@ggui-ai/protocol 0.15.0 → 0.16.0

package/dist/schemas/mcp.js

@@ -7,7 +7,7 @@
  * Two consumption patterns, both anchored here:
  *
  *   - **Wired raw shapes** (`*InputShape`): handlers in
- *     `@ggui-ai/mcp-server-handlers` (and the hosted pod's discover
+ *     `@ggui-ai/mcp-server-handlers` (and a hosted deployment's discover
  *     tool) import the SHAPE directly as their `inputSchema` and
  *     validate with `z.object(shape)` — unknown keys are STRIPPED.
  *     The shape is the one authored copy of the validation rules AND
@@ -48,14 +48,14 @@ export const consumeInputShape = {
     sessionId: z
         .string()
         .min(1)
-        .describe('Globally-unique sessionId to consume events from. Cross-tenant access surfaces uniformly as session_not_found.'),
+        .describe('Globally-unique sessionId to consume events from. Cross-app access surfaces uniformly as session_not_found.'),
     timeout: z
         .number()
         .int()
         .min(0)
         .max(25)
         .optional()
-        .describe('Inline long-poll seconds, integer in [0, 25]. 0 = immediate. Values outside the bound reject INVALID_PARAMS. Returns on first event OR timeout; re-call on empty to keep waiting — longer waits are your loop, not a bigger timeout.'),
+        .describe('Inline long-poll seconds, integer in [0, 25]. 0 = immediate. Values outside the bound reject INVALID_PARAMS. Returns on first event OR timeout; on empty you may re-call once, then end your turn — a later gesture arrives as a new user message carrying its own consume directive.'),
 };
 export const consumeInputSchema = z.object(consumeInputShape);
 /**
@@ -220,7 +220,7 @@ export const handshakeInputSchema = z.object({
  * `'declined'` cover every legal outcome.
  */
 export const handshakeOutputSchema = z.object({
-    handshakeId: z.string().describe('Stable id — pass to ggui_render / ggui_update'),
+    handshakeId: z.string().describe('Stable id — pass to ggui_render'),
     action: z.enum(['create', 'reuse', 'update', 'replace', 'declined']),
     /**
      * The handshake suggestion — see `handshakeSuggestionSchema`. The
@@ -330,7 +330,7 @@ export const renderInputShape = {
             .string()
             .min(1)
             .optional()
-            .describe('Model route in either wire form — canonical `anthropic:claude-haiku-4-5-20251001` or LiteLLM `anthropic/claude-haiku-4-5` (aliases resolve in both); generator-specific prefixes (e.g. `bedrock/...`) route to that transport. A value that parses in neither form fails the handler input parse at `infra.model`, before any pre-generation gate; `model_not_in_tier` is only ever a well-formed route with no rate row on the effective tier.'),
+            .describe('Model route in either wire form — canonical `anthropic:claude-haiku-4-5-20251001` or LiteLLM `anthropic/claude-haiku-4-5` (aliases resolve in both); generator-specific prefixes (e.g. `bedrock/...`) route to that transport. A value that parses in neither form fails the handler input parse at `infra.model`, before any pre-generation gate; `model_not_allowed` is only ever a well-formed route with no rate row on the effective tier.'),
     })
         .strict()
         .optional(),
@@ -516,13 +516,23 @@ export const renderRefusalSchema = z.object({
  * from {@link MCP_ENDPOINT_REFUSAL_CODES} — today exactly
  * `app_deprovisioned`, the one refusal with a tenant-side fix and
  * therefore the one that MUST be legible where a deleted app and a bad
- * credential would otherwise look alike.
+ * credential would otherwise look alike. `appId` (ggui#870) is the app
+ * the refused endpoint serves, as DATA — equal to the path's `{appId}`
+ * — so a tenant's repair loop keys on it and never parses prose; it is
+ * the ggui id the bound caller already holds, never the tenant's own
+ * `ownerRef`. The typed refusal answers a correctly bound federated
+ * identity only (identity first): an anonymous request is refused by the
+ * auth adapter before this arm, and learns nothing about the app.
  */
 export const transportRefusalSchema = z.strictObject({
     code: z
         .enum(MCP_ENDPOINT_REFUSAL_CODES)
         .describe("Registered refusal state on the per-app endpoint. Look the code up in the protocol's refusal registry for its retry class and which party can act."),
     ...refusalProjectionFields,
+    appId: z
+        .string()
+        .min(1)
+        .describe('The app id the refused endpoint serves — equals the {appId} of the endpoint path. Structured here so a repair loop keys on it instead of parsing the message.'),
 });
 /**
  * The JSON-RPC error object a per-app MCP endpoint answers with when it
@@ -532,7 +542,7 @@ export const transportRefusalSchema = z.strictObject({
  * proxy 403) and `message` `App not found`, plus `data.refusal`, which
  * makes it legible. `data` is strict: it carries the refusal and nothing
  * else. An authorization failure that is not a registry state answers
- * HTTP 403 with `-32001` (`UNAUTHORIZED`) and NO `data` — the three
+ * HTTP 403 with `-32007` (`UNAUTHORIZED`) and NO `data` — the three
  * untyped arms stay indistinguishable among themselves by contract:
  * naming any of them would say which is true. A first-party server
  * never chooses `-32000`: it is the SDK client's `ConnectionClosed`, so
@@ -851,7 +861,7 @@ export const renderOutputSchema = z.object({
  *     wise). Use when most props stay the same and the agent only
  *     needs to send a small delta — common after a single domain-tool
  *     mutation. RFC 7396 chosen because it has a published spec and
- *     wide library support (GitHub API, Kubernetes strategic-merge).
+ *     wide library support (GitHub API's merge semantics, strategic-merge-patch).
  *
  * Anti-patterns (the discriminated union rejects these structurally,
  * but they're a common author mistake when copy-pasting):
@@ -864,7 +874,7 @@ export const renderOutputSchema = z.object({
  * partial patches that would break required fields, type-mismatch
  * values, etc. all reject pre-persist.
  *
- * `sessionId` is globally unique; the server tenancy-checks via
+ * `sessionId` is globally unique; the server checks the app scope via
  * `ctx.appId`.
  */
 export const updateInputSchema = z.discriminatedUnion('kind', [
@@ -1138,15 +1148,15 @@ export const gguiSessionEventSchema = z.object({
  * OPTIONAL here (the bridge rung owns its cursor and seeds from 0; the
  * route requires it because a bare browser GET has no cursor owner),
  * and `limit` is clamped to {@link RUNTIME_PULL_MAX_LIMIT} instead of
- * rejecting above it. Tenancy violations and unknown sessionIds
+ * rejecting above it. Cross-app access and unknown sessionIds
  * surface uniformly as the `session_not_found` error — existence of
- * other tenants' renders is never leaked.
+ * other apps' renders is never leaked.
  */
 export const runtimePullInputShape = {
     sessionId: z
         .string()
         .min(1)
-        .describe('Active render id — sourced from `_meta["ai.ggui/render"].sessionId` on the iframe boot envelope. Unknown and cross-tenant ids surface uniformly as session_not_found.'),
+        .describe('Active render id — sourced from `_meta["ai.ggui/render"].sessionId` on the iframe boot envelope. Unknown and cross-app ids surface uniformly as session_not_found.'),
     sinceSequence: z
         .number()
         .int()
@@ -1332,9 +1342,9 @@ export const gguiSessionStatusSchema = z.enum(['active', 'expired']);
 /**
  * One drained row of `ggui_consume` — a user action that reached the
  * pipe (ggui#817 part C2). Closed on the wire: an unknown key is
- * stripped at the transport, a missing key refuses the row at the seam
- * (`parsePendingEnvelope`), so a malformed pipe entry never ships to an
- * agent typed as a good one.
+ * stripped at the transport, a missing key refuses the row at the store
+ * boundary (`pendingEventSchema`, ggui#839), so a malformed pipe entry
+ * never ships to an agent typed as a good one.
  */
 export const consumeEventEntrySchema = z.object({
     type: z.literal('action'),
@@ -1345,6 +1355,25 @@ export const consumeEventEntrySchema = z.object({
     actionId: z.string(),
     firedAt: z.string(),
 });
+/**
+ * One stored row of the consume pipe — what a producer appends and
+ * `consumeAndClear` drains, the same shape on every store (ggui#839; a
+ * store-boundary contract, never wire — `ggui_consume` returns the
+ * entries, never the wrapper). `id` is the drain_ack key and the
+ * idempotency key per `(sessionId, id)`; `envelope` is the
+ * {@link consumeEventEntrySchema} entry, always the object (every writer
+ * passes one; a store that serializes the row serializes the whole row);
+ * `createdAt` is when the row was appended — a string, never `.datetime()`:
+ * the relay copies the client's `firedAt`, which the ingress accepts as a
+ * diagnostic. `PendingEventConsumer` adapters validate every row through
+ * this schema on append and, when rows come back from a serialization, on
+ * drain — a malformed row never reaches an agent typed as a good entry.
+ */
+export const pendingEventSchema = z.object({
+    id: z.string().min(1),
+    envelope: consumeEventEntrySchema,
+    createdAt: z.string(),
+});
 /**
  * `ggui_consume`'s output — the drained rows, the session's state, and the
  * client's observations when the host sent any (ggui#817 part C2). The

package/dist/schemas/ops-blueprint.d.ts

@@ -7,7 +7,7 @@
  *     persisting the result. Optionally pins as the operator default
  *     for its `(appId, contractHash)` group.
  *   - `ggui_ops_list_blueprints` — enumerate blueprint metadata
- *     (no code body) under tenancy + optional filters. Sorted by
+ *     (no code body) under the caller's app scope + optional filters. Sorted by
  *     `createdAt desc`.
  *   - `ggui_ops_update_blueprint` — toggle the operator-default flag
  *     and/or patch variance tags. Immutable fields (contractHash,
@@ -19,7 +19,7 @@
  * The schemas live in `@ggui-ai/protocol` (not the handler package)
  * for the same reason all wire-shape schemas do: the protocol package
  * is the source of truth for every MCP wire surface, and consumers
- * (cloud pod handlers, console UI, fixture authors) can import from
+ * (a hosted deployment's handlers, console UI, fixture authors) can import from
  * one place. Handler package wraps these into `SharedHandler`
  * factories.
  */
@@ -69,11 +69,11 @@ export declare const opsGenerateBlueprintOutputSchema: z.ZodObject<{
  *   - Seeding pre-vetted blueprints at deploy time (fixture corpus,
  *     migration imports).
  *   - Round-tripping export+reimport — operator exports a blueprint
- *     from one tenant and re-registers it in another.
+ *     from one app (or one deployment) and re-registers it in another.
  *   - Reapplying a fixed version of a blueprint after live edits
  *     (manual recovery from a bad generate run).
  *
- * Same tenancy + variance + default-pin semantics as
+ * Same app-scoping + variance + default-pin semantics as
  * `*_generate_*`; the only difference is the LLM/generator dispatch
  * is replaced with a verbatim accept of the operator's
  * `componentCode` string.

package/dist/schemas/ops-blueprint.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"ops-blueprint.d.ts","sourceRoot":"","sources":["../../src/schemas/ops-blueprint.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAYxB;;;;;;;;;;;;;;GAcG;AACH,eAAO,MAAM,+BAA+B;;;;;;;;;kBAgDjC,CAAC;AAEZ;;;;GAIG;AACH,eAAO,MAAM,gCAAgC;;;;;kBAqBlC,CAAC;AAEZ;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AACH,eAAO,MAAM,+BAA+B;;;;;;;;;kBA+CjC,CAAC;AAEZ;;;;GAIG;AACH,eAAO,MAAM,gCAAgC;;;;kBAalC,CAAC;AAEZ;;;;;;;;;;;;;;;;;;;GAmBG;AACH,eAAO,MAAM,4BAA4B;;;;;;kBAoC9B,CAAC;AAEZ,eAAO,MAAM,6BAA6B;;kBAI/B,CAAC;AAEZ;;;;;;;;GAQG;AACH,eAAO,MAAM,6BAA6B;;;;;kBAsB/B,CAAC;AAEZ,eAAO,MAAM,8BAA8B;;;kBAKhC,CAAC;AAEZ;;;;GAIG;AACH,eAAO,MAAM,6BAA6B;;;kBAW/B,CAAC;AAEZ,eAAO,MAAM,8BAA8B;;kBAIhC,CAAC;AAEZ;;;;GAIG;AACH,MAAM,MAAM,yBAAyB,GAAG,CAAC,CAAC,KAAK,CAC7C,OAAO,+BAA+B,CACvC,CAAC;AACF,MAAM,MAAM,0BAA0B,GAAG,CAAC,CAAC,KAAK,CAC9C,OAAO,gCAAgC,CACxC,CAAC;AACF,MAAM,MAAM,yBAAyB,GAAG,CAAC,CAAC,KAAK,CAC7C,OAAO,+BAA+B,CACvC,CAAC;AACF,MAAM,MAAM,0BAA0B,GAAG,CAAC,CAAC,KAAK,CAC9C,OAAO,gCAAgC,CACxC,CAAC;AACF,MAAM,MAAM,sBAAsB,GAAG,CAAC,CAAC,KAAK,CAC1C,OAAO,4BAA4B,CACpC,CAAC;AACF,MAAM,MAAM,uBAAuB,GAAG,CAAC,CAAC,KAAK,CAC3C,OAAO,6BAA6B,CACrC,CAAC;AACF,MAAM,MAAM,uBAAuB,GAAG,CAAC,CAAC,KAAK,CAC3C,OAAO,6BAA6B,CACrC,CAAC;AACF,MAAM,MAAM,wBAAwB,GAAG,CAAC,CAAC,KAAK,CAC5C,OAAO,8BAA8B,CACtC,CAAC;AACF,MAAM,MAAM,uBAAuB,GAAG,CAAC,CAAC,KAAK,CAC3C,OAAO,6BAA6B,CACrC,CAAC;AACF,MAAM,MAAM,wBAAwB,GAAG,CAAC,CAAC,KAAK,CAC5C,OAAO,8BAA8B,CACtC,CAAC"}
+{"version":3,"file":"ops-blueprint.d.ts","sourceRoot":"","sources":["../../src/schemas/ops-blueprint.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAaxB;;;;;;;;;;;;;;GAcG;AACH,eAAO,MAAM,+BAA+B;;;;;;;;;kBAkDjC,CAAC;AAEZ;;;;GAIG;AACH,eAAO,MAAM,gCAAgC;;;;;kBAqBlC,CAAC;AAEZ;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AACH,eAAO,MAAM,+BAA+B;;;;;;;;;kBA+CjC,CAAC;AAEZ;;;;GAIG;AACH,eAAO,MAAM,gCAAgC;;;;kBAalC,CAAC;AAEZ;;;;;;;;;;;;;;;;;;;GAmBG;AACH,eAAO,MAAM,4BAA4B;;;;;;kBAsC9B,CAAC;AAEZ,eAAO,MAAM,6BAA6B;;kBAI/B,CAAC;AAEZ;;;;;;;;GAQG;AACH,eAAO,MAAM,6BAA6B;;;;;kBAsB/B,CAAC;AAEZ,eAAO,MAAM,8BAA8B;;;kBAKhC,CAAC;AAEZ;;;;GAIG;AACH,eAAO,MAAM,6BAA6B;;;kBAW/B,CAAC;AAEZ,eAAO,MAAM,8BAA8B;;kBAIhC,CAAC;AAEZ;;;;GAIG;AACH,MAAM,MAAM,yBAAyB,GAAG,CAAC,CAAC,KAAK,CAC7C,OAAO,+BAA+B,CACvC,CAAC;AACF,MAAM,MAAM,0BAA0B,GAAG,CAAC,CAAC,KAAK,CAC9C,OAAO,gCAAgC,CACxC,CAAC;AACF,MAAM,MAAM,yBAAyB,GAAG,CAAC,CAAC,KAAK,CAC7C,OAAO,+BAA+B,CACvC,CAAC;AACF,MAAM,MAAM,0BAA0B,GAAG,CAAC,CAAC,KAAK,CAC9C,OAAO,gCAAgC,CACxC,CAAC;AACF,MAAM,MAAM,sBAAsB,GAAG,CAAC,CAAC,KAAK,CAC1C,OAAO,4BAA4B,CACpC,CAAC;AACF,MAAM,MAAM,uBAAuB,GAAG,CAAC,CAAC,KAAK,CAC3C,OAAO,6BAA6B,CACrC,CAAC;AACF,MAAM,MAAM,uBAAuB,GAAG,CAAC,CAAC,KAAK,CAC3C,OAAO,6BAA6B,CACrC,CAAC;AACF,MAAM,MAAM,wBAAwB,GAAG,CAAC,CAAC,KAAK,CAC5C,OAAO,8BAA8B,CACtC,CAAC;AACF,MAAM,MAAM,uBAAuB,GAAG,CAAC,CAAC,KAAK,CAC3C,OAAO,6BAA6B,CACrC,CAAC;AACF,MAAM,MAAM,wBAAwB,GAAG,CAAC,CAAC,KAAK,CAC5C,OAAO,8BAA8B,CACtC,CAAC"}

package/dist/schemas/ops-blueprint.js

@@ -7,7 +7,7 @@
  *     persisting the result. Optionally pins as the operator default
  *     for its `(appId, contractHash)` group.
  *   - `ggui_ops_list_blueprints` — enumerate blueprint metadata
- *     (no code body) under tenancy + optional filters. Sorted by
+ *     (no code body) under the caller's app scope + optional filters. Sorted by
  *     `createdAt desc`.
  *   - `ggui_ops_update_blueprint` — toggle the operator-default flag
  *     and/or patch variance tags. Immutable fields (contractHash,
@@ -19,11 +19,12 @@
  * The schemas live in `@ggui-ai/protocol` (not the handler package)
  * for the same reason all wire-shape schemas do: the protocol package
  * is the source of truth for every MCP wire surface, and consumers
- * (cloud pod handlers, console UI, fixture authors) can import from
+ * (a hosted deployment's handlers, console UI, fixture authors) can import from
  * one place. Handler package wraps these into `SharedHandler`
  * factories.
  */
 import { z } from 'zod';
+import { GENERATOR_ID_PATTERN } from '../types/blueprint-source.js';
 import { dataContractSchema, jsonValueSchema, } from './data-contract.js';
 import { blueprintSchema, blueprintVarianceSchema, llmBlueprintSourceSchema, userBlueprintSourceSchema, } from './blueprint.js';
 /**
@@ -51,9 +52,11 @@ export const opsGenerateBlueprintInputSchema = z
     contract: dataContractSchema,
     generator: z
         .string()
-        .min(1)
+        .regex(GENERATOR_ID_PATTERN, {
+        error: 'generator is an identity `ui-gen-<tier>` — one tier token, no model segment (ggui#924)',
+    })
         .optional()
-        .describe('Generator slug (e.g. `ui-gen-default-haiku-4-5`). When omitted, dispatches through `GeneratorRegistry.defaultGenerator()`.'),
+        .describe('Generator identity (e.g. `ui-gen-default`; the model is chosen by the deployment and reported on `source.model`). When omitted, dispatches through `GeneratorRegistry.defaultGenerator()`.'),
     persona: z
         .string()
         .optional()
@@ -106,11 +109,11 @@ export const opsGenerateBlueprintOutputSchema = z
  *   - Seeding pre-vetted blueprints at deploy time (fixture corpus,
  *     migration imports).
  *   - Round-tripping export+reimport — operator exports a blueprint
- *     from one tenant and re-registers it in another.
+ *     from one app (or one deployment) and re-registers it in another.
  *   - Reapplying a fixed version of a blueprint after live edits
  *     (manual recovery from a bad generate run).
  *
- * Same tenancy + variance + default-pin semantics as
+ * Same app-scoping + variance + default-pin semantics as
  * `*_generate_*`; the only difference is the LLM/generator dispatch
  * is replaced with a verbatim accept of the operator's
  * `componentCode` string.
@@ -206,9 +209,11 @@ export const opsListBlueprintsInputSchema = z
         .describe('Filter to a single `(appId, contractHash)` group. Combine with `generator` / `persona` to narrow within the group.'),
     generator: z
         .string()
-        .min(1)
+        .regex(GENERATOR_ID_PATTERN, {
+        error: 'generator is an identity `ui-gen-<tier>` — one tier token, no model segment (ggui#924)',
+    })
         .optional()
-        .describe('Filter to engine-generated blueprints (`source.kind === "llm"`) whose `source.generator` equals this slug. `user`-sourced rows never match (they carry no engine provenance).'),
+        .describe('Filter to engine-generated blueprints (`source.kind === "llm"`) whose `source.generator` equals this identity (`ui-gen-<tier>`, e.g. `ui-gen-advanced`). `user`-sourced rows never match (they carry no engine provenance).'),
     persona: z
         .string()
         .optional()

package/dist/schemas/render-input-envelope.js

@@ -7,7 +7,7 @@ import { renderInputShape } from './mcp.js';
  * either wire form (canonical `provider:model` or LiteLLM `provider/model`;
  * aliases resolve in both). The render handler parses this BEFORE its
  * pre-generation gate, so a malformed route is a contract error at zod path
- * `infra.model` — never a policy refusal (`model_not_in_tier` is reserved
+ * `infra.model` — never a policy refusal (`model_not_allowed` is reserved
  * for a well-formed route with no rate row on the effective tier).
  *
  * Kept OUT of the registered shape on purpose: `@ggui-ai/iframe-runtime`

package/dist/types/blueprint-source.d.ts

@@ -11,7 +11,7 @@
  *
  *   - `llm` — engine-generated. `generator` is the slug of the
  *     {@link UiGenerator} that produced the component code; `model` is
- *     the LLM model id the engine called. Both REQUIRED: every
+ *     the route the engine called, as a `ModelRef`. Both REQUIRED: every
  *     generation mint site has them in scope, and an engine-generated
  *     artifact without them is not a real state.
  *   - `user` — developer-registered / hand-authored. Covers
@@ -30,21 +30,41 @@
  * cache (invalidation = regeneration, never data loss), so unlabeled
  * rows are dropped at the trust boundary, never coerced.
  */
+import { type ModelRef } from "./llm-route.js";
 /** Closed list of `BlueprintSource` discriminants. */
 export declare const BLUEPRINT_SOURCE_KINDS: readonly ["llm", "user", "curated"];
 /** Discriminant of {@link BlueprintSource}. */
 export type BlueprintSourceKind = (typeof BLUEPRINT_SOURCE_KINDS)[number];
+/**
+ * The de-modeled generator identity (ggui#924): `ui-gen-` + ONE tier token
+ * — `ui-gen-default`, `ui-gen-advanced`, or an operator-defined tier. No
+ * model segment: the model is its own field, so a model retirement never
+ * renames an identity or re-keys a stored record. The template admits any
+ * `ui-gen-*` at the type level; {@link isGeneratorId} is the grammar.
+ */
+export declare const GENERATOR_ID_PATTERN: RegExp;
+/** A generator identity — see {@link GENERATOR_ID_PATTERN}. */
+export type GeneratorId = `ui-gen-${string}`;
+/** Whether `value` is a generator identity: one tier token, no model segment. */
+export declare function isGeneratorId(value: string): value is GeneratorId;
 /** Engine-generated — full engine provenance is mandatory. */
 export interface LlmBlueprintSource {
     readonly kind: "llm";
     /**
-     * Slug of the generator that produced the component code (e.g.
-     * `'ui-gen-default-haiku-4-5'`). The server's `GeneratorRegistry` is
-     * the authority for which slugs exist on a given deployment.
+     * The generator identity that produced the component code (e.g.
+     * `'ui-gen-default'`), de-modeled — see {@link GENERATOR_ID_PATTERN}.
+     * The server's `GeneratorRegistry` is the authority for which
+     * identities exist on a given deployment.
+     */
+    readonly generator: GeneratorId;
+    /**
+     * The route the generator's LLM call used, rendered in the registry's
+     * spelling (`<prefix>/<model>`; {@link ModelRef}, composed only by
+     * `modelRefOfRoute`). Registry ids (`'anthropic/claude-haiku-4-5'`) are
+     * the subset the registry lists; a self-hoster's bedrock or OpenRouter
+     * route is a ref too. One spelling per route: a dated wire id is refused.
      */
-    readonly generator: string;
-    /** Model id of the LLM call the generator made. */
-    readonly model: string;
+    readonly model: ModelRef;
 }
 /** Developer-registered / hand-authored — no engine provenance exists. */
 export interface UserBlueprintSource {

package/dist/types/blueprint-source.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"blueprint-source.d.ts","sourceRoot":"","sources":["../../src/types/blueprint-source.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+BG;AAIH,sDAAsD;AACtD,eAAO,MAAM,sBAAsB,qCAAsC,CAAC;AAE1E,+CAA+C;AAC/C,MAAM,MAAM,mBAAmB,GAAG,CAAC,OAAO,sBAAsB,CAAC,CAAC,MAAM,CAAC,CAAC;AAE1E,8DAA8D;AAC9D,MAAM,WAAW,kBAAkB;IACjC,QAAQ,CAAC,IAAI,EAAE,KAAK,CAAC;IACrB;;;;OAIG;IACH,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,mDAAmD;IACnD,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;CACxB;AAED,0EAA0E;AAC1E,MAAM,WAAW,mBAAmB;IAClC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;CACvB;AAED,0EAA0E;AAC1E,MAAM,WAAW,sBAAsB;IACrC,QAAQ,CAAC,IAAI,EAAE,SAAS,CAAC;CAC1B;AAED,MAAM,MAAM,eAAe,GACvB,kBAAkB,GAClB,mBAAmB,GACnB,sBAAsB,CAAC;AAE3B;;;;;;;GAOG;AACH,wBAAgB,oBAAoB,CAAC,KAAK,EAAE,OAAO,GAAG,eAAe,GAAG,IAAI,CAoB3E;AAED,uDAAuD;AACvD,wBAAgB,iBAAiB,CAAC,KAAK,EAAE,OAAO,GAAG,KAAK,IAAI,eAAe,CAE1E;AAMD;;;;;;;;;;;;;;;;GAgBG;AACH,eAAO,MAAM,0BAA0B;;;;CAI7B,CAAC;AAEX;;;;;GAKG;AACH,MAAM,WAAW,mBAAmB;IAClC,QAAQ,CAAC,UAAU,EAAE,mBAAmB,CAAC;IACzC,QAAQ,CAAC,eAAe,CAAC,EAAE,MAAM,CAAC;IAClC,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAC;CAC/B;AAED,qEAAqE;AACrE,wBAAgB,qBAAqB,CACnC,MAAM,EAAE,eAAe,GACtB,mBAAmB,CAQrB;AAED;;;;;;;;;;;;;GAaG;AACH,wBAAgB,qBAAqB,CAAC,GAAG,EAAE;IACzC,QAAQ,CAAC,UAAU,CAAC,EAAE,OAAO,CAAC;IAC9B,QAAQ,CAAC,eAAe,CAAC,EAAE,OAAO,CAAC;IACnC,QAAQ,CAAC,WAAW,CAAC,EAAE,OAAO,CAAC;CAChC,GAAG,eAAe,GAAG,IAAI,CAMzB"}
+{"version":3,"file":"blueprint-source.d.ts","sourceRoot":"","sources":["../../src/types/blueprint-source.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+BG;AAGH,OAAO,EAAc,KAAK,QAAQ,EAAE,MAAM,aAAa,CAAC;AAExD,sDAAsD;AACtD,eAAO,MAAM,sBAAsB,qCAAsC,CAAC;AAE1E,+CAA+C;AAC/C,MAAM,MAAM,mBAAmB,GAAG,CAAC,OAAO,sBAAsB,CAAC,CAAC,MAAM,CAAC,CAAC;AAE1E;;;;;;GAMG;AACH,eAAO,MAAM,oBAAoB,QAAuB,CAAC;AAEzD,+DAA+D;AAC/D,MAAM,MAAM,WAAW,GAAG,UAAU,MAAM,EAAE,CAAC;AAE7C,iFAAiF;AACjF,wBAAgB,aAAa,CAAC,KAAK,EAAE,MAAM,GAAG,KAAK,IAAI,WAAW,CAEjE;AAED,8DAA8D;AAC9D,MAAM,WAAW,kBAAkB;IACjC,QAAQ,CAAC,IAAI,EAAE,KAAK,CAAC;IACrB;;;;;OAKG;IACH,QAAQ,CAAC,SAAS,EAAE,WAAW,CAAC;IAChC;;;;;;OAMG;IACH,QAAQ,CAAC,KAAK,EAAE,QAAQ,CAAC;CAC1B;AAED,0EAA0E;AAC1E,MAAM,WAAW,mBAAmB;IAClC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;CACvB;AAED,0EAA0E;AAC1E,MAAM,WAAW,sBAAsB;IACrC,QAAQ,CAAC,IAAI,EAAE,SAAS,CAAC;CAC1B;AAED,MAAM,MAAM,eAAe,GACvB,kBAAkB,GAClB,mBAAmB,GACnB,sBAAsB,CAAC;AAE3B;;;;;;;GAOG;AACH,wBAAgB,oBAAoB,CAAC,KAAK,EAAE,OAAO,GAAG,eAAe,GAAG,IAAI,CAuB3E;AAED,uDAAuD;AACvD,wBAAgB,iBAAiB,CAAC,KAAK,EAAE,OAAO,GAAG,KAAK,IAAI,eAAe,CAE1E;AAMD;;;;;;;;;;;;;;;;GAgBG;AACH,eAAO,MAAM,0BAA0B;;;;CAI7B,CAAC;AAEX;;;;;GAKG;AACH,MAAM,WAAW,mBAAmB;IAClC,QAAQ,CAAC,UAAU,EAAE,mBAAmB,CAAC;IACzC,QAAQ,CAAC,eAAe,CAAC,EAAE,MAAM,CAAC;IAClC,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAC;CAC/B;AAED,qEAAqE;AACrE,wBAAgB,qBAAqB,CACnC,MAAM,EAAE,eAAe,GACtB,mBAAmB,CAQrB;AAED;;;;;;;;;;;;;GAaG;AACH,wBAAgB,qBAAqB,CAAC,GAAG,EAAE;IACzC,QAAQ,CAAC,UAAU,CAAC,EAAE,OAAO,CAAC;IAC9B,QAAQ,CAAC,eAAe,CAAC,EAAE,OAAO,CAAC;IACnC,QAAQ,CAAC,WAAW,CAAC,EAAE,OAAO,CAAC;CAChC,GAAG,eAAe,GAAG,IAAI,CAMzB"}

package/dist/types/blueprint-source.js

@@ -11,7 +11,7 @@
  *
  *   - `llm` — engine-generated. `generator` is the slug of the
  *     {@link UiGenerator} that produced the component code; `model` is
- *     the LLM model id the engine called. Both REQUIRED: every
+ *     the route the engine called, as a `ModelRef`. Both REQUIRED: every
  *     generation mint site has them in scope, and an engine-generated
  *     artifact without them is not a real state.
  *   - `user` — developer-registered / hand-authored. Covers
@@ -31,8 +31,21 @@
  * rows are dropped at the trust boundary, never coerced.
  */
 import { isRecord } from "../validation/is-record.js";
+import { isModelRef } from "./llm-route.js";
 /** Closed list of `BlueprintSource` discriminants. */
 export const BLUEPRINT_SOURCE_KINDS = ["llm", "user", "curated"];
+/**
+ * The de-modeled generator identity (ggui#924): `ui-gen-` + ONE tier token
+ * — `ui-gen-default`, `ui-gen-advanced`, or an operator-defined tier. No
+ * model segment: the model is its own field, so a model retirement never
+ * renames an identity or re-keys a stored record. The template admits any
+ * `ui-gen-*` at the type level; {@link isGeneratorId} is the grammar.
+ */
+export const GENERATOR_ID_PATTERN = /^ui-gen-[a-z0-9]+$/;
+/** Whether `value` is a generator identity: one tier token, no model segment. */
+export function isGeneratorId(value) {
+    return GENERATOR_ID_PATTERN.test(value);
+}
 /**
  * Validating narrower for trust boundaries (DB row → union, JSON
  * artifact → union). Returns a CANONICAL rebuild of the union value —
@@ -50,9 +63,12 @@ export function parseBlueprintSource(value) {
         case "llm": {
             const generator = v["generator"];
             const model = v["model"];
-            if (typeof generator !== "string" || generator.length === 0)
+            // ggui#924: a modeled identity (`ui-gen-default-haiku-4-5`) or a
+            // non-route model (a bare `claude-…`, a dated API name) is not a
+            // provenance — null.
+            if (typeof generator !== "string" || !isGeneratorId(generator))
                 return null;
-            if (typeof model !== "string" || model.length === 0)
+            if (typeof model !== "string" || !isModelRef(model))
                 return null;
             return { kind: "llm", generator, model };
         }

package/dist/types/blueprint.d.ts

@@ -18,7 +18,7 @@
  *     advanced-generator iterative-loop output routinely exceeds
  *     them). The in-memory adapter skips the body store (in-process
  *     `Map<codeHash, string>`).
- *   - **Tenancy.** Scoped per `(appId, contractHash)`. Different apps'
+ *   - **App scope.** Scoped per `(appId, contractHash)`. Different apps'
  *     contract may coincidentally hash the same; their blueprints
  *     must never cross-pollinate. Rows are keyed by `blueprintId`;
  *     lookups go through an indexed `(appId, contractHash)` query.
@@ -127,7 +127,7 @@ export interface Blueprint {
      * key.
      */
     readonly contractHash: string;
-    /** Tenancy scope. Composite secondary key with `contractHash`. */
+    /** App scope. Composite secondary key with `contractHash`. */
     readonly appId: string;
     /**
      * S3 URL (`s3://<bucket>/<key>`) of the generated code body when

package/dist/types/blueprint.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"blueprint.d.ts","sourceRoot":"","sources":["../../src/types/blueprint.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgCG;AACH,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,uBAAuB,CAAC;AAC7D,OAAO,KAAK,EAAE,YAAY,EAAE,UAAU,EAAE,MAAM,oBAAoB,CAAC;AAEnE;;;;;;;;;;;;GAYG;AACH,MAAM,WAAW,sBAAsB;IACrC;;qDAEiD;IACjD,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,uEAAuE;IACvE,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB;0CACsC;IACtC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB;yCACqC;IACrC,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B;yCACqC;IACrC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;CACzB;AAED;;;;;;;;GAQG;AACH,MAAM,WAAW,wBAAwB;IACvC;8CAC0C;IAC1C,QAAQ,CAAC,OAAO,CAAC,EAAE,OAAO,CAAC,sBAAsB,CAAC,CAAC;IACnD;yCACqC;IACrC,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC;IAC5B,0DAA0D;IAC1D,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC;CACxB;AAED;;;;;;GAMG;AACH,MAAM,WAAW,iBAAiB;IAChC;;;OAGG;IACH,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC;IAC1B;;;;;;OAMG;IACH,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC;IAC5B;;;OAGG;IACH,QAAQ,CAAC,OAAO,CAAC,EAAE,UAAU,CAAC;IAC9B;;;OAGG;IACH,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAC;CAC9B;AAED;;;GAGG;AACH,MAAM,WAAW,SAAS;IACxB,mEAAmE;IACnE,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B;;;;OAIG;IACH,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;IAC9B,kEAAkE;IAClE,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB;;;;;;OAMG;IACH,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC;IAC5B;;;OAGG;IACH,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAC3B;;;;;;;;;;OAUG;IACH,QAAQ,CAAC,cAAc,CAAC,EAAE,MAAM,CAAC;IACjC;;;;;;;;;OASG;IACH,QAAQ,CAAC,MAAM,EAAE,eAAe,CAAC;IACjC;;;;OAIG;IACH,QAAQ,CAAC,cAAc,CAAC,EAAE,MAAM,CAAC;IACjC;;;OAGG;IACH,QAAQ,CAAC,QAAQ,EAAE,iBAAiB,CAAC;IACrC;;;;;;;;;OASG;IACH,QAAQ,CAAC,iBAAiB,CAAC,EAAE,IAAI,CAAC;IAClC,qDAAqD;IACrD,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B;;;;OAIG;IACH,QAAQ,CAAC,SAAS,EAAE,OAAO,GAAG,UAAU,CAAC;IACzC;;;;;OAKG;IACH,QAAQ,CAAC,QAAQ,EAAE,YAAY,CAAC;IAChC;;;;;;;;;;;;;;;;;OAiBG;IACH,QAAQ,CAAC,iBAAiB,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;CAChD"}
+{"version":3,"file":"blueprint.d.ts","sourceRoot":"","sources":["../../src/types/blueprint.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgCG;AACH,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,uBAAuB,CAAC;AAC7D,OAAO,KAAK,EAAE,YAAY,EAAE,UAAU,EAAE,MAAM,oBAAoB,CAAC;AAEnE;;;;;;;;;;;;GAYG;AACH,MAAM,WAAW,sBAAsB;IACrC;;qDAEiD;IACjD,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,uEAAuE;IACvE,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB;0CACsC;IACtC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB;yCACqC;IACrC,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B;yCACqC;IACrC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;CACzB;AAED;;;;;;;;GAQG;AACH,MAAM,WAAW,wBAAwB;IACvC;8CAC0C;IAC1C,QAAQ,CAAC,OAAO,CAAC,EAAE,OAAO,CAAC,sBAAsB,CAAC,CAAC;IACnD;yCACqC;IACrC,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC;IAC5B,0DAA0D;IAC1D,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC;CACxB;AAED;;;;;;GAMG;AACH,MAAM,WAAW,iBAAiB;IAChC;;;OAGG;IACH,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC;IAC1B;;;;;;OAMG;IACH,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC;IAC5B;;;OAGG;IACH,QAAQ,CAAC,OAAO,CAAC,EAAE,UAAU,CAAC;IAC9B;;;OAGG;IACH,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAC;CAC9B;AAED;;;GAGG;AACH,MAAM,WAAW,SAAS;IACxB,mEAAmE;IACnE,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B;;;;OAIG;IACH,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;IAC9B,8DAA8D;IAC9D,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB;;;;;;OAMG;IACH,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC;IAC5B;;;OAGG;IACH,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAC3B;;;;;;;;;;OAUG;IACH,QAAQ,CAAC,cAAc,CAAC,EAAE,MAAM,CAAC;IACjC;;;;;;;;;OASG;IACH,QAAQ,CAAC,MAAM,EAAE,eAAe,CAAC;IACjC;;;;OAIG;IACH,QAAQ,CAAC,cAAc,CAAC,EAAE,MAAM,CAAC;IACjC;;;OAGG;IACH,QAAQ,CAAC,QAAQ,EAAE,iBAAiB,CAAC;IACrC;;;;;;;;;OASG;IACH,QAAQ,CAAC,iBAAiB,CAAC,EAAE,IAAI,CAAC;IAClC,qDAAqD;IACrD,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B;;;;OAIG;IACH,QAAQ,CAAC,SAAS,EAAE,OAAO,GAAG,UAAU,CAAC;IACzC;;;;;OAKG;IACH,QAAQ,CAAC,QAAQ,EAAE,YAAY,CAAC;IAChC;;;;;;;;;;;;;;;;;OAiBG;IACH,QAAQ,CAAC,iBAAiB,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;CAChD"}

package/dist/types/data-contract.d.ts

@@ -188,7 +188,7 @@ export interface StreamChannelEntry {
      * `CTR_SCHEMA_INCOMPAT` linter additionally checks that the feed
      * tool's declared return schema is a subset of this schema — see
      * the docstring on {@link ActionEntry.schema} for the schema-subset
-     * algorithm and the `SCHEMA_MISMATCH_ERROR` failure surface.
+     * algorithm and the `schema_mismatch_error` failure surface.
      */
     schema: JsonSchema;
     /** Example payload (used for documentation and smoke testing). Typed as {@link JsonValue}. */
@@ -276,7 +276,7 @@ export interface ActionEntry {
      * advisory — the agent owns the actual tool call on its next turn
      * and is responsible for shaping the payload as the tool expects.
      * For tools registered on THIS server, the F4 schema-compat checker
-     * surfaces a `SCHEMA_MISMATCH_ERROR` at render-time / blueprint-
+     * surfaces a `schema_mismatch_error` at render-time / blueprint-
      * registration-time so authors get fail-loud feedback.
      *
      * The canonical algorithm lives in
@@ -610,7 +610,7 @@ export interface GadgetDescriptor {
     package: string;
     /**
      * ggui-hosted bundle URL — the preferred distribution path. Same
-     * origin as the iframe in single-tenant OSS deployments (served
+     * origin as the iframe in single-deployment installs (served
      * from `/_ggui/libs/<libId>/bundle.js`) and the ggui marketplace
      * CDN in cloud deployments. CSP `script-src` allowlists only the
      * ggui origin — no per-plugin third-party origins.

package/dist/types/domain-error-codes.d.ts

@@ -0,0 +1,167 @@
+/**
+ * The Plane-2 registry — the ONLY list of domain-error slugs (ggui#880).
+ *
+ * SPEC §7.9 Plane 2: a recoverable, contract-level failure the caller can
+ * fix — a missing session or handshake, props that do not satisfy the
+ * contract, an undeclared channel. The MCP SDK ships a thrown handler error
+ * to the agent as `{content: [{type: 'text', text: error.message}],
+ * isError: true}` and nothing else, so the slug travels as the LEADING
+ * token of that text — `<code>: <detail>` — composed by the `DomainError`
+ * base in `../errors/domain-error` from a code in this registry. A reader
+ * branches on `text.startsWith(code + ': ')` for a registered code and on
+ * nothing else.
+ *
+ * Same posture as the refusal registry in `./refusal-codes`: `code === key`
+ * is forced at the definer, the code type is derived from the keys, and
+ * the two registries are disjoint (pinned) — one code names one plane.
+ */
+/**
+ * How a caller recovers from a Plane-2 failure.
+ *
+ * - `retry-same-id` — fix the input and retry on the SAME handshakeId /
+ *   sessionId; nothing was consumed.
+ * - `re-mint` — the id itself is gone (unknown, consumed, expired,
+ *   another app's); mint a fresh one (`ggui_handshake`, then `ggui_render`).
+ * - `later` — a dependency the server fetches was unavailable; time
+ *   restores it, the input was fine.
+ */
+export declare const DOMAIN_ERROR_RECOVERIES: readonly ["retry-same-id", "re-mint", "later"];
+/** One member of {@link DOMAIN_ERROR_RECOVERIES}. */
+export type DomainErrorRecovery = (typeof DOMAIN_ERROR_RECOVERIES)[number];
+/**
+ * A data-plane `tools/call` name a Plane-2 slug may be emitted on. The
+ * template admits any `ggui_*` name at the type level; the registry's own
+ * suite narrows every row's `tools` to the data-plane set (no `ggui_ops_*`,
+ * no `ggui_protocol_*`).
+ */
+export type DataPlaneToolName = `ggui_${string}`;
+/**
+ * The registry with its per-key literal types kept (ggui#889):
+ * `DOMAIN_ERROR_ROWS.session_not_found.code` is `'session_not_found'`,
+ * its `recovery` is `'re-mint'`. {@link DOMAIN_ERROR_REGISTRY} is the
+ * same object read through the normalized row type.
+ */
+export declare const DOMAIN_ERROR_ROWS: {
+    readonly session_not_found: {
+        readonly code: "session_not_found";
+        readonly tools: readonly ["ggui_consume", "ggui_get_session", "ggui_get_render_source", "ggui_update", "ggui_amend", "ggui_emit", "ggui_runtime_pull"];
+        readonly recovery: "re-mint";
+        readonly emitter: "the session lookup on every session-scoped tool";
+        readonly description: "The sessionId names no session this caller can reach — never minted, expired, closed, or owned by another app (cross-app access surfaces uniformly). Re-handshake and re-render to mint a fresh one.";
+    };
+    readonly handshake_not_found: {
+        readonly code: "handshake_not_found";
+        readonly tools: readonly ["ggui_render"];
+        readonly recovery: "re-mint";
+        readonly emitter: "the handshake-record lookup at ggui_render";
+        readonly description: "The handshakeId is unknown, already consumed by a render, or expired. Call ggui_handshake again for a fresh id, then render with the new pair.";
+    };
+    readonly contract_violation: {
+        readonly code: "contract_violation";
+        readonly tools: readonly ["ggui_render", "ggui_update", "ggui_amend", "ggui_emit"];
+        readonly recovery: "retry-same-id";
+        readonly emitter: "the props / payload validator against the contract";
+        readonly description: "Props or a payload do not satisfy the contract's spec — a missing required prop included. Fix the values and retry with the same id; nothing was consumed.";
+    };
+    readonly schema_mismatch_error: {
+        readonly code: "schema_mismatch_error";
+        readonly tools: readonly ["ggui_render"];
+        readonly recovery: "retry-same-id";
+        readonly emitter: "the schema-compatibility check between the contract and the registered tool shapes";
+        readonly description: "An actionSpec or streamSpec schema is not a subset of the named tool's registered shape. Adjust the contract or the tool, then retry with the same handshakeId.";
+    };
+    readonly contract_validation_failed: {
+        readonly code: "contract_validation_failed";
+        readonly tools: readonly ["ggui_render"];
+        readonly recovery: "retry-same-id";
+        readonly emitter: "the contract lint gate (shape, retired fields, schema metadata, cross-references, schema compatibility)";
+        readonly description: "The contract failed the lint gate; the detail names the category and the finding. Fix the contract and retry with the same handshakeId.";
+    };
+    readonly override_contract_invalid: {
+        readonly code: "override_contract_invalid";
+        readonly tools: readonly ["ggui_render"];
+        readonly recovery: "retry-same-id";
+        readonly emitter: "the override gate at ggui_render";
+        readonly description: "override.contract failed validation — an override commits the caller to a conforming contract. Drop the override and render the suggestion, or fix the draft.";
+    };
+    readonly channel_not_declared: {
+        readonly code: "channel_not_declared";
+        readonly tools: readonly ["ggui_emit"];
+        readonly recovery: "retry-same-id";
+        readonly emitter: "ggui_emit's channel check against the contract's streamSpec";
+        readonly description: "The channel is not declared by the session's contract. Emit on a declared channel; the detail lists them.";
+    };
+    readonly invalid_complete: {
+        readonly code: "invalid_complete";
+        readonly tools: readonly ["ggui_emit"];
+        readonly recovery: "retry-same-id";
+        readonly emitter: "ggui_emit's completion check";
+        readonly description: "A completion was signalled for a channel that cannot complete in its current state. Emit on the channel first, or omit the completion.";
+    };
+    readonly gadget_not_registered: {
+        readonly code: "gadget_not_registered";
+        readonly tools: readonly ["ggui_render"];
+        readonly recovery: "retry-same-id";
+        readonly emitter: "the gadget gate at ggui_render";
+        readonly description: "A clientCapabilities.gadgets reference names an export the app's gadget registry does not carry. Drop the reference or fix the name; the detail suggests the nearest match.";
+    };
+    readonly gadget_package_mismatch: {
+        readonly code: "gadget_package_mismatch";
+        readonly tools: readonly ["ggui_render"];
+        readonly recovery: "retry-same-id";
+        readonly emitter: "the gadget gate at ggui_render";
+        readonly description: "A gadget export is registered, but only under a different package than the contract requested. Request the registered package; the detail names it.";
+    };
+    readonly gadget_public_env_missing: {
+        readonly code: "gadget_public_env_missing";
+        readonly tools: readonly ["ggui_render"];
+        readonly recovery: "retry-same-id";
+        readonly emitter: "the gadget gate at ggui_render";
+        readonly description: "A registered wrapper requires a public-env key the app has not set. Set the key on the app's public env, then retry.";
+    };
+    readonly duplicate_gadget_hook: {
+        readonly code: "duplicate_gadget_hook";
+        readonly tools: readonly ["ggui_render"];
+        readonly recovery: "retry-same-id";
+        readonly emitter: "the gadget gate at ggui_render";
+        readonly description: "Two gadget packages export the same name; the generated import would collide. Reference one of them.";
+    };
+    readonly gadget_types_fetch_failed: {
+        readonly code: "gadget_types_fetch_failed";
+        readonly tools: readonly ["ggui_render"];
+        readonly recovery: "later";
+        readonly emitter: "the gadget type fetch before cold generation";
+        readonly description: "Fetching a gadget package's types failed; the input was fine. Retry after a short delay.";
+    };
+    readonly gadget_catalog_integrity: {
+        readonly code: "gadget_catalog_integrity";
+        readonly tools: readonly ["ggui_render"];
+        readonly recovery: "retry-same-id";
+        readonly emitter: "the app's gadget catalog resolver at ggui_render";
+        readonly description: "The app's gadget catalog is inconsistent with its registrations. Repair the catalog, then retry with the same handshakeId.";
+    };
+    readonly blueprint_rejected: {
+        readonly code: "blueprint_rejected";
+        readonly tools: readonly ["ggui_render"];
+        readonly recovery: "retry-same-id";
+        readonly emitter: "the blueprint registry on registration";
+        readonly description: "The blueprint was rejected by the registry's error-level findings; the detail lists them. Fix the contract and retry with the same handshakeId.";
+    };
+};
+/** A domain-error code = a registry key. Derived; never a second list. */
+export type DomainErrorCode = keyof typeof DOMAIN_ERROR_ROWS;
+/** A registry row, as consumers read it. */
+export interface DomainErrorRow {
+    readonly code: DomainErrorCode;
+    readonly tools: readonly DataPlaneToolName[];
+    readonly recovery: DomainErrorRecovery;
+    readonly emitter: string;
+    readonly description: string;
+}
+/** The registry consumers read. */
+export declare const DOMAIN_ERROR_REGISTRY: Readonly<Record<DomainErrorCode, DomainErrorRow>>;
+/** Whether `value` is a registered domain-error code. */
+export declare function isDomainErrorCode(value: string): value is DomainErrorCode;
+/** Every registered code, in registry order. */
+export declare const DOMAIN_ERROR_CODES: readonly DomainErrorCode[];
+//# sourceMappingURL=domain-error-codes.d.ts.map

package/dist/types/domain-error-codes.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"domain-error-codes.d.ts","sourceRoot":"","sources":["../../src/types/domain-error-codes.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAEH;;;;;;;;;GASG;AACH,eAAO,MAAM,uBAAuB,gDAAiD,CAAC;AAEtF,qDAAqD;AACrD,MAAM,MAAM,mBAAmB,GAAG,CAAC,OAAO,uBAAuB,CAAC,CAAC,MAAM,CAAC,CAAC;AAE3E;;;;;GAKG;AACH,MAAM,MAAM,iBAAiB,GAAG,QAAQ,MAAM,EAAE,CAAC;AAyBjD;;;;;GAKG;AACH,eAAO,MAAM,iBAAiB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAsI5B,CAAC;AAEH,0EAA0E;AAC1E,MAAM,MAAM,eAAe,GAAG,MAAM,OAAO,iBAAiB,CAAC;AAE7D,4CAA4C;AAC5C,MAAM,WAAW,cAAc;IAC7B,QAAQ,CAAC,IAAI,EAAE,eAAe,CAAC;IAC/B,QAAQ,CAAC,KAAK,EAAE,SAAS,iBAAiB,EAAE,CAAC;IAC7C,QAAQ,CAAC,QAAQ,EAAE,mBAAmB,CAAC;IACvC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;CAC9B;AAED,mCAAmC;AACnC,eAAO,MAAM,qBAAqB,EAAE,QAAQ,CAAC,MAAM,CAAC,eAAe,EAAE,cAAc,CAAC,CACjE,CAAC;AAEpB,yDAAyD;AACzD,wBAAgB,iBAAiB,CAAC,KAAK,EAAE,MAAM,GAAG,KAAK,IAAI,eAAe,CAEzE;AAED,gDAAgD;AAChD,eAAO,MAAM,kBAAkB,EAAE,SAAS,eAAe,EACC,CAAC"}