Compose Preview Catalogs

Ask a human for access to this server. Returns an approveUrl and a userCode: show BOTH to the person you are working with, ask them to open the link and check that the code on the page matches, then call poll_access. When the client supports URL elicitation, call poll_access with urlMode=true instead of pasting the link into chat; clients without it keep this complete text fallback. The link grants nothing by itself — keep the deviceSecret this returns, it is what collects the token. Use this when a call answered 'authorization_required', or when your token stopped working (a server restart drops every grant).

Collect the outcome of a request_access, proving possession of its deviceSecret. It HOLDS THE CALL OPEN and answers the moment the human decides — one call instead of a dozen, since each poll here costs a whole round trip through you. It waits 8 seconds by default; pass waitSeconds (up to 30) if your client tolerates a longer call. Pass urlMode=true when the client supports URL elicitation: while the request is pending this returns the standard -32042 URL-elicitation-required error, and retrying the same call after the browser decision returns the outcome. A wait that times out answers status=pending, and you simply call again. Then approved (with the token) or denied/expired. Use the token on every later call: as the X-Compose-Preview-Token header where you control headers, and otherwise as each gated tool's 'token' argument — which is what an MCP client reaching this flow mid-session needs, since its headers were fixed when it connected.

Report readiness, the aggregate catalog set, and which host this is: `origin`, the canonical origin designs here are homed at, and `originAliases`, other hostnames that reach this same server.

List every remote catalog with its stable id and preview count. Call this first: catalog_list_previews and catalog_list_data_products take one of these ids as 'catalog'.

Open the hosted preview catalog browser app. With no arguments it lists every catalog with its preview count only; pass projectId to list one catalog's previews. To find previews without the app, call catalog_list_projects, then catalog_list_previews with a catalog id. Also opens from the ChatGPT/Codex sidebar.

Open the UI Builder's design list: pick a design to see it as the editor draws it. Takes no arguments. Also opens from the ChatGPT/Codex sidebar, and a deep link to /design/<id> opens one design.

List the Compose previews and published metadata of one hosted catalog. 'catalog' is required (ids from catalog_list_projects). Pass 'query' (a component name such as EdgeButton) to narrow by id or label; results are paged (100 by default, 'offset'/'limit' for more). This server holds published library catalogs only: previews of the project you are editing come from the local compose-preview-mcp server, not from here.

Render one preview. Like local compose-ai-tools, the default semantics observation is token-frugal; request observe=png for pixels, observe=svg for the compose/figma-svg vector export as SVG source, or observe=scroll-png / observe=scroll-svg for the full-page capture of a scrollable screen rather than the viewport crop. Overrides, other observations and fresh renders require live grant scope; without it, a call with no overrides returns the published snapshot (as resources/read does).

Render one preview across the cross-product of the given override axes in a single call, returning a hash/size observation per cell (observe=png adds the pixels). Prefer this over a catalog_render_preview per combination: the cells share one catalog lease and are reported together, so comparing axes costs one round trip instead of N. Capped at 24 cells. Requires live grant scope.

List the `@Preview(device = ...)` ids this server's render lane recognises, with each one's dp size and density. The `device` override takes one of these ids; an unrecognised name renders the default frame rather than failing, so check here instead of guessing.

Compare two previews' semantics by testTag: which tags are only in one side, which moved, and which changed occupancy count. Identity is the authored testTag, not a positional ref, so a tag that stops resolving is reported rather than silently retargeted at different pixels. Requires live grant scope.

The render timeline for one preview: which versions of its rendered bytes exist, when each appeared, and whether the preview is unstable (re-renders differently on every publish) rather than genuinely changing. Where this server holds the timeline it is returned inline; where the catalog is published from a delivery branch the manifest lives on that branch and this reports where to fetch it.

Compare two of a preview's recorded renders. Defaults to the two newest — did the last publish move this preview? A metadata comparison: the timeline's versions are already collapsed distinct renders, so whether the bytes changed is answered without fetching either image. Reports `unstable` so a difference on a nondeterministic preview is not mistaken for a real change.

Fetch one historical render's pixels through this server, by `commit` or `blob` (a prefix is enough). Use when an agent cannot reach the delivery branch itself, or wants the bytes rather than the timeline.

List the component catalogs a UI-builder design can pin to. Start here: a design's `catalogPin` must name a revision this server actually serves, and each catalog's `catalogPin` here is exactly that. By default a summary of what authoring needs, a few KB rather than the whole capability: per component its id, role, traits, `slots` as `name[min..max]:accepted|roles` and `properties` as `name:type`, with `!` when required and `=a|b` listing the allowed values; per catalog its export formats and the modifier vocabulary. `full: true` returns the released CatalogsResponseV1 envelope with adapter status, parity and export notes per component; `componentIds` narrows either to the components you are about to use.

Find catalog components by id, display name, Compose symbol, role or trait, e.g. `TextField`, `text field`, `OutlinedTextField`, `Button`, `Card`. Case, spaces, hyphens, underscores, slashes and camelCase are ignored, and the components the query names come first: an exact name, then a prefix, then a name containing it, then role and traits. Returns the same summary as ui_builder_list_catalogs (id, role, traits, slots, properties, and the catalog pin) for only the matches, so you don't pay for the whole catalog.

List the UI-builder designs on this server, newest first, with the cursor to continue.

Read one design: its whole document — nodes, slots, properties, modifiers, state variables and catalog pin — plus the revision to quote as `baseRevision` when editing it. The catalog the design pins is left out unless `includeCatalog` is true: it is the same for every design on the pin, ui_builder_list_catalogs serves it, and it is most of the bytes. `home`, at the top of the reply, is where the design is canonical (`{kind: server, url, designId}` or `{kind: repo, path}`): edit it there. It is absent when none is recorded (a design made before homes existed, or on a host with no public origin), and then the canonical home cannot be verified. On hosts with design discussions, `unacknowledgedComments` is the number of comment threads this actor has not acknowledged; a nonzero count also carries the bounded `comments` notice.

Dry-run recovery of a design whose stored catalog pin no longer resolves. The server selects the exact currently served pin for the same catalog system and returns a CatalogUpgradePreviewV1 with changes, issues and the hashes required by a later `upgradeCatalog` mutation through ui_builder_apply. This call never writes.

Wait for somebody else to change a design and return what they changed, rather than asking again whether they have. Returns the moment a designer in the browser or another agent commits an edit, as the same update frame the browser's own live socket receives; returns a `timedOut` reply if nothing happens within `waitSeconds`, which you answer by calling again with the same cursor. Quote as `afterSequence` the `throughSequence` of the delta you last received, or the `lastSequence` of the last snapshot; a cursor the server no longer retains is answered with a whole snapshot instead of the operations you missed. `waitSeconds: 0` checks without blocking. Nothing is lost between calls — the cursor is replayed when you call again — so somebody merely looking at the design does not wake you, and only a committed change does.

Create a design, either from a whole `document` you supply or by copying an existing design named by `fromDesignId`. Copying is usually right: a document's `catalogPin` must match a catalog revision this server serves, and a copy carries one that does. A `document` whose `home` is an existing design on this server is refused with a `compose-preview-decision/v1` choice to put to the person — or, when your client supports form elicitation on this connection, the person is asked in a form and the call acts on their answer.

Apply design mutations — insertNode, setProperty, deleteNode, moveNode and the rest of DesignMutationV1 — as one operation. `baseRevision` is the revision you read; the outcome reports conflicts or rejected edits. This is how an agent adds a scaffold, fills its slots and sets modifiers. Use `setStateVariable` with `name` and `declaration` to add or edit state, `removeStateVariable` with `name` to remove unused state, and `setEventBinding` with `nodeId`, `event` and an ordered `actions` array to edit behavior. An empty actions array removes the event handler. `removeNodeProperty` (or a setProperty whose value is `{"type":"null"}`) unsets the property — the way back after trying one — and is refused, naming the node and the field, when the catalog requires it. When somebody has commented on the design and you have not acknowledged it, the outcome carries a `comments` block naming the threads waiting on you; read it, because it is somebody talking about what you are editing.

Move a design's canonical home between this server and a repository checkout. This changes real authoritative state: quote the exact `baseRevision` and current `sourceHome` from ui_builder_get_design, provide a stable `operationId`, and name the new `targetHome`. The old server record remains as a retained copy pointing at the new home. The reply is an idempotent operation outcome with the new revision; a stale revision or changed source home is refused rather than overwriting a concurrent move. Unless the person already chose this move, call first with `dryRun: true`: it changes nothing and returns the choices to put to them — or, when your client supports form elicitation on this connection, asks them in a form and, if they choose to move, returns this move's outcome.

Replace one stored design from a complete DesignDocumentV1 copy — the authoritative save-back and re-import operation. The document must name the same design and the same canonical home you read from ui_builder_get_design; `baseRevision` must still be current. The runtime validates the complete document and quotas, preserves server-owned identity, access and creation time, retains the old revision, and broadcasts a whole snapshot. Retry with the same `operationId`; never invent a new id after a lost response. Unless the person already chose to save back or re-import onto this home, call first with `dryRun: true`: it changes nothing and returns the choices to put to them — or, when your client supports form elicitation on this connection, asks them in a form and returns the outcome of the write they chose.

Export a design. `compose` returns the Kotlin the generator writes, or — when the design holds something it cannot express — diagnostics naming each reason. This is the same gate the browser's code pane shows, so an agent and a designer get the same answer about the same design.

Check a design without saving it: a whole `document`, a stored design by `designId`, or `operations` against a stored design exactly as ui_builder_apply would apply them. Runs the same checks the real call does — document shape, catalog pin, the catalog's own validation, the mutation reducer — and then the Compose export gate, which is the list the editor's problems panel shows. Returns `{valid, problems:[{severity, source, code, message, nodeId?, field?, operationIndex?}]}`; `valid` is false exactly when a problem is an error. Nothing is written, no revision moves and nobody watching the design is notified. The shapes are published as the resources compose-preview://schemas/ui-builder-document-v1.json and compose-preview://schemas/design-mutation-v1.json.

Put a picture behind an `assetKey`, so an `asset/image` node naming that key draws it instead of a placeholder. Send the PNG, JPEG, GIF or WebP bytes base64-encoded in `imageBase64`; the server stores them by content digest and pins {mediaType, contentDigest, source: uploaded} into the design's `assets` map under the key. This moves the design's revision, and the reply carries the new one to quote as `baseRevision`. Idempotent by content — the same bytes under the same key change nothing. Put the picture first, then insert the `asset/image` node with ui_builder_apply: the reducer refuses a key that is neither pinned in the design nor in the catalog's own registry. A pinned key whose bytes a lane cannot show renders as a visible placeholder, never as an error.

Read who can open a design: its owner, and every actor it has been shared with, each with the role and the actions that grant carries. Only the owner may ask — this is the answer to "who else is in here" and to "what is the id I must name when sharing".

Share a design with somebody else, or take that sharing back. `actorId` is the other party's actor id as this server spells it — `github:<login>` for a signed-in person, `operator` for the token holder, `agent:<fingerprint>` for another agent's grant; ui_builder_design_access lists the ones a design already carries. A `viewer` may read and export, an `editor` may also change the design, and neither may share it on. Only the design's owner may share it, and an agent acting under an approved grant shares as the person who approved that grant. Pass visibility instead of actorId to choose private or public (read only). Private keeps existing invited collaborators.

Read what a design is **for**: the `issue` it was drawn for, the `reference` frame in the design tool it reproduces, the `pr` that implemented it, the `thread` it is being discussed in, and the `previous` design it continues. Start a session on somebody else's design here — it is the brief, and it is what ui_builder_get_design cannot tell you. Every field is optional; a reply with none of them means nobody has said yet. The record is kept beside the design and is never part of it: no node holds it, no export sees it, and writing one does not move the revision. Ancestry rides along where there is some: `forkedFrom` / `forks` for a fork made with ui_builder_fork_design, and `branchOf` / `branches` for a design branch and its parent.

Say what a design is for. **Replaces the whole record**: send every link you want kept, and omit one to clear it — so read ui_builder_get_links first if you are adding to what is already there. `issue`, `reference`, `pr` and `thread` are absolute http or https URLs, at most 2 KB each; `previous` is a design id on this host, not a URL. Anything else is refused with the reason. Sending an empty record clears it. Record the `pr` when you open one for a design you built here: it is what lets the next session, and the person who filed the issue, find one from the other.

Give a design a new title. The title is the one thing about a design nothing else could change: it is set at creation, shown in every listing and the editor, and not part of any mutation. Anybody who may write the design may rename it. The revision does not move — a title is not design content — so `baseRevision` is not needed and an edit in flight is unaffected. Not the released envelope: the contract has no rename, so the reply is the design's listing entry with its new title.

Delete a design: it moves to the trash with its history, access list, overlay and discussion, and is gone from every listing and tool until ui_builder_restore_design brings it back, which works until `restorableUntilEpochMillis` in the reply (a day). After that it is purged for good. Only the owner may delete, or an agent acting for the owner: on a design it created itself under its current grant, or on any of the owner's designs when the approver also ticked `ui-builder-destructive` — never an editor, a viewer, or anybody merely holding a write grant. Without that capability a session can clean up the designs it made and nobody else's; ask for it with request_access when you are asked to delete existing designs. A trashed id cannot be reused until it is restored or purged. Not the released envelope: the contract has no delete, so the reply names the design and its restore deadline.

The designs in the trash that you could restore — ones you deleted, or ones you own — most recently deleted first, each with who deleted it and its `restorableUntilEpochMillis`. Use it to undo a ui_builder_delete_design you regret, or to check what a cleanup removed. Takes no arguments.

Bring a deleted design back out of the trash exactly as it was: the same revision, history, access list, overlay and discussion. Allowed to whoever could have deleted it, until its `restorableUntilEpochMillis`; after that it is not found. The reply is the design's listing entry.

Read the discussion on a design: every thread, where each is pinned — a markup stroke, a design node, or a point on the frame — whether it is resolved, and every reply under it. `sequence` rises on each change and is the cursor to quote to ui_builder_await_comments. Comments are kept beside the design and are never part of it: no node holds them and no export sees them. Each thread carries `acknowledgedBy`, so you can see what you have already caught up with; say you have read the rest with ui_builder_acknowledge_comment.

Say something on a design — a reply into `threadId`, or a new thread when it is omitted. Pin a new thread with `markId` (a stroke on the reference overlay), `nodeId` (a node in the design), or `x`/`y` in frame fractions, so the person reading it can see what you meant. The comment is attributed to your own grant; you cannot post as somebody else.

Close a comment thread once it is answered, or reopen one by passing `resolved: false`. The resolution is attributed to you and is reversible.

Say that you have read a comment thread — which is **not** the same as resolving it. Resolving claims the question is settled; acknowledging claims only that you have seen it, which is the honest thing to say while you are still working on what it asked for. Omit `threadId` to acknowledge the whole discussion, which is what you mean after reading it with ui_builder_list_comments. Acknowledgement is per actor, so a thread you have read is still waiting for the other people in the design, and it is what clears the `comments` block the server puts on your ui_builder_apply, ui_builder_get_design, ui_builder_export and ui_builder_put_asset replies.

React to one comment with an emoji, or take the reaction back with `on: false`. The lightest thing you can say: 👀 on a comment you have just picked up, 👍 on a fix somebody made, where a reply would be noise in a thread a person has to read. `commentId` is the `id` of a comment inside a thread, from ui_builder_list_comments. Reacting also acknowledges that thread for you, so it counts as the lightest acknowledgement; it says nothing about whether the question is settled.

Wait for the discussion to move past `afterSequence` and return it, rather than polling for it. Returns as soon as anybody — a designer in the browser or another agent — posts, resolves or deletes; returns a `timedOut` reply if nothing happens within `waitSeconds`, which you answer by calling again with the same cursor. This is how you hold a conversation about a design: post, wait, read, act.

Compile a design and render it with real Compose on this host, rather than in the browser's Wasm canvas — the way to see what a design looks like on Android. Returns the first frame, the token the live frame stream is opened with, and the design node ids the render is tagged with, so `catalog_get_preview_data` can report each node's bounds and a client can put selectable regions over the image. This host has a native render lane. The reply is not an McpResponseEnvelopeV1: the released contract defines no request type for a native render.

See a design the way a person in the editor sees it: a PNG of the canvas with the overlays drawn on — the `selection` outline, the `reference` picture when one is attached, the discussion's `comments` pins, and the layout `bounds` — and beside it JSON with the revision, each visible node's id and box, each pin's thread and position, all in the returned image's pixels. The picture is a short-lived signed https link by default; `inline: true` puts the bytes in the reply as well. The frame is the PNG export (`renderer: "export"`, the editor's own renderer), which reports no node boxes; `renderer: "native"` draws real Compose on a host with a native render lane, reports every node's box so the selection can be outlined, and needs the ui-builder-export capability. With no `renderer`, a non-empty `selection` is drawn on the native frame when the host has a lane and the caller the capability, and otherwise on the export with a note saying why it is not outlined. A node with no box is reported in `notes`, never drawn at a guessed position. Not an McpResponseEnvelopeV1.

Check a design before you show it to anybody — one call instead of validate, view and an accessibility pass. Runs `schema` (document shape), `catalog` (the pinned catalog's validation, the mutation reducer and the Compose export gate — what ui_builder_validate runs) and `a11y`: controls with no label, icons and pictures with no `contentDescription`, touch targets under 48dp, text and icon contrast under WCAG 4.5:1 / 3:1, and text in a fixed height that clips at 200% font scale. Check a stored design (`designId`, optionally a past `revision`), a whole `document`, or `operations` applied to a scratch copy of `designId` exactly as ui_builder_apply would — nothing is saved. Returns `summary` first, then `ok`, the counts, and `findings` with the `nodeId` each is about, so you can fix them with ui_builder_apply and check again. `rendered: true` measures touch targets on a native render where the host has one (needs the ui-builder-export capability). Contrast against theme roles is resolved with the Material 3 baseline scheme, in both the light and the dark theme when a colour follows the theme (the finding names the theme that fails), and reported as a warning, never an error. `hostLogic` checks a design's host logic would run (it loads, exports `init` and `onAction`, and `init` answers what the design can hold); a design without host logic passes it for free. `guidelines` runs only when named: a model judges the design against the Android design guides (developer.android.com) for its platform and reports each broken rule as a warning or note with its source. It uses this host's shared model key, so it runs only for the accounts the operator enabled and is reported as skipped for everyone else; with `rendered: true` the visual rules are judged on the native render too.

Run a stored design's host logic — the JavaScript in its `hostLogic` that stands in for the host feeding it, answering host actions by setting host inputs — headless, without a browser: `init`, then each of `actions` in order, as the editor's canvas runs it. Each action is `{"name": …, "value": …}`, exactly what a design's host action sends (a value is text, a whole number or a decimal; omit it for none). Returns `summary` first, then `ok` and `steps`: for `init` and each action, the program's private `state`, every host input's `values` as the canvas would draw them, which inputs the step `set`, and the `error` when its answer could not be used. A failing step keeps the values before it and the next action is still sent; a program that overruns its budget stops the run (`stopped`). Use it to show the logic works (a calculator shows 3 after `1 + 2 =`) and to find which key breaks it. Nothing is saved. At most 200 actions.

Read the exact prompt a design-guidelines model is given for a design, before anybody spends a key on it: the rules for the design's platform (Android design guidance from developer.android.com, each with its source), the fixed system prompt, the user message with the design tree and Compose source, the JSON schema the verdicts must follow, a sentence on where each part comes from, and the pictures as image blocks — a Wear screen on its device (and unrolled when it scrolls), a Wear widget in the Samsung and Pixel Watch containers, a phone or tablet design at phone and tablet size. It spends no key. Judge it with your own model, then record the verdicts with ui_builder_record_guidelines so the editor and other agents see them. `rendered: false` leaves out the pictures and source (and the visual rules), and needs only read access; otherwise it needs the ui-builder-export capability.

Read a design's latest design-guidelines result, whoever ran it — a person in the editor on their own key, ui_builder_check_design on this host's key, or an agent that recorded verdicts with ui_builder_record_guidelines. Returns the record (model, revision, rules asked, verdicts, `ranBy`), the findings it implies, and `stale: true` when the design has changed since it was checked.

Record your own model's verdicts on ui_builder_guidelines_prompt as the design's latest design-guidelines result, so the editor's Issues panel and other agents show them. Pass the `revision` and rule ids the prompt asked (`rules.asked[].id`), and one verdict per rule you answered: `pass`, `fail` or `not_applicable`, with `confidence` 0..1, the `nodeIds` it is about and a one-sentence `reason`. `ranBy` is taken from your credential. Returns what ui_builder_get_guidelines returns.

See one design on several devices in ONE picture: a contact sheet with a captioned cell per device × theme × font scale, plus each cell's device, size and box on the sheet. Nothing is saved — the design's environment is swapped on a scratch copy for each cell. Name `devices` by preset (phone_small, phone, phone_landscape, foldable_folded, foldable_unfolded, tablet_portrait, tablet_landscape, wear_small_round, wear_large_round, wear_square, tv_1080p, widget_small_round, widget_small_squircle, widget_small_rectangular, widget_large_round, widget_large_squircle, widget_large_rectangular) or as {widthDp, heightDp, label?, round?}; or a `formFactor` (phone, foldable, tablet, wear, tv, widget, adaptive) for its default set; with neither you get the design's own form factor — phone, foldable and tablet for a mobile catalog, the round watches for Wear, and for a Wear widget (a `widget-container-*` root) its own container in each widget host: Samsung round, Pixel Watch squircle and rectangular, at the container's frame. Widget host cells are drawn natively in that host when the caller holds ui-builder-export and the host has a native lane (`renderer: "native"`); otherwise by the editor's export, masked to the host's outline. Add `themes: ["light","dark"]` and `fontScales: [1, 2]` to cross them; at most 16 cells. The sheet is a short-lived signed https link kept under 3.5 MB, so a chat surface can show it inline; `inline: true` puts the bytes in the reply as well.

Record a review verdict — `approve` or `reject` — on one revision of a design, with an optional note. Kept beside the design, like comments: it never moves the revision. Recorded as an agent's decision, so a person waiting with ui_builder_await_decision's default `from: "human"` is not answered by it. Pass your own `decisionId` to make a retry idempotent.

Wait for somebody to approve or reject a design, rather than asking again whether they have. Returns as soon as a decision lands after `afterSequence` — by default only a person's (`from: "human"`), on any revision unless you name one — or a `timedOut` reply after `waitSeconds`. Every reply carries `latest` (the newest matching verdict, new or not) and `approved`, so `waitSeconds: 0` is a cheap, idempotent poll for a routine that can only check back later; quote the reply's `sequence` as the next `afterSequence`. People record theirs over the design's `decisions` HTTP route.

Record the pull request that implements a design: its URL, its `status` (draft, open, merged, closed), the design `revision` it implements, and — once you have compared the PR's rendered previews with the design — `previewMatch` {status: match|mismatch|unknown, evidence: a URL to the comparison, note}. Replaces the whole record; pass only `designId` to clear it. Writing the same record again changes nothing and wakes nobody. Needs write access to the design.

Everything the code side needs to implement a design, in one call: the revision, its links (issue, reference, PR, thread), the implementation PR with its status and whether its previews were found to match, the latest verdict on this revision, and the Compose export with the generator's diagnostics. `summary` says in one line whether the PR implements this revision and whether it was approved. `includeExport: false` leaves the Kotlin out and needs only read access; with it the call needs the ui-builder-export capability.

From a pull request back to the design(s) it implements: every design you can read whose implementation record or links name `pr`, with the implementation status and revision. Then call ui_builder_implementation_status for what the design expects.

Attach the picture a design is being built against — a Figma frame, a screenshot of a shipped screen, a mock — as its reference overlay, or `clear` it. The same overlay the browser editor's Frame, density and reference panel shows, so a person opening the design sees what you attached. Kept beside the design and never part of it: no node holds it, no export sees it, the revision does not move. Send PNG, JPEG, WebP or SVG bytes in `imageBase64`. For a Figma frame, fetch the picture with your Figma tools (a screenshot of the node) and pass the frame's URL as `sourceUrl`; this host fetches nothing itself. State the export scale as `density` (2 for a Figma 2x export) or in the name (`[email protected]`): without it a screen-shaped picture is read across the frame's width and anything else at the design's own density. The reply says what the picture is against the frame — size in dp, density, whether it is a screen or a region — and whether pixel comparison means anything. Marks drawn in the editor are kept; the alignment is reset, as a new picture in the editor does. A user-supplied image is stored on this host: say so, and attach it only with their permission.

Measure a design against its reference overlay (attach one with ui_builder_set_reference). Returns what the picture is against the frame and whether a pixel comparison means anything (`facts.pixelComparable` — a 328×56 dp crop stretched over a screen is not comparable until measured at its `actual` size); with `differences`, the share of pixels that differ and up to eight regions in dp, each with the layer it falls in; and for each of `nodeIds`, where that layer sits in the reference — from a box drawn over it in the editor, or a search of the reference's pixels, which for text also reads the font size — with the `alignment` that would make it agree (move, size, font size) and the exact `operations` to pass to ui_builder_apply. Nothing is written: apply the operations you agree with, then compare again and look with ui_builder_view. Layer matching needs node boxes, so `nodeIds` measures the native render (an export grant); differences alone use the PNG export. Treat `confident: false` as a hint to check, not an edit to make.

A design's retained revisions, newest first: each one's number, who made it, when, the operation that produced it (`setProperty ×2, insertNode`, `undo`, `restored r3`) and its document digest. `retention` says how far back the history still reaches — older revisions are gone, and get, diff, restore and fork stop at that floor. Page with `before`. Read access.

Compare two designs, or two retained revisions of one: nodes added, removed and moved, and properties, modifiers and other fields changed, each with its node id and path (`root/slot[index]/node`), plus changed document fields (title, environment, state). Works across a design and its fork. `b` defaults to the current revision of `a`'s design. Values are the protocol's own JSON, ready to send back through ui_builder_apply. Read access to both.

Make a retained revision the design's current content again, **forward**: it is committed as a new revision and nothing after it is lost, so a restore is undone by restoring again. `baseRevision` must be the current revision (a restore that raced an edit is refused as stale). `dryRun: true` writes nothing and returns the diff the restore would apply. Needs write access to the design.

Make a new design from one revision of another — yours to edit, owned by you, with its parent recorded: the fork's `forkedFrom` (design, revision, document digest) and the parent's `forks` both show in ui_builder_get_links. A fork is not a branch: it never inherits the parent's canonical home and nothing flows back on its own, so tell the person it exists and bring a chosen change back with ui_builder_apply on the parent. Needs write access on this server and read access to the parent.

Fork a design at a revision into a **branch** to explore an alternative, or to change it without trampling somebody editing it live. A branch is a design with its own id: edit it with ui_builder_apply, look at it with ui_builder_view or ui_builder_get_design, compare it with ui_builder_diff_designs, then bring it back with ui_builder_merge_branch or drop it with ui_builder_archive_branch. Branch N times from the same revision to try N alternatives: merging one archives the others. Branches of a branch are refused; so are asset uploads, restores and document replacements on a branch. Needs write access to the design.

A design's branches, newest first: each one's id, name, owner, status (open, merged, archived), fork revision, head revision and the number of commands a merge would replay; for a merged one the parent revision it landed at, for an archived sibling the branch whose merge superseded it. Read access to the design.

Replay a branch's edits onto its parent's current revision through the same reducer every edit goes through — all or nothing. The reply reports every command: `applied` with the revision it landed at and any `STALE_*` notice of what it overwrote, or `refused` with the rejection code that stopped the run (nothing is then written), plus `skippedOperationIds` and how many were never tried. Run `dryRun: true` first: it reports `merged: false` and `wouldMerge` (true when every command would land) and writes nothing. Resolve a refusal by passing that command's id in `skipOperationIds` (skip an undo with what it undoes), or branch again from the parent. On success the branch is merged and its open siblings — branches forked at the same revision — are archived. Needs write access to the parent.

Close a branch without merging it: it stays readable and listed, and can no longer be edited or merged. Needs write access to the parent, or to have made the branch.

Put a design's alternatives side by side in one call: the parent's head and each open branch (or the `branchIds` named) rendered into ONE picture — a short-lived signed https link, numbered by caption — plus, per branch, what it changes against the parent at its fork (counts and a few lines, as ui_builder_diff_designs reports them). Show the person the picture and the numbered list, then ask with ui_builder_pick_branch; merge the choice with ui_builder_merge_branch. Writes nothing. Read access to the design.

Ask the person which alternative (open branch) of a design to keep, and return their choice. In ChatGPT or Codex it is a thumbnail picker, one option per branch; with plain form elicitation it is a single-choice form; otherwise — and in chat tools like Slack — it returns a numbered list and one picture for YOU to post, and the person replies with a number. It never waits on a client that cannot answer. `outcome` is `chosen` (with `branchId`), `declined`, `ask-in-chat` or `no-branches`. Writes nothing: merge the chosen branch with ui_builder_merge_branch (dryRun first). Read access to the design.

List the structured data-product kinds of one catalog, optionally one preview. Name the catalog with 'catalog' (ids from catalog_list_projects) or a preview 'uri'.

Fetch the merged accessibility or annotation product for a preview. This lane requires live grant scope.

Storybook-MCP-compatible alias that lists every preview as a story.

Storybook-MCP-compatible preview metadata lookup.

Storybook-MCP-compatible rendering of one or more story ids. Requires live scope.