@ggui-ai/protocol 0.2.0-alpha.4 → 0.3.0-rc.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ggui-ai/protocol",
-  "version": "0.2.0-alpha.4",
+  "version": "0.3.0-rc.0",
   "description": "ggui protocol types — events, renders, WebSocket, MCP, LLM models",
   "license": "Apache-2.0",
   "keywords": [
@@ -104,7 +104,7 @@
   },
   "author": "ggui contributors <hello@ggui.ai>",
   "scripts": {
-    "build": "tsc && node ../scripts/fix-esm-imports.mjs dist",
+    "build": "rm -rf dist && tsc && node ../scripts/fix-esm-imports.mjs dist",
     "dev": "tsc --watch",
     "typecheck": "tsc --noEmit",
     "sync-check": "tsx src/schemas/sync-check.ts",

package/dist/bridge/invoke-agent.d.ts

@@ -1,65 +0,0 @@
-/**
- * Agent invocation helper for the bridge agent pattern.
- *
- * Cloud-provider agnostic — uses standard fetch API. Can be used by any
- * platform implementation (serverless function, self-hosted server, etc.) that needs
- * to forward messages to an agent's HTTP endpoint.
- *
- * Handles both JSON and SSE streaming responses using stream-parser.
- */
-import type { InterfaceContext } from '../types/interface-context';
-import type { ConversationTurn } from '../types/session';
-export interface InvokeAgentOptions {
-    /** The agent's HTTP endpoint URL */
-    connectorEndpointUrl: string;
-    /** Conversation envelope id (omit for 'start' flow — agent mints one) */
-    hostSessionId?: string;
-    /** Invocation type: 'start' begins a fresh conversation, 'message' continues one */
-    type: 'start' | 'message';
-    /** User message text */
-    message?: string;
-    /** App ID to include in the request */
-    appId: string;
-    /** Client interface context (device, viewport, shell type) */
-    interfaceContext?: InterfaceContext;
-    /** Conversation history for multi-turn context */
-    conversationHistory?: ConversationTurn[];
-    /** Callback to forward streaming text chunks to the user */
-    onStreamChunk?: (text: string) => Promise<void>;
-    /** Callback when the stream is done */
-    onStreamDone?: () => Promise<void>;
-    /** Callback when the agent returns a hostSessionId (start flow, SSE) */
-    onHostSessionId?: (hostSessionId: string) => Promise<void>;
-    /** Callback for structured agent events (stream, push, etc.) from the events array */
-    onAgentEvent?: (event: {
-        type: string;
-        payload: unknown;
-    }) => Promise<void>;
-    /** Request timeout in milliseconds (default: 90000) */
-    timeoutMs?: number;
-}
-export interface InvokeAgentResult {
-    /** Conversation envelope id returned by the agent (start flow) */
-    hostSessionId?: string;
-    /** Full text response (JSON responses only — streaming uses callbacks) */
-    text?: string;
-    /** Whether the response was streamed via SSE */
-    streamed: boolean;
-    /** Outcome status */
-    status: 'ok' | 'error';
-    /** Error message if status is 'error' */
-    error?: string;
-}
-/**
- * Invoke an agent's HTTP endpoint and handle the response.
- *
- * Supports two response formats:
- *   1. JSON — returns the parsed body as InvokeAgentResult
- *   2. SSE stream — forwards chunks via callbacks, returns when stream ends
- *
- * The request body shape follows the ggui bridge protocol:
- *   - start:   { type: 'start', message, appId, interfaceContext }
- *   - message: { type: 'message', hostSessionId, appId, message, conversationHistory, interfaceContext }
- */
-export declare function invokeAgentEndpoint(options: InvokeAgentOptions): Promise<InvokeAgentResult>;
-//# sourceMappingURL=invoke-agent.d.ts.map

package/dist/bridge/invoke-agent.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"invoke-agent.d.ts","sourceRoot":"","sources":["../../src/bridge/invoke-agent.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AACH,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,4BAA4B,CAAC;AACnE,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,kBAAkB,CAAC;AAgBzD,MAAM,WAAW,kBAAkB;IACjC,oCAAoC;IACpC,oBAAoB,EAAE,MAAM,CAAC;IAC7B,yEAAyE;IACzE,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,oFAAoF;IACpF,IAAI,EAAE,OAAO,GAAG,SAAS,CAAC;IAC1B,wBAAwB;IACxB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,uCAAuC;IACvC,KAAK,EAAE,MAAM,CAAC;IACd,8DAA8D;IAC9D,gBAAgB,CAAC,EAAE,gBAAgB,CAAC;IACpC,kDAAkD;IAClD,mBAAmB,CAAC,EAAE,gBAAgB,EAAE,CAAC;IACzC,4DAA4D;IAC5D,aAAa,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IAChD,uCAAuC;IACvC,YAAY,CAAC,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC;IACnC,wEAAwE;IACxE,eAAe,CAAC,EAAE,CAAC,aAAa,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IAC3D,sFAAsF;IACtF,YAAY,CAAC,EAAE,CAAC,KAAK,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,OAAO,CAAA;KAAE,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IAC5E,uDAAuD;IACvD,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAED,MAAM,WAAW,iBAAiB;IAChC,kEAAkE;IAClE,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,0EAA0E;IAC1E,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,gDAAgD;IAChD,QAAQ,EAAE,OAAO,CAAC;IAClB,qBAAqB;IACrB,MAAM,EAAE,IAAI,GAAG,OAAO,CAAC;IACvB,yCAAyC;IACzC,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAID;;;;;;;;;;GAUG;AACH,wBAAsB,mBAAmB,CACvC,OAAO,EAAE,kBAAkB,GAC1B,OAAO,CAAC,iBAAiB,CAAC,CA4G5B"}

package/dist/bridge/invoke-agent.js

@@ -1,113 +0,0 @@
-import { z } from 'zod';
-import { isStreamingContentType } from '../stream/stream-parser.js';
-/** Schema for agent HTTP response data — validates untrusted external input. */
-const agentResponseSchema = z.object({
-    hostSessionId: z.string().optional(),
-    text: z.string().optional(),
-    events: z.array(z.object({
-        type: z.string(),
-        payload: z.unknown(),
-    }).passthrough()).optional(),
-}).passthrough();
-// ── Implementation ──
-/**
- * Invoke an agent's HTTP endpoint and handle the response.
- *
- * Supports two response formats:
- *   1. JSON — returns the parsed body as InvokeAgentResult
- *   2. SSE stream — forwards chunks via callbacks, returns when stream ends
- *
- * The request body shape follows the ggui bridge protocol:
- *   - start:   { type: 'start', message, appId, interfaceContext }
- *   - message: { type: 'message', hostSessionId, appId, message, conversationHistory, interfaceContext }
- */
-export async function invokeAgentEndpoint(options) {
-    const { connectorEndpointUrl, type, appId, hostSessionId, message, interfaceContext, conversationHistory, onStreamChunk, onStreamDone, onHostSessionId, timeoutMs = 90_000, } = options;
-    // Build request body based on invocation type
-    const body = { type, appId };
-    if (type === 'start') {
-        if (hostSessionId)
-            body.hostSessionId = hostSessionId;
-        body.message = message || 'Start a new session';
-        if (interfaceContext)
-            body.interfaceContext = interfaceContext;
-    }
-    else {
-        body.hostSessionId = hostSessionId;
-        body.message = message;
-        if (interfaceContext)
-            body.interfaceContext = interfaceContext;
-        if (conversationHistory && conversationHistory.length > 0) {
-            body.conversationHistory = conversationHistory;
-        }
-    }
-    // Build headers
-    const headers = {
-        'Content-Type': 'application/json',
-        'X-Ggui-App-Id': appId,
-    };
-    if (hostSessionId) {
-        headers['X-Ggui-Host-Session-Id'] = hostSessionId;
-    }
-    // POST to agent endpoint
-    let response;
-    try {
-        response = await fetch(connectorEndpointUrl, {
-            method: 'POST',
-            headers,
-            body: JSON.stringify(body),
-            signal: AbortSignal.timeout(timeoutMs),
-        });
-    }
-    catch (err) {
-        const errMsg = err instanceof Error ? err.message : 'Agent invocation failed';
-        return { status: 'error', error: errMsg, streamed: false };
-    }
-    if (!response.ok) {
-        return {
-            status: 'error',
-            error: `Agent returned ${response.status}`,
-            streamed: false,
-        };
-    }
-    // Determine response format
-    const contentType = response.headers.get('content-type') || '';
-    const transferEncoding = response.headers.get('transfer-encoding') || '';
-    // Read the full response body (SSE or JSON)
-    const responseText = await response.text();
-    // Parse the response — handle SSE format (strip `data: ` prefix)
-    let agentData;
-    try {
-        // SSE responses have `data: {...}` lines
-        const lines = responseText.split('\n').filter(l => l.startsWith('data: '));
-        const raw = lines.length > 0
-            ? JSON.parse(lines[lines.length - 1].slice(6).trim())
-            : JSON.parse(responseText);
-        agentData = agentResponseSchema.parse(raw);
-    }
-    catch {
-        // Couldn't parse or validate — forward raw text
-        await onStreamChunk?.(responseText);
-        await onStreamDone?.();
-        return { status: 'ok', streamed: true };
-    }
-    // Extract hostSessionId
-    if (agentData.hostSessionId) {
-        await onHostSessionId?.(agentData.hostSessionId);
-    }
-    // Forward structured agent events
-    if (agentData.events && options.onAgentEvent) {
-        for (const event of agentData.events) {
-            await options.onAgentEvent(event);
-        }
-    }
-    // Extract text for conversation history
-    const resultText = agentData.text;
-    await onStreamDone?.();
-    return {
-        hostSessionId: agentData.hostSessionId,
-        text: resultText,
-        status: 'ok',
-        streamed: isStreamingContentType(contentType, transferEncoding),
-    };
-}

package/dist/stream/stream-parser.d.ts

@@ -1,62 +0,0 @@
-/**
- * Universal stream parser for agent responses.
- *
- * Extracts text from any LLM provider's streaming format (Anthropic, OpenAI,
- * Gemini, Cohere, Mistral, etc.) without hardcoding provider schemas.
- * Uses depth-first search on well-known field names and container structures.
- *
- * Decoupled from any transport (WebSocket, HTTP, etc.) — callers provide
- * callbacks for chunk delivery.
- */
-/**
- * Detect whether a response should be treated as a stream based on headers.
- * Accepts raw header strings so callers aren't coupled to the fetch API.
- */
-export declare function isStreamingContentType(contentType: string, transferEncoding?: string): boolean;
-/**
- * Depth-first search for a text string in a JSON structure.
- *
- * Search strategy:
- *   1. Check TEXT_FIELDS at current level (string values only)
- *   2. Recurse into CONTAINER_FIELDS
- *
- * Works with any provider because it searches by field-name patterns,
- * not by provider-specific schemas.
- */
-export declare function deepFindText(obj: unknown, depth?: number): string;
-/**
- * Detect if a streaming JSON event signals end-of-stream.
- *
- * Recognized signals:
- *   - type: "done" / "message_stop"
- *   - choices[0].finish_reason !== null
- *   - (HTTP stream close is handled by the reader, not here)
- */
-export declare function isStreamDone(data: Record<string, unknown>): boolean;
-/**
- * Extract hostSessionId (conversation envelope id) from a streaming event.
- * Checks for a top-level `hostSessionId` string — no envelope format required.
- */
-export declare function extractHostSessionId(data: Record<string, unknown>): string | undefined;
-/**
- * Callbacks for stream consumers. Transport-agnostic — works with WebSocket,
- * HTTP response streaming, file output, or anything else.
- */
-export interface StreamCallbacks {
-    onChunk: (text: string) => Promise<void>;
-    onDone: () => Promise<void>;
-    onHostSessionId?: (hostSessionId: string) => Promise<void>;
-}
-/**
- * Read a streaming HTTP response and invoke callbacks for each text chunk.
- *
- * Supports three wire formats:
- *   1. text/event-stream (SSE) — parses `data:` lines
- *   2. application/x-ndjson — one JSON object per line
- *   3. Any other — forwards raw text chunks
- *
- * JSON events (SSE and NDJSON) are parsed with deepFindText for universal
- * text extraction. Non-JSON content is forwarded as raw text.
- */
-export declare function readStream(body: ReadableStream<Uint8Array>, contentType: string, callbacks: StreamCallbacks): Promise<void>;
-//# sourceMappingURL=stream-parser.d.ts.map

package/dist/stream/stream-parser.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"stream-parser.d.ts","sourceRoot":"","sources":["../../src/stream/stream-parser.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAIH;;;GAGG;AACH,wBAAgB,sBAAsB,CACpC,WAAW,EAAE,MAAM,EACnB,gBAAgB,CAAC,EAAE,MAAM,GACxB,OAAO,CAKT;AAUD;;;;;;;;;GASG;AACH,wBAAgB,YAAY,CAAC,GAAG,EAAE,OAAO,EAAE,KAAK,SAAI,GAAG,MAAM,CA0B5D;AAID;;;;;;;GAOG;AACH,wBAAgB,YAAY,CAAC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,OAAO,CAUnE;AAID;;;GAGG;AACH,wBAAgB,oBAAoB,CAAC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,MAAM,GAAG,SAAS,CAKtF;AAID;;;GAGG;AACH,MAAM,WAAW,eAAe;IAC9B,OAAO,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IACzC,MAAM,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC;IAC5B,eAAe,CAAC,EAAE,CAAC,aAAa,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;CAC5D;AAED;;;;;;;;;;GAUG;AACH,wBAAsB,UAAU,CAC9B,IAAI,EAAE,cAAc,CAAC,UAAU,CAAC,EAChC,WAAW,EAAE,MAAM,EACnB,SAAS,EAAE,eAAe,GACzB,OAAO,CAAC,IAAI,CAAC,CAkFf"}

package/dist/stream/stream-parser.js

@@ -1,199 +0,0 @@
-/**
- * Universal stream parser for agent responses.
- *
- * Extracts text from any LLM provider's streaming format (Anthropic, OpenAI,
- * Gemini, Cohere, Mistral, etc.) without hardcoding provider schemas.
- * Uses depth-first search on well-known field names and container structures.
- *
- * Decoupled from any transport (WebSocket, HTTP, etc.) — callers provide
- * callbacks for chunk delivery.
- */
-// ── Detection ──
-/**
- * Detect whether a response should be treated as a stream based on headers.
- * Accepts raw header strings so callers aren't coupled to the fetch API.
- */
-export function isStreamingContentType(contentType, transferEncoding) {
-    if (contentType.includes('text/event-stream'))
-        return true;
-    if (contentType.includes('application/x-ndjson'))
-        return true;
-    if (contentType.includes('text/plain') && transferEncoding?.includes('chunked'))
-        return true;
-    return false;
-}
-// ── Text extraction ──
-/** Well-known field names that carry streaming text across LLM providers. */
-const TEXT_FIELDS = ['text', 'content', 'chunk', 'message', 'output', 'response'];
-/** Well-known container fields that wrap text in nested structures. */
-const CONTAINER_FIELDS = ['delta', 'choices', 'candidates', 'parts', 'content_block', 'data', 'body'];
-/**
- * Depth-first search for a text string in a JSON structure.
- *
- * Search strategy:
- *   1. Check TEXT_FIELDS at current level (string values only)
- *   2. Recurse into CONTAINER_FIELDS
- *
- * Works with any provider because it searches by field-name patterns,
- * not by provider-specific schemas.
- */
-export function deepFindText(obj, depth = 0) {
-    if (depth > 6)
-        return '';
-    if (!obj || typeof obj !== 'object')
-        return '';
-    const record = obj;
-    for (const key of TEXT_FIELDS) {
-        const val = record[key];
-        if (typeof val === 'string' && val.length > 0)
-            return val;
-    }
-    for (const key of CONTAINER_FIELDS) {
-        if (!(key in record))
-            continue;
-        const val = record[key];
-        if (Array.isArray(val)) {
-            for (const item of val) {
-                const found = deepFindText(item, depth + 1);
-                if (found)
-                    return found;
-            }
-        }
-        else {
-            const found = deepFindText(val, depth + 1);
-            if (found)
-                return found;
-        }
-    }
-    return '';
-}
-// ── Done detection ──
-/**
- * Detect if a streaming JSON event signals end-of-stream.
- *
- * Recognized signals:
- *   - type: "done" / "message_stop"
- *   - choices[0].finish_reason !== null
- *   - (HTTP stream close is handled by the reader, not here)
- */
-export function isStreamDone(data) {
-    const t = data.type;
-    if (t === 'done' || t === 'message_stop')
-        return true;
-    if (Array.isArray(data.choices)) {
-        const first = data.choices[0];
-        if (first?.finish_reason != null)
-            return true;
-    }
-    return false;
-}
-// ── HostSessionId extraction ──
-/**
- * Extract hostSessionId (conversation envelope id) from a streaming event.
- * Checks for a top-level `hostSessionId` string — no envelope format required.
- */
-export function extractHostSessionId(data) {
-    if (typeof data.hostSessionId === 'string' && data.hostSessionId) {
-        return data.hostSessionId;
-    }
-    return undefined;
-}
-/**
- * Read a streaming HTTP response and invoke callbacks for each text chunk.
- *
- * Supports three wire formats:
- *   1. text/event-stream (SSE) — parses `data:` lines
- *   2. application/x-ndjson — one JSON object per line
- *   3. Any other — forwards raw text chunks
- *
- * JSON events (SSE and NDJSON) are parsed with deepFindText for universal
- * text extraction. Non-JSON content is forwarded as raw text.
- */
-export async function readStream(body, contentType, callbacks) {
-    const reader = body.getReader();
-    const decoder = new TextDecoder();
-    const isSSE = contentType.includes('text/event-stream');
-    const isNDJSON = contentType.includes('application/x-ndjson');
-    let buffer = '';
-    let doneSent = false;
-    const emitDone = async () => {
-        if (doneSent)
-            return;
-        doneSent = true;
-        await callbacks.onDone();
-    };
-    const processJsonEvent = async (data) => {
-        const hsid = extractHostSessionId(data);
-        if (hsid)
-            await callbacks.onHostSessionId?.(hsid);
-        if (isStreamDone(data)) {
-            await emitDone();
-            return;
-        }
-        const text = deepFindText(data);
-        if (text)
-            await callbacks.onChunk(text);
-    };
-    try {
-        for (;;) {
-            const { done, value } = await reader.read();
-            if (done)
-                break;
-            buffer += decoder.decode(value, { stream: true });
-            if (isSSE) {
-                const lines = buffer.split('\n');
-                buffer = lines.pop() || '';
-                for (const line of lines) {
-                    if (!line || line.startsWith(':'))
-                        continue;
-                    if (!line.startsWith('data: '))
-                        continue;
-                    const payload = line.slice(6).trim();
-                    if (!payload)
-                        continue;
-                    if (payload === '[DONE]') {
-                        await emitDone();
-                        continue;
-                    }
-                    try {
-                        await processJsonEvent(JSON.parse(payload));
-                    }
-                    catch {
-                        // Not valid JSON — forward as raw text chunk
-                        await callbacks.onChunk(payload);
-                    }
-                }
-            }
-            else if (isNDJSON) {
-                const lines = buffer.split('\n');
-                buffer = lines.pop() || '';
-                for (const line of lines) {
-                    const trimmed = line.trim();
-                    if (!trimmed)
-                        continue;
-                    try {
-                        await processJsonEvent(JSON.parse(trimmed));
-                    }
-                    catch {
-                        // Not valid JSON — forward as raw text chunk
-                        await callbacks.onChunk(trimmed);
-                    }
-                }
-            }
-            else {
-                const chunk = buffer;
-                buffer = '';
-                if (chunk)
-                    await callbacks.onChunk(chunk);
-            }
-        }
-        await emitDone();
-    }
-    catch (err) {
-        console.error('Stream reading error:', err);
-        await emitDone().catch(() => { });
-    }
-    finally {
-        reader.releaseLock();
-    }
-}

package/dist/types/canvas-lifecycle.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"canvas-lifecycle.d.ts","sourceRoot":"","sources":["../../src/types/canvas-lifecycle.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAoCG;AAEH,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,iBAAiB,CAAC;AAElD;;;;GAIG;AACH,MAAM,WAAW,uBAAwB,SAAQ,UAAU;IACzD,QAAQ,CAAC,IAAI,EAAE,mBAAmB,CAAC;IACnC,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,oEAAoE;IACpE,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;CACzB;AAED;;;;;GAKG;AACH,MAAM,WAAW,yBAA0B,SAAQ,UAAU;IAC3D,QAAQ,CAAC,IAAI,EAAE,qBAAqB,CAAC;IACrC,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,gEAAgE;IAChE,QAAQ,CAAC,OAAO,EAAE,UAAU,GAAG,SAAS,GAAG,UAAU,GAAG,QAAQ,CAAC;IACjE;;;;OAIG;IACH,QAAQ,CAAC,WAAW,EAAE,OAAO,CAAC;CAC/B;AAED;;;;GAIG;AACH,MAAM,WAAW,oBAAqB,SAAQ,UAAU;IACtD,QAAQ,CAAC,IAAI,EAAE,gBAAgB,CAAC;IAChC,+DAA+D;IAC/D,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,4DAA4D;IAC5D,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;CACzB;AAED;;;;GAIG;AACH,MAAM,WAAW,qBAAsB,SAAQ,UAAU;IACvD,QAAQ,CAAC,IAAI,EAAE,iBAAiB,CAAC;IACjC;;;;;;;OAOG;IACH,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,mDAAmD;IACnD,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;CAC3B;AAED;;;;GAIG;AACH,MAAM,MAAM,sBAAsB,GAC9B,uBAAuB,GACvB,yBAAyB,GACzB,oBAAoB,GACpB,qBAAqB,CAAC"}

package/dist/types/credential.d.ts

@@ -1,41 +0,0 @@
-/**
- * Credential injection — cross-process wire protocol between the
- * open @ggui-ai/server auth relay (which writes placeholders) and
- * the closed cloud mcp-proxy service (which resolves them).
- *
- * Shared between:
- *   - packages/server/src/mcp-auth-middleware.ts (writes placeholders)
- *   - cloud/amplify/functions/rest-api/mcp-proxy/handler.ts (resolves placeholders)
- *   - cloud/services/mcp-proxy/src/* (resolves placeholders)
- *
- * Hosted-overlay shapes for the `auth` block inside per-app
- * config files are a hosting concept and not a portable wire
- * protocol. What remains here is the runtime placeholder /
- * injection-mode protocol, which is legitimately cross-process.
- */
-/** How the proxy injects a credential into the outbound request. */
-export type CredentialInjection = 'bearer_header' | 'api_key_header' | 'query_param' | 'custom_header';
-/** Full injection config — resolved from app config or McpServiceConfig. */
-export interface CredentialInjectionConfig {
-    mode: CredentialInjection;
-    /** Header name for api_key_header / custom_header. Default: 'X-API-Key'. */
-    headerName?: string;
-    /** Query param name for query_param. Default: 'api_key'. */
-    paramName?: string;
-}
-/**
- * Placeholder regex — matches `<ggui:credential:{serviceId}>`.
- * The placeholder is always the raw credential slot value.
- * The proxy applies injection formatting (Bearer prefix, header name, etc.).
- */
-export declare const CREDENTIAL_PLACEHOLDER_RE: RegExp;
-/**
- * Internal control header for placeholder pre-injection.
- * - Writer: auth relay middleware only
- * - Consumer: proxy only (reads, resolves, strips before forwarding)
- * - Never forwarded upstream
- */
-export declare const CREDENTIAL_HEADER = "x-ggui-credential";
-/** Build a placeholder string for a given serviceId. */
-export declare function credentialPlaceholder(serviceId: string): string;
-//# sourceMappingURL=credential.d.ts.map

package/dist/types/credential.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"credential.d.ts","sourceRoot":"","sources":["../../src/types/credential.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAEH,oEAAoE;AACpE,MAAM,MAAM,mBAAmB,GAC3B,eAAe,GACf,gBAAgB,GAChB,aAAa,GACb,eAAe,CAAC;AAEpB,4EAA4E;AAC5E,MAAM,WAAW,yBAAyB;IACxC,IAAI,EAAE,mBAAmB,CAAC;IAC1B,4EAA4E;IAC5E,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,4DAA4D;IAC5D,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAED;;;;GAIG;AACH,eAAO,MAAM,yBAAyB,QAAyC,CAAC;AAEhF;;;;;GAKG;AACH,eAAO,MAAM,iBAAiB,sBAAsB,CAAC;AAErD,wDAAwD;AACxD,wBAAgB,qBAAqB,CAAC,SAAS,EAAE,MAAM,GAAG,MAAM,CAE/D"}

package/dist/types/credential.js

@@ -1,32 +0,0 @@
-/**
- * Credential injection — cross-process wire protocol between the
- * open @ggui-ai/server auth relay (which writes placeholders) and
- * the closed cloud mcp-proxy service (which resolves them).
- *
- * Shared between:
- *   - packages/server/src/mcp-auth-middleware.ts (writes placeholders)
- *   - cloud/amplify/functions/rest-api/mcp-proxy/handler.ts (resolves placeholders)
- *   - cloud/services/mcp-proxy/src/* (resolves placeholders)
- *
- * Hosted-overlay shapes for the `auth` block inside per-app
- * config files are a hosting concept and not a portable wire
- * protocol. What remains here is the runtime placeholder /
- * injection-mode protocol, which is legitimately cross-process.
- */
-/**
- * Placeholder regex — matches `<ggui:credential:{serviceId}>`.
- * The placeholder is always the raw credential slot value.
- * The proxy applies injection formatting (Bearer prefix, header name, etc.).
- */
-export const CREDENTIAL_PLACEHOLDER_RE = /^<ggui:credential:([a-zA-Z0-9_-]+)>$/;
-/**
- * Internal control header for placeholder pre-injection.
- * - Writer: auth relay middleware only
- * - Consumer: proxy only (reads, resolves, strips before forwarding)
- * - Never forwarded upstream
- */
-export const CREDENTIAL_HEADER = 'x-ggui-credential';
-/** Build a placeholder string for a given serviceId. */
-export function credentialPlaceholder(serviceId) {
-    return `<ggui:credential:${serviceId}>`;
-}