@ggui-ai/dev-stack 0.9.0 → 0.10.0

package/dist/hub-preview/client.js

@@ -19685,7 +19685,7 @@ var __export2 = (target, all) => {
 };
 
 // ../protocol/dist/version.js
-var PROTOCOL_VERSION = "draft-2026-06-12";
+var PROTOCOL_VERSION = "draft-2026-08-19";
 var PROTOCOL_SCHEMA_VERSION = PROTOCOL_VERSION;
 var CLIENT_SUPPORTED_VERSIONS = Object.freeze([
   PROTOCOL_SCHEMA_VERSION
@@ -34212,7 +34212,7 @@ config(en_default());
 
 // ../protocol/dist/gadgets/stdlib-gadgets.js
 var STDLIB_GADGETS_PACKAGE = "@ggui-ai/gadgets";
-var STDLIB_GADGETS_VERSION = "0.9.0";
+var STDLIB_GADGETS_VERSION = "0.10.0";
 var STDLIB_GADGETS = [
   {
     package: STDLIB_GADGETS_PACKAGE,
@@ -34363,15 +34363,24 @@ var jsonValueSchema = external_exports.lazy(() => external_exports.union([
   // surface as `undefined` at runtime which JSON.stringify drops.
   external_exports.record(external_exports.string(), jsonValueSchema)
 ]));
+var jsonSchemaTypeNameSchema = external_exports.enum([
+  "string",
+  "number",
+  "integer",
+  "boolean",
+  "array",
+  "object",
+  "null"
+]);
 var jsonSchemaSchema = external_exports.lazy(() => external_exports.object({
-  type: external_exports.enum([
-    "string",
-    "number",
-    "integer",
-    "boolean",
-    "array",
-    "object",
-    "null"
+  // Single type OR a draft-07 type array (`['string','null']` —
+  // the canonical nullability form the enforced-props-schema
+  // emission produces). Mirrors `JsonSchemaTypeName | JsonSchemaTypeName[]`
+  // on the TS type — the zod and TS sides are an SSoT pair; widen
+  // both or neither.
+  type: external_exports.union([
+    jsonSchemaTypeNameSchema,
+    external_exports.array(jsonSchemaTypeNameSchema)
   ]).optional(),
   description: external_exports.string().optional(),
   enum: external_exports.array(jsonValueSchema).optional(),
@@ -34539,12 +34548,12 @@ var clientCapabilitiesSpecSchema = external_exports.object({
 }).strict();
 var appPublicEnvSchema = external_exports.record(external_exports.string().regex(PUBLIC_ENV_APP_KEY_RE), external_exports.string()).readonly();
 var dataContractSchema = external_exports.object({
-  propsSpec: propsSpecSchema.optional(),
-  actionSpec: actionSpecSchema.optional(),
-  streamSpec: streamSpecSchema.optional(),
-  contextSpec: contextSpecSchema.optional(),
-  agentCapabilities: agentCapabilitiesSpecSchema.optional(),
-  clientCapabilities: clientCapabilitiesSpecSchema.optional()
+  propsSpec: propsSpecSchema.optional().describe("Initial render data: {description?, properties: {<name>: {schema: <JSON Schema>, required?: boolean, description?, default?, example?}}}. A prop is required at the wire gate ONLY when `required: true`; omitted \u21D2 optional (declare `required: true` for props the render must always pass)."),
+  actionSpec: actionSpecSchema.optional().describe("User gestures the agent reacts to on its next turn: {<action>: {label: string (REQUIRED \u2014 button copy / accessible name), schema?: <payload JSON Schema>, description?, example?, icon?, confirm?, nextStep?: '<agentCapabilities.tools key>'}}. Every action is agent-routed; `nextStep` is a hint, not a dispatch."),
+  streamSpec: streamSpecSchema.optional().describe("Live update channels the agent emits into: {<channel>: {schema: <JSON Schema>, description?, example?, mode?: append|replace, replay?: latest|all|none, complete?, source?: {tool, args?}}}. `source.tool` must be declared in agentCapabilities.tools."),
+  contextSpec: contextSpecSchema.optional().describe("Observable client state the agent reads alongside each action: {<slot>: {schema: <JSON Schema>, description?, default?, debounceMs?, example?}}. State that needs no next-turn reasoning belongs here, not in actionSpec."),
+  agentCapabilities: agentCapabilitiesSpecSchema.optional().describe("MCP tools the AGENT may call: {tools: {<bareToolName>: {toolInfo: {inputSchema (REQUIRED), description?, outputSchema?}, serverInfo?: {name, version?}, usage?, example?: {input, output}}}}. Key by the BARE tool name (after any `mcp__<server>__` prefix); the component never calls these."),
+  clientCapabilities: clientCapabilitiesSpecSchema.optional().describe("Browser-capability gadgets the COMPONENT imports: {gadgets: {<npm package>: {<exportName>: {description?, usage?}}}} \u2014 `use`-prefixed export keys are hooks, PascalCase keys are components; version and transport resolve from the app's registered catalog, never on the wire.")
 }).passthrough();
 
 // ../protocol/dist/schemas/blueprint.js
@@ -34560,11 +34569,17 @@ var blueprintSourceSchema = external_exports.union([
   userBlueprintSourceSchema,
   curatedBlueprintSourceSchema
 ]);
+var BLUEPRINT_VARIANCE_KEYS = ["persona", "aesthetic", "context", "seedPrompt"];
 var blueprintVarianceSchema = external_exports.object({
   persona: external_exports.string().optional().describe('Design persona, e.g. "minimalist" / "data-dense". Part of cache identity.'),
   aesthetic: external_exports.string().optional().describe('Visual aesthetic, e.g. "calm" / "ornate". Part of cache identity.'),
   context: external_exports.record(external_exports.string(), jsonValueSchema).optional().describe('Deliberate design-shaping signals (e.g. {situation:"sad"}) \u2014 part of cache identity. NOT for per-user runtime data; put that in propsSpec/contextSpec.'),
   seedPrompt: external_exports.string().optional().describe("Generation seed directive. Part of cache identity.")
+}, {
+  // A rejection that teaches (ggui#523 item 2): the first live guest
+  // turn sent `mood` and got a bare "Unrecognized key" — name the
+  // legal set and where the misplaced intent belongs.
+  error: (issue2) => issue2.code === "unrecognized_keys" ? `variance: unknown key(s) ${issue2.keys.map((k) => JSON.stringify(k)).join(", ")} \u2014 variance is EXACTLY {${BLUEPRINT_VARIANCE_KEYS.join(", ")}}; put tonal intent in \`aesthetic\`, and per-user runtime data in props / contextSpec, never in variance` : void 0
 }).strict();
 var blueprintSchema = external_exports.object({
   blueprintId: external_exports.string().min(1),
@@ -34625,15 +34640,17 @@ var jsonPatchOpSchema = external_exports.union([
   }).strict()
 ]);
 var jsonPatchSchema = external_exports.array(jsonPatchOpSchema);
+var BLUEPRINT_DRAFT_KEYS = ["contract", "variance", "generator"];
 var blueprintDraftObjectSchema = external_exports.object({
   contract: dataContractSchema,
-  variance: external_exports.object({
-    persona: external_exports.string().optional(),
-    aesthetic: external_exports.string().optional(),
-    context: external_exports.record(external_exports.string(), jsonValueSchema).optional(),
-    seedPrompt: external_exports.string().optional()
-  }).strict().optional(),
+  // ONE declaration of the variance shape, protocol-wide: the same
+  // schema (with its `.describe()` teaching and its legal-set
+  // rejection message) that `blueprintMeta.variance` projects on the
+  // way back out (ggui#523 item 1 — the mirror-of-a-mirror is gone).
+  variance: blueprintVarianceSchema.optional(),
   generator: external_exports.string().optional()
+}, {
+  error: (issue2) => issue2.code === "unrecognized_keys" ? `blueprintDraft: unknown key(s) ${issue2.keys.map((k) => JSON.stringify(k)).join(", ")} \u2014 a draft is EXACTLY {${BLUEPRINT_DRAFT_KEYS.join(", ")}}; \`intent\` is a top-level ggui_handshake field, not a draft field, and the four specs live INSIDE \`contract\`` : void 0
 }).strict();
 var blueprintDraftSchema = blueprintDraftObjectSchema;
 var blueprintMetaSchema = external_exports.object({
@@ -34695,6 +34712,10 @@ var getSessionInputShape = {
   sessionId: external_exports.string().min(1).describe("GguiSession opaque id (UUID) \u2014 returned by ggui_render.")
 };
 var getSessionInputSchema = external_exports.object(getSessionInputShape);
+var getRenderSourceInputShape = {
+  sessionId: external_exports.string().min(1).describe("GguiSession opaque id (UUID) \u2014 returned by ggui_render.")
+};
+var getRenderSourceInputSchema = external_exports.object(getRenderSourceInputShape);
 var listFeaturedBlueprintsInputShape = {};
 var listFeaturedBlueprintsInputSchema = external_exports.object(listFeaturedBlueprintsInputShape);
 var searchBlueprintsInputShape = {
@@ -34729,7 +34750,7 @@ var handshakeInputSchema = external_exports.object({
    * and the contract validators; variance feeds the variance axis
    * and rides through to the suggestion's `blueprintMeta`.
    */
-  blueprintDraft: blueprintDraftSchema.describe("Agent's draft: contract (required) + optional variance + optional generator slug hint. The server combines this with cached blueprints + validator outcomes to produce a three-mode suggestion (cache / agent / synth)."),
+  blueprintDraft: blueprintDraftSchema.describe(`Agent's draft \u2014 a JSON OBJECT, never a JSON-encoded string (pass {contract: {...}}, not "{\\"contract\\":...}"; a string fails input validation with -32602). Fields: contract (required) + optional variance + optional generator slug hint. The server combines this with cached blueprints + validator outcomes to produce a three-mode suggestion (cache / agent / synth).`),
   /**
    * Skip blueprint-search on step-2 and route straight to validation
    * + (if validation passes) agent-mode suggestion against the draft.
@@ -35135,87 +35156,13 @@ var appThemeSchema = external_exports.object({
 // ../protocol/dist/registry/canonicalize-contract.js
 var import_canonicalize = __toESM(require_canonicalize(), 1);
 
+// ../protocol/dist/validation/enforced-props-schema.js
+var import_canonicalize2 = __toESM(require_canonicalize(), 1);
+
 // ../protocol/dist/types/data-contract.js
 var CONTEXT_SLOT_VALUE_MAX_BYTES = 16 * 1024;
 var CONTEXT_SNAPSHOT_MAX_BYTES = 64 * 1024;
 
-// ../protocol/dist/schemas/ops-blueprint.js
-var opsGenerateBlueprintInputSchema = external_exports.object({
-  contract: dataContractSchema,
-  generator: external_exports.string().min(1).optional().describe("Generator slug (e.g. `ui-gen-default-haiku-4-5`). When omitted, dispatches through `GeneratorRegistry.defaultGenerator()`."),
-  persona: external_exports.string().optional().describe("Free-form persona tag (e.g. 'minimalist', 'data-dense'). Normalized via lowercase+trim before persistence; logged as a warning when within Levenshtein distance < 2 of an existing tag for the same appId."),
-  aesthetic: external_exports.string().optional().describe("Free-form aesthetic tag (e.g. 'glassmorphic', 'brutalist', 'editorial'). Persisted on `Blueprint.variance.aesthetic`. Distinct from persona \u2014 persona names the user mental model; aesthetic names the visual treatment."),
-  context: external_exports.record(external_exports.string(), jsonValueSchema).optional().describe("Small structured signal carried alongside the persona. Persisted on `Blueprint.variance.context`."),
-  seedPrompt: external_exports.string().optional().describe("The raw operator prompt that produced this variant. Round-trip input for the variant-selector + audit trail."),
-  setAsOperatorDefault: external_exports.boolean().optional().describe("When true, pins the new blueprint as the operator default for its `(appId, contractHash)` group, clearing any prior default in the same group.")
-}).strict();
-var opsGenerateBlueprintOutputSchema = external_exports.object({
-  blueprintId: external_exports.string().min(1),
-  codeHash: external_exports.string().optional().describe("Content hash of the generated code body. Absent when the generator returned a non-`ok` result and persistence skipped \u2014 the failure mode is surfaced through generator-level error reporting elsewhere."),
-  validatorScore: external_exports.number().min(0).max(1).optional().describe("Advanced generator's iterative-loop validator score (0-1). Absent for default-generator output."),
-  source: llmBlueprintSourceSchema.describe("Provenance stamped on the persisted `Blueprint.source` \u2014 always the `llm` arm on this path: `generator` is the engine slug the dispatch resolved to (stamped from the engine's own metadata claim); `model` is the LLM model id the engine called.")
-}).strict();
-var opsRegisterBlueprintInputSchema = external_exports.object({
-  contract: dataContractSchema,
-  componentCode: external_exports.string().min(1).describe("Verbatim component-code body to persist. Stored as-is \u2014 no LLM call, no validator pass. Operator owns correctness; the handler computes the canonical sha256 codeHash and routes the bytes through the same persistence seams as `*_generate_*`."),
-  persona: external_exports.string().optional().describe("Free-form persona tag (e.g. 'minimalist', 'data-dense'). Normalized via lowercase+trim before persistence; logged as a warning when within Levenshtein distance < 2 of an existing tag for the same appId."),
-  aesthetic: external_exports.string().optional().describe("Free-form aesthetic tag. Persisted on `Blueprint.variance.aesthetic`."),
-  context: external_exports.record(external_exports.string(), jsonValueSchema).optional().describe("Small structured signal carried alongside the persona. Persisted on `Blueprint.variance.context`."),
-  seedPrompt: external_exports.string().optional().describe("Optional originating prompt for audit + round-tripping (e.g. the prose the operator originally fed into `*_generate_*` before exporting)."),
-  setAsOperatorDefault: external_exports.boolean().optional().describe("When true, pins the new blueprint as the operator default for its `(appId, contractHash)` group, clearing any prior default in the same group.")
-}).strict();
-var opsRegisterBlueprintOutputSchema = external_exports.object({
-  blueprintId: external_exports.string().min(1),
-  codeHash: external_exports.string().min(1).describe("Content hash of the persisted code body (full sha256 hex)."),
-  source: userBlueprintSourceSchema.describe('Provenance stamped on the persisted `Blueprint.source` \u2014 always `{kind: "user"}` on this path: operator-supplied bytes, no LLM dispatch, no engine claim to record.')
-}).strict();
-var opsListBlueprintsInputSchema = external_exports.object({
-  contractHash: external_exports.string().min(1).optional().describe("Filter to a single `(appId, contractHash)` group. Combine with `generator` / `persona` to narrow within the group."),
-  generator: external_exports.string().min(1).optional().describe('Filter to engine-generated blueprints (`source.kind === "llm"`) whose `source.generator` equals this slug. `user`-sourced rows never match (they carry no engine provenance).'),
-  persona: external_exports.string().optional().describe("Filter on `variance.persona`. Normalized to match persisted form (lowercase+trim)."),
-  intentKeywords: external_exports.array(external_exports.string().min(1)).optional().describe("Semantic-search tokens. When set, dispatches through `BlueprintSearch.search()` rather than indexed `list()`.")
-}).strict();
-var opsListBlueprintsOutputSchema = external_exports.object({
-  blueprints: external_exports.array(blueprintSchema)
-}).strict();
-var opsUpdateBlueprintInputSchema = external_exports.object({
-  blueprintId: external_exports.string().min(1),
-  isOperatorDefault: external_exports.literal(true).optional().describe("When `true`, pins this blueprint as the operator default for its `(appId, contractHash)` group. Clears any prior default. Cannot set to `false` \u2014 to unpin, set another blueprint in the same group as default, or delete this one."),
-  variance: blueprintVarianceSchema.optional().describe('Partial-merge into the existing variance. Supplied keys overwrite; omitted keys preserve. Pass `{persona: ""}` to clear a persona (handler treats empty string as removal).')
-}).strict();
-var opsUpdateBlueprintOutputSchema = external_exports.object({
-  blueprintId: external_exports.string().min(1),
-  updatedAt: external_exports.string().min(1)
-}).strict();
-var opsDeleteBlueprintInputSchema = external_exports.object({
-  blueprintId: external_exports.string().min(1)
-}).strict();
-var opsDeleteBlueprintOutputSchema = external_exports.object({
-  deleted: external_exports.literal(true)
-}).strict();
-
-// ../protocol/dist/envelopes/builders.js
-function resolveSchemaVersion(parts) {
-  if ("schemaVersion" in parts) {
-    return parts.schemaVersion;
-  }
-  return PROTOCOL_SCHEMA_VERSION;
-}
-function makeActionEnvelope(parts) {
-  const envelope = {
-    sessionId: parts.sessionId,
-    type: parts.type
-  };
-  if (parts.payload !== void 0)
-    envelope.payload = parts.payload;
-  if (parts.clientSeq !== void 0)
-    envelope.clientSeq = parts.clientSeq;
-  const stamp = resolveSchemaVersion(parts);
-  if (stamp !== void 0)
-    envelope.schemaVersion = stamp;
-  return envelope;
-}
-
 // ../protocol/dist/validation/ajv-runtime.js
 var import_ajv = __toESM(require_ajv(), 1);
 var import_ajv_formats = __toESM(require_dist(), 1);
@@ -35258,8 +35205,20 @@ if (!standaloneAjv.getKeyword("example")) {
 if (!standaloneAjv.getKeyword("nullable")) {
   standaloneAjv.addKeyword({ keyword: "nullable" });
 }
+var standaloneCjsAjv = new import_ajv.default({
+  ...AJV_OPTIONS,
+  code: { source: true }
+});
+(0, import_ajv_formats.default)(standaloneCjsAjv);
+if (!standaloneCjsAjv.getKeyword("example")) {
+  standaloneCjsAjv.addKeyword({ keyword: "example" });
+}
+if (!standaloneCjsAjv.getKeyword("nullable")) {
+  standaloneCjsAjv.addKeyword({ keyword: "nullable" });
+}
 function injectClosedShape(schema) {
-  const isObjectNode = schema.type === "object" || schema.properties !== void 0;
+  const typeSet = new Set(Array.isArray(schema.type) ? schema.type : schema.type ? [schema.type] : []);
+  const isObjectNode = typeSet.has("object") || schema.properties !== void 0;
   if (isObjectNode) {
     const out = { ...schema };
     if (out.properties) {
@@ -35280,7 +35239,7 @@ function injectClosedShape(schema) {
       out.anyOf = out.anyOf.map(injectClosedShape);
     return out;
   }
-  if (schema.type === "array" && schema.items) {
+  if (typeSet.has("array") && schema.items) {
     return { ...schema, items: injectClosedShape(schema.items) };
   }
   if (schema.oneOf || schema.anyOf) {
@@ -35300,7 +35259,10 @@ function compileForValidation(schema) {
 function mapAjvErrorsToViolations(errors, data) {
   if (!errors)
     return [];
-  return errors.map((err) => mapOne(err, data));
+  return errors.map((err) => ({
+    ...mapOne(err, data),
+    ...err.keyword ? { keyword: err.keyword } : {}
+  }));
 }
 function prefixViolations(violations, prefix) {
   if (!prefix)
@@ -35647,6 +35609,88 @@ function validateActionEnvelope(envelope, spec, precompiledActions) {
   return validateActionData(envelope.payload, spec, precompiledActions);
 }
 
+// ../protocol/dist/schemas/ops-blueprint.js
+var opsGenerateBlueprintInputSchema = external_exports.object({
+  appId: external_exports.string().min(1).optional().describe("Target app for this curation call. Defaults to the caller's bound app identity; callers not bound to an app must provide it. The deployment's authorization policy decides whether the caller may curate the named app."),
+  contract: dataContractSchema,
+  generator: external_exports.string().min(1).optional().describe("Generator slug (e.g. `ui-gen-default-haiku-4-5`). When omitted, dispatches through `GeneratorRegistry.defaultGenerator()`."),
+  persona: external_exports.string().optional().describe("Free-form persona tag (e.g. 'minimalist', 'data-dense'). Normalized via lowercase+trim before persistence; logged as a warning when within Levenshtein distance < 2 of an existing tag for the same appId."),
+  aesthetic: external_exports.string().optional().describe("Free-form aesthetic tag (e.g. 'glassmorphic', 'brutalist', 'editorial'). Persisted on `Blueprint.variance.aesthetic`. Distinct from persona \u2014 persona names the user mental model; aesthetic names the visual treatment."),
+  context: external_exports.record(external_exports.string(), jsonValueSchema).optional().describe("Small structured signal carried alongside the persona. Persisted on `Blueprint.variance.context`."),
+  seedPrompt: external_exports.string().optional().describe("The raw operator prompt that produced this variant. Round-trip input for the variant-selector + audit trail."),
+  setAsOperatorDefault: external_exports.boolean().optional().describe("When true, pins the new blueprint as the operator default for its `(appId, contractHash)` group, clearing any prior default in the same group.")
+}).strict();
+var opsGenerateBlueprintOutputSchema = external_exports.object({
+  blueprintId: external_exports.string().min(1),
+  codeHash: external_exports.string().optional().describe("Content hash of the generated code body. Absent when the generator returned a non-`ok` result and persistence skipped \u2014 the failure mode is surfaced through generator-level error reporting elsewhere."),
+  validatorScore: external_exports.number().min(0).max(1).optional().describe("Advanced generator's iterative-loop validator score (0-1). Absent for default-generator output."),
+  source: llmBlueprintSourceSchema.describe("Provenance stamped on the persisted `Blueprint.source` \u2014 always the `llm` arm on this path: `generator` is the engine slug the dispatch resolved to (stamped from the engine's own metadata claim); `model` is the LLM model id the engine called.")
+}).strict();
+var opsRegisterBlueprintInputSchema = external_exports.object({
+  appId: external_exports.string().min(1).optional().describe("Target app for this curation call. Defaults to the caller's bound app identity; callers not bound to an app must provide it. The deployment's authorization policy decides whether the caller may curate the named app."),
+  contract: dataContractSchema,
+  componentCode: external_exports.string().min(1).describe("Verbatim component-code body to persist. Stored as-is \u2014 no LLM call, no validator pass. Operator owns correctness; the handler computes the canonical sha256 codeHash and routes the bytes through the same persistence seams as `*_generate_*`."),
+  persona: external_exports.string().optional().describe("Free-form persona tag (e.g. 'minimalist', 'data-dense'). Normalized via lowercase+trim before persistence; logged as a warning when within Levenshtein distance < 2 of an existing tag for the same appId."),
+  aesthetic: external_exports.string().optional().describe("Free-form aesthetic tag. Persisted on `Blueprint.variance.aesthetic`."),
+  context: external_exports.record(external_exports.string(), jsonValueSchema).optional().describe("Small structured signal carried alongside the persona. Persisted on `Blueprint.variance.context`."),
+  seedPrompt: external_exports.string().optional().describe("Optional originating prompt for audit + round-tripping (e.g. the prose the operator originally fed into `*_generate_*` before exporting)."),
+  setAsOperatorDefault: external_exports.boolean().optional().describe("When true, pins the new blueprint as the operator default for its `(appId, contractHash)` group, clearing any prior default in the same group.")
+}).strict();
+var opsRegisterBlueprintOutputSchema = external_exports.object({
+  blueprintId: external_exports.string().min(1),
+  codeHash: external_exports.string().min(1).describe("Content hash of the persisted code body (full sha256 hex)."),
+  source: userBlueprintSourceSchema.describe('Provenance stamped on the persisted `Blueprint.source` \u2014 always `{kind: "user"}` on this path: operator-supplied bytes, no LLM dispatch, no engine claim to record.')
+}).strict();
+var opsListBlueprintsInputSchema = external_exports.object({
+  appId: external_exports.string().min(1).optional().describe("Target app for this curation call. Defaults to the caller's bound app identity; callers not bound to an app must provide it. The deployment's authorization policy decides whether the caller may curate the named app."),
+  contractHash: external_exports.string().min(1).optional().describe("Filter to a single `(appId, contractHash)` group. Combine with `generator` / `persona` to narrow within the group."),
+  generator: external_exports.string().min(1).optional().describe('Filter to engine-generated blueprints (`source.kind === "llm"`) whose `source.generator` equals this slug. `user`-sourced rows never match (they carry no engine provenance).'),
+  persona: external_exports.string().optional().describe("Filter on `variance.persona`. Normalized to match persisted form (lowercase+trim)."),
+  intentKeywords: external_exports.array(external_exports.string().min(1)).optional().describe("Semantic-search tokens. When set, dispatches through `BlueprintSearch.search()` rather than indexed `list()`.")
+}).strict();
+var opsListBlueprintsOutputSchema = external_exports.object({
+  blueprints: external_exports.array(blueprintSchema)
+}).strict();
+var opsUpdateBlueprintInputSchema = external_exports.object({
+  appId: external_exports.string().min(1).optional().describe("Target app for this curation call. Defaults to the caller's bound app identity; callers not bound to an app must provide it. The deployment's authorization policy decides whether the caller may curate the named app. Must match the app the addressed blueprint belongs to."),
+  blueprintId: external_exports.string().min(1),
+  isOperatorDefault: external_exports.literal(true).optional().describe("When `true`, pins this blueprint as the operator default for its `(appId, contractHash)` group. Clears any prior default. Cannot set to `false` \u2014 to unpin, set another blueprint in the same group as default, or delete this one."),
+  variance: blueprintVarianceSchema.optional().describe('Partial-merge into the existing variance. Supplied keys overwrite; omitted keys preserve. Pass `{persona: ""}` to clear a persona (handler treats empty string as removal).')
+}).strict();
+var opsUpdateBlueprintOutputSchema = external_exports.object({
+  blueprintId: external_exports.string().min(1),
+  updatedAt: external_exports.string().min(1)
+}).strict();
+var opsDeleteBlueprintInputSchema = external_exports.object({
+  appId: external_exports.string().min(1).optional().describe("Target app for this curation call. Defaults to the caller's bound app identity; callers not bound to an app must provide it. The deployment's authorization policy decides whether the caller may curate the named app. Must match the app the addressed blueprint belongs to."),
+  blueprintId: external_exports.string().min(1)
+}).strict();
+var opsDeleteBlueprintOutputSchema = external_exports.object({
+  deleted: external_exports.literal(true)
+}).strict();
+
+// ../protocol/dist/envelopes/builders.js
+function resolveSchemaVersion(parts) {
+  if ("schemaVersion" in parts) {
+    return parts.schemaVersion;
+  }
+  return PROTOCOL_SCHEMA_VERSION;
+}
+function makeActionEnvelope(parts) {
+  const envelope = {
+    sessionId: parts.sessionId,
+    type: parts.type
+  };
+  if (parts.payload !== void 0)
+    envelope.payload = parts.payload;
+  if (parts.clientSeq !== void 0)
+    envelope.clientSeq = parts.clientSeq;
+  const stamp = resolveSchemaVersion(parts);
+  if (stamp !== void 0)
+    envelope.schemaVersion = stamp;
+  return envelope;
+}
+
 // ../mcp-apps-react/dist/index.mjs
 var import_react5 = __toESM(require_react(), 1);
 var import_react6 = __toESM(require_react(), 1);
@@ -36185,7 +36229,7 @@ function resolveToneCss(tone) {
     case "warning":
     case "error":
     case "info":
-      return `var(--ggui-color-${tone}, ${SEMANTIC_TONE_FALLBACK[tone]})`;
+      return `var(--ggui-color-${tone}-500, ${SEMANTIC_TONE_FALLBACK[tone]})`;
     case "inverse":
       return "var(--ggui-color-surface, #ffffff)";
     case "inherit":
@@ -46927,19 +46971,26 @@ function replaceSpecifier(code, specifier, replacement) {
 function globalExpr(gguiKey, legacyName) {
   return `(globalThis.__ggui__&&globalThis.__ggui__["${gguiKey}"]||window["${legacyName}"])`;
 }
-function buildDataUrlReactShim(globalName) {
+function toDataUrl(js) {
+  return `data:text/javascript,${encodeURIComponent(js)}`;
+}
+function jsReactShim(globalName) {
   const namedExports = REACT_EXPORTS.map((e) => `export const ${e} = R.${e};`).join(" ");
   const resolve = globalExpr("react", globalName);
-  const js = `const R = ${resolve}; export default R; ${namedExports}`;
-  return `data:text/javascript,${encodeURIComponent(js)}`;
+  return `const R = ${resolve}; export default R; ${namedExports}`;
 }
-function buildDataUrlReactDomShim() {
+function buildDataUrlReactShim(globalName) {
+  return toDataUrl(jsReactShim(globalName));
+}
+function jsReactDomShim() {
   const REACT_DOM_EXPORTS = ["createPortal", "flushSync", "unstable_batchedUpdates"];
   const namedExports = REACT_DOM_EXPORTS.map((e) => `export const ${e} = D.${e};`).join(" ");
-  const js = `const D = globalThis.__ggui__["reactDom"]; export default D; ${namedExports}`;
-  return `data:text/javascript,${encodeURIComponent(js)}`;
+  return `const D = globalThis.__ggui__["reactDom"]; export default D; ${namedExports}`;
 }
-function buildDataUrlJsxShim(globalName) {
+function buildDataUrlReactDomShim() {
+  return toDataUrl(jsReactDomShim());
+}
+function jsJsxShim(globalName) {
   const resolve = globalExpr("react", globalName);
   const js = [
     `const R = ${resolve};`,
@@ -46952,9 +47003,12 @@ function buildDataUrlJsxShim(globalName) {
     `export{jsx,jsx as jsxs,jsx as jsxDEV};`,
     `export const Fragment=R.Fragment;`
   ].join("");
-  return `data:text/javascript,${encodeURIComponent(js)}`;
+  return js;
 }
-function buildDataUrlGlobalShim(globalName, gguiKey, exportNames, fallbackGlobals, fallbackGguiKeys) {
+function buildDataUrlJsxShim(globalName) {
+  return toDataUrl(jsJsxShim(globalName));
+}
+function jsGlobalShim(globalName, gguiKey, exportNames, fallbackGlobals, fallbackGguiKeys) {
   if (exportNames && exportNames.length > 0) {
     const globals = [globalName, ...fallbackGlobals || []];
     const gguiKeys = [gguiKey, ...fallbackGguiKeys || []];
@@ -46965,17 +47019,20 @@ function buildDataUrlGlobalShim(globalName, gguiKey, exportNames, fallbackGlobal
     ));
     const mergeExpr = resolveExprs.join(",");
     const named = exportNames.map((n) => `export const ${n} = M["${n}"];`).join(" ");
-    const js2 = resolveExprs.length > 1 ? `const M = Object.assign({}, ${mergeExpr}); ${named} export default M;` : `const M = ${resolveExprs[0]}; ${named} export default M;`;
-    return `data:text/javascript,${encodeURIComponent(js2)}`;
+    return resolveExprs.length > 1 ? `const M = Object.assign({}, ${mergeExpr}); ${named} export default M;` : `const M = ${resolveExprs[0]}; ${named} export default M;`;
   }
   const resolve = globalExpr(gguiKey, globalName);
-  const js = `const M = ${resolve} || {}; const handler = { get(_, key) { return M[key]; } }; export default new Proxy({}, handler);`;
-  return `data:text/javascript,${encodeURIComponent(js)}`;
+  return `const M = ${resolve} || {}; const handler = { get(_, key) { return M[key]; } }; export default new Proxy({}, handler);`;
 }
-function buildDataUrlWireShim() {
+function buildDataUrlGlobalShim(globalName, gguiKey, exportNames, fallbackGlobals, fallbackGguiKeys) {
+  return toDataUrl(jsGlobalShim(globalName, gguiKey, exportNames, fallbackGlobals, fallbackGguiKeys));
+}
+function jsWireShim() {
   const named = WIRE_EXPORTS.map((e) => `export const ${e} = w.${e};`).join(" ");
-  const js = `const w = globalThis.__ggui__.wire; ${named} export default w;`;
-  return `data:text/javascript,${encodeURIComponent(js)}`;
+  return `const w = globalThis.__ggui__.wire; ${named} export default w;`;
+}
+function buildDataUrlWireShim() {
+  return toDataUrl(jsWireShim());
 }
 function extractNamedImports(code, specifier) {
   const esc2 = specifier.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
@@ -46992,7 +47049,7 @@ function extractNamedImports(code, specifier) {
   }
   return [...names];
 }
-function buildGadgetPackageShim(packageName, exportNames) {
+function jsGadgetPackageShim(packageName, exportNames) {
   const pkgLit = JSON.stringify(packageName);
   const hasComponent = exportNames.some((n) => /^[A-Z]/.test(n));
   const parts = [];
@@ -47009,7 +47066,10 @@ function buildGadgetPackageShim(packageName, exportNames) {
     parts.push(`export const ${name}=${factory}(${JSON.stringify(name)});`);
   }
   parts.push(`export default new Proxy({},{get:function(_,k){return NS()[k];}});`);
-  return `data:text/javascript,${encodeURIComponent(parts.join(""))}`;
+  return parts.join("");
+}
+function buildGadgetPackageShim(packageName, exportNames) {
+  return toDataUrl(jsGadgetPackageShim(packageName, exportNames));
 }
 function rewriteDataUrl(code, opts) {
   const reactGlobal = opts.reactGlobal ?? "__REACT";
@@ -47044,6 +47104,29 @@ function rewriteDataUrl(code, opts) {
   }
   return code;
 }
+var ASSET_SHIM_FOR_SPECIFIER = {
+  "react/jsx-runtime": "jsx-runtime",
+  "react/jsx-dev-runtime": "jsx-runtime",
+  "react-dom": "react-dom",
+  react: "react",
+  "@ggui-ai/design/primitives": "primitives",
+  "@ggui-ai/design/components": "components",
+  "@ggui-ai/design/compositions": "compositions",
+  "@ggui-ai/design/interact": "interact",
+  "@ggui-ai/design/templates": "templates",
+  "@ggui-ai/design/app-components": "app-components",
+  "@ggui-ai/design/tokens": "tokens",
+  "@ggui-ai/design": "design",
+  "@ggui-ai/wire": "wire",
+  "@ggui-ai/gadgets": "gadgets"
+};
+function rewriteAssetUrl(code, opts) {
+  const base = opts.shimBaseUrl.replace(/\/$/, "");
+  for (const [specifier, shimName] of Object.entries(ASSET_SHIM_FOR_SPECIFIER)) {
+    code = replaceSpecifier(code, specifier, `${base}/${shimName}.js`);
+  }
+  return code;
+}
 function rewriteImportmap(code, opts) {
   const base = opts.reactBaseUrl ?? "https://esm.sh/react@18.2.0";
   code = replaceSpecifier(code, "react/jsx-runtime", `${base}/jsx-runtime`);
@@ -47057,6 +47140,8 @@ function rewriteImports(code, options) {
       return rewriteDataUrl(code, options);
     case "importmap":
       return rewriteImportmap(code, options);
+    case "asset-url":
+      return rewriteAssetUrl(code, options);
   }
 }
 function hoistImports(code) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ggui-ai/dev-stack",
-  "version": "0.9.0",
+  "version": "0.10.0",
   "description": "Shared local dev engine for the ggui protocol: local UI registry discovery, compile-on-demand, filesystem watcher with SSE, and a read-only HTTP surface for dev tooling. Framework-neutral — agent runtime supervision plugs in via an adapter seam, so no agent SDK is hardcoded.",
   "keywords": [
     "ggui",
@@ -28,9 +28,9 @@
   "dependencies": {
     "chokidar": "^4.0.3",
     "esbuild": "^0.25.12",
-    "@ggui-ai/project-config": "0.9.0",
-    "@ggui-ai/agent-runtime": "0.9.0",
-    "@ggui-ai/ui-registry": "0.9.0"
+    "@ggui-ai/project-config": "0.10.0",
+    "@ggui-ai/agent-runtime": "0.10.0",
+    "@ggui-ai/ui-registry": "0.10.0"
   },
   "devDependencies": {
     "@types/node": "^24.0.0",
@@ -40,9 +40,9 @@
     "react-dom": "^19.0.0",
     "typescript": "^5.0.0",
     "vitest": "^3.2.6",
-    "@ggui-ai/design": "0.9.0",
-    "@ggui-ai/mcp-apps-react": "0.9.0",
-    "@ggui-ai/wire": "0.9.0"
+    "@ggui-ai/mcp-apps-react": "0.10.0",
+    "@ggui-ai/design": "0.10.0",
+    "@ggui-ai/wire": "0.10.0"
   },
   "repository": {
     "type": "git",