@ggui-ai/ui-gen 0.23.0 → 0.24.0

package/dist/patch.d.ts

@@ -2,7 +2,8 @@ import { PatchFn } from './harness/types-public.js';
 import '@ggui-ai/protocol';
 import './styling-profile-CxfvV48g.js';
 import './axes-CzLEMDeB.js';
-import './types-public-Ow-tNtFE.js';
+import './types-public-Bk6d1WLN.js';
+import '@ggui-ai/mcp-server-core';
 import './design-mode-DLufhrNp.js';
 import './types-BOvHNG7K.js';
 import './llm.js';

package/dist/policy.d.ts

@@ -47,12 +47,15 @@ interface ContextPolicy {
      * Axis-keyed primitives doc slice. When `"axis-keyed"`, the first-turn
      * system prompt injects only the allowlisted primitives derived from
      * the classification, shrinking the ~130 KB monolith to ~30–50 KB.
-     * Default `"full"`.
+     * `"axis-keyed+contract"` adds the input primitives the contract's own
+     * fields imply (ggui#1324: the axis slice alone dropped `Input` /
+     * `TextArea` from a card that edits a string). Default `"full"`.
      */
-    readonly primitiveDocSlice?: "full" | "axis-keyed";
+    readonly primitiveDocSlice?: "full" | "axis-keyed" | "axis-keyed+contract";
     /**
-     * Primitives to exclude from the axis-keyed slice. Only meaningful
-     * when `primitiveDocSlice === "axis-keyed"`.
+     * Primitives to exclude from the axis-keyed slice (applied after the
+     * contract additions under `"axis-keyed+contract"`). Only meaningful
+     * when `primitiveDocSlice` is one of the two slice modes.
      */
     readonly primitiveDocExcludes?: readonly string[];
     /**

package/dist/policy.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../src/policy.ts"],"names":[],"mappings":";AAuLO,IAAM,sBAAA,GAAwC,OAAO,MAAA,CAAO;AAAA,EACjE,gBAAA,EAAkB,KAAA;AAAA,EAClB,YAAA,EAAc,KAAA;AAAA,EACd,mBAAA,EAAqB,KAAA;AAAA,EACrB,eAAA,EAAiB,QAAA;AAAA,EACjB,iBAAA,EAAmB,MAAA;AAAA,EACnB,QAAA,EAAU,KAAA;AAAA,EACV,cAAA,EAAgB,KAAA;AAAA,EAChB,wBAAA,EAA0B,KAAA;AAAA,EAC1B,sBAAA,EAAwB,KAAA;AAAA;AAAA;AAAA;AAAA,EAIxB,kBAAA,EAAoB,IAAA;AAAA,EACpB,aAAA,EAAe,KAAA;AAAA;AAAA;AAAA;AAAA,EAIf,UAAA,EAAY;AACd,CAAC;AAEM,IAAM,sBAAA,GAAwC,OAAO,MAAA,CAAO;AAAA,EACjE,OAAA,EAAS;AACX,CAAC;AAiBM,SAAS,qBAAqB,eAAA,EAAgD;AACnF,EAAA,OAAO,sBAAA;AACT;AAUO,SAAS,gBAAA,CACd,SACA,WAAA,EACmB;AACnB,EAAA,OAAO,OAAA,CAAQ,MAAA;AACjB;AAcO,SAAS,uBAAuB,MAAA,EAAgC;AACrE,EAAA,OACE,OAAO,OAAA,CAAQ,gBAAA,KAAqB,uBAAuB,gBAAA,IAC3D,MAAA,CAAO,QAAQ,YAAA,KAAiB,sBAAA,CAAuB,YAAA,IACvD,MAAA,CAAO,QAAQ,mBAAA,KAAwB,sBAAA,CAAuB,wBAC7D,MAAA,CAAO,OAAA,CAAQ,mBAAmB,QAAA,OAChC,sBAAA,CAAuB,eAAA,IAAmB,QAAA,CAAA,IAAA,CAC5C,OAAO,OAAA,CAAQ,iBAAA,IAAqB,aAClC,sBAAA,CAAuB,iBAAA,IAAqB,YAC9C,MAAA,CAAO,OAAA,CAAQ,oBAAA,EAAsB,MAAA,IAAU,OAAO,CAAA,IAAA,CACtD,MAAA,CAAO,QAAQ,QAAA,IAAY,KAAA,OAAY,uBAAuB,QAAA,IAAY,KAAA,CAAA,IAAA,CAC1E,MAAA,CAAO,OAAA,CAAQ,kBAAkB,KAAA,OAC/B,sBAAA,CAAuB,kBAAkB,KAAA,CAAA,IAAA,CAC3C,MAAA,CAAO,QAAQ,wBAAA,IAA4B,KAAA,OACzC,sBAAA,CAAuB,wBAAA,IAA4B,WACrD,MAAA,CAAO,OAAA,CAAQ,0BAA0B,KAAA,OACvC,sBAAA,CAAuB,0BAA0B,KAAA,CAAA,IAAA,CACnD,MAAA,CAAO,OAAA,CAAQ,kBAAA,IAAsB,iBACnC,sBAAA,CAAuB,kBAAA,IAAsB,gBAC/C,MAAA,CAAO,OAAA,CAAQ,iBAAiB,KAAA,OAC9B,sBAAA,CAAuB,iBAAiB,KAAA,CAAA,IAAA,CAC1C,MAAA,CAAO,QAAQ,UAAA,IAAc,OAAA,OAC3B,uBAAuB,UAAA,IAAc,OAAA,CAAA,IACxC,OAAO,WAAA,KAAgB,MAAA;AAE3B","file":"policy.js","sourcesContent":["// packages/ui-gen/src/policy.ts\n//\n// Harness policy — validated defaults + identity resolvers.\n//\n// What lives here is the CONTRACT layer + the SHIPPING DEFAULTS:\n//   - Type vocabulary every harness is built against\n//     (ContextPolicy, HarnessPolicy, RuntimeCtx, ResolvedRunPolicy,\n//      ProcessMode).\n//   - The default values that reflect the current best-known harness\n//     (DEFAULT_CONTEXT_POLICY, DEFAULT_HARNESS_POLICY), updated as new\n//     configurations ship as new defaults.\n//   - The structural-equality check `isDefaultHarnessPolicy`, used by\n//     createHarness to decide whether policy participates in the\n//     harness id (a harness running the vanilla default policy gets a\n//     byte-identical id regardless of how the policy was constructed).\n//   - The default `resolveHarnessPolicy(classification)` (returns\n//     `DEFAULT_HARNESS_POLICY` for every classification — no ENV\n//     profile branches here).\n//   - The identity `resolveRunPolicy(harness, runtimeCtx)` (returns\n//     `harness.policy` unchanged — no per-model registry lookup here).\n//\n// What does NOT live here (it lives in `./harness/policy.ts`, the\n// experiment layer that wraps this module):\n//   - `GGUI_POLICY_PROFILE` environment-variable reading.\n//   - The named experimental profile branches\n//     (narrow-merge-v1, hashline-v2, tool-driven-primitives-*,\n//      primitives-ts-format, tsformat-plan-impl, numberline-flat,\n//      legacy-code-array, hashline-v2-flat).\n//   - `resolveRunPolicyForProfile`.\n//   - The per-model `MODEL_HARNESS_REGISTRY` consultation in\n//     `resolveRunPolicy`.\n// Those are experiment plumbing — a new arm lives in the wrapper layer\n// until it is validated, then graduates into the defaults here.\n\nimport type { Classification } from \"./classifier/axes.js\";\n\n// ─── Execution topology ────────────────────────────────────────────────────\n\n/**\n * Coarse execution-topology label attached to `ProcessLeg`. The workflow\n * DAG itself is the source of truth; this is a label on it, used by filters\n * and by `HarnessPolicy.processMode` to override the default `\"single_pass\"`.\n */\nexport type ProcessMode = \"single_pass\" | \"staged\" | \"staged-concurrent\";\n\n// ─── ContextPolicy ─────────────────────────────────────────────────────────\n\n/**\n * Context-leg policy. Controls the SHAPE of feedback the LLM sees on retry /\n * patch surfaces, the format of the primitives reference, and the tool-grammar\n * schema of `apply_changes`. Does NOT change what errors get caught or how\n * the code executes — only how errors get rendered back to the LLM and how\n * the primitive documentation is staged on turn 1.\n *\n * Every field is documented against the experiment that justified it. The\n * defaults in `DEFAULT_CONTEXT_POLICY` reflect the current best-known\n * harness; changing a default here is a semver-major-level event for\n * a hosted closed runtime (which shifts every benchmark cell) and\n * deserves its own commit with bench evidence.\n */\nexport interface ContextPolicy {\n  /**\n   * Prefix the preflight `PATCH_INVALID` retry message with `[P0-compile]`\n   * so the LLM can rank it against the prompt's P0/P1/P2 priority schema.\n   * Default `false`.\n   */\n  readonly labeledPreflight: boolean;\n  /**\n   * Reserved for future plumbing. When true, would prefix tier-0 self-check\n   * retry violations with `[P0-*]` / `[P1-*]` priority tags. Default false.\n   */\n  readonly labeledTier0: boolean;\n  /**\n   * When true, the coding loop detects duplicate patch/error-class\n   * fingerprints across consecutive patch turns and, on match, runs the\n   * action chosen by {@link dupeBreakAction}. Default false.\n   */\n  readonly breakDuplicatePatch: boolean;\n  /**\n   * When `breakDuplicatePatch` fires, choose the intervention. Default\n   * `\"escape\"` for back-compat with the dormant scoped-escape plumbing —\n   * has no effect unless `breakDuplicatePatch` is also true.\n   */\n  readonly dupeBreakAction?: \"escape\" | \"diagnostic\" | \"diagnostic-noforce\";\n  /**\n   * Axis-keyed primitives doc slice. When `\"axis-keyed\"`, the first-turn\n   * system prompt injects only the allowlisted primitives derived from\n   * the classification, shrinking the ~130 KB monolith to ~30–50 KB.\n   * Default `\"full\"`.\n   */\n  readonly primitiveDocSlice?: \"full\" | \"axis-keyed\";\n  /**\n   * Primitives to exclude from the axis-keyed slice. Only meaningful\n   * when `primitiveDocSlice === \"axis-keyed\"`.\n   */\n  readonly primitiveDocExcludes?: readonly string[];\n  /**\n   * Hashline view format on `## Current File` + hash-verified\n   * apply_changes line refs. Default `\"off\"`.\n   */\n  readonly hashline?: \"off\" | \"v2\";\n  /**\n   * Tool-driven primitive docs. When `\"names-only\"` or `\"with-props\"`,\n   * the ~130 KB primitives doc is replaced with a compact ~7–9 KB index\n   * and `get_components_info` is advertised alongside the authoring tool.\n   * Default `\"off\"`.\n   */\n  readonly primitiveIndex?: \"off\" | \"names-only\" | \"with-props\";\n  /**\n   * Force turn 1 to advertise ONLY `get_components_info`. Requires\n   * `primitiveIndex !== \"off\"`. Default `false`.\n   */\n  readonly primitiveIndexForceFetch?: boolean;\n  /**\n   * Force turn 2 to advertise ONLY `write_plan`. Requires\n   * `primitiveIndex !== \"off\"` and typically `primitiveIndexForceFetch`.\n   * Default `false`.\n   */\n  readonly primitiveIndexPlanTurn?: boolean;\n  /**\n   * Format of the primitive component reference. `\"markdown\"` = verbose\n   * markdown tables (~128 KB); `\"ts\"` = compact TS-interface format\n   * (~59 KB, same enum coverage). The TS format is the shipped default.\n   */\n  readonly primitiveDocFormat?: \"markdown\" | \"ts\";\n  /**\n   * Force turn 1 to advertise ONLY `write_plan`. Orthogonal to\n   * `primitiveIndex`. Default `false`.\n   */\n  readonly planFirstTurn?: boolean;\n  /**\n   * apply_changes `code` field schema. `\"array\"` = `string[]` (one line\n   * per element); `\"flat\"` = single string with `\\n` separators (3 JSON\n   * nesting levels instead of 4). The flat format is the shipped\n   * default.\n   */\n  readonly codeFormat?: \"array\" | \"flat\";\n}\n\n// ─── HarnessPolicy + runtime context ───────────────────────────────────────\n\n/**\n * Top-level policy attached to a harness. v1 defines only the context\n * sub-policy + an optional process-mode override. More sub-policies\n * (eval, retry, process-specific) will land when they have a first real\n * field with clean semantics.\n */\nexport interface HarnessPolicy {\n  readonly context: ContextPolicy;\n  /**\n   * Process-leg mode override. When set, `createHarness` uses this value\n   * instead of the default `\"single_pass\"`. Null/undefined → default.\n   */\n  readonly processMode?: ProcessMode;\n}\n\n/**\n * Runtime context visible at dispatch time. v1 carries `provider` +\n * optional `modelId`. Future fields (observed axis values, capability\n * flags) may appear as warranted.\n */\nexport interface RuntimeCtx {\n  readonly provider: \"anthropic\" | \"openai\" | \"google\" | \"openrouter\";\n  /**\n   * Model id as passed to the provider SDK. Optional — when absent,\n   * runtime policy resolution falls through to provider-level and\n   * default resolution only.\n   */\n  readonly modelId?: string;\n}\n\n/**\n * Runtime-resolved policy. Identical shape to {@link HarnessPolicy} for\n * v1 — the default {@link resolveRunPolicy} is an identity. The separate\n * type exists as a parking spot for future provider-aware overrides so\n * callers can start typing `ResolvedRunPolicy` today and get new fields\n * automatically when they land.\n */\nexport type ResolvedRunPolicy = HarnessPolicy;\n\n// ─── Defaults ──────────────────────────────────────────────────────────────\n\n/** Validated shipping defaults for the generation harness. */\nexport const DEFAULT_CONTEXT_POLICY: ContextPolicy = Object.freeze({\n  labeledPreflight: false,\n  labeledTier0: false,\n  breakDuplicatePatch: false,\n  dupeBreakAction: \"escape\",\n  primitiveDocSlice: \"full\",\n  hashline: \"off\",\n  primitiveIndex: \"off\",\n  primitiveIndexForceFetch: false,\n  primitiveIndexPlanTurn: false,\n  // A processed TypeScript-interface format for the primitive docs,\n  // chosen over verbose markdown tables: roughly half the size with no\n  // loss of enum-value information.\n  primitiveDocFormat: \"ts\",\n  planFirstTurn: false,\n  // A flat `code: string` patch payload instead of `code: string[]`.\n  // The shallower JSON nesting is more reliably decoded by tool-calling\n  // models.\n  codeFormat: \"flat\",\n});\n\nexport const DEFAULT_HARNESS_POLICY: HarnessPolicy = Object.freeze({\n  context: DEFAULT_CONTEXT_POLICY,\n});\n\n// ─── Resolvers (defaults + identity) ───────────────────────────────────────\n\n/**\n * Default harness-policy resolver — v1 returns `DEFAULT_HARNESS_POLICY`\n * for every classification. A hosted closed runtime can overlay its own\n * funnel profile-branching wrapper around this; OSS consumers get this\n * single default path and can wrap it themselves if they need\n * classification-aware overrides.\n *\n * Preserves reference equality: every call on every classification\n * returns the same frozen singleton object, so callers can use\n * `resolved === DEFAULT_HARNESS_POLICY` to detect the vanilla path\n * (used by `createHarness` via `isDefaultHarnessPolicy` to keep\n * `harness.id` byte-identical on the default path).\n */\nexport function resolveHarnessPolicy(_classification: Classification): HarnessPolicy {\n  return DEFAULT_HARNESS_POLICY;\n}\n\n/**\n * Identity run-time resolver — returns `harness.policy` unchanged for\n * any runtime context. A hosted closed runtime can overlay a per-model\n * registry lookup on top (graduating bench-validated overrides per\n * model id); OSS consumers get the identity, preserving reference\n * equality so `resolved === harness.policy` detects \"no override\n * applied.\"\n */\nexport function resolveRunPolicy(\n  harness: { readonly policy: HarnessPolicy },\n  _runtimeCtx: RuntimeCtx,\n): ResolvedRunPolicy {\n  return harness.policy;\n}\n\n// ─── Structural-equality check ─────────────────────────────────────────────\n\n/**\n * Structural equality against `DEFAULT_HARNESS_POLICY`. Used by\n * `createHarness` to skip hashing the policy for the vanilla case —\n * keeps `harness.id` byte-identical for every harness running the\n * default policy.\n *\n * Checks each field explicitly (including the unset-means-default\n * shorthand) instead of `policy === DEFAULT_HARNESS_POLICY` so callers\n * can pass a structurally-equivalent object they built themselves.\n */\nexport function isDefaultHarnessPolicy(policy: HarnessPolicy): boolean {\n  return (\n    policy.context.labeledPreflight === DEFAULT_CONTEXT_POLICY.labeledPreflight &&\n    policy.context.labeledTier0 === DEFAULT_CONTEXT_POLICY.labeledTier0 &&\n    policy.context.breakDuplicatePatch === DEFAULT_CONTEXT_POLICY.breakDuplicatePatch &&\n    (policy.context.dupeBreakAction ?? \"escape\") ===\n      (DEFAULT_CONTEXT_POLICY.dupeBreakAction ?? \"escape\") &&\n    (policy.context.primitiveDocSlice ?? \"full\") ===\n      (DEFAULT_CONTEXT_POLICY.primitiveDocSlice ?? \"full\") &&\n    (policy.context.primitiveDocExcludes?.length ?? 0) === 0 &&\n    (policy.context.hashline ?? \"off\") === (DEFAULT_CONTEXT_POLICY.hashline ?? \"off\") &&\n    (policy.context.primitiveIndex ?? \"off\") ===\n      (DEFAULT_CONTEXT_POLICY.primitiveIndex ?? \"off\") &&\n    (policy.context.primitiveIndexForceFetch ?? false) ===\n      (DEFAULT_CONTEXT_POLICY.primitiveIndexForceFetch ?? false) &&\n    (policy.context.primitiveIndexPlanTurn ?? false) ===\n      (DEFAULT_CONTEXT_POLICY.primitiveIndexPlanTurn ?? false) &&\n    (policy.context.primitiveDocFormat ?? \"markdown\") ===\n      (DEFAULT_CONTEXT_POLICY.primitiveDocFormat ?? \"markdown\") &&\n    (policy.context.planFirstTurn ?? false) ===\n      (DEFAULT_CONTEXT_POLICY.planFirstTurn ?? false) &&\n    (policy.context.codeFormat ?? \"array\") ===\n      (DEFAULT_CONTEXT_POLICY.codeFormat ?? \"array\") &&\n    policy.processMode === undefined\n  );\n}\n"]}
+{"version":3,"sources":["../src/policy.ts"],"names":[],"mappings":";AA0LO,IAAM,sBAAA,GAAwC,OAAO,MAAA,CAAO;AAAA,EACjE,gBAAA,EAAkB,KAAA;AAAA,EAClB,YAAA,EAAc,KAAA;AAAA,EACd,mBAAA,EAAqB,KAAA;AAAA,EACrB,eAAA,EAAiB,QAAA;AAAA,EACjB,iBAAA,EAAmB,MAAA;AAAA,EACnB,QAAA,EAAU,KAAA;AAAA,EACV,cAAA,EAAgB,KAAA;AAAA,EAChB,wBAAA,EAA0B,KAAA;AAAA,EAC1B,sBAAA,EAAwB,KAAA;AAAA;AAAA;AAAA;AAAA,EAIxB,kBAAA,EAAoB,IAAA;AAAA,EACpB,aAAA,EAAe,KAAA;AAAA;AAAA;AAAA;AAAA,EAIf,UAAA,EAAY;AACd,CAAC;AAEM,IAAM,sBAAA,GAAwC,OAAO,MAAA,CAAO;AAAA,EACjE,OAAA,EAAS;AACX,CAAC;AAiBM,SAAS,qBAAqB,eAAA,EAAgD;AACnF,EAAA,OAAO,sBAAA;AACT;AAUO,SAAS,gBAAA,CACd,SACA,WAAA,EACmB;AACnB,EAAA,OAAO,OAAA,CAAQ,MAAA;AACjB;AAcO,SAAS,uBAAuB,MAAA,EAAgC;AACrE,EAAA,OACE,OAAO,OAAA,CAAQ,gBAAA,KAAqB,uBAAuB,gBAAA,IAC3D,MAAA,CAAO,QAAQ,YAAA,KAAiB,sBAAA,CAAuB,YAAA,IACvD,MAAA,CAAO,QAAQ,mBAAA,KAAwB,sBAAA,CAAuB,wBAC7D,MAAA,CAAO,OAAA,CAAQ,mBAAmB,QAAA,OAChC,sBAAA,CAAuB,eAAA,IAAmB,QAAA,CAAA,IAAA,CAC5C,OAAO,OAAA,CAAQ,iBAAA,IAAqB,aAClC,sBAAA,CAAuB,iBAAA,IAAqB,YAC9C,MAAA,CAAO,OAAA,CAAQ,oBAAA,EAAsB,MAAA,IAAU,OAAO,CAAA,IAAA,CACtD,MAAA,CAAO,QAAQ,QAAA,IAAY,KAAA,OAAY,uBAAuB,QAAA,IAAY,KAAA,CAAA,IAAA,CAC1E,MAAA,CAAO,OAAA,CAAQ,kBAAkB,KAAA,OAC/B,sBAAA,CAAuB,kBAAkB,KAAA,CAAA,IAAA,CAC3C,MAAA,CAAO,QAAQ,wBAAA,IAA4B,KAAA,OACzC,sBAAA,CAAuB,wBAAA,IAA4B,WACrD,MAAA,CAAO,OAAA,CAAQ,0BAA0B,KAAA,OACvC,sBAAA,CAAuB,0BAA0B,KAAA,CAAA,IAAA,CACnD,MAAA,CAAO,OAAA,CAAQ,kBAAA,IAAsB,iBACnC,sBAAA,CAAuB,kBAAA,IAAsB,gBAC/C,MAAA,CAAO,OAAA,CAAQ,iBAAiB,KAAA,OAC9B,sBAAA,CAAuB,iBAAiB,KAAA,CAAA,IAAA,CAC1C,MAAA,CAAO,QAAQ,UAAA,IAAc,OAAA,OAC3B,uBAAuB,UAAA,IAAc,OAAA,CAAA,IACxC,OAAO,WAAA,KAAgB,MAAA;AAE3B","file":"policy.js","sourcesContent":["// packages/ui-gen/src/policy.ts\n//\n// Harness policy — validated defaults + identity resolvers.\n//\n// What lives here is the CONTRACT layer + the SHIPPING DEFAULTS:\n//   - Type vocabulary every harness is built against\n//     (ContextPolicy, HarnessPolicy, RuntimeCtx, ResolvedRunPolicy,\n//      ProcessMode).\n//   - The default values that reflect the current best-known harness\n//     (DEFAULT_CONTEXT_POLICY, DEFAULT_HARNESS_POLICY), updated as new\n//     configurations ship as new defaults.\n//   - The structural-equality check `isDefaultHarnessPolicy`, used by\n//     createHarness to decide whether policy participates in the\n//     harness id (a harness running the vanilla default policy gets a\n//     byte-identical id regardless of how the policy was constructed).\n//   - The default `resolveHarnessPolicy(classification)` (returns\n//     `DEFAULT_HARNESS_POLICY` for every classification — no ENV\n//     profile branches here).\n//   - The identity `resolveRunPolicy(harness, runtimeCtx)` (returns\n//     `harness.policy` unchanged — no per-model registry lookup here).\n//\n// What does NOT live here (it lives in `./harness/policy.ts`, the\n// experiment layer that wraps this module):\n//   - `GGUI_POLICY_PROFILE` environment-variable reading.\n//   - The named experimental profile branches\n//     (narrow-merge-v1, hashline-v2, tool-driven-primitives-*,\n//      primitives-ts-format, tsformat-plan-impl, numberline-flat,\n//      legacy-code-array, hashline-v2-flat).\n//   - `resolveRunPolicyForProfile`.\n//   - The per-model `MODEL_HARNESS_REGISTRY` consultation in\n//     `resolveRunPolicy`.\n// Those are experiment plumbing — a new arm lives in the wrapper layer\n// until it is validated, then graduates into the defaults here.\n\nimport type { Classification } from \"./classifier/axes.js\";\n\n// ─── Execution topology ────────────────────────────────────────────────────\n\n/**\n * Coarse execution-topology label attached to `ProcessLeg`. The workflow\n * DAG itself is the source of truth; this is a label on it, used by filters\n * and by `HarnessPolicy.processMode` to override the default `\"single_pass\"`.\n */\nexport type ProcessMode = \"single_pass\" | \"staged\" | \"staged-concurrent\";\n\n// ─── ContextPolicy ─────────────────────────────────────────────────────────\n\n/**\n * Context-leg policy. Controls the SHAPE of feedback the LLM sees on retry /\n * patch surfaces, the format of the primitives reference, and the tool-grammar\n * schema of `apply_changes`. Does NOT change what errors get caught or how\n * the code executes — only how errors get rendered back to the LLM and how\n * the primitive documentation is staged on turn 1.\n *\n * Every field is documented against the experiment that justified it. The\n * defaults in `DEFAULT_CONTEXT_POLICY` reflect the current best-known\n * harness; changing a default here is a semver-major-level event for\n * a hosted closed runtime (which shifts every benchmark cell) and\n * deserves its own commit with bench evidence.\n */\nexport interface ContextPolicy {\n  /**\n   * Prefix the preflight `PATCH_INVALID` retry message with `[P0-compile]`\n   * so the LLM can rank it against the prompt's P0/P1/P2 priority schema.\n   * Default `false`.\n   */\n  readonly labeledPreflight: boolean;\n  /**\n   * Reserved for future plumbing. When true, would prefix tier-0 self-check\n   * retry violations with `[P0-*]` / `[P1-*]` priority tags. Default false.\n   */\n  readonly labeledTier0: boolean;\n  /**\n   * When true, the coding loop detects duplicate patch/error-class\n   * fingerprints across consecutive patch turns and, on match, runs the\n   * action chosen by {@link dupeBreakAction}. Default false.\n   */\n  readonly breakDuplicatePatch: boolean;\n  /**\n   * When `breakDuplicatePatch` fires, choose the intervention. Default\n   * `\"escape\"` for back-compat with the dormant scoped-escape plumbing —\n   * has no effect unless `breakDuplicatePatch` is also true.\n   */\n  readonly dupeBreakAction?: \"escape\" | \"diagnostic\" | \"diagnostic-noforce\";\n  /**\n   * Axis-keyed primitives doc slice. When `\"axis-keyed\"`, the first-turn\n   * system prompt injects only the allowlisted primitives derived from\n   * the classification, shrinking the ~130 KB monolith to ~30–50 KB.\n   * `\"axis-keyed+contract\"` adds the input primitives the contract's own\n   * fields imply (ggui#1324: the axis slice alone dropped `Input` /\n   * `TextArea` from a card that edits a string). Default `\"full\"`.\n   */\n  readonly primitiveDocSlice?: \"full\" | \"axis-keyed\" | \"axis-keyed+contract\";\n  /**\n   * Primitives to exclude from the axis-keyed slice (applied after the\n   * contract additions under `\"axis-keyed+contract\"`). Only meaningful\n   * when `primitiveDocSlice` is one of the two slice modes.\n   */\n  readonly primitiveDocExcludes?: readonly string[];\n  /**\n   * Hashline view format on `## Current File` + hash-verified\n   * apply_changes line refs. Default `\"off\"`.\n   */\n  readonly hashline?: \"off\" | \"v2\";\n  /**\n   * Tool-driven primitive docs. When `\"names-only\"` or `\"with-props\"`,\n   * the ~130 KB primitives doc is replaced with a compact ~7–9 KB index\n   * and `get_components_info` is advertised alongside the authoring tool.\n   * Default `\"off\"`.\n   */\n  readonly primitiveIndex?: \"off\" | \"names-only\" | \"with-props\";\n  /**\n   * Force turn 1 to advertise ONLY `get_components_info`. Requires\n   * `primitiveIndex !== \"off\"`. Default `false`.\n   */\n  readonly primitiveIndexForceFetch?: boolean;\n  /**\n   * Force turn 2 to advertise ONLY `write_plan`. Requires\n   * `primitiveIndex !== \"off\"` and typically `primitiveIndexForceFetch`.\n   * Default `false`.\n   */\n  readonly primitiveIndexPlanTurn?: boolean;\n  /**\n   * Format of the primitive component reference. `\"markdown\"` = verbose\n   * markdown tables (~128 KB); `\"ts\"` = compact TS-interface format\n   * (~59 KB, same enum coverage). The TS format is the shipped default.\n   */\n  readonly primitiveDocFormat?: \"markdown\" | \"ts\";\n  /**\n   * Force turn 1 to advertise ONLY `write_plan`. Orthogonal to\n   * `primitiveIndex`. Default `false`.\n   */\n  readonly planFirstTurn?: boolean;\n  /**\n   * apply_changes `code` field schema. `\"array\"` = `string[]` (one line\n   * per element); `\"flat\"` = single string with `\\n` separators (3 JSON\n   * nesting levels instead of 4). The flat format is the shipped\n   * default.\n   */\n  readonly codeFormat?: \"array\" | \"flat\";\n}\n\n// ─── HarnessPolicy + runtime context ───────────────────────────────────────\n\n/**\n * Top-level policy attached to a harness. v1 defines only the context\n * sub-policy + an optional process-mode override. More sub-policies\n * (eval, retry, process-specific) will land when they have a first real\n * field with clean semantics.\n */\nexport interface HarnessPolicy {\n  readonly context: ContextPolicy;\n  /**\n   * Process-leg mode override. When set, `createHarness` uses this value\n   * instead of the default `\"single_pass\"`. Null/undefined → default.\n   */\n  readonly processMode?: ProcessMode;\n}\n\n/**\n * Runtime context visible at dispatch time. v1 carries `provider` +\n * optional `modelId`. Future fields (observed axis values, capability\n * flags) may appear as warranted.\n */\nexport interface RuntimeCtx {\n  readonly provider: \"anthropic\" | \"openai\" | \"google\" | \"openrouter\";\n  /**\n   * Model id as passed to the provider SDK. Optional — when absent,\n   * runtime policy resolution falls through to provider-level and\n   * default resolution only.\n   */\n  readonly modelId?: string;\n}\n\n/**\n * Runtime-resolved policy. Identical shape to {@link HarnessPolicy} for\n * v1 — the default {@link resolveRunPolicy} is an identity. The separate\n * type exists as a parking spot for future provider-aware overrides so\n * callers can start typing `ResolvedRunPolicy` today and get new fields\n * automatically when they land.\n */\nexport type ResolvedRunPolicy = HarnessPolicy;\n\n// ─── Defaults ──────────────────────────────────────────────────────────────\n\n/** Validated shipping defaults for the generation harness. */\nexport const DEFAULT_CONTEXT_POLICY: ContextPolicy = Object.freeze({\n  labeledPreflight: false,\n  labeledTier0: false,\n  breakDuplicatePatch: false,\n  dupeBreakAction: \"escape\",\n  primitiveDocSlice: \"full\",\n  hashline: \"off\",\n  primitiveIndex: \"off\",\n  primitiveIndexForceFetch: false,\n  primitiveIndexPlanTurn: false,\n  // A processed TypeScript-interface format for the primitive docs,\n  // chosen over verbose markdown tables: roughly half the size with no\n  // loss of enum-value information.\n  primitiveDocFormat: \"ts\",\n  planFirstTurn: false,\n  // A flat `code: string` patch payload instead of `code: string[]`.\n  // The shallower JSON nesting is more reliably decoded by tool-calling\n  // models.\n  codeFormat: \"flat\",\n});\n\nexport const DEFAULT_HARNESS_POLICY: HarnessPolicy = Object.freeze({\n  context: DEFAULT_CONTEXT_POLICY,\n});\n\n// ─── Resolvers (defaults + identity) ───────────────────────────────────────\n\n/**\n * Default harness-policy resolver — v1 returns `DEFAULT_HARNESS_POLICY`\n * for every classification. A hosted closed runtime can overlay its own\n * funnel profile-branching wrapper around this; OSS consumers get this\n * single default path and can wrap it themselves if they need\n * classification-aware overrides.\n *\n * Preserves reference equality: every call on every classification\n * returns the same frozen singleton object, so callers can use\n * `resolved === DEFAULT_HARNESS_POLICY` to detect the vanilla path\n * (used by `createHarness` via `isDefaultHarnessPolicy` to keep\n * `harness.id` byte-identical on the default path).\n */\nexport function resolveHarnessPolicy(_classification: Classification): HarnessPolicy {\n  return DEFAULT_HARNESS_POLICY;\n}\n\n/**\n * Identity run-time resolver — returns `harness.policy` unchanged for\n * any runtime context. A hosted closed runtime can overlay a per-model\n * registry lookup on top (graduating bench-validated overrides per\n * model id); OSS consumers get the identity, preserving reference\n * equality so `resolved === harness.policy` detects \"no override\n * applied.\"\n */\nexport function resolveRunPolicy(\n  harness: { readonly policy: HarnessPolicy },\n  _runtimeCtx: RuntimeCtx,\n): ResolvedRunPolicy {\n  return harness.policy;\n}\n\n// ─── Structural-equality check ─────────────────────────────────────────────\n\n/**\n * Structural equality against `DEFAULT_HARNESS_POLICY`. Used by\n * `createHarness` to skip hashing the policy for the vanilla case —\n * keeps `harness.id` byte-identical for every harness running the\n * default policy.\n *\n * Checks each field explicitly (including the unset-means-default\n * shorthand) instead of `policy === DEFAULT_HARNESS_POLICY` so callers\n * can pass a structurally-equivalent object they built themselves.\n */\nexport function isDefaultHarnessPolicy(policy: HarnessPolicy): boolean {\n  return (\n    policy.context.labeledPreflight === DEFAULT_CONTEXT_POLICY.labeledPreflight &&\n    policy.context.labeledTier0 === DEFAULT_CONTEXT_POLICY.labeledTier0 &&\n    policy.context.breakDuplicatePatch === DEFAULT_CONTEXT_POLICY.breakDuplicatePatch &&\n    (policy.context.dupeBreakAction ?? \"escape\") ===\n      (DEFAULT_CONTEXT_POLICY.dupeBreakAction ?? \"escape\") &&\n    (policy.context.primitiveDocSlice ?? \"full\") ===\n      (DEFAULT_CONTEXT_POLICY.primitiveDocSlice ?? \"full\") &&\n    (policy.context.primitiveDocExcludes?.length ?? 0) === 0 &&\n    (policy.context.hashline ?? \"off\") === (DEFAULT_CONTEXT_POLICY.hashline ?? \"off\") &&\n    (policy.context.primitiveIndex ?? \"off\") ===\n      (DEFAULT_CONTEXT_POLICY.primitiveIndex ?? \"off\") &&\n    (policy.context.primitiveIndexForceFetch ?? false) ===\n      (DEFAULT_CONTEXT_POLICY.primitiveIndexForceFetch ?? false) &&\n    (policy.context.primitiveIndexPlanTurn ?? false) ===\n      (DEFAULT_CONTEXT_POLICY.primitiveIndexPlanTurn ?? false) &&\n    (policy.context.primitiveDocFormat ?? \"markdown\") ===\n      (DEFAULT_CONTEXT_POLICY.primitiveDocFormat ?? \"markdown\") &&\n    (policy.context.planFirstTurn ?? false) ===\n      (DEFAULT_CONTEXT_POLICY.planFirstTurn ?? false) &&\n    (policy.context.codeFormat ?? \"array\") ===\n      (DEFAULT_CONTEXT_POLICY.codeFormat ?? \"array\") &&\n    policy.processMode === undefined\n  );\n}\n"]}

package/dist/tools/render-check-worker.d.ts

@@ -1,2 +1,8 @@
+/**
+ * Parse one input document, render once, write the verdict. Whatever
+ * happens, esbuild's service is stopped before this returns (or
+ * rejects). If the service was never started, `stop()` is a no-op.
+ */
+declare function workerMain(raw: string): Promise<void>;
 
-export {  }
+export { workerMain };

package/dist/tools/render-check-worker.js

@@ -1,12 +1,16 @@
 import { createRequire } from 'module';
+import { realpathSync } from 'fs';
+import { resolve } from 'path';
+import { fileURLToPath } from 'url';
+import * as esbuild from 'esbuild';
 
 // src/tools/render-check-worker.ts
 
 // src/internal/evaluate-component-source.ts
 async function evaluateComponentSource(sourceCode, sandboxRequire) {
-  const esbuild = await import('esbuild');
+  const esbuild2 = await import('esbuild');
   const { Script } = await import('vm');
-  const cjsResult = await esbuild.transform(sourceCode, {
+  const cjsResult = await esbuild2.transform(sourceCode, {
     loader: "tsx",
     target: "es2020",
     format: "cjs",
@@ -33,24 +37,37 @@ function hostGlobals() {
 }
 
 // src/tools/render-check-worker.ts
-async function main() {
-  const raw = await readAllStdin();
-  let input;
+async function workerMain(raw) {
   try {
-    input = JSON.parse(raw);
-  } catch (err) {
-    emit({
-      ok: false,
-      error: `worker: malformed input JSON \u2014 ${err instanceof Error ? err.message : String(err)}`
-    });
-    return;
-  }
-  if (typeof input.sourceCode !== "string" || input.sourceCode.length === 0) {
-    emit({ ok: false, error: "worker: sourceCode is required" });
-    return;
+    let input;
+    try {
+      input = JSON.parse(raw);
+    } catch (err) {
+      emit({
+        ok: false,
+        error: `worker: malformed input JSON \u2014 ${err instanceof Error ? err.message : String(err)}`
+      });
+      return;
+    }
+    if (typeof input.sourceCode !== "string" || input.sourceCode.length === 0) {
+      emit({ ok: false, error: "worker: sourceCode is required" });
+      return;
+    }
+    const result = await renderOnce(input);
+    emit(result);
+  } finally {
+    try {
+      await esbuild.stop();
+    } catch (err) {
+      process.stderr.write(
+        `render-check worker: esbuild.stop() failed \u2014 ${err instanceof Error ? err.message : String(err)}
+`
+      );
+    }
   }
-  const result = await renderOnce(input);
-  emit(result);
+}
+async function main() {
+  await workerMain(await readAllStdin());
 }
 async function renderOnce(input) {
   const g = hostGlobals();
@@ -158,11 +175,26 @@ async function readAllStdin() {
   }
   return buffer;
 }
-void main().catch((err) => {
-  emit({
-    ok: false,
-    error: `worker crashed: ${err instanceof Error ? err.message : String(err)}`
+function isProcessEntry() {
+  const entry = process.argv[1];
+  if (entry === void 0) return false;
+  let entryReal;
+  try {
+    entryReal = realpathSync(resolve(entry));
+  } catch {
+    return false;
+  }
+  return entryReal === realpathSync(fileURLToPath(import.meta.url));
+}
+if (isProcessEntry()) {
+  void main().catch((err) => {
+    emit({
+      ok: false,
+      error: `worker crashed: ${err instanceof Error ? err.message : String(err)}`
+    });
   });
-});
+}
+
+export { workerMain };
 //# sourceMappingURL=render-check-worker.js.map
 //# sourceMappingURL=render-check-worker.js.map

package/dist/tools/render-check-worker.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../src/internal/evaluate-component-source.ts","../../src/internal/open-record.ts","../../src/tools/render-check-worker.ts"],"names":[],"mappings":";;;;;AAwBA,eAAsB,uBAAA,CACpB,YACA,cAAA,EACkC;AAClC,EAAA,MAAM,OAAA,GAAU,MAAM,OAAO,SAAS,CAAA;AACtC,EAAA,MAAM,EAAE,MAAA,EAAO,GAAI,MAAM,OAAO,IAAS,CAAA;AAEzC,EAAA,MAAM,SAAA,GAAY,MAAM,OAAA,CAAQ,SAAA,CAAU,UAAA,EAAY;AAAA,IACpD,MAAA,EAAQ,KAAA;AAAA,IACR,MAAA,EAAQ,QAAA;AAAA,IACR,MAAA,EAAQ,KAAA;AAAA,IACR,GAAA,EAAK,WAAA;AAAA,IACL,eAAA,EAAiB,OAAA;AAAA,IACjB,UAAA,EAAY;AAAA,GACb,CAAA;AAED,EAAA,MAAM,aAAA,GAAsD,EAAE,OAAA,EAAS,EAAC,EAAE;AAE1E,EAAA,MAAM,WAAA,GAAc,CAAA;AAAA,EAA0C,UAAU,IAAI;AAAA,EAAA,CAAA;AAC5E,EAAA,MAAM,SAAS,IAAI,MAAA,CAAO,aAAa,EAAE,QAAA,EAAU,iBAAiB,CAAA;AACpE,EAAA,MAAM,EAAA,GAAK,OAAO,gBAAA,EAAiB;AAMnC,EAAA,EAAA,CAAG,cAAA,EAAgB,aAAA,CAAc,OAAA,EAAS,aAAa,CAAA;AAEvD,EAAA,OAAO,aAAA,CAAc,OAAA;AACvB;;;ACnCO,SAAS,WAAW,CAAA,EAAoC;AAC7D,EAAA,OAAO,CAAA;AACT;AAQO,SAAS,WAAA,GAAuC;AACrD,EAAA,OAAO,WAAW,UAAU,CAAA;AAC9B;;;ACcA,eAAe,IAAA,GAAsB;AACnC,EAAA,MAAM,GAAA,GAAM,MAAM,YAAA,EAAa;AAC/B,EAAA,IAAI,KAAA;AACJ,EAAA,IAAI;AACF,IAAA,KAAA,GAAQ,IAAA,CAAK,MAAM,GAAG,CAAA;AAAA,EACxB,SAAS,GAAA,EAAK;AACZ,IAAA,IAAA,CAAK;AAAA,MACH,EAAA,EAAI,KAAA;AAAA,MACJ,KAAA,EAAO,uCACL,GAAA,YAAe,KAAA,GAAQ,IAAI,OAAA,GAAU,MAAA,CAAO,GAAG,CACjD,CAAA;AAAA,KACD,CAAA;AACD,IAAA;AAAA,EACF;AAEA,EAAA,IAAI,OAAO,KAAA,CAAM,UAAA,KAAe,YAAY,KAAA,CAAM,UAAA,CAAW,WAAW,CAAA,EAAG;AACzE,IAAA,IAAA,CAAK,EAAE,EAAA,EAAI,KAAA,EAAO,KAAA,EAAO,kCAAkC,CAAA;AAC3D,IAAA;AAAA,EACF;AAEA,EAAA,MAAM,MAAA,GAAS,MAAM,UAAA,CAAW,KAAK,CAAA;AACrC,EAAA,IAAA,CAAK,MAAM,CAAA;AACb;AAEA,eAAe,WAAW,KAAA,EAA2C;AAKnE,EAAA,MAAM,IAAI,WAAA,EAAY;AACtB,EAAA,IAAI,EAAE,YAAY,UAAA,CAAA,EAAa;AAC7B,IAAA,CAAA,CAAE,MAAA,GAAS;AAAA,MACT,kBAAkB,MAAM;AAAA,MAAC,CAAA;AAAA,MACzB,qBAAqB,MAAM;AAAA,MAAC;AAAA,KAC9B;AAAA,EACF;AACA,EAAA,IAAI,EAAE,cAAc,UAAA,CAAA,EAAa;AAC/B,IAAA,CAAA,CAAE,QAAA,GAAW;AAAA,MACX,gBAAgB,MAAM,IAAA;AAAA,MACtB,aAAA,EAAe,OAAO,EAAC,CAAA;AAAA,MACvB,kBAAkB,MAAM;AAAA,MAAC;AAAA,KAC3B;AAAA,EACF;AAEA,EAAA,IAAI;AACF,IAAA,MAAM,KAAA,GAAQ,MAAM,OAAO,OAAO,CAAA;AAClC,IAAA,MAAM,cAAA,GAAiB,MAAM,OAAO,kBAAkB,CAAA;AAEtD,IAAA,MAAM,QAAA,GAAW,aAAA,CAAc,MAAA,CAAA,IAAA,CAAY,GAAG,CAAA;AAE9C,IAAA,MAAM,cAAA,GAAiB,CAAC,EAAA,KAAwB;AAC9C,MAAA,IAAI,EAAA,KAAO,mBAAA,IAAuB,EAAA,KAAO,uBAAA,EAAyB;AAChE,QAAA,OAAO,SAAS,mBAAmB,CAAA;AAAA,MACrC;AACA,MAAA,IAAI,EAAA,KAAO,OAAA,EAAS,OAAO,QAAA,CAAS,OAAO,CAAA;AAC3C,MAAA,IAAI,EAAA,CAAG,UAAA,CAAW,iBAAiB,CAAA,EAAG;AACpC,QAAA,IAAI;AACF,UAAA,OAAO,SAAS,EAAE,CAAA;AAAA,QACpB,CAAA,CAAA,MAAQ;AAKN,UAAA,OAAO,IAAI,KAAA;AAAA,YACT,EAAC;AAAA,YACD;AAAA,cACE,GAAA,EAAK,CAAC,OAAA,EAAS,IAAA,KAAS;AACtB,gBAAA,IAAI,IAAA,KAAS,cAAc,OAAO,IAAA;AAClC,gBAAA,OAAO,CAAC;AAAA,kBACN,QAAA;AAAA,kBACA,GAAG;AAAA,sBAKH,KAAA,CAAM,aAAA;AAAA,kBACJ,KAAA;AAAA,kBACA,EAAE,gBAAA,EAAkB,MAAA,CAAO,IAAI,CAAA,EAAG,GAAG,KAAA,EAAM;AAAA,kBAC3C;AAAA,iBACF;AAAA,cACJ;AAAA;AACF,WACF;AAAA,QACF;AAAA,MACF;AACA,MAAA,MAAM,IAAI,KAAA,CAAM,CAAA,oBAAA,EAAuB,EAAE,CAAA,CAAE,CAAA;AAAA,IAC7C,CAAA;AAEA,IAAA,MAAM,gBAAgB,MAAM,uBAAA;AAAA,MAC1B,KAAA,CAAM,UAAA;AAAA,MACN;AAAA,KACF;AAEA,IAAA,MAAM,YAAY,aAAA,CAAc,OAAA;AAChC,IAAA,IAAI,OAAO,cAAc,UAAA,EAAY;AACnC,MAAA,OAAO;AAAA,QACL,EAAA,EAAI,KAAA;AAAA,QACJ,KAAA,EAAO;AAAA,OACT;AAAA,IACF;AAEA,IAAA,MAAM,OAAO,cAAA,CAAe,cAAA;AAAA,MAC1B,KAAA,CAAM,aAAA;AAAA,QACJ,SAAA;AAAA,QACA,KAAA,CAAM,eAAe;AAAC;AACxB,KACF;AAEA,IAAA,IAAI,CAAC,IAAA,IAAQ,IAAA,CAAK,MAAA,GAAS,CAAA,EAAG;AAC5B,MAAA,OAAO,EAAE,EAAA,EAAI,KAAA,EAAO,KAAA,EAAO,iCAAA,EAAkC;AAAA,IAC/D;AAEA,IAAA,OAAO,EAAE,IAAI,IAAA,EAAK;AAAA,EACpB,SAAS,GAAA,EAAK;AACZ,IAAA,MAAM,UAAU,GAAA,YAAe,KAAA,GAAQ,GAAA,CAAI,OAAA,GAAU,OAAO,GAAG,CAAA;AAC/D,IAAA,IAAI,OAAA,CAAQ,QAAA,CAAS,qCAAqC,CAAA,EAAG;AAC3D,MAAA,OAAO;AAAA,QACL,EAAA,EAAI,KAAA;AAAA,QACJ,KAAA,EAAO,iBAAiB,OAAO,CAAA,sEAAA;AAAA,OACjC;AAAA,IACF;AACA,IAAA,IAAI,OAAA,CAAQ,QAAA,CAAS,gCAAgC,CAAA,EAAG;AACtD,MAAA,OAAO;AAAA,QACL,EAAA,EAAI,KAAA;AAAA,QACJ,KAAA,EAAO,iBAAiB,OAAO,CAAA,sDAAA;AAAA,OACjC;AAAA,IACF;AACA,IAAA,IAAI,OAAA,CAAQ,QAAA,CAAS,mBAAmB,CAAA,EAAG;AACzC,MAAA,OAAO;AAAA,QACL,EAAA,EAAI,KAAA;AAAA,QACJ,KAAA,EAAO,iBAAiB,OAAO,CAAA,mEAAA;AAAA,OACjC;AAAA,IACF;AACA,IAAA,OAAO,EAAE,EAAA,EAAI,KAAA,EAAO,KAAA,EAAO,CAAA,cAAA,EAAiB,OAAO,CAAA,CAAA,EAAG;AAAA,EACxD;AACF;AAEA,SAAS,KAAK,MAAA,EAA4B;AACxC,EAAA,OAAA,CAAQ,MAAA,CAAO,KAAA,CAAM,IAAA,CAAK,SAAA,CAAU,MAAM,CAAC,CAAA;AAC7C;AAEA,eAAe,YAAA,GAAgC;AAC7C,EAAA,IAAI,MAAA,GAAS,EAAA;AACb,EAAA,OAAA,CAAQ,KAAA,CAAM,YAAY,OAAO,CAAA;AACjC,EAAA,WAAA,MAAiB,KAAA,IAAS,QAAQ,KAAA,EAAO;AACvC,IAAA,MAAA,IAAU,KAAA;AAAA,EACZ;AACA,EAAA,OAAO,MAAA;AACT;AAEA,KAAK,IAAA,EAAK,CAAE,KAAA,CAAM,CAAC,GAAA,KAAiB;AAClC,EAAA,IAAA,CAAK;AAAA,IACH,EAAA,EAAI,KAAA;AAAA,IACJ,KAAA,EAAO,mBAAmB,GAAA,YAAe,KAAA,GAAQ,IAAI,OAAA,GAAU,MAAA,CAAO,GAAG,CAAC,CAAA;AAAA,GAC3E,CAAA;AACH,CAAC,CAAA","file":"render-check-worker.js","sourcesContent":["// packages/ui-gen/src/internal/evaluate-component-source.ts\n//\n// The ONE compile-and-evaluate helper for component source: esbuild\n// TSX→CJS transform + vm.Script in-context execution behind a\n// caller-supplied `require`. Consumed by:\n//\n//   - `tools/render-check-worker.ts` — the subprocess render smoke\n//     test (host isolation lives at the spawn layer, in the parent's\n//     `tryRender` via `@ggui-ai/sandbox`).\n//   - `harness/check/runtime-render/load-component.ts` — the in-loop\n//     probe (single-realm React; caller injects module resolutions).\n//\n// The module-resolution POLICY is deliberately not shared — each\n// caller owns its own `require` shim (allowed specifiers, fallbacks,\n// error wording). What is shared is the mechanical eval pipeline:\n//\n//   1. esbuild.transform(source) → CJS\n//   2. wrap in `(function(require, exports, module) { ... })`\n//   3. vm.Script(...).runInThisContext()\n//   4. call with the caller's require + a fresh module object\n//   5. return `module.exports` read AFTER execution — esbuild's CJS\n//      output REPLACES `module.exports` (`module.exports =\n//      __toCommonJS(...)`), so the initial reference can't be trusted.\n\nexport async function evaluateComponentSource(\n  sourceCode: string,\n  sandboxRequire: (id: string) => unknown,\n): Promise<Record<string, unknown>> {\n  const esbuild = await import(\"esbuild\");\n  const { Script } = await import(\"node:vm\");\n\n  const cjsResult = await esbuild.transform(sourceCode, {\n    loader: \"tsx\",\n    target: \"es2020\",\n    format: \"cjs\",\n    jsx: \"automatic\",\n    jsxImportSource: \"react\",\n    sourcefile: \"Component.tsx\",\n  });\n\n  const sandboxModule: { exports: Record<string, unknown> } = { exports: {} };\n\n  const wrappedCode = `(function(require, exports, module) {\\n${cjsResult.code}\\n})`;\n  const script = new Script(wrappedCode, { filename: \"Component.cjs\" });\n  const fn = script.runInThisContext() as (\n    require: (id: string) => unknown,\n    exports: Record<string, unknown>,\n    module: { exports: Record<string, unknown> },\n  ) => void;\n\n  fn(sandboxRequire, sandboxModule.exports, sandboxModule);\n\n  return sandboxModule.exports;\n}\n","// packages/ui-gen/src/internal/open-record.ts\n//\n// Single documented narrowing seam for \"object used as an open\n// string-keyed property bag\" — the host global object and happy-dom's\n// `Window` both genuinely ARE open records at runtime (we install /\n// restore named globals like `window` / `document` on them by key),\n// but TypeScript cannot express that without polluting the global type\n// space via declaration merging. Centralizing the one structural\n// widening here keeps every call site cast-free.\n\n/**\n * View an object as an open string-keyed record.\n *\n * Single structural widening (`Record<string, unknown>` is assignable\n * to `object`, so the cast is checked in one direction by tsc — no\n * `unknown` erasure). Returns the SAME reference: property writes land\n * on the live object.\n */\nexport function openRecord(o: object): Record<string, unknown> {\n  return o as Record<string, unknown>;\n}\n\n/**\n * The host global object viewed as an open property bag.\n *\n * Used by the render-check pipeline (and its subprocess worker) to\n * install and restore DOM globals by name.\n */\nexport function hostGlobals(): Record<string, unknown> {\n  return openRecord(globalThis);\n}\n","/**\n * Child worker for `tryRender`. Runs the render smoke test in a\n * subprocess so the LLM-generated TSX executes outside the parent\n * Node process.\n *\n * Wire protocol (newline-delimited JSON):\n *\n *   stdin:  { sourceCode: string, sampleProps?: JsonObject }\n *   stdout: { ok: true } | { ok: false, error: string }\n *   exit:   0 on either outcome (errors are data, not status).\n *\n * Why a separate worker instead of `vm.Script.runInThisContext` in\n * the parent:\n *\n *   - `runInThisContext` runs in the parent's V8 context. A\n *     pathological component that attaches to a global, recurses\n *     into the event loop, or allocates a large buffer poisons the\n *     parent.\n *   - A subprocess gives us real kill semantics on runaway code +\n *     output caps + env isolation — delegated to\n *     `@ggui-ai/sandbox`.\n *\n * The worker still uses `vm.Script` to run compiled CJS because the\n * component needs a tailored `require` (react / jsx-runtime /\n * @ggui-ai/design only). Host-level process isolation is the\n * sandbox; module-scoped `require` is the resolution policy. The\n * mechanical compile+vm pipeline is the shared\n * `evaluateComponentSource` helper (also used by the in-loop probe's\n * `loadComponent`); only the resolution policy lives here.\n */\nimport { createRequire } from 'node:module';\nimport type { JsonObject } from '@ggui-ai/protocol';\nimport { evaluateComponentSource } from '../internal/evaluate-component-source.js';\nimport { hostGlobals } from '../internal/open-record.js';\n\ninterface WorkerInput {\n  readonly sourceCode: string;\n  readonly sampleProps?: JsonObject;\n}\n\ntype WorkerOutput =\n  | { readonly ok: true }\n  | { readonly ok: false; readonly error: string };\n\nasync function main(): Promise<void> {\n  const raw = await readAllStdin();\n  let input: WorkerInput;\n  try {\n    input = JSON.parse(raw) as WorkerInput;\n  } catch (err) {\n    emit({\n      ok: false,\n      error: `worker: malformed input JSON — ${\n        err instanceof Error ? err.message : String(err)\n      }`,\n    });\n    return;\n  }\n\n  if (typeof input.sourceCode !== 'string' || input.sourceCode.length === 0) {\n    emit({ ok: false, error: 'worker: sourceCode is required' });\n    return;\n  }\n\n  const result = await renderOnce(input);\n  emit(result);\n}\n\nasync function renderOnce(input: WorkerInput): Promise<WorkerOutput> {\n  // Minimal window/document shims — mirror the in-process impl so\n  // components that touch either global don't crash on import. The\n  // shims only need to exist for the render; they're torn down by\n  // process exit.\n  const g = hostGlobals();\n  if (!('window' in globalThis)) {\n    g.window = {\n      addEventListener: () => {},\n      removeEventListener: () => {},\n    };\n  }\n  if (!('document' in globalThis)) {\n    g.document = {\n      getElementById: () => null,\n      createElement: () => ({}),\n      addEventListener: () => {},\n    };\n  }\n\n  try {\n    const React = await import('react');\n    const ReactDOMServer = await import('react-dom/server');\n\n    const require_ = createRequire(import.meta.url);\n\n    const sandboxRequire = (id: string): unknown => {\n      if (id === 'react/jsx-runtime' || id === 'react/jsx-dev-runtime') {\n        return require_('react/jsx-runtime');\n      }\n      if (id === 'react') return require_('react');\n      if (id.startsWith('@ggui-ai/design')) {\n        try {\n          return require_(id);\n        } catch {\n          // Fallback proxy — used in environments where the real\n          // design package isn't resolvable. Each primitive becomes\n          // a pass-through `div` so the render still exercises the\n          // component's own logic.\n          return new Proxy(\n            {},\n            {\n              get: (_target, prop) => {\n                if (prop === '__esModule') return true;\n                return ({\n                  children,\n                  ...props\n                }: {\n                  children?: React.ReactNode;\n                  [key: string]: unknown;\n                }) =>\n                  React.createElement(\n                    'div',\n                    { 'data-component': String(prop), ...props },\n                    children,\n                  );\n              },\n            },\n          );\n        }\n      }\n      throw new Error(`Import not allowed: ${id}`);\n    };\n\n    const exportsRecord = await evaluateComponentSource(\n      input.sourceCode,\n      sandboxRequire,\n    );\n\n    const Component = exportsRecord.default;\n    if (typeof Component !== 'function') {\n      return {\n        ok: false,\n        error: 'No default export function found in compiled code',\n      };\n    }\n\n    const html = ReactDOMServer.renderToString(\n      React.createElement(\n        Component as React.ComponentType<JsonObject>,\n        input.sampleProps ?? {},\n      ),\n    );\n\n    if (!html || html.length < 5) {\n      return { ok: false, error: 'Component rendered empty output' };\n    }\n\n    return { ok: true };\n  } catch (err) {\n    const message = err instanceof Error ? err.message : String(err);\n    if (message.includes('Cannot read properties of undefined')) {\n      return {\n        ok: false,\n        error: `Render error: ${message}. A prop is likely undefined — add a default value or null check.`,\n      };\n    }\n    if (message.includes('Cannot read properties of null')) {\n      return {\n        ok: false,\n        error: `Render error: ${message}. A value is null — add a null check or fallback.`,\n      };\n    }\n    if (message.includes('is not a function')) {\n      return {\n        ok: false,\n        error: `Render error: ${message}. Check that all imported functions exist and are called correctly.`,\n      };\n    }\n    return { ok: false, error: `Render error: ${message}` };\n  }\n}\n\nfunction emit(output: WorkerOutput): void {\n  process.stdout.write(JSON.stringify(output));\n}\n\nasync function readAllStdin(): Promise<string> {\n  let buffer = '';\n  process.stdin.setEncoding('utf-8');\n  for await (const chunk of process.stdin) {\n    buffer += chunk as string;\n  }\n  return buffer;\n}\n\nvoid main().catch((err: unknown) => {\n  emit({\n    ok: false,\n    error: `worker crashed: ${err instanceof Error ? err.message : String(err)}`,\n  });\n});\n"]}
+{"version":3,"sources":["../../src/internal/evaluate-component-source.ts","../../src/internal/open-record.ts","../../src/tools/render-check-worker.ts"],"names":["esbuild","resolvePath"],"mappings":";;;;;;;;;AAwBA,eAAsB,uBAAA,CACpB,YACA,cAAA,EACkC;AAClC,EAAA,MAAMA,QAAAA,GAAU,MAAM,OAAO,SAAS,CAAA;AACtC,EAAA,MAAM,EAAE,MAAA,EAAO,GAAI,MAAM,OAAO,IAAS,CAAA;AAEzC,EAAA,MAAM,SAAA,GAAY,MAAMA,QAAAA,CAAQ,SAAA,CAAU,UAAA,EAAY;AAAA,IACpD,MAAA,EAAQ,KAAA;AAAA,IACR,MAAA,EAAQ,QAAA;AAAA,IACR,MAAA,EAAQ,KAAA;AAAA,IACR,GAAA,EAAK,WAAA;AAAA,IACL,eAAA,EAAiB,OAAA;AAAA,IACjB,UAAA,EAAY;AAAA,GACb,CAAA;AAED,EAAA,MAAM,aAAA,GAAsD,EAAE,OAAA,EAAS,EAAC,EAAE;AAE1E,EAAA,MAAM,WAAA,GAAc,CAAA;AAAA,EAA0C,UAAU,IAAI;AAAA,EAAA,CAAA;AAC5E,EAAA,MAAM,SAAS,IAAI,MAAA,CAAO,aAAa,EAAE,QAAA,EAAU,iBAAiB,CAAA;AACpE,EAAA,MAAM,EAAA,GAAK,OAAO,gBAAA,EAAiB;AAMnC,EAAA,EAAA,CAAG,cAAA,EAAgB,aAAA,CAAc,OAAA,EAAS,aAAa,CAAA;AAEvD,EAAA,OAAO,aAAA,CAAc,OAAA;AACvB;;;ACnCO,SAAS,WAAW,CAAA,EAAoC;AAC7D,EAAA,OAAO,CAAA;AACT;AAQO,SAAS,WAAA,GAAuC;AACrD,EAAA,OAAO,WAAW,UAAU,CAAA;AAC9B;;;AC8BA,eAAsB,WAAW,GAAA,EAA4B;AAC3D,EAAA,IAAI;AACF,IAAA,IAAI,KAAA;AACJ,IAAA,IAAI;AACF,MAAA,KAAA,GAAQ,IAAA,CAAK,MAAM,GAAG,CAAA;AAAA,IACxB,SAAS,GAAA,EAAK;AACZ,MAAA,IAAA,CAAK;AAAA,QACH,EAAA,EAAI,KAAA;AAAA,QACJ,KAAA,EAAO,uCACL,GAAA,YAAe,KAAA,GAAQ,IAAI,OAAA,GAAU,MAAA,CAAO,GAAG,CACjD,CAAA;AAAA,OACD,CAAA;AACD,MAAA;AAAA,IACF;AAEA,IAAA,IAAI,OAAO,KAAA,CAAM,UAAA,KAAe,YAAY,KAAA,CAAM,UAAA,CAAW,WAAW,CAAA,EAAG;AACzE,MAAA,IAAA,CAAK,EAAE,EAAA,EAAI,KAAA,EAAO,KAAA,EAAO,kCAAkC,CAAA;AAC3D,MAAA;AAAA,IACF;AAEA,IAAA,MAAM,MAAA,GAAS,MAAM,UAAA,CAAW,KAAK,CAAA;AACrC,IAAA,IAAA,CAAK,MAAM,CAAA;AAAA,EACb,CAAA,SAAE;AAIA,IAAA,IAAI;AACF,MAAA,MAAc,OAAA,CAAA,IAAA,EAAK;AAAA,IACrB,SAAS,GAAA,EAAK;AACZ,MAAA,OAAA,CAAQ,MAAA,CAAO,KAAA;AAAA,QACb,qDAAgD,GAAA,YAAe,KAAA,GAAQ,IAAI,OAAA,GAAU,MAAA,CAAO,GAAG,CAAC;AAAA;AAAA,OAClG;AAAA,IACF;AAAA,EACF;AACF;AAEA,eAAe,IAAA,GAAsB;AACnC,EAAA,MAAM,UAAA,CAAW,MAAM,YAAA,EAAc,CAAA;AACvC;AAEA,eAAe,WAAW,KAAA,EAA2C;AAKnE,EAAA,MAAM,IAAI,WAAA,EAAY;AACtB,EAAA,IAAI,EAAE,YAAY,UAAA,CAAA,EAAa;AAC7B,IAAA,CAAA,CAAE,MAAA,GAAS;AAAA,MACT,kBAAkB,MAAM;AAAA,MAAC,CAAA;AAAA,MACzB,qBAAqB,MAAM;AAAA,MAAC;AAAA,KAC9B;AAAA,EACF;AACA,EAAA,IAAI,EAAE,cAAc,UAAA,CAAA,EAAa;AAC/B,IAAA,CAAA,CAAE,QAAA,GAAW;AAAA,MACX,gBAAgB,MAAM,IAAA;AAAA,MACtB,aAAA,EAAe,OAAO,EAAC,CAAA;AAAA,MACvB,kBAAkB,MAAM;AAAA,MAAC;AAAA,KAC3B;AAAA,EACF;AAEA,EAAA,IAAI;AACF,IAAA,MAAM,KAAA,GAAQ,MAAM,OAAO,OAAO,CAAA;AAClC,IAAA,MAAM,cAAA,GAAiB,MAAM,OAAO,kBAAkB,CAAA;AAEtD,IAAA,MAAM,QAAA,GAAW,aAAA,CAAc,MAAA,CAAA,IAAA,CAAY,GAAG,CAAA;AAE9C,IAAA,MAAM,cAAA,GAAiB,CAAC,EAAA,KAAwB;AAC9C,MAAA,IAAI,EAAA,KAAO,mBAAA,IAAuB,EAAA,KAAO,uBAAA,EAAyB;AAChE,QAAA,OAAO,SAAS,mBAAmB,CAAA;AAAA,MACrC;AACA,MAAA,IAAI,EAAA,KAAO,OAAA,EAAS,OAAO,QAAA,CAAS,OAAO,CAAA;AAC3C,MAAA,IAAI,EAAA,CAAG,UAAA,CAAW,iBAAiB,CAAA,EAAG;AACpC,QAAA,IAAI;AACF,UAAA,OAAO,SAAS,EAAE,CAAA;AAAA,QACpB,CAAA,CAAA,MAAQ;AAKN,UAAA,OAAO,IAAI,KAAA;AAAA,YACT,EAAC;AAAA,YACD;AAAA,cACE,GAAA,EAAK,CAAC,OAAA,EAAS,IAAA,KAAS;AACtB,gBAAA,IAAI,IAAA,KAAS,cAAc,OAAO,IAAA;AAClC,gBAAA,OAAO,CAAC;AAAA,kBACN,QAAA;AAAA,kBACA,GAAG;AAAA,sBAKH,KAAA,CAAM,aAAA;AAAA,kBACJ,KAAA;AAAA,kBACA,EAAE,gBAAA,EAAkB,MAAA,CAAO,IAAI,CAAA,EAAG,GAAG,KAAA,EAAM;AAAA,kBAC3C;AAAA,iBACF;AAAA,cACJ;AAAA;AACF,WACF;AAAA,QACF;AAAA,MACF;AACA,MAAA,MAAM,IAAI,KAAA,CAAM,CAAA,oBAAA,EAAuB,EAAE,CAAA,CAAE,CAAA;AAAA,IAC7C,CAAA;AAEA,IAAA,MAAM,gBAAgB,MAAM,uBAAA;AAAA,MAC1B,KAAA,CAAM,UAAA;AAAA,MACN;AAAA,KACF;AAEA,IAAA,MAAM,YAAY,aAAA,CAAc,OAAA;AAChC,IAAA,IAAI,OAAO,cAAc,UAAA,EAAY;AACnC,MAAA,OAAO;AAAA,QACL,EAAA,EAAI,KAAA;AAAA,QACJ,KAAA,EAAO;AAAA,OACT;AAAA,IACF;AAEA,IAAA,MAAM,OAAO,cAAA,CAAe,cAAA;AAAA,MAC1B,KAAA,CAAM,aAAA;AAAA,QACJ,SAAA;AAAA,QACA,KAAA,CAAM,eAAe;AAAC;AACxB,KACF;AAEA,IAAA,IAAI,CAAC,IAAA,IAAQ,IAAA,CAAK,MAAA,GAAS,CAAA,EAAG;AAC5B,MAAA,OAAO,EAAE,EAAA,EAAI,KAAA,EAAO,KAAA,EAAO,iCAAA,EAAkC;AAAA,IAC/D;AAEA,IAAA,OAAO,EAAE,IAAI,IAAA,EAAK;AAAA,EACpB,SAAS,GAAA,EAAK;AACZ,IAAA,MAAM,UAAU,GAAA,YAAe,KAAA,GAAQ,GAAA,CAAI,OAAA,GAAU,OAAO,GAAG,CAAA;AAC/D,IAAA,IAAI,OAAA,CAAQ,QAAA,CAAS,qCAAqC,CAAA,EAAG;AAC3D,MAAA,OAAO;AAAA,QACL,EAAA,EAAI,KAAA;AAAA,QACJ,KAAA,EAAO,iBAAiB,OAAO,CAAA,sEAAA;AAAA,OACjC;AAAA,IACF;AACA,IAAA,IAAI,OAAA,CAAQ,QAAA,CAAS,gCAAgC,CAAA,EAAG;AACtD,MAAA,OAAO;AAAA,QACL,EAAA,EAAI,KAAA;AAAA,QACJ,KAAA,EAAO,iBAAiB,OAAO,CAAA,sDAAA;AAAA,OACjC;AAAA,IACF;AACA,IAAA,IAAI,OAAA,CAAQ,QAAA,CAAS,mBAAmB,CAAA,EAAG;AACzC,MAAA,OAAO;AAAA,QACL,EAAA,EAAI,KAAA;AAAA,QACJ,KAAA,EAAO,iBAAiB,OAAO,CAAA,mEAAA;AAAA,OACjC;AAAA,IACF;AACA,IAAA,OAAO,EAAE,EAAA,EAAI,KAAA,EAAO,KAAA,EAAO,CAAA,cAAA,EAAiB,OAAO,CAAA,CAAA,EAAG;AAAA,EACxD;AACF;AAEA,SAAS,KAAK,MAAA,EAA4B;AACxC,EAAA,OAAA,CAAQ,MAAA,CAAO,KAAA,CAAM,IAAA,CAAK,SAAA,CAAU,MAAM,CAAC,CAAA;AAC7C;AAEA,eAAe,YAAA,GAAgC;AAC7C,EAAA,IAAI,MAAA,GAAS,EAAA;AACb,EAAA,OAAA,CAAQ,KAAA,CAAM,YAAY,OAAO,CAAA;AACjC,EAAA,WAAA,MAAiB,KAAA,IAAS,QAAQ,KAAA,EAAO;AACvC,IAAA,MAAA,IAAU,KAAA;AAAA,EACZ;AACA,EAAA,OAAO,MAAA;AACT;AAGA,SAAS,cAAA,GAA0B;AACjC,EAAA,MAAM,KAAA,GAAQ,OAAA,CAAQ,IAAA,CAAK,CAAC,CAAA;AAC5B,EAAA,IAAI,KAAA,KAAU,QAAW,OAAO,KAAA;AAKhC,EAAA,IAAI,SAAA;AACJ,EAAA,IAAI;AACF,IAAA,SAAA,GAAY,YAAA,CAAaC,OAAA,CAAY,KAAK,CAAC,CAAA;AAAA,EAC7C,CAAA,CAAA,MAAQ;AACN,IAAA,OAAO,KAAA;AAAA,EACT;AACA,EAAA,OAAO,SAAA,KAAc,YAAA,CAAa,aAAA,CAAc,MAAA,CAAA,IAAA,CAAY,GAAG,CAAC,CAAA;AAClE;AAEA,IAAI,gBAAe,EAAG;AACpB,EAAA,KAAK,IAAA,EAAK,CAAE,KAAA,CAAM,CAAC,GAAA,KAAiB;AAClC,IAAA,IAAA,CAAK;AAAA,MACH,EAAA,EAAI,KAAA;AAAA,MACJ,KAAA,EAAO,mBAAmB,GAAA,YAAe,KAAA,GAAQ,IAAI,OAAA,GAAU,MAAA,CAAO,GAAG,CAAC,CAAA;AAAA,KAC3E,CAAA;AAAA,EACH,CAAC,CAAA;AACH","file":"render-check-worker.js","sourcesContent":["// packages/ui-gen/src/internal/evaluate-component-source.ts\n//\n// The ONE compile-and-evaluate helper for component source: esbuild\n// TSX→CJS transform + vm.Script in-context execution behind a\n// caller-supplied `require`. Consumed by:\n//\n//   - `tools/render-check-worker.ts` — the subprocess render smoke\n//     test (host isolation lives at the spawn layer, in the parent's\n//     `tryRender` via `@ggui-ai/sandbox`).\n//   - `harness/check/runtime-render/load-component.ts` — the in-loop\n//     probe (single-realm React; caller injects module resolutions).\n//\n// The module-resolution POLICY is deliberately not shared — each\n// caller owns its own `require` shim (allowed specifiers, fallbacks,\n// error wording). What is shared is the mechanical eval pipeline:\n//\n//   1. esbuild.transform(source) → CJS\n//   2. wrap in `(function(require, exports, module) { ... })`\n//   3. vm.Script(...).runInThisContext()\n//   4. call with the caller's require + a fresh module object\n//   5. return `module.exports` read AFTER execution — esbuild's CJS\n//      output REPLACES `module.exports` (`module.exports =\n//      __toCommonJS(...)`), so the initial reference can't be trusted.\n\nexport async function evaluateComponentSource(\n  sourceCode: string,\n  sandboxRequire: (id: string) => unknown,\n): Promise<Record<string, unknown>> {\n  const esbuild = await import(\"esbuild\");\n  const { Script } = await import(\"node:vm\");\n\n  const cjsResult = await esbuild.transform(sourceCode, {\n    loader: \"tsx\",\n    target: \"es2020\",\n    format: \"cjs\",\n    jsx: \"automatic\",\n    jsxImportSource: \"react\",\n    sourcefile: \"Component.tsx\",\n  });\n\n  const sandboxModule: { exports: Record<string, unknown> } = { exports: {} };\n\n  const wrappedCode = `(function(require, exports, module) {\\n${cjsResult.code}\\n})`;\n  const script = new Script(wrappedCode, { filename: \"Component.cjs\" });\n  const fn = script.runInThisContext() as (\n    require: (id: string) => unknown,\n    exports: Record<string, unknown>,\n    module: { exports: Record<string, unknown> },\n  ) => void;\n\n  fn(sandboxRequire, sandboxModule.exports, sandboxModule);\n\n  return sandboxModule.exports;\n}\n","// packages/ui-gen/src/internal/open-record.ts\n//\n// Single documented narrowing seam for \"object used as an open\n// string-keyed property bag\" — the host global object and happy-dom's\n// `Window` both genuinely ARE open records at runtime (we install /\n// restore named globals like `window` / `document` on them by key),\n// but TypeScript cannot express that without polluting the global type\n// space via declaration merging. Centralizing the one structural\n// widening here keeps every call site cast-free.\n\n/**\n * View an object as an open string-keyed record.\n *\n * Single structural widening (`Record<string, unknown>` is assignable\n * to `object`, so the cast is checked in one direction by tsc — no\n * `unknown` erasure). Returns the SAME reference: property writes land\n * on the live object.\n */\nexport function openRecord(o: object): Record<string, unknown> {\n  return o as Record<string, unknown>;\n}\n\n/**\n * The host global object viewed as an open property bag.\n *\n * Used by the render-check pipeline (and its subprocess worker) to\n * install and restore DOM globals by name.\n */\nexport function hostGlobals(): Record<string, unknown> {\n  return openRecord(globalThis);\n}\n","/**\n * Child worker for `tryRender`. Runs the render smoke test in a\n * subprocess so the LLM-generated TSX executes outside the parent\n * Node process.\n *\n * Wire protocol (newline-delimited JSON):\n *\n *   stdin:  { sourceCode: string, sampleProps?: JsonObject }\n *   stdout: { ok: true } | { ok: false, error: string }\n *   exit:   0 on either outcome (errors are data, not status).\n *\n * Why a separate worker instead of `vm.Script.runInThisContext` in\n * the parent:\n *\n *   - `runInThisContext` runs in the parent's V8 context. A\n *     pathological component that attaches to a global, recurses\n *     into the event loop, or allocates a large buffer poisons the\n *     parent.\n *   - A subprocess gives us real kill semantics on runaway code +\n *     output caps + env isolation — delegated to\n *     `@ggui-ai/sandbox`.\n *\n * The worker still uses `vm.Script` to run compiled CJS because the\n * component needs a tailored `require` (react / jsx-runtime /\n * @ggui-ai/design only). Host-level process isolation is the\n * sandbox; module-scoped `require` is the resolution policy. The\n * mechanical compile+vm pipeline is the shared\n * `evaluateComponentSource` helper (also used by the in-loop probe's\n * `loadComponent`); only the resolution policy lives here.\n *\n * Shutdown (ggui#1380): the compile runs on esbuild's service, a child\n * process esbuild keeps alive for the life of this worker. After the\n * verdict is written the worker calls `esbuild.stop()` so that child is\n * gone before the worker is. `workerMain` is exported for the\n * process-shape pins; `main()` runs only when this file is the process\n * entry, so importing it never reads stdin.\n */\nimport { createRequire } from 'node:module';\nimport { realpathSync } from 'node:fs';\nimport { resolve as resolvePath } from 'node:path';\nimport { fileURLToPath } from 'node:url';\nimport * as esbuild from 'esbuild';\nimport type { JsonObject } from '@ggui-ai/protocol';\nimport { evaluateComponentSource } from '../internal/evaluate-component-source.js';\nimport { hostGlobals } from '../internal/open-record.js';\n\ninterface WorkerInput {\n  readonly sourceCode: string;\n  readonly sampleProps?: JsonObject;\n}\n\ntype WorkerOutput =\n  | { readonly ok: true }\n  | { readonly ok: false; readonly error: string };\n\n/**\n * Parse one input document, render once, write the verdict. Whatever\n * happens, esbuild's service is stopped before this returns (or\n * rejects). If the service was never started, `stop()` is a no-op.\n */\nexport async function workerMain(raw: string): Promise<void> {\n  try {\n    let input: WorkerInput;\n    try {\n      input = JSON.parse(raw) as WorkerInput;\n    } catch (err) {\n      emit({\n        ok: false,\n        error: `worker: malformed input JSON — ${\n          err instanceof Error ? err.message : String(err)\n        }`,\n      });\n      return;\n    }\n\n    if (typeof input.sourceCode !== 'string' || input.sourceCode.length === 0) {\n      emit({ ok: false, error: 'worker: sourceCode is required' });\n      return;\n    }\n\n    const result = await renderOnce(input);\n    emit(result);\n  } finally {\n    // Post-verdict work must never turn a written verdict into a failure:\n    // a rejecting `stop()` would otherwise become an unhandled rejection,\n    // exit code 1, and the host discarding the verdict on stdout.\n    try {\n      await esbuild.stop();\n    } catch (err) {\n      process.stderr.write(\n        `render-check worker: esbuild.stop() failed — ${err instanceof Error ? err.message : String(err)}\\n`,\n      );\n    }\n  }\n}\n\nasync function main(): Promise<void> {\n  await workerMain(await readAllStdin());\n}\n\nasync function renderOnce(input: WorkerInput): Promise<WorkerOutput> {\n  // Minimal window/document shims — mirror the in-process impl so\n  // components that touch either global don't crash on import. The\n  // shims only need to exist for the render; they're torn down by\n  // process exit.\n  const g = hostGlobals();\n  if (!('window' in globalThis)) {\n    g.window = {\n      addEventListener: () => {},\n      removeEventListener: () => {},\n    };\n  }\n  if (!('document' in globalThis)) {\n    g.document = {\n      getElementById: () => null,\n      createElement: () => ({}),\n      addEventListener: () => {},\n    };\n  }\n\n  try {\n    const React = await import('react');\n    const ReactDOMServer = await import('react-dom/server');\n\n    const require_ = createRequire(import.meta.url);\n\n    const sandboxRequire = (id: string): unknown => {\n      if (id === 'react/jsx-runtime' || id === 'react/jsx-dev-runtime') {\n        return require_('react/jsx-runtime');\n      }\n      if (id === 'react') return require_('react');\n      if (id.startsWith('@ggui-ai/design')) {\n        try {\n          return require_(id);\n        } catch {\n          // Fallback proxy — used in environments where the real\n          // design package isn't resolvable. Each primitive becomes\n          // a pass-through `div` so the render still exercises the\n          // component's own logic.\n          return new Proxy(\n            {},\n            {\n              get: (_target, prop) => {\n                if (prop === '__esModule') return true;\n                return ({\n                  children,\n                  ...props\n                }: {\n                  children?: React.ReactNode;\n                  [key: string]: unknown;\n                }) =>\n                  React.createElement(\n                    'div',\n                    { 'data-component': String(prop), ...props },\n                    children,\n                  );\n              },\n            },\n          );\n        }\n      }\n      throw new Error(`Import not allowed: ${id}`);\n    };\n\n    const exportsRecord = await evaluateComponentSource(\n      input.sourceCode,\n      sandboxRequire,\n    );\n\n    const Component = exportsRecord.default;\n    if (typeof Component !== 'function') {\n      return {\n        ok: false,\n        error: 'No default export function found in compiled code',\n      };\n    }\n\n    const html = ReactDOMServer.renderToString(\n      React.createElement(\n        Component as React.ComponentType<JsonObject>,\n        input.sampleProps ?? {},\n      ),\n    );\n\n    if (!html || html.length < 5) {\n      return { ok: false, error: 'Component rendered empty output' };\n    }\n\n    return { ok: true };\n  } catch (err) {\n    const message = err instanceof Error ? err.message : String(err);\n    if (message.includes('Cannot read properties of undefined')) {\n      return {\n        ok: false,\n        error: `Render error: ${message}. A prop is likely undefined — add a default value or null check.`,\n      };\n    }\n    if (message.includes('Cannot read properties of null')) {\n      return {\n        ok: false,\n        error: `Render error: ${message}. A value is null — add a null check or fallback.`,\n      };\n    }\n    if (message.includes('is not a function')) {\n      return {\n        ok: false,\n        error: `Render error: ${message}. Check that all imported functions exist and are called correctly.`,\n      };\n    }\n    return { ok: false, error: `Render error: ${message}` };\n  }\n}\n\nfunction emit(output: WorkerOutput): void {\n  process.stdout.write(JSON.stringify(output));\n}\n\nasync function readAllStdin(): Promise<string> {\n  let buffer = '';\n  process.stdin.setEncoding('utf-8');\n  for await (const chunk of process.stdin) {\n    buffer += chunk as string;\n  }\n  return buffer;\n}\n\n/** True when this file is the process entry (`node <this file>`), not an import. */\nfunction isProcessEntry(): boolean {\n  const entry = process.argv[1];\n  if (entry === undefined) return false;\n  // Resolve BOTH sides through the filesystem: `import.meta.url` is this\n  // file's realpath while argv[1] is whatever the spawner passed — a\n  // symlinked spawn path must still read as the entry, or the worker would\n  // exit with no verdict and the host would read a silent `unverified`.\n  let entryReal: string;\n  try {\n    entryReal = realpathSync(resolvePath(entry));\n  } catch {\n    return false;\n  }\n  return entryReal === realpathSync(fileURLToPath(import.meta.url));\n}\n\nif (isProcessEntry()) {\n  void main().catch((err: unknown) => {\n    emit({\n      ok: false,\n      error: `worker crashed: ${err instanceof Error ? err.message : String(err)}`,\n    });\n  });\n}\n"]}

package/dist/{types-public-Ow-tNtFE.d.ts → types-public-Bk6d1WLN.d.ts}

@@ -1,3 +1,4 @@
+import { GenerationRuntimeProbeStatus, GenerationRuntimeProbeOutcome } from '@ggui-ai/mcp-server-core';
 import { C as CanvasClass, D as DesignMode } from './design-mode-DLufhrNp.js';
 import { DataContract } from '@ggui-ai/protocol';
 import { C as Classification, A as AxisVector } from './axes-CzLEMDeB.js';
@@ -27,8 +28,10 @@ interface EvalIssue {
     line?: number;
 }
 /**
- * Runtime-render probe execution status — three-valued so "the probe
- * never ran" is never conflated with "the probe ran clean".
+ * Runtime-render probe execution status — four-valued so "the probe
+ * never ran" is never conflated with "the probe ran clean". ONE union: the
+ * same values a generation's metadata reports (`GenerationRuntimeProbeStatus`
+ * in `@ggui-ai/mcp-server-core`), declared there and named here.
  *
  *   - `ran`           — probe executed; its findings (possibly none) are
  *                       in the issue stream under `runtime:*` subcategories.
@@ -47,7 +50,7 @@ interface EvalIssue {
  *                       `hostLoad` say how long it ran and how busy the
  *                       host was, so a reader can tell the two cases apart.
  */
-type RuntimeProbeStatus = "ran" | "infra-skipped" | "not-applicable" | "timed-out";
+type RuntimeProbeStatus = GenerationRuntimeProbeStatus;
 /**
  * The host's 1-minute load average at a probe's start and end, beside the
  * number of CPUs the process can use (ggui#1299). A load well above
@@ -60,20 +63,76 @@ interface ProbeHostLoad {
     readonly cores: number;
 }
 /**
- * Probe execution meta stamped onto an `EvalResult` at the exit-decision
- * points that invoke the probe. Absence of this field means the eval
- * path never reached a probe invocation at all — consumers treat that
- * the same as not-run, never as a pass.
+ * The engine's own fields on a probe's meta, beside the outcome a
+ * generation's metadata reports: why a probe did not finish, its render
+ * time, the host's load around it. Present on every arm of
+ * {@link RuntimeProbeMeta}; each is absent when the probe had nothing to
+ * say about it.
  */
-interface RuntimeProbeMeta {
-    readonly status: RuntimeProbeStatus;
+interface RuntimeProbeMetaDetail {
     /** Populated for `infra-skipped` / `not-applicable` / `timed-out` — why the probe didn't finish. */
     readonly reason?: string;
-    /** `timed-out` only: how long the probe ran before it was stopped. */
-    readonly elapsedMs?: number;
+    /** `ran` only: the check's own render time, inside `elapsedMs`. */
+    readonly renderMs?: number;
     /** Host load around the probe, when it ran isolated (absent for an in-process probe). */
     readonly hostLoad?: ProbeHostLoad;
+    /** Time the check waited for a probe slot before it started, ms; present only when > 0 (ggui#1380 C2b). */
+    readonly queuedMs?: number;
 }
+/**
+ * Probe execution meta stamped onto an `EvalResult` at the exit-decision
+ * points that invoke the probe. Absence of this field means the eval
+ * path never reached a probe invocation at all — consumers treat that
+ * the same as not-run, never as a pass.
+ *
+ * ONE union with the generation metadata's probe outcome
+ * (`GenerationRuntimeProbeOutcome` in `@ggui-ai/mcp-server-core`, declared
+ * there and carried here with {@link RuntimeProbeMetaDetail} on every arm),
+ * so the round's stamp and the metadata's record cannot say different
+ * things (ggui#1380):
+ *
+ *   - `ran` + `verdict: 'pass'` — the probe executed and no check failed;
+ *   - `ran` + `verdict: 'fail'` — ANY check failed; `failChecks` lists the
+ *     distinct check kinds that did (`RenderCheckKind`, the engine's name
+ *     for the same union), never empty, in the order `RENDER_CHECK_KINDS`
+ *     declares them, parsed from the probe's own
+ *     `runtime:<check>[:<subject>]` issues;
+ *   - `timed-out` / `infra-skipped` / `not-applicable` — no verdict, and the
+ *     type carries none. `elapsedMs` (on every status that reached the
+ *     check) and `hostLoad` say how long it ran and how busy the host was.
+ *
+ * The verdict and the repair trigger are two different questions. The
+ * verdict is `fail` on any failing check. The one repair turn a probe-only
+ * round buys fires on a `render-no-throw` fail the engine recognises
+ * (`isRecoverableRenderCrash`) and on nothing else: a `fail` verdict whose
+ * checks are `prop-sensitivity`, `action-wiring` or any other kind is
+ * recorded here and never fed back.
+ */
+type RuntimeProbeMeta = GenerationRuntimeProbeOutcome & RuntimeProbeMetaDetail;
+/**
+ * The one repair turn a probe-only round buys (ggui#1380). A serving
+ * deployment that wires the runtime probe and configures no evaluator runs
+ * the probe once after the coding turns; a render crash the engine
+ * recognises buys exactly one repair turn, then one re-probe. This records
+ * what came of it:
+ *   - `compiled: false` — the repair turn's code did not pass self-check, so
+ *     no re-probe ran (there is no `after`) and the pre-repair card is the
+ *     one served;
+ *   - `compiled: true` — the re-probe ran and `after` is its whole meta:
+ *     its status, its verdict when it ran, and the checks that still fail.
+ *     Whether the crash class the turn was bought for is still there is
+ *     `after.verdict === 'fail' && after.failChecks.includes('render-no-throw')`.
+ * The two arms are exclusive by type.
+ */
+type RuntimeProbeRepair = {
+    readonly attempted: true;
+    readonly compiled: false;
+    readonly trigger?: never;
+} | {
+    readonly attempted: true;
+    readonly compiled: true;
+    readonly trigger: RuntimeProbeMeta;
+};
 /**
  * Per-criterion execution status — three-valued so "the criterion
  * silently produced no verdict" is never conflated with "the criterion
@@ -169,6 +228,13 @@ interface EvalResult {
      * probe runner; absent on eval paths that never invoke the probe.
      */
     runtimeProbe?: RuntimeProbeMeta;
+    /**
+     * The probe-only round's repair record (ggui#1380) — present only when a
+     * recoverable render crash bought the one repair turn. See
+     * {@link RuntimeProbeRepair}. `runtimeProbe` beside it is the re-probe's
+     * verdict when the repair compiled, else the pre-repair probe's.
+     */
+    runtimeProbeRepair?: RuntimeProbeRepair;
     /**
      * The contract-feedback round, when one fired this generation (ggui#1261):
      * which exit-probe findings bought it and the source as it stood when the

package/dist/workflows.d.ts

@@ -2,7 +2,8 @@ import { C as Classification } from './axes-CzLEMDeB.js';
 import { Workflow } from './harness/types-public.js';
 import '@ggui-ai/protocol';
 import './styling-profile-CxfvV48g.js';
-import './types-public-Ow-tNtFE.js';
+import './types-public-Bk6d1WLN.js';
+import '@ggui-ai/mcp-server-core';
 import './design-mode-DLufhrNp.js';
 import './types-BOvHNG7K.js';
 import './llm.js';

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ggui-ai/ui-gen",
-  "version": "0.23.0",
+  "version": "0.24.0",
   "description": "UI generation harness for ggui — the LLM system prompt, multi-turn coding loop, and evaluation engine that turn a DataContract into a React component. Implements the UiGenerator contract from @ggui-ai/mcp-server-core; consumed by @ggui-ai/mcp-server.",
   "license": "Apache-2.0",
   "keywords": [
@@ -189,9 +189,9 @@
     "puppeteer-core": "^24.40.0 || ^25.0.0",
     "react": "^18.0.0 || ^19.0.0",
     "react-dom": "^18.0.0 || ^19.0.0",
-    "@ggui-ai/mcp-server-core": "0.23.0",
-    "@ggui-ai/protocol": "0.23.0",
-    "@ggui-ai/project-config": "0.23.0"
+    "@ggui-ai/project-config": "0.24.0",
+    "@ggui-ai/protocol": "0.24.0",
+    "@ggui-ai/mcp-server-core": "0.24.0"
   },
   "peerDependenciesMeta": {
     "@google/adk": {
@@ -233,11 +233,11 @@
     "openai": "^7.9.0",
     "typescript": "^5.0.0",
     "zod": "^4.3.6",
-    "@ggui-ai/design": "0.23.0",
-    "@ggui-ai/gadgets": "0.23.0",
-    "@ggui-ai/sandbox": "0.23.0",
-    "@ggui-ai/wire": "0.23.0",
-    "@ggui-ai/ui-visual-tester": "0.23.0"
+    "@ggui-ai/design": "0.24.0",
+    "@ggui-ai/gadgets": "0.24.0",
+    "@ggui-ai/sandbox": "0.24.0",
+    "@ggui-ai/ui-visual-tester": "0.24.0",
+    "@ggui-ai/wire": "0.24.0"
   },
   "devDependencies": {
     "@google/adk": "^2.0.0",
@@ -252,9 +252,9 @@
     "react-dom": "^19.0.0",
     "tsup": "^8.5.0",
     "vitest": "^3.2.6",
-    "@ggui-ai/mcp-server-core": "0.23.0",
-    "@ggui-ai/project-config": "0.23.0",
-    "@ggui-ai/protocol": "0.23.0"
+    "@ggui-ai/mcp-server-core": "0.24.0",
+    "@ggui-ai/project-config": "0.24.0",
+    "@ggui-ai/protocol": "0.24.0"
   },
   "engines": {
     "node": ">=22.0.0"