@ggui-ai/cli 0.2.0-alpha.3 → 0.3.0-rc.0

package/dist/internal/auth-strategy.d.ts

@@ -1,48 +1,44 @@
 /**
- * Vendor-neutral auth strategy for marketplace CLI verbs
+ * Auth strategy for marketplace CLI verbs
  * (`ggui {gadget,blueprint} publish`).
  *
  * Two strategies — explicit `--auth=bearer` for self-hosted and local
- * registries, and the (default) hosted-auth flow for the cloud
- * registry. The default flow is implemented behind a vendor-neutral
- * function name (`acquireHostedAuthJwt`) so this surface never names
- * any specific identity provider; the underlying implementation in
- * `artifact-publish` calls the cloud's hosted auth provider.
- *
- * The public surface (this file, its consumers, and the CLI help
- * text) stays vendor-neutral.
+ * registries, and the (default) `ggui login` session: the CLI reuses
+ * the credential the device flow stored at `~/.ggui/auth.json`,
+ * refreshing it when expired. The session acquisition itself lives in
+ * `artifact-publish` (`acquireLoginSessionToken`) and is injected here
+ * as a callback so this router stays IO-free.
  *
  * @example
  * ```ts
  * import { parseAuthFlags, acquireAuthToken } from './internal/auth-strategy.js';
  *
  * const authFlags = parseAuthFlags(args);
- * const jwt = await acquireAuthToken({
+ * const token = await acquireAuthToken({
  *   flags: authFlags,
  *   env: process.env,
- *   registryUrl,
- *   acquireHostedAuthJwt,
+ *   acquireSessionToken,
  * });
  * ```
  */
 /**
- * Parsed `--auth=<mode>` + `--token <token>` flags. Vendor-neutral.
+ * Parsed `--auth=<mode>` + `--token <token>` flags.
  *
- * `auth: undefined` means "use the default (hosted auth via the
- * registry)". The only public flag value is `'bearer'`.
+ * `auth: undefined` means "use the default (the stored `ggui login`
+ * session)". The only public flag value is `'bearer'`.
  */
 export interface AuthFlags {
     /** Auth mode. Only `'bearer'` is admitted as a public value; absent
-     * means "default = hosted auth via the configured registry". */
+     * means "default = the stored `ggui login` session". */
     readonly auth?: 'bearer';
     /** Explicit bearer token. Used only when `auth === 'bearer'`. */
     readonly token?: string;
 }
 /**
  * Help-text fragment for the auth flags, inlined into each subcommand's
- * help block. Vendor-neutral copy — never name the identity provider.
+ * help block.
  */
-export declare const AUTH_HELP_FRAGMENT = "Auth:\n  --auth=bearer        Use a bearer token (for self-hosted or local\n                       registries). Pair with --token <token> or set\n                       GGUI_REGISTRY_TOKEN in the environment.\n  --token <token>      Bearer token (paired with --auth=bearer).\n  (default)            Hosted auth via the configured registry \u2014\n                       no flag needed; the CLI prompts for credentials\n                       on first publish and caches the resulting\n                       session at ~/.ggui/auth/<registry-host>/token.json.\n";
+export declare const AUTH_HELP_FRAGMENT = "Auth:\n  --auth=bearer        Use a bearer token (for self-hosted or local\n                       registries). Pair with --token <token> or set\n                       GGUI_REGISTRY_TOKEN in the environment.\n  --token <token>      Bearer token (paired with --auth=bearer).\n  (default)            Your `ggui login` session \u2014 the CLI reads\n                       ~/.ggui/auth.json and refreshes the token\n                       automatically when it has expired. Run\n                       `ggui login` first.\n";
 /**
  * Pop the auth-related flags out of an argv-like list, returning the
  * parsed flags + the residual args (so subcommand parsers can keep
@@ -58,22 +54,18 @@ export declare function parseAuthFlags(args: readonly string[]): {
     error: string;
 };
 /**
- * Hosted-auth callback shape. Vendor-neutral by design — the caller
- * injects the actual implementation (which today calls the cloud
- * registry's hosted auth vendor).
+ * Login-session callback shape. The caller injects the actual
+ * implementation (`acquireLoginSessionToken` in `artifact-publish`,
+ * which reads `~/.ggui/auth.json` + refreshes when expired).
  *
- * Returns the bearer JWT the CLI sends as `Authorization: Bearer <jwt>`.
+ * Returns the bearer token the CLI sends as `Authorization: Bearer <token>`.
  */
-export type HostedAuthAcquirer = (deps: {
-    readonly registryUrl: string;
-    readonly env: NodeJS.ProcessEnv;
-    readonly cwd: string;
-}) => Promise<string>;
+export type SessionTokenAcquirer = () => Promise<string>;
 /**
  * Acquire the auth token to send to the registry. Routes:
  *
  *   - `flags.auth === 'bearer'` → use `flags.token` || `GGUI_REGISTRY_TOKEN`
- *   - otherwise → call `acquireHostedAuthJwt`
+ *   - otherwise → call `acquireSessionToken` (the stored `ggui login` session)
  *
  * Throws (with an operator-readable message) when bearer auth is
  * selected but no token is supplied; the message names the env var so
@@ -82,8 +74,6 @@ export type HostedAuthAcquirer = (deps: {
 export declare function acquireAuthToken(deps: {
     readonly flags: AuthFlags;
     readonly env: NodeJS.ProcessEnv;
-    readonly cwd: string;
-    readonly registryUrl: string;
-    readonly acquireHostedAuthJwt: HostedAuthAcquirer;
+    readonly acquireSessionToken: SessionTokenAcquirer;
 }): Promise<string>;
 //# sourceMappingURL=auth-strategy.d.ts.map

package/dist/internal/auth-strategy.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"auth-strategy.d.ts","sourceRoot":"","sources":["../../src/internal/auth-strategy.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AAEH;;;;;GAKG;AACH,MAAM,WAAW,SAAS;IACxB;oEACgE;IAChE,QAAQ,CAAC,IAAI,CAAC,EAAE,QAAQ,CAAC;IACzB,iEAAiE;IACjE,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC;CACzB;AAED;;;GAGG;AACH,eAAO,MAAM,kBAAkB,sjBAS9B,CAAC;AAEF;;;;;;;GAOG;AACH,wBAAgB,cAAc,CAC5B,IAAI,EAAE,SAAS,MAAM,EAAE,GACtB;IAAE,KAAK,EAAE,SAAS,CAAC;IAAC,IAAI,EAAE,SAAS,MAAM,EAAE,CAAA;CAAE,GAAG;IAAE,KAAK,EAAE,MAAM,CAAA;CAAE,CAuDnE;AAED;;;;;;GAMG;AACH,MAAM,MAAM,kBAAkB,GAAG,CAAC,IAAI,EAAE;IACtC,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC,UAAU,CAAC;IAChC,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;CACtB,KAAK,OAAO,CAAC,MAAM,CAAC,CAAC;AAEtB;;;;;;;;;GASG;AACH,wBAAsB,gBAAgB,CAAC,IAAI,EAAE;IAC3C,QAAQ,CAAC,KAAK,EAAE,SAAS,CAAC;IAC1B,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC,UAAU,CAAC;IAChC,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,oBAAoB,EAAE,kBAAkB,CAAC;CACnD,GAAG,OAAO,CAAC,MAAM,CAAC,CAsBlB"}
+{"version":3,"file":"auth-strategy.d.ts","sourceRoot":"","sources":["../../src/internal/auth-strategy.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;GAsBG;AAEH;;;;;GAKG;AACH,MAAM,WAAW,SAAS;IACxB;4DACwD;IACxD,QAAQ,CAAC,IAAI,CAAC,EAAE,QAAQ,CAAC;IACzB,iEAAiE;IACjE,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC;CACzB;AAED;;;GAGG;AACH,eAAO,MAAM,kBAAkB,6gBAS9B,CAAC;AAEF;;;;;;;GAOG;AACH,wBAAgB,cAAc,CAC5B,IAAI,EAAE,SAAS,MAAM,EAAE,GACtB;IAAE,KAAK,EAAE,SAAS,CAAC;IAAC,IAAI,EAAE,SAAS,MAAM,EAAE,CAAA;CAAE,GAAG;IAAE,KAAK,EAAE,MAAM,CAAA;CAAE,CAuDnE;AAED;;;;;;GAMG;AACH,MAAM,MAAM,oBAAoB,GAAG,MAAM,OAAO,CAAC,MAAM,CAAC,CAAC;AAEzD;;;;;;;;;GASG;AACH,wBAAsB,gBAAgB,CAAC,IAAI,EAAE;IAC3C,QAAQ,CAAC,KAAK,EAAE,SAAS,CAAC;IAC1B,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC,UAAU,CAAC;IAChC,QAAQ,CAAC,mBAAmB,EAAE,oBAAoB,CAAC;CACpD,GAAG,OAAO,CAAC,MAAM,CAAC,CAkBlB"}

package/dist/internal/auth-strategy.js

@@ -1,43 +1,39 @@
 /**
- * Vendor-neutral auth strategy for marketplace CLI verbs
+ * Auth strategy for marketplace CLI verbs
  * (`ggui {gadget,blueprint} publish`).
  *
  * Two strategies — explicit `--auth=bearer` for self-hosted and local
- * registries, and the (default) hosted-auth flow for the cloud
- * registry. The default flow is implemented behind a vendor-neutral
- * function name (`acquireHostedAuthJwt`) so this surface never names
- * any specific identity provider; the underlying implementation in
- * `artifact-publish` calls the cloud's hosted auth provider.
- *
- * The public surface (this file, its consumers, and the CLI help
- * text) stays vendor-neutral.
+ * registries, and the (default) `ggui login` session: the CLI reuses
+ * the credential the device flow stored at `~/.ggui/auth.json`,
+ * refreshing it when expired. The session acquisition itself lives in
+ * `artifact-publish` (`acquireLoginSessionToken`) and is injected here
+ * as a callback so this router stays IO-free.
  *
  * @example
  * ```ts
  * import { parseAuthFlags, acquireAuthToken } from './internal/auth-strategy.js';
  *
  * const authFlags = parseAuthFlags(args);
- * const jwt = await acquireAuthToken({
+ * const token = await acquireAuthToken({
  *   flags: authFlags,
  *   env: process.env,
- *   registryUrl,
- *   acquireHostedAuthJwt,
+ *   acquireSessionToken,
  * });
  * ```
  */
 /**
  * Help-text fragment for the auth flags, inlined into each subcommand's
- * help block. Vendor-neutral copy — never name the identity provider.
+ * help block.
  */
 export const AUTH_HELP_FRAGMENT = `Auth:
   --auth=bearer        Use a bearer token (for self-hosted or local
                        registries). Pair with --token <token> or set
                        GGUI_REGISTRY_TOKEN in the environment.
   --token <token>      Bearer token (paired with --auth=bearer).
-  (default)            Hosted auth via the configured registry —
-                       no flag needed; the CLI prompts for credentials
-                       on first publish and caches the resulting
-                       session at ~/.ggui/auth/<registry-host>/token.json.
+  (default)            Your \`ggui login\` session — the CLI reads
+                       ~/.ggui/auth.json and refreshes the token
+                       automatically when it has expired. Run
+                       \`ggui login\` first.
 `;
 /**
  * Pop the auth-related flags out of an argv-like list, returning the
@@ -104,7 +100,7 @@ export function parseAuthFlags(args) {
  * Acquire the auth token to send to the registry. Routes:
  *
  *   - `flags.auth === 'bearer'` → use `flags.token` || `GGUI_REGISTRY_TOKEN`
- *   - otherwise → call `acquireHostedAuthJwt`
+ *   - otherwise → call `acquireSessionToken` (the stored `ggui login` session)
  *
  * Throws (with an operator-readable message) when bearer auth is
  * selected but no token is supplied; the message names the env var so
@@ -124,9 +120,5 @@ export async function acquireAuthToken(deps) {
         }
         return token;
     }
-    return deps.acquireHostedAuthJwt({
-        registryUrl: deps.registryUrl,
-        env: deps.env,
-        cwd: deps.cwd,
-    });
+    return deps.acquireSessionToken();
 }

package/dist/internal/register-author-key.d.ts

@@ -1,10 +1,11 @@
+import { type AuthFlags } from './auth-strategy.js';
 /**
  * Outcome discriminator. The `ok: false` `code` union surfaces specific
  * HTTP failure modes so callers (notably a future `--json` flag) can
  * branch on the registry's closed error set without parsing the human-
  * readable message:
  *
- *   - `unauthorized`     ← HTTP 401 (missing/invalid Cognito JWT).
+ *   - `unauthorized`     ← HTTP 401 (missing/invalid bearer credential).
  *   - `invalid_request`  ← HTTP 400 (malformed body or wrong key length).
  *   - `key_conflict`     ← HTTP 409 (collision against an existing row).
  *   - `http-error`       ← any other non-2xx (5xx or unexpected status).
@@ -29,6 +30,11 @@ export type RegisterKeyOutcome = {
 export interface RunRegisterKeyFlags {
     readonly scope: string;
     readonly registry?: string;
+    /** Auth strategy + bearer token. `undefined` → the stored `ggui
+     *  login` session; `{ auth: 'bearer', token? }` → explicit bearer
+     *  (self-hosted registries), token from the flag or
+     *  `GGUI_REGISTRY_TOKEN`. Mirrors the publish flow's `AuthFlags`. */
+    readonly auth?: AuthFlags;
 }
 export interface RunRegisterKeyDeps {
     readonly cwd: string;

package/dist/internal/register-author-key.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"register-author-key.d.ts","sourceRoot":"","sources":["../../src/internal/register-author-key.ts"],"names":[],"mappings":"AA2BA;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,MAAM,kBAAkB,GAC1B;IACE,QAAQ,CAAC,EAAE,EAAE,IAAI,CAAC;IAClB,QAAQ,CAAC,MAAM,EAAE,GAAG,GAAG,GAAG,CAAC;IAC3B,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;CACxB,GACD;IACE,QAAQ,CAAC,EAAE,EAAE,KAAK,CAAC;IACnB,QAAQ,CAAC,IAAI,EACT,aAAa,GACb,kBAAkB,GAClB,YAAY,GACZ,aAAa,GACb,qBAAqB,GACrB,eAAe,GACf,cAAc,GACd,iBAAiB,GACjB,cAAc,GACd,YAAY,GACZ,cAAc,CAAC;IACnB,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;CAC1B,CAAC;AAEN,MAAM,WAAW,mBAAmB;IAClC,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;CAC5B;AAED,MAAM,WAAW,kBAAkB;IACjC,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC,UAAU,CAAC;IAChC,QAAQ,CAAC,KAAK,EAAE,OAAO,KAAK,CAAC;IAC7B,QAAQ,CAAC,GAAG,EAAE,MAAM,MAAM,CAAC;CAC5B;AAED;;;GAGG;AACH,wBAAsB,oBAAoB,CACxC,KAAK,EAAE,mBAAmB,EAC1B,IAAI,EAAE,kBAAkB,GACvB,OAAO,CAAC,kBAAkB,CAAC,CA0J7B"}
+{"version":3,"file":"register-author-key.d.ts","sourceRoot":"","sources":["../../src/internal/register-author-key.ts"],"names":[],"mappings":"AA0BA,OAAO,EAAoB,KAAK,SAAS,EAAE,MAAM,oBAAoB,CAAC;AAGtE;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,MAAM,kBAAkB,GAC1B;IACE,QAAQ,CAAC,EAAE,EAAE,IAAI,CAAC;IAClB,QAAQ,CAAC,MAAM,EAAE,GAAG,GAAG,GAAG,CAAC;IAC3B,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;CACxB,GACD;IACE,QAAQ,CAAC,EAAE,EAAE,KAAK,CAAC;IACnB,QAAQ,CAAC,IAAI,EACT,aAAa,GACb,kBAAkB,GAClB,YAAY,GACZ,aAAa,GACb,qBAAqB,GACrB,eAAe,GACf,cAAc,GACd,iBAAiB,GACjB,cAAc,GACd,YAAY,GACZ,cAAc,CAAC;IACnB,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;CAC1B,CAAC;AAEN,MAAM,WAAW,mBAAmB;IAClC,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAC3B;;;yEAGqE;IACrE,QAAQ,CAAC,IAAI,CAAC,EAAE,SAAS,CAAC;CAC3B;AAED,MAAM,WAAW,kBAAkB;IACjC,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC,UAAU,CAAC;IAChC,QAAQ,CAAC,KAAK,EAAE,OAAO,KAAK,CAAC;IAC7B,QAAQ,CAAC,GAAG,EAAE,MAAM,MAAM,CAAC;CAC5B;AAcD;;;GAGG;AACH,wBAAsB,oBAAoB,CACxC,KAAK,EAAE,mBAAmB,EAC1B,IAAI,EAAE,kBAAkB,GACvB,OAAO,CAAC,kBAAkB,CAAC,CA6K7B"}

package/dist/internal/register-author-key.js

@@ -6,20 +6,36 @@
  * `aws dynamodb put-item` workflow that previously required raw IAM
  * credentials + registry table knowledge.
  *
- * The publisher's identity is the Cognito JWT's `sub` (server-side);
- * the body carries only `publicKeyBase64`. `keyId` is derived from the
- * public-key bytes on the server, so re-running with the same key is
- * idempotent (200 OK).
+ * The publisher's identity is derived server-side from the verified
+ * bearer credential; the body carries only `publicKeyBase64`. `keyId`
+ * is derived from the public-key bytes on the server, so re-running
+ * with the same key is idempotent (200 OK).
  *
- * Auth + registry-URL resolution match the publish flow (so the
- * cached token / `GGUI_REGISTRY` env / `ggui.json#registry` chain
- * works the same way operators are used to).
+ * Auth + registry-URL resolution match the publish flow (the stored
+ * `ggui login` session by default, `--auth=bearer --token <token>` /
+ * `GGUI_REGISTRY_TOKEN` for self-hosted registries; `GGUI_REGISTRY`
+ * env / `ggui.json#registry` URL chain works the same way operators
+ * are used to).
  */
 import { readFileSync } from 'node:fs';
 import { REGISTER_AUTHOR_KEY_ERROR_CODES } from '@ggui-ai/registry-core';
-import { acquireHostedAuthJwt, } from './artifact-publish.js';
+import { acquireLoginSessionToken, } from './artifact-publish.js';
 import { resolveRegistryUrl } from './artifact-search.js';
+import { acquireAuthToken } from './auth-strategy.js';
 import { getPublicKeyPath, hasKeypair } from './key-store.js';
+/**
+ * Sentinel that carries the structured {@link AuthFailed} payload
+ * through `acquireAuthToken`'s throwing session callback — the
+ * register flow's never-throws contract maps it back to an outcome.
+ * Mirrors `SessionAuthError` in `artifact-publish.ts`.
+ */
+class SessionOutcomeError extends Error {
+    payload;
+    constructor(payload) {
+        super(payload.error.message);
+        this.payload = payload;
+    }
+}
 /**
  * Run the register flow end-to-end. Never throws — every error path
  * returns a structured outcome.
@@ -75,18 +91,39 @@ export async function runRegisterAuthorKey(flags, deps) {
         };
     }
     const publicKeyBase64 = publicKeyBytes.toString('base64');
-    // 3. Hosted-auth Cognito JWT — same chain as publish.
-    const auth = await acquireHostedAuthJwt({
-        registryUrl: resolved.url,
-        env: deps.env,
-        cwd: deps.cwd,
-        now: deps.now,
-    });
-    if (!auth.ok) {
+    // 3. Credential — same two-path strategy as publish:
+    //    --auth=bearer → token from the flag or GGUI_REGISTRY_TOKEN
+    //    default       → the stored `ggui login` session.
+    let accessToken;
+    try {
+        accessToken = await acquireAuthToken({
+            flags: flags.auth ?? {},
+            env: deps.env,
+            acquireSessionToken: async () => {
+                const auth = await acquireLoginSessionToken({
+                    now: deps.now,
+                    fetchImpl: deps.fetch,
+                });
+                if (!auth.ok)
+                    throw new SessionOutcomeError(auth);
+                return auth.accessToken;
+            },
+        });
+    }
+    catch (err) {
+        if (err instanceof SessionOutcomeError) {
+            return {
+                ok: false,
+                code: err.payload.error.code,
+                message: err.payload.error.message,
+            };
+        }
+        // Bearer selected but no token supplied — `acquireAuthToken`
+        // throws with an operator-readable message naming the env var.
         return {
             ok: false,
-            code: auth.error.code,
-            message: auth.error.message,
+            code: 'auth_config_missing',
+            message: err instanceof Error ? err.message : String(err),
         };
     }
     // 4. POST /author-keys
@@ -97,7 +134,7 @@ export async function runRegisterAuthorKey(flags, deps) {
             method: 'POST',
             headers: {
                 'content-type': 'application/json',
-                authorization: `Bearer ${auth.token.idToken}`,
+                authorization: `Bearer ${accessToken}`,
             },
             body: JSON.stringify({ publicKeyBase64 }),
         });

package/dist/mcp-backend.d.ts

@@ -1,5 +1,6 @@
 import { type BlueprintProvider, type DiscoveredPrimitiveCatalog, type GadgetDescriptor, type GenerationDeps, type LoadedTheme, type McpServerMount, type McpUiDisplayMode, type OperatorConfig, type ResolvedStorageStores, type ShortCodeIndex, type ThemeWriter } from "@ggui-ai/mcp-server";
-import type { UiManifest } from "@ggui-ai/project-config";
+import { type BlueprintPool } from "@ggui-ai/mcp-server-handlers/renders";
+import type { ThemeConfig, UiManifest } from "@ggui-ai/project-config";
 import type { UiRegistry } from "@ggui-ai/ui-registry";
 import type { ServeBackend } from "./serve-command.js";
 export interface BuildMcpServerBackendOptions {
@@ -94,21 +95,15 @@ export interface BuildMcpServerBackendOptions {
      * Optional change notifier — fires from
      * `mountDevtoolThemeRoutes`'s POST handlers when the operator
      * saves a new theme via the picker. Pair with `themeProvider` so
-     * the push handler reads the live theme on every call.
+     * the render handler reads the live theme on every call.
+     * `null` = cleared.
      */
-    readonly onThemeConfigChange?: (next: string | {
-        preset: string;
-        mode?: "light" | "dark";
-        overrides?: Record<string, string>;
-    } | {
-        file: string;
-        mode?: "light" | "dark";
-    } | null) => void;
+    readonly onThemeConfigChange?: (next: ThemeConfig | null) => void;
     /**
      * Generation wiring for `ggui_render`. When present, the OSS render
      * handler invokes the bound `UiGenerator` on every story-path
-     * call and commits real componentCode as a `Render`. Absent =
-     * placeholder mode: render mints renderIds + shortCodes but does
+     * call and commits real componentCode as a `GguiSession`. Absent =
+     * placeholder mode: render mints sessionIds + shortCodes but does
      * not produce componentCode.
      *
      * The CLI resolves this from the operator's BYOK state at boot via
@@ -119,6 +114,12 @@ export interface BuildMcpServerBackendOptions {
      * setting, a test double, etc.).
      */
     readonly generation?: GenerationDeps;
+    /**
+     * Read-only shared/seed blueprint pools for cross-deployment reuse.
+     * Threaded into the handshake negotiator's `seedPools`. Built by the
+     * CLI from `--seed-pool` artifacts; absent ⇒ no shared pool.
+     */
+    readonly seedPools?: readonly BlueprintPool[];
     /**
      * Marketplace-install bridge data. When set, the backend
      * constructs an
@@ -127,8 +128,9 @@ export interface BuildMcpServerBackendOptions {
      * into `generation.installedBlueprints`. On the first
      * `matchBlueprint` call per scope, every entry with a contract is
      * compiled (esbuild) and registered into the cache with
-     * `provenance: 'install'` — so installed blueprints accelerate
-     * render the way synth-cached ones do.
+     * `source: {kind: 'user'}` + the `installed` lifecycle marker — so
+     * installed blueprints accelerate render the way cold-gen-cached
+     * ones do.
      *
      * Caller is responsible for filtering `entries` to actual
      * marketplace installs (typically: discovered UIs whose
@@ -258,17 +260,15 @@ export interface BuildMcpServerBackendOptions {
     readonly persistentDir?: string;
     /**
      * Pre-resolved `ShortCodeIndex` implementation. When set, replaces
-     * the default `InMemoryShortCodeIndex` — typically the caller passes
-     * `SqliteShortCodeIndex` rooted under `persistentDir` so cached
-     * `/api/bootstrap/<code>` URLs (and the `/r/<code>` viewer) keep
-     * resolving after a `ggui serve` restart. Without that, the index
-     * is process-local and every restart turns prior shortCodes into
-     * 404s — defeating the bootstrap-secret persistence above.
+     * the default `InMemoryShortCodeIndex` — e.g. a `SqliteShortCodeIndex`
+     * rooted under `persistentDir` so cached `/api/bootstrap/<code>` URLs
+     * keep resolving after a `ggui serve` restart. With the in-memory
+     * default the index is process-local and every restart turns prior
+     * shortCodes into 404s — defeating the bootstrap-secret persistence
+     * above.
      *
-     * Absent = `InMemoryShortCodeIndex` (the legacy default, fine for
-     * tests + `--ephemeral`). The CLI composes this via
-     * `createPersistentShortCodeIndex(persistentDir)` in cli.ts so the
-     * sqlite peer-dep loads lazily.
+     * Absent = `InMemoryShortCodeIndex` (the default, fine for tests +
+     * `--ephemeral`).
      */
     readonly shortCodeIndex?: ShortCodeIndex;
     /**
@@ -299,7 +299,7 @@ export interface BuildMcpServerBackendOptions {
      * Per-app gadget catalog from `ggui.json#app.gadgets`.
      * Gadgets (Leaflet, Mapbox, …) declared
      * here populate `App.gadgets` so the
-     * `assertGadgetsRegistered` validator (push, ops_register,
+     * `assertGadgetsRegistered` validator (render, ops_register,
      * ops_generate) accepts contracts that reference them.
      *
      * Omitted ⇒ `STDLIB_GADGETS` defaults from

package/dist/mcp-backend.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"mcp-backend.d.ts","sourceRoot":"","sources":["../src/mcp-backend.ts"],"names":[],"mappings":"AA0CA,OAAO,EAUL,KAAK,iBAAiB,EACtB,KAAK,0BAA0B,EAE/B,KAAK,gBAAgB,EACrB,KAAK,cAAc,EACnB,KAAK,WAAW,EAChB,KAAK,cAAc,EACnB,KAAK,gBAAgB,EACrB,KAAK,cAAc,EACnB,KAAK,qBAAqB,EAC1B,KAAK,cAAc,EACnB,KAAK,WAAW,EACjB,MAAM,qBAAqB,CAAC;AAW7B,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,yBAAyB,CAAC;AAC1D,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,sBAAsB,CAAC;AAOvD,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAEvD,MAAM,WAAW,4BAA4B;IAC3C;;;;;OAKG;IACH,QAAQ,CAAC,OAAO,CAAC,EAAE,qBAAqB,CAAC;IACzC;;;;;OAKG;IACH,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B;;;;OAIG;IACH,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB;;;;;;;OAOG;IACH,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB;;;;;;;OAOG;IACH,QAAQ,CAAC,iBAAiB,CAAC,EAAE,iBAAiB,CAAC;IAC/C;;;;;;;;;OASG;IACH,QAAQ,CAAC,UAAU,CAAC,EAAE,UAAU,CAAC;IACjC;;;;;;;;OAQG;IACH,QAAQ,CAAC,iBAAiB,CAAC,EAAE,SAAS,0BAA0B,EAAE,CAAC;IACnE;;;;;;;OAOG;IACH,QAAQ,CAAC,KAAK,CAAC,EAAE,WAAW,CAAC;IAC7B;;;;;;;OAOG;IACH,QAAQ,CAAC,WAAW,CAAC,EAAE,WAAW,CAAC;IACnC;;;;;OAKG;IACH,QAAQ,CAAC,aAAa,CAAC,EAAE,MACrB;QACE,QAAQ,CAAC,EAAE,CAAC,EAAE,MAAM,CAAC;QACrB,QAAQ,CAAC,IAAI,CAAC,EAAE,OAAO,GAAG,MAAM,CAAC;KAClC,GACD,SAAS,CAAC;IACd;;;;;OAKG;IACH,QAAQ,CAAC,mBAAmB,CAAC,EAAE,CAC7B,IAAI,EACA,MAAM,GACN;QAAE,MAAM,EAAE,MAAM,CAAC;QAAC,IAAI,CAAC,EAAE,OAAO,GAAG,MAAM,CAAC;QAAC,SAAS,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;KAAE,GAC/E;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,IAAI,CAAC,EAAE,OAAO,GAAG,MAAM,CAAA;KAAE,GACzC,IAAI,KACL,IAAI,CAAC;IACV;;;;;;;;;;;;;OAaG;IACH,QAAQ,CAAC,UAAU,CAAC,EAAE,cAAc,CAAC;IAErC;;;;;;;;;;;;;;;OAeG;IACH,QAAQ,CAAC,mBAAmB,CAAC,EAAE;QAC7B,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;QAC7B,QAAQ,CAAC,OAAO,EAAE,aAAa,CAAC;YAC9B,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;YACpB,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;YAC9B,QAAQ,CAAC,QAAQ,EAAE,UAAU,CAAC;SAC/B,CAAC,CAAC;KACJ,CAAC;IAEF;;;;;;;;;OASG;IACH,QAAQ,CAAC,SAAS,CAAC,EAAE,aAAa,CAAC,cAAc,CAAC,CAAC;IAEnD;;;;;;;;;OASG;IACH,QAAQ,CAAC,WAAW,CAAC,EAAE,OAAO,CAAC;IAE/B;;;;;;;;;;;;OAYG;IACH,QAAQ,CAAC,UAAU,CAAC,EAAE,OAAO,CAAC;IAE9B;;;;;;;;;;;;;OAaG;IACH,QAAQ,CAAC,WAAW,CAAC,EAAE,OAAO,CAAC;IAE/B;;;;;;;;;;OAUG;IACH,QAAQ,CAAC,aAAa,CAAC,EAAE,MAAM,CAAC;IAEhC;;;;;;;;;OASG;IACH,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAE3B;;;;;;;;;;;;;;OAcG;IACH,QAAQ,CAAC,KAAK,CAAC,EAAE,OAAO,CAAC;IAEzB;;;;;;;;OAQG;IACH,QAAQ,CAAC,eAAe,CAAC,EAAE,SAAS,GAAG,YAAY,GAAG,QAAQ,GAAG,SAAS,GAAG,KAAK,CAAC;IAEnF;;;;;;;;;;;OAWG;IACH,QAAQ,CAAC,aAAa,CAAC,EAAE,MAAM,CAAC;IAEhC;;;;;;;;;;;;;OAaG;IACH,QAAQ,CAAC,cAAc,CAAC,EAAE,cAAc,CAAC;IAEzC;;;;;;;;OAQG;IACH,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAC;IAE7B;;;;;;;;;OASG;IACH,QAAQ,CAAC,WAAW,CAAC,EAAE;QACrB,QAAQ,CAAC,QAAQ,CAAC,EAAE,cAAc,CAAC;QACnC,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC;KAC3B,CAAC;IAEF;;;;;;;;;OASG;IACH,QAAQ,CAAC,OAAO,CAAC,EAAE,SAAS,gBAAgB,EAAE,CAAC;IAE/C;;;;;;;;;;;OAWG;IACH,QAAQ,CAAC,SAAS,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;IAEtD;;;;;;OAMG;IACH,QAAQ,CAAC,kBAAkB,CAAC,EAAE,gBAAgB,CAAC;CAChD;AAED;;;;;;;;;;;;GAYG;AACH,wBAAgB,YAAY,CAAC,IAAI,SAAc,GAAG,OAAO,CAAC,MAAM,CAAC,CAkBhE;AAED;;;;;;GAMG;AACH,wBAAgB,qBAAqB,CAAC,IAAI,EAAE,4BAA4B,GAAG,YAAY,CAijBtF"}
+{"version":3,"file":"mcp-backend.d.ts","sourceRoot":"","sources":["../src/mcp-backend.ts"],"names":[],"mappings":"AA0CA,OAAO,EAQL,KAAK,iBAAiB,EACtB,KAAK,0BAA0B,EAE/B,KAAK,gBAAgB,EACrB,KAAK,cAAc,EACnB,KAAK,WAAW,EAChB,KAAK,cAAc,EACnB,KAAK,gBAAgB,EACrB,KAAK,cAAc,EACnB,KAAK,qBAAqB,EAC1B,KAAK,cAAc,EACnB,KAAK,WAAW,EACjB,MAAM,qBAAqB,CAAC;AAO7B,OAAO,EAIL,KAAK,aAAa,EAKnB,MAAM,sCAAsC,CAAC;AAE9C,OAAO,KAAK,EAAE,WAAW,EAAE,UAAU,EAAE,MAAM,yBAAyB,CAAC;AACvE,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,sBAAsB,CAAC;AAMvD,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAEvD,MAAM,WAAW,4BAA4B;IAC3C;;;;;OAKG;IACH,QAAQ,CAAC,OAAO,CAAC,EAAE,qBAAqB,CAAC;IACzC;;;;;OAKG;IACH,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B;;;;OAIG;IACH,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB;;;;;;;OAOG;IACH,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB;;;;;;;OAOG;IACH,QAAQ,CAAC,iBAAiB,CAAC,EAAE,iBAAiB,CAAC;IAC/C;;;;;;;;;OASG;IACH,QAAQ,CAAC,UAAU,CAAC,EAAE,UAAU,CAAC;IACjC;;;;;;;;OAQG;IACH,QAAQ,CAAC,iBAAiB,CAAC,EAAE,SAAS,0BAA0B,EAAE,CAAC;IACnE;;;;;;;OAOG;IACH,QAAQ,CAAC,KAAK,CAAC,EAAE,WAAW,CAAC;IAC7B;;;;;;;OAOG;IACH,QAAQ,CAAC,WAAW,CAAC,EAAE,WAAW,CAAC;IACnC;;;;;OAKG;IACH,QAAQ,CAAC,aAAa,CAAC,EAAE,MACrB;QACE,QAAQ,CAAC,EAAE,CAAC,EAAE,MAAM,CAAC;QACrB,QAAQ,CAAC,IAAI,CAAC,EAAE,OAAO,GAAG,MAAM,CAAC;KAClC,GACD,SAAS,CAAC;IACd;;;;;;OAMG;IACH,QAAQ,CAAC,mBAAmB,CAAC,EAAE,CAAC,IAAI,EAAE,WAAW,GAAG,IAAI,KAAK,IAAI,CAAC;IAClE;;;;;;;;;;;;;OAaG;IACH,QAAQ,CAAC,UAAU,CAAC,EAAE,cAAc,CAAC;IAErC;;;;OAIG;IACH,QAAQ,CAAC,SAAS,CAAC,EAAE,SAAS,aAAa,EAAE,CAAC;IAE9C;;;;;;;;;;;;;;;;OAgBG;IACH,QAAQ,CAAC,mBAAmB,CAAC,EAAE;QAC7B,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;QAC7B,QAAQ,CAAC,OAAO,EAAE,aAAa,CAAC;YAC9B,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;YACpB,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;YAC9B,QAAQ,CAAC,QAAQ,EAAE,UAAU,CAAC;SAC/B,CAAC,CAAC;KACJ,CAAC;IAEF;;;;;;;;;OASG;IACH,QAAQ,CAAC,SAAS,CAAC,EAAE,aAAa,CAAC,cAAc,CAAC,CAAC;IAEnD;;;;;;;;;OASG;IACH,QAAQ,CAAC,WAAW,CAAC,EAAE,OAAO,CAAC;IAE/B;;;;;;;;;;;;OAYG;IACH,QAAQ,CAAC,UAAU,CAAC,EAAE,OAAO,CAAC;IAE9B;;;;;;;;;;;;;OAaG;IACH,QAAQ,CAAC,WAAW,CAAC,EAAE,OAAO,CAAC;IAE/B;;;;;;;;;;OAUG;IACH,QAAQ,CAAC,aAAa,CAAC,EAAE,MAAM,CAAC;IAEhC;;;;;;;;;OASG;IACH,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAE3B;;;;;;;;;;;;;;OAcG;IACH,QAAQ,CAAC,KAAK,CAAC,EAAE,OAAO,CAAC;IAEzB;;;;;;;;OAQG;IACH,QAAQ,CAAC,eAAe,CAAC,EAAE,SAAS,GAAG,YAAY,GAAG,QAAQ,GAAG,SAAS,GAAG,KAAK,CAAC;IAEnF;;;;;;;;;;;OAWG;IACH,QAAQ,CAAC,aAAa,CAAC,EAAE,MAAM,CAAC;IAEhC;;;;;;;;;;;OAWG;IACH,QAAQ,CAAC,cAAc,CAAC,EAAE,cAAc,CAAC;IAEzC;;;;;;;;OAQG;IACH,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAC;IAE7B;;;;;;;;;OASG;IACH,QAAQ,CAAC,WAAW,CAAC,EAAE;QACrB,QAAQ,CAAC,QAAQ,CAAC,EAAE,cAAc,CAAC;QACnC,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC;KAC3B,CAAC;IAEF;;;;;;;;;OASG;IACH,QAAQ,CAAC,OAAO,CAAC,EAAE,SAAS,gBAAgB,EAAE,CAAC;IAE/C;;;;;;;;;;;OAWG;IACH,QAAQ,CAAC,SAAS,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;IAEtD;;;;;;OAMG;IACH,QAAQ,CAAC,kBAAkB,CAAC,EAAE,gBAAgB,CAAC;CAChD;AAED;;;;;;;;;;;;GAYG;AACH,wBAAgB,YAAY,CAAC,IAAI,SAAc,GAAG,OAAO,CAAC,MAAM,CAAC,CAkBhE;AAED;;;;;;GAMG;AACH,wBAAgB,qBAAqB,CAAC,IAAI,EAAE,4BAA4B,GAAG,YAAY,CA4jBtF"}