAiC,CAAC;AAChD,YAAY,EAAE,YAAY,EAAE,MAAM,kBAAkB,CAAC;AACrD,cAAc,kBAAkB,CAAC;AACjC,cAAc,yBAAyB,CAAC;AAIxC,cAAc,qBAAqB,CAAC;AAIpC,OAAO,EAAE,qBAAqB,EAAE,iBAAiB,EAAE,MAAM,kCAAkC,CAAC;AAK5F,OAAO,EAAE,iBAAiB,EAAE,MAAM,+BAA+B,CAAC;AAOlE,OAAO,EACL,wBAAwB,EACxB,yBAAyB,EACzB,0BAA0B,EAC1B,oBAAoB,EACpB,qBAAqB,EACrB,KAAK,kBAAkB,GACxB,MAAM,oCAAoC,CAAC;AAM5C,YAAY,EAEV,SAAS,EACT,YAAY,EACZ,eAAe,EACf,YAAY,EAEZ,WAAW,EACX,eAAe,EAEf,UAAU,GACX,MAAM,gBAAgB,CAAC;AACxB,cAAc,aAAa,CAAC;AAK5B,cAAc,uBAAuB,CAAC;AACtC,cAAc,mBAAmB,CAAC;AAClC,cAAc,2BAA2B,CAAC;AAC1C,cAAc,sBAAsB,CAAC;AACrC,cAAc,mBAAmB,CAAC;AAClC,cAAc,uBAAuB,CAAC;AACtC,cAAc,mBAAmB,CAAC;AAClC,cAAc,0BAA0B,CAAC;AACzC,cAAc,4BAA4B,CAAC;AAC3C,cAAc,qBAAqB,CAAC;AACpC,cAAc,8BAA8B,CAAC;AAC7C,cAAc,gCAAgC,CAAC;AAI/C,cAAc,yBAAyB,CAAC;AACxC,cAAc,4BAA4B,CAAC;AAC3C,cAAc,gBAAgB,CAAC;AAC/B,cAAc,oBAAoB,CAAC;AAKnC,OAAO,EAAE,kBAAkB,EAAE,MAAM,0BAA0B,CAAC;AAC9D,cAAc,iBAAiB,CAAC;AAChC,cAAc,qBAAqB,CAAC;AACpC,cAAc,sBAAsB,CAAC;AACrC,cAAc,4BAA4B,CAAC;AAC3C,cAAc,2BAA2B,CAAC;AAC1C,cAAc,kCAAkC,CAAC;AAGjD,cAAc,wBAAwB,CAAC;AACvC,cAAc,iCAAiC,CAAC;AAChD,cAAc,+BAA+B,CAAC;AAC9C,cAAc,wBAAwB,CAAC;AACvC,cAAc,4BAA4B,CAAC;AAC3C,cAAc,4BAA4B,CAAC;AAC3C,cAAc,8BAA8B,CAAC;AAC7C,cAAc,uCAAuC,CAAC;AACtD,cAAc,qCAAqC,CAAC;AACpD,cAAc,qCAAqC,CAAC;AACpD,cAAc,gCAAgC,CAAC;AAC/C,cAAc,6BAA6B,CAAC;AAC5C,cAAc,4BAA4B,CAAC;AAC3C,cAAc,iCAAiC,CAAC;AAChD,cAAc,0BAA0B,CAAC;AACzC,cAAc,yBAAyB,CAAC;AACxC,cAAc,mCAAmC,CAAC;AAClD,cAAc,2BAA2B,CAAC;AAC1C,OAAO,EAAE,wBAAwB,EAAE,MAAM,uBAAuB,CAAC;AACjE,OAAO,EACL,cAAc,EACd,sBAAsB,EACtB,sBAAsB,EACtB,mBAAmB,GACpB,MAAM,0BAA0B,CAAC;AAClC,OAAO,EAAE,iBAAiB,EAAE,MAAM,+BAA+B,CAAC;AAClE,OAAO,EACL,2BAA2B,EAC3B,iBAAiB,EACjB,gBAAgB,EAChB,mBAAmB,GACpB,MAAM,oCAAoC,CAAC"}

package/dist/index.js

@@ -17,6 +17,9 @@ export * from "./types/live-channel.js";
 export * from "./types/ui-generator.js";
 export * from "./types/mcp.js";
 export * from "./schemas/mcp.js";
+export * from "./schemas/interface-context.js";
+export * from "./schemas/runtime-telemetry-limits.js";
+export * from "./schemas/public-env-key.js";
 export * from "./schemas/render-input-envelope.js";
 export * from "./schemas/invoke.js";
 export * from "./schemas/data-contract.js";
@@ -72,6 +75,7 @@ export { composeOAuthUserId } from "./types/oauth-user-id.js";
 export * from "./iframe-bridge.js";
 export * from "./envelope-adapters.js";
 export * from "./envelopes/builders.js";
+export * from "./envelopes/render-refusal.js";
 export * from "./errors/version-mismatch.js";
 export * from "./errors/unknown-permission-name.js";
 // Typed `resources/read` failures → JSON-RPC. The single exit for every

package/dist/integrations/mcp-apps.d.ts

@@ -30,8 +30,8 @@
 import type { JsonObject, JsonSchema, JsonValue } from '../types/data-contract.js';
 import { type AppTheme } from '../schemas/app-theme.js';
 import type { z } from 'zod';
-import type { gguiSessionSummaryWireSchema } from '../schemas/mcp';
-import type { DeepReadonly } from '../types/readonly';
+import type { gguiSessionSummaryWireSchema } from '../schemas/mcp.js';
+import type { DeepReadonly } from '../types/readonly.js';
 /**
  * MCP capability name ggui servers advertise in their MCP `initialize`
  * response capabilities when they implement the MCP Apps outbound path.

package/dist/schemas/blueprint.d.ts

@@ -5,8 +5,8 @@
  * here is `z.ZodType<Blueprint>` so any drift fails compile.
  */
 import { z } from 'zod';
-import type { AppBlueprintSearchConfig, Blueprint, BlueprintVariance } from '../types/blueprint';
-import type { BlueprintSource, CuratedBlueprintSource, LlmBlueprintSource, UserBlueprintSource } from '../types/blueprint-source';
+import type { AppBlueprintSearchConfig, Blueprint, BlueprintVariance } from '../types/blueprint.js';
+import type { BlueprintSource, CuratedBlueprintSource, LlmBlueprintSource, UserBlueprintSource } from '../types/blueprint-source.js';
 /**
  * Zod mirror of {@link LlmBlueprintSource} — the engine-generated arm.
  * Both provenance fields are REQUIRED: every generation mint site has

package/dist/schemas/data-contract.d.ts

@@ -51,7 +51,7 @@
  * just to accept the contract and pass it to the generator.
  */
 import { z } from 'zod';
-import type { DataContract, JsonValue, JsonSchema, JsonObject } from '../types/data-contract';
+import type { DataContract, JsonValue, JsonSchema, JsonObject } from '../types/data-contract.js';
 /**
  * Recursive {@link JsonValue} — string | number | boolean | null |
  * array | object. All fields on contract entries that carry default
@@ -211,26 +211,6 @@ export declare const agentCapabilitiesSpecSchema: z.ZodObject<{
         }, z.core.$strict>>;
     }, z.core.$strict>>;
 }, z.core.$loose>;
-/**
- * `App.publicEnv` key regex.
- *
- * Each key in `App.publicEnv` MUST match this pattern. The prefix is
- * the **security boundary** — operators can't accidentally stash
- * sensitive credentials under arbitrary names, and downstream consumers
- * (render gate, bootstrap projection, iframe shim) can rely on the
- * naming convention to mean "public-by-design".
- *
- * Rule: `GGUI_PUBLIC_APP_` prefix, then uppercase letters / digits /
- * underscores, at least one char after the prefix.
- *
- * `GGUI_PUBLIC_USER_*` keys are RESERVED for a future per-user
- * channel. The current regex rejects them so App-side config can't
- * pre-emptively use the namespace.
- *
- * Hoisted above `gadgetDescriptorSchema` so the wrapper's `requires`
- * array can reference it at schema-construction time (TDZ-safe).
- */
-export declare const PUBLIC_ENV_APP_KEY_RE: RegExp;
 /**
  * Single source of truth for the `requires[]` field shape on gadget
  * descriptors. The wire-permissive `gadgetDescriptorSchema`, the
@@ -244,7 +224,7 @@ export declare const PUBLIC_ENV_APP_KEY_RE: RegExp;
  * that declare a `requires` key must have a corresponding App-side
  * publicEnv value at render time (gate: `assertPublicEnvSatisfied`).
  */
-export declare const gadgetRequiresSchema: z.ZodReadonly<z.ZodArray<z.ZodString>>;
+export declare const gadgetRequiresSchema: z.ZodArray<z.ZodString>;
 /**
  * SRI hash format for gadget bundles. Registry install writes
  * `bundleSri` in this shape; iframe-runtime emits it verbatim into
@@ -367,7 +347,7 @@ export declare function bundleHostScheme(host: string): 'http' | 'https';
  * needs the grammars and which this module imports
  * `KNOWN_PERMISSION_NAMES` from).
  */
-export { HOOK_NAME_RE, COMPONENT_NAME_RE } from './gadget-name-grammar';
+export { HOOK_NAME_RE, COMPONENT_NAME_RE } from './gadget-name-grammar.js';
 /**
  * Wire-permissive {@link GadgetExport} schema — a union of a
  * hook-export shape (carries `hook`) and a component-export shape
@@ -475,8 +455,8 @@ export declare const gadgetDescriptorSchema: z.ZodObject<{
     bundleHost: z.ZodOptional<z.ZodString>;
     bundleSri: z.ZodOptional<z.ZodString>;
     styleUrl: z.ZodOptional<z.ZodURL>;
-    connect: z.ZodOptional<z.ZodReadonly<z.ZodArray<z.ZodURL>>>;
-    requires: z.ZodOptional<z.ZodReadonly<z.ZodArray<z.ZodString>>>;
+    connect: z.ZodOptional<z.ZodArray<z.ZodURL>>;
+    requires: z.ZodOptional<z.ZodArray<z.ZodString>>;
     typesUrl: z.ZodOptional<z.ZodURL>;
     typesSri: z.ZodOptional<z.ZodString>;
 }, z.core.$strict>;
@@ -550,8 +530,8 @@ export declare const strictGadgetDescriptorSchema: z.ZodObject<{
     bundleHost: z.ZodOptional<z.ZodString>;
     bundleSri: z.ZodOptional<z.ZodString>;
     styleUrl: z.ZodOptional<z.ZodURL>;
-    connect: z.ZodOptional<z.ZodReadonly<z.ZodArray<z.ZodURL>>>;
-    requires: z.ZodOptional<z.ZodReadonly<z.ZodArray<z.ZodString>>>;
+    connect: z.ZodOptional<z.ZodArray<z.ZodURL>>;
+    requires: z.ZodOptional<z.ZodArray<z.ZodString>>;
     typesUrl: z.ZodOptional<z.ZodURL>;
     typesSri: z.ZodOptional<z.ZodString>;
 }, z.core.$strict>;
@@ -640,8 +620,8 @@ export declare const registeredGadgetDescriptorSchema: z.ZodObject<{
     bundleHost: z.ZodOptional<z.ZodString>;
     bundleSri: z.ZodOptional<z.ZodString>;
     styleUrl: z.ZodOptional<z.ZodURL>;
-    connect: z.ZodOptional<z.ZodReadonly<z.ZodArray<z.ZodURL>>>;
-    requires: z.ZodOptional<z.ZodReadonly<z.ZodArray<z.ZodString>>>;
+    connect: z.ZodOptional<z.ZodArray<z.ZodURL>>;
+    requires: z.ZodOptional<z.ZodArray<z.ZodString>>;
     typesUrl: z.ZodOptional<z.ZodURL>;
     typesSri: z.ZodOptional<z.ZodString>;
 }, z.core.$strict>;
@@ -718,7 +698,7 @@ export declare const clientCapabilitiesSpecSchema: z.ZodObject<{
  *   - Defensive re-validation in the iframe-runtime slice-meta
  *     extractors (`parseMetaFromGlobal`, `parseMetaFromToolResult`).
  */
-export declare const appPublicEnvSchema: z.ZodReadonly<z.ZodRecord<z.ZodString, z.ZodString>>;
+export declare const appPublicEnvSchema: z.ZodRecord<z.ZodString, z.ZodString>;
 /**
  * {@link DataContract} — the unified four-spec contract surface
  * agents author on `story.contract` and that the generator

package/dist/schemas/data-contract.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"data-contract.d.ts","sourceRoot":"","sources":["../../src/schemas/data-contract.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAmDG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAIxB,OAAO,KAAK,EACV,YAAY,EACZ,SAAS,EACT,UAAU,EACV,UAAU,EACX,MAAM,wBAAwB,CAAC;AAEhC;;;;GAIG;AACH,eAAO,MAAM,eAAe,EAAE,CAAC,CAAC,OAAO,CAAC,SAAS,CAYhD,CAAC;AAEF,0EAA0E;AAC1E,eAAO,MAAM,gBAAgB,EAAE,CAAC,CAAC,OAAO,CAAC,UAAU,CAAyC,CAAC;AAmB7F,eAAO,MAAM,gBAAgB,EAAE,CAAC,CAAC,OAAO,CAAC,UAAU,CA2BlD,CAAC;AAEF;;;;;;;GAOG;AACH,eAAO,MAAM,eAAe;;;;;;;kBASjB,CAAC;AAEZ,sFAAsF;AACtF,eAAO,MAAM,eAAe;;;;;;;;;;kBAKjB,CAAC;AAEZ;;;;;;;;;;GAUG;AACH,eAAO,MAAM,iBAAiB;;;;;;;;kBAUnB,CAAC;AAEZ,6DAA6D;AAC7D,eAAO,MAAM,gBAAgB;;;;;;;;mBAA0C,CAAC;AAExE,iFAAiF;AACjF,eAAO,MAAM,wBAAwB;;;;;;;;;;;;;;;;;;kBAgB1B,CAAC;AAEZ,uEAAuE;AACvE,eAAO,MAAM,gBAAgB;;;;;;;;;;;;;;;;;;mBAAiD,CAAC;AAE/E,yEAAyE;AACzE,eAAO,MAAM,kBAAkB;;;;;;kBAQpB,CAAC;AAEZ,+DAA+D;AAC/D,eAAO,MAAM,iBAAiB;;;;;;mBAA2C,CAAC;AAE1E,sFAAsF;AACtF,eAAO,MAAM,oBAAoB;;;;;;;;;;;;;;;kBAiBtB,CAAC;AAEZ,qEAAqE;AACrE,eAAO,MAAM,2BAA2B;;;;;;;;;;;;;;;;;iBAIxB,CAAC;AAEjB;;;;;;;;;;;;;;;;;;GAkBG;AACH,eAAO,MAAM,qBAAqB,QAAiC,CAAC;AAEpE;;;;;;;;;;;;GAYG;AACH,eAAO,MAAM,oBAAoB,wCAEpB,CAAC;AAEd;;;;;;;;;;;;;;;;GAgBG;AACH,eAAO,MAAM,aAAa,QAA8B,CAAC;AAEzD;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,eAAO,MAAM,mBAAmB,QACsB,CAAC;AAEvD;;;;;;;;;;;;;;GAcG;AACH,eAAO,MAAM,aAAa,QAAyC,CAAC;AAEpE;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,eAAO,MAAM,cAAc,QAAyB,CAAC;AAErD;;;;;;GAMG;AACH,eAAO,MAAM,mBAAmB,qBAAqB,CAAC;AAEtD;;;;;;;;;;;;;;;;;GAiBG;AACH,eAAO,MAAM,gBAAgB,QAAiD,CAAC;AAE/E;;;;;;GAMG;AACH,wBAAgB,gBAAgB,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,GAAG,OAAO,CAE/D;AAED;;;;;;;;GAQG;AACH,OAAO,EAAE,YAAY,EAAE,iBAAiB,EAAE,MAAM,uBAAuB,CAAC;AAwExE;;;;;;;;GAQG;AACH,eAAO,MAAM,kBAAkB;;;;;;;;;;;;;;oBAa7B,CAAC;AAEH;;;;GAIG;AACH,eAAO,MAAM,wBAAwB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;oBAanC,CAAC;AAEH;;;;;;GAMG;AACH,eAAO,MAAM,sBAAsB;;;;;;;;;;;;;;;;;;;;;;;;;;kBAKxB,CAAC;AAEZ;;;;;;;;;;;;;GAaG;AACH,eAAO,MAAM,4BAA4B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;kBAK9B,CAAC;AAEZ;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AACH,eAAO,MAAM,gCAAgC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;kBAU1C,CAAC;AAQJ;;;;;;;;;;;;;;;;;GAiBG;AACH,eAAO,MAAM,qBAAqB;;;kBAKvB,CAAC;AAEZ;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,sBAAsB;;;mBAa/B,CAAC;AAEL;;;;;;;;;;;;;;;GAeG;AACH,eAAO,MAAM,4BAA4B;;;;;kBAO9B,CAAC;AAEZ;;;;;;;;;;;;GAYG;AACH,eAAO,MAAM,kBAAkB,sDAElB,CAAC;AAEd;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AACH;;;;;;;GAOG;AACH,eAAO,MAAM,wBAAwB,QAQa,CAAC;AAEnD;;;;;GAKG;AACH,eAAO,MAAM,6BAA6B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAehC,CAAC;AAEX,eAAO,MAAM,kBAAkB,EAAE,CAAC,CAAC,OAAO,CAAC,YAAY,CAiCZ,CAAC"}
+{"version":3,"file":"data-contract.d.ts","sourceRoot":"","sources":["../../src/schemas/data-contract.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAmDG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAMxB,OAAO,KAAK,EACV,YAAY,EACZ,SAAS,EACT,UAAU,EACV,UAAU,EACX,MAAM,wBAAwB,CAAC;AAEhC;;;;GAIG;AACH,eAAO,MAAM,eAAe,EAAE,CAAC,CAAC,OAAO,CAAC,SAAS,CAYhD,CAAC;AAEF,0EAA0E;AAC1E,eAAO,MAAM,gBAAgB,EAAE,CAAC,CAAC,OAAO,CAAC,UAAU,CAAyC,CAAC;AAmB7F,eAAO,MAAM,gBAAgB,EAAE,CAAC,CAAC,OAAO,CAAC,UAAU,CA2BlD,CAAC;AAEF;;;;;;;GAOG;AACH,eAAO,MAAM,eAAe;;;;;;;kBASjB,CAAC;AAEZ,sFAAsF;AACtF,eAAO,MAAM,eAAe;;;;;;;;;;kBAKjB,CAAC;AAEZ;;;;;;;;;;GAUG;AACH,eAAO,MAAM,iBAAiB;;;;;;;;kBAUnB,CAAC;AAEZ,6DAA6D;AAC7D,eAAO,MAAM,gBAAgB;;;;;;;;mBAA0C,CAAC;AAExE,iFAAiF;AACjF,eAAO,MAAM,wBAAwB;;;;;;;;;;;;;;;;;;kBAgB1B,CAAC;AAEZ,uEAAuE;AACvE,eAAO,MAAM,gBAAgB;;;;;;;;;;;;;;;;;;mBAAiD,CAAC;AAE/E,yEAAyE;AACzE,eAAO,MAAM,kBAAkB;;;;;;kBAQpB,CAAC;AAEZ,+DAA+D;AAC/D,eAAO,MAAM,iBAAiB;;;;;;mBAA2C,CAAC;AAE1E,sFAAsF;AACtF,eAAO,MAAM,oBAAoB;;;;;;;;;;;;;;;kBAiBtB,CAAC;AAEZ,qEAAqE;AACrE,eAAO,MAAM,2BAA2B;;;;;;;;;;;;;;;;;iBAIxB,CAAC;AAGjB;;;;;;;;;;;;GAYG;AACH,eAAO,MAAM,oBAAoB,yBAAmD,CAAC;AAErF;;;;;;;;;;;;;;;;GAgBG;AACH,eAAO,MAAM,aAAa,QAA8B,CAAC;AAEzD;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,eAAO,MAAM,mBAAmB,QACsB,CAAC;AAEvD;;;;;;;;;;;;;;GAcG;AACH,eAAO,MAAM,aAAa,QAAyC,CAAC;AAEpE;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,eAAO,MAAM,cAAc,QAAyB,CAAC;AAErD;;;;;;GAMG;AACH,eAAO,MAAM,mBAAmB,qBAAqB,CAAC;AAEtD;;;;;;;;;;;;;;;;;GAiBG;AACH,eAAO,MAAM,gBAAgB,QAAiD,CAAC;AAE/E;;;;;;GAMG;AACH,wBAAgB,gBAAgB,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,GAAG,OAAO,CAE/D;AAED;;;;;;;;GAQG;AACH,OAAO,EAAE,YAAY,EAAE,iBAAiB,EAAE,MAAM,uBAAuB,CAAC;AAwExE;;;;;;;;GAQG;AACH,eAAO,MAAM,kBAAkB;;;;;;;;;;;;;;oBAa7B,CAAC;AAEH;;;;GAIG;AACH,eAAO,MAAM,wBAAwB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;oBAanC,CAAC;AAEH;;;;;;GAMG;AACH,eAAO,MAAM,sBAAsB;;;;;;;;;;;;;;;;;;;;;;;;;;kBAKxB,CAAC;AAEZ;;;;;;;;;;;;;GAaG;AACH,eAAO,MAAM,4BAA4B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;kBAK9B,CAAC;AAEZ;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AACH,eAAO,MAAM,gCAAgC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;kBAU1C,CAAC;AAQJ;;;;;;;;;;;;;;;;;GAiBG;AACH,eAAO,MAAM,qBAAqB;;;kBAKvB,CAAC;AAEZ;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,sBAAsB;;;mBAa/B,CAAC;AAEL;;;;;;;;;;;;;;;GAeG;AACH,eAAO,MAAM,4BAA4B;;;;;kBAO9B,CAAC;AAEZ;;;;;;;;;;;;GAYG;AACH,eAAO,MAAM,kBAAkB,uCAAgE,CAAC;AAEhG;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AACH;;;;;;;GAOG;AACH,eAAO,MAAM,wBAAwB,QAQa,CAAC;AAEnD;;;;;GAKG;AACH,eAAO,MAAM,6BAA6B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAehC,CAAC;AAEX,eAAO,MAAM,kBAAkB,EAAE,CAAC,CAAC,OAAO,CAAC,YAAY,CAiCZ,CAAC"}

package/dist/schemas/data-contract.js

@@ -51,6 +51,7 @@
  * just to accept the contract and pass it to the generator.
  */
 import { z } from 'zod';
+import { PUBLIC_ENV_APP_KEY_RE } from './public-env-key.js';
 import { KNOWN_PERMISSION_NAMES } from '../validation/hygiene-rules.js';
 import { STDLIB_GADGETS_PACKAGE } from '../gadgets/stdlib-gadgets.js';
 import { COMPONENT_NAME_RE, HOOK_NAME_RE } from './gadget-name-grammar.js';
@@ -220,26 +221,6 @@ export const agentCapabilitiesSpecSchema = z
     tools: z.record(z.string(), agentToolEntrySchema),
 })
     .passthrough();
-/**
- * `App.publicEnv` key regex.
- *
- * Each key in `App.publicEnv` MUST match this pattern. The prefix is
- * the **security boundary** — operators can't accidentally stash
- * sensitive credentials under arbitrary names, and downstream consumers
- * (render gate, bootstrap projection, iframe shim) can rely on the
- * naming convention to mean "public-by-design".
- *
- * Rule: `GGUI_PUBLIC_APP_` prefix, then uppercase letters / digits /
- * underscores, at least one char after the prefix.
- *
- * `GGUI_PUBLIC_USER_*` keys are RESERVED for a future per-user
- * channel. The current regex rejects them so App-side config can't
- * pre-emptively use the namespace.
- *
- * Hoisted above `gadgetDescriptorSchema` so the wrapper's `requires`
- * array can reference it at schema-construction time (TDZ-safe).
- */
-export const PUBLIC_ENV_APP_KEY_RE = /^GGUI_PUBLIC_APP_[A-Z0-9_]+$/;
 /**
  * Single source of truth for the `requires[]` field shape on gadget
  * descriptors. The wire-permissive `gadgetDescriptorSchema`, the
@@ -253,9 +234,7 @@ export const PUBLIC_ENV_APP_KEY_RE = /^GGUI_PUBLIC_APP_[A-Z0-9_]+$/;
  * that declare a `requires` key must have a corresponding App-side
  * publicEnv value at render time (gate: `assertPublicEnvSatisfied`).
  */
-export const gadgetRequiresSchema = z
-    .array(z.string().regex(PUBLIC_ENV_APP_KEY_RE))
-    .readonly();
+export const gadgetRequiresSchema = z.array(z.string().regex(PUBLIC_ENV_APP_KEY_RE));
 /**
  * SRI hash format for gadget bundles. Registry install writes
  * `bundleSri` in this shape; iframe-runtime emits it verbatim into
@@ -434,7 +413,7 @@ const basePackageFieldsShape = {
     bundleSri: z.string().regex(BUNDLE_SRI_RE).optional(),
     styleUrl: z.url().optional(),
     // CSP `connect-src` feed — full URL shape on every entry.
-    connect: z.array(z.url()).readonly().optional(),
+    connect: z.array(z.url()).optional(),
     // Shared `gadgetRequiresSchema`.
     requires: gadgetRequiresSchema.optional(),
     // HTTPS URL of the package's `.d.ts`. The handler fetches it at
@@ -640,9 +619,7 @@ export const clientCapabilitiesSpecSchema = z
  *   - Defensive re-validation in the iframe-runtime slice-meta
  *     extractors (`parseMetaFromGlobal`, `parseMetaFromToolResult`).
  */
-export const appPublicEnvSchema = z
-    .record(z.string().regex(PUBLIC_ENV_APP_KEY_RE), z.string())
-    .readonly();
+export const appPublicEnvSchema = z.record(z.string().regex(PUBLIC_ENV_APP_KEY_RE), z.string());
 /**
  * {@link DataContract} — the unified four-spec contract surface
  * agents author on `story.contract` and that the generator

package/dist/schemas/interface-context.d.ts

@@ -0,0 +1,44 @@
+/**
+ * Interface-context schema — the client's viewport/platform snapshot every
+ * handshake and every `InvokeEvent` carries. Its own module (ggui#819) so
+ * the browser entry (`@ggui-ai/protocol/wire`) reaches it without the
+ * tool schemas that used to share its file.
+ */
+import { z } from 'zod';
+export declare const viewportSchema: z.ZodObject<{
+    width: z.ZodNumber;
+    height: z.ZodNumber;
+}, z.core.$strip>;
+export declare const interfaceContextSchema: z.ZodObject<{
+    viewport: z.ZodObject<{
+        width: z.ZodNumber;
+        height: z.ZodNumber;
+    }, z.core.$strip>;
+    platform: z.ZodEnum<{
+        web: "web";
+        desktop: "desktop";
+        mobile: "mobile";
+    }>;
+    deviceType: z.ZodEnum<{
+        desktop: "desktop";
+        tablet: "tablet";
+        phone: "phone";
+    }>;
+    orientation: z.ZodEnum<{
+        portrait: "portrait";
+        landscape: "landscape";
+    }>;
+    devicePixelRatio: z.ZodOptional<z.ZodNumber>;
+    touchPrimary: z.ZodOptional<z.ZodBoolean>;
+    shellType: z.ZodOptional<z.ZodEnum<{
+        fullscreen: "fullscreen";
+        chat: "chat";
+        spatial: "spatial";
+    }>>;
+    colorScheme: z.ZodOptional<z.ZodEnum<{
+        light: "light";
+        dark: "dark";
+    }>>;
+    reducedMotion: z.ZodOptional<z.ZodBoolean>;
+}, z.core.$loose>;
+//# sourceMappingURL=interface-context.d.ts.map

package/dist/schemas/interface-context.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"interface-context.d.ts","sourceRoot":"","sources":["../../src/schemas/interface-context.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AACH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,eAAO,MAAM,cAAc;;;iBAGzB,CAAC;AAEH,eAAO,MAAM,sBAAsB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;iBAUnB,CAAC"}

package/dist/schemas/interface-context.js

@@ -0,0 +1,22 @@
+/**
+ * Interface-context schema — the client's viewport/platform snapshot every
+ * handshake and every `InvokeEvent` carries. Its own module (ggui#819) so
+ * the browser entry (`@ggui-ai/protocol/wire`) reaches it without the
+ * tool schemas that used to share its file.
+ */
+import { z } from 'zod';
+export const viewportSchema = z.object({
+    width: z.number(),
+    height: z.number(),
+});
+export const interfaceContextSchema = z.object({
+    viewport: viewportSchema,
+    platform: z.enum(['web', 'mobile', 'desktop']),
+    deviceType: z.enum(['phone', 'tablet', 'desktop']),
+    orientation: z.enum(['portrait', 'landscape']),
+    devicePixelRatio: z.number().optional(),
+    touchPrimary: z.boolean().optional(),
+    shellType: z.enum(['chat', 'fullscreen', 'spatial']).optional(),
+    colorScheme: z.enum(['light', 'dark']).optional(),
+    reducedMotion: z.boolean().optional(),
+}).passthrough();

package/dist/schemas/invoke.d.ts

@@ -307,13 +307,13 @@ export declare const invokeRequestSchema: z.ZodObject<{
         }, z.core.$strip>;
         platform: z.ZodEnum<{
             web: "web";
-            mobile: "mobile";
             desktop: "desktop";
+            mobile: "mobile";
         }>;
         deviceType: z.ZodEnum<{
             desktop: "desktop";
-            phone: "phone";
             tablet: "tablet";
+            phone: "phone";
         }>;
         orientation: z.ZodEnum<{
             portrait: "portrait";
@@ -322,8 +322,8 @@ export declare const invokeRequestSchema: z.ZodObject<{
         devicePixelRatio: z.ZodOptional<z.ZodNumber>;
         touchPrimary: z.ZodOptional<z.ZodBoolean>;
         shellType: z.ZodOptional<z.ZodEnum<{
-            chat: "chat";
             fullscreen: "fullscreen";
+            chat: "chat";
             spatial: "spatial";
         }>>;
         colorScheme: z.ZodOptional<z.ZodEnum<{

package/dist/schemas/invoke.js

@@ -12,7 +12,7 @@
  * and types for authoring.
  */
 import { z } from 'zod';
-import { interfaceContextSchema } from './mcp.js';
+import { interfaceContextSchema } from './interface-context.js';
 // ── Content blocks ────────────────────────────────────────────────────
 /** Plain text content — streamed via `text_delta` events. */
 export const textBlockSchema = z.object({