@ggui-ai/protocol 0.2.0-alpha.4 → 0.3.0-rc.0

package/dist/types/{session.d.ts → render.d.ts}

@@ -3,14 +3,15 @@ import type { KNOWN_PERMISSION_NAMES } from '../validation/hygiene-rules';
 import type { PropsSpec, StreamSpec, ActionSpec, ContextSpec, ClientCapabilitiesSpec, GadgetDescriptor, JsonSchema, JsonObject } from './data-contract';
 import type { EndUserIdentity } from './auth';
 import type { HostContextProjection } from './host-context';
-import type { McpAppsRender } from '../integrations/mcp-apps';
+import type { AppTheme } from '../schemas/app-theme';
+import type { McpAppsGguiSession } from '../integrations/mcp-apps';
 /**
  * Recognised system-card kinds the runtime renders via built-in
  * components. The wire is open-ended (string), but new kinds without a
  * matching renderer fall through to a generic "system message" card so
  * an old runtime + new server still produce something visible.
  */
-export type SystemRenderKind = 'no-credentials' | 'mcp-apps-probe' | (string & {});
+export type SystemGguiSessionKind = 'no-credentials' | 'mcp-apps-probe' | (string & {});
 /**
  * Adapter permission status
  */
@@ -27,7 +28,7 @@ export type AdapterPermissions = {
     readonly [K in (typeof KNOWN_PERMISSION_NAMES)[number]]?: PermissionStatus;
 };
 /**
- * Lifecycle status of a {@link Render}. RenderStore implementations MAY
+ * Lifecycle status of a {@link GguiSession}. GguiSessionStore implementations MAY
  * populate this on `get`; absent ⇒ caller treats as `'active'`.
  *
  * Two states only:
@@ -35,29 +36,29 @@ export type AdapterPermissions = {
  *   - `'expired'` — TTL elapsed; no further writes accepted, reads return
  *     a historical snapshot.
  *
- * There is no explicit terminal state. Renders decay implicitly via TTL.
+ * There is no explicit terminal state. GguiSessions decay implicitly via TTL.
  * The dropped `'completed'` state was a vestige of the deleted Session
  * vessel — kept symmetrical with `ggui_new_session`, which was deleted
  * in the earlier handshake collapse. The companion `ggui_close` tool
  * that wrote it was removed in the same slice.
  */
-export type RenderStatus = 'active' | 'expired';
+export type GguiSessionStatus = 'active' | 'expired';
 /**
- * Common base for every {@link Render} variant. Carries identity,
+ * Common base for every {@link GguiSession} variant. Carries identity,
  * tenancy, lifecycle, and conversation-scoped context that every
  * rendered thing has regardless of how its visible bits are
  * produced (LLM-generated component, server-emitted system card,
  * embedded MCP-App iframe).
  *
  * **Conversation-scoped context note** — fields that convey "this
- * render belongs to a logical group of renders within a host
- * conversation" (hostContext continuity, sibling render discovery)
- * are NOT duplicated onto each Render. They look up via the optional
- * {@link RenderBase.hostSession} pair instead. See
+ * GguiSession belongs to a logical group of GguiSessions within a host
+ * conversation" (hostContext continuity, sibling-GguiSession discovery)
+ * are NOT duplicated onto each GguiSession. They look up via the optional
+ * {@link GguiSessionBase.hostSession} pair instead. See
  * [[session-concept-deletion-2026-05-27]] for the framing.
  */
-export interface RenderBase {
-    /** Render identity. The value an iframe's bootstrap meta and every
+export interface GguiSessionBase {
+    /** GguiSession identity. The value an iframe's bootstrap meta and every
      *  wire reference (props_update, consume, update) keys by. */
     readonly id: string;
     /** App identity (tenancy boundary, always per-render). */
@@ -74,13 +75,13 @@ export interface RenderBase {
      * host's opaque grouping key for "this conversation" — typically
      * the host's thread/chat id.
      *
-     * Multiple renders inside one host conversation share the same
-     * `hostSessionId`. The `ggui_list_renders(hostName, hostSessionId)`
-     * tool enumerates renders belonging to a host conversation; absent
-     * `hostSession` ⇒ the render is one-shot (functional but
+     * Multiple GguiSessions inside one host conversation share the same
+     * `hostSessionId`. The `ggui_list_sessions(hostName, hostSessionId)`
+     * tool enumerates GguiSessions belonging to a host conversation; absent
+     * `hostSession` ⇒ the GguiSession is one-shot (functional but
      * non-rehydratable).
      *
-     * Once captured, immutable for the render's lifetime.
+     * Once captured, immutable for the GguiSession's lifetime.
      */
     readonly hostSession?: {
         readonly hostName: string;
@@ -88,7 +89,7 @@ export interface RenderBase {
     };
     /**
      * Theme preset id for this render. Resolution chain:
-     *   1. `Render.themeId` — agent-explicit per-render override
+     *   1. `GguiSession.themeId` — agent-explicit per-render override
      *   2. `App.defaultThemeId` — server-side per-app default
      *   3. server fallback (process default)
      * First non-undefined wins at bootstrap-meta projection.
@@ -111,13 +112,13 @@ export interface RenderBase {
     /**
      * Per-render Web Permissions API status map. Populated as the user
      * grants / denies adapter requests (geolocation, camera, etc.) over
-     * the render's lifetime.
+     * the GguiSession's lifetime.
      */
     readonly adapterPermissions?: AdapterPermissions;
     /** Resolved lifecycle status. Absent ⇒ caller treats as `'active'`. */
-    readonly status?: RenderStatus;
-    /** Monotonic event ledger sequence (per-render — each Render has its
-     *  own RenderEvent ledger). */
+    readonly status?: GguiSessionStatus;
+    /** Monotonic event ledger sequence (per-render — each GguiSession has its
+     *  own GguiSessionEvent ledger). */
     readonly eventSequence: number;
     /** Creation timestamp (epoch ms). */
     readonly createdAt: number;
@@ -127,18 +128,18 @@ export interface RenderBase {
     readonly expiresAt: number;
 }
 /**
- * `Render` — the canonical protocol shape for a single rendered UI.
+ * `GguiSession` — the canonical protocol shape for a single rendered UI.
  *
- * Three variants share {@link RenderBase} (identity, tenancy,
+ * Three variants share {@link GguiSessionBase} (identity, tenancy,
  * lifecycle); each variant adds its own visible-bits surface:
  *
- *   - {@link ComponentRender} — LLM-generated / native React component.
+ *   - {@link ComponentGguiSession} — LLM-generated / native React component.
  *     Carries `componentCode`, `propsSpec`, `actionSpec`, `streamSpec`,
  *     `contextSpec`, `gadgetDescriptors`, etc.
- *   - {@link SystemRender} — server-emitted system card. Carries an
+ *   - {@link SystemGguiSession} — server-emitted system card. Carries an
  *     opaque `kind` + structured `props`; the runtime maps the kind to
  *     a built-in `.tsx` renderer.
- *   - {@link McpAppsRender} — embedded third-party MCP-App iframe.
+ *   - {@link McpAppsGguiSession} — embedded third-party MCP-App iframe.
  *     Carries `resourceUri` + MCP server config. (Lives in
  *     `@ggui-ai/protocol/integrations/mcp-apps` to keep core typing
  *     MCP-Apps-opt-in.)
@@ -146,22 +147,22 @@ export interface RenderBase {
  * Narrowing pattern:
  * ```ts
  * if (render.type === 'mcpApps') {
- *   // McpAppsRender — render via host-role adapter
+ *   // McpAppsGguiSession — render via host-role adapter
  * } else if (render.type === 'system') {
- *   // SystemRender — render via built-in card registry
+ *   // SystemGguiSession — render via built-in card registry
  * } else {
- *   // ComponentRender — render via DynamicComponent
+ *   // ComponentGguiSession — render via DynamicComponent
  * }
  * ```
  */
-export type Render<TProps = JsonObject> = ComponentRender<TProps> | SystemRender | McpAppsRender;
+export type GguiSession<TProps = JsonObject> = ComponentGguiSession<TProps> | SystemGguiSession | McpAppsGguiSession;
 /**
- * Render variant: LLM-generated / native React component.
+ * GguiSession variant: LLM-generated / native React component.
  *
  * Discriminator: `type === 'component'` OR `type` absent (back-compat
  * default — every producer that omits `type` is producing this variant).
  */
-export interface ComponentRender<TProps = JsonObject> extends RenderBase {
+export interface ComponentGguiSession<TProps = JsonObject> extends GguiSessionBase {
     /** Variant discriminator. Optional; absent ⇒ `'component'`. */
     readonly type?: 'component';
     /** Blueprint component code (pure UI). */
@@ -208,7 +209,7 @@ export interface ComponentRender<TProps = JsonObject> extends RenderBase {
      * preserved verbatim from the agent's render payload — no enrichment
      * overlay, no `version` (resolves from `App.gadgets`). Resolution
      * metadata lives on the parallel
-     * {@link ComponentRender.gadgetDescriptors} sidecar.
+     * {@link ComponentGguiSession.gadgetDescriptors} sidecar.
      */
     readonly clientCapabilities?: ClientCapabilitiesSpec;
     /**
@@ -218,6 +219,18 @@ export interface ComponentRender<TProps = JsonObject> extends RenderBase {
      * + CSP + bundle-loader derivation read from this array.
      */
     readonly gadgetDescriptors?: readonly GadgetDescriptor[];
+    /**
+     * Theme sidecar — the resolved per-app theme overlay (mode +
+     * `--ggui-*` CSS-variable map) snapshotted from `App.theme` at
+     * render-commit time. Sibling to {@link ComponentGguiSession.gadgetDescriptors}:
+     * a render-time snapshot the slice-meta derivation reads without
+     * re-resolving against the App record. The bootstrap projection
+     * (`deriveRenderMeta`) surfaces it on the
+     * `_meta["ai.ggui/render"].theme` slice so the iframe applies the
+     * operator-curated overlay at boot. Absent ⇒ the renderer's default
+     * theme.
+     */
+    readonly theme?: AppTheme;
     /**
      * Last-known snapshot of the contextSpec slot values, mirrored from
      * the runtime's `ui/update-model-context` posts via
@@ -235,7 +248,7 @@ export interface ComponentRender<TProps = JsonObject> extends RenderBase {
     readonly contextSnapshot?: JsonObject;
 }
 /**
- * Render variant: server-emitted system card.
+ * GguiSession variant: server-emitted system card.
  *
  * Used when the SERVER (not an LLM, not an MCP host) needs to render
  * a UI card the operator can act on: "set up your LLM key", "rate
@@ -244,7 +257,7 @@ export interface ComponentRender<TProps = JsonObject> extends RenderBase {
  * Wire shape is intentionally tiny — server emits identifier + data,
  * not code. The runtime maps `kind` to a built-in `.tsx` component.
  */
-export interface SystemRender<TProps extends JsonObject = JsonObject> extends RenderBase {
+export interface SystemGguiSession<TProps extends JsonObject = JsonObject> extends GguiSessionBase {
     readonly type: 'system';
     /**
      * Identifier the runtime maps to a built-in renderer. Stable strings
@@ -252,7 +265,7 @@ export interface SystemRender<TProps extends JsonObject = JsonObject> extends Re
      * never breaks an older runtime; it just falls through to a generic
      * card carrying the props as raw JSON.
      */
-    readonly kind: SystemRenderKind;
+    readonly kind: SystemGguiSessionKind;
     /** Props forwarded to the built-in renderer. */
     readonly props?: TProps;
     /** Optional descriptive text the server can attach (telemetry, logs). */
@@ -275,19 +288,4 @@ export interface ConversationTurn<TToolArgs = JsonObject> {
     }[];
     timestamp: string;
 }
-/**
- * Progress update emitted by a producer during component production.
- * Delivered via the `ggui:logs` bridge event.
- *
- * Post-Phase-B: collapsed from `{ sessionId, stackItemId }` to a single
- * `renderId` (the two identifiers were the same value once each render
- * was its own thing).
- */
-export interface ProgressUpdate {
-    renderId: string;
-    step: 'queued' | 'negotiating' | 'matching' | 'generating' | 'compiling' | 'evaluating' | 'complete' | 'error';
-    label: string;
-    percent: number;
-    message?: string;
-}
-//# sourceMappingURL=session.d.ts.map
+//# sourceMappingURL=render.d.ts.map

package/dist/types/render.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"render.d.ts","sourceRoot":"","sources":["../../src/types/render.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,qBAAqB,EAAE,eAAe,EAAE,MAAM,gBAAgB,CAAC;AAC7E,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,6BAA6B,CAAC;AAC1E,OAAO,KAAK,EACV,SAAS,EACT,UAAU,EACV,UAAU,EACV,WAAW,EACX,sBAAsB,EACtB,gBAAgB,EAChB,UAAU,EACV,UAAU,EACX,MAAM,iBAAiB,CAAC;AACzB,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,QAAQ,CAAC;AAC9C,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,gBAAgB,CAAC;AAC5D,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,sBAAsB,CAAC;AAKrD,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,0BAA0B,CAAC;AA6BnE;;;;;GAKG;AACH,MAAM,MAAM,qBAAqB,GAC7B,gBAAgB,GAChB,gBAAgB,GAEhB,CAAC,MAAM,GAAG,EAAE,CAAC,CAAC;AAElB;;GAEG;AACH,MAAM,MAAM,gBAAgB,GAAG,SAAS,GAAG,QAAQ,GAAG,QAAQ,CAAC;AAE/D;;;;;;;GAOG;AACH,MAAM,MAAM,kBAAkB,GAAG;IAC/B,QAAQ,EAAE,CAAC,IAAI,CAAC,OAAO,sBAAsB,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,gBAAgB;CAC3E,CAAC;AAMF;;;;;;;;;;;;;;GAcG;AACH,MAAM,MAAM,iBAAiB,GAAG,QAAQ,GAAG,SAAS,CAAC;AAErD;;;;;;;;;;;;;GAaG;AACH,MAAM,WAAW,eAAe;IAC9B;kEAC8D;IAC9D,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;IACpB,0DAA0D;IAC1D,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB;iBACa;IACb,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;IACzB,wEAAwE;IACxE,QAAQ,CAAC,eAAe,CAAC,EAAE,eAAe,CAAC;IAC3C;;;;;;;;;;;;;;OAcG;IACH,QAAQ,CAAC,WAAW,CAAC,EAAE;QACrB,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;QAC1B,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;KAChC,CAAC;IACF;;;;;;OAMG;IACH,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC;IAC1B;;;;;;;;;;;;OAYG;IACH,QAAQ,CAAC,WAAW,CAAC,EAAE,qBAAqB,CAAC;IAC7C;;;;OAIG;IACH,QAAQ,CAAC,kBAAkB,CAAC,EAAE,kBAAkB,CAAC;IACjD,uEAAuE;IACvE,QAAQ,CAAC,MAAM,CAAC,EAAE,iBAAiB,CAAC;IACpC;wCACoC;IACpC,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;IAC/B,qCAAqC;IACrC,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,0CAA0C;IAC1C,QAAQ,CAAC,cAAc,EAAE,MAAM,CAAC;IAChC,mCAAmC;IACnC,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;CAC5B;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AACH,MAAM,MAAM,WAAW,CAAC,MAAM,GAAG,UAAU,IACvC,oBAAoB,CAAC,MAAM,CAAC,GAC5B,iBAAiB,GACjB,kBAAkB,CAAC;AAEvB;;;;;GAKG;AACH,MAAM,WAAW,oBAAoB,CAAC,MAAM,GAAG,UAAU,CAAE,SAAQ,eAAe;IAChF,+DAA+D;IAC/D,QAAQ,CAAC,IAAI,CAAC,EAAE,WAAW,CAAC;IAC5B,0CAA0C;IAC1C,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;IAC/B;qFACiF;IACjF,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC;IACxB,oEAAoE;IACpE,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;IACzB,4DAA4D;IAC5D,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAC;IAC9B;qDACiD;IACjD,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAC;IAC9B;gCAC4B;IAC5B,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC;IAC1B,2DAA2D;IAC3D,QAAQ,CAAC,MAAM,CAAC,EAAE,UAAU,CAAC;IAC7B,wDAAwD;IACxD,QAAQ,CAAC,YAAY,CAAC,EAAE,qBAAqB,CAAC;IAC9C,mCAAmC;IACnC,QAAQ,CAAC,OAAO,CAAC,EAAE,eAAe,CAAC;IACnC,uDAAuD;IACvD,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC;IACxB;qCACiC;IACjC,QAAQ,CAAC,UAAU,CAAC,EAAE,UAAU,CAAC;IACjC;+BAC2B;IAC3B,QAAQ,CAAC,SAAS,CAAC,EAAE,SAAS,CAAC;IAC/B;+BAC2B;IAC3B,QAAQ,CAAC,UAAU,CAAC,EAAE,UAAU,CAAC;IACjC;mDAC+C;IAC/C,QAAQ,CAAC,WAAW,CAAC,EAAE,WAAW,CAAC;IACnC;;;;;;;;;;OAUG;IACH,QAAQ,CAAC,kBAAkB,CAAC,EAAE,sBAAsB,CAAC;IACrD;;;;;OAKG;IACH,QAAQ,CAAC,iBAAiB,CAAC,EAAE,SAAS,gBAAgB,EAAE,CAAC;IACzD;;;;;;;;;;OAUG;IACH,QAAQ,CAAC,KAAK,CAAC,EAAE,QAAQ,CAAC;IAC1B;;;;;;;;;;;;;OAaG;IACH,QAAQ,CAAC,eAAe,CAAC,EAAE,UAAU,CAAC;CACvC;AAED;;;;;;;;;GASG;AACH,MAAM,WAAW,iBAAiB,CAAC,MAAM,SAAS,UAAU,GAAG,UAAU,CACvE,SAAQ,eAAe;IACvB,QAAQ,CAAC,IAAI,EAAE,QAAQ,CAAC;IACxB;;;;;OAKG;IACH,QAAQ,CAAC,IAAI,EAAE,qBAAqB,CAAC;IACrC,gDAAgD;IAChD,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC;IACxB,yEAAyE;IACzE,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAC;CAC/B;AAMD;;;;;;;GAOG;AACH,MAAM,WAAW,gBAAgB,CAAC,SAAS,GAAG,UAAU;IACtD,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC;IACvB,OAAO,EAAE,MAAM,CAAC;IAChB,SAAS,CAAC,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,SAAS,CAAA;KAAE,EAAE,CAAC;IAChD,SAAS,EAAE,MAAM,CAAC;CACnB"}

package/dist/types/thread.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"thread.d.ts","sourceRoot":"","sources":["../../src/types/thread.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AAEH;;;;;;;;;;;;;GAaG;AACH,MAAM,MAAM,aAAa,GAAG,MAAM,CAAC;AAEnC,gEAAgE;AAChE,MAAM,MAAM,mBAAmB,GAAG,MAAM,GAAG,OAAO,GAAG,QAAQ,CAAC;AAE9D,iEAAiE;AACjE,MAAM,MAAM,iBAAiB,GAAG,MAAM,GAAG,MAAM,GAAG,OAAO,CAAC;AAE1D,+BAA+B;AAC/B,MAAM,MAAM,YAAY,GAAG,QAAQ,GAAG,UAAU,GAAG,gBAAgB,CAAC;AAEpE;;;;;;;;GAQG;AACH,eAAO,MAAM,oBAAoB,+GAUvB,CAAC;AACX,MAAM,MAAM,iBAAiB,GAAG,CAAC,OAAO,oBAAoB,CAAC,CAAC,MAAM,CAAC,CAAC;AAEtE,wBAAgB,mBAAmB,CAAC,KAAK,EAAE,OAAO,GAAG,KAAK,IAAI,iBAAiB,CAK9E;AAED;;;;;;GAMG;AACH,MAAM,WAAW,MAAM;IACrB,EAAE,EAAE,MAAM,CAAC;IACX,kCAAkC;IAClC,KAAK,EAAE,MAAM,CAAC;IACd,yDAAyD;IACzD,OAAO,EAAE,aAAa,CAAC;IACvB;;;uDAGmD;IACnD,KAAK,CAAC,EAAE,MAAM,CAAC;IACf;0CACsC;IACtC,OAAO,EAAE,MAAM,CAAC;IAChB;gCAC4B;IAC5B,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB;kDAC8C;IAC9C,WAAW,EAAE,MAAM,CAAC;IACpB,MAAM,EAAE,OAAO,CAAC;IAChB,KAAK,EAAE,OAAO,CAAC;IACf,MAAM,EAAE,YAAY,CAAC;IACrB,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,EAAE,MAAM,CAAC;IAClB;;+CAE2C;IAC3C,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CACpC;AAED;;;;;;;;;GASG;AACH,MAAM,WAAW,aAAa;IAC5B,QAAQ,EAAE,MAAM,CAAC;IACjB,qDAAqD;IACrD,GAAG,EAAE,MAAM,CAAC;IACZ,8CAA8C;IAC9C,GAAG,EAAE,MAAM,CAAC;IACZ,uCAAuC;IACvC,EAAE,EAAE,MAAM,CAAC;IACX,UAAU,EAAE,mBAAmB,CAAC;IAChC,IAAI,EAAE,iBAAiB,CAAC;IACxB;;;;;kBAKc;IACd,MAAM,EAAE,OAAO,EAAE,CAAC;IAClB,gEAAgE;IAChE,YAAY,CAAC,EAAE,OAAO,CAAC;IACvB,qEAAqE;IACrE,WAAW,EAAE,MAAM,CAAC;IACpB,iEAAiE;IACjE,SAAS,CAAC,EAAE,OAAO,CAAC;CACrB;AAID;;GAEG;AACH,MAAM,WAAW,iBAAiB;IAChC,KAAK,EAAE,MAAM,CAAC;IACd;;;mDAG+C;IAC/C,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CACpC;AAED;;GAEG;AACH,MAAM,WAAW,wBAAwB;IACvC,QAAQ,EAAE,MAAM,CAAC;IACjB,GAAG,EAAE,MAAM,CAAC;IACZ,UAAU,EAAE,mBAAmB,CAAC;IAChC,IAAI,EAAE,iBAAiB,CAAC;IACxB,MAAM,EAAE,OAAO,EAAE,CAAC;IAClB,YAAY,CAAC,EAAE,OAAO,CAAC;IACvB;;oDAEgD;IAChD,WAAW,EAAE,MAAM,CAAC;IACpB,SAAS,CAAC,EAAE,OAAO,CAAC;CACrB;AAED;;GAEG;AACH,MAAM,WAAW,mBAAmB;IAClC,0CAA0C;IAC1C,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB;4DACwD;IACxD,KAAK,CAAC,EAAE,MAAM,CAAC;IACf;gEAC4D;IAC5D,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAED,MAAM,WAAW,kBAAkB;IACjC,QAAQ,EAAE,aAAa,EAAE,CAAC;IAC1B,2DAA2D;IAC3D,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB;AAED;;GAEG;AACH,MAAM,WAAW,iBAAiB;IAChC,iDAAiD;IACjD,MAAM,CAAC,EAAE,YAAY,CAAC;IACtB,0CAA0C;IAC1C,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,0CAA0C;IAC1C,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAED,MAAM,WAAW,iBAAiB;IAChC,OAAO,EAAE,MAAM,EAAE,CAAC;IAClB,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB;AAED;;;;;;GAMG;AACH,MAAM,WAAW,iBAAiB;IAChC,iEAAiE;IACjE,IAAI,EAAE,gBAAgB,CAAC;IACvB,OAAO,EAAE,aAAa,CAAC;CACxB;AAED,wBAAgB,mBAAmB,CAAC,KAAK,EAAE,OAAO,GAAG,KAAK,IAAI,iBAAiB,CAI9E"}
+{"version":3,"file":"thread.d.ts","sourceRoot":"","sources":["../../src/types/thread.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AAIH;;;;;;;;;;;;;GAaG;AACH,MAAM,MAAM,aAAa,GAAG,MAAM,CAAC;AAEnC,gEAAgE;AAChE,MAAM,MAAM,mBAAmB,GAAG,MAAM,GAAG,OAAO,GAAG,QAAQ,CAAC;AAE9D,iEAAiE;AACjE,MAAM,MAAM,iBAAiB,GAAG,MAAM,GAAG,MAAM,GAAG,OAAO,CAAC;AAE1D,+BAA+B;AAC/B,MAAM,MAAM,YAAY,GAAG,QAAQ,GAAG,UAAU,GAAG,gBAAgB,CAAC;AAEpE;;;;;;;;GAQG;AACH,eAAO,MAAM,oBAAoB,+GAUvB,CAAC;AACX,MAAM,MAAM,iBAAiB,GAAG,CAAC,OAAO,oBAAoB,CAAC,CAAC,MAAM,CAAC,CAAC;AAEtE,wBAAgB,mBAAmB,CAAC,KAAK,EAAE,OAAO,GAAG,KAAK,IAAI,iBAAiB,CAK9E;AAED;;;;;;GAMG;AACH,MAAM,WAAW,MAAM;IACrB,EAAE,EAAE,MAAM,CAAC;IACX,kCAAkC;IAClC,KAAK,EAAE,MAAM,CAAC;IACd,yDAAyD;IACzD,OAAO,EAAE,aAAa,CAAC;IACvB;;;uDAGmD;IACnD,KAAK,CAAC,EAAE,MAAM,CAAC;IACf;0CACsC;IACtC,OAAO,EAAE,MAAM,CAAC;IAChB;gCAC4B;IAC5B,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB;kDAC8C;IAC9C,WAAW,EAAE,MAAM,CAAC;IACpB,MAAM,EAAE,OAAO,CAAC;IAChB,KAAK,EAAE,OAAO,CAAC;IACf,MAAM,EAAE,YAAY,CAAC;IACrB,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,EAAE,MAAM,CAAC;IAClB;;+CAE2C;IAC3C,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CACpC;AAED;;;;;;;;;GASG;AACH,MAAM,WAAW,aAAa;IAC5B,QAAQ,EAAE,MAAM,CAAC;IACjB,qDAAqD;IACrD,GAAG,EAAE,MAAM,CAAC;IACZ,8CAA8C;IAC9C,GAAG,EAAE,MAAM,CAAC;IACZ,uCAAuC;IACvC,EAAE,EAAE,MAAM,CAAC;IACX,UAAU,EAAE,mBAAmB,CAAC;IAChC,IAAI,EAAE,iBAAiB,CAAC;IACxB;;;;;kBAKc;IACd,MAAM,EAAE,OAAO,EAAE,CAAC;IAClB,gEAAgE;IAChE,YAAY,CAAC,EAAE,OAAO,CAAC;IACvB,qEAAqE;IACrE,WAAW,EAAE,MAAM,CAAC;IACpB,iEAAiE;IACjE,SAAS,CAAC,EAAE,OAAO,CAAC;CACrB;AAID;;GAEG;AACH,MAAM,WAAW,iBAAiB;IAChC,KAAK,EAAE,MAAM,CAAC;IACd;;;mDAG+C;IAC/C,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CACpC;AAED;;GAEG;AACH,MAAM,WAAW,wBAAwB;IACvC,QAAQ,EAAE,MAAM,CAAC;IACjB,GAAG,EAAE,MAAM,CAAC;IACZ,UAAU,EAAE,mBAAmB,CAAC;IAChC,IAAI,EAAE,iBAAiB,CAAC;IACxB,MAAM,EAAE,OAAO,EAAE,CAAC;IAClB,YAAY,CAAC,EAAE,OAAO,CAAC;IACvB;;oDAEgD;IAChD,WAAW,EAAE,MAAM,CAAC;IACpB,SAAS,CAAC,EAAE,OAAO,CAAC;CACrB;AAED;;GAEG;AACH,MAAM,WAAW,mBAAmB;IAClC,0CAA0C;IAC1C,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB;4DACwD;IACxD,KAAK,CAAC,EAAE,MAAM,CAAC;IACf;gEAC4D;IAC5D,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAED,MAAM,WAAW,kBAAkB;IACjC,QAAQ,EAAE,aAAa,EAAE,CAAC;IAC1B,2DAA2D;IAC3D,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB;AAED;;GAEG;AACH,MAAM,WAAW,iBAAiB;IAChC,iDAAiD;IACjD,MAAM,CAAC,EAAE,YAAY,CAAC;IACtB,0CAA0C;IAC1C,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,0CAA0C;IAC1C,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAED,MAAM,WAAW,iBAAiB;IAChC,OAAO,EAAE,MAAM,EAAE,CAAC;IAClB,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB;AAED;;;;;;GAMG;AACH,MAAM,WAAW,iBAAiB;IAChC,iEAAiE;IACjE,IAAI,EAAE,gBAAgB,CAAC;IACvB,OAAO,EAAE,aAAa,CAAC;CACxB;AAED,wBAAgB,mBAAmB,CAAC,KAAK,EAAE,OAAO,GAAG,KAAK,IAAI,iBAAiB,CAG9E"}

package/dist/types/thread.js

@@ -25,6 +25,7 @@
  * **Additions are additive forever** (consumer adapters dedupe on
  * fields they know). Breaking changes require a protocol version bump.
  */
+import { isRecord } from '../validation/is-record.js';
 /**
  * The 9-action state machine that mutates per-thread UI state. Identical
  * vocabulary to `packages/chat-managed-amplify/src/createAdapter.ts#
@@ -50,8 +51,7 @@ export function isThreadStateAction(value) {
         THREAD_STATE_ACTIONS.includes(value));
 }
 export function isThreadStreamEvent(value) {
-    if (typeof value !== 'object' || value === null)
+    if (!isRecord(value))
         return false;
-    const v = value;
-    return v['type'] === 'thread-message' && typeof v['message'] === 'object';
+    return value['type'] === 'thread-message' && typeof value['message'] === 'object';
 }

package/dist/types/ui-generator.d.ts

@@ -1,51 +1,10 @@
 import type { DataContract, JsonObject, JsonSchema, JsonValue } from './data-contract';
-/**
- * Design system version — used as part of the cache fingerprint.
- * When tokens or primitives change, bump this to invalidate cached blueprints.
- *
- * Keep in sync with the `@ggui-ai/design` package.json version.
- */
-export declare const DESIGN_SYSTEM_VERSION = "0.1.0";
-/**
- * Inputs for computing a style fingerprint.
- * The fingerprint determines cache validity for generated blueprints.
- *
- * NOTE: themeId is NOT included — theme colors are injected at render time
- * via cssOverrides, not baked into generated code.
- */
-export interface StyleFingerprintInput {
-    /** App's styling/generation prompt (affects component structure/layout) */
-    stylingPrompt?: string;
-    /** Design system preset (affects available components/tokens) */
-    designSystemPreset?: string;
-    /** Design system version (covers tokens, primitives, motion, everything compiled) */
-    designSystemVersion: string;
-}
-/**
- * Compute a style fingerprint for cache invalidation.
- *
- * Blueprints generated under the same fingerprint are interchangeable.
- * A fingerprint change means cached blueprints may use outdated primitives,
- * tokens, or structural patterns and should be regenerated.
- *
- * What invalidates the cache:
- * - stylingPrompt changed ("make it playful" → different layout)
- * - designSystemPreset changed (different component set available)
- * - designSystemVersion bumped (new tokens, primitives, motion, etc.)
- *
- * What does NOT invalidate:
- * - themeId changed (colors are applied at render time via cssOverrides)
- *
- * Uses FNV-1a (non-cryptographic) — this is for cache keys, not security.
- * Works in all JS runtimes (browser, Node.js, React Native).
- */
-export declare function computeStyleFingerprint(input: StyleFingerprintInput): string;
 /**
  * Request to generate a UI component.
  * Generic `TContext` defaults to {@link JsonObject} for generator context hints.
  */
 export interface UIGenerationRequest<TContext = JsonObject> {
-    renderId: string;
+    sessionId: string;
     prompt: string;
     context?: TContext;
     schema?: JsonSchema;
@@ -60,7 +19,7 @@ export interface UIGenerationRequest<TContext = JsonObject> {
  * field.
  */
 export interface UIGenerationResponse {
-    renderId: string;
+    sessionId: string;
     componentCode: string;
     sourceCode?: string;
     warnings?: string[];
@@ -70,8 +29,8 @@ export interface UIGenerationResponse {
      * Populated by the generator when the component calls wire hooks
      * (`useAction('name')`, `useStream('channel')`) — the generator
      * extracts the call sites and emits a matching authoring-side
-     * envelope so downstream consumers (`ggui_render` → Render, console
-     * inspectors, render-channel router) have the contract available.
+     * envelope so downstream consumers (`ggui_render` → GguiSession,
+     * console inspectors) have the contract available.
      *
      * - When the caller supplied `UiGenerateInput.contract` that
      *   envelope is passed through as-is (already authoritative).
@@ -80,7 +39,7 @@ export interface UIGenerationResponse {
      *   `actionSpec[name] = {label: name}` and
      *   `streamSpec[channel] = {schema: {type: 'object'}}`. Enough for
      *   the receiver to know the surface exists; callers who need
-     *   richer metadata (labels, schemas, refresh tools) should
+     *   richer metadata (labels, schemas, nextStep hints) should
      *   author the contract themselves and pass it on input.
      * - When no wire hooks are used, this field stays absent.
      */

package/dist/types/ui-generator.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"ui-generator.d.ts","sourceRoot":"","sources":["../../src/types/ui-generator.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EACV,YAAY,EACZ,UAAU,EACV,UAAU,EACV,SAAS,EACV,MAAM,iBAAiB,CAAC;AAEzB;;;;;GAKG;AACH,eAAO,MAAM,qBAAqB,UAAU,CAAC;AAE7C;;;;;;GAMG;AACH,MAAM,WAAW,qBAAqB;IACpC,2EAA2E;IAC3E,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,iEAAiE;IACjE,kBAAkB,CAAC,EAAE,MAAM,CAAC;IAC5B,qFAAqF;IACrF,mBAAmB,EAAE,MAAM,CAAC;CAC7B;AAuBD;;;;;;;;;;;;;;;;;GAiBG;AACH,wBAAgB,uBAAuB,CAAC,KAAK,EAAE,qBAAqB,GAAG,MAAM,CAO5E;AAED;;;GAGG;AACH,MAAM,WAAW,mBAAmB,CAAC,QAAQ,GAAG,UAAU;IACxD,QAAQ,EAAE,MAAM,CAAC;IACjB,MAAM,EAAE,MAAM,CAAC;IACf,OAAO,CAAC,EAAE,QAAQ,CAAC;IACnB,MAAM,CAAC,EAAE,UAAU,CAAC;CACrB;AAED;;;;;;;;GAQG;AACH,MAAM,WAAW,oBAAoB;IACnC,QAAQ,EAAE,MAAM,CAAC;IACjB,aAAa,EAAE,MAAM,CAAC;IACtB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,QAAQ,CAAC,EAAE,MAAM,EAAE,CAAC;IACpB;;;;;;;;;;;;;;;;;;;OAmBG;IACH,QAAQ,CAAC,EAAE,YAAY,CAAC;CACzB;AAED;;;GAGG;AACH,MAAM,WAAW,eAAe;IAC9B,IAAI,EAAE,mBAAmB,GAAG,mBAAmB,GAAG,kBAAkB,CAAC;IACrE,OAAO,EAAE,MAAM,CAAC;IAChB,2FAA2F;IAC3F,OAAO,CAAC,EAAE,SAAS,CAAC;CACrB"}
+{"version":3,"file":"ui-generator.d.ts","sourceRoot":"","sources":["../../src/types/ui-generator.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EACV,YAAY,EACZ,UAAU,EACV,UAAU,EACV,SAAS,EACV,MAAM,iBAAiB,CAAC;AAEzB;;;GAGG;AACH,MAAM,WAAW,mBAAmB,CAAC,QAAQ,GAAG,UAAU;IACxD,SAAS,EAAE,MAAM,CAAC;IAClB,MAAM,EAAE,MAAM,CAAC;IACf,OAAO,CAAC,EAAE,QAAQ,CAAC;IACnB,MAAM,CAAC,EAAE,UAAU,CAAC;CACrB;AAED;;;;;;;;GAQG;AACH,MAAM,WAAW,oBAAoB;IACnC,SAAS,EAAE,MAAM,CAAC;IAClB,aAAa,EAAE,MAAM,CAAC;IACtB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,QAAQ,CAAC,EAAE,MAAM,EAAE,CAAC;IACpB;;;;;;;;;;;;;;;;;;;OAmBG;IACH,QAAQ,CAAC,EAAE,YAAY,CAAC;CACzB;AAED;;;GAGG;AACH,MAAM,WAAW,eAAe;IAC9B,IAAI,EAAE,mBAAmB,GAAG,mBAAmB,GAAG,kBAAkB,CAAC;IACrE,OAAO,EAAE,MAAM,CAAC;IAChB,2FAA2F;IAC3F,OAAO,CAAC,EAAE,SAAS,CAAC;CACrB"}

package/dist/types/ui-generator.js

@@ -1,53 +1 @@
-/**
- * Design system version — used as part of the cache fingerprint.
- * When tokens or primitives change, bump this to invalidate cached blueprints.
- *
- * Keep in sync with the `@ggui-ai/design` package.json version.
- */
-export const DESIGN_SYSTEM_VERSION = '0.1.0';
-/**
- * FNV-1a hash — a fast, non-cryptographic hash with good distribution.
- * Used for cache key fingerprinting only, not for security purposes.
- * Works in all JS runtimes (browser, Node.js, React Native).
- */
-function fnv1aHash(str) {
-    let hash = 0x811c9dc5; // FNV offset basis (32-bit)
-    for (let i = 0; i < str.length; i++) {
-        hash ^= str.charCodeAt(i);
-        hash = Math.imul(hash, 0x01000193); // FNV prime (32-bit)
-    }
-    // Convert to unsigned 32-bit, then to base-36 for compact representation.
-    // Produce two 32-bit hashes (second seeded differently) for a longer fingerprint.
-    let hash2 = 0x1a2b3c4d;
-    for (let i = 0; i < str.length; i++) {
-        hash2 ^= str.charCodeAt(i);
-        hash2 = Math.imul(hash2, 0x01000193);
-    }
-    return (hash >>> 0).toString(36) + (hash2 >>> 0).toString(36);
-}
-/**
- * Compute a style fingerprint for cache invalidation.
- *
- * Blueprints generated under the same fingerprint are interchangeable.
- * A fingerprint change means cached blueprints may use outdated primitives,
- * tokens, or structural patterns and should be regenerated.
- *
- * What invalidates the cache:
- * - stylingPrompt changed ("make it playful" → different layout)
- * - designSystemPreset changed (different component set available)
- * - designSystemVersion bumped (new tokens, primitives, motion, etc.)
- *
- * What does NOT invalidate:
- * - themeId changed (colors are applied at render time via cssOverrides)
- *
- * Uses FNV-1a (non-cryptographic) — this is for cache keys, not security.
- * Works in all JS runtimes (browser, Node.js, React Native).
- */
-export function computeStyleFingerprint(input) {
-    const raw = [
-        input.stylingPrompt || '',
-        input.designSystemPreset || 'default',
-        input.designSystemVersion,
-    ].join('|');
-    return fnv1aHash(raw);
-}
+export {};

package/dist/validation/ajv-runtime.d.ts

@@ -15,7 +15,7 @@
  *     between props vs action vs stream vs context.
  *   - Compile-time meta-validation: `strict: true` rejects malformed
  *     JSON Schemas at `compile()` — agents discover bugs at
- *     handshake/push, not at first data flow.
+ *     handshake/render, not at first data flow.
  *
  * Closed-shape (load-bearing):
  *   JSON Schema's default is `additionalProperties: true` (extras
@@ -66,7 +66,7 @@ export declare function injectClosedShape(schema: JsonSchema): JsonSchema;
  * closed-shape injected at every object node. Throws if the schema
  * is malformed under Ajv strict mode — this is layer B meta-
  * validation as a free side effect. Dedicated meta-validation call
- * sites (handshake / push) wrap this in a structured error.
+ * sites (handshake / render) wrap this in a structured error.
  *
  * Not cached. Compilation is fast and contracts are small; caching
  * adds a memory cost without a measured win. Revisit if profiling
@@ -82,7 +82,7 @@ export declare function compileForValidation(schema: JsonSchema): ValidateFuncti
  * Why this exists: the renderer iframe runs under a strict CSP with no
  * `'unsafe-eval'`, so `ajv.compile()` (which builds the validator via
  * `new Function`) throws `EvalError` there. Codegen has to happen
- * where `eval` is legal — the server, at push time, where the contract
+ * where `eval` is legal — the server, at render time, where the contract
  * schema is already fixed. The iframe then loads this module source
  * via a `blob:` dynamic import (governed by `script-src`, not
  * `unsafe-eval`) and only ever *runs* the validator.

package/dist/validation/ajv-runtime.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"ajv-runtime.d.ts","sourceRoot":"","sources":["../../src/validation/ajv-runtime.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAqCG;AAGH,OAAO,KAAK,EAAE,WAAW,EAAE,gBAAgB,EAAE,MAAM,KAAK,CAAC;AAGzD;;;;;GAKG;AACH,YAAY,EAAE,gBAAgB,EAAE,MAAM,KAAK,CAAC;AAI5C,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,wBAAwB,CAAC;AACzD,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,sBAAsB,CAAC;AAmF9D;;;;;;;;;;;;;GAaG;AACH,wBAAgB,iBAAiB,CAAC,MAAM,EAAE,UAAU,GAAG,UAAU,CAqChE;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,oBAAoB,CAAC,MAAM,EAAE,UAAU,GAAG,gBAAgB,CAGzE;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AACH,wBAAgB,sBAAsB,CAAC,MAAM,EAAE,UAAU,GAAG,MAAM,CAIjE;AA4DD;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,wBAAgB,wBAAwB,CACtC,MAAM,EAAE,WAAW,EAAE,GAAG,IAAI,GAAG,SAAS,EACxC,IAAI,EAAE,OAAO,GACZ,iBAAiB,EAAE,CAGrB;AAED;;;;;;;;;;;GAWG;AACH,wBAAgB,gBAAgB,CAC9B,UAAU,EAAE,iBAAiB,EAAE,EAC/B,MAAM,EAAE,MAAM,GACb,iBAAiB,EAAE,CAMrB"}
+{"version":3,"file":"ajv-runtime.d.ts","sourceRoot":"","sources":["../../src/validation/ajv-runtime.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAqCG;AAGH,OAAO,KAAK,EAAE,WAAW,EAAE,gBAAgB,EAAE,MAAM,KAAK,CAAC;AAGzD;;;;;GAKG;AACH,YAAY,EAAE,gBAAgB,EAAE,MAAM,KAAK,CAAC;AAI5C,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,wBAAwB,CAAC;AACzD,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,sBAAsB,CAAC;AAoF9D;;;;;;;;;;;;;GAaG;AACH,wBAAgB,iBAAiB,CAAC,MAAM,EAAE,UAAU,GAAG,UAAU,CAqChE;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,oBAAoB,CAAC,MAAM,EAAE,UAAU,GAAG,gBAAgB,CAGzE;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AACH,wBAAgB,sBAAsB,CAAC,MAAM,EAAE,UAAU,GAAG,MAAM,CAIjE;AA4DD;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,wBAAgB,wBAAwB,CACtC,MAAM,EAAE,WAAW,EAAE,GAAG,IAAI,GAAG,SAAS,EACxC,IAAI,EAAE,OAAO,GACZ,iBAAiB,EAAE,CAGrB;AAED;;;;;;;;;;;GAWG;AACH,wBAAgB,gBAAgB,CAC9B,UAAU,EAAE,iBAAiB,EAAE,EAC/B,MAAM,EAAE,MAAM,GACb,iBAAiB,EAAE,CAMrB"}

package/dist/validation/ajv-runtime.js

@@ -15,7 +15,7 @@
  *     between props vs action vs stream vs context.
  *   - Compile-time meta-validation: `strict: true` rejects malformed
  *     JSON Schemas at `compile()` — agents discover bugs at
- *     handshake/push, not at first data flow.
+ *     handshake/render, not at first data flow.
  *
  * Closed-shape (load-bearing):
  *   JSON Schema's default is `additionalProperties: true` (extras
@@ -41,6 +41,7 @@ import addFormats from 'ajv-formats';
 import standaloneCode from 'ajv/dist/standalone/index.js';
 import equalImport from 'ajv/dist/runtime/equal.js';
 import ucs2lengthImport from 'ajv/dist/runtime/ucs2length.js';
+import { isRecord } from './is-record.js';
 /**
  * Resolve a runtime-helper module's exported function across the
  * CJS↔ESM interop gap: a plain `module.exports = fn` CJS module
@@ -172,7 +173,7 @@ export function injectClosedShape(schema) {
  * closed-shape injected at every object node. Throws if the schema
  * is malformed under Ajv strict mode — this is layer B meta-
  * validation as a free side effect. Dedicated meta-validation call
- * sites (handshake / push) wrap this in a structured error.
+ * sites (handshake / render) wrap this in a structured error.
  *
  * Not cached. Compilation is fast and contracts are small; caching
  * adds a memory cost without a measured win. Revisit if profiling
@@ -191,7 +192,7 @@ export function compileForValidation(schema) {
  * Why this exists: the renderer iframe runs under a strict CSP with no
  * `'unsafe-eval'`, so `ajv.compile()` (which builds the validator via
  * `new Function`) throws `EvalError` there. Codegen has to happen
- * where `eval` is legal — the server, at push time, where the contract
+ * where `eval` is legal — the server, at render time, where the contract
  * schema is already fixed. The iframe then loads this module source
  * via a `blob:` dynamic import (governed by `script-src`, not
  * `unsafe-eval`) and only ever *runs* the validator.
@@ -247,7 +248,7 @@ function inlineRuntimeHelpers(source) {
     }
     // Survivor check: a remaining `ajv/dist/runtime/*` import means Ajv
     // emitted a helper we don't inline. Fail loud here (server-side,
-    // caught by tests / push) rather than shipping a module the iframe
+    // caught by tests / render) rather than shipping a module the iframe
     // cannot load. Scoped to the `ajv/dist/runtime/` prefix — the only
     // specifiers Ajv standalone emits — so an embedded contract-schema
     // string can't false-trip it.
@@ -434,7 +435,7 @@ function resolveAtPath(root, instancePath) {
                 return undefined;
             cur = cur[idx];
         }
-        else if (typeof cur === 'object') {
+        else if (isRecord(cur)) {
             cur = cur[part];
         }
         else {

package/dist/validation/contract-validator.d.ts

@@ -24,7 +24,7 @@ export interface ValidationResult {
  * pre-injection wrapper.
  *
  * Shared by {@link validatePropsData} (server-side runtime check) and
- * {@link compileContractValidators} (push-time standalone emission) so
+ * {@link compileContractValidators} (render-time standalone emission) so
  * the precompiled in-iframe validator enforces byte-identical
  * semantics to the runtime validator — one synthesis, no drift.
  */
@@ -42,7 +42,7 @@ export declare function buildPropsWrapperSchema(spec: PropsSpec): JsonSchema;
  *
  * Load-bearing for `ggui_update kind:'merge'` (RFC 7396): a patch
  * adding a key absent from `propsSpec.properties` would silently
- * land on the stack item without this gate. Same rule applies to
+ * land on the render without this gate. Same rule applies to
  * the `done`-vs-declared-`completed` class of bug inside array
  * items — Ajv rejects with the exact path (`todos[0].done`).
  */
@@ -75,18 +75,18 @@ export declare function validatePropsData(props: Record<string, unknown>, spec:
  *        validator for `_ggui:preview`. Consulted FIRST so callers can
  *        override or extend built-ins.
  *     2. `BUILTIN_RESERVED_VALIDATORS` — protocol-owned, always active.
- *        Ships the {@link validateContractErrorPayload} for
- *        `_ggui:contract-error`.
+ *        Ships the {@link validateGguiLifecyclePayload} for
+ *        `_ggui:lifecycle`.
  *     3. Fall-through: if no validator is registered for the known
  *        reserved channel, return `{valid: true}`. Preserves backward
  *        compatibility for any future reserved channel the runtime
  *        adds before its validator is authored.
  *
- *   Without this structure, a `_ggui:preview` emission into a session
- *   whose active stack item carries ANY user streamSpec would
+ *   Without this structure, a `_ggui:preview` emission into a render
+ *   whose active render carries ANY user streamSpec would
  *   synthesize a false "Unknown channel" violation, blocking the
  *   provisional preview runtime. Symmetric with the client-side
- *   handling in `GguiSession`.
+ *   handling in `GguiRender`.
  *
  * Crucially narrow by design — the known-reserved path is a CLOSED
  * SET, not a prefix check. A typo inside the reserved namespace
@@ -118,7 +118,7 @@ export declare function validateStreamData(channelName: string, payload: unknown
  */
 export declare function validateContextData(slotName: string, value: unknown, spec: ContextSpec, precompiledSlots?: ReadonlyMap<string, ValidateFunction>): ValidationResult;
 /**
- * Validate an inbound user-action payload against the session's ActionSpec.
+ * Validate an inbound user-action payload against the render's ActionSpec.
  *
  * Symmetric with {@link validatePropsData} / {@link validateStreamData}, but for
  * live-channel INBOUND user → core traffic. Enforces the action contract at the
@@ -140,24 +140,25 @@ export declare function validateContextData(slotName: string, value: unknown, sp
  */
 export declare function validateActionData(value: unknown, spec: ActionSpec, precompiledActions?: ReadonlyMap<string, ValidateFunction>): ValidationResult;
 /**
- * Validate an inbound {@link ActionEnvelope} against the target stack
- * item's {@link ActionSpec}. Payload-contract layer of live-channel
- * inbound enforcement — the allowlist gate (`assertEventAllowed` in
- * `@ggui-ai/mcp-server-handlers`) is a separate concern that runs
- * first.
+ * Validate an inbound {@link ActionEnvelope} against the target
+ * render's {@link ActionSpec}. Payload-contract layer of live-channel
+ * inbound enforcement — the ONLY gate on inbound actions today (the
+ * pre-Phase-B `subscription.events` allowlist gate was deleted with
+ * the session-stack collapse).
  *
  * Semantics:
  *   - `envelope.type !== 'data:submit'` → `{valid: true, violations: []}`.
- *     Only action submissions carry payload contract today; other
- *     event types (lifecycle, interaction, error) have no schema
- *     enforcement on this layer.
- *   - `spec === undefined` → `{valid: true, violations: []}`. Stack
- *     items without an actionSpec have no contract; legacy pushes keep
+ *     {@link EventType} has exactly one member, so a TYPED caller never
+ *     hits this branch — it is a wire-trust guard: a rogue client's
+ *     envelope claiming an unknown type string is ledger-only upstream
+ *     and gets no payload enforcement on this layer.
+ *   - `spec === undefined` → `{valid: true, violations: []}`. Renders
+ *     without an actionSpec have no contract; legacy renders keep
  *     flowing.
  *   - Otherwise `envelope.payload` is validated against `spec` via
  *     {@link validateActionData}. Same rules, same output shape.
  *
- * This helper does NOT enforce allowlist, session binding, or stack
+ * This helper does NOT enforce allowlist, render binding, or render
  * routing — those are ingress-plumbing concerns. Pure payload-shape
  * check; returns `ValidationResult` rather than throwing so callers
  * can decide whether to surface as a wire error, log, etc.
@@ -171,7 +172,7 @@ export declare function validateActionEnvelope(envelope: ActionEnvelope, spec: A
  *
  * The renderer iframe runs under a strict CSP with no `'unsafe-eval'`,
  * so it cannot call `ajv.compile()` (which builds validators via
- * `new Function`). Compilation therefore happens server-side at push
+ * `new Function`). Compilation therefore happens server-side at render
  * time — where the contract schema is fixed and codegen is legal — and
  * the iframe loads each emitted module via a `blob:` dynamic import.
  *
@@ -216,7 +217,7 @@ export declare function compileContractValidators(specs: {
  * + Node — the producer's iteration order is preserved, so a given
  * contract always serializes to identical bytes. {@link computeContractBundle}
  * leans on that determinism so the resulting hash is stable across
- * pushes of the same contract.
+ * renders of the same contract.
  *
  * @public
  */
@@ -224,7 +225,7 @@ export declare function bundleCompiledValidatorsAsModule(compiled: CompiledContr
 /**
  * Convenience over {@link compileContractValidators} +
  * {@link bundleCompiledValidatorsAsModule} + sha256 — produces the
- * `{contractHash, bundleSource, validators}` triple the emitter (push.ts
+ * `{contractHash, bundleSource, validators}` triple the emitter (render.ts
  * / update.ts in #109 C4) writes to the content-addressable store and
  * emits as `_meta["ai.ggui/contract"] = {contractHash, validatorsUrl}`.
  *