@guuey/mcp-apps-host 0.5.0 → 0.6.1

package/dist/action.d.ts

@@ -51,10 +51,33 @@ export type McpToolCallResult = {
     structuredContent?: McpToolStructuredContent;
 };
 /**
- * The runtime-action tools a card sandbox may relay — the client-side twin
- * of the server allowlist (defense in depth: the proxy enforces it again).
+ * The runtime tools a card sandbox may RELAY over `tools/call` — the
+ * client-side twin of the server allowlist (defense in depth: the proxy
+ * enforces it again). Exactly ggui's iframe-runtime surface, all declared
+ * `_meta.ui.visibility: ['app']` (never model-callable):
+ *
+ *  - `ggui_runtime_submit_action` — the user's gesture (the SEMANTIC one);
+ *  - `ggui_runtime_refresh_ws_token` — live-channel credential refresh
+ *    (the wsToken TTL is 180 s; without the relay a view on SSE/polling
+ *    dies at that mark — guuey#220);
+ *  - `ggui_runtime_pull` — the host-relayed polling rung where the
+ *    sandbox's own transports are blocked (bridge-pull, terminal rung).
+ *
+ * Two of these are transport plumbing whose arguments are opaque runtime
+ * state — see {@link UI_SEMANTIC_ACTION_TOOLS} for the ONLY set a host may
+ * treat as "the user did something".
  */
 export declare const UI_ACTION_TOOLS: ReadonlySet<string>;
+/**
+ * The strict subset of {@link UI_ACTION_TOOLS} that carries a USER gesture —
+ * the only calls a host may project into user-facing affordances (composer
+ * staging, "the user selected X" copy, telemetry as intent). Every other
+ * relayed tool is runtime plumbing whose payload must NEVER reach the user
+ * verbatim (guuey#215/#218: a staged `sessionId …` was exactly that leak).
+ * A tool that is relayable is NOT thereby semantic; a host that widens
+ * this set is asserting the wire semantics of the new name.
+ */
+export declare const UI_SEMANTIC_ACTION_TOOLS: ReadonlySet<string>;
 /** The in-band answer for anything the relay cannot (or will not) do. */
 export declare const UI_ACTION_UNAVAILABLE_TEXT = "This action isn't available right now.";
 /**

package/dist/action.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"action.d.ts","sourceRoot":"","sources":["../src/action.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAEH,oFAAoF;AACpF,MAAM,MAAM,kBAAkB,GAC1B;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAE,GAC9B;IAAE,IAAI,EAAE,OAAO,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAA;CAAE,GACjD;IACE,IAAI,EAAE,UAAU,CAAC;IACjB,QAAQ,EAAE;QAAE,GAAG,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,EAAE,MAAM,CAAA;KAAE,GAAG,CAC3C;QAAE,IAAI,EAAE,MAAM,CAAA;KAAE,GAChB;QAAE,IAAI,EAAE,MAAM,CAAA;KAAE,CACnB,CAAC;CACH,CAAC;AAEN;;;;GAIG;AACH,MAAM,MAAM,wBAAwB,GAAG;IACrC,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC;CACxB,CAAC;AAEF;;;;;GAKG;AACH,MAAM,MAAM,iBAAiB,GAAG;IAC9B,OAAO,EAAE,kBAAkB,EAAE,CAAC;IAC9B,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,iBAAiB,CAAC,EAAE,wBAAwB,CAAC;CAC9C,CAAC;AAEF;;;GAGG;AACH,eAAO,MAAM,eAAe,EAAE,WAAW,CAAC,MAAM,CAE9C,CAAC;AAEH,yEAAyE;AACzE,eAAO,MAAM,0BAA0B,2CACG,CAAC;AAE3C;;;;GAIG;AACH,wBAAgB,yBAAyB,IAAI,iBAAiB,CAK7D;AAkCD;;;;GAIG;AACH,wBAAgB,gBAAgB,CAAC,KAAK,EAAE,OAAO,GAAG,iBAAiB,GAAG,SAAS,CAgB9E;AAED,iFAAiF;AACjF,MAAM,WAAW,0BAA0B;IACzC;;;;;OAKG;IACH,QAAQ,EAAE,CACR,GAAG,EAAE,MAAM,EACX,IAAI,EAAE,MAAM,EACZ,IAAI,EAAE,wBAAwB,GAAG,SAAS,KACvC,OAAO,CAAC,OAAO,CAAC,CAAC;CACvB;AAED,uEAAuE;AACvE,MAAM,WAAW,eAAe;IAC9B,yEAAyE;IACzE,WAAW,EAAE,MAAM,CAAC;IACpB,IAAI,EAAE,MAAM,CAAC;IACb,SAAS,CAAC,EAAE,wBAAwB,CAAC;CACtC;AAED;;;;GAIG;AACH,wBAAgB,sBAAsB,CACpC,IAAI,EAAE,0BAA0B,GAC/B,CAAC,OAAO,EAAE,eAAe,KAAK,OAAO,CAAC,iBAAiB,CAAC,CAa1D"}
+{"version":3,"file":"action.d.ts","sourceRoot":"","sources":["../src/action.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAEH,oFAAoF;AACpF,MAAM,MAAM,kBAAkB,GAC1B;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAE,GAC9B;IAAE,IAAI,EAAE,OAAO,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAA;CAAE,GACjD;IACE,IAAI,EAAE,UAAU,CAAC;IACjB,QAAQ,EAAE;QAAE,GAAG,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,EAAE,MAAM,CAAA;KAAE,GAAG,CAC3C;QAAE,IAAI,EAAE,MAAM,CAAA;KAAE,GAChB;QAAE,IAAI,EAAE,MAAM,CAAA;KAAE,CACnB,CAAC;CACH,CAAC;AAEN;;;;GAIG;AACH,MAAM,MAAM,wBAAwB,GAAG;IACrC,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC;CACxB,CAAC;AAEF;;;;;GAKG;AACH,MAAM,MAAM,iBAAiB,GAAG;IAC9B,OAAO,EAAE,kBAAkB,EAAE,CAAC;IAC9B,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,iBAAiB,CAAC,EAAE,wBAAwB,CAAC;CAC9C,CAAC;AAEF;;;;;;;;;;;;;;;;GAgBG;AACH,eAAO,MAAM,eAAe,EAAE,WAAW,CAAC,MAAM,CAI9C,CAAC;AAEH;;;;;;;;GAQG;AACH,eAAO,MAAM,wBAAwB,EAAE,WAAW,CAAC,MAAM,CAEvD,CAAC;AAEH,yEAAyE;AACzE,eAAO,MAAM,0BAA0B,2CACG,CAAC;AAE3C;;;;GAIG;AACH,wBAAgB,yBAAyB,IAAI,iBAAiB,CAK7D;AAkCD;;;;GAIG;AACH,wBAAgB,gBAAgB,CAAC,KAAK,EAAE,OAAO,GAAG,iBAAiB,GAAG,SAAS,CAgB9E;AAED,iFAAiF;AACjF,MAAM,WAAW,0BAA0B;IACzC;;;;;OAKG;IACH,QAAQ,EAAE,CACR,GAAG,EAAE,MAAM,EACX,IAAI,EAAE,MAAM,EACZ,IAAI,EAAE,wBAAwB,GAAG,SAAS,KACvC,OAAO,CAAC,OAAO,CAAC,CAAC;CACvB;AAED,uEAAuE;AACvE,MAAM,WAAW,eAAe;IAC9B,yEAAyE;IACzE,WAAW,EAAE,MAAM,CAAC;IACpB,IAAI,EAAE,MAAM,CAAC;IACb,SAAS,CAAC,EAAE,wBAAwB,CAAC;CACtC;AAED;;;;GAIG;AACH,wBAAgB,sBAAsB,CACpC,IAAI,EAAE,0BAA0B,GAC/B,CAAC,OAAO,EAAE,eAAe,KAAK,OAAO,CAAC,iBAAiB,CAAC,CAa1D"}

package/dist/action.js

@@ -13,11 +13,38 @@
  *    it crosses into the sandbox.
  */
 /**
- * The runtime-action tools a card sandbox may relay — the client-side twin
- * of the server allowlist (defense in depth: the proxy enforces it again).
+ * The runtime tools a card sandbox may RELAY over `tools/call` — the
+ * client-side twin of the server allowlist (defense in depth: the proxy
+ * enforces it again). Exactly ggui's iframe-runtime surface, all declared
+ * `_meta.ui.visibility: ['app']` (never model-callable):
+ *
+ *  - `ggui_runtime_submit_action` — the user's gesture (the SEMANTIC one);
+ *  - `ggui_runtime_refresh_ws_token` — live-channel credential refresh
+ *    (the wsToken TTL is 180 s; without the relay a view on SSE/polling
+ *    dies at that mark — guuey#220);
+ *  - `ggui_runtime_pull` — the host-relayed polling rung where the
+ *    sandbox's own transports are blocked (bridge-pull, terminal rung).
+ *
+ * Two of these are transport plumbing whose arguments are opaque runtime
+ * state — see {@link UI_SEMANTIC_ACTION_TOOLS} for the ONLY set a host may
+ * treat as "the user did something".
  */
 export const UI_ACTION_TOOLS = new Set([
     "ggui_runtime_submit_action",
+    "ggui_runtime_refresh_ws_token",
+    "ggui_runtime_pull",
+]);
+/**
+ * The strict subset of {@link UI_ACTION_TOOLS} that carries a USER gesture —
+ * the only calls a host may project into user-facing affordances (composer
+ * staging, "the user selected X" copy, telemetry as intent). Every other
+ * relayed tool is runtime plumbing whose payload must NEVER reach the user
+ * verbatim (guuey#215/#218: a staged `sessionId …` was exactly that leak).
+ * A tool that is relayable is NOT thereby semantic; a host that widens
+ * this set is asserting the wire semantics of the new name.
+ */
+export const UI_SEMANTIC_ACTION_TOOLS = new Set([
+    "ggui_runtime_submit_action",
 ]);
 /** The in-band answer for anything the relay cannot (or will not) do. */
 export const UI_ACTION_UNAVAILABLE_TEXT = "This action isn't available right now.";

package/dist/block-ui.d.ts

@@ -104,6 +104,24 @@ export declare function toolResultUiResource(block: Extract<AgBlock, {
  * are one producer of this shape.
  */
 export declare function uiLocator(uiData: JsonValue | undefined): string | undefined;
+/**
+ * The `ui://` locator a `tool-result` block carries, from EITHER channel it
+ * can arrive on — the single seam every locator reader goes through.
+ *
+ * AgJSON §2.1 routes a tool result's `structuredContent` by its `_meta.ui`
+ * sibling: WITH the sibling it is surface data and the normalizer stamps
+ * `uiData`; WITHOUT it, it is model-channel data and lands in
+ * `structuredContent`. A producer that withholds `_meta` (ggui's non-prod
+ * posture; any plain-locator MCP server) therefore delivers a locator that
+ * is byte-identical in shape but lives one field over — reading `uiData`
+ * alone renders NOTHING for it (dark, not "expired"), and the persistence
+ * projector minted no placeholder row (the read plane 404s). `uiData` wins
+ * when both carry one (guuey#209 route-A finding).
+ */
+export declare function toolResultLocator(block: {
+    uiData?: JsonValue;
+    structuredContent?: JsonValue;
+}): string | undefined;
 export declare function snapshotUiResource(cardSnapshot: JsonValue): McpUiResourcePayload | undefined;
 /**
  * The resource's HTML: inline `text` wins; else base64-decode `blob`. `atob`

package/dist/block-ui.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"block-ui.d.ts","sourceRoot":"","sources":["../src/block-ui.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,OAAO,KAAK,EAAE,OAAO,EAAE,SAAS,EAAE,MAAM,sBAAsB,CAAC;AAE/D;;;;;GAKG;AACH,MAAM,WAAW,oBAAoB;IACnC,GAAG,EAAE,MAAM,CAAC;IACZ,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,IAAI,CAAC,EAAE,MAAM,CAAC;CACf;AAED,uEAAuE;AACvE,wBAAgB,YAAY,CAAC,CAAC,EAAE,SAAS,GAAG,SAAS,GAAG,CAAC,IAAI;IAAE,CAAC,GAAG,EAAE,MAAM,GAAG,SAAS,CAAA;CAAE,CAExF;AAED;;;GAGG;AACH,wBAAgB,iBAAiB,CAAC,CAAC,EAAE,SAAS,GAAG,SAAS,GAAG,oBAAoB,GAAG,SAAS,CAU5F;AAED;;;;;;GAMG;AACH,wBAAgB,YAAY,CAAC,MAAM,EAAE,SAAS,GAAG,SAAS,GAAG,oBAAoB,GAAG,SAAS,CAK5F;AAED;;;;;;GAMG;AACH,wBAAgB,4BAA4B,CAC1C,GAAG,EAAE,SAAS,GAAG,SAAS,GACzB,oBAAoB,GAAG,SAAS,CAMlC;AAED;;;;;;;;;;;;;GAaG;AACH,wBAAgB,eAAe,CAAC,KAAK,EAAE,SAAS,GAAG,oBAAoB,GAAG,SAAS,CAyBlF;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,oBAAoB,CAClC,KAAK,EAAE,OAAO,CAAC,OAAO,EAAE;IAAE,IAAI,EAAE,aAAa,CAAA;CAAE,CAAC,GAC/C,oBAAoB,GAAG,SAAS,CAUlC;AAED;;;;;;;;;;;GAWG;AACH;;;;GAIG;AACH,wBAAgB,SAAS,CAAC,MAAM,EAAE,SAAS,GAAG,SAAS,GAAG,MAAM,GAAG,SAAS,CAI3E;AAED,wBAAgB,kBAAkB,CAAC,YAAY,EAAE,SAAS,GAAG,oBAAoB,GAAG,SAAS,CAU5F;AAED;;;;GAIG;AACH,wBAAgB,YAAY,CAAC,QAAQ,EAAE,oBAAoB,GAAG,MAAM,GAAG,SAAS,CAU/E"}
+{"version":3,"file":"block-ui.d.ts","sourceRoot":"","sources":["../src/block-ui.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,OAAO,KAAK,EAAE,OAAO,EAAE,SAAS,EAAE,MAAM,sBAAsB,CAAC;AAE/D;;;;;GAKG;AACH,MAAM,WAAW,oBAAoB;IACnC,GAAG,EAAE,MAAM,CAAC;IACZ,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,IAAI,CAAC,EAAE,MAAM,CAAC;CACf;AAED,uEAAuE;AACvE,wBAAgB,YAAY,CAAC,CAAC,EAAE,SAAS,GAAG,SAAS,GAAG,CAAC,IAAI;IAAE,CAAC,GAAG,EAAE,MAAM,GAAG,SAAS,CAAA;CAAE,CAExF;AAED;;;GAGG;AACH,wBAAgB,iBAAiB,CAAC,CAAC,EAAE,SAAS,GAAG,SAAS,GAAG,oBAAoB,GAAG,SAAS,CAU5F;AAED;;;;;;GAMG;AACH,wBAAgB,YAAY,CAAC,MAAM,EAAE,SAAS,GAAG,SAAS,GAAG,oBAAoB,GAAG,SAAS,CAK5F;AAED;;;;;;GAMG;AACH,wBAAgB,4BAA4B,CAC1C,GAAG,EAAE,SAAS,GAAG,SAAS,GACzB,oBAAoB,GAAG,SAAS,CAMlC;AAED;;;;;;;;;;;;;GAaG;AACH,wBAAgB,eAAe,CAAC,KAAK,EAAE,SAAS,GAAG,oBAAoB,GAAG,SAAS,CAyBlF;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,oBAAoB,CAClC,KAAK,EAAE,OAAO,CAAC,OAAO,EAAE;IAAE,IAAI,EAAE,aAAa,CAAA;CAAE,CAAC,GAC/C,oBAAoB,GAAG,SAAS,CAUlC;AAED;;;;;;;;;;;GAWG;AACH;;;;GAIG;AACH,wBAAgB,SAAS,CAAC,MAAM,EAAE,SAAS,GAAG,SAAS,GAAG,MAAM,GAAG,SAAS,CAI3E;AAED;;;;;;;;;;;;;GAaG;AACH,wBAAgB,iBAAiB,CAAC,KAAK,EAAE;IACvC,MAAM,CAAC,EAAE,SAAS,CAAC;IACnB,iBAAiB,CAAC,EAAE,SAAS,CAAC;CAC/B,GAAG,MAAM,GAAG,SAAS,CAErB;AAED,wBAAgB,kBAAkB,CAAC,YAAY,EAAE,SAAS,GAAG,oBAAoB,GAAG,SAAS,CAU5F;AAED;;;;GAIG;AACH,wBAAgB,YAAY,CAAC,QAAQ,EAAE,oBAAoB,GAAG,MAAM,GAAG,SAAS,CAU/E"}

package/dist/block-ui.js

@@ -140,6 +140,23 @@ export function uiLocator(uiData) {
     const uri = uiData.resourceUri;
     return typeof uri === "string" && uri.startsWith("ui://") ? uri : undefined;
 }
+/**
+ * The `ui://` locator a `tool-result` block carries, from EITHER channel it
+ * can arrive on — the single seam every locator reader goes through.
+ *
+ * AgJSON §2.1 routes a tool result's `structuredContent` by its `_meta.ui`
+ * sibling: WITH the sibling it is surface data and the normalizer stamps
+ * `uiData`; WITHOUT it, it is model-channel data and lands in
+ * `structuredContent`. A producer that withholds `_meta` (ggui's non-prod
+ * posture; any plain-locator MCP server) therefore delivers a locator that
+ * is byte-identical in shape but lives one field over — reading `uiData`
+ * alone renders NOTHING for it (dark, not "expired"), and the persistence
+ * projector minted no placeholder row (the read plane 404s). `uiData` wins
+ * when both carry one (guuey#209 route-A finding).
+ */
+export function toolResultLocator(block) {
+    return uiLocator(block.uiData) ?? uiLocator(block.structuredContent);
+}
 export function snapshotUiResource(cardSnapshot) {
     if (!isJsonObject(cardSnapshot))
         return undefined;

package/dist/card-mount.d.ts

@@ -44,7 +44,9 @@ export type ViewMountChannel = "inline" | "ggui" | "locator";
  * `"ggui"` — a shell that boots the ggui runtime from a platform-pinned
  * origin, and therefore needs a host page whose CSP allows that origin.
  * `"locator"` — no mount material in hand, only the durable `ui://`
- * identity (guuey#122): the host resolves it with a fresh, authenticated
+ * identity (guuey#122) — read from `uiData` OR, for a producer that
+ * withheld `_meta` (AgJSON §2.1 then routes it to `structuredContent`),
+ * from `structuredContent` (guuey#209): the host resolves it with a fresh, authenticated
  * `resources/read` of the uri ({@link UiResourceReader}) — the spec-consistent
  * template fetch, vendor-neutral. (The spec defers persistence/restoration
  * itself; a full remount additionally owes the View `ui/notifications/tool-input`
@@ -65,7 +67,7 @@ export interface ResolvedViewMount {
 /** The durable-identity arm: no mount material, only the uri to re-fetch. */
 export interface LocatorViewMount {
     channel: "locator";
-    /** The persisted `uiData.resourceUri` (`ui://` scheme) to re-fetch. */
+    /** The durable `ui://` locator to re-fetch (`uiData.resourceUri`, else `structuredContent.resourceUri`). */
     resourceUri: string;
 }
 /**

package/dist/card-mount.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"card-mount.d.ts","sourceRoot":"","sources":["../src/card-mount.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAkCG;AACH,OAAO,EAAuD,KAAK,oBAAoB,EAAE,MAAM,eAAe,CAAC;AAE/G,OAAO,KAAK,EAAE,OAAO,EAAE,SAAS,EAAE,MAAM,sBAAsB,CAAC;AAW/D,8EAA8E;AAC9E,MAAM,MAAM,gBAAgB,GAAG,QAAQ,GAAG,MAAM,GAAG,SAAS,CAAC;AAE7D;;;;;;;;;;;;;GAaG;AACH,MAAM,MAAM,SAAS,GAAG,iBAAiB,GAAG,gBAAgB,CAAC;AAE7D;;;;GAIG;AACH,MAAM,WAAW,iBAAiB;IAChC,OAAO,EAAE,QAAQ,GAAG,MAAM,CAAC;IAC3B,+EAA+E;IAC/E,QAAQ,EAAE,oBAAoB,CAAC;CAChC;AAED,6EAA6E;AAC7E,MAAM,WAAW,gBAAgB;IAC/B,OAAO,EAAE,SAAS,CAAC;IACnB,uEAAuE;IACvE,WAAW,EAAE,MAAM,CAAC;CACrB;AAED;;;;;;;;GAQG;AACH,MAAM,MAAM,gBAAgB,GAAG,CAAC,WAAW,EAAE,MAAM,KAAK,OAAO,CAAC,SAAS,GAAG,SAAS,CAAC,CAAC;AAEvF;;;;GAIG;AACH,wBAAgB,mBAAmB,CACjC,KAAK,EAAE,OAAO,CAAC,OAAO,EAAE;IAAE,IAAI,EAAE,aAAa,CAAA;CAAE,CAAC,GAC/C,SAAS,GAAG,SAAS,CAkBvB;AAED;;;;;;;;;GASG;AACH,wBAAgB,iBAAiB,CAAC,YAAY,EAAE,SAAS,GAAG,SAAS,GAAG,SAAS,CAUhF;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAsB,gBAAgB,CACpC,KAAK,EAAE,SAAS,GAAG,SAAS,EAC5B,MAAM,CAAC,EAAE,gBAAgB,GACxB,OAAO,CAAC,iBAAiB,GAAG,SAAS,CAAC,CAKxC"}
+{"version":3,"file":"card-mount.d.ts","sourceRoot":"","sources":["../src/card-mount.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAkCG;AACH,OAAO,EAA+D,KAAK,oBAAoB,EAAE,MAAM,eAAe,CAAC;AAEvH,OAAO,KAAK,EAAE,OAAO,EAAE,SAAS,EAAE,MAAM,sBAAsB,CAAC;AAW/D,8EAA8E;AAC9E,MAAM,MAAM,gBAAgB,GAAG,QAAQ,GAAG,MAAM,GAAG,SAAS,CAAC;AAE7D;;;;;;;;;;;;;;;GAeG;AACH,MAAM,MAAM,SAAS,GAAG,iBAAiB,GAAG,gBAAgB,CAAC;AAE7D;;;;GAIG;AACH,MAAM,WAAW,iBAAiB;IAChC,OAAO,EAAE,QAAQ,GAAG,MAAM,CAAC;IAC3B,+EAA+E;IAC/E,QAAQ,EAAE,oBAAoB,CAAC;CAChC;AAED,6EAA6E;AAC7E,MAAM,WAAW,gBAAgB;IAC/B,OAAO,EAAE,SAAS,CAAC;IACnB,4GAA4G;IAC5G,WAAW,EAAE,MAAM,CAAC;CACrB;AAED;;;;;;;;GAQG;AACH,MAAM,MAAM,gBAAgB,GAAG,CAAC,WAAW,EAAE,MAAM,KAAK,OAAO,CAAC,SAAS,GAAG,SAAS,CAAC,CAAC;AAEvF;;;;GAIG;AACH,wBAAgB,mBAAmB,CACjC,KAAK,EAAE,OAAO,CAAC,OAAO,EAAE;IAAE,IAAI,EAAE,aAAa,CAAA;CAAE,CAAC,GAC/C,SAAS,GAAG,SAAS,CAoBvB;AAED;;;;;;;;;GASG;AACH,wBAAgB,iBAAiB,CAAC,YAAY,EAAE,SAAS,GAAG,SAAS,GAAG,SAAS,CAUhF;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAsB,gBAAgB,CACpC,KAAK,EAAE,SAAS,GAAG,SAAS,EAC5B,MAAM,CAAC,EAAE,gBAAgB,GACxB,OAAO,CAAC,iBAAiB,GAAG,SAAS,CAAC,CAKxC"}

package/dist/card-mount.js

@@ -33,7 +33,7 @@
  * keeps that one narrowing in one place — the alternative was for every host
  * to re-run `toolResultGguiRender` beside this call and ask again.
  */
-import { snapshotUiResource, toolResultUiResource, uiLocator } from "./block-ui.js";
+import { snapshotUiResource, toolResultLocator, toolResultUiResource } from "./block-ui.js";
 import { GGUI_RENDER_META_KEY, gguiRenderResource, toolResultGguiRender } from "./ggui-render.js";
 /** Does the block's `_meta` carry the ggui render key at all (valid or not)? */
 function blockCarriesGguiMetaKey(block) {
@@ -54,14 +54,16 @@ export function toolResultViewMount(block) {
     if (resource)
         return { resource, channel: "ggui" };
     // A live locator whose mount material didn't reach us (a fold that
-    // dropped `_meta`): re-fetch works on live turns too — the resource is
-    // freshly minted (guuey#122). One diagnostic when `_meta` DID carry the
+    // dropped `_meta`, or a producer that never sent it — the locator then
+    // rides `structuredContent`, see `toolResultLocator`): re-fetch works on
+    // live turns too — the resource is freshly minted (guuey#122). One
+    // diagnostic when `_meta` DID carry the
     // vendor key but failed validation — a producer bug would otherwise be
     // indistinguishable from a meta-less fold (blank UI, zero errors).
     if (ggui && !ggui.bootstrap && blockCarriesGguiMetaKey(block)) {
         console.warn(`mcp-apps-host: tool result ${block.toolCallId} carries a malformed ggui render bootstrap — degrading to the locator channel`);
     }
-    const locator = uiLocator(block.uiData);
+    const locator = toolResultLocator(block);
     return locator !== undefined ? { channel: "locator", resourceUri: locator } : undefined;
 }
 /**
@@ -83,7 +85,7 @@ export function snapshotViewMount(cardSnapshot) {
             continue;
         if (block.type !== "tool-result")
             continue;
-        const locator = uiLocator(block.uiData);
+        const locator = toolResultLocator(block);
         if (locator !== undefined)
             return { channel: "locator", resourceUri: locator };
     }

package/dist/index.d.ts

@@ -3,12 +3,12 @@
  * narrowing, ui:// locator rehydration, sandbox-trust channels. See README +
  * the conformance map (guuey#123).
  */
-export { asResourcePayload, asUiResource, blockUiResource, isJsonObject, resourceHtml, scanProviderRawForUiResource, snapshotUiResource, toolResultUiResource, uiLocator, type McpUiResourcePayload, } from "./block-ui.js";
+export { asResourcePayload, asUiResource, blockUiResource, isJsonObject, resourceHtml, scanProviderRawForUiResource, snapshotUiResource, toolResultLocator, toolResultUiResource, uiLocator, type McpUiResourcePayload, } from "./block-ui.js";
 export { asGguiRender, asGguiRenderBootstrap, blockGguiRender, gguiRenderResource, gguiShellHtml, toolResultGguiRender, GGUI_RENDER_META_KEY, type GguiRenderBootstrap, type GguiRenderDescriptor, type GguiShellHtmlOptions, } from "./ggui-render.js";
 export { resolveViewMount, snapshotViewMount, toolResultViewMount, type LocatorViewMount, type ResolvedViewMount, type UiResourceReader, type ViewMount, type ViewMountChannel, } from "./card-mount.js";
 export { createMcpUiResourceReader, uiResourceChannel, type CreateMcpUiResourceReaderDeps, type McpResourceReadResult, } from "./reader.js";
-export { asToolCallResult, createMcpUiActionRelay, unavailableToolCallResult, UI_ACTION_TOOLS, UI_ACTION_UNAVAILABLE_TEXT, type CreateMcpUiActionRelayDeps, type McpToolCallContent, type McpToolCallResult, type McpToolStructuredContent, type UiActionRequest, } from "./action.js";
-export { initializeResult, initialViewHostState, teardownMessage, toolCallResponse, TOOLS_CALL_METHOD, viewHostElapsed, viewHostReceive, type ViewHostBehavior, type ViewHostEffect, type ViewHostOutbound, type ViewHostPhase, type ViewHostInfo, type ViewHostState, type ViewHostTransition, type ViewRequestId, } from "./view-host-protocol.js";
+export { asToolCallResult, createMcpUiActionRelay, unavailableToolCallResult, UI_ACTION_TOOLS, UI_ACTION_UNAVAILABLE_TEXT, UI_SEMANTIC_ACTION_TOOLS, type CreateMcpUiActionRelayDeps, type McpToolCallContent, type McpToolCallResult, type McpToolStructuredContent, type UiActionRequest, } from "./action.js";
+export { initializeResult, initialViewHostState, resourceReadResponse, RESOURCES_READ_METHOD, teardownMessage, toolCallResponse, TOOLS_CALL_METHOD, viewHostElapsed, viewHostReceive, type ViewHostBehavior, type ViewHostEffect, type ViewHostOutbound, type ViewHostPhase, type ViewHostInfo, type ViewHostState, type ViewHostTransition, type ViewRequestId, } from "./view-host-protocol.js";
 export { attachViewHost, viewDocumentHtml, type AttachViewHostConfig, type ViewFrameLike, type ViewHostEvents, } from "./view-host.js";
 export { attachSandboxPageDelivery, isSandboxProxyReady, SANDBOX_PROXY_READY_METHOD, SANDBOX_RESOURCE_READY_METHOD, type SandboxPageDeliveryConfig, } from "./sandbox-page.js";
 //# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AACH,OAAO,EACL,iBAAiB,EACjB,YAAY,EACZ,eAAe,EACf,YAAY,EACZ,YAAY,EACZ,4BAA4B,EAC5B,kBAAkB,EAClB,oBAAoB,EACpB,SAAS,EACT,KAAK,oBAAoB,GAC1B,MAAM,eAAe,CAAC;AACvB,OAAO,EACL,YAAY,EACZ,qBAAqB,EACrB,eAAe,EACf,kBAAkB,EAClB,aAAa,EACb,oBAAoB,EACpB,oBAAoB,EACpB,KAAK,mBAAmB,EACxB,KAAK,oBAAoB,EACzB,KAAK,oBAAoB,GAC1B,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EACL,gBAAgB,EAChB,iBAAiB,EACjB,mBAAmB,EACnB,KAAK,gBAAgB,EACrB,KAAK,iBAAiB,EACtB,KAAK,gBAAgB,EACrB,KAAK,SAAS,EACd,KAAK,gBAAgB,GACtB,MAAM,iBAAiB,CAAC;AACzB,OAAO,EACL,yBAAyB,EACzB,iBAAiB,EACjB,KAAK,6BAA6B,EAClC,KAAK,qBAAqB,GAC3B,MAAM,aAAa,CAAC;AACrB,OAAO,EACL,gBAAgB,EAChB,sBAAsB,EACtB,yBAAyB,EACzB,eAAe,EACf,0BAA0B,EAC1B,KAAK,0BAA0B,EAC/B,KAAK,kBAAkB,EACvB,KAAK,iBAAiB,EACtB,KAAK,wBAAwB,EAC7B,KAAK,eAAe,GACrB,MAAM,aAAa,CAAC;AACrB,OAAO,EACL,gBAAgB,EAChB,oBAAoB,EACpB,eAAe,EACf,gBAAgB,EAChB,iBAAiB,EACjB,eAAe,EACf,eAAe,EACf,KAAK,gBAAgB,EACrB,KAAK,cAAc,EACnB,KAAK,gBAAgB,EACrB,KAAK,aAAa,EAClB,KAAK,YAAY,EACjB,KAAK,aAAa,EAClB,KAAK,kBAAkB,EACvB,KAAK,aAAa,GACnB,MAAM,yBAAyB,CAAC;AACjC,OAAO,EACL,cAAc,EACd,gBAAgB,EAChB,KAAK,oBAAoB,EACzB,KAAK,aAAa,EAClB,KAAK,cAAc,GACpB,MAAM,gBAAgB,CAAC;AACxB,OAAO,EACL,yBAAyB,EACzB,mBAAmB,EACnB,0BAA0B,EAC1B,6BAA6B,EAC7B,KAAK,yBAAyB,GAC/B,MAAM,mBAAmB,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AACH,OAAO,EACL,iBAAiB,EACjB,YAAY,EACZ,eAAe,EACf,YAAY,EACZ,YAAY,EACZ,4BAA4B,EAC5B,kBAAkB,EAClB,iBAAiB,EACjB,oBAAoB,EACpB,SAAS,EACT,KAAK,oBAAoB,GAC1B,MAAM,eAAe,CAAC;AACvB,OAAO,EACL,YAAY,EACZ,qBAAqB,EACrB,eAAe,EACf,kBAAkB,EAClB,aAAa,EACb,oBAAoB,EACpB,oBAAoB,EACpB,KAAK,mBAAmB,EACxB,KAAK,oBAAoB,EACzB,KAAK,oBAAoB,GAC1B,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EACL,gBAAgB,EAChB,iBAAiB,EACjB,mBAAmB,EACnB,KAAK,gBAAgB,EACrB,KAAK,iBAAiB,EACtB,KAAK,gBAAgB,EACrB,KAAK,SAAS,EACd,KAAK,gBAAgB,GACtB,MAAM,iBAAiB,CAAC;AACzB,OAAO,EACL,yBAAyB,EACzB,iBAAiB,EACjB,KAAK,6BAA6B,EAClC,KAAK,qBAAqB,GAC3B,MAAM,aAAa,CAAC;AACrB,OAAO,EACL,gBAAgB,EAChB,sBAAsB,EACtB,yBAAyB,EACzB,eAAe,EACf,0BAA0B,EAC1B,wBAAwB,EACxB,KAAK,0BAA0B,EAC/B,KAAK,kBAAkB,EACvB,KAAK,iBAAiB,EACtB,KAAK,wBAAwB,EAC7B,KAAK,eAAe,GACrB,MAAM,aAAa,CAAC;AACrB,OAAO,EACL,gBAAgB,EAChB,oBAAoB,EACpB,oBAAoB,EACpB,qBAAqB,EACrB,eAAe,EACf,gBAAgB,EAChB,iBAAiB,EACjB,eAAe,EACf,eAAe,EACf,KAAK,gBAAgB,EACrB,KAAK,cAAc,EACnB,KAAK,gBAAgB,EACrB,KAAK,aAAa,EAClB,KAAK,YAAY,EACjB,KAAK,aAAa,EAClB,KAAK,kBAAkB,EACvB,KAAK,aAAa,GACnB,MAAM,yBAAyB,CAAC;AACjC,OAAO,EACL,cAAc,EACd,gBAAgB,EAChB,KAAK,oBAAoB,EACzB,KAAK,aAAa,EAClB,KAAK,cAAc,GACpB,MAAM,gBAAgB,CAAC;AACxB,OAAO,EACL,yBAAyB,EACzB,mBAAmB,EACnB,0BAA0B,EAC1B,6BAA6B,EAC7B,KAAK,yBAAyB,GAC/B,MAAM,mBAAmB,CAAC"}

package/dist/index.js

@@ -3,11 +3,11 @@
  * narrowing, ui:// locator rehydration, sandbox-trust channels. See README +
  * the conformance map (guuey#123).
  */
-export { asResourcePayload, asUiResource, blockUiResource, isJsonObject, resourceHtml, scanProviderRawForUiResource, snapshotUiResource, toolResultUiResource, uiLocator, } from "./block-ui.js";
+export { asResourcePayload, asUiResource, blockUiResource, isJsonObject, resourceHtml, scanProviderRawForUiResource, snapshotUiResource, toolResultLocator, toolResultUiResource, uiLocator, } from "./block-ui.js";
 export { asGguiRender, asGguiRenderBootstrap, blockGguiRender, gguiRenderResource, gguiShellHtml, toolResultGguiRender, GGUI_RENDER_META_KEY, } from "./ggui-render.js";
 export { resolveViewMount, snapshotViewMount, toolResultViewMount, } from "./card-mount.js";
 export { createMcpUiResourceReader, uiResourceChannel, } from "./reader.js";
-export { asToolCallResult, createMcpUiActionRelay, unavailableToolCallResult, UI_ACTION_TOOLS, UI_ACTION_UNAVAILABLE_TEXT, } from "./action.js";
-export { initializeResult, initialViewHostState, teardownMessage, toolCallResponse, TOOLS_CALL_METHOD, viewHostElapsed, viewHostReceive, } from "./view-host-protocol.js";
+export { asToolCallResult, createMcpUiActionRelay, unavailableToolCallResult, UI_ACTION_TOOLS, UI_ACTION_UNAVAILABLE_TEXT, UI_SEMANTIC_ACTION_TOOLS, } from "./action.js";
+export { initializeResult, initialViewHostState, resourceReadResponse, RESOURCES_READ_METHOD, teardownMessage, toolCallResponse, TOOLS_CALL_METHOD, viewHostElapsed, viewHostReceive, } from "./view-host-protocol.js";
 export { attachViewHost, viewDocumentHtml, } from "./view-host.js";
 export { attachSandboxPageDelivery, isSandboxProxyReady, SANDBOX_PROXY_READY_METHOD, SANDBOX_RESOURCE_READY_METHOD, } from "./sandbox-page.js";

package/dist/narrowing.d.ts

@@ -5,5 +5,5 @@
  * graph through the barrel (which re-exports the ggui render arm until its
  * retirement — conformance-map step 4).
  */
-export { asResourcePayload, asUiResource, blockUiResource, isJsonObject, resourceHtml, scanProviderRawForUiResource, snapshotUiResource, toolResultUiResource, uiLocator, type McpUiResourcePayload, } from "./block-ui.js";
+export { asResourcePayload, asUiResource, blockUiResource, isJsonObject, resourceHtml, scanProviderRawForUiResource, snapshotUiResource, toolResultLocator, toolResultUiResource, uiLocator, type McpUiResourcePayload, } from "./block-ui.js";
 //# sourceMappingURL=narrowing.d.ts.map

package/dist/narrowing.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"narrowing.d.ts","sourceRoot":"","sources":["../src/narrowing.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AACH,OAAO,EACL,iBAAiB,EACjB,YAAY,EACZ,eAAe,EACf,YAAY,EACZ,YAAY,EACZ,4BAA4B,EAC5B,kBAAkB,EAClB,oBAAoB,EACpB,SAAS,EACT,KAAK,oBAAoB,GAC1B,MAAM,eAAe,CAAC"}
+{"version":3,"file":"narrowing.d.ts","sourceRoot":"","sources":["../src/narrowing.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AACH,OAAO,EACL,iBAAiB,EACjB,YAAY,EACZ,eAAe,EACf,YAAY,EACZ,YAAY,EACZ,4BAA4B,EAC5B,kBAAkB,EAClB,iBAAiB,EACjB,oBAAoB,EACpB,SAAS,EACT,KAAK,oBAAoB,GAC1B,MAAM,eAAe,CAAC"}

package/dist/narrowing.js

@@ -5,4 +5,4 @@
  * graph through the barrel (which re-exports the ggui render arm until its
  * retirement — conformance-map step 4).
  */
-export { asResourcePayload, asUiResource, blockUiResource, isJsonObject, resourceHtml, scanProviderRawForUiResource, snapshotUiResource, toolResultUiResource, uiLocator, } from "./block-ui.js";
+export { asResourcePayload, asUiResource, blockUiResource, isJsonObject, resourceHtml, scanProviderRawForUiResource, snapshotUiResource, toolResultLocator, toolResultUiResource, uiLocator, } from "./block-ui.js";

package/dist/react.d.ts

@@ -41,7 +41,7 @@ export type { AttachViewHostConfig, ViewFrameLike, ViewHostEvents } from "./view
 export { attachSandboxPageDelivery, isSandboxProxyReady, SANDBOX_PROXY_READY_METHOD, SANDBOX_RESOURCE_READY_METHOD, type SandboxPageDeliveryConfig, } from "./sandbox-page.js";
 export type { ViewHostPhase } from "./view-host-protocol.js";
 export type { ResolvedViewMount, ViewMount, ViewMountChannel } from "./card-mount.js";
-export interface GuueyViewProps extends Pick<AttachViewHostConfig, "hostCapabilities" | "hostInfo" | "hostContext" | "onCallTool" | "negotiationTimeoutMs"> {
+export interface GuueyViewProps extends Pick<AttachViewHostConfig, "hostCapabilities" | "hostInfo" | "hostContext" | "onCallTool" | "onReadResource" | "onSizeChanged" | "negotiationTimeoutMs"> {
     /** The resolved card to mount (see `toolResultViewMount`/`resolveViewMount`). */
     mount: ResolvedViewMount;
     /**
@@ -59,8 +59,23 @@ export interface GuueyViewProps extends Pick<AttachViewHostConfig, "hostCapabili
      * for its CSP + referrer checks to mean anything), never agent HTML.
      * The page must be a genuinely different origin; a same-origin URL is
      * refused with a labeled state, never mounted.
+     *
+     * `null` (as opposed to absent) means the two-origin mount is REQUIRED
+     * by the embedder's posture but no page is configured — the mount is
+     * refused with the same labeled state, and srcdoc is NEVER fallen back
+     * to (falling back would silently trade the caller's egress confinement
+     * for the page's CSP; the widget/Studio convergence posture).
      */
-    sandboxPageUrl?: string;
+    sandboxPageUrl?: string | null;
+    /**
+     * Apply the view's own size reports (`ui/notifications/size-changed` —
+     * spec surface) to the frame: a reported HEIGHT becomes the frame's
+     * height; width stays the container's (a transcript column owns its
+     * width). Default OFF — the primitive changes nothing for existing
+     * hosts; a caller's {@link AttachViewHostConfig.onSizeChanged} observer
+     * fires either way.
+     */
+    autoResize?: boolean;
     /**
      * Sandbox flags appended to the safe default (`allow-scripts`). Every
      * entry widens what agent-generated HTML may do — `allow-same-origin`

package/dist/react.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"react.d.ts","sourceRoot":"","sources":["../src/react.tsx"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAiCG;AACH,OAAO,EAAwC,KAAK,aAAa,EAAE,KAAK,SAAS,EAAE,MAAM,OAAO,CAAC;AACjG,OAAO,EAAoC,KAAK,oBAAoB,EAAE,MAAM,gBAAgB,CAAC;AAE7F,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,yBAAyB,CAAC;AAC7D,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,iBAAiB,CAAC;AAEzD,OAAO,EAAE,cAAc,EAAE,gBAAgB,EAAE,MAAM,gBAAgB,CAAC;AAClE,YAAY,EAAE,oBAAoB,EAAE,aAAa,EAAE,cAAc,EAAE,MAAM,gBAAgB,CAAC;AAC1F,OAAO,EACL,yBAAyB,EACzB,mBAAmB,EACnB,0BAA0B,EAC1B,6BAA6B,EAC7B,KAAK,yBAAyB,GAC/B,MAAM,mBAAmB,CAAC;AAC3B,YAAY,EAAE,aAAa,EAAE,MAAM,yBAAyB,CAAC;AAC7D,YAAY,EAAE,iBAAiB,EAAE,SAAS,EAAE,gBAAgB,EAAE,MAAM,iBAAiB,CAAC;AAKtF,MAAM,WAAW,cACf,SAAQ,IAAI,CACV,oBAAoB,EACpB,kBAAkB,GAAG,UAAU,GAAG,aAAa,GAAG,YAAY,GAAG,sBAAsB,CACxF;IACD,iFAAiF;IACjF,KAAK,EAAE,iBAAiB,CAAC;IACzB;;;;;;;;;;;;;;;OAeG;IACH,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB;;;;;;OAMG;IACH,0BAA0B,CAAC,EAAE,MAAM,EAAE,CAAC;IACtC,8EAA8E;IAC9E,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,wDAAwD;IACxD,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,KAAK,CAAC,EAAE,aAAa,CAAC;IACtB,6EAA6E;IAC7E,aAAa,CAAC,EAAE,CAAC,KAAK,EAAE,aAAa,KAAK,IAAI,CAAC;IAC/C;;;;;;OAMG;IACH,YAAY,CAAC,EAAE,CAAC,KAAK,EAAE,aAAa,KAAK,SAAS,CAAC;CACpD;AA+BD;;;GAGG;AACH,wBAAgB,SAAS,CAAC,KAAK,EAAE,cAAc,GAAG,SAAS,CAiI1D"}
+{"version":3,"file":"react.d.ts","sourceRoot":"","sources":["../src/react.tsx"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAiCG;AACH,OAAO,EAAwC,KAAK,aAAa,EAAE,KAAK,SAAS,EAAE,MAAM,OAAO,CAAC;AACjG,OAAO,EAAoC,KAAK,oBAAoB,EAAE,MAAM,gBAAgB,CAAC;AAE7F,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,yBAAyB,CAAC;AAC7D,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,iBAAiB,CAAC;AAEzD,OAAO,EAAE,cAAc,EAAE,gBAAgB,EAAE,MAAM,gBAAgB,CAAC;AAClE,YAAY,EAAE,oBAAoB,EAAE,aAAa,EAAE,cAAc,EAAE,MAAM,gBAAgB,CAAC;AAC1F,OAAO,EACL,yBAAyB,EACzB,mBAAmB,EACnB,0BAA0B,EAC1B,6BAA6B,EAC7B,KAAK,yBAAyB,GAC/B,MAAM,mBAAmB,CAAC;AAC3B,YAAY,EAAE,aAAa,EAAE,MAAM,yBAAyB,CAAC;AAC7D,YAAY,EAAE,iBAAiB,EAAE,SAAS,EAAE,gBAAgB,EAAE,MAAM,iBAAiB,CAAC;AAKtF,MAAM,WAAW,cACf,SAAQ,IAAI,CACV,oBAAoB,EAClB,kBAAkB,GAClB,UAAU,GACV,aAAa,GACb,YAAY,GACZ,gBAAgB,GAChB,eAAe,GACf,sBAAsB,CACzB;IACD,iFAAiF;IACjF,KAAK,EAAE,iBAAiB,CAAC;IACzB;;;;;;;;;;;;;;;;;;;;;OAqBG;IACH,cAAc,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC/B;;;;;;;OAOG;IACH,UAAU,CAAC,EAAE,OAAO,CAAC;IACrB;;;;;;OAMG;IACH,0BAA0B,CAAC,EAAE,MAAM,EAAE,CAAC;IACtC,8EAA8E;IAC9E,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,wDAAwD;IACxD,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,KAAK,CAAC,EAAE,aAAa,CAAC;IACtB,6EAA6E;IAC7E,aAAa,CAAC,EAAE,CAAC,KAAK,EAAE,aAAa,KAAK,IAAI,CAAC;IAC/C;;;;;;OAMG;IACH,YAAY,CAAC,EAAE,CAAC,KAAK,EAAE,aAAa,KAAK,SAAS,CAAC;CACpD;AA+BD;;;GAGG;AACH,wBAAgB,SAAS,CAAC,KAAK,EAAE,cAAc,GAAG,SAAS,CA0J1D"}

package/dist/react.js

@@ -68,18 +68,23 @@ function defaultStatus(phase, channel) {
  * docblock for the sandbox and state contracts.
  */
 export function GuueyView(props) {
-    const { mount, sandboxPageUrl, dangerouslyAddSandboxFlags, allow, title, className, style, onPhaseChange, renderStatus, ...hostConfig } = props;
+    const { mount, sandboxPageUrl, autoResize, dangerouslyAddSandboxFlags, allow, title, className, style, onPhaseChange, renderStatus, ...hostConfig } = props;
     const frameRef = useRef(null);
     const [phase, setPhase] = useState("negotiating");
+    // The view's own size report, applied only under `autoResize`.
+    const [reportedHeight, setReportedHeight] = useState(undefined);
     const html = viewDocumentHtml(mount.resource);
     // Vet the sandbox page once per URL. Same-origin is REFUSED (the widget's
     // ResourceMount precedent, generalized): the whole point of the page is
     // being a different origin — same-origin would hand the relay page (and
     // through `allow-same-origin`, everything it can reach) the embedder's
-    // own origin.
+    // own origin. `null` — page mode required but unconfigured — refuses the
+    // same way: srcdoc is never a silent fallback for a confinement posture.
     const sandboxPage = useMemo(() => {
         if (sandboxPageUrl === undefined)
             return undefined;
+        if (sandboxPageUrl === null)
+            return "refused";
         let url;
         try {
             url = new URL(sandboxPageUrl);
@@ -95,13 +100,14 @@ export function GuueyView(props) {
     // The attachment is keyed to the mounted DOCUMENT, not to every render's
     // fresh callback identities — host config rides a ref so the effect's
     // dependency list is honestly just the document identity.
-    const latest = useRef({ hostConfig, onPhaseChange, dangerouslyAddSandboxFlags });
-    latest.current = { hostConfig, onPhaseChange, dangerouslyAddSandboxFlags };
+    const latest = useRef({ hostConfig, onPhaseChange, dangerouslyAddSandboxFlags, autoResize });
+    latest.current = { hostConfig, onPhaseChange, dangerouslyAddSandboxFlags, autoResize };
     useEffect(() => {
         // Keyed to the same identity the frame is (the resource uri): a new
         // document boots fresh, and the previous negotiation's phase must not
-        // paper over it.
+        // paper over it — nor must the previous document's reported size.
         setPhase("negotiating");
+        setReportedHeight(undefined);
         const frame = frameRef.current;
         if (frame === null || html === undefined)
             return;
@@ -115,6 +121,12 @@ export function GuueyView(props) {
                 setPhase(next);
                 latest.current.onPhaseChange?.(next);
             },
+            onSizeChanged: (size) => {
+                if (latest.current.autoResize === true && size.height !== undefined) {
+                    setReportedHeight(size.height);
+                }
+                latest.current.hostConfig.onSizeChanged?.(size);
+            },
         });
         if (page === undefined)
             return detachHost;
@@ -141,9 +153,14 @@ export function GuueyView(props) {
         return (_jsx("div", { className: className, style: { position: "relative", ...style }, children: _jsx("p", { role: "alert", style: { ...statusLineStyle, opacity: 1, pointerEvents: "auto" }, children: "This view could not be displayed \u2014 its resource carries no document." }) }));
     }
     if (sandboxPageUrl !== undefined && page === undefined) {
-        // A malformed or SAME-ORIGIN sandbox page is a configuration state, not
-        // a property of the card — refused, labeled, never mounted.
-        return (_jsx("div", { className: className, style: { position: "relative", ...style }, children: _jsx("p", { role: "alert", style: { ...statusLineStyle, opacity: 1, pointerEvents: "auto" }, children: "Interactive view unavailable \u2014 the sandbox page is not usable from this origin." }) }));
+        // A missing (null), malformed, or SAME-ORIGIN sandbox page is a
+        // configuration state, not a property of the card — refused, labeled,
+        // never mounted, and never silently downgraded to srcdoc. The copy
+        // names the configuration cause (an operator can act on it) without
+        // ever printing the offending URL.
+        return (_jsx("div", { className: className, style: { position: "relative", ...style }, children: _jsx("p", { role: "alert", style: { ...statusLineStyle, opacity: 1, pointerEvents: "auto" }, children: sandboxPageUrl === null
+                    ? "Interactive view unavailable — no sandbox page is configured."
+                    : "Interactive view unavailable — the sandbox page is not usable from this origin." }) }));
     }
     return (_jsxs("div", { className: className, style: { position: "relative", ...style }, children: [_jsx("iframe", { ref: frameRef, ...(page !== undefined ? { src: page.href } : { srcDoc: html }), title: title ?? DEFAULT_TITLE, 
                 // srcdoc mode: the INVARIANT — agent HTML in an opaque origin, extra
@@ -154,5 +171,14 @@ export function GuueyView(props) {
                 // and the caller's extra flags travel to THAT frame via the relay.
                 sandbox: page !== undefined
                     ? "allow-scripts allow-same-origin allow-forms"
-                    : ["allow-scripts", ...(dangerouslyAddSandboxFlags ?? [])].join(" "), allow: allow ?? "clipboard-write", style: { display: "block", width: "100%", height: "100%", border: 0 } }, `${page?.href ?? "srcdoc"}::${mount.resource.uri}`), renderStatus !== undefined ? renderStatus(phase) : defaultStatus(phase, mount.channel)] }));
+                    : ["allow-scripts", ...(dangerouslyAddSandboxFlags ?? [])].join(" "), allow: allow ?? "clipboard-write", 
+                // Under `autoResize`, the view's own height report wins over the
+                // fill-the-container default (width stays the container's — a
+                // transcript column owns its width).
+                style: {
+                    display: "block",
+                    width: "100%",
+                    height: autoResize === true && reportedHeight !== undefined ? reportedHeight : "100%",
+                    border: 0,
+                } }, `${page?.href ?? "srcdoc"}::${mount.resource.uri}`), renderStatus !== undefined ? renderStatus(phase) : defaultStatus(phase, mount.channel)] }));
 }

package/dist/view-host-protocol.d.ts

@@ -32,6 +32,7 @@
  */
 import { type McpUiHostCapabilities, type McpUiHostContext, type McpUiInitializeResult } from "@modelcontextprotocol/ext-apps";
 import type { McpToolStructuredContent } from "./action.js";
+import type { McpResourceReadResult } from "./reader.js";
 /**
  * The host identity in the initialize result — structurally the spec's
  * `Implementation` (which the ext-apps root does not re-export), narrowed
@@ -43,6 +44,15 @@ export interface ViewHostInfo {
 }
 /** The standard MCP method a view uses to reach host-proxied tools. */
 export declare const TOOLS_CALL_METHOD = "tools/call";
+/**
+ * The standard MCP method a view uses to read host-proxied resources —
+ * `ReadResourceRequest` in the spec's App→Host request union
+ * (`@modelcontextprotocol/ext-apps` `AppRequest`). A local constant, same
+ * as {@link TOOLS_CALL_METHOD}: the string is MCP-core vocabulary the
+ * ext-apps root does not re-export, and this package deliberately carries
+ * no `@modelcontextprotocol/sdk` dependency.
+ */
+export declare const RESOURCES_READ_METHOD = "resources/read";
 /** A JSON-RPC id as the wire allows it. */
 export type ViewRequestId = number | string;
 /** The messages this host posts INTO the view frame. */
@@ -105,6 +115,31 @@ export type ViewHostEffect = {
     id: ViewRequestId;
     name: string;
     arguments?: McpToolStructuredContent;
+} | {
+    /**
+     * A `resources/read` the config accepted for relaying (spec surface:
+     * `ReadResourceRequest` rides the App→Host union, and the matching
+     * advertisement is `hostCapabilities.serverResources`). The glue runs
+     * the read hook and posts {@link resourceReadResponse}. Only emitted
+     * when {@link ViewHostBehavior.resourceRelay} is true — unwired, the
+     * machine refuses in-band like every other unsupported request.
+     */
+    kind: "relay-resource-read";
+    id: ViewRequestId;
+    uri: string;
+} | {
+    /**
+     * The view reported its content size (`ui/notifications/size-changed`
+     * — spec notification, App → Host). At least one of the two fields is
+     * a finite number; a notification carrying neither is consumed
+     * silently instead. The glue forwards this to the embedder
+     * ({@link AttachViewHostConfig.onSizeChanged} in `view-host.ts`) —
+     * whether/how to resize the frame is the embedder's layout decision,
+     * never the machine's.
+     */
+    kind: "size-changed";
+    width?: number;
+    height?: number;
 };
 /**
  * The host identity/behavior the machine answers with. Everything here is
@@ -125,6 +160,8 @@ export interface ViewHostBehavior {
     hostContext: McpUiHostContext;
     /** Whether a `tools/call` relay hook is wired (see `view-host.ts`). */
     toolRelay: boolean;
+    /** Whether a `resources/read` relay hook is wired (see `view-host.ts`). */
+    resourceRelay: boolean;
 }
 /** The result of feeding one inbound frame (or the timeout) to the machine. */
 export interface ViewHostTransition {
@@ -137,6 +174,13 @@ export declare function initializeResult(behavior: ViewHostBehavior, requestedPr
 export declare function toolCallResponse(id: ViewRequestId, result: {
     [key: string]: unknown;
 }): ViewHostOutbound;
+/**
+ * Build the in-band response for a relayed `resources/read`. An entry
+ * becomes the spec's `ReadResourceResult` (`contents: [entry]`); `undefined`
+ * — a miss, a deny, or a relay failure alike — becomes the one
+ * `Resource not found` error (deny == miss, {@link RESOURCE_NOT_FOUND}).
+ */
+export declare function resourceReadResponse(id: ViewRequestId, entry: McpResourceReadResult | undefined): ViewHostOutbound;
 /**
  * The spec-mannered farewell a detaching host posts (`ui/resource-teardown`).
  * Sent WITHOUT an id — a host that is tearing the frame down cannot await a

package/dist/view-host-protocol.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"view-host-protocol.d.ts","sourceRoot":"","sources":["../src/view-host-protocol.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+BG;AACH,OAAO,EAIL,KAAK,qBAAqB,EAC1B,KAAK,gBAAgB,EACrB,KAAK,qBAAqB,EAC3B,MAAM,gCAAgC,CAAC;AACxC,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,aAAa,CAAC;AAE5D;;;;GAIG;AACH,MAAM,WAAW,YAAY;IAC3B,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,MAAM,CAAC;CACjB;AAKD,uEAAuE;AACvE,eAAO,MAAM,iBAAiB,eAAe,CAAC;AAE9C,2CAA2C;AAC3C,MAAM,MAAM,aAAa,GAAG,MAAM,GAAG,MAAM,CAAC;AAE5C,wDAAwD;AACxD,MAAM,WAAW,gBAAgB;IAC/B,OAAO,EAAE,KAAK,CAAC;IACf,EAAE,CAAC,EAAE,aAAa,CAAC;IACnB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,MAAM,CAAC,EAAE;QAAE,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAA;KAAE,CAAC;IACpC,MAAM,CAAC,EAAE;QAAE,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAA;KAAE,CAAC;IACpC,KAAK,CAAC,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,CAAA;KAAE,CAAC;CAC3C;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,MAAM,aAAa,GAAG,aAAa,GAAG,WAAW,GAAG,cAAc,CAAC;AAEzE,iFAAiF;AACjF,MAAM,WAAW,aAAa;IAC5B,KAAK,EAAE,aAAa,CAAC;IACrB,0EAA0E;IAC1E,eAAe,EAAE,OAAO,CAAC;CAC1B;AAED,wBAAgB,oBAAoB,IAAI,aAAa,CAEpD;AAED;;;GAGG;AACH,MAAM,MAAM,cAAc,GACtB;IAAE,IAAI,EAAE,SAAS,CAAC;IAAC,OAAO,EAAE,gBAAgB,CAAA;CAAE,GAC9C;IACE;;;;;;OAMG;IACH,IAAI,EAAE,iBAAiB,CAAC;IACxB,EAAE,EAAE,aAAa,CAAC;IAClB,IAAI,EAAE,MAAM,CAAC;IACb,SAAS,CAAC,EAAE,wBAAwB,CAAC;CACtC,CAAC;AAEN;;;GAGG;AACH,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,EAAE,YAAY,CAAC;IACvB;;;;;;;OAOG;IACH,gBAAgB,EAAE,qBAAqB,CAAC;IACxC,+DAA+D;IAC/D,WAAW,EAAE,gBAAgB,CAAC;IAC9B,uEAAuE;IACvE,SAAS,EAAE,OAAO,CAAC;CACpB;AAED,+EAA+E;AAC/E,MAAM,WAAW,kBAAkB;IACjC,KAAK,EAAE,aAAa,CAAC;IACrB,OAAO,EAAE,cAAc,EAAE,CAAC;CAC3B;AAiCD,iFAAiF;AACjF,wBAAgB,gBAAgB,CAC9B,QAAQ,EAAE,gBAAgB,EAC1B,wBAAwB,EAAE,OAAO,GAChC,qBAAqB,CAcvB;AAED,8EAA8E;AAC9E,wBAAgB,gBAAgB,CAC9B,EAAE,EAAE,aAAa,EACjB,MAAM,EAAE;IAAE,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAA;CAAE,GACjC,gBAAgB,CAElB;AAED;;;;;GAKG;AACH,wBAAgB,eAAe,IAAI,gBAAgB,CAElD;AAED;;;;;;;;;;;;GAYG;AACH,wBAAgB,eAAe,CAC7B,KAAK,EAAE,aAAa,EACpB,QAAQ,EAAE,gBAAgB,EAC1B,IAAI,EAAE,OAAO,GACZ,kBAAkB,CAuDpB;AAED;;;;GAIG;AACH,wBAAgB,eAAe,CAAC,KAAK,EAAE,aAAa,GAAG,aAAa,CAEnE"}
+{"version":3,"file":"view-host-protocol.d.ts","sourceRoot":"","sources":["../src/view-host-protocol.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+BG;AACH,OAAO,EAKL,KAAK,qBAAqB,EAC1B,KAAK,gBAAgB,EACrB,KAAK,qBAAqB,EAC3B,MAAM,gCAAgC,CAAC;AACxC,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,aAAa,CAAC;AAC5D,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,aAAa,CAAC;AAEzD;;;;GAIG;AACH,MAAM,WAAW,YAAY;IAC3B,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,MAAM,CAAC;CACjB;AAKD,uEAAuE;AACvE,eAAO,MAAM,iBAAiB,eAAe,CAAC;AAE9C;;;;;;;GAOG;AACH,eAAO,MAAM,qBAAqB,mBAAmB,CAAC;AAStD,2CAA2C;AAC3C,MAAM,MAAM,aAAa,GAAG,MAAM,GAAG,MAAM,CAAC;AAE5C,wDAAwD;AACxD,MAAM,WAAW,gBAAgB;IAC/B,OAAO,EAAE,KAAK,CAAC;IACf,EAAE,CAAC,EAAE,aAAa,CAAC;IACnB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,MAAM,CAAC,EAAE;QAAE,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAA;KAAE,CAAC;IACpC,MAAM,CAAC,EAAE;QAAE,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAA;KAAE,CAAC;IACpC,KAAK,CAAC,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,CAAA;KAAE,CAAC;CAC3C;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,MAAM,aAAa,GAAG,aAAa,GAAG,WAAW,GAAG,cAAc,CAAC;AAEzE,iFAAiF;AACjF,MAAM,WAAW,aAAa;IAC5B,KAAK,EAAE,aAAa,CAAC;IACrB,0EAA0E;IAC1E,eAAe,EAAE,OAAO,CAAC;CAC1B;AAED,wBAAgB,oBAAoB,IAAI,aAAa,CAEpD;AAED;;;GAGG;AACH,MAAM,MAAM,cAAc,GACtB;IAAE,IAAI,EAAE,SAAS,CAAC;IAAC,OAAO,EAAE,gBAAgB,CAAA;CAAE,GAC9C;IACE;;;;;;OAMG;IACH,IAAI,EAAE,iBAAiB,CAAC;IACxB,EAAE,EAAE,aAAa,CAAC;IAClB,IAAI,EAAE,MAAM,CAAC;IACb,SAAS,CAAC,EAAE,wBAAwB,CAAC;CACtC,GACD;IACE;;;;;;;OAOG;IACH,IAAI,EAAE,qBAAqB,CAAC;IAC5B,EAAE,EAAE,aAAa,CAAC;IAClB,GAAG,EAAE,MAAM,CAAC;CACb,GACD;IACE;;;;;;;;OAQG;IACH,IAAI,EAAE,cAAc,CAAC;IACrB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB,CAAC;AAEN;;;GAGG;AACH,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,EAAE,YAAY,CAAC;IACvB;;;;;;;OAOG;IACH,gBAAgB,EAAE,qBAAqB,CAAC;IACxC,+DAA+D;IAC/D,WAAW,EAAE,gBAAgB,CAAC;IAC9B,uEAAuE;IACvE,SAAS,EAAE,OAAO,CAAC;IACnB,2EAA2E;IAC3E,aAAa,EAAE,OAAO,CAAC;CACxB;AAED,+EAA+E;AAC/E,MAAM,WAAW,kBAAkB;IACjC,KAAK,EAAE,aAAa,CAAC;IACrB,OAAO,EAAE,cAAc,EAAE,CAAC;CAC3B;AAiCD,iFAAiF;AACjF,wBAAgB,gBAAgB,CAC9B,QAAQ,EAAE,gBAAgB,EAC1B,wBAAwB,EAAE,OAAO,GAChC,qBAAqB,CAcvB;AAED,8EAA8E;AAC9E,wBAAgB,gBAAgB,CAC9B,EAAE,EAAE,aAAa,EACjB,MAAM,EAAE;IAAE,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAA;CAAE,GACjC,gBAAgB,CAElB;AAED;;;;;GAKG;AACH,wBAAgB,oBAAoB,CAClC,EAAE,EAAE,aAAa,EACjB,KAAK,EAAE,qBAAqB,GAAG,SAAS,GACvC,gBAAgB,CASlB;AAED;;;;;GAKG;AACH,wBAAgB,eAAe,IAAI,gBAAgB,CAElD;AAED;;;;;;;;;;;;GAYG;AACH,wBAAgB,eAAe,CAC7B,KAAK,EAAE,aAAa,EACpB,QAAQ,EAAE,gBAAgB,EAC1B,IAAI,EAAE,OAAO,GACZ,kBAAkB,CAuFpB;AAED;;;;GAIG;AACH,wBAAgB,eAAe,CAAC,KAAK,EAAE,aAAa,GAAG,aAAa,CAEnE"}

package/dist/view-host-protocol.js

@@ -30,11 +30,26 @@
  * view; everything ggui-specific stays in `ggui-render.ts` behind ggui's
  * own published protocol package.
  */
-import { INITIALIZE_METHOD, LATEST_PROTOCOL_VERSION, RESOURCE_TEARDOWN_METHOD, } from "@modelcontextprotocol/ext-apps";
+import { INITIALIZE_METHOD, LATEST_PROTOCOL_VERSION, RESOURCE_TEARDOWN_METHOD, SIZE_CHANGED_METHOD, } from "@modelcontextprotocol/ext-apps";
 /** JSON-RPC `method not found` — the spec's code, not an invented one. */
 const METHOD_NOT_SUPPORTED = -32601;
 /** The standard MCP method a view uses to reach host-proxied tools. */
 export const TOOLS_CALL_METHOD = "tools/call";
+/**
+ * The standard MCP method a view uses to read host-proxied resources —
+ * `ReadResourceRequest` in the spec's App→Host request union
+ * (`@modelcontextprotocol/ext-apps` `AppRequest`). A local constant, same
+ * as {@link TOOLS_CALL_METHOD}: the string is MCP-core vocabulary the
+ * ext-apps root does not re-export, and this package deliberately carries
+ * no `@modelcontextprotocol/sdk` dependency.
+ */
+export const RESOURCES_READ_METHOD = "resources/read";
+/**
+ * MCP's `Resource not found` JSON-RPC code — the one answer for a miss, a
+ * transport deny, AND a relay failure (deny == miss: the reader discipline,
+ * `reader.ts` — the view gets no oracle for which locators resolve).
+ */
+const RESOURCE_NOT_FOUND = -32002;
 export function initialViewHostState() {
     return { phase: "negotiating", initializedSeen: false };
 }
@@ -83,6 +98,22 @@ export function initializeResult(behavior, requestedProtocolVersion) {
 export function toolCallResponse(id, result) {
     return { jsonrpc: "2.0", id, result };
 }
+/**
+ * Build the in-band response for a relayed `resources/read`. An entry
+ * becomes the spec's `ReadResourceResult` (`contents: [entry]`); `undefined`
+ * — a miss, a deny, or a relay failure alike — becomes the one
+ * `Resource not found` error (deny == miss, {@link RESOURCE_NOT_FOUND}).
+ */
+export function resourceReadResponse(id, entry) {
+    if (entry === undefined) {
+        return {
+            jsonrpc: "2.0",
+            id,
+            error: { code: RESOURCE_NOT_FOUND, message: "resource unavailable" },
+        };
+    }
+    return { jsonrpc: "2.0", id, result: { contents: [entry] } };
+}
 /**
  * The spec-mannered farewell a detaching host posts (`ui/resource-teardown`).
  * Sent WITHOUT an id — a host that is tearing the frame down cannot await a
@@ -110,10 +141,29 @@ export function viewHostReceive(state, behavior, data) {
     if (req === undefined)
         return { state, effects: [] };
     if (req.id === undefined) {
-        // A notification. Track the one the handshake defines; consume the rest.
+        // A notification. Track the one the handshake defines, surface the one
+        // the embedder may act on; consume the rest.
         if (req.method === "ui/notifications/initialized" && !state.initializedSeen) {
             return { state: { ...state, initializedSeen: true }, effects: [] };
         }
+        if (req.method === SIZE_CHANGED_METHOD) {
+            const width = req.params?.["width"];
+            const height = req.params?.["height"];
+            const validWidth = typeof width === "number" && Number.isFinite(width);
+            const validHeight = typeof height === "number" && Number.isFinite(height);
+            if (validWidth || validHeight) {
+                return {
+                    state,
+                    effects: [
+                        {
+                            kind: "size-changed",
+                            ...(validWidth ? { width } : {}),
+                            ...(validHeight ? { height } : {}),
+                        },
+                    ],
+                };
+            }
+        }
         return { state, effects: [] };
     }
     if (req.method === INITIALIZE_METHOD) {
@@ -141,6 +191,18 @@ export function viewHostReceive(state, behavior, data) {
         }
         // fall through: a nameless tools/call is not a call we can relay.
     }
+    if (req.method === RESOURCES_READ_METHOD && behavior.resourceRelay) {
+        const uri = req.params?.["uri"];
+        if (typeof uri === "string") {
+            return { state, effects: [{ kind: "relay-resource-read", id: req.id, uri }] };
+        }
+        // fall through: a uri-less read is not a read we can relay.
+    }
+    const answered = [
+        INITIALIZE_METHOD,
+        ...(behavior.toolRelay ? [TOOLS_CALL_METHOD] : []),
+        ...(behavior.resourceRelay ? [RESOURCES_READ_METHOD] : []),
+    ];
     return {
         state,
         effects: [
@@ -151,7 +213,7 @@ export function viewHostReceive(state, behavior, data) {
                     id: req.id,
                     error: {
                         code: METHOD_NOT_SUPPORTED,
-                        message: `method_not_supported: ${req.method} — this host answers ${INITIALIZE_METHOD}${behavior.toolRelay ? ` and ${TOOLS_CALL_METHOD}` : ""} only`,
+                        message: `method_not_supported: ${req.method} — this host answers ${answered.join(", ")} only`,
                     },
                 },
             },