@ggui-ai/protocol 0.2.0-alpha.3 → 0.3.0-rc.0

package/dist/validation/resolve-stream-channel.js

@@ -23,7 +23,7 @@
  * Returns `undefined` for two distinct cases, both of which are
  * "nothing to enforce" at call sites:
  *
- *   - `spec === undefined` — the stack item has no stream contract.
+ *   - `spec === undefined` — the render has no stream contract.
  *   - `spec.channels[channelName]` is missing — the channel isn't
  *     declared. Callers MUST NOT assume this means "permissive";
  *     rejection is the downstream responsibility of
@@ -37,8 +37,8 @@ import { DEFAULT_STREAM_CHANNEL_COMPLETE, DEFAULT_STREAM_CHANNEL_MODE, DEFAULT_S
  * (`mode` / `replay` / `complete`) are filled with their locked
  * defaults.
  *
- * @param spec        The active stack item's stream contract, or undefined
- *                    when the item has no `streamSpec` at all.
+ * @param spec        The active render's stream contract, or undefined
+ *                    when the render has no `streamSpec` at all.
  * @param channelName The channel name to resolve — typically read
  *                    from the outbound envelope's `channel` field.
  * @returns `ResolvedStreamChannel` when the channel is declared;
@@ -59,6 +59,5 @@ export function resolveStreamChannel(spec, channelName) {
         complete: entry.complete ?? DEFAULT_STREAM_CHANNEL_COMPLETE,
         ...(entry.description !== undefined ? { description: entry.description } : {}),
         ...(entry.example !== undefined ? { example: entry.example } : {}),
-        ...(entry.tool !== undefined ? { tool: entry.tool } : {}),
     };
 }

package/dist/validation/sanitize-error.d.ts

@@ -1,13 +1,13 @@
 /**
- * Patterns stripped from stringified errors before emission on
- * `_ggui:contract-error`. The default set covers the common credential
+ * Patterns stripped from stringified errors before they ride a wire
+ * frame. The default set covers the common credential
  * shapes that show up in stack traces by accident (URLs with token query
  * params, Bearer headers captured by retry libraries, env-var dumps).
  *
  * Each regex replaces the matched span with `[REDACTED]`. Replacement is
  * conservative — we'd rather over-redact than leak. Operators who need
- * finer control inject a custom sanitizer via
- * `createSessionChannelServer({ sanitizeCausedBy })`.
+ * finer control supply a custom {@link SanitizeCausedBy} function (or
+ * pass a stricter pattern set to {@link sanitizeCausedBy}).
  */
 export declare const DEFAULT_CREDENTIAL_PATTERNS: readonly RegExp[];
 /** Default max length for a sanitized `causedBy` string. */
@@ -16,7 +16,8 @@ export declare const DEFAULT_CAUSED_BY_MAX_LENGTH = 2048;
 export declare const TRUNCATION_MARKER = "\n\u2026[truncated]";
 /**
  * Sanitize a stringified error (typically `err.stack`) before it's
- * written to `ContractErrorPayload.error.causedBy`.
+ * written to a wire-visible diagnostic slot (e.g. the `channel_error`
+ * frame's `details`).
  *
  * Applies every pattern in {@link DEFAULT_CREDENTIAL_PATTERNS} in order,
  * replacing matches with `[REDACTED]`. If the result exceeds `maxLength`,
@@ -34,11 +35,11 @@ export declare const TRUNCATION_MARKER = "\n\u2026[truncated]";
  */
 export declare function sanitizeCausedBy(raw: string, maxLength?: number, patterns?: readonly RegExp[]): string;
 /**
- * Signature of the sanitizer hook operators can inject into
- * `createSessionChannelServer`. Receives the raw stringified error
- * (typically `err.stack`) and MUST return a safe-to-emit string.
+ * Signature of a `causedBy` sanitizer hook. Receives the raw
+ * stringified error (typically `err.stack`) and MUST return a
+ * safe-to-emit string.
  *
- * Defaults to {@link sanitizeCausedBy} when no override is supplied. A
+ * {@link sanitizeCausedBy} is the canonical implementation. A
  * pass-through function that returns `raw` unchanged is valid but
  * discouraged — it re-enables the leak this module was added to close.
  */

package/dist/validation/sanitize-error.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"sanitize-error.d.ts","sourceRoot":"","sources":["../../src/validation/sanitize-error.ts"],"names":[],"mappings":"AA0BA;;;;;;;;;;GAUG;AACH,eAAO,MAAM,2BAA2B,EAAE,SAAS,MAAM,EAWxD,CAAC;AAEF,4DAA4D;AAC5D,eAAO,MAAM,4BAA4B,OAAO,CAAC;AAEjD,yEAAyE;AACzE,eAAO,MAAM,iBAAiB,wBAAmB,CAAC;AAElD;;;;;;;;;;;;;;;;;GAiBG;AACH,wBAAgB,gBAAgB,CAC9B,GAAG,EAAE,MAAM,EACX,SAAS,GAAE,MAAqC,EAChD,QAAQ,GAAE,SAAS,MAAM,EAAgC,GACxD,MAAM,CAgBR;AAED;;;;;;;;GAQG;AACH,MAAM,MAAM,gBAAgB,GAAG,CAAC,GAAG,EAAE,MAAM,KAAK,MAAM,CAAC"}
+{"version":3,"file":"sanitize-error.d.ts","sourceRoot":"","sources":["../../src/validation/sanitize-error.ts"],"names":[],"mappings":"AA0BA;;;;;;;;;;GAUG;AACH,eAAO,MAAM,2BAA2B,EAAE,SAAS,MAAM,EAWxD,CAAC;AAEF,4DAA4D;AAC5D,eAAO,MAAM,4BAA4B,OAAO,CAAC;AAEjD,yEAAyE;AACzE,eAAO,MAAM,iBAAiB,wBAAmB,CAAC;AAElD;;;;;;;;;;;;;;;;;;GAkBG;AACH,wBAAgB,gBAAgB,CAC9B,GAAG,EAAE,MAAM,EACX,SAAS,GAAE,MAAqC,EAChD,QAAQ,GAAE,SAAS,MAAM,EAAgC,GACxD,MAAM,CAgBR;AAED;;;;;;;;GAQG;AACH,MAAM,MAAM,gBAAgB,GAAG,CAAC,GAAG,EAAE,MAAM,KAAK,MAAM,CAAC"}

package/dist/validation/sanitize-error.js

@@ -1,22 +1,22 @@
 // packages/protocol/src/validation/sanitize-error.ts
 //
-// Credential-leak sanitizer for `ContractErrorPayload.error.causedBy`.
+// Credential-leak sanitizer for stringified errors bound for the wire.
 //
-// The `causedBy` field on a contract-error envelope carries the
-// stringified original error — typically `Error.stack`. Stacks frequently
+// A diagnostic cause string carries the stringified original error —
+// typically `Error.stack`. Stacks frequently
 // contain URLs with query-param tokens (`?token=...`, `?api_key=...`),
 // Authorization header values captured by over-eager logging libraries,
-// and env-var dumps. The envelope flows on the reserved
-// `_ggui:contract-error` channel with `replay: 'all'`, so anything that
-// lands in `causedBy` persists in the session ring buffer and is visible
-// in operator tools (RenderInspector activity panels). If an operator
-// shares a bug report with that data, the credential leaks externally.
+// and env-var dumps. The primary consumer is the live channel's
+// `channel_error` frame: a `POLL_FAILED` emission threads the polled
+// tool's failure into the frame's `details` slot, where it is visible
+// to the subscribed client and in operator tools (RenderInspector
+// activity panels). If an operator shares a bug report with that data,
+// the credential leaks externally.
 //
-// This module's default posture is "sanitize before emission": the
-// session-channel router pipes every `err.stack` through
-// {@link sanitizeCausedBy} before populating `causedBy`. Operators who
-// need stricter sanitization can inject their own function via
-// `createSessionChannelServer({ sanitizeCausedBy })`.
+// This module's default posture is "sanitize before emission": every
+// producer pipes the raw `err.stack` through {@link sanitizeCausedBy}
+// before putting it on the wire. Producers that need stricter
+// sanitization substitute their own {@link SanitizeCausedBy} function.
 //
 // Scope: this is a DEFENSE-IN-DEPTH belt, not the sole line. Libraries
 // that handle secrets should already avoid embedding them in error
@@ -24,15 +24,15 @@
 // opportunistically by code that didn't think about leaking and we'd
 // rather redact conservatively than ship raw stacks.
 /**
- * Patterns stripped from stringified errors before emission on
- * `_ggui:contract-error`. The default set covers the common credential
+ * Patterns stripped from stringified errors before they ride a wire
+ * frame. The default set covers the common credential
  * shapes that show up in stack traces by accident (URLs with token query
  * params, Bearer headers captured by retry libraries, env-var dumps).
  *
  * Each regex replaces the matched span with `[REDACTED]`. Replacement is
  * conservative — we'd rather over-redact than leak. Operators who need
- * finer control inject a custom sanitizer via
- * `createSessionChannelServer({ sanitizeCausedBy })`.
+ * finer control supply a custom {@link SanitizeCausedBy} function (or
+ * pass a stricter pattern set to {@link sanitizeCausedBy}).
  */
 export const DEFAULT_CREDENTIAL_PATTERNS = [
     // Bearer / Basic header values. `Bearer <token>` / `Authorization: Basic <base64>`.
@@ -52,7 +52,8 @@ export const DEFAULT_CAUSED_BY_MAX_LENGTH = 2048;
 export const TRUNCATION_MARKER = '\n…[truncated]';
 /**
  * Sanitize a stringified error (typically `err.stack`) before it's
- * written to `ContractErrorPayload.error.causedBy`.
+ * written to a wire-visible diagnostic slot (e.g. the `channel_error`
+ * frame's `details`).
  *
  * Applies every pattern in {@link DEFAULT_CREDENTIAL_PATTERNS} in order,
  * replacing matches with `[REDACTED]`. If the result exceeds `maxLength`,

package/dist/validation/schema-compat-invariants.d.ts

@@ -131,7 +131,7 @@ export declare class SchemaCompatInvariantError extends Error {
  * agentCapabilities catalog.
  *
  * Slots alongside `assertCrossReferences` + `assertNameInvariants`
- * at push time. Different scope from the server-level
+ * at render time. Different scope from the server-level
  * `SchemaCompatError` thrown by `checkRenderSchemaCompat` in
  * `@ggui-ai/mcp-server`: this check uses ONLY the contract's own
  * catalog; the server-level check uses the runtime tool registry.

package/dist/validation/schema-compat-invariants.js

@@ -88,7 +88,7 @@ export function checkActionSchemaCompat(actionSpec, agentCapabilities) {
         const tool = tools.get(toolName);
         if (!tool)
             continue; // CTR_REF_NEXT_STEP covers this
-        const toolInput = tool.inputSchema;
+        const toolInput = tool.toolInfo.inputSchema;
         if (!toolInput)
             continue; // catalog entry incomplete — no anchor
         const actionSchema = entry.schema ?? {
@@ -143,7 +143,7 @@ export function checkStreamSchemaCompat(streamSpec, agentCapabilities) {
         const tool = tools.get(toolName);
         if (!tool)
             continue; // CTR_REF_STREAM_SOURCE covers this
-        const toolOutput = tool.outputSchema;
+        const toolOutput = tool.toolInfo.outputSchema;
         if (!toolOutput)
             continue;
         const channelSchema = entry.schema;
@@ -207,7 +207,7 @@ export class SchemaCompatInvariantError extends Error {
  * agentCapabilities catalog.
  *
  * Slots alongside `assertCrossReferences` + `assertNameInvariants`
- * at push time. Different scope from the server-level
+ * at render time. Different scope from the server-level
  * `SchemaCompatError` thrown by `checkRenderSchemaCompat` in
  * `@ggui-ai/mcp-server`: this check uses ONLY the contract's own
  * catalog; the server-level check uses the runtime tool registry.

package/dist/validation/schema-meta-validation.d.ts

@@ -6,8 +6,8 @@
  *   2. `actionSpec[*].schema` (optional per entry)
  *   3. `streamSpec[*].schema`
  *   4. `contextSpec[*].schema`
- *   5. `agentCapabilities.tools[*].inputSchema` (optional per entry)
- *   6. `agentCapabilities.tools[*].outputSchema` (optional per entry)
+ *   5. `agentCapabilities.tools[*].toolInfo.inputSchema` (required per entry)
+ *   6. `agentCapabilities.tools[*].toolInfo.outputSchema` (optional per entry)
  *
  * For each present schema, runs `compileForValidation()` from
  * `ajv-runtime`. Ajv's `strict: true` mode throws on malformed JSON
@@ -40,7 +40,7 @@ export interface SchemaMetaViolation {
 /**
  * Typed error for contract schema meta-validation failures. Mirrors
  * the shape of `CrossReferenceError` / `ContractViolationError` for
- * symmetry — push/handshake catch and surface a structured
+ * symmetry — render/handshake catch and surface a structured
  * `contract_schema_invalid` error to the agent.
  */
 export declare class ContractSchemaMetaError extends Error {
@@ -50,11 +50,24 @@ export declare class ContractSchemaMetaError extends Error {
     constructor(violations: readonly SchemaMetaViolation[]);
 }
 /**
- * Walks the contract's six inner JSON Schema fields and asserts
- * each compiles cleanly under Ajv's strict mode. Throws
- * {@link ContractSchemaMetaError} on the first push attempt that
- * smuggles a malformed schema; collects every offender in one pass
- * before throwing so the agent sees the full list.
+ * Walks the contract's six inner JSON Schema fields and collects a
+ * {@link SchemaMetaViolation} for each that does not compile cleanly
+ * under Ajv's strict mode (unknown keyword, missing `items`, a
+ * non-schema `properties` value, or a missing `schema:` wrapper). Pure
+ * check — returns the full list so callers can either repair (the
+ * handshake repair loop) or throw (see {@link assertContractSchemasValid}).
+ *
+ * This is the inner-schema validity check folded into the unified
+ * `validateContract` gate (lint-contract.ts `phaseSchemaMeta`) — the
+ * one check the strict linter was previously missing relative to the
+ * render/handshake assert set.
+ */
+export declare function checkContractSchemasValid(contract: DataContract): SchemaMetaViolation[];
+/**
+ * Throwable wrapper around {@link checkContractSchemasValid}. Throws
+ * {@link ContractSchemaMetaError} (collecting every malformed schema in
+ * one pass) when any inner JSON Schema fails Ajv strict-mode
+ * compilation. No-op when all schemas are well-formed.
  */
 export declare function assertContractSchemasValid(contract: DataContract): void;
 //# sourceMappingURL=schema-meta-validation.d.ts.map

package/dist/validation/schema-meta-validation.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"schema-meta-validation.d.ts","sourceRoot":"","sources":["../../src/validation/schema-meta-validation.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+BG;AAEH,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,wBAAwB,CAAC;AAG3D,MAAM,WAAW,mBAAmB;IAClC,sFAAsF;IACtF,KAAK,EAAE,MAAM,CAAC;IACd,+DAA+D;IAC/D,OAAO,EAAE,MAAM,CAAC;CACjB;AAED;;;;;GAKG;AACH,qBAAa,uBAAwB,SAAQ,KAAK;IAChD,QAAQ,CAAC,IAAI,EAAG,yBAAyB,CAAU;IACnD,QAAQ,CAAC,UAAU,EAAE,SAAS,mBAAmB,EAAE,CAAC;IACpD,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;gBAEV,UAAU,EAAE,SAAS,mBAAmB,EAAE;CAWvD;AAmCD;;;;;;GAMG;AACH,wBAAgB,0BAA0B,CAAC,QAAQ,EAAE,YAAY,GAAG,IAAI,CAuDvE"}
+{"version":3,"file":"schema-meta-validation.d.ts","sourceRoot":"","sources":["../../src/validation/schema-meta-validation.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+BG;AAEH,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,wBAAwB,CAAC;AAG3D,MAAM,WAAW,mBAAmB;IAClC,sFAAsF;IACtF,KAAK,EAAE,MAAM,CAAC;IACd,+DAA+D;IAC/D,OAAO,EAAE,MAAM,CAAC;CACjB;AAED;;;;;GAKG;AACH,qBAAa,uBAAwB,SAAQ,KAAK;IAChD,QAAQ,CAAC,IAAI,EAAG,yBAAyB,CAAU;IACnD,QAAQ,CAAC,UAAU,EAAE,SAAS,mBAAmB,EAAE,CAAC;IACpD,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;gBAEV,UAAU,EAAE,SAAS,mBAAmB,EAAE;CAWvD;AAmCD;;;;;;;;;;;;GAYG;AACH,wBAAgB,yBAAyB,CACvC,QAAQ,EAAE,YAAY,GACrB,mBAAmB,EAAE,CAmDvB;AAED;;;;;GAKG;AACH,wBAAgB,0BAA0B,CAAC,QAAQ,EAAE,YAAY,GAAG,IAAI,CAKvE"}

package/dist/validation/schema-meta-validation.js

@@ -6,8 +6,8 @@
  *   2. `actionSpec[*].schema` (optional per entry)
  *   3. `streamSpec[*].schema`
  *   4. `contextSpec[*].schema`
- *   5. `agentCapabilities.tools[*].inputSchema` (optional per entry)
- *   6. `agentCapabilities.tools[*].outputSchema` (optional per entry)
+ *   5. `agentCapabilities.tools[*].toolInfo.inputSchema` (required per entry)
+ *   6. `agentCapabilities.tools[*].toolInfo.outputSchema` (optional per entry)
  *
  * For each present schema, runs `compileForValidation()` from
  * `ajv-runtime`. Ajv's `strict: true` mode throws on malformed JSON
@@ -34,7 +34,7 @@ import { compileForValidation } from './ajv-runtime.js';
 /**
  * Typed error for contract schema meta-validation failures. Mirrors
  * the shape of `CrossReferenceError` / `ContractViolationError` for
- * symmetry — push/handshake catch and surface a structured
+ * symmetry — render/handshake catch and surface a structured
  * `contract_schema_invalid` error to the agent.
  */
 export class ContractSchemaMetaError extends Error {
@@ -81,13 +81,19 @@ function truncate(s, max) {
     return s.length > max ? `${s.slice(0, max - 1)}…` : s;
 }
 /**
- * Walks the contract's six inner JSON Schema fields and asserts
- * each compiles cleanly under Ajv's strict mode. Throws
- * {@link ContractSchemaMetaError} on the first push attempt that
- * smuggles a malformed schema; collects every offender in one pass
- * before throwing so the agent sees the full list.
+ * Walks the contract's six inner JSON Schema fields and collects a
+ * {@link SchemaMetaViolation} for each that does not compile cleanly
+ * under Ajv's strict mode (unknown keyword, missing `items`, a
+ * non-schema `properties` value, or a missing `schema:` wrapper). Pure
+ * check — returns the full list so callers can either repair (the
+ * handshake repair loop) or throw (see {@link assertContractSchemasValid}).
+ *
+ * This is the inner-schema validity check folded into the unified
+ * `validateContract` gate (lint-contract.ts `phaseSchemaMeta`) — the
+ * one check the strict linter was previously missing relative to the
+ * render/handshake assert set.
  */
-export function assertContractSchemasValid(contract) {
+export function checkContractSchemasValid(contract) {
     const violations = [];
     if (contract.propsSpec?.properties) {
         for (const [name, entry] of Object.entries(contract.propsSpec.properties)) {
@@ -117,14 +123,22 @@ export function assertContractSchemasValid(contract) {
     }
     if (contract.agentCapabilities?.tools) {
         for (const [name, entry] of Object.entries(contract.agentCapabilities.tools)) {
-            if (entry.inputSchema) {
-                tryCompile(`agentCapabilities.tools.${name}.inputSchema`, entry.inputSchema, violations);
-            }
-            if (entry.outputSchema) {
-                tryCompile(`agentCapabilities.tools.${name}.outputSchema`, entry.outputSchema, violations);
+            tryCompile(`agentCapabilities.tools.${name}.inputSchema`, entry.toolInfo.inputSchema, violations);
+            if (entry.toolInfo.outputSchema) {
+                tryCompile(`agentCapabilities.tools.${name}.outputSchema`, entry.toolInfo.outputSchema, violations);
             }
         }
     }
+    return violations;
+}
+/**
+ * Throwable wrapper around {@link checkContractSchemasValid}. Throws
+ * {@link ContractSchemaMetaError} (collecting every malformed schema in
+ * one pass) when any inner JSON Schema fails Ajv strict-mode
+ * compilation. No-op when all schemas are well-formed.
+ */
+export function assertContractSchemasValid(contract) {
+    const violations = checkContractSchemasValid(contract);
     if (violations.length > 0) {
         throw new ContractSchemaMetaError(violations);
     }

package/dist/validation/schema-subset.d.ts

@@ -3,16 +3,17 @@
  * schema accepts also pass the `superset` schema?".
  *
  * **Why this lives in the protocol package.** The schema-alignment
- * contract is enforced at push-time + blueprint-registration; the
- * canonical failure is {@link ContractErrorCode}
- * `'SCHEMA_MISMATCH_ERROR'` — same envelope shape + channel as every
- * other named contract violation. See the schema-compat docstrings
+ * contract is enforced at render-time + blueprint-registration; the
+ * canonical failure is the named `'SCHEMA_MISMATCH_ERROR'` rejection
+ * the push / registration call answers with — fail-loud at
+ * declaration time, before a malformed payload reaches the agentic
+ * loop. See the schema-compat docstrings
  * on {@link ActionEntry.schema} and {@link StreamChannelEntry.schema}
  * for the author-invariant the check enforces.
  *
  * **Check points.**
  *
- *   - Pre-commit of a `Render` with `actionSpec` / `streamSpec`
+ *   - Pre-commit of a `GguiSession` with `actionSpec` / `streamSpec`
  *     entries that reference tools: each action's declared schema
  *     MUST be a subset of the tool's inputSchema (what the action
  *     payload is allowed to send ⊆ what the tool accepts). Each
@@ -71,13 +72,13 @@
  * **Determinism contract.** No randomness, no IO, no thrown
  * exceptions for normal violations. Every incompatibility is
  * reported as a {@link SubsetViolation} with enough field-path
- * context for the emitted `SCHEMA_MISMATCH_ERROR` to name the
+ * context for the `SCHEMA_MISMATCH_ERROR` rejection to name the
  * mismatch cleanly. Thrown errors are reserved for programmer-
  * bug conditions (a caller passes `null` where a JsonSchema is
  * expected).
  *
  * @see ./schema-compat-invariants.ts — the protocol-level invariants
- *      that call this algorithm at push-time.
+ *      that call this algorithm at render-time.
  */
 import type { JsonSchema, JsonValue } from '../types/data-contract.js';
 /**
@@ -132,7 +133,7 @@ export interface SubsetViolation {
      *  {@link SubsetViolation.superset}. */
     readonly subset?: string;
     /** Human-readable summary suitable for inclusion in a
-     *  `SCHEMA_MISMATCH_ERROR` envelope. Producers MAY ignore this
+     *  `SCHEMA_MISMATCH_ERROR` rejection. Producers MAY ignore this
      *  and render their own message from `path` + `reason` if they
      *  prefer a consistent localized format. */
     readonly message: string;

package/dist/validation/schema-subset.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"schema-subset.d.ts","sourceRoot":"","sources":["../../src/validation/schema-subset.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgFG;AACH,OAAO,KAAK,EAAE,UAAU,EAAE,SAAS,EAAE,MAAM,2BAA2B,CAAC;AAEvE;;;;;GAKG;AACH,MAAM,MAAM,qBAAqB,GAC7B,eAAe;AACjB;sDACsD;GACpD,gBAAgB;AAClB;;;;mDAImD;GACjD,iBAAiB;AACnB;sEACsE;GACpE,kBAAkB;AACpB,mCAAmC;GACjC,gBAAgB;AAClB,sEAAsE;GACpE,8BAA8B;AAChC;;mDAEmD;GACjD,aAAa,CAAC;AAElB;;;;GAIG;AACH,MAAM,WAAW,eAAe;IAC9B;;;;;;;OAOG;IACH,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,6BAA6B;IAC7B,QAAQ,CAAC,MAAM,EAAE,qBAAqB,CAAC;IACvC;;sDAEkD;IAClD,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAC3B;4CACwC;IACxC,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;IACzB;;;gDAG4C;IAC5C,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;CAC1B;AAED;;;;;GAKG;AACH,MAAM,WAAW,kBAAkB;IACjC,QAAQ,CAAC,UAAU,EAAE,OAAO,CAAC;IAC7B,QAAQ,CAAC,UAAU,EAAE,SAAS,eAAe,EAAE,CAAC;CACjD;AAED;;;;;;;;;;;;GAYG;AACH,wBAAgB,cAAc,CAC5B,QAAQ,EAAE,UAAU,EACpB,MAAM,EAAE,UAAU,GACjB,kBAAkB,CAiBpB;AAoTD,YAAY,EAAE,SAAS,EAAE,CAAC"}
+{"version":3,"file":"schema-subset.d.ts","sourceRoot":"","sources":["../../src/validation/schema-subset.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAiFG;AACH,OAAO,KAAK,EAAE,UAAU,EAAE,SAAS,EAAE,MAAM,2BAA2B,CAAC;AAEvE;;;;;GAKG;AACH,MAAM,MAAM,qBAAqB,GAC7B,eAAe;AACjB;sDACsD;GACpD,gBAAgB;AAClB;;;;mDAImD;GACjD,iBAAiB;AACnB;sEACsE;GACpE,kBAAkB;AACpB,mCAAmC;GACjC,gBAAgB;AAClB,sEAAsE;GACpE,8BAA8B;AAChC;;mDAEmD;GACjD,aAAa,CAAC;AAElB;;;;GAIG;AACH,MAAM,WAAW,eAAe;IAC9B;;;;;;;OAOG;IACH,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,6BAA6B;IAC7B,QAAQ,CAAC,MAAM,EAAE,qBAAqB,CAAC;IACvC;;sDAEkD;IAClD,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAC3B;4CACwC;IACxC,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;IACzB;;;gDAG4C;IAC5C,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;CAC1B;AAED;;;;;GAKG;AACH,MAAM,WAAW,kBAAkB;IACjC,QAAQ,CAAC,UAAU,EAAE,OAAO,CAAC;IAC7B,QAAQ,CAAC,UAAU,EAAE,SAAS,eAAe,EAAE,CAAC;CACjD;AAED;;;;;;;;;;;;GAYG;AACH,wBAAgB,cAAc,CAC5B,QAAQ,EAAE,UAAU,EACpB,MAAM,EAAE,UAAU,GACjB,kBAAkB,CAiBpB;AAoTD,YAAY,EAAE,SAAS,EAAE,CAAC"}

package/dist/validation/ui-security.d.ts

@@ -25,8 +25,6 @@ export interface DangerousPattern {
  * These are security-critical — changes here affect every validation consumer.
  */
 export declare const DANGEROUS_PATTERNS: DangerousPattern[];
-/** Import prefixes that indicate a fullstack UI (requires client bundle). */
-export declare const FULLSTACK_IMPORT_PREFIXES: readonly ["@ggui-ai/wire", "@ggui-ai/react", "@app/components"];
 /**
  * Classify a component as sandboxed or fullstack based on its imports.
  *
@@ -36,19 +34,4 @@ export declare const FULLSTACK_IMPORT_PREFIXES: readonly ["@ggui-ai/wire", "@ggu
  * Works on both source (.tsx) and compiled (.js) code.
  */
 export declare function classifyUi(code: string): UiClass;
-export interface SecurityCheckResult {
-    /** True if no dangerous patterns found. */
-    safe: boolean;
-    /** List of violations found. */
-    violations: Array<{
-        name: string;
-        suggestion: string;
-        line?: number;
-    }>;
-}
-/**
- * Check code for dangerous patterns.
- * Works on both source and compiled code.
- */
-export declare function checkSecurity(code: string): SecurityCheckResult;
 //# sourceMappingURL=ui-security.d.ts.map

package/dist/validation/ui-security.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"ui-security.d.ts","sourceRoot":"","sources":["../../src/validation/ui-security.ts"],"names":[],"mappings":"AAcA;;;;;;;;;;;;GAYG;AACH,MAAM,MAAM,OAAO,GAAG,WAAW,GAAG,WAAW,CAAC;AAMhD,MAAM,WAAW,gBAAgB;IAC/B,mDAAmD;IACnD,OAAO,EAAE,MAAM,CAAC;IAChB,0CAA0C;IAC1C,IAAI,EAAE,MAAM,CAAC;IACb,kDAAkD;IAClD,UAAU,EAAE,MAAM,CAAC;CACpB;AAED;;;GAGG;AACH,eAAO,MAAM,kBAAkB,EAAE,gBAAgB,EAiFhD,CAAC;AAIF,6EAA6E;AAC7E,eAAO,MAAM,yBAAyB,iEAI5B,CAAC;AAEX;;;;;;;GAOG;AACH,wBAAgB,UAAU,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAUhD;AAUD,MAAM,WAAW,mBAAmB;IAClC,2CAA2C;IAC3C,IAAI,EAAE,OAAO,CAAC;IACd,gCAAgC;IAChC,UAAU,EAAE,KAAK,CAAC;QAChB,IAAI,EAAE,MAAM,CAAC;QACb,UAAU,EAAE,MAAM,CAAC;QACnB,IAAI,CAAC,EAAE,MAAM,CAAC;KACf,CAAC,CAAC;CACJ;AAED;;;GAGG;AACH,wBAAgB,aAAa,CAAC,IAAI,EAAE,MAAM,GAAG,mBAAmB,CAc/D"}
+{"version":3,"file":"ui-security.d.ts","sourceRoot":"","sources":["../../src/validation/ui-security.ts"],"names":[],"mappings":"AAkBA;;;;;;;;;;;;GAYG;AACH,MAAM,MAAM,OAAO,GAAG,WAAW,GAAG,WAAW,CAAC;AAMhD,MAAM,WAAW,gBAAgB;IAC/B,mDAAmD;IACnD,OAAO,EAAE,MAAM,CAAC;IAChB,0CAA0C;IAC1C,IAAI,EAAE,MAAM,CAAC;IACb,kDAAkD;IAClD,UAAU,EAAE,MAAM,CAAC;CACpB;AAED;;;GAGG;AACH,eAAO,MAAM,kBAAkB,EAAE,gBAAgB,EAiFhD,CAAC;AAcF;;;;;;;GAOG;AACH,wBAAgB,UAAU,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAUhD"}

package/dist/validation/ui-security.js

@@ -2,9 +2,13 @@
 //
 // Shared UI security validation — single source of truth for dangerous
 // patterns and UI classification. Used by:
-//   - core/src/tools/validation.ts (generator pipeline)
-//   - core/src/validation/ui-compiler.ts (CLI compiler)
-//   - cloud/amplify/functions/rest-api/cli-api/ui-register-handler.ts (register endpoint)
+//   - @ggui-ai/ui-gen src/validation/component-detailed.ts
+//     (validateComponentDetailed — the generator/compiler validation
+//     pipeline, consumes DANGEROUS_PATTERNS)
+//   - @ggui-ai/ui-gen src/validation/ui-compiler.ts (standalone
+//     compileUi/validateUi — consumes classifyUi + UiClass)
+//   - @ggui-ai/project-config src/ui-manifest.ts (UiManifest schema —
+//     validates against the UiClass vocabulary owned here)
 //
 // This module is PUBLIC (@ggui-ai/protocol) — keep it dependency-free.
 /**
@@ -94,8 +98,11 @@ export const DANGEROUS_PATTERNS = [
     },
 ];
 // ── UI Classification ───────────────────────────────────────────────
-/** Import prefixes that indicate a fullstack UI (requires client bundle). */
-export const FULLSTACK_IMPORT_PREFIXES = [
+/**
+ * Import prefixes that indicate a fullstack UI (requires client bundle).
+ * Internal input of {@link classifyUi} — not part of the published API.
+ */
+const FULLSTACK_IMPORT_PREFIXES = [
     '@ggui-ai/wire',
     '@ggui-ai/react',
     '@app/components',
@@ -119,20 +126,8 @@ export function classifyUi(code) {
     }
     return 'sandboxed';
 }
-/**
- * Check code for dangerous patterns.
- * Works on both source and compiled code.
- */
-export function checkSecurity(code) {
-    const violations = [];
-    for (const { pattern, name, suggestion } of DANGEROUS_PATTERNS) {
-        // Reset lastIndex for global regexes
-        const re = new RegExp(pattern.source, pattern.flags);
-        const match = re.exec(code);
-        if (match) {
-            const line = code.substring(0, match.index).split('\n').length;
-            violations.push({ name, suggestion, line });
-        }
-    }
-    return { safe: violations.length === 0, violations };
-}
+// ── Content Hash ────────────────────────────────────────────────────
+//
+// Moved to `./content-hash` because it depends on `node:crypto`. Server-
+// only callers import it via `@ggui-ai/protocol/content-hash` — see that
+// file's header for rationale.

package/dist/validation/zod-to-json-schema.d.ts

@@ -33,7 +33,7 @@
  *
  * **Intended call sites.**
  *
- *   - Push-time + blueprint-registration schema-compat checks in
+ *   - render-time + blueprint-registration schema-compat checks in
  *     `@ggui-ai/mcp-server`: a mount-registered tool handler exposes
  *     its `inputSchema` as a {@link ZodRawShape}; wrapping it in
  *     `z.object(shape)` and converting gives the JsonSchema that

package/dist/validation/zod-to-json-schema.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"zod-to-json-schema.d.ts","sourceRoot":"","sources":["../../src/validation/zod-to-json-schema.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4CG;AACH,OAAO,EAAK,KAAK,WAAW,EAAE,KAAK,OAAO,EAAE,MAAM,KAAK,CAAC;AACxD,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,2BAA2B,CAAC;AAE5D;;;;;;;;;;;;;GAaG;AACH,wBAAgB,eAAe,CAAC,KAAK,EAAE,OAAO,GAAG,WAAW,GAAG,UAAU,CAQxE"}
+{"version":3,"file":"zod-to-json-schema.d.ts","sourceRoot":"","sources":["../../src/validation/zod-to-json-schema.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4CG;AACH,OAAO,EAAK,KAAK,WAAW,EAAE,KAAK,OAAO,EAAE,MAAM,KAAK,CAAC;AACxD,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,2BAA2B,CAAC;AAG5D;;;;;;;;;;;;;GAaG;AACH,wBAAgB,eAAe,CAAC,KAAK,EAAE,OAAO,GAAG,WAAW,GAAG,UAAU,CAQxE"}

package/dist/validation/zod-to-json-schema.js

@@ -33,7 +33,7 @@
  *
  * **Intended call sites.**
  *
- *   - Push-time + blueprint-registration schema-compat checks in
+ *   - render-time + blueprint-registration schema-compat checks in
  *     `@ggui-ai/mcp-server`: a mount-registered tool handler exposes
  *     its `inputSchema` as a {@link ZodRawShape}; wrapping it in
  *     `z.object(shape)` and converting gives the JsonSchema that
@@ -44,6 +44,7 @@
  * @see ./schema-subset.ts
  */
 import { z } from 'zod';
+import { isRecord } from './is-record.js';
 /**
  * Convert a zod schema (or raw shape) to a {@link JsonSchema} suitable
  * for the subset algorithm.
@@ -78,13 +79,13 @@ export function zodToJsonSchema(input) {
 function normalize(value) {
     if (Array.isArray(value))
         return value.map(normalize);
-    if (value === null || typeof value !== 'object')
+    if (!isRecord(value))
         return value;
     const out = {};
     for (const [key, v] of Object.entries(value)) {
         if (key === '$schema')
             continue;
-        if (key === 'properties' && v !== null && typeof v === 'object') {
+        if (key === 'properties' && isRecord(v)) {
             const props = {};
             for (const [pkey, pval] of Object.entries(v)) {
                 props[pkey] = normalize(pval);