agentic-zi-ui-schema 0.0.2 → 0.1.0

package/README.md

@@ -0,0 +1,9 @@
+# agentic-zi-ui-schema
+
+Shared schema contracts for safe server-driven widgets.
+
+- `UiTemplateSchema`: strict UI DSL validation
+- `UiActionSchema`: safe event actions
+- `WidgetRegistrationRequestSchema`: server registration input
+- `AgenticWidgetSchema`: server -> renderer contract
+- hard guard helpers: `countNodes`, `assertWithinLimits`

package/dist/index.d.ts

@@ -14,7 +14,7 @@ export declare const UI_LIMITS: {
     readonly MAX_URL_LEN: 2000;
     readonly MAX_KEY_LEN: 200;
 };
-export declare const UI_ALLOWED_TAGS: readonly ["a", "article", "aside", "blockquote", "br", "button", "code", "div", "em", "figcaption", "figure", "fieldset", "footer", "form", "h1", "h2", "h3", "h4", "header", "hr", "img", "input", "label", "li", "main", "nav", "ol", "option", "p", "path", "pre", "section", "select", "small", "span", "strong", "svg", "table", "tbody", "td", "textarea", "tfoot", "th", "thead", "tr", "ul"];
+export declare const UI_ALLOWED_TAGS: readonly ["repeat", "a", "article", "aside", "blockquote", "br", "button", "code", "div", "em", "figcaption", "figure", "fieldset", "footer", "form", "h1", "h2", "h3", "h4", "header", "hr", "img", "input", "label", "li", "main", "nav", "ol", "option", "p", "path", "pre", "section", "select", "small", "span", "strong", "svg", "table", "tbody", "td", "textarea", "tfoot", "th", "thead", "tr", "ul"];
 export declare const UI_ALLOWED_PROPS: readonly ["alt", "aria-label", "aria-controls", "aria-current", "aria-describedby", "aria-disabled", "aria-expanded", "aria-hidden", "aria-invalid", "aria-labelledby", "aria-live", "aria-pressed", "aria-required", "aria-selected", "aria-checked", "aria-valuemax", "aria-valuemin", "aria-valuenow", "aria-valuetext", "aria-busy", "checked", "clipRule", "cols", "cx", "cy", "d", "decoding", "disabled", "fill", "fillRule", "height", "htmlFor", "href", "loading", "max", "maxLength", "min", "minLength", "name", "opacity", "placeholder", "preserveAspectRatio", "rel", "role", "r", "rows", "src", "stroke", "strokeLinecap", "strokeLinejoin", "strokeWidth", "step", "target", "title", "type", "value", "viewBox", "width", "x", "y"];
 export declare const UI_ALLOWED_EVENTS: readonly ["onClick", "onChange", "onSubmit", "onMouseEnter", "onMouseLeave", "onMouseOver", "onMouseOut", "onMouseDown", "onMouseUp", "onMouseMove", "onFocus", "onBlur"];
 export declare const UiActionTypeSchema: z.ZodEnum<["FLOW_EVENT", "OPEN_URL", "COPY", "TOAST", "PATCH_STATE"]>;
@@ -1578,4 +1578,448 @@ export declare function countNodes(root: UiNode): {
     depth: number;
 };
 export declare function assertWithinLimits(template: UiTemplate): void;
+export declare const WidgetMetadataSchema: z.ZodObject<{
+    name: z.ZodString;
+    description: z.ZodOptional<z.ZodString>;
+    tags: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
+}, "strict", z.ZodTypeAny, {
+    name: string;
+    description?: string | undefined;
+    tags?: string[] | undefined;
+}, {
+    name: string;
+    description?: string | undefined;
+    tags?: string[] | undefined;
+}>;
+export type WidgetMetadata = z.infer<typeof WidgetMetadataSchema>;
+export declare const WidgetStylesheetSchema: z.ZodOptional<z.ZodObject<{
+    styleId: z.ZodOptional<z.ZodString>;
+    cssText: z.ZodOptional<z.ZodString>;
+    cssUrl: z.ZodOptional<z.ZodString>;
+    classList: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
+}, "strict", z.ZodTypeAny, {
+    styleId?: string | undefined;
+    cssText?: string | undefined;
+    cssUrl?: string | undefined;
+    classList?: string[] | undefined;
+}, {
+    styleId?: string | undefined;
+    cssText?: string | undefined;
+    cssUrl?: string | undefined;
+    classList?: string[] | undefined;
+}>>;
+export type WidgetStylesheet = z.infer<typeof WidgetStylesheetSchema>;
+export declare const AgenticWidgetSchema: z.ZodObject<{
+    schema: z.ZodLiteral<"agentic.widget.v1">;
+    widgetId: z.ZodString;
+    template: z.ZodObject<{
+        schema: z.ZodLiteral<"ui.v1">;
+        root: z.ZodType<any, z.ZodTypeDef, any>;
+    }, "strict", z.ZodTypeAny, {
+        schema: "ui.v1";
+        root?: any;
+    }, {
+        schema: "ui.v1";
+        root?: any;
+    }>;
+    data: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodUnknown>>;
+    metadata: z.ZodOptional<z.ZodObject<{
+        name: z.ZodString;
+        description: z.ZodOptional<z.ZodString>;
+        tags: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
+    }, "strict", z.ZodTypeAny, {
+        name: string;
+        description?: string | undefined;
+        tags?: string[] | undefined;
+    }, {
+        name: string;
+        description?: string | undefined;
+        tags?: string[] | undefined;
+    }>>;
+    policy: z.ZodOptional<z.ZodObject<{
+        allowedTags: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
+        allowedProps: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
+        allowedActions: z.ZodOptional<z.ZodArray<z.ZodEnum<["FLOW_EVENT", "OPEN_URL", "COPY", "TOAST", "PATCH_STATE"]>, "many">>;
+        maxNodes: z.ZodOptional<z.ZodNumber>;
+        maxDepth: z.ZodOptional<z.ZodNumber>;
+    }, "strict", z.ZodTypeAny, {
+        allowedTags?: string[] | undefined;
+        allowedProps?: string[] | undefined;
+        allowedActions?: ("FLOW_EVENT" | "OPEN_URL" | "COPY" | "TOAST" | "PATCH_STATE")[] | undefined;
+        maxNodes?: number | undefined;
+        maxDepth?: number | undefined;
+    }, {
+        allowedTags?: string[] | undefined;
+        allowedProps?: string[] | undefined;
+        allowedActions?: ("FLOW_EVENT" | "OPEN_URL" | "COPY" | "TOAST" | "PATCH_STATE")[] | undefined;
+        maxNodes?: number | undefined;
+        maxDepth?: number | undefined;
+    }>>;
+    stylesheet: z.ZodOptional<z.ZodObject<{
+        styleId: z.ZodOptional<z.ZodString>;
+        cssText: z.ZodOptional<z.ZodString>;
+        cssUrl: z.ZodOptional<z.ZodString>;
+        classList: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
+    }, "strict", z.ZodTypeAny, {
+        styleId?: string | undefined;
+        cssText?: string | undefined;
+        cssUrl?: string | undefined;
+        classList?: string[] | undefined;
+    }, {
+        styleId?: string | undefined;
+        cssText?: string | undefined;
+        cssUrl?: string | undefined;
+        classList?: string[] | undefined;
+    }>>;
+}, "strict", z.ZodTypeAny, {
+    widgetId: string;
+    schema: "agentic.widget.v1";
+    template: {
+        schema: "ui.v1";
+        root?: any;
+    };
+    policy?: {
+        allowedTags?: string[] | undefined;
+        allowedProps?: string[] | undefined;
+        allowedActions?: ("FLOW_EVENT" | "OPEN_URL" | "COPY" | "TOAST" | "PATCH_STATE")[] | undefined;
+        maxNodes?: number | undefined;
+        maxDepth?: number | undefined;
+    } | undefined;
+    data?: Record<string, unknown> | undefined;
+    metadata?: {
+        name: string;
+        description?: string | undefined;
+        tags?: string[] | undefined;
+    } | undefined;
+    stylesheet?: {
+        styleId?: string | undefined;
+        cssText?: string | undefined;
+        cssUrl?: string | undefined;
+        classList?: string[] | undefined;
+    } | undefined;
+}, {
+    widgetId: string;
+    schema: "agentic.widget.v1";
+    template: {
+        schema: "ui.v1";
+        root?: any;
+    };
+    policy?: {
+        allowedTags?: string[] | undefined;
+        allowedProps?: string[] | undefined;
+        allowedActions?: ("FLOW_EVENT" | "OPEN_URL" | "COPY" | "TOAST" | "PATCH_STATE")[] | undefined;
+        maxNodes?: number | undefined;
+        maxDepth?: number | undefined;
+    } | undefined;
+    data?: Record<string, unknown> | undefined;
+    metadata?: {
+        name: string;
+        description?: string | undefined;
+        tags?: string[] | undefined;
+    } | undefined;
+    stylesheet?: {
+        styleId?: string | undefined;
+        cssText?: string | undefined;
+        cssUrl?: string | undefined;
+        classList?: string[] | undefined;
+    } | undefined;
+}>;
+export type AgenticWidget = z.infer<typeof AgenticWidgetSchema>;
+export declare const WidgetRegistrationRequestSchema: z.ZodObject<{
+    id: z.ZodOptional<z.ZodString>;
+    template: z.ZodObject<{
+        schema: z.ZodLiteral<"ui.v1">;
+        root: z.ZodType<any, z.ZodTypeDef, any>;
+    }, "strict", z.ZodTypeAny, {
+        schema: "ui.v1";
+        root?: any;
+    }, {
+        schema: "ui.v1";
+        root?: any;
+    }>;
+    data: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodUnknown>>;
+    metadata: z.ZodObject<{
+        name: z.ZodString;
+        description: z.ZodOptional<z.ZodString>;
+        tags: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
+    }, "strict", z.ZodTypeAny, {
+        name: string;
+        description?: string | undefined;
+        tags?: string[] | undefined;
+    }, {
+        name: string;
+        description?: string | undefined;
+        tags?: string[] | undefined;
+    }>;
+    policy: z.ZodOptional<z.ZodObject<{
+        allowedTags: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
+        allowedProps: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
+        allowedActions: z.ZodOptional<z.ZodArray<z.ZodEnum<["FLOW_EVENT", "OPEN_URL", "COPY", "TOAST", "PATCH_STATE"]>, "many">>;
+        maxNodes: z.ZodOptional<z.ZodNumber>;
+        maxDepth: z.ZodOptional<z.ZodNumber>;
+    }, "strict", z.ZodTypeAny, {
+        allowedTags?: string[] | undefined;
+        allowedProps?: string[] | undefined;
+        allowedActions?: ("FLOW_EVENT" | "OPEN_URL" | "COPY" | "TOAST" | "PATCH_STATE")[] | undefined;
+        maxNodes?: number | undefined;
+        maxDepth?: number | undefined;
+    }, {
+        allowedTags?: string[] | undefined;
+        allowedProps?: string[] | undefined;
+        allowedActions?: ("FLOW_EVENT" | "OPEN_URL" | "COPY" | "TOAST" | "PATCH_STATE")[] | undefined;
+        maxNodes?: number | undefined;
+        maxDepth?: number | undefined;
+    }>>;
+    replaceIfExists: z.ZodOptional<z.ZodBoolean>;
+}, "strict", z.ZodTypeAny, {
+    template: {
+        schema: "ui.v1";
+        root?: any;
+    };
+    metadata: {
+        name: string;
+        description?: string | undefined;
+        tags?: string[] | undefined;
+    };
+    id?: string | undefined;
+    policy?: {
+        allowedTags?: string[] | undefined;
+        allowedProps?: string[] | undefined;
+        allowedActions?: ("FLOW_EVENT" | "OPEN_URL" | "COPY" | "TOAST" | "PATCH_STATE")[] | undefined;
+        maxNodes?: number | undefined;
+        maxDepth?: number | undefined;
+    } | undefined;
+    data?: Record<string, unknown> | undefined;
+    replaceIfExists?: boolean | undefined;
+}, {
+    template: {
+        schema: "ui.v1";
+        root?: any;
+    };
+    metadata: {
+        name: string;
+        description?: string | undefined;
+        tags?: string[] | undefined;
+    };
+    id?: string | undefined;
+    policy?: {
+        allowedTags?: string[] | undefined;
+        allowedProps?: string[] | undefined;
+        allowedActions?: ("FLOW_EVENT" | "OPEN_URL" | "COPY" | "TOAST" | "PATCH_STATE")[] | undefined;
+        maxNodes?: number | undefined;
+        maxDepth?: number | undefined;
+    } | undefined;
+    data?: Record<string, unknown> | undefined;
+    replaceIfExists?: boolean | undefined;
+}>;
+export type WidgetRegistrationRequest = z.infer<typeof WidgetRegistrationRequestSchema>;
+export declare const WidgetRecordSchema: z.ZodObject<{
+    schema: z.ZodLiteral<"agentic.widget.record.v1">;
+    id: z.ZodString;
+    version: z.ZodNumber;
+    widget: z.ZodObject<{
+        schema: z.ZodLiteral<"agentic.widget.v1">;
+        widgetId: z.ZodString;
+        template: z.ZodObject<{
+            schema: z.ZodLiteral<"ui.v1">;
+            root: z.ZodType<any, z.ZodTypeDef, any>;
+        }, "strict", z.ZodTypeAny, {
+            schema: "ui.v1";
+            root?: any;
+        }, {
+            schema: "ui.v1";
+            root?: any;
+        }>;
+        data: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodUnknown>>;
+        metadata: z.ZodOptional<z.ZodObject<{
+            name: z.ZodString;
+            description: z.ZodOptional<z.ZodString>;
+            tags: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
+        }, "strict", z.ZodTypeAny, {
+            name: string;
+            description?: string | undefined;
+            tags?: string[] | undefined;
+        }, {
+            name: string;
+            description?: string | undefined;
+            tags?: string[] | undefined;
+        }>>;
+        policy: z.ZodOptional<z.ZodObject<{
+            allowedTags: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
+            allowedProps: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
+            allowedActions: z.ZodOptional<z.ZodArray<z.ZodEnum<["FLOW_EVENT", "OPEN_URL", "COPY", "TOAST", "PATCH_STATE"]>, "many">>;
+            maxNodes: z.ZodOptional<z.ZodNumber>;
+            maxDepth: z.ZodOptional<z.ZodNumber>;
+        }, "strict", z.ZodTypeAny, {
+            allowedTags?: string[] | undefined;
+            allowedProps?: string[] | undefined;
+            allowedActions?: ("FLOW_EVENT" | "OPEN_URL" | "COPY" | "TOAST" | "PATCH_STATE")[] | undefined;
+            maxNodes?: number | undefined;
+            maxDepth?: number | undefined;
+        }, {
+            allowedTags?: string[] | undefined;
+            allowedProps?: string[] | undefined;
+            allowedActions?: ("FLOW_EVENT" | "OPEN_URL" | "COPY" | "TOAST" | "PATCH_STATE")[] | undefined;
+            maxNodes?: number | undefined;
+            maxDepth?: number | undefined;
+        }>>;
+        stylesheet: z.ZodOptional<z.ZodObject<{
+            styleId: z.ZodOptional<z.ZodString>;
+            cssText: z.ZodOptional<z.ZodString>;
+            cssUrl: z.ZodOptional<z.ZodString>;
+            classList: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
+        }, "strict", z.ZodTypeAny, {
+            styleId?: string | undefined;
+            cssText?: string | undefined;
+            cssUrl?: string | undefined;
+            classList?: string[] | undefined;
+        }, {
+            styleId?: string | undefined;
+            cssText?: string | undefined;
+            cssUrl?: string | undefined;
+            classList?: string[] | undefined;
+        }>>;
+    }, "strict", z.ZodTypeAny, {
+        widgetId: string;
+        schema: "agentic.widget.v1";
+        template: {
+            schema: "ui.v1";
+            root?: any;
+        };
+        policy?: {
+            allowedTags?: string[] | undefined;
+            allowedProps?: string[] | undefined;
+            allowedActions?: ("FLOW_EVENT" | "OPEN_URL" | "COPY" | "TOAST" | "PATCH_STATE")[] | undefined;
+            maxNodes?: number | undefined;
+            maxDepth?: number | undefined;
+        } | undefined;
+        data?: Record<string, unknown> | undefined;
+        metadata?: {
+            name: string;
+            description?: string | undefined;
+            tags?: string[] | undefined;
+        } | undefined;
+        stylesheet?: {
+            styleId?: string | undefined;
+            cssText?: string | undefined;
+            cssUrl?: string | undefined;
+            classList?: string[] | undefined;
+        } | undefined;
+    }, {
+        widgetId: string;
+        schema: "agentic.widget.v1";
+        template: {
+            schema: "ui.v1";
+            root?: any;
+        };
+        policy?: {
+            allowedTags?: string[] | undefined;
+            allowedProps?: string[] | undefined;
+            allowedActions?: ("FLOW_EVENT" | "OPEN_URL" | "COPY" | "TOAST" | "PATCH_STATE")[] | undefined;
+            maxNodes?: number | undefined;
+            maxDepth?: number | undefined;
+        } | undefined;
+        data?: Record<string, unknown> | undefined;
+        metadata?: {
+            name: string;
+            description?: string | undefined;
+            tags?: string[] | undefined;
+        } | undefined;
+        stylesheet?: {
+            styleId?: string | undefined;
+            cssText?: string | undefined;
+            cssUrl?: string | undefined;
+            classList?: string[] | undefined;
+        } | undefined;
+    }>;
+    createdAt: z.ZodString;
+    updatedAt: z.ZodString;
+}, "strict", z.ZodTypeAny, {
+    id: string;
+    schema: "agentic.widget.record.v1";
+    version: number;
+    widget: {
+        widgetId: string;
+        schema: "agentic.widget.v1";
+        template: {
+            schema: "ui.v1";
+            root?: any;
+        };
+        policy?: {
+            allowedTags?: string[] | undefined;
+            allowedProps?: string[] | undefined;
+            allowedActions?: ("FLOW_EVENT" | "OPEN_URL" | "COPY" | "TOAST" | "PATCH_STATE")[] | undefined;
+            maxNodes?: number | undefined;
+            maxDepth?: number | undefined;
+        } | undefined;
+        data?: Record<string, unknown> | undefined;
+        metadata?: {
+            name: string;
+            description?: string | undefined;
+            tags?: string[] | undefined;
+        } | undefined;
+        stylesheet?: {
+            styleId?: string | undefined;
+            cssText?: string | undefined;
+            cssUrl?: string | undefined;
+            classList?: string[] | undefined;
+        } | undefined;
+    };
+    createdAt: string;
+    updatedAt: string;
+}, {
+    id: string;
+    schema: "agentic.widget.record.v1";
+    version: number;
+    widget: {
+        widgetId: string;
+        schema: "agentic.widget.v1";
+        template: {
+            schema: "ui.v1";
+            root?: any;
+        };
+        policy?: {
+            allowedTags?: string[] | undefined;
+            allowedProps?: string[] | undefined;
+            allowedActions?: ("FLOW_EVENT" | "OPEN_URL" | "COPY" | "TOAST" | "PATCH_STATE")[] | undefined;
+            maxNodes?: number | undefined;
+            maxDepth?: number | undefined;
+        } | undefined;
+        data?: Record<string, unknown> | undefined;
+        metadata?: {
+            name: string;
+            description?: string | undefined;
+            tags?: string[] | undefined;
+        } | undefined;
+        stylesheet?: {
+            styleId?: string | undefined;
+            cssText?: string | undefined;
+            cssUrl?: string | undefined;
+            classList?: string[] | undefined;
+        } | undefined;
+    };
+    createdAt: string;
+    updatedAt: string;
+}>;
+export type WidgetRecord = z.infer<typeof WidgetRecordSchema>;
+export declare const WidgetListItemSchema: z.ZodObject<{
+    id: z.ZodString;
+    name: z.ZodString;
+    version: z.ZodNumber;
+    updatedAt: z.ZodString;
+    tags: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
+}, "strict", z.ZodTypeAny, {
+    name: string;
+    id: string;
+    version: number;
+    updatedAt: string;
+    tags?: string[] | undefined;
+}, {
+    name: string;
+    id: string;
+    version: number;
+    updatedAt: string;
+    tags?: string[] | undefined;
+}>;
+export type WidgetListItem = z.infer<typeof WidgetListItemSchema>;
 //# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB;;;;;GAKG;AAIH,eAAO,MAAM,SAAS;;;;;;;;CAQZ,CAAC;AAEX,eAAO,MAAM,eAAe,sYA+ClB,CAAC;AAEX,eAAO,MAAM,gBAAgB,wtBA6DnB,CAAC;AAEX,eAAO,MAAM,iBAAiB,2KAapB,CAAC;AAYX,eAAO,MAAM,kBAAkB,uEAM7B,CAAC;AAEH,MAAM,MAAM,YAAY,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,kBAAkB,CAAC,CAAC;AAE9D,eAAO,MAAM,cAAc;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;IA6BzB,CAAC;AAEH,MAAM,MAAM,QAAQ,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,cAAc,CAAC,CAAC;AAItD,eAAO,MAAM,gBAAgB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAelB,CAAC;AAEZ,MAAM,MAAM,UAAU,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,gBAAgB,CAAC,CAAC;AA0G1D,eAAO,MAAM,YAAY;;;;;;;;;GAOZ,CAAC;AAEd,MAAM,MAAM,MAAM,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,YAAY,CAAC,CAAC;AAElD,eAAO,MAAM,YAAY,EAAE,CAAC,CAAC,OAAO,CAAC,GAAG,CAsHvC,CAAC;AAEF,MAAM,MAAM,MAAM,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,YAAY,CAAC,CAAC;AAIlD,eAAO,MAAM,gBAAgB;;;;;;;;;EAKlB,CAAC;AAEZ,MAAM,MAAM,UAAU,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,gBAAgB,CAAC,CAAC;AAU1D,eAAO,MAAM,kBAAkB;;;;;;;;;;;;;;;;;;GASlB,CAAC;AAEd,eAAO,MAAM,sBAAsB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAYxB,CAAC;AAEZ,MAAM,MAAM,gBAAgB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,sBAAsB,CAAC,CAAC;AAEtE,eAAO,MAAM,gBAAgB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;IAQ3B,CAAC;AAEH,MAAM,MAAM,UAAU,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,gBAAgB,CAAC,CAAC;AAE1D,eAAO,MAAM,mBAAmB;;;;;;;;;;;;IAM9B,CAAC;AAEH,MAAM,MAAM,aAAa,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,mBAAmB,CAAC,CAAC;AAEhE,eAAO,MAAM,qBAAqB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAGhC,CAAC;AAEH,MAAM,MAAM,eAAe,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,qBAAqB,CAAC,CAAC;AAIpE,wBAAgB,UAAU,CAAC,IAAI,EAAE,MAAM,GAAG;IAAE,KAAK,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,CAyBzE;AAED,wBAAgB,kBAAkB,CAAC,QAAQ,EAAE,UAAU,GAAG,IAAI,CAY7D"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB;;;;;GAKG;AAIH,eAAO,MAAM,SAAS;;;;;;;;CAQZ,CAAC;AAEX,eAAO,MAAM,eAAe,gZAgDlB,CAAC;AAEX,eAAO,MAAM,gBAAgB,wtBA6DnB,CAAC;AAEX,eAAO,MAAM,iBAAiB,2KAapB,CAAC;AAYX,eAAO,MAAM,kBAAkB,uEAM7B,CAAC;AAEH,MAAM,MAAM,YAAY,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,kBAAkB,CAAC,CAAC;AAE9D,eAAO,MAAM,cAAc;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;IA6BzB,CAAC;AAEH,MAAM,MAAM,QAAQ,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,cAAc,CAAC,CAAC;AAItD,eAAO,MAAM,gBAAgB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAelB,CAAC;AAEZ,MAAM,MAAM,UAAU,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,gBAAgB,CAAC,CAAC;AA0G1D,eAAO,MAAM,YAAY;;;;;;;;;GAOZ,CAAC;AAEd,MAAM,MAAM,MAAM,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,YAAY,CAAC,CAAC;AAElD,eAAO,MAAM,YAAY,EAAE,CAAC,CAAC,OAAO,CAAC,GAAG,CAsHvC,CAAC;AAEF,MAAM,MAAM,MAAM,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,YAAY,CAAC,CAAC;AAIlD,eAAO,MAAM,gBAAgB;;;;;;;;;EAKlB,CAAC;AAEZ,MAAM,MAAM,UAAU,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,gBAAgB,CAAC,CAAC;AAU1D,eAAO,MAAM,kBAAkB;;;;;;;;;;;;;;;;;;GASlB,CAAC;AAEd,eAAO,MAAM,sBAAsB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAYxB,CAAC;AAEZ,MAAM,MAAM,gBAAgB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,sBAAsB,CAAC,CAAC;AAEtE,eAAO,MAAM,gBAAgB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;IAQ3B,CAAC;AAEH,MAAM,MAAM,UAAU,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,gBAAgB,CAAC,CAAC;AAE1D,eAAO,MAAM,mBAAmB;;;;;;;;;;;;IAM9B,CAAC;AAEH,MAAM,MAAM,aAAa,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,mBAAmB,CAAC,CAAC;AAEhE,eAAO,MAAM,qBAAqB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAGhC,CAAC;AAEH,MAAM,MAAM,eAAe,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,qBAAqB,CAAC,CAAC;AAIpE,wBAAgB,UAAU,CAAC,IAAI,EAAE,MAAM,GAAG;IAAE,KAAK,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,CAyBzE;AAED,wBAAgB,kBAAkB,CAAC,QAAQ,EAAE,UAAU,GAAG,IAAI,CAY7D;AAID,eAAO,MAAM,oBAAoB;;;;;;;;;;;;EAMtB,CAAC;AAEZ,MAAM,MAAM,cAAc,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,oBAAoB,CAAC,CAAC;AAElE,eAAO,MAAM,sBAAsB;;;;;;;;;;;;;;;GAQtB,CAAC;AAEd,MAAM,MAAM,gBAAgB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,sBAAsB,CAAC,CAAC;AAEtE,eAAO,MAAM,mBAAmB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAUrB,CAAC;AAEZ,MAAM,MAAM,aAAa,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,mBAAmB,CAAC,CAAC;AAEhE,eAAO,MAAM,+BAA+B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EASjC,CAAC;AAEZ,MAAM,MAAM,yBAAyB,GAAG,CAAC,CAAC,KAAK,CAC7C,OAAO,+BAA+B,CACvC,CAAC;AAEF,eAAO,MAAM,kBAAkB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EASpB,CAAC;AAEZ,MAAM,MAAM,YAAY,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,kBAAkB,CAAC,CAAC;AAE9D,eAAO,MAAM,oBAAoB;;;;;;;;;;;;;;;;;;EAQtB,CAAC;AAEZ,MAAM,MAAM,cAAc,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,oBAAoB,CAAC,CAAC"}

package/dist/index.js

@@ -16,6 +16,7 @@ export const UI_LIMITS = {
     MAX_KEY_LEN: 200,
 };
 export const UI_ALLOWED_TAGS = [
+    "repeat",
     "a",
     "article",
     "aside",
@@ -509,3 +510,60 @@ export function assertWithinLimits(template) {
         throw new Error(`UI template too deep: depth=${depth} > ${UI_LIMITS.MAX_DEPTH}`);
     }
 }
+// ------------------ Widget transport contracts ------------------
+export const WidgetMetadataSchema = z
+    .object({
+    name: z.string().min(1).max(120),
+    description: z.string().max(2000).optional(),
+    tags: z.array(z.string().min(1).max(50)).max(20).optional(),
+})
+    .strict();
+export const WidgetStylesheetSchema = z
+    .object({
+    styleId: zSafeId.optional(),
+    cssText: z.string().max(2000000).optional(),
+    cssUrl: z.string().max(UI_LIMITS.MAX_URL_LEN).optional(),
+    classList: z.array(z.string().min(1).max(200)).max(10000).optional(),
+})
+    .strict()
+    .optional();
+export const AgenticWidgetSchema = z
+    .object({
+    schema: z.literal("agentic.widget.v1"),
+    widgetId: zSafeId,
+    template: UiTemplateSchema,
+    data: z.record(z.string(), z.unknown()).optional(),
+    metadata: WidgetMetadataSchema.optional(),
+    policy: WidgetPolicySchema,
+    stylesheet: WidgetStylesheetSchema,
+})
+    .strict();
+export const WidgetRegistrationRequestSchema = z
+    .object({
+    id: zSafeId.optional(),
+    template: UiTemplateSchema,
+    data: z.record(z.string(), z.unknown()).optional(),
+    metadata: WidgetMetadataSchema,
+    policy: WidgetPolicySchema,
+    replaceIfExists: z.boolean().optional(),
+})
+    .strict();
+export const WidgetRecordSchema = z
+    .object({
+    schema: z.literal("agentic.widget.record.v1"),
+    id: zSafeId,
+    version: z.number().int().min(1),
+    widget: AgenticWidgetSchema,
+    createdAt: z.string(),
+    updatedAt: z.string(),
+})
+    .strict();
+export const WidgetListItemSchema = z
+    .object({
+    id: zSafeId,
+    name: z.string().min(1).max(120),
+    version: z.number().int().min(1),
+    updatedAt: z.string(),
+    tags: z.array(z.string().min(1).max(50)).max(20).optional(),
+})
+    .strict();

package/package.json

@@ -1,12 +1,22 @@
 {
   "name": "agentic-zi-ui-schema",
-  "version": "0.0.2",
+  "version": "0.1.0",
   "main": "dist/index.js",
   "types": "dist/index.d.ts",
   "private": false,
   "scripts": {
     "dev": "tsc -w",
-    "build": "tsc"
+    "build": "tsc",
+    "prepublishOnly": "npm run build",
+    "npm:login": "npm login --registry https://registry.npmjs.org/",
+    "publish:public": "(npm whoami --registry https://registry.npmjs.org/ >/dev/null 2>&1 || npm run npm:login) && npm_config_cache=./.npm-cache npm publish --registry https://registry.npmjs.org/ --access public"
+  },
+  "files": [
+    "dist",
+    "README.md"
+  ],
+  "devDependencies": {
+    "typescript": "~5.9.3"
   },
   "dependencies": {
     "zod": "^3.23.8"

package/src/index.ts

@@ -1,576 +0,0 @@
-import { z } from "zod";
-
-/**
- * ui.v1 — a safe, declarative UI schema.
- * - No executable JS
- * - Events map to action descriptors
- * - Client uses allowlists to render
- */
-
-// ------------------ Guardrails ------------------
-
-export const UI_LIMITS = {
-  MAX_NODES: 500,
-  MAX_DEPTH: 30,
-  MAX_TEXT_LEN: 10_000,
-  MAX_CLASSNAME_LEN: 1_000,
-  MAX_ID_LEN: 200,
-  MAX_URL_LEN: 2_000,
-  MAX_KEY_LEN: 200,
-} as const;
-
-export const UI_ALLOWED_TAGS = [
-  "a",
-  "article",
-  "aside",
-  "blockquote",
-  "br",
-  "button",
-  "code",
-  "div",
-  "em",
-  "figcaption",
-  "figure",
-  "fieldset",
-  "footer",
-  "form",
-  "h1",
-  "h2",
-  "h3",
-  "h4",
-  "header",
-  "hr",
-  "img",
-  "input",
-  "label",
-  "li",
-  "main",
-  "nav",
-  "ol",
-  "option",
-  "p",
-  "path",
-  "pre",
-  "section",
-  "select",
-  "small",
-  "span",
-  "strong",
-  "svg",
-  "table",
-  "tbody",
-  "td",
-  "textarea",
-  "tfoot",
-  "th",
-  "thead",
-  "tr",
-  "ul",
-] as const;
-
-export const UI_ALLOWED_PROPS = [
-  "alt",
-  "aria-label",
-  "aria-controls",
-  "aria-current",
-  "aria-describedby",
-  "aria-disabled",
-  "aria-expanded",
-  "aria-hidden",
-  "aria-invalid",
-  "aria-labelledby",
-  "aria-live",
-  "aria-pressed",
-  "aria-required",
-  "aria-selected",
-  "aria-checked",
-  "aria-valuemax",
-  "aria-valuemin",
-  "aria-valuenow",
-  "aria-valuetext",
-  "aria-busy",
-  "checked",
-  "clipRule",
-  "cols",
-  "cx",
-  "cy",
-  "d",
-  "decoding",
-  "disabled",
-  "fill",
-  "fillRule",
-  "height",
-  "htmlFor",
-  "href",
-  "loading",
-  "max",
-  "maxLength",
-  "min",
-  "minLength",
-  "name",
-  "opacity",
-  "placeholder",
-  "preserveAspectRatio",
-  "rel",
-  "role",
-  "r",
-  "rows",
-  "src",
-  "stroke",
-  "strokeLinecap",
-  "strokeLinejoin",
-  "strokeWidth",
-  "step",
-  "target",
-  "title",
-  "type",
-  "value",
-  "viewBox",
-  "width",
-  "x",
-  "y",
-] as const;
-
-export const UI_ALLOWED_EVENTS = [
-  "onClick",
-  "onChange",
-  "onSubmit",
-  "onMouseEnter",
-  "onMouseLeave",
-  "onMouseOver",
-  "onMouseOut",
-  "onMouseDown",
-  "onMouseUp",
-  "onMouseMove",
-  "onFocus",
-  "onBlur",
-] as const;
-
-const zSafeId = z.string().min(1).max(UI_LIMITS.MAX_ID_LEN);
-const zSafeText = z.string().max(UI_LIMITS.MAX_TEXT_LEN);
-const zSafeClassName = z.string().max(UI_LIMITS.MAX_CLASSNAME_LEN);
-const zSafeKey = z.string().min(1).max(UI_LIMITS.MAX_KEY_LEN);
-const zSafePropValue = z.union([z.string(), z.number(), z.boolean()]);
-
-const UI_BASE_PROP_KEYS = new Set<string>(UI_ALLOWED_PROPS);
-
-// ------------------ Actions ------------------
-
-export const UiActionTypeSchema = z.enum([
-  "FLOW_EVENT",
-  "OPEN_URL",
-  "COPY",
-  "TOAST",
-  "PATCH_STATE",
-]);
-
-export type UiActionType = z.infer<typeof UiActionTypeSchema>;
-
-export const UiActionSchema = z.discriminatedUnion("type", [
-  z.object({
-    type: z.literal("FLOW_EVENT"),
-    name: z.string().min(1).max(200),
-    payload: z.record(z.string(), z.unknown()).optional(),
-  }),
-  z.object({
-    type: z.literal("OPEN_URL"),
-    url: z.string().min(1).max(UI_LIMITS.MAX_URL_LEN),
-    target: z.enum(["_blank", "_self"]).optional(),
-  }),
-  z.object({
-    type: z.literal("COPY"),
-    text: zSafeText,
-  }),
-  z.object({
-    type: z.literal("TOAST"),
-    message: z.string().min(1).max(500),
-    level: z.enum(["info", "success", "warning", "error"]).optional(),
-  }),
-  z.object({
-    // Local component state patch. (POC: flat key/value)
-    type: z.literal("PATCH_STATE"),
-    key: z.string().min(1).max(UI_LIMITS.MAX_KEY_LEN),
-    valueFrom: z
-      .enum(["event.target.value", "event.target.checked"])
-      .optional(),
-    value: z.unknown().optional(),
-  }),
-]);
-
-export type UiAction = z.infer<typeof UiActionSchema>;
-
-// ------------------ Events ------------------
-
-export const UiEventMapSchema = z
-  .object({
-    onClick: UiActionSchema.optional(),
-    onChange: UiActionSchema.optional(),
-    onSubmit: UiActionSchema.optional(),
-    onMouseEnter: UiActionSchema.optional(),
-    onMouseLeave: UiActionSchema.optional(),
-    onMouseOver: UiActionSchema.optional(),
-    onMouseOut: UiActionSchema.optional(),
-    onMouseDown: UiActionSchema.optional(),
-    onMouseUp: UiActionSchema.optional(),
-    onMouseMove: UiActionSchema.optional(),
-    onFocus: UiActionSchema.optional(),
-    onBlur: UiActionSchema.optional(),
-  })
-  .strict();
-
-export type UiEventMap = z.infer<typeof UiEventMapSchema>;
-
-// ------------------ Node schema ------------------
-
-/**
- * We keep props limited. No dangerouslySetInnerHTML.
- * You can expand allowed props gradually.
- */
-const UiPropsSchema = z
-  .object({
-    // common
-    title: z.string().max(500).optional(),
-    role: z.string().max(200).optional(),
-    "aria-label": z.string().max(200).optional(),
-    "aria-controls": z.string().max(200).optional(),
-    "aria-current": zSafePropValue.optional(),
-    "aria-describedby": z.string().max(200).optional(),
-    "aria-disabled": zSafePropValue.optional(),
-    "aria-expanded": zSafePropValue.optional(),
-    "aria-hidden": zSafePropValue.optional(),
-    "aria-invalid": zSafePropValue.optional(),
-    "aria-labelledby": z.string().max(200).optional(),
-    "aria-live": z.string().max(50).optional(),
-    "aria-pressed": zSafePropValue.optional(),
-    "aria-required": zSafePropValue.optional(),
-    "aria-selected": zSafePropValue.optional(),
-    "aria-checked": zSafePropValue.optional(),
-    "aria-valuemax": zSafePropValue.optional(),
-    "aria-valuemin": zSafePropValue.optional(),
-    "aria-valuenow": zSafePropValue.optional(),
-    "aria-valuetext": z.string().max(200).optional(),
-    "aria-busy": zSafePropValue.optional(),
-
-    // input-ish
-    placeholder: z.string().max(200).optional(),
-    type: z.string().max(50).optional(),
-    name: z.string().max(200).optional(),
-    value: z.union([z.string(), z.number(), z.boolean()]).optional(),
-    checked: z.union([z.boolean(), z.string()]).optional(),
-    disabled: z.union([z.boolean(), z.string()]).optional(),
-
-    // links + media
-    href: z.string().max(UI_LIMITS.MAX_URL_LEN).optional(),
-    target: z.enum(["_blank", "_self"]).optional(),
-    rel: z.string().max(200).optional(),
-    src: z.string().max(UI_LIMITS.MAX_URL_LEN).optional(),
-    alt: z.string().max(500).optional(),
-    loading: z.enum(["eager", "lazy"]).optional(),
-    decoding: z.enum(["auto", "async", "sync"]).optional(),
-
-    // sizing + constraints
-    width: z.union([z.string(), z.number()]).optional(),
-    height: z.union([z.string(), z.number()]).optional(),
-    rows: z.number().int().min(1).max(1000).optional(),
-    cols: z.number().int().min(1).max(2000).optional(),
-    min: z.union([z.string(), z.number()]).optional(),
-    max: z.union([z.string(), z.number()]).optional(),
-    step: z.union([z.string(), z.number()]).optional(),
-    minLength: z.number().int().min(0).max(10000).optional(),
-    maxLength: z.number().int().min(0).max(10000).optional(),
-
-    // label
-    htmlFor: z.string().max(200).optional(),
-
-    // svg-ish
-    viewBox: z.string().max(200).optional(),
-    preserveAspectRatio: z.string().max(200).optional(),
-    fill: z.string().max(200).optional(),
-    fillRule: z.string().max(50).optional(),
-    clipRule: z.string().max(50).optional(),
-    stroke: z.string().max(200).optional(),
-    strokeWidth: z.union([z.string(), z.number()]).optional(),
-    strokeLinecap: z.string().max(50).optional(),
-    strokeLinejoin: z.string().max(50).optional(),
-    d: z.string().max(2000).optional(),
-    cx: z.union([z.string(), z.number()]).optional(),
-    cy: z.union([z.string(), z.number()]).optional(),
-    r: z.union([z.string(), z.number()]).optional(),
-    x: z.union([z.string(), z.number()]).optional(),
-    y: z.union([z.string(), z.number()]).optional(),
-    opacity: z.union([z.string(), z.number()]).optional(),
-  })
-  .catchall(zSafePropValue)
-  .superRefine((props, ctx) => {
-    if (!props) return;
-    for (const key of Object.keys(props)) {
-      if (UI_BASE_PROP_KEYS.has(key)) continue;
-      if (key.startsWith("aria-") || key.startsWith("data-")) {
-        if (key.length > UI_LIMITS.MAX_KEY_LEN) {
-          ctx.addIssue({
-            code: z.ZodIssueCode.custom,
-            message: `Prop key too long: ${key}`,
-            path: [key],
-          });
-        }
-        continue;
-      }
-      ctx.addIssue({
-        code: z.ZodIssueCode.custom,
-        message: `Unsupported prop: ${key}`,
-        path: [key],
-      });
-    }
-  })
-  .optional();
-
-export const UiBindSchema = z
-  .object({
-    // bind node value/checked to local state key
-    valueKey: zSafeKey.optional(),
-    checkedKey: zSafeKey.optional(),
-  })
-  .strict()
-  .optional();
-
-export type UiBind = z.infer<typeof UiBindSchema>;
-
-export const UiNodeSchema: z.ZodType<any> = z.lazy(() =>
-  z
-    .object({
-      id: zSafeId.optional(),
-      type: z.string().min(1).max(50), // allowlist enforced on client
-      className: zSafeClassName.optional(),
-      props: UiPropsSchema,
-      events: UiEventMapSchema.optional(),
-      bind: UiBindSchema,
-      // repeat support
-      items: z.string().min(1).max(200).optional(),
-      as: zSafeKey.optional(),
-      indexAs: zSafeKey.optional(),
-      widgetId: zSafeId.optional(),
-      widgetProps: z.record(zSafeKey, z.unknown()).optional(),
-      slots: z
-        .record(
-          zSafeKey,
-          z.array(z.union([zSafeText, UiNodeSchema])).max(UI_LIMITS.MAX_NODES)
-        )
-        .optional(),
-      slotName: zSafeKey.optional(),
-      children: z
-        .array(z.union([zSafeText, UiNodeSchema]))
-        .max(UI_LIMITS.MAX_NODES) // soft guard; hard guard below
-        .optional(),
-    })
-    .strict()
-    .superRefine((node, ctx) => {
-      const isWidget = node.type === "widget";
-      const isSlot = node.type === "slot";
-      const isRepeat = node.type === "repeat";
-
-      if (isWidget) {
-        if (!node.widgetId) {
-          ctx.addIssue({
-            code: z.ZodIssueCode.custom,
-            message: "widgetId is required for widget nodes",
-          });
-        }
-        if (node.className || node.props || node.events || node.bind) {
-          ctx.addIssue({
-            code: z.ZodIssueCode.custom,
-            message:
-              "widget nodes cannot use className/props/events/bind; use widgetProps and slots",
-          });
-        }
-        if (node.children) {
-          ctx.addIssue({
-            code: z.ZodIssueCode.custom,
-            message: "widget nodes must use slots instead of children",
-          });
-        }
-        if (node.slotName) {
-          ctx.addIssue({
-            code: z.ZodIssueCode.custom,
-            message: "widget nodes cannot define slotName",
-          });
-        }
-      } else if (isSlot) {
-        if (!node.slotName) {
-          ctx.addIssue({
-            code: z.ZodIssueCode.custom,
-            message: "slotName is required for slot nodes",
-          });
-        }
-        if (
-          node.className ||
-          node.props ||
-          node.events ||
-          node.bind ||
-          node.children ||
-          node.widgetId ||
-          node.widgetProps ||
-          node.slots
-        ) {
-          ctx.addIssue({
-            code: z.ZodIssueCode.custom,
-            message: "slot nodes cannot include other node fields",
-          });
-        }
-      } else if (isRepeat) {
-        if (!node.items || !node.as) {
-          ctx.addIssue({
-            code: z.ZodIssueCode.custom,
-            message: "repeat nodes require items and as",
-          });
-        }
-        if (node.className || node.props || node.events || node.bind) {
-          ctx.addIssue({
-            code: z.ZodIssueCode.custom,
-            message: "repeat nodes cannot use className/props/events/bind",
-          });
-        }
-        if (node.widgetId || node.widgetProps || node.slots || node.slotName) {
-          ctx.addIssue({
-            code: z.ZodIssueCode.custom,
-            message: "repeat nodes cannot include widget/slot fields",
-          });
-        }
-      } else {
-        if (
-          node.widgetId ||
-          node.widgetProps ||
-          node.slots ||
-          node.slotName ||
-          node.items ||
-          node.as ||
-          node.indexAs
-        ) {
-          ctx.addIssue({
-            code: z.ZodIssueCode.custom,
-            message:
-              "reserved widget/slot/repeat fields are not allowed on UI nodes",
-          });
-        }
-      }
-    })
-);
-
-export type UiNode = z.infer<typeof UiNodeSchema>;
-
-// ------------------ Messages ------------------
-
-export const UiTemplateSchema = z
-  .object({
-    schema: z.literal("ui.v1"),
-    root: UiNodeSchema,
-  })
-  .strict();
-
-export type UiTemplate = z.infer<typeof UiTemplateSchema>;
-
-const WidgetPropSchema = z
-  .object({
-    type: z.enum(["string", "number", "boolean", "json"]),
-    required: z.boolean().optional(),
-    default: z.unknown().optional(),
-  })
-  .strict();
-
-export const WidgetPolicySchema = z
-  .object({
-    allowedTags: z.array(z.string().min(1).max(50)).optional(),
-    allowedProps: z.array(zSafeKey).optional(),
-    allowedActions: z.array(UiActionTypeSchema).optional(),
-    maxNodes: z.number().int().min(1).max(UI_LIMITS.MAX_NODES).optional(),
-    maxDepth: z.number().int().min(1).max(UI_LIMITS.MAX_DEPTH).optional(),
-  })
-  .strict()
-  .optional();
-
-export const WidgetDefinitionSchema = z
-  .object({
-    schema: z.literal("widget.v1"),
-    widgetId: zSafeId,
-    version: z.string().min(1).max(50),
-    template: UiTemplateSchema,
-    props: z.record(zSafeKey, WidgetPropSchema).optional(),
-    slots: z
-      .record(zSafeKey, z.object({ required: z.boolean().optional() }).strict())
-      .optional(),
-    policy: WidgetPolicySchema,
-  })
-  .strict();
-
-export type WidgetDefinition = z.infer<typeof WidgetDefinitionSchema>;
-
-export const FlowOutputSchema = z.discriminatedUnion("kind", [
-  z.object({ kind: z.literal("text"), text: zSafeText }),
-  z.object({ kind: z.literal("markdown"), markdown: zSafeText }),
-  z.object({
-    kind: z.literal("ui"),
-    templateId: z.string().min(1).max(200),
-    data: z.record(z.string(), z.unknown()).optional(),
-  }),
-]);
-
-export type FlowOutput = z.infer<typeof FlowOutputSchema>;
-
-export const WsClientEventSchema = z.discriminatedUnion("kind", [
-  z.object({
-    kind: z.literal("ui_event"),
-    name: z.string().min(1).max(200),
-    payload: z.record(z.string(), z.unknown()).optional(),
-  }),
-]);
-
-export type WsClientEvent = z.infer<typeof WsClientEventSchema>;
-
-export const WsServerMessageSchema = z.object({
-  kind: z.literal("flow_output"),
-  output: FlowOutputSchema,
-});
-
-export type WsServerMessage = z.infer<typeof WsServerMessageSchema>;
-
-// ------------------ Hard guard helpers ------------------
-
-export function countNodes(root: UiNode): { nodes: number; depth: number } {
-  let nodes = 0;
-  let maxDepth = 0;
-
-  function walk(node: UiNode, depth: number) {
-    nodes += 1;
-    if (depth > maxDepth) maxDepth = depth;
-
-    const children = node.children ?? [];
-    for (const c of children) {
-      if (typeof c === "string") continue;
-      walk(c, depth + 1);
-    }
-
-    const slots = node.slots ? Object.values(node.slots) : [];
-    for (const slotNodes of slots as any) {
-      for (const c of slotNodes) {
-        if (typeof c === "string") continue;
-        walk(c, depth + 1);
-      }
-    }
-  }
-
-  walk(root, 1);
-  return { nodes, depth: maxDepth };
-}
-
-export function assertWithinLimits(template: UiTemplate): void {
-  const { nodes, depth } = countNodes(template.root);
-  if (nodes > UI_LIMITS.MAX_NODES) {
-    throw new Error(
-      `UI template too large: nodes=${nodes} > ${UI_LIMITS.MAX_NODES}`
-    );
-  }
-  if (depth > UI_LIMITS.MAX_DEPTH) {
-    throw new Error(
-      `UI template too deep: depth=${depth} > ${UI_LIMITS.MAX_DEPTH}`
-    );
-  }
-}

package/tsconfig.json

@@ -1,14 +0,0 @@
-{
-  "compilerOptions": {
-    "target": "ES2020",
-    "module": "ESNext",
-    "declaration": true,
-    "declarationMap": true,
-    "outDir": "dist",
-    "rootDir": "src",
-    "moduleResolution": "Bundler",
-    "strict": true,
-    "skipLibCheck": true
-  },
-  "include": ["src"]
-}