@ggui-ai/protocol 0.2.0-alpha.4 → 0.4.0-rc.0

package/dist/validation/contract-validator.d.ts

@@ -24,7 +24,7 @@ export interface ValidationResult {
  * pre-injection wrapper.
  *
  * Shared by {@link validatePropsData} (server-side runtime check) and
- * {@link compileContractValidators} (push-time standalone emission) so
+ * {@link compileContractValidators} (render-time standalone emission) so
  * the precompiled in-iframe validator enforces byte-identical
  * semantics to the runtime validator — one synthesis, no drift.
  */
@@ -42,7 +42,7 @@ export declare function buildPropsWrapperSchema(spec: PropsSpec): JsonSchema;
  *
  * Load-bearing for `ggui_update kind:'merge'` (RFC 7396): a patch
  * adding a key absent from `propsSpec.properties` would silently
- * land on the stack item without this gate. Same rule applies to
+ * land on the render without this gate. Same rule applies to
  * the `done`-vs-declared-`completed` class of bug inside array
  * items — Ajv rejects with the exact path (`todos[0].done`).
  */
@@ -75,18 +75,18 @@ export declare function validatePropsData(props: Record<string, unknown>, spec:
  *        validator for `_ggui:preview`. Consulted FIRST so callers can
  *        override or extend built-ins.
  *     2. `BUILTIN_RESERVED_VALIDATORS` — protocol-owned, always active.
- *        Ships the {@link validateContractErrorPayload} for
- *        `_ggui:contract-error`.
+ *        Ships the {@link validateGguiLifecyclePayload} for
+ *        `_ggui:lifecycle`.
  *     3. Fall-through: if no validator is registered for the known
  *        reserved channel, return `{valid: true}`. Preserves backward
  *        compatibility for any future reserved channel the runtime
  *        adds before its validator is authored.
  *
- *   Without this structure, a `_ggui:preview` emission into a session
- *   whose active stack item carries ANY user streamSpec would
+ *   Without this structure, a `_ggui:preview` emission into a render
+ *   whose active render carries ANY user streamSpec would
  *   synthesize a false "Unknown channel" violation, blocking the
  *   provisional preview runtime. Symmetric with the client-side
- *   handling in `GguiSession`.
+ *   handling in `GguiRender`.
  *
  * Crucially narrow by design — the known-reserved path is a CLOSED
  * SET, not a prefix check. A typo inside the reserved namespace
@@ -118,7 +118,7 @@ export declare function validateStreamData(channelName: string, payload: unknown
  */
 export declare function validateContextData(slotName: string, value: unknown, spec: ContextSpec, precompiledSlots?: ReadonlyMap<string, ValidateFunction>): ValidationResult;
 /**
- * Validate an inbound user-action payload against the session's ActionSpec.
+ * Validate an inbound user-action payload against the render's ActionSpec.
  *
  * Symmetric with {@link validatePropsData} / {@link validateStreamData}, but for
  * live-channel INBOUND user → core traffic. Enforces the action contract at the
@@ -140,24 +140,25 @@ export declare function validateContextData(slotName: string, value: unknown, sp
  */
 export declare function validateActionData(value: unknown, spec: ActionSpec, precompiledActions?: ReadonlyMap<string, ValidateFunction>): ValidationResult;
 /**
- * Validate an inbound {@link ActionEnvelope} against the target stack
- * item's {@link ActionSpec}. Payload-contract layer of live-channel
- * inbound enforcement — the allowlist gate (`assertEventAllowed` in
- * `@ggui-ai/mcp-server-handlers`) is a separate concern that runs
- * first.
+ * Validate an inbound {@link ActionEnvelope} against the target
+ * render's {@link ActionSpec}. Payload-contract layer of live-channel
+ * inbound enforcement — the ONLY gate on inbound actions today (the
+ * pre-Phase-B `subscription.events` allowlist gate was deleted with
+ * the session-stack collapse).
  *
  * Semantics:
  *   - `envelope.type !== 'data:submit'` → `{valid: true, violations: []}`.
- *     Only action submissions carry payload contract today; other
- *     event types (lifecycle, interaction, error) have no schema
- *     enforcement on this layer.
- *   - `spec === undefined` → `{valid: true, violations: []}`. Stack
- *     items without an actionSpec have no contract; legacy pushes keep
+ *     {@link EventType} has exactly one member, so a TYPED caller never
+ *     hits this branch — it is a wire-trust guard: a rogue client's
+ *     envelope claiming an unknown type string is ledger-only upstream
+ *     and gets no payload enforcement on this layer.
+ *   - `spec === undefined` → `{valid: true, violations: []}`. Renders
+ *     without an actionSpec have no contract; legacy renders keep
  *     flowing.
  *   - Otherwise `envelope.payload` is validated against `spec` via
  *     {@link validateActionData}. Same rules, same output shape.
  *
- * This helper does NOT enforce allowlist, session binding, or stack
+ * This helper does NOT enforce allowlist, render binding, or render
  * routing — those are ingress-plumbing concerns. Pure payload-shape
  * check; returns `ValidationResult` rather than throwing so callers
  * can decide whether to surface as a wire error, log, etc.
@@ -171,7 +172,7 @@ export declare function validateActionEnvelope(envelope: ActionEnvelope, spec: A
  *
  * The renderer iframe runs under a strict CSP with no `'unsafe-eval'`,
  * so it cannot call `ajv.compile()` (which builds validators via
- * `new Function`). Compilation therefore happens server-side at push
+ * `new Function`). Compilation therefore happens server-side at render
  * time — where the contract schema is fixed and codegen is legal — and
  * the iframe loads each emitted module via a `blob:` dynamic import.
  *
@@ -216,7 +217,7 @@ export declare function compileContractValidators(specs: {
  * + Node — the producer's iteration order is preserved, so a given
  * contract always serializes to identical bytes. {@link computeContractBundle}
  * leans on that determinism so the resulting hash is stable across
- * pushes of the same contract.
+ * renders of the same contract.
  *
  * @public
  */
@@ -224,7 +225,7 @@ export declare function bundleCompiledValidatorsAsModule(compiled: CompiledContr
 /**
  * Convenience over {@link compileContractValidators} +
  * {@link bundleCompiledValidatorsAsModule} + sha256 — produces the
- * `{contractHash, bundleSource, validators}` triple the emitter (push.ts
+ * `{contractHash, bundleSource, validators}` triple the emitter (render.ts
  * / update.ts in #109 C4) writes to the content-addressable store and
  * emits as `_meta["ai.ggui/contract"] = {contractHash, validatorsUrl}`.
  *

package/dist/validation/contract-validator.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"contract-validator.d.ts","sourceRoot":"","sources":["../../src/validation/contract-validator.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,SAAS,EAAE,UAAU,EAAE,UAAU,EAAE,WAAW,EAAE,UAAU,EAAE,UAAU,EAAE,YAAY,EAAE,MAAM,wBAAwB,CAAC;AAEnI,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,iBAAiB,CAAC;AACtD,OAAO,KAAK,EAAE,0BAA0B,EAAE,MAAM,0BAA0B,CAAC;AAO3E,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,eAAe,CAAC;AAItD,YAAY,EAAE,gBAAgB,EAAE,MAAM,eAAe,CAAC;AAItD,OAAO,EAKL,KAAK,wBAAwB,EAC9B,MAAM,qBAAqB,CAAC;AAE7B,MAAM,WAAW,iBAAkB,SAAQ,UAAU;IACnD,KAAK,EAAE,MAAM,CAAC;IACd,OAAO,EAAE,MAAM,CAAC;IAChB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB;AAED,MAAM,WAAW,gBAAgB;IAC/B,KAAK,EAAE,OAAO,CAAC;IACf,UAAU,EAAE,iBAAiB,EAAE,CAAC;CACjC;AAED;;;;;;;;;;;;;GAaG;AACH,wBAAgB,uBAAuB,CAAC,IAAI,EAAE,SAAS,GAAG,UAAU,CAcnE;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAgB,iBAAiB,CAC/B,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAC9B,IAAI,EAAE,SAAS,EACf,WAAW,CAAC,EAAE,gBAAgB,GAC7B,gBAAgB,CAWlB;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAkDG;AACH,wBAAgB,kBAAkB,CAChC,WAAW,EAAE,MAAM,EACnB,OAAO,EAAE,OAAO,EAChB,IAAI,EAAE,UAAU,EAChB,uBAAuB,CAAC,EAAE,WAAW,CAAC,MAAM,EAAE,wBAAwB,CAAC,EACvE,mBAAmB,CAAC,EAAE,WAAW,CAAC,MAAM,EAAE,gBAAgB,CAAC,GAC1D,gBAAgB,CAyClB;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAgB,mBAAmB,CACjC,QAAQ,EAAE,MAAM,EAChB,KAAK,EAAE,OAAO,EACd,IAAI,EAAE,WAAW,EACjB,gBAAgB,CAAC,EAAE,WAAW,CAAC,MAAM,EAAE,gBAAgB,CAAC,GACvD,gBAAgB,CA+BlB;AAED;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,wBAAgB,kBAAkB,CAChC,KAAK,EAAE,OAAO,EACd,IAAI,EAAE,UAAU,EAChB,kBAAkB,CAAC,EAAE,WAAW,CAAC,MAAM,EAAE,gBAAgB,CAAC,GACzD,gBAAgB,CAoDlB;AAQD;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,wBAAgB,sBAAsB,CACpC,QAAQ,EAAE,cAAc,EACxB,IAAI,EAAE,UAAU,GAAG,SAAS,EAC5B,kBAAkB,CAAC,EAAE,WAAW,CAAC,MAAM,EAAE,gBAAgB,CAAC,GACzD,gBAAgB,CAIlB;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AACH,wBAAgB,yBAAyB,CAAC,KAAK,EAAE;IAC/C,QAAQ,CAAC,SAAS,CAAC,EAAE,SAAS,CAAC;IAC/B,QAAQ,CAAC,UAAU,CAAC,EAAE,UAAU,CAAC;IACjC,QAAQ,CAAC,UAAU,CAAC,EAAE,UAAU,CAAC;IACjC,QAAQ,CAAC,WAAW,CAAC,EAAE,WAAW,CAAC;CACpC,GAAG,0BAA0B,GAAG,SAAS,CAuCzC;AAED;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,wBAAgB,gCAAgC,CAC9C,QAAQ,EAAE,0BAA0B,GACnC,MAAM,CAER;AAiCD;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,wBAAsB,qBAAqB,CAAC,KAAK,EAAE;IACjD,QAAQ,CAAC,SAAS,CAAC,EAAE,SAAS,CAAC;IAC/B,QAAQ,CAAC,UAAU,CAAC,EAAE,UAAU,CAAC;IACjC,QAAQ,CAAC,UAAU,CAAC,EAAE,UAAU,CAAC;IACjC,QAAQ,CAAC,WAAW,CAAC,EAAE,WAAW,CAAC;CACpC,GAAG,OAAO,CACP;IACE,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;IAC9B,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;IAC9B,QAAQ,CAAC,UAAU,EAAE,0BAA0B,CAAC;CACjD,GACD,SAAS,CACZ,CAeA;AAED;;GAEG;AACH,wBAAgB,gBAAgB,CAAC,UAAU,EAAE,iBAAiB,EAAE,GAAG,MAAM,CAIxE;AAMD;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,wBAAgB,yBAAyB,CAAC,QAAQ,EAAE,YAAY,GAAG,gBAAgB,CAiGlF;AAyPD,qBAAa,sBAAuB,SAAQ,KAAK;IAC/C,QAAQ,CAAC,UAAU,EAAE,iBAAiB,EAAE,CAAC;IACzC,QAAQ,CAAC,IAAI,EAAE,aAAa,GAAG,aAAa,GAAG,WAAW,GAAG,YAAY,CAAC;IAC1E,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;gBAEV,IAAI,EAAE;QAChB,IAAI,EAAE,aAAa,GAAG,aAAa,GAAG,WAAW,GAAG,YAAY,CAAC;QACjE,UAAU,EAAE,iBAAiB,EAAE,CAAC;QAChC,IAAI,CAAC,EAAE,MAAM,CAAC;KACf;IASD,8DAA8D;IAC9D,WAAW,IAAI;QACb,KAAK,EAAE,oBAAoB,CAAC;QAC5B,IAAI,EAAE,MAAM,CAAC;QACb,UAAU,EAAE,iBAAiB,EAAE,CAAC;QAChC,IAAI,EAAE,MAAM,CAAC;KACd;CAQF"}
+{"version":3,"file":"contract-validator.d.ts","sourceRoot":"","sources":["../../src/validation/contract-validator.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,SAAS,EAAE,UAAU,EAAE,UAAU,EAAE,WAAW,EAAE,UAAU,EAAE,UAAU,EAAE,YAAY,EAAE,MAAM,wBAAwB,CAAC;AAEnI,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,iBAAiB,CAAC;AACtD,OAAO,KAAK,EAAE,0BAA0B,EAAE,MAAM,0BAA0B,CAAC;AAO3E,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,eAAe,CAAC;AAItD,YAAY,EAAE,gBAAgB,EAAE,MAAM,eAAe,CAAC;AAKtD,OAAO,EAKL,KAAK,wBAAwB,EAC9B,MAAM,qBAAqB,CAAC;AAE7B,MAAM,WAAW,iBAAkB,SAAQ,UAAU;IACnD,KAAK,EAAE,MAAM,CAAC;IACd,OAAO,EAAE,MAAM,CAAC;IAChB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB;AAED,MAAM,WAAW,gBAAgB;IAC/B,KAAK,EAAE,OAAO,CAAC;IACf,UAAU,EAAE,iBAAiB,EAAE,CAAC;CACjC;AAED;;;;;;;;;;;;;GAaG;AACH,wBAAgB,uBAAuB,CAAC,IAAI,EAAE,SAAS,GAAG,UAAU,CAcnE;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAgB,iBAAiB,CAC/B,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAC9B,IAAI,EAAE,SAAS,EACf,WAAW,CAAC,EAAE,gBAAgB,GAC7B,gBAAgB,CAWlB;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAkDG;AACH,wBAAgB,kBAAkB,CAChC,WAAW,EAAE,MAAM,EACnB,OAAO,EAAE,OAAO,EAChB,IAAI,EAAE,UAAU,EAChB,uBAAuB,CAAC,EAAE,WAAW,CAAC,MAAM,EAAE,wBAAwB,CAAC,EACvE,mBAAmB,CAAC,EAAE,WAAW,CAAC,MAAM,EAAE,gBAAgB,CAAC,GAC1D,gBAAgB,CAyClB;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAgB,mBAAmB,CACjC,QAAQ,EAAE,MAAM,EAChB,KAAK,EAAE,OAAO,EACd,IAAI,EAAE,WAAW,EACjB,gBAAgB,CAAC,EAAE,WAAW,CAAC,MAAM,EAAE,gBAAgB,CAAC,GACvD,gBAAgB,CA+BlB;AAED;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,wBAAgB,kBAAkB,CAChC,KAAK,EAAE,OAAO,EACd,IAAI,EAAE,UAAU,EAChB,kBAAkB,CAAC,EAAE,WAAW,CAAC,MAAM,EAAE,gBAAgB,CAAC,GACzD,gBAAgB,CAoDlB;AAQD;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,wBAAgB,sBAAsB,CACpC,QAAQ,EAAE,cAAc,EACxB,IAAI,EAAE,UAAU,GAAG,SAAS,EAC5B,kBAAkB,CAAC,EAAE,WAAW,CAAC,MAAM,EAAE,gBAAgB,CAAC,GACzD,gBAAgB,CAIlB;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AACH,wBAAgB,yBAAyB,CAAC,KAAK,EAAE;IAC/C,QAAQ,CAAC,SAAS,CAAC,EAAE,SAAS,CAAC;IAC/B,QAAQ,CAAC,UAAU,CAAC,EAAE,UAAU,CAAC;IACjC,QAAQ,CAAC,UAAU,CAAC,EAAE,UAAU,CAAC;IACjC,QAAQ,CAAC,WAAW,CAAC,EAAE,WAAW,CAAC;CACpC,GAAG,0BAA0B,GAAG,SAAS,CAuCzC;AAED;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,wBAAgB,gCAAgC,CAC9C,QAAQ,EAAE,0BAA0B,GACnC,MAAM,CAER;AAiCD;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,wBAAsB,qBAAqB,CAAC,KAAK,EAAE;IACjD,QAAQ,CAAC,SAAS,CAAC,EAAE,SAAS,CAAC;IAC/B,QAAQ,CAAC,UAAU,CAAC,EAAE,UAAU,CAAC;IACjC,QAAQ,CAAC,UAAU,CAAC,EAAE,UAAU,CAAC;IACjC,QAAQ,CAAC,WAAW,CAAC,EAAE,WAAW,CAAC;CACpC,GAAG,OAAO,CACP;IACE,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;IAC9B,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;IAC9B,QAAQ,CAAC,UAAU,EAAE,0BAA0B,CAAC;CACjD,GACD,SAAS,CACZ,CAeA;AAED;;GAEG;AACH,wBAAgB,gBAAgB,CAAC,UAAU,EAAE,iBAAiB,EAAE,GAAG,MAAM,CAIxE;AAMD;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,wBAAgB,yBAAyB,CAAC,QAAQ,EAAE,YAAY,GAAG,gBAAgB,CAiGlF;AAyPD,qBAAa,sBAAuB,SAAQ,KAAK;IAC/C,QAAQ,CAAC,UAAU,EAAE,iBAAiB,EAAE,CAAC;IACzC,QAAQ,CAAC,IAAI,EAAE,aAAa,GAAG,aAAa,GAAG,WAAW,GAAG,YAAY,CAAC;IAC1E,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;gBAEV,IAAI,EAAE;QAChB,IAAI,EAAE,aAAa,GAAG,aAAa,GAAG,WAAW,GAAG,YAAY,CAAC;QACjE,UAAU,EAAE,iBAAiB,EAAE,CAAC;QAChC,IAAI,CAAC,EAAE,MAAM,CAAC;KACf;IASD,8DAA8D;IAC9D,WAAW,IAAI;QACb,KAAK,EAAE,oBAAoB,CAAC;QAC5B,IAAI,EAAE,MAAM,CAAC;QACb,UAAU,EAAE,iBAAiB,EAAE,CAAC;QAChC,IAAI,EAAE,MAAM,CAAC;KACd;CAQF"}

package/dist/validation/contract-validator.js

@@ -2,6 +2,7 @@ import { deriveContextDefault } from '../types/data-contract.js';
 import { compileForValidation, compileValidatorModule, mapAjvErrorsToViolations, prefixViolations, } from './ajv-runtime.js';
 import { checkCrossReferences } from './cross-references.js';
 import { checkNameInvariants } from './name-invariants.js';
+import { isRecord } from './is-record.js';
 import { checkSchemaCompat } from './schema-compat-invariants.js';
 import { BUILTIN_RESERVED_VALIDATORS, RESERVED_CHANNEL_PREFIX, isKnownReservedChannel, isReservedChannelName, } from './reserved-channels.js';
 /**
@@ -14,7 +15,7 @@ import { BUILTIN_RESERVED_VALIDATORS, RESERVED_CHANNEL_PREFIX, isKnownReservedCh
  * pre-injection wrapper.
  *
  * Shared by {@link validatePropsData} (server-side runtime check) and
- * {@link compileContractValidators} (push-time standalone emission) so
+ * {@link compileContractValidators} (render-time standalone emission) so
  * the precompiled in-iframe validator enforces byte-identical
  * semantics to the runtime validator — one synthesis, no drift.
  */
@@ -44,7 +45,7 @@ export function buildPropsWrapperSchema(spec) {
  *
  * Load-bearing for `ggui_update kind:'merge'` (RFC 7396): a patch
  * adding a key absent from `propsSpec.properties` would silently
- * land on the stack item without this gate. Same rule applies to
+ * land on the render without this gate. Same rule applies to
  * the `done`-vs-declared-`completed` class of bug inside array
  * items — Ajv rejects with the exact path (`todos[0].done`).
  */
@@ -89,18 +90,18 @@ export function validatePropsData(props, spec, precompiled) {
  *        validator for `_ggui:preview`. Consulted FIRST so callers can
  *        override or extend built-ins.
  *     2. `BUILTIN_RESERVED_VALIDATORS` — protocol-owned, always active.
- *        Ships the {@link validateContractErrorPayload} for
- *        `_ggui:contract-error`.
+ *        Ships the {@link validateGguiLifecyclePayload} for
+ *        `_ggui:lifecycle`.
  *     3. Fall-through: if no validator is registered for the known
  *        reserved channel, return `{valid: true}`. Preserves backward
  *        compatibility for any future reserved channel the runtime
  *        adds before its validator is authored.
  *
- *   Without this structure, a `_ggui:preview` emission into a session
- *   whose active stack item carries ANY user streamSpec would
+ *   Without this structure, a `_ggui:preview` emission into a render
+ *   whose active render carries ANY user streamSpec would
  *   synthesize a false "Unknown channel" violation, blocking the
  *   provisional preview runtime. Symmetric with the client-side
- *   handling in `GguiSession`.
+ *   handling in `GguiRender`.
  *
  * Crucially narrow by design — the known-reserved path is a CLOSED
  * SET, not a prefix check. A typo inside the reserved namespace
@@ -190,7 +191,7 @@ export function validateContextData(slotName, value, spec, precompiledSlots) {
     return { valid: violations.length === 0, violations };
 }
 /**
- * Validate an inbound user-action payload against the session's ActionSpec.
+ * Validate an inbound user-action payload against the render's ActionSpec.
  *
  * Symmetric with {@link validatePropsData} / {@link validateStreamData}, but for
  * live-channel INBOUND user → core traffic. Enforces the action contract at the
@@ -212,7 +213,7 @@ export function validateContextData(slotName, value, spec, precompiledSlots) {
  */
 export function validateActionData(value, spec, precompiledActions) {
     const violations = [];
-    if (typeof value !== 'object' || value === null || Array.isArray(value)) {
+    if (!isRecord(value)) {
         violations.push({
             field: 'value',
             message: 'Action payload must be an object with an `action` field',
@@ -261,24 +262,25 @@ function getJsonType(value) {
     return typeof value;
 }
 /**
- * Validate an inbound {@link ActionEnvelope} against the target stack
- * item's {@link ActionSpec}. Payload-contract layer of live-channel
- * inbound enforcement — the allowlist gate (`assertEventAllowed` in
- * `@ggui-ai/mcp-server-handlers`) is a separate concern that runs
- * first.
+ * Validate an inbound {@link ActionEnvelope} against the target
+ * render's {@link ActionSpec}. Payload-contract layer of live-channel
+ * inbound enforcement — the ONLY gate on inbound actions today (the
+ * pre-Phase-B `subscription.events` allowlist gate was deleted with
+ * the session-stack collapse).
  *
  * Semantics:
  *   - `envelope.type !== 'data:submit'` → `{valid: true, violations: []}`.
- *     Only action submissions carry payload contract today; other
- *     event types (lifecycle, interaction, error) have no schema
- *     enforcement on this layer.
- *   - `spec === undefined` → `{valid: true, violations: []}`. Stack
- *     items without an actionSpec have no contract; legacy pushes keep
+ *     {@link EventType} has exactly one member, so a TYPED caller never
+ *     hits this branch — it is a wire-trust guard: a rogue client's
+ *     envelope claiming an unknown type string is ledger-only upstream
+ *     and gets no payload enforcement on this layer.
+ *   - `spec === undefined` → `{valid: true, violations: []}`. Renders
+ *     without an actionSpec have no contract; legacy renders keep
  *     flowing.
  *   - Otherwise `envelope.payload` is validated against `spec` via
  *     {@link validateActionData}. Same rules, same output shape.
  *
- * This helper does NOT enforce allowlist, session binding, or stack
+ * This helper does NOT enforce allowlist, render binding, or render
  * routing — those are ingress-plumbing concerns. Pure payload-shape
  * check; returns `ValidationResult` rather than throwing so callers
  * can decide whether to surface as a wire error, log, etc.
@@ -298,7 +300,7 @@ export function validateActionEnvelope(envelope, spec, precompiledActions) {
  *
  * The renderer iframe runs under a strict CSP with no `'unsafe-eval'`,
  * so it cannot call `ajv.compile()` (which builds validators via
- * `new Function`). Compilation therefore happens server-side at push
+ * `new Function`). Compilation therefore happens server-side at render
  * time — where the contract schema is fixed and codegen is legal — and
  * the iframe loads each emitted module via a `blob:` dynamic import.
  *
@@ -369,7 +371,7 @@ export function compileContractValidators(specs) {
  * + Node — the producer's iteration order is preserved, so a given
  * contract always serializes to identical bytes. {@link computeContractBundle}
  * leans on that determinism so the resulting hash is stable across
- * pushes of the same contract.
+ * renders of the same contract.
  *
  * @public
  */
@@ -399,7 +401,7 @@ function canonicalJsonStringify(value) {
     if (Array.isArray(value)) {
         return `[${value.map(canonicalJsonStringify).join(',')}]`;
     }
-    if (typeof value === 'object') {
+    if (isRecord(value)) {
         const keys = Object.keys(value).sort();
         const parts = keys.map((k) => `${JSON.stringify(k)}:${canonicalJsonStringify(value[k])}`);
         return `{${parts.join(',')}}`;
@@ -410,7 +412,7 @@ function canonicalJsonStringify(value) {
 /**
  * Convenience over {@link compileContractValidators} +
  * {@link bundleCompiledValidatorsAsModule} + sha256 — produces the
- * `{contractHash, bundleSource, validators}` triple the emitter (push.ts
+ * `{contractHash, bundleSource, validators}` triple the emitter (render.ts
  * / update.ts in #109 C4) writes to the content-addressable store and
  * emits as `_meta["ai.ggui/contract"] = {contractHash, validatorsUrl}`.
  *
@@ -573,7 +575,7 @@ export function validateContractStructure(contract) {
  * Slot-key identifier check for contextSpec. Slot keys are surfaced
  * as React Context names by the boilerplate generator (`currentStep`
  * → `CurrentStepContext`); a non-identifier here would break the
- * generation step at runtime, so we reject at push-time instead.
+ * generation step at runtime, so we reject at render-time instead.
  */
 const CONTEXT_SLOT_KEY_PATTERN = /^[a-zA-Z_][a-zA-Z0-9_]*$/;
 /**
@@ -582,7 +584,7 @@ const CONTEXT_SLOT_KEY_PATTERN = /^[a-zA-Z_][a-zA-Z0-9_]*$/;
  * context map (e.g., `obj['__proto__'] = …` in pre-frozen
  * environments would mutate the prototype chain rather than set a
  * slot). Defensive — the runtime uses a frozen spec lookup, but the
- * push-time gate keeps the invariant load-bearing for any future
+ * render-time gate keeps the invariant load-bearing for any future
  * implementation that materializes the spec into a plain object.
  */
 const CONTEXT_RESERVED_KEYS = new Set([

package/dist/validation/cross-references.d.ts

@@ -13,7 +13,7 @@
  * own `agentCapabilities.tools` catalog — same-MCP and cross-MCP both
  * funnel through this single resolution path (the catalog is the
  * declarative source of truth for every referenced tool). Violations
- * are author-recoverable at push time.
+ * are author-recoverable at render time.
  */
 import type { DataContract, ActionSpec, StreamSpec, AgentCapabilitiesSpec } from '../types/data-contract';
 import type { ContractViolation } from './contract-validator';
@@ -83,7 +83,7 @@ export declare function checkCrossReferences(contract: DataContract): CrossRefer
 /**
  * Throwable form of {@link checkCrossReferences}. Use at protocol
  * boundaries where an unresolved cross-reference is a contract bug
- * the caller must fix (push handler, blueprint registration).
+ * the caller must fix (render handler, blueprint registration).
  *
  * Carries the full violation list so error renderers can show every
  * dangling reference in one pass instead of fix-and-retry per-field.
@@ -97,7 +97,7 @@ export declare class CrossReferenceError extends Error {
  * Throw-on-violation wrapper around {@link checkCrossReferences}.
  * No-op when the contract is internally consistent.
  *
- * Invoked at handshake AND push time: contract-internal mistakes
+ * Invoked at handshake AND render time: contract-internal mistakes
  * surface at the earliest possible boundary so the agent can fix and
  * retry on the SAME handshakeId.
  */

package/dist/validation/cross-references.js

@@ -13,7 +13,7 @@
  * own `agentCapabilities.tools` catalog — same-MCP and cross-MCP both
  * funnel through this single resolution path (the catalog is the
  * declarative source of truth for every referenced tool). Violations
- * are author-recoverable at push time.
+ * are author-recoverable at render time.
  */
 /**
  * Stable error code emitted when an `actionSpec[*].nextStep` value
@@ -131,7 +131,7 @@ export function checkCrossReferences(contract) {
 /**
  * Throwable form of {@link checkCrossReferences}. Use at protocol
  * boundaries where an unresolved cross-reference is a contract bug
- * the caller must fix (push handler, blueprint registration).
+ * the caller must fix (render handler, blueprint registration).
  *
  * Carries the full violation list so error renderers can show every
  * dangling reference in one pass instead of fix-and-retry per-field.
@@ -152,7 +152,7 @@ export class CrossReferenceError extends Error {
  * Throw-on-violation wrapper around {@link checkCrossReferences}.
  * No-op when the contract is internally consistent.
  *
- * Invoked at handshake AND push time: contract-internal mistakes
+ * Invoked at handshake AND render time: contract-internal mistakes
  * surface at the earliest possible boundary so the agent can fix and
  * retry on the SAME handshakeId.
  */

package/dist/validation/hygiene-rules.d.ts

@@ -102,7 +102,7 @@ export declare const FATAL_CATALOG_LINT_CODES: ReadonlySet<string>;
  *   - `broadcast`     → `streamSpec[ch].source`
  *   - `capabilities`  → `agentCapabilities` + `clientCapabilities`
  *
- * Push-gate handlers re-use this list to hard-reject; surfacing it
+ * Render-gate handlers re-use this list to hard-reject; surfacing it
  * here keeps the wire vocabulary single-sourced.
  */
 export declare const RETIRED_CONTRACT_FIELDS: Readonly<Record<string, string>>;
@@ -147,7 +147,7 @@ export declare function checkOrphanAgentTools(contract: DataContract): HygieneWa
  * is intentionally NOT linted here: `GadgetExportUse.usage` is an
  * OPTIONAL intent-OVERRIDE, and the SPEC-documented canonical wire
  * form is the bare identity reference `gadgets[<pkg>][<export>] = {}`.
- * Push-time resolution inherits the registered descriptor's `usage`,
+ * Render-time resolution inherits the registered descriptor's `usage`,
  * and the registry-side `lintGadgetCatalog` (via
  * `strictGadgetExportSchema`) already enforces real teaching text at
  * registration time. Flagging an empty wire-side use object would
@@ -169,7 +169,7 @@ export declare function checkMissingExample(contract: DataContract): HygieneWarn
  *
  * Third-party packages (any `package !== DEFAULT_GADGET_PACKAGE`) are
  * NOT checked here — the lint can't know an operator's own hook
- * names. The registry-side {@link lintGadgetCatalog} + the push-time
+ * names. The registry-side {@link lintGadgetCatalog} + the render-time
  * {@link assertGadgetsRegistered} gate cover third-party resolution.
  *
  * Permission checks live on the registry-side `lintGadgetCatalog`
@@ -189,9 +189,9 @@ export declare function checkGadgetHookNames(contract: DataContract): HygieneWar
  * imports of the same name — from different packages — produce an
  * unresolvable identifier collision in the generated module scope.
  *
- * Keys on the export name alone, matching the push-time hard gate
+ * Keys on the export name alone, matching the render-time hard gate
  * `assertNoDuplicateGadgetHooks`. Soft mirror of that gate so
- * authoring tools surface the issue before a push round-trip.
+ * authoring tools surface the issue before a render round-trip.
  */
 export declare function checkDuplicateGadgetHooks(contract: DataContract): HygieneWarning[];
 /**
@@ -228,10 +228,10 @@ export declare function lintGadgetCatalog(descriptors: readonly GadgetDescriptor
  * Find top-level retired-field carriers on the contract. The schema
  * is `.passthrough()`, so a stray `libraries`/`dispatch`/`wiredTools`/
  * `clientTools`/`broadcast`/`capabilities` slips through silently. The
- * push-gate hard-rejects these (see
+ * render-gate hard-rejects these (see
  * `mcp-server-handlers/.../assert-contract-no-retired-fields.ts`); this
  * lint surface keeps authoring tools symmetric — show the warning before
- * the push call so the author can fix it without a server round-trip.
+ * the render call so the author can fix it without a server round-trip.
  */
 export declare function checkRetiredContractFields(contract: DataContract): HygieneWarning[];
 /**
@@ -241,11 +241,11 @@ export declare function checkRetiredContractFields(contract: DataContract): Hygi
  * checklist. Retired-field detection is NOT here — it is promoted to an
  * ERROR phase (`phaseRetired` in lint-contract.ts); the detector
  * `checkRetiredContractFields` stays exported for the author-time
- * surface and the push-gate assert.
+ * surface and the render-gate assert.
  *
  * Registry-side gadget lints (`lintGadgetCatalog`) are NOT run here:
  * they need an `App.gadgets` descriptor array, not a contract, and
- * fire at registration time rather than push time.
+ * fire at registration time rather than render time.
  * Call {@link lintGadgetCatalog} separately at the registration
  * boundary.
  */

package/dist/validation/hygiene-rules.js

@@ -109,7 +109,7 @@ export const FATAL_CATALOG_LINT_CODES = new Set([
  *   - `broadcast`     → `streamSpec[ch].source`
  *   - `capabilities`  → `agentCapabilities` + `clientCapabilities`
  *
- * Push-gate handlers re-use this list to hard-reject; surfacing it
+ * Render-gate handlers re-use this list to hard-reject; surfacing it
  * here keeps the wire vocabulary single-sourced.
  */
 export const RETIRED_CONTRACT_FIELDS = {
@@ -124,12 +124,12 @@ export const RETIRED_CONTRACT_FIELDS = {
  * Sourced from {@link STDLIB_GADGET_HOOKS} — the canonical
  * hook-name set the first-party `@ggui-ai/gadgets` package
  * exports. Local alias keeps existing call sites stable while the
- * source of truth lives in `registries/stdlib-gadgets.ts`.
+ * source of truth lives in `gadgets/stdlib-gadgets.ts`.
  */
 const KNOWN_STDLIB_HOOKS = STDLIB_GADGET_HOOKS;
 /**
  * Default package for gadget hooks. Sourced from the
- * stdlib-libraries registry — when an entry's `package` is omitted,
+ * stdlib-gadgets registry — when an entry's `package` is omitted,
  * the hygiene linter assumes it resolves to the first-party
  * `@ggui-ai/gadgets` package and runs hook-registry +
  * permission checks against the stdlib catalog. Third-party packages
@@ -248,7 +248,7 @@ export function checkOrphanAgentTools(contract) {
  * is intentionally NOT linted here: `GadgetExportUse.usage` is an
  * OPTIONAL intent-OVERRIDE, and the SPEC-documented canonical wire
  * form is the bare identity reference `gadgets[<pkg>][<export>] = {}`.
- * Push-time resolution inherits the registered descriptor's `usage`,
+ * Render-time resolution inherits the registered descriptor's `usage`,
  * and the registry-side `lintGadgetCatalog` (via
  * `strictGadgetExportSchema`) already enforces real teaching text at
  * registration time. Flagging an empty wire-side use object would
@@ -307,7 +307,7 @@ export function checkMissingExample(contract) {
  *
  * Third-party packages (any `package !== DEFAULT_GADGET_PACKAGE`) are
  * NOT checked here — the lint can't know an operator's own hook
- * names. The registry-side {@link lintGadgetCatalog} + the push-time
+ * names. The registry-side {@link lintGadgetCatalog} + the render-time
  * {@link assertGadgetsRegistered} gate cover third-party resolution.
  *
  * Permission checks live on the registry-side `lintGadgetCatalog`
@@ -357,9 +357,9 @@ export function checkGadgetHookNames(contract) {
  * imports of the same name — from different packages — produce an
  * unresolvable identifier collision in the generated module scope.
  *
- * Keys on the export name alone, matching the push-time hard gate
+ * Keys on the export name alone, matching the render-time hard gate
  * `assertNoDuplicateGadgetHooks`. Soft mirror of that gate so
- * authoring tools surface the issue before a push round-trip.
+ * authoring tools surface the issue before a render round-trip.
  */
 export function checkDuplicateGadgetHooks(contract) {
     const seen = new Map(); // export name → first package
@@ -516,10 +516,10 @@ export function lintGadgetCatalog(descriptors) {
  * Find top-level retired-field carriers on the contract. The schema
  * is `.passthrough()`, so a stray `libraries`/`dispatch`/`wiredTools`/
  * `clientTools`/`broadcast`/`capabilities` slips through silently. The
- * push-gate hard-rejects these (see
+ * render-gate hard-rejects these (see
  * `mcp-server-handlers/.../assert-contract-no-retired-fields.ts`); this
  * lint surface keeps authoring tools symmetric — show the warning before
- * the push call so the author can fix it without a server round-trip.
+ * the render call so the author can fix it without a server round-trip.
  */
 export function checkRetiredContractFields(contract) {
     // Cast to a generic record so we can probe the keys the passthrough
@@ -534,7 +534,7 @@ export function checkRetiredContractFields(contract) {
         warnings.push({
             code: LINT_CONTRACT_RETIRED_FIELD,
             path: retired,
-            message: `contract.${retired} is retired. Use ${replacement} instead — the field rides through .passthrough() but the push gate hard-rejects it as a structural error.`,
+            message: `contract.${retired} is retired. Use ${replacement} instead — the field rides through .passthrough() but the render gate hard-rejects it as a structural error.`,
             fixHint: `Delete contract.${retired}; move its data to ${replacement}.`,
         });
     }
@@ -547,11 +547,11 @@ export function checkRetiredContractFields(contract) {
  * checklist. Retired-field detection is NOT here — it is promoted to an
  * ERROR phase (`phaseRetired` in lint-contract.ts); the detector
  * `checkRetiredContractFields` stays exported for the author-time
- * surface and the push-gate assert.
+ * surface and the render-gate assert.
  *
  * Registry-side gadget lints (`lintGadgetCatalog`) are NOT run here:
  * they need an `App.gadgets` descriptor array, not a contract, and
- * fire at registration time rather than push time.
+ * fire at registration time rather than render time.
  * Call {@link lintGadgetCatalog} separately at the registration
  * boundary.
  */
@@ -565,6 +565,6 @@ export function checkHygiene(contract) {
         // Retired-field detection is promoted to an ERROR phase
         // (`phaseRetired` in lint-contract.ts) — not a hygiene warning.
         // `checkRetiredContractFields` stays exported for the author-time
-        // surface + the push-gate assert.
+        // surface + the render-gate assert.
     ];
 }

package/dist/validation/is-record.d.ts

@@ -0,0 +1,17 @@
+/**
+ * Validating narrower for the JSON-object shape: is `value` a
+ * non-null, non-array object — the shape every wire frame, request
+ * body, and envelope must satisfy before keyed access?
+ *
+ * One definition for the whole protocol family so every trust
+ * boundary narrows with the SAME predicate — no per-package
+ * duplicates, no per-site `as Record<string, unknown>` casts. Use it
+ * wherever untrusted input (HTTP bodies, wire frames, parsed JSON)
+ * needs to become a `Record<string, unknown>` before field reads:
+ *
+ * ```ts
+ * const body: Record<string, unknown> = isRecord(req.body) ? req.body : {};
+ * ```
+ */
+export declare function isRecord(value: unknown): value is Record<string, unknown>;
+//# sourceMappingURL=is-record.d.ts.map

package/dist/validation/is-record.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"is-record.d.ts","sourceRoot":"","sources":["../../src/validation/is-record.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,QAAQ,CAAC,KAAK,EAAE,OAAO,GAAG,KAAK,IAAI,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAEzE"}

package/dist/validation/is-record.js

@@ -0,0 +1,18 @@
+/**
+ * Validating narrower for the JSON-object shape: is `value` a
+ * non-null, non-array object — the shape every wire frame, request
+ * body, and envelope must satisfy before keyed access?
+ *
+ * One definition for the whole protocol family so every trust
+ * boundary narrows with the SAME predicate — no per-package
+ * duplicates, no per-site `as Record<string, unknown>` casts. Use it
+ * wherever untrusted input (HTTP bodies, wire frames, parsed JSON)
+ * needs to become a `Record<string, unknown>` before field reads:
+ *
+ * ```ts
+ * const body: Record<string, unknown> = isRecord(req.body) ? req.body : {};
+ * ```
+ */
+export function isRecord(value) {
+    return value !== null && typeof value === "object" && !Array.isArray(value);
+}

package/dist/validation/lint-contract.d.ts

@@ -5,7 +5,7 @@
  *
  *   - {@link validateContract} — strict; runs phased validation and
  *     throws {@link ContractValidationError} on the FIRST phase that
- *     produces errors. Used at every protocol boundary (push handler,
+ *     produces errors. Used at every protocol boundary (render handler,
  *     blueprint registration, future synth output gate).
  *
  *   - {@link lintContract} — graded; runs ALL phases unconditionally

package/dist/validation/lint-contract.js

@@ -5,7 +5,7 @@
  *
  *   - {@link validateContract} — strict; runs phased validation and
  *     throws {@link ContractValidationError} on the FIRST phase that
- *     produces errors. Used at every protocol boundary (push handler,
+ *     produces errors. Used at every protocol boundary (render handler,
  *     blueprint registration, future synth output gate).
  *
  *   - {@link lintContract} — graded; runs ALL phases unconditionally
@@ -103,7 +103,7 @@ function zodIssueCode(zodCode) {
  * (an LLM correctly re-nests `wiredTools` → `agentCapabilities.tools`),
  * and `ggui_render`'s override path rejects it. Shares the one detector
  * (`checkRetiredContractFields`) with the author-time surface + the
- * push-gate assert, so the retired vocabulary can't drift across sites.
+ * render-gate assert, so the retired vocabulary can't drift across sites.
  */
 function phaseRetired(contract) {
     return checkRetiredContractFields(contract).map((w) => ({
@@ -123,7 +123,7 @@ function phaseRetired(contract) {
  * under Ajv strict mode. Distinct from phase-1 shape: zod validates the
  * WRAPPER shape, but the wrapped JSON Schema rides through
  * `.passthrough()` unvalidated. Runs before references / schema-compat,
- * which read these schemas. This is the check the push/handshake assert
+ * which read these schemas. This is the check the render/handshake assert
  * set had that `validateContract` was previously missing — folding it in
  * here is what makes the strict gate complete (and therefore safe to use
  * as the single boundary gate).

package/dist/validation/name-invariants.d.ts

@@ -41,7 +41,7 @@ import type { ContractViolation } from './contract-validator';
  * Stable error code for collisions across the three inbound spec maps
  * (`actionSpec` / `streamSpec` / `contextSpec`). The boilerplate
  * generator emits identifiers from these keys; a collision is an
- * author bug that the protocol catches at push.
+ * author bug that the protocol catches at render.
  */
 export declare const CTR_DUP_NAME = "CTR_DUP_NAME";
 /**
@@ -72,7 +72,7 @@ export declare function checkNameCollisions(contract: DataContract): NameInvaria
  * Validate that no `actionSpec` or `contextSpec` key uses the
  * `_ggui:` reserved namespace. `streamSpec` reserved-channel rejection
  * lives in `validateContractStructure` (the reserved namespace there
- * carries server-side semantics like the `_ggui:contract-error`
+ * carries server-side semantics like the `_ggui:lifecycle`
  * channel); this invariant extends the rule uniformly across the
  * other two inbound spec maps.
  *
@@ -93,7 +93,7 @@ export declare function checkNameInvariants(contract: DataContract): NameInvaria
 /**
  * Throwable form of {@link checkNameInvariants}. Use at protocol
  * boundaries where a name collision or reserved-namespace use is a
- * contract bug the caller must fix (push handler, blueprint
+ * contract bug the caller must fix (render handler, blueprint
  * registration).
  *
  * Carries the full violation list so error renderers can show every
@@ -108,7 +108,7 @@ export declare class NameInvariantError extends Error {
  * Throw-on-violation wrapper around {@link checkNameInvariants}.
  * No-op when the contract's names are consistent.
  *
- * Designed to slot alongside `assertCrossReferences` at push time:
+ * Designed to slot alongside `assertCrossReferences` at render time:
  * cross-reference invariants catch dangling pointers between specs;
  * name invariants catch malformed name spaces within specs. Both
  * surface author-recoverable failures before any state mutation.