@toon-protocol/views 0.2.0

package/dist/render/node-shims/node-builtins.js

@@ -0,0 +1,38 @@
+/**
+ * Browser shim for the Node builtins (`child_process`, `fs/promises`, `os`,
+ * `path`, `crypto`) that `@toon-protocol/core`'s root entry top-level-imports for
+ * its Node-only devnet `preset` helper. Aliased in by `vite.config.ts` for the
+ * MCP-app bundle only.
+ *
+ * The render trust gradient uses only core's PURE `ui` coordinate helpers; the
+ * devnet-preset code that needs these builtins is dead in the iframe. Vite's
+ * default `__vite-browser-external` stub does not export the *named* bindings
+ * core imports (`execFile`, `mkdtemp`, `tmpdir`, …), which fails the build at
+ * link time. This shim exports every name core references so the (dead) imports
+ * resolve; any actual call throws — none happens in the browser.
+ */
+function unavailable(name) {
+    throw new Error(`Node builtin "${name}" is not available in the browser bundle`);
+}
+// child_process
+export const execFile = () => unavailable('child_process.execFile');
+// fs/promises
+export const readFile = () => unavailable('fs/promises.readFile');
+export const writeFile = () => unavailable('fs/promises.writeFile');
+export const mkdtemp = () => unavailable('fs/promises.mkdtemp');
+export const cp = () => unavailable('fs/promises.cp');
+export const rm = () => unavailable('fs/promises.rm');
+// os
+export const tmpdir = () => unavailable('os.tmpdir');
+// crypto
+export const createHash = () => unavailable('crypto.createHash');
+// path — default import in core; provide the members it could reference.
+const pathShim = {
+    join: () => unavailable('path.join'),
+    resolve: () => unavailable('path.resolve'),
+    dirname: () => unavailable('path.dirname'),
+    basename: () => unavailable('path.basename'),
+    sep: '/',
+};
+export default pathShim;
+//# sourceMappingURL=node-builtins.js.map

package/dist/render/node-shims/node-builtins.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"node-builtins.js","sourceRoot":"","sources":["../../../src/render/node-shims/node-builtins.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAEH,SAAS,WAAW,CAAC,IAAY;IAC/B,MAAM,IAAI,KAAK,CAAC,iBAAiB,IAAI,0CAA0C,CAAC,CAAC;AACnF,CAAC;AAED,gBAAgB;AAChB,MAAM,CAAC,MAAM,QAAQ,GAAG,GAAU,EAAE,CAAC,WAAW,CAAC,wBAAwB,CAAC,CAAC;AAE3E,cAAc;AACd,MAAM,CAAC,MAAM,QAAQ,GAAG,GAAU,EAAE,CAAC,WAAW,CAAC,sBAAsB,CAAC,CAAC;AACzE,MAAM,CAAC,MAAM,SAAS,GAAG,GAAU,EAAE,CAAC,WAAW,CAAC,uBAAuB,CAAC,CAAC;AAC3E,MAAM,CAAC,MAAM,OAAO,GAAG,GAAU,EAAE,CAAC,WAAW,CAAC,qBAAqB,CAAC,CAAC;AACvE,MAAM,CAAC,MAAM,EAAE,GAAG,GAAU,EAAE,CAAC,WAAW,CAAC,gBAAgB,CAAC,CAAC;AAC7D,MAAM,CAAC,MAAM,EAAE,GAAG,GAAU,EAAE,CAAC,WAAW,CAAC,gBAAgB,CAAC,CAAC;AAE7D,KAAK;AACL,MAAM,CAAC,MAAM,MAAM,GAAG,GAAU,EAAE,CAAC,WAAW,CAAC,WAAW,CAAC,CAAC;AAE5D,SAAS;AACT,MAAM,CAAC,MAAM,UAAU,GAAG,GAAU,EAAE,CAAC,WAAW,CAAC,mBAAmB,CAAC,CAAC;AAExE,yEAAyE;AACzE,MAAM,QAAQ,GAAG;IACf,IAAI,EAAE,GAAU,EAAE,CAAC,WAAW,CAAC,WAAW,CAAC;IAC3C,OAAO,EAAE,GAAU,EAAE,CAAC,WAAW,CAAC,cAAc,CAAC;IACjD,OAAO,EAAE,GAAU,EAAE,CAAC,WAAW,CAAC,cAAc,CAAC;IACjD,QAAQ,EAAE,GAAU,EAAE,CAAC,WAAW,CAAC,eAAe,CAAC;IACnD,GAAG,EAAE,GAAG;CACT,CAAC;AAEF,eAAe,QAAQ,CAAC"}

package/dist/render/resolve.d.ts

@@ -0,0 +1,72 @@
+/**
+ * Live render-trust-gradient resolution for incoming events.
+ *
+ * This is the host-wiring half of the NIP-on-TOON render gradient (toon-meta#58):
+ * `@toon-protocol/client` owns the pure dispatch + swap-defense; this module
+ * fetches the renderer over the app's {@link ViewBridge} (the app has no direct
+ * relay access) and drives {@link guardedRenderDispatch} so every incoming event
+ * is routed through the gradient instead of unconditionally rendered native.
+ *
+ * Flow per event:
+ *   1. {@link resolveUiCoordinate} parses the event's `ui` tag → a renderer
+ *      coordinate `31036:<event-author>:<targetKind>` (or `null` if no `ui` tag).
+ *   2. If a coordinate exists, fetch candidate `kind:31036` renderers via the
+ *      bridge: `toon_query { kinds: [31036], '#d': [targetKind], authors: [author] }`.
+ *      The query is a relay round-trip, so resolution is async (loading state).
+ *   3. {@link guardedRenderDispatch} runs the swap-defense guard over the raw
+ *      candidates (author-binding + signature re-verify + anti-swap pinning) and
+ *      returns the {@link RenderDecision} — native / a2ui / mcp-ui / generative.
+ *
+ * Known kinds short-circuit to branch 1 (native) without any bridge round-trip,
+ * keeping the common feed path fast: a kind with a registered atom never needs a
+ * renderer fetch.
+ *
+ * NOTE on coordinate forms: the query filter is built from
+ * {@link resolveUiCoordinate}, which accepts BOTH the bare target-kind `ui` tag
+ * (`["ui","42"]`) and the full `31036:<pubkey>:<kind>` coordinate. The
+ * swap-defense guard inside {@link guardedRenderDispatch}, however, is authored
+ * against the FULL coordinate (core's `getUiCoordinate`) and fails closed
+ * (→ generative) on a bare-only `ui` tag. So branches 2/3 light up for events
+ * carrying the full coordinate (the canonical renderer-aware form); a bare-only
+ * `ui` tag still resolves a query but the guard routes it to the safe generative
+ * branch. This mirrors the guard being the security-authoritative gate.
+ */
+import { type DispatchGuardInfo, type KindRegistry, type RenderDecision, type RendererPinStore } from '@toon-protocol/client/render';
+import { type NostrEvent } from '../types.js';
+import { type ViewBridge } from '../app-bridge/types.js';
+import { type Atom } from '../atoms/types.js';
+/**
+ * Build the `toon_query` filter that fetches the candidate `kind:31036`
+ * renderers for an event's `ui` coordinate. Returns `undefined` when the event
+ * carries no usable `ui` tag (nothing to resolve — branch 4 territory).
+ *
+ * The filter is author-bound to the event author (the authoritative renderer
+ * author, per toon#36) and pinned to the target kind via the `#d` tag, mirroring
+ * the coordinate the swap-defense guard re-derives — so the relay returns only
+ * the revisions that can legitimately win.
+ */
+export declare function rendererQueryFilter(event: NostrEvent): {
+    kinds: number[];
+    authors: string[];
+    '#d': string[];
+} | undefined;
+/** The outcome of {@link useRenderDecision}. */
+export interface RenderResolution {
+    /** The dispatch decision, or `null` while a renderer fetch is in flight. */
+    decision: RenderDecision<Atom> | null;
+    /** Set when the swap-defense guard refused a renderer (the gradient fell back). */
+    guard?: DispatchGuardInfo;
+    /** `true` while the renderer query round-trip is in flight. */
+    loading: boolean;
+}
+/**
+ * Resolve an event to a {@link RenderDecision} through the render trust gradient.
+ *
+ * Known kinds resolve synchronously to branch 1 (native) — no bridge call. For
+ * an unknown kind with a `ui` coordinate, the candidate renderers are fetched
+ * over the bridge and the guarded dispatch picks the branch once they arrive;
+ * until then `loading` is `true` and `decision` is `null`. Unknown kinds with no
+ * `ui` tag resolve immediately to branch 4 (generative).
+ */
+export declare function useRenderDecision(event: NostrEvent, bridge: ViewBridge, registry: KindRegistry<Atom>, pins: RendererPinStore): RenderResolution;
+//# sourceMappingURL=resolve.d.ts.map

package/dist/render/resolve.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"resolve.d.ts","sourceRoot":"","sources":["../../src/render/resolve.tsx"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgCG;AAGH,OAAO,EAGL,KAAK,iBAAiB,EACtB,KAAK,YAAY,EACjB,KAAK,cAAc,EACnB,KAAK,gBAAgB,EAEtB,MAAM,8BAA8B,CAAC;AACtC,OAAO,EAAE,KAAK,UAAU,EAAE,MAAM,aAAa,CAAC;AAC9C,OAAO,EAAE,KAAK,UAAU,EAAE,MAAM,wBAAwB,CAAC;AACzD,OAAO,EAAE,KAAK,IAAI,EAAE,MAAM,mBAAmB,CAAC;AAG9C;;;;;;;;;GASG;AACH,wBAAgB,mBAAmB,CACjC,KAAK,EAAE,UAAU,GAChB;IAAE,KAAK,EAAE,MAAM,EAAE,CAAC;IAAC,OAAO,EAAE,MAAM,EAAE,CAAC;IAAC,IAAI,EAAE,MAAM,EAAE,CAAA;CAAE,GAAG,SAAS,CAQpE;AAED,gDAAgD;AAChD,MAAM,WAAW,gBAAgB;IAC/B,4EAA4E;IAC5E,QAAQ,EAAE,cAAc,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC;IACtC,mFAAmF;IACnF,KAAK,CAAC,EAAE,iBAAiB,CAAC;IAC1B,+DAA+D;IAC/D,OAAO,EAAE,OAAO,CAAC;CAClB;AAED;;;;;;;;GAQG;AACH,wBAAgB,iBAAiB,CAC/B,KAAK,EAAE,UAAU,EACjB,MAAM,EAAE,UAAU,EAClB,QAAQ,EAAE,YAAY,CAAC,IAAI,CAAC,EAC5B,IAAI,EAAE,gBAAgB,GACrB,gBAAgB,CAkDlB"}

package/dist/render/resolve.js

@@ -0,0 +1,115 @@
+/**
+ * Live render-trust-gradient resolution for incoming events.
+ *
+ * This is the host-wiring half of the NIP-on-TOON render gradient (toon-meta#58):
+ * `@toon-protocol/client` owns the pure dispatch + swap-defense; this module
+ * fetches the renderer over the app's {@link ViewBridge} (the app has no direct
+ * relay access) and drives {@link guardedRenderDispatch} so every incoming event
+ * is routed through the gradient instead of unconditionally rendered native.
+ *
+ * Flow per event:
+ *   1. {@link resolveUiCoordinate} parses the event's `ui` tag → a renderer
+ *      coordinate `31036:<event-author>:<targetKind>` (or `null` if no `ui` tag).
+ *   2. If a coordinate exists, fetch candidate `kind:31036` renderers via the
+ *      bridge: `toon_query { kinds: [31036], '#d': [targetKind], authors: [author] }`.
+ *      The query is a relay round-trip, so resolution is async (loading state).
+ *   3. {@link guardedRenderDispatch} runs the swap-defense guard over the raw
+ *      candidates (author-binding + signature re-verify + anti-swap pinning) and
+ *      returns the {@link RenderDecision} — native / a2ui / mcp-ui / generative.
+ *
+ * Known kinds short-circuit to branch 1 (native) without any bridge round-trip,
+ * keeping the common feed path fast: a kind with a registered atom never needs a
+ * renderer fetch.
+ *
+ * NOTE on coordinate forms: the query filter is built from
+ * {@link resolveUiCoordinate}, which accepts BOTH the bare target-kind `ui` tag
+ * (`["ui","42"]`) and the full `31036:<pubkey>:<kind>` coordinate. The
+ * swap-defense guard inside {@link guardedRenderDispatch}, however, is authored
+ * against the FULL coordinate (core's `getUiCoordinate`) and fails closed
+ * (→ generative) on a bare-only `ui` tag. So branches 2/3 light up for events
+ * carrying the full coordinate (the canonical renderer-aware form); a bare-only
+ * `ui` tag still resolves a query but the guard routes it to the safe generative
+ * branch. This mirrors the guard being the security-authoritative gate.
+ */
+import { useEffect, useState } from 'react';
+import { guardedRenderDispatch, resolveUiCoordinate, UI_RENDERER_KIND, } from '@toon-protocol/client/render';
+import {} from '../types.js';
+import {} from '../app-bridge/types.js';
+import {} from '../atoms/types.js';
+import { QUERY_TOOL } from '../tool-names.js';
+/**
+ * Build the `toon_query` filter that fetches the candidate `kind:31036`
+ * renderers for an event's `ui` coordinate. Returns `undefined` when the event
+ * carries no usable `ui` tag (nothing to resolve — branch 4 territory).
+ *
+ * The filter is author-bound to the event author (the authoritative renderer
+ * author, per toon#36) and pinned to the target kind via the `#d` tag, mirroring
+ * the coordinate the swap-defense guard re-derives — so the relay returns only
+ * the revisions that can legitimately win.
+ */
+export function rendererQueryFilter(event) {
+    const coord = resolveUiCoordinate(event);
+    if (!coord)
+        return undefined;
+    return {
+        kinds: [UI_RENDERER_KIND],
+        authors: [coord.pubkey],
+        '#d': [String(coord.targetKind)],
+    };
+}
+/**
+ * Resolve an event to a {@link RenderDecision} through the render trust gradient.
+ *
+ * Known kinds resolve synchronously to branch 1 (native) — no bridge call. For
+ * an unknown kind with a `ui` coordinate, the candidate renderers are fetched
+ * over the bridge and the guarded dispatch picks the branch once they arrive;
+ * until then `loading` is `true` and `decision` is `null`. Unknown kinds with no
+ * `ui` tag resolve immediately to branch 4 (generative).
+ */
+export function useRenderDecision(event, bridge, registry, pins) {
+    const [resolution, setResolution] = useState(() => {
+        // Known kind, or no `ui` tag → no fetch needed; decide synchronously so the
+        // common path renders on the first frame with no loading flash.
+        if (registry.has(event.kind) || rendererQueryFilter(event) === undefined) {
+            const { decision, guard } = guardedRenderDispatch({ event }, registry, pins);
+            return { decision, ...(guard ? { guard } : {}), loading: false };
+        }
+        return { decision: null, loading: true };
+    });
+    useEffect(() => {
+        const filter = rendererQueryFilter(event);
+        // Known kind or no coordinate: already decided synchronously above; nothing
+        // to fetch. (Re-assert in case the event prop changed between renders.)
+        if (registry.has(event.kind) || filter === undefined) {
+            const { decision, guard } = guardedRenderDispatch({ event }, registry, pins);
+            setResolution({ decision, ...(guard ? { guard } : {}), loading: false });
+            return;
+        }
+        let cancelled = false;
+        setResolution({ decision: null, loading: true });
+        void bridge
+            .callTool(QUERY_TOOL, { filter })
+            .then((res) => {
+            if (cancelled)
+                return;
+            const candidates = res.events ?? [];
+            const { decision, guard } = guardedRenderDispatch({ event, candidates }, registry, pins);
+            setResolution({ decision, ...(guard ? { guard } : {}), loading: false });
+        })
+            .catch(() => {
+            if (cancelled)
+                return;
+            // A failed renderer fetch must never render nothing — fall back to the
+            // gradient's safe branch (generative for the unknown kind) with no
+            // candidates, exactly as if the relay returned an empty set.
+            const { decision, guard } = guardedRenderDispatch({ event }, registry, pins);
+            setResolution({ decision, ...(guard ? { guard } : {}), loading: false });
+        });
+        return () => {
+            cancelled = true;
+        };
+        // `event.id` keys the event; bridge/registry/pins are stable for a session.
+    }, [event.id, bridge, registry, pins]);
+    return resolution;
+}
+//# sourceMappingURL=resolve.js.map

package/dist/render/resolve.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"resolve.js","sourceRoot":"","sources":["../../src/render/resolve.tsx"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgCG;AAEH,OAAO,EAAE,SAAS,EAAE,QAAQ,EAAE,MAAM,OAAO,CAAC;AAC5C,OAAO,EACL,qBAAqB,EACrB,mBAAmB,EAKnB,gBAAgB,GACjB,MAAM,8BAA8B,CAAC;AACtC,OAAO,EAAmB,MAAM,aAAa,CAAC;AAC9C,OAAO,EAAmB,MAAM,wBAAwB,CAAC;AACzD,OAAO,EAAa,MAAM,mBAAmB,CAAC;AAC9C,OAAO,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAC;AAE9C;;;;;;;;;GASG;AACH,MAAM,UAAU,mBAAmB,CACjC,KAAiB;IAEjB,MAAM,KAAK,GAAG,mBAAmB,CAAC,KAAK,CAAC,CAAC;IACzC,IAAI,CAAC,KAAK;QAAE,OAAO,SAAS,CAAC;IAC7B,OAAO;QACL,KAAK,EAAE,CAAC,gBAAgB,CAAC;QACzB,OAAO,EAAE,CAAC,KAAK,CAAC,MAAM,CAAC;QACvB,IAAI,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC;KACjC,CAAC;AACJ,CAAC;AAYD;;;;;;;;GAQG;AACH,MAAM,UAAU,iBAAiB,CAC/B,KAAiB,EACjB,MAAkB,EAClB,QAA4B,EAC5B,IAAsB;IAEtB,MAAM,CAAC,UAAU,EAAE,aAAa,CAAC,GAAG,QAAQ,CAAmB,GAAG,EAAE;QAClE,4EAA4E;QAC5E,gEAAgE;QAChE,IAAI,QAAQ,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,mBAAmB,CAAC,KAAK,CAAC,KAAK,SAAS,EAAE,CAAC;YACzE,MAAM,EAAE,QAAQ,EAAE,KAAK,EAAE,GAAG,qBAAqB,CAAC,EAAE,KAAK,EAAE,EAAE,QAAQ,EAAE,IAAI,CAAC,CAAC;YAC7E,OAAO,EAAE,QAAQ,EAAE,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC;QACnE,CAAC;QACD,OAAO,EAAE,QAAQ,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;IAC3C,CAAC,CAAC,CAAC;IAEH,SAAS,CAAC,GAAG,EAAE;QACb,MAAM,MAAM,GAAG,mBAAmB,CAAC,KAAK,CAAC,CAAC;QAC1C,4EAA4E;QAC5E,wEAAwE;QACxE,IAAI,QAAQ,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;YACrD,MAAM,EAAE,QAAQ,EAAE,KAAK,EAAE,GAAG,qBAAqB,CAAC,EAAE,KAAK,EAAE,EAAE,QAAQ,EAAE,IAAI,CAAC,CAAC;YAC7E,aAAa,CAAC,EAAE,QAAQ,EAAE,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC,CAAC;YACzE,OAAO;QACT,CAAC;QAED,IAAI,SAAS,GAAG,KAAK,CAAC;QACtB,aAAa,CAAC,EAAE,QAAQ,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC;QACjD,KAAK,MAAM;aACR,QAAQ,CAAC,UAAU,EAAE,EAAE,MAAM,EAAE,CAAC;aAChC,IAAI,CAAC,CAAC,GAAG,EAAE,EAAE;YACZ,IAAI,SAAS;gBAAE,OAAO;YACtB,MAAM,UAAU,GAAG,GAAG,CAAC,MAAM,IAAI,EAAE,CAAC;YACpC,MAAM,EAAE,QAAQ,EAAE,KAAK,EAAE,GAAG,qBAAqB,CAC/C,EAAE,KAAK,EAAE,UAAU,EAAE,EACrB,QAAQ,EACR,IAAI,CACL,CAAC;YACF,aAAa,CAAC,EAAE,QAAQ,EAAE,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC,CAAC;QAC3E,CAAC,CAAC;aACD,KAAK,CAAC,GAAG,EAAE;YACV,IAAI,SAAS;gBAAE,OAAO;YACtB,uEAAuE;YACvE,mEAAmE;YACnE,6DAA6D;YAC7D,MAAM,EAAE,QAAQ,EAAE,KAAK,EAAE,GAAG,qBAAqB,CAAC,EAAE,KAAK,EAAE,EAAE,QAAQ,EAAE,IAAI,CAAC,CAAC;YAC7E,aAAa,CAAC,EAAE,QAAQ,EAAE,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC,CAAC;QAC3E,CAAC,CAAC,CAAC;QACL,OAAO,GAAG,EAAE;YACV,SAAS,GAAG,IAAI,CAAC;QACnB,CAAC,CAAC;QACF,4EAA4E;IAC9E,CAAC,EAAE,CAAC,KAAK,CAAC,EAAE,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,CAAC,CAAC,CAAC;IAEvC,OAAO,UAAU,CAAC;AACpB,CAAC"}

package/dist/runtime.d.ts

@@ -0,0 +1,17 @@
+/**
+ * ViewSpec composition runtime.
+ *
+ * Interprets a (model-authored, validated) ViewSpec into a React tree using the
+ * atom registry. Data binds resolve via the {@link ViewBridge} (free reads);
+ * write actions are wired to the bridge. Unknown atom ids / invalid specs
+ * degrade to the generic fallback — never crash, never `eval`.
+ */
+import { type ReactNode } from 'react';
+import { type ViewBridge } from './app-bridge/types.js';
+export { QUERY_TOOL, WRITE_TOOLS } from './tool-names.js';
+/** Top-level: validate an untrusted ViewSpec then render it, or show the error. */
+export declare function ViewSpecRenderer({ spec, bridge, }: {
+    spec: unknown;
+    bridge: ViewBridge;
+}): ReactNode;
+//# sourceMappingURL=runtime.d.ts.map

package/dist/runtime.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"runtime.d.ts","sourceRoot":"","sources":["../src/runtime.tsx"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,EAAgC,KAAK,SAAS,EAAE,MAAM,OAAO,CAAC;AASrE,OAAO,EAAE,KAAK,UAAU,EAAE,MAAM,uBAAuB,CAAC;AAqCxD,OAAO,EAAE,UAAU,EAAE,WAAW,EAAE,MAAM,iBAAiB,CAAC;AAqP1D,mFAAmF;AACnF,wBAAgB,gBAAgB,CAAC,EAC/B,IAAI,EACJ,MAAM,GACP,EAAE;IACD,IAAI,EAAE,OAAO,CAAC;IACd,MAAM,EAAE,UAAU,CAAC;CACpB,GAAG,SAAS,CAOZ"}

package/dist/runtime.js

@@ -0,0 +1,218 @@
+import { jsx as _jsx, Fragment as _Fragment, jsxs as _jsxs } from "react/jsx-runtime";
+/**
+ * ViewSpec composition runtime.
+ *
+ * Interprets a (model-authored, validated) ViewSpec into a React tree using the
+ * atom registry. Data binds resolve via the {@link ViewBridge} (free reads);
+ * write actions are wired to the bridge. Unknown atom ids / invalid specs
+ * degrade to the generic fallback — never crash, never `eval`.
+ */
+import { useEffect, useMemo, useState } from 'react';
+import { extractUiResource, GenerativeFallbackRenderer, RendererPinStore, } from '@toon-protocol/client/render';
+import {} from './types.js';
+import {} from './app-bridge/types.js';
+import { validateViewSpec, } from './spec.js';
+import { ATOMS, ATOM_IDS, buildKindRegistry, fallbackAtomFor, } from './atoms/registry.js';
+import {} from './atoms/types.js';
+import { useRenderDecision } from './render/resolve.js';
+import { A2UIRenderer } from './a2ui/A2UIRenderer.js';
+import { SandboxedAppRenderer } from './mcp-ui/SandboxedAppRenderer.js';
+import { DEFAULT_MCP_UI_SANDBOX_URL } from './mcp-ui/sandbox.js';
+import { QUERY_TOOL, STATUS_TOOL, WRITE_TOOLS } from './tool-names.js';
+/**
+ * Session-scoped render-gradient state. Built once per bundle load:
+ *   - the branch-1 native {@link KindRegistry} of atoms, and
+ *   - the anti-swap {@link RendererPinStore} that pins each coordinate's chosen
+ *     renderer for the life of the session (the swap-defense's V4 guard).
+ * Both are stable across renders so `guardedRenderDispatch` sees a consistent
+ * registry/pin store and the swap-defense pins persist.
+ */
+const KIND_REGISTRY = buildKindRegistry();
+const RENDERER_PINS = new RendererPinStore();
+/**
+ * The branch-4 generative fallback. Uses the deterministic generator (no model
+ * is wired in the app yet — the injected-generator seam stays available) and
+ * publish-back stays OFF (no `publish` option). See toon-meta#58.
+ */
+const GENERATIVE_FALLBACK = new GenerativeFallbackRenderer();
+// Re-export so existing importers (and tests) can keep importing from the runtime.
+export { QUERY_TOOL, WRITE_TOOLS } from './tool-names.js';
+function useBind(bind, bridge) {
+    const [events, setEvents] = useState([]);
+    const bindKey = bind ? JSON.stringify(bind) : '';
+    useEffect(() => {
+        const filter = bind?.query ?? (bind?.eventId ? { ids: [bind.eventId] } : undefined);
+        if (!filter) {
+            setEvents([]);
+            return;
+        }
+        let cancelled = false;
+        void bridge.callTool(QUERY_TOOL, { filter }).then((res) => {
+            if (!cancelled && res.events)
+                setEvents(res.events);
+        });
+        return () => {
+            cancelled = true;
+        };
+        // bindKey captures the (serialized) bind; bridge is stable for a session.
+        // eslint-disable-next-line react-hooks/exhaustive-deps
+    }, [bindKey, bridge]);
+    return events;
+}
+function buildActions(node, bridge) {
+    const actions = {};
+    for (const [name, ref] of Object.entries(node.actions ?? {})) {
+        actions[name] = async (runtimeArgs) => {
+            const args = { ...(ref.args ?? {}), ...(runtimeArgs ?? {}) };
+            if (ref.spendy) {
+                const label = ref.confirmLabel ?? 'This action spends to publish. Continue?';
+                // Fallback is browser-only; auto-approves in Worker/SSR environments where window is absent.
+                const confirmFn = bridge.confirm ??
+                    ((msg) => Promise.resolve(typeof window !== 'undefined' ? !!window.confirm(msg) : true));
+                const ok = await confirmFn(label);
+                if (!ok) {
+                    bridge.notifyModel(`Action "${name}" cancelled.`);
+                    return { ok: false, error: 'cancelled' };
+                }
+                args['spendy'] = true;
+            }
+            const res = await bridge.callTool(ref.tool, args);
+            bridge.notifyModel(res.ok ? `Action "${name}" completed.` : `Action "${name}" failed: ${res.error ?? 'unknown'}`);
+            // Surface the real published id so atoms can render an accurate receipt.
+            // The publish/upload tools return `{ eventId, … }` as `structuredContent`,
+            // which the bridge carries on `ToolOutcome.data`.
+            const eventId = res.data && typeof res.data === 'object' && 'eventId' in res.data
+                ? String(res.data.eventId)
+                : undefined;
+            return {
+                ok: res.ok,
+                ...(eventId ? { eventId } : {}),
+                ...(res.data !== undefined ? { data: res.data } : {}),
+                ...(res.error ? { error: res.error } : {}),
+            };
+        };
+    }
+    return actions;
+}
+/** Render an event with a resolved branch-1 native atom (full trust). */
+function NativeEvent({ atom, event, bridge }) {
+    const Component = atom.Component;
+    return (_jsx(Component, { events: [event], props: {}, actions: {}, renderEvent: (e) => _jsx(EventAtom, { event: e, bridge: bridge }, e.id), children: null }));
+}
+/** Branch 4 — generative fallback (low trust). Renders the deterministic HTML. */
+function GenerativeEvent({ event }) {
+    const [result, setResult] = useState(null);
+    useEffect(() => {
+        let cancelled = false;
+        void GENERATIVE_FALLBACK.render(event).then((r) => {
+            if (!cancelled)
+                setResult(r);
+        });
+        return () => {
+            cancelled = true;
+        };
+    }, [event]);
+    if (!result) {
+        return _jsx("div", { className: "p-2 text-xs text-muted-foreground", children: "Rendering\u2026" });
+    }
+    // The deterministic generator emits trusted, host-built HTML (no widget code);
+    // it is safe to render directly. (A model-backed generator would route through
+    // the sandbox like branch 3 — not wired in the app yet.)
+    return (_jsx("div", { "data-branch": "generative", "data-trust": result.trust, dangerouslySetInnerHTML: { __html: result.rendered.html } }));
+}
+/** Adapt the app bridge into the branch-3 `onPerform` (authorized tool runner). */
+function bridgePerformTool(bridge) {
+    return async (toolName, args) => {
+        const res = await bridge.callTool(toolName, args);
+        return {
+            ...(res.error ? { isError: true } : {}),
+            content: [{ type: 'text', text: res.error ?? 'ok' }],
+            ...(res.data !== undefined ? { structuredContent: res.data } : {}),
+        };
+    };
+}
+/**
+ * Render a single incoming event through the NIP-on-TOON render trust gradient
+ * (feeds / kindAuto). Branch 1 (known kind) renders the native atom; branches
+ * 2/3/4 render through the resolved `kind:31036` renderer (A2UI / sandboxed
+ * mcp-ui) or the generative fallback — guarded by the swap-defense + consent.
+ */
+function EventAtom({ event, bridge }) {
+    const { decision, loading } = useRenderDecision(event, bridge, KIND_REGISTRY, RENDERER_PINS);
+    const performTool = useMemo(() => bridgePerformTool(bridge), [bridge]);
+    if (loading || decision === null) {
+        return _jsx("div", { className: "p-2 text-xs text-muted-foreground", children: "Resolving renderer\u2026" });
+    }
+    switch (decision.branch) {
+        case 'native':
+            return _jsx(NativeEvent, { atom: decision.component, event: event, bridge: bridge });
+        case 'a2ui':
+            // Branch 2: medium trust. On a gate refusal the renderer signals fallback;
+            // drop to the generative branch (per the gate's signal) so a refused A2UI
+            // surface still renders something safe rather than nothing.
+            return (_jsx(A2UIBranch, { renderer: decision.renderer, event: event }));
+        case 'mcp-ui':
+            // Branch 3: low trust, sandboxed iframe + host-rendered consent prompt.
+            return _jsx(McpUiBranch, { renderer: decision.renderer, event: event, performTool: performTool });
+        case 'generative':
+            // Branch 4: low trust, generative fallback (deterministic; no model wired).
+            return _jsx(GenerativeEvent, { event: event });
+        default:
+            return _jsx(GenerativeEvent, { event: event });
+    }
+}
+/** Branch 2 wrapper: render A2UI, falling back to generative on a gate refusal. */
+function A2UIBranch({ renderer, event }) {
+    const [refused, setRefused] = useState(false);
+    if (refused)
+        return _jsx(GenerativeEvent, { event: event });
+    return _jsx(A2UIRenderer, { renderer: renderer, event: event, onFallback: () => setRefused(true) });
+}
+/** Branch 3 wrapper: extract the widget resource and render it sandboxed. */
+function McpUiBranch({ renderer, event, performTool, }) {
+    const resource = useMemo(() => extractUiResource(renderer), [renderer]);
+    // A renderer that doesn't yield a usable widget resource falls back to branch 4.
+    if (!resource)
+        return _jsx(GenerativeEvent, { event: event });
+    return (_jsx(SandboxedAppRenderer, { resource: resource, sandboxUrl: new URL(DEFAULT_MCP_UI_SANDBOX_URL), onPerform: performTool }));
+}
+/** Read the live pay-to-write status (`toon_status`) for the fee-confirm UX. */
+function buildReadStatus(bridge) {
+    return async () => {
+        const res = await bridge.callTool(STATUS_TOOL, {});
+        const data = (res.data ?? {});
+        // Throw so the atom catches it as statusError=true and disables Confirm — never
+        // silently show '0' for a non-zero charge.
+        if (typeof data.feePerEvent !== 'string' || !data.feePerEvent) {
+            throw new Error('fee unavailable');
+        }
+        return {
+            feePerEvent: data.feePerEvent,
+            settlementChain: typeof data.settlementChain === 'string' ? data.settlementChain : 'unknown',
+            ...(typeof data.asset === 'string' ? { asset: data.asset } : {}),
+        };
+    };
+}
+function NodeView({ node, bridge }) {
+    const atom = ATOMS.get(node.atom) ?? fallbackAtomFor();
+    const events = useBind(node.bind, bridge);
+    const actions = useMemo(() => buildActions(node, bridge), [node, bridge]);
+    const readStatus = useMemo(() => buildReadStatus(bridge), [bridge]);
+    if (node.bind?.kindAuto) {
+        return _jsx(_Fragment, { children: events.map((e) => _jsx(EventAtom, { event: e, bridge: bridge }, e.id)) });
+    }
+    const Component = atom.Component;
+    return (_jsx(Component, { events: events, props: node.props ?? {}, actions: actions, readStatus: readStatus, renderEvent: (e) => _jsx(EventAtom, { event: e, bridge: bridge }, e.id), children: node.children?.map((child, i) => _jsx(NodeView, { node: child, bridge: bridge }, i)) }));
+}
+/** Renders an invalid spec's errors without leaking internals to the user. */
+function InvalidSpec({ errors }) {
+    return (_jsxs("div", { className: "rounded-md border border-destructive/40 bg-destructive/5 p-3 text-sm", children: [_jsx("div", { className: "font-medium", children: "This view could not be rendered." }), _jsx("ul", { className: "mt-1 list-disc pl-5 text-xs text-muted-foreground", children: errors.slice(0, 5).map((e, i) => (_jsx("li", { children: e }, i))) })] }));
+}
+/** Top-level: validate an untrusted ViewSpec then render it, or show the error. */
+export function ViewSpecRenderer({ spec, bridge, }) {
+    const result = useMemo(() => validateViewSpec(spec, { allowedAtoms: ATOM_IDS, allowedTools: WRITE_TOOLS }), [spec]);
+    if (!result.ok)
+        return _jsx(InvalidSpec, { errors: result.errors });
+    return _jsx(NodeView, { node: result.spec.root, bridge: bridge });
+}
+//# sourceMappingURL=runtime.js.map

package/dist/runtime.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"runtime.js","sourceRoot":"","sources":["../src/runtime.tsx"],"names":[],"mappings":";AAAA;;;;;;;GAOG;AAEH,OAAO,EAAE,SAAS,EAAE,OAAO,EAAE,QAAQ,EAAkB,MAAM,OAAO,CAAC;AACrE,OAAO,EACL,iBAAiB,EACjB,0BAA0B,EAC1B,gBAAgB,GAEjB,MAAM,8BAA8B,CAAC;AAEtC,OAAO,EAAmB,MAAM,YAAY,CAAC;AAC7C,OAAO,EAAmB,MAAM,uBAAuB,CAAC;AACxD,OAAO,EAGL,gBAAgB,GACjB,MAAM,WAAW,CAAC;AACnB,OAAO,EACL,KAAK,EACL,QAAQ,EACR,iBAAiB,EACjB,eAAe,GAChB,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EAAmE,MAAM,kBAAkB,CAAC;AACnG,OAAO,EAAE,iBAAiB,EAAE,MAAM,qBAAqB,CAAC;AACxD,OAAO,EAAE,YAAY,EAAE,MAAM,wBAAwB,CAAC;AACtD,OAAO,EAAE,oBAAoB,EAAE,MAAM,kCAAkC,CAAC;AACxE,OAAO,EAAE,0BAA0B,EAAE,MAAM,qBAAqB,CAAC;AACjE,OAAO,EAAE,UAAU,EAAE,WAAW,EAAE,WAAW,EAAE,MAAM,iBAAiB,CAAC;AAEvE;;;;;;;GAOG;AACH,MAAM,aAAa,GAAG,iBAAiB,EAAE,CAAC;AAC1C,MAAM,aAAa,GAAG,IAAI,gBAAgB,EAAE,CAAC;AAC7C;;;;GAIG;AACH,MAAM,mBAAmB,GAAG,IAAI,0BAA0B,EAAE,CAAC;AAE7D,mFAAmF;AACnF,OAAO,EAAE,UAAU,EAAE,WAAW,EAAE,MAAM,iBAAiB,CAAC;AAE1D,SAAS,OAAO,CAAC,IAA0B,EAAE,MAAkB;IAC7D,MAAM,CAAC,MAAM,EAAE,SAAS,CAAC,GAAG,QAAQ,CAAe,EAAE,CAAC,CAAC;IACvD,MAAM,OAAO,GAAG,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IAEjD,SAAS,CAAC,GAAG,EAAE;QACb,MAAM,MAAM,GAAG,IAAI,EAAE,KAAK,IAAI,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;QACpF,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,SAAS,CAAC,EAAE,CAAC,CAAC;YACd,OAAO;QACT,CAAC;QACD,IAAI,SAAS,GAAG,KAAK,CAAC;QACtB,KAAK,MAAM,CAAC,QAAQ,CAAC,UAAU,EAAE,EAAE,MAAM,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,GAAG,EAAE,EAAE;YACxD,IAAI,CAAC,SAAS,IAAI,GAAG,CAAC,MAAM;gBAAE,SAAS,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;QACtD,CAAC,CAAC,CAAC;QACH,OAAO,GAAG,EAAE;YACV,SAAS,GAAG,IAAI,CAAC;QACnB,CAAC,CAAC;QACF,0EAA0E;QAC1E,uDAAuD;IACzD,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC,CAAC;IAEtB,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,SAAS,YAAY,CAAC,IAAc,EAAE,MAAkB;IACtD,MAAM,OAAO,GAA+B,EAAE,CAAC;IAC/C,KAAK,MAAM,CAAC,IAAI,EAAE,GAAG,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,OAAO,IAAI,EAAE,CAAC,EAAE,CAAC;QAC7D,OAAO,CAAC,IAAI,CAAC,GAAG,KAAK,EAAE,WAAW,EAA0B,EAAE;YAC5D,MAAM,IAAI,GAA4B,EAAE,GAAG,CAAC,GAAG,CAAC,IAAI,IAAI,EAAE,CAAC,EAAE,GAAG,CAAC,WAAW,IAAI,EAAE,CAAC,EAAE,CAAC;YACtF,IAAI,GAAG,CAAC,MAAM,EAAE,CAAC;gBACf,MAAM,KAAK,GAAG,GAAG,CAAC,YAAY,IAAI,0CAA0C,CAAC;gBAC7E,6FAA6F;gBAC7F,MAAM,SAAS,GACb,MAAM,CAAC,OAAO;oBACd,CAAC,CAAC,GAAW,EAAE,EAAE,CACf,OAAO,CAAC,OAAO,CAAC,OAAO,MAAM,KAAK,WAAW,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC;gBACnF,MAAM,EAAE,GAAG,MAAM,SAAS,CAAC,KAAK,CAAC,CAAC;gBAClC,IAAI,CAAC,EAAE,EAAE,CAAC;oBACR,MAAM,CAAC,WAAW,CAAC,WAAW,IAAI,cAAc,CAAC,CAAC;oBAClD,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,WAAW,EAAE,CAAC;gBAC3C,CAAC;gBACD,IAAI,CAAC,QAAQ,CAAC,GAAG,IAAI,CAAC;YACxB,CAAC;YACD,MAAM,GAAG,GAAG,MAAM,MAAM,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;YAClD,MAAM,CAAC,WAAW,CAChB,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC,WAAW,IAAI,cAAc,CAAC,CAAC,CAAC,WAAW,IAAI,aAAa,GAAG,CAAC,KAAK,IAAI,SAAS,EAAE,CAC9F,CAAC;YACF,yEAAyE;YACzE,2EAA2E;YAC3E,kDAAkD;YAClD,MAAM,OAAO,GACX,GAAG,CAAC,IAAI,IAAI,OAAO,GAAG,CAAC,IAAI,KAAK,QAAQ,IAAI,SAAS,IAAI,GAAG,CAAC,IAAI;gBAC/D,CAAC,CAAC,MAAM,CAAE,GAAG,CAAC,IAA6B,CAAC,OAAO,CAAC;gBACpD,CAAC,CAAC,SAAS,CAAC;YAChB,OAAO;gBACL,EAAE,EAAE,GAAG,CAAC,EAAE;gBACV,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBAC/B,GAAG,CAAC,GAAG,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,GAAG,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBACrD,GAAG,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,GAAG,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;aAC3C,CAAC;QACJ,CAAC,CAAC;IACJ,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,yEAAyE;AACzE,SAAS,WAAW,CAAC,EAAE,IAAI,EAAE,KAAK,EAAE,MAAM,EAAyD;IACjG,MAAM,SAAS,GAAG,IAAI,CAAC,SAAS,CAAC;IACjC,OAAO,CACL,KAAC,SAAS,IACR,MAAM,EAAE,CAAC,KAAK,CAAC,EACf,KAAK,EAAE,EAAE,EACT,OAAO,EAAE,EAAE,EACX,WAAW,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,KAAC,SAAS,IAAY,KAAK,EAAE,CAAC,EAAE,MAAM,EAAE,MAAM,IAA9B,CAAC,CAAC,EAAE,CAA8B,YAErE,IAAI,GACK,CACb,CAAC;AACJ,CAAC;AAED,kFAAkF;AAClF,SAAS,eAAe,CAAC,EAAE,KAAK,EAAyB;IACvD,MAAM,CAAC,MAAM,EAAE,SAAS,CAAC,GAAG,QAAQ,CAAkC,IAAI,CAAC,CAAC;IAC5E,SAAS,CAAC,GAAG,EAAE;QACb,IAAI,SAAS,GAAG,KAAK,CAAC;QACtB,KAAK,mBAAmB,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE;YAChD,IAAI,CAAC,SAAS;gBAAE,SAAS,CAAC,CAAC,CAAC,CAAC;QAC/B,CAAC,CAAC,CAAC;QACH,OAAO,GAAG,EAAE;YACV,SAAS,GAAG,IAAI,CAAC;QACnB,CAAC,CAAC;IACJ,CAAC,EAAE,CAAC,KAAK,CAAC,CAAC,CAAC;IAEZ,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,OAAO,cAAK,SAAS,EAAC,mCAAmC,gCAAiB,CAAC;IAC7E,CAAC;IACD,+EAA+E;IAC/E,+EAA+E;IAC/E,yDAAyD;IACzD,OAAO,CACL,6BACc,YAAY,gBACZ,MAAM,CAAC,KAAK,EACxB,uBAAuB,EAAE,EAAE,MAAM,EAAE,MAAM,CAAC,QAAQ,CAAC,IAAI,EAAE,GACzD,CACH,CAAC;AACJ,CAAC;AAED,mFAAmF;AACnF,SAAS,iBAAiB,CACxB,MAAkB;IAElB,OAAO,KAAK,EAAE,QAAQ,EAAE,IAAI,EAAE,EAAE;QAC9B,MAAM,GAAG,GAAG,MAAM,MAAM,CAAC,QAAQ,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAC;QAClD,OAAO;YACL,GAAG,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACvC,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,GAAG,CAAC,KAAK,IAAI,IAAI,EAAE,CAAC;YACpD,GAAG,CAAC,GAAG,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,iBAAiB,EAAE,GAAG,CAAC,IAA+B,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SAC9F,CAAC;IACJ,CAAC,CAAC;AACJ,CAAC;AAED;;;;;GAKG;AACH,SAAS,SAAS,CAAC,EAAE,KAAK,EAAE,MAAM,EAA6C;IAC7E,MAAM,EAAE,QAAQ,EAAE,OAAO,EAAE,GAAG,iBAAiB,CAAC,KAAK,EAAE,MAAM,EAAE,aAAa,EAAE,aAAa,CAAC,CAAC;IAC7F,MAAM,WAAW,GAAG,OAAO,CAAC,GAAG,EAAE,CAAC,iBAAiB,CAAC,MAAM,CAAC,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC;IAEvE,IAAI,OAAO,IAAI,QAAQ,KAAK,IAAI,EAAE,CAAC;QACjC,OAAO,cAAK,SAAS,EAAC,mCAAmC,yCAA0B,CAAC;IACtF,CAAC;IAED,QAAQ,QAAQ,CAAC,MAAM,EAAE,CAAC;QACxB,KAAK,QAAQ;YACX,OAAO,KAAC,WAAW,IAAC,IAAI,EAAE,QAAQ,CAAC,SAAS,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,GAAI,CAAC;QACjF,KAAK,MAAM;YACT,2EAA2E;YAC3E,0EAA0E;YAC1E,4DAA4D;YAC5D,OAAO,CACL,KAAC,UAAU,IAAC,QAAQ,EAAE,QAAQ,CAAC,QAAQ,EAAE,KAAK,EAAE,KAAK,GAAI,CAC1D,CAAC;QACJ,KAAK,QAAQ;YACX,wEAAwE;YACxE,OAAO,KAAC,WAAW,IAAC,QAAQ,EAAE,QAAQ,CAAC,QAAQ,EAAE,KAAK,EAAE,KAAK,EAAE,WAAW,EAAE,WAAW,GAAI,CAAC;QAC9F,KAAK,YAAY;YACf,4EAA4E;YAC5E,OAAO,KAAC,eAAe,IAAC,KAAK,EAAE,KAAK,GAAI,CAAC;QAC3C;YACE,OAAO,KAAC,eAAe,IAAC,KAAK,EAAE,KAAK,GAAI,CAAC;IAC7C,CAAC;AACH,CAAC;AAED,mFAAmF;AACnF,SAAS,UAAU,CAAC,EAAE,QAAQ,EAAE,KAAK,EAA+C;IAClF,MAAM,CAAC,OAAO,EAAE,UAAU,CAAC,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAC;IAC9C,IAAI,OAAO;QAAE,OAAO,KAAC,eAAe,IAAC,KAAK,EAAE,KAAK,GAAI,CAAC;IACtD,OAAO,KAAC,YAAY,IAAC,QAAQ,EAAE,QAAQ,EAAE,KAAK,EAAE,KAAK,EAAE,UAAU,EAAE,GAAG,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC,GAAI,CAAC;AAChG,CAAC;AAED,6EAA6E;AAC7E,SAAS,WAAW,CAAC,EACnB,QAAQ,EACR,KAAK,EACL,WAAW,GAKZ;IACC,MAAM,QAAQ,GAAG,OAAO,CAAC,GAAG,EAAE,CAAC,iBAAiB,CAAC,QAAQ,CAAC,EAAE,CAAC,QAAQ,CAAC,CAAC,CAAC;IACxE,iFAAiF;IACjF,IAAI,CAAC,QAAQ;QAAE,OAAO,KAAC,eAAe,IAAC,KAAK,EAAE,KAAK,GAAI,CAAC;IACxD,OAAO,CACL,KAAC,oBAAoB,IACnB,QAAQ,EAAE,QAAQ,EAClB,UAAU,EAAE,IAAI,GAAG,CAAC,0BAA0B,CAAC,EAC/C,SAAS,EAAE,WAAW,GACtB,CACH,CAAC;AACJ,CAAC;AAED,gFAAgF;AAChF,SAAS,eAAe,CAAC,MAAkB;IACzC,OAAO,KAAK,IAAI,EAAE;QAChB,MAAM,GAAG,GAAG,MAAM,MAAM,CAAC,QAAQ,CAAC,WAAW,EAAE,EAAE,CAAC,CAAC;QACnD,MAAM,IAAI,GAAG,CAAC,GAAG,CAAC,IAAI,IAAI,EAAE,CAAwB,CAAC;QACrD,gFAAgF;QAChF,2CAA2C;QAC3C,IAAI,OAAO,IAAI,CAAC,WAAW,KAAK,QAAQ,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC;YAC9D,MAAM,IAAI,KAAK,CAAC,iBAAiB,CAAC,CAAC;QACrC,CAAC;QACD,OAAO;YACL,WAAW,EAAE,IAAI,CAAC,WAAW;YAC7B,eAAe,EACb,OAAO,IAAI,CAAC,eAAe,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC,CAAC,SAAS;YAC7E,GAAG,CAAC,OAAO,IAAI,CAAC,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SACjE,CAAC;IACJ,CAAC,CAAC;AACJ,CAAC;AAED,SAAS,QAAQ,CAAC,EAAE,IAAI,EAAE,MAAM,EAA0C;IACxE,MAAM,IAAI,GAAG,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,eAAe,EAAE,CAAC;IACvD,MAAM,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;IAC1C,MAAM,OAAO,GAAG,OAAO,CAAC,GAAG,EAAE,CAAC,YAAY,CAAC,IAAI,EAAE,MAAM,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC,CAAC;IAC1E,MAAM,UAAU,GAAG,OAAO,CAAC,GAAG,EAAE,CAAC,eAAe,CAAC,MAAM,CAAC,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC;IAEpE,IAAI,IAAI,CAAC,IAAI,EAAE,QAAQ,EAAE,CAAC;QACxB,OAAO,4BAAG,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,KAAC,SAAS,IAAY,KAAK,EAAE,CAAC,EAAE,MAAM,EAAE,MAAM,IAA9B,CAAC,CAAC,EAAE,CAA8B,CAAC,GAAI,CAAC;IACtF,CAAC;IAED,MAAM,SAAS,GAAG,IAAI,CAAC,SAAS,CAAC;IACjC,OAAO,CACL,KAAC,SAAS,IACR,MAAM,EAAE,MAAM,EACd,KAAK,EAAE,IAAI,CAAC,KAAK,IAAI,EAAE,EACvB,OAAO,EAAE,OAAO,EAChB,UAAU,EAAE,UAAU,EACtB,WAAW,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,KAAC,SAAS,IAAY,KAAK,EAAE,CAAC,EAAE,MAAM,EAAE,MAAM,IAA9B,CAAC,CAAC,EAAE,CAA8B,YAErE,IAAI,CAAC,QAAQ,EAAE,GAAG,CAAC,CAAC,KAAK,EAAE,CAAC,EAAE,EAAE,CAAC,KAAC,QAAQ,IAAS,IAAI,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,IAA9B,CAAC,CAAiC,CAAC,GAC1E,CACb,CAAC;AACJ,CAAC;AAED,8EAA8E;AAC9E,SAAS,WAAW,CAAC,EAAE,MAAM,EAAwB;IACnD,OAAO,CACL,eAAK,SAAS,EAAC,sEAAsE,aACnF,cAAK,SAAS,EAAC,aAAa,iDAAuC,EACnE,aAAI,SAAS,EAAC,mDAAmD,YAC9D,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAChC,uBAAa,CAAC,IAAL,CAAC,CAAU,CACrB,CAAC,GACC,IACD,CACP,CAAC;AACJ,CAAC;AAED,mFAAmF;AACnF,MAAM,UAAU,gBAAgB,CAAC,EAC/B,IAAI,EACJ,MAAM,GAIP;IACC,MAAM,MAAM,GAAG,OAAO,CACpB,GAAG,EAAE,CAAC,gBAAgB,CAAC,IAAI,EAAE,EAAE,YAAY,EAAE,QAAQ,EAAE,YAAY,EAAE,WAAW,EAAE,CAAC,EACnF,CAAC,IAAI,CAAC,CACP,CAAC;IACF,IAAI,CAAC,MAAM,CAAC,EAAE;QAAE,OAAO,KAAC,WAAW,IAAC,MAAM,EAAE,MAAM,CAAC,MAAM,GAAI,CAAC;IAC9D,OAAO,KAAC,QAAQ,IAAC,IAAI,EAAE,MAAM,CAAC,IAAI,CAAC,IAAI,EAAE,MAAM,EAAE,MAAM,GAAI,CAAC;AAC9D,CAAC"}

package/dist/server/apps-server.d.ts

@@ -0,0 +1,32 @@
+/**
+ * Registers the TOON apps surface on an MCP server: the single `ui://toon/app`
+ * UI resource plus the tools the agent uses to drive a generative user journey.
+ *
+ * The journey loop:
+ *   1. agent → `toon_atoms`  (discover the atom vocabulary)
+ *   2. agent → `toon_render(spec)`  (compose a ViewSpec; rides back as the tool
+ *      result, and the tool's `_meta.ui.resourceUri` makes the host render the
+ *      app bundle with it)
+ *   3. iframe → `toon_query(filter)`  (free reads, fed into atoms)
+ *   4. iframe → `toon_publish_unsigned` / `toon_upload_media`  (writes)
+ *   5. iframe → updateModelContext → agent composes the next ViewSpec
+ *
+ * ViewSpecs are model-authored → validated here (server side) before they are
+ * echoed back, in addition to the iframe runtime's own validation.
+ */
+import type { McpServer } from '@modelcontextprotocol/sdk/server/mcp.js';
+import { type AppBackend } from './backend.js';
+export interface RegisterToonAppsOptions {
+    /** Read/write backend (fake for the demo; real daemon later). */
+    backend: AppBackend;
+    /** The self-contained app bundle HTML (served as the `ui://toon/app` resource). */
+    appHtml: string;
+    /** Domains to allow in the iframe CSP (Arweave gateway, relay origin, …). */
+    cspDomains?: {
+        connect?: string[];
+        resource?: string[];
+    };
+}
+/** Register the `ui://toon/app` resource + the generative-UI tools. */
+export declare function registerToonApps(server: McpServer, opts: RegisterToonAppsOptions): void;
+//# sourceMappingURL=apps-server.d.ts.map

package/dist/server/apps-server.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"apps-server.d.ts","sourceRoot":"","sources":["../../src/server/apps-server.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAGH,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,yCAAyC,CAAC;AAuBzE,OAAO,EAAE,KAAK,UAAU,EAAoB,MAAM,cAAc,CAAC;AAEjE,MAAM,WAAW,uBAAuB;IACtC,iEAAiE;IACjE,OAAO,EAAE,UAAU,CAAC;IACpB,mFAAmF;IACnF,OAAO,EAAE,MAAM,CAAC;IAChB,6EAA6E;IAC7E,UAAU,CAAC,EAAE;QAAE,OAAO,CAAC,EAAE,MAAM,EAAE,CAAC;QAAC,QAAQ,CAAC,EAAE,MAAM,EAAE,CAAA;KAAE,CAAC;CAC1D;AAaD,uEAAuE;AACvE,wBAAgB,gBAAgB,CAAC,MAAM,EAAE,SAAS,EAAE,IAAI,EAAE,uBAAuB,GAAG,IAAI,CAkMvF"}