@ggui-ai/cli 0.6.2 → 0.7.0

package/dist/internal/artifact-search.d.ts

@@ -1,3 +1,28 @@
+/**
+ * `ggui gadget search [q]` — query the marketplace registry's
+ * `GET /search` endpoint and render results.
+ *
+ * The consumer-side discovery surface, companion to `gadget create`
+ * and `gadget publish`. Public and unauthenticated; the registry's
+ * `/search` route returns only `visibility: "public"` rows.
+ *
+ * Registry resolution rides the shared resolver (`./registry-url.ts`)
+ * with the READ-verb posture (highest priority wins):
+ *
+ *   1. `--registry <url>` flag.
+ *   2. `GGUI_REGISTRY` environment variable.
+ *   3. `ggui.json#registry` field (walks up from `cwd`).
+ *   4. The public default registry.
+ *
+ * Kept pure / testable — no `process.exit`, no direct stdout writes.
+ * Returns a `SearchOutput` discriminated union; the CLI driver in
+ * `gadget-command.ts` renders copy + picks the exit code.
+ *
+ * The wire shapes (`SearchResultEntry` / `SearchResponse` /
+ * `ArtifactKind`) are imported from `@ggui-ai/registry-core` — the
+ * canonical owner of the registry HTTP response types — and
+ * re-exported for this module's consumers.
+ */
 import { type ArtifactKind, type SearchResponse, type SearchResultEntry } from '@ggui-ai/registry-core';
 export type { ArtifactKind, SearchResponse, SearchResultEntry };
 /**
@@ -44,26 +69,6 @@ export interface ParsedSearchFlags {
  * Accepts both `--flag value` and `--flag=value` for every option.
  */
 export declare function parseArtifactSearchFlags(lockedKind: ArtifactKind | undefined, args: readonly string[]): ParsedSearchFlags;
-/**
- * Three-layer resolution: `--registry` flag > `GGUI_REGISTRY` env >
- * `ggui.json#registry` > error.
- *
- * `cwd` + `env` are injectable for tests. Returns either `{ url }` on
- * success or `{ error }` with a stderr-ready diagnostic. Trailing
- * slashes on the URL are normalized away so the URL builder can append
- * `/search?…` deterministically.
- */
-export declare function resolveRegistryUrl(args: {
-    flag?: string;
-    cwd: string;
-    env: {
-        readonly GGUI_REGISTRY?: string | undefined;
-    };
-}): {
-    url: string;
-} | {
-    error: string;
-};
 /**
  * Build a query string from {@link ArtifactSearchFlags}. Pulled out so
  * tests can assert the wire shape without a real fetch. Empty / absent
@@ -111,7 +116,8 @@ export interface RunArtifactSearchDeps {
 /**
  * Run a search end-to-end:
  *
- *   1. Resolve the registry URL via the three-layer chain.
+ *   1. Resolve the registry URL via the shared chain (READ-verb
+ *      posture: flag > env > ggui.json > public default).
  *   2. Build the query string.
  *   3. GET `<registry>/search?<qs>` (no auth; public endpoint).
  *   4. Parse + validate the response shape.

package/dist/internal/artifact-search.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"artifact-search.d.ts","sourceRoot":"","sources":["../../src/internal/artifact-search.ts"],"names":[],"mappings":"AA2BA,OAAO,EAEL,KAAK,YAAY,EAEjB,KAAK,cAAc,EACnB,KAAK,iBAAiB,EACvB,MAAM,wBAAwB,CAAC;AAEhC,YAAY,EAAE,YAAY,EAAE,cAAc,EAAE,iBAAiB,EAAE,CAAC;AAehE;;;;GAIG;AACH,MAAM,WAAW,mBAAmB;IAClC,wDAAwD;IACxD,QAAQ,CAAC,CAAC,CAAC,EAAE,MAAM,CAAC;IACpB,wBAAwB;IACxB,QAAQ,CAAC,IAAI,CAAC,EAAE,YAAY,CAAC;IAC7B,uCAAuC;IACvC,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC;IACvB,uEAAuE;IACvE,QAAQ,CAAC,GAAG,CAAC,EAAE,MAAM,CAAC;IACtB,yEAAyE;IACzE,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;IACzB,mDAAmD;IACnD,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC;IACxB,8CAA8C;IAC9C,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;IACzB,oDAAoD;IACpD,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAC3B,kEAAkE;IAClE,QAAQ,CAAC,IAAI,CAAC,EAAE,OAAO,CAAC;CACzB;AAED,MAAM,WAAW,iBAAiB;IAChC,QAAQ,CAAC,KAAK,CAAC,EAAE,mBAAmB,CAAC;IACrC,8DAA8D;IAC9D,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC;CACzB;AAED;;;;;;;;;;;;GAYG;AACH,wBAAgB,wBAAwB,CACtC,UAAU,EAAE,YAAY,GAAG,SAAS,EACpC,IAAI,EAAE,SAAS,MAAM,EAAE,GACtB,iBAAiB,CAuInB;AAMD;;;;;;;;GAQG;AACH,wBAAgB,kBAAkB,CAAC,IAAI,EAAE;IACvC,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,GAAG,EAAE,MAAM,CAAC;IACZ,GAAG,EAAE;QAAE,QAAQ,CAAC,aAAa,CAAC,EAAE,MAAM,GAAG,SAAS,CAAA;KAAE,CAAC;CACtD,GAAG;IAAE,GAAG,EAAE,MAAM,CAAA;CAAE,GAAG;IAAE,KAAK,EAAE,MAAM,CAAA;CAAE,CA0BtC;AAiFD;;;;;;;GAOG;AACH,wBAAgB,sBAAsB,CAAC,KAAK,EAAE,mBAAmB,GAAG,MAAM,CAWzE;AAMD,uEAAuE;AACvE,MAAM,WAAW,aAAa;IAC5B,QAAQ,CAAC,EAAE,EAAE,IAAI,CAAC;IAClB,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,QAAQ,EAAE,cAAc,CAAC;IAClC;;;;;OAKG;IACH,QAAQ,CAAC,KAAK,EAAE,SAAS,MAAM,EAAE,CAAC;IAClC,8DAA8D;IAC9D,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;CACvB;AAED,wEAAwE;AACxE,MAAM,WAAW,aAAa;IAC5B,QAAQ,CAAC,EAAE,EAAE,KAAK,CAAC;IACnB,qCAAqC;IACrC,QAAQ,CAAC,IAAI,EACT,aAAa,GACb,kBAAkB,GAClB,eAAe,GACf,YAAY,GACZ,cAAc,CAAC;IACnB,oEAAoE;IACpE,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;CAC1B;AAED,MAAM,MAAM,YAAY,GAAG,aAAa,GAAG,aAAa,CAAC;AAMzD;;;GAGG;AACH,MAAM,WAAW,qBAAqB;IACpC,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,GAAG,EAAE;QAAE,QAAQ,CAAC,aAAa,CAAC,EAAE,MAAM,GAAG,SAAS,CAAA;KAAE,CAAC;IAC9D,QAAQ,CAAC,KAAK,EAAE,OAAO,KAAK,CAAC;CAC9B;AAED;;;;;;;;;;GAUG;AACH,wBAAsB,iBAAiB,CACrC,KAAK,EAAE,mBAAmB,EAC1B,IAAI,EAAE,qBAAqB,GAC1B,OAAO,CAAC,YAAY,CAAC,CAuFvB;AAwGD;;;;GAIG;AACH,wBAAgB,eAAe,CAAC,IAAI,EAAE,YAAY,GAAG,MAAM,CAuC1D"}
+{"version":3,"file":"artifact-search.d.ts","sourceRoot":"","sources":["../../src/internal/artifact-search.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,OAAO,EAEL,KAAK,YAAY,EAEjB,KAAK,cAAc,EACnB,KAAK,iBAAiB,EACvB,MAAM,wBAAwB,CAAC;AAGhC,YAAY,EAAE,YAAY,EAAE,cAAc,EAAE,iBAAiB,EAAE,CAAC;AAMhE;;;;GAIG;AACH,MAAM,WAAW,mBAAmB;IAClC,wDAAwD;IACxD,QAAQ,CAAC,CAAC,CAAC,EAAE,MAAM,CAAC;IACpB,wBAAwB;IACxB,QAAQ,CAAC,IAAI,CAAC,EAAE,YAAY,CAAC;IAC7B,uCAAuC;IACvC,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC;IACvB,uEAAuE;IACvE,QAAQ,CAAC,GAAG,CAAC,EAAE,MAAM,CAAC;IACtB,yEAAyE;IACzE,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;IACzB,mDAAmD;IACnD,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC;IACxB,8CAA8C;IAC9C,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;IACzB,oDAAoD;IACpD,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAC3B,kEAAkE;IAClE,QAAQ,CAAC,IAAI,CAAC,EAAE,OAAO,CAAC;CACzB;AAED,MAAM,WAAW,iBAAiB;IAChC,QAAQ,CAAC,KAAK,CAAC,EAAE,mBAAmB,CAAC;IACrC,8DAA8D;IAC9D,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC;CACzB;AAED;;;;;;;;;;;;GAYG;AACH,wBAAgB,wBAAwB,CACtC,UAAU,EAAE,YAAY,GAAG,SAAS,EACpC,IAAI,EAAE,SAAS,MAAM,EAAE,GACtB,iBAAiB,CAuInB;AAMD;;;;;;;GAOG;AACH,wBAAgB,sBAAsB,CAAC,KAAK,EAAE,mBAAmB,GAAG,MAAM,CAWzE;AAMD,uEAAuE;AACvE,MAAM,WAAW,aAAa;IAC5B,QAAQ,CAAC,EAAE,EAAE,IAAI,CAAC;IAClB,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,QAAQ,EAAE,cAAc,CAAC;IAClC;;;;;OAKG;IACH,QAAQ,CAAC,KAAK,EAAE,SAAS,MAAM,EAAE,CAAC;IAClC,8DAA8D;IAC9D,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;CACvB;AAED,wEAAwE;AACxE,MAAM,WAAW,aAAa;IAC5B,QAAQ,CAAC,EAAE,EAAE,KAAK,CAAC;IACnB,qCAAqC;IACrC,QAAQ,CAAC,IAAI,EACT,aAAa,GACb,kBAAkB,GAClB,eAAe,GACf,YAAY,GACZ,cAAc,CAAC;IACnB,oEAAoE;IACpE,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;CAC1B;AAED,MAAM,MAAM,YAAY,GAAG,aAAa,GAAG,aAAa,CAAC;AAMzD;;;GAGG;AACH,MAAM,WAAW,qBAAqB;IACpC,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,GAAG,EAAE;QAAE,QAAQ,CAAC,aAAa,CAAC,EAAE,MAAM,GAAG,SAAS,CAAA;KAAE,CAAC;IAC9D,QAAQ,CAAC,KAAK,EAAE,OAAO,KAAK,CAAC;CAC9B;AAED;;;;;;;;;;;GAWG;AACH,wBAAsB,iBAAiB,CACrC,KAAK,EAAE,mBAAmB,EAC1B,IAAI,EAAE,qBAAqB,GAC1B,OAAO,CAAC,YAAY,CAAC,CAuFvB;AAwGD;;;;GAIG;AACH,wBAAgB,eAAe,CAAC,IAAI,EAAE,YAAY,GAAG,MAAM,CAwC1D"}

package/dist/internal/artifact-search.js

@@ -6,13 +6,13 @@
  * and `gadget publish`. Public and unauthenticated; the registry's
  * `/search` route returns only `visibility: "public"` rows.
  *
- * Three-layer registry resolution (highest priority wins, mirrors
- * `gadget publish` + `ggui install`):
+ * Registry resolution rides the shared resolver (`./registry-url.ts`)
+ * with the READ-verb posture (highest priority wins):
  *
  *   1. `--registry <url>` flag.
  *   2. `GGUI_REGISTRY` environment variable.
  *   3. `ggui.json#registry` field (walks up from `cwd`).
- *   4. Error if unset — no hard-coded default.
+ *   4. The public default registry.
  *
  * Kept pure / testable — no `process.exit`, no direct stdout writes.
  * Returns a `SearchOutput` discriminated union; the CLI driver in
@@ -23,17 +23,8 @@
  * canonical owner of the registry HTTP response types — and
  * re-exported for this module's consumers.
  */
-import { existsSync, readFileSync } from 'node:fs';
-import { dirname, join, resolve } from 'node:path';
 import { SEARCH_ERROR_CODES, } from '@ggui-ai/registry-core';
-/**
- * Filename constant for the project manifest. Duplicated from
- * `@ggui-ai/project-config` rather than imported to keep this
- * subcommand from pulling in the full project-config dependency tree.
- */
-const GGUI_JSON_FILENAME = 'ggui.json';
-/** How many parent directories the upward walk will inspect. */
-const FIND_MAX_DEPTH = 8;
+import { DEFAULT_REGISTRY_URL, resolveRegistryUrl } from './registry-url.js';
 /**
  * Flag parser. Returns a discriminated `{error}` vs. `{flags}` so the
  * caller doesn't throw on user input. The `lockedKind` argument is the
@@ -175,113 +166,6 @@ export function parseArtifactSearchFlags(lockedKind, args) {
     return { flags };
 }
 /* -------------------------------------------------------------------------- */
-/* Registry URL resolution                                                   */
-/* -------------------------------------------------------------------------- */
-/**
- * Three-layer resolution: `--registry` flag > `GGUI_REGISTRY` env >
- * `ggui.json#registry` > error.
- *
- * `cwd` + `env` are injectable for tests. Returns either `{ url }` on
- * success or `{ error }` with a stderr-ready diagnostic. Trailing
- * slashes on the URL are normalized away so the URL builder can append
- * `/search?…` deterministically.
- */
-export function resolveRegistryUrl(args) {
-    const candidate = args.flag ??
-        (typeof args.env.GGUI_REGISTRY === 'string' && args.env.GGUI_REGISTRY.length > 0
-            ? args.env.GGUI_REGISTRY
-            : undefined);
-    if (typeof candidate === 'string' && candidate.length > 0) {
-        return normalizeRegistryUrl(candidate);
-    }
-    const gguiJsonPath = findGguiJson(args.cwd);
-    if (gguiJsonPath !== null) {
-        const loaded = readGguiJsonRegistryField(gguiJsonPath);
-        if ('error' in loaded) {
-            return { error: loaded.error };
-        }
-        if (loaded.registry !== undefined) {
-            return normalizeRegistryUrl(loaded.registry);
-        }
-    }
-    return {
-        error: 'no registry configured. Pass --registry <url>, set GGUI_REGISTRY, or add `registry` to ggui.json.',
-    };
-}
-/**
- * Walk up from `startDir` looking for a `ggui.json`. Returns the
- * absolute path of the first match, or `null` if none found within
- * {@link FIND_MAX_DEPTH} levels. Mirrors the algorithm in
- * `@ggui-ai/project-config/node`'s `findGguiJson` — duplicated here
- * to keep this subcommand free of the project-config dependency.
- */
-function findGguiJson(startDir) {
-    let dir = resolve(startDir);
-    for (let i = 0; i <= FIND_MAX_DEPTH; i++) {
-        const candidate = join(dir, GGUI_JSON_FILENAME);
-        if (existsSync(candidate))
-            return candidate;
-        const parent = dirname(dir);
-        if (parent === dir)
-            return null;
-        dir = parent;
-    }
-    return null;
-}
-/**
- * Read just the `registry` field from a `ggui.json`. We don't run the
- * full schema parser here — that would couple this command to every
- * other field in the manifest, and a corrupt `gadgets` block
- * (unrelated to search) would prevent `gadget search` from running.
- * The field is validated structurally: must be a string. Schema-level
- * URL validation happens downstream in {@link normalizeRegistryUrl}.
- */
-function readGguiJsonRegistryField(path) {
-    let raw;
-    try {
-        raw = readFileSync(path, 'utf-8');
-    }
-    catch (err) {
-        return {
-            error: `failed to read ${path}: ${err instanceof Error ? err.message : String(err)}`,
-        };
-    }
-    let decoded;
-    try {
-        decoded = JSON.parse(raw);
-    }
-    catch (err) {
-        return {
-            error: `${path} is not valid JSON: ${err instanceof Error ? err.message : String(err)}`,
-        };
-    }
-    if (decoded === null || typeof decoded !== 'object' || Array.isArray(decoded)) {
-        return { error: `${path} is not a JSON object` };
-    }
-    const reg = decoded.registry;
-    if (reg === undefined)
-        return { registry: undefined };
-    if (typeof reg !== 'string') {
-        return { error: `${path}#registry must be a string` };
-    }
-    return { registry: reg };
-}
-function normalizeRegistryUrl(raw) {
-    let parsed;
-    try {
-        parsed = new URL(raw);
-    }
-    catch {
-        return { error: `registry URL is malformed: ${raw}` };
-    }
-    // Strip trailing slashes so we can append `/search` deterministically.
-    // `URL` already normalized scheme + host casing.
-    let serialized = parsed.toString();
-    while (serialized.endsWith('/'))
-        serialized = serialized.slice(0, -1);
-    return { url: serialized };
-}
-/* -------------------------------------------------------------------------- */
 /* Query string                                                              */
 /* -------------------------------------------------------------------------- */
 /**
@@ -314,7 +198,8 @@ export function buildSearchQueryString(flags) {
 /**
  * Run a search end-to-end:
  *
- *   1. Resolve the registry URL via the three-layer chain.
+ *   1. Resolve the registry URL via the shared chain (READ-verb
+ *      posture: flag > env > ggui.json > public default).
  *   2. Build the query string.
  *   3. GET `<registry>/search?<qs>` (no auth; public endpoint).
  *   4. Parse + validate the response shape.
@@ -327,13 +212,13 @@ export async function runArtifactSearch(flags, deps) {
         ...(flags.registry !== undefined ? { flag: flags.registry } : {}),
         cwd: deps.cwd,
         env: deps.env,
+        defaultUrl: DEFAULT_REGISTRY_URL,
     });
-    if ('error' in resolved) {
-        const isNoRegistryError = resolved.error.startsWith('no registry');
+    if (!resolved.ok) {
         return {
             ok: false,
-            code: isNoRegistryError ? 'no-registry' : 'invalid-registry',
-            message: resolved.error,
+            code: resolved.code,
+            message: resolved.message,
         };
     }
     const qs = buildSearchQueryString(flags);
@@ -522,9 +407,10 @@ ${hookLines}  --tag <tag>               Filter by tag (exact match).
   --limit <n>               Page size; 1..200, default 50.
   --cursor <opaque>         Opaque cursor from a previous response —
                             roundtrip verbatim for pagination.
-  --registry <url>          Override the registry URL. Three-layer
-                            resolution: flag > GGUI_REGISTRY env >
-                            ggui.json#registry > error if unset.
+  --registry <url>          Override the registry URL. Resolution:
+                            flag > GGUI_REGISTRY env >
+                            ggui.json#registry > default
+                            (\`${DEFAULT_REGISTRY_URL}\`).
   --json                    Emit the raw JSON response body instead of
                             the human-readable table.
   --help, -h                Show this help.

package/dist/internal/artifact-uninstall.d.ts

@@ -16,13 +16,16 @@ export interface ArtifactUninstallDeps {
 }
 export interface ArtifactUninstallResult {
     readonly exitCode: number;
-    /** `true` when a directory was actually removed. `false` on idempotent no-ops. */
+    /** `true` when something was actually removed (a blueprint's install
+     * directory, or a gadget's `app.gadgets` row). `false` on idempotent
+     * no-ops. */
     readonly removed: boolean;
     /**
-     * `true` when `INSTALLED_BLUEPRINTS_GLOB` was stripped from
-     * `ggui.json#blueprints.include` (i.e. no installed-blueprints
-     * subdirs remained). `false` when the glob was kept (other installs
-     * still on disk) or wasn't present to begin with.
+     * Blueprint-only signal: `true` when `INSTALLED_BLUEPRINTS_GLOB` was
+     * stripped from `ggui.json#blueprints.include` (i.e. no
+     * installed-blueprints subdirs remained). `false` when the glob was
+     * kept (other installs still on disk), wasn't present to begin with,
+     * or the uninstall was a gadget (gadgets never touch the glob).
      */
     readonly globRemoved: boolean;
 }

package/dist/internal/artifact-uninstall.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"artifact-uninstall.d.ts","sourceRoot":"","sources":["../../src/internal/artifact-uninstall.ts"],"names":[],"mappings":"AA0CA,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,uBAAuB,CAAC;AAM1D,wBAAgB,kBAAkB,CAAC,IAAI,EAAE,YAAY,GAAG,MAAM,CA4B7D;AAMD,MAAM,WAAW,4BAA4B;IAC3C,QAAQ,CAAC,IAAI,EAAE,YAAY,CAAC;IAC5B,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;CAC1B;AAED,MAAM,MAAM,uBAAuB,GAC/B,4BAA4B,GAC5B;IAAE,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAA;CAAE,CAAC;AAE/B,wBAAgB,2BAA2B,CACzC,IAAI,EAAE,YAAY,EAClB,IAAI,EAAE,SAAS,MAAM,EAAE,GACtB,uBAAuB,CAwCzB;AAMD,MAAM,WAAW,qBAAqB;IACpC,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,EAAE,MAAM,KAAK,IAAI,CAAC;IACtC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,EAAE,MAAM,KAAK,IAAI,CAAC;CACvC;AAED,MAAM,WAAW,uBAAuB;IACtC,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,kFAAkF;IAClF,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC;IAC1B;;;;;OAKG;IACH,QAAQ,CAAC,WAAW,EAAE,OAAO,CAAC;CAC/B;AAED,wBAAsB,oBAAoB,CACxC,KAAK,EAAE,4BAA4B,EACnC,IAAI,EAAE,qBAAqB,GAC1B,OAAO,CAAC,uBAAuB,CAAC,CAmFlC"}
+{"version":3,"file":"artifact-uninstall.d.ts","sourceRoot":"","sources":["../../src/internal/artifact-uninstall.ts"],"names":[],"mappings":"AAsDA,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,uBAAuB,CAAC;AAM1D,wBAAgB,kBAAkB,CAAC,IAAI,EAAE,YAAY,GAAG,MAAM,CA0C7D;AAMD,MAAM,WAAW,4BAA4B;IAC3C,QAAQ,CAAC,IAAI,EAAE,YAAY,CAAC;IAC5B,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;CAC1B;AAED,MAAM,MAAM,uBAAuB,GAC/B,4BAA4B,GAC5B;IAAE,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAA;CAAE,CAAC;AAE/B,wBAAgB,2BAA2B,CACzC,IAAI,EAAE,YAAY,EAClB,IAAI,EAAE,SAAS,MAAM,EAAE,GACtB,uBAAuB,CAwCzB;AAMD,MAAM,WAAW,qBAAqB;IACpC,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,EAAE,MAAM,KAAK,IAAI,CAAC;IACtC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,EAAE,MAAM,KAAK,IAAI,CAAC;CACvC;AAED,MAAM,WAAW,uBAAuB;IACtC,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B;;iBAEa;IACb,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC;IAC1B;;;;;;OAMG;IACH,QAAQ,CAAC,WAAW,EAAE,OAAO,CAAC;CAC/B;AAED,wBAAsB,oBAAoB,CACxC,KAAK,EAAE,4BAA4B,EACnC,IAAI,EAAE,qBAAqB,GAC1B,OAAO,CAAC,uBAAuB,CAAC,CA6HlC"}

package/dist/internal/artifact-uninstall.js

@@ -1,12 +1,23 @@
 /**
- * `ggui blueprint uninstall <scope/name>@<version>`.
+ * `ggui {gadget,blueprint} uninstall <scope/name>@<version>` — the
+ * kind-discriminated reverse of `runArtifactInstall`, one branch per
+ * install effect:
  *
- * Reverse of `runArtifactInstall`'s on-disk materialization. Removes
- * `.ggui/installed-blueprints/<scope-bare>__<name>__<version>/`
- * from the project root and — when this was the LAST remaining
- * installed-blueprint subdir — strips the `INSTALLED_BLUEPRINTS_GLOB`
- * entry from `ggui.json#blueprints.include` so a future `ggui serve`
- * doesn't walk an empty glob.
+ * - **blueprint** — removes
+ *   `.ggui/installed-blueprints/<scope-bare>__<name>__<version>/`
+ *   from the project root and — when this was the LAST remaining
+ *   installed-blueprint subdir — strips the `INSTALLED_BLUEPRINTS_GLOB`
+ *   entry from `ggui.json#blueprints.include` so a future `ggui serve`
+ *   doesn't walk an empty glob.
+ * - **gadget** — removes the PACKAGE's row from
+ *   `ggui.json#app.gadgets` (the row `runArtifactInstall` appended).
+ *   Rows are keyed by package — one row per package is the catalog
+ *   invariant, and install replaces the row on a version change — so
+ *   the supplied version does not gate the match; when it differs
+ *   from the installed one, the actual removed version is reported.
+ *   When it was the last row, the empty `gadgets` array is dropped
+ *   too, keeping the manifest tidy. Nothing on disk to delete —
+ *   gadget installs never materialize files.
  *
  * What this does NOT touch:
  *
@@ -28,28 +39,16 @@
  * shouldn't be punished for re-running the command.
  */
 import { existsSync, readdirSync, rmSync } from 'node:fs';
-import { join } from 'node:path';
-import { findGguiJson, readGguiJson, writeGguiJson, } from './ggui-json.js';
+import { dirname, join } from 'node:path';
+import { FIND_MAX_DEPTH, findGguiJson, readGguiJson, writeGguiJson, } from './ggui-json.js';
 import { blueprintInstallSubdir, INSTALLED_BLUEPRINTS_GLOB, INSTALLED_BLUEPRINTS_SUBDIR, } from './artifact-install.js';
 /* -------------------------------------------------------------------------- */
 /* Help text                                                                  */
 /* -------------------------------------------------------------------------- */
 export function buildUninstallHelp(kind) {
-    const noun = kind === 'blueprint' ? 'blueprint' : 'gadget';
-    const verb = `ggui ${noun} uninstall`;
-    return `${verb} — remove a marketplace-installed ${noun} from this project.
-
-Usage:
-  ${verb} <scope/name>@<version> [options]
-
-Arguments:
-  <scope/name>@<version>    Full install identifier. Same shape as install.
-
-Options:
-  --help                    Show this help.
-
-Behavior:
-  - Removes \`.ggui/installed-blueprints/<scope-bare>__<name>__<version>/\` from disk.
+    const verb = `ggui ${kind} uninstall`;
+    const behavior = kind === 'blueprint'
+        ? `  - Removes \`.ggui/installed-blueprints/<scope-bare>__<name>__<version>/\` from disk.
   - When this was the LAST installed-blueprint subdir, strips the
     \`${INSTALLED_BLUEPRINTS_GLOB}\` entry from \`ggui.json#blueprints.include\`.
     Other globs in the include list are preserved verbatim.
@@ -61,7 +60,32 @@ Caveats:
     (the install-to-cache bridge is per-scope idempotent within a server
     lifetime). Restart to reclaim the cache slot.
   - This is local-only. The published marketplace artifact is unchanged.
+`
+        : `  - Removes the package's entry from \`ggui.json#app.gadgets\`
+    (the entry install appended). Entries are keyed by package — if the
+    installed version differs from the one you supply, the entry is
+    still removed and the actual version is reported. When it was
+    the last entry, the empty \`gadgets\` array is dropped too. Other
+    entries are preserved verbatim.
+  - Idempotent: uninstalling a never-installed identifier exits 0
+    with a stderr note. Re-runs are safe.
+
+Caveats:
+  - This is local-only. The published marketplace artifact is unchanged.
 `;
+    return `${verb} — remove a marketplace-installed ${kind} from this project.
+
+Usage:
+  ${verb} <scope/name>@<version> [options]
+
+Arguments:
+  <scope/name>@<version>    Full install identifier. Same shape as install.
+
+Options:
+  --help                    Show this help.
+
+Behavior:
+${behavior}`;
 }
 export function parseArtifactUninstallFlags(kind, args) {
     let positional;
@@ -109,7 +133,7 @@ export async function runArtifactUninstall(flags, deps) {
     const stderr = deps.stderr ?? ((s) => void process.stderr.write(s));
     const gguiPath = findGguiJson(deps.cwd);
     if (gguiPath === null) {
-        stderr(`${verb}: no ggui.json found in ${deps.cwd} or any ancestor (up to 8 levels).\n`);
+        stderr(`${verb}: no ggui.json found in ${deps.cwd} or any ancestor (up to ${FIND_MAX_DEPTH} levels).\n`);
         return { exitCode: 2, removed: false, globRemoved: false };
     }
     const loaded = readGguiJson(gguiPath);
@@ -118,7 +142,38 @@ export async function runArtifactUninstall(flags, deps) {
         return { exitCode: 2, removed: false, globRemoved: false };
     }
     const gguiJson = loaded.value;
-    const projectRoot = gguiPath.slice(0, gguiPath.lastIndexOf('/'));
+    // ---- gadget branch: remove the ggui.json#app.gadgets row ----
+    // Gadget installs never materialize files; the whole install effect
+    // is the package-keyed row `appendGadget` wrote. Reverse it: rows
+    // are keyed by PACKAGE (one row per package is the catalog
+    // invariant, and install replaces the row on a version change), so
+    // uninstall matches by package alone — otherwise uninstalling the
+    // originally-installed version after an upgrade would report
+    // "nothing to remove" while the row is still live.
+    if (flags.kind === 'gadget') {
+        const rowRes = removeGadgetRow(gguiJson, flags.artifactId);
+        if ('error' in rowRes) {
+            stderr(`${verb}: ${rowRes.error}\n`);
+            return { exitCode: 1, removed: false, globRemoved: false };
+        }
+        if (!rowRes.removed) {
+            stderr(`${verb}: ${flags.artifactId} is not installed (no matching entry in ${gguiPath}#app.gadgets) — nothing to remove.\n`);
+            return { exitCode: 0, removed: false, globRemoved: false };
+        }
+        writeGguiJson(gguiPath, gguiJson);
+        for (const v of rowRes.removedVersions) {
+            stdout(`removed: ${flags.artifactId}@${v} from ggui.json#app.gadgets\n`);
+        }
+        const mismatched = rowRes.removedVersions.filter((v) => v !== flags.version);
+        if (mismatched.length > 0) {
+            stdout(`note: you supplied @${flags.version}, but the installed version was ${mismatched.join(', ')} — gadget rows are keyed by package (one row per package), so the package's row was removed.\n`);
+        }
+        stdout(`\nUninstall complete.\n`);
+        return { exitCode: 0, removed: true, globRemoved: false };
+    }
+    // ---- blueprint branch: remove the materialized install directory ----
+    // `dirname` (not a hand-rolled '/'-slice) so Windows paths resolve.
+    const projectRoot = dirname(gguiPath);
     const scope = flags.artifactId.slice(1, flags.artifactId.indexOf('/'));
     const name = flags.artifactId.slice(flags.artifactId.indexOf('/') + 1);
     const subdir = blueprintInstallSubdir({
@@ -172,6 +227,58 @@ export async function runArtifactUninstall(flags, deps) {
     }
     return { exitCode: 0, removed, globRemoved };
 }
+/**
+ * Remove every row of `artifactId`'s PACKAGE from
+ * `ggui.json#app.gadgets`. Exact reverse of the append: rows are keyed
+ * by package (one row per package is the catalog invariant, and
+ * install replaces the row on any version change), so the supplied
+ * version is NOT part of the match — uninstalling with a stale version
+ * still removes the package's row; the caller reports the versions
+ * that actually went away. Install keeps the catalog at one row per
+ * package, but hand-edited manifests can carry duplicates — uninstall
+ * removes ALL matches so "Uninstall complete" is never a half-truth.
+ * When the removal empties the array, the `gadgets` key is dropped so
+ * the manifest stays tidy (mirrors the blueprint branch's last-install
+ * glob cleanup).
+ *
+ * Structural errors (`app` / `app.gadgets` present but wrong-shaped)
+ * surface as `{ error }`; a missing block is simply "not installed".
+ */
+function removeGadgetRow(gguiJson, artifactId) {
+    const app = gguiJson['app'];
+    if (app === undefined)
+        return { removed: false, removedVersions: [] };
+    if (typeof app !== 'object' || app === null || Array.isArray(app)) {
+        return { error: 'ggui.json#app must be an object' };
+    }
+    const appObj = app;
+    const gadgets = appObj['gadgets'];
+    if (gadgets === undefined)
+        return { removed: false, removedVersions: [] };
+    if (!Array.isArray(gadgets)) {
+        return { error: 'ggui.json#app.gadgets must be an array' };
+    }
+    const removedVersions = [];
+    const remaining = gadgets.filter((e) => {
+        if (e === null || typeof e !== 'object')
+            return true;
+        const cand = e;
+        if (cand.package !== artifactId)
+            return true;
+        removedVersions.push(typeof cand.version === 'string' ? cand.version : '(unknown)');
+        return false;
+    });
+    if (remaining.length === gadgets.length) {
+        return { removed: false, removedVersions: [] };
+    }
+    if (remaining.length === 0) {
+        delete appObj['gadgets'];
+    }
+    else {
+        appObj['gadgets'] = remaining;
+    }
+    return { removed: true, removedVersions };
+}
 /**
  * Strip `INSTALLED_BLUEPRINTS_GLOB` from `gguiJson.blueprints.include`
  * when present. Returns `true` when a write is needed. Leaves the

package/dist/internal/ggui-json.d.ts

@@ -1,11 +1,15 @@
+import { type GadgetDescriptor } from '@ggui-ai/protocol';
 /** Canonical filename — duplicated from `@ggui-ai/project-config` so
  * this helper stays free of that dependency. The constant lives in one
  * place per package; updates ride along on a project-config bump. */
 export declare const GGUI_JSON_FILENAME = "ggui.json";
-/** How many parent directories to walk before giving up. Mirrors the
- * convention used by `gadget-search.ts#findGguiJson` + the upstream
- * `@ggui-ai/project-config/node` helper. */
-export declare const FIND_MAX_DEPTH = 8;
+/** How many parent directories to walk before giving up. The single
+ * shared depth for every ggui.json walk in this package — manifest
+ * discovery (install/uninstall) AND registry-field resolution
+ * (`./registry-url.ts`). 16 levels covers deep monorepo layouts; the
+ * historical publish resolver walked 16 while search/install walked 8,
+ * and unifying DOWN would have broken 9-16-level-deep publishes. */
+export declare const FIND_MAX_DEPTH = 16;
 /**
  * Walk up from `startDir` looking for the first `ggui.json` ancestor.
  * Returns the absolute path or `null` if none found within
@@ -50,4 +54,31 @@ export declare function readGguiJson(path: string): {
  * already.
  */
 export declare function writeGguiJson(path: string, value: GguiJsonObject): void;
+/**
+ * Result of {@link readGadgetsFromGguiJson}: the validated catalog, or
+ * a row-indexed error string ready for stderr.
+ */
+export type GadgetsReadResult = {
+    readonly ok: true;
+    readonly gadgets: GadgetDescriptor[];
+} | {
+    readonly ok: false;
+    readonly error: string;
+};
+/**
+ * THE one ggui.json gadget-catalog reader for this package — the
+ * install write gate and the `ggui deploy` config push both call it,
+ * so the two surfaces cannot drift on optionality or error shape.
+ *
+ * Navigates to `app.gadgets` via a nested non-strict schema (other
+ * manifest fields ride through untouched) and strict-parses every row
+ * (`strictGadgetDescriptorSchema` — the same posture every other
+ * catalog boundary applies). Absent `app` / `app.gadgets` reads as an
+ * empty catalog.
+ *
+ * On failure the error names the offending ROW by index and points at
+ * editing `ggui.json` — callers surface it verbatim, plus their own
+ * context, and MUST NOT imply the current command created the row.
+ */
+export declare function readGadgetsFromGguiJson(gguiJson: unknown): GadgetsReadResult;
 //# sourceMappingURL=ggui-json.d.ts.map

package/dist/internal/ggui-json.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"ggui-json.d.ts","sourceRoot":"","sources":["../../src/internal/ggui-json.ts"],"names":[],"mappings":"AAqBA;;qEAEqE;AACrE,eAAO,MAAM,kBAAkB,cAAc,CAAC;AAE9C;;4CAE4C;AAC5C,eAAO,MAAM,cAAc,IAAI,CAAC;AAEhC;;;;;;;;;;GAUG;AACH,wBAAgB,YAAY,CAAC,QAAQ,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAU5D;AAED;;;;;GAKG;AACH,MAAM,MAAM,cAAc,GAAG;IAAE,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAA;CAAE,CAAC;AAExD;;;;;;;GAOG;AACH,wBAAgB,YAAY,CAC1B,IAAI,EAAE,MAAM,GACX;IAAE,KAAK,EAAE,cAAc,CAAA;CAAE,GAAG;IAAE,KAAK,EAAE,MAAM,CAAA;CAAE,CAyB/C;AAED;;;;;;;;GAQG;AACH,wBAAgB,aAAa,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,cAAc,GAAG,IAAI,CAEvE"}
+{"version":3,"file":"ggui-json.d.ts","sourceRoot":"","sources":["../../src/internal/ggui-json.ts"],"names":[],"mappings":"AAsBA,OAAO,EAEL,KAAK,gBAAgB,EACtB,MAAM,mBAAmB,CAAC;AAG3B;;qEAEqE;AACrE,eAAO,MAAM,kBAAkB,cAAc,CAAC;AAE9C;;;;;oEAKoE;AACpE,eAAO,MAAM,cAAc,KAAK,CAAC;AAEjC;;;;;;;;;;GAUG;AACH,wBAAgB,YAAY,CAAC,QAAQ,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAU5D;AAED;;;;;GAKG;AACH,MAAM,MAAM,cAAc,GAAG;IAAE,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAA;CAAE,CAAC;AAExD;;;;;;;GAOG;AACH,wBAAgB,YAAY,CAC1B,IAAI,EAAE,MAAM,GACX;IAAE,KAAK,EAAE,cAAc,CAAA;CAAE,GAAG;IAAE,KAAK,EAAE,MAAM,CAAA;CAAE,CAyB/C;AAED;;;;;;;;GAQG;AACH,wBAAgB,aAAa,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,cAAc,GAAG,IAAI,CAEvE;AAED;;;GAGG;AACH,MAAM,MAAM,iBAAiB,GACzB;IAAE,QAAQ,CAAC,EAAE,EAAE,IAAI,CAAC;IAAC,QAAQ,CAAC,OAAO,EAAE,gBAAgB,EAAE,CAAA;CAAE,GAC3D;IAAE,QAAQ,CAAC,EAAE,EAAE,KAAK,CAAC;IAAC,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAA;CAAE,CAAC;AAEnD;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,uBAAuB,CAAC,QAAQ,EAAE,OAAO,GAAG,iBAAiB,CA+B5E"}

package/dist/internal/ggui-json.js

@@ -2,10 +2,12 @@
  * Minimal ggui.json read/write helpers shared by gadget subcommands.
  *
  * Shared by the publish and install subcommands so neither has to
- * duplicate the path-walk + JSON IO scaffolding. The parser is
- * deliberately structural (no schema parse): install touches
+ * duplicate the path-walk + JSON IO scaffolding. The file-level parser
+ * is deliberately structural (no schema parse): install touches
  * `app.gadgets` only, so a malformed `theme` block elsewhere in the
- * file shouldn't prevent an install from rewriting the array.
+ * file shouldn't prevent an install from rewriting the array. The one
+ * schema-validating helper here is {@link readGadgetsFromGguiJson} —
+ * the package's single gadget-catalog reader (install + deploy).
  *
  * The shape returned is the raw decoded JSON. Callers narrow the
  * sub-objects they touch (e.g. `app.gadgets`) and run the
@@ -14,14 +16,19 @@
  */
 import { existsSync, readFileSync, writeFileSync, } from 'node:fs';
 import { dirname, join, resolve } from 'node:path';
+import { strictGadgetDescriptorSchema, } from '@ggui-ai/protocol';
+import { z } from 'zod';
 /** Canonical filename — duplicated from `@ggui-ai/project-config` so
  * this helper stays free of that dependency. The constant lives in one
  * place per package; updates ride along on a project-config bump. */
 export const GGUI_JSON_FILENAME = 'ggui.json';
-/** How many parent directories to walk before giving up. Mirrors the
- * convention used by `gadget-search.ts#findGguiJson` + the upstream
- * `@ggui-ai/project-config/node` helper. */
-export const FIND_MAX_DEPTH = 8;
+/** How many parent directories to walk before giving up. The single
+ * shared depth for every ggui.json walk in this package — manifest
+ * discovery (install/uninstall) AND registry-field resolution
+ * (`./registry-url.ts`). 16 levels covers deep monorepo layouts; the
+ * historical publish resolver walked 16 while search/install walked 8,
+ * and unifying DOWN would have broken 9-16-level-deep publishes. */
+export const FIND_MAX_DEPTH = 16;
 /**
  * Walk up from `startDir` looking for the first `ggui.json` ancestor.
  * Returns the absolute path or `null` if none found within
@@ -90,3 +97,47 @@ export function readGguiJson(path) {
 export function writeGguiJson(path, value) {
     writeFileSync(path, `${JSON.stringify(value, null, 2)}\n`, 'utf-8');
 }
+/**
+ * THE one ggui.json gadget-catalog reader for this package — the
+ * install write gate and the `ggui deploy` config push both call it,
+ * so the two surfaces cannot drift on optionality or error shape.
+ *
+ * Navigates to `app.gadgets` via a nested non-strict schema (other
+ * manifest fields ride through untouched) and strict-parses every row
+ * (`strictGadgetDescriptorSchema` — the same posture every other
+ * catalog boundary applies). Absent `app` / `app.gadgets` reads as an
+ * empty catalog.
+ *
+ * On failure the error names the offending ROW by index and points at
+ * editing `ggui.json` — callers surface it verbatim, plus their own
+ * context, and MUST NOT imply the current command created the row.
+ */
+export function readGadgetsFromGguiJson(gguiJson) {
+    const schema = z.object({
+        app: z
+            .object({
+            gadgets: z.array(strictGadgetDescriptorSchema).optional(),
+        })
+            .optional(),
+    });
+    const result = schema.safeParse(gguiJson);
+    if (!result.success) {
+        const issue = result.error.issues[0];
+        // `issue.path` is ['app', 'gadgets', <rowIndex>, ...rest] when a
+        // row failed; shallower when the container itself is malformed.
+        const path = issue !== undefined && issue.path.length > 0
+            ? issue.path
+                .map((p, i) => typeof p === 'number'
+                ? `[${p}]`
+                : i === 0
+                    ? String(p)
+                    : `.${String(p)}`)
+                .join('')
+            : 'app.gadgets';
+        return {
+            ok: false,
+            error: `ggui.json#${path} failed validation — ${issue?.message ?? 'malformed descriptor'}. Edit ggui.json#app.gadgets to fix or remove the offending entry.`,
+        };
+    }
+    return { ok: true, gadgets: [...(result.data.app?.gadgets ?? [])] };
+}