@guuey/mcp-apps-host 0.7.1 → 0.8.0

package/src/view-host-protocol.ts

@@ -28,8 +28,8 @@
  * SEP-1865 surface itself, someone else's frozen contract. Zero ggui
  * imports, deliberately (guuey#123): this host answers ANY spec-following
  * view. (The ggui vendor arm that used to live beside it in
- * `ggui-render.ts` retired 2026-08-16 — guuey#209; that module is now
- * deprecated re-exports only.)
+ * `ggui-render.ts` retired 2026-08-16 — guuey#209; the module shipped one
+ * minor as deprecated re-exports and was deleted at 0.8.0.)
  */
 import {
   INITIALIZE_METHOD,
@@ -39,6 +39,7 @@ import {
   type McpUiHostCapabilities,
   type McpUiHostContext,
   type McpUiInitializeResult,
+  type McpUiResourceCsp,
 } from "@modelcontextprotocol/ext-apps";
 import type { McpToolStructuredContent } from "./action.js";
 import type { McpResourceReadResult } from "./reader.js";
@@ -398,3 +399,104 @@ export function viewHostReceive(
 export function viewHostElapsed(state: ViewHostState): ViewHostState {
   return state.phase === "negotiating" ? { ...state, phase: "no-handshake" } : state;
 }
+
+// ─── CSP diagnosis (guuey#235) ────────────────────────────────────────────
+
+/**
+ * The origins a view needs the EMBEDDER's page to allow — the spec's own
+ * per-resource CSP declaration (`McpUiResourceCsp`: `connectDomains` →
+ * `connect-src`, `resourceDomains` → `script-src`/`style-src`/…,
+ * `frameDomains` → `frame-src`). This is the honest filter for the CSP
+ * tripwire: a `securitypolicyviolation` whose `blockedURI` lands on one of
+ * these hosts is a violation ABOUT the view, not about anything else the
+ * page loads. Empty/absent → nothing to match, tripwire inert.
+ */
+export type ViewCspOrigins = McpUiResourceCsp;
+
+/**
+ * What the embedder can act on when its own CSP blocked the view: the
+ * URI the browser refused, the directive that refused it, and the entry
+ * that would allow it (the blocked URI's origin — the smallest allowance
+ * that fixes exactly this). Rides beside `"no-handshake"` — the phase
+ * stays honest ("it never negotiated"); this is WHY.
+ */
+export interface ViewCspDiagnosis {
+  blockedUri: string;
+  violatedDirective: string;
+  /** The origin to add under `violatedDirective` — e.g. `https://assets.mcp.example`. */
+  suggestedEntry: string;
+  /** Operator-facing sentence, ready to label. */
+  message: string;
+}
+
+/**
+ * The slice of a `SecurityPolicyViolationEvent` the tripwire reads —
+ * structural, so Node tests hand in plain objects (lib.dom's class is not
+ * constructible outside a browser).
+ */
+export interface CspViolationLike {
+  blockedURI: string;
+  /** e.g. `script-src-elem`, `connect-src`. */
+  violatedDirective: string;
+  /** The directive as the policy spelled it (`script-src` may govern `script-src-elem`). */
+  effectiveDirective?: string;
+}
+
+/** Every declared origin's HOST, wildcards (`https://*.x`) reduced to their suffix. */
+function declaredHosts(origins: ViewCspOrigins): { host: string; wildcard: boolean }[] {
+  const out: { host: string; wildcard: boolean }[] = [];
+  for (const list of [origins.connectDomains, origins.resourceDomains, origins.frameDomains]) {
+    for (const entry of list ?? []) {
+      // `https://*.example.com` → wildcard suffix `.example.com`
+      const wildcard = /^[a-z]+:\/\/\*\./i.exec(entry);
+      if (wildcard) {
+        out.push({ host: entry.slice(wildcard[0].length - 1).toLowerCase(), wildcard: true });
+        continue;
+      }
+      try {
+        out.push({ host: new URL(entry).hostname.toLowerCase(), wildcard: false });
+      } catch {
+        // A malformed declaration is producer-side wire data; it simply
+        // never matches. The tripwire only ever ADDS a diagnosis, never
+        // blocks, so there is nothing to guard.
+      }
+    }
+  }
+  return out;
+}
+
+/**
+ * Pure: is this violation ABOUT the view (its blocked URI lands on a
+ * declared origin), and if so, what should the embedder add?
+ *
+ * `blockedURI` is a full URL for network/script blocks; the browser sends
+ * bare tokens (`eval`, `inline`, `data`) for policy-class blocks — those
+ * carry no host and never match a declared origin, which is right: a
+ * `script-src eval` report is not the view's (see guuey#236 for the zod
+ * probe that produces exactly one such report at boot).
+ */
+export function diagnoseCspViolation(
+  violation: CspViolationLike,
+  origins: ViewCspOrigins | undefined,
+): ViewCspDiagnosis | undefined {
+  if (origins === undefined) return undefined;
+  let blocked: URL;
+  try {
+    blocked = new URL(violation.blockedURI);
+  } catch {
+    return undefined; // bare token (eval/inline/data/…) — not a host, not the view's
+  }
+  const host = blocked.hostname.toLowerCase();
+  const hit = declaredHosts(origins).some((d) =>
+    d.wildcard ? host.endsWith(d.host) : host === d.host,
+  );
+  if (!hit) return undefined;
+  const directive = violation.effectiveDirective || violation.violatedDirective;
+  const suggestedEntry = blocked.origin;
+  return {
+    blockedUri: violation.blockedURI,
+    violatedDirective: directive,
+    suggestedEntry,
+    message: `This page's Content-Security-Policy blocks ${violation.blockedURI} (${directive}) — the view cannot start. Add \`${directive} ${suggestedEntry}\` to the page's policy.`,
+  };
+}

package/src/view-host.ts

@@ -28,12 +28,16 @@
  * re-derived here against the pure machine + our own tests.
  */
 import {
+  diagnoseCspViolation,
   initialViewHostState,
   resourceReadResponse,
   teardownMessage,
   toolCallResponse,
   viewHostElapsed,
   viewHostReceive,
+  type CspViolationLike,
+  type ViewCspDiagnosis,
+  type ViewCspOrigins,
   type ViewHostBehavior,
   type ViewHostOutbound,
   type ViewHostPhase,
@@ -74,6 +78,16 @@ export interface ViewHostEvents {
   ): void;
 }
 
+/**
+ * Where CSP violations are observed — the EMBEDDING document (the frame's
+ * blocked loads report there, not inside the opaque frame). Structural like
+ * {@link ViewHostEvents}, injectable for tests. Default: `document`.
+ */
+export interface ViewCspEvents {
+  addEventListener(type: "securitypolicyviolation", listener: (event: CspViolationLike) => void): void;
+  removeEventListener(type: "securitypolicyviolation", listener: (event: CspViolationLike) => void): void;
+}
+
 export interface AttachViewHostConfig {
   /**
    * Capabilities to advertise in the initialize result. Default: `{}` —
@@ -130,6 +144,41 @@ export interface AttachViewHostConfig {
   onSizeChanged?: (size: { width?: number; height?: number }) => void;
   /** Observe phase transitions (see {@link ViewHostPhase}). */
   onPhaseChange?: (phase: ViewHostPhase) => void;
+  /**
+   * The origins this view needs the embedding PAGE's CSP to allow — the
+   * spec's per-resource declaration (`McpUiResourceCsp`). Given, the host
+   * arms a CSP tripwire for the attachment's lifetime: a
+   * `securitypolicyviolation` on the EMBEDDING document whose blocked URI
+   * lands on one of these hosts is upgraded from a silent "never
+   * negotiated" into an actionable {@link ViewCspDiagnosis} (guuey#235).
+   * The phase itself stays `"no-handshake"` — honest about WHAT happened;
+   * the diagnosis says WHY. Absent → tripwire not installed, zero behavior
+   * change (the default for every existing caller).
+   *
+   * REACH (pinned by the browser leg, `e2e/tests/sdk/view-host.spec.ts`):
+   * the listener lives on the embedding document, so it sees violations
+   * the PAGE incurs on the view's origins — a runtime bundle the page
+   * loads at page level, a live channel the page opens on the view's
+   * behalf (the shape ggui's landing tripwire exercised). It does NOT see
+   * a `srcdoc` view's own blocked loads: the frame inherits the page's
+   * policy, but the browser enforces that copy in — and dispatches the
+   * violation on — the FRAME's document, which is opaque-origin and cannot
+   * be listened to from outside. A frame-side reporter would need host
+   * script injected into untrusted view HTML, a trust-boundary change this
+   * primitive deliberately does not make; the `sandboxPageUrl` mount owns
+   * its own policy and reports nothing here by construction.
+   */
+  cspOrigins?: ViewCspOrigins;
+  /**
+   * A CSP violation ABOUT this view was observed (see {@link cspOrigins}).
+   * Fires at most once per attachment, as soon as the violation lands —
+   * typically BEFORE the negotiation window lapses, since a blocked runtime
+   * never gets to negotiate. `<GuueyView>` folds it into the no-handshake
+   * label; a custom renderer shows/logs it as it likes.
+   */
+  onCspDiagnosis?: (diagnosis: ViewCspDiagnosis) => void;
+  /** CSP-violation event source, injectable for tests. Default: `document`. */
+  cspEvents?: ViewCspEvents;
   /**
    * How long to wait for `ui/initialize` before declaring
    * `"no-handshake"` (ms). `0` disables the timer. Default 8000 — a view
@@ -270,6 +319,33 @@ export function attachViewHost(frame: ViewFrameLike, config: AttachViewHostConfi
   };
   const unsubscribe = subscribe();
 
+  // The CSP tripwire (guuey#235): armed only when the caller declared the
+  // view's origins — with none, there is nothing to match and nothing is
+  // installed. It only ever ADDS a diagnosis; it never changes what the
+  // machine does. Once per attachment: the first violation about the view
+  // is the diagnosis (later ones are the same failure repeating).
+  const unsubscribeCsp = ((): (() => void) => {
+    const { cspOrigins, onCspDiagnosis } = config;
+    if (cspOrigins === undefined) return () => {};
+    let reported = false;
+    const onViolation = (event: CspViolationLike): void => {
+      if (reported) return;
+      const diagnosis = diagnoseCspViolation(event, cspOrigins);
+      if (diagnosis === undefined) return;
+      reported = true;
+      onCspDiagnosis?.(diagnosis);
+    };
+    const { cspEvents } = config;
+    if (cspEvents !== undefined) {
+      cspEvents.addEventListener("securitypolicyviolation", onViolation);
+      return () => cspEvents.removeEventListener("securitypolicyviolation", onViolation);
+    }
+    if (typeof document === "undefined") return () => {}; // no embedding document — nothing reports there
+    const domListener = (event: SecurityPolicyViolationEvent): void => onViolation(event);
+    document.addEventListener("securitypolicyviolation", domListener);
+    return () => document.removeEventListener("securitypolicyviolation", domListener);
+  })();
+
   const timeoutMs = config.negotiationTimeoutMs ?? DEFAULT_NEGOTIATION_TIMEOUT_MS;
   const timer =
     timeoutMs > 0 ? setTimeout(() => setState(viewHostElapsed(state)), timeoutMs) : undefined;
@@ -277,6 +353,7 @@ export function attachViewHost(frame: ViewFrameLike, config: AttachViewHostConfi
   return () => {
     if (timer !== undefined) clearTimeout(timer);
     unsubscribe();
+    unsubscribeCsp();
     cachedWindow?.postMessage(teardownMessage(), "*");
   };
 }

package/dist/ggui-render.d.ts

@@ -1,144 +0,0 @@
-/**
- * @deprecated — the ggui vendor arm is RETIRED (guuey#209, 2026-08-16).
- *
- * Everything in this module is kept exported for ONE MINOR under the
- * post-launch compatibility rule and is removed in the minor after the one
- * that ships this notice. Nothing in `@guuey/mcp-apps-host` calls it any
- * more: `toolResultViewMount` hands a ggui render back as a `ui://`
- * **locator** (`toolResultLocator`, either channel), the mount material
- * comes from a `resources/read` through a `UiResourceReader` (pod door
- * live, persisted door on rehydration), and the `"ggui"` sandbox-trust
- * channel is assigned at resolution from the requested uri
- * (`uiResourceChannel` in `reader.ts`). Migration per symbol:
- *
- *  - {@link asGguiRender} / {@link toolResultGguiRender} /
- *    {@link blockGguiRender} → `toolResultLocator(block)` — the locator is
- *    the recognition signal; there is no descriptor to build.
- *  - {@link gguiRenderResource} → resolve the locator through a reader
- *    (`resolveViewMount(mount, reader)`); ggui's `resources/read` returns
- *    the shell with live-channel material minted FRESH at read time.
- *  - {@link GGUI_RENDER_META_KEY} → the wire key is ggui's; import
- *    `MCP_APP_AI_GGUI_RENDER_META_KEY` from
- *    `@ggui-ai/protocol/integrations/mcp-apps` if you still inspect
- *    `_meta` (nothing here does).
- *  - {@link asGguiRenderBootstrap} / {@link gguiShellHtml} and their types
- *    are pure re-exports of ggui's protocol package — import them from
- *    `@ggui-ai/protocol/integrations/mcp-apps` directly.
- *
- * ## Why the arm existed, for the record
- *
- * A ggui render's `tool.done` used to carry two signals: `uiData.resourceUri`
- * (recognition — the only part surviving the fold) and the
- * `_meta["ai.ggui/render"]` bootstrap (mount material: runtime bundle,
- * live channel, seeded props). Because guuey's chat client is not an MCP
- * client (the pod holds the connection), a live locator had no host-side
- * read channel, so the bootstrap was inlined as a read-skipping fast path
- * and this module built ggui's self-contained shell from it. The pod door
- * (`GET <pod>/agent/ui-resource`, guuey#209 C1) closed that gap; ggui's
- * read-time mint (C2) made the read strictly fresher than the inlined
- * copy; the vendor arm's only reason to exist was gone.
- */
-import type { AgBlock, JsonValue } from "@silverprotocol/core";
-import { type GguiRenderBootstrap } from "@ggui-ai/protocol/integrations/mcp-apps";
-import { type McpUiResourcePayload } from "./block-ui.js";
-export { 
-/** @deprecated import from `@ggui-ai/protocol/integrations/mcp-apps` (guuey#209; removed next minor). */
-asGguiRenderBootstrap, 
-/** @deprecated import from `@ggui-ai/protocol/integrations/mcp-apps` (guuey#209; removed next minor). */
-gguiShellHtml, } from "@ggui-ai/protocol/integrations/mcp-apps";
-export type { 
-/** @deprecated import from `@ggui-ai/protocol/integrations/mcp-apps` (guuey#209; removed next minor). */
-GguiRenderBootstrap, 
-/** @deprecated import from `@ggui-ai/protocol/integrations/mcp-apps` (guuey#209; removed next minor). */
-GguiShellHtmlOptions, } from "@ggui-ai/protocol/integrations/mcp-apps";
-/**
- * The `_meta` key the ggui render bootstrap rides on. Alias of the
- * protocol package's own constant — one spelling, owned upstream.
- *
- * @deprecated guuey#209 — nothing in this package reads `_meta` any more.
- * Import `MCP_APP_AI_GGUI_RENDER_META_KEY` from
- * `@ggui-ai/protocol/integrations/mcp-apps` if you still need the key.
- * Removed in the minor after the one shipping this notice.
- */
-export declare const GGUI_RENDER_META_KEY: "ai.ggui/render";
-/**
- * A ggui render recognised on a tool result: its resource uri + mount material.
- * @deprecated guuey#209 — the locator (`toolResultLocator`) is the whole
- * recognition signal now; there is no descriptor to build. Removed next minor.
- */
-export interface GguiRenderDescriptor {
-    /** `uiData.resourceUri` — `ui://ggui/render/<sessionId>/<contractHash>`. */
-    resourceUri: string;
-    /** `uiData.sessionId`, when present. */
-    sessionId?: string;
-    /**
-     * The `_meta["ai.ggui/render"]` slice, when it reached us. Absent for a
-     * persisted history card and for any consumer folding without `fold.ts`'s
-     * `_meta` carriage — such a descriptor is recognised but NOT mountable.
-     */
-    bootstrap?: GguiRenderBootstrap;
-}
-/**
- * A tool result's `uiData` (+ its `_meta`, when carried) → a ggui render
- * descriptor, or `undefined` for anything that is not one.
- *
- * The `ui://` scheme gate is deliberate: `uiData` is a general-purpose channel
- * (every `structuredContent` of a `_meta.ui`-stamped tool lands there), so a
- * bare `resourceUri` string is not on its own a claim of generative UI.
- *
- * @deprecated guuey#209 — use `toolResultLocator(block)`; the vendor arm is
- * retired and nothing consumes the descriptor. Removed next minor.
- */
-export declare function asGguiRender(uiData: JsonValue | undefined, meta: JsonValue | undefined): GguiRenderDescriptor | undefined;
-/**
- * A live `tool-result` AgBlock → its ggui render descriptor, if it is one.
- *
- * NOTE: `@ggui-ai/protocol/integrations/mcp-apps` exports a helper of the
- * same name that narrows a spec-canonical MCP `CallToolResult` instead. This
- * one is the silverprotocol-side twin — the input is the FOLDED block, whose
- * `uiData`/`_meta` carriage is `@silverprotocol/core`'s contract, not ggui's.
- *
- * @deprecated guuey#209 — use `toolResultLocator(block)`. Removed next minor.
- */
-export declare function toolResultGguiRender(block: Extract<AgBlock, {
-    type: "tool-result";
-}>): GguiRenderDescriptor | undefined;
-/**
- * An untyped (persisted-snapshot) block → its ggui render descriptor, if it is one.
- * @deprecated guuey#209 — use `snapshotViewMount(cardSnapshot)`, whose locator
- * arm is the persisted path. Removed next minor.
- */
-export declare function blockGguiRender(block: JsonValue): GguiRenderDescriptor | undefined;
-/**
- * A ggui render descriptor → the mountable resource the host's existing
- * mcp-ui path already knows how to mount, or `undefined` when the descriptor
- * carries no bootstrap (history cards, and any fold that dropped `_meta`).
- *
- * @deprecated guuey#209 — resolve the locator through a `UiResourceReader`
- * (`resolveViewMount`); ggui's `resources/read` returns the shell with
- * live-channel material minted FRESH at read time, which this inlined
- * copy could never be. Removed next minor.
- *
- * The `uri` is the render's REAL `resourceUri` — the shell is the payload, not
- * a renaming of the resource.
- *
- * The shell is built `background: 'transparent'`: every guuey host that
- * mounts through this adapter (widget, portal web, Studio) draws its own
- * card chrome around the iframe, so the host page composits behind the card.
- * The upstream default (`'surface'`) is for standalone served documents —
- * see `GguiShellHtmlOptions` in `@ggui-ai/protocol/integrations/mcp-apps`.
- *
- * **On `_meta` being required to MOUNT (but never to RECOGNISE).** Recognition
- * — "this tool result is a ggui card" — is keyed on `uiData.resourceUri` alone
- * and never waits for anything (see {@link asGguiRender}); nothing in this
- * package is blocked on an upstream change. Mounting is different, and the
- * requirement is ggui's, not ours: its runtime rejects a slice without
- * `runtimeUrl` AND without at least one mode discriminator (`wsUrl`+`wsToken`,
- * `codeUrl`, or `kind`) as `MALFORMED_BOOTSTRAP` and renders nothing. `uiData`
- * carries none of those fields, so a bootstrap-less descriptor could only ever
- * produce a blank frame; returning `undefined` and letting the host show its
- * own placeholder is the honest answer, not a deferral. `@silverprotocol/core`'s
- * `Reducer` is what puts `_meta` on the block for a live turn, in-repo, today.
- */
-export declare function gguiRenderResource(render: GguiRenderDescriptor): McpUiResourcePayload | undefined;
-//# sourceMappingURL=ggui-render.d.ts.map

package/dist/ggui-render.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"ggui-render.d.ts","sourceRoot":"","sources":["../src/ggui-render.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAuCG;AACH,OAAO,KAAK,EAAE,OAAO,EAAE,SAAS,EAAE,MAAM,sBAAsB,CAAC;AAC/D,OAAO,EAIL,KAAK,mBAAmB,EACzB,MAAM,yCAAyC,CAAC;AACjD,OAAO,EAAgB,KAAK,oBAAoB,EAAE,MAAM,eAAe,CAAC;AAExE,OAAO;AACL,yGAAyG;AACzG,qBAAqB;AACrB,yGAAyG;AACzG,aAAa,GACd,MAAM,yCAAyC,CAAC;AACjD,YAAY;AACV,yGAAyG;AACzG,mBAAmB;AACnB,yGAAyG;AACzG,oBAAoB,GACrB,MAAM,yCAAyC,CAAC;AAEjD;;;;;;;;GAQG;AACH,eAAO,MAAM,oBAAoB,kBAAkC,CAAC;AAKpE;;;;GAIG;AACH,MAAM,WAAW,oBAAoB;IACnC,4EAA4E;IAC5E,WAAW,EAAE,MAAM,CAAC;IACpB,wCAAwC;IACxC,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB;;;;OAIG;IACH,SAAS,CAAC,EAAE,mBAAmB,CAAC;CACjC;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,YAAY,CAC1B,MAAM,EAAE,SAAS,GAAG,SAAS,EAC7B,IAAI,EAAE,SAAS,GAAG,SAAS,GAC1B,oBAAoB,GAAG,SAAS,CAUlC;AAED;;;;;;;;;GASG;AACH,wBAAgB,oBAAoB,CAClC,KAAK,EAAE,OAAO,CAAC,OAAO,EAAE;IAAE,IAAI,EAAE,aAAa,CAAA;CAAE,CAAC,GAC/C,oBAAoB,GAAG,SAAS,CAElC;AAED;;;;GAIG;AACH,wBAAgB,eAAe,CAAC,KAAK,EAAE,SAAS,GAAG,oBAAoB,GAAG,SAAS,CAIlF;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8BG;AACH,wBAAgB,kBAAkB,CAChC,MAAM,EAAE,oBAAoB,GAC3B,oBAAoB,GAAG,SAAS,CAOlC"}

package/dist/ggui-render.js

@@ -1,108 +0,0 @@
-import { asGguiRenderBootstrap, gguiShellHtml, MCP_APP_AI_GGUI_RENDER_META_KEY, } from "@ggui-ai/protocol/integrations/mcp-apps";
-import { isJsonObject } from "./block-ui.js";
-export { 
-/** @deprecated import from `@ggui-ai/protocol/integrations/mcp-apps` (guuey#209; removed next minor). */
-asGguiRenderBootstrap, 
-/** @deprecated import from `@ggui-ai/protocol/integrations/mcp-apps` (guuey#209; removed next minor). */
-gguiShellHtml, } from "@ggui-ai/protocol/integrations/mcp-apps";
-/**
- * The `_meta` key the ggui render bootstrap rides on. Alias of the
- * protocol package's own constant — one spelling, owned upstream.
- *
- * @deprecated guuey#209 — nothing in this package reads `_meta` any more.
- * Import `MCP_APP_AI_GGUI_RENDER_META_KEY` from
- * `@ggui-ai/protocol/integrations/mcp-apps` if you still need the key.
- * Removed in the minor after the one shipping this notice.
- */
-export const GGUI_RENDER_META_KEY = MCP_APP_AI_GGUI_RENDER_META_KEY;
-/** The `ui://` scheme prefix every ggui render resource uri carries. */
-const UI_SCHEME = "ui://";
-/**
- * A tool result's `uiData` (+ its `_meta`, when carried) → a ggui render
- * descriptor, or `undefined` for anything that is not one.
- *
- * The `ui://` scheme gate is deliberate: `uiData` is a general-purpose channel
- * (every `structuredContent` of a `_meta.ui`-stamped tool lands there), so a
- * bare `resourceUri` string is not on its own a claim of generative UI.
- *
- * @deprecated guuey#209 — use `toolResultLocator(block)`; the vendor arm is
- * retired and nothing consumes the descriptor. Removed next minor.
- */
-export function asGguiRender(uiData, meta) {
-    if (!isJsonObject(uiData))
-        return undefined;
-    const resourceUri = uiData.resourceUri;
-    if (typeof resourceUri !== "string" || !resourceUri.startsWith(UI_SCHEME))
-        return undefined;
-    const bootstrap = asGguiRenderBootstrap(meta);
-    return {
-        resourceUri,
-        ...(typeof uiData.sessionId === "string" ? { sessionId: uiData.sessionId } : {}),
-        ...(bootstrap ? { bootstrap } : {}),
-    };
-}
-/**
- * A live `tool-result` AgBlock → its ggui render descriptor, if it is one.
- *
- * NOTE: `@ggui-ai/protocol/integrations/mcp-apps` exports a helper of the
- * same name that narrows a spec-canonical MCP `CallToolResult` instead. This
- * one is the silverprotocol-side twin — the input is the FOLDED block, whose
- * `uiData`/`_meta` carriage is `@silverprotocol/core`'s contract, not ggui's.
- *
- * @deprecated guuey#209 — use `toolResultLocator(block)`. Removed next minor.
- */
-export function toolResultGguiRender(block) {
-    return asGguiRender(block.uiData, block._meta);
-}
-/**
- * An untyped (persisted-snapshot) block → its ggui render descriptor, if it is one.
- * @deprecated guuey#209 — use `snapshotViewMount(cardSnapshot)`, whose locator
- * arm is the persisted path. Removed next minor.
- */
-export function blockGguiRender(block) {
-    if (!isJsonObject(block))
-        return undefined;
-    if (block.type !== "tool-result")
-        return undefined;
-    return asGguiRender(block.uiData, block._meta);
-}
-/**
- * A ggui render descriptor → the mountable resource the host's existing
- * mcp-ui path already knows how to mount, or `undefined` when the descriptor
- * carries no bootstrap (history cards, and any fold that dropped `_meta`).
- *
- * @deprecated guuey#209 — resolve the locator through a `UiResourceReader`
- * (`resolveViewMount`); ggui's `resources/read` returns the shell with
- * live-channel material minted FRESH at read time, which this inlined
- * copy could never be. Removed next minor.
- *
- * The `uri` is the render's REAL `resourceUri` — the shell is the payload, not
- * a renaming of the resource.
- *
- * The shell is built `background: 'transparent'`: every guuey host that
- * mounts through this adapter (widget, portal web, Studio) draws its own
- * card chrome around the iframe, so the host page composits behind the card.
- * The upstream default (`'surface'`) is for standalone served documents —
- * see `GguiShellHtmlOptions` in `@ggui-ai/protocol/integrations/mcp-apps`.
- *
- * **On `_meta` being required to MOUNT (but never to RECOGNISE).** Recognition
- * — "this tool result is a ggui card" — is keyed on `uiData.resourceUri` alone
- * and never waits for anything (see {@link asGguiRender}); nothing in this
- * package is blocked on an upstream change. Mounting is different, and the
- * requirement is ggui's, not ours: its runtime rejects a slice without
- * `runtimeUrl` AND without at least one mode discriminator (`wsUrl`+`wsToken`,
- * `codeUrl`, or `kind`) as `MALFORMED_BOOTSTRAP` and renders nothing. `uiData`
- * carries none of those fields, so a bootstrap-less descriptor could only ever
- * produce a blank frame; returning `undefined` and letting the host show its
- * own placeholder is the honest answer, not a deferral. `@silverprotocol/core`'s
- * `Reducer` is what puts `_meta` on the block for a live turn, in-repo, today.
- */
-export function gguiRenderResource(render) {
-    if (!render.bootstrap)
-        return undefined;
-    return {
-        uri: render.resourceUri,
-        mimeType: "text/html",
-        text: gguiShellHtml(render.bootstrap, { background: "transparent" }),
-    };
-}