@ggui-ai/protocol 0.14.0 → 0.16.0

package/dist/types/mcp.js

@@ -11,8 +11,17 @@
  * §7.1; see {@link RenderErrorCode}). The slot stays unassigned so a
  * future canonical code can't silently collide with stale consumers.
  *
+ * `-32001` is RETIRED-RESERVED too (ggui#853): `UNAUTHORIZED` lived
+ * there until the 0.16.0 wave, but `-32001` is the MCP SDK client's own
+ * `RequestTimeout` — minted locally, never sent by a server — so a
+ * client reading the number could not tell a server's UNAUTHORIZED
+ * from its own timeout, the class ggui#836 closed for `-32000`
+ * (`ConnectionClosed`). `UNAUTHORIZED` is `-32007`; the slot stays
+ * unassigned. `error-codes-vs-sdk.test.ts` pins that no ggui-chosen
+ * code equals a code the SDK's `ErrorCode` enum owns.
+ *
  * `-32006` is assigned to `MOUNT_UNAVAILABLE`; new canonical codes come
- * at `-32007` onwards.
+ * at `-32008` onwards.
  */
 export const MCP_ERROR_CODES = {
     PARSE_ERROR: -32700,
@@ -20,11 +29,10 @@ export const MCP_ERROR_CODES = {
     METHOD_NOT_FOUND: -32601,
     INVALID_PARAMS: -32602,
     INTERNAL_ERROR: -32603,
-    // Protocol-specific error codes (-32004 retired-reserved — see above)
-    UNAUTHORIZED: -32001,
+    // Protocol-specific error codes (-32001, -32004 and -32005 retired-reserved — see above)
+    UNAUTHORIZED: -32007,
     SESSION_NOT_FOUND: -32002,
     APP_NOT_FOUND: -32003,
-    CAPABILITY_DENIED: -32005,
     /**
      * A `resources/read` identified the resource but cannot return a
      * mount for it — the component behind it is gone, the server keeps no
@@ -44,11 +52,22 @@ export const MCP_ERROR_CODES = {
 /**
  * Platform-specific error codes (-32010 range).
  * These are ggui platform extensions, not part of the core protocol.
+ * `-32010`..`-32013` and `-32020` are retired-reserved (SPEC §7.9,
+ * ggui#910 / ggui#890): declared once, emitted by nothing first-party —
+ * quota, app-limit and concurrency states are refusals or
+ * implementation-range codes, and a contract violation is the Plane-2
+ * `contract_violation` result or the live channel's `CONTRACT_VIOLATION`
+ * frame code, never a JSON-RPC number.
  */
 export const PLATFORM_ERROR_CODES = {
-    GENERATION_QUOTA_EXCEEDED: -32010,
-    APP_LIMIT_EXCEEDED: -32011,
-    CONCURRENT_SESSION_LIMIT: -32012,
-    RATE_LIMIT_EXCEEDED: -32013,
-    CONTRACT_VIOLATION: -32020,
+    /**
+     * The generation queue is saturated — the server, not the caller, is
+     * the limit (contrast a caller-side rate cap, which is a render-gate
+     * REFUSAL — `app_rate_limited` / `issuer_rate_limited`, SPEC §7.1 — the
+     * caller slows down; its former numeric `-32013` is retired-reserved,
+     * SPEC §7.9, ggui#890). HTTP
+     * 503 with `Retry-After`, which governs the retry; a parsed request's
+     * refusal, so it speaks this table (ggui#836 follow-up).
+     */
+    GENERATION_OVERLOADED: -32014,
 };

package/dist/types/refusal-codes.d.ts

@@ -65,8 +65,15 @@
  *   - `owner-api` — an app owner's own billing mutations.
  *   - `provisioning-api` — a tenant provisioning an app on behalf of
  *     its own users.
+ *   - `mcp-endpoint` — the per-app MCP endpoint's authorization, on
+ *     any JSON-RPC request (`initialize` included). The refusal rides
+ *     the JSON-RPC error object's `data.refusal` (HTTP 403, error code
+ *     `-32003` `APP_NOT_FOUND`, message `App not found` — ggui#836); only the codes listed
+ *     here are ever typed there, and an authorization failure that is
+ *     NOT one of them stays a bare 403 by contract, so a client can
+ *     never learn which of the untyped arms it hit.
  */
-export declare const REFUSAL_SURFACES: readonly ["render-gate", "owner-api", "provisioning-api"];
+export declare const REFUSAL_SURFACES: readonly ["render-gate", "owner-api", "provisioning-api", "mcp-endpoint"];
 /** One member of {@link REFUSAL_SURFACES}. */
 export type RefusalSurface = (typeof REFUSAL_SURFACES)[number];
 /** The closed `retry` vocabulary — see the file header for semantics. */
@@ -95,7 +102,7 @@ declare const REFUSAL_ROWS: {
         readonly retry: "after-fix";
         readonly fixBy: "owner";
         readonly emitter: "a deployment's generation gate, balance arm";
-        readonly description: "The balance this deployment funds the app from is exhausted. The app owner adds funds, after which the same call succeeds.";
+        readonly description: "The balance this deployment funds the render from is at or below zero — pool or BYOK lane alike — so nothing renders under it. The owner adds credit, after which the same call succeeds.";
     };
     readonly hard_cap_exceeded: {
         readonly code: "hard_cap_exceeded";
@@ -104,13 +111,13 @@ declare const REFUSAL_ROWS: {
         readonly emitter: "a deployment's generation gate, cap arm";
         readonly description: "The app reached the hard ceiling this deployment set for the current period. Nothing the caller or the owner does lifts it before the period rolls over.";
     };
-    readonly model_not_in_tier: {
-        readonly code: "model_not_in_tier";
+    readonly model_not_allowed: {
+        readonly code: "model_not_allowed";
         readonly surfaces: readonly ["render-gate"];
         readonly retry: "after-fix";
         readonly fixBy: "caller";
         readonly emitter: "a deployment's generation gate, model arm";
-        readonly description: "The requested model is not among those the app is allowed to use. The caller picks an allowed model and retries — the one render-gate state an agent may act on itself.";
+        readonly description: "The requested model is not one this account has been granted on this deployment. The caller picks a granted model and retries with the same handshakeId — the one render-gate state an agent may act on itself.";
     };
     readonly managed_default_cap_exceeded: {
         readonly code: "managed_default_cap_exceeded";
@@ -135,30 +142,6 @@ declare const REFUSAL_ROWS: {
         readonly emitter: "a deployment's provisioning guard and its generation gate, reading the same record";
         readonly description: "The app record declares a funding mode this deployment does not recognise, or declares none at all. The value is reported as read and never coerced — an unreadable record is not a policy.";
     };
-    readonly app_canceled: {
-        readonly code: "app_canceled";
-        readonly surfaces: readonly ["render-gate"];
-        readonly retry: "after-fix";
-        readonly fixBy: "owner";
-        readonly emitter: "a deployment's generation gate, plan-state arm";
-        readonly description: "The app's plan has ended, so it renders nothing while the stored work is kept. The owner starts a new plan to restore rendering.";
-    };
-    readonly trial_exhausted: {
-        readonly code: "trial_exhausted";
-        readonly surfaces: readonly ["render-gate"];
-        readonly retry: "after-fix";
-        readonly fixBy: "owner";
-        readonly emitter: "a deployment's generation gate, trial arm";
-        readonly description: "The trial this deployment grants the app has used up its allotment. The owner starts a paid plan.";
-    };
-    readonly trial_expired: {
-        readonly code: "trial_expired";
-        readonly surfaces: readonly ["render-gate"];
-        readonly retry: "after-fix";
-        readonly fixBy: "owner";
-        readonly emitter: "a deployment's generation gate, trial arm";
-        readonly description: "The app's trial window has closed. The owner starts a paid plan.";
-    };
     readonly issuer_rate_limited: {
         readonly code: "issuer_rate_limited";
         readonly surfaces: readonly ["render-gate"];
@@ -175,7 +158,7 @@ declare const REFUSAL_ROWS: {
     };
     readonly app_deprovisioned: {
         readonly code: "app_deprovisioned";
-        readonly surfaces: readonly ["render-gate"];
+        readonly surfaces: readonly ["render-gate", "mcp-endpoint"];
         readonly retry: "never";
         readonly emitter: "the generation gate's owner-claim check, before any reservation or metering";
         readonly description: "The app record has no owner claim any more — either the claim was removed, or the record names no issuing tenant at all. A record with no owner cannot be funded, so nothing renders under it and no caller action restores it.";
@@ -185,16 +168,8 @@ declare const REFUSAL_ROWS: {
         readonly surfaces: readonly ["render-gate"];
         readonly retry: "after-fix";
         readonly fixBy: "owner";
-        readonly emitter: "the generation gate's fall-through arm: a non-playground identity that resolves to no billing path (not a trial account, not a managed app, not a credit holder)";
-        readonly description: "The caller has no billing subject on this deployment, so nothing renders under it. The owner provisions one — a trial account, a managed policy, or credit. Unlike `billing_mode_anomaly` — an app record that exists and declares a funding mode this deployment cannot read — no record arm applies here: there is simply no subject to bill. A deployment MAY suppress this refusal by operator override; that switch is deployment policy, not a wire state.";
-    };
-    readonly subscription_exists: {
-        readonly code: "subscription_exists";
-        readonly surfaces: readonly ["owner-api"];
-        readonly retry: "after-fix";
-        readonly fixBy: "owner";
-        readonly emitter: "a deployment's owner billing mutations";
-        readonly description: "An active (non-canceled) plan exists on this app. It refuses starting another one AND deleting the app — the refusal's own `fix` names the next step for the action that was called.";
+        readonly emitter: "the generation gate's fall-through arm: a non-playground identity that resolves to no billing path (not a managed app, not a credit holder)";
+        readonly description: "The caller has no billing subject on this deployment, so nothing renders under it. The owner provisions one — a managed policy, or credit. Unlike `billing_mode_anomaly` — an app record that exists and declares a funding mode this deployment cannot read — no record arm applies here: there is simply no subject to bill. A deployment MAY suppress this refusal by operator override; that switch is deployment policy, not a wire state.";
     };
     readonly checkout_unavailable: {
         readonly code: "checkout_unavailable";
@@ -202,60 +177,7 @@ declare const REFUSAL_ROWS: {
         readonly retry: "later";
         readonly fixBy: "operator";
         readonly emitter: "a deployment's owner billing mutations";
-        readonly description: "The surface that starts a plan is unavailable on this deployment right now — unconfigured, or its provider is down. Only the operator can restore it.";
-    };
-    readonly card_update_unavailable: {
-        readonly code: "card_update_unavailable";
-        readonly surfaces: readonly ["owner-api"];
-        readonly retry: "later";
-        readonly fixBy: "operator";
-        readonly emitter: "a deployment's owner billing mutations";
-        readonly description: "The surface that updates a payment method is unavailable on this deployment right now. Only the operator can restore it.";
-    };
-    readonly portal_unavailable: {
-        readonly code: "portal_unavailable";
-        readonly surfaces: readonly ["owner-api"];
-        readonly retry: "later";
-        readonly fixBy: "operator";
-        readonly emitter: "a deployment's owner billing mutations";
-        readonly description: "The self-service billing surface is unavailable on this deployment right now. Only the operator can restore it.";
-    };
-    readonly no_subscription: {
-        readonly code: "no_subscription";
-        readonly surfaces: readonly ["owner-api"];
-        readonly retry: "after-fix";
-        readonly fixBy: "owner";
-        readonly emitter: "a deployment's owner billing mutations";
-        readonly description: "A plan-management action was called on an app that has no plan. The owner starts a plan first.";
-    };
-    readonly already_on_tier: {
-        readonly code: "already_on_tier";
-        readonly surfaces: readonly ["owner-api"];
-        readonly retry: "after-fix";
-        readonly fixBy: "owner";
-        readonly emitter: "a deployment's owner billing mutations";
-        readonly description: "The plan requested is the one the app is already on. The owner picks a different plan.";
-    };
-    readonly managed_app_no_checkout: {
-        readonly code: "managed_app_no_checkout";
-        readonly surfaces: readonly ["owner-api"];
-        readonly retry: "never";
-        readonly emitter: "a deployment's owner billing mutations";
-        readonly description: "This app is funded by the tenant that provisioned it, so it has no owner-facing plan surface at all. No owner action creates one.";
-    };
-    readonly managed_app_no_card_update: {
-        readonly code: "managed_app_no_card_update";
-        readonly surfaces: readonly ["owner-api"];
-        readonly retry: "never";
-        readonly emitter: "a deployment's owner billing mutations";
-        readonly description: "This app is funded by the tenant that provisioned it, so it carries no owner payment method to update.";
-    };
-    readonly managed_app_no_portal: {
-        readonly code: "managed_app_no_portal";
-        readonly surfaces: readonly ["owner-api"];
-        readonly retry: "never";
-        readonly emitter: "a deployment's owner billing mutations";
-        readonly description: "This app is funded by the tenant that provisioned it, so it has no owner self-service billing surface.";
+        readonly description: "The surface that adds credit (a top-up) is unavailable on this deployment right now — unconfigured, or its provider is down. Only the operator can restore it.";
     };
     readonly owner_ref_mismatch: {
         readonly code: "owner_ref_mismatch";
@@ -294,6 +216,15 @@ export interface RefusalRow {
 }
 /** The registry consumers read. */
 export declare const PRE_GENERATION_REFUSAL_CODES: Readonly<Record<RefusalCode, RefusalRow>>;
+/**
+ * The SAME registry object with its per-key literal types kept
+ * (ggui#889): `PRE_GENERATION_REFUSAL_ROWS.app_rate_limited.code` is
+ * `'app_rate_limited'`, its `retry` is `'later'`. The normalized view
+ * above erases those literals so `fixBy` reads uniformly; a producer
+ * that must satisfy a wire enum from a row (the registry-purity pin
+ * forbids the literal in source) reads it here — no parse, no literal.
+ */
+export declare const PRE_GENERATION_REFUSAL_ROWS: typeof REFUSAL_ROWS;
 /**
  * The codes on one surface, derived type-level from the literal rows'
  * `surfaces` tuples. A runtime `.filter()` cannot narrow a type, so the
@@ -310,10 +241,38 @@ type CodesOnSurface<S extends RefusalSurface> = {
  * render wire.
  */
 export type PreGenerationRefusalCode = CodesOnSurface<'render-gate'>;
+/**
+ * A code that can appear in a per-app MCP endpoint refusal's
+ * `error.data.refusal.code` — i.e. one whose `surfaces` include
+ * `mcp-endpoint` (ggui#825). Derived, so a render-gate-only code is not
+ * expressible on the transport wire.
+ */
+export type McpEndpointRefusalCode = CodesOnSurface<'mcp-endpoint'>;
 /**
  * Every render-gate code, as the literal tuple the wire enum
  * (`renderRefusalSchema.code`) is built from. Order is the registry's.
  */
-export declare const RENDER_GATE_REFUSAL_CODES: readonly ["unsupported_provider", "insufficient_credit", "hard_cap_exceeded", "model_not_in_tier", "managed_default_cap_exceeded", "app_policy_missing", "billing_mode_anomaly", "billing_path_missing", "app_canceled", "trial_exhausted", "trial_expired", "issuer_rate_limited", "app_rate_limited", "app_deprovisioned"];
+export declare const RENDER_GATE_REFUSAL_CODES: readonly ["unsupported_provider", "insufficient_credit", "hard_cap_exceeded", "model_not_allowed", "managed_default_cap_exceeded", "app_policy_missing", "billing_mode_anomaly", "billing_path_missing", "issuer_rate_limited", "app_rate_limited", "app_deprovisioned"];
+/**
+ * Every mcp-endpoint code, as the literal tuple the transport wire enum
+ * (`transportRefusalSchema.code`) is built from — the refusals a per-app
+ * MCP endpoint's authorization types on `error.data.refusal`
+ * (ggui#825). Order is the registry's.
+ */
+export declare const MCP_ENDPOINT_REFUSAL_CODES: readonly ["app_deprovisioned"];
+/**
+ * A code an owner-API billing mutation may refuse with — i.e. one whose
+ * `surfaces` include `owner-api`. Derived, so a render-gate code is not
+ * expressible on an owner-API refusal. Registry v11 (ggui#960): the
+ * plan-era owner-api rows retired with the plan model; one owner billing
+ * surface remains — adding credit.
+ */
+export type OwnerApiRefusalCode = CodesOnSurface<'owner-api'>;
+/**
+ * Every owner-api code, as the literal tuple a backend's owner-API
+ * refusal helper types its `code` from (ggui#960). Order is the
+ * registry's.
+ */
+export declare const OWNER_API_REFUSAL_CODES: readonly ["checkout_unavailable"];
 export {};
 //# sourceMappingURL=refusal-codes.d.ts.map

package/dist/types/refusal-codes.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"refusal-codes.d.ts","sourceRoot":"","sources":["../../src/types/refusal-codes.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAyDG;AAEH;;;;;;;;;GASG;AACH,eAAO,MAAM,gBAAgB,2DAInB,CAAC;AAEX,8CAA8C;AAC9C,MAAM,MAAM,cAAc,GAAG,CAAC,OAAO,gBAAgB,CAAC,CAAC,MAAM,CAAC,CAAC;AAE/D,yEAAyE;AACzE,eAAO,MAAM,eAAe,yDAKlB,CAAC;AAEX,6CAA6C;AAC7C,MAAM,MAAM,YAAY,GAAG,CAAC,OAAO,eAAe,CAAC,CAAC,MAAM,CAAC,CAAC;AAE5D;;;GAGG;AACH,eAAO,MAAM,cAAc,oDAAqD,CAAC;AAEjF,4CAA4C;AAC5C,MAAM,MAAM,YAAY,GAAG,CAAC,OAAO,cAAc,CAAC,CAAC,MAAM,CAAC,CAAC;AAiD3D,QAAA,MAAM,YAAY;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAqOhB,CAAC;AAEH,qEAAqE;AACrE,MAAM,MAAM,WAAW,GAAG,MAAM,OAAO,YAAY,CAAC;AAEpD;;;;;;;GAOG;AACH,MAAM,WAAW,UAAU;IACzB,QAAQ,CAAC,IAAI,EAAE,WAAW,CAAC;IAC3B,QAAQ,CAAC,QAAQ,EAAE,SAAS,cAAc,EAAE,CAAC;IAC7C,QAAQ,CAAC,KAAK,EAAE,YAAY,CAAC;IAC7B,QAAQ,CAAC,KAAK,CAAC,EAAE,YAAY,CAAC;IAC9B,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;CAC9B;AAED,mCAAmC;AACnC,eAAO,MAAM,4BAA4B,EAAE,QAAQ,CACjD,MAAM,CAAC,WAAW,EAAE,UAAU,CAAC,CACjB,CAAC;AAEjB;;;;;GAKG;AACH,KAAK,cAAc,CAAC,CAAC,SAAS,cAAc,IAAI;KAC7C,CAAC,IAAI,WAAW,GAAG,CAAC,SAAS,CAAC,OAAO,YAAY,CAAC,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,MAAM,CAAC,GACtE,CAAC,GACD,KAAK;CACV,CAAC,WAAW,CAAC,CAAC;AAEf;;;;;GAKG;AACH,MAAM,MAAM,wBAAwB,GAAG,cAAc,CAAC,aAAa,CAAC,CAAC;AAiBrE;;;GAGG;AACH,eAAO,MAAM,yBAAyB,8TAepC,CAAC"}
+{"version":3,"file":"refusal-codes.d.ts","sourceRoot":"","sources":["../../src/types/refusal-codes.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAyDG;AAEH;;;;;;;;;;;;;;;;GAgBG;AACH,eAAO,MAAM,gBAAgB,2EAKnB,CAAC;AAEX,8CAA8C;AAC9C,MAAM,MAAM,cAAc,GAAG,CAAC,OAAO,gBAAgB,CAAC,CAAC,MAAM,CAAC,CAAC;AAE/D,yEAAyE;AACzE,eAAO,MAAM,eAAe,yDAKlB,CAAC;AAEX,6CAA6C;AAC7C,MAAM,MAAM,YAAY,GAAG,CAAC,OAAO,eAAe,CAAC,CAAC,MAAM,CAAC,CAAC;AAE5D;;;GAGG;AACH,eAAO,MAAM,cAAc,oDAAqD,CAAC;AAEjF,4CAA4C;AAC5C,MAAM,MAAM,YAAY,GAAG,CAAC,OAAO,cAAc,CAAC,CAAC,MAAM,CAAC,CAAC;AAiE3D,QAAA,MAAM,YAAY;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAqIhB,CAAC;AAEH,qEAAqE;AACrE,MAAM,MAAM,WAAW,GAAG,MAAM,OAAO,YAAY,CAAC;AAEpD;;;;;;;GAOG;AACH,MAAM,WAAW,UAAU;IACzB,QAAQ,CAAC,IAAI,EAAE,WAAW,CAAC;IAC3B,QAAQ,CAAC,QAAQ,EAAE,SAAS,cAAc,EAAE,CAAC;IAC7C,QAAQ,CAAC,KAAK,EAAE,YAAY,CAAC;IAC7B,QAAQ,CAAC,KAAK,CAAC,EAAE,YAAY,CAAC;IAC9B,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;CAC9B;AAED,mCAAmC;AACnC,eAAO,MAAM,4BAA4B,EAAE,QAAQ,CACjD,MAAM,CAAC,WAAW,EAAE,UAAU,CAAC,CACjB,CAAC;AAEjB;;;;;;;GAOG;AACH,eAAO,MAAM,2BAA2B,EAAE,OAAO,YAA2B,CAAC;AAE7E;;;;;GAKG;AACH,KAAK,cAAc,CAAC,CAAC,SAAS,cAAc,IAAI;KAC7C,CAAC,IAAI,WAAW,GAAG,CAAC,SAAS,CAAC,OAAO,YAAY,CAAC,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,MAAM,CAAC,GACtE,CAAC,GACD,KAAK;CACV,CAAC,WAAW,CAAC,CAAC;AAEf;;;;;GAKG;AACH,MAAM,MAAM,wBAAwB,GAAG,cAAc,CAAC,aAAa,CAAC,CAAC;AAErE;;;;;GAKG;AACH,MAAM,MAAM,sBAAsB,GAAG,cAAc,CAAC,cAAc,CAAC,CAAC;AAkBpE;;;GAGG;AACH,eAAO,MAAM,yBAAyB,0QAYpC,CAAC;AAEH;;;;;GAKG;AACH,eAAO,MAAM,0BAA0B,gCAErC,CAAC;AAEH;;;;;;GAMG;AACH,MAAM,MAAM,mBAAmB,GAAG,cAAc,CAAC,WAAW,CAAC,CAAC;AAE9D;;;;GAIG;AACH,eAAO,MAAM,uBAAuB,mCAElC,CAAC"}

package/dist/types/refusal-codes.js

@@ -65,11 +65,19 @@
  *   - `owner-api` — an app owner's own billing mutations.
  *   - `provisioning-api` — a tenant provisioning an app on behalf of
  *     its own users.
+ *   - `mcp-endpoint` — the per-app MCP endpoint's authorization, on
+ *     any JSON-RPC request (`initialize` included). The refusal rides
+ *     the JSON-RPC error object's `data.refusal` (HTTP 403, error code
+ *     `-32003` `APP_NOT_FOUND`, message `App not found` — ggui#836); only the codes listed
+ *     here are ever typed there, and an authorization failure that is
+ *     NOT one of them stays a bare 403 by contract, so a client can
+ *     never learn which of the untyped arms it hit.
  */
 export const REFUSAL_SURFACES = [
     'render-gate',
     'owner-api',
     'provisioning-api',
+    'mcp-endpoint',
 ];
 /** The closed `retry` vocabulary — see the file header for semantics. */
 export const REFUSAL_RETRIES = [
@@ -83,6 +91,22 @@ export const REFUSAL_RETRIES = [
  * itself — see the no-auto-retry rule in the file header.
  */
 export const REFUSAL_FIX_BY = ['caller', 'owner', 'tenant', 'operator'];
+/**
+ * Registry v11 (ggui#960, 2026-09-08) — the plan model is retired: a
+ * deployment funds renders from a credit balance at flat rates, and the
+ * states that only a plan, a trial or a subscription could produce no
+ * longer exist. Retired with their emitting arms, in the same slice:
+ * render-gate `trial_exhausted`, `trial_expired`, `app_canceled`;
+ * owner-api `subscription_exists`, `no_subscription`,
+ * `subscription_unchanged`, `portal_unavailable`, `card_update_unavailable`,
+ * `managed_app_no_portal`, `managed_app_no_card_update`,
+ * `managed_app_no_checkout` (the top-up mutation is user-scoped — no
+ * managed branch exists to refuse from). Re-described: `billing_path_missing`
+ * (off the trial), `model_not_allowed` (per-account grant),
+ * `checkout_unavailable` (adding credit), `insufficient_credit` (pool or
+ * BYOK — the BYOK lane is charged). `managed_default_cap_exceeded` is NOT in this
+ * bump: unemitted since N1's swap but federated-side (ggui#965).
+ */
 /**
  * The registry is the ONLY list of refusal codes: {@link RefusalCode}
  * is derived from the keys below, and this definer forces every row's
@@ -112,7 +136,7 @@ const REFUSAL_ROWS = /* @__PURE__ */ defineRefusalRegistry({
         retry: 'after-fix',
         fixBy: 'owner',
         emitter: "a deployment's generation gate, balance arm",
-        description: 'The balance this deployment funds the app from is exhausted. The app owner adds funds, after which the same call succeeds.',
+        description: "The balance this deployment funds the render from is at or below zero — pool or BYOK lane alike — so nothing renders under it. The owner adds credit, after which the same call succeeds.",
     },
     hard_cap_exceeded: {
         code: 'hard_cap_exceeded',
@@ -121,13 +145,13 @@ const REFUSAL_ROWS = /* @__PURE__ */ defineRefusalRegistry({
         emitter: "a deployment's generation gate, cap arm",
         description: 'The app reached the hard ceiling this deployment set for the current period. Nothing the caller or the owner does lifts it before the period rolls over.',
     },
-    model_not_in_tier: {
-        code: 'model_not_in_tier',
+    model_not_allowed: {
+        code: 'model_not_allowed',
         surfaces: ['render-gate'],
         retry: 'after-fix',
         fixBy: 'caller',
         emitter: "a deployment's generation gate, model arm",
-        description: 'The requested model is not among those the app is allowed to use. The caller picks an allowed model and retries — the one render-gate state an agent may act on itself.',
+        description: 'The requested model is not one this account has been granted on this deployment. The caller picks a granted model and retries with the same handshakeId — the one render-gate state an agent may act on itself.',
     },
     managed_default_cap_exceeded: {
         code: 'managed_default_cap_exceeded',
@@ -155,30 +179,6 @@ const REFUSAL_ROWS = /* @__PURE__ */ defineRefusalRegistry({
         emitter: "a deployment's provisioning guard and its generation gate, reading the same record",
         description: 'The app record declares a funding mode this deployment does not recognise, or declares none at all. The value is reported as read and never coerced — an unreadable record is not a policy.',
     },
-    app_canceled: {
-        code: 'app_canceled',
-        surfaces: ['render-gate'],
-        retry: 'after-fix',
-        fixBy: 'owner',
-        emitter: "a deployment's generation gate, plan-state arm",
-        description: "The app's plan has ended, so it renders nothing while the stored work is kept. The owner starts a new plan to restore rendering.",
-    },
-    trial_exhausted: {
-        code: 'trial_exhausted',
-        surfaces: ['render-gate'],
-        retry: 'after-fix',
-        fixBy: 'owner',
-        emitter: "a deployment's generation gate, trial arm",
-        description: 'The trial this deployment grants the app has used up its allotment. The owner starts a paid plan.',
-    },
-    trial_expired: {
-        code: 'trial_expired',
-        surfaces: ['render-gate'],
-        retry: 'after-fix',
-        fixBy: 'owner',
-        emitter: "a deployment's generation gate, trial arm",
-        description: "The app's trial window has closed. The owner starts a paid plan.",
-    },
     issuer_rate_limited: {
         code: 'issuer_rate_limited',
         surfaces: ['render-gate'],
@@ -195,7 +195,7 @@ const REFUSAL_ROWS = /* @__PURE__ */ defineRefusalRegistry({
     },
     app_deprovisioned: {
         code: 'app_deprovisioned',
-        surfaces: ['render-gate'],
+        surfaces: ['render-gate', 'mcp-endpoint'],
         retry: 'never',
         emitter: "the generation gate's owner-claim check, before any reservation or metering",
         description: 'The app record has no owner claim any more \u2014 either the claim was removed, or the record names no issuing tenant at all. A record with no owner cannot be funded, so nothing renders under it and no caller action restores it.',
@@ -205,78 +205,17 @@ const REFUSAL_ROWS = /* @__PURE__ */ defineRefusalRegistry({
         surfaces: ['render-gate'],
         retry: 'after-fix',
         fixBy: 'owner',
-        emitter: "the generation gate's fall-through arm: a non-playground identity that resolves to no billing path (not a trial account, not a managed app, not a credit holder)",
-        description: 'The caller has no billing subject on this deployment, so nothing renders under it. The owner provisions one — a trial account, a managed policy, or credit. Unlike `billing_mode_anomaly` — an app record that exists and declares a funding mode this deployment cannot read — no record arm applies here: there is simply no subject to bill. A deployment MAY suppress this refusal by operator override; that switch is deployment policy, not a wire state.',
+        emitter: "the generation gate's fall-through arm: a non-playground identity that resolves to no billing path (not a managed app, not a credit holder)",
+        description: "The caller has no billing subject on this deployment, so nothing renders under it. The owner provisions one — a managed policy, or credit. Unlike `billing_mode_anomaly` — an app record that exists and declares a funding mode this deployment cannot read — no record arm applies here: there is simply no subject to bill. A deployment MAY suppress this refusal by operator override; that switch is deployment policy, not a wire state.",
     },
     // ── owner-api ─────────────────────────────────────────────────────
-    subscription_exists: {
-        code: 'subscription_exists',
-        surfaces: ['owner-api'],
-        retry: 'after-fix',
-        fixBy: 'owner',
-        emitter: "a deployment's owner billing mutations",
-        description: "An active (non-canceled) plan exists on this app. It refuses starting another one AND deleting the app — the refusal's own `fix` names the next step for the action that was called.",
-    },
     checkout_unavailable: {
         code: 'checkout_unavailable',
         surfaces: ['owner-api'],
         retry: 'later',
         fixBy: 'operator',
         emitter: "a deployment's owner billing mutations",
-        description: 'The surface that starts a plan is unavailable on this deployment right now — unconfigured, or its provider is down. Only the operator can restore it.',
-    },
-    card_update_unavailable: {
-        code: 'card_update_unavailable',
-        surfaces: ['owner-api'],
-        retry: 'later',
-        fixBy: 'operator',
-        emitter: "a deployment's owner billing mutations",
-        description: 'The surface that updates a payment method is unavailable on this deployment right now. Only the operator can restore it.',
-    },
-    portal_unavailable: {
-        code: 'portal_unavailable',
-        surfaces: ['owner-api'],
-        retry: 'later',
-        fixBy: 'operator',
-        emitter: "a deployment's owner billing mutations",
-        description: "The self-service billing surface is unavailable on this deployment right now. Only the operator can restore it.",
-    },
-    no_subscription: {
-        code: 'no_subscription',
-        surfaces: ['owner-api'],
-        retry: 'after-fix',
-        fixBy: 'owner',
-        emitter: "a deployment's owner billing mutations",
-        description: 'A plan-management action was called on an app that has no plan. The owner starts a plan first.',
-    },
-    already_on_tier: {
-        code: 'already_on_tier',
-        surfaces: ['owner-api'],
-        retry: 'after-fix',
-        fixBy: 'owner',
-        emitter: "a deployment's owner billing mutations",
-        description: 'The plan requested is the one the app is already on. The owner picks a different plan.',
-    },
-    managed_app_no_checkout: {
-        code: 'managed_app_no_checkout',
-        surfaces: ['owner-api'],
-        retry: 'never',
-        emitter: "a deployment's owner billing mutations",
-        description: 'This app is funded by the tenant that provisioned it, so it has no owner-facing plan surface at all. No owner action creates one.',
-    },
-    managed_app_no_card_update: {
-        code: 'managed_app_no_card_update',
-        surfaces: ['owner-api'],
-        retry: 'never',
-        emitter: "a deployment's owner billing mutations",
-        description: 'This app is funded by the tenant that provisioned it, so it carries no owner payment method to update.',
-    },
-    managed_app_no_portal: {
-        code: 'managed_app_no_portal',
-        surfaces: ['owner-api'],
-        retry: 'never',
-        emitter: "a deployment's owner billing mutations",
-        description: 'This app is funded by the tenant that provisioned it, so it has no owner self-service billing surface.',
+        description: 'The surface that adds credit (a top-up) is unavailable on this deployment right now — unconfigured, or its provider is down. Only the operator can restore it.',
     },
     // ── provisioning-api ──────────────────────────────────────────────
     owner_ref_mismatch: {
@@ -299,31 +238,54 @@ const REFUSAL_ROWS = /* @__PURE__ */ defineRefusalRegistry({
 /** The registry consumers read. */
 export const PRE_GENERATION_REFUSAL_CODES = REFUSAL_ROWS;
 /**
- * Identity helper that only accepts an EXHAUSTIVE tuple of the
- * render-gate codes: omit one and the parameter type collapses to
- * `never`, so the call site is a compile error. A tuple is needed
- * because the wire enum requires a literal, non-empty tuple — a
- * runtime filter over the rows yields `string[]`, which cannot type an
- * enum. This keeps the tuple derived-CHECKED rather than a second list.
+ * The SAME registry object with its per-key literal types kept
+ * (ggui#889): `PRE_GENERATION_REFUSAL_ROWS.app_rate_limited.code` is
+ * `'app_rate_limited'`, its `retry` is `'later'`. The normalized view
+ * above erases those literals so `fixBy` reads uniformly; a producer
+ * that must satisfy a wire enum from a row (the registry-purity pin
+ * forbids the literal in source) reads it here — no parse, no literal.
+ */
+export const PRE_GENERATION_REFUSAL_ROWS = REFUSAL_ROWS;
+/**
+ * Identity helper that only accepts an EXHAUSTIVE tuple of one surface's
+ * codes: omit one and the parameter type collapses to `never`, so the
+ * call site is a compile error. A tuple is needed because a wire enum
+ * requires a literal, non-empty tuple — a runtime filter over the rows
+ * yields `string[]`, which cannot type an enum. This keeps every
+ * per-surface tuple derived-CHECKED rather than a second list.
  */
-const exhaustiveRenderGateCodes = (codes) => codes;
+const exhaustiveCodesOn = () => (codes) => codes;
 /**
  * Every render-gate code, as the literal tuple the wire enum
  * (`renderRefusalSchema.code`) is built from. Order is the registry's.
  */
-export const RENDER_GATE_REFUSAL_CODES = exhaustiveRenderGateCodes([
+export const RENDER_GATE_REFUSAL_CODES = exhaustiveCodesOn()([
     'unsupported_provider',
     'insufficient_credit',
     'hard_cap_exceeded',
-    'model_not_in_tier',
+    'model_not_allowed',
     'managed_default_cap_exceeded',
     'app_policy_missing',
     'billing_mode_anomaly',
     'billing_path_missing',
-    'app_canceled',
-    'trial_exhausted',
-    'trial_expired',
     'issuer_rate_limited',
     'app_rate_limited',
     'app_deprovisioned',
 ]);
+/**
+ * Every mcp-endpoint code, as the literal tuple the transport wire enum
+ * (`transportRefusalSchema.code`) is built from — the refusals a per-app
+ * MCP endpoint's authorization types on `error.data.refusal`
+ * (ggui#825). Order is the registry's.
+ */
+export const MCP_ENDPOINT_REFUSAL_CODES = exhaustiveCodesOn()([
+    'app_deprovisioned',
+]);
+/**
+ * Every owner-api code, as the literal tuple a backend's owner-API
+ * refusal helper types its `code` from (ggui#960). Order is the
+ * registry's.
+ */
+export const OWNER_API_REFUSAL_CODES = exhaustiveCodesOn()([
+    'checkout_unavailable',
+]);

package/dist/types/render.d.ts

@@ -1,10 +1,11 @@
-import type { KNOWN_PERMISSION_NAMES } from '../validation/hygiene-rules';
-import type { PropsSpec, StreamSpec, ActionSpec, ContextSpec, ClientCapabilitiesSpec, GadgetDescriptor, JsonSchema, JsonObject } from './data-contract';
-import type { EndUserIdentity } from './auth';
-import type { HostContextProjection } from './host-context';
-import type { AppTheme } from '../schemas/app-theme';
-import type { RenderErrorCode } from '../schemas/mcp';
-import type { McpAppsGguiSession } from '../integrations/mcp-apps';
+import type { KNOWN_PERMISSION_NAMES } from '../validation/hygiene-rules.js';
+import type { PropsSpec, StreamSpec, ActionSpec, ContextSpec, ClientCapabilitiesSpec, GadgetDescriptor, JsonSchema, JsonObject } from './data-contract.js';
+import type { EndUserIdentity } from './auth.js';
+import type { HostContextProjection } from './host-context.js';
+import type { AppTheme } from '../schemas/app-theme.js';
+import type { z } from 'zod';
+import type { RenderErrorCode, gguiSessionStatusSchema } from '../schemas/mcp.js';
+import type { McpAppsGguiSession } from '../integrations/mcp-apps.js';
 /**
  * Recognised system-card kinds the runtime renders via built-in
  * components. The wire is open-ended (string), but new kinds without a
@@ -42,10 +43,10 @@ export type AdapterPermissions = {
  * in the earlier handshake collapse. The companion `ggui_close` tool
  * that wrote it was removed in the same slice.
  */
-export type GguiSessionStatus = 'active' | 'expired';
+export type GguiSessionStatus = z.infer<typeof gguiSessionStatusSchema>;
 /**
  * Common base for every {@link GguiSession} variant. Carries identity,
- * tenancy, lifecycle, and conversation-scoped context that every
+ * app scope, lifecycle, and conversation-scoped context that every
  * rendered thing has regardless of how its visible bits are
  * produced (LLM-generated component, server-emitted system card,
  * embedded MCP-App iframe).
@@ -61,7 +62,7 @@ export interface GguiSessionBase {
     /** GguiSession identity. The value an iframe's bootstrap meta and every
      *  wire reference (props_update, consume, update) keys by. */
     readonly id: string;
-    /** App identity (tenancy boundary, always per-render). */
+    /** App identity (the app-scope boundary, always per-render). */
     readonly appId: string;
     /** Authenticated end-user (after the auth gate). Absent for anon
      *  flows. */
@@ -142,7 +143,7 @@ export interface GguiSessionBase {
 /**
  * `GguiSession` — the canonical protocol shape for a single rendered UI.
  *
- * Three variants share {@link GguiSessionBase} (identity, tenancy,
+ * Three variants share {@link GguiSessionBase} (identity, app scope,
  * lifecycle); each variant adds its own visible-bits surface:
  *
  *   - {@link ComponentGguiSession} — LLM-generated / native React component.

package/dist/types/render.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"render.d.ts","sourceRoot":"","sources":["../../src/types/render.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,6BAA6B,CAAC;AAC1E,OAAO,KAAK,EACV,SAAS,EACT,UAAU,EACV,UAAU,EACV,WAAW,EACX,sBAAsB,EACtB,gBAAgB,EAChB,UAAU,EACV,UAAU,EACX,MAAM,iBAAiB,CAAC;AACzB,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,QAAQ,CAAC;AAC9C,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,gBAAgB,CAAC;AAC5D,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,sBAAsB,CAAC;AACrD,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,gBAAgB,CAAC;AAKtD,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,0BAA0B,CAAC;AA6BnE;;;;;GAKG;AACH,MAAM,MAAM,qBAAqB,GAC7B,gBAAgB,GAChB,gBAAgB,GAEhB,CAAC,MAAM,GAAG,EAAE,CAAC,CAAC;AAElB;;GAEG;AACH,MAAM,MAAM,gBAAgB,GAAG,SAAS,GAAG,QAAQ,GAAG,QAAQ,CAAC;AAE/D;;;;;;;GAOG;AACH,MAAM,MAAM,kBAAkB,GAAG;IAC/B,QAAQ,EAAE,CAAC,IAAI,CAAC,OAAO,sBAAsB,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,gBAAgB;CAC3E,CAAC;AAMF;;;;;;;;;;;;;;GAcG;AACH,MAAM,MAAM,iBAAiB,GAAG,QAAQ,GAAG,SAAS,CAAC;AAErD;;;;;;;;;;;;;GAaG;AACH,MAAM,WAAW,eAAe;IAC9B;kEAC8D;IAC9D,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;IACpB,0DAA0D;IAC1D,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB;iBACa;IACb,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;IACzB,wEAAwE;IACxE,QAAQ,CAAC,eAAe,CAAC,EAAE,eAAe,CAAC;IAC3C;;;;;;;;;;;;;;OAcG;IACH,QAAQ,CAAC,WAAW,CAAC,EAAE;QACrB,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;QAC1B,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;KAChC,CAAC;IACF;;;;;;OAMG;IACH,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC;IAC1B;;;;;;;;;;;;OAYG;IACH,QAAQ,CAAC,WAAW,CAAC,EAAE,qBAAqB,CAAC;IAC7C;;;;OAIG;IACH,QAAQ,CAAC,kBAAkB,CAAC,EAAE,kBAAkB,CAAC;IACjD,uEAAuE;IACvE,QAAQ,CAAC,MAAM,CAAC,EAAE,iBAAiB,CAAC;IACpC;wCACoC;IACpC,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;IAC/B;;;;;;;;;;OAUG;IACH,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC;IACxB,qCAAqC;IACrC,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,0CAA0C;IAC1C,QAAQ,CAAC,cAAc,EAAE,MAAM,CAAC;IAChC,mCAAmC;IACnC,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;CAC5B;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AACH,MAAM,MAAM,WAAW,CAAC,MAAM,GAAG,UAAU,IACvC,oBAAoB,CAAC,MAAM,CAAC,GAC5B,iBAAiB,GACjB,kBAAkB,CAAC;AAEvB;;;;;;;;GAQG;AACH,wBAAgB,oBAAoB,CAAC,MAAM,EAAE,WAAW,GAAG,OAAO,CAKjE;AAED;;;;GAIG;AACH,wBAAgB,sBAAsB,CACpC,MAAM,EAAE,WAAW,GAClB,eAAe,GAAG,SAAS,CAG7B;AAED;;;;;GAKG;AACH,MAAM,WAAW,oBAAoB,CAAC,MAAM,GAAG,UAAU,CAAE,SAAQ,eAAe;IAChF,+DAA+D;IAC/D,QAAQ,CAAC,IAAI,CAAC,EAAE,WAAW,CAAC;IAC5B,0CAA0C;IAC1C,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;IAC/B;qFACiF;IACjF,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC;IACxB,oEAAoE;IACpE,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;IACzB,4DAA4D;IAC5D,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAC;IAC9B;qDACiD;IACjD,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAC;IAC9B;gCAC4B;IAC5B,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC;IAC1B,2DAA2D;IAC3D,QAAQ,CAAC,MAAM,CAAC,EAAE,UAAU,CAAC;IAC7B,uDAAuD;IACvD,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC;IACxB;;;;;;;;;;;;;;OAcG;IACH,QAAQ,CAAC,SAAS,CAAC,EAAE,eAAe,CAAC;IACrC;qCACiC;IACjC,QAAQ,CAAC,UAAU,CAAC,EAAE,UAAU,CAAC;IACjC;+BAC2B;IAC3B,QAAQ,CAAC,SAAS,CAAC,EAAE,SAAS,CAAC;IAC/B;+BAC2B;IAC3B,QAAQ,CAAC,UAAU,CAAC,EAAE,UAAU,CAAC;IACjC;mDAC+C;IAC/C,QAAQ,CAAC,WAAW,CAAC,EAAE,WAAW,CAAC;IACnC;;;;;;;;;;OAUG;IACH,QAAQ,CAAC,kBAAkB,CAAC,EAAE,sBAAsB,CAAC;IACrD;;;;;OAKG;IACH,QAAQ,CAAC,iBAAiB,CAAC,EAAE,SAAS,gBAAgB,EAAE,CAAC;IACzD;;;;;;;;;;OAUG;IACH,QAAQ,CAAC,KAAK,CAAC,EAAE,QAAQ,CAAC;IAC1B;;;;;;;;;;;;;OAaG;IACH,QAAQ,CAAC,eAAe,CAAC,EAAE,UAAU,CAAC;CACvC;AAED;;;;;;;;;GASG;AACH,MAAM,WAAW,iBAAiB,CAAC,MAAM,SAAS,UAAU,GAAG,UAAU,CACvE,SAAQ,eAAe;IACvB,QAAQ,CAAC,IAAI,EAAE,QAAQ,CAAC;IACxB;;;;;OAKG;IACH,QAAQ,CAAC,IAAI,EAAE,qBAAqB,CAAC;IACrC,gDAAgD;IAChD,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC;IACxB,yEAAyE;IACzE,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAC;CAC/B;AAMD;;;;;;;GAOG;AACH,MAAM,WAAW,gBAAgB,CAAC,SAAS,GAAG,UAAU;IACtD,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC;IACvB,OAAO,EAAE,MAAM,CAAC;IAChB,SAAS,CAAC,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,SAAS,CAAA;KAAE,EAAE,CAAC;IAChD,SAAS,EAAE,MAAM,CAAC;CACnB"}
+{"version":3,"file":"render.d.ts","sourceRoot":"","sources":["../../src/types/render.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,6BAA6B,CAAC;AAC1E,OAAO,KAAK,EACV,SAAS,EACT,UAAU,EACV,UAAU,EACV,WAAW,EACX,sBAAsB,EACtB,gBAAgB,EAChB,UAAU,EACV,UAAU,EACX,MAAM,iBAAiB,CAAC;AACzB,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,QAAQ,CAAC;AAC9C,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,gBAAgB,CAAC;AAC5D,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,sBAAsB,CAAC;AACrD,OAAO,KAAK,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAE7B,OAAO,KAAK,EAAE,eAAe,EAAE,uBAAuB,EAAE,MAAM,gBAAgB,CAAC;AAK/E,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,0BAA0B,CAAC;AA6BnE;;;;;GAKG;AACH,MAAM,MAAM,qBAAqB,GAC7B,gBAAgB,GAChB,gBAAgB,GAEhB,CAAC,MAAM,GAAG,EAAE,CAAC,CAAC;AAElB;;GAEG;AACH,MAAM,MAAM,gBAAgB,GAAG,SAAS,GAAG,QAAQ,GAAG,QAAQ,CAAC;AAE/D;;;;;;;GAOG;AACH,MAAM,MAAM,kBAAkB,GAAG;IAC/B,QAAQ,EAAE,CAAC,IAAI,CAAC,OAAO,sBAAsB,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,gBAAgB;CAC3E,CAAC;AAMF;;;;;;;;;;;;;;GAcG;AACH,MAAM,MAAM,iBAAiB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,uBAAuB,CAAC,CAAC;AAExE;;;;;;;;;;;;;GAaG;AACH,MAAM,WAAW,eAAe;IAC9B;kEAC8D;IAC9D,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;IACpB,gEAAgE;IAChE,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB;iBACa;IACb,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;IACzB,wEAAwE;IACxE,QAAQ,CAAC,eAAe,CAAC,EAAE,eAAe,CAAC;IAC3C;;;;;;;;;;;;;;OAcG;IACH,QAAQ,CAAC,WAAW,CAAC,EAAE;QACrB,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;QAC1B,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;KAChC,CAAC;IACF;;;;;;OAMG;IACH,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC;IAC1B;;;;;;;;;;;;OAYG;IACH,QAAQ,CAAC,WAAW,CAAC,EAAE,qBAAqB,CAAC;IAC7C;;;;OAIG;IACH,QAAQ,CAAC,kBAAkB,CAAC,EAAE,kBAAkB,CAAC;IACjD,uEAAuE;IACvE,QAAQ,CAAC,MAAM,CAAC,EAAE,iBAAiB,CAAC;IACpC;wCACoC;IACpC,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;IAC/B;;;;;;;;;;OAUG;IACH,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC;IACxB,qCAAqC;IACrC,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,0CAA0C;IAC1C,QAAQ,CAAC,cAAc,EAAE,MAAM,CAAC;IAChC,mCAAmC;IACnC,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;CAC5B;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AACH,MAAM,MAAM,WAAW,CAAC,MAAM,GAAG,UAAU,IACvC,oBAAoB,CAAC,MAAM,CAAC,GAC5B,iBAAiB,GACjB,kBAAkB,CAAC;AAEvB;;;;;;;;GAQG;AACH,wBAAgB,oBAAoB,CAAC,MAAM,EAAE,WAAW,GAAG,OAAO,CAKjE;AAED;;;;GAIG;AACH,wBAAgB,sBAAsB,CACpC,MAAM,EAAE,WAAW,GAClB,eAAe,GAAG,SAAS,CAG7B;AAED;;;;;GAKG;AACH,MAAM,WAAW,oBAAoB,CAAC,MAAM,GAAG,UAAU,CAAE,SAAQ,eAAe;IAChF,+DAA+D;IAC/D,QAAQ,CAAC,IAAI,CAAC,EAAE,WAAW,CAAC;IAC5B,0CAA0C;IAC1C,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;IAC/B;qFACiF;IACjF,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC;IACxB,oEAAoE;IACpE,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;IACzB,4DAA4D;IAC5D,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAC;IAC9B;qDACiD;IACjD,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAC;IAC9B;gCAC4B;IAC5B,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC;IAC1B,2DAA2D;IAC3D,QAAQ,CAAC,MAAM,CAAC,EAAE,UAAU,CAAC;IAC7B,uDAAuD;IACvD,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC;IACxB;;;;;;;;;;;;;;OAcG;IACH,QAAQ,CAAC,SAAS,CAAC,EAAE,eAAe,CAAC;IACrC;qCACiC;IACjC,QAAQ,CAAC,UAAU,CAAC,EAAE,UAAU,CAAC;IACjC;+BAC2B;IAC3B,QAAQ,CAAC,SAAS,CAAC,EAAE,SAAS,CAAC;IAC/B;+BAC2B;IAC3B,QAAQ,CAAC,UAAU,CAAC,EAAE,UAAU,CAAC;IACjC;mDAC+C;IAC/C,QAAQ,CAAC,WAAW,CAAC,EAAE,WAAW,CAAC;IACnC;;;;;;;;;;OAUG;IACH,QAAQ,CAAC,kBAAkB,CAAC,EAAE,sBAAsB,CAAC;IACrD;;;;;OAKG;IACH,QAAQ,CAAC,iBAAiB,CAAC,EAAE,SAAS,gBAAgB,EAAE,CAAC;IACzD;;;;;;;;;;OAUG;IACH,QAAQ,CAAC,KAAK,CAAC,EAAE,QAAQ,CAAC;IAC1B;;;;;;;;;;;;;OAaG;IACH,QAAQ,CAAC,eAAe,CAAC,EAAE,UAAU,CAAC;CACvC;AAED;;;;;;;;;GASG;AACH,MAAM,WAAW,iBAAiB,CAAC,MAAM,SAAS,UAAU,GAAG,UAAU,CACvE,SAAQ,eAAe;IACvB,QAAQ,CAAC,IAAI,EAAE,QAAQ,CAAC;IACxB;;;;;OAKG;IACH,QAAQ,CAAC,IAAI,EAAE,qBAAqB,CAAC;IACrC,gDAAgD;IAChD,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC;IACxB,yEAAyE;IACzE,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAC;CAC/B;AAMD;;;;;;;GAOG;AACH,MAAM,WAAW,gBAAgB,CAAC,SAAS,GAAG,UAAU;IACtD,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC;IACvB,OAAO,EAAE,MAAM,CAAC;IAChB,SAAS,CAAC,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,SAAS,CAAA;KAAE,EAAE,CAAC;IAChD,SAAS,EAAE,MAAM,CAAC;CACnB"}

package/dist/types/ui-generator.d.ts

@@ -1,4 +1,4 @@
-import type { DataContract, JsonObject, JsonSchema, JsonValue } from './data-contract';
+import type { DataContract, JsonObject, JsonSchema, JsonValue } from './data-contract.js';
 /**
  * Request to generate a UI component.
  * Generic `TContext` defaults to {@link JsonObject} for generator context hints.

package/dist/validation/ajv-runtime.d.ts

@@ -50,8 +50,8 @@ import type { ErrorObject, ValidateFunction } from 'ajv';
  * dependency — TS resolves the type transitively through this package.
  */
 export type { ValidateFunction } from 'ajv';
-import type { JsonSchema } from '../types/data-contract';
-import type { ContractViolation } from './contract-validator';
+import type { JsonSchema } from '../types/data-contract.js';
+import type { ContractViolation } from './contract-validator.js';
 /**
  * Recursively walk a JSON Schema and inject
  * `additionalProperties: false` at every object node. Authors who