@ggui-ai/protocol 0.9.0 → 0.10.0

package/dist/version.d.ts

@@ -6,6 +6,131 @@
  * schema change; the most recent change anchors {@link PROTOCOL_VERSION}.
  *
  * --------------------------------------------------------------------
+ * Authored source rides blueprint reuse (2026-08-14, additive,
+ * pre-launch). Cache-reuse renders (a repeated prompt semantic-matches
+ * a cached blueprint) previously committed without authored
+ * `sourceCode` — structurally, not incidentally: the reuse-commit path
+ * never carried it, and blueprint registry rows never persisted it, so
+ * `ggui_get_render_source` always returned `render_source_unavailable`
+ * for every reuse render.
+ *
+ *   sc1. **`Blueprint.sourceCodeHash?: string`** added to
+ *      `@ggui-ai/protocol` — content hash (`CodeStore.hashOf`) of the
+ *      AUTHORED, pre-compile source body, distinct from the existing
+ *      `codeHash` (compiled `componentCode`). The body itself is never
+ *      stored on the row — persistent adapters keep vector/metadata
+ *      rows small and content-address the body through the same
+ *      `CodeStore` seam `codeHash` already implies. Absent on legacy
+ *      rows and on blueprints with no authored form distinct from
+ *      their compiled output.
+ *
+ *   sc2. **Registration threads it through.** `registerBlueprint`
+ *      (`@ggui-ai/mcp-server-handlers`) gains an optional
+ *      `sourceCode` input; when present, distinct from the compiled
+ *      `componentCode` (fallback-collapse symmetry — a byte-identical
+ *      pair is never worth persisting, since the read-side envelope
+ *      guard would reject it anyway), and a `CodeStore` is bound, the
+ *      registry computes + persists `sourceCodeHash` on the row and
+ *      writes the body through the durability `CodeStore` (body-
+ *      before-row ordering, same orphan-body-beats-dangling-pointer
+ *      posture as the existing compiled-code write). New durability
+ *      event `blueprint_source_write_failed` (additive, sibling to
+ *      `blueprint_code_write_failed`) on a failed body write — the row
+ *      still commits with the hash; a reuse read against a missing
+ *      body degrades gracefully to `render_source_unavailable`, never
+ *      an error.
+ *
+ *   sc3. **Reuse commit threads it back.** The cache-hit reuse branch
+ *      resolves the body from `CodeStore` by the stored hash and
+ *      stamps it onto `GenerationCacheHit.sourceCode`, which
+ *      `commitCachedGguiSession` sidecars onto the render exactly like
+ *      the cold-gen commit path already does — reuse renders now serve
+ *      `ggui_get_render_source` identically to cold-gen renders.
+ *
+ * Conformance-kit verdict: no kit entry required — additive optional
+ * fields + a new durability event, no existing wire shape changed, no
+ * MCP tool name/shape touched.
+ *
+ * Package version — classification MADE here: PATCH for
+ * `@ggui-ai/protocol` (additive optional field, no new export),
+ * MINOR for `@ggui-ai/mcp-server-handlers` (new optional input field +
+ * new event), pre-1.0 and pre-launch. PROTOCOL_VERSION unchanged.
+ * --------------------------------------------------------------------
+ * ops-blueprint appId input + app-access seam (2026-08-14, additive,
+ * pre-launch, ggui#501). Cross-app curation seam for the operator-
+ * class blueprint family — the prerequisite for the family mounting
+ * beyond the OSS default server.
+ *
+ *   ob1. **Optional `appId` input** on all five `ggui_ops_*_blueprint`
+ *      tools (`generate`, `register`, `list`, `update`, `delete`).
+ *      Omitted ⇒ resolves to the caller's bound `ctx.appId` (unchanged
+ *      default behavior). Present ⇒ the tool curates the NAMED app
+ *      instead, subject to the authorizer below.
+ *
+ *   ob2. **`authorizeAppAccess` dep seam**
+ *      (`OpsBlueprintAppAuthorizer`, exported from
+ *      `@ggui-ai/mcp-server-handlers`'s ops-blueprint barrel):
+ *      consulted via `resolveEffectiveAppId` on every resolution,
+ *      bound or unbound `appId` input alike. Seam unbound ⇒ legacy
+ *      bound-only posture — a cross-app `appId` input (different from
+ *      `ctx.appId`) rejects with the new `cross_app_curation_unavailable`
+ *      named code, mirroring the `app_scoped_keys_unavailable` idiom
+ *      from the 2026-07-29 ops slice. Seam bound and denying ⇒
+ *      `app_curation_denied` with a `not_found` / `not_owner` reason.
+ *      `@ggui-ai/mcp-server`'s default server binds an allow-all
+ *      authorizer when the operator supplies none — the
+ *      single-operator trust model: whoever runs the server operates
+ *      every app on it.
+ *
+ *   ob3. **Deployment boundary retired.** The restriction that pinned
+ *      this family to the OSS default server only (2026-08-13 ruling,
+ *      ggui#496) is retired: the family now mounts on any control
+ *      plane whose deployment supplies the store/search/authorizer
+ *      deps. Single-operator deployments bind an allow-all
+ *      authorizer; multi-user deployments supply one that enforces
+ *      their ownership model.
+ *
+ * Conformance-kit verdict: ops tools are not conformance-kit surface —
+ * NO protocol stamp roll.
+ *
+ * Package version — classification MADE here: MINOR for
+ * `@ggui-ai/protocol`, `@ggui-ai/mcp-server-handlers`,
+ * `@ggui-ai/mcp-server` (additive), pre-1.0 and pre-launch.
+ * PROTOCOL_VERSION unchanged.
+ * --------------------------------------------------------------------
+ * `ggui_get_render_source` data-plane tool (2026-08-14, additive,
+ * pre-launch, ggui#282). New bare-wire-name MCP tool, `agent`
+ * audience — the calling app reads the generated source of its OWN
+ * render as `{sessionId, blueprint: {source, contract?,
+ * fixtureProps?}}`. New input shape `getRenderSourceInputShape`
+ * (mirrors `getSessionInputShape`) and output type
+ * `GguiGetRenderSourceOutput` added to `@ggui-ai/protocol`; new
+ * factory `createGguiGetRenderSourceHandler` (modeled on
+ * `createGguiGetSessionHandler` — same tenancy posture via
+ * `ctx.appId`, no heartbeat) plus the shared
+ * `buildRenderSourceEnvelope` helper added to
+ * `@ggui-ai/mcp-server-handlers`. The pre-existing control-plane
+ * `ggui_ops_get_render_source` (cloud-only, connector-key tenancy —
+ * a different caller, unchanged contract) now imports the SAME
+ * shared helper so the two tools' envelope shape cannot drift apart;
+ * a behavior-neutral refactor pinned by an envelope-equivalence test.
+ * No existing wire shape changed.
+ *
+ * Conformance-kit verdict: no kit entry required. The kit's WS
+ * live-channel conformance surface (`@ggui-ai/protocol-conformance`)
+ * has zero enumeration of MCP tool names anywhere in its source —
+ * verified by grepping the package for `ggui_` tool-name references
+ * outside its fixtures/tests, which returns nothing; it grades
+ * `GguiSessionChannelServer` wire-frame behavior (ack/error/data,
+ * echoed requestId, session-state read-back), a surface this
+ * addition never touches.
+ *
+ * Package version — the classification is MADE here, not deferred:
+ * MINOR for `@ggui-ai/protocol` (new exports, additive) and
+ * `@ggui-ai/mcp-server-handlers` (new factory + shared helper,
+ * additive), pre-1.0 and pre-launch. PROTOCOL_VERSION is unchanged —
+ * no WS envelope moved.
+ * --------------------------------------------------------------------
  * MCP tool bindings & discovery (2026-08-10, additive, pre-launch,
  * ggui#259). Artifacts gain an optional MCP tool-binding list and
  * registry search gains a tool dimension, connecting the two
@@ -304,6 +429,23 @@
  * it), not a new member.
  *
  * --------------------------------------------------------------------
+ * Render outcome facet (2026-08-13, ggui#495; rides the next cut
+ * after 0.9.0 — additive MINOR): `ComponentGguiSession` gains
+ * `errorCode?: RenderErrorCode` — the SAME closed enum the §7.1
+ * failure envelope carries, persisted on the committed error render
+ * beside the existing `error` message (invariant: `errorCode` ⇒
+ * `error`; one writer, the failure commit). Deliberately NOT a new
+ * `GguiSessionStatus` member: outcome ⊥ lifecycle — errored rows
+ * still TTL-expire. New exported predicate `isErroredGguiSession` +
+ * accessor `erroredGguiSessionCode` are the single normative
+ * definition of "errored" (message-only legacy rows count); store
+ * `erroredOnly` filters (GguiSessionFilter, all three stores) and
+ * `ggui_ops_list_recent_renders`' new `erroredOnly` arg + per-row
+ * `errorCode` derive from them. The canonical `RenderErrorCode` type
+ * declaration moved from `types/mcp.ts` beside its schema in
+ * `schemas/mcp.ts` (types/mcp re-exports — import paths unchanged).
+ *
+ * --------------------------------------------------------------------
  * React/RN SDK-surface retirement (2026-08-13, owner ruling; rides
  * the same next cut ≥ 0.9.0): `@ggui-ai/react` + `@ggui-ai/react-
  * native` are MCP Apps HOST-HELPER libraries, not SDKs — embeds mount
@@ -2905,8 +3047,33 @@
  *      and the WS frame discriminators `'render'` / `'render_event'`.
  *      OSS-first; the cloud pod follows at its next image build. See
  *      `docs/protocol/migrations/2026-06-05-gguisession-reintroduction.md`.
+ *
+ * draft-2026-08-19 — SCHEMA-PRECISE RENDER (additive minor; frozen
+ *      shape per the 2026-08-19 consumer review, design record
+ *      `docs/plans/2026-08-19-schema-precise-render.md`):
+ *
+ *   c1. **Enforced props schema on the handshake output** (SPEC
+ *      §2.3.2 + §7.1.1). `GguiHandshakeOutput` gains `propsSchema?`
+ *      (the exact schema the paired render enforces, emission form,
+ *      RFC 8785-canonical construction), `propsSchemaHash?` (sha256
+ *      over the canonical bytes; on EVERY non-declined handshake) and
+ *      `propsSchemaProfile?` ('grammar-safe' | 'full'; unknown values
+ *      degrade to 'full'). The record persists the artifact and
+ *      `ggui_render` validates against the PERSISTED value — the
+ *      AUTHORITY obligation is structural under version skew.
+ *   c2. **`ContractViolation.keyword`** (additive) + **`propsSchemaHash`
+ *      on `contract_violation` error data** — the failure-class
+ *      segmentation and breach-classifier surfaces (SPEC §7.9).
+ *   c3. **`JsonSchema.type` admits draft-07 type arrays**
+ *      (`['string','null']` — the canonical nullability form the
+ *      emission rewrites OpenAPI `nullable: true` into). Acceptance
+ *      widening only; the schema-subset checker compares type SETS.
+ *   c4. **Conformance:** the `props-schema-conformance` catalog
+ *      (drift / hash / profile / authority obligations; pins the
+ *      2026-08-19 out-of-vocabulary enum incident as a permanent
+ *      sample).
  */
-export declare const PROTOCOL_VERSION = "draft-2026-06-12";
+export declare const PROTOCOL_VERSION = "draft-2026-08-19";
 /**
  * Schema version stamped onto wire envelopes that opt into the
  * `schemaVersion` forward-compat field (see {@link ActionEnvelope},
@@ -2927,7 +3094,7 @@ export declare const PROTOCOL_VERSION = "draft-2026-06-12";
  * consumers can reference schema-versioning specifically without
  * coupling to the broader cache-invalidation constant.
  */
-export declare const PROTOCOL_SCHEMA_VERSION = "draft-2026-06-12";
+export declare const PROTOCOL_SCHEMA_VERSION = "draft-2026-08-19";
 /**
  * Canonical live-channel error code emitted when a peer's declared
  * {@link SubscribePayload.supportedVersions} /

package/dist/version.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"version.d.ts","sourceRoot":"","sources":["../src/version.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA21FG;AACH,eAAO,MAAM,gBAAgB,qBAAqB,CAAC;AAEnD;;;;;;;;;;;;;;;;;;;GAmBG;AACH,eAAO,MAAM,uBAAuB,qBAAmB,CAAC;AAExD;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,eAAO,MAAM,gBAAgB,qBAAqB,CAAC;AAEnD;;;;;;;;;;;;;;;;;;;GAmBG;AACH,eAAO,MAAM,yBAAyB,EAAE,SAAS,MAAM,EAErD,CAAC"}
+{"version":3,"file":"version.d.ts","sourceRoot":"","sources":["../src/version.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAkgGG;AACH,eAAO,MAAM,gBAAgB,qBAAqB,CAAC;AAEnD;;;;;;;;;;;;;;;;;;;GAmBG;AACH,eAAO,MAAM,uBAAuB,qBAAmB,CAAC;AAExD;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,eAAO,MAAM,gBAAgB,qBAAqB,CAAC;AAEnD;;;;;;;;;;;;;;;;;;;GAmBG;AACH,eAAO,MAAM,yBAAyB,EAAE,SAAS,MAAM,EAErD,CAAC"}

package/dist/version.js

@@ -6,6 +6,131 @@
  * schema change; the most recent change anchors {@link PROTOCOL_VERSION}.
  *
  * --------------------------------------------------------------------
+ * Authored source rides blueprint reuse (2026-08-14, additive,
+ * pre-launch). Cache-reuse renders (a repeated prompt semantic-matches
+ * a cached blueprint) previously committed without authored
+ * `sourceCode` — structurally, not incidentally: the reuse-commit path
+ * never carried it, and blueprint registry rows never persisted it, so
+ * `ggui_get_render_source` always returned `render_source_unavailable`
+ * for every reuse render.
+ *
+ *   sc1. **`Blueprint.sourceCodeHash?: string`** added to
+ *      `@ggui-ai/protocol` — content hash (`CodeStore.hashOf`) of the
+ *      AUTHORED, pre-compile source body, distinct from the existing
+ *      `codeHash` (compiled `componentCode`). The body itself is never
+ *      stored on the row — persistent adapters keep vector/metadata
+ *      rows small and content-address the body through the same
+ *      `CodeStore` seam `codeHash` already implies. Absent on legacy
+ *      rows and on blueprints with no authored form distinct from
+ *      their compiled output.
+ *
+ *   sc2. **Registration threads it through.** `registerBlueprint`
+ *      (`@ggui-ai/mcp-server-handlers`) gains an optional
+ *      `sourceCode` input; when present, distinct from the compiled
+ *      `componentCode` (fallback-collapse symmetry — a byte-identical
+ *      pair is never worth persisting, since the read-side envelope
+ *      guard would reject it anyway), and a `CodeStore` is bound, the
+ *      registry computes + persists `sourceCodeHash` on the row and
+ *      writes the body through the durability `CodeStore` (body-
+ *      before-row ordering, same orphan-body-beats-dangling-pointer
+ *      posture as the existing compiled-code write). New durability
+ *      event `blueprint_source_write_failed` (additive, sibling to
+ *      `blueprint_code_write_failed`) on a failed body write — the row
+ *      still commits with the hash; a reuse read against a missing
+ *      body degrades gracefully to `render_source_unavailable`, never
+ *      an error.
+ *
+ *   sc3. **Reuse commit threads it back.** The cache-hit reuse branch
+ *      resolves the body from `CodeStore` by the stored hash and
+ *      stamps it onto `GenerationCacheHit.sourceCode`, which
+ *      `commitCachedGguiSession` sidecars onto the render exactly like
+ *      the cold-gen commit path already does — reuse renders now serve
+ *      `ggui_get_render_source` identically to cold-gen renders.
+ *
+ * Conformance-kit verdict: no kit entry required — additive optional
+ * fields + a new durability event, no existing wire shape changed, no
+ * MCP tool name/shape touched.
+ *
+ * Package version — classification MADE here: PATCH for
+ * `@ggui-ai/protocol` (additive optional field, no new export),
+ * MINOR for `@ggui-ai/mcp-server-handlers` (new optional input field +
+ * new event), pre-1.0 and pre-launch. PROTOCOL_VERSION unchanged.
+ * --------------------------------------------------------------------
+ * ops-blueprint appId input + app-access seam (2026-08-14, additive,
+ * pre-launch, ggui#501). Cross-app curation seam for the operator-
+ * class blueprint family — the prerequisite for the family mounting
+ * beyond the OSS default server.
+ *
+ *   ob1. **Optional `appId` input** on all five `ggui_ops_*_blueprint`
+ *      tools (`generate`, `register`, `list`, `update`, `delete`).
+ *      Omitted ⇒ resolves to the caller's bound `ctx.appId` (unchanged
+ *      default behavior). Present ⇒ the tool curates the NAMED app
+ *      instead, subject to the authorizer below.
+ *
+ *   ob2. **`authorizeAppAccess` dep seam**
+ *      (`OpsBlueprintAppAuthorizer`, exported from
+ *      `@ggui-ai/mcp-server-handlers`'s ops-blueprint barrel):
+ *      consulted via `resolveEffectiveAppId` on every resolution,
+ *      bound or unbound `appId` input alike. Seam unbound ⇒ legacy
+ *      bound-only posture — a cross-app `appId` input (different from
+ *      `ctx.appId`) rejects with the new `cross_app_curation_unavailable`
+ *      named code, mirroring the `app_scoped_keys_unavailable` idiom
+ *      from the 2026-07-29 ops slice. Seam bound and denying ⇒
+ *      `app_curation_denied` with a `not_found` / `not_owner` reason.
+ *      `@ggui-ai/mcp-server`'s default server binds an allow-all
+ *      authorizer when the operator supplies none — the
+ *      single-operator trust model: whoever runs the server operates
+ *      every app on it.
+ *
+ *   ob3. **Deployment boundary retired.** The restriction that pinned
+ *      this family to the OSS default server only (2026-08-13 ruling,
+ *      ggui#496) is retired: the family now mounts on any control
+ *      plane whose deployment supplies the store/search/authorizer
+ *      deps. Single-operator deployments bind an allow-all
+ *      authorizer; multi-user deployments supply one that enforces
+ *      their ownership model.
+ *
+ * Conformance-kit verdict: ops tools are not conformance-kit surface —
+ * NO protocol stamp roll.
+ *
+ * Package version — classification MADE here: MINOR for
+ * `@ggui-ai/protocol`, `@ggui-ai/mcp-server-handlers`,
+ * `@ggui-ai/mcp-server` (additive), pre-1.0 and pre-launch.
+ * PROTOCOL_VERSION unchanged.
+ * --------------------------------------------------------------------
+ * `ggui_get_render_source` data-plane tool (2026-08-14, additive,
+ * pre-launch, ggui#282). New bare-wire-name MCP tool, `agent`
+ * audience — the calling app reads the generated source of its OWN
+ * render as `{sessionId, blueprint: {source, contract?,
+ * fixtureProps?}}`. New input shape `getRenderSourceInputShape`
+ * (mirrors `getSessionInputShape`) and output type
+ * `GguiGetRenderSourceOutput` added to `@ggui-ai/protocol`; new
+ * factory `createGguiGetRenderSourceHandler` (modeled on
+ * `createGguiGetSessionHandler` — same tenancy posture via
+ * `ctx.appId`, no heartbeat) plus the shared
+ * `buildRenderSourceEnvelope` helper added to
+ * `@ggui-ai/mcp-server-handlers`. The pre-existing control-plane
+ * `ggui_ops_get_render_source` (cloud-only, connector-key tenancy —
+ * a different caller, unchanged contract) now imports the SAME
+ * shared helper so the two tools' envelope shape cannot drift apart;
+ * a behavior-neutral refactor pinned by an envelope-equivalence test.
+ * No existing wire shape changed.
+ *
+ * Conformance-kit verdict: no kit entry required. The kit's WS
+ * live-channel conformance surface (`@ggui-ai/protocol-conformance`)
+ * has zero enumeration of MCP tool names anywhere in its source —
+ * verified by grepping the package for `ggui_` tool-name references
+ * outside its fixtures/tests, which returns nothing; it grades
+ * `GguiSessionChannelServer` wire-frame behavior (ack/error/data,
+ * echoed requestId, session-state read-back), a surface this
+ * addition never touches.
+ *
+ * Package version — the classification is MADE here, not deferred:
+ * MINOR for `@ggui-ai/protocol` (new exports, additive) and
+ * `@ggui-ai/mcp-server-handlers` (new factory + shared helper,
+ * additive), pre-1.0 and pre-launch. PROTOCOL_VERSION is unchanged —
+ * no WS envelope moved.
+ * --------------------------------------------------------------------
  * MCP tool bindings & discovery (2026-08-10, additive, pre-launch,
  * ggui#259). Artifacts gain an optional MCP tool-binding list and
  * registry search gains a tool dimension, connecting the two
@@ -304,6 +429,23 @@
  * it), not a new member.
  *
  * --------------------------------------------------------------------
+ * Render outcome facet (2026-08-13, ggui#495; rides the next cut
+ * after 0.9.0 — additive MINOR): `ComponentGguiSession` gains
+ * `errorCode?: RenderErrorCode` — the SAME closed enum the §7.1
+ * failure envelope carries, persisted on the committed error render
+ * beside the existing `error` message (invariant: `errorCode` ⇒
+ * `error`; one writer, the failure commit). Deliberately NOT a new
+ * `GguiSessionStatus` member: outcome ⊥ lifecycle — errored rows
+ * still TTL-expire. New exported predicate `isErroredGguiSession` +
+ * accessor `erroredGguiSessionCode` are the single normative
+ * definition of "errored" (message-only legacy rows count); store
+ * `erroredOnly` filters (GguiSessionFilter, all three stores) and
+ * `ggui_ops_list_recent_renders`' new `erroredOnly` arg + per-row
+ * `errorCode` derive from them. The canonical `RenderErrorCode` type
+ * declaration moved from `types/mcp.ts` beside its schema in
+ * `schemas/mcp.ts` (types/mcp re-exports — import paths unchanged).
+ *
+ * --------------------------------------------------------------------
  * React/RN SDK-surface retirement (2026-08-13, owner ruling; rides
  * the same next cut ≥ 0.9.0): `@ggui-ai/react` + `@ggui-ai/react-
  * native` are MCP Apps HOST-HELPER libraries, not SDKs — embeds mount
@@ -2905,8 +3047,33 @@
  *      and the WS frame discriminators `'render'` / `'render_event'`.
  *      OSS-first; the cloud pod follows at its next image build. See
  *      `docs/protocol/migrations/2026-06-05-gguisession-reintroduction.md`.
+ *
+ * draft-2026-08-19 — SCHEMA-PRECISE RENDER (additive minor; frozen
+ *      shape per the 2026-08-19 consumer review, design record
+ *      `docs/plans/2026-08-19-schema-precise-render.md`):
+ *
+ *   c1. **Enforced props schema on the handshake output** (SPEC
+ *      §2.3.2 + §7.1.1). `GguiHandshakeOutput` gains `propsSchema?`
+ *      (the exact schema the paired render enforces, emission form,
+ *      RFC 8785-canonical construction), `propsSchemaHash?` (sha256
+ *      over the canonical bytes; on EVERY non-declined handshake) and
+ *      `propsSchemaProfile?` ('grammar-safe' | 'full'; unknown values
+ *      degrade to 'full'). The record persists the artifact and
+ *      `ggui_render` validates against the PERSISTED value — the
+ *      AUTHORITY obligation is structural under version skew.
+ *   c2. **`ContractViolation.keyword`** (additive) + **`propsSchemaHash`
+ *      on `contract_violation` error data** — the failure-class
+ *      segmentation and breach-classifier surfaces (SPEC §7.9).
+ *   c3. **`JsonSchema.type` admits draft-07 type arrays**
+ *      (`['string','null']` — the canonical nullability form the
+ *      emission rewrites OpenAPI `nullable: true` into). Acceptance
+ *      widening only; the schema-subset checker compares type SETS.
+ *   c4. **Conformance:** the `props-schema-conformance` catalog
+ *      (drift / hash / profile / authority obligations; pins the
+ *      2026-08-19 out-of-vocabulary enum incident as a permanent
+ *      sample).
  */
-export const PROTOCOL_VERSION = "draft-2026-06-12";
+export const PROTOCOL_VERSION = "draft-2026-08-19";
 /**
  * Schema version stamped onto wire envelopes that opt into the
  * `schemaVersion` forward-compat field (see {@link ActionEnvelope},

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ggui-ai/protocol",
-  "version": "0.9.0",
+  "version": "0.10.0",
   "description": "ggui protocol types — events, renders, WebSocket, MCP, LLM models",
   "license": "Apache-2.0",
   "keywords": [
@@ -50,6 +50,12 @@
       "require": "./dist/registry/blueprint-key.js",
       "default": "./dist/registry/blueprint-key.js"
     },
+    "./props-schema-hash": {
+      "types": "./dist/registry/props-schema-hash.d.ts",
+      "import": "./dist/registry/props-schema-hash.js",
+      "require": "./dist/registry/props-schema-hash.js",
+      "default": "./dist/registry/props-schema-hash.js"
+    },
     "./transport/websocket": {
       "types": "./dist/transport/websocket.d.ts",
       "import": "./dist/transport/websocket.js",