@ggui-ai/cli 0.6.3 → 0.8.0

package/dist/auth-keys.d.ts

@@ -1,8 +1,10 @@
-export declare const KEYS_HELP = "ggui keys \u2014 manage CLI keys\n\nUsage:\n  ggui keys list                          [--keys-file <path>]\n  ggui keys create  [--name <label>] [--expires-at <iso8601>] [--keys-file <path>]\n  ggui keys revoke  <id>                  [--keys-file <path>]\n  ggui keys register --scope <@scope>    [--registry <url>] [--auth=bearer [--token <token>]]\n\nlist      Print the caller's keys (id, prefix, name, status, dates).\ncreate    Mint a new connector key. The full secret is printed ONCE \u2014 copy it.\nrevoke    Soft-revoke a connector key by id (the row stays for audit).\nregister  Register a per-scope Ed25519 PUBLISHER key with the marketplace\n          registry so future `ggui gadget publish` / `ggui blueprint publish`\n          signed by the matching private key validate. The keypair is\n          auto-generated on first publish under\n          ~/.ggui/keys/<scope>/{private,public}.key \u2014 this verb ships\n          the public half to the registry's POST /author-keys.\n\nregister-only Auth:\n  --auth=bearer        Use a bearer token (for self-hosted or local\n                       registries). Pair with --token <token> or set\n                       GGUI_REGISTRY_TOKEN in the environment.\n  --token <token>      Bearer token (paired with --auth=bearer).\n  (default)            Your `ggui login` session \u2014 the CLI reads\n                       ~/.ggui/auth.json and refreshes the token\n                       automatically when it has expired. Run\n                       `ggui login` first.\n\n\nPass --keys-file <path> to operate on the LOCAL JSON file instead of\nthe cloud (api.ggui.ai). The file format is the one written by\n`ggui serve --keys-file` \u2014 the two commands share the same store, so\nyou can mint a bearer here and have `ggui serve` accept it on next\nboot. Use this for self-host / personal-mode workflows. --keys-file\napplies to list/create/revoke only; `register` always talks to the\nmarketplace registry.\n";
+export declare const KEYS_HELP = "ggui keys \u2014 manage CLI keys\n\nUsage:\n  ggui keys list                          [--keys-file <path>]\n  ggui keys create  [--name <label>] [--expires-at <iso8601>] [--keys-file <path>]\n  ggui keys revoke  <id>                  [--keys-file <path>]\n  ggui keys register --scope <@scope>    [--label <name>] [--registry <url>] [--auth=bearer [--token <token>]]\n\nlist      Print the caller's keys (id, prefix, name, status, dates).\ncreate    Mint a new connector key. The full secret is printed ONCE \u2014 copy it.\nrevoke    Soft-revoke a connector key by id (the row stays for audit).\nregister  Register a per-scope Ed25519 PUBLISHER key with the marketplace\n          registry so future `ggui gadget publish` / `ggui blueprint publish`\n          signed by the matching private key validate. The keypair is\n          auto-generated on first publish under\n          ~/.ggui/keys/<scope>/{private,public}.key \u2014 this verb ships\n          the public half to the registry's POST /author-keys.\n          --label attaches a display name shown by the registry's key\n          management surfaces (e.g. \"ci laptop\").\n\nregister-only Auth:\n  --auth=bearer        Use a bearer token (for self-hosted or local\n                       registries). Pair with --token <token> or set\n                       GGUI_REGISTRY_TOKEN in the environment.\n  --token <token>      Bearer token (paired with --auth=bearer).\n  (default)            Your `ggui login` session \u2014 the CLI reads\n                       ~/.ggui/auth.json and refreshes the token\n                       automatically when it has expired. Run\n                       `ggui login` first.\n\n\nPass --keys-file <path> to operate on the LOCAL JSON file instead of\nthe cloud (api.ggui.ai). The file format is the one written by\n`ggui serve --keys-file` \u2014 the two commands share the same store, so\nyou can mint a bearer here and have `ggui serve` accept it on next\nboot. Use this for self-host / personal-mode workflows. --keys-file\napplies to list/create/revoke only; `register` always talks to the\nmarketplace registry.\n";
 export declare function runKeysCommand(args: readonly string[]): Promise<number>;
 export interface RegisterFlags {
     readonly scope?: string;
     readonly registry?: string;
+    /** Optional display name stored on the registered key ([E]). */
+    readonly label?: string;
     readonly help: boolean;
     readonly error?: string;
 }

package/dist/auth-keys.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"auth-keys.d.ts","sourceRoot":"","sources":["../src/auth-keys.ts"],"names":[],"mappings":"AAwBA,eAAO,MAAM,SAAS,w7DA2BrB,CAAC;AAEF,wBAAsB,cAAc,CAAC,IAAI,EAAE,SAAS,MAAM,EAAE,GAAG,OAAO,CAAC,MAAM,CAAC,CAoB7E;AA6PD,MAAM,WAAW,aAAa;IAC5B,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,IAAI,EAAE,OAAO,CAAC;IACvB,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC;CACzB;AAED,wBAAgB,kBAAkB,CAAC,IAAI,EAAE,SAAS,MAAM,EAAE,GAAG,aAAa,CA2CzE"}
+{"version":3,"file":"auth-keys.d.ts","sourceRoot":"","sources":["../src/auth-keys.ts"],"names":[],"mappings":"AAwBA,eAAO,MAAM,SAAS,qkEA6BrB,CAAC;AAEF,wBAAsB,cAAc,CAAC,IAAI,EAAE,SAAS,MAAM,EAAE,GAAG,OAAO,CAAC,MAAM,CAAC,CAoB7E;AA6PD,MAAM,WAAW,aAAa;IAC5B,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAC3B,gEAAgE;IAChE,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,IAAI,EAAE,OAAO,CAAC;IACvB,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC;CACzB;AAED,wBAAgB,kBAAkB,CAAC,IAAI,EAAE,SAAS,MAAM,EAAE,GAAG,aAAa,CAuEzE"}

package/dist/auth-keys.js

@@ -21,7 +21,7 @@ Usage:
   ggui keys list                          [--keys-file <path>]
   ggui keys create  [--name <label>] [--expires-at <iso8601>] [--keys-file <path>]
   ggui keys revoke  <id>                  [--keys-file <path>]
-  ggui keys register --scope <@scope>    [--registry <url>] [--auth=bearer [--token <token>]]
+  ggui keys register --scope <@scope>    [--label <name>] [--registry <url>] [--auth=bearer [--token <token>]]
 
 list      Print the caller's keys (id, prefix, name, status, dates).
 create    Mint a new connector key. The full secret is printed ONCE — copy it.
@@ -32,6 +32,8 @@ register  Register a per-scope Ed25519 PUBLISHER key with the marketplace
           auto-generated on first publish under
           ~/.ggui/keys/<scope>/{private,public}.key — this verb ships
           the public half to the registry's POST /author-keys.
+          --label attaches a display name shown by the registry's key
+          management surfaces (e.g. "ci laptop").
 
 register-only ${AUTH_HELP_FRAGMENT}
 
@@ -290,6 +292,7 @@ function printApiError(label, err) {
 export function parseRegisterFlags(args) {
     let scope;
     let registry;
+    let label;
     let help = false;
     for (let i = 0; i < args.length; i++) {
         const arg = args[i];
@@ -323,12 +326,39 @@ export function parseRegisterFlags(args) {
             registry = arg.slice('--registry='.length);
             continue;
         }
+        if (arg === '--label') {
+            const value = args[i + 1];
+            if (typeof value !== 'string' || value.trim().length === 0) {
+                return {
+                    help,
+                    error: '--label requires a non-empty value (e.g. `ci laptop`)',
+                };
+            }
+            label = value;
+            i += 1;
+            continue;
+        }
+        if (arg && arg.startsWith('--label=')) {
+            // Same rule as the space form — an explicit empty (`--label=`)
+            // or whitespace-only value is a usage error, never a silent
+            // no-label register.
+            const value = arg.slice('--label='.length);
+            if (value.trim().length === 0) {
+                return {
+                    help,
+                    error: '--label requires a non-empty value (e.g. `ci laptop`)',
+                };
+            }
+            label = value;
+            continue;
+        }
         return { help, error: `unknown flag: ${arg}` };
     }
     return {
         help,
         ...(scope !== undefined ? { scope } : {}),
         ...(registry !== undefined ? { registry } : {}),
+        ...(label !== undefined ? { label } : {}),
     };
 }
 async function runKeysRegister(args) {
@@ -361,6 +391,7 @@ async function runKeysRegister(args) {
     const outcome = await runRegisterAuthorKey({
         scope: flags.scope,
         ...(flags.registry !== undefined ? { registry: flags.registry } : {}),
+        ...(flags.label !== undefined ? { label: flags.label } : {}),
         ...(authFlags.auth !== undefined || authFlags.token !== undefined
             ? { auth: authFlags }
             : {}),
@@ -380,7 +411,16 @@ async function runKeysRegister(args) {
         process.stdout.write(`${verb} publisher key for ${flags.scope}.\n` +
             `  registry: ${outcome.registryUrl}\n` +
             `  subject:  ${outcome.subject}\n` +
-            `  keyId:    ${outcome.keyId}\n`);
+            `  keyId:    ${outcome.keyId}\n` +
+            (outcome.label !== undefined ? `  label:    ${outcome.label}\n` : ''));
+        // Idempotent re-register keeps the STORED label — say so when the
+        // caller asked for a different one, so a silent "why didn't my
+        // label change" mystery never happens.
+        if (flags.label !== undefined && outcome.label !== flags.label) {
+            process.stdout.write(`  note: the registry kept the key's existing label` +
+                `${outcome.label !== undefined ? ` ("${outcome.label}")` : ''} — ` +
+                `re-registering never rewrites it.\n`);
+        }
         return 0;
     }
     process.stderr.write(`ggui keys register: ${outcome.code}: ${outcome.message}\n`);

package/dist/blueprint-command.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"blueprint-command.d.ts","sourceRoot":"","sources":["../src/blueprint-command.ts"],"names":[],"mappings":"AA6CA,eAAO,MAAM,cAAc,uiBAa1B,CAAC;AAEF,wBAAsB,mBAAmB,CACvC,IAAI,EAAE,SAAS,MAAM,EAAE,GACtB,OAAO,CAAC,MAAM,CAAC,CAsBjB"}
+{"version":3,"file":"blueprint-command.d.ts","sourceRoot":"","sources":["../src/blueprint-command.ts"],"names":[],"mappings":"AA+CA,eAAO,MAAM,cAAc,uiBAa1B,CAAC;AAEF,wBAAsB,mBAAmB,CACvC,IAAI,EAAE,SAAS,MAAM,EAAE,GACtB,OAAO,CAAC,MAAM,CAAC,CAsBjB"}

package/dist/blueprint-command.js

@@ -1,20 +1,21 @@
 /**
- * `ggui blueprint <create|publish|install|search>` — kind-discriminated
- * sibling of `gadget-command.ts`.
+ * `ggui blueprint <create|publish|install|uninstall|search>` —
+ * kind-discriminated sibling of `gadget-command.ts`.
  *
- * - `create`  — scaffold a new blueprint repo (TSX + contract stub)
- * - `publish` — build, sign, and push to a registry; manifest-kind
- *               mismatch errors with a friendly redirect.
- * - `install` — fetch, verify, and materialize a blueprint into
- *               `.ggui/installed-blueprints/<id>/`.
- * - `search`  — query the registry, hard-locked to `kind=blueprint`.
+ * - `create`    — scaffold a new blueprint repo (TSX + contract stub)
+ * - `publish`   — build, sign, and push to a registry; manifest-kind
+ *                 mismatch errors with a friendly redirect.
+ * - `install`   — fetch, verify, and materialize a blueprint into
+ *                 `.ggui/installed-blueprints/<id>/`.
+ * - `uninstall` — remove the materialized directory (reverse of install).
+ * - `search`    — query the registry, hard-locked to `kind=blueprint`.
  *
  * A thin router that passes `kind: 'blueprint'` to the shared
  * `internal/artifact-*` implementations. Per-kind state (scaffolders,
  * help text) lives in sibling files; the rest is shared.
  */
 import { BLUEPRINT_CREATE_HELP, parseBlueprintCreateFlags, runBlueprintCreate, } from './blueprint-create.js';
-import { buildPublishHelp, parseArtifactPublishFlags, runArtifactPublish, } from './internal/artifact-publish.js';
+import { buildPublishHelp, parseArtifactPublishFlags, publishOptionsFromFlags, runArtifactPublish, } from './internal/artifact-publish.js';
 import { buildInstallHelp, parseArtifactInstallFlags, runArtifactInstall, } from './internal/artifact-install.js';
 import { buildUninstallHelp, parseArtifactUninstallFlags, runArtifactUninstall, } from './internal/artifact-uninstall.js';
 import { buildSearchHelp, parseArtifactSearchFlags, runArtifactSearch, } from './internal/artifact-search.js';
@@ -110,12 +111,11 @@ async function runPublish(args) {
         process.stderr.write(`ggui blueprint publish: ${flags.error}\n`);
         return 2;
     }
+    // Forward the WHOLE parsed-flag bundle — no per-field spreads (a
+    // hand-written spread is how `--identity-token` got dropped once).
     const result = await runArtifactPublish({
         kind: KIND,
-        ...(flags.registry !== undefined ? { registry: flags.registry } : {}),
-        dryRun: flags.dryRun,
-        ...(flags.key !== undefined ? { key: flags.key } : {}),
-        ...(flags.auth !== undefined ? { auth: flags.auth } : {}),
+        ...publishOptionsFromFlags(flags),
     });
     return result.exitCode;
 }

package/dist/cli.js

@@ -615,6 +615,14 @@ async function runServeCommand(args) {
             return 1;
         }
     }
+    // Browser-origin allowlist (ggui#438). CLI flags win; the env var is
+    // the container/compose ergonomic. Resolved HERE so the banner, the
+    // backend, and the server all see the same effective list.
+    const envBrowserOrigins = (process.env['GGUI_BROWSER_ORIGINS'] ?? '')
+        .split(',')
+        .map((o) => o.trim())
+        .filter((o) => o.length > 0);
+    const browserOrigins = parsed.browserOrigins.length > 0 ? parsed.browserOrigins : envBrowserOrigins;
     try {
         return await runServe({
             flags: {
@@ -625,6 +633,7 @@ async function runServeCommand(args) {
                 publicDemo: parsed.publicDemo,
                 multiTenant: parsed.multiTenant,
                 oauth: parsed.oauth,
+                browserOrigins,
                 ...(parsed.publicBaseUrl !== undefined
                     ? { publicBaseUrl: parsed.publicBaseUrl }
                     : {}),
@@ -746,6 +755,7 @@ async function runServeCommand(args) {
                 generation: generationBinding.generation,
                 ...(mcpMounts.length > 0 ? { mcpMounts } : {}),
                 ...(seedPools.length > 0 ? { seedPools } : {}),
+                ...(browserOrigins.length > 0 ? { browserOrigins } : {}),
                 // Marketplace-install bridge. Pass the projectRoot +
                 // filtered installed-blueprint subset so `buildMcpServerBackend`
                 // can construct an `InstalledBlueprintsProvider` rooted on the

package/dist/config-push.d.ts

@@ -1,12 +1,4 @@
 import { type GadgetDescriptor, type AppTheme } from '@ggui-ai/protocol';
-/**
- * Extract and validate `app.gadgets` from a decoded ggui.json value.
- *
- * Returns `[]` when the field is absent.
- * Throws with a descriptive message when any descriptor is malformed
- * (schema parse fails).
- */
-export declare function readGadgetsFromGguiJson(gguiJson: unknown): GadgetDescriptor[];
 /**
  * Extract and validate `app.publicEnv` from a decoded ggui.json value.
  *

package/dist/config-push.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"config-push.d.ts","sourceRoot":"","sources":["../src/config-push.ts"],"names":[],"mappings":"AAUA,OAAO,EAKL,KAAK,gBAAgB,EACrB,KAAK,QAAQ,EACd,MAAM,mBAAmB,CAAC;AAU3B;;;;;;GAMG;AACH,wBAAgB,uBAAuB,CAAC,QAAQ,EAAE,OAAO,GAAG,gBAAgB,EAAE,CAqB7E;AAED;;;;;;GAMG;AACH,wBAAgB,yBAAyB,CAAC,QAAQ,EAAE,OAAO,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAmBnF;AAED;;;;;;;;;GASG;AACH,wBAAgB,0BAA0B,CACxC,QAAQ,EAAE,OAAO,GAChB;IAAE,KAAK,EAAE,MAAM,CAAC;IAAC,SAAS,EAAE,KAAK,GAAG,SAAS,CAAA;CAAE,GAAG,SAAS,CAkB7D;AA4BD;;;;;;;;;;;;;;;;;GAiBG;AACH,wBAAgB,qBAAqB,CACnC,WAAW,EAAE,MAAM,EACnB,QAAQ,EAAE,OAAO,GAChB,QAAQ,GAAG,SAAS,CA4CtB;AAMD;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,4BAA4B,CAAC,OAAO,EAAE,gBAAgB,EAAE,GAAG,IAAI,CAiB9E;AAMD;;;;;;;;;;GAUG;AACH,wBAAsB,iBAAiB,CACrC,KAAK,EAAE,MAAM,EACb,QAAQ,GAAE,MAAsB,GAC/B,OAAO,CAAC,MAAM,CAAC,CA8FjB"}
+{"version":3,"file":"config-push.d.ts","sourceRoot":"","sources":["../src/config-push.ts"],"names":[],"mappings":"AAUA,OAAO,EAIL,KAAK,gBAAgB,EACrB,KAAK,QAAQ,EACd,MAAM,mBAAmB,CAAC;AAmB3B;;;;;;GAMG;AACH,wBAAgB,yBAAyB,CAAC,QAAQ,EAAE,OAAO,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAmBnF;AAED;;;;;;;;;GASG;AACH,wBAAgB,0BAA0B,CACxC,QAAQ,EAAE,OAAO,GAChB;IAAE,KAAK,EAAE,MAAM,CAAC;IAAC,SAAS,EAAE,KAAK,GAAG,SAAS,CAAA;CAAE,GAAG,SAAS,CAkB7D;AA4BD;;;;;;;;;;;;;;;;;GAiBG;AACH,wBAAgB,qBAAqB,CACnC,WAAW,EAAE,MAAM,EACnB,QAAQ,EAAE,OAAO,GAChB,QAAQ,GAAG,SAAS,CA4CtB;AAMD;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,4BAA4B,CAAC,OAAO,EAAE,gBAAgB,EAAE,GAAG,IAAI,CAiB9E;AAMD;;;;;;;;;;GAUG;AACH,wBAAsB,iBAAiB,CACrC,KAAK,EAAE,MAAM,EACb,QAAQ,GAAE,MAAsB,GAC/B,OAAO,CAAC,MAAM,CAAC,CA2FjB"}

package/dist/config-push.js

@@ -8,41 +8,18 @@
  */
 import process from 'node:process';
 import { dirname } from 'node:path';
-import { strictGadgetDescriptorSchema, appPublicEnvSchema, appThemeSchema, LOOPBACK_HOST_RE, } from '@ggui-ai/protocol';
+import { appPublicEnvSchema, appThemeSchema, LOOPBACK_HOST_RE, } from '@ggui-ai/protocol';
 import { loadTheme, parseGguiJson } from '@ggui-ai/project-config/node';
 import { z } from 'zod';
 import { patchAppConfig } from './api-client.js';
-import { findGguiJson, readGguiJson } from './internal/ggui-json.js';
+import { findGguiJson, readGadgetsFromGguiJson, readGguiJson, } from './internal/ggui-json.js';
 // ─────────────────────────────────────────────────────────────────────────────
 // Readers
 // ─────────────────────────────────────────────────────────────────────────────
-/**
- * Extract and validate `app.gadgets` from a decoded ggui.json value.
- *
- * Returns `[]` when the field is absent.
- * Throws with a descriptive message when any descriptor is malformed
- * (schema parse fails).
- */
-export function readGadgetsFromGguiJson(gguiJson) {
-    // Navigate to `app.gadgets` via a nested schema rather than casting +
-    // index access. `z.object` is non-strict by default, so ggui.json's other
-    // fields (schema / protocol / generation / app.publicEnv / …) ride through
-    // as allowed-and-stripped extras — only `app.gadgets` is validated here.
-    const schema = z.object({
-        app: z
-            .object({
-            gadgets: z.array(strictGadgetDescriptorSchema).optional(),
-        })
-            .optional(),
-    });
-    const result = schema.safeParse(gguiJson);
-    if (!result.success) {
-        throw new Error(`ggui.json: app.gadgets is invalid — ${result.error.issues[0]?.message ?? 'malformed descriptor'}`);
-    }
-    // result.data.app?.gadgets is GadgetDescriptor[] — strictGadgetDescriptorSchema
-    // parses to the same shape as GadgetDescriptor. Spread to a fresh mutable array.
-    return [...(result.data.app?.gadgets ?? [])];
-}
+// The gadget-catalog reader lives in `./internal/ggui-json.ts`
+// (`readGadgetsFromGguiJson`) — ONE reader shared with the install
+// write gate so deploy and install cannot drift on optionality or
+// error shape.
 /**
  * Extract and validate `app.publicEnv` from a decoded ggui.json value.
  *
@@ -235,17 +212,15 @@ export async function runConfigPushStep(appId, startDir = process.cwd()) {
         process.stderr.write(`ggui deploy: ${readResult.error}\n`);
         return 1;
     }
-    let gadgets;
     let publicEnv;
     let generation;
     let theme;
-    try {
-        gadgets = readGadgetsFromGguiJson(readResult.value);
-    }
-    catch (err) {
-        process.stderr.write(`ggui deploy: ${err instanceof Error ? err.message : String(err)}\n`);
+    const gadgetsRead = readGadgetsFromGguiJson(readResult.value);
+    if (!gadgetsRead.ok) {
+        process.stderr.write(`ggui deploy: ${gadgetsRead.error}\n`);
         return 1;
     }
+    const gadgets = gadgetsRead.gadgets;
     try {
         publicEnv = readPublicEnvFromGguiJson(readResult.value);
     }

package/dist/gadget-command.d.ts

@@ -1,3 +1,3 @@
-export declare const GADGET_HELP = "ggui gadget \u2014 author + manage marketplace gadgets\n\nUsage:\n  ggui gadget <subcommand> [options]\n\nSubcommands:\n  create       Scaffold a new gadget repo.\n  publish      Build, sign, and push the gadget in CWD to a marketplace registry.\n  install      Fetch, verify, and register a gadget in ggui.json.\n  search       Search the marketplace registry for gadgets.\n\nRun `ggui gadget <subcommand> --help` for subcommand-specific options.\n";
+export declare const GADGET_HELP = "ggui gadget \u2014 author + manage marketplace gadgets\n\nUsage:\n  ggui gadget <subcommand> [options]\n\nSubcommands:\n  create       Scaffold a new gadget repo.\n  publish      Build, sign, and push the gadget in CWD to a marketplace registry.\n  install      Fetch, verify, and register a gadget in ggui.json.\n  uninstall    Remove an installed gadget from ggui.json (reverse of install).\n  search       Search the marketplace registry for gadgets.\n\nRun `ggui gadget <subcommand> --help` for subcommand-specific options.\n";
 export declare function runGadgetCommand(args: readonly string[]): Promise<number>;
 //# sourceMappingURL=gadget-command.d.ts.map

package/dist/gadget-command.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"gadget-command.d.ts","sourceRoot":"","sources":["../src/gadget-command.ts"],"names":[],"mappings":"AAwCA,eAAO,MAAM,WAAW,scAYvB,CAAC;AAEF,wBAAsB,gBAAgB,CACpC,IAAI,EAAE,SAAS,MAAM,EAAE,GACtB,OAAO,CAAC,MAAM,CAAC,CAoBjB"}
+{"version":3,"file":"gadget-command.d.ts","sourceRoot":"","sources":["../src/gadget-command.ts"],"names":[],"mappings":"AA+CA,eAAO,MAAM,WAAW,shBAavB,CAAC;AAEF,wBAAsB,gBAAgB,CACpC,IAAI,EAAE,SAAS,MAAM,EAAE,GACtB,OAAO,CAAC,MAAM,CAAC,CAsBjB"}

package/dist/gadget-command.js

@@ -1,21 +1,23 @@
 /**
- * `ggui gadget <create|publish|install|search>` — top-level router for
- * the marketplace author + consumer surface.
+ * `ggui gadget <create|publish|install|uninstall|search>` — top-level
+ * router for the marketplace author + consumer surface.
  *
  * A thin sibling of `blueprint-command.ts`. Both commands dispatch into
  * the shared `internal/artifact-*` modules with their own `kind`
  * discriminator; per-kind state (scaffolders, help text) lives in
  * sibling files.
  *
- * - `create`  — scaffold a new gadget repo (hook + bundle stub).
- * - `publish` — build, sign, and push to a registry.
- *               Manifest-kind mismatch surfaces a redirect.
- * - `install` — fetch, verify, append to ggui.json.
- * - `search`  — query the registry, hard-locked to `kind=gadget`.
+ * - `create`    — scaffold a new gadget repo (hook + bundle stub).
+ * - `publish`   — build, sign, and push to a registry.
+ *                 Manifest-kind mismatch surfaces a redirect.
+ * - `install`   — fetch, verify, append to ggui.json.
+ * - `uninstall` — remove the ggui.json#app.gadgets row (reverse of install).
+ * - `search`    — query the registry, hard-locked to `kind=gadget`.
  */
 import { GADGET_CREATE_HELP, parseGadgetCreateFlags, runGadgetCreate, } from './gadget-create.js';
-import { buildPublishHelp, parseArtifactPublishFlags, runArtifactPublish, } from './internal/artifact-publish.js';
+import { buildPublishHelp, parseArtifactPublishFlags, publishOptionsFromFlags, runArtifactPublish, } from './internal/artifact-publish.js';
 import { buildInstallHelp, parseArtifactInstallFlags, runArtifactInstall, } from './internal/artifact-install.js';
+import { buildUninstallHelp, parseArtifactUninstallFlags, runArtifactUninstall, } from './internal/artifact-uninstall.js';
 import { buildSearchHelp, parseArtifactSearchFlags, runArtifactSearch, } from './internal/artifact-search.js';
 const KIND = 'gadget';
 export const GADGET_HELP = `ggui gadget — author + manage marketplace gadgets
@@ -27,6 +29,7 @@ Subcommands:
   create       Scaffold a new gadget repo.
   publish      Build, sign, and push the gadget in CWD to a marketplace registry.
   install      Fetch, verify, and register a gadget in ggui.json.
+  uninstall    Remove an installed gadget from ggui.json (reverse of install).
   search       Search the marketplace registry for gadgets.
 
 Run \`ggui gadget <subcommand> --help\` for subcommand-specific options.
@@ -44,6 +47,8 @@ export async function runGadgetCommand(args) {
             return runPublish(rest);
         case 'install':
             return runInstall(rest);
+        case 'uninstall':
+            return runUninstall(rest);
         case 'search':
             return runSearch(rest);
         default:
@@ -107,12 +112,11 @@ async function runPublish(args) {
         process.stderr.write(`ggui gadget publish: ${flags.error}\n`);
         return 2;
     }
+    // Forward the WHOLE parsed-flag bundle — no per-field spreads (a
+    // hand-written spread is how `--identity-token` got dropped once).
     const result = await runArtifactPublish({
         kind: KIND,
-        ...(flags.registry !== undefined ? { registry: flags.registry } : {}),
-        dryRun: flags.dryRun,
-        ...(flags.key !== undefined ? { key: flags.key } : {}),
-        ...(flags.auth !== undefined ? { auth: flags.auth } : {}),
+        ...publishOptionsFromFlags(flags),
     });
     return result.exitCode;
 }
@@ -137,6 +141,25 @@ async function runInstall(args) {
     });
 }
 /* -------------------------------------------------------------------------- */
+/* uninstall                                                                  */
+/* -------------------------------------------------------------------------- */
+async function runUninstall(args) {
+    const parsed = parseArtifactUninstallFlags(KIND, args);
+    if ('error' in parsed) {
+        if (parsed.error === '__help__') {
+            process.stdout.write(buildUninstallHelp(KIND));
+            return 0;
+        }
+        process.stderr.write(`ggui gadget uninstall: ${parsed.error}\n\n`);
+        process.stderr.write(buildUninstallHelp(KIND));
+        return 2;
+    }
+    const result = await runArtifactUninstall(parsed, {
+        cwd: process.cwd(),
+    });
+    return result.exitCode;
+}
+/* -------------------------------------------------------------------------- */
 /* search                                                                     */
 /* -------------------------------------------------------------------------- */
 async function runSearch(args) {

package/dist/internal/artifact-install.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"artifact-install.d.ts","sourceRoot":"","sources":["../../src/internal/artifact-install.ts"],"names":[],"mappings":"AA6EA,OAAO,EAAoB,KAAK,YAAY,EAAsB,MAAM,wBAAwB,CAAC;AAQjG;;;sCAGsC;AACtC,YAAY,EAAE,YAAY,EAAE,CAAC;AAqB7B;;;;GAIG;AACH,MAAM,WAAW,YAAY;IAC3B,wEAAwE;IACxE,QAAQ,CAAC,IAAI,EAAE,YAAY,CAAC;IAC5B,uDAAuD;IACvD,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,wDAAwD;IACxD,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,sDAAsD;IACtD,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAC3B,sFAAsF;IACtF,QAAQ,CAAC,QAAQ,EAAE,OAAO,CAAC;IAC3B,yEAAyE;IACzE,QAAQ,CAAC,MAAM,EAAE,OAAO,CAAC;IACzB;;;;;;;OAOG;IACH,QAAQ,CAAC,cAAc,CAAC,EAAE,MAAM,CAAC;CAClC;AAED;;;;;GAKG;AACH,MAAM,MAAM,kBAAkB,GAAG,YAAY,GAAG;IAAE,KAAK,EAAE,MAAM,CAAA;CAAE,CAAC;AAElE;;;;GAIG;AACH,wBAAgB,gBAAgB,CAAC,IAAI,EAAE,YAAY,GAAG,MAAM,CAgD3D;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,yBAAyB,CACvC,IAAI,EAAE,YAAY,EAClB,IAAI,EAAE,SAAS,MAAM,EAAE,GACtB,kBAAkB,CAsGpB;AA6DD;;;;GAIG;AACH,MAAM,WAAW,sBAAsB;IACrC,kCAAkC;IAClC,QAAQ,CAAC,GAAG,CAAC,EAAE,MAAM,CAAC;IACtB,oDAAoD;IACpD,QAAQ,CAAC,GAAG,CAAC,EAAE,QAAQ,CAAC,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC,CAAC,CAAC,CAAC;IACrE,iEAAiE;IACjE,QAAQ,CAAC,KAAK,CAAC,EAAE,OAAO,KAAK,CAAC;IAC9B,uDAAuD;IACvD,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,CAAC;IACzC,uDAAuD;IACvD,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,CAAC;IACzC;;;;;;;OAOG;IACH,QAAQ,CAAC,YAAY,CAAC,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAAC;CACjE;AAmMD;;;;;;;;;;GAUG;AACH,wBAAsB,kBAAkB,CACtC,KAAK,EAAE,YAAY,EACnB,IAAI,GAAE,sBAA2B,GAChC,OAAO,CAAC,MAAM,CAAC,CA8XjB;AAmID;;;;;;;GAOG;AACH,eAAO,MAAM,2BAA2B,+BAA+B,CAAC;AAExE;;;;GAIG;AACH,eAAO,MAAM,yBAAyB,8CACqB,CAAC;AAE5D;;;;;;;;;;;;;GAaG;AACH,wBAAgB,wBAAwB,CAAC,YAAY,EAAE,MAAM,GAAG,OAAO,CAOtE;AAED;;;;;GAKG;AACH,wBAAgB,sBAAsB,CAAC,IAAI,EAAE;IAC3C,KAAK,EAAE,MAAM,CAAC;IACd,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,MAAM,CAAC;CACjB,GAAG,MAAM,CAGT;AAED;;;;;GAKG;AACH,wBAAgB,qBAAqB,CAAC,IAAI,EAAE;IAC1C,KAAK,EAAE,MAAM,CAAC;IACd,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,MAAM,CAAC;CACjB,GAAG,MAAM,CAGT"}
+{"version":3,"file":"artifact-install.d.ts","sourceRoot":"","sources":["../../src/internal/artifact-install.ts"],"names":[],"mappings":"AAyFA,OAAO,EAAoB,KAAK,YAAY,EAAsB,MAAM,wBAAwB,CAAC;AAWjG;;;sCAGsC;AACtC,YAAY,EAAE,YAAY,EAAE,CAAC;AAM7B;;;;GAIG;AACH,MAAM,WAAW,YAAY;IAC3B,wEAAwE;IACxE,QAAQ,CAAC,IAAI,EAAE,YAAY,CAAC;IAC5B,uDAAuD;IACvD,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,wDAAwD;IACxD,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,sDAAsD;IACtD,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAC3B,sFAAsF;IACtF,QAAQ,CAAC,QAAQ,EAAE,OAAO,CAAC;IAC3B,yEAAyE;IACzE,QAAQ,CAAC,MAAM,EAAE,OAAO,CAAC;IACzB;;;;;;;OAOG;IACH,QAAQ,CAAC,cAAc,CAAC,EAAE,MAAM,CAAC;CAClC;AAED;;;;;GAKG;AACH,MAAM,MAAM,kBAAkB,GAAG,YAAY,GAAG;IAAE,KAAK,EAAE,MAAM,CAAA;CAAE,CAAC;AAElE;;;;GAIG;AACH,wBAAgB,gBAAgB,CAAC,IAAI,EAAE,YAAY,GAAG,MAAM,CAgD3D;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,yBAAyB,CACvC,IAAI,EAAE,YAAY,EAClB,IAAI,EAAE,SAAS,MAAM,EAAE,GACtB,kBAAkB,CAsGpB;AA6DD;;;;GAIG;AACH,MAAM,WAAW,sBAAsB;IACrC,kCAAkC;IAClC,QAAQ,CAAC,GAAG,CAAC,EAAE,MAAM,CAAC;IACtB,oDAAoD;IACpD,QAAQ,CAAC,GAAG,CAAC,EAAE,QAAQ,CAAC,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC,CAAC,CAAC,CAAC;IACrE,iEAAiE;IACjE,QAAQ,CAAC,KAAK,CAAC,EAAE,OAAO,KAAK,CAAC;IAC9B,uDAAuD;IACvD,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,CAAC;IACzC,uDAAuD;IACvD,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,CAAC;IACzC;;;;;;;OAOG;IACH,QAAQ,CAAC,YAAY,CAAC,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAAC;CACjE;AA8ID;;;;;;;;;;GAUG;AACH,wBAAsB,kBAAkB,CACtC,KAAK,EAAE,YAAY,EACnB,IAAI,GAAE,sBAA2B,GAChC,OAAO,CAAC,MAAM,CAAC,CAidjB;AA0JD;;;;;;;GAOG;AACH,eAAO,MAAM,2BAA2B,+BAA+B,CAAC;AAExE;;;;GAIG;AACH,eAAO,MAAM,yBAAyB,8CACqB,CAAC;AAE5D;;;;;;;;;;;;;GAaG;AACH,wBAAgB,wBAAwB,CAAC,YAAY,EAAE,MAAM,GAAG,OAAO,CAOtE;AAED;;;;;GAKG;AACH,wBAAgB,sBAAsB,CAAC,IAAI,EAAE;IAC3C,KAAK,EAAE,MAAM,CAAC;IACd,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,MAAM,CAAC;CACjB,GAAG,MAAM,CAGT;AAED;;;;;GAKG;AACH,wBAAgB,qBAAqB,CAAC,IAAI,EAAE;IAC1C,KAAK,EAAE,MAAM,CAAC;IACd,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,MAAM,CAAC;CACjB,GAAG,MAAM,CAGT"}