@ggui-ai/protocol 0.7.0 → 0.9.0

package/dist/gadgets/stdlib-gadgets.d.ts

@@ -12,7 +12,7 @@ export declare const STDLIB_GADGETS_PACKAGE = "@ggui-ai/gadgets";
  * in `@ggui-ai/gadgets` asserts the two stay in sync, so a release-time
  * bump to the runtime package without updating this constant fails CI.
  */
-export declare const STDLIB_GADGETS_VERSION = "0.7.0";
+export declare const STDLIB_GADGETS_VERSION = "0.9.0";
 /**
  * v1 catalog of stdlib gadget descriptors. Every entry's
  * `package` defaults to {@link STDLIB_GADGETS_PACKAGE}; the

package/dist/gadgets/stdlib-gadgets.js

@@ -39,7 +39,7 @@ export const STDLIB_GADGETS_PACKAGE = '@ggui-ai/gadgets';
  * in `@ggui-ai/gadgets` asserts the two stay in sync, so a release-time
  * bump to the runtime package without updating this constant fails CI.
  */
-export const STDLIB_GADGETS_VERSION = '0.7.0';
+export const STDLIB_GADGETS_VERSION = '0.9.0';
 /**
  * v1 catalog of stdlib gadget descriptors. Every entry's
  * `package` defaults to {@link STDLIB_GADGETS_PACKAGE}; the

package/dist/integrations/epoch-uri.d.ts

@@ -0,0 +1,42 @@
+/**
+ * Epoch-pinned resource URIs (#483).
+ *
+ * A session's history is a linear chain of epoch-numbered render
+ * records: `ggui_render` mints epoch 0; every `ggui_update` advances
+ * the head by one (`ggui_amend` never does). The epoch rides the
+ * resource URI:
+ *
+ *   - **Bare URI** (`ui://ggui/render/<sessionId>[/<contractKey>]`) —
+ *     the LIVE HEAD. Reads track the session's current state.
+ *   - **Pinned URI** (`…#N`) — the immutable epoch-N record. Reads
+ *     MUST serve identical content forever (conformance-pinned).
+ *
+ * This module is the ONE encoding seam: every producer (result-meta
+ * stamping, resource templates) and consumer (iframe-runtime latch,
+ * pinned reads) routes through these two functions, so the encoding
+ * (URI fragment today) can flip to a path segment after the
+ * host-transport probe without touching call sites. Do not hand-roll
+ * `#${n}` anywhere else.
+ */
+export declare const EPOCH_URI_SEPARATOR = "#";
+/**
+ * Compose the pinned URI for an epoch. Throws on non-integer or
+ * negative epochs — a producer stamping a bogus epoch is a bug that
+ * must be loud, not a tolerable wire variant.
+ */
+export declare function composeEpochUri(baseUri: string, epoch: number): string;
+export interface ParsedEpochUri {
+    /** The URI with any epoch pin removed — the live-head address. */
+    readonly baseUri: string;
+    /** Present iff the URI carried a well-formed epoch pin. */
+    readonly epoch?: number;
+}
+/**
+ * Tolerant read — never throws. A malformed suffix (non-canonical
+ * number, leading zeros, empty) is NOT an epoch: the whole input
+ * passes through as `baseUri` so an exotic-but-legal URI is never
+ * mangled by mis-parsing. Canonical epochs only: `0` or a digit
+ * string with no leading zero.
+ */
+export declare function parseEpochUri(uri: string): ParsedEpochUri;
+//# sourceMappingURL=epoch-uri.d.ts.map

package/dist/integrations/epoch-uri.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"epoch-uri.d.ts","sourceRoot":"","sources":["../../src/integrations/epoch-uri.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;GAmBG;AACH,eAAO,MAAM,mBAAmB,MAAM,CAAC;AAEvC;;;;GAIG;AACH,wBAAgB,eAAe,CAAC,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,MAAM,CAKtE;AAED,MAAM,WAAW,cAAc;IAC7B,kEAAkE;IAClE,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,2DAA2D;IAC3D,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC;CACzB;AAED;;;;;;GAMG;AACH,wBAAgB,aAAa,CAAC,GAAG,EAAE,MAAM,GAAG,cAAc,CAMzD"}

package/dist/integrations/epoch-uri.js

@@ -0,0 +1,48 @@
+/**
+ * Epoch-pinned resource URIs (#483).
+ *
+ * A session's history is a linear chain of epoch-numbered render
+ * records: `ggui_render` mints epoch 0; every `ggui_update` advances
+ * the head by one (`ggui_amend` never does). The epoch rides the
+ * resource URI:
+ *
+ *   - **Bare URI** (`ui://ggui/render/<sessionId>[/<contractKey>]`) —
+ *     the LIVE HEAD. Reads track the session's current state.
+ *   - **Pinned URI** (`…#N`) — the immutable epoch-N record. Reads
+ *     MUST serve identical content forever (conformance-pinned).
+ *
+ * This module is the ONE encoding seam: every producer (result-meta
+ * stamping, resource templates) and consumer (iframe-runtime latch,
+ * pinned reads) routes through these two functions, so the encoding
+ * (URI fragment today) can flip to a path segment after the
+ * host-transport probe without touching call sites. Do not hand-roll
+ * `#${n}` anywhere else.
+ */
+export const EPOCH_URI_SEPARATOR = '#';
+/**
+ * Compose the pinned URI for an epoch. Throws on non-integer or
+ * negative epochs — a producer stamping a bogus epoch is a bug that
+ * must be loud, not a tolerable wire variant.
+ */
+export function composeEpochUri(baseUri, epoch) {
+    if (!Number.isInteger(epoch) || epoch < 0) {
+        throw new Error(`epoch must be a non-negative integer, got ${epoch}`);
+    }
+    return `${baseUri}${EPOCH_URI_SEPARATOR}${epoch}`;
+}
+/**
+ * Tolerant read — never throws. A malformed suffix (non-canonical
+ * number, leading zeros, empty) is NOT an epoch: the whole input
+ * passes through as `baseUri` so an exotic-but-legal URI is never
+ * mangled by mis-parsing. Canonical epochs only: `0` or a digit
+ * string with no leading zero.
+ */
+export function parseEpochUri(uri) {
+    const idx = uri.lastIndexOf(EPOCH_URI_SEPARATOR);
+    if (idx < 0)
+        return { baseUri: uri };
+    const suffix = uri.slice(idx + 1);
+    if (!/^(0|[1-9][0-9]*)$/.test(suffix))
+        return { baseUri: uri };
+    return { baseUri: uri.slice(0, idx), epoch: Number(suffix) };
+}

package/dist/integrations/mcp-apps.d.ts

@@ -49,6 +49,7 @@ export declare const GGUI_RENDER_RESOURCE_URI: "ui://ggui/render";
  * render them as plain HTML.
  */
 export declare const GGUI_RENDER_RESOURCE_MIME: "text/html;profile=mcp-app";
+export { composeEpochUri, parseEpochUri, EPOCH_URI_SEPARATOR, type ParsedEpochUri, } from './epoch-uri.js';
 /**
  * The single `_meta.ui.resourceUri` value ggui uses across every MCP Apps
  * host surface. Exposed as a named constant so tool-declaration code,
@@ -192,16 +193,50 @@ export interface McpAppContextSlot {
  * WS auth credential the iframe threads on the WebSocket upgrade as
  * `?wsToken=<encoded>` and inside `SubscribePayload.wsToken`.
  *
- * **Polling-fallback URL.** When WS is blocked at the host CSP layer
- * the iframe polls `pollingUrl` (server-stamped post-Phase-B as
- * `/api/sessions/<sessionId>/events?wsToken=<token>`). The iframe-runtime
- * composes per-tick `&sinceSequence=<cursor>&limit=<N>` against this
- * base; companion to `lastSequence` which seeds the initial cursor.
- *
- * **Mode discriminator.** At least one of `{ codeUrl, kind, wsUrl-with-token }`
- * MUST be present for the iframe to mount. `kind` and `codeUrl` are
- * mutually exclusive (kind = system-card mode; codeUrl = static-component
- * mode; live-channel = absent both).
+ * **Failover ladder (WS → SSE → polling).** `sseUrl` and `pollingUrl`
+ * are the two HTTP fallback rungs the iframe-runtime descends when the
+ * WS rung fails (host CSP block, proxy, network policy). Both are
+ * stamped by the SERVER via {@link composeSessionApiUrls} — one
+ * composer for every stamping surface — and consumed by the
+ * IFRAME-RUNTIME. Auth for both is the embedded `wsToken` query
+ * credential (`EventSource` cannot set request headers, so the query
+ * string is the only channel — same posture on both rungs), which is
+ * why each URL is stamped ONLY when the live trio was minted.
+ * Absence semantics: `sseUrl` absent ⇒ no SSE rung (ladder is
+ * WS → polling); `pollingUrl` absent ⇒ no polling rung.
+ *
+ * `pollingUrl` (server-stamped
+ * `/api/sessions/<sessionId>/events?wsToken=<token>`): the
+ * iframe-runtime composes per-tick `&sinceSequence=<cursor>&limit=<N>`
+ * against this base; companion to `lastSequence` which seeds the
+ * initial cursor.
+ *
+ * `sseUrl` (server-stamped
+ * `/api/sessions/<sessionId>/stream?wsToken=<token>`): consumed via
+ * `EventSource`. Server obligations — the endpoint serves
+ * `text/event-stream` where each SSE message's `data:` is EXACTLY one
+ * ChannelFrame JSON (`{type, payload}` — byte-same shape as the WS
+ * push); a message's `id:` is the decimal event-ledger `seq` (the SAME
+ * cursor space as `lastSequence`/`sinceSequence`), stamped ONLY on
+ * ledger-backed `render_event` replay frames — live frames are id-less
+ * (same ephemeral posture as WS) — so the browser's automatic
+ * `Last-Event-ID` reconnect header IS the existing cursor replay; the
+ * server emits a comment heartbeat (`: hb`, no `id:`) at least every
+ * ~25s (proxy/ALB idle-timeout floor) and `retry: 3000` as the first
+ * write after headers. Client obligations — append
+ * `&sinceSequence=<lastSequence>` on FIRST connect (before any
+ * `Last-Event-ID` exists); on reconnect the header WINS over the
+ * query. Failure modes mirror `/events`: 401 invalid token; 404
+ * evicted → stop; 410 expired / `REPLAY_HORIZON_PASSED` →
+ * re-bootstrap (the horizon violation is an in-band error frame
+ * carrying `resumeId: String(lastSequence)`, so the browser cursor
+ * advances and the ack snapshot re-mounts state).
+ *
+ * **Mode discriminator.** At least one of `{ codeUrl, codeB64, kind,
+ * wsUrl-with-token }` MUST be present for the iframe to mount. `kind` is
+ * mutually exclusive with `codeUrl`/`codeB64` (kind = system-card mode;
+ * codeUrl/codeB64 = static-component mode, fetched vs inline;
+ * live-channel = absent all).
  *
  * @public
  */
@@ -213,6 +248,7 @@ export interface McpAppAiGguiRenderMeta {
     readonly wsToken?: string;
     readonly expiresAt?: string;
     readonly pollingUrl?: string;
+    readonly sseUrl?: string;
     readonly themeId?: string;
     readonly themeMode?: 'light' | 'dark';
     /**
@@ -238,12 +274,34 @@ export interface McpAppAiGguiRenderMeta {
      * from a cursor.
      */
     readonly lastSequence?: number;
+    /**
+     * History head epoch this mount belongs to (#483, SPEC §7.1.2.2).
+     * `ggui_render` mints epoch 0; each `ggui_update` result carries its
+     * new epoch; a pinned `#N` read carries N. The iframe reads it at
+     * boot as its OWN epoch: when a later `props_update` frame carries a
+     * HIGHER epoch, this mount has been superseded and freezes (the
+     * freeze latch). Absent ⇒ 0.
+     */
+    readonly epoch?: number;
     readonly propsJson?: string;
     readonly contextSlots?: ReadonlyArray<McpAppContextSlot>;
     readonly contractHash?: string;
     readonly validatorsUrl?: string;
     readonly codeUrl?: string;
     readonly codeHash?: string;
+    /**
+     * Base64-encoded compiled ES-module source of the component — the
+     * fetch-free twin of {@link codeUrl}. Produced by servers whose
+     * renders must mount inside hosts that forbid cross-origin fetches
+     * at the iframe CSP layer (no `connect-src`, no external
+     * `script-src`); consumed by the iframe-runtime's seed builder,
+     * which decodes it instead of fetching. MAY coexist with `codeUrl`
+     * (a consumer prefers the inline bytes; the URL remains for
+     * cache-addressable consumers); mutually exclusive with `kind`.
+     * Malformed base64 fails at decode time as a boot failure — the
+     * parser here validates shape only (non-empty string).
+     */
+    readonly codeB64?: string;
     readonly kind?: string;
 }
 /**
@@ -282,6 +340,39 @@ export declare function parseMcpAppAiGguiRenderMeta(meta: unknown): ParseMcpAppA
  * @public
  */
 export declare function toMcpAppEnvelope(render: McpAppAiGguiRenderMeta): Record<string, unknown>;
+/**
+ * Token-bearing session-API URL pair — the return shape of
+ * {@link composeSessionApiUrls}. Field names deliberately match the
+ * {@link McpAppAiGguiRenderMeta} slice fields they stamp, so callers
+ * spread the pair straight into a slice literal.
+ *
+ * @public
+ */
+export interface SessionApiUrls {
+    /** `${base}/api/sessions/<sessionId>/events?wsToken=<token>` */
+    readonly pollingUrl: string;
+    /** `${base}/api/sessions/<sessionId>/stream?wsToken=<token>` */
+    readonly sseUrl: string;
+}
+/**
+ * Compose the token-bearing session-API URL pair — ONE composer for
+ * every stamping surface (render resultMeta, update resultMeta, the
+ * self-contained shell, the `/api/sessions/:id/state` bootstrap). Same
+ * move as `deriveRenderMeta`: because every surface routes through this
+ * function, cross-transport drift in the URL shapes is structurally
+ * impossible.
+ *
+ * Pure string composition, no I/O. `base` is the absolute public
+ * origin the session API is served on (a trailing `/` is tolerated and
+ * stripped); `sessionId` and `wsToken` are URL-encoded into path and
+ * query. Callers MUST invoke this only when the live trio was minted —
+ * both URLs embed the token, and a token-less URL can only 401 through
+ * the fallback composers; omission of both fields is the honest
+ * no-HTTP-fallback signal the slice contract defines.
+ *
+ * @public
+ */
+export declare function composeSessionApiUrls(base: string, sessionId: string, wsToken: string): SessionApiUrls;
 /**
  * `_meta` key carrying host-supplied conversation-grouping metadata on
  * every inbound `tools/call` request. Captured ONCE on the first call
@@ -451,6 +542,13 @@ export interface McpAppsGguiSession {
     readonly type: 'mcpApps';
     readonly id: string;
     readonly createdAt: string;
+    /**
+     * History head epoch (#483) — same semantics as
+     * `GguiSessionBase.epoch` (absent ⇒ 0; advanced only by
+     * `ggui_update`). Declared here too because this variant does not
+     * extend the base.
+     */
+    readonly epoch?: number;
     readonly prompt?: string;
     readonly description?: string;
     readonly message?: string;
@@ -982,7 +1080,39 @@ export interface GguiShellHtmlOptions {
      *     iframe and accept the Safari canvas-color trade-off.
      */
     readonly background?: 'surface' | 'transparent';
+    /**
+     * Full source text of the iframe-runtime bundle to embed as an
+     * inline `<script type="module">` in place of the external
+     * `src={runtimeUrl}` tag. For hosts whose iframe CSP forbids
+     * external `script-src` while permitting inline scripts — the
+     * external tag can never load there, so the shell carries the
+     * runtime in its own bytes.
+     *
+     * The source is embedded via {@link escapeInlineScript}; see its
+     * contract for the (esbuild-bundle-safe) escaping guarantee. The
+     * bootstrap's `runtimeUrl` stays REQUIRED and stays on the inlined
+     * meta — the runtime's boot validator requires it across all modes;
+     * with this option set it is informational rather than fetched.
+     */
+    readonly runtimeInlineSource?: string;
 }
+/**
+ * Make raw JS source safe to embed as the text content of an HTML
+ * `<script>` element.
+ *
+ * The HTML parser terminates script data at the first
+ * case-insensitive `</script` and shifts parse state on `<!--`; both
+ * sequences are rewritten with a backslash (`<\/script`, `<\!--`).
+ * Inside JS string, template, and regex literals — the only positions
+ * these byte sequences occur in a well-formed bundled module (a bare
+ * `<!--` outside a literal is a SyntaxError in module code; a bare
+ * `</` cannot follow an expression) — `\/` and `\!` are identity
+ * escapes, so the escaped source evaluates identically to the
+ * original.
+ *
+ * @public
+ */
+export declare function escapeInlineScript(source: string): string;
 /**
  * Build the ggui **self-contained shell** for a render bootstrap.
  *

package/dist/integrations/mcp-apps.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"mcp-apps.d.ts","sourceRoot":"","sources":["../../src/integrations/mcp-apps.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AAEH,OAAO,KAAK,EACV,UAAU,EACV,UAAU,EACV,SAAS,EACV,MAAM,2BAA2B,CAAC;AACnC,OAAO,EAAkB,KAAK,QAAQ,EAAE,MAAM,yBAAyB,CAAC;AAGxE;;;;GAIG;AACH,eAAO,MAAM,sBAAsB,EAAG,4BAAqC,CAAC;AAE5E;;;;;GAKG;AACH,eAAO,MAAM,wBAAwB,EAAG,kBAA2B,CAAC;AAEpE;;;;;GAKG;AACH,eAAO,MAAM,yBAAyB,EAAG,2BAAoC,CAAC;AAE9E;;;;GAIG;AACH,eAAO,MAAM,mBAAmB;IAC9B,kFAAkF;;IAElF,kEAAkE;;CAE1D,CAAC;AAEX;;;;;GAKG;AACH,MAAM,MAAM,qBAAqB,GAAG,OAAO,GAAG,KAAK,CAAC;AAEpD;;;;;;;;;GASG;AAEH;;;;;;;;;;;GAWG;AACH,MAAM,WAAW,0BAA0B;IACzC,sEAAsE;IACtE,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC;IACxB;;;OAGG;IACH,QAAQ,CAAC,OAAO,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;IACpD;;;OAGG;IACH,QAAQ,CAAC,OAAO,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;IACpD;;;OAGG;IACH,QAAQ,CAAC,OAAO,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;CACrD;AAED;;;;;;;;;;;;GAYG;AACH,wBAAgB,iBAAiB,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,CAGzD;AA0CD;;;;;;;GAOG;AACH,eAAO,MAAM,+BAA+B,EAAG,gBAAyB,CAAC;AAEzE;;;;;;;GAOG;AACH,MAAM,WAAW,eAAe;IAC9B;;;oEAGgE;IAChE,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB;;mEAE+D;IAC/D,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC;IAC5B;;;yDAGqD;IACrD,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC;CAC7B;AAED;;;;;;GAMG;AACH,MAAM,WAAW,iBAAiB;IAChC,6DAA6D;IAC7D,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB;yDACqD;IACrD,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B;4EACwE;IACxE,QAAQ,CAAC,MAAM,EAAE,UAAU,CAAC;IAC5B,8DAA8D;IAC9D,QAAQ,CAAC,OAAO,EAAE,SAAS,CAAC;IAC5B;uEACmE;IACnE,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAC;CAC9B;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AACH,MAAM,WAAW,sBAAsB;IAGrC,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAG5B,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC;IAI5B,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAC;IAG7B,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,SAAS,CAAC,EAAE,OAAO,GAAG,MAAM,CAAC;IACtC;;;;;;;OAOG;IACH,QAAQ,CAAC,KAAK,CAAC,EAAE,QAAQ,CAAC;IAG1B,QAAQ,CAAC,OAAO,CAAC,EAAE,aAAa,CAAC,eAAe,CAAC,CAAC;IAClD,QAAQ,CAAC,SAAS,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;IACtD,QAAQ,CAAC,yBAAyB,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IACvD,QAAQ,CAAC,iBAAiB,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IAE/C;;;;;;;;OAQG;IACH,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM,CAAC;IAG/B,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,YAAY,CAAC,EAAE,aAAa,CAAC,iBAAiB,CAAC,CAAC;IAMzD,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM,CAAC;IAC/B,QAAQ,CAAC,aAAa,CAAC,EAAE,MAAM,CAAC;IAMhC,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC;CACxB;AAED;;;;;;;;;GASG;AACH,MAAM,MAAM,iCAAiC,GACzC;IAAE,QAAQ,CAAC,EAAE,EAAE,IAAI,CAAC;IAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,sBAAsB,CAAA;CAAE,GAC7D;IAAE,QAAQ,CAAC,EAAE,EAAE,KAAK,CAAC;IAAC,QAAQ,CAAC,MAAM,EAAE,kBAAkB,CAAA;CAAE,CAAC;AAEhE;;;;;;;;;;GAUG;AACH,wBAAgB,2BAA2B,CACzC,IAAI,EAAE,OAAO,GACZ,iCAAiC,CAuInC;AAED;;;;;GAKG;AACH,wBAAgB,gBAAgB,CAC9B,MAAM,EAAE,sBAAsB,GAC7B,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAIzB;AAYD;;;;;;;;;;;;;GAaG;AACH,eAAO,MAAM,qCAAqC,EAAG,sBAA+B,CAAC;AAErF;;;;;;;;;;;;;;;GAeG;AACH,MAAM,WAAW,2BAA2B;IAC1C;;;;OAIG;IACH,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B;;;;OAIG;IACH,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;CAChC;AAED;;;;;;;;;;;;;;GAcG;AACH,MAAM,MAAM,sCAAsC,GAC9C;IAAE,QAAQ,CAAC,EAAE,EAAE,IAAI,CAAC;IAAC,QAAQ,CAAC,WAAW,CAAC,EAAE,2BAA2B,CAAA;CAAE,GACzE;IAAE,QAAQ,CAAC,EAAE,EAAE,KAAK,CAAC;IAAC,QAAQ,CAAC,MAAM,EAAE,wBAAwB,CAAA;CAAE,CAAC;AAEtE;;;;;;;GAOG;AACH,wBAAgB,gCAAgC,CAC9C,IAAI,EAAE,OAAO,GACZ,sCAAsC,CA2BxC;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,WAAW,sBAAsB;IACrC,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,aAAa,CAAC,EAAE,MAAM,CAAC;IAChC,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,cAAc,EAAE,MAAM,CAAC;IAChC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,gBAAgB,CAAC,EAAE,MAAM,CAAC;CACpC;AAMD;;;GAGG;AACH,MAAM,WAAW,UAAU;IACzB,QAAQ,CAAC,cAAc,CAAC,EAAE,MAAM,EAAE,CAAC;IACnC,QAAQ,CAAC,eAAe,CAAC,EAAE,MAAM,EAAE,CAAC;IACpC,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM,EAAE,CAAC;CAClC;AAED;;;GAGG;AACH,MAAM,WAAW,kBAAkB;IACjC,QAAQ,CAAC,MAAM,CAAC,EAAE,OAAO,CAAC;IAC1B,QAAQ,CAAC,UAAU,CAAC,EAAE,OAAO,CAAC;IAC9B,QAAQ,CAAC,WAAW,CAAC,EAAE,OAAO,CAAC;IAC/B,QAAQ,CAAC,cAAc,CAAC,EAAE,OAAO,CAAC;CACnC;AAED;;;GAGG;AACH,MAAM,WAAW,0BAA0B;IACzC,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;CAC5B;AAED;;;;;;GAMG;AACH,MAAM,WAAW,aAAa;IAC5B,oEAAoE;IACpE,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B;gCAC4B;IAC5B,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B;iCAC6B;IAC7B,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;CAC9B;AAED;;;;;;;;;;;;;;GAcG;AACH,MAAM,WAAW,kBAAkB;IACjC,gDAAgD;IAChD,QAAQ,CAAC,IAAI,EAAE,SAAS,CAAC;IAGzB,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;IACpB,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAC;IAC9B,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC;IAG1B,QAAQ,CAAC,MAAM,EAAE,aAAa,CAAC;IAC/B,QAAQ,CAAC,GAAG,CAAC,EAAE,UAAU,CAAC;IAC1B,QAAQ,CAAC,WAAW,CAAC,EAAE,kBAAkB,CAAC;IAC1C,QAAQ,CAAC,mBAAmB,CAAC,EAAE,0BAA0B,CAAC;IAE1D;;;;;OAKG;IACH,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM,CAAC;IAE/B;;;;;OAKG;IACH,QAAQ,CAAC,eAAe,CAAC,EAAE,MAAM,CAAC;IAOlC,QAAQ,CAAC,aAAa,CAAC,EAAE,KAAK,CAAC;IAC/B,QAAQ,CAAC,KAAK,CAAC,EAAE,KAAK,CAAC;IACvB,QAAQ,CAAC,WAAW,CAAC,EAAE,KAAK,CAAC;IAC7B,QAAQ,CAAC,MAAM,CAAC,EAAE,KAAK,CAAC;IACxB,QAAQ,CAAC,YAAY,CAAC,EAAE,KAAK,CAAC;IAC9B,QAAQ,CAAC,YAAY,CAAC,EAAE,KAAK,CAAC;IAC9B,QAAQ,CAAC,OAAO,CAAC,EAAE,KAAK,CAAC;IACzB,QAAQ,CAAC,OAAO,CAAC,EAAE,KAAK,CAAC;IACzB,QAAQ,CAAC,KAAK,CAAC,EAAE,KAAK,CAAC;IACvB,QAAQ,CAAC,UAAU,CAAC,EAAE,KAAK,CAAC;IAC5B,QAAQ,CAAC,SAAS,CAAC,EAAE,KAAK,CAAC;IAC3B,QAAQ,CAAC,UAAU,CAAC,EAAE,KAAK,CAAC;IAC5B,QAAQ,CAAC,WAAW,CAAC,EAAE,KAAK,CAAC;IAC7B,QAAQ,CAAC,kBAAkB,CAAC,EAAE,KAAK,CAAC;CACrC;AAED;;;GAGG;AACH,wBAAgB,oBAAoB,CAAC,KAAK,EAAE,OAAO,GAAG,KAAK,IAAI,kBAAkB,CAMhF;AAED;;;;;;GAMG;AACH,wBAAgB,0BAA0B,CACxC,KAAK,EAAE,OAAO,GACb,kBAAkB,GAAG,IAAI,CAE3B;AAwCD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4CG;AACH,MAAM,MAAM,oBAAoB,GAC5B,UAAU,GACV,YAAY,GACZ,OAAO,GACP,cAAc,CAAC;AAEnB;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,MAAM,WAAW,oBAAoB;IACnC,QAAQ,CAAC,KAAK,EAAE,oBAAoB,CAAC;IACrC,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,KAAK,CAAC,EAAE;QACf,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;QACtB,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;KAC1B,CAAC;CACH;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAwDG;AACH,MAAM,WAAW,sBAAsB;IACrC,QAAQ,CAAC,IAAI,EAAE,gBAAgB,CAAC;IAChC,QAAQ,CAAC,KAAK,EAAE,oBAAoB,CAAC;CACtC;AAED;;;;;;GAMG;AACH,eAAO,MAAM,wBAAwB,EAAE,SAAS,oBAAoB,EAK1D,CAAC;AAEX;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,wBAAwB,CACtC,OAAO,EAAE,OAAO,GACf,OAAO,IAAI,sBAAsB,CA2BnC;AA4BD,6EAA6E;AAC7E,eAAO,MAAM,2BAA2B,wBAAwB,CAAC;AAEjE,0EAA0E;AAC1E,eAAO,MAAM,6BAA6B,0BAA0B,CAAC;AAErE,uEAAuE;AACvE,eAAO,MAAM,oBAAoB,iBAAiB,CAAC;AAEnD;;;;GAIG;AACH,eAAO,MAAM,sBAAsB,EAAE,sBAAsB,CAAC,MAAM,CAChD,CAAC;AAEnB;;;;;GAKG;AACH,MAAM,WAAW,0BAA0B;IACzC,QAAQ,CAAC,IAAI,EAAE,OAAO,2BAA2B,CAAC;IAClD,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;CAC1B;AAED;;;;;;;GAOG;AACH,MAAM,WAAW,4BAA4B;IAC3C,QAAQ,CAAC,IAAI,EAAE,OAAO,6BAA6B,CAAC;IACpD,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;CAC1B;AAMD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAkCG;AACH,MAAM,MAAM,gBAAgB,GACxB,UAAU,GACV,UAAU,GACV,oBAAoB,GACpB,CAAC,MAAM,GAAG,EAAE,CAAC,CAAC;AAElB;;;;;;;;;GASG;AACH,MAAM,MAAM,oBAAoB,GAC5B;IACE,QAAQ,CAAC,IAAI,EAAE,UAAU,CAAC;IAC1B,QAAQ,CAAC,OAAO,EAAE;QAChB,yDAAyD;QACzD,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;QACxB;;;WAGG;QACH,QAAQ,CAAC,UAAU,EAAE,SAAS,GAAG,IAAI,CAAC;QACtC;;;;;;;;;WASG;QACH,QAAQ,CAAC,SAAS,EAAE,UAAU,CAAC;KAChC,CAAC;CACH,GACD;IACE,QAAQ,CAAC,IAAI,EAAE,UAAU,CAAC;IAC1B,QAAQ,CAAC,OAAO,EAAE;QAAE,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAA;KAAE,CAAC;CAC5C,GACD;IACE,QAAQ,CAAC,IAAI,EAAE,oBAAoB,CAAC;IACpC,QAAQ,CAAC,OAAO,EAAE;QAChB,QAAQ,CAAC,IAAI,EAAE,YAAY,GAAG,KAAK,GAAG,QAAQ,GAAG,CAAC,MAAM,GAAG,EAAE,CAAC,CAAC;KAChE,CAAC;CACH,GACD;IACE,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CAC3C,CAAC;AAEN;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAyCG;AACH,MAAM,MAAM,qBAAqB,GAAG,oBAAoB,GAAG;IACzD,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;CAC1B,CAAC;AAEF;;;;GAIG;AACH,eAAO,MAAM,mBAAmB,yDAIgB,CAAC;AAEjD;;;;;;;;;;;GAWG;AACH,wBAAgB,uBAAuB,CACrC,KAAK,EAAE,OAAO,GACb,KAAK,IAAI,qBAAqB,CAoChC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAwCG;AACH,MAAM,WAAW,kBAAkB;IACjC,QAAQ,CAAC,IAAI,EAAE,aAAa,CAAC;IAC7B,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,QAAQ,EAAE;QACjB,QAAQ,CAAC,IAAI,EAAE,cAAc,CAAC;QAC9B,QAAQ,CAAC,IAAI,EAAE;YAAE,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAA;SAAE,CAAC;KAC/C,CAAC;CACH;AAmCD;;;;;;;;;;;;;GAaG;AACH,MAAM,WAAW,mBAAmB;IAClC,uEAAuE;IACvE,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,wDAAwD;IACxD,QAAQ,CAAC,KAAK,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;CACnD;AAkBD;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,qBAAqB,CACnC,IAAI,EAAE,OAAO,GACZ,mBAAmB,GAAG,SAAS,CAUjC;AAED;;;;;;;;;;;GAWG;AACH,wBAAgB,oBAAoB,CAClC,MAAM,EAAE,OAAO,GACd,mBAAmB,GAAG,SAAS,CAGjC;AAED;;;;;;;;GAQG;AACH,eAAO,MAAM,yBAAyB,uCAAuC,CAAC;AAE9E;;;;GAIG;AACH,MAAM,WAAW,oBAAoB;IACnC;;;;;;;;;;;;OAYG;IACH,QAAQ,CAAC,UAAU,CAAC,EAAE,SAAS,GAAG,aAAa,CAAC;CACjD;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+BG;AACH,wBAAgB,aAAa,CAC3B,SAAS,EAAE,mBAAmB,EAC9B,OAAO,CAAC,EAAE,oBAAoB,GAC7B,MAAM,CAiCR"}
+{"version":3,"file":"mcp-apps.d.ts","sourceRoot":"","sources":["../../src/integrations/mcp-apps.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AAEH,OAAO,KAAK,EACV,UAAU,EACV,UAAU,EACV,SAAS,EACV,MAAM,2BAA2B,CAAC;AACnC,OAAO,EAAkB,KAAK,QAAQ,EAAE,MAAM,yBAAyB,CAAC;AAGxE;;;;GAIG;AACH,eAAO,MAAM,sBAAsB,EAAG,4BAAqC,CAAC;AAE5E;;;;;GAKG;AACH,eAAO,MAAM,wBAAwB,EAAG,kBAA2B,CAAC;AAEpE;;;;;GAKG;AACH,eAAO,MAAM,yBAAyB,EAAG,2BAAoC,CAAC;AAM9E,OAAO,EACL,eAAe,EACf,aAAa,EACb,mBAAmB,EACnB,KAAK,cAAc,GACpB,MAAM,gBAAgB,CAAC;AAExB;;;;GAIG;AACH,eAAO,MAAM,mBAAmB;IAC9B,kFAAkF;;IAElF,kEAAkE;;CAE1D,CAAC;AAEX;;;;;GAKG;AACH,MAAM,MAAM,qBAAqB,GAAG,OAAO,GAAG,KAAK,CAAC;AAEpD;;;;;;;;;GASG;AAEH;;;;;;;;;;;GAWG;AACH,MAAM,WAAW,0BAA0B;IACzC,sEAAsE;IACtE,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC;IACxB;;;OAGG;IACH,QAAQ,CAAC,OAAO,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;IACpD;;;OAGG;IACH,QAAQ,CAAC,OAAO,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;IACpD;;;OAGG;IACH,QAAQ,CAAC,OAAO,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;CACrD;AAED;;;;;;;;;;;;GAYG;AACH,wBAAgB,iBAAiB,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,CAGzD;AA0CD;;;;;;;GAOG;AACH,eAAO,MAAM,+BAA+B,EAAG,gBAAyB,CAAC;AAEzE;;;;;;;GAOG;AACH,MAAM,WAAW,eAAe;IAC9B;;;oEAGgE;IAChE,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB;;mEAE+D;IAC/D,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC;IAC5B;;;yDAGqD;IACrD,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC;CAC7B;AAED;;;;;;GAMG;AACH,MAAM,WAAW,iBAAiB;IAChC,6DAA6D;IAC7D,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB;yDACqD;IACrD,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B;4EACwE;IACxE,QAAQ,CAAC,MAAM,EAAE,UAAU,CAAC;IAC5B,8DAA8D;IAC9D,QAAQ,CAAC,OAAO,EAAE,SAAS,CAAC;IAC5B;uEACmE;IACnE,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAC;CAC9B;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6DG;AACH,MAAM,WAAW,sBAAsB;IAGrC,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAG5B,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC;IAI5B,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAC;IAI7B,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;IAGzB,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,SAAS,CAAC,EAAE,OAAO,GAAG,MAAM,CAAC;IACtC;;;;;;;OAOG;IACH,QAAQ,CAAC,KAAK,CAAC,EAAE,QAAQ,CAAC;IAG1B,QAAQ,CAAC,OAAO,CAAC,EAAE,aAAa,CAAC,eAAe,CAAC,CAAC;IAClD,QAAQ,CAAC,SAAS,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;IACtD,QAAQ,CAAC,yBAAyB,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IACvD,QAAQ,CAAC,iBAAiB,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IAE/C;;;;;;;;OAQG;IACH,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM,CAAC;IAE/B;;;;;;;OAOG;IACH,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC;IAGxB,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,YAAY,CAAC,EAAE,aAAa,CAAC,iBAAiB,CAAC,CAAC;IAMzD,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM,CAAC;IAC/B,QAAQ,CAAC,aAAa,CAAC,EAAE,MAAM,CAAC;IAOhC,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAC3B;;;;;;;;;;;OAWG;IACH,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC;CACxB;AAED;;;;;;;;;GASG;AACH,MAAM,MAAM,iCAAiC,GACzC;IAAE,QAAQ,CAAC,EAAE,EAAE,IAAI,CAAC;IAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,sBAAsB,CAAA;CAAE,GAC7D;IAAE,QAAQ,CAAC,EAAE,EAAE,KAAK,CAAC;IAAC,QAAQ,CAAC,MAAM,EAAE,kBAAkB,CAAA;CAAE,CAAC;AAEhE;;;;;;;;;;GAUG;AACH,wBAAgB,2BAA2B,CACzC,IAAI,EAAE,OAAO,GACZ,iCAAiC,CAqKnC;AAED;;;;;GAKG;AACH,wBAAgB,gBAAgB,CAC9B,MAAM,EAAE,sBAAsB,GAC7B,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAIzB;AAED;;;;;;;GAOG;AACH,MAAM,WAAW,cAAc;IAC7B,gEAAgE;IAChE,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,gEAAgE;IAChE,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;CACzB;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,wBAAgB,qBAAqB,CACnC,IAAI,EAAE,MAAM,EACZ,SAAS,EAAE,MAAM,EACjB,OAAO,EAAE,MAAM,GACd,cAAc,CAQhB;AAYD;;;;;;;;;;;;;GAaG;AACH,eAAO,MAAM,qCAAqC,EAAG,sBAA+B,CAAC;AAErF;;;;;;;;;;;;;;;GAeG;AACH,MAAM,WAAW,2BAA2B;IAC1C;;;;OAIG;IACH,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B;;;;OAIG;IACH,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;CAChC;AAED;;;;;;;;;;;;;;GAcG;AACH,MAAM,MAAM,sCAAsC,GAC9C;IAAE,QAAQ,CAAC,EAAE,EAAE,IAAI,CAAC;IAAC,QAAQ,CAAC,WAAW,CAAC,EAAE,2BAA2B,CAAA;CAAE,GACzE;IAAE,QAAQ,CAAC,EAAE,EAAE,KAAK,CAAC;IAAC,QAAQ,CAAC,MAAM,EAAE,wBAAwB,CAAA;CAAE,CAAC;AAEtE;;;;;;;GAOG;AACH,wBAAgB,gCAAgC,CAC9C,IAAI,EAAE,OAAO,GACZ,sCAAsC,CA2BxC;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,WAAW,sBAAsB;IACrC,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,aAAa,CAAC,EAAE,MAAM,CAAC;IAChC,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,cAAc,EAAE,MAAM,CAAC;IAChC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,gBAAgB,CAAC,EAAE,MAAM,CAAC;CACpC;AAMD;;;GAGG;AACH,MAAM,WAAW,UAAU;IACzB,QAAQ,CAAC,cAAc,CAAC,EAAE,MAAM,EAAE,CAAC;IACnC,QAAQ,CAAC,eAAe,CAAC,EAAE,MAAM,EAAE,CAAC;IACpC,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM,EAAE,CAAC;CAClC;AAED;;;GAGG;AACH,MAAM,WAAW,kBAAkB;IACjC,QAAQ,CAAC,MAAM,CAAC,EAAE,OAAO,CAAC;IAC1B,QAAQ,CAAC,UAAU,CAAC,EAAE,OAAO,CAAC;IAC9B,QAAQ,CAAC,WAAW,CAAC,EAAE,OAAO,CAAC;IAC/B,QAAQ,CAAC,cAAc,CAAC,EAAE,OAAO,CAAC;CACnC;AAED;;;GAGG;AACH,MAAM,WAAW,0BAA0B;IACzC,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;CAC5B;AAED;;;;;;GAMG;AACH,MAAM,WAAW,aAAa;IAC5B,oEAAoE;IACpE,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B;gCAC4B;IAC5B,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B;iCAC6B;IAC7B,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;CAC9B;AAED;;;;;;;;;;;;;;GAcG;AACH,MAAM,WAAW,kBAAkB;IACjC,gDAAgD;IAChD,QAAQ,CAAC,IAAI,EAAE,SAAS,CAAC;IAGzB,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;IACpB,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B;;;;;OAKG;IACH,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAC;IAC9B,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC;IAG1B,QAAQ,CAAC,MAAM,EAAE,aAAa,CAAC;IAC/B,QAAQ,CAAC,GAAG,CAAC,EAAE,UAAU,CAAC;IAC1B,QAAQ,CAAC,WAAW,CAAC,EAAE,kBAAkB,CAAC;IAC1C,QAAQ,CAAC,mBAAmB,CAAC,EAAE,0BAA0B,CAAC;IAE1D;;;;;OAKG;IACH,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM,CAAC;IAE/B;;;;;OAKG;IACH,QAAQ,CAAC,eAAe,CAAC,EAAE,MAAM,CAAC;IAOlC,QAAQ,CAAC,aAAa,CAAC,EAAE,KAAK,CAAC;IAC/B,QAAQ,CAAC,KAAK,CAAC,EAAE,KAAK,CAAC;IACvB,QAAQ,CAAC,WAAW,CAAC,EAAE,KAAK,CAAC;IAC7B,QAAQ,CAAC,MAAM,CAAC,EAAE,KAAK,CAAC;IACxB,QAAQ,CAAC,YAAY,CAAC,EAAE,KAAK,CAAC;IAC9B,QAAQ,CAAC,YAAY,CAAC,EAAE,KAAK,CAAC;IAC9B,QAAQ,CAAC,OAAO,CAAC,EAAE,KAAK,CAAC;IACzB,QAAQ,CAAC,OAAO,CAAC,EAAE,KAAK,CAAC;IACzB,QAAQ,CAAC,KAAK,CAAC,EAAE,KAAK,CAAC;IACvB,QAAQ,CAAC,UAAU,CAAC,EAAE,KAAK,CAAC;IAC5B,QAAQ,CAAC,SAAS,CAAC,EAAE,KAAK,CAAC;IAC3B,QAAQ,CAAC,UAAU,CAAC,EAAE,KAAK,CAAC;IAC5B,QAAQ,CAAC,WAAW,CAAC,EAAE,KAAK,CAAC;IAC7B,QAAQ,CAAC,kBAAkB,CAAC,EAAE,KAAK,CAAC;CACrC;AAED;;;GAGG;AACH,wBAAgB,oBAAoB,CAAC,KAAK,EAAE,OAAO,GAAG,KAAK,IAAI,kBAAkB,CAMhF;AAED;;;;;;GAMG;AACH,wBAAgB,0BAA0B,CACxC,KAAK,EAAE,OAAO,GACb,kBAAkB,GAAG,IAAI,CAE3B;AAwCD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4CG;AACH,MAAM,MAAM,oBAAoB,GAC5B,UAAU,GACV,YAAY,GACZ,OAAO,GACP,cAAc,CAAC;AAEnB;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,MAAM,WAAW,oBAAoB;IACnC,QAAQ,CAAC,KAAK,EAAE,oBAAoB,CAAC;IACrC,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,KAAK,CAAC,EAAE;QACf,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;QACtB,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;KAC1B,CAAC;CACH;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAwDG;AACH,MAAM,WAAW,sBAAsB;IACrC,QAAQ,CAAC,IAAI,EAAE,gBAAgB,CAAC;IAChC,QAAQ,CAAC,KAAK,EAAE,oBAAoB,CAAC;CACtC;AAED;;;;;;GAMG;AACH,eAAO,MAAM,wBAAwB,EAAE,SAAS,oBAAoB,EAK1D,CAAC;AAEX;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,wBAAwB,CACtC,OAAO,EAAE,OAAO,GACf,OAAO,IAAI,sBAAsB,CA2BnC;AA4BD,6EAA6E;AAC7E,eAAO,MAAM,2BAA2B,wBAAwB,CAAC;AAEjE,0EAA0E;AAC1E,eAAO,MAAM,6BAA6B,0BAA0B,CAAC;AAErE,uEAAuE;AACvE,eAAO,MAAM,oBAAoB,iBAAiB,CAAC;AAEnD;;;;GAIG;AACH,eAAO,MAAM,sBAAsB,EAAE,sBAAsB,CAAC,MAAM,CAChD,CAAC;AAEnB;;;;;GAKG;AACH,MAAM,WAAW,0BAA0B;IACzC,QAAQ,CAAC,IAAI,EAAE,OAAO,2BAA2B,CAAC;IAClD,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;CAC1B;AAED;;;;;;;GAOG;AACH,MAAM,WAAW,4BAA4B;IAC3C,QAAQ,CAAC,IAAI,EAAE,OAAO,6BAA6B,CAAC;IACpD,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;CAC1B;AAMD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAkCG;AACH,MAAM,MAAM,gBAAgB,GACxB,UAAU,GACV,UAAU,GACV,oBAAoB,GACpB,CAAC,MAAM,GAAG,EAAE,CAAC,CAAC;AAElB;;;;;;;;;GASG;AACH,MAAM,MAAM,oBAAoB,GAC5B;IACE,QAAQ,CAAC,IAAI,EAAE,UAAU,CAAC;IAC1B,QAAQ,CAAC,OAAO,EAAE;QAChB,yDAAyD;QACzD,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;QACxB;;;WAGG;QACH,QAAQ,CAAC,UAAU,EAAE,SAAS,GAAG,IAAI,CAAC;QACtC;;;;;;;;;WASG;QACH,QAAQ,CAAC,SAAS,EAAE,UAAU,CAAC;KAChC,CAAC;CACH,GACD;IACE,QAAQ,CAAC,IAAI,EAAE,UAAU,CAAC;IAC1B,QAAQ,CAAC,OAAO,EAAE;QAAE,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAA;KAAE,CAAC;CAC5C,GACD;IACE,QAAQ,CAAC,IAAI,EAAE,oBAAoB,CAAC;IACpC,QAAQ,CAAC,OAAO,EAAE;QAChB,QAAQ,CAAC,IAAI,EAAE,YAAY,GAAG,KAAK,GAAG,QAAQ,GAAG,CAAC,MAAM,GAAG,EAAE,CAAC,CAAC;KAChE,CAAC;CACH,GACD;IACE,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CAC3C,CAAC;AAEN;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAyCG;AACH,MAAM,MAAM,qBAAqB,GAAG,oBAAoB,GAAG;IACzD,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;CAC1B,CAAC;AAEF;;;;GAIG;AACH,eAAO,MAAM,mBAAmB,yDAIgB,CAAC;AAEjD;;;;;;;;;;;GAWG;AACH,wBAAgB,uBAAuB,CACrC,KAAK,EAAE,OAAO,GACb,KAAK,IAAI,qBAAqB,CAoChC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAwCG;AACH,MAAM,WAAW,kBAAkB;IACjC,QAAQ,CAAC,IAAI,EAAE,aAAa,CAAC;IAC7B,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,QAAQ,EAAE;QACjB,QAAQ,CAAC,IAAI,EAAE,cAAc,CAAC;QAC9B,QAAQ,CAAC,IAAI,EAAE;YAAE,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAA;SAAE,CAAC;KAC/C,CAAC;CACH;AAmCD;;;;;;;;;;;;;GAaG;AACH,MAAM,WAAW,mBAAmB;IAClC,uEAAuE;IACvE,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,wDAAwD;IACxD,QAAQ,CAAC,KAAK,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;CACnD;AAmBD;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,qBAAqB,CACnC,IAAI,EAAE,OAAO,GACZ,mBAAmB,GAAG,SAAS,CAUjC;AAED;;;;;;;;;;;GAWG;AACH,wBAAgB,oBAAoB,CAClC,MAAM,EAAE,OAAO,GACd,mBAAmB,GAAG,SAAS,CAGjC;AAED;;;;;;;;GAQG;AACH,eAAO,MAAM,yBAAyB,uCAAuC,CAAC;AAE9E;;;;GAIG;AACH,MAAM,WAAW,oBAAoB;IACnC;;;;;;;;;;;;OAYG;IACH,QAAQ,CAAC,UAAU,CAAC,EAAE,SAAS,GAAG,aAAa,CAAC;IAChD;;;;;;;;;;;;;OAaG;IACH,QAAQ,CAAC,mBAAmB,CAAC,EAAE,MAAM,CAAC;CACvC;AAED;;;;;;;;;;;;;;;GAeG;AACH,wBAAgB,kBAAkB,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,CAIzD;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+BG;AACH,wBAAgB,aAAa,CAC3B,SAAS,EAAE,mBAAmB,EAC9B,OAAO,CAAC,EAAE,oBAAoB,GAC7B,MAAM,CAyCR"}

package/dist/integrations/mcp-apps.js

@@ -49,6 +49,11 @@ export const GGUI_RENDER_RESOURCE_URI = 'ui://ggui/render';
  * render them as plain HTML.
  */
 export const GGUI_RENDER_RESOURCE_MIME = 'text/html;profile=mcp-app';
+// Epoch-pinned resource URIs (#483) — bare URI = live head, `#N` =
+// immutable history record. Re-exported here because this module is
+// the package's MCP-Apps export surface; the seam itself lives in
+// epoch-uri.ts (ONE place to flip the encoding).
+export { composeEpochUri, parseEpochUri, EPOCH_URI_SEPARATOR, } from './epoch-uri.js';
 /**
  * The single `_meta.ui.resourceUri` value ggui uses across every MCP Apps
  * host surface. Exposed as a named constant so tool-declaration code,
@@ -96,7 +101,7 @@ export function deriveContextName(slotKey) {
 //   "ai.ggui/render": {
 //     sessionId, appId, runtimeUrl,
 //     wsUrl?, wsToken?, expiresAt?,
-//     pollingUrl?,
+//     pollingUrl?, sseUrl?,
 //     themeId?, themeMode?, theme?,
 //     gadgets?, publicEnv?, streamWebSocketLocalTools?,
 //     permissionsPolicy?,
@@ -177,10 +182,24 @@ export function parseMcpAppAiGguiRenderMeta(meta) {
         (typeof ls !== 'number' || !Number.isInteger(ls) || ls < 0)) {
         return { ok: false, reason: 'MALFORMED_RENDER' };
     }
-    // Component-mode discriminator: codeUrl + kind mutually exclusive.
+    // `epoch` (#483) mirrors lastSequence's invariant: the freeze-latch
+    // self-epoch is a non-negative integer when present. This parser
+    // REBUILDS the slice field-by-field, so a field missing from the
+    // constructor below is silently deleted from every downstream
+    // consumer — epoch was exactly such a drop (probe 18 round 3: the
+    // head card booted believing epoch 0 and froze on its own amend).
+    const ep = s.epoch;
+    if (ep !== undefined &&
+        (typeof ep !== 'number' || !Number.isInteger(ep) || ep < 0)) {
+        return { ok: false, reason: 'MALFORMED_RENDER' };
+    }
+    // Component-mode discriminator: kind mutually exclusive with
+    // codeUrl/codeB64 (the two static-component carriers may coexist —
+    // consumers prefer the inline bytes).
     const cu = s.codeUrl;
     const ck = s.kind;
     const ch = s.codeHash;
+    const cb = s.codeB64;
     if (cu !== undefined && (typeof cu !== 'string' || cu.length === 0)) {
         return { ok: false, reason: 'MALFORMED_RENDER' };
     }
@@ -190,7 +209,12 @@ export function parseMcpAppAiGguiRenderMeta(meta) {
     if (ch !== undefined && (typeof ch !== 'string' || ch.length === 0)) {
         return { ok: false, reason: 'MALFORMED_RENDER' };
     }
-    if (typeof cu === 'string' && cu.length > 0 && typeof ck === 'string' && ck.length > 0) {
+    if (cb !== undefined && (typeof cb !== 'string' || cb.length === 0)) {
+        return { ok: false, reason: 'MALFORMED_RENDER' };
+    }
+    const hasStaticComponent = (typeof cu === 'string' && cu.length > 0) ||
+        (typeof cb === 'string' && cb.length > 0);
+    if (hasStaticComponent && typeof ck === 'string' && ck.length > 0) {
         return { ok: false, reason: 'MALFORMED_RENDER' };
     }
     // Contract pair — both present or both absent (or both effectively
@@ -214,6 +238,11 @@ export function parseMcpAppAiGguiRenderMeta(meta) {
         ...(hasW && hasT ? { wsUrl: aw, wsToken: at } : {}),
         ...(ae !== undefined ? { expiresAt: ae } : {}),
         ...(s.pollingUrl !== undefined ? { pollingUrl: s.pollingUrl } : {}),
+        // Same tolerant scalar posture as pollingUrl; deliberately NO
+        // wsToken-pairing invariant — the URL is self-authorizing via its
+        // embedded token; field-level defense lives downstream in the
+        // iframe-runtime's `validateMeta`.
+        ...(s.sseUrl !== undefined ? { sseUrl: s.sseUrl } : {}),
         ...(s.themeId !== undefined ? { themeId: s.themeId } : {}),
         ...(s.themeMode !== undefined
             ? { themeMode: s.themeMode }
@@ -239,6 +268,7 @@ export function parseMcpAppAiGguiRenderMeta(meta) {
             ? { permissionsPolicy: s.permissionsPolicy }
             : {}),
         ...(ls !== undefined ? { lastSequence: ls } : {}),
+        ...(ep !== undefined ? { epoch: ep } : {}),
         ...(s.propsJson !== undefined ? { propsJson: s.propsJson } : {}),
         ...(s.contextSlots !== undefined
             ? {
@@ -253,6 +283,7 @@ export function parseMcpAppAiGguiRenderMeta(meta) {
             : {}),
         ...(typeof cu === 'string' && cu.length > 0 ? { codeUrl: cu } : {}),
         ...(typeof ch === 'string' && ch.length > 0 ? { codeHash: ch } : {}),
+        ...(typeof cb === 'string' && cb.length > 0 ? { codeB64: cb } : {}),
         ...(typeof ck === 'string' && ck.length > 0 ? { kind: ck } : {}),
     };
     return { ok: true, meta: slice };
@@ -268,6 +299,33 @@ export function toMcpAppEnvelope(render) {
         [MCP_APP_AI_GGUI_RENDER_META_KEY]: render,
     };
 }
+/**
+ * Compose the token-bearing session-API URL pair — ONE composer for
+ * every stamping surface (render resultMeta, update resultMeta, the
+ * self-contained shell, the `/api/sessions/:id/state` bootstrap). Same
+ * move as `deriveRenderMeta`: because every surface routes through this
+ * function, cross-transport drift in the URL shapes is structurally
+ * impossible.
+ *
+ * Pure string composition, no I/O. `base` is the absolute public
+ * origin the session API is served on (a trailing `/` is tolerated and
+ * stripped); `sessionId` and `wsToken` are URL-encoded into path and
+ * query. Callers MUST invoke this only when the live trio was minted —
+ * both URLs embed the token, and a token-less URL can only 401 through
+ * the fallback composers; omission of both fields is the honest
+ * no-HTTP-fallback signal the slice contract defines.
+ *
+ * @public
+ */
+export function composeSessionApiUrls(base, sessionId, wsToken) {
+    const b = base.replace(/\/$/, '');
+    const sid = encodeURIComponent(sessionId);
+    const tok = encodeURIComponent(wsToken);
+    return {
+        pollingUrl: `${b}/api/sessions/${sid}/events?wsToken=${tok}`,
+        sseUrl: `${b}/api/sessions/${sid}/stream?wsToken=${tok}`,
+    };
+}
 // =============================================================================
 // Request-side `_meta` — host-supplied metadata on inbound `tools/call`.
 //
@@ -533,8 +591,8 @@ export function isGguiSubmitActionInput(value) {
  * Does this slice carry at least one MOUNT MODE discriminator?
  * Mirrors the iframe-runtime's `validateMeta`: the runtime needs
  * `runtimeUrl` PLUS one of live mode (`wsUrl` + `wsToken` together),
- * `codeUrl`, or `kind` — without one of those three the iframe has
- * nothing to mount.
+ * `codeUrl`, `codeB64`, or `kind` — without one of those the iframe
+ * has nothing to mount.
  */
 function hasMountModeDiscriminator(slice) {
     const nonEmpty = (v) => typeof v === 'string' && v.length > 0;
@@ -542,6 +600,8 @@ function hasMountModeDiscriminator(slice) {
         return true;
     if (nonEmpty(slice.codeUrl))
         return true;
+    if (nonEmpty(slice.codeB64))
+        return true;
     if (nonEmpty(slice.kind))
         return true;
     return false;
@@ -602,6 +662,27 @@ export function toolResultGguiRender(result) {
  * @public
  */
 export const GGUI_RENDER_SHELL_SURFACE = 'var(--ggui-color-surface, #1e293b)';
+/**
+ * Make raw JS source safe to embed as the text content of an HTML
+ * `<script>` element.
+ *
+ * The HTML parser terminates script data at the first
+ * case-insensitive `</script` and shifts parse state on `<!--`; both
+ * sequences are rewritten with a backslash (`<\/script`, `<\!--`).
+ * Inside JS string, template, and regex literals — the only positions
+ * these byte sequences occur in a well-formed bundled module (a bare
+ * `<!--` outside a literal is a SyntaxError in module code; a bare
+ * `</` cannot follow an expression) — `\/` and `\!` are identity
+ * escapes, so the escaped source evaluates identically to the
+ * original.
+ *
+ * @public
+ */
+export function escapeInlineScript(source) {
+    return source
+        .replace(/<\/(script)/gi, '<\\/$1')
+        .replace(/<!--/g, '<\\!--');
+}
 /**
  * Build the ggui **self-contained shell** for a render bootstrap.
  *
@@ -658,10 +739,17 @@ export function gguiShellHtml(bootstrap, options) {
     const background = options?.background === 'transparent'
         ? 'background:transparent'
         : `background-color:${GGUI_RENDER_SHELL_SURFACE}`;
+    // Inline vs external runtime: same document shape either way — the
+    // classic meta script always runs first (parse order + module
+    // deferral), so `__GGUI_META__` is populated before the runtime
+    // evaluates in both variants.
+    const runtimeTag = options?.runtimeInlineSource !== undefined
+        ? `<script type="module" data-ggui-runtime="inline">${escapeInlineScript(options.runtimeInlineSource)}</script>`
+        : `<script type="module" crossorigin="anonymous" src="${safeRuntimeUrl}"></script>`;
     return `<!doctype html>
 <html lang="en" style="${background}"><head><meta charset="utf-8"><meta name="viewport" content="width=device-width, initial-scale=1"><meta name="color-scheme" content="light dark"><title>ggui render</title></head>
 <body style="margin:0;${background}">
 <script>globalThis.__GGUI_META__ = ${json};</script>
-<script type="module" crossorigin="anonymous" src="${safeRuntimeUrl}"></script>
+${runtimeTag}
 </body></html>`;
 }

package/dist/schemas/data-contract.d.ts

@@ -309,8 +309,10 @@ export declare const SEMVER_PIN_RE: RegExp;
 /**
  * Hostname-only regex for `bundleHost` — the registry hostname (no
  * scheme, no path) that the server prepends `https://` to and
- * appends the canonical `/bundles/<scope>/<name>/<version>/{bundle.js,style.css}`
- * suffix to when resolving a gadget's URLs at render time.
+ * appends the canonical
+ * `/bundles/public/<scope>/<name>/<version>/{bundle.js,style.css}`
+ * suffix to when resolving a gadget's URLs at render time (the PUBLIC
+ * prefix of the registry's visibility-split bundle layout).
  *
  * Examples that pass:
  *   - `registry.ggui.ai` (spec default)

package/dist/schemas/data-contract.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"data-contract.d.ts","sourceRoot":"","sources":["../../src/schemas/data-contract.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAmDG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAIxB,OAAO,KAAK,EACV,YAAY,EACZ,SAAS,EACT,UAAU,EACX,MAAM,wBAAwB,CAAC;AAEhC;;;;GAIG;AACH,eAAO,MAAM,eAAe,EAAE,CAAC,CAAC,OAAO,CAAC,SAAS,CAYhD,CAAC;AAEF;;;;;;GAMG;AACH,eAAO,MAAM,gBAAgB,EAAE,CAAC,CAAC,OAAO,CAAC,UAAU,CA2BlD,CAAC;AAEF;;;;;;;GAOG;AACH,eAAO,MAAM,eAAe;;;;;;;kBASjB,CAAC;AAEZ,sFAAsF;AACtF,eAAO,MAAM,eAAe;;;;;;;;;;kBAKjB,CAAC;AAEZ;;;;;;;;;;GAUG;AACH,eAAO,MAAM,iBAAiB;;;;;;;;kBAUnB,CAAC;AAEZ,6DAA6D;AAC7D,eAAO,MAAM,gBAAgB;;;;;;;;mBAA0C,CAAC;AAExE,iFAAiF;AACjF,eAAO,MAAM,wBAAwB;;;;;;;;;;;;;;;;;;kBAgB1B,CAAC;AAEZ,uEAAuE;AACvE,eAAO,MAAM,gBAAgB;;;;;;;;;;;;;;;;;;mBAAiD,CAAC;AAE/E,yEAAyE;AACzE,eAAO,MAAM,kBAAkB;;;;;;kBAQpB,CAAC;AAEZ,+DAA+D;AAC/D,eAAO,MAAM,iBAAiB;;;;;;mBAA2C,CAAC;AAE1E,sFAAsF;AACtF,eAAO,MAAM,oBAAoB;;;;;;;;;;;;;;;kBAiBtB,CAAC;AAEZ,qEAAqE;AACrE,eAAO,MAAM,2BAA2B;;;;;;;;;;;;;;;;;iBAIxB,CAAC;AAEjB;;;;;;;;;;;;;;;;;;GAkBG;AACH,eAAO,MAAM,qBAAqB,QAAiC,CAAC;AAEpE;;;;;;;;;;;;GAYG;AACH,eAAO,MAAM,oBAAoB,wCAEpB,CAAC;AAEd;;;;;;;;;;;;;;;;GAgBG;AACH,eAAO,MAAM,aAAa,QAA8B,CAAC;AAEzD;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,eAAO,MAAM,mBAAmB,QACsB,CAAC;AAEvD;;;;;;;;;;;;;;GAcG;AACH,eAAO,MAAM,aAAa,QAAyC,CAAC;AAEpE;;;;;;;;;;;;;;;;;;GAkBG;AACH,eAAO,MAAM,cAAc,QAAyB,CAAC;AAErD;;;;;;GAMG;AACH,eAAO,MAAM,mBAAmB,qBAAqB,CAAC;AAEtD;;;;;;;;;;;;;;;;;GAiBG;AACH,eAAO,MAAM,gBAAgB,QAAiD,CAAC;AAE/E;;;;;;GAMG;AACH,wBAAgB,gBAAgB,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,GAAG,OAAO,CAE/D;AAED;;;;;;;;GAQG;AACH,OAAO,EAAE,YAAY,EAAE,iBAAiB,EAAE,MAAM,uBAAuB,CAAC;AAwExE;;;;;;;;GAQG;AACH,eAAO,MAAM,kBAAkB;;;;;;;;;;;;;;oBAa7B,CAAC;AAEH;;;;GAIG;AACH,eAAO,MAAM,wBAAwB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;oBAanC,CAAC;AAEH;;;;;;GAMG;AACH,eAAO,MAAM,sBAAsB;;;;;;;;;;;;;;;;;;;;;;;;;;kBAKxB,CAAC;AAEZ;;;;;;;;;;;;;GAaG;AACH,eAAO,MAAM,4BAA4B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;kBAK9B,CAAC;AAEZ;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AACH,eAAO,MAAM,gCAAgC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;kBAU1C,CAAC;AAQJ;;;;;;;;;;;;;;;;;GAiBG;AACH,eAAO,MAAM,qBAAqB;;;kBAKvB,CAAC;AAEZ;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,sBAAsB;;;mBAa/B,CAAC;AAEL;;;;;;;;;;;;;;;GAeG;AACH,eAAO,MAAM,4BAA4B;;;;;kBAO9B,CAAC;AAEZ;;;;;;;;;;;;GAYG;AACH,eAAO,MAAM,kBAAkB,sDAElB,CAAC;AAEd;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AACH,eAAO,MAAM,kBAAkB,EAAE,CAAC,CAAC,OAAO,CAAC,YAAY,CASZ,CAAC"}
+{"version":3,"file":"data-contract.d.ts","sourceRoot":"","sources":["../../src/schemas/data-contract.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAmDG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAIxB,OAAO,KAAK,EACV,YAAY,EACZ,SAAS,EACT,UAAU,EACX,MAAM,wBAAwB,CAAC;AAEhC;;;;GAIG;AACH,eAAO,MAAM,eAAe,EAAE,CAAC,CAAC,OAAO,CAAC,SAAS,CAYhD,CAAC;AAEF;;;;;;GAMG;AACH,eAAO,MAAM,gBAAgB,EAAE,CAAC,CAAC,OAAO,CAAC,UAAU,CA2BlD,CAAC;AAEF;;;;;;;GAOG;AACH,eAAO,MAAM,eAAe;;;;;;;kBASjB,CAAC;AAEZ,sFAAsF;AACtF,eAAO,MAAM,eAAe;;;;;;;;;;kBAKjB,CAAC;AAEZ;;;;;;;;;;GAUG;AACH,eAAO,MAAM,iBAAiB;;;;;;;;kBAUnB,CAAC;AAEZ,6DAA6D;AAC7D,eAAO,MAAM,gBAAgB;;;;;;;;mBAA0C,CAAC;AAExE,iFAAiF;AACjF,eAAO,MAAM,wBAAwB;;;;;;;;;;;;;;;;;;kBAgB1B,CAAC;AAEZ,uEAAuE;AACvE,eAAO,MAAM,gBAAgB;;;;;;;;;;;;;;;;;;mBAAiD,CAAC;AAE/E,yEAAyE;AACzE,eAAO,MAAM,kBAAkB;;;;;;kBAQpB,CAAC;AAEZ,+DAA+D;AAC/D,eAAO,MAAM,iBAAiB;;;;;;mBAA2C,CAAC;AAE1E,sFAAsF;AACtF,eAAO,MAAM,oBAAoB;;;;;;;;;;;;;;;kBAiBtB,CAAC;AAEZ,qEAAqE;AACrE,eAAO,MAAM,2BAA2B;;;;;;;;;;;;;;;;;iBAIxB,CAAC;AAEjB;;;;;;;;;;;;;;;;;;GAkBG;AACH,eAAO,MAAM,qBAAqB,QAAiC,CAAC;AAEpE;;;;;;;;;;;;GAYG;AACH,eAAO,MAAM,oBAAoB,wCAEpB,CAAC;AAEd;;;;;;;;;;;;;;;;GAgBG;AACH,eAAO,MAAM,aAAa,QAA8B,CAAC;AAEzD;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,eAAO,MAAM,mBAAmB,QACsB,CAAC;AAEvD;;;;;;;;;;;;;;GAcG;AACH,eAAO,MAAM,aAAa,QAAyC,CAAC;AAEpE;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,eAAO,MAAM,cAAc,QAAyB,CAAC;AAErD;;;;;;GAMG;AACH,eAAO,MAAM,mBAAmB,qBAAqB,CAAC;AAEtD;;;;;;;;;;;;;;;;;GAiBG;AACH,eAAO,MAAM,gBAAgB,QAAiD,CAAC;AAE/E;;;;;;GAMG;AACH,wBAAgB,gBAAgB,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,GAAG,OAAO,CAE/D;AAED;;;;;;;;GAQG;AACH,OAAO,EAAE,YAAY,EAAE,iBAAiB,EAAE,MAAM,uBAAuB,CAAC;AAwExE;;;;;;;;GAQG;AACH,eAAO,MAAM,kBAAkB;;;;;;;;;;;;;;oBAa7B,CAAC;AAEH;;;;GAIG;AACH,eAAO,MAAM,wBAAwB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;oBAanC,CAAC;AAEH;;;;;;GAMG;AACH,eAAO,MAAM,sBAAsB;;;;;;;;;;;;;;;;;;;;;;;;;;kBAKxB,CAAC;AAEZ;;;;;;;;;;;;;GAaG;AACH,eAAO,MAAM,4BAA4B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;kBAK9B,CAAC;AAEZ;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AACH,eAAO,MAAM,gCAAgC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;kBAU1C,CAAC;AAQJ;;;;;;;;;;;;;;;;;GAiBG;AACH,eAAO,MAAM,qBAAqB;;;kBAKvB,CAAC;AAEZ;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,sBAAsB;;;mBAa/B,CAAC;AAEL;;;;;;;;;;;;;;;GAeG;AACH,eAAO,MAAM,4BAA4B;;;;;kBAO9B,CAAC;AAEZ;;;;;;;;;;;;GAYG;AACH,eAAO,MAAM,kBAAkB,sDAElB,CAAC;AAEd;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AACH,eAAO,MAAM,kBAAkB,EAAE,CAAC,CAAC,OAAO,CAAC,YAAY,CASZ,CAAC"}

package/dist/schemas/data-contract.js

@@ -304,8 +304,10 @@ export const SEMVER_PIN_RE = /^\d+\.\d+\.\d+(-[\w.]+)?(\+[\w.]+)?$/;
 /**
  * Hostname-only regex for `bundleHost` — the registry hostname (no
  * scheme, no path) that the server prepends `https://` to and
- * appends the canonical `/bundles/<scope>/<name>/<version>/{bundle.js,style.css}`
- * suffix to when resolving a gadget's URLs at render time.
+ * appends the canonical
+ * `/bundles/public/<scope>/<name>/<version>/{bundle.js,style.css}`
+ * suffix to when resolving a gadget's URLs at render time (the PUBLIC
+ * prefix of the registry's visibility-split bundle layout).
  *
  * Examples that pass:
  *   - `registry.ggui.ai` (spec default)

package/dist/schemas/invoke.d.ts

@@ -8,7 +8,7 @@
  * client tools — no ggui-specific block type.
  *
  * TS types in types/invoke.ts are derived from these via z.infer. Consumers
- * (@ggui-ai/server, @ggui-ai/react) import schemas for runtime validation
+ * (@ggui-ai/server, @ggui-ai/mcp-apps-react) import schemas for runtime validation
  * and types for authoring.
  */
 import { z } from 'zod';

package/dist/schemas/invoke.js

@@ -8,7 +8,7 @@
  * client tools — no ggui-specific block type.
  *
  * TS types in types/invoke.ts are derived from these via z.infer. Consumers
- * (@ggui-ai/server, @ggui-ai/react) import schemas for runtime validation
+ * (@ggui-ai/server, @ggui-ai/mcp-apps-react) import schemas for runtime validation
  * and types for authoring.
  */
 import { z } from 'zod';