@ggui-ai/protocol 0.15.0 → 0.16.0

package/dist/types/mcp.d.ts

@@ -1,41 +1,21 @@
 import type { z } from 'zod';
 import type { DataContract, JsonObject, JsonSchema, JsonValue } from './data-contract.js';
 import type { DeepReadonly } from './readonly.js';
-import type { consumeInputSchema, getRenderSourceInputSchema, getSessionInputSchema, handshakeInputSchema, handshakeOutputSchema, renderBlueprintInputSchema, renderCacheMarkerSchema, renderErrorSchema, renderInputSchema, renderOutputSchema, resourceReadErrorCodeSchema, resourceReadErrorSchema, runtimePullInputSchema, runtimeTelemetryInputSchema, runtimeTelemetryOutputSchema, searchBlueprintsInputSchema, updateInputSchema, updateOutputSchema, amendInputSchema, amendOutputSchema, declareToolCatalogOutputSchema, gguiGetSessionOutputSchema, gguiSearchBlueprintsOutputSchema, consumeEventEntrySchema, gguiConsumeOutputSchema, gguiEmitOutputSchema, gguiListSessionsOutputSchema } from '../schemas/mcp.js';
+import type { consumeInputSchema, getRenderSourceInputSchema, getSessionInputSchema, handshakeInputSchema, handshakeOutputSchema, renderBlueprintInputSchema, renderCacheMarkerSchema, renderErrorSchema, renderInputSchema, renderOutputSchema, resourceReadErrorCodeSchema, resourceReadErrorSchema, runtimePullInputSchema, runtimeTelemetryInputSchema, runtimeTelemetryOutputSchema, searchBlueprintsInputSchema, updateInputSchema, updateOutputSchema, amendInputSchema, amendOutputSchema, declareToolCatalogOutputSchema, gguiGetSessionOutputSchema, gguiSearchBlueprintsOutputSchema, consumeEventEntrySchema, pendingEventSchema, gguiConsumeOutputSchema, gguiEmitOutputSchema, gguiListSessionsOutputSchema } from '../schemas/mcp.js';
 import type { EventsResponse, ReplayHorizonPassedError } from './ggui-session-event.js';
 export type { GguiSessionStatus } from './render.js';
 /** Target screen size category for responsive layout */
 export type Screen = 'mobile' | 'tablet' | 'desktop' | 'universal';
 /**
- * Pending action stored server-side for agent consumption.
+ * One stored row of the consume pipe — a user action awaiting the agent's
+ * `ggui_consume`. Derived from {@link pendingEventSchema} (ggui#839): the
+ * shape a producer appends and a store drains, on every store.
  *
- * `envelope` is the canonical {@link ConsumeEventEntry} row. `sequence`
- * is the render-scoped monotonic assigned at ingestion; it sits on the
- * row wrapper so consumers can detect gaps without parsing the payload.
- *
- * **Storage note**: the envelope is stored as either a JSON object or
- * a JSON-stringified object, depending on how the deployment's storage
- * layer serializes rows. Consume readers MUST accept both — see
- * {@link parsePendingEnvelope}.
- */
-export interface PendingEvent {
-    /** Stable row id — UUID assigned at ingestion. */
-    id: string;
-    /**
-     * Canonical {@link ConsumeEventEntry} row payload. JSON object or
-     * stringified JSON on the wire (both shapes round-trip through the
-     * consume helpers).
-     */
-    envelope: ConsumeEventEntry | string;
-    /**
-     * GguiSession-scoped monotonic sequence assigned at ingestion. Mirrors
-     * `GguiSession.eventSequence` at the moment this row was appended so
-     * consumers can detect gaps without reading render state.
-     */
-    sequence: number;
-    /** ISO datetime when the row was appended. */
-    createdAt: string;
-}
+ * `envelope` is the canonical {@link ConsumeEventEntry} — always the
+ * object. `id` is the drain_ack key and the idempotency key per
+ * `(sessionId, id)`. `createdAt` is when the row was appended.
+ */
+export type PendingEvent = Readonly<z.infer<typeof pendingEventSchema>>;
 /**
  * Input for ggui_consume tool — long-poll for buffered events on a
  * specific render.
@@ -280,7 +260,7 @@ export type GguiHandshakeOutput = z.infer<typeof handshakeOutputSchema>;
  *
  * Mirrors `handshakeOutputSchema.serverCapabilities` exactly — exported
  * here as a named TypeScript type so server-side composition layers
- * (the OSS `createGguiServer` resolver, the cloud pod composer) can hand
+ * (the OSS `createGguiServer` resolver, a hosted deployment's composer) can hand
  * one back to the handshake factory without re-deriving the shape from
  * the schema.
  *
@@ -395,8 +375,17 @@ export type GguiRuntimeTelemetryOutput = z.infer<typeof runtimeTelemetryOutputSc
  * §7.1; see {@link RenderErrorCode}). The slot stays unassigned so a
  * future canonical code can't silently collide with stale consumers.
  *
+ * `-32001` is RETIRED-RESERVED too (ggui#853): `UNAUTHORIZED` lived
+ * there until the 0.16.0 wave, but `-32001` is the MCP SDK client's own
+ * `RequestTimeout` — minted locally, never sent by a server — so a
+ * client reading the number could not tell a server's UNAUTHORIZED
+ * from its own timeout, the class ggui#836 closed for `-32000`
+ * (`ConnectionClosed`). `UNAUTHORIZED` is `-32007`; the slot stays
+ * unassigned. `error-codes-vs-sdk.test.ts` pins that no ggui-chosen
+ * code equals a code the SDK's `ErrorCode` enum owns.
+ *
  * `-32006` is assigned to `MOUNT_UNAVAILABLE`; new canonical codes come
- * at `-32007` onwards.
+ * at `-32008` onwards.
  */
 export declare const MCP_ERROR_CODES: {
     readonly PARSE_ERROR: -32700;
@@ -404,10 +393,9 @@ export declare const MCP_ERROR_CODES: {
     readonly METHOD_NOT_FOUND: -32601;
     readonly INVALID_PARAMS: -32602;
     readonly INTERNAL_ERROR: -32603;
-    readonly UNAUTHORIZED: -32001;
+    readonly UNAUTHORIZED: -32007;
     readonly SESSION_NOT_FOUND: -32002;
     readonly APP_NOT_FOUND: -32003;
-    readonly CAPABILITY_DENIED: -32005;
     /**
      * A `resources/read` identified the resource but cannot return a
      * mount for it — the component behind it is gone, the server keeps no
@@ -427,19 +415,23 @@ export declare const MCP_ERROR_CODES: {
 /**
  * Platform-specific error codes (-32010 range).
  * These are ggui platform extensions, not part of the core protocol.
+ * `-32010`..`-32013` and `-32020` are retired-reserved (SPEC §7.9,
+ * ggui#910 / ggui#890): declared once, emitted by nothing first-party —
+ * quota, app-limit and concurrency states are refusals or
+ * implementation-range codes, and a contract violation is the Plane-2
+ * `contract_violation` result or the live channel's `CONTRACT_VIOLATION`
+ * frame code, never a JSON-RPC number.
  */
 export declare const PLATFORM_ERROR_CODES: {
-    readonly GENERATION_QUOTA_EXCEEDED: -32010;
-    readonly APP_LIMIT_EXCEEDED: -32011;
-    readonly CONCURRENT_SESSION_LIMIT: -32012;
-    readonly RATE_LIMIT_EXCEEDED: -32013;
     /**
      * The generation queue is saturated — the server, not the caller, is
-     * the limit (contrast `RATE_LIMIT_EXCEEDED`: the caller slows down). HTTP
+     * the limit (contrast a caller-side rate cap, which is a render-gate
+     * REFUSAL — `app_rate_limited` / `issuer_rate_limited`, SPEC §7.1 — the
+     * caller slows down; its former numeric `-32013` is retired-reserved,
+     * SPEC §7.9, ggui#890). HTTP
      * 503 with `Retry-After`, which governs the retry; a parsed request's
      * refusal, so it speaks this table (ggui#836 follow-up).
      */
     readonly GENERATION_OVERLOADED: -32014;
-    readonly CONTRACT_VIOLATION: -32020;
 };
 //# sourceMappingURL=mcp.d.ts.map

package/dist/types/mcp.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"mcp.d.ts","sourceRoot":"","sources":["../../src/types/mcp.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAC7B,OAAO,KAAK,EAAE,YAAY,EAAE,UAAU,EAAE,UAAU,EAAE,SAAS,EAAE,MAAM,iBAAiB,CAAC;AACvF,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,YAAY,CAAC;AAC/C,OAAO,KAAK,EACV,kBAAkB,EAClB,0BAA0B,EAC1B,qBAAqB,EACrB,oBAAoB,EACpB,qBAAqB,EACrB,0BAA0B,EAC1B,uBAAuB,EACvB,iBAAiB,EACjB,iBAAiB,EACjB,kBAAkB,EAClB,2BAA2B,EAC3B,uBAAuB,EACvB,sBAAsB,EACtB,2BAA2B,EAC3B,4BAA4B,EAC5B,2BAA2B,EAC3B,iBAAiB,EACjB,kBAAkB,EAClB,gBAAgB,EAChB,iBAAiB,EACjB,8BAA8B,EAC9B,0BAA0B,EAC1B,gCAAgC,EAChC,uBAAuB,EACvB,uBAAuB,EACvB,oBAAoB,EACpB,4BAA4B,EAC7B,MAAM,gBAAgB,CAAC;AACxB,OAAO,KAAK,EACV,cAAc,EACd,wBAAwB,EACzB,MAAM,sBAAsB,CAAC;AAE9B,YAAY,EAAE,iBAAiB,EAAE,MAAM,UAAU,CAAC;AAQlD,wDAAwD;AACxD,MAAM,MAAM,MAAM,GAAG,QAAQ,GAAG,QAAQ,GAAG,SAAS,GAAG,WAAW,CAAC;AAEnE;;;;;;;;;;;GAWG;AACH,MAAM,WAAW,YAAY;IAC3B,kDAAkD;IAClD,EAAE,EAAE,MAAM,CAAC;IACX;;;;OAIG;IACH,QAAQ,EAAE,iBAAiB,GAAG,MAAM,CAAC;IACrC;;;;OAIG;IACH,QAAQ,EAAE,MAAM,CAAC;IACjB,8CAA8C;IAC9C,SAAS,EAAE,MAAM,CAAC;CACnB;AAED;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,MAAM,MAAM,gBAAgB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,kBAAkB,CAAC,CAAC;AAElE;;;;;;;;;;;;;;;GAeG;AACH,MAAM,WAAW,aAAa,CAAC,QAAQ,GAAG,SAAS;IACjD,+DAA+D;IAC/D,SAAS,EAAE,MAAM,CAAC;IAElB;;;OAGG;IACH,OAAO,EAAE,MAAM,CAAC;IAEhB;;;OAGG;IACH,OAAO,EAAE,QAAQ,CAAC;IAElB;;;;;;;;OAQG;IACH,QAAQ,CAAC,EAAE,OAAO,CAAC;CACpB;AAED;;;;;;;GAOG;AACH,MAAM,MAAM,cAAc,GAAG,YAAY,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,oBAAoB,CAAC,CAAC,CAAC;AAEhF,wGAAwG;AACxG,MAAM,MAAM,sBAAsB,GAAG,YAAY,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,4BAA4B,CAAC,CAAC,CAAC;AAIhG;;;GAGG;AACH,MAAM,MAAM,mBAAmB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,qBAAqB,CAAC,CAAC;AAExE;;;;GAIG;AACH,MAAM,MAAM,oBAAoB,GAAG,YAAY,CAC7C,CAAC,CAAC,KAAK,CAAC,OAAO,0BAA0B,CAAC,CAC3C,CAAC;AAEF;;;GAGG;AACH,MAAM,MAAM,wBAAwB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,0BAA0B,CAAC,CAAC;AAElF;;;;;;;GAOG;AACH,MAAM,WAAW,yBAAyB;IACxC,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,SAAS,EAAE;QAClB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;QACxB,QAAQ,CAAC,QAAQ,CAAC,EAAE,YAAY,CAAC;QACjC,QAAQ,CAAC,YAAY,CAAC,EAAE,OAAO,CAAC;KACjC,CAAC;CACH;AAMD;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,MAAM,iBAAiB,GAAG,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,uBAAuB,CAAC,CAAC,CAAC;AAElF;;;;;;;;GAQG;AACH,MAAM,MAAM,iBAAiB,GAAG,YAAY,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,uBAAuB,CAAC,CAAC,CAAC;AAEtF;;;GAGG;AACH,MAAM,MAAM,yBAAyB,GAAG,CAAC,CAAC,KAAK,CAC7C,OAAO,2BAA2B,CACnC,CAAC;AAEF;;GAEG;AACH,MAAM,MAAM,0BAA0B,GAAG,YAAY,CACnD,CAAC,CAAC,KAAK,CAAC,OAAO,gCAAgC,CAAC,CACjD,CAAC;AAEF;;;GAGG;AACH,MAAM,MAAM,wBAAwB,GAAG,CAAC,CAAC,KAAK,CAC5C,OAAO,0BAA0B,CAClC,CAAC;AAEF;;;;;;;;GAQG;AACH,MAAM,WAAW,yBAAyB;IACxC,sCAAsC;IACtC,WAAW,EAAE,MAAM,CAAC;IACpB,kCAAkC;IAClC,aAAa,EAAE,MAAM,CAAC;IACtB;;;OAGG;IACH,IAAI,EAAE,MAAM,CAAC;IACb;;;;OAIG;IACH,WAAW,EAAE,MAAM,CAAC;CACrB;AAMD;;;GAGG;AACH,MAAM,WAAW,UAAU,CAAC,OAAO,GAAG,UAAU;IAC9C,OAAO,EAAE,KAAK,CAAC;IACf,EAAE,EAAE,MAAM,GAAG,MAAM,CAAC;IACpB,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,CAAC,EAAE,OAAO,CAAC;CAClB;AAED;;;GAGG;AACH,MAAM,WAAW,WAAW,CAAC,OAAO,GAAG,SAAS;IAC9C,OAAO,EAAE,KAAK,CAAC;IACf,EAAE,EAAE,MAAM,GAAG,MAAM,CAAC;IACpB,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,KAAK,CAAC,EAAE,QAAQ,CAAC;CAClB;AAED;;;GAGG;AACH,MAAM,WAAW,QAAQ;IACvB,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,MAAM,CAAC;IAChB,+EAA+E;IAC/E,IAAI,CAAC,EAAE,SAAS,CAAC;CAClB;AAED;;;GAGG;AACH,MAAM,WAAW,iBAAkB,SAAQ,UAAU;IACnD,IAAI,EAAE,MAAM,CAAC;IACb,WAAW,EAAE,MAAM,CAAC;IACpB,WAAW,EAAE;QACX,IAAI,EAAE,QAAQ,CAAC;QACf,UAAU,EAAE,MAAM,CAAC,MAAM,EAAE,UAAU,CAAC,CAAC;QACvC,QAAQ,CAAC,EAAE,MAAM,EAAE,CAAC;KACrB,CAAC;IAEF,YAAY,CAAC,EAAE;QACb,IAAI,EAAE,QAAQ,CAAC;QACf,UAAU,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,UAAU,CAAC,CAAC;QACxC,QAAQ,CAAC,EAAE,MAAM,EAAE,CAAC;KACrB,CAAC;CACH;AAED;;;GAGG;AACH,MAAM,WAAW,aAAc,SAAQ,UAAU;IAC/C,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,MAAM,CAAC;CACjB;AAED;;;GAGG;AACH,MAAM,WAAW,eAAgB,SAAQ,UAAU;IACjD,KAAK,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC;CAC/B;AAUD,MAAM,MAAM,kBAAkB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,oBAAoB,CAAC,CAAC;AACtE,MAAM,MAAM,mBAAmB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,qBAAqB,CAAC,CAAC;AAExE;;;;;;;;;;;;;;;GAeG;AACH,MAAM,WAAW,kBAAkB;IACjC;;;;;OAKG;IACH,QAAQ,CAAC,eAAe,CAAC,EAAE;QACzB,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;KACtB,CAAC;IACF;;;;;OAKG;IACH,QAAQ,CAAC,yBAAyB,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;CACxD;AAED,MAAM,MAAM,eAAe,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,iBAAiB,CAAC,CAAC;AAChE,MAAM,MAAM,gBAAgB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,kBAAkB,CAAC,CAAC;AAElE;;;GAGG;AACH,MAAM,MAAM,iBAAiB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,uBAAuB,CAAC,CAAC;AAExE;;;;;;GAMG;AACH,YAAY,EAAE,eAAe,EAAE,MAAM,gBAAgB,CAAC;AAEtD;;;GAGG;AACH,MAAM,MAAM,WAAW,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,iBAAiB,CAAC,CAAC;AAE5D;;;;;;GAMG;AACH,YAAY,EAAE,oBAAoB,EAAE,aAAa,EAAE,MAAM,gBAAgB,CAAC;AAE1E;;;;;;GAMG;AACH,MAAM,MAAM,qBAAqB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,2BAA2B,CAAC,CAAC;AAEhF;;;GAGG;AACH,MAAM,MAAM,iBAAiB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,uBAAuB,CAAC,CAAC;AAExE,MAAM,MAAM,eAAe,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,iBAAiB,CAAC,CAAC;AAChE,MAAM,MAAM,gBAAgB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,kBAAkB,CAAC,CAAC;AAElE,MAAM,MAAM,cAAc,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,gBAAgB,CAAC,CAAC;AAC9D,MAAM,MAAM,eAAe,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,iBAAiB,CAAC,CAAC;AAEhE;;;;;;GAMG;AACH,MAAM,MAAM,wBAAwB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,8BAA8B,CAAC,CAAC;AAEtF;;;GAGG;AACH,MAAM,MAAM,oBAAoB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,sBAAsB,CAAC,CAAC;AAE1E;;;;;;;GAOG;AACH,MAAM,MAAM,qBAAqB,GAAG,cAAc,GAAG,wBAAwB,CAAC;AAE9E;;;;GAIG;AACH,MAAM,MAAM,yBAAyB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,2BAA2B,CAAC,CAAC;AAEpF;;GAEG;AACH,MAAM,MAAM,0BAA0B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,4BAA4B,CAAC,CAAC;AAMtF;;;;;;;;;;;;GAYG;AACH,eAAO,MAAM,eAAe;;;;;;;;;;IAW1B;;;;;;;;;;;;;OAaG;;CAEK,CAAC;AAEX;;;GAGG;AACH,eAAO,MAAM,oBAAoB;;;;;IAK/B;;;;;OAKG;;;CAGK,CAAC"}
+{"version":3,"file":"mcp.d.ts","sourceRoot":"","sources":["../../src/types/mcp.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAC7B,OAAO,KAAK,EAAE,YAAY,EAAE,UAAU,EAAE,UAAU,EAAE,SAAS,EAAE,MAAM,iBAAiB,CAAC;AACvF,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,YAAY,CAAC;AAC/C,OAAO,KAAK,EACV,kBAAkB,EAClB,0BAA0B,EAC1B,qBAAqB,EACrB,oBAAoB,EACpB,qBAAqB,EACrB,0BAA0B,EAC1B,uBAAuB,EACvB,iBAAiB,EACjB,iBAAiB,EACjB,kBAAkB,EAClB,2BAA2B,EAC3B,uBAAuB,EACvB,sBAAsB,EACtB,2BAA2B,EAC3B,4BAA4B,EAC5B,2BAA2B,EAC3B,iBAAiB,EACjB,kBAAkB,EAClB,gBAAgB,EAChB,iBAAiB,EACjB,8BAA8B,EAC9B,0BAA0B,EAC1B,gCAAgC,EAChC,uBAAuB,EACvB,kBAAkB,EAClB,uBAAuB,EACvB,oBAAoB,EACpB,4BAA4B,EAC7B,MAAM,gBAAgB,CAAC;AACxB,OAAO,KAAK,EACV,cAAc,EACd,wBAAwB,EACzB,MAAM,sBAAsB,CAAC;AAE9B,YAAY,EAAE,iBAAiB,EAAE,MAAM,UAAU,CAAC;AAQlD,wDAAwD;AACxD,MAAM,MAAM,MAAM,GAAG,QAAQ,GAAG,QAAQ,GAAG,SAAS,GAAG,WAAW,CAAC;AAEnE;;;;;;;;GAQG;AACH,MAAM,MAAM,YAAY,GAAG,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,kBAAkB,CAAC,CAAC,CAAC;AAExE;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,MAAM,MAAM,gBAAgB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,kBAAkB,CAAC,CAAC;AAElE;;;;;;;;;;;;;;;GAeG;AACH,MAAM,WAAW,aAAa,CAAC,QAAQ,GAAG,SAAS;IACjD,+DAA+D;IAC/D,SAAS,EAAE,MAAM,CAAC;IAElB;;;OAGG;IACH,OAAO,EAAE,MAAM,CAAC;IAEhB;;;OAGG;IACH,OAAO,EAAE,QAAQ,CAAC;IAElB;;;;;;;;OAQG;IACH,QAAQ,CAAC,EAAE,OAAO,CAAC;CACpB;AAED;;;;;;;GAOG;AACH,MAAM,MAAM,cAAc,GAAG,YAAY,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,oBAAoB,CAAC,CAAC,CAAC;AAEhF,wGAAwG;AACxG,MAAM,MAAM,sBAAsB,GAAG,YAAY,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,4BAA4B,CAAC,CAAC,CAAC;AAIhG;;;GAGG;AACH,MAAM,MAAM,mBAAmB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,qBAAqB,CAAC,CAAC;AAExE;;;;GAIG;AACH,MAAM,MAAM,oBAAoB,GAAG,YAAY,CAC7C,CAAC,CAAC,KAAK,CAAC,OAAO,0BAA0B,CAAC,CAC3C,CAAC;AAEF;;;GAGG;AACH,MAAM,MAAM,wBAAwB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,0BAA0B,CAAC,CAAC;AAElF;;;;;;;GAOG;AACH,MAAM,WAAW,yBAAyB;IACxC,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,SAAS,EAAE;QAClB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;QACxB,QAAQ,CAAC,QAAQ,CAAC,EAAE,YAAY,CAAC;QACjC,QAAQ,CAAC,YAAY,CAAC,EAAE,OAAO,CAAC;KACjC,CAAC;CACH;AAMD;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,MAAM,iBAAiB,GAAG,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,uBAAuB,CAAC,CAAC,CAAC;AAElF;;;;;;;;GAQG;AACH,MAAM,MAAM,iBAAiB,GAAG,YAAY,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,uBAAuB,CAAC,CAAC,CAAC;AAEtF;;;GAGG;AACH,MAAM,MAAM,yBAAyB,GAAG,CAAC,CAAC,KAAK,CAC7C,OAAO,2BAA2B,CACnC,CAAC;AAEF;;GAEG;AACH,MAAM,MAAM,0BAA0B,GAAG,YAAY,CACnD,CAAC,CAAC,KAAK,CAAC,OAAO,gCAAgC,CAAC,CACjD,CAAC;AAEF;;;GAGG;AACH,MAAM,MAAM,wBAAwB,GAAG,CAAC,CAAC,KAAK,CAC5C,OAAO,0BAA0B,CAClC,CAAC;AAEF;;;;;;;;GAQG;AACH,MAAM,WAAW,yBAAyB;IACxC,sCAAsC;IACtC,WAAW,EAAE,MAAM,CAAC;IACpB,kCAAkC;IAClC,aAAa,EAAE,MAAM,CAAC;IACtB;;;OAGG;IACH,IAAI,EAAE,MAAM,CAAC;IACb;;;;OAIG;IACH,WAAW,EAAE,MAAM,CAAC;CACrB;AAMD;;;GAGG;AACH,MAAM,WAAW,UAAU,CAAC,OAAO,GAAG,UAAU;IAC9C,OAAO,EAAE,KAAK,CAAC;IACf,EAAE,EAAE,MAAM,GAAG,MAAM,CAAC;IACpB,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,CAAC,EAAE,OAAO,CAAC;CAClB;AAED;;;GAGG;AACH,MAAM,WAAW,WAAW,CAAC,OAAO,GAAG,SAAS;IAC9C,OAAO,EAAE,KAAK,CAAC;IACf,EAAE,EAAE,MAAM,GAAG,MAAM,CAAC;IACpB,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,KAAK,CAAC,EAAE,QAAQ,CAAC;CAClB;AAED;;;GAGG;AACH,MAAM,WAAW,QAAQ;IACvB,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,MAAM,CAAC;IAChB,+EAA+E;IAC/E,IAAI,CAAC,EAAE,SAAS,CAAC;CAClB;AAED;;;GAGG;AACH,MAAM,WAAW,iBAAkB,SAAQ,UAAU;IACnD,IAAI,EAAE,MAAM,CAAC;IACb,WAAW,EAAE,MAAM,CAAC;IACpB,WAAW,EAAE;QACX,IAAI,EAAE,QAAQ,CAAC;QACf,UAAU,EAAE,MAAM,CAAC,MAAM,EAAE,UAAU,CAAC,CAAC;QACvC,QAAQ,CAAC,EAAE,MAAM,EAAE,CAAC;KACrB,CAAC;IAEF,YAAY,CAAC,EAAE;QACb,IAAI,EAAE,QAAQ,CAAC;QACf,UAAU,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,UAAU,CAAC,CAAC;QACxC,QAAQ,CAAC,EAAE,MAAM,EAAE,CAAC;KACrB,CAAC;CACH;AAED;;;GAGG;AACH,MAAM,WAAW,aAAc,SAAQ,UAAU;IAC/C,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,MAAM,CAAC;CACjB;AAED;;;GAGG;AACH,MAAM,WAAW,eAAgB,SAAQ,UAAU;IACjD,KAAK,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC;CAC/B;AAUD,MAAM,MAAM,kBAAkB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,oBAAoB,CAAC,CAAC;AACtE,MAAM,MAAM,mBAAmB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,qBAAqB,CAAC,CAAC;AAExE;;;;;;;;;;;;;;;GAeG;AACH,MAAM,WAAW,kBAAkB;IACjC;;;;;OAKG;IACH,QAAQ,CAAC,eAAe,CAAC,EAAE;QACzB,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;KACtB,CAAC;IACF;;;;;OAKG;IACH,QAAQ,CAAC,yBAAyB,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;CACxD;AAED,MAAM,MAAM,eAAe,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,iBAAiB,CAAC,CAAC;AAChE,MAAM,MAAM,gBAAgB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,kBAAkB,CAAC,CAAC;AAElE;;;GAGG;AACH,MAAM,MAAM,iBAAiB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,uBAAuB,CAAC,CAAC;AAExE;;;;;;GAMG;AACH,YAAY,EAAE,eAAe,EAAE,MAAM,gBAAgB,CAAC;AAEtD;;;GAGG;AACH,MAAM,MAAM,WAAW,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,iBAAiB,CAAC,CAAC;AAE5D;;;;;;GAMG;AACH,YAAY,EAAE,oBAAoB,EAAE,aAAa,EAAE,MAAM,gBAAgB,CAAC;AAE1E;;;;;;GAMG;AACH,MAAM,MAAM,qBAAqB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,2BAA2B,CAAC,CAAC;AAEhF;;;GAGG;AACH,MAAM,MAAM,iBAAiB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,uBAAuB,CAAC,CAAC;AAExE,MAAM,MAAM,eAAe,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,iBAAiB,CAAC,CAAC;AAChE,MAAM,MAAM,gBAAgB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,kBAAkB,CAAC,CAAC;AAElE,MAAM,MAAM,cAAc,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,gBAAgB,CAAC,CAAC;AAC9D,MAAM,MAAM,eAAe,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,iBAAiB,CAAC,CAAC;AAEhE;;;;;;GAMG;AACH,MAAM,MAAM,wBAAwB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,8BAA8B,CAAC,CAAC;AAEtF;;;GAGG;AACH,MAAM,MAAM,oBAAoB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,sBAAsB,CAAC,CAAC;AAE1E;;;;;;;GAOG;AACH,MAAM,MAAM,qBAAqB,GAAG,cAAc,GAAG,wBAAwB,CAAC;AAE9E;;;;GAIG;AACH,MAAM,MAAM,yBAAyB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,2BAA2B,CAAC,CAAC;AAEpF;;GAEG;AACH,MAAM,MAAM,0BAA0B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,4BAA4B,CAAC,CAAC;AAMtF;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,eAAO,MAAM,eAAe;;;;;;;;;IAU1B;;;;;;;;;;;;;OAaG;;CAEK,CAAC;AAEX;;;;;;;;;GASG;AACH,eAAO,MAAM,oBAAoB;IAC/B;;;;;;;;OAQG;;CAEK,CAAC"}

package/dist/types/mcp.js

@@ -11,8 +11,17 @@
  * §7.1; see {@link RenderErrorCode}). The slot stays unassigned so a
  * future canonical code can't silently collide with stale consumers.
  *
+ * `-32001` is RETIRED-RESERVED too (ggui#853): `UNAUTHORIZED` lived
+ * there until the 0.16.0 wave, but `-32001` is the MCP SDK client's own
+ * `RequestTimeout` — minted locally, never sent by a server — so a
+ * client reading the number could not tell a server's UNAUTHORIZED
+ * from its own timeout, the class ggui#836 closed for `-32000`
+ * (`ConnectionClosed`). `UNAUTHORIZED` is `-32007`; the slot stays
+ * unassigned. `error-codes-vs-sdk.test.ts` pins that no ggui-chosen
+ * code equals a code the SDK's `ErrorCode` enum owns.
+ *
  * `-32006` is assigned to `MOUNT_UNAVAILABLE`; new canonical codes come
- * at `-32007` onwards.
+ * at `-32008` onwards.
  */
 export const MCP_ERROR_CODES = {
     PARSE_ERROR: -32700,
@@ -20,11 +29,10 @@ export const MCP_ERROR_CODES = {
     METHOD_NOT_FOUND: -32601,
     INVALID_PARAMS: -32602,
     INTERNAL_ERROR: -32603,
-    // Protocol-specific error codes (-32004 retired-reserved — see above)
-    UNAUTHORIZED: -32001,
+    // Protocol-specific error codes (-32001, -32004 and -32005 retired-reserved — see above)
+    UNAUTHORIZED: -32007,
     SESSION_NOT_FOUND: -32002,
     APP_NOT_FOUND: -32003,
-    CAPABILITY_DENIED: -32005,
     /**
      * A `resources/read` identified the resource but cannot return a
      * mount for it — the component behind it is gone, the server keeps no
@@ -44,18 +52,22 @@ export const MCP_ERROR_CODES = {
 /**
  * Platform-specific error codes (-32010 range).
  * These are ggui platform extensions, not part of the core protocol.
+ * `-32010`..`-32013` and `-32020` are retired-reserved (SPEC §7.9,
+ * ggui#910 / ggui#890): declared once, emitted by nothing first-party —
+ * quota, app-limit and concurrency states are refusals or
+ * implementation-range codes, and a contract violation is the Plane-2
+ * `contract_violation` result or the live channel's `CONTRACT_VIOLATION`
+ * frame code, never a JSON-RPC number.
  */
 export const PLATFORM_ERROR_CODES = {
-    GENERATION_QUOTA_EXCEEDED: -32010,
-    APP_LIMIT_EXCEEDED: -32011,
-    CONCURRENT_SESSION_LIMIT: -32012,
-    RATE_LIMIT_EXCEEDED: -32013,
     /**
      * The generation queue is saturated — the server, not the caller, is
-     * the limit (contrast `RATE_LIMIT_EXCEEDED`: the caller slows down). HTTP
+     * the limit (contrast a caller-side rate cap, which is a render-gate
+     * REFUSAL — `app_rate_limited` / `issuer_rate_limited`, SPEC §7.1 — the
+     * caller slows down; its former numeric `-32013` is retired-reserved,
+     * SPEC §7.9, ggui#890). HTTP
      * 503 with `Retry-After`, which governs the retry; a parsed request's
      * refusal, so it speaks this table (ggui#836 follow-up).
      */
     GENERATION_OVERLOADED: -32014,
-    CONTRACT_VIOLATION: -32020,
 };

package/dist/types/refusal-codes.d.ts

@@ -102,7 +102,7 @@ declare const REFUSAL_ROWS: {
         readonly retry: "after-fix";
         readonly fixBy: "owner";
         readonly emitter: "a deployment's generation gate, balance arm";
-        readonly description: "The balance this deployment funds the app from is exhausted. The app owner adds funds, after which the same call succeeds.";
+        readonly description: "The balance this deployment funds the render from is at or below zero — pool or BYOK lane alike — so nothing renders under it. The owner adds credit, after which the same call succeeds.";
     };
     readonly hard_cap_exceeded: {
         readonly code: "hard_cap_exceeded";
@@ -111,13 +111,13 @@ declare const REFUSAL_ROWS: {
         readonly emitter: "a deployment's generation gate, cap arm";
         readonly description: "The app reached the hard ceiling this deployment set for the current period. Nothing the caller or the owner does lifts it before the period rolls over.";
     };
-    readonly model_not_in_tier: {
-        readonly code: "model_not_in_tier";
+    readonly model_not_allowed: {
+        readonly code: "model_not_allowed";
         readonly surfaces: readonly ["render-gate"];
         readonly retry: "after-fix";
         readonly fixBy: "caller";
         readonly emitter: "a deployment's generation gate, model arm";
-        readonly description: "The requested model is not among those the app is allowed to use. The caller picks an allowed model and retries — the one render-gate state an agent may act on itself.";
+        readonly description: "The requested model is not one this account has been granted on this deployment. The caller picks a granted model and retries with the same handshakeId — the one render-gate state an agent may act on itself.";
     };
     readonly managed_default_cap_exceeded: {
         readonly code: "managed_default_cap_exceeded";
@@ -142,30 +142,6 @@ declare const REFUSAL_ROWS: {
         readonly emitter: "a deployment's provisioning guard and its generation gate, reading the same record";
         readonly description: "The app record declares a funding mode this deployment does not recognise, or declares none at all. The value is reported as read and never coerced — an unreadable record is not a policy.";
     };
-    readonly app_canceled: {
-        readonly code: "app_canceled";
-        readonly surfaces: readonly ["render-gate"];
-        readonly retry: "after-fix";
-        readonly fixBy: "owner";
-        readonly emitter: "a deployment's generation gate, plan-state arm";
-        readonly description: "The app's plan has ended, so it renders nothing while the stored work is kept. The owner starts a new plan to restore rendering.";
-    };
-    readonly trial_exhausted: {
-        readonly code: "trial_exhausted";
-        readonly surfaces: readonly ["render-gate"];
-        readonly retry: "after-fix";
-        readonly fixBy: "owner";
-        readonly emitter: "a deployment's generation gate, trial arm";
-        readonly description: "The trial this deployment grants the app has used up its allotment. The owner starts a paid plan.";
-    };
-    readonly trial_expired: {
-        readonly code: "trial_expired";
-        readonly surfaces: readonly ["render-gate"];
-        readonly retry: "after-fix";
-        readonly fixBy: "owner";
-        readonly emitter: "a deployment's generation gate, trial arm";
-        readonly description: "The app's trial window has closed. The owner starts a paid plan.";
-    };
     readonly issuer_rate_limited: {
         readonly code: "issuer_rate_limited";
         readonly surfaces: readonly ["render-gate"];
@@ -192,16 +168,8 @@ declare const REFUSAL_ROWS: {
         readonly surfaces: readonly ["render-gate"];
         readonly retry: "after-fix";
         readonly fixBy: "owner";
-        readonly emitter: "the generation gate's fall-through arm: a non-playground identity that resolves to no billing path (not a trial account, not a managed app, not a credit holder)";
-        readonly description: "The caller has no billing subject on this deployment, so nothing renders under it. The owner provisions one — a trial account, a managed policy, or credit. Unlike `billing_mode_anomaly` — an app record that exists and declares a funding mode this deployment cannot read — no record arm applies here: there is simply no subject to bill. A deployment MAY suppress this refusal by operator override; that switch is deployment policy, not a wire state.";
-    };
-    readonly subscription_exists: {
-        readonly code: "subscription_exists";
-        readonly surfaces: readonly ["owner-api"];
-        readonly retry: "after-fix";
-        readonly fixBy: "owner";
-        readonly emitter: "a deployment's owner billing mutations";
-        readonly description: "An active (non-canceled) plan exists on this app. It refuses starting another one AND deleting the app — the refusal's own `fix` names the next step for the action that was called.";
+        readonly emitter: "the generation gate's fall-through arm: a non-playground identity that resolves to no billing path (not a managed app, not a credit holder)";
+        readonly description: "The caller has no billing subject on this deployment, so nothing renders under it. The owner provisions one — a managed policy, or credit. Unlike `billing_mode_anomaly` — an app record that exists and declares a funding mode this deployment cannot read — no record arm applies here: there is simply no subject to bill. A deployment MAY suppress this refusal by operator override; that switch is deployment policy, not a wire state.";
     };
     readonly checkout_unavailable: {
         readonly code: "checkout_unavailable";
@@ -209,60 +177,7 @@ declare const REFUSAL_ROWS: {
         readonly retry: "later";
         readonly fixBy: "operator";
         readonly emitter: "a deployment's owner billing mutations";
-        readonly description: "The surface that starts a plan is unavailable on this deployment right now — unconfigured, or its provider is down. Only the operator can restore it.";
-    };
-    readonly card_update_unavailable: {
-        readonly code: "card_update_unavailable";
-        readonly surfaces: readonly ["owner-api"];
-        readonly retry: "later";
-        readonly fixBy: "operator";
-        readonly emitter: "a deployment's owner billing mutations";
-        readonly description: "The surface that updates a payment method is unavailable on this deployment right now. Only the operator can restore it.";
-    };
-    readonly portal_unavailable: {
-        readonly code: "portal_unavailable";
-        readonly surfaces: readonly ["owner-api"];
-        readonly retry: "later";
-        readonly fixBy: "operator";
-        readonly emitter: "a deployment's owner billing mutations";
-        readonly description: "The self-service billing surface is unavailable on this deployment right now. Only the operator can restore it.";
-    };
-    readonly no_subscription: {
-        readonly code: "no_subscription";
-        readonly surfaces: readonly ["owner-api"];
-        readonly retry: "after-fix";
-        readonly fixBy: "owner";
-        readonly emitter: "a deployment's owner billing mutations";
-        readonly description: "A plan-management action was called on an app that has no plan. The owner starts a plan first.";
-    };
-    readonly already_on_tier: {
-        readonly code: "already_on_tier";
-        readonly surfaces: readonly ["owner-api"];
-        readonly retry: "after-fix";
-        readonly fixBy: "owner";
-        readonly emitter: "a deployment's owner billing mutations";
-        readonly description: "The plan requested is the one the app is already on. The owner picks a different plan.";
-    };
-    readonly managed_app_no_checkout: {
-        readonly code: "managed_app_no_checkout";
-        readonly surfaces: readonly ["owner-api"];
-        readonly retry: "never";
-        readonly emitter: "a deployment's owner billing mutations";
-        readonly description: "This app is funded by the tenant that provisioned it, so it has no owner-facing plan surface at all. No owner action creates one.";
-    };
-    readonly managed_app_no_card_update: {
-        readonly code: "managed_app_no_card_update";
-        readonly surfaces: readonly ["owner-api"];
-        readonly retry: "never";
-        readonly emitter: "a deployment's owner billing mutations";
-        readonly description: "This app is funded by the tenant that provisioned it, so it carries no owner payment method to update.";
-    };
-    readonly managed_app_no_portal: {
-        readonly code: "managed_app_no_portal";
-        readonly surfaces: readonly ["owner-api"];
-        readonly retry: "never";
-        readonly emitter: "a deployment's owner billing mutations";
-        readonly description: "This app is funded by the tenant that provisioned it, so it has no owner self-service billing surface.";
+        readonly description: "The surface that adds credit (a top-up) is unavailable on this deployment right now — unconfigured, or its provider is down. Only the operator can restore it.";
     };
     readonly owner_ref_mismatch: {
         readonly code: "owner_ref_mismatch";
@@ -301,6 +216,15 @@ export interface RefusalRow {
 }
 /** The registry consumers read. */
 export declare const PRE_GENERATION_REFUSAL_CODES: Readonly<Record<RefusalCode, RefusalRow>>;
+/**
+ * The SAME registry object with its per-key literal types kept
+ * (ggui#889): `PRE_GENERATION_REFUSAL_ROWS.app_rate_limited.code` is
+ * `'app_rate_limited'`, its `retry` is `'later'`. The normalized view
+ * above erases those literals so `fixBy` reads uniformly; a producer
+ * that must satisfy a wire enum from a row (the registry-purity pin
+ * forbids the literal in source) reads it here — no parse, no literal.
+ */
+export declare const PRE_GENERATION_REFUSAL_ROWS: typeof REFUSAL_ROWS;
 /**
  * The codes on one surface, derived type-level from the literal rows'
  * `surfaces` tuples. A runtime `.filter()` cannot narrow a type, so the
@@ -328,7 +252,7 @@ export type McpEndpointRefusalCode = CodesOnSurface<'mcp-endpoint'>;
  * Every render-gate code, as the literal tuple the wire enum
  * (`renderRefusalSchema.code`) is built from. Order is the registry's.
  */
-export declare const RENDER_GATE_REFUSAL_CODES: readonly ["unsupported_provider", "insufficient_credit", "hard_cap_exceeded", "model_not_in_tier", "managed_default_cap_exceeded", "app_policy_missing", "billing_mode_anomaly", "billing_path_missing", "app_canceled", "trial_exhausted", "trial_expired", "issuer_rate_limited", "app_rate_limited", "app_deprovisioned"];
+export declare const RENDER_GATE_REFUSAL_CODES: readonly ["unsupported_provider", "insufficient_credit", "hard_cap_exceeded", "model_not_allowed", "managed_default_cap_exceeded", "app_policy_missing", "billing_mode_anomaly", "billing_path_missing", "issuer_rate_limited", "app_rate_limited", "app_deprovisioned"];
 /**
  * Every mcp-endpoint code, as the literal tuple the transport wire enum
  * (`transportRefusalSchema.code`) is built from — the refusals a per-app
@@ -336,5 +260,19 @@ export declare const RENDER_GATE_REFUSAL_CODES: readonly ["unsupported_provider"
  * (ggui#825). Order is the registry's.
  */
 export declare const MCP_ENDPOINT_REFUSAL_CODES: readonly ["app_deprovisioned"];
+/**
+ * A code an owner-API billing mutation may refuse with — i.e. one whose
+ * `surfaces` include `owner-api`. Derived, so a render-gate code is not
+ * expressible on an owner-API refusal. Registry v11 (ggui#960): the
+ * plan-era owner-api rows retired with the plan model; one owner billing
+ * surface remains — adding credit.
+ */
+export type OwnerApiRefusalCode = CodesOnSurface<'owner-api'>;
+/**
+ * Every owner-api code, as the literal tuple a backend's owner-API
+ * refusal helper types its `code` from (ggui#960). Order is the
+ * registry's.
+ */
+export declare const OWNER_API_REFUSAL_CODES: readonly ["checkout_unavailable"];
 export {};
 //# sourceMappingURL=refusal-codes.d.ts.map

package/dist/types/refusal-codes.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"refusal-codes.d.ts","sourceRoot":"","sources":["../../src/types/refusal-codes.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAyDG;AAEH;;;;;;;;;;;;;;;;GAgBG;AACH,eAAO,MAAM,gBAAgB,2EAKnB,CAAC;AAEX,8CAA8C;AAC9C,MAAM,MAAM,cAAc,GAAG,CAAC,OAAO,gBAAgB,CAAC,CAAC,MAAM,CAAC,CAAC;AAE/D,yEAAyE;AACzE,eAAO,MAAM,eAAe,yDAKlB,CAAC;AAEX,6CAA6C;AAC7C,MAAM,MAAM,YAAY,GAAG,CAAC,OAAO,eAAe,CAAC,CAAC,MAAM,CAAC,CAAC;AAE5D;;;GAGG;AACH,eAAO,MAAM,cAAc,oDAAqD,CAAC;AAEjF,4CAA4C;AAC5C,MAAM,MAAM,YAAY,GAAG,CAAC,OAAO,cAAc,CAAC,CAAC,MAAM,CAAC,CAAC;AAiD3D,QAAA,MAAM,YAAY;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAqOhB,CAAC;AAEH,qEAAqE;AACrE,MAAM,MAAM,WAAW,GAAG,MAAM,OAAO,YAAY,CAAC;AAEpD;;;;;;;GAOG;AACH,MAAM,WAAW,UAAU;IACzB,QAAQ,CAAC,IAAI,EAAE,WAAW,CAAC;IAC3B,QAAQ,CAAC,QAAQ,EAAE,SAAS,cAAc,EAAE,CAAC;IAC7C,QAAQ,CAAC,KAAK,EAAE,YAAY,CAAC;IAC7B,QAAQ,CAAC,KAAK,CAAC,EAAE,YAAY,CAAC;IAC9B,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;CAC9B;AAED,mCAAmC;AACnC,eAAO,MAAM,4BAA4B,EAAE,QAAQ,CACjD,MAAM,CAAC,WAAW,EAAE,UAAU,CAAC,CACjB,CAAC;AAEjB;;;;;GAKG;AACH,KAAK,cAAc,CAAC,CAAC,SAAS,cAAc,IAAI;KAC7C,CAAC,IAAI,WAAW,GAAG,CAAC,SAAS,CAAC,OAAO,YAAY,CAAC,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,MAAM,CAAC,GACtE,CAAC,GACD,KAAK;CACV,CAAC,WAAW,CAAC,CAAC;AAEf;;;;;GAKG;AACH,MAAM,MAAM,wBAAwB,GAAG,cAAc,CAAC,aAAa,CAAC,CAAC;AAErE;;;;;GAKG;AACH,MAAM,MAAM,sBAAsB,GAAG,cAAc,CAAC,cAAc,CAAC,CAAC;AAkBpE;;;GAGG;AACH,eAAO,MAAM,yBAAyB,8TAepC,CAAC;AAEH;;;;;GAKG;AACH,eAAO,MAAM,0BAA0B,gCAErC,CAAC"}
+{"version":3,"file":"refusal-codes.d.ts","sourceRoot":"","sources":["../../src/types/refusal-codes.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAyDG;AAEH;;;;;;;;;;;;;;;;GAgBG;AACH,eAAO,MAAM,gBAAgB,2EAKnB,CAAC;AAEX,8CAA8C;AAC9C,MAAM,MAAM,cAAc,GAAG,CAAC,OAAO,gBAAgB,CAAC,CAAC,MAAM,CAAC,CAAC;AAE/D,yEAAyE;AACzE,eAAO,MAAM,eAAe,yDAKlB,CAAC;AAEX,6CAA6C;AAC7C,MAAM,MAAM,YAAY,GAAG,CAAC,OAAO,eAAe,CAAC,CAAC,MAAM,CAAC,CAAC;AAE5D;;;GAGG;AACH,eAAO,MAAM,cAAc,oDAAqD,CAAC;AAEjF,4CAA4C;AAC5C,MAAM,MAAM,YAAY,GAAG,CAAC,OAAO,cAAc,CAAC,CAAC,MAAM,CAAC,CAAC;AAiE3D,QAAA,MAAM,YAAY;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAqIhB,CAAC;AAEH,qEAAqE;AACrE,MAAM,MAAM,WAAW,GAAG,MAAM,OAAO,YAAY,CAAC;AAEpD;;;;;;;GAOG;AACH,MAAM,WAAW,UAAU;IACzB,QAAQ,CAAC,IAAI,EAAE,WAAW,CAAC;IAC3B,QAAQ,CAAC,QAAQ,EAAE,SAAS,cAAc,EAAE,CAAC;IAC7C,QAAQ,CAAC,KAAK,EAAE,YAAY,CAAC;IAC7B,QAAQ,CAAC,KAAK,CAAC,EAAE,YAAY,CAAC;IAC9B,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;CAC9B;AAED,mCAAmC;AACnC,eAAO,MAAM,4BAA4B,EAAE,QAAQ,CACjD,MAAM,CAAC,WAAW,EAAE,UAAU,CAAC,CACjB,CAAC;AAEjB;;;;;;;GAOG;AACH,eAAO,MAAM,2BAA2B,EAAE,OAAO,YAA2B,CAAC;AAE7E;;;;;GAKG;AACH,KAAK,cAAc,CAAC,CAAC,SAAS,cAAc,IAAI;KAC7C,CAAC,IAAI,WAAW,GAAG,CAAC,SAAS,CAAC,OAAO,YAAY,CAAC,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,MAAM,CAAC,GACtE,CAAC,GACD,KAAK;CACV,CAAC,WAAW,CAAC,CAAC;AAEf;;;;;GAKG;AACH,MAAM,MAAM,wBAAwB,GAAG,cAAc,CAAC,aAAa,CAAC,CAAC;AAErE;;;;;GAKG;AACH,MAAM,MAAM,sBAAsB,GAAG,cAAc,CAAC,cAAc,CAAC,CAAC;AAkBpE;;;GAGG;AACH,eAAO,MAAM,yBAAyB,0QAYpC,CAAC;AAEH;;;;;GAKG;AACH,eAAO,MAAM,0BAA0B,gCAErC,CAAC;AAEH;;;;;;GAMG;AACH,MAAM,MAAM,mBAAmB,GAAG,cAAc,CAAC,WAAW,CAAC,CAAC;AAE9D;;;;GAIG;AACH,eAAO,MAAM,uBAAuB,mCAElC,CAAC"}

package/dist/types/refusal-codes.js

@@ -91,6 +91,22 @@ export const REFUSAL_RETRIES = [
  * itself — see the no-auto-retry rule in the file header.
  */
 export const REFUSAL_FIX_BY = ['caller', 'owner', 'tenant', 'operator'];
+/**
+ * Registry v11 (ggui#960, 2026-09-08) — the plan model is retired: a
+ * deployment funds renders from a credit balance at flat rates, and the
+ * states that only a plan, a trial or a subscription could produce no
+ * longer exist. Retired with their emitting arms, in the same slice:
+ * render-gate `trial_exhausted`, `trial_expired`, `app_canceled`;
+ * owner-api `subscription_exists`, `no_subscription`,
+ * `subscription_unchanged`, `portal_unavailable`, `card_update_unavailable`,
+ * `managed_app_no_portal`, `managed_app_no_card_update`,
+ * `managed_app_no_checkout` (the top-up mutation is user-scoped — no
+ * managed branch exists to refuse from). Re-described: `billing_path_missing`
+ * (off the trial), `model_not_allowed` (per-account grant),
+ * `checkout_unavailable` (adding credit), `insufficient_credit` (pool or
+ * BYOK — the BYOK lane is charged). `managed_default_cap_exceeded` is NOT in this
+ * bump: unemitted since N1's swap but federated-side (ggui#965).
+ */
 /**
  * The registry is the ONLY list of refusal codes: {@link RefusalCode}
  * is derived from the keys below, and this definer forces every row's
@@ -120,7 +136,7 @@ const REFUSAL_ROWS = /* @__PURE__ */ defineRefusalRegistry({
         retry: 'after-fix',
         fixBy: 'owner',
         emitter: "a deployment's generation gate, balance arm",
-        description: 'The balance this deployment funds the app from is exhausted. The app owner adds funds, after which the same call succeeds.',
+        description: "The balance this deployment funds the render from is at or below zero — pool or BYOK lane alike — so nothing renders under it. The owner adds credit, after which the same call succeeds.",
     },
     hard_cap_exceeded: {
         code: 'hard_cap_exceeded',
@@ -129,13 +145,13 @@ const REFUSAL_ROWS = /* @__PURE__ */ defineRefusalRegistry({
         emitter: "a deployment's generation gate, cap arm",
         description: 'The app reached the hard ceiling this deployment set for the current period. Nothing the caller or the owner does lifts it before the period rolls over.',
     },
-    model_not_in_tier: {
-        code: 'model_not_in_tier',
+    model_not_allowed: {
+        code: 'model_not_allowed',
         surfaces: ['render-gate'],
         retry: 'after-fix',
         fixBy: 'caller',
         emitter: "a deployment's generation gate, model arm",
-        description: 'The requested model is not among those the app is allowed to use. The caller picks an allowed model and retries — the one render-gate state an agent may act on itself.',
+        description: 'The requested model is not one this account has been granted on this deployment. The caller picks a granted model and retries with the same handshakeId — the one render-gate state an agent may act on itself.',
     },
     managed_default_cap_exceeded: {
         code: 'managed_default_cap_exceeded',
@@ -163,30 +179,6 @@ const REFUSAL_ROWS = /* @__PURE__ */ defineRefusalRegistry({
         emitter: "a deployment's provisioning guard and its generation gate, reading the same record",
         description: 'The app record declares a funding mode this deployment does not recognise, or declares none at all. The value is reported as read and never coerced — an unreadable record is not a policy.',
     },
-    app_canceled: {
-        code: 'app_canceled',
-        surfaces: ['render-gate'],
-        retry: 'after-fix',
-        fixBy: 'owner',
-        emitter: "a deployment's generation gate, plan-state arm",
-        description: "The app's plan has ended, so it renders nothing while the stored work is kept. The owner starts a new plan to restore rendering.",
-    },
-    trial_exhausted: {
-        code: 'trial_exhausted',
-        surfaces: ['render-gate'],
-        retry: 'after-fix',
-        fixBy: 'owner',
-        emitter: "a deployment's generation gate, trial arm",
-        description: 'The trial this deployment grants the app has used up its allotment. The owner starts a paid plan.',
-    },
-    trial_expired: {
-        code: 'trial_expired',
-        surfaces: ['render-gate'],
-        retry: 'after-fix',
-        fixBy: 'owner',
-        emitter: "a deployment's generation gate, trial arm",
-        description: "The app's trial window has closed. The owner starts a paid plan.",
-    },
     issuer_rate_limited: {
         code: 'issuer_rate_limited',
         surfaces: ['render-gate'],
@@ -213,78 +205,17 @@ const REFUSAL_ROWS = /* @__PURE__ */ defineRefusalRegistry({
         surfaces: ['render-gate'],
         retry: 'after-fix',
         fixBy: 'owner',
-        emitter: "the generation gate's fall-through arm: a non-playground identity that resolves to no billing path (not a trial account, not a managed app, not a credit holder)",
-        description: 'The caller has no billing subject on this deployment, so nothing renders under it. The owner provisions one — a trial account, a managed policy, or credit. Unlike `billing_mode_anomaly` — an app record that exists and declares a funding mode this deployment cannot read — no record arm applies here: there is simply no subject to bill. A deployment MAY suppress this refusal by operator override; that switch is deployment policy, not a wire state.',
+        emitter: "the generation gate's fall-through arm: a non-playground identity that resolves to no billing path (not a managed app, not a credit holder)",
+        description: "The caller has no billing subject on this deployment, so nothing renders under it. The owner provisions one — a managed policy, or credit. Unlike `billing_mode_anomaly` — an app record that exists and declares a funding mode this deployment cannot read — no record arm applies here: there is simply no subject to bill. A deployment MAY suppress this refusal by operator override; that switch is deployment policy, not a wire state.",
     },
     // ── owner-api ─────────────────────────────────────────────────────
-    subscription_exists: {
-        code: 'subscription_exists',
-        surfaces: ['owner-api'],
-        retry: 'after-fix',
-        fixBy: 'owner',
-        emitter: "a deployment's owner billing mutations",
-        description: "An active (non-canceled) plan exists on this app. It refuses starting another one AND deleting the app — the refusal's own `fix` names the next step for the action that was called.",
-    },
     checkout_unavailable: {
         code: 'checkout_unavailable',
         surfaces: ['owner-api'],
         retry: 'later',
         fixBy: 'operator',
         emitter: "a deployment's owner billing mutations",
-        description: 'The surface that starts a plan is unavailable on this deployment right now — unconfigured, or its provider is down. Only the operator can restore it.',
-    },
-    card_update_unavailable: {
-        code: 'card_update_unavailable',
-        surfaces: ['owner-api'],
-        retry: 'later',
-        fixBy: 'operator',
-        emitter: "a deployment's owner billing mutations",
-        description: 'The surface that updates a payment method is unavailable on this deployment right now. Only the operator can restore it.',
-    },
-    portal_unavailable: {
-        code: 'portal_unavailable',
-        surfaces: ['owner-api'],
-        retry: 'later',
-        fixBy: 'operator',
-        emitter: "a deployment's owner billing mutations",
-        description: "The self-service billing surface is unavailable on this deployment right now. Only the operator can restore it.",
-    },
-    no_subscription: {
-        code: 'no_subscription',
-        surfaces: ['owner-api'],
-        retry: 'after-fix',
-        fixBy: 'owner',
-        emitter: "a deployment's owner billing mutations",
-        description: 'A plan-management action was called on an app that has no plan. The owner starts a plan first.',
-    },
-    already_on_tier: {
-        code: 'already_on_tier',
-        surfaces: ['owner-api'],
-        retry: 'after-fix',
-        fixBy: 'owner',
-        emitter: "a deployment's owner billing mutations",
-        description: 'The plan requested is the one the app is already on. The owner picks a different plan.',
-    },
-    managed_app_no_checkout: {
-        code: 'managed_app_no_checkout',
-        surfaces: ['owner-api'],
-        retry: 'never',
-        emitter: "a deployment's owner billing mutations",
-        description: 'This app is funded by the tenant that provisioned it, so it has no owner-facing plan surface at all. No owner action creates one.',
-    },
-    managed_app_no_card_update: {
-        code: 'managed_app_no_card_update',
-        surfaces: ['owner-api'],
-        retry: 'never',
-        emitter: "a deployment's owner billing mutations",
-        description: 'This app is funded by the tenant that provisioned it, so it carries no owner payment method to update.',
-    },
-    managed_app_no_portal: {
-        code: 'managed_app_no_portal',
-        surfaces: ['owner-api'],
-        retry: 'never',
-        emitter: "a deployment's owner billing mutations",
-        description: 'This app is funded by the tenant that provisioned it, so it has no owner self-service billing surface.',
+        description: 'The surface that adds credit (a top-up) is unavailable on this deployment right now — unconfigured, or its provider is down. Only the operator can restore it.',
     },
     // ── provisioning-api ──────────────────────────────────────────────
     owner_ref_mismatch: {
@@ -306,6 +237,15 @@ const REFUSAL_ROWS = /* @__PURE__ */ defineRefusalRegistry({
 });
 /** The registry consumers read. */
 export const PRE_GENERATION_REFUSAL_CODES = REFUSAL_ROWS;
+/**
+ * The SAME registry object with its per-key literal types kept
+ * (ggui#889): `PRE_GENERATION_REFUSAL_ROWS.app_rate_limited.code` is
+ * `'app_rate_limited'`, its `retry` is `'later'`. The normalized view
+ * above erases those literals so `fixBy` reads uniformly; a producer
+ * that must satisfy a wire enum from a row (the registry-purity pin
+ * forbids the literal in source) reads it here — no parse, no literal.
+ */
+export const PRE_GENERATION_REFUSAL_ROWS = REFUSAL_ROWS;
 /**
  * Identity helper that only accepts an EXHAUSTIVE tuple of one surface's
  * codes: omit one and the parameter type collapses to `never`, so the
@@ -323,14 +263,11 @@ export const RENDER_GATE_REFUSAL_CODES = exhaustiveCodesOn()([
     'unsupported_provider',
     'insufficient_credit',
     'hard_cap_exceeded',
-    'model_not_in_tier',
+    'model_not_allowed',
     'managed_default_cap_exceeded',
     'app_policy_missing',
     'billing_mode_anomaly',
     'billing_path_missing',
-    'app_canceled',
-    'trial_exhausted',
-    'trial_expired',
     'issuer_rate_limited',
     'app_rate_limited',
     'app_deprovisioned',
@@ -344,3 +281,11 @@ export const RENDER_GATE_REFUSAL_CODES = exhaustiveCodesOn()([
 export const MCP_ENDPOINT_REFUSAL_CODES = exhaustiveCodesOn()([
     'app_deprovisioned',
 ]);
+/**
+ * Every owner-api code, as the literal tuple a backend's owner-API
+ * refusal helper types its `code` from (ggui#960). Order is the
+ * registry's.
+ */
+export const OWNER_API_REFUSAL_CODES = exhaustiveCodesOn()([
+    'checkout_unavailable',
+]);

package/dist/types/render.d.ts

@@ -46,7 +46,7 @@ export type AdapterPermissions = {
 export type GguiSessionStatus = z.infer<typeof gguiSessionStatusSchema>;
 /**
  * Common base for every {@link GguiSession} variant. Carries identity,
- * tenancy, lifecycle, and conversation-scoped context that every
+ * app scope, lifecycle, and conversation-scoped context that every
  * rendered thing has regardless of how its visible bits are
  * produced (LLM-generated component, server-emitted system card,
  * embedded MCP-App iframe).
@@ -62,7 +62,7 @@ export interface GguiSessionBase {
     /** GguiSession identity. The value an iframe's bootstrap meta and every
      *  wire reference (props_update, consume, update) keys by. */
     readonly id: string;
-    /** App identity (tenancy boundary, always per-render). */
+    /** App identity (the app-scope boundary, always per-render). */
     readonly appId: string;
     /** Authenticated end-user (after the auth gate). Absent for anon
      *  flows. */
@@ -143,7 +143,7 @@ export interface GguiSessionBase {
 /**
  * `GguiSession` — the canonical protocol shape for a single rendered UI.
  *
- * Three variants share {@link GguiSessionBase} (identity, tenancy,
+ * Three variants share {@link GguiSessionBase} (identity, app scope,
  * lifecycle); each variant adds its own visible-bits surface:
  *
  *   - {@link ComponentGguiSession} — LLM-generated / native React component.