@ggui-ai/mcp-server-handlers 0.11.0 → 0.12.0

package/dist/ops-apps/set-app-theme.d.ts

@@ -27,6 +27,11 @@ declare const inputSchema: {
         }>;
         cssVariables: z.ZodRecord<z.ZodString, z.ZodString>;
         name: z.ZodOptional<z.ZodString>;
+        base: z.ZodOptional<z.ZodObject<{
+            documentHash: z.ZodString;
+            light: z.ZodRecord<z.ZodString, z.ZodString>;
+            dark: z.ZodRecord<z.ZodString, z.ZodString>;
+        }, z.core.$strict>>;
     }, z.core.$strict>;
 };
 declare const outputSchema: {
@@ -38,17 +43,47 @@ declare const outputSchema: {
         }>;
         cssVariables: z.ZodRecord<z.ZodString, z.ZodString>;
         name: z.ZodOptional<z.ZodString>;
+        base: z.ZodOptional<z.ZodObject<{
+            documentHash: z.ZodString;
+            light: z.ZodRecord<z.ZodString, z.ZodString>;
+            dark: z.ZodRecord<z.ZodString, z.ZodString>;
+        }, z.core.$strict>>;
     }, z.core.$strict>;
     readonly updatedAt: z.ZodString;
+    /**
+     * Migration nudge (ggui#598 slice 3): present when the overlay is
+     * BRAND-SHAPED — ≥3 color families over a name that resolves to no
+     * registered theme. The write still succeeds (overlays stay legal);
+     * the tier just stops being silent about brands living in it.
+     */
+    readonly warning: z.ZodOptional<z.ZodString>;
 };
 export interface SetAppThemeOutput {
     readonly appId: string;
     readonly theme: z.infer<typeof appThemeSchema>;
     readonly updatedAt: string;
+    readonly warning?: string;
 }
 export interface SetAppThemeDeps {
     readonly apps: AppsSource;
+    /**
+     * Known theme ids (built-in presets + registered) for the
+     * brand-shaped-overlay WARN's name resolution. Absent = names cannot
+     * be resolved, so brand-scale coverage always draws the nudge.
+     */
+    readonly knownThemeIds?: readonly string[];
 }
+/**
+ * Detect a BRAND-SHAPED overlay (ggui#598 slice 3): ≥3 distinct color
+ * families in the variable map while the overlay's `name` resolves to
+ * no known theme. A brand living in the accent tier is the round-3
+ * mechanism — the overlay inherits every unmapped token from someone
+ * else's ladder. The WARN names the registration path; it never
+ * blocks. Exported for its unit pins.
+ *
+ * @internal
+ */
+export declare function detectBrandShapedOverlay(theme: z.infer<typeof appThemeSchema>, deps: Pick<SetAppThemeDeps, 'knownThemeIds'>): string | undefined;
 export declare function createSetAppThemeHandler(deps: SetAppThemeDeps): SharedHandler<typeof inputSchema, typeof outputSchema, SetAppThemeOutput>;
 export {};
 //# sourceMappingURL=set-app-theme.d.ts.map

package/dist/ops-apps/set-app-theme.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"set-app-theme.d.ts","sourceRoot":"","sources":["../../src/ops-apps/set-app-theme.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AACH,OAAO,EAAE,cAAc,EAAE,MAAM,mBAAmB,CAAC;AACnD,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,KAAK,EAAkB,aAAa,EAAE,MAAM,aAAa,CAAC;AAGjE,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,YAAY,CAAC;AAE7C,QAAA,MAAM,WAAW;;;;;;;;;;CAUP,CAAC;AAEX,QAAA,MAAM,YAAY;;;;;;;;;;;CAIR,CAAC;AAEX,MAAM,WAAW,iBAAiB;IAChC,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,KAAK,EAAE,CAAC,CAAC,KAAK,CAAC,OAAO,cAAc,CAAC,CAAC;IAC/C,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;CAC5B;AAED,MAAM,WAAW,eAAe;IAC9B,QAAQ,CAAC,IAAI,EAAE,UAAU,CAAC;CAC3B;AAED,wBAAgB,wBAAwB,CACtC,IAAI,EAAE,eAAe,GACpB,aAAa,CAAC,OAAO,WAAW,EAAE,OAAO,YAAY,EAAE,iBAAiB,CAAC,CAkC3E"}
+{"version":3,"file":"set-app-theme.d.ts","sourceRoot":"","sources":["../../src/ops-apps/set-app-theme.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AACH,OAAO,EAAE,cAAc,EAAE,MAAM,mBAAmB,CAAC;AACnD,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,KAAK,EAAkB,aAAa,EAAE,MAAM,aAAa,CAAC;AAGjE,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,YAAY,CAAC;AAE7C,QAAA,MAAM,WAAW;;;;;;;;;;;;;;;CAUP,CAAC;AAEX,QAAA,MAAM,YAAY;;;;;;;;;;;;;;;;IAIhB;;;;;OAKG;;CAEK,CAAC;AAEX,MAAM,WAAW,iBAAiB;IAChC,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,KAAK,EAAE,CAAC,CAAC,KAAK,CAAC,OAAO,cAAc,CAAC,CAAC;IAC/C,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC;CAC3B;AAED,MAAM,WAAW,eAAe;IAC9B,QAAQ,CAAC,IAAI,EAAE,UAAU,CAAC;IAC1B;;;;OAIG;IACH,QAAQ,CAAC,aAAa,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;CAC5C;AAED;;;;;;;;;GASG;AACH,wBAAgB,wBAAwB,CACtC,KAAK,EAAE,CAAC,CAAC,KAAK,CAAC,OAAO,cAAc,CAAC,EACrC,IAAI,EAAE,IAAI,CAAC,eAAe,EAAE,eAAe,CAAC,GAC3C,MAAM,GAAG,SAAS,CAkBpB;AAED,wBAAgB,wBAAwB,CACtC,IAAI,EAAE,eAAe,GACpB,aAAa,CAAC,OAAO,WAAW,EAAE,OAAO,YAAY,EAAE,iBAAiB,CAAC,CAoC3E"}

package/dist/ops-apps/set-app-theme.js

@@ -29,7 +29,41 @@ const outputSchema = {
     appId: z.string(),
     theme: appThemeSchema,
     updatedAt: z.string(),
+    /**
+     * Migration nudge (ggui#598 slice 3): present when the overlay is
+     * BRAND-SHAPED — ≥3 color families over a name that resolves to no
+     * registered theme. The write still succeeds (overlays stay legal);
+     * the tier just stops being silent about brands living in it.
+     */
+    warning: z.string().optional(),
 };
+/**
+ * Detect a BRAND-SHAPED overlay (ggui#598 slice 3): ≥3 distinct color
+ * families in the variable map while the overlay's `name` resolves to
+ * no known theme. A brand living in the accent tier is the round-3
+ * mechanism — the overlay inherits every unmapped token from someone
+ * else's ladder. The WARN names the registration path; it never
+ * blocks. Exported for its unit pins.
+ *
+ * @internal
+ */
+export function detectBrandShapedOverlay(theme, deps) {
+    const families = new Set();
+    for (const key of Object.keys(theme.cssVariables)) {
+        const m = key.match(/^--ggui-color-([a-zA-Z]+)/);
+        if (m)
+            families.add(m[1].toLowerCase());
+    }
+    if (families.size < 3)
+        return undefined;
+    if (theme.name !== undefined &&
+        deps.knownThemeIds !== undefined &&
+        deps.knownThemeIds.includes(theme.name)) {
+        // Brand-scale accents over a COVERED registered base — legitimate.
+        return undefined;
+    }
+    return `This overlay carries ${families.size} color families over ${theme.name !== undefined ? `an unregistered name ("${theme.name}")` : 'no named base'} — brand-scale theming belongs in a REGISTERED theme (runtime theme registration), where coverage is validated and every token is yours; overlays are accents over a covered base. The write succeeded; unmapped tokens will paint the default ladder.`;
+}
 export function createSetAppThemeHandler(deps) {
     return {
         name: 'ggui_ops_set_app_theme',
@@ -53,9 +87,11 @@ export function createSetAppThemeHandler(deps) {
                 ownerSub,
                 theme: parsed.theme,
             });
+            const warning = detectBrandShapedOverlay(parsed.theme, deps);
             return {
                 appId: written.appId,
                 theme: parsed.theme,
+                ...(warning !== undefined ? { warning } : {}),
                 updatedAt: written.updatedAt,
             };
         },

package/dist/ops-themes/delete-theme.d.ts

@@ -0,0 +1,29 @@
+/**
+ * `ggui_ops_delete_theme` — remove one runtime theme registration
+ * (ggui#598-C). Idempotent-with-report: `deleted` says whether a
+ * registration existed. Renders referencing a deleted theme fall back
+ * per the resolution ladder — deletion never breaks a mounted frame.
+ */
+import { z } from 'zod';
+import type { ThemeStore } from '@ggui-ai/mcp-server-core';
+import type { SharedHandler } from '../types.js';
+import { type AppsSource } from '../ops-apps/types.js';
+declare const inputSchema: {
+    readonly appId: z.ZodString;
+    readonly themeId: z.ZodString;
+};
+declare const outputSchema: {
+    readonly themeId: z.ZodString;
+    readonly deleted: z.ZodBoolean;
+};
+export interface DeleteThemeOutput {
+    readonly themeId: string;
+    readonly deleted: boolean;
+}
+export interface DeleteThemeDeps {
+    readonly apps: AppsSource;
+    readonly themeStore: ThemeStore;
+}
+export declare function createDeleteThemeHandler(deps: DeleteThemeDeps): SharedHandler<typeof inputSchema, typeof outputSchema, DeleteThemeOutput>;
+export {};
+//# sourceMappingURL=delete-theme.d.ts.map

package/dist/ops-themes/delete-theme.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"delete-theme.d.ts","sourceRoot":"","sources":["../../src/ops-themes/delete-theme.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AACH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,0BAA0B,CAAC;AAC3D,OAAO,KAAK,EAAkB,aAAa,EAAE,MAAM,aAAa,CAAC;AAEjE,OAAO,EAAoB,KAAK,UAAU,EAAE,MAAM,sBAAsB,CAAC;AAEzE,QAAA,MAAM,WAAW;;;CAMP,CAAC;AAEX,QAAA,MAAM,YAAY;;;CAKR,CAAC;AAEX,MAAM,WAAW,iBAAiB;IAChC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC;CAC3B;AAED,MAAM,WAAW,eAAe;IAC9B,QAAQ,CAAC,IAAI,EAAE,UAAU,CAAC;IAC1B,QAAQ,CAAC,UAAU,EAAE,UAAU,CAAC;CACjC;AAED,wBAAgB,wBAAwB,CACtC,IAAI,EAAE,eAAe,GACpB,aAAa,CAAC,OAAO,WAAW,EAAE,OAAO,YAAY,EAAE,iBAAiB,CAAC,CAwB3E"}

package/dist/ops-themes/delete-theme.js

@@ -0,0 +1,41 @@
+/**
+ * `ggui_ops_delete_theme` — remove one runtime theme registration
+ * (ggui#598-C). Idempotent-with-report: `deleted` says whether a
+ * registration existed. Renders referencing a deleted theme fall back
+ * per the resolution ladder — deletion never breaks a mounted frame.
+ */
+import { z } from 'zod';
+import { resolveOwnerSub } from '../ops-apps/identity.js';
+import { AppNotFoundError } from '../ops-apps/types.js';
+const inputSchema = {
+    appId: z
+        .string()
+        .min(1)
+        .describe('Target app — must be one the calling user owns.'),
+    themeId: z.string().min(1).describe('The registered theme id to remove.'),
+};
+const outputSchema = {
+    themeId: z.string(),
+    deleted: z
+        .boolean()
+        .describe('True iff a registration existed and was removed.'),
+};
+export function createDeleteThemeHandler(deps) {
+    return {
+        name: 'ggui_ops_delete_theme',
+        title: 'Delete theme',
+        audience: ['ops'],
+        description: 'Remove one registered runtime theme from an app the caller owns. Idempotent — `deleted` reports whether a registration existed. The id becomes registerable again.',
+        inputSchema,
+        outputSchema,
+        async handler(rawInput, ctx) {
+            const ownerSub = resolveOwnerSub('ggui_ops_delete_theme', ctx);
+            const parsed = z.object(inputSchema).parse(rawInput);
+            const app = await deps.apps.get({ appId: parsed.appId, ownerSub });
+            if (!app)
+                throw new AppNotFoundError(parsed.appId);
+            const deleted = await deps.themeStore.delete(parsed.appId, parsed.themeId);
+            return { themeId: parsed.themeId, deleted };
+        },
+    };
+}

package/dist/ops-themes/index.d.ts

@@ -0,0 +1,9 @@
+/**
+ * ops-themes — runtime theme registration tools (ggui#598-C).
+ * Subpath entry, mirroring the other ops families.
+ */
+export { createRegisterThemeHandler, type RegisterThemeDeps, type RegisterThemeOutput, type ThemeCoverageResultLike, } from './register-theme.js';
+export { createListThemesHandler, type ListThemesDeps, type ListThemesOutput, } from './list-themes.js';
+export { createDeleteThemeHandler, type DeleteThemeDeps, type DeleteThemeOutput, } from './delete-theme.js';
+export { ThemeCoverageError, ThemeDocumentError, ThemeIdentityError, ThemeQuotaError, mapStorePutError, type ThemeCoverageValidator, } from './types.js';
+//# sourceMappingURL=index.d.ts.map

package/dist/ops-themes/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/ops-themes/index.ts"],"names":[],"mappings":"AAAA;;;GAGG;AACH,OAAO,EACL,0BAA0B,EAC1B,KAAK,iBAAiB,EACtB,KAAK,mBAAmB,EACxB,KAAK,uBAAuB,GAC7B,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EACL,uBAAuB,EACvB,KAAK,cAAc,EACnB,KAAK,gBAAgB,GACtB,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EACL,wBAAwB,EACxB,KAAK,eAAe,EACpB,KAAK,iBAAiB,GACvB,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EACL,kBAAkB,EAClB,kBAAkB,EAClB,kBAAkB,EAClB,eAAe,EACf,gBAAgB,EAChB,KAAK,sBAAsB,GAC5B,MAAM,YAAY,CAAC"}

package/dist/ops-themes/index.js

@@ -0,0 +1,8 @@
+/**
+ * ops-themes — runtime theme registration tools (ggui#598-C).
+ * Subpath entry, mirroring the other ops families.
+ */
+export { createRegisterThemeHandler, } from './register-theme.js';
+export { createListThemesHandler, } from './list-themes.js';
+export { createDeleteThemeHandler, } from './delete-theme.js';
+export { ThemeCoverageError, ThemeDocumentError, ThemeIdentityError, ThemeQuotaError, mapStorePutError, } from './types.js';

package/dist/ops-themes/list-themes.d.ts

@@ -0,0 +1,36 @@
+/**
+ * `ggui_ops_list_themes` — the caller's registered themes for one of
+ * their apps (ggui#598-C). Metadata only — the registration document
+ * itself never rides a list (bounded output; fetch-by-id is a later
+ * surface if a reader ever needs the bytes back).
+ */
+import { z } from 'zod';
+import type { ThemeStore } from '@ggui-ai/mcp-server-core';
+import type { SharedHandler } from '../types.js';
+import { type AppsSource } from '../ops-apps/types.js';
+declare const inputSchema: {
+    readonly appId: z.ZodString;
+};
+declare const outputSchema: {
+    readonly themes: z.ZodArray<z.ZodObject<{
+        themeId: z.ZodString;
+        documentHash: z.ZodString;
+        registeredAt: z.ZodNumber;
+        updatedAt: z.ZodNumber;
+    }, z.core.$strip>>;
+};
+export interface ListThemesOutput {
+    readonly themes: readonly {
+        readonly themeId: string;
+        readonly documentHash: string;
+        readonly registeredAt: number;
+        readonly updatedAt: number;
+    }[];
+}
+export interface ListThemesDeps {
+    readonly apps: AppsSource;
+    readonly themeStore: ThemeStore;
+}
+export declare function createListThemesHandler(deps: ListThemesDeps): SharedHandler<typeof inputSchema, typeof outputSchema, ListThemesOutput>;
+export {};
+//# sourceMappingURL=list-themes.d.ts.map

package/dist/ops-themes/list-themes.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"list-themes.d.ts","sourceRoot":"","sources":["../../src/ops-themes/list-themes.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AACH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,0BAA0B,CAAC;AAC3D,OAAO,KAAK,EAAkB,aAAa,EAAE,MAAM,aAAa,CAAC;AAEjE,OAAO,EAAoB,KAAK,UAAU,EAAE,MAAM,sBAAsB,CAAC;AAEzE,QAAA,MAAM,WAAW;;CAKP,CAAC;AAEX,QAAA,MAAM,YAAY;;;;;;;CAWR,CAAC;AAEX,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,CAAC,MAAM,EAAE,SAAS;QACxB,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;QACzB,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;QAC9B,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;QAC9B,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;KAC5B,EAAE,CAAC;CACL;AAED,MAAM,WAAW,cAAc;IAC7B,QAAQ,CAAC,IAAI,EAAE,UAAU,CAAC;IAC1B,QAAQ,CAAC,UAAU,EAAE,UAAU,CAAC;CACjC;AAED,wBAAgB,uBAAuB,CACrC,IAAI,EAAE,cAAc,GACnB,aAAa,CAAC,OAAO,WAAW,EAAE,OAAO,YAAY,EAAE,gBAAgB,CAAC,CA4B1E"}

package/dist/ops-themes/list-themes.js

@@ -0,0 +1,51 @@
+/**
+ * `ggui_ops_list_themes` — the caller's registered themes for one of
+ * their apps (ggui#598-C). Metadata only — the registration document
+ * itself never rides a list (bounded output; fetch-by-id is a later
+ * surface if a reader ever needs the bytes back).
+ */
+import { z } from 'zod';
+import { resolveOwnerSub } from '../ops-apps/identity.js';
+import { AppNotFoundError } from '../ops-apps/types.js';
+const inputSchema = {
+    appId: z
+        .string()
+        .min(1)
+        .describe('Target app — must be one the calling user owns.'),
+};
+const outputSchema = {
+    themes: z.array(z.object({
+        themeId: z.string(),
+        documentHash: z
+            .string()
+            .describe('sha256 over the stored registration bytes.'),
+        registeredAt: z.number().describe('First-registration ms epoch.'),
+        updatedAt: z.number().describe('Last-write ms epoch.'),
+    })),
+};
+export function createListThemesHandler(deps) {
+    return {
+        name: 'ggui_ops_list_themes',
+        title: 'List themes',
+        audience: ['ops'],
+        description: "The app's registered runtime themes — id, documentHash, and timestamps, themeId-sorted. Registration documents themselves are not included.",
+        inputSchema,
+        outputSchema,
+        async handler(rawInput, ctx) {
+            const ownerSub = resolveOwnerSub('ggui_ops_list_themes', ctx);
+            const parsed = z.object(inputSchema).parse(rawInput);
+            const app = await deps.apps.get({ appId: parsed.appId, ownerSub });
+            if (!app)
+                throw new AppNotFoundError(parsed.appId);
+            const rows = await deps.themeStore.list(parsed.appId);
+            return {
+                themes: rows.map((r) => ({
+                    themeId: r.themeId,
+                    documentHash: r.documentHash,
+                    registeredAt: r.registeredAt,
+                    updatedAt: r.updatedAt,
+                })),
+            };
+        },
+    };
+}

package/dist/ops-themes/register-theme.d.ts

@@ -0,0 +1,57 @@
+import { z } from 'zod';
+import { type ThemeStore } from '@ggui-ai/mcp-server-core';
+import type { SharedHandler } from '../types.js';
+import { type AppsSource } from '../ops-apps/types.js';
+import { type ThemeCoverageValidator } from './types.js';
+/**
+ * Structural mirror of the coverage validator's result — the shape the
+ * injected gate returns (kept here so `types.ts` and the composer can
+ * reference one definition without a design-package import).
+ */
+export interface ThemeCoverageResultLike {
+    readonly covered: boolean;
+    readonly uncovered: {
+        readonly light: readonly string[];
+        readonly dark: readonly string[];
+    };
+    readonly inheritMatched: readonly string[];
+    readonly excluded: readonly string[];
+}
+declare const inputSchema: {
+    readonly appId: z.ZodString;
+    readonly themeId: z.ZodString;
+    readonly registration: z.ZodObject<{
+        light: z.ZodRecord<z.ZodString, z.ZodUnknown>;
+        dark: z.ZodRecord<z.ZodString, z.ZodUnknown>;
+    }, z.core.$strip>;
+};
+declare const outputSchema: {
+    readonly themeId: z.ZodString;
+    readonly documentHash: z.ZodString;
+    readonly updated: z.ZodBoolean;
+    readonly coverage: z.ZodObject<{
+        inheritMatched: z.ZodArray<z.ZodString>;
+        excluded: z.ZodArray<z.ZodString>;
+    }, z.core.$strip>;
+};
+export interface RegisterThemeOutput {
+    readonly themeId: string;
+    readonly documentHash: string;
+    readonly updated: boolean;
+    readonly coverage: {
+        readonly inheritMatched: readonly string[];
+        readonly excluded: readonly string[];
+    };
+}
+export interface RegisterThemeDeps {
+    readonly apps: AppsSource;
+    readonly themeStore: ThemeStore;
+    readonly coverageValidator: ThemeCoverageValidator;
+    /** The consumed-token manifest (`consumed-tokens.manifest.json` tokens). */
+    readonly manifestTokens: readonly string[];
+    /** Built-in theme ids — registration refuses collisions outright. */
+    readonly staticThemeIds: readonly string[];
+}
+export declare function createRegisterThemeHandler(deps: RegisterThemeDeps): SharedHandler<typeof inputSchema, typeof outputSchema, RegisterThemeOutput>;
+export {};
+//# sourceMappingURL=register-theme.d.ts.map

package/dist/ops-themes/register-theme.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"register-theme.d.ts","sourceRoot":"","sources":["../../src/ops-themes/register-theme.ts"],"names":[],"mappings":"AA6BA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAkB,KAAK,UAAU,EAAE,MAAM,0BAA0B,CAAC;AAC3E,OAAO,KAAK,EAAkB,aAAa,EAAE,MAAM,aAAa,CAAC;AAEjE,OAAO,EAAoB,KAAK,UAAU,EAAE,MAAM,sBAAsB,CAAC;AACzE,OAAO,EAKL,KAAK,sBAAsB,EAC5B,MAAM,YAAY,CAAC;AAEpB;;;;GAIG;AACH,MAAM,WAAW,uBAAuB;IACtC,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC;IAC1B,QAAQ,CAAC,SAAS,EAAE;QAClB,QAAQ,CAAC,KAAK,EAAE,SAAS,MAAM,EAAE,CAAC;QAClC,QAAQ,CAAC,IAAI,EAAE,SAAS,MAAM,EAAE,CAAC;KAClC,CAAC;IACF,QAAQ,CAAC,cAAc,EAAE,SAAS,MAAM,EAAE,CAAC;IAC3C,QAAQ,CAAC,QAAQ,EAAE,SAAS,MAAM,EAAE,CAAC;CACtC;AAQD,QAAA,MAAM,WAAW;;;;;;;CAmBP,CAAC;AAEX,QAAA,MAAM,YAAY;;;;;;;;CAgBR,CAAC;AAEX,MAAM,WAAW,mBAAmB;IAClC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;IAC9B,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC;IAC1B,QAAQ,CAAC,QAAQ,EAAE;QACjB,QAAQ,CAAC,cAAc,EAAE,SAAS,MAAM,EAAE,CAAC;QAC3C,QAAQ,CAAC,QAAQ,EAAE,SAAS,MAAM,EAAE,CAAC;KACtC,CAAC;CACH;AAED,MAAM,WAAW,iBAAiB;IAChC,QAAQ,CAAC,IAAI,EAAE,UAAU,CAAC;IAC1B,QAAQ,CAAC,UAAU,EAAE,UAAU,CAAC;IAChC,QAAQ,CAAC,iBAAiB,EAAE,sBAAsB,CAAC;IACnD,4EAA4E;IAC5E,QAAQ,CAAC,cAAc,EAAE,SAAS,MAAM,EAAE,CAAC;IAC3C,qEAAqE;IACrE,QAAQ,CAAC,cAAc,EAAE,SAAS,MAAM,EAAE,CAAC;CAC5C;AAKD,wBAAgB,0BAA0B,CACxC,IAAI,EAAE,iBAAiB,GACtB,aAAa,CAAC,OAAO,WAAW,EAAE,OAAO,YAAY,EAAE,mBAAmB,CAAC,CAmF7E"}

package/dist/ops-themes/register-theme.js

@@ -0,0 +1,142 @@
+/**
+ * `ggui_ops_register_theme` — register (or update) a runtime theme for
+ * an app the caller owns (ggui#598-C).
+ *
+ * Gate order — each wall is a distinct named refusal:
+ *   1. tenancy   — the app must be the caller's (uniform not-found).
+ *   2. identity  — the frozen id grammar, then collision with any
+ *                  built-in theme id (`theme_identity`).
+ *   3. coverage  — the injected validator vs the consumed-token
+ *                  manifest (`theme_coverage`; uncovered lists ride
+ *                  verbatim — never-quiet).
+ *   4. policy    — the store may refuse the write (a deployment-policy
+ *                  seam, e.g. a per-app registration cap; surfaced as
+ *                  `theme_quota` with the store's own message).
+ *
+ * What gets stored: the `{light, dark}` registration serialized ONCE
+ * here to CANONICAL JSON (RFC 8785) — those bytes are the identity
+ * (`documentHash` = sha256) and the store returns them verbatim.
+ * Identity is deliberately canonical: two key-orderings of one
+ * semantic document are ONE registration version (the same
+ * representation-independence rule the contract and props-schema
+ * hashes obey).
+ *
+ * The output is never-quiet about inheritance: what the document
+ * inherited (`inheritMatched`) and what the manifest excluded from
+ * the obligation (`excluded`) are IN the result, not just implied.
+ */
+import { createHash } from 'node:crypto';
+import canonicalize from 'canonicalize';
+import { z } from 'zod';
+import { isValidThemeId } from '@ggui-ai/mcp-server-core';
+import { resolveOwnerSub } from '../ops-apps/identity.js';
+import { AppNotFoundError } from '../ops-apps/types.js';
+import { mapStorePutError, ThemeCoverageError, ThemeDocumentError, ThemeIdentityError, } from './types.js';
+const dtcgDocSchema = z
+    .record(z.string(), z.unknown())
+    .describe('A DTCG design-token document for one mode. Validated for token coverage at registration — the response names every uncovered token.');
+const inputSchema = {
+    appId: z
+        .string()
+        .min(1)
+        .describe('Target app — must be one the calling user owns. Discover via `ggui_ops_list_apps`.'),
+    themeId: z
+        .string()
+        .min(3)
+        .max(64)
+        .describe('Theme id: lowercase kebab, alphanumeric-bounded, 3-64 chars. Must not collide with a built-in theme id. Re-registering an existing id replaces its document.'),
+    registration: z
+        .object({ light: dtcgDocSchema, dark: dtcgDocSchema })
+        .describe('Both modes, required. Register what dark IS, even when identical to light — silent mode fallback is not part of runtime registration.'),
+};
+const outputSchema = {
+    themeId: z.string(),
+    documentHash: z
+        .string()
+        .describe('sha256 over the stored registration bytes — the identity join key.'),
+    updated: z
+        .boolean()
+        .describe('True when an existing registration was replaced; false on first registration.'),
+    coverage: z.object({
+        inheritMatched: z
+            .array(z.string())
+            .describe('Obligated tokens satisfied via explicit inherit patterns.'),
+        excluded: z
+            .array(z.string())
+            .describe('Manifest tokens excluded from the coverage obligation.'),
+    }),
+};
+const sha256 = (s) => createHash('sha256').update(s, 'utf8').digest('hex');
+export function createRegisterThemeHandler(deps) {
+    return {
+        name: 'ggui_ops_register_theme',
+        title: 'Register theme',
+        audience: ['ops'],
+        description: 'Register (or update) a runtime theme for an app the caller owns. The document must cover the consumed-token manifest — refusals name every uncovered token, per mode. The theme id obeys a fixed grammar and must not collide with a built-in id. Returns the stored documentHash (the identity join key) and the coverage detail (inherited + excluded tokens).',
+        inputSchema,
+        outputSchema,
+        async handler(rawInput, ctx) {
+            const ownerSub = resolveOwnerSub('ggui_ops_register_theme', ctx);
+            const parsed = z.object(inputSchema).parse(rawInput);
+            // 1. Tenancy — uniform not-found, no existence leak.
+            const app = await deps.apps.get({ appId: parsed.appId, ownerSub });
+            if (!app)
+                throw new AppNotFoundError(parsed.appId);
+            // 2. Identity — grammar first, then built-in collision.
+            if (!isValidThemeId(parsed.themeId)) {
+                throw new ThemeIdentityError('grammar', parsed.themeId);
+            }
+            if (deps.staticThemeIds.includes(parsed.themeId)) {
+                throw new ThemeIdentityError('collision', parsed.themeId);
+            }
+            // 3. Document — the validator's parser owns DTCG shape; a throw
+            // here means the document itself does not parse. Named wall,
+            // never a bare 500 (a fat-fingered document is user error).
+            // 4. Coverage — the registration gate.
+            let coverage;
+            try {
+                coverage = deps.coverageValidator(parsed.registration, deps.manifestTokens);
+            }
+            catch (err) {
+                throw new ThemeDocumentError(err instanceof Error ? err.message : String(err));
+            }
+            if (!coverage.covered) {
+                throw new ThemeCoverageError(coverage.uncovered);
+            }
+            // 5. Persist — CANONICAL bytes are the identity (RFC 8785, the
+            // contractHash/propsSchemaHash precedent): two key-orderings of
+            // one semantic document are ONE registration version. Raw
+            // stringify here would re-open the #579 representation class at
+            // the front door.
+            const document = canonicalize(parsed.registration);
+            if (document === undefined) {
+                throw new ThemeDocumentError('registration is not canonicalizable JSON');
+            }
+            const documentHash = sha256(document);
+            const existing = await deps.themeStore.get(parsed.appId, parsed.themeId);
+            const now = Date.now();
+            try {
+                await deps.themeStore.put({
+                    appId: parsed.appId,
+                    themeId: parsed.themeId,
+                    document,
+                    documentHash,
+                    registeredAt: existing?.registeredAt ?? now,
+                    updatedAt: now,
+                });
+            }
+            catch (err) {
+                mapStorePutError(err);
+            }
+            return {
+                themeId: parsed.themeId,
+                documentHash,
+                updated: existing !== null,
+                coverage: {
+                    inheritMatched: coverage.inheritMatched,
+                    excluded: coverage.excluded,
+                },
+            };
+        },
+    };
+}

package/dist/ops-themes/types.d.ts

@@ -0,0 +1,63 @@
+/**
+ * ops-themes — runtime theme registration tools (ggui#598-C).
+ *
+ * Dependency posture: EVERYTHING injected. This package never imports
+ * the design package — the composer supplies the coverage validator,
+ * the consumed-token manifest, and the static preset-id list; the
+ * store arrives behind the frozen `ThemeStore` port. The handlers own
+ * orchestration + the refusal taxonomy, nothing else.
+ *
+ * Refusal taxonomy (one named class per wall — an operator must never
+ * guess which wall they hit):
+ *   - `theme_coverage` — the document fails coverage conformance; the
+ *     uncovered token lists ride verbatim.
+ *   - `theme_identity` — the id fails the frozen grammar, or collides
+ *     with a statically-compiled theme id.
+ *   - `theme_quota` — a deployment-policy seam refused the write (the
+ *     store decorator names its own limit in the message).
+ * Storage-integrity failures are deliberately NOT mapped: they bubble
+ * untouched as server faults.
+ */
+import type { ThemeCoverageResultLike } from './register-theme.js';
+/**
+ * Structural seam for the registration gate — shaped after the design
+ * package's `validateThemeCoverage` without importing it. The composer
+ * binds the real validator; tests bind stubs.
+ */
+export type ThemeCoverageValidator = (docs: {
+    readonly light: Record<string, unknown>;
+    readonly dark: Record<string, unknown>;
+}, manifestTokens: readonly string[]) => ThemeCoverageResultLike;
+export declare class ThemeCoverageError extends Error {
+    readonly uncovered: {
+        readonly light: readonly string[];
+        readonly dark: readonly string[];
+    };
+    readonly code: "theme_coverage";
+    constructor(uncovered: {
+        readonly light: readonly string[];
+        readonly dark: readonly string[];
+    });
+}
+export declare class ThemeIdentityError extends Error {
+    readonly reason: 'grammar' | 'collision';
+    readonly code: "theme_identity";
+    constructor(reason: 'grammar' | 'collision', themeId: string);
+}
+export declare class ThemeDocumentError extends Error {
+    readonly code: "theme_document";
+    constructor(underlying: string);
+}
+export declare class ThemeQuotaError extends Error {
+    readonly code: "theme_quota";
+    constructor(detail: string);
+}
+/**
+ * Map a store-thrown deployment-policy refusal onto the wire taxonomy
+ * WITHOUT importing the deployment's class: the policy seam is
+ * name-structural (any store decorator refusing a write names itself
+ * `ThemeQuotaExceededError`). Everything else rethrows untouched —
+ * integrity faults must never be dressed as user errors.
+ */
+export declare function mapStorePutError(err: unknown): never;
+//# sourceMappingURL=types.d.ts.map

package/dist/ops-themes/types.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../src/ops-themes/types.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;GAmBG;AACH,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,qBAAqB,CAAC;AAEnE;;;;GAIG;AACH,MAAM,MAAM,sBAAsB,GAAG,CACnC,IAAI,EAAE;IAAE,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAAC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;CAAE,EACzF,cAAc,EAAE,SAAS,MAAM,EAAE,KAC9B,uBAAuB,CAAC;AAE7B,qBAAa,kBAAmB,SAAQ,KAAK;IAGzC,QAAQ,CAAC,SAAS,EAAE;QAClB,QAAQ,CAAC,KAAK,EAAE,SAAS,MAAM,EAAE,CAAC;QAClC,QAAQ,CAAC,IAAI,EAAE,SAAS,MAAM,EAAE,CAAC;KAClC;IALH,QAAQ,CAAC,IAAI,EAAG,gBAAgB,CAAU;gBAE/B,SAAS,EAAE;QAClB,QAAQ,CAAC,KAAK,EAAE,SAAS,MAAM,EAAE,CAAC;QAClC,QAAQ,CAAC,IAAI,EAAE,SAAS,MAAM,EAAE,CAAC;KAClC;CASJ;AAED,qBAAa,kBAAmB,SAAQ,KAAK;IAGzC,QAAQ,CAAC,MAAM,EAAE,SAAS,GAAG,WAAW;IAF1C,QAAQ,CAAC,IAAI,EAAG,gBAAgB,CAAU;gBAE/B,MAAM,EAAE,SAAS,GAAG,WAAW,EACxC,OAAO,EAAE,MAAM;CASlB;AAED,qBAAa,kBAAmB,SAAQ,KAAK;IAC3C,QAAQ,CAAC,IAAI,EAAG,gBAAgB,CAAU;gBAC9B,UAAU,EAAE,MAAM;CAO/B;AAED,qBAAa,eAAgB,SAAQ,KAAK;IACxC,QAAQ,CAAC,IAAI,EAAG,aAAa,CAAU;gBAC3B,MAAM,EAAE,MAAM;CAI3B;AAED;;;;;;GAMG;AACH,wBAAgB,gBAAgB,CAAC,GAAG,EAAE,OAAO,GAAG,KAAK,CAKpD"}

package/dist/ops-themes/types.js

@@ -0,0 +1,50 @@
+export class ThemeCoverageError extends Error {
+    uncovered;
+    code = 'theme_coverage';
+    constructor(uncovered) {
+        super(`theme_coverage: the registration document does not cover the consumed-token manifest — ` +
+            `uncovered light: [${uncovered.light.join(', ')}], dark: [${uncovered.dark.join(', ')}]. ` +
+            `Emit each listed token or claim it via an explicit $extensions["ai.ggui.coverage"].inherit pattern.`);
+        this.uncovered = uncovered;
+        this.name = 'ThemeCoverageError';
+    }
+}
+export class ThemeIdentityError extends Error {
+    reason;
+    code = 'theme_identity';
+    constructor(reason, themeId) {
+        super(reason === 'grammar'
+            ? `theme_identity: ${JSON.stringify(themeId)} fails the theme-id grammar — lowercase kebab, alphanumeric-bounded, 3-64 chars`
+            : `theme_identity: ${JSON.stringify(themeId)} collides with a built-in theme id — pick a distinct id`);
+        this.reason = reason;
+        this.name = 'ThemeIdentityError';
+    }
+}
+export class ThemeDocumentError extends Error {
+    code = 'theme_document';
+    constructor(underlying) {
+        super(`theme_document: the registration does not parse as a DTCG theme document — ` +
+            `fix the document shape and re-submit. Underlying: ${underlying}`);
+        this.name = 'ThemeDocumentError';
+    }
+}
+export class ThemeQuotaError extends Error {
+    code = 'theme_quota';
+    constructor(detail) {
+        super(`theme_quota: ${detail}`);
+        this.name = 'ThemeQuotaError';
+    }
+}
+/**
+ * Map a store-thrown deployment-policy refusal onto the wire taxonomy
+ * WITHOUT importing the deployment's class: the policy seam is
+ * name-structural (any store decorator refusing a write names itself
+ * `ThemeQuotaExceededError`). Everything else rethrows untouched —
+ * integrity faults must never be dressed as user errors.
+ */
+export function mapStorePutError(err) {
+    if (err instanceof Error && err.name === 'ThemeQuotaExceededError') {
+        throw new ThemeQuotaError(err.message);
+    }
+    throw err;
+}

package/dist/renders/amend.d.ts

@@ -41,12 +41,17 @@ declare const outputSchema: {
     readonly resourceUri: z.ZodString;
     /** No-op feedback channel — same semantics as ggui_update's. */
     readonly warning: z.ZodOptional<z.ZodString>;
+    /** ggui#560 — schema attestation, same semantics as ggui_update's. */
+    readonly propsSchemaHash: z.ZodOptional<z.ZodString>;
+    readonly propsSchemaProfile: z.ZodOptional<z.ZodString>;
 };
 interface AmendOutput {
     sessionId: string;
     updated: boolean;
     resourceUri: string;
     warning?: string;
+    propsSchemaHash?: string;
+    propsSchemaProfile?: string;
 }
 /**
  * Build the OSS `ggui_amend` handler. Additive, like `update:` — server