@guuey/mcp-apps-host 0.6.0 → 0.7.0

package/dist/ggui-render.js

@@ -1,9 +1,18 @@
 import { asGguiRenderBootstrap, gguiShellHtml, MCP_APP_AI_GGUI_RENDER_META_KEY, } from "@ggui-ai/protocol/integrations/mcp-apps";
 import { isJsonObject } from "./block-ui.js";
-export { asGguiRenderBootstrap, gguiShellHtml, } from "@ggui-ai/protocol/integrations/mcp-apps";
+export { 
+/** @deprecated import from `@ggui-ai/protocol/integrations/mcp-apps` (guuey#209; removed next minor). */
+asGguiRenderBootstrap, 
+/** @deprecated import from `@ggui-ai/protocol/integrations/mcp-apps` (guuey#209; removed next minor). */
+gguiShellHtml, } from "@ggui-ai/protocol/integrations/mcp-apps";
 /**
  * The `_meta` key the ggui render bootstrap rides on. Alias of the
  * protocol package's own constant — one spelling, owned upstream.
+ *
+ * @deprecated guuey#209 — nothing in this package reads `_meta` any more.
+ * Import `MCP_APP_AI_GGUI_RENDER_META_KEY` from
+ * `@ggui-ai/protocol/integrations/mcp-apps` if you still need the key.
+ * Removed in the minor after the one shipping this notice.
  */
 export const GGUI_RENDER_META_KEY = MCP_APP_AI_GGUI_RENDER_META_KEY;
 /** The `ui://` scheme prefix every ggui render resource uri carries. */
@@ -15,6 +24,9 @@ const UI_SCHEME = "ui://";
  * The `ui://` scheme gate is deliberate: `uiData` is a general-purpose channel
  * (every `structuredContent` of a `_meta.ui`-stamped tool lands there), so a
  * bare `resourceUri` string is not on its own a claim of generative UI.
+ *
+ * @deprecated guuey#209 — use `toolResultLocator(block)`; the vendor arm is
+ * retired and nothing consumes the descriptor. Removed next minor.
  */
 export function asGguiRender(uiData, meta) {
     if (!isJsonObject(uiData))
@@ -36,11 +48,17 @@ export function asGguiRender(uiData, meta) {
  * same name that narrows a spec-canonical MCP `CallToolResult` instead. This
  * one is the silverprotocol-side twin — the input is the FOLDED block, whose
  * `uiData`/`_meta` carriage is `@silverprotocol/core`'s contract, not ggui's.
+ *
+ * @deprecated guuey#209 — use `toolResultLocator(block)`. Removed next minor.
  */
 export function toolResultGguiRender(block) {
     return asGguiRender(block.uiData, block._meta);
 }
-/** An untyped (persisted-snapshot) block → its ggui render descriptor, if it is one. */
+/**
+ * An untyped (persisted-snapshot) block → its ggui render descriptor, if it is one.
+ * @deprecated guuey#209 — use `snapshotViewMount(cardSnapshot)`, whose locator
+ * arm is the persisted path. Removed next minor.
+ */
 export function blockGguiRender(block) {
     if (!isJsonObject(block))
         return undefined;
@@ -53,6 +71,11 @@ export function blockGguiRender(block) {
  * mcp-ui path already knows how to mount, or `undefined` when the descriptor
  * carries no bootstrap (history cards, and any fold that dropped `_meta`).
  *
+ * @deprecated guuey#209 — resolve the locator through a `UiResourceReader`
+ * (`resolveViewMount`); ggui's `resources/read` returns the shell with
+ * live-channel material minted FRESH at read time, which this inlined
+ * copy could never be. Removed next minor.
+ *
  * The `uri` is the render's REAL `resourceUri` — the shell is the payload, not
  * a renaming of the resource.
  *

package/dist/index.d.ts

@@ -3,11 +3,11 @@
  * narrowing, ui:// locator rehydration, sandbox-trust channels. See README +
  * the conformance map (guuey#123).
  */
-export { asResourcePayload, asUiResource, blockUiResource, isJsonObject, resourceHtml, scanProviderRawForUiResource, snapshotUiResource, toolResultUiResource, uiLocator, type McpUiResourcePayload, } from "./block-ui.js";
+export { asResourcePayload, asUiResource, blockUiResource, isJsonObject, resourceHtml, scanProviderRawForUiResource, snapshotUiResource, toolResultLocator, toolResultUiResource, uiLocator, type McpUiResourcePayload, } from "./block-ui.js";
 export { asGguiRender, asGguiRenderBootstrap, blockGguiRender, gguiRenderResource, gguiShellHtml, toolResultGguiRender, GGUI_RENDER_META_KEY, type GguiRenderBootstrap, type GguiRenderDescriptor, type GguiShellHtmlOptions, } from "./ggui-render.js";
 export { resolveViewMount, snapshotViewMount, toolResultViewMount, type LocatorViewMount, type ResolvedViewMount, type UiResourceReader, type ViewMount, type ViewMountChannel, } from "./card-mount.js";
 export { createMcpUiResourceReader, uiResourceChannel, type CreateMcpUiResourceReaderDeps, type McpResourceReadResult, } from "./reader.js";
-export { asToolCallResult, createMcpUiActionRelay, unavailableToolCallResult, UI_ACTION_TOOLS, UI_ACTION_UNAVAILABLE_TEXT, type CreateMcpUiActionRelayDeps, type McpToolCallContent, type McpToolCallResult, type McpToolStructuredContent, type UiActionRequest, } from "./action.js";
+export { asToolCallResult, createMcpUiActionRelay, unavailableToolCallResult, UI_ACTION_TOOLS, UI_ACTION_UNAVAILABLE_TEXT, UI_SEMANTIC_ACTION_TOOLS, type CreateMcpUiActionRelayDeps, type McpToolCallContent, type McpToolCallResult, type McpToolStructuredContent, type UiActionRequest, } from "./action.js";
 export { initializeResult, initialViewHostState, resourceReadResponse, RESOURCES_READ_METHOD, teardownMessage, toolCallResponse, TOOLS_CALL_METHOD, viewHostElapsed, viewHostReceive, type ViewHostBehavior, type ViewHostEffect, type ViewHostOutbound, type ViewHostPhase, type ViewHostInfo, type ViewHostState, type ViewHostTransition, type ViewRequestId, } from "./view-host-protocol.js";
 export { attachViewHost, viewDocumentHtml, type AttachViewHostConfig, type ViewFrameLike, type ViewHostEvents, } from "./view-host.js";
 export { attachSandboxPageDelivery, isSandboxProxyReady, SANDBOX_PROXY_READY_METHOD, SANDBOX_RESOURCE_READY_METHOD, type SandboxPageDeliveryConfig, } from "./sandbox-page.js";

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AACH,OAAO,EACL,iBAAiB,EACjB,YAAY,EACZ,eAAe,EACf,YAAY,EACZ,YAAY,EACZ,4BAA4B,EAC5B,kBAAkB,EAClB,oBAAoB,EACpB,SAAS,EACT,KAAK,oBAAoB,GAC1B,MAAM,eAAe,CAAC;AACvB,OAAO,EACL,YAAY,EACZ,qBAAqB,EACrB,eAAe,EACf,kBAAkB,EAClB,aAAa,EACb,oBAAoB,EACpB,oBAAoB,EACpB,KAAK,mBAAmB,EACxB,KAAK,oBAAoB,EACzB,KAAK,oBAAoB,GAC1B,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EACL,gBAAgB,EAChB,iBAAiB,EACjB,mBAAmB,EACnB,KAAK,gBAAgB,EACrB,KAAK,iBAAiB,EACtB,KAAK,gBAAgB,EACrB,KAAK,SAAS,EACd,KAAK,gBAAgB,GACtB,MAAM,iBAAiB,CAAC;AACzB,OAAO,EACL,yBAAyB,EACzB,iBAAiB,EACjB,KAAK,6BAA6B,EAClC,KAAK,qBAAqB,GAC3B,MAAM,aAAa,CAAC;AACrB,OAAO,EACL,gBAAgB,EAChB,sBAAsB,EACtB,yBAAyB,EACzB,eAAe,EACf,0BAA0B,EAC1B,KAAK,0BAA0B,EAC/B,KAAK,kBAAkB,EACvB,KAAK,iBAAiB,EACtB,KAAK,wBAAwB,EAC7B,KAAK,eAAe,GACrB,MAAM,aAAa,CAAC;AACrB,OAAO,EACL,gBAAgB,EAChB,oBAAoB,EACpB,oBAAoB,EACpB,qBAAqB,EACrB,eAAe,EACf,gBAAgB,EAChB,iBAAiB,EACjB,eAAe,EACf,eAAe,EACf,KAAK,gBAAgB,EACrB,KAAK,cAAc,EACnB,KAAK,gBAAgB,EACrB,KAAK,aAAa,EAClB,KAAK,YAAY,EACjB,KAAK,aAAa,EAClB,KAAK,kBAAkB,EACvB,KAAK,aAAa,GACnB,MAAM,yBAAyB,CAAC;AACjC,OAAO,EACL,cAAc,EACd,gBAAgB,EAChB,KAAK,oBAAoB,EACzB,KAAK,aAAa,EAClB,KAAK,cAAc,GACpB,MAAM,gBAAgB,CAAC;AACxB,OAAO,EACL,yBAAyB,EACzB,mBAAmB,EACnB,0BAA0B,EAC1B,6BAA6B,EAC7B,KAAK,yBAAyB,GAC/B,MAAM,mBAAmB,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AACH,OAAO,EACL,iBAAiB,EACjB,YAAY,EACZ,eAAe,EACf,YAAY,EACZ,YAAY,EACZ,4BAA4B,EAC5B,kBAAkB,EAClB,iBAAiB,EACjB,oBAAoB,EACpB,SAAS,EACT,KAAK,oBAAoB,GAC1B,MAAM,eAAe,CAAC;AAMvB,OAAO,EACL,YAAY,EACZ,qBAAqB,EACrB,eAAe,EACf,kBAAkB,EAClB,aAAa,EACb,oBAAoB,EACpB,oBAAoB,EACpB,KAAK,mBAAmB,EACxB,KAAK,oBAAoB,EACzB,KAAK,oBAAoB,GAC1B,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EACL,gBAAgB,EAChB,iBAAiB,EACjB,mBAAmB,EACnB,KAAK,gBAAgB,EACrB,KAAK,iBAAiB,EACtB,KAAK,gBAAgB,EACrB,KAAK,SAAS,EACd,KAAK,gBAAgB,GACtB,MAAM,iBAAiB,CAAC;AACzB,OAAO,EACL,yBAAyB,EACzB,iBAAiB,EACjB,KAAK,6BAA6B,EAClC,KAAK,qBAAqB,GAC3B,MAAM,aAAa,CAAC;AACrB,OAAO,EACL,gBAAgB,EAChB,sBAAsB,EACtB,yBAAyB,EACzB,eAAe,EACf,0BAA0B,EAC1B,wBAAwB,EACxB,KAAK,0BAA0B,EAC/B,KAAK,kBAAkB,EACvB,KAAK,iBAAiB,EACtB,KAAK,wBAAwB,EAC7B,KAAK,eAAe,GACrB,MAAM,aAAa,CAAC;AACrB,OAAO,EACL,gBAAgB,EAChB,oBAAoB,EACpB,oBAAoB,EACpB,qBAAqB,EACrB,eAAe,EACf,gBAAgB,EAChB,iBAAiB,EACjB,eAAe,EACf,eAAe,EACf,KAAK,gBAAgB,EACrB,KAAK,cAAc,EACnB,KAAK,gBAAgB,EACrB,KAAK,aAAa,EAClB,KAAK,YAAY,EACjB,KAAK,aAAa,EAClB,KAAK,kBAAkB,EACvB,KAAK,aAAa,GACnB,MAAM,yBAAyB,CAAC;AACjC,OAAO,EACL,cAAc,EACd,gBAAgB,EAChB,KAAK,oBAAoB,EACzB,KAAK,aAAa,EAClB,KAAK,cAAc,GACpB,MAAM,gBAAgB,CAAC;AACxB,OAAO,EACL,yBAAyB,EACzB,mBAAmB,EACnB,0BAA0B,EAC1B,6BAA6B,EAC7B,KAAK,yBAAyB,GAC/B,MAAM,mBAAmB,CAAC"}

package/dist/index.js

@@ -3,11 +3,16 @@
  * narrowing, ui:// locator rehydration, sandbox-trust channels. See README +
  * the conformance map (guuey#123).
  */
-export { asResourcePayload, asUiResource, blockUiResource, isJsonObject, resourceHtml, scanProviderRawForUiResource, snapshotUiResource, toolResultUiResource, uiLocator, } from "./block-ui.js";
+export { asResourcePayload, asUiResource, blockUiResource, isJsonObject, resourceHtml, scanProviderRawForUiResource, snapshotUiResource, toolResultLocator, toolResultUiResource, uiLocator, } from "./block-ui.js";
+// The retired ggui vendor arm (guuey#209, 2026-08-16). Every symbol below
+// is `@deprecated` and stays exported for ONE MINOR under the post-launch
+// compat rule — removed in the minor after the one shipping this notice.
+// Nothing in this package calls them; `toolResultViewMount` hands a ggui
+// render back as a locator, and the reader assigns the "ggui" channel.
 export { asGguiRender, asGguiRenderBootstrap, blockGguiRender, gguiRenderResource, gguiShellHtml, toolResultGguiRender, GGUI_RENDER_META_KEY, } from "./ggui-render.js";
 export { resolveViewMount, snapshotViewMount, toolResultViewMount, } from "./card-mount.js";
 export { createMcpUiResourceReader, uiResourceChannel, } from "./reader.js";
-export { asToolCallResult, createMcpUiActionRelay, unavailableToolCallResult, UI_ACTION_TOOLS, UI_ACTION_UNAVAILABLE_TEXT, } from "./action.js";
+export { asToolCallResult, createMcpUiActionRelay, unavailableToolCallResult, UI_ACTION_TOOLS, UI_ACTION_UNAVAILABLE_TEXT, UI_SEMANTIC_ACTION_TOOLS, } from "./action.js";
 export { initializeResult, initialViewHostState, resourceReadResponse, RESOURCES_READ_METHOD, teardownMessage, toolCallResponse, TOOLS_CALL_METHOD, viewHostElapsed, viewHostReceive, } from "./view-host-protocol.js";
 export { attachViewHost, viewDocumentHtml, } from "./view-host.js";
 export { attachSandboxPageDelivery, isSandboxProxyReady, SANDBOX_PROXY_READY_METHOD, SANDBOX_RESOURCE_READY_METHOD, } from "./sandbox-page.js";

package/dist/narrowing.d.ts

@@ -5,5 +5,5 @@
  * graph through the barrel (which re-exports the ggui render arm until its
  * retirement — conformance-map step 4).
  */
-export { asResourcePayload, asUiResource, blockUiResource, isJsonObject, resourceHtml, scanProviderRawForUiResource, snapshotUiResource, toolResultUiResource, uiLocator, type McpUiResourcePayload, } from "./block-ui.js";
+export { asResourcePayload, asUiResource, blockUiResource, isJsonObject, resourceHtml, scanProviderRawForUiResource, snapshotUiResource, toolResultLocator, toolResultUiResource, uiLocator, type McpUiResourcePayload, } from "./block-ui.js";
 //# sourceMappingURL=narrowing.d.ts.map

package/dist/narrowing.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"narrowing.d.ts","sourceRoot":"","sources":["../src/narrowing.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AACH,OAAO,EACL,iBAAiB,EACjB,YAAY,EACZ,eAAe,EACf,YAAY,EACZ,YAAY,EACZ,4BAA4B,EAC5B,kBAAkB,EAClB,oBAAoB,EACpB,SAAS,EACT,KAAK,oBAAoB,GAC1B,MAAM,eAAe,CAAC"}
+{"version":3,"file":"narrowing.d.ts","sourceRoot":"","sources":["../src/narrowing.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AACH,OAAO,EACL,iBAAiB,EACjB,YAAY,EACZ,eAAe,EACf,YAAY,EACZ,YAAY,EACZ,4BAA4B,EAC5B,kBAAkB,EAClB,iBAAiB,EACjB,oBAAoB,EACpB,SAAS,EACT,KAAK,oBAAoB,GAC1B,MAAM,eAAe,CAAC"}

package/dist/narrowing.js

@@ -5,4 +5,4 @@
  * graph through the barrel (which re-exports the ggui render arm until its
  * retirement — conformance-map step 4).
  */
-export { asResourcePayload, asUiResource, blockUiResource, isJsonObject, resourceHtml, scanProviderRawForUiResource, snapshotUiResource, toolResultUiResource, uiLocator, } from "./block-ui.js";
+export { asResourcePayload, asUiResource, blockUiResource, isJsonObject, resourceHtml, scanProviderRawForUiResource, snapshotUiResource, toolResultLocator, toolResultUiResource, uiLocator, } from "./block-ui.js";

package/dist/view-host-protocol.d.ts

@@ -27,8 +27,9 @@
  * Types and method names come from `@modelcontextprotocol/ext-apps` — the
  * SEP-1865 surface itself, someone else's frozen contract. Zero ggui
  * imports, deliberately (guuey#123): this host answers ANY spec-following
- * view; everything ggui-specific stays in `ggui-render.ts` behind ggui's
- * own published protocol package.
+ * view. (The ggui vendor arm that used to live beside it in
+ * `ggui-render.ts` retired 2026-08-16 — guuey#209; that module is now
+ * deprecated re-exports only.)
  */
 import { type McpUiHostCapabilities, type McpUiHostContext, type McpUiInitializeResult } from "@modelcontextprotocol/ext-apps";
 import type { McpToolStructuredContent } from "./action.js";

package/dist/view-host-protocol.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"view-host-protocol.d.ts","sourceRoot":"","sources":["../src/view-host-protocol.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+BG;AACH,OAAO,EAKL,KAAK,qBAAqB,EAC1B,KAAK,gBAAgB,EACrB,KAAK,qBAAqB,EAC3B,MAAM,gCAAgC,CAAC;AACxC,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,aAAa,CAAC;AAC5D,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,aAAa,CAAC;AAEzD;;;;GAIG;AACH,MAAM,WAAW,YAAY;IAC3B,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,MAAM,CAAC;CACjB;AAKD,uEAAuE;AACvE,eAAO,MAAM,iBAAiB,eAAe,CAAC;AAE9C;;;;;;;GAOG;AACH,eAAO,MAAM,qBAAqB,mBAAmB,CAAC;AAStD,2CAA2C;AAC3C,MAAM,MAAM,aAAa,GAAG,MAAM,GAAG,MAAM,CAAC;AAE5C,wDAAwD;AACxD,MAAM,WAAW,gBAAgB;IAC/B,OAAO,EAAE,KAAK,CAAC;IACf,EAAE,CAAC,EAAE,aAAa,CAAC;IACnB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,MAAM,CAAC,EAAE;QAAE,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAA;KAAE,CAAC;IACpC,MAAM,CAAC,EAAE;QAAE,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAA;KAAE,CAAC;IACpC,KAAK,CAAC,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,CAAA;KAAE,CAAC;CAC3C;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,MAAM,aAAa,GAAG,aAAa,GAAG,WAAW,GAAG,cAAc,CAAC;AAEzE,iFAAiF;AACjF,MAAM,WAAW,aAAa;IAC5B,KAAK,EAAE,aAAa,CAAC;IACrB,0EAA0E;IAC1E,eAAe,EAAE,OAAO,CAAC;CAC1B;AAED,wBAAgB,oBAAoB,IAAI,aAAa,CAEpD;AAED;;;GAGG;AACH,MAAM,MAAM,cAAc,GACtB;IAAE,IAAI,EAAE,SAAS,CAAC;IAAC,OAAO,EAAE,gBAAgB,CAAA;CAAE,GAC9C;IACE;;;;;;OAMG;IACH,IAAI,EAAE,iBAAiB,CAAC;IACxB,EAAE,EAAE,aAAa,CAAC;IAClB,IAAI,EAAE,MAAM,CAAC;IACb,SAAS,CAAC,EAAE,wBAAwB,CAAC;CACtC,GACD;IACE;;;;;;;OAOG;IACH,IAAI,EAAE,qBAAqB,CAAC;IAC5B,EAAE,EAAE,aAAa,CAAC;IAClB,GAAG,EAAE,MAAM,CAAC;CACb,GACD;IACE;;;;;;;;OAQG;IACH,IAAI,EAAE,cAAc,CAAC;IACrB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB,CAAC;AAEN;;;GAGG;AACH,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,EAAE,YAAY,CAAC;IACvB;;;;;;;OAOG;IACH,gBAAgB,EAAE,qBAAqB,CAAC;IACxC,+DAA+D;IAC/D,WAAW,EAAE,gBAAgB,CAAC;IAC9B,uEAAuE;IACvE,SAAS,EAAE,OAAO,CAAC;IACnB,2EAA2E;IAC3E,aAAa,EAAE,OAAO,CAAC;CACxB;AAED,+EAA+E;AAC/E,MAAM,WAAW,kBAAkB;IACjC,KAAK,EAAE,aAAa,CAAC;IACrB,OAAO,EAAE,cAAc,EAAE,CAAC;CAC3B;AAiCD,iFAAiF;AACjF,wBAAgB,gBAAgB,CAC9B,QAAQ,EAAE,gBAAgB,EAC1B,wBAAwB,EAAE,OAAO,GAChC,qBAAqB,CAcvB;AAED,8EAA8E;AAC9E,wBAAgB,gBAAgB,CAC9B,EAAE,EAAE,aAAa,EACjB,MAAM,EAAE;IAAE,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAA;CAAE,GACjC,gBAAgB,CAElB;AAED;;;;;GAKG;AACH,wBAAgB,oBAAoB,CAClC,EAAE,EAAE,aAAa,EACjB,KAAK,EAAE,qBAAqB,GAAG,SAAS,GACvC,gBAAgB,CASlB;AAED;;;;;GAKG;AACH,wBAAgB,eAAe,IAAI,gBAAgB,CAElD;AAED;;;;;;;;;;;;GAYG;AACH,wBAAgB,eAAe,CAC7B,KAAK,EAAE,aAAa,EACpB,QAAQ,EAAE,gBAAgB,EAC1B,IAAI,EAAE,OAAO,GACZ,kBAAkB,CAuFpB;AAED;;;;GAIG;AACH,wBAAgB,eAAe,CAAC,KAAK,EAAE,aAAa,GAAG,aAAa,CAEnE"}
+{"version":3,"file":"view-host-protocol.d.ts","sourceRoot":"","sources":["../src/view-host-protocol.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgCG;AACH,OAAO,EAKL,KAAK,qBAAqB,EAC1B,KAAK,gBAAgB,EACrB,KAAK,qBAAqB,EAC3B,MAAM,gCAAgC,CAAC;AACxC,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,aAAa,CAAC;AAC5D,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,aAAa,CAAC;AAEzD;;;;GAIG;AACH,MAAM,WAAW,YAAY;IAC3B,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,MAAM,CAAC;CACjB;AAKD,uEAAuE;AACvE,eAAO,MAAM,iBAAiB,eAAe,CAAC;AAE9C;;;;;;;GAOG;AACH,eAAO,MAAM,qBAAqB,mBAAmB,CAAC;AAStD,2CAA2C;AAC3C,MAAM,MAAM,aAAa,GAAG,MAAM,GAAG,MAAM,CAAC;AAE5C,wDAAwD;AACxD,MAAM,WAAW,gBAAgB;IAC/B,OAAO,EAAE,KAAK,CAAC;IACf,EAAE,CAAC,EAAE,aAAa,CAAC;IACnB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,MAAM,CAAC,EAAE;QAAE,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAA;KAAE,CAAC;IACpC,MAAM,CAAC,EAAE;QAAE,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAA;KAAE,CAAC;IACpC,KAAK,CAAC,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,CAAA;KAAE,CAAC;CAC3C;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,MAAM,aAAa,GAAG,aAAa,GAAG,WAAW,GAAG,cAAc,CAAC;AAEzE,iFAAiF;AACjF,MAAM,WAAW,aAAa;IAC5B,KAAK,EAAE,aAAa,CAAC;IACrB,0EAA0E;IAC1E,eAAe,EAAE,OAAO,CAAC;CAC1B;AAED,wBAAgB,oBAAoB,IAAI,aAAa,CAEpD;AAED;;;GAGG;AACH,MAAM,MAAM,cAAc,GACtB;IAAE,IAAI,EAAE,SAAS,CAAC;IAAC,OAAO,EAAE,gBAAgB,CAAA;CAAE,GAC9C;IACE;;;;;;OAMG;IACH,IAAI,EAAE,iBAAiB,CAAC;IACxB,EAAE,EAAE,aAAa,CAAC;IAClB,IAAI,EAAE,MAAM,CAAC;IACb,SAAS,CAAC,EAAE,wBAAwB,CAAC;CACtC,GACD;IACE;;;;;;;OAOG;IACH,IAAI,EAAE,qBAAqB,CAAC;IAC5B,EAAE,EAAE,aAAa,CAAC;IAClB,GAAG,EAAE,MAAM,CAAC;CACb,GACD;IACE;;;;;;;;OAQG;IACH,IAAI,EAAE,cAAc,CAAC;IACrB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB,CAAC;AAEN;;;GAGG;AACH,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,EAAE,YAAY,CAAC;IACvB;;;;;;;OAOG;IACH,gBAAgB,EAAE,qBAAqB,CAAC;IACxC,+DAA+D;IAC/D,WAAW,EAAE,gBAAgB,CAAC;IAC9B,uEAAuE;IACvE,SAAS,EAAE,OAAO,CAAC;IACnB,2EAA2E;IAC3E,aAAa,EAAE,OAAO,CAAC;CACxB;AAED,+EAA+E;AAC/E,MAAM,WAAW,kBAAkB;IACjC,KAAK,EAAE,aAAa,CAAC;IACrB,OAAO,EAAE,cAAc,EAAE,CAAC;CAC3B;AAiCD,iFAAiF;AACjF,wBAAgB,gBAAgB,CAC9B,QAAQ,EAAE,gBAAgB,EAC1B,wBAAwB,EAAE,OAAO,GAChC,qBAAqB,CAcvB;AAED,8EAA8E;AAC9E,wBAAgB,gBAAgB,CAC9B,EAAE,EAAE,aAAa,EACjB,MAAM,EAAE;IAAE,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAA;CAAE,GACjC,gBAAgB,CAElB;AAED;;;;;GAKG;AACH,wBAAgB,oBAAoB,CAClC,EAAE,EAAE,aAAa,EACjB,KAAK,EAAE,qBAAqB,GAAG,SAAS,GACvC,gBAAgB,CASlB;AAED;;;;;GAKG;AACH,wBAAgB,eAAe,IAAI,gBAAgB,CAElD;AAED;;;;;;;;;;;;GAYG;AACH,wBAAgB,eAAe,CAC7B,KAAK,EAAE,aAAa,EACpB,QAAQ,EAAE,gBAAgB,EAC1B,IAAI,EAAE,OAAO,GACZ,kBAAkB,CAuFpB;AAED;;;;GAIG;AACH,wBAAgB,eAAe,CAAC,KAAK,EAAE,aAAa,GAAG,aAAa,CAEnE"}

package/dist/view-host-protocol.js

@@ -27,8 +27,9 @@
  * Types and method names come from `@modelcontextprotocol/ext-apps` — the
  * SEP-1865 surface itself, someone else's frozen contract. Zero ggui
  * imports, deliberately (guuey#123): this host answers ANY spec-following
- * view; everything ggui-specific stays in `ggui-render.ts` behind ggui's
- * own published protocol package.
+ * view. (The ggui vendor arm that used to live beside it in
+ * `ggui-render.ts` retired 2026-08-16 — guuey#209; that module is now
+ * deprecated re-exports only.)
  */
 import { INITIALIZE_METHOD, LATEST_PROTOCOL_VERSION, RESOURCE_TEARDOWN_METHOD, SIZE_CHANGED_METHOD, } from "@modelcontextprotocol/ext-apps";
 /** JSON-RPC `method not found` — the spec's code, not an invented one. */

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@guuey/mcp-apps-host",
-  "version": "0.6.0",
+  "version": "0.7.0",
   "description": "The MCP Apps (SEP-1865) Host role for guuey's chat surfaces — view-mount narrowing across UI channels, ui:// locator rehydration by resources/read, and the sandbox-trust channel contract. Vendor-neutral: any spec-following MCP App mounts through it.",
   "license": "MIT",
   "type": "module",

package/src/action.ts

@@ -47,11 +47,39 @@ export type McpToolCallResult = {
 };
 
 /**
- * The runtime-action tools a card sandbox may relay — the client-side twin
- * of the server allowlist (defense in depth: the proxy enforces it again).
+ * The runtime tools a card sandbox may RELAY over `tools/call` — the
+ * client-side twin of the server allowlist (defense in depth: the proxy
+ * enforces it again). Exactly ggui's iframe-runtime surface, all declared
+ * `_meta.ui.visibility: ['app']` (never model-callable):
+ *
+ *  - `ggui_runtime_submit_action` — the user's gesture (the SEMANTIC one);
+ *  - `ggui_runtime_refresh_ws_token` — live-channel credential refresh
+ *    (the wsToken TTL is 180 s; without the relay a view on SSE/polling
+ *    dies at that mark — guuey#220);
+ *  - `ggui_runtime_pull` — the host-relayed polling rung where the
+ *    sandbox's own transports are blocked (bridge-pull, terminal rung).
+ *
+ * Two of these are transport plumbing whose arguments are opaque runtime
+ * state — see {@link UI_SEMANTIC_ACTION_TOOLS} for the ONLY set a host may
+ * treat as "the user did something".
  */
 export const UI_ACTION_TOOLS: ReadonlySet<string> = new Set([
   "ggui_runtime_submit_action",
+  "ggui_runtime_refresh_ws_token",
+  "ggui_runtime_pull",
+]);
+
+/**
+ * The strict subset of {@link UI_ACTION_TOOLS} that carries a USER gesture —
+ * the only calls a host may project into user-facing affordances (composer
+ * staging, "the user selected X" copy, telemetry as intent). Every other
+ * relayed tool is runtime plumbing whose payload must NEVER reach the user
+ * verbatim (guuey#215/#218: a staged `sessionId …` was exactly that leak).
+ * A tool that is relayable is NOT thereby semantic; a host that widens
+ * this set is asserting the wire semantics of the new name.
+ */
+export const UI_SEMANTIC_ACTION_TOOLS: ReadonlySet<string> = new Set([
+  "ggui_runtime_submit_action",
 ]);
 
 /** The in-band answer for anything the relay cannot (or will not) do. */

package/src/block-ui.ts

@@ -175,6 +175,27 @@ export function uiLocator(uiData: JsonValue | undefined): string | undefined {
   return typeof uri === "string" && uri.startsWith("ui://") ? uri : undefined;
 }
 
+/**
+ * The `ui://` locator a `tool-result` block carries, from EITHER channel it
+ * can arrive on — the single seam every locator reader goes through.
+ *
+ * AgJSON §2.1 routes a tool result's `structuredContent` by its `_meta.ui`
+ * sibling: WITH the sibling it is surface data and the normalizer stamps
+ * `uiData`; WITHOUT it, it is model-channel data and lands in
+ * `structuredContent`. A producer that withholds `_meta` (ggui's non-prod
+ * posture; any plain-locator MCP server) therefore delivers a locator that
+ * is byte-identical in shape but lives one field over — reading `uiData`
+ * alone renders NOTHING for it (dark, not "expired"), and the persistence
+ * projector minted no placeholder row (the read plane 404s). `uiData` wins
+ * when both carry one (guuey#209 route-A finding).
+ */
+export function toolResultLocator(block: {
+  uiData?: JsonValue;
+  structuredContent?: JsonValue;
+}): string | undefined {
+  return uiLocator(block.uiData) ?? uiLocator(block.structuredContent);
+}
+
 export function snapshotUiResource(cardSnapshot: JsonValue): McpUiResourcePayload | undefined {
   if (!isJsonObject(cardSnapshot)) return undefined;
   const parts = cardSnapshot.parts;

package/src/card-mount.ts

@@ -1,52 +1,54 @@
 /**
  * The card-mount dispatcher: ONE narrowing that answers "what, if anything,
- * does this block mount?" across BOTH generative-UI channels a guuey pod
- * emits.
+ * does this block mount?" for every generative-UI shape a guuey pod emits.
  *
  *   1. **inline mcp-ui resource** — `{uri, text|blob}` on `uiData`, or a
  *      `ui://` resource degraded into a `provider-raw` content part. Handled
  *      verbatim by `block-ui.ts`; this module does not touch that path, it
  *      only tries it FIRST.
- *   2. **ggui render** — `uiData.resourceUri` + the `_meta["ai.ggui/render"]`
- *      bootstrap, mounted through ggui's self-contained shell. See
- *      `ggui-render.ts`.
+ *   2. **`ui://` locator** — the durable identity of a view produced by ANY
+ *      MCP server (ggui's `ggui_render` included), on `uiData.resourceUri`
+ *      when the producer sent `_meta.ui` (AgJSON §2.1 surface routing) or on
+ *      `structuredContent.resourceUri` when it did not. The host resolves it
+ *      by a fresh, authenticated `resources/read` of the uri
+ *      ({@link UiResourceReader}) — the spec-consistent template fetch, on
+ *      the live turn (pod door) and on rehydration (persisted door) alike.
  *
- * Both channels land on the SAME `McpUiResourcePayload`, which is the whole
- * point: a host that already mounts inline resources through
- * `@mcp-ui/client`'s `AppRenderer` in a second-origin sandbox gains ggui cards
- * without a second mount mechanism, a second iframe contract, or a second
- * security posture to review.
+ * ## The ggui vendor arm is retired (guuey#209, 2026-08-16)
  *
- * Precedence is inline-first and deliberate: an inline resource is the
- * server's explicit, self-sufficient HTML. A ggui render only ever wins when
- * there is no inline resource to prefer, so this dispatcher can never change
- * what an existing inline card renders.
+ * This dispatcher used to carry a THIRD arm: when a `tool-result` carried the
+ * `_meta["ai.ggui/render"]` bootstrap it built ggui's self-contained shell
+ * inline and mounted it without a read — a fast path that existed only
+ * because the pod holds the MCP connection and a live locator had no host-
+ * side read channel. That precondition is gone: the pod door
+ * (`GET <pod>/agent/ui-resource`) answers live-turn locators, the persisted
+ * door answers rehydration, and ggui's `resources/read` mints the live-
+ * channel material FRESH at read time — strictly fresher than any inlined
+ * bootstrap. A ggui render is therefore just another locator producer; live
+ * == rehydrated == spec. The arm's narrowing helpers stay exported one
+ * minor as `@deprecated` (`ggui-render.ts`); nothing here consumes them.
  *
  * ## Why the CHANNEL is returned alongside the resource
  *
- * The payload alone cannot say where it came from — a ggui shell is a string
+ * The payload alone cannot say where it came from — ggui's shell is a string
  * of HTML like any other. But a host has one decision that genuinely depends
  * on the origin of that HTML: WHICH sandbox host page to mount it in. A ggui
  * shell must load ggui's runtime bundle and open its WSS, so it needs a page
  * whose CSP names the ggui origins; an inline card is arbitrary tenant HTML
- * and must keep the self-only page it has always had. Handing back the channel
- * keeps that one narrowing in one place — the alternative was for every host
- * to re-run `toolResultGguiRender` beside this call and ask again.
+ * and must keep the self-only page it has always had. Since the flip the
+ * channel is assigned at RESOLUTION time from the requested locator uri
+ * (`uiResourceChannel` in `reader.ts` — `ui://ggui/…` → `"ggui"`), never
+ * from the response and never from mount material a producer inlined.
  */
-import { snapshotUiResource, toolResultUiResource, uiLocator, type McpUiResourcePayload } from "./block-ui.js";
-import { GGUI_RENDER_META_KEY, gguiRenderResource, toolResultGguiRender } from "./ggui-render.js";
+import { snapshotUiResource, toolResultLocator, toolResultUiResource, type McpUiResourcePayload } from "./block-ui.js";
 import type { AgBlock, JsonValue } from "@silverprotocol/core";
 
-
-/** Does the block's `_meta` carry the ggui render key at all (valid or not)? */
-function blockCarriesGguiMetaKey(block: Extract<AgBlock, { type: "tool-result" }>): boolean {
-  const meta = block._meta;
-  return (
-    typeof meta === "object" && meta !== null && !Array.isArray(meta) && GGUI_RENDER_META_KEY in meta
-  );
-}
-
-/** Which generative-UI channel produced a mount. See this module's header. */
+/**
+ * Which sandbox-trust channel a mount rides. See this module's header.
+ * `"ggui"` is assigned at RESOLUTION time from the requested locator uri
+ * (`uiResourceChannel`) — a `toolResultViewMount` result is only ever
+ * `"inline"` or `"locator"`.
+ */
 export type ViewMountChannel = "inline" | "ggui" | "locator";
 
 /**
@@ -56,7 +58,9 @@ export type ViewMountChannel = "inline" | "ggui" | "locator";
  * `"ggui"` — a shell that boots the ggui runtime from a platform-pinned
  * origin, and therefore needs a host page whose CSP allows that origin.
  * `"locator"` — no mount material in hand, only the durable `ui://`
- * identity (guuey#122): the host resolves it with a fresh, authenticated
+ * identity (guuey#122) — read from `uiData` OR, for a producer that
+ * withheld `_meta` (AgJSON §2.1 then routes it to `structuredContent`),
+ * from `structuredContent` (guuey#209): the host resolves it with a fresh, authenticated
  * `resources/read` of the uri ({@link UiResourceReader}) — the spec-consistent
  * template fetch, vendor-neutral. (The spec defers persistence/restoration
  * itself; a full remount additionally owes the View `ui/notifications/tool-input`
@@ -69,6 +73,8 @@ export type ViewMount = ResolvedViewMount | LocatorViewMount;
  * A view with mount material in hand — the arms a host can render directly,
  * and the ONLY arms a `UiResourceReader` resolves (guuey#127): a read either
  * yields mount material or the honest placeholder, never another locator.
+ * `"ggui"` here always comes from a reader (`uiResourceChannel` on the
+ * requested uri) — no dispatcher in this module produces it.
  */
 export interface ResolvedViewMount {
   channel: "inline" | "ggui";
@@ -79,7 +85,7 @@ export interface ResolvedViewMount {
 /** The durable-identity arm: no mount material, only the uri to re-fetch. */
 export interface LocatorViewMount {
   channel: "locator";
-  /** The persisted `uiData.resourceUri` (`ui://` scheme) to re-fetch. */
+  /** The durable `ui://` locator to re-fetch (`uiData.resourceUri`, else `structuredContent.resourceUri`). */
   resourceUri: string;
 }
 
@@ -95,41 +101,33 @@ export interface LocatorViewMount {
 export type UiResourceReader = (resourceUri: string) => Promise<ViewMount | undefined>;
 
 /**
- * A live `tool-result` block → the card to mount, across both channels.
- * `undefined` when the block carries no generative UI at all (or carries a
- * ggui render whose bootstrap did not reach us — see `ggui-render.ts`).
+ * A live `tool-result` block → the card to mount: an inline resource, else the
+ * `ui://` locator (either channel — see `toolResultLocator`), else `undefined`
+ * when the block carries no generative UI at all.
+ *
+ * A locator on a LIVE turn resolves through the pod door (its live-card
+ * ledger registers the locator the moment the result streams — guuey#209
+ * C1/C5); the same locator persisted resolves through the platform door.
+ * One authority per lifecycle phase, one dispatcher for both.
  */
 export function toolResultViewMount(
   block: Extract<AgBlock, { type: "tool-result" }>,
 ): ViewMount | undefined {
   const inline = toolResultUiResource(block);
   if (inline) return { resource: inline, channel: "inline" };
-  const ggui = toolResultGguiRender(block);
-  const resource = ggui ? gguiRenderResource(ggui) : undefined;
-  if (resource) return { resource, channel: "ggui" };
-  // A live locator whose mount material didn't reach us (a fold that
-  // dropped `_meta`): re-fetch works on live turns too — the resource is
-  // freshly minted (guuey#122). One diagnostic when `_meta` DID carry the
-  // vendor key but failed validation — a producer bug would otherwise be
-  // indistinguishable from a meta-less fold (blank UI, zero errors).
-  if (ggui && !ggui.bootstrap && blockCarriesGguiMetaKey(block)) {
-    console.warn(
-      `mcp-apps-host: tool result ${block.toolCallId} carries a malformed ggui render bootstrap — degrading to the locator channel`,
-    );
-  }
-  const locator = uiLocator(block.uiData);
+  const locator = toolResultLocator(block);
   return locator !== undefined ? { channel: "locator", resourceUri: locator } : undefined;
 }
 
 /**
  * A persisted `HistoryCard`'s `cardSnapshot` → the card to mount.
  *
- * There is deliberately NO bootstrap arm here (guuey#122): persistence
- * strips tool-result `_meta` (see `@guuey/threads`' fold-rows), and a
- * foreign snapshot that still carries one holds an expired `wsToken` — a
- * dead mount. A persisted `ui://` locator resolves to the `"locator"`
- * channel instead: rehydration is a fresh `resources/read` of the uri,
- * the spec-consistent template fetch, vendor-neutral.
+ * Same two arms as the live dispatcher (since guuey#209 there is no third):
+ * an inline resource, else the `ui://` locator. Persistence strips
+ * tool-result `_meta` (see `@guuey/threads`' fold-rows), and a foreign
+ * snapshot that still carries a stale bootstrap is ignored — its `wsToken`
+ * expired minutes after the render. Rehydration is a fresh `resources/read`
+ * of the uri, the spec-consistent template fetch, vendor-neutral.
  */
 export function snapshotViewMount(cardSnapshot: JsonValue): ViewMount | undefined {
   const inline = snapshotUiResource(cardSnapshot);
@@ -137,7 +135,7 @@ export function snapshotViewMount(cardSnapshot: JsonValue): ViewMount | undefine
   for (const block of snapshotBlocks(cardSnapshot)) {
     if (typeof block !== "object" || block === null || Array.isArray(block)) continue;
     if (block.type !== "tool-result") continue;
-    const locator = uiLocator(block.uiData);
+    const locator = toolResultLocator(block);
     if (locator !== undefined) return { channel: "locator", resourceUri: locator };
   }
   return undefined;

package/src/ggui-render.ts

@@ -1,49 +1,42 @@
 /**
- * The **ggui render** channel: narrowing + self-contained shell construction
- * for a generative-UI card produced by the ggui MCP server (`ggui_render`).
+ * @deprecated — the ggui vendor arm is RETIRED (guuey#209, 2026-08-16).
  *
- * ## Where the pieces live (guuey#108 / ggui#427)
+ * Everything in this module is kept exported for ONE MINOR under the
+ * post-launch compatibility rule and is removed in the minor after the one
+ * that ships this notice. Nothing in `@guuey/mcp-apps-host` calls it any
+ * more: `toolResultViewMount` hands a ggui render back as a `ui://`
+ * **locator** (`toolResultLocator`, either channel), the mount material
+ * comes from a `resources/read` through a `UiResourceReader` (pod door
+ * live, persisted door on rehydration), and the `"ggui"` sandbox-trust
+ * channel is assigned at resolution from the requested uri
+ * (`uiResourceChannel` in `reader.ts`). Migration per symbol:
  *
- * The two halves of this channel have different owners, and the module is
- * split along that line:
+ *  - {@link asGguiRender} / {@link toolResultGguiRender} /
+ *    {@link blockGguiRender} → `toolResultLocator(block)` — the locator is
+ *    the recognition signal; there is no descriptor to build.
+ *  - {@link gguiRenderResource} → resolve the locator through a reader
+ *    (`resolveViewMount(mount, reader)`); ggui's `resources/read` returns
+ *    the shell with live-channel material minted FRESH at read time.
+ *  - {@link GGUI_RENDER_META_KEY} → the wire key is ggui's; import
+ *    `MCP_APP_AI_GGUI_RENDER_META_KEY` from
+ *    `@ggui-ai/protocol/integrations/mcp-apps` if you still inspect
+ *    `_meta` (nothing here does).
+ *  - {@link asGguiRenderBootstrap} / {@link gguiShellHtml} and their types
+ *    are pure re-exports of ggui's protocol package — import them from
+ *    `@ggui-ai/protocol/integrations/mcp-apps` directly.
  *
- *  - **ggui's wire contract** — what makes a `_meta` slice a mountable
- *    render bootstrap, and what the self-contained shell must contain — is
- *    OWNED by ggui and imported from
- *    `@ggui-ai/protocol/integrations/mcp-apps` ({@link asGguiRenderBootstrap},
- *    {@link gguiShellHtml}, the `ai.ggui/render` key). This package used to
- *    carry byte-compatible private copies (lifted upstream as ggui#427);
- *    re-exporting the originals means a shell-contract change lands here by
- *    bumping the pin, not by mirror-editing two repos.
- *  - **host/silverprotocol shapes** — the `uiData`-keyed RECOGNITION signal,
- *    the `AgBlock` tool-result narrowing, and the `McpUiResourcePayload`
- *    adapter onto the host's existing mcp-ui mount path — are guuey-side
- *    contracts and stay implemented here.
+ * ## Why the arm existed, for the record
  *
- * ## Why recognition and mounting are separate
- *
- * A ggui render's `tool.done` carries two distinct signals:
- *
- *  1. **`uiData.resourceUri` is the RECOGNITION signal.** It is the only part
- *     of the render's identity that survives `@silverprotocol/core`'s fold
- *     (the reducer copies `uiData` — and, as of `@silverprotocol/core`
- *     0.4.1 (workspace#9), `_meta` — onto the `tool-result` block).
- *  2. **`_meta["ai.ggui/render"]` is the MOUNT MATERIAL.** Everything needed
- *     to boot the card — which runtime bundle to load, which live-channel to
- *     open, which props to seed — lives there and nowhere else.
- *
- * The shell {@link gguiShellHtml} builds is a string of HTML, so the ggui
- * card rides the host's EXISTING mcp-ui mount path unchanged: it narrows to
- * the same `McpUiResourcePayload` an inline resource does, so
- * `@mcp-ui/client`'s `AppRenderer` posts it as `srcdoc` into the
- * second-origin `mcp-app-sandbox.html` page — same double-iframe rule, same
- * sandbox origin, same opaque inner frame. No second mount mechanism.
- *
- * NOT in scope here: rehydrating a ggui card from persisted history. The
- * bootstrap's `wsToken` expires minutes after the render, so a stored
- * bootstrap is dead on arrival — a history card resolves to the `locator`
- * channel (`card-mount.ts`, guuey#122) and remounts by a fresh
- * `resources/read`, never a bootstrap replay.
+ * A ggui render's `tool.done` used to carry two signals: `uiData.resourceUri`
+ * (recognition — the only part surviving the fold) and the
+ * `_meta["ai.ggui/render"]` bootstrap (mount material: runtime bundle,
+ * live channel, seeded props). Because guuey's chat client is not an MCP
+ * client (the pod holds the connection), a live locator had no host-side
+ * read channel, so the bootstrap was inlined as a read-skipping fast path
+ * and this module built ggui's self-contained shell from it. The pod door
+ * (`GET <pod>/agent/ui-resource`, guuey#209 C1) closed that gap; ggui's
+ * read-time mint (C2) made the read strictly fresher than the inlined
+ * copy; the vendor arm's only reason to exist was gone.
  */
 import type { AgBlock, JsonValue } from "@silverprotocol/core";
 import {
@@ -55,24 +48,37 @@ import {
 import { isJsonObject, type McpUiResourcePayload } from "./block-ui.js";
 
 export {
+  /** @deprecated import from `@ggui-ai/protocol/integrations/mcp-apps` (guuey#209; removed next minor). */
   asGguiRenderBootstrap,
+  /** @deprecated import from `@ggui-ai/protocol/integrations/mcp-apps` (guuey#209; removed next minor). */
   gguiShellHtml,
 } from "@ggui-ai/protocol/integrations/mcp-apps";
 export type {
+  /** @deprecated import from `@ggui-ai/protocol/integrations/mcp-apps` (guuey#209; removed next minor). */
   GguiRenderBootstrap,
+  /** @deprecated import from `@ggui-ai/protocol/integrations/mcp-apps` (guuey#209; removed next minor). */
   GguiShellHtmlOptions,
 } from "@ggui-ai/protocol/integrations/mcp-apps";
 
 /**
  * The `_meta` key the ggui render bootstrap rides on. Alias of the
  * protocol package's own constant — one spelling, owned upstream.
+ *
+ * @deprecated guuey#209 — nothing in this package reads `_meta` any more.
+ * Import `MCP_APP_AI_GGUI_RENDER_META_KEY` from
+ * `@ggui-ai/protocol/integrations/mcp-apps` if you still need the key.
+ * Removed in the minor after the one shipping this notice.
  */
 export const GGUI_RENDER_META_KEY = MCP_APP_AI_GGUI_RENDER_META_KEY;
 
 /** The `ui://` scheme prefix every ggui render resource uri carries. */
 const UI_SCHEME = "ui://";
 
-/** A ggui render recognised on a tool result: its resource uri + mount material. */
+/**
+ * A ggui render recognised on a tool result: its resource uri + mount material.
+ * @deprecated guuey#209 — the locator (`toolResultLocator`) is the whole
+ * recognition signal now; there is no descriptor to build. Removed next minor.
+ */
 export interface GguiRenderDescriptor {
   /** `uiData.resourceUri` — `ui://ggui/render/<sessionId>/<contractHash>`. */
   resourceUri: string;
@@ -93,6 +99,9 @@ export interface GguiRenderDescriptor {
  * The `ui://` scheme gate is deliberate: `uiData` is a general-purpose channel
  * (every `structuredContent` of a `_meta.ui`-stamped tool lands there), so a
  * bare `resourceUri` string is not on its own a claim of generative UI.
+ *
+ * @deprecated guuey#209 — use `toolResultLocator(block)`; the vendor arm is
+ * retired and nothing consumes the descriptor. Removed next minor.
  */
 export function asGguiRender(
   uiData: JsonValue | undefined,
@@ -116,6 +125,8 @@ export function asGguiRender(
  * same name that narrows a spec-canonical MCP `CallToolResult` instead. This
  * one is the silverprotocol-side twin — the input is the FOLDED block, whose
  * `uiData`/`_meta` carriage is `@silverprotocol/core`'s contract, not ggui's.
+ *
+ * @deprecated guuey#209 — use `toolResultLocator(block)`. Removed next minor.
  */
 export function toolResultGguiRender(
   block: Extract<AgBlock, { type: "tool-result" }>,
@@ -123,7 +134,11 @@ export function toolResultGguiRender(
   return asGguiRender(block.uiData, block._meta);
 }
 
-/** An untyped (persisted-snapshot) block → its ggui render descriptor, if it is one. */
+/**
+ * An untyped (persisted-snapshot) block → its ggui render descriptor, if it is one.
+ * @deprecated guuey#209 — use `snapshotViewMount(cardSnapshot)`, whose locator
+ * arm is the persisted path. Removed next minor.
+ */
 export function blockGguiRender(block: JsonValue): GguiRenderDescriptor | undefined {
   if (!isJsonObject(block)) return undefined;
   if (block.type !== "tool-result") return undefined;
@@ -135,6 +150,11 @@ export function blockGguiRender(block: JsonValue): GguiRenderDescriptor | undefi
  * mcp-ui path already knows how to mount, or `undefined` when the descriptor
  * carries no bootstrap (history cards, and any fold that dropped `_meta`).
  *
+ * @deprecated guuey#209 — resolve the locator through a `UiResourceReader`
+ * (`resolveViewMount`); ggui's `resources/read` returns the shell with
+ * live-channel material minted FRESH at read time, which this inlined
+ * copy could never be. Removed next minor.
+ *
  * The `uri` is the render's REAL `resourceUri` — the shell is the payload, not
  * a renaming of the resource.
  *

package/src/index.ts

@@ -11,10 +11,16 @@ export {
   resourceHtml,
   scanProviderRawForUiResource,
   snapshotUiResource,
+  toolResultLocator,
   toolResultUiResource,
   uiLocator,
   type McpUiResourcePayload,
 } from "./block-ui.js";
+// The retired ggui vendor arm (guuey#209, 2026-08-16). Every symbol below
+// is `@deprecated` and stays exported for ONE MINOR under the post-launch
+// compat rule — removed in the minor after the one shipping this notice.
+// Nothing in this package calls them; `toolResultViewMount` hands a ggui
+// render back as a locator, and the reader assigns the "ggui" channel.
 export {
   asGguiRender,
   asGguiRenderBootstrap,
@@ -49,6 +55,7 @@ export {
   unavailableToolCallResult,
   UI_ACTION_TOOLS,
   UI_ACTION_UNAVAILABLE_TEXT,
+  UI_SEMANTIC_ACTION_TOOLS,
   type CreateMcpUiActionRelayDeps,
   type McpToolCallContent,
   type McpToolCallResult,