@ggui-ai/cli 0.2.0-alpha.4 → 0.3.0-rc.0

package/dist/serve-command.js

@@ -26,6 +26,7 @@ export function parseServeFlags(args) {
         publicDemo: false,
         multiTenant: false,
         oauth: false,
+        seedPools: [],
     };
     for (let i = 0; i < args.length; i++) {
         const arg = args[i];
@@ -88,14 +89,6 @@ export function parseServeFlags(args) {
             out.publicBaseUrl = v.replace(/\/+$/, '');
             continue;
         }
-        if (arg === '--public') {
-            out.publicAutoTunnel = true;
-            continue;
-        }
-        if (arg === '--i-know-its-public') {
-            out.iKnowItsPublic = true;
-            continue;
-        }
         if (arg === '--no-open') {
             out.noOpen = true;
             continue;
@@ -138,6 +131,13 @@ export function parseServeFlags(args) {
             out.ephemeral = true;
             continue;
         }
+        if (arg === '--seed-pool') {
+            const value = args[++i];
+            if (value === undefined)
+                return { ...out, error: '--seed-pool requires a path' };
+            out.seedPools.push(value);
+            continue;
+        }
         if (arg === '--all') {
             // §10.2a lock: --all is NOT a first-class flag. The default
             // already runs everything. Reject with a pointer so users
@@ -171,22 +171,6 @@ export function parseServeFlags(args) {
                 'multi-tenant gate rejects. Drop the other flag and pair with real bearers.',
         };
     }
-    if (out.publicAutoTunnel && out.publicBaseUrl !== undefined) {
-        return {
-            ...out,
-            error: '--public and --public-base-url are mutually exclusive. ' +
-                '--public auto-spawns a cloudflared quick-tunnel and sets the URL; ' +
-                '--public-base-url pins an explicit URL. Pick one.',
-        };
-    }
-    if (out.publicAutoTunnel && out.devAllowAll && !out.iKnowItsPublic) {
-        return {
-            ...out,
-            error: '--public + --dev-allow-all exposes any-bearer auth to the open ' +
-                'internet via cloudflared. Add --i-know-its-public to acknowledge ' +
-                'this, or pair real bearers and drop --dev-allow-all.',
-        };
-    }
     return out;
 }
 export function describeServeBanner(input) {
@@ -520,6 +504,9 @@ Options:
                          survive a server restart. Pass this flag to
                          keep restarts ephemeral (tests / CI / nuclear-
                          revoke). Override the dir via GGUI_PERSISTENT_DIR.
+  --seed-pool <dir>      Load a read-only shared blueprint pool from a
+                         directory artifact (repeatable). Blueprints in it
+                         are reused by exact contract match, after your own.
   --help, -h             Show this help.
 
 Agent runtime:
@@ -549,7 +536,7 @@ Persistent storage (default-on; opt-out via --ephemeral):
       ├── ws-token-secret.hex       (HMAC, 0600)
       ├── render-signer-secret.hex  (HMAC, 0600)
       ├── short-codes.sqlite        (signed render-URL resolution)
-      ├── renders.sqlite            (RenderStore — renders + event history)
+      ├── sessions.sqlite            (GguiSessionStore — renders + event history)
       ├── vectors.sqlite            (RAG corpus)
       └── keys.json                 (paired bearers)
 
@@ -563,7 +550,7 @@ Persistent storage (default-on; opt-out via --ephemeral):
 
     {
       "storage": {
-        "renders": { "driver": "sqlite", "path": "./ggui-renders.sqlite" },
+        "renders": { "driver": "sqlite", "path": "./ggui-sessions.sqlite" },
         "vectors": { "driver": "sqlite", "path": "./ggui-vectors.sqlite" },
         "threads": { "driver": "sqlite", "path": "./ggui-threads.sqlite" }
       }

package/dist/theme-command.js

@@ -145,8 +145,6 @@ function describeValidTheme(absPath, theme) {
         optional.push('accessibility');
     if (theme.zIndex !== undefined)
         optional.push('zIndex');
-    if (theme.canvas !== undefined)
-        optional.push('canvas');
     lines.push(optional.length === 0
         ? `  optional blocks: none`
         : `  optional blocks: ${optional.join(', ')}`);

package/dist/tunnel-provider.d.ts

@@ -183,12 +183,13 @@ export interface NullTunnelProviderOptions {
 }
 export declare function createNullTunnelProvider(options?: NullTunnelProviderOptions): TunnelProvider;
 /**
- * Contract a tunnel-provider module must satisfy for dynamic
- * discovery. Modules export either a default factory or a named
- * `createTunnelProvider` factory — both shapes are tried in that
- * order. The factory takes no arguments for the first slice; future
- * revisions MAY pass options (project identity, login snapshot)
- * behind a backwards-compatible shim.
+ * Contract a tunnel-provider plugin module must satisfy for dynamic
+ * discovery. Point `GGUI_TUNNEL_PROVIDER` at a module specifier; the
+ * module exports either a named `createTunnelProvider` factory or a
+ * default export (factory or provider instance) — both shapes are
+ * tried in that order. The factory takes no arguments today; if a
+ * future revision needs options (project identity, login snapshot)
+ * the contract version bumps with it.
  *
  * Kept as a module shape rather than a typed `require` because the
  * target module path is controlled by the user's env, not by the
@@ -198,7 +199,7 @@ export declare function createNullTunnelProvider(options?: NullTunnelProviderOpt
 export interface TunnelProviderModule {
     /** Preferred shape. */
     readonly createTunnelProvider?: () => TunnelProvider | Promise<TunnelProvider>;
-    /** Backwards-compatible shape — default export returning the provider. */
+    /** Alternate shape — default export returning the provider. */
     readonly default?: TunnelProvider | (() => TunnelProvider | Promise<TunnelProvider>);
 }
 /**

package/dist/tunnel-provider.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"tunnel-provider.d.ts","sourceRoot":"","sources":["../src/tunnel-provider.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAkCG;AAEH;;;;GAIG;AACH,MAAM,WAAW,aAAa;IAC5B;;;;OAIG;IACH,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAE1B;;;;;;;;;;OAUG;IACH,QAAQ,CAAC,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IAElC;;;;;OAKG;IACH,QAAQ,CAAC,OAAO,EAAE;QAChB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;QACtB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;KACvB,CAAC;IAEF;;;;;;;;;;;;;;;OAeG;IACH,QAAQ,CAAC,WAAW,EAAE,MAAM,GAAG,IAAI,CAAC;IAEpC;;;;;;OAMG;IACH,QAAQ,CAAC,MAAM,EAAE,WAAW,CAAC;CAC9B;AAED;;;;;;;;;GASG;AACH,MAAM,MAAM,aAAa,GAAG,kBAAkB,GAAG,wBAAwB,CAAC;AAE1E,MAAM,WAAW,kBAAkB;IACjC,QAAQ,CAAC,MAAM,EAAE,OAAO,CAAC;IACzB,iDAAiD;IACjD,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B;;;;OAIG;IACH,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;CACxB;AAED,MAAM,WAAW,wBAAwB;IACvC,QAAQ,CAAC,MAAM,EAAE,aAAa,CAAC;IAC/B;;;;OAIG;IACH,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB;;;;OAIG;IACH,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC;CACxB;AAED;;;;GAIG;AACH,MAAM,WAAW,cAAc;IAC7B;;;;OAIG;IACH,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IAEtB;;;;;;;OAOG;IACH,IAAI,CAAC,GAAG,EAAE,aAAa,GAAG,OAAO,CAAC,aAAa,CAAC,CAAC;CAClD;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,MAAM,WAAW,yBAAyB;IACxC;;;;;OAKG;IACH,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;IACzB,gDAAgD;IAChD,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC;CACxB;AAED,wBAAgB,wBAAwB,CACtC,OAAO,GAAE,yBAA8B,GACtC,cAAc,CAehB;AAED;;;;;;;;;;;;GAYG;AACH,MAAM,WAAW,oBAAoB;IACnC,uBAAuB;IACvB,QAAQ,CAAC,oBAAoB,CAAC,EAAE,MAAM,cAAc,GAAG,OAAO,CAAC,cAAc,CAAC,CAAC;IAC/E,0EAA0E;IAC1E,QAAQ,CAAC,OAAO,CAAC,EAAE,cAAc,GAAG,CAAC,MAAM,cAAc,GAAG,OAAO,CAAC,cAAc,CAAC,CAAC,CAAC;CACtF;AAED;;;;GAIG;AACH,MAAM,WAAW,6BAA6B;IAC5C;;;;;OAKG;IACH,QAAQ,CAAC,eAAe,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACzC;;;;;OAKG;IACH,QAAQ,CAAC,OAAO,CAAC,EAAE,CAAC,SAAS,EAAE,MAAM,KAAK,OAAO,CAAC,OAAO,CAAC,CAAC;CAC5D;AAED;;;;;;;;;;;;GAYG;AACH,MAAM,MAAM,uBAAuB,GAC/B;IAAE,QAAQ,CAAC,IAAI,EAAE,OAAO,CAAC;IAAC,QAAQ,CAAC,QAAQ,EAAE,cAAc,CAAC;IAAC,QAAQ,CAAC,eAAe,EAAE,MAAM,CAAA;CAAE,GAC/F;IAAE,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;CAAE,GACzB;IAAE,QAAQ,CAAC,IAAI,EAAE,OAAO,CAAC;IAAC,QAAQ,CAAC,eAAe,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;CAAE,CAAC;AAE1F;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,wBAAsB,sBAAsB,CAC1C,OAAO,GAAE,6BAAkC,GAC1C,OAAO,CAAC,uBAAuB,CAAC,CA4ElC"}
+{"version":3,"file":"tunnel-provider.d.ts","sourceRoot":"","sources":["../src/tunnel-provider.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAkCG;AAEH;;;;GAIG;AACH,MAAM,WAAW,aAAa;IAC5B;;;;OAIG;IACH,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAE1B;;;;;;;;;;OAUG;IACH,QAAQ,CAAC,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IAElC;;;;;OAKG;IACH,QAAQ,CAAC,OAAO,EAAE;QAChB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;QACtB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;KACvB,CAAC;IAEF;;;;;;;;;;;;;;;OAeG;IACH,QAAQ,CAAC,WAAW,EAAE,MAAM,GAAG,IAAI,CAAC;IAEpC;;;;;;OAMG;IACH,QAAQ,CAAC,MAAM,EAAE,WAAW,CAAC;CAC9B;AAED;;;;;;;;;GASG;AACH,MAAM,MAAM,aAAa,GAAG,kBAAkB,GAAG,wBAAwB,CAAC;AAE1E,MAAM,WAAW,kBAAkB;IACjC,QAAQ,CAAC,MAAM,EAAE,OAAO,CAAC;IACzB,iDAAiD;IACjD,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B;;;;OAIG;IACH,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;CACxB;AAED,MAAM,WAAW,wBAAwB;IACvC,QAAQ,CAAC,MAAM,EAAE,aAAa,CAAC;IAC/B;;;;OAIG;IACH,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB;;;;OAIG;IACH,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC;CACxB;AAED;;;;GAIG;AACH,MAAM,WAAW,cAAc;IAC7B;;;;OAIG;IACH,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IAEtB;;;;;;;OAOG;IACH,IAAI,CAAC,GAAG,EAAE,aAAa,GAAG,OAAO,CAAC,aAAa,CAAC,CAAC;CAClD;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,MAAM,WAAW,yBAAyB;IACxC;;;;;OAKG;IACH,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;IACzB,gDAAgD;IAChD,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC;CACxB;AAED,wBAAgB,wBAAwB,CACtC,OAAO,GAAE,yBAA8B,GACtC,cAAc,CAehB;AAED;;;;;;;;;;;;;GAaG;AACH,MAAM,WAAW,oBAAoB;IACnC,uBAAuB;IACvB,QAAQ,CAAC,oBAAoB,CAAC,EAAE,MAAM,cAAc,GAAG,OAAO,CAAC,cAAc,CAAC,CAAC;IAC/E,+DAA+D;IAC/D,QAAQ,CAAC,OAAO,CAAC,EAAE,cAAc,GAAG,CAAC,MAAM,cAAc,GAAG,OAAO,CAAC,cAAc,CAAC,CAAC,CAAC;CACtF;AAED;;;;GAIG;AACH,MAAM,WAAW,6BAA6B;IAC5C;;;;;OAKG;IACH,QAAQ,CAAC,eAAe,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACzC;;;;;OAKG;IACH,QAAQ,CAAC,OAAO,CAAC,EAAE,CAAC,SAAS,EAAE,MAAM,KAAK,OAAO,CAAC,OAAO,CAAC,CAAC;CAC5D;AAED;;;;;;;;;;;;GAYG;AACH,MAAM,MAAM,uBAAuB,GAC/B;IAAE,QAAQ,CAAC,IAAI,EAAE,OAAO,CAAC;IAAC,QAAQ,CAAC,QAAQ,EAAE,cAAc,CAAC;IAAC,QAAQ,CAAC,eAAe,EAAE,MAAM,CAAA;CAAE,GAC/F;IAAE,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;CAAE,GACzB;IAAE,QAAQ,CAAC,IAAI,EAAE,OAAO,CAAC;IAAC,QAAQ,CAAC,eAAe,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;CAAE,CAAC;AAE1F;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,wBAAsB,sBAAsB,CAC1C,OAAO,GAAE,6BAAkC,GAC1C,OAAO,CAAC,uBAAuB,CAAC,CA4ElC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ggui-ai/cli",
-  "version": "0.2.0-alpha.4",
+  "version": "0.3.0-rc.0",
   "description": "The `ggui` CLI — run the ggui protocol locally: dev server, self-hosted MCP server, and gadget / blueprint authoring. End-to-end OSS and self-hosted workflows; no account required.",
   "keywords": [
     "ggui",
@@ -21,6 +21,11 @@
       "types": "./dist/tunnel-provider.d.ts",
       "import": "./dist/tunnel-provider.js",
       "default": "./dist/tunnel-provider.js"
+    },
+    "./push": {
+      "types": "./dist/push-command.d.ts",
+      "import": "./dist/push-command.js",
+      "default": "./dist/push-command.js"
     }
   },
   "files": [
@@ -28,32 +33,31 @@
     "README.md"
   ],
   "dependencies": {
-    "@aws-sdk/client-cognito-identity-provider": "^3.600.0",
     "@huggingface/transformers": "^3.0.0",
     "@noble/hashes": "^1.6.0",
     "esbuild": "^0.25.12",
-    "@ggui-ai/agent-runtime": "0.2.0-alpha.4",
-    "@ggui-ai/artifact-manifest": "0.2.0-alpha.4",
-    "@ggui-ai/design": "0.2.0-alpha.4",
-    "@ggui-ai/dev-stack": "0.2.0-alpha.4",
-    "@ggui-ai/gadget-signing": "0.2.0-alpha.4",
-    "@ggui-ai/mcp-server": "0.2.0-alpha.4",
-    "@ggui-ai/embedding-local": "0.2.0-alpha.4",
-    "@ggui-ai/mcp-server-core": "0.2.0-alpha.4",
-    "@ggui-ai/preview-a2ui": "0.2.0-alpha.4",
-    "@ggui-ai/mcp-server-handlers": "0.2.0-alpha.4",
-    "@ggui-ai/project-config": "0.2.0-alpha.4",
-    "@ggui-ai/registry-core": "0.2.0-alpha.4",
-    "@ggui-ai/iframe-runtime": "0.2.0-alpha.4",
-    "@ggui-ai/ui-gen": "0.2.0-alpha.4",
-    "@ggui-ai/ui-registry": "0.2.0-alpha.4",
-    "@ggui-ai/protocol": "0.2.0-alpha.4"
+    "zod": "^4.3.6",
+    "@ggui-ai/agent-runtime": "0.3.0-rc.0",
+    "@ggui-ai/dev-stack": "0.3.0-rc.0",
+    "@ggui-ai/design": "0.3.0-rc.0",
+    "@ggui-ai/gadget-signing": "0.3.0-rc.0",
+    "@ggui-ai/artifact-manifest": "0.3.0-rc.0",
+    "@ggui-ai/mcp-server": "0.3.0-rc.0",
+    "@ggui-ai/mcp-server-handlers": "0.3.0-rc.0",
+    "@ggui-ai/embedding-local": "0.3.0-rc.0",
+    "@ggui-ai/mcp-server-core": "0.3.0-rc.0",
+    "@ggui-ai/preview-a2ui": "0.3.0-rc.0",
+    "@ggui-ai/project-config": "0.3.0-rc.0",
+    "@ggui-ai/protocol": "0.3.0-rc.0",
+    "@ggui-ai/registry-core": "0.3.0-rc.0",
+    "@ggui-ai/iframe-runtime": "0.3.0-rc.0",
+    "@ggui-ai/ui-registry": "0.3.0-rc.0",
+    "@ggui-ai/ui-gen": "0.3.0-rc.0"
   },
   "devDependencies": {
     "@types/node": "^24.0.0",
     "typescript": "^5.0.0",
-    "vitest": "^3.0.0",
-    "zod": "^4.3.6"
+    "vitest": "^3.0.0"
   },
   "repository": {
     "type": "git",
@@ -72,7 +76,7 @@
   },
   "author": "ggui contributors <hello@ggui.ai>",
   "scripts": {
-    "build": "tsc -p tsconfig.build.json && chmod +x dist/cli.js",
+    "build": "rm -rf dist && tsc -p tsconfig.build.json && chmod +x dist/cli.js",
     "dev": "tsc --watch",
     "typecheck": "tsc --noEmit",
     "test": "vitest run --passWithNoTests",

package/dist/internal/auth-cache.d.ts

@@ -1,40 +0,0 @@
-/** v1 on-disk shape. */
-export interface RegistryTokenDocument {
-    readonly version: 1;
-    /** Full registry origin (e.g. `https://dev.registry.sandbox.ggui.ai`). */
-    readonly registry: string;
-    /** Cognito IdToken — sent as `Authorization: Bearer <idToken>`. */
-    readonly idToken: string;
-    /** Cognito AccessToken — surfaced separately for handlers that need it. */
-    readonly accessToken: string;
-    /** Cognito RefreshToken — used to mint fresh id/access tokens. */
-    readonly refreshToken: string;
-    /** Unix epoch SECONDS — past this, the id token is rejected by the registry. */
-    readonly expiresAt: number;
-    /** Username the tokens belong to (informational; for `--whoami` reuse). */
-    readonly username: string;
-    /** ISO 8601 timestamp this document was written. */
-    readonly writtenAt: string;
-}
-/**
- * Compute the on-disk path for a registry's token cache. Pure (no
- * IO) so callers can derive the path before existence checks.
- */
-export declare function getRegistryTokenPath(registryUrl: string): string;
-/**
- * Load a cached token document. Returns null when missing OR
- * malformed — callers treat both as "need to log in".
- */
-export declare function loadRegistryToken(registryUrl: string): RegistryTokenDocument | null;
-/**
- * Atomically write the document with mode `0o600`. write-temp +
- * rename pattern so a crash mid-write doesn't strand a partial doc.
- */
-export declare function saveRegistryToken(doc: RegistryTokenDocument): void;
-/**
- * Decide whether a cached document is still usable for the next
- * request. Subtracts a 60-second safety margin so we don't race a
- * boundary expiry that the registry would refuse.
- */
-export declare function isTokenFresh(doc: RegistryTokenDocument, nowSeconds?: number): boolean;
-//# sourceMappingURL=auth-cache.d.ts.map

package/dist/internal/auth-cache.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"auth-cache.d.ts","sourceRoot":"","sources":["../../src/internal/auth-cache.ts"],"names":[],"mappings":"AA6BA,wBAAwB;AACxB,MAAM,WAAW,qBAAqB;IACpC,QAAQ,CAAC,OAAO,EAAE,CAAC,CAAC;IACpB,0EAA0E;IAC1E,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,mEAAmE;IACnE,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,2EAA2E;IAC3E,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,kEAAkE;IAClE,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;IAC9B,gFAAgF;IAChF,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,2EAA2E;IAC3E,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,oDAAoD;IACpD,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;CAC5B;AAED;;;GAGG;AACH,wBAAgB,oBAAoB,CAAC,WAAW,EAAE,MAAM,GAAG,MAAM,CAGhE;AAED;;;GAGG;AACH,wBAAgB,iBAAiB,CAC/B,WAAW,EAAE,MAAM,GAClB,qBAAqB,GAAG,IAAI,CAiB9B;AAED;;;GAGG;AACH,wBAAgB,iBAAiB,CAAC,GAAG,EAAE,qBAAqB,GAAG,IAAI,CA4BlE;AAED;;;;GAIG;AACH,wBAAgB,YAAY,CAC1B,GAAG,EAAE,qBAAqB,EAC1B,UAAU,GAAE,MAAsC,GACjD,OAAO,CAET"}

package/dist/internal/auth-cache.js

@@ -1,133 +0,0 @@
-/**
- * Per-registry JWT cache for `ggui gadget publish`.
- *
- * Layout: `~/.ggui/auth/<registry-hostname>/token.json`. One file per
- * registry hostname so an operator who publishes to a dev sandbox
- * AND production doesn't paper over one session with the other. The
- * hostname is the directory name (no path component leaks into disk
- * names) — full URL is captured inside the document.
- *
- * Document version is `1`. Bumped on breaking-change shape edits;
- * loaders that see `version > 1` refuse rather than mis-parse.
- *
- * **Distinct from `~/.ggui/auth.json`.** That file holds the
- * `api.ggui.ai` device-flow session for hosted-key management. The
- * registry tokens here are a SEPARATE auth surface (different IdP,
- * different audience), so they live in a parallel namespace.
- */
-import { URL } from 'node:url';
-import { chmodSync, existsSync, mkdirSync, readFileSync, renameSync, writeFileSync, } from 'node:fs';
-import { dirname, join } from 'node:path';
-import { getConfigDir } from '../paths.js';
-/**
- * Compute the on-disk path for a registry's token cache. Pure (no
- * IO) so callers can derive the path before existence checks.
- */
-export function getRegistryTokenPath(registryUrl) {
-    const host = safeHostname(registryUrl);
-    return join(getConfigDir(), 'auth', host, 'token.json');
-}
-/**
- * Load a cached token document. Returns null when missing OR
- * malformed — callers treat both as "need to log in".
- */
-export function loadRegistryToken(registryUrl) {
-    const path = getRegistryTokenPath(registryUrl);
-    if (!existsSync(path))
-        return null;
-    let raw;
-    try {
-        raw = readFileSync(path, 'utf8');
-    }
-    catch {
-        return null;
-    }
-    let decoded;
-    try {
-        decoded = JSON.parse(raw);
-    }
-    catch {
-        return null;
-    }
-    if (!isRegistryTokenDocument(decoded))
-        return null;
-    return decoded;
-}
-/**
- * Atomically write the document with mode `0o600`. write-temp +
- * rename pattern so a crash mid-write doesn't strand a partial doc.
- */
-export function saveRegistryToken(doc) {
-    const target = getRegistryTokenPath(doc.registry);
-    const dir = dirname(target);
-    if (!existsSync(dir)) {
-        mkdirSync(dir, { recursive: true, mode: 0o700 });
-    }
-    else {
-        try {
-            chmodSync(dir, 0o700);
-        }
-        catch {
-            // best-effort on Windows
-        }
-    }
-    const tmp = `${target}.tmp-${process.pid}-${Date.now()}`;
-    writeFileSync(tmp, `${JSON.stringify(doc, null, 2)}\n`, {
-        encoding: 'utf8',
-        mode: 0o600,
-    });
-    try {
-        chmodSync(tmp, 0o600);
-    }
-    catch {
-        // best-effort
-    }
-    renameSync(tmp, target);
-    try {
-        chmodSync(target, 0o600);
-    }
-    catch {
-        // best-effort
-    }
-}
-/**
- * Decide whether a cached document is still usable for the next
- * request. Subtracts a 60-second safety margin so we don't race a
- * boundary expiry that the registry would refuse.
- */
-export function isTokenFresh(doc, nowSeconds = Math.floor(Date.now() / 1000)) {
-    return doc.expiresAt - nowSeconds > 60;
-}
-// ---------------------------------------------------------------------------
-// internal
-// ---------------------------------------------------------------------------
-function isRegistryTokenDocument(x) {
-    if (typeof x !== 'object' || x === null)
-        return false;
-    const r = x;
-    return (r['version'] === 1 &&
-        typeof r['registry'] === 'string' &&
-        typeof r['idToken'] === 'string' &&
-        typeof r['accessToken'] === 'string' &&
-        typeof r['refreshToken'] === 'string' &&
-        typeof r['expiresAt'] === 'number' &&
-        typeof r['username'] === 'string' &&
-        typeof r['writtenAt'] === 'string');
-}
-/**
- * Extract a filesystem-safe hostname from a registry URL. Replaces
- * non-alphanumeric chars with `-` so the result is always a valid
- * directory name on every supported OS.
- */
-function safeHostname(registryUrl) {
-    let host;
-    try {
-        host = new URL(registryUrl).hostname;
-    }
-    catch {
-        // Caller validated earlier; if we got here with a bogus URL the
-        // cleanest thing is to refuse the path entirely.
-        throw new Error(`auth-cache: invalid registry URL: ${registryUrl}`);
-    }
-    return host.replace(/[^a-z0-9.-]/gi, '-');
-}

package/dist/persistent-short-code-index.d.ts

@@ -1,14 +0,0 @@
-import type { ShortCodeIndex } from '@ggui-ai/mcp-server-core';
-/**
- * Construct the persistent ShortCodeIndex backed by `<persistentDir>/
- * short-codes.sqlite`. Creates the parent dir if missing (the persistent
- * dir always exists by the time this is called — the secrets helper
- * already mkdir'd it — but mkdir is idempotent and cheap).
- *
- * Throws if `better-sqlite3` can't be loaded (e.g. native binding
- * missing for the current platform). The CLI surfaces this as a fatal
- * boot error so the operator can either install the binding or pass
- * `--ephemeral`.
- */
-export declare function createPersistentShortCodeIndex(persistentDir: string): Promise<ShortCodeIndex>;
-//# sourceMappingURL=persistent-short-code-index.d.ts.map

package/dist/persistent-short-code-index.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"persistent-short-code-index.d.ts","sourceRoot":"","sources":["../src/persistent-short-code-index.ts"],"names":[],"mappings":"AAqBA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,0BAA0B,CAAC;AAE/D;;;;;;;;;;GAUG;AACH,wBAAsB,8BAA8B,CAClD,aAAa,EAAE,MAAM,GACpB,OAAO,CAAC,cAAc,CAAC,CAQzB"}

package/dist/persistent-short-code-index.js

@@ -1,39 +0,0 @@
-/**
- * Resolve a persistent `ShortCodeIndex` for `ggui serve`.
- *
- * The OSS default for `shortCodeIndex` is `InMemoryShortCodeIndex` —
- * the mapping lives in process memory and a restart drops every
- * binding, so `/r/<code>` + `/api/bootstrap/<code>` 404 on the cached
- * envelopes claude.ai stored before the restart.
- *
- * When the CLI is running in persistent mode (no `--ephemeral`), this
- * helper constructs a `SqliteShortCodeIndex` against
- * `<persistentDir>/short-codes.sqlite` so the same lookups survive
- * restart. better-sqlite3 is dynamic-imported (same pattern as
- * `@ggui-ai/mcp-server::resolveStorageFromConfig`) so consumers that
- * stay ephemeral don't pay the N-API binding load on boot.
- *
- * Caller composes the path; this module is pure construction over a
- * given dir + better-sqlite3 dynamic-import, so tests can scope to a
- * tmpdir.
- */
-import { mkdirSync } from 'node:fs';
-import { join } from 'node:path';
-/**
- * Construct the persistent ShortCodeIndex backed by `<persistentDir>/
- * short-codes.sqlite`. Creates the parent dir if missing (the persistent
- * dir always exists by the time this is called — the secrets helper
- * already mkdir'd it — but mkdir is idempotent and cheap).
- *
- * Throws if `better-sqlite3` can't be loaded (e.g. native binding
- * missing for the current platform). The CLI surfaces this as a fatal
- * boot error so the operator can either install the binding or pass
- * `--ephemeral`.
- */
-export async function createPersistentShortCodeIndex(persistentDir) {
-    mkdirSync(persistentDir, { recursive: true });
-    const { SqliteShortCodeIndex } = await import('@ggui-ai/mcp-server-core/sqlite');
-    return new SqliteShortCodeIndex({
-        filename: join(persistentDir, 'short-codes.sqlite'),
-    });
-}

package/dist/spawn-cloudflared.d.ts

@@ -1,61 +0,0 @@
-/**
- * `spawnCloudflaredTunnel` — auto-tunnel helper for `ggui serve --public`.
- *
- * The local-dev → claude.ai integration loop has a well-known trap:
- * every demo session would otherwise need to manually run
- * `cloudflared tunnel --url http://localhost:6781`, grep the URL from
- * its noisy stderr, then restart `ggui serve --public-base-url <url>`
- * with that value pinned. `runtimeUrl` is auto-derived from
- * `X-Forwarded-Host` and no longer depends on `publicBaseUrl`, but
- * production deployments still need the URL pinned for OAuth callbacks
- * and email magic-links. This helper closes the gap: one `--public`
- * flag spawns cloudflared, parses its URL, and threads it into the
- * boot config.
- *
- * **Trust posture.** This helper does NOT mask the public exposure. It
- * is the operator's explicit opt-in (`--public`); when combined with
- * `--dev-allow-all` the CLI front-end requires a second flag
- * (`--i-know-its-public`) to prevent accidentally serving any-bearer
- * auth over the internet.
- *
- * **Process management.** The spawned child is the operator's only
- * dependency on the host's `cloudflared` binary; we don't bundle it.
- * On `close()`, SIGTERM → SIGKILL fallback after 5s. AbortSignal
- * support lets the CLI lifecycle (Ctrl-C handler in `runServe`)
- * tear down cloudflared in lockstep with the server.
- */
-export interface SpawnCloudflaredOptions {
-    /** Local port the tunnel forwards to. */
-    readonly port: number;
-    /** Optional override of the binary path. Defaults to `cloudflared`
-     *  on PATH; operators wrap with `--cloudflared-bin <path>` when
-     *  installed outside PATH. */
-    readonly binary?: string;
-    /** Optional AbortSignal — fires SIGTERM on the child when aborted. */
-    readonly signal?: AbortSignal;
-    /** Optional logger seam. Default no-op. */
-    readonly onLog?: (line: string) => void;
-    /** URL-detection timeout. */
-    readonly urlTimeoutMs?: number;
-}
-export interface SpawnCloudflaredResult {
-    /** Public `https://<random>.trycloudflare.com` URL extracted from
-     *  cloudflared's stderr. */
-    readonly url: string;
-    /** Tear down the tunnel. Idempotent; safe to call multiple times. */
-    close(): Promise<void>;
-}
-/**
- * Spawn `cloudflared tunnel --url http://localhost:<port>` and resolve
- * with the assigned trycloudflare URL. Rejects when:
- *
- *   - The binary can't be spawned (cloudflared not installed / wrong
- *     path / permission denied). Error message includes the install
- *     hint.
- *   - cloudflared exits before printing a URL. Error includes any
- *     captured stderr tail.
- *   - URL detection times out. Error includes elapsed time + last
- *     ~10 lines of stderr so the operator can diagnose.
- */
-export declare function spawnCloudflaredTunnel(opts: SpawnCloudflaredOptions): Promise<SpawnCloudflaredResult>;
-//# sourceMappingURL=spawn-cloudflared.d.ts.map

package/dist/spawn-cloudflared.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"spawn-cloudflared.d.ts","sourceRoot":"","sources":["../src/spawn-cloudflared.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AAeH,MAAM,WAAW,uBAAuB;IACtC,yCAAyC;IACzC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB;;kCAE8B;IAC9B,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;IACzB,sEAAsE;IACtE,QAAQ,CAAC,MAAM,CAAC,EAAE,WAAW,CAAC;IAC9B,2CAA2C;IAC3C,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,CAAC;IACxC,6BAA6B;IAC7B,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM,CAAC;CAChC;AAED,MAAM,WAAW,sBAAsB;IACrC;gCAC4B;IAC5B,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,qEAAqE;IACrE,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;CACxB;AAED;;;;;;;;;;;GAWG;AACH,wBAAgB,sBAAsB,CACpC,IAAI,EAAE,uBAAuB,GAC5B,OAAO,CAAC,sBAAsB,CAAC,CA6IjC"}