@ggui-ai/cli 0.15.0 → 0.17.0

package/README.md

@@ -46,7 +46,7 @@ ggui serve --mcp-only               # skip agent supervision
 - ✅ Local server, viewer, cookie-authenticated WebSocket subscribe/ack all work end-to-end.
 - ✅ `ggui_render` mints shortCodes and lands on the same-origin viewer.
 - ✅ Component-code generation is wired on the OSS path via `createUiGenerator()` from `@ggui-ai/ui-gen` — the same harness the hosted runtime uses. When no LLM credentials resolve (no `ANTHROPIC_API_KEY` / `OPENAI_API_KEY` / etc.), `ggui_render` returns an `isError: true` tool result whose `structuredContent.error.code` is `NO_CREDENTIALS`, with a message naming which key to set; supply a key to get full generation locally.
-- 🔒 Default auth is strict pairing — only pair-minted bearer tokens authenticate `/mcp` (pair via the landing page or `POST /pair`). `--dev-allow-all` (local dev / tunnel smoke) and `--public-demo` (rate-limited, operator-paid public demo) relax `/mcp` to any-bearer; `--multi-tenant` keeps strict auth with per-user provider-key scoping; `--oauth` mounts the OAuth 2.1 + DCR routes MCP custom-connector hosts (claude.ai, ChatGPT) need. Custom adapters via `createGguiServer({ auth })`.
+- 🔒 Default auth is strict pairing — only pair-minted bearer tokens authenticate `/mcp` (pair via the landing page or `POST /pair`). `--dev-allow-all` (local dev / tunnel smoke) and `--public-demo` (rate-limited, operator-paid public demo) relax `/mcp` to any-bearer; `--multi-user` keeps strict auth with per-user provider-key scoping; `--oauth` mounts the OAuth 2.1 + DCR routes MCP custom-connector hosts (claude.ai, ChatGPT) need. Custom adapters via `createGguiServer({ auth })`.
 
 ### `ggui dev`
 

package/dist/api-client.d.ts

@@ -61,7 +61,7 @@ export interface AppsCreateResponse {
     appId: string;
     /**
      * The app's MCP endpoint, used VERBATIM as `GGUI_MCP_URL` — `<base>/apps/<appId>`,
-     * with NO `/mcp` suffix. The per-app cloud pod serves the MCP transport at this
+     * with NO `/mcp` suffix. The hosted per-app server serves the MCP transport at this
      * bare path; appending `/mcp` (a local `ggui serve` convention) 404s. Carries
      * the deployment-correct host (prod `mcp.ggui.ai`, sandbox `<env>.mcp.sandbox…`),
      * so prefer it over any reconstructed/hardcoded URL. See `resolveDeployMcpUrl`.

package/dist/byok-resolver.d.ts

@@ -29,7 +29,7 @@
  *   2. **`~/.ggui/credentials.json`** — operator-persistent personal
  *      store. Backed by `PlaintextFileProviderKeyStore` from
  *      `@ggui-ai/mcp-server-core/plaintext` at the **global** app
- *      scope. Single-user, single-tenant; multi-app or multi-user
+ *      scope. Single-user, single-app; multi-app or multi-user
  *      deployments swap in a different `ProviderKeyStore` binding at
  *      composition time and bypass this resolver entirely.
  *

package/dist/byok-resolver.js

@@ -75,7 +75,7 @@ export function createByokResolver(opts = {}) {
                 return globalHit;
             // Step 3: credentials file at the end-user's identity scope.
             // Only consulted when the operator opted out of paying (no
-            // global key). The /settings UI under --multi-tenant writes
+            // global key). The /settings UI under --multi-user writes
             // here.
             if (resolveOpts?.userScope &&
                 resolveOpts.userScope !== BYOK_GLOBAL_APP_SCOPE) {

package/dist/cli.js

@@ -12,6 +12,7 @@ import { fileURLToPath } from 'node:url';
 import { GguiDevError, LocalUiRegistry, runDev } from '@ggui-ai/dev-stack';
 import { discoverLocalUis, discoverMcpMounts, discoverPrimitives, GguiJsonLoadError, loadTheme, } from '@ggui-ai/project-config/node';
 import { resolveAgentPlan } from './serve-fallback.js';
+import { DRAIN_DEADLINE_MS, armDrainDeadline } from './drain-deadline.js';
 import { buildAgentRuntime, describeTunnelSession, DEV_HELP, launchBrowser, openTunnel, parseDevFlags, resolveAgentCommand, resolveHubUrl, shouldAutoOpen, } from './dev-command.js';
 import { createNullTunnelProvider, discoverTunnelProvider, } from './tunnel-provider.js';
 import { ManifestBlueprintProvider, resolveStorageFromConfig, buildNoCredentialsGguiSession, } from '@ggui-ai/mcp-server';
@@ -632,7 +633,7 @@ async function runServeCommand(args) {
                 devAllowAll: parsed.devAllowAll,
                 withholdResultMeta: parsed.withholdResultMeta,
                 publicDemo: parsed.publicDemo,
-                multiTenant: parsed.multiTenant,
+                multiUser: parsed.multiUser,
                 oauth: parsed.oauth,
                 browserOrigins,
                 ...(parsed.publicBaseUrl !== undefined
@@ -650,7 +651,7 @@ async function runServeCommand(args) {
                 port: effectivePort,
                 devAllowAll: parsed.devAllowAll,
                 publicDemo: parsed.publicDemo,
-                multiTenant: parsed.multiTenant,
+                multiUser: parsed.multiUser,
                 oauth: parsed.oauth,
                 ...(parsed.publicBaseUrl !== undefined
                     ? { publicBaseUrl: parsed.publicBaseUrl }
@@ -1203,7 +1204,25 @@ function readVersion() {
     }
 }
 main(process.argv).then((code) => {
-    process.exit(code);
+    // Set the code and let the event loop drain — never `process.exit()`
+    // here. Every command closes its own handles before resolving, so the
+    // process ends on its own; a hard exit while the local embedding
+    // model is loaded runs ONNX Runtime's static teardown under its
+    // still-parked worker threads and aborts (`libc++abi … mutex lock
+    // failed`, SIGABRT on every Ctrl-C — #855). The journeys spec
+    // `serve-teardown.spec.ts` pins the clean exit on every serve shape.
+    process.exitCode = code;
+    // Bounded: a leaked handle must not turn Ctrl-C into a hang. If the
+    // loop has not drained by the deadline, the live resources are named
+    // on stderr and the process hard-exits with the same code.
+    armDrainDeadline({
+        exitCode: code,
+        deadlineMs: DRAIN_DEADLINE_MS,
+        exit: (c) => process.exit(c),
+        stderr: (line) => process.stderr.write(line),
+        setTimer: (fn, ms) => setTimeout(fn, ms),
+        liveResources: () => process.getActiveResourcesInfo(),
+    });
 }, (error) => {
     const message = error instanceof Error ? (error.stack ?? error.message) : String(error);
     process.stderr.write(`ggui: ${message}\n`);

package/dist/config-push.d.ts

@@ -39,7 +39,19 @@ export declare function readGenerationFromGguiJson(gguiJson: unknown): {
  *     backend enforces, so a deploy fails loud LOCALLY rather than with a
  *     confusing 422.
  */
-export declare function readThemeFromGguiJson(projectRoot: string, gguiJson: unknown): AppTheme | undefined;
+/** What `ggui.json#theme` resolves to for a deploy. */
+export interface ThemeRead {
+    /** The projection the PATCH ships. */
+    readonly theme: AppTheme;
+    /**
+     * The families the document's `typography.faces` declare, deduped in
+     * declaration order. The hosted path does not deliver them yet
+     * (ggui#990): the deploy names them so the fallback is visible, not
+     * silent.
+     */
+    readonly declaredFaceFamilies: readonly string[];
+}
+export declare function readThemeFromGguiJson(projectRoot: string, gguiJson: unknown): Promise<ThemeRead | undefined>;
 /**
  * Assert that none of the gadget bundle references point at a loopback host.
  *

package/dist/config-push.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"config-push.d.ts","sourceRoot":"","sources":["../src/config-push.ts"],"names":[],"mappings":"AAUA,OAAO,EAIL,KAAK,gBAAgB,EACrB,KAAK,QAAQ,EACd,MAAM,mBAAmB,CAAC;AAmB3B;;;;;;GAMG;AACH,wBAAgB,yBAAyB,CAAC,QAAQ,EAAE,OAAO,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAmBnF;AAED;;;;;;;;;GASG;AACH,wBAAgB,0BAA0B,CACxC,QAAQ,EAAE,OAAO,GAChB;IAAE,KAAK,EAAE,MAAM,CAAC;IAAC,SAAS,EAAE,KAAK,GAAG,SAAS,CAAA;CAAE,GAAG,SAAS,CAkB7D;AA4BD;;;;;;;;;;;;;;;;;GAiBG;AACH,wBAAgB,qBAAqB,CACnC,WAAW,EAAE,MAAM,EACnB,QAAQ,EAAE,OAAO,GAChB,QAAQ,GAAG,SAAS,CA4CtB;AAMD;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,4BAA4B,CAAC,OAAO,EAAE,gBAAgB,EAAE,GAAG,IAAI,CAiB9E;AAMD;;;;;;;;;;GAUG;AACH,wBAAsB,iBAAiB,CACrC,KAAK,EAAE,MAAM,EACb,QAAQ,GAAE,MAAsB,GAC/B,OAAO,CAAC,MAAM,CAAC,CA2FjB"}
+{"version":3,"file":"config-push.d.ts","sourceRoot":"","sources":["../src/config-push.ts"],"names":[],"mappings":"AAUA,OAAO,EAKL,KAAK,gBAAgB,EACrB,KAAK,QAAQ,EACd,MAAM,mBAAmB,CAAC;AAmB3B;;;;;;GAMG;AACH,wBAAgB,yBAAyB,CAAC,QAAQ,EAAE,OAAO,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAmBnF;AAED;;;;;;;;;GASG;AACH,wBAAgB,0BAA0B,CACxC,QAAQ,EAAE,OAAO,GAChB;IAAE,KAAK,EAAE,MAAM,CAAC;IAAC,SAAS,EAAE,KAAK,GAAG,SAAS,CAAA;CAAE,GAAG,SAAS,CAkB7D;AAGD;;;;;;;;;;;;;;;;;GAiBG;AACH,uDAAuD;AACvD,MAAM,WAAW,SAAS;IACxB,sCAAsC;IACtC,QAAQ,CAAC,KAAK,EAAE,QAAQ,CAAC;IACzB;;;;;OAKG;IACH,QAAQ,CAAC,oBAAoB,EAAE,SAAS,MAAM,EAAE,CAAC;CAClD;AAED,wBAAsB,qBAAqB,CACzC,WAAW,EAAE,MAAM,EACnB,QAAQ,EAAE,OAAO,GAChB,OAAO,CAAC,SAAS,GAAG,SAAS,CAAC,CA0DhC;AAMD;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,4BAA4B,CAAC,OAAO,EAAE,gBAAgB,EAAE,GAAG,IAAI,CAiB9E;AAMD;;;;;;;;;;GAUG;AACH,wBAAsB,iBAAiB,CACrC,KAAK,EAAE,MAAM,EACb,QAAQ,GAAE,MAAsB,GAC/B,OAAO,CAAC,MAAM,CAAC,CAqGjB"}

package/dist/config-push.js

@@ -8,7 +8,7 @@
  */
 import process from 'node:process';
 import { dirname } from 'node:path';
-import { appPublicEnvSchema, appThemeSchema, LOOPBACK_HOST_RE, } from '@ggui-ai/protocol';
+import { appPublicEnvSchema, appThemeSchema, canonicalOverlayHash, LOOPBACK_HOST_RE, } from '@ggui-ai/protocol';
 import { loadTheme, parseGguiJson } from '@ggui-ai/project-config/node';
 import { z } from 'zod';
 import { patchAppConfig } from './api-client.js';
@@ -73,53 +73,7 @@ export function readGenerationFromGguiJson(gguiJson) {
         return undefined;
     return { model, keySource: result.data.generation?.keySource ?? 'managed' };
 }
-/**
- * Parse a generated `:root { --ggui-x: val; … }` block into a flat
- * `{ '--ggui-x': 'val' }` map.
- *
- * The block is machine-generated by `@ggui-ai/design`'s theme parser
- * (one `--ggui-*: value;` declaration per line, wrapped in a `:root {…}`
- * selector), so a line-based parse is deterministic:
- *   - split on newlines;
- *   - on each line, split at the FIRST `:` (custom-property names never
- *     contain `:`, so the key is unambiguous even when the value does);
- *   - keep only `--ggui-*`-prefixed keys with a non-empty value. The
- *     `:root {` and `}` wrapper lines have no such key and drop out.
- */
-function parseCssVarBlock(css) {
-    const out = {};
-    for (const line of css.split('\n')) {
-        const i = line.indexOf(':');
-        if (i === -1)
-            continue;
-        const key = line.slice(0, i).trim();
-        let val = line.slice(i + 1).trim();
-        if (val.endsWith(';'))
-            val = val.slice(0, -1).trim();
-        if (key.startsWith('--ggui-') && val.length > 0)
-            out[key] = val;
-    }
-    return out;
-}
-/**
- * Resolve the developer's local `ggui.json#theme` into a concrete,
- * injection-safe {@link AppTheme} ready to PATCH to the cloud.
- *
- * Returns `undefined` when no `theme` field is declared (deploy leaves the
- * app's theme untouched).
- *
- * When a theme IS declared we parse the FULL manifest (via `parseGguiJson`)
- * — `loadTheme` requires the typed `GguiJsonV1` shape and resolves relative
- * `theme.file` paths against `projectRoot`, so a partial slice will not do.
- *
- * Throws with a clear, local message when:
- *   - the manifest is structurally invalid (so deploy fails before the wire);
- *   - the theme cannot be loaded (e.g. an unregistered preset id);
- *   - the resolved overlay fails `appThemeSchema` — the SAME validator the
- *     backend enforces, so a deploy fails loud LOCALLY rather than with a
- *     confusing 422.
- */
-export function readThemeFromGguiJson(projectRoot, gguiJson) {
+export async function readThemeFromGguiJson(projectRoot, gguiJson) {
     // Cheap pre-check on the raw value: no `theme` field → nothing to push,
     // and we avoid forcing a full-manifest parse on theme-less deploys.
     const presence = z
@@ -140,9 +94,20 @@ export function readThemeFromGguiJson(projectRoot, gguiJson) {
         throw new Error(`ggui.json: ${result.issue.message}`);
     }
     const loaded = result.theme;
+    // The wire's theme is the PROJECTION (ggui#987 §3): both modes'
+    // derived sets, attested; the declared mode is the default the card
+    // paints when no host announces one; the preset id is the label.
+    const overlays = loaded.overlays;
+    // The document's declared faces ride the wire verbatim (ggui#1093):
+    // `typography.faces` and `AppTheme.fonts` are ONE grammar now, so the
+    // deploy carries what the author declared instead of dropping it.
+    // Absence stays absence — no faces, no `fonts` member.
+    const fonts = loaded.document.typography?.faces ?? [];
     const theme = {
+        overlayHash: await canonicalOverlayHash({ overlays }),
+        overlays,
         mode: loaded.mode,
-        cssVariables: parseCssVarBlock(loaded.cssVariables),
+        ...(fonts.length > 0 ? { fonts: [...fonts] } : {}),
         ...(loaded.source === 'preset' ? { name: loaded.preset } : {}),
     };
     // Defense + clear local error: the resolved overlay must satisfy the same
@@ -152,7 +117,10 @@ export function readThemeFromGguiJson(projectRoot, gguiJson) {
     if (!parsed.success) {
         throw new Error(`ggui.json: resolved theme is invalid — ${parsed.error.issues[0]?.message ?? 'unexpected css value'}`);
     }
-    return parsed.data;
+    const declaredFaceFamilies = [
+        ...new Set((loaded.document.typography?.faces ?? []).map((face) => face.family)),
+    ];
+    return { theme: parsed.data, declaredFaceFamilies };
 }
 // ─────────────────────────────────────────────────────────────────────────────
 // Loopback guard
@@ -238,7 +206,15 @@ export async function runConfigPushStep(appId, startDir = process.cwd()) {
     try {
         // `loadTheme` resolves relative `theme.file` paths against the directory
         // containing ggui.json — the same root convention `storage.*.path` uses.
-        theme = readThemeFromGguiJson(dirname(gguiJsonPath), readResult.value);
+        const read = await readThemeFromGguiJson(dirname(gguiJsonPath), readResult.value);
+        theme = read?.theme;
+        if (read !== undefined && read.declaredFaceFamilies.length > 0) {
+            // ggui#990/#1093: the PATCH now CARRIES the faces (`AppTheme.fonts`)
+            // and a server on this release inlines them in the shell it serves.
+            // A deployment still running an older release cannot — so the deploy
+            // names the families once, as the version-skew line it is.
+            process.stderr.write(`ggui deploy: theme declares font faces (${read.declaredFaceFamilies.join(', ')}) — carried on the wire; a deployment older than this release paints the fallback stack until it rolls (ggui-ai/ggui#990).\n`);
+        }
     }
     catch (err) {
         process.stderr.write(`ggui deploy: ${err instanceof Error ? err.message : String(err)}\n`);

package/dist/deploy-command.d.ts

@@ -28,10 +28,10 @@ export declare function planDeploySteps(input: DeployInput): DeployStep[];
 /**
  * Resolve the `GGUI_MCP_URL` value `ggui deploy` wires into `.env.local`.
  *
- * The per-app cloud pod serves the MCP transport at the BARE per-app endpoint
+ * The hosted per-app server serves the MCP transport at the BARE per-app endpoint
  * `<base>/apps/<appId>` (the `connectUrl` the backend advertises) — NOT a
  * `/mcp` sub-path. The `/mcp` suffix is the LOCAL `ggui serve` convention;
- * appending it here produced a URL the per-app pod 404s, so the agent (which
+ * appending it here produced a URL the per-app server 404s, so the agent (which
  * reads GGUI_MCP_URL verbatim) could never connect to a deployed app.
  *
  *   - `connectUrl` present (a create-app ran this session) → use it VERBATIM —

package/dist/deploy-command.js

@@ -52,10 +52,10 @@ export function planDeploySteps(input) {
 /**
  * Resolve the `GGUI_MCP_URL` value `ggui deploy` wires into `.env.local`.
  *
- * The per-app cloud pod serves the MCP transport at the BARE per-app endpoint
+ * The hosted per-app server serves the MCP transport at the BARE per-app endpoint
  * `<base>/apps/<appId>` (the `connectUrl` the backend advertises) — NOT a
  * `/mcp` sub-path. The `/mcp` suffix is the LOCAL `ggui serve` convention;
- * appending it here produced a URL the per-app pod 404s, so the agent (which
+ * appending it here produced a URL the per-app server 404s, so the agent (which
  * reads GGUI_MCP_URL verbatim) could never connect to a deployed app.
  *
  *   - `connectUrl` present (a create-app ran this session) → use it VERBATIM —
@@ -330,7 +330,7 @@ export async function runDeployCommand(_args) {
                     break;
                 }
                 // No prior value → resolve the deployment-correct BARE per-app URL
-                // (see resolveDeployMcpUrl: the per-app pod serves MCP at the bare
+                // (see resolveDeployMcpUrl: the per-app server serves MCP at the bare
                 // endpoint, never `/mcp`). The fallback to the production default only
                 // fires when create-app didn't run this session — a first deploy always
                 // has connectUrl, so it never reaches the fallback in practice.

package/dist/drain-deadline.d.ts

@@ -0,0 +1,27 @@
+/**
+ * Bounded drain for the CLI's success path.
+ *
+ * `main()` resolves with an exit code and the process is expected to end on
+ * its own: every command closes its handles, and a hard `process.exit()`
+ * while the local embedding model is loaded aborts under ONNX Runtime's
+ * parked worker threads (#855). The drain is the contract — this is what
+ * happens if a future change leaks a handle: instead of a process that
+ * never ends (strictly worse for an operator than the abort it replaced),
+ * the deadline names the live resources on stderr and hard-exits with the
+ * code. The timer is unref'd so the deadline itself never keeps the loop
+ * alive; a drained loop exits before it fires and nothing is written.
+ */
+export declare const DRAIN_DEADLINE_MS = 5000;
+export interface DrainDeadlineDeps {
+    readonly exitCode: number;
+    readonly deadlineMs: number;
+    readonly exit: (code: number) => void;
+    readonly stderr: (line: string) => void;
+    readonly setTimer: (fn: () => void, ms: number) => {
+        unref: () => void;
+    };
+    /** `process.getActiveResourcesInfo()` — what still keeps the loop alive. */
+    readonly liveResources: () => readonly string[];
+}
+export declare function armDrainDeadline(deps: DrainDeadlineDeps): void;
+//# sourceMappingURL=drain-deadline.d.ts.map

package/dist/drain-deadline.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"drain-deadline.d.ts","sourceRoot":"","sources":["../src/drain-deadline.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AACH,eAAO,MAAM,iBAAiB,OAAQ,CAAC;AAEvC,MAAM,WAAW,iBAAiB;IAChC,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,IAAI,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,CAAC;IACtC,QAAQ,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,CAAC;IACxC,QAAQ,CAAC,QAAQ,EAAE,CAAC,EAAE,EAAE,MAAM,IAAI,EAAE,EAAE,EAAE,MAAM,KAAK;QAAE,KAAK,EAAE,MAAM,IAAI,CAAA;KAAE,CAAC;IACzE,4EAA4E;IAC5E,QAAQ,CAAC,aAAa,EAAE,MAAM,SAAS,MAAM,EAAE,CAAC;CACjD;AAED,wBAAgB,gBAAgB,CAAC,IAAI,EAAE,iBAAiB,GAAG,IAAI,CAS9D"}

package/dist/drain-deadline.js

@@ -0,0 +1,22 @@
+/**
+ * Bounded drain for the CLI's success path.
+ *
+ * `main()` resolves with an exit code and the process is expected to end on
+ * its own: every command closes its handles, and a hard `process.exit()`
+ * while the local embedding model is loaded aborts under ONNX Runtime's
+ * parked worker threads (#855). The drain is the contract — this is what
+ * happens if a future change leaks a handle: instead of a process that
+ * never ends (strictly worse for an operator than the abort it replaced),
+ * the deadline names the live resources on stderr and hard-exits with the
+ * code. The timer is unref'd so the deadline itself never keeps the loop
+ * alive; a drained loop exits before it fires and nothing is written.
+ */
+export const DRAIN_DEADLINE_MS = 5_000;
+export function armDrainDeadline(deps) {
+    const timer = deps.setTimer(() => {
+        const live = deps.liveResources();
+        deps.stderr(`ggui: shutdown did not drain within ${deps.deadlineMs}ms — live resources: ${live.length > 0 ? live.join(', ') : '(none reported)'}; exiting ${deps.exitCode}\n`);
+        deps.exit(deps.exitCode);
+    }, deps.deadlineMs);
+    timer.unref();
+}

package/dist/generation-probe.d.ts

@@ -14,7 +14,7 @@
  *      re-runs the resolver for the chosen provider with
  *      `userScope: ctx.appId`, so per-end-user keys stored at the
  *      caller's identity scope flip in at request time without a
- *      server restart. Multi-tenant `ggui serve` lives off this
+ *      server restart. Multi-user `ggui serve` lives off this
  *      seam: each authenticated user manages their OWN provider
  *      key via `/settings`, the resolver picks it up on the next
  *      `ggui_render`.
@@ -166,7 +166,7 @@ export interface GenerationBinding {
      * `true` when the boot scan resolved a key at the operator's
      * `'global'` scope (env or credentials-file). `false` means
      * generation will fall back to either the per-end-user key
-     * (multi-tenant) or the {@link GenerationDeps.onNoCredentials}
+     * (multi-user) or the {@link GenerationDeps.onNoCredentials}
      * card on first call.
      */
     readonly bootResolved: boolean;

package/dist/generation-probe.js

@@ -119,7 +119,7 @@ export async function probeGenerationBinding(opts) {
     const resolveLlm = async (ctx) => {
         // Per-call BYOK with `userScope: ctx.appId` — env + global
         // (operator) checked first, then the caller's identity scope
-        // (end-user). Multi-tenant + Anthropic-OAuth flows store
+        // (end-user). Multi-user + Anthropic-OAuth flows store
         // user-supplied bundles under `userId` here.
         const resolution = await opts.resolver.resolve(defaultProvider, {
             userScope: ctx.appId,

package/dist/mcp-backend.d.ts

@@ -110,7 +110,7 @@ export interface BuildMcpServerBackendOptions {
      * {@link probeGenerationBinding} — env (`ANTHROPIC_API_KEY` etc.)
      * first, then `~/.ggui/credentials.json`. Programmatic hosts
      * embedding `buildMcpServerBackend` directly supply their own
-     * `GenerationDeps` bundle (real BYOK in a hosted multi-tenant
+     * `GenerationDeps` bundle (real BYOK in a hosted multi-user
      * setting, a test double, etc.).
      */
     readonly generation?: GenerationDeps;
@@ -188,20 +188,20 @@ export interface BuildMcpServerBackendOptions {
      */
     readonly publicDemo?: boolean;
     /**
-     * Multi-tenant posture. Switches the `/ggui/console/llm-keys` gate
+     * Multi-user posture. Switches the `/ggui/console/llm-keys` gate
      * from admin-token to auth-adapter — each authenticated end-user
      * manages their OWN provider keys (scope = `userId` for `kind:'user'`
      * identities, `appId` for `kind:'app'`). `kind:'builder'` identities
-     * are rejected at the gate; multi-tenant is meaningless without a
+     * are rejected at the gate; multi-user is meaningless without a
      * real per-caller id.
      *
      * Strict-auth shape — every bearer must clear the `AuthAdapter`
      * (pairing-minted, OIDC, Cognito, or whatever the embedding host
      * binds). Mutually exclusive with `devAllowAll` and `publicDemo`;
      * the CLI rejects combinations at parse time. Surface =
-     * `--multi-tenant` CLI flag.
+     * `--multi-user` CLI flag.
      */
-    readonly multiTenant?: boolean;
+    readonly multiUser?: boolean;
     /**
      * Public base URL that replaces `http://<host>:<port>` when
      * composing `mcpApps.wsUrl` and `runtime.url`. Set this when the

package/dist/mcp-backend.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"mcp-backend.d.ts","sourceRoot":"","sources":["../src/mcp-backend.ts"],"names":[],"mappings":"AA0CA,OAAO,EAQL,KAAK,iBAAiB,EACtB,KAAK,0BAA0B,EAE/B,KAAK,gBAAgB,EACrB,KAAK,cAAc,EACnB,KAAK,WAAW,EAChB,KAAK,cAAc,EACnB,KAAK,gBAAgB,EACrB,KAAK,cAAc,EACnB,KAAK,qBAAqB,EAC1B,KAAK,cAAc,EACnB,KAAK,WAAW,EACjB,MAAM,qBAAqB,CAAC;AAO7B,OAAO,EAIL,KAAK,aAAa,EAKnB,MAAM,sCAAsC,CAAC;AAE9C,OAAO,KAAK,EAAE,WAAW,EAAE,UAAU,EAAE,MAAM,yBAAyB,CAAC;AACvE,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,sBAAsB,CAAC;AAMvD,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAEvD,MAAM,WAAW,4BAA4B;IAC3C;;;;;OAKG;IACH,QAAQ,CAAC,OAAO,CAAC,EAAE,qBAAqB,CAAC;IACzC;;;;;OAKG;IACH,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B;;;;OAIG;IACH,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB;;;;;;;OAOG;IACH,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB;;;;;;;OAOG;IACH,QAAQ,CAAC,iBAAiB,CAAC,EAAE,iBAAiB,CAAC;IAC/C;;;;;;;;;OASG;IACH,QAAQ,CAAC,UAAU,CAAC,EAAE,UAAU,CAAC;IACjC;;;;;;;;OAQG;IACH,QAAQ,CAAC,iBAAiB,CAAC,EAAE,SAAS,0BAA0B,EAAE,CAAC;IACnE;;;;;;;OAOG;IACH,QAAQ,CAAC,KAAK,CAAC,EAAE,WAAW,CAAC;IAC7B;;;;;;;OAOG;IACH,QAAQ,CAAC,WAAW,CAAC,EAAE,WAAW,CAAC;IACnC;;;;;OAKG;IACH,QAAQ,CAAC,aAAa,CAAC,EAAE,MACrB;QACE,QAAQ,CAAC,EAAE,CAAC,EAAE,MAAM,CAAC;QACrB,QAAQ,CAAC,IAAI,CAAC,EAAE,OAAO,GAAG,MAAM,CAAC;KAClC,GACD,SAAS,CAAC;IACd;;;;;;OAMG;IACH,QAAQ,CAAC,mBAAmB,CAAC,EAAE,CAAC,IAAI,EAAE,WAAW,GAAG,IAAI,KAAK,IAAI,CAAC;IAClE;;;;;;;;;;;;;OAaG;IACH,QAAQ,CAAC,UAAU,CAAC,EAAE,cAAc,CAAC;IAErC;;;;OAIG;IACH,QAAQ,CAAC,SAAS,CAAC,EAAE,SAAS,aAAa,EAAE,CAAC;IAE9C;;;;OAIG;IACH,QAAQ,CAAC,cAAc,CAAC,EAAE,aAAa,CAAC,MAAM,CAAC,CAAC;IAEhD;;;;;;;;;;;;;;;;OAgBG;IACH,QAAQ,CAAC,mBAAmB,CAAC,EAAE;QAC7B,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;QAC7B,QAAQ,CAAC,OAAO,EAAE,aAAa,CAAC;YAC9B,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;YACpB,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;YAC9B,QAAQ,CAAC,QAAQ,EAAE,UAAU,CAAC;SAC/B,CAAC,CAAC;KACJ,CAAC;IAEF;;;;;;;;;OASG;IACH,QAAQ,CAAC,SAAS,CAAC,EAAE,aAAa,CAAC,cAAc,CAAC,CAAC;IAEnD;;;;;;;;;OASG;IACH,QAAQ,CAAC,WAAW,CAAC,EAAE,OAAO,CAAC;IAE/B;;;;;;;;;;;;OAYG;IACH,QAAQ,CAAC,UAAU,CAAC,EAAE,OAAO,CAAC;IAE9B;;;;;;;;;;;;;OAaG;IACH,QAAQ,CAAC,WAAW,CAAC,EAAE,OAAO,CAAC;IAE/B;;;;;;;;;;OAUG;IACH,QAAQ,CAAC,aAAa,CAAC,EAAE,MAAM,CAAC;IAEhC;;;;;;;;;OASG;IACH,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAE3B;;;;;;;;;;;;;;OAcG;IACH,QAAQ,CAAC,KAAK,CAAC,EAAE,OAAO,CAAC;IAEzB;;;;;;;;OAQG;IACH,QAAQ,CAAC,eAAe,CAAC,EAAE,SAAS,GAAG,YAAY,GAAG,QAAQ,GAAG,SAAS,GAAG,KAAK,CAAC;IACnF;;;;;;;OAOG;IACH,QAAQ,CAAC,kBAAkB,CAAC,EAAE,OAAO,CAAC;IAEtC;;;;;;;;;;;OAWG;IACH,QAAQ,CAAC,aAAa,CAAC,EAAE,MAAM,CAAC;IAEhC;;;;;;;;;;;OAWG;IACH,QAAQ,CAAC,cAAc,CAAC,EAAE,cAAc,CAAC;IAEzC;;;;;;;;OAQG;IACH,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAC;IAE7B;;;;;;;;;OASG;IACH,QAAQ,CAAC,WAAW,CAAC,EAAE;QACrB,QAAQ,CAAC,QAAQ,CAAC,EAAE,cAAc,CAAC;QACnC,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC;KAC3B,CAAC;IAEF;;;;;;;;;OASG;IACH,QAAQ,CAAC,OAAO,CAAC,EAAE,SAAS,gBAAgB,EAAE,CAAC;IAE/C;;;;;;;;;;;OAWG;IACH,QAAQ,CAAC,SAAS,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;IAEtD;;;;;;OAMG;IACH,QAAQ,CAAC,kBAAkB,CAAC,EAAE,gBAAgB,CAAC;CAChD;AAED;;;;;;;;;;;;GAYG;AACH,wBAAgB,YAAY,CAAC,IAAI,SAAc,GAAG,OAAO,CAAC,MAAM,CAAC,CAkBhE;AAED;;;;;;GAMG;AACH,wBAAgB,qBAAqB,CAAC,IAAI,EAAE,4BAA4B,GAAG,YAAY,CA6kBtF"}
+{"version":3,"file":"mcp-backend.d.ts","sourceRoot":"","sources":["../src/mcp-backend.ts"],"names":[],"mappings":"AA0CA,OAAO,EAQL,KAAK,iBAAiB,EACtB,KAAK,0BAA0B,EAE/B,KAAK,gBAAgB,EACrB,KAAK,cAAc,EACnB,KAAK,WAAW,EAChB,KAAK,cAAc,EACnB,KAAK,gBAAgB,EACrB,KAAK,cAAc,EACnB,KAAK,qBAAqB,EAC1B,KAAK,cAAc,EACnB,KAAK,WAAW,EACjB,MAAM,qBAAqB,CAAC;AAO7B,OAAO,EAIL,KAAK,aAAa,EAKnB,MAAM,sCAAsC,CAAC;AAE9C,OAAO,KAAK,EAAE,WAAW,EAAE,UAAU,EAAE,MAAM,yBAAyB,CAAC;AACvE,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,sBAAsB,CAAC;AAMvD,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAEvD,MAAM,WAAW,4BAA4B;IAC3C;;;;;OAKG;IACH,QAAQ,CAAC,OAAO,CAAC,EAAE,qBAAqB,CAAC;IACzC;;;;;OAKG;IACH,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B;;;;OAIG;IACH,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB;;;;;;;OAOG;IACH,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB;;;;;;;OAOG;IACH,QAAQ,CAAC,iBAAiB,CAAC,EAAE,iBAAiB,CAAC;IAC/C;;;;;;;;;OASG;IACH,QAAQ,CAAC,UAAU,CAAC,EAAE,UAAU,CAAC;IACjC;;;;;;;;OAQG;IACH,QAAQ,CAAC,iBAAiB,CAAC,EAAE,SAAS,0BAA0B,EAAE,CAAC;IACnE;;;;;;;OAOG;IACH,QAAQ,CAAC,KAAK,CAAC,EAAE,WAAW,CAAC;IAC7B;;;;;;;OAOG;IACH,QAAQ,CAAC,WAAW,CAAC,EAAE,WAAW,CAAC;IACnC;;;;;OAKG;IACH,QAAQ,CAAC,aAAa,CAAC,EAAE,MACrB;QACE,QAAQ,CAAC,EAAE,CAAC,EAAE,MAAM,CAAC;QACrB,QAAQ,CAAC,IAAI,CAAC,EAAE,OAAO,GAAG,MAAM,CAAC;KAClC,GACD,SAAS,CAAC;IACd;;;;;;OAMG;IACH,QAAQ,CAAC,mBAAmB,CAAC,EAAE,CAAC,IAAI,EAAE,WAAW,GAAG,IAAI,KAAK,IAAI,CAAC;IAClE;;;;;;;;;;;;;OAaG;IACH,QAAQ,CAAC,UAAU,CAAC,EAAE,cAAc,CAAC;IAErC;;;;OAIG;IACH,QAAQ,CAAC,SAAS,CAAC,EAAE,SAAS,aAAa,EAAE,CAAC;IAE9C;;;;OAIG;IACH,QAAQ,CAAC,cAAc,CAAC,EAAE,aAAa,CAAC,MAAM,CAAC,CAAC;IAEhD;;;;;;;;;;;;;;;;OAgBG;IACH,QAAQ,CAAC,mBAAmB,CAAC,EAAE;QAC7B,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;QAC7B,QAAQ,CAAC,OAAO,EAAE,aAAa,CAAC;YAC9B,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;YACpB,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;YAC9B,QAAQ,CAAC,QAAQ,EAAE,UAAU,CAAC;SAC/B,CAAC,CAAC;KACJ,CAAC;IAEF;;;;;;;;;OASG;IACH,QAAQ,CAAC,SAAS,CAAC,EAAE,aAAa,CAAC,cAAc,CAAC,CAAC;IAEnD;;;;;;;;;OASG;IACH,QAAQ,CAAC,WAAW,CAAC,EAAE,OAAO,CAAC;IAE/B;;;;;;;;;;;;OAYG;IACH,QAAQ,CAAC,UAAU,CAAC,EAAE,OAAO,CAAC;IAE9B;;;;;;;;;;;;;OAaG;IACH,QAAQ,CAAC,SAAS,CAAC,EAAE,OAAO,CAAC;IAE7B;;;;;;;;;;OAUG;IACH,QAAQ,CAAC,aAAa,CAAC,EAAE,MAAM,CAAC;IAEhC;;;;;;;;;OASG;IACH,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAE3B;;;;;;;;;;;;;;OAcG;IACH,QAAQ,CAAC,KAAK,CAAC,EAAE,OAAO,CAAC;IAEzB;;;;;;;;OAQG;IACH,QAAQ,CAAC,eAAe,CAAC,EAAE,SAAS,GAAG,YAAY,GAAG,QAAQ,GAAG,SAAS,GAAG,KAAK,CAAC;IACnF;;;;;;;OAOG;IACH,QAAQ,CAAC,kBAAkB,CAAC,EAAE,OAAO,CAAC;IAEtC;;;;;;;;;;;OAWG;IACH,QAAQ,CAAC,aAAa,CAAC,EAAE,MAAM,CAAC;IAEhC;;;;;;;;;;;OAWG;IACH,QAAQ,CAAC,cAAc,CAAC,EAAE,cAAc,CAAC;IAEzC;;;;;;;;OAQG;IACH,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAC;IAE7B;;;;;;;;;OASG;IACH,QAAQ,CAAC,WAAW,CAAC,EAAE;QACrB,QAAQ,CAAC,QAAQ,CAAC,EAAE,cAAc,CAAC;QACnC,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC;KAC3B,CAAC;IAEF;;;;;;;;;OASG;IACH,QAAQ,CAAC,OAAO,CAAC,EAAE,SAAS,gBAAgB,EAAE,CAAC;IAE/C;;;;;;;;;;;OAWG;IACH,QAAQ,CAAC,SAAS,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;IAEtD;;;;;;OAMG;IACH,QAAQ,CAAC,kBAAkB,CAAC,EAAE,gBAAgB,CAAC;CAChD;AAED;;;;;;;;;;;;GAYG;AACH,wBAAgB,YAAY,CAAC,IAAI,SAAc,GAAG,OAAO,CAAC,MAAM,CAAC,CAkBhE;AAED;;;;;;GAMG;AACH,wBAAgB,qBAAqB,CAAC,IAAI,EAAE,4BAA4B,GAAG,YAAY,CAimBtF"}

package/dist/mcp-backend.js

@@ -166,7 +166,14 @@ export function buildMcpServerBackend(opts) {
     // fallback warning rather than a silent first-lookup degradation.
     // eslint-disable-next-line no-console -- one-shot boot signal, mirrors banner output
     console.warn(`[ggui:embedding] local ${embedding.id} (cache: ${embeddingCacheDir})`);
-    embedding.embed("warmup").catch((err) => {
+    const warmupStartedAt = Date.now();
+    embedding.embed("warmup").then(() => {
+        // One-shot boot signal: the model is loaded and semantic search is
+        // live from here. Harnesses wait on this line before exercising
+        // (or tearing down) the loaded-model path (#855).
+        // eslint-disable-next-line no-console -- one-shot boot signal, mirrors banner output
+        console.warn(`[ggui:embedding] warm — local model loaded in ${Date.now() - warmupStartedAt}ms`);
+    }, (err) => {
         const reason = err instanceof Error ? err.message : String(err);
         // No provider swap happens here — the local provider stays bound and
         // every embed() keeps failing, which search handlers absorb per-call
@@ -247,7 +254,7 @@ export function buildMcpServerBackend(opts) {
         }
     }
     // Per-app metadata store seeded from `ggui.json#theme.preset` (when
-    // the manifest declares a preset variant). Single-tenant OSS: any
+    // the manifest declares a preset variant). Single-app: any
     // appId the handlers see picks up this default theme via
     // `InMemoryAppMetadataStore.get`'s defaults fall-through. File-mode
     // themes don't have a registry id to surface here — agents pick from
@@ -405,12 +412,12 @@ export function buildMcpServerBackend(opts) {
             : {}),
         ...(resolvedMcpInstructions !== undefined ? { mcpInstructions: resolvedMcpInstructions } : {}),
         ...(resolvedWithhold ? { withholdResultMeta: true } : {}),
-        // `--multi-tenant` flips the `/ggui/console/llm-keys` gate from
+        // `--multi-user` flips the `/ggui/console/llm-keys` gate from
         // admin-token to auth-adapter. Default scope derivation in the
         // server picks up `userId` / `appId` from the resolved identity;
         // operators with composite scopes pass their own `providerKeyScope`
         // by composing `createGguiServer` directly.
-        ...(opts.multiTenant ? { providerKeysGate: "auth-adapter" } : {}),
+        ...(opts.multiUser ? { providerKeysGate: "auth-adapter" } : {}),
         // Gate OAuth login routes on publicBaseUrl. Without it the
         // redirect_uri can't be composed; the admin transport still mounts
         // so operators can paste credentials in advance.
@@ -538,6 +545,14 @@ export function buildMcpServerBackend(opts) {
         // `ggui.json#theme`; absent = `createGguiServer` falls back to its
         // `lightTheme`-backed default internally.
         ...(opts.theme ? { theme: opts.theme } : {}),
+        // The theme document's declared font faces (ggui#987 §5): the
+        // server unions their origins into every served shell's CSP and
+        // inlines the rules, so the faces load without host cooperation.
+        ...(opts.theme !== undefined &&
+            opts.theme.document.typography?.faces !== undefined &&
+            opts.theme.document.typography.faces.length > 0
+            ? { fontFaces: opts.theme.document.typography.faces }
+            : {}),
         // Console theme picker writer — paired with the admin-gated
         // `/ggui/console/theme` POST. Absent = picker UI surfaces a
         // read-only banner + POST returns 501. CLI sets this when

package/dist/push-command.d.ts

@@ -20,7 +20,7 @@ export interface PushRecord {
         /** Tool-identity catalog hash at export — feeds the import gate's re-key check. */
         readonly toolIdentityCatalogHash?: string;
     };
-    /** Compiled ESM JS, ready for the pod to evaluate directly (no pod-side esbuild). */
+    /** Compiled ESM JS, ready for the hosted server to evaluate directly (no server-side esbuild). */
     readonly compiledBytes: string;
 }
 export interface ParsedPushFlags {

package/dist/push-command.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"push-command.d.ts","sourceRoot":"","sources":["../src/push-command.ts"],"names":[],"mappings":"AAMA,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,mBAAmB,CAAC;AAWtD,kFAAkF;AAClF,MAAM,WAAW,UAAU;IACzB,2FAA2F;IAC3F,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,4DAA4D;IAC5D,QAAQ,CAAC,OAAO,EAAE,GAAG,CAAC;IACtB,QAAQ,CAAC,QAAQ,EAAE;QACjB,QAAQ,CAAC,QAAQ,EAAE,YAAY,CAAC;QAChC,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAC;QAC9B;;;;;WAKG;QACH,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;QACzB,8EAA8E;QAC9E,QAAQ,CAAC,wBAAwB,CAAC,EAAE,MAAM,CAAC;QAC3C,mFAAmF;QACnF,QAAQ,CAAC,uBAAuB,CAAC,EAAE,MAAM,CAAC;KAC3C,CAAC;IACF,qFAAqF;IACrF,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;CAChC;AAED,MAAM,WAAW,eAAe;IAC9B,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC;CACzB;AAMD,wBAAgB,cAAc,CAAC,IAAI,EAAE,SAAS,MAAM,EAAE,GAAG,eAAe,CA+BvE;AAMD;;;;;;;;;;GAUG;AACH,wBAAsB,UAAU,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CA0B9D;AAMD;;;;;;GAMG;AACH,wBAAsB,yBAAyB,CAAC,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,UAAU,EAAE,CAAC,CAyC1F;AAMD,eAAO,MAAM,SAAS,onBAerB,CAAC;AAEF,wBAAsB,cAAc,CAAC,IAAI,EAAE,SAAS,MAAM,EAAE,GAAG,OAAO,CAAC,MAAM,CAAC,CA4E7E"}
+{"version":3,"file":"push-command.d.ts","sourceRoot":"","sources":["../src/push-command.ts"],"names":[],"mappings":"AAMA,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,mBAAmB,CAAC;AAWtD,kFAAkF;AAClF,MAAM,WAAW,UAAU;IACzB,2FAA2F;IAC3F,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,4DAA4D;IAC5D,QAAQ,CAAC,OAAO,EAAE,GAAG,CAAC;IACtB,QAAQ,CAAC,QAAQ,EAAE;QACjB,QAAQ,CAAC,QAAQ,EAAE,YAAY,CAAC;QAChC,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAC;QAC9B;;;;;WAKG;QACH,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;QACzB,8EAA8E;QAC9E,QAAQ,CAAC,wBAAwB,CAAC,EAAE,MAAM,CAAC;QAC3C,mFAAmF;QACnF,QAAQ,CAAC,uBAAuB,CAAC,EAAE,MAAM,CAAC;KAC3C,CAAC;IACF,kGAAkG;IAClG,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;CAChC;AAED,MAAM,WAAW,eAAe;IAC9B,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC;CACzB;AAMD,wBAAgB,cAAc,CAAC,IAAI,EAAE,SAAS,MAAM,EAAE,GAAG,eAAe,CA+BvE;AAMD;;;;;;;;;;GAUG;AACH,wBAAsB,UAAU,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CA0B9D;AAMD;;;;;;GAMG;AACH,wBAAsB,yBAAyB,CAAC,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,UAAU,EAAE,CAAC,CAyC1F;AAMD,eAAO,MAAM,SAAS,onBAerB,CAAC;AAEF,wBAAsB,cAAc,CAAC,IAAI,EAAE,SAAS,MAAM,EAAE,GAAG,OAAO,CAAC,MAAM,CAAC,CA4E7E"}

package/dist/serve-command.d.ts

@@ -120,7 +120,7 @@ export interface ParsedServeFlags {
      */
     publicDemo: boolean;
     /**
-     * Multi-tenant posture. Switches the `/ggui/console/llm-keys` gate
+     * Multi-user posture. Switches the `/ggui/console/llm-keys` gate
      * from admin-token to auth-adapter — each authenticated end-user
      * manages their OWN provider keys (scope = `userId` for `kind:'user'`
      * identities, `appId` for `kind:'app'`). `kind:'builder'` identities
@@ -129,14 +129,14 @@ export interface ParsedServeFlags {
      * Strict-auth shape — every bearer must clear the `AuthAdapter`.
      * Mutually exclusive with {@link devAllowAll} and {@link publicDemo};
      * those modes collapse every identity to `kind:'builder'` which the
-     * multi-tenant gate rejects, so the combination would produce a
-     * server that's wired multi-tenant but can't authenticate anyone.
+     * multi-user gate rejects, so the combination would produce a
+     * server that's wired multi-user but can't authenticate anyone.
      *
      * Use case: a single `ggui serve` instance fronting many users (a
      * shared dev box, a small team server) where each user pastes their
      * own LLM key via /settings using their paired bearer.
      */
-    multiTenant: boolean;
+    multiUser: boolean;
     /**
      * Server-level MCP instructions preset (the string injected into
      * the LLM's system prompt above the tool catalog). Operator-tunable
@@ -312,13 +312,13 @@ export interface ServeBannerInputs {
      */
     readonly publicDemo?: boolean;
     /**
-     * When true, the auth section adds a "MULTI-TENANT" line below the
+     * When true, the auth section adds a "MULTI-USER" line below the
      * strict-auth blurb explaining that each user manages their own LLM
      * keys via /settings under their paired bearer. Set by
-     * `--multi-tenant`. Mutually exclusive with `devAllowAll` and
+     * `--multi-user`. Mutually exclusive with `devAllowAll` and
      * `publicDemo` at parse time.
      */
-    readonly multiTenant?: boolean;
+    readonly multiUser?: boolean;
     /**
      * Public base URL displayed under the local URLs when set via
      * `--public-base-url`. Reminds the operator which URL their tunnel
@@ -525,5 +525,5 @@ export interface RunServeOptions {
  * {@link describeServeBanner} / {@link describeAgentStatus}.
  */
 export declare function runServe(opts: RunServeOptions): Promise<number>;
-export declare const SERVE_HELP = "ggui serve \u2014 run the open self-hosted personal-mode app\n\nBoots the @ggui-ai/mcp-server binding with persistent defaults AND\n(by default) supervises your agent alongside it. The current MCP\nhandler surface is the blueprint-read family (search / list_featured\n/ render); more tools come online as @ggui-ai/mcp-server-handlers\ngrows.\n\nFirst-run bundle (all on by default):\n  - Landing page at /          \u2014 operator opens a browser and sees\n                                  server identity + pair-code card.\n  - Render viewer at /r/<code>  \u2014 same-origin viewer for renders\n                                  minted by ggui_render; same-origin\n                                  HTTP-only cookie authenticates the\n                                  live-channel /ws upgrade.\n  - POST /pair + POST /admin/pair/init \u2014 pairing endpoint for MCP\n                                  hosts and third-party clients.\n  - Live-channel /ws            \u2014 live render plane for MCP Apps\n                                  iframes and the console.\n\nEmbedding hosts that want a different shape (no landing page, no\npairing, programmatic control) should compose createGguiServer()\ndirectly in code rather than invoking `ggui serve`.\n\nUsage:\n  ggui serve [options]\n\nOptions:\n  --port <n>             Bind port (default: 6781, 0 = OS-assigned).\n  --host <addr>          Bind host (default: 127.0.0.1).\n  --mcp-only             Run just the MCP server; do not supervise an agent.\n  --dev-allow-all        Accept any non-empty bearer (incl. no bearer) as\n                         builder. Local-dev / tunnel smoke ONLY \u2014 never\n                         expose to the open internet.\n  --public-demo          Public-facing demo posture: same any-bearer auth\n                         as --dev-allow-all, plus per-IP rate limit on\n                         ggui_render (30 generations / 10 min) and a\n                         \"PUBLIC DEMO \u2014 operator pays\" banner. Mutually\n                         exclusive with --dev-allow-all.\n  --multi-tenant         Multi-tenant posture: switches the /settings LLM-\n                         keys gate from admin-token to auth-adapter so\n                         each authenticated end-user manages their OWN\n                         key plane (scope = userId/appId). kind:'builder'\n                         identities are rejected at the gate. Strict-auth\n                         only; mutually exclusive with --dev-allow-all\n                         and --public-demo. (Generation-time BYOK still\n                         resolves at the operator 'global' scope \u2014 a\n                         follow-up will thread per-user BYOK through\n                         ggui_render.)\n  --public-base-url <u>  Override the public base URL used to compose\n                         iframe-runtime + shortCode URLs. Set this to a\n                         tunnel URL (https://<random>.trycloudflare.com)\n                         when testing against a remote MCP host so URLs\n                         resolve from the host's perspective. Without\n                         this, URLs derive from --host:--port and only\n                         work from the same machine.\n  --browser-origin <o>   Allow pages at this origin past MCP-wire Origin\n                         validation (repeatable; env GGUI_BROWSER_ORIGINS,\n                         comma-separated). Pages on localhost need no\n                         entry. NOT authentication \u2014 /mcp still requires\n                         a bearer. Non-browser clients are unaffected.\n  --oauth                Mount OAuth 2.1 + PKCE + Dynamic Client\n                         Registration routes (.well-known/oauth-* +\n                         /oauth/{authorize,token,register}). Required\n                         for MCP custom-connector hosts (claude.ai,\n                         ChatGPT) whose Add Connector form has no field\n                         for a pre-shared bearer; OAuth lets them do\n                         a discovery \u2192 DCR \u2192 consent dance ending in\n                         the same paired bearer the strict-auth flow\n                         already mints. Pure-bearer clients (Claude\n                         Desktop with bearer in config) work without it.\n  --admin-token <t>      Pin the admin bearer that gates the console\n                         /keys plane (list / mint / revoke pairings +\n                         /admin-login route). Without this, the server\n                         mints a fresh ggui_admin_* token per boot and\n                         prints it on the banner. Pin a stable value\n                         when you want the bearer to survive restarts\n                         (e.g. paste once into a password manager).\n  --ephemeral            Disable cross-restart persistence. Without\n                         this flag, the HMAC secrets that sign MCP\n                         Apps bootstrap tokens and signed render URLs\n                         are read or minted under .ggui/persistent/\n                         (project-local if a ggui.json was resolved,\n                         else ~/.ggui/persistent/) so cached tokens\n                         survive a server restart. Pass this flag to\n                         keep restarts ephemeral (tests / CI / nuclear-\n                         revoke). Override the dir via GGUI_PERSISTENT_DIR.\n  --seed-pool <dir>      Load a read-only shared blueprint pool from a\n                         directory artifact (repeatable). Blueprints in it\n                         are reused by exact contract match, after your own.\n  --help, -h             Show this help.\n\nAgent runtime:\n  The default boots your agent alongside MCP. The agent's entry file\n  comes from ggui.json:\n\n    { \"agent\": { \"entry\": \"./agent.ts\" } }\n\n  Supported extensions: .js / .mjs / .cjs (node), .ts / .tsx / .mts\n  (node --import=tsx). No ggui.json, or no agent.entry, falls back\n  to MCP-only with a warning. Malformed ggui.json or a bad entry\n  is a hard error.\n\n  Agent crashes after startup are logged; the MCP server keeps\n  running. No auto-restart \u2014 compose that with your own supervisor.\n\nPersistent storage (default-on; opt-out via --ephemeral):\n  By default `ggui serve` writes a small bundle under .ggui/persistent/\n  (project-local if a ggui.json was resolved, else ~/.ggui/persistent/)\n  so cached MCP Apps tokens, signed render URLs, shortCodes, renders,\n  vectors, and paired bearers survive a restart \u2014 claude.ai chat-history\n  revisits keep working.\n\n  Bundle layout:\n\n    .ggui/persistent/\n      \u251C\u2500\u2500 ws-token-secret.hex       (HMAC, 0600)\n      \u251C\u2500\u2500 render-signer-secret.hex  (HMAC, 0600)\n      \u251C\u2500\u2500 short-codes.sqlite        (signed render-URL resolution)\n      \u251C\u2500\u2500 sessions.sqlite            (GguiSessionStore \u2014 renders + event history)\n      \u251C\u2500\u2500 vectors.sqlite            (RAG corpus)\n      \u2514\u2500\u2500 keys.json                 (paired bearers)\n\n  Override the dir with `GGUI_PERSISTENT_DIR`. Pass `--ephemeral` to\n  skip the bundle entirely (tests, CI loops, nuclear-revoke).\n\n  Explicit ggui.json#storage declarations always win \u2014 declare\n  `{ \"renders\": { \"driver\": \"memory\" } }` to opt renders back to\n  in-memory while keeping other surfaces persistent. Custom sqlite\n  paths via ggui.json#storage are honored verbatim:\n\n    {\n      \"storage\": {\n        \"renders\": { \"driver\": \"sqlite\", \"path\": \"./ggui-sessions.sqlite\" },\n        \"vectors\": { \"driver\": \"sqlite\", \"path\": \"./ggui-vectors.sqlite\" },\n        \"threads\": { \"driver\": \"sqlite\", \"path\": \"./ggui-threads.sqlite\" }\n      }\n    }\n\n  Threads: the persistent-chat route family (/threads) is opt-in.\n  Absent `storage.threads` leaves the routes unmounted \u2014 pairs\n  with Portal's self-hosted origins only when declared. Driver\n  semantics:\n    - `driver: \"sqlite\"` \u2014 durable. Threads survive restart.\n      /ggui/health reports `threads.durability: \"durable\"`;\n      Portal hides its non-durable caveat.\n    - `driver: \"memory\"` \u2014 routes mount but data is lost on\n      restart. /ggui/health reports `threads.durability:\n      \"ephemeral\"`; Portal shows its caveat.\n\n  Paths resolve relative to the ggui.json directory. The sqlite\n  driver needs `better-sqlite3` installed in your project.\n\nRecommended setups:\n\n  Local-only smoke (no tunnel, no remote MCP host):\n    ggui serve\n\n  claude.ai custom connector (over a public tunnel):\n    1. Tunnel: cloudflared tunnel --url http://localhost:6781\n    2. ggui serve --oauth \\\n                  --public-base-url https://<tunnel>.trycloudflare.com\n    3. Note PAIR_CODE from boot. Visit the landing page (the public URL\n       above), complete pairing, save the bearer.\n    4. claude.ai \u2192 Settings \u2192 Connectors \u2192 Add custom connector.\n       URL: https://<tunnel>.trycloudflare.com/mcp\n       Client ID / Secret: leave empty (server uses Dynamic Client\n       Registration; no pre-shared secret needed).\n    5. Click Connect \u2192 claude.ai redirects you to a paste-key page.\n       Paste the bearer from step 3. Done.\n\n  Quick local-dev WITHOUT auth (NEVER over a public tunnel):\n    ggui serve --dev-allow-all\n\nCurrent limits:\n  - Strict-auth only: /mcp rejects any bearer that isn't pair-minted.\n    The CLI pre-mints one pairing code on boot (printed as\n    `PAIR_CODE <code>` and shown in the banner + on the landing\n    page). Complete `POST /pair {code, deviceName}` to receive a\n    bearer you can use with MCP. Embed @ggui-ai/mcp-server in your\n    own entrypoint to inject a different AuthAdapter (OIDC, Cognito,\n    etc.) for production.\n  - Single-tenant: every request scopes to one `builder` app id.\n";
+export declare const SERVE_HELP = "ggui serve \u2014 run the open self-hosted personal-mode app\n\nBoots the @ggui-ai/mcp-server binding with persistent defaults AND\n(by default) supervises your agent alongside it. The current MCP\nhandler surface is the blueprint-read family (search / list_featured\n/ render); more tools come online as @ggui-ai/mcp-server-handlers\ngrows.\n\nFirst-run bundle (all on by default):\n  - Landing page at /          \u2014 operator opens a browser and sees\n                                  server identity + pair-code card.\n  - Render viewer at /r/<code>  \u2014 same-origin viewer for renders\n                                  minted by ggui_render; same-origin\n                                  HTTP-only cookie authenticates the\n                                  live-channel /ws upgrade.\n  - POST /pair + POST /admin/pair/init \u2014 pairing endpoint for MCP\n                                  hosts and third-party clients.\n  - Live-channel /ws            \u2014 live render plane for MCP Apps\n                                  iframes and the console.\n\nEmbedding hosts that want a different shape (no landing page, no\npairing, programmatic control) should compose createGguiServer()\ndirectly in code rather than invoking `ggui serve`.\n\nUsage:\n  ggui serve [options]\n\nOptions:\n  --port <n>             Bind port (default: 6781, 0 = OS-assigned).\n  --host <addr>          Bind host (default: 127.0.0.1).\n  --mcp-only             Run just the MCP server; do not supervise an agent.\n  --dev-allow-all        Accept any non-empty bearer (incl. no bearer) as\n                         builder. Local-dev / tunnel smoke ONLY \u2014 never\n                         expose to the open internet.\n  --public-demo          Public-facing demo posture: same any-bearer auth\n                         as --dev-allow-all, plus per-IP rate limit on\n                         ggui_render (30 generations / 10 min) and a\n                         \"PUBLIC DEMO \u2014 operator pays\" banner. Mutually\n                         exclusive with --dev-allow-all.\n  --multi-user         Multi-user posture: switches the /settings LLM-\n                         keys gate from admin-token to auth-adapter so\n                         each authenticated end-user manages their OWN\n                         key plane (scope = userId/appId). kind:'builder'\n                         identities are rejected at the gate. Strict-auth\n                         only; mutually exclusive with --dev-allow-all\n                         and --public-demo. (Generation-time BYOK still\n                         resolves at the operator 'global' scope \u2014 a\n                         follow-up will thread per-user BYOK through\n                         ggui_render.)\n  --public-base-url <u>  Override the public base URL used to compose\n                         iframe-runtime + shortCode URLs. Set this to a\n                         tunnel URL (https://<random>.trycloudflare.com)\n                         when testing against a remote MCP host so URLs\n                         resolve from the host's perspective. Without\n                         this, URLs derive from --host:--port and only\n                         work from the same machine.\n  --browser-origin <o>   Allow pages at this origin past MCP-wire Origin\n                         validation (repeatable; env GGUI_BROWSER_ORIGINS,\n                         comma-separated). Pages on localhost need no\n                         entry. NOT authentication \u2014 /mcp still requires\n                         a bearer. Non-browser clients are unaffected.\n  --oauth                Mount OAuth 2.1 + PKCE + Dynamic Client\n                         Registration routes (.well-known/oauth-* +\n                         /oauth/{authorize,token,register}). Required\n                         for MCP custom-connector hosts (claude.ai,\n                         ChatGPT) whose Add Connector form has no field\n                         for a pre-shared bearer; OAuth lets them do\n                         a discovery \u2192 DCR \u2192 consent dance ending in\n                         the same paired bearer the strict-auth flow\n                         already mints. Pure-bearer clients (Claude\n                         Desktop with bearer in config) work without it.\n  --admin-token <t>      Pin the admin bearer that gates the console\n                         /keys plane (list / mint / revoke pairings +\n                         /admin-login route). Without this, the server\n                         mints a fresh ggui_admin_* token per boot and\n                         prints it on the banner. Pin a stable value\n                         when you want the bearer to survive restarts\n                         (e.g. paste once into a password manager).\n  --ephemeral            Disable cross-restart persistence. Without\n                         this flag, the HMAC secrets that sign MCP\n                         Apps bootstrap tokens and signed render URLs\n                         are read or minted under .ggui/persistent/\n                         (project-local if a ggui.json was resolved,\n                         else ~/.ggui/persistent/) so cached tokens\n                         survive a server restart. Pass this flag to\n                         keep restarts ephemeral (tests / CI / nuclear-\n                         revoke). Override the dir via GGUI_PERSISTENT_DIR.\n  --seed-pool <dir>      Load a read-only shared blueprint pool from a\n                         directory artifact (repeatable). Blueprints in it\n                         are reused by exact contract match, after your own.\n  --help, -h             Show this help.\n\nAgent runtime:\n  The default boots your agent alongside MCP. The agent's entry file\n  comes from ggui.json:\n\n    { \"agent\": { \"entry\": \"./agent.ts\" } }\n\n  Supported extensions: .js / .mjs / .cjs (node), .ts / .tsx / .mts\n  (node --import=tsx). No ggui.json, or no agent.entry, falls back\n  to MCP-only with a warning. Malformed ggui.json or a bad entry\n  is a hard error.\n\n  Agent crashes after startup are logged; the MCP server keeps\n  running. No auto-restart \u2014 compose that with your own supervisor.\n\nPersistent storage (default-on; opt-out via --ephemeral):\n  By default `ggui serve` writes a small bundle under .ggui/persistent/\n  (project-local if a ggui.json was resolved, else ~/.ggui/persistent/)\n  so cached MCP Apps tokens, signed render URLs, shortCodes, renders,\n  vectors, and paired bearers survive a restart \u2014 claude.ai chat-history\n  revisits keep working.\n\n  Bundle layout:\n\n    .ggui/persistent/\n      \u251C\u2500\u2500 ws-token-secret.hex       (HMAC, 0600)\n      \u251C\u2500\u2500 render-signer-secret.hex  (HMAC, 0600)\n      \u251C\u2500\u2500 short-codes.sqlite        (signed render-URL resolution)\n      \u251C\u2500\u2500 sessions.sqlite            (GguiSessionStore \u2014 renders + event history)\n      \u251C\u2500\u2500 vectors.sqlite            (RAG corpus)\n      \u2514\u2500\u2500 keys.json                 (paired bearers)\n\n  Override the dir with `GGUI_PERSISTENT_DIR`. Pass `--ephemeral` to\n  skip the bundle entirely (tests, CI loops, nuclear-revoke).\n\n  Explicit ggui.json#storage declarations always win \u2014 declare\n  `{ \"renders\": { \"driver\": \"memory\" } }` to opt renders back to\n  in-memory while keeping other surfaces persistent. Custom sqlite\n  paths via ggui.json#storage are honored verbatim:\n\n    {\n      \"storage\": {\n        \"renders\": { \"driver\": \"sqlite\", \"path\": \"./ggui-sessions.sqlite\" },\n        \"vectors\": { \"driver\": \"sqlite\", \"path\": \"./ggui-vectors.sqlite\" },\n        \"threads\": { \"driver\": \"sqlite\", \"path\": \"./ggui-threads.sqlite\" }\n      }\n    }\n\n  Threads: the persistent-chat route family (/threads) is opt-in.\n  Absent `storage.threads` leaves the routes unmounted \u2014 pairs\n  with Portal's self-hosted origins only when declared. Driver\n  semantics:\n    - `driver: \"sqlite\"` \u2014 durable. Threads survive restart.\n      /ggui/health reports `threads.durability: \"durable\"`;\n      Portal hides its non-durable caveat.\n    - `driver: \"memory\"` \u2014 routes mount but data is lost on\n      restart. /ggui/health reports `threads.durability:\n      \"ephemeral\"`; Portal shows its caveat.\n\n  Paths resolve relative to the ggui.json directory. The sqlite\n  driver needs `better-sqlite3` installed in your project.\n\nRecommended setups:\n\n  Local-only smoke (no tunnel, no remote MCP host):\n    ggui serve\n\n  claude.ai custom connector (over a public tunnel):\n    1. Tunnel: cloudflared tunnel --url http://localhost:6781\n    2. ggui serve --oauth \\\n                  --public-base-url https://<tunnel>.trycloudflare.com\n    3. Note PAIR_CODE from boot. Visit the landing page (the public URL\n       above), complete pairing, save the bearer.\n    4. claude.ai \u2192 Settings \u2192 Connectors \u2192 Add custom connector.\n       URL: https://<tunnel>.trycloudflare.com/mcp\n       Client ID / Secret: leave empty (server uses Dynamic Client\n       Registration; no pre-shared secret needed).\n    5. Click Connect \u2192 claude.ai redirects you to a paste-key page.\n       Paste the bearer from step 3. Done.\n\n  Quick local-dev WITHOUT auth (NEVER over a public tunnel):\n    ggui serve --dev-allow-all\n\nCurrent limits:\n  - Strict-auth only: /mcp rejects any bearer that isn't pair-minted.\n    The CLI pre-mints one pairing code on boot (printed as\n    `PAIR_CODE <code>` and shown in the banner + on the landing\n    page). Complete `POST /pair {code, deviceName}` to receive a\n    bearer you can use with MCP. Embed @ggui-ai/mcp-server in your\n    own entrypoint to inject a different AuthAdapter (OIDC, Cognito,\n    etc.) for production.\n  - Single-user: every request scopes to one `builder` app id.\n";
 //# sourceMappingURL=serve-command.d.ts.map

package/dist/serve-command.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"serve-command.d.ts","sourceRoot":"","sources":["../src/serve-command.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AACH,OAAO,KAAK,EACV,mBAAmB,EACnB,iBAAiB,EAEjB,sBAAsB,EACvB,MAAM,wBAAwB,CAAC;AAChC,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,qBAAqB,CAAC;AAG1D;;;;GAIG;AACH,eAAO,MAAM,kBAAkB,OAAO,CAAC;AAEvC,6DAA6D;AAC7D,eAAO,MAAM,kBAAkB,cAAc,CAAC;AAE9C,MAAM,WAAW,gBAAgB;IAC/B,+EAA+E;IAC/E,IAAI,EAAE,MAAM,CAAC;IACb,4DAA4D;IAC5D,IAAI,EAAE,MAAM,CAAC;IACb;;;;OAIG;IACH,OAAO,EAAE,OAAO,CAAC;IACjB;;;;;;;;;;OAUG;IACH,WAAW,EAAE,OAAO,CAAC;IACrB;;;;;;;;;;;OAWG;IACH,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB;;;;;;;;;;;;;;;;;;;;;;;OAuBG;IACH,KAAK,EAAE,OAAO,CAAC;IACf;;;;;;;;;;;;;;;;;;;;;;OAsBG;IACH,UAAU,EAAE,OAAO,CAAC;IACpB;;;;;;;;;;;;;;;;OAgBG;IACH,WAAW,EAAE,OAAO,CAAC;IACrB;;;;;;;;;;;;;;;OAeG;IACH,eAAe,CAAC,EAAE,SAAS,GAAG,YAAY,GAAG,QAAQ,GAAG,SAAS,GAAG,KAAK,CAAC;IAC1E;;;;;;;;;;OAUG;IACH,kBAAkB,EAAE,OAAO,CAAC;IAC5B;;;;;;;;;OASG;IACH,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB;;;;;;;;;OASG;IACH,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB;;;;;;;;;;;;;;OAcG;IACH,SAAS,CAAC,EAAE,OAAO,CAAC;IACpB;;;;;;;OAOG;IACH,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB;;;;;;;;;;;OAWG;IACH,SAAS,EAAE,MAAM,EAAE,CAAC;IACpB;;;;;;OAMG;IACH,cAAc,EAAE,MAAM,EAAE,CAAC;IACzB,8EAA8E;IAC9E,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAED;;;;;;;;;GASG;AACH,wBAAgB,eAAe,CAAC,IAAI,EAAE,SAAS,MAAM,EAAE,GAAG,gBAAgB,CAgLzE;AAED;;;;GAIG;AACH,MAAM,MAAM,WAAW,GACnB;IACE,QAAQ,CAAC,IAAI,EAAE,SAAS,CAAC;IACzB,6DAA6D;IAC7D,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,mDAAmD;IACnD,QAAQ,CAAC,QAAQ,EAAE,IAAI,GAAG,IAAI,CAAC;CAChC,GACD;IACE,QAAQ,CAAC,IAAI,EAAE,UAAU,CAAC;IAC1B,QAAQ,CAAC,MAAM,EAAE,mBAAmB,CAAC;CACtC,CAAC;AAEN,MAAM,MAAM,mBAAmB,GAC3B,YAAY,GACZ,cAAc,GACd,8BAA8B,CAAC;AAEnC;;;;;;;;;;GAUG;AACH,MAAM,WAAW,iBAAiB;IAChC,wEAAwE;IACxE,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,6BAA6B;IAC7B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,sCAAsC;IACtC,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,oCAAoC;IACpC,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,uCAAuC;IACvC,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;IAC/B,6CAA6C;IAC7C,QAAQ,CAAC,KAAK,EAAE,WAAW,CAAC;IAC5B;;;;OAIG;IACH,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAC3B;;;OAGG;IACH,QAAQ,CAAC,iBAAiB,CAAC,EAAE,MAAM,CAAC;IACpC;;;OAGG;IACH,QAAQ,CAAC,WAAW,CAAC,EAAE,OAAO,CAAC;IAC/B;;;;;OAKG;IACH,QAAQ,CAAC,UAAU,CAAC,EAAE,OAAO,CAAC;IAC9B;;;;;;OAMG;IACH,QAAQ,CAAC,WAAW,CAAC,EAAE,OAAO,CAAC;IAC/B;;;;;OAKG;IACH,QAAQ,CAAC,aAAa,CAAC,EAAE,MAAM,CAAC;IAChC;;;;OAIG;IACH,QAAQ,CAAC,KAAK,CAAC,EAAE,OAAO,CAAC;IACzB;;;;OAIG;IACH,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAC;IAC7B;;;;;OAKG;IACH,QAAQ,CAAC,QAAQ,CAAC,EAAE,OAAO,CAAC;IAC5B;;;;;;OAMG;IACH,QAAQ,CAAC,cAAc,CAAC,EAAE,MAAM,CAAC;IACjC;;;OAGG;IACH,QAAQ,CAAC,cAAc,CAAC,EAAE,aAAa,CAAC,MAAM,CAAC,CAAC;CACjD;AAED,wBAAgB,mBAAmB,CAAC,KAAK,EAAE,iBAAiB,GAAG,MAAM,EAAE,CAgItE;AAED;;GAEG;AACH,wBAAgB,mBAAmB,CAAC,MAAM,EAAE,WAAW,GAAG,MAAM,CAa/D;AAED;;;;;;GAMG;AACH,MAAM,WAAW,YAAY;IAC3B,+DAA+D;IAC/D,MAAM,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;IACpD,yCAAyC;IACzC,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;IACvB,qDAAqD;IACrD,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,oCAAoC;IACpC,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,uCAAuC;IACvC,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;IAC/B;;;;;;OAMG;IACH,QAAQ,CAAC,qBAAqB,EAAE,MAAM,CAAC;IACvC;;;;;;;;;;OAUG;IACH,QAAQ,CAAC,WAAW,EAAE,SAAS,GAAG,MAAM,GAAG,QAAQ,CAAC;IACpD;;;;;;;;;;OAUG;IACH,QAAQ,CAAC,cAAc,EAAE,cAAc,GAAG,IAAI,CAAC;IAC/C;;;;;;;;;;OAUG;IACH,QAAQ,CAAC,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;IACnC;;;;;;;OAOG;IACH,QAAQ,CAAC,cAAc,CAAC,EAAE,MAAM,CAAC;CAClC;AAED;;;;;GAKG;AACH,MAAM,MAAM,mBAAmB,GAAG,MAAM,YAAY,CAAC;AAErD;;;;GAIG;AACH,MAAM,WAAW,qBAAqB;IACpC,QAAQ,CAAC,OAAO,EAAE,mBAAmB,CAAC;IACtC,QAAQ,CAAC,UAAU,EAAE,sBAAsB,CAAC;IAC5C;;;;;;OAMG;IACH,QAAQ,CAAC,OAAO,CAAC,EAAE,CAAC,KAAK,EAAE,iBAAiB,KAAK,IAAI,CAAC;CACvD;AAED;;;;GAIG;AACH,MAAM,WAAW,mBAAmB;IAClC,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC;IAC1B,gBAAgB,CACd,KAAK,EAAE,OAAO,EACd,OAAO,EAAE,MAAM,IAAI,EACnB,IAAI,CAAC,EAAE;QAAE,IAAI,CAAC,EAAE,OAAO,CAAA;KAAE,GACxB,IAAI,CAAC;CACT;AAED,MAAM,WAAW,eAAe;IAC9B;;;;;OAKG;IACH,QAAQ,CAAC,KAAK,EAAE,QAAQ,CAAC,IAAI,CAAC,gBAAgB,EAAE,OAAO,GAAG,WAAW,CAAC,CAAC,CAAC;IACxE,0DAA0D;IAC1D,QAAQ,CAAC,cAAc,EAAE,mBAAmB,CAAC;IAC7C;;;OAGG;IACH,QAAQ,CAAC,KAAK,CAAC,EAAE,qBAAqB,CAAC;IACvC,gFAAgF;IAChF,QAAQ,CAAC,WAAW,EAAE,WAAW,CAAC;IAClC;;;;;;OAMG;IACH,QAAQ,CAAC,QAAQ,CAAC,EAAE,OAAO,CAAC;IAC5B,iCAAiC;IACjC,QAAQ,CAAC,MAAM,EAAE;QAAE,KAAK,CAAC,KAAK,EAAE,MAAM,GAAG,IAAI,CAAA;KAAE,CAAC;IAChD;;;OAGG;IACH,QAAQ,CAAC,cAAc,EAAE,mBAAmB,CAAC;CAC9C;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,wBAAsB,QAAQ,CAAC,IAAI,EAAE,eAAe,GAAG,OAAO,CAAC,MAAM,CAAC,CAyJrE;AAED,eAAO,MAAM,UAAU,kvTAuLtB,CAAC"}
+{"version":3,"file":"serve-command.d.ts","sourceRoot":"","sources":["../src/serve-command.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AACH,OAAO,KAAK,EACV,mBAAmB,EACnB,iBAAiB,EAEjB,sBAAsB,EACvB,MAAM,wBAAwB,CAAC;AAChC,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,qBAAqB,CAAC;AAG1D;;;;GAIG;AACH,eAAO,MAAM,kBAAkB,OAAO,CAAC;AAEvC,6DAA6D;AAC7D,eAAO,MAAM,kBAAkB,cAAc,CAAC;AAE9C,MAAM,WAAW,gBAAgB;IAC/B,+EAA+E;IAC/E,IAAI,EAAE,MAAM,CAAC;IACb,4DAA4D;IAC5D,IAAI,EAAE,MAAM,CAAC;IACb;;;;OAIG;IACH,OAAO,EAAE,OAAO,CAAC;IACjB;;;;;;;;;;OAUG;IACH,WAAW,EAAE,OAAO,CAAC;IACrB;;;;;;;;;;;OAWG;IACH,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB;;;;;;;;;;;;;;;;;;;;;;;OAuBG;IACH,KAAK,EAAE,OAAO,CAAC;IACf;;;;;;;;;;;;;;;;;;;;;;OAsBG;IACH,UAAU,EAAE,OAAO,CAAC;IACpB;;;;;;;;;;;;;;;;OAgBG;IACH,SAAS,EAAE,OAAO,CAAC;IACnB;;;;;;;;;;;;;;;OAeG;IACH,eAAe,CAAC,EAAE,SAAS,GAAG,YAAY,GAAG,QAAQ,GAAG,SAAS,GAAG,KAAK,CAAC;IAC1E;;;;;;;;;;OAUG;IACH,kBAAkB,EAAE,OAAO,CAAC;IAC5B;;;;;;;;;OASG;IACH,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB;;;;;;;;;OASG;IACH,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB;;;;;;;;;;;;;;OAcG;IACH,SAAS,CAAC,EAAE,OAAO,CAAC;IACpB;;;;;;;OAOG;IACH,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB;;;;;;;;;;;OAWG;IACH,SAAS,EAAE,MAAM,EAAE,CAAC;IACpB;;;;;;OAMG;IACH,cAAc,EAAE,MAAM,EAAE,CAAC;IACzB,8EAA8E;IAC9E,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAED;;;;;;;;;GASG;AACH,wBAAgB,eAAe,CAAC,IAAI,EAAE,SAAS,MAAM,EAAE,GAAG,gBAAgB,CAgLzE;AAED;;;;GAIG;AACH,MAAM,MAAM,WAAW,GACnB;IACE,QAAQ,CAAC,IAAI,EAAE,SAAS,CAAC;IACzB,6DAA6D;IAC7D,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,mDAAmD;IACnD,QAAQ,CAAC,QAAQ,EAAE,IAAI,GAAG,IAAI,CAAC;CAChC,GACD;IACE,QAAQ,CAAC,IAAI,EAAE,UAAU,CAAC;IAC1B,QAAQ,CAAC,MAAM,EAAE,mBAAmB,CAAC;CACtC,CAAC;AAEN,MAAM,MAAM,mBAAmB,GAC3B,YAAY,GACZ,cAAc,GACd,8BAA8B,CAAC;AAEnC;;;;;;;;;;GAUG;AACH,MAAM,WAAW,iBAAiB;IAChC,wEAAwE;IACxE,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,6BAA6B;IAC7B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,sCAAsC;IACtC,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,oCAAoC;IACpC,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,uCAAuC;IACvC,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;IAC/B,6CAA6C;IAC7C,QAAQ,CAAC,KAAK,EAAE,WAAW,CAAC;IAC5B;;;;OAIG;IACH,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAC3B;;;OAGG;IACH,QAAQ,CAAC,iBAAiB,CAAC,EAAE,MAAM,CAAC;IACpC;;;OAGG;IACH,QAAQ,CAAC,WAAW,CAAC,EAAE,OAAO,CAAC;IAC/B;;;;;OAKG;IACH,QAAQ,CAAC,UAAU,CAAC,EAAE,OAAO,CAAC;IAC9B;;;;;;OAMG;IACH,QAAQ,CAAC,SAAS,CAAC,EAAE,OAAO,CAAC;IAC7B;;;;;OAKG;IACH,QAAQ,CAAC,aAAa,CAAC,EAAE,MAAM,CAAC;IAChC;;;;OAIG;IACH,QAAQ,CAAC,KAAK,CAAC,EAAE,OAAO,CAAC;IACzB;;;;OAIG;IACH,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAC;IAC7B;;;;;OAKG;IACH,QAAQ,CAAC,QAAQ,CAAC,EAAE,OAAO,CAAC;IAC5B;;;;;;OAMG;IACH,QAAQ,CAAC,cAAc,CAAC,EAAE,MAAM,CAAC;IACjC;;;OAGG;IACH,QAAQ,CAAC,cAAc,CAAC,EAAE,aAAa,CAAC,MAAM,CAAC,CAAC;CACjD;AAED,wBAAgB,mBAAmB,CAAC,KAAK,EAAE,iBAAiB,GAAG,MAAM,EAAE,CAgItE;AAED;;GAEG;AACH,wBAAgB,mBAAmB,CAAC,MAAM,EAAE,WAAW,GAAG,MAAM,CAa/D;AAED;;;;;;GAMG;AACH,MAAM,WAAW,YAAY;IAC3B,+DAA+D;IAC/D,MAAM,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;IACpD,yCAAyC;IACzC,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;IACvB,qDAAqD;IACrD,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,oCAAoC;IACpC,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,uCAAuC;IACvC,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;IAC/B;;;;;;OAMG;IACH,QAAQ,CAAC,qBAAqB,EAAE,MAAM,CAAC;IACvC;;;;;;;;;;OAUG;IACH,QAAQ,CAAC,WAAW,EAAE,SAAS,GAAG,MAAM,GAAG,QAAQ,CAAC;IACpD;;;;;;;;;;OAUG;IACH,QAAQ,CAAC,cAAc,EAAE,cAAc,GAAG,IAAI,CAAC;IAC/C;;;;;;;;;;OAUG;IACH,QAAQ,CAAC,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;IACnC;;;;;;;OAOG;IACH,QAAQ,CAAC,cAAc,CAAC,EAAE,MAAM,CAAC;CAClC;AAED;;;;;GAKG;AACH,MAAM,MAAM,mBAAmB,GAAG,MAAM,YAAY,CAAC;AAErD;;;;GAIG;AACH,MAAM,WAAW,qBAAqB;IACpC,QAAQ,CAAC,OAAO,EAAE,mBAAmB,CAAC;IACtC,QAAQ,CAAC,UAAU,EAAE,sBAAsB,CAAC;IAC5C;;;;;;OAMG;IACH,QAAQ,CAAC,OAAO,CAAC,EAAE,CAAC,KAAK,EAAE,iBAAiB,KAAK,IAAI,CAAC;CACvD;AAED;;;;GAIG;AACH,MAAM,WAAW,mBAAmB;IAClC,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC;IAC1B,gBAAgB,CACd,KAAK,EAAE,OAAO,EACd,OAAO,EAAE,MAAM,IAAI,EACnB,IAAI,CAAC,EAAE;QAAE,IAAI,CAAC,EAAE,OAAO,CAAA;KAAE,GACxB,IAAI,CAAC;CACT;AAED,MAAM,WAAW,eAAe;IAC9B;;;;;OAKG;IACH,QAAQ,CAAC,KAAK,EAAE,QAAQ,CAAC,IAAI,CAAC,gBAAgB,EAAE,OAAO,GAAG,WAAW,CAAC,CAAC,CAAC;IACxE,0DAA0D;IAC1D,QAAQ,CAAC,cAAc,EAAE,mBAAmB,CAAC;IAC7C;;;OAGG;IACH,QAAQ,CAAC,KAAK,CAAC,EAAE,qBAAqB,CAAC;IACvC,gFAAgF;IAChF,QAAQ,CAAC,WAAW,EAAE,WAAW,CAAC;IAClC;;;;;;OAMG;IACH,QAAQ,CAAC,QAAQ,CAAC,EAAE,OAAO,CAAC;IAC5B,iCAAiC;IACjC,QAAQ,CAAC,MAAM,EAAE;QAAE,KAAK,CAAC,KAAK,EAAE,MAAM,GAAG,IAAI,CAAA;KAAE,CAAC;IAChD;;;OAGG;IACH,QAAQ,CAAC,cAAc,EAAE,mBAAmB,CAAC;CAC9C;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,wBAAsB,QAAQ,CAAC,IAAI,EAAE,eAAe,GAAG,OAAO,CAAC,MAAM,CAAC,CAyJrE;AAED,eAAO,MAAM,UAAU,4uTAuLtB,CAAC"}

package/dist/serve-command.js

@@ -25,7 +25,7 @@ export function parseServeFlags(args) {
         devAllowAll: false,
         withholdResultMeta: false,
         publicDemo: false,
-        multiTenant: false,
+        multiUser: false,
         oauth: false,
         seedPools: [],
         browserOrigins: [],
@@ -71,8 +71,8 @@ export function parseServeFlags(args) {
             out.publicDemo = true;
             continue;
         }
-        if (arg === '--multi-tenant') {
-            out.multiTenant = true;
+        if (arg === '--multi-user') {
+            out.multiUser = true;
             continue;
         }
         if (arg === '--oauth') {
@@ -179,13 +179,13 @@ export function parseServeFlags(args) {
                 'public demo (rate-limited, "PUBLIC DEMO" copy). Pick one.',
         };
     }
-    if (out.multiTenant && (out.devAllowAll || out.publicDemo)) {
+    if (out.multiUser && (out.devAllowAll || out.publicDemo)) {
         return {
             ...out,
-            error: '--multi-tenant is incompatible with --dev-allow-all and --public-demo. ' +
-                'Multi-tenant requires real per-user identities (kind:"user" / kind:"app"); ' +
+            error: '--multi-user is incompatible with --dev-allow-all and --public-demo. ' +
+                'Multi-user requires real per-user identities (kind:"user" / kind:"app"); ' +
                 'the any-bearer modes collapse every caller to kind:"builder" which the ' +
-                'multi-tenant gate rejects. Drop the other flag and pair with real bearers.',
+                'multi-user gate rejects. Drop the other flag and pair with real bearers.',
         };
     }
     return out;
@@ -256,8 +256,8 @@ export function describeServeBanner(input) {
     }
     else {
         lines.push(`  auth: strict — only pair-minted bearer tokens authenticate /mcp.`, `        Pair via the code above (landing page or \`POST /pair\`).`, `        Override the adapter via GguiServer({ auth }) in code for`, `        custom deployments (OIDC, Cognito, etc.).`);
-        if (input.multiTenant) {
-            lines.push(``, `  multi-tenant: each authenticated user manages their OWN LLM`, `        keys at /settings — the gate uses the request's bearer`, `        (Authorization: Bearer their-paired-token), NOT the`, `        admin token. Per-user scope is auto-derived from the`, `        identity (userId / appId).`, `        Note: ggui_render generation still resolves BYOK at the`, `        operator scope (env + credentials-file 'global'). Per-`, `        user generation-time BYOK is a follow-up — for now,`, `        multi-tenant lets each user MANAGE their key plane`, `        without granting them the operator's admin token.`);
+        if (input.multiUser) {
+            lines.push(``, `  multi-user: each authenticated user manages their OWN LLM`, `        keys at /settings — the gate uses the request's bearer`, `        (Authorization: Bearer their-paired-token), NOT the`, `        admin token. Per-user scope is auto-derived from the`, `        identity (userId / appId).`, `        Note: ggui_render generation still resolves BYOK at the`, `        operator scope (env + credentials-file 'global'). Per-`, `        user generation-time BYOK is a follow-up — for now,`, `        multi-user lets each user MANAGE their key plane`, `        without granting them the operator's admin token.`);
         }
         if (input.oauth) {
             lines.push(``, `  oauth: enabled — MCP custom-connector hosts (claude.ai etc.)`, `         can discover via /.well-known/oauth-* and complete the`, `         auth dance against /oauth/{authorize,token,register}.`, `         Paste the paired bearer on the consent page.`);
@@ -381,7 +381,7 @@ export async function runServe(opts) {
         agent: opts.agentStatus,
         devAllowAll: opts.flags.devAllowAll,
         publicDemo: opts.flags.publicDemo,
-        multiTenant: opts.flags.multiTenant,
+        multiUser: opts.flags.multiUser,
         oauth: opts.flags.oauth,
         ...(opts.flags.publicBaseUrl !== undefined
             ? { publicBaseUrl: opts.flags.publicBaseUrl }
@@ -490,7 +490,7 @@ Options:
                          ggui_render (30 generations / 10 min) and a
                          "PUBLIC DEMO — operator pays" banner. Mutually
                          exclusive with --dev-allow-all.
-  --multi-tenant         Multi-tenant posture: switches the /settings LLM-
+  --multi-user         Multi-user posture: switches the /settings LLM-
                          keys gate from admin-token to auth-adapter so
                          each authenticated end-user manages their OWN
                          key plane (scope = userId/appId). kind:'builder'
@@ -633,5 +633,5 @@ Current limits:
     bearer you can use with MCP. Embed @ggui-ai/mcp-server in your
     own entrypoint to inject a different AuthAdapter (OIDC, Cognito,
     etc.) for production.
-  - Single-tenant: every request scopes to one \`builder\` app id.
+  - Single-user: every request scopes to one \`builder\` app id.
 `;

package/dist/theme-command.d.ts

@@ -1,4 +1,4 @@
-export declare const THEME_HELP = "ggui theme \u2014 validate + inspect operator-authored DTCG themes\n\nUsage:\n  ggui theme <subcommand> [options]\n\nSubcommands:\n  validate <path>   Validate a JSON theme file against the ThemeDocumentV1 schema.\n\nRun `ggui theme <subcommand> --help` for subcommand-specific options.\n";
+export declare const THEME_HELP = "ggui theme \u2014 validate + inspect operator-authored DTCG themes\n\nUsage:\n  ggui theme <subcommand> [options]\n\nSubcommands:\n  validate <path>   Validate a JSON theme file against the ThemeDocumentV2 schema.\n\nRun `ggui theme <subcommand> --help` for subcommand-specific options.\n";
 export declare const THEME_VALIDATE_HELP = "ggui theme validate \u2014 validate a DTCG theme file\n\nUsage:\n  ggui theme validate <path>\n\nArguments:\n  <path>    Path to a JSON theme document (e.g. `./theme.json`).\n\nExit codes:\n  0   theme is valid\n  1   theme file is unreadable, not JSON, or fails schema validation\n  2   bad CLI usage (missing path argument)\n";
 export declare function runThemeCommand(args: readonly string[]): Promise<number>;
 //# sourceMappingURL=theme-command.d.ts.map

package/dist/theme-command.js

@@ -27,7 +27,7 @@ Usage:
   ggui theme <subcommand> [options]
 
 Subcommands:
-  validate <path>   Validate a JSON theme file against the ThemeDocumentV1 schema.
+  validate <path>   Validate a JSON theme file against the ThemeDocumentV2 schema.
 
 Run \`ggui theme <subcommand> --help\` for subcommand-specific options.
 `;
@@ -127,7 +127,7 @@ async function runValidate(args) {
  */
 function describeValidTheme(absPath, theme) {
     const lines = [];
-    const mark = process.stdout.isTTY ? '✓' : '✓';
+    const mark = process.stdout.isTTY ? '\x1b[32m✓\x1b[0m' : '✓';
     const nameSuffix = theme.$name ? ` (${theme.$name})` : '';
     lines.push(`${mark} Theme valid${nameSuffix}`);
     lines.push(`  file: ${absPath}`);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ggui-ai/cli",
-  "version": "0.15.0",
+  "version": "0.17.0",
   "description": "The `ggui` CLI — run the ggui protocol locally: dev server, self-hosted MCP server, and gadget / blueprint authoring. End-to-end OSS and self-hosted workflows; no account required.",
   "keywords": [
     "ggui",
@@ -37,22 +37,22 @@
     "@noble/hashes": "^1.6.0",
     "esbuild": "^0.28.2",
     "zod": "^4.3.6",
-    "@ggui-ai/artifact-manifest": "0.15.0",
-    "@ggui-ai/agent-runtime": "0.15.0",
-    "@ggui-ai/gadget-signing": "0.15.0",
-    "@ggui-ai/design": "0.15.0",
-    "@ggui-ai/dev-stack": "0.15.0",
-    "@ggui-ai/embedding-local": "0.15.0",
-    "@ggui-ai/mcp-server": "0.15.0",
-    "@ggui-ai/mcp-server-core": "0.15.0",
-    "@ggui-ai/preview-a2ui": "0.15.0",
-    "@ggui-ai/mcp-server-handlers": "0.15.0",
-    "@ggui-ai/project-config": "0.15.0",
-    "@ggui-ai/protocol": "0.15.0",
-    "@ggui-ai/registry-core": "0.15.0",
-    "@ggui-ai/iframe-runtime": "0.15.0",
-    "@ggui-ai/ui-gen": "0.15.0",
-    "@ggui-ai/ui-registry": "0.15.0"
+    "@ggui-ai/gadget-signing": "0.17.0",
+    "@ggui-ai/dev-stack": "0.17.0",
+    "@ggui-ai/design": "0.17.0",
+    "@ggui-ai/artifact-manifest": "0.17.0",
+    "@ggui-ai/agent-runtime": "0.17.0",
+    "@ggui-ai/embedding-local": "0.17.0",
+    "@ggui-ai/mcp-server": "0.17.0",
+    "@ggui-ai/mcp-server-handlers": "0.17.0",
+    "@ggui-ai/protocol": "0.17.0",
+    "@ggui-ai/preview-a2ui": "0.17.0",
+    "@ggui-ai/registry-core": "0.17.0",
+    "@ggui-ai/project-config": "0.17.0",
+    "@ggui-ai/iframe-runtime": "0.17.0",
+    "@ggui-ai/mcp-server-core": "0.17.0",
+    "@ggui-ai/ui-gen": "0.17.0",
+    "@ggui-ai/ui-registry": "0.17.0"
   },
   "devDependencies": {
     "@types/node": "^24.0.0",