@ggui-ai/protocol 0.17.0 → 0.19.0

package/dist/schemas/app-theme.js

@@ -240,6 +240,22 @@ export const appThemeReadSchema = z.object(appThemeSchema.shape);
  * the top-level members that were stripped (payload order, `[]` when none),
  * or the issues in `path: message` form when the theme is refused for a
  * reason the write door would also refuse.
+ *
+ * TWO READ PATHS, OPPOSITE OBLIGATIONS — they sit next to each other and
+ * they are NOT the same door (ggui#1124; do not "tidy" them into one):
+ *
+ *   **a read whose purpose is to INTERPRET state strips unknown members
+ *   and names what it stripped; a read whose purpose is to REPRODUCE
+ *   state must not strip at all.**
+ *
+ * This function is the INTERPRET side — a server painting a theme, an
+ * operator surface rendering one — and a reader must not be handed data it
+ * cannot validate.
+ * The REPRODUCE side is a writer's CARRY path, which receives the stored
+ * document VERBATIM, including members this release does not name: its job
+ * is fidelity, not interpretation. Applying THIS strip to a carry path is
+ * the ggui#1124 defect exactly — the writer carries a stripped document,
+ * writes it back, and destroys the members the belt exists to protect.
  */
 export function parseAppThemeAtReadDoor(input) {
     const r = appThemeReadSchema.safeParse(input);
@@ -258,9 +274,144 @@ export function parseAppThemeAtReadDoor(input) {
  * `errorInfo`, the MCP ops door's `{ ok: false }` structured content. A
  * discriminated union by key — exactly one of the four.
  */
+/**
+ * The CARRY read — the REPRODUCE side of the two-read-paths rule stated on
+ * {@link parseAppThemeAtReadDoor} (ggui#1155).
+ *
+ * A theme READ exists so that a writer can carry the stored document forward
+ * and write it back. That reader's job is fidelity: it MUST return the stored
+ * document VERBATIM — every top-level member, including members this release
+ * does not name, plus the stored attestation. Routing it through the
+ * INTERPRET door instead would strip exactly the members the writer is
+ * obliged to carry, and the very next write would be refused by the
+ * ggui#1124 guard as `wouldDrop` — the door built to protect those members
+ * catching the door that dropped them. That is the defect this schema
+ * exists to make impossible rather than merely noticed.
+ *
+ * So this is a SHAPE check, not a strip: the members this release names are
+ * validated exactly as the write door validates them (a bad token is still
+ * invalid, not carried), and everything else passes through untouched.
+ * Never `.strict()`, never the stripping read door.
+ */
+export const appThemeCarrySchema = z.object(appThemeSchema.shape).passthrough();
+/**
+ * What a theme GET promises (ggui#1155) — the DOOR's emit-side contract.
+ *
+ * `theme` is the stored document verbatim ({@link appThemeCarrySchema}) or
+ * `null` when the app has no theme. `interpreted.stripped`, when present,
+ * names the top-level members an INTERPRET reader on THIS release would have
+ * dropped — computed beside the document, never applied to it — so a carrier
+ * can see the gap without the document being altered.
+ *
+ * Presence ⇔ at least one name: `stripped` is `.min(1)`, so
+ * `{ interpreted: { stripped: [] } }` is INVALID rather than a second way to
+ * say "nothing was stripped". Two representations of nothing is exactly the
+ * ambiguity a reader keying on presence cannot be asked to resolve. The
+ * response is `.strict()` because this is what the DOOR emits — a reader on
+ * an older release parses it with its own tolerant read, per §3.6; this
+ * schema states the promise, not the reader's demand.
+ *
+ * Observable violation: a response whose `theme` carries fewer top-level
+ * members than the stored row holds; or `interpreted` present with nothing
+ * in it. The conformance kit's `app-theme-carry` forward case grades both.
+ */
+export const appThemeGetResponseSchema = z
+    .object({
+    theme: appThemeCarrySchema.nullable(),
+    interpreted: z
+        .object({ stripped: z.array(z.string().min(1)).min(1) })
+        .strict()
+        .optional(),
+})
+    .strict();
+/**
+ * The top-level members the STORED theme holds that an incoming write does
+ * not carry — i.e. exactly what the write would destroy (ggui#1124).
+ *
+ * `putAppTheme` REPLACES the whole `theme` attribute (the shared writer's
+ * `SET theme = :theme`), so a writer that composes fewer members than the
+ * stored document silently deletes the rest. On 2026-09-10, 26 rows lost
+ * their theme outright and ~20 more lost members nobody can now name,
+ * because a writer believed the door merged. **The rule lives here because
+ * what makes a write destructive is a fact about the wire shape, not about
+ * a storage engine** — the shared writer enforces it at the choke point, so
+ * safety does not depend on each door remembering.
+ *
+ * Deliberately total and deliberately dumb: it compares TOP-LEVEL keys and
+ * nothing else. A changed VALUE is not a drop. An explicit `undefined` IS a
+ * drop, because absent and undefined are the same wire fact. A member this
+ * release does not name still counts — that is the whole point, since a
+ * strict schema cannot see the member a later release wrote, and a
+ * whole-column write is exactly what destroys it. Given anything that is not
+ * a plain object on either side it reports nothing rather than inventing a
+ * drop: a guard that guesses is worse than one that abstains.
+ *
+ * Parties: the SHARED WRITER calls this before writing and refuses a
+ * non-empty result with {@link appThemeRefusalBodySchema}'s `wouldDrop` arm,
+ * naming the members; the WRITER retries carrying them (read the stored
+ * document, carry what it does not own by REST OMISSION — never by
+ * enumerating what it knows — and hash after the carry). Observable
+ * violation: a stored member absent after a write that did not name it.
+ */
+export function appThemeDroppedMembers(stored, incoming) {
+    if (!isPlainObject(stored) || !isPlainObject(incoming))
+        return [];
+    return Object.keys(stored).filter((key) => incoming[key] === undefined);
+}
+function isPlainObject(value) {
+    return typeof value === 'object' && value !== null && !Array.isArray(value);
+}
+/**
+ * The ONE wording for a `wouldDrop` refusal (ggui#1124, founder's ruling
+ * 2026-09-16: *"the refusal names the clear-then-set path"*). Exported so
+ * every door that refuses a destructive theme write carries the SAME words
+ * rather than paraphrasing them — a writer meeting two different
+ * explanations of one rule learns neither.
+ *
+ * Why the wording is part of the contract and not decoration: **a refusal
+ * with no compliance path converts "we protected your data" into "we broke
+ * your write", and the writer cannot tell which happened to them.** Naming
+ * the path collapses that ambiguity — it turns the refusal from a VERDICT
+ * into an INSTRUCTION. So the text MUST do three things, and the tests pin
+ * each: name the members that would have been dropped (so a writer can see
+ * whether they meant it), give the carry path for a writer who did not, and
+ * give the clear-then-set path for a writer who did — stating plainly that
+ * the app has no theme between those two writes, because that is the kind
+ * of fact a caller must not discover in production.
+ *
+ * The CLEAR half names the mechanism outright — `theme: null` — because it
+ * is true on EVERY door that writes a theme (ggui#1145): the shared writer
+ * routes an explicit `null` to one named removal before validation, on the
+ * PUT, the PATCH, the ops tool and the replace-mode push alike. For one
+ * release this sentence hedged by door (ggui#1124's `cb87cf0bc`), because
+ * `null` cleared on one door of four and a writer following a universal
+ * instruction got a second refusal on the other three; that hedge was a
+ * workaround for the asymmetry, never the contract, and it left with the
+ * asymmetry. The CARRY half needs no such history: it is implementable on
+ * every door, which is why it is stated first and unconditionally.
+ */
+export function appThemeWouldDropRefusalText(wouldDrop) {
+    if (wouldDrop.length === 0) {
+        throw new Error('appThemeWouldDropRefusalText: a refusal must name at least one dropped member');
+    }
+    const members = wouldDrop.join(', ');
+    return (`this write would drop stored theme members it does not carry — [${members}]. ` +
+        `If you did not mean to drop them: read the stored theme and carry every member this write does not own, ` +
+        `then recompute the attestation over the result. ` +
+        `If you DID mean to drop them: send \`theme: null\` to clear the theme, then write the theme you want — ` +
+        `the app has NO theme between those two writes.`);
+}
 export const appThemeRefusalBodySchema = z.union([
     z.object({ uncovered: z.object({ light: z.array(z.string()), dark: z.array(z.string()) }).strict() }).strict(),
     z.object({ unknown: z.object({ light: z.array(z.string()), dark: z.array(z.string()) }).strict() }).strict(),
     z.object({ overlayHash: z.literal('mismatch') }).strict(),
     z.object({ refused: z.literal('v1 shape') }).strict(),
+    /**
+     * The write would have DESTROYED stored members it did not carry
+     * (ggui#1124) — the refusal names them so the writer can carry them on
+     * the retry. A refusal that named nothing would be an error message
+     * instead of a teaching one, which is why the list may not be empty:
+     * naming the members is how the console got fixed.
+     */
+    z.object({ wouldDrop: z.array(z.string().min(1)).min(1) }).strict(),
 ]);

package/dist/schemas/data-contract.d.ts

@@ -107,6 +107,7 @@ export declare const actionEntrySchema: z.ZodObject<{
     example: z.ZodOptional<z.ZodType<JsonValue, unknown, z.core.$ZodTypeInternals<JsonValue, unknown>>>;
     icon: z.ZodOptional<z.ZodString>;
     confirm: z.ZodOptional<z.ZodBoolean>;
+    oneShot: z.ZodOptional<z.ZodBoolean>;
     nextStep: z.ZodOptional<z.ZodString>;
 }, z.core.$strict>;
 /** {@link ActionSpec} — flat `Record<name, ActionEntry>`. */
@@ -117,6 +118,7 @@ export declare const actionSpecSchema: z.ZodRecord<z.ZodString, z.ZodObject<{
     example: z.ZodOptional<z.ZodType<JsonValue, unknown, z.core.$ZodTypeInternals<JsonValue, unknown>>>;
     icon: z.ZodOptional<z.ZodString>;
     confirm: z.ZodOptional<z.ZodBoolean>;
+    oneShot: z.ZodOptional<z.ZodBoolean>;
     nextStep: z.ZodOptional<z.ZodString>;
 }, z.core.$strict>>;
 /** {@link StreamChannelEntry} — per-channel metadata in a {@link StreamSpec}. */
@@ -789,5 +791,49 @@ export declare const DATA_CONTRACT_MINIMAL_EXAMPLE: {
         };
     };
 };
+/**
+ * The contract READ-door result (ggui#1115): the contract as this release
+ * can read it, plus the entry members it had to strip to get there.
+ */
+export type DataContractReadDoorResult = {
+    readonly ok: true;
+    readonly contract: DataContract;
+    readonly stripped: readonly string[];
+} | {
+    readonly ok: false;
+    readonly issues: readonly string[];
+};
+/**
+ * Parse a STORED contract at a READ door (ggui#1115).
+ *
+ * `dataContractSchema`'s outer object is `.passthrough()`, so a whole new
+ * top-level spec was never the hazard — but its ENTRY schemas are
+ * `.strict()`, and contracts are STORED (blueprint rows, artifact
+ * manifests). So a release that adds a member to an action / prop / stream /
+ * context / tool ENTRY makes every older reader fail the parse, and a reader
+ * that turns a failed parse into "no candidate" drops the row from the match
+ * set: the generator runs again, a different card is produced, and nothing
+ * anywhere says a stored blueprint was skipped. A silent cache miss, not a
+ * failure — which is why this door exists and why it NAMES what it stripped.
+ *
+ * WRITE doors keep entry strictness and MUST: it is what catches a typo in a
+ * generated contract before it is stored, and relaxing it globally would
+ * trade a silent cache miss for silently stored garbage. The asymmetry is by
+ * DOOR, exactly as for `AppTheme` (`schemas/app-theme.ts`, VERSION-POLICY
+ * §3.6): this is the INTERPRET side, so it strips and reports; a read whose
+ * purpose is to REPRODUCE state (a writer's carry path) must not strip at
+ * all.
+ *
+ * Everything the write door refuses is still refused — a missing required
+ * field, a wrong type, a malformed spec. Only members this release does not
+ * NAME are stripped, never members it finds INVALID.
+ *
+ * NOT COVERED, deliberately and named rather than discovered: the gadget
+ * family under `clientCapabilities`. Its descriptors are validated per row
+ * with their own salvage posture (`strictGadgetDescriptorSchema`), evolve on
+ * their own surface, and folding them in here would put two different
+ * evolution stories behind one door.
+ */
+export declare function parseDataContractAtReadDoor(input: unknown): DataContractReadDoorResult;
 export declare const dataContractSchema: z.ZodType<DataContract>;
 //# sourceMappingURL=data-contract.d.ts.map

package/dist/schemas/data-contract.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"data-contract.d.ts","sourceRoot":"","sources":["../../src/schemas/data-contract.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAmDG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAMxB,OAAO,KAAK,EACV,YAAY,EACZ,SAAS,EACT,UAAU,EACV,UAAU,EACX,MAAM,wBAAwB,CAAC;AAEhC;;;;GAIG;AACH,eAAO,MAAM,eAAe,EAAE,CAAC,CAAC,OAAO,CAAC,SAAS,CAYhD,CAAC;AAEF,0EAA0E;AAC1E,eAAO,MAAM,gBAAgB,EAAE,CAAC,CAAC,OAAO,CAAC,UAAU,CAAyC,CAAC;AAmB7F,eAAO,MAAM,gBAAgB,EAAE,CAAC,CAAC,OAAO,CAAC,UAAU,CA2BlD,CAAC;AAEF;;;;;;;GAOG;AACH,eAAO,MAAM,eAAe;;;;;;;kBASjB,CAAC;AAEZ,sFAAsF;AACtF,eAAO,MAAM,eAAe;;;;;;;;;;kBAKjB,CAAC;AAEZ;;;;;;;;;;GAUG;AACH,eAAO,MAAM,iBAAiB;;;;;;;;kBAUnB,CAAC;AAEZ,6DAA6D;AAC7D,eAAO,MAAM,gBAAgB;;;;;;;;mBAA0C,CAAC;AAExE,iFAAiF;AACjF,eAAO,MAAM,wBAAwB;;;;;;;;;;;;;;;;;;kBAgB1B,CAAC;AAEZ,uEAAuE;AACvE,eAAO,MAAM,gBAAgB;;;;;;;;;;;;;;;;;;mBAAiD,CAAC;AAE/E,yEAAyE;AACzE,eAAO,MAAM,kBAAkB;;;;;;kBAQpB,CAAC;AAEZ,+DAA+D;AAC/D,eAAO,MAAM,iBAAiB;;;;;;mBAA2C,CAAC;AAE1E,sFAAsF;AACtF,eAAO,MAAM,oBAAoB;;;;;;;;;;;;;;;kBAiBtB,CAAC;AAEZ,qEAAqE;AACrE,eAAO,MAAM,2BAA2B;;;;;;;;;;;;;;;;;iBAIxB,CAAC;AAGjB;;;;;;;;;;;;GAYG;AACH,eAAO,MAAM,oBAAoB,yBAAmD,CAAC;AAErF;;;;;;;;;;;;;;;;GAgBG;AACH,eAAO,MAAM,aAAa,QAA8B,CAAC;AAEzD;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,eAAO,MAAM,mBAAmB,QACsB,CAAC;AAEvD;;;;;;;;;;;;;;GAcG;AACH,eAAO,MAAM,aAAa,QAAyC,CAAC;AAEpE;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,eAAO,MAAM,cAAc,QAAyB,CAAC;AAErD;;;;;;GAMG;AACH,eAAO,MAAM,mBAAmB,qBAAqB,CAAC;AAEtD;;;;;;;;;;;;;;;;;GAiBG;AACH,eAAO,MAAM,gBAAgB,QAAiD,CAAC;AAE/E;;;;;;GAMG;AACH,wBAAgB,gBAAgB,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,GAAG,OAAO,CAE/D;AAED;;;;;;;;GAQG;AACH,OAAO,EAAE,YAAY,EAAE,iBAAiB,EAAE,MAAM,uBAAuB,CAAC;AAwExE;;;;;;;;GAQG;AACH,eAAO,MAAM,kBAAkB;;;;;;;;;;;;;;oBAa7B,CAAC;AAEH;;;;GAIG;AACH,eAAO,MAAM,wBAAwB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;oBAanC,CAAC;AAEH;;;;;;GAMG;AACH,eAAO,MAAM,sBAAsB;;;;;;;;;;;;;;;;;;;;;;;;;;kBAKxB,CAAC;AAEZ;;;;;;;;;;;;;GAaG;AACH,eAAO,MAAM,4BAA4B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;kBAK9B,CAAC;AAEZ;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AACH,eAAO,MAAM,gCAAgC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;kBAU1C,CAAC;AAQJ;;;;;;;;;;;;;;;;;GAiBG;AACH,eAAO,MAAM,qBAAqB;;;kBAKvB,CAAC;AAEZ;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,sBAAsB;;;mBAa/B,CAAC;AAEL;;;;;;;;;;;;;;;GAeG;AACH,eAAO,MAAM,4BAA4B;;;;;kBAO9B,CAAC;AAEZ;;;;;;;;;;;;GAYG;AACH,eAAO,MAAM,kBAAkB,uCAAgE,CAAC;AAEhG;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AACH;;;;;;;GAOG;AACH,eAAO,MAAM,wBAAwB,QAQa,CAAC;AAEnD;;;;;GAKG;AACH,eAAO,MAAM,6BAA6B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAehC,CAAC;AAEX,eAAO,MAAM,kBAAkB,EAAE,CAAC,CAAC,OAAO,CAAC,YAAY,CAiCZ,CAAC"}
+{"version":3,"file":"data-contract.d.ts","sourceRoot":"","sources":["../../src/schemas/data-contract.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAmDG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAMxB,OAAO,KAAK,EACV,YAAY,EACZ,SAAS,EACT,UAAU,EACV,UAAU,EACX,MAAM,wBAAwB,CAAC;AAEhC;;;;GAIG;AACH,eAAO,MAAM,eAAe,EAAE,CAAC,CAAC,OAAO,CAAC,SAAS,CAYhD,CAAC;AAEF,0EAA0E;AAC1E,eAAO,MAAM,gBAAgB,EAAE,CAAC,CAAC,OAAO,CAAC,UAAU,CAAyC,CAAC;AAmB7F,eAAO,MAAM,gBAAgB,EAAE,CAAC,CAAC,OAAO,CAAC,UAAU,CA2BlD,CAAC;AAEF;;;;;;;GAOG;AACH,eAAO,MAAM,eAAe;;;;;;;kBASjB,CAAC;AAEZ,sFAAsF;AACtF,eAAO,MAAM,eAAe;;;;;;;;;;kBAKjB,CAAC;AAEZ;;;;;;;;;;GAUG;AACH,eAAO,MAAM,iBAAiB;;;;;;;;;kBAsFnB,CAAC;AAEZ,6DAA6D;AAC7D,eAAO,MAAM,gBAAgB;;;;;;;;;mBAA0C,CAAC;AAExE,iFAAiF;AACjF,eAAO,MAAM,wBAAwB;;;;;;;;;;;;;;;;;;kBAgB1B,CAAC;AAEZ,uEAAuE;AACvE,eAAO,MAAM,gBAAgB;;;;;;;;;;;;;;;;;;mBAAiD,CAAC;AAE/E,yEAAyE;AACzE,eAAO,MAAM,kBAAkB;;;;;;kBAQpB,CAAC;AAEZ,+DAA+D;AAC/D,eAAO,MAAM,iBAAiB;;;;;;mBAA2C,CAAC;AAE1E,sFAAsF;AACtF,eAAO,MAAM,oBAAoB;;;;;;;;;;;;;;;kBAiBtB,CAAC;AAEZ,qEAAqE;AACrE,eAAO,MAAM,2BAA2B;;;;;;;;;;;;;;;;;iBAIxB,CAAC;AAGjB;;;;;;;;;;;;GAYG;AACH,eAAO,MAAM,oBAAoB,yBAAmD,CAAC;AAErF;;;;;;;;;;;;;;;;GAgBG;AACH,eAAO,MAAM,aAAa,QAA8B,CAAC;AAEzD;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,eAAO,MAAM,mBAAmB,QACsB,CAAC;AAEvD;;;;;;;;;;;;;;GAcG;AACH,eAAO,MAAM,aAAa,QAAyC,CAAC;AAEpE;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,eAAO,MAAM,cAAc,QAAyB,CAAC;AAErD;;;;;;GAMG;AACH,eAAO,MAAM,mBAAmB,qBAAqB,CAAC;AAEtD;;;;;;;;;;;;;;;;;GAiBG;AACH,eAAO,MAAM,gBAAgB,QAAiD,CAAC;AAE/E;;;;;;GAMG;AACH,wBAAgB,gBAAgB,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,GAAG,OAAO,CAE/D;AAED;;;;;;;;GAQG;AACH,OAAO,EAAE,YAAY,EAAE,iBAAiB,EAAE,MAAM,uBAAuB,CAAC;AAwExE;;;;;;;;GAQG;AACH,eAAO,MAAM,kBAAkB;;;;;;;;;;;;;;oBAa7B,CAAC;AAEH;;;;GAIG;AACH,eAAO,MAAM,wBAAwB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;oBAanC,CAAC;AAEH;;;;;;GAMG;AACH,eAAO,MAAM,sBAAsB;;;;;;;;;;;;;;;;;;;;;;;;;;kBAKxB,CAAC;AAEZ;;;;;;;;;;;;;GAaG;AACH,eAAO,MAAM,4BAA4B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;kBAK9B,CAAC;AAEZ;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AACH,eAAO,MAAM,gCAAgC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;kBAU1C,CAAC;AAQJ;;;;;;;;;;;;;;;;;GAiBG;AACH,eAAO,MAAM,qBAAqB;;;kBAKvB,CAAC;AAEZ;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,sBAAsB;;;mBAa/B,CAAC;AAEL;;;;;;;;;;;;;;;GAeG;AACH,eAAO,MAAM,4BAA4B;;;;;kBAO9B,CAAC;AAEZ;;;;;;;;;;;;GAYG;AACH,eAAO,MAAM,kBAAkB,uCAAgE,CAAC;AAEhG;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AACH;;;;;;;GAOG;AACH,eAAO,MAAM,wBAAwB,QAQa,CAAC;AAEnD;;;;;GAKG;AACH,eAAO,MAAM,6BAA6B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAehC,CAAC;AAEX;;;GAGG;AACH,MAAM,MAAM,0BAA0B,GAClC;IAAE,QAAQ,CAAC,EAAE,EAAE,IAAI,CAAC;IAAC,QAAQ,CAAC,QAAQ,EAAE,YAAY,CAAC;IAAC,QAAQ,CAAC,QAAQ,EAAE,SAAS,MAAM,EAAE,CAAA;CAAE,GAC5F;IAAE,QAAQ,CAAC,EAAE,EAAE,KAAK,CAAC;IAAC,QAAQ,CAAC,MAAM,EAAE,SAAS,MAAM,EAAE,CAAA;CAAE,CAAC;AA2C/D;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8BG;AACH,wBAAgB,2BAA2B,CAAC,KAAK,EAAE,OAAO,GAAG,0BAA0B,CAmEtF;AAED,eAAO,MAAM,kBAAkB,EAAE,CAAC,CAAC,OAAO,CAAC,YAAY,CAiCZ,CAAC"}

package/dist/schemas/data-contract.js

@@ -158,7 +158,83 @@ export const actionEntrySchema = z
     schema: jsonSchemaSchema.optional(),
     example: jsonValueSchema.optional(),
     icon: z.string().optional(),
+    /**
+     * The author marks this action GRAVE (ggui#1112).
+     *
+     * ADVISORY, and honoured by exactly one party: `@ggui-ai/ui-gen`'s
+     * contract context renders it to the composing model as INFORMATION —
+     * *"the author marked this action grave enough to confirm before it
+     * fires"* — alongside `label`, `description`, `example` and `nextStep`.
+     * The model decides what to do with it. That is the same standing
+     * `nextStep` has: a declared field with a named consumer and no
+     * mechanical enforcer, which is legitimate as long as it says so.
+     *
+     * DO NOT promote it to a rule without re-measuring. Citing `confirm` in
+     * the generator's terminal-actions section MEASURED ZERO — two wordings,
+     * n = 4 each, a `save` action carrying `confirm: true` came back armed
+     * 0/4 and 0/4 (rnd, ggui#1108 narrowing). The finding that explains it:
+     * the field says GRAVITY, not at-most-once, and the model reads it that
+     * way. `confirm` asks BEFORE firing; {@link ActionEntry.oneShot} bounds
+     * HOW OFTEN it may fire. Siblings in intent, different questions, and an
+     * action may declare either, both or neither.
+     *
+     * Emitted today by the shipped system blueprints on destructive ops
+     * (`ggui_ops_revoke_connector_key`), so it is a live author signal and
+     * not a vestigial field.
+     *
+     * Observable violation: a contract declaring `confirm: true` whose
+     * rendered contract context omits the flag. (The pin for that belongs
+     * in `@ggui-ai/ui-gen` beside the renderer; this docblock names the
+     * criterion, not a test — a test name in a docblock is a claim about
+     * another package's tree, and this one once named a test that did
+     * not exist.)
+     */
     confirm: z.boolean().optional(),
+    /**
+     * This action may fire AT MOST ONCE per render (ggui#1108).
+     *
+     * DECLARED, never inferred — that is the whole design. The runtime
+     * cannot infer terminality; the server cannot tell a double-fire from a
+     * legitimate second "add item"; and the component cannot GUARANTEE it,
+     * because whether a generated control disables itself is decided afresh
+     * by a model on every generation. Only the contract's author knows, so
+     * the contract is where it is said.
+     *
+     * Obligations: the RUNTIME suppresses a second dispatch of a declared
+     * one-shot action for the render's lifetime — AND the suppression is
+     * NEVER SILENT: a suppressed dispatch leaves a named trace an operator
+     * can find (at minimum the runtime's diagnostic channel, carrying the
+     * `actionId` and `oneShot` as the reason), and it does NOT reach the
+     * agent as a dispatch. This is the rule `@ggui-ai/wire`'s dispatch
+     * dedup already holds for its own suppression, inherited here on
+     * purpose: a second gesture the runtime refuses to forward is an
+     * EVENT, not silence — otherwise a silent double-fire is replaced by a
+     * silent swallow, the same unobservable violation facing the other
+     * way. The RELAY never collapses distinct `actionId`s — two gestures
+     * are two facts and the relay stays honest about them; the AGENT
+     * treats `actionId` as an idempotency key for EVERY action, which buys
+     * at-most-once per DISPATCH (a replay, a re-delivered buffer) and
+     * explicitly NOT per intent, since a second gesture mints a new
+     * `actionId`.
+     *
+     * THE WINDOW, stated because "the render's lifetime" is ambiguous
+     * otherwise: a fresh `ggui_render` RE-ARMS the action; a `ggui_update`
+     * or props amend of the SAME render does NOT. So an agent re-sending
+     * props after a submit ("confirmed, here is your receipt") cannot
+     * silently re-arm a terminal action. A flow that legitimately
+     * re-submits either does not declare the action one-shot, or renders a
+     * new card — the declarer's choice, which is the point of declaring.
+     *
+     * Sibling, not a pair: `confirm` asks BEFORE firing; `oneShot` bounds
+     * how often it may fire. An action may be either, both or neither.
+     *
+     * Failure mode: a duplicated side effect — a confirm card that writes
+     * twice. Observable violation: two consume entries with distinct
+     * `actionId`s for the same declared one-shot action inside one render;
+     * or a second gesture on such an action that produced neither a consume
+     * entry NOR a named suppression trace.
+     */
+    oneShot: z.boolean().optional(),
     nextStep: z.string().min(1).optional(),
 })
     .strict();
@@ -687,6 +763,106 @@ export const DATA_CONTRACT_MINIMAL_EXAMPLE = {
         filter: { schema: { type: 'string' }, default: 'all' },
     },
 };
+function isEntryObject(value) {
+    return typeof value === 'object' && value !== null && !Array.isArray(value);
+}
+/**
+ * Strip the keys of one ENTRY that this release does not name, recording the
+ * path of each. Returns the entry unchanged when there is nothing to strip,
+ * so an untouched contract keeps object identity where it can.
+ */
+function stripEntry(entry, known, path, stripped) {
+    if (!isEntryObject(entry))
+        return entry;
+    const extra = Object.keys(entry).filter((k) => !known.has(k));
+    if (extra.length === 0)
+        return entry;
+    const out = {};
+    for (const [k, v] of Object.entries(entry)) {
+        if (known.has(k))
+            out[k] = v;
+        else
+            stripped.push(`${path}.${k}`);
+    }
+    return out;
+}
+/** Strip every entry of a `Record<name, Entry>` map. */
+function stripEntryMap(map, known, path, stripped) {
+    if (!isEntryObject(map))
+        return map;
+    const out = {};
+    for (const [name, entry] of Object.entries(map)) {
+        out[name] = stripEntry(entry, known, `${path}.${name}`, stripped);
+    }
+    return out;
+}
+/**
+ * Parse a STORED contract at a READ door (ggui#1115).
+ *
+ * `dataContractSchema`'s outer object is `.passthrough()`, so a whole new
+ * top-level spec was never the hazard — but its ENTRY schemas are
+ * `.strict()`, and contracts are STORED (blueprint rows, artifact
+ * manifests). So a release that adds a member to an action / prop / stream /
+ * context / tool ENTRY makes every older reader fail the parse, and a reader
+ * that turns a failed parse into "no candidate" drops the row from the match
+ * set: the generator runs again, a different card is produced, and nothing
+ * anywhere says a stored blueprint was skipped. A silent cache miss, not a
+ * failure — which is why this door exists and why it NAMES what it stripped.
+ *
+ * WRITE doors keep entry strictness and MUST: it is what catches a typo in a
+ * generated contract before it is stored, and relaxing it globally would
+ * trade a silent cache miss for silently stored garbage. The asymmetry is by
+ * DOOR, exactly as for `AppTheme` (`schemas/app-theme.ts`, VERSION-POLICY
+ * §3.6): this is the INTERPRET side, so it strips and reports; a read whose
+ * purpose is to REPRODUCE state (a writer's carry path) must not strip at
+ * all.
+ *
+ * Everything the write door refuses is still refused — a missing required
+ * field, a wrong type, a malformed spec. Only members this release does not
+ * NAME are stripped, never members it finds INVALID.
+ *
+ * NOT COVERED, deliberately and named rather than discovered: the gadget
+ * family under `clientCapabilities`. Its descriptors are validated per row
+ * with their own salvage posture (`strictGadgetDescriptorSchema`), evolve on
+ * their own surface, and folding them in here would put two different
+ * evolution stories behind one door.
+ */
+export function parseDataContractAtReadDoor(input) {
+    const issuesOf = (error) => error.issues.map((i) => `${i.path.join('.')}: ${i.message}`);
+    if (!isEntryObject(input)) {
+        const direct = dataContractSchema.safeParse(input);
+        return direct.success
+            ? { ok: true, contract: direct.data, stripped: [] }
+            : { ok: false, issues: issuesOf(direct.error) };
+    }
+    const stripped = [];
+    const cleaned = { ...input };
+    const propsSpec = cleaned['propsSpec'];
+    if (isEntryObject(propsSpec)) {
+        cleaned['propsSpec'] = {
+            ...propsSpec,
+            properties: stripEntryMap(propsSpec['properties'], new Set(Object.keys(propEntrySchema.shape)), 'propsSpec.properties', stripped),
+        };
+    }
+    cleaned['actionSpec'] = stripEntryMap(cleaned['actionSpec'], new Set(Object.keys(actionEntrySchema.shape)), 'actionSpec', stripped);
+    cleaned['streamSpec'] = stripEntryMap(cleaned['streamSpec'], new Set(Object.keys(streamChannelEntrySchema.shape)), 'streamSpec', stripped);
+    cleaned['contextSpec'] = stripEntryMap(cleaned['contextSpec'], new Set(Object.keys(contextEntrySchema.shape)), 'contextSpec', stripped);
+    const agentCapabilities = cleaned['agentCapabilities'];
+    if (isEntryObject(agentCapabilities)) {
+        cleaned['agentCapabilities'] = {
+            ...agentCapabilities,
+            tools: stripEntryMap(agentCapabilities['tools'], new Set(Object.keys(agentToolEntrySchema.shape)), 'agentCapabilities.tools', stripped),
+        };
+    }
+    for (const key of ['actionSpec', 'streamSpec', 'contextSpec']) {
+        if (cleaned[key] === undefined)
+            delete cleaned[key];
+    }
+    const parsed = dataContractSchema.safeParse(cleaned);
+    return parsed.success
+        ? { ok: true, contract: parsed.data, stripped }
+        : { ok: false, issues: issuesOf(parsed.error) };
+}
 export const dataContractSchema = z
     .object({
     propsSpec: propsSpecSchema

package/dist/schemas/mcp.d.ts

@@ -145,8 +145,9 @@ export declare const handshakeInputSchema: z.ZodObject<{
  *   - `synth`  → render `{handshakeId, props}` (omit `override`) to gen against the amended contract.
  *
  * Any origin → render `{handshakeId, props, override: {contract?, variance?}}`
- * to re-aim the suggestion — `override.contract` gens against a fresh
- * contract; `override.variance` re-aims the variant axis.
+ * to re-aim the suggestion — `override.contract` re-aims to a fresh
+ * contract (resolved at its own key); `override.variance` re-aims the
+ * variant axis.
  *
  * Wire-output is intentionally lean. The handler carries `target`,
  * `alternatives`, `contractHash`, `serverCapabilities` on its internal
@@ -192,7 +193,12 @@ export declare const handshakeOutputSchema: z.ZodObject<{
  *   - ACCEPT (omit `override`) reuses the agreed contract + the proposed
  *     variance, resolving the proposed `(contractKey, variantKey)`.
  *   - `override.contract` re-drafts the contract (STRICT — must already
- *     conform; the server does not repair it) and cold-gens against it.
+ *     conform; the server does not repair it) and re-resolves the
+ *     effective `(blueprintKey(newContract), variantKey)` — reuse if a
+ *     blueprint exists there, else cold-gen registered under that key.
+ *     An override is a RE-AIM, never a request for a fresh generation
+ *     (ggui#1131); `forceCreate` on the handshake is the only lever
+ *     that forces one.
  *   - `override.variance` re-aims the variant axis while keeping the
  *     agreed contract, re-resolving the effective
  *     `(contractKey, variantKey(newVariance))`.

package/dist/schemas/mcp.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"mcp.d.ts","sourceRoot":"","sources":["../../src/schemas/mcp.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAyBxB;;;;;GAKG;AACH,eAAO,MAAM,iBAAiB;;;CAgBpB,CAAC;AAEX,eAAO,MAAM,kBAAkB;;;iBAA8B,CAAC;AAE9D;;;GAGG;AACH,eAAO,MAAM,cAAc;;;;;CAKjB,CAAC;AAEX,eAAO,MAAM,eAAe;;;;;iBAA2B,CAAC;AAExD,eAAO,MAAM,oBAAoB;;CAKvB,CAAC;AAEX,eAAO,MAAM,qBAAqB;;iBAAiC,CAAC;AAEpE;;;;;;GAMG;AACH,eAAO,MAAM,yBAAyB;;CAK5B,CAAC;AAEX,eAAO,MAAM,0BAA0B;;iBAAsC,CAAC;AAE9E;;;;;GAKG;AACH,eAAO,MAAM,gCAAgC,IAAc,CAAC;AAE5D,eAAO,MAAM,iCAAiC,gCAE7C,CAAC;AAEF,eAAO,MAAM,0BAA0B;;;;;CAwB7B,CAAC;AAEX,eAAO,MAAM,2BAA2B;;;;;iBAAuC,CAAC;AAEhF,eAAO,MAAM,yBAAyB;;CAO5B,CAAC;AAEX,eAAO,MAAM,0BAA0B;;iBAAsC,CAAC;AAE9E,eAAO,MAAM,kBAAkB,IAAc,CAAC;AAE9C,eAAO,MAAM,mBAAmB,gCAA+B,CAAC;AAahE;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AACH,eAAO,MAAM,oBAAoB;;;;kBA0BtB,CAAC;AAEZ;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AACH,eAAO,MAAM,qBAAqB;;;;;;;;;;;;;;;;iBAgChC,CAAC;AAEH;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgCG;AACH,eAAO,MAAM,gBAAgB;;IAO3B;;;;;;;;OAQG;;IAEH;;;;;OAKG;;IAQH;;;;;;;;;;;;;;;OAeG;;;;IAaH;;;;;;;;;;;OAWG;;;;;CAuBK,CAAC;AAEX,eAAO,MAAM,iBAAiB;;;;;;;;;;;iBAA6B,CAAC;AAE5D;;;;;GAKG;AACH,eAAO,MAAM,uBAAuB;;;;;;;;;;iBAyBlC,CAAC;AAEH;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,eAAO,MAAM,qBAAqB;;;;;;EAMhC,CAAC;AAEH;;;;;GAKG;AACH,MAAM,MAAM,eAAe,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,qBAAqB,CAAC,CAAC;AAEpE;;;;;GAKG;AACH,eAAO,MAAM,iBAAiB;;;;;;;;;iBAS5B,CAAC;AAEH;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,eAAO,MAAM,mBAAmB;;;;EAA4C,CAAC;AAE7E,+DAA+D;AAC/D,MAAM,MAAM,aAAa,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,mBAAmB,CAAC,CAAC;AAyChE,eAAO,MAAM,mBAAmB;;;;;;;;;;;;;;;;;;;;;;;;iBAmB9B,CAAC;AAEH,oEAAoE;AACpE,MAAM,MAAM,oBAAoB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,mBAAmB,CAAC,CAAC;AAEvE;;;;;;;;;;;;;;;GAeG;AACH,eAAO,MAAM,sBAAsB;;;;;;;;;;;;;kBAajC,CAAC;AAEH,0FAA0F;AAC1F,MAAM,MAAM,gBAAgB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,sBAAsB,CAAC,CAAC;AAEtE;;;;;;;;;;;;;GAaG;AACH,eAAO,MAAM,2BAA2B;;;;;;;;;;;;;;;;;;;kBAItC,CAAC;AAEH,iGAAiG;AACjG,MAAM,MAAM,qBAAqB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,2BAA2B,CAAC,CAAC;AAEhF;;;;;;;;;;;;;;;;;;GAkBG;AACH,eAAO,MAAM,mBAAmB;;;;;;;;;;;;;;;;;;;;;;;;;;;kBAG9B,CAAC;AAqDH;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,eAAO,MAAM,2BAA2B;;;;;EAKtC,CAAC;AAEH;;;;;;;;;;GAUG;AACH,eAAO,MAAM,uBAAuB;;;;;;;;;iBAalC,CAAC;AAEH;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6CG;AACH,eAAO,MAAM,kBAAkB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;iBAiK7B,CAAC;AAEH;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8BG;AACH,eAAO,MAAM,iBAAiB;;;;;;;;4BAa5B,CAAC;AAEH;;;;;;GAMG;AACH,eAAO,MAAM,gBAAgB;;;;;;;;4BAa3B,CAAC;AAkBH;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,eAAO,MAAM,kBAAkB;;;;;;;;iBAgD7B,CAAC;AAEH;;;;;;;;;;GAUG;AACH,eAAO,MAAM,iBAAiB;;;;;;;iBAsC5B,CAAC;AAEH;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,eAAO,MAAM,6BAA6B;;;;;kBAW/B,CAAC;AAEZ,eAAO,MAAM,8BAA8B;;;kBAKhC,CAAC;AAIZ;;;;;;GAMG;AACH,eAAO,MAAM,sBAAsB,MAAM,CAAC;AAE1C;;;;;;;;;;;;;;;GAeG;AACH,eAAO,MAAM,6BAA6B,KAAK,CAAC;AAEhD;;;;;GAKG;AACH,eAAO,MAAM,sBAAsB;;;;;iBAsBjC,CAAC;AAEH;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AACH,eAAO,MAAM,qBAAqB;;;;;CA8BxB,CAAC;AAEX,eAAO,MAAM,sBAAsB;;;;;iBAAkC,CAAC;AAEtE;;;;;;;GAOG;AACH,eAAO,MAAM,2BAA2B;;;;;;;;;iBAItC,CAAC;AAEH;;;;;;;;;GASG;AACH,eAAO,MAAM,wBAAwB;;;iBAGnC,CAAC;AAEH;;;;;;;;GAQG;AACH,eAAO,MAAM,uBAAuB;;;;;;;;;;;;mBAGlC,CAAC;AAGH;;;;;;;;;;;;;;;;;;GAkBG;AACH,eAAO,MAAM,0BAA0B;;;;;;;CA+B7B,CAAC;AAEX,eAAO,MAAM,2BAA2B;;;;;;;iBAAuC,CAAC;AAEhF,8DAA8D;AAC9D,eAAO,MAAM,4BAA4B;;iBAAoC,CAAC;AAW9E,KAAK,iBAAiB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,kBAAkB,CAAC,CAAC;AAE5D,kDAAkD;AAClD,KAAK,uBAAuB,GAAG,QAAQ,CACrC,IAAI,CACF,iBAAiB,EACjB,WAAW,GAAG,QAAQ,GAAG,cAAc,GAAG,aAAa,GAAG,YAAY,GAAG,OAAO,CACjF,CACF,CAAC;AAEF,qEAAqE;AACrE,wBAAgB,gBAAgB,CAC9B,MAAM,EAAE,iBAAiB,GACxB,MAAM,IAAI,iBAAiB,GAAG;IAAE,OAAO,EAAE,UAAU,CAAA;CAAE,GAAG,uBAAuB,CAEjF;AAED;;;GAGG;AACH,wBAAgB,oBAAoB,CAClC,MAAM,EAAE,iBAAiB,GACxB,MAAM,IAAI,iBAAiB,GAAG;IAC/B,OAAO,EAAE,QAAQ,CAAC;IAClB,KAAK,EAAE,CAAC,CAAC,KAAK,CAAC,OAAO,iBAAiB,CAAC,CAAC;CAC1C,GAAG,uBAAuB,CAE1B;AAED;;;;;GAKG;AACH,wBAAgB,qBAAqB,CACnC,MAAM,EAAE,iBAAiB,GACxB,MAAM,IAAI;IAAE,OAAO,EAAE,SAAS,CAAC;IAAC,OAAO,EAAE,oBAAoB,CAAA;CAAE,CAEjE;AAYD,iFAAiF;AACjF,eAAO,MAAM,sBAAsB;;;;EAA0C,CAAC;AAE9E;;;;GAIG;AACH,eAAO,MAAM,2BAA2B;;;;;;;;;;;;;;;;;;;;;;;;;;;;iBAiBtC,CAAC;AAEH,kFAAkF;AAClF,eAAO,MAAM,wBAAwB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;iBAEnC,CAAC;AAEH,mFAAmF;AACnF,eAAO,MAAM,4BAA4B;;;;;;;;;iBASvC,CAAC;AAEH;;;;GAIG;AACH,eAAO,MAAM,uBAAuB;;;EAAgC,CAAC;AAErE;;;;;;GAMG;AACH,eAAO,MAAM,uBAAuB;;;;;;;;iBAQlC,CAAC;AAEH;;;;;;;;;;;;;GAaG;AACH,eAAO,MAAM,kBAAkB;;;;;;;;;;;;iBAI7B,CAAC;AAEH;;;;;;GAMG;AACH,eAAO,MAAM,uBAAuB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;iBAIlC,CAAC;AAEH,iFAAiF;AACjF,eAAO,MAAM,4BAA4B;;;;;;;;;;;iBAEvC,CAAC;AAEH;;;;GAIG;AACH,eAAO,MAAM,oBAAoB;;;iBAU/B,CAAC;AAEH;;;;;;;;;GASG;AACH,eAAO,MAAM,0BAA0B;;;;;;;;;;;;iBAgBrC,CAAC;AAEH,wEAAwE;AACxE,eAAO,MAAM,6BAA6B;;;;EAA8C,CAAC;AAEzF,eAAO,MAAM,8BAA8B;;;;;;;;;iBAKzC,CAAC;AAEH,6GAA6G;AAC7G,eAAO,MAAM,+BAA+B;;;;;;;;;;;;;;;;;;;;;;;;;;;iBAK1C,CAAC;AAEH,mFAAmF;AACnF,eAAO,MAAM,wBAAwB;;;;;;;iBAOnC,CAAC;AAEH,eAAO,MAAM,sCAAsC;;;;;;;;;;iBAGjD,CAAC;AAEH,mFAAmF;AACnF,eAAO,MAAM,gCAAgC;;;;;;;;;;;;;;;;;;;;;;;;;;iBAiB3C,CAAC;AAEH,eAAO,MAAM,gCAAgC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;iBAY3C,CAAC"}
+{"version":3,"file":"mcp.d.ts","sourceRoot":"","sources":["../../src/schemas/mcp.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAyBxB;;;;;GAKG;AACH,eAAO,MAAM,iBAAiB;;;CAgBpB,CAAC;AAEX,eAAO,MAAM,kBAAkB;;;iBAA8B,CAAC;AAE9D;;;GAGG;AACH,eAAO,MAAM,cAAc;;;;;CAKjB,CAAC;AAEX,eAAO,MAAM,eAAe;;;;;iBAA2B,CAAC;AAExD,eAAO,MAAM,oBAAoB;;CAKvB,CAAC;AAEX,eAAO,MAAM,qBAAqB;;iBAAiC,CAAC;AAEpE;;;;;;GAMG;AACH,eAAO,MAAM,yBAAyB;;CAK5B,CAAC;AAEX,eAAO,MAAM,0BAA0B;;iBAAsC,CAAC;AAE9E;;;;;GAKG;AACH,eAAO,MAAM,gCAAgC,IAAc,CAAC;AAE5D,eAAO,MAAM,iCAAiC,gCAE7C,CAAC;AAEF,eAAO,MAAM,0BAA0B;;;;;CAwB7B,CAAC;AAEX,eAAO,MAAM,2BAA2B;;;;;iBAAuC,CAAC;AAEhF,eAAO,MAAM,yBAAyB;;CAO5B,CAAC;AAEX,eAAO,MAAM,0BAA0B;;iBAAsC,CAAC;AAE9E,eAAO,MAAM,kBAAkB,IAAc,CAAC;AAE9C,eAAO,MAAM,mBAAmB,gCAA+B,CAAC;AAahE;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AACH,eAAO,MAAM,oBAAoB;;;;kBA0BtB,CAAC;AAEZ;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6BG;AACH,eAAO,MAAM,qBAAqB;;;;;;;;;;;;;;;;iBAgChC,CAAC;AAEH;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAqCG;AACH,eAAO,MAAM,gBAAgB;;IAO3B;;;;;;;;OAQG;;IAEH;;;;;OAKG;;IAQH;;;;;;;;;;;;;;;OAeG;;;;IAaH;;;;;;;;;;;OAWG;;;;;CAuBK,CAAC;AAEX,eAAO,MAAM,iBAAiB;;;;;;;;;;;iBAA6B,CAAC;AAE5D;;;;;GAKG;AACH,eAAO,MAAM,uBAAuB;;;;;;;;;;iBAyBlC,CAAC;AAEH;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,eAAO,MAAM,qBAAqB;;;;;;EAMhC,CAAC;AAEH;;;;;GAKG;AACH,MAAM,MAAM,eAAe,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,qBAAqB,CAAC,CAAC;AAEpE;;;;;GAKG;AACH,eAAO,MAAM,iBAAiB;;;;;;;;;iBAS5B,CAAC;AAEH;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,eAAO,MAAM,mBAAmB;;;;EAA4C,CAAC;AAE7E,+DAA+D;AAC/D,MAAM,MAAM,aAAa,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,mBAAmB,CAAC,CAAC;AAyChE,eAAO,MAAM,mBAAmB;;;;;;;;;;;;;;;;;;;;;;;;iBAmB9B,CAAC;AAEH,oEAAoE;AACpE,MAAM,MAAM,oBAAoB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,mBAAmB,CAAC,CAAC;AAEvE;;;;;;;;;;;;;;;GAeG;AACH,eAAO,MAAM,sBAAsB;;;;;;;;;;;;;kBAajC,CAAC;AAEH,0FAA0F;AAC1F,MAAM,MAAM,gBAAgB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,sBAAsB,CAAC,CAAC;AAEtE;;;;;;;;;;;;;GAaG;AACH,eAAO,MAAM,2BAA2B;;;;;;;;;;;;;;;;;;;kBAItC,CAAC;AAEH,iGAAiG;AACjG,MAAM,MAAM,qBAAqB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,2BAA2B,CAAC,CAAC;AAEhF;;;;;;;;;;;;;;;;;;GAkBG;AACH,eAAO,MAAM,mBAAmB;;;;;;;;;;;;;;;;;;;;;;;;;;;kBAG9B,CAAC;AAqDH;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,eAAO,MAAM,2BAA2B;;;;;EAKtC,CAAC;AAEH;;;;;;;;;;GAUG;AACH,eAAO,MAAM,uBAAuB;;;;;;;;;iBAalC,CAAC;AAEH;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6CG;AACH,eAAO,MAAM,kBAAkB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;iBAiK7B,CAAC;AAEH;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8BG;AACH,eAAO,MAAM,iBAAiB;;;;;;;;4BAa5B,CAAC;AAEH;;;;;;GAMG;AACH,eAAO,MAAM,gBAAgB;;;;;;;;4BAa3B,CAAC;AAkBH;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,eAAO,MAAM,kBAAkB;;;;;;;;iBAgD7B,CAAC;AAEH;;;;;;;;;;GAUG;AACH,eAAO,MAAM,iBAAiB;;;;;;;iBAsC5B,CAAC;AAEH;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,eAAO,MAAM,6BAA6B;;;;;kBAW/B,CAAC;AAEZ,eAAO,MAAM,8BAA8B;;;kBAKhC,CAAC;AAIZ;;;;;;GAMG;AACH,eAAO,MAAM,sBAAsB,MAAM,CAAC;AAE1C;;;;;;;;;;;;;;;GAeG;AACH,eAAO,MAAM,6BAA6B,KAAK,CAAC;AAEhD;;;;;GAKG;AACH,eAAO,MAAM,sBAAsB;;;;;iBAsBjC,CAAC;AAEH;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AACH,eAAO,MAAM,qBAAqB;;;;;CA8BxB,CAAC;AAEX,eAAO,MAAM,sBAAsB;;;;;iBAAkC,CAAC;AAEtE;;;;;;;GAOG;AACH,eAAO,MAAM,2BAA2B;;;;;;;;;iBAItC,CAAC;AAEH;;;;;;;;;GASG;AACH,eAAO,MAAM,wBAAwB;;;iBAGnC,CAAC;AAEH;;;;;;;;GAQG;AACH,eAAO,MAAM,uBAAuB;;;;;;;;;;;;mBAGlC,CAAC;AAGH;;;;;;;;;;;;;;;;;;GAkBG;AACH,eAAO,MAAM,0BAA0B;;;;;;;CA+B7B,CAAC;AAEX,eAAO,MAAM,2BAA2B;;;;;;;iBAAuC,CAAC;AAEhF,8DAA8D;AAC9D,eAAO,MAAM,4BAA4B;;iBAAoC,CAAC;AAW9E,KAAK,iBAAiB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,kBAAkB,CAAC,CAAC;AAE5D,kDAAkD;AAClD,KAAK,uBAAuB,GAAG,QAAQ,CACrC,IAAI,CACF,iBAAiB,EACjB,WAAW,GAAG,QAAQ,GAAG,cAAc,GAAG,aAAa,GAAG,YAAY,GAAG,OAAO,CACjF,CACF,CAAC;AAEF,qEAAqE;AACrE,wBAAgB,gBAAgB,CAC9B,MAAM,EAAE,iBAAiB,GACxB,MAAM,IAAI,iBAAiB,GAAG;IAAE,OAAO,EAAE,UAAU,CAAA;CAAE,GAAG,uBAAuB,CAEjF;AAED;;;GAGG;AACH,wBAAgB,oBAAoB,CAClC,MAAM,EAAE,iBAAiB,GACxB,MAAM,IAAI,iBAAiB,GAAG;IAC/B,OAAO,EAAE,QAAQ,CAAC;IAClB,KAAK,EAAE,CAAC,CAAC,KAAK,CAAC,OAAO,iBAAiB,CAAC,CAAC;CAC1C,GAAG,uBAAuB,CAE1B;AAED;;;;;GAKG;AACH,wBAAgB,qBAAqB,CACnC,MAAM,EAAE,iBAAiB,GACxB,MAAM,IAAI;IAAE,OAAO,EAAE,SAAS,CAAC;IAAC,OAAO,EAAE,oBAAoB,CAAA;CAAE,CAEjE;AAYD,iFAAiF;AACjF,eAAO,MAAM,sBAAsB;;;;EAA0C,CAAC;AAE9E;;;;GAIG;AACH,eAAO,MAAM,2BAA2B;;;;;;;;;;;;;;;;;;;;;;;;;;;;iBAiBtC,CAAC;AAEH,kFAAkF;AAClF,eAAO,MAAM,wBAAwB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;iBAEnC,CAAC;AAEH,mFAAmF;AACnF,eAAO,MAAM,4BAA4B;;;;;;;;;iBASvC,CAAC;AAEH;;;;GAIG;AACH,eAAO,MAAM,uBAAuB;;;EAAgC,CAAC;AAErE;;;;;;GAMG;AACH,eAAO,MAAM,uBAAuB;;;;;;;;iBAQlC,CAAC;AAEH;;;;;;;;;;;;;GAaG;AACH,eAAO,MAAM,kBAAkB;;;;;;;;;;;;iBAI7B,CAAC;AAEH;;;;;;GAMG;AACH,eAAO,MAAM,uBAAuB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;iBAIlC,CAAC;AAEH,iFAAiF;AACjF,eAAO,MAAM,4BAA4B;;;;;;;;;;;iBAEvC,CAAC;AAEH;;;;GAIG;AACH,eAAO,MAAM,oBAAoB;;;iBAU/B,CAAC;AAEH;;;;;;;;;GASG;AACH,eAAO,MAAM,0BAA0B;;;;;;;;;;;;iBAgBrC,CAAC;AAEH,wEAAwE;AACxE,eAAO,MAAM,6BAA6B;;;;EAA8C,CAAC;AAEzF,eAAO,MAAM,8BAA8B;;;;;;;;;iBAKzC,CAAC;AAEH,6GAA6G;AAC7G,eAAO,MAAM,+BAA+B;;;;;;;;;;;;;;;;;;;;;;;;;;;iBAK1C,CAAC;AAEH,mFAAmF;AACnF,eAAO,MAAM,wBAAwB;;;;;;;iBAOnC,CAAC;AAEH,eAAO,MAAM,sCAAsC;;;;;;;;;;iBAGjD,CAAC;AAEH,mFAAmF;AACnF,eAAO,MAAM,gCAAgC;;;;;;;;;;;;;;;;;;;;;;;;;;iBAiB3C,CAAC;AAEH,eAAO,MAAM,gCAAgC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;iBAY3C,CAAC"}

package/dist/schemas/mcp.js

@@ -203,8 +203,9 @@ export const handshakeInputSchema = z.object({
  *   - `synth`  → render `{handshakeId, props}` (omit `override`) to gen against the amended contract.
  *
  * Any origin → render `{handshakeId, props, override: {contract?, variance?}}`
- * to re-aim the suggestion — `override.contract` gens against a fresh
- * contract; `override.variance` re-aims the variant axis.
+ * to re-aim the suggestion — `override.contract` re-aims to a fresh
+ * contract (resolved at its own key); `override.variance` re-aims the
+ * variant axis.
  *
  * Wire-output is intentionally lean. The handler carries `target`,
  * `alternatives`, `contractHash`, `serverCapabilities` on its internal
@@ -262,7 +263,12 @@ export const handshakeOutputSchema = z.object({
  *   - ACCEPT (omit `override`) reuses the agreed contract + the proposed
  *     variance, resolving the proposed `(contractKey, variantKey)`.
  *   - `override.contract` re-drafts the contract (STRICT — must already
- *     conform; the server does not repair it) and cold-gens against it.
+ *     conform; the server does not repair it) and re-resolves the
+ *     effective `(blueprintKey(newContract), variantKey)` — reuse if a
+ *     blueprint exists there, else cold-gen registered under that key.
+ *     An override is a RE-AIM, never a request for a fresh generation
+ *     (ggui#1131); `forceCreate` on the handshake is the only lever
+ *     that forces one.
  *   - `override.variance` re-aims the variant axis while keeping the
  *     agreed contract, re-resolving the effective
  *     `(contractKey, variantKey(newVariance))`.
@@ -745,7 +751,7 @@ export const renderOutputSchema = z.object({
     blueprintId: z
         .string()
         .optional()
-        .describe('Opaque id of the materialised component for this render. On the handshake-decided reuse paths (accept a cache-origin proposal, or a variance re-aim that resolves to an existing variant) it is the stored id — equal ids across renders mean the same stored component. override.contract always generates cold and mints a fresh id, even for an identical contract.'),
+        .describe('Opaque id of the materialised component for this render. On every reuse path (accept a cache-origin proposal, or an override — contract and/or variance — that resolves to an existing blueprint at its key) it is the stored id; equal ids across renders mean the same stored component. A fresh id is minted only when nothing is stored at the resolved key, or when the handshake carried forceCreate.'),
     variantKey: z
         .string()
         .optional()

package/dist/types/data-contract.d.ts

@@ -266,6 +266,16 @@ export interface ActionEntry {
     description?: string;
     /** Label shown on the UI element */
     label: string;
+    /**
+     * This action may fire AT MOST ONCE per render (ggui#1108) — declared by
+     * the contract's author, never inferred, because only the author knows.
+     * The runtime suppresses a second dispatch for the render's lifetime — and
+     * names the suppression (never silent; it does not reach the agent as a
+     * dispatch): a fresh `ggui_render` re-arms it, a `ggui_update` of the same
+     * render does not. Sibling of `confirm` (which asks before firing), not a
+     * pair.
+     */
+    oneShot?: boolean;
     /**
      * JSON Schema for the callback payload. Optional — actions without a
      * `schema` have void payload (fire-and-forget).
@@ -298,7 +308,13 @@ export interface ActionEntry {
     example?: JsonValue;
     /** Icon hint (emoji or icon name) */
     icon?: string;
-    /** Whether to show confirmation before triggering */
+    /**
+     * The author marks this action GRAVE (ggui#1112) — ADVISORY, not a rule.
+     * `@ggui-ai/ui-gen`'s contract context renders it to the composing model
+     * as information and the model decides; nothing enforces it mechanically,
+     * which is the same standing `nextStep` has. It asks BEFORE firing, where
+     * {@link ActionEntry.oneShot} bounds how OFTEN it may fire.
+     */
     confirm?: boolean;
     /**
      * OPTIONAL. Author-declared hint for the agent's next turn — the

package/dist/types/data-contract.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"data-contract.d.ts","sourceRoot":"","sources":["../../src/types/data-contract.ts"],"names":[],"mappings":"AAwCA;;;;;;;;;GASG;AACH,MAAM,WAAW,UAAU;IACzB,CAAC,GAAG,EAAE,MAAM,GAAG,SAAS,GAAG,SAAS,CAAC;CACtC;AAED;;;;;;;;;GASG;AACH,MAAM,MAAM,SAAS,GACjB,MAAM,GACN,MAAM,GACN,OAAO,GACP,IAAI,GACJ,SAAS,EAAE,GACX,UAAU,CAAC;AAMf;;;;;;;;GAQG;AACH,4DAA4D;AAC5D,MAAM,MAAM,kBAAkB,GAC1B,QAAQ,GACR,QAAQ,GACR,SAAS,GACT,SAAS,GACT,OAAO,GACP,QAAQ,GACR,MAAM,CAAC;AAEX,MAAM,WAAW,UAAW,SAAQ,UAAU;IAC5C;;;;;;;;OAQG;IACH,IAAI,CAAC,EAAE,kBAAkB,GAAG,kBAAkB,EAAE,CAAC;IACjD,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,uCAAuC;IACvC,IAAI,CAAC,EAAE,SAAS,EAAE,CAAC;IACnB,oBAAoB;IACpB,OAAO,CAAC,EAAE,SAAS,CAAC;IACpB,2DAA2D;IAC3D,OAAO,CAAC,EAAE,SAAS,CAAC;IACpB,uDAAuD;IACvD,KAAK,CAAC,EAAE,UAAU,CAAC;IACnB,gDAAgD;IAChD,UAAU,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,UAAU,CAAC,CAAC;IACxC,yDAAyD;IACzD,QAAQ,CAAC,EAAE,MAAM,EAAE,CAAC;IACpB,gFAAgF;IAChF,oBAAoB,CAAC,EAAE,UAAU,GAAG,OAAO,CAAC;IAC5C,sEAAsE;IACtE,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,qDAAqD;IACrD,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,qDAAqD;IACrD,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,0CAA0C;IAC1C,KAAK,CAAC,EAAE,UAAU,EAAE,CAAC;IACrB,kCAAkC;IAClC,KAAK,CAAC,EAAE,UAAU,EAAE,CAAC;IACrB,6BAA6B;IAC7B,KAAK,CAAC,EAAE,SAAS,CAAC;IAClB,qCAAqC;IACrC,QAAQ,CAAC,EAAE,OAAO,CAAC;CACpB;AAMD;;;;GAIG;AACH,MAAM,WAAW,SAAS;IACxB,8CAA8C;IAC9C,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,uCAAuC;IACvC,MAAM,EAAE,UAAU,CAAC;IACnB,+DAA+D;IAC/D,QAAQ,CAAC,EAAE,OAAO,CAAC;IACnB,uFAAuF;IACvF,OAAO,CAAC,EAAE,SAAS,CAAC;IACpB,8EAA8E;IAC9E,OAAO,CAAC,EAAE,SAAS,CAAC;IACpB;;;;;;;OAOG;IACH,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB;AAED;;;;;;;;;;;;;;;;;;;GAmBG;AACH,MAAM,WAAW,SAAS;IACxB,+DAA+D;IAC/D,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,8CAA8C;IAC9C,UAAU,EAAE,MAAM,CAAC,MAAM,EAAE,SAAS,CAAC,CAAC;CACvC;AA2CD;;;;;;;;;;GAUG;AACH,MAAM,MAAM,iBAAiB,GAAG,QAAQ,GAAG,SAAS,CAAC;AAErD;;;;;;;;;;;;;;;;;;GAkBG;AACH,MAAM,MAAM,kBAAkB,GAAG,QAAQ,GAAG,KAAK,GAAG,MAAM,CAAC;AAE3D,8EAA8E;AAC9E,eAAO,MAAM,2BAA2B,EAAE,iBAA4B,CAAC;AAEvE,gFAAgF;AAChF,eAAO,MAAM,4BAA4B,EAAE,kBAA2B,CAAC;AAEvE,kFAAkF;AAClF,eAAO,MAAM,+BAA+B,QAAQ,CAAC;AAErD;;;;;;;;;GASG;AACH,MAAM,WAAW,kBAAkB;IACjC,iDAAiD;IACjD,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB;;;;;;;;;;;;OAYG;IACH,MAAM,EAAE,UAAU,CAAC;IACnB,8FAA8F;IAC9F,OAAO,CAAC,EAAE,SAAS,CAAC;IACpB;;;;OAIG;IACH,IAAI,CAAC,EAAE,iBAAiB,CAAC;IACzB;;;;;OAKG;IACH,MAAM,CAAC,EAAE,kBAAkB,CAAC;IAC5B;;;;;;;;;;OAUG;IACH,QAAQ,CAAC,EAAE,OAAO,CAAC;IACnB;;;;;;;;;;;;;OAaG;IACH,MAAM,CAAC,EAAE;QACP,iEAAiE;QACjE,IAAI,EAAE,MAAM,CAAC;QACb,wDAAwD;QACxD,IAAI,CAAC,EAAE,UAAU,CAAC;KACnB,CAAC;CACH;AAED;;;;;;;;;GASG;AACH,MAAM,MAAM,UAAU,GAAG,MAAM,CAAC,MAAM,EAAE,kBAAkB,CAAC,CAAC;AAO5D;;;;;;;;;;GAUG;AACH,MAAM,WAAW,WAAW;IAC1B,gDAAgD;IAChD,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,oCAAoC;IACpC,KAAK,EAAE,MAAM,CAAC;IACd;;;;;;;;;;;;;;;;;;;;;;;;;;OA0BG;IACH,MAAM,CAAC,EAAE,UAAU,CAAC;IACpB,qFAAqF;IACrF,OAAO,CAAC,EAAE,SAAS,CAAC;IACpB,qCAAqC;IACrC,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,qDAAqD;IACrD,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB;;;;;;;;;;;;;;;;;;;;;OAqBG;IACH,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB;AAED;;;;;GAKG;AACH,MAAM,MAAM,UAAU,GAAG,MAAM,CAAC,MAAM,EAAE,WAAW,CAAC,CAAC;AAMrD;;;;;;;;;;;;;;;;;;GAkBG;AACH,MAAM,WAAW,cAAc;IAC7B;;;;mDAI+C;IAC/C,UAAU,CAAC,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,OAAO,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC;IAChD,oFAAoF;IACpF,QAAQ,EAAE;QACR,yEAAyE;QACzE,WAAW,EAAE,UAAU,CAAC;QACxB,WAAW,CAAC,EAAE,MAAM,CAAC;QACrB,YAAY,CAAC,EAAE,UAAU,CAAC;KAC3B,CAAC;IACF,2EAA2E;IAC3E,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,OAAO,CAAC,EAAE;QAAE,KAAK,EAAE,SAAS,CAAC;QAAC,MAAM,EAAE,SAAS,CAAA;KAAE,CAAC;CACnD;AAED;;;;;;;;;;;;;;GAcG;AACH,MAAM,WAAW,qBAAqB;IACpC,+CAA+C;IAC/C,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,cAAc,CAAC,CAAC;CACvC;AAMD;;;;;;;;GAQG;AACH,MAAM,WAAW,gBAAgB;IAC/B;;;;OAIG;IACH,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB;;;;OAIG;IACH,KAAK,CAAC,EAAE,MAAM,CAAC;IACf;;;;OAIG;IACH,OAAO,CAAC,EAAE,SAAS,CAAC;IACpB;;;OAGG;IACH,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB;;;;;OAKG;IACH,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB;AAED;;;GAGG;AACH,MAAM,WAAW,gBAAiB,SAAQ,gBAAgB;IACxD;;;;OAIG;IACH,IAAI,EAAE,MAAM,CAAC;IACb;;;;;;OAMG;IACH,SAAS,CAAC,EAAE,KAAK,CAAC;CACnB;AAED;;;GAGG;AACH,MAAM,WAAW,qBAAsB,SAAQ,gBAAgB;IAC7D;;;;OAIG;IACH,SAAS,EAAE,MAAM,CAAC;IAClB;;;;;OAKG;IACH,IAAI,CAAC,EAAE,KAAK,CAAC;CACd;AAED;;;;;;GAMG;AACH,MAAM,MAAM,YAAY,GAAG,gBAAgB,GAAG,qBAAqB,CAAC;AAEpE;;;;;;;;;;;;;;;;;;GAkBG;AACH,MAAM,WAAW,eAAe;IAC9B;;;;OAIG;IACH,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB;;;OAGG;IACH,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAED;;;;;;;;;;GAUG;AACH,MAAM,MAAM,gBAAgB,GAAG,MAAM,CAAC,MAAM,EAAE,eAAe,CAAC,CAAC;AAE/D;;;;;;;;GAQG;AACH,MAAM,WAAW,SAAS;IACxB,mEAAmE;IACnE,OAAO,EAAE,MAAM,CAAC;IAChB,iEAAiE;IACjE,IAAI,EAAE,MAAM,CAAC;IACb,uEAAuE;IACvE,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,iEAAiE;IACjE,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6BG;AACH,MAAM,WAAW,gBAAgB;IAC/B;;;;;;OAMG;IACH,OAAO,EAAE,YAAY,EAAE,CAAC;IACxB;;;;;;;;;;OAUG;IACH,OAAO,EAAE,MAAM,CAAC;IAChB;;;;;;;;;;;OAWG;IACH,OAAO,EAAE,MAAM,CAAC;IAChB;;;;;;;;;;;;;;;OAeG;IACH,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB;;;;;;;;;;;;;;;;;;;;;;;;;;;;OA4BG;IACH,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB;;;;;;;;;;;;;;;;;OAiBG;IACH,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB;;;;;;;OAOG;IACH,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB;;;;;;;;;;OAUG;IACH,OAAO,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IAC5B;;;;;OAKG;IACH,QAAQ,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IAC7B;;;;;;;;;;;;;;;;;;;;;;;OAuBG;IACH,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB;;;;;;;;;OASG;IACH,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB;AAED;;;;;;;;;;;;;;;GAeG;AACH,MAAM,WAAW,sBAAsB;IACrC,yDAAyD;IACzD,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,gBAAgB,CAAC,CAAC;CAC3C;AA6CD;;;;;;;;;;;;;;GAcG;AACH,MAAM,WAAW,YAAY;IAC3B;sDACkD;IAClD,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB;;;;;OAKG;IACH,MAAM,EAAE,UAAU,CAAC;IACnB;;;;;OAKG;IACH,OAAO,CAAC,EAAE,SAAS,CAAC;IACpB;;;;;;;;;;;;OAYG;IACH,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB;;;OAGG;IACH,OAAO,CAAC,EAAE,SAAS,CAAC;CACrB;AAED;iBACiB;AACjB,eAAO,MAAM,2BAA2B,MAAM,CAAC;AAE/C;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,MAAM,MAAM,WAAW,GAAG,MAAM,CAAC,MAAM,EAAE,YAAY,CAAC,CAAC;AAEvD;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,wBAAgB,oBAAoB,CAAC,KAAK,EAAE,YAAY,GAAG,SAAS,GAAG,SAAS,CAa/E;AAMD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAoEG;AACH,MAAM,WAAW,YAAY;IAC3B;;;;;;;;;;;;OAYG;IACH;;;;;;OAMG;IACH,SAAS,CAAC,EAAE,SAAS,CAAC;IACtB;;;;;;;;;;;;;;;;OAgBG;IACH,UAAU,CAAC,EAAE,UAAU,CAAC;IACxB;;;OAGG;IACH,UAAU,CAAC,EAAE,UAAU,CAAC;IACxB;;;;;;;OAOG;IACH,WAAW,CAAC,EAAE,WAAW,CAAC;IAC1B,sEAAsE;IACtE,iBAAiB,CAAC,EAAE,qBAAqB,CAAC;IAC1C;;;;;;;;;;;OAWG;IACH,kBAAkB,CAAC,EAAE,sBAAsB,CAAC;CAC7C;AAMD;;;;;;GAMG;AACH,eAAO,MAAM,4BAA4B,QAAY,CAAC;AAEtD;;;;GAIG;AACH,eAAO,MAAM,0BAA0B,QAAY,CAAC;AAEpD;;;GAGG;AACH,eAAO,MAAM,0BAA0B,KAAK,CAAC"}
+{"version":3,"file":"data-contract.d.ts","sourceRoot":"","sources":["../../src/types/data-contract.ts"],"names":[],"mappings":"AAwCA;;;;;;;;;GASG;AACH,MAAM,WAAW,UAAU;IACzB,CAAC,GAAG,EAAE,MAAM,GAAG,SAAS,GAAG,SAAS,CAAC;CACtC;AAED;;;;;;;;;GASG;AACH,MAAM,MAAM,SAAS,GACjB,MAAM,GACN,MAAM,GACN,OAAO,GACP,IAAI,GACJ,SAAS,EAAE,GACX,UAAU,CAAC;AAMf;;;;;;;;GAQG;AACH,4DAA4D;AAC5D,MAAM,MAAM,kBAAkB,GAC1B,QAAQ,GACR,QAAQ,GACR,SAAS,GACT,SAAS,GACT,OAAO,GACP,QAAQ,GACR,MAAM,CAAC;AAEX,MAAM,WAAW,UAAW,SAAQ,UAAU;IAC5C;;;;;;;;OAQG;IACH,IAAI,CAAC,EAAE,kBAAkB,GAAG,kBAAkB,EAAE,CAAC;IACjD,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,uCAAuC;IACvC,IAAI,CAAC,EAAE,SAAS,EAAE,CAAC;IACnB,oBAAoB;IACpB,OAAO,CAAC,EAAE,SAAS,CAAC;IACpB,2DAA2D;IAC3D,OAAO,CAAC,EAAE,SAAS,CAAC;IACpB,uDAAuD;IACvD,KAAK,CAAC,EAAE,UAAU,CAAC;IACnB,gDAAgD;IAChD,UAAU,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,UAAU,CAAC,CAAC;IACxC,yDAAyD;IACzD,QAAQ,CAAC,EAAE,MAAM,EAAE,CAAC;IACpB,gFAAgF;IAChF,oBAAoB,CAAC,EAAE,UAAU,GAAG,OAAO,CAAC;IAC5C,sEAAsE;IACtE,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,qDAAqD;IACrD,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,qDAAqD;IACrD,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,0CAA0C;IAC1C,KAAK,CAAC,EAAE,UAAU,EAAE,CAAC;IACrB,kCAAkC;IAClC,KAAK,CAAC,EAAE,UAAU,EAAE,CAAC;IACrB,6BAA6B;IAC7B,KAAK,CAAC,EAAE,SAAS,CAAC;IAClB,qCAAqC;IACrC,QAAQ,CAAC,EAAE,OAAO,CAAC;CACpB;AAMD;;;;GAIG;AACH,MAAM,WAAW,SAAS;IACxB,8CAA8C;IAC9C,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,uCAAuC;IACvC,MAAM,EAAE,UAAU,CAAC;IACnB,+DAA+D;IAC/D,QAAQ,CAAC,EAAE,OAAO,CAAC;IACnB,uFAAuF;IACvF,OAAO,CAAC,EAAE,SAAS,CAAC;IACpB,8EAA8E;IAC9E,OAAO,CAAC,EAAE,SAAS,CAAC;IACpB;;;;;;;OAOG;IACH,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB;AAED;;;;;;;;;;;;;;;;;;;GAmBG;AACH,MAAM,WAAW,SAAS;IACxB,+DAA+D;IAC/D,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,8CAA8C;IAC9C,UAAU,EAAE,MAAM,CAAC,MAAM,EAAE,SAAS,CAAC,CAAC;CACvC;AA2CD;;;;;;;;;;GAUG;AACH,MAAM,MAAM,iBAAiB,GAAG,QAAQ,GAAG,SAAS,CAAC;AAErD;;;;;;;;;;;;;;;;;;GAkBG;AACH,MAAM,MAAM,kBAAkB,GAAG,QAAQ,GAAG,KAAK,GAAG,MAAM,CAAC;AAE3D,8EAA8E;AAC9E,eAAO,MAAM,2BAA2B,EAAE,iBAA4B,CAAC;AAEvE,gFAAgF;AAChF,eAAO,MAAM,4BAA4B,EAAE,kBAA2B,CAAC;AAEvE,kFAAkF;AAClF,eAAO,MAAM,+BAA+B,QAAQ,CAAC;AAErD;;;;;;;;;GASG;AACH,MAAM,WAAW,kBAAkB;IACjC,iDAAiD;IACjD,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB;;;;;;;;;;;;OAYG;IACH,MAAM,EAAE,UAAU,CAAC;IACnB,8FAA8F;IAC9F,OAAO,CAAC,EAAE,SAAS,CAAC;IACpB;;;;OAIG;IACH,IAAI,CAAC,EAAE,iBAAiB,CAAC;IACzB;;;;;OAKG;IACH,MAAM,CAAC,EAAE,kBAAkB,CAAC;IAC5B;;;;;;;;;;OAUG;IACH,QAAQ,CAAC,EAAE,OAAO,CAAC;IACnB;;;;;;;;;;;;;OAaG;IACH,MAAM,CAAC,EAAE;QACP,iEAAiE;QACjE,IAAI,EAAE,MAAM,CAAC;QACb,wDAAwD;QACxD,IAAI,CAAC,EAAE,UAAU,CAAC;KACnB,CAAC;CACH;AAED;;;;;;;;;GASG;AACH,MAAM,MAAM,UAAU,GAAG,MAAM,CAAC,MAAM,EAAE,kBAAkB,CAAC,CAAC;AAO5D;;;;;;;;;;GAUG;AACH,MAAM,WAAW,WAAW;IAC1B,gDAAgD;IAChD,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,oCAAoC;IACpC,KAAK,EAAE,MAAM,CAAC;IACd;;;;;;;;OAQG;IACH,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB;;;;;;;;;;;;;;;;;;;;;;;;;;OA0BG;IACH,MAAM,CAAC,EAAE,UAAU,CAAC;IACpB,qFAAqF;IACrF,OAAO,CAAC,EAAE,SAAS,CAAC;IACpB,qCAAqC;IACrC,IAAI,CAAC,EAAE,MAAM,CAAC;IACd;;;;;;OAMG;IACH,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB;;;;;;;;;;;;;;;;;;;;;OAqBG;IACH,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB;AAED;;;;;GAKG;AACH,MAAM,MAAM,UAAU,GAAG,MAAM,CAAC,MAAM,EAAE,WAAW,CAAC,CAAC;AAMrD;;;;;;;;;;;;;;;;;;GAkBG;AACH,MAAM,WAAW,cAAc;IAC7B;;;;mDAI+C;IAC/C,UAAU,CAAC,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,OAAO,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC;IAChD,oFAAoF;IACpF,QAAQ,EAAE;QACR,yEAAyE;QACzE,WAAW,EAAE,UAAU,CAAC;QACxB,WAAW,CAAC,EAAE,MAAM,CAAC;QACrB,YAAY,CAAC,EAAE,UAAU,CAAC;KAC3B,CAAC;IACF,2EAA2E;IAC3E,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,OAAO,CAAC,EAAE;QAAE,KAAK,EAAE,SAAS,CAAC;QAAC,MAAM,EAAE,SAAS,CAAA;KAAE,CAAC;CACnD;AAED;;;;;;;;;;;;;;GAcG;AACH,MAAM,WAAW,qBAAqB;IACpC,+CAA+C;IAC/C,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,cAAc,CAAC,CAAC;CACvC;AAMD;;;;;;;;GAQG;AACH,MAAM,WAAW,gBAAgB;IAC/B;;;;OAIG;IACH,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB;;;;OAIG;IACH,KAAK,CAAC,EAAE,MAAM,CAAC;IACf;;;;OAIG;IACH,OAAO,CAAC,EAAE,SAAS,CAAC;IACpB;;;OAGG;IACH,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB;;;;;OAKG;IACH,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB;AAED;;;GAGG;AACH,MAAM,WAAW,gBAAiB,SAAQ,gBAAgB;IACxD;;;;OAIG;IACH,IAAI,EAAE,MAAM,CAAC;IACb;;;;;;OAMG;IACH,SAAS,CAAC,EAAE,KAAK,CAAC;CACnB;AAED;;;GAGG;AACH,MAAM,WAAW,qBAAsB,SAAQ,gBAAgB;IAC7D;;;;OAIG;IACH,SAAS,EAAE,MAAM,CAAC;IAClB;;;;;OAKG;IACH,IAAI,CAAC,EAAE,KAAK,CAAC;CACd;AAED;;;;;;GAMG;AACH,MAAM,MAAM,YAAY,GAAG,gBAAgB,GAAG,qBAAqB,CAAC;AAEpE;;;;;;;;;;;;;;;;;;GAkBG;AACH,MAAM,WAAW,eAAe;IAC9B;;;;OAIG;IACH,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB;;;OAGG;IACH,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAED;;;;;;;;;;GAUG;AACH,MAAM,MAAM,gBAAgB,GAAG,MAAM,CAAC,MAAM,EAAE,eAAe,CAAC,CAAC;AAE/D;;;;;;;;GAQG;AACH,MAAM,WAAW,SAAS;IACxB,mEAAmE;IACnE,OAAO,EAAE,MAAM,CAAC;IAChB,iEAAiE;IACjE,IAAI,EAAE,MAAM,CAAC;IACb,uEAAuE;IACvE,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,iEAAiE;IACjE,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6BG;AACH,MAAM,WAAW,gBAAgB;IAC/B;;;;;;OAMG;IACH,OAAO,EAAE,YAAY,EAAE,CAAC;IACxB;;;;;;;;;;OAUG;IACH,OAAO,EAAE,MAAM,CAAC;IAChB;;;;;;;;;;;OAWG;IACH,OAAO,EAAE,MAAM,CAAC;IAChB;;;;;;;;;;;;;;;OAeG;IACH,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB;;;;;;;;;;;;;;;;;;;;;;;;;;;;OA4BG;IACH,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB;;;;;;;;;;;;;;;;;OAiBG;IACH,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB;;;;;;;OAOG;IACH,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB;;;;;;;;;;OAUG;IACH,OAAO,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IAC5B;;;;;OAKG;IACH,QAAQ,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IAC7B;;;;;;;;;;;;;;;;;;;;;;;OAuBG;IACH,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB;;;;;;;;;OASG;IACH,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB;AAED;;;;;;;;;;;;;;;GAeG;AACH,MAAM,WAAW,sBAAsB;IACrC,yDAAyD;IACzD,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,gBAAgB,CAAC,CAAC;CAC3C;AA6CD;;;;;;;;;;;;;;GAcG;AACH,MAAM,WAAW,YAAY;IAC3B;sDACkD;IAClD,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB;;;;;OAKG;IACH,MAAM,EAAE,UAAU,CAAC;IACnB;;;;;OAKG;IACH,OAAO,CAAC,EAAE,SAAS,CAAC;IACpB;;;;;;;;;;;;OAYG;IACH,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB;;;OAGG;IACH,OAAO,CAAC,EAAE,SAAS,CAAC;CACrB;AAED;iBACiB;AACjB,eAAO,MAAM,2BAA2B,MAAM,CAAC;AAE/C;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,MAAM,MAAM,WAAW,GAAG,MAAM,CAAC,MAAM,EAAE,YAAY,CAAC,CAAC;AAEvD;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,wBAAgB,oBAAoB,CAAC,KAAK,EAAE,YAAY,GAAG,SAAS,GAAG,SAAS,CAa/E;AAMD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAoEG;AACH,MAAM,WAAW,YAAY;IAC3B;;;;;;;;;;;;OAYG;IACH;;;;;;OAMG;IACH,SAAS,CAAC,EAAE,SAAS,CAAC;IACtB;;;;;;;;;;;;;;;;OAgBG;IACH,UAAU,CAAC,EAAE,UAAU,CAAC;IACxB;;;OAGG;IACH,UAAU,CAAC,EAAE,UAAU,CAAC;IACxB;;;;;;;OAOG;IACH,WAAW,CAAC,EAAE,WAAW,CAAC;IAC1B,sEAAsE;IACtE,iBAAiB,CAAC,EAAE,qBAAqB,CAAC;IAC1C;;;;;;;;;;;OAWG;IACH,kBAAkB,CAAC,EAAE,sBAAsB,CAAC;CAC7C;AAMD;;;;;;GAMG;AACH,eAAO,MAAM,4BAA4B,QAAY,CAAC;AAEtD;;;;GAIG;AACH,eAAO,MAAM,0BAA0B,QAAY,CAAC;AAEpD;;;GAGG;AACH,eAAO,MAAM,0BAA0B,KAAK,CAAC"}

package/dist/version.d.ts

@@ -6,6 +6,29 @@
  * schema change; the most recent change anchors {@link PROTOCOL_VERSION}.
  *
  * --------------------------------------------------------------------
+ * Theme CARRY read (2026-09-17, additive, ggui#1155 — MINOR, same draft
+ * stamp): `appThemeCarrySchema` / `AppThemeCarry` and
+ * `appThemeGetResponseSchema` / `AppThemeGetResponse` — the REPRODUCE side
+ * of the two-read-paths rule. A theme GET returns the stored document
+ * VERBATIM (unknown members kept; a shape check over the named members,
+ * never a strip) or `null`, with an optional `interpreted.stripped`
+ * (`.min(1)`: present ⇔ at least one name) naming what an INTERPRET
+ * reader would drop. Exists so a writer's carry cannot be turned into the
+ * ggui#1124 defect by the reader it carries from. New exports only; no
+ * existing shape changes. Kit: wire `app-theme-carry`, forward case.
+ * --------------------------------------------------------------------
+ * `ggui:dismiss` (2026-09-16, additive, ggui#1109 — MINOR, same draft
+ * stamp): a user dismiss GESTURE forwarded from the card to its host as
+ * an INTENT, on a new protocol-owned tag in the `ggui:` postMessage
+ * family beside `ggui:lifecycle`. The card MUST NOT act on it (the host
+ * owns what dismissal means) and emits at most one intent per gesture;
+ * the host decides, and ignoring is CONFORMANT — so adoption breaks no
+ * host. `reason` is extensibly-closed ('escape' today), and the type
+ * guard validates SHAPE only: checking today's reason set would make a
+ * release-N host silently drop a release-N+1 intent (§3.6). Not on
+ * `ggui:observe` (a host may ignore telemetry by contract) and not a
+ * `ui/notifications/*` name (a frozen external namespace).
+ * --------------------------------------------------------------------
  * Motion tempo override (2026-09-16, additive, ggui#1093 P1c — MINOR,
  * same draft stamp; no WIRE change). The theming spec's §2.3 retirement
  * of per-app motion is AMENDED (protocol + rnd): layer-1 keeps the motion
@@ -3725,7 +3748,7 @@ export declare const PROTOCOL_VERSION = "draft-2026-09-10";
  *     PATCH under §1.3); it cannot be cut from main, whose delta since
  *     0.14.0 is minor-class.
  */
-export declare const GGUI_WAVE_VERSION = "0.17.0";
+export declare const GGUI_WAVE_VERSION = "0.19.0";
 /**
  * Schema version stamped onto wire envelopes that opt into the
  * `schemaVersion` forward-compat field (see {@link ActionEnvelope},