@otto-code/protocol 0.7.6 → 0.8.1

package/dist/widgets/bridge.d.ts

@@ -1,12 +1,12 @@
 import { z } from "zod";
 /**
- * The widget message bridge — the contract between a widget guest (WebView /
+ * The widget message bridge - the contract between a widget guest (WebView /
  * iframe / Electron <webview>) and its host renderer.
  *
  * Three transports carry the same two message shapes:
- *   native   — `window.ReactNativeWebView.postMessage` + `onMessage`
- *   web      — a `MessageChannel` port transferred in at load
- *   electron — a preload's `ipcRenderer.sendToHost` + the `ipc-message` event
+ *   native   - `window.ReactNativeWebView.postMessage` + `onMessage`
+ *   web      - a `MessageChannel` port transferred in at load
+ *   electron - a preload's `ipcRenderer.sendToHost` + the `ipc-message` event
  *
  * The schema lives here, once, so a transport cannot quietly drift. Everything
  * arriving from a guest is untrusted model-generated content: parse, never
@@ -50,7 +50,7 @@ export type WidgetGuestMessage = z.infer<typeof WidgetGuestMessageSchema>;
 /**
  * Parse a raw guest frame. Accepts the JSON string the native and Electron
  * transports deliver as well as an already-structured object (web's
- * MessageChannel). Returns null for anything unrecognized — including frames
+ * MessageChannel). Returns null for anything unrecognized - including frames
  * for a different widget, which the caller filters by id.
  */
 export declare function parseWidgetGuestMessage(raw: unknown): WidgetGuestMessage | null;

package/dist/widgets/bridge.js

@@ -1,12 +1,12 @@
 import { z } from "zod";
 /**
- * The widget message bridge — the contract between a widget guest (WebView /
+ * The widget message bridge - the contract between a widget guest (WebView /
  * iframe / Electron <webview>) and its host renderer.
  *
  * Three transports carry the same two message shapes:
- *   native   — `window.ReactNativeWebView.postMessage` + `onMessage`
- *   web      — a `MessageChannel` port transferred in at load
- *   electron — a preload's `ipcRenderer.sendToHost` + the `ipc-message` event
+ *   native   - `window.ReactNativeWebView.postMessage` + `onMessage`
+ *   web      - a `MessageChannel` port transferred in at load
+ *   electron - a preload's `ipcRenderer.sendToHost` + the `ipc-message` event
  *
  * The schema lives here, once, so a transport cannot quietly drift. Everything
  * arriving from a guest is untrusted model-generated content: parse, never
@@ -59,7 +59,7 @@ export const WidgetGuestMessageSchema = z.discriminatedUnion("type", [
 /**
  * Parse a raw guest frame. Accepts the JSON string the native and Electron
  * transports deliver as well as an already-structured object (web's
- * MessageChannel). Returns null for anything unrecognized — including frames
+ * MessageChannel). Returns null for anything unrecognized - including frames
  * for a different widget, which the caller filters by id.
  */
 export function parseWidgetGuestMessage(raw) {

package/dist/widgets/document.d.ts

@@ -9,7 +9,7 @@ export interface BuildWidgetDocumentInput {
 /**
  * Wrap a sanitized fragment into the full guest document.
  *
- * The fragment is inserted verbatim — it was already sanitized daemon-side
+ * The fragment is inserted verbatim - it was already sanitized daemon-side
  * (`packages/server/src/server/widget/widget-fragment.ts`) and the CSP plus the
  * per-platform sandbox are what actually contain it. Re-parsing it here would
  * add a second, weaker sanitizer that only ever disagrees with the first.

package/dist/widgets/document.js

@@ -6,7 +6,7 @@ import { buildWidgetThemeVariables } from "./theme.js";
  *
  * Shared by all three renderers (native WebView, web iframe, Electron
  * <webview>) so the CSP, the host stylesheet and the bridge bootstrap cannot
- * drift apart per platform — a widget that works in one has to work in all of
+ * drift apart per platform - a widget that works in one has to work in all of
  * them.
  */
 /**
@@ -25,7 +25,7 @@ import { buildWidgetThemeVariables } from "./theme.js";
  *      a hostile file or page, and an outbound URL is a payload.
  *
  * The fragment therefore gets inline script/style and data: assets, and nothing
- * else. Charts are hand-rolled SVG — the contract document says so plainly, and
+ * else. Charts are hand-rolled SVG - the contract document says so plainly, and
  * a blocked resource surfaces as a visible error rather than a blank box.
  */
 const WIDGET_CSP = "default-src 'none'; script-src 'unsafe-inline'; style-src 'unsafe-inline'; " +
@@ -114,7 +114,7 @@ function buildBootstrap(widgetId) {
       return true;
     }
     // Web: the MessagePort the host transferred in. Validating on port identity
-    // is the point — this iframe has no allow-same-origin, so its origin is
+    // is the point - this iframe has no allow-same-origin, so its origin is
     // "null" and event.origin can prove nothing.
     if (port) {
       port.postMessage(payload);
@@ -215,7 +215,7 @@ function buildBootstrap(widgetId) {
 /**
  * Wrap a sanitized fragment into the full guest document.
  *
- * The fragment is inserted verbatim — it was already sanitized daemon-side
+ * The fragment is inserted verbatim - it was already sanitized daemon-side
  * (`packages/server/src/server/widget/widget-fragment.ts`) and the CSP plus the
  * per-platform sandbox are what actually contain it. Re-parsing it here would
  * add a second, weaker sanitizer that only ever disagrees with the first.

package/dist/widgets/icons.d.ts

@@ -10,7 +10,7 @@
  * So the set is curated instead: ~40 glyphs covering what widgets actually
  * reach for, drawn in Tabler's outline language (24px box, 2px stroke, round
  * caps) and applied as a CSS mask so each one inherits `currentColor`. A name
- * outside the set renders nothing rather than a broken box — and the contract
+ * outside the set renders nothing rather than a broken box - and the contract
  * document lists exactly what exists, so the model never guesses.
  */
 /** Every icon name a widget may use. The contract document renders this list. */

package/dist/widgets/icons.js

@@ -10,7 +10,7 @@
  * So the set is curated instead: ~40 glyphs covering what widgets actually
  * reach for, drawn in Tabler's outline language (24px box, 2px stroke, round
  * caps) and applied as a CSS mask so each one inherits `currentColor`. A name
- * outside the set renders nothing rather than a broken box — and the contract
+ * outside the set renders nothing rather than a broken box - and the contract
  * document lists exactly what exists, so the model never guesses.
  */
 const ICON_PATHS = {

package/dist/widgets/theme.d.ts

@@ -2,7 +2,7 @@
  * The CSS custom properties a widget fragment is written against, and the
  * mapping from Otto's semantic theme tokens onto them.
  *
- * The HOST assembles the guest document, not the daemon — because only the
+ * The HOST assembles the guest document, not the daemon - because only the
  * client knows which theme is live, and a theme switch has to re-skin an
  * already-rendered widget without a daemon round trip. The variable NAMES are
  * frozen here so the contract document, the fixtures, and every renderer agree.
@@ -21,7 +21,7 @@ export interface WidgetThemeInput {
     accent: string;
     danger: string;
     success: string;
-    /** Optional — themes without a warning token fall back to a fixed amber. */
+    /** Optional - themes without a warning token fall back to a fixed amber. */
     warning?: string;
     fontSans: string;
     fontMono: string;

package/dist/widgets/theme.js

@@ -2,7 +2,7 @@
  * The CSS custom properties a widget fragment is written against, and the
  * mapping from Otto's semantic theme tokens onto them.
  *
- * The HOST assembles the guest document, not the daemon — because only the
+ * The HOST assembles the guest document, not the daemon - because only the
  * client knows which theme is live, and a theme switch has to re-skin an
  * already-rendered widget without a daemon round trip. The variable NAMES are
  * frozen here so the contract document, the fixtures, and every renderer agree.
@@ -68,7 +68,7 @@ function roleText(color, input) {
 function roleTint(color, input) {
     return mix(color, input.surface0, input.isDark ? 0.22 : 0.12);
 }
-/** SVG palette. Fixed hues rather than theme tokens — a chart needs categorical
+/** SVG palette. Fixed hues rather than theme tokens - a chart needs categorical
  * separation that survives every theme, and the two dark/light rows keep each
  * hue legible on whichever surface it lands on. */
 const SVG_PALETTE_LIGHT = {

package/dist/widgets/types.d.ts

@@ -1,12 +1,12 @@
 import { z } from "zod";
 /**
- * Inline widgets — an agent emits a tool call carrying a fragment of HTML or
+ * Inline widgets - an agent emits a tool call carrying a fragment of HTML or
  * SVG, and Otto renders it inline in the transcript at that call's position.
  *
  * Widgets are NOT artifacts. An artifact is a file-backed document the user
  * keeps (see `../artifacts/types.ts`); a widget is a thought the model had in
  * the middle of a sentence. It has no file, no versioning, and no lifetime
- * beyond its transcript position — the tool-call input IS the content, so a
+ * beyond its transcript position - the tool-call input IS the content, so a
  * re-opened chat re-renders its widgets from the stored timeline for free.
  *
  * See `docs/widgets.md`.
@@ -22,7 +22,7 @@ export declare const WIDGET_CONTRACT_TOOL_NAME = "widget_contract";
  * (messages.ts) is a `z.discriminatedUnion`, so a client that predates widgets
  * would reject an unknown discriminator and fail to parse the ENTIRE timeline
  * message, not just the widget. `metadata` is `z.record(z.string(), z.unknown())`
- * — an old client carries this through untouched and renders the tool call's
+ * - an old client carries this through untouched and renders the tool call's
  * `plain_text` detail as an ordinary row. That is the protocol contract doing
  * its job.
  */
@@ -35,7 +35,7 @@ export declare const WIDGET_METADATA_KEY = "ottoWidget";
 export declare const WIDGET_PAYLOAD_VERSION = 1;
 /**
  * How the fragment is interpreted. Auto-detected from the code itself (a
- * fragment starting with `<svg` is SVG), never asked of the model — one less
+ * fragment starting with `<svg` is SVG), never asked of the model - one less
  * thing for it to get wrong.
  */
 export declare const WIDGET_MODES: readonly ["html", "svg"];
@@ -68,7 +68,7 @@ export type WidgetPayload = z.infer<typeof WidgetPayloadSchema>;
  * Read a widget payload out of a tool call's metadata bag.
  *
  * Returns null for anything that is not a widget of a version this build
- * understands — the caller renders the ordinary tool-call row instead. Never
+ * understands - the caller renders the ordinary tool-call row instead. Never
  * throws: metadata is `unknown` by contract and may come from a newer daemon.
  */
 export declare function readWidgetPayload(metadata: Record<string, unknown> | undefined): WidgetPayload | null;

package/dist/widgets/types.js

@@ -1,12 +1,12 @@
 import { z } from "zod";
 /**
- * Inline widgets — an agent emits a tool call carrying a fragment of HTML or
+ * Inline widgets - an agent emits a tool call carrying a fragment of HTML or
  * SVG, and Otto renders it inline in the transcript at that call's position.
  *
  * Widgets are NOT artifacts. An artifact is a file-backed document the user
  * keeps (see `../artifacts/types.ts`); a widget is a thought the model had in
  * the middle of a sentence. It has no file, no versioning, and no lifetime
- * beyond its transcript position — the tool-call input IS the content, so a
+ * beyond its transcript position - the tool-call input IS the content, so a
  * re-opened chat re-renders its widgets from the stored timeline for free.
  *
  * See `docs/widgets.md`.
@@ -22,7 +22,7 @@ export const WIDGET_CONTRACT_TOOL_NAME = "widget_contract";
  * (messages.ts) is a `z.discriminatedUnion`, so a client that predates widgets
  * would reject an unknown discriminator and fail to parse the ENTIRE timeline
  * message, not just the widget. `metadata` is `z.record(z.string(), z.unknown())`
- * — an old client carries this through untouched and renders the tool call's
+ * - an old client carries this through untouched and renders the tool call's
  * `plain_text` detail as an ordinary row. That is the protocol contract doing
  * its job.
  */
@@ -35,7 +35,7 @@ export const WIDGET_METADATA_KEY = "ottoWidget";
 export const WIDGET_PAYLOAD_VERSION = 1;
 /**
  * How the fragment is interpreted. Auto-detected from the code itself (a
- * fragment starting with `<svg` is SVG), never asked of the model — one less
+ * fragment starting with `<svg` is SVG), never asked of the model - one less
  * thing for it to get wrong.
  */
 export const WIDGET_MODES = ["html", "svg"];
@@ -64,7 +64,7 @@ const WidgetPayloadSchema = z.object({
  * Read a widget payload out of a tool call's metadata bag.
  *
  * Returns null for anything that is not a widget of a version this build
- * understands — the caller renders the ordinary tool-call row instead. Never
+ * understands - the caller renders the ordinary tool-call row instead. Never
  * throws: metadata is `unknown` by contract and may come from a newer daemon.
  */
 export function readWidgetPayload(metadata) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@otto-code/protocol",
-  "version": "0.7.6",
+  "version": "0.8.1",
   "description": "Otto shared protocol schemas and wire types",
   "license": "AGPL-3.0-or-later",
   "files": [