@ggui-ai/mcp-server-handlers 0.16.0 → 0.18.0

package/dist/ops-apps/set-app-theme.d.ts

@@ -65,6 +65,39 @@ declare const outputSchema: {
             dark: z.ZodOptional<z.ZodString>;
         }, z.core.$strict>>;
         frameless: z.ZodOptional<z.ZodBoolean>;
+        fonts: z.ZodOptional<z.ZodArray<z.ZodObject<{
+            family: z.ZodString;
+            src: z.ZodString;
+            weight: z.ZodOptional<z.ZodUnion<readonly [z.ZodString, z.ZodNumber]>>;
+            style: z.ZodOptional<z.ZodString>;
+            display: z.ZodOptional<z.ZodString>;
+        }, z.core.$strict>>>;
+        imagery: z.ZodOptional<z.ZodObject<{
+            mark: z.ZodOptional<z.ZodObject<{
+                src: z.ZodString;
+                alt: z.ZodOptional<z.ZodString>;
+                tone: z.ZodOptional<z.ZodEnum<{
+                    light: "light";
+                    dark: "dark";
+                }>>;
+            }, z.core.$strict>>;
+            hero: z.ZodOptional<z.ZodObject<{
+                src: z.ZodString;
+                alt: z.ZodOptional<z.ZodString>;
+                tone: z.ZodOptional<z.ZodEnum<{
+                    light: "light";
+                    dark: "dark";
+                }>>;
+            }, z.core.$strict>>;
+            pattern: z.ZodOptional<z.ZodObject<{
+                src: z.ZodString;
+                alt: z.ZodOptional<z.ZodString>;
+                tone: z.ZodOptional<z.ZodEnum<{
+                    light: "light";
+                    dark: "dark";
+                }>>;
+            }, z.core.$strict>>;
+        }, z.core.$strict>>;
     }, z.core.$strict>>;
     readonly updatedAt: z.ZodOptional<z.ZodString>;
     /** Present on a refusal: the one refusal class this door emits. */
@@ -84,6 +117,8 @@ declare const outputSchema: {
         overlayHash: z.ZodLiteral<"mismatch">;
     }, z.core.$strict>, z.ZodObject<{
         refused: z.ZodLiteral<"v1 shape">;
+    }, z.core.$strict>, z.ZodObject<{
+        wouldDrop: z.ZodArray<z.ZodString>;
     }, z.core.$strict>]>>;
     /** Present on a shape refusal the schema itself raised — its messages, one per issue. */
     readonly issues: z.ZodOptional<z.ZodArray<z.ZodString>>;
@@ -132,6 +167,39 @@ export declare function createSetAppThemeHandler(deps: SetAppThemeDeps): import(
             dark: z.ZodOptional<z.ZodString>;
         }, z.core.$strict>>;
         frameless: z.ZodOptional<z.ZodBoolean>;
+        fonts: z.ZodOptional<z.ZodArray<z.ZodObject<{
+            family: z.ZodString;
+            src: z.ZodString;
+            weight: z.ZodOptional<z.ZodUnion<readonly [z.ZodString, z.ZodNumber]>>;
+            style: z.ZodOptional<z.ZodString>;
+            display: z.ZodOptional<z.ZodString>;
+        }, z.core.$strict>>>;
+        imagery: z.ZodOptional<z.ZodObject<{
+            mark: z.ZodOptional<z.ZodObject<{
+                src: z.ZodString;
+                alt: z.ZodOptional<z.ZodString>;
+                tone: z.ZodOptional<z.ZodEnum<{
+                    light: "light";
+                    dark: "dark";
+                }>>;
+            }, z.core.$strict>>;
+            hero: z.ZodOptional<z.ZodObject<{
+                src: z.ZodString;
+                alt: z.ZodOptional<z.ZodString>;
+                tone: z.ZodOptional<z.ZodEnum<{
+                    light: "light";
+                    dark: "dark";
+                }>>;
+            }, z.core.$strict>>;
+            pattern: z.ZodOptional<z.ZodObject<{
+                src: z.ZodString;
+                alt: z.ZodOptional<z.ZodString>;
+                tone: z.ZodOptional<z.ZodEnum<{
+                    light: "light";
+                    dark: "dark";
+                }>>;
+            }, z.core.$strict>>;
+        }, z.core.$strict>>;
     }, z.core.$strict>;
 }, {
     readonly ok: z.ZodBoolean;
@@ -153,6 +221,39 @@ export declare function createSetAppThemeHandler(deps: SetAppThemeDeps): import(
             dark: z.ZodOptional<z.ZodString>;
         }, z.core.$strict>>;
         frameless: z.ZodOptional<z.ZodBoolean>;
+        fonts: z.ZodOptional<z.ZodArray<z.ZodObject<{
+            family: z.ZodString;
+            src: z.ZodString;
+            weight: z.ZodOptional<z.ZodUnion<readonly [z.ZodString, z.ZodNumber]>>;
+            style: z.ZodOptional<z.ZodString>;
+            display: z.ZodOptional<z.ZodString>;
+        }, z.core.$strict>>>;
+        imagery: z.ZodOptional<z.ZodObject<{
+            mark: z.ZodOptional<z.ZodObject<{
+                src: z.ZodString;
+                alt: z.ZodOptional<z.ZodString>;
+                tone: z.ZodOptional<z.ZodEnum<{
+                    light: "light";
+                    dark: "dark";
+                }>>;
+            }, z.core.$strict>>;
+            hero: z.ZodOptional<z.ZodObject<{
+                src: z.ZodString;
+                alt: z.ZodOptional<z.ZodString>;
+                tone: z.ZodOptional<z.ZodEnum<{
+                    light: "light";
+                    dark: "dark";
+                }>>;
+            }, z.core.$strict>>;
+            pattern: z.ZodOptional<z.ZodObject<{
+                src: z.ZodString;
+                alt: z.ZodOptional<z.ZodString>;
+                tone: z.ZodOptional<z.ZodEnum<{
+                    light: "light";
+                    dark: "dark";
+                }>>;
+            }, z.core.$strict>>;
+        }, z.core.$strict>>;
     }, z.core.$strict>>;
     readonly updatedAt: z.ZodOptional<z.ZodString>;
     /** Present on a refusal: the one refusal class this door emits. */
@@ -172,6 +273,8 @@ export declare function createSetAppThemeHandler(deps: SetAppThemeDeps): import(
         overlayHash: z.ZodLiteral<"mismatch">;
     }, z.core.$strict>, z.ZodObject<{
         refused: z.ZodLiteral<"v1 shape">;
+    }, z.core.$strict>, z.ZodObject<{
+        wouldDrop: z.ZodArray<z.ZodString>;
     }, z.core.$strict>]>>;
     /** Present on a shape refusal the schema itself raised — its messages, one per issue. */
     readonly issues: z.ZodOptional<z.ZodArray<z.ZodString>>;
@@ -192,6 +295,30 @@ export declare function createSetAppThemeHandler(deps: SetAppThemeDeps): import(
             dark?: string | undefined;
         } | undefined;
         frameless?: boolean | undefined;
+        fonts?: {
+            family: string;
+            src: string;
+            weight?: string | number | undefined;
+            style?: string | undefined;
+            display?: string | undefined;
+        }[] | undefined;
+        imagery?: {
+            mark?: {
+                src: string;
+                alt?: string | undefined;
+                tone?: "light" | "dark" | undefined;
+            } | undefined;
+            hero?: {
+                src: string;
+                alt?: string | undefined;
+                tone?: "light" | "dark" | undefined;
+            } | undefined;
+            pattern?: {
+                src: string;
+                alt?: string | undefined;
+                tone?: "light" | "dark" | undefined;
+            } | undefined;
+        } | undefined;
     } | undefined;
     updatedAt?: string | undefined;
     code?: "invalid_app_config" | undefined;
@@ -209,6 +336,8 @@ export declare function createSetAppThemeHandler(deps: SetAppThemeDeps): import(
         overlayHash: "mismatch";
     } | {
         refused: "v1 shape";
+    } | {
+        wouldDrop: string[];
     } | undefined;
     issues?: string[] | undefined;
 }>>;

package/dist/ops-apps/set-app-theme.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"set-app-theme.d.ts","sourceRoot":"","sources":["../../src/ops-apps/set-app-theme.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgCG;AACH,OAAO,EAIL,KAAK,QAAQ,EACb,KAAK,mBAAmB,EACzB,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAIL,KAAK,mBAAmB,EACzB,MAAM,aAAa,CAAC;AAGrB,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,YAAY,CAAC;AAE7C;;;;GAIG;AACH,MAAM,MAAM,wBAAwB,GAAG,CAAC,OAAO,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,KAAK;IACpF,QAAQ,CAAC,SAAS,EAAE,SAAS,MAAM,EAAE,CAAC;IACtC,QAAQ,CAAC,OAAO,EAAE,SAAS,MAAM,EAAE,CAAC;IACpC,QAAQ,CAAC,QAAQ,EAAE,SAAS,MAAM,EAAE,CAAC;CACtC,CAAC;AAcF,QAAA,MAAM,YAAY;;;;;;;;;;;;;;;;;;;;;;IAKhB,mEAAmE;;IAEnE,sGAAsG;;;;;;;;;;;;;;;;IAEtG,yFAAyF;;CAEjF,CAAC;AAEX,uEAAuE;AACvE,MAAM,MAAM,iBAAiB,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC,OAAO,YAAY,CAAC,CAAC,CAAC;AAE1E,MAAM,WAAW,eAAe;IAC9B,QAAQ,CAAC,IAAI,EAAE,UAAU,CAAC;IAC1B,8FAA8F;IAC9F,QAAQ,CAAC,eAAe,EAAE,wBAAwB,CAAC;CACpD;AAED,0EAA0E;AAC1E,MAAM,MAAM,iBAAiB,GACzB;IAAE,QAAQ,CAAC,EAAE,EAAE,IAAI,CAAC;IAAC,QAAQ,CAAC,KAAK,EAAE,QAAQ,CAAA;CAAE,GAC/C;IAAE,QAAQ,CAAC,EAAE,EAAE,KAAK,CAAC;IAAC,QAAQ,CAAC,OAAO,EAAE,mBAAmB,CAAA;CAAE,GAC7D;IAAE,QAAQ,CAAC,EAAE,EAAE,KAAK,CAAC;IAAC,QAAQ,CAAC,MAAM,EAAE,SAAS,MAAM,EAAE,CAAA;CAAE,CAAC;AAY/D;;;;;GAKG;AACH,wBAAsB,aAAa,CACjC,GAAG,EAAE,OAAO,EACZ,eAAe,EAAE,wBAAwB,GACxC,OAAO,CAAC,iBAAiB,CAAC,CAsB5B;AAWD,wBAAgB,wBAAwB,CAAC,IAAI,EAAE,eAAe;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;IA3E5D,mEAAmE;;IAEnE,sGAAsG;;;;;;;;;;;;;;;;IAEtG,yFAAyF;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;IA4G1F"}
+{"version":3,"file":"set-app-theme.d.ts","sourceRoot":"","sources":["../../src/ops-apps/set-app-theme.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgCG;AACH,OAAO,EAIL,KAAK,QAAQ,EACb,KAAK,mBAAmB,EAEzB,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAIL,KAAK,mBAAmB,EACzB,MAAM,aAAa,CAAC;AAGrB,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,YAAY,CAAC;AAE7C;;;;GAIG;AACH,MAAM,MAAM,wBAAwB,GAAG,CAAC,OAAO,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,KAAK;IACpF,QAAQ,CAAC,SAAS,EAAE,SAAS,MAAM,EAAE,CAAC;IACtC,QAAQ,CAAC,OAAO,EAAE,SAAS,MAAM,EAAE,CAAC;IACpC,QAAQ,CAAC,QAAQ,EAAE,SAAS,MAAM,EAAE,CAAC;CACtC,CAAC;AAcF,QAAA,MAAM,YAAY;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;IAKhB,mEAAmE;;IAEnE,sGAAsG;;;;;;;;;;;;;;;;;;IAEtG,yFAAyF;;CAEjF,CAAC;AAEX,uEAAuE;AACvE,MAAM,MAAM,iBAAiB,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC,OAAO,YAAY,CAAC,CAAC,CAAC;AAE1E,MAAM,WAAW,eAAe;IAC9B,QAAQ,CAAC,IAAI,EAAE,UAAU,CAAC;IAC1B,8FAA8F;IAC9F,QAAQ,CAAC,eAAe,EAAE,wBAAwB,CAAC;CACpD;AAED,0EAA0E;AAC1E,MAAM,MAAM,iBAAiB,GACzB;IAAE,QAAQ,CAAC,EAAE,EAAE,IAAI,CAAC;IAAC,QAAQ,CAAC,KAAK,EAAE,QAAQ,CAAA;CAAE,GAC/C;IAAE,QAAQ,CAAC,EAAE,EAAE,KAAK,CAAC;IAAC,QAAQ,CAAC,OAAO,EAAE,mBAAmB,CAAA;CAAE,GAC7D;IAAE,QAAQ,CAAC,EAAE,EAAE,KAAK,CAAC;IAAC,QAAQ,CAAC,MAAM,EAAE,SAAS,MAAM,EAAE,CAAA;CAAE,CAAC;AAY/D;;;;;GAKG;AACH,wBAAsB,aAAa,CACjC,GAAG,EAAE,OAAO,EACZ,eAAe,EAAE,wBAAwB,GACxC,OAAO,CAAC,iBAAiB,CAAC,CAsB5B;AAmBD,wBAAgB,wBAAwB,CAAC,IAAI,EAAE,eAAe;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;IAnF5D,mEAAmE;;IAEnE,sGAAsG;;;;;;;;;;;;;;;;;;IAEtG,yFAAyF;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;IAoH1F"}

package/dist/ops-apps/set-app-theme.js

@@ -31,7 +31,7 @@
  *
  * Pure over the {@link AppsSource} seam + the injected validator.
  */
-import { appThemeSchema, appThemeRefusalBodySchema, canonicalOverlayHash, } from '@ggui-ai/protocol';
+import { appThemeSchema, appThemeRefusalBodySchema, canonicalOverlayHash, appThemeWouldDropRefusalText, } from '@ggui-ai/protocol';
 import { z } from 'zod';
 import { defineHandler, handlerFailure, } from '../types.js';
 import { resolveOwnerSub } from './identity.js';
@@ -41,7 +41,7 @@ const inputSchema = {
         .string()
         .min(1)
         .describe('Target `GguiApp.appId` — must be one the calling user owns. Discover via `ggui_ops_list_apps`.'),
-    theme: appThemeSchema.describe('The app theme: `overlays.light` / `overlays.dark` are the derived `--ggui-*` sets (every consumed token, minus the floor the renderer owns), `overlayHash` = canonicalOverlayHash({ overlays, cssVariables, keyframes }); optional `mode` (the default when no host announces one), `name` (a label), `cssVariables` (mode-agnostic overrides), `keyframes` (per mode), `frameless`. Refused with `invalid_app_config` when a mode leaves a token uncovered, names a token outside the manifest, the attestation mismatches, or the body is the retired one-palette shape.'),
+    theme: appThemeSchema.describe('The app theme: `overlays.light` / `overlays.dark` are the derived `--ggui-*` sets (every consumed token, minus the floor the renderer owns), `overlayHash` = canonicalOverlayHash({ overlays, cssVariables, keyframes }); optional `mode` (the default when no host announces one), `name` (a label), `cssVariables` (mode-agnostic overrides), `keyframes` (per mode), `frameless`. Refused with `invalid_app_config` when a mode leaves a token uncovered, names a token outside the manifest, the attestation mismatches, or the body is the retired one-palette shape. Optional declared assets (ggui#1093): `fonts` — 1..16 faces, https-only `src`, the host admits their origins and the shell inlines them — and `imagery` — `mark` / `hero` / `pattern`, each `{ src, alt?, tone? }`, https-only; both outside the attestation.'),
 };
 const outputSchema = {
     ok: z.boolean(),
@@ -101,6 +101,14 @@ function refusalText(admission) {
         return 'invalid_app_config: the one-palette theme body is retired — send { overlays: { light, dark }, overlayHash, … }';
     if ('overlayHash' in r)
         return 'invalid_app_config: overlayHash does not match canonicalOverlayHash({ overlays, cssVariables, keyframes })';
+    if ('wouldDrop' in r) {
+        // ggui#1124 — the write would have DESTROYED stored members it did not
+        // carry. The wording is the protocol's ONE text, not this handler's:
+        // every door that refuses a destructive write says the same words, and
+        // the refusal names the compliance path so it is an instruction rather
+        // than a verdict (founder's ruling, 2026-09-16).
+        return `invalid_app_config: ${appThemeWouldDropRefusalText(r.wouldDrop)}`;
+    }
     if ('unknown' in r)
         return `invalid_app_config: keys outside the consumed-token manifest — light: [${r.unknown.light.join(', ')}] dark: [${r.unknown.dark.join(', ')}]`;
     return `invalid_app_config: consumed tokens left uncovered — light: [${r.uncovered.light.join(', ')}] dark: [${r.uncovered.dark.join(', ')}]`;

package/dist/ops-blueprint/generate.d.ts

@@ -172,6 +172,7 @@ export declare function createGguiOpsGenerateBlueprintHandler(deps: GguiOpsGener
     aesthetic: z.ZodOptional<z.ZodString>;
     context: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodType<import("@ggui-ai/protocol").JsonValue, unknown, z.core.$ZodTypeInternals<import("@ggui-ai/protocol").JsonValue, unknown>>>>;
     seedPrompt: z.ZodOptional<z.ZodString>;
+    intent: z.ZodOptional<z.ZodString>;
     setAsOperatorDefault: z.ZodOptional<z.ZodBoolean>;
 }, {
     blueprintId: z.ZodString;

package/dist/ops-blueprint/generate.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"generate.d.ts","sourceRoot":"","sources":["../../src/ops-blueprint/generate.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+CG;AAEH,OAAO,KAAK,EACV,gBAAgB,EAChB,iBAAiB,EACjB,cAAc,EACd,iBAAiB,EACjB,aAAa,EAGd,MAAM,0BAA0B,CAAC;AAClC,OAAO,EAGL,KAAK,SAAS,EACd,KAAK,YAAY,EAIlB,MAAM,mBAAmB,CAAC;AAG3B,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAGxB,OAAO,EAEL,KAAK,qBAAqB,EAC1B,KAAK,qBAAqB,EAC3B,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EAAiB,KAAK,cAAc,EAAE,MAAM,aAAa,CAAC;AACjE,OAAO,EAAyB,KAAK,yBAAyB,EAAE,MAAM,iBAAiB,CAAC;AAsBxF;;;;;;GAMG;AACH,MAAM,WAAW,WAAW;IAC1B,CAAC,QAAQ,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CACxD;AAED;;GAEG;AACH,MAAM,WAAW,4BAA4B;IAC3C;;;;OAIG;IACH,QAAQ,CAAC,QAAQ,EAAE,iBAAiB,CAAC;IACrC;;;OAGG;IACH,QAAQ,CAAC,cAAc,EAAE,cAAc,CAAC;IACxC;;;;;;;OAOG;IACH,QAAQ,CAAC,aAAa,CAAC,EAAE,CAAC,KAAK,EAAE,MAAM,KAAK,OAAO,CAAC,SAAS,SAAS,EAAE,CAAC,CAAC;IAC1E;;;;;;;OAOG;IACH,QAAQ,CAAC,gBAAgB,CAAC,EAAE,gBAAgB,CAAC;IAC7C;;;;;OAKG;IACH,QAAQ,CAAC,UAAU,EAAE,CACnB,GAAG,EAAE,cAAc,KAChB,OAAO,CAAC,qBAAqB,GAAG,IAAI,CAAC,GAAG,qBAAqB,GAAG,IAAI,CAAC;IAC1E;;;;OAIG;IACH,QAAQ,CAAC,UAAU,EAAE,iBAAiB,CAAC;IACvC;;;;;;OAMG;IACH,QAAQ,CAAC,OAAO,CAAC,EAAE,WAAW,CAAC;IAC/B;;;;;;;;;;;;;;;;;;;;OAoBG;IACH,QAAQ,CAAC,aAAa,CAAC,EAAE,qBAAqB,CAAC;IAC/C;;;;OAIG;IACH,QAAQ,CAAC,SAAS,CAAC,EAAE,aAAa,CAAC;IACnC;;;OAGG;IACH,QAAQ,CAAC,GAAG,CAAC,EAAE,MAAM,MAAM,CAAC;IAC5B;;;OAGG;IACH,QAAQ,CAAC,eAAe,CAAC,EAAE,MAAM,MAAM,CAAC;IACxC;;;;;;;OAOG;IACH,QAAQ,CAAC,kBAAkB,CAAC,EAAE,yBAAyB,CAAC;CACzD;AAmCD,wBAAgB,qCAAqC,CACnD,IAAI,EAAE,4BAA4B;;;;;;;;;;;;;;;;;;;;;;;GA4QnC"}
+{"version":3,"file":"generate.d.ts","sourceRoot":"","sources":["../../src/ops-blueprint/generate.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+CG;AAEH,OAAO,KAAK,EACV,gBAAgB,EAChB,iBAAiB,EACjB,cAAc,EACd,iBAAiB,EACjB,aAAa,EAGd,MAAM,0BAA0B,CAAC;AAClC,OAAO,EAGL,KAAK,SAAS,EACd,KAAK,YAAY,EAIlB,MAAM,mBAAmB,CAAC;AAG3B,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAGxB,OAAO,EAEL,KAAK,qBAAqB,EAC1B,KAAK,qBAAqB,EAC3B,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EAAiB,KAAK,cAAc,EAAE,MAAM,aAAa,CAAC;AACjE,OAAO,EAAyB,KAAK,yBAAyB,EAAE,MAAM,iBAAiB,CAAC;AAsBxF;;;;;;GAMG;AACH,MAAM,WAAW,WAAW;IAC1B,CAAC,QAAQ,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CACxD;AAED;;GAEG;AACH,MAAM,WAAW,4BAA4B;IAC3C;;;;OAIG;IACH,QAAQ,CAAC,QAAQ,EAAE,iBAAiB,CAAC;IACrC;;;OAGG;IACH,QAAQ,CAAC,cAAc,EAAE,cAAc,CAAC;IACxC;;;;;;;OAOG;IACH,QAAQ,CAAC,aAAa,CAAC,EAAE,CAAC,KAAK,EAAE,MAAM,KAAK,OAAO,CAAC,SAAS,SAAS,EAAE,CAAC,CAAC;IAC1E;;;;;;;OAOG;IACH,QAAQ,CAAC,gBAAgB,CAAC,EAAE,gBAAgB,CAAC;IAC7C;;;;;OAKG;IACH,QAAQ,CAAC,UAAU,EAAE,CACnB,GAAG,EAAE,cAAc,KAChB,OAAO,CAAC,qBAAqB,GAAG,IAAI,CAAC,GAAG,qBAAqB,GAAG,IAAI,CAAC;IAC1E;;;;OAIG;IACH,QAAQ,CAAC,UAAU,EAAE,iBAAiB,CAAC;IACvC;;;;;;OAMG;IACH,QAAQ,CAAC,OAAO,CAAC,EAAE,WAAW,CAAC;IAC/B;;;;;;;;;;;;;;;;;;;;OAoBG;IACH,QAAQ,CAAC,aAAa,CAAC,EAAE,qBAAqB,CAAC;IAC/C;;;;OAIG;IACH,QAAQ,CAAC,SAAS,CAAC,EAAE,aAAa,CAAC;IACnC;;;OAGG;IACH,QAAQ,CAAC,GAAG,CAAC,EAAE,MAAM,MAAM,CAAC;IAC5B;;;OAGG;IACH,QAAQ,CAAC,eAAe,CAAC,EAAE,MAAM,MAAM,CAAC;IACxC;;;;;;;OAOG;IACH,QAAQ,CAAC,kBAAkB,CAAC,EAAE,yBAAyB,CAAC;CACzD;AA2CD,wBAAgB,qCAAqC,CACnD,IAAI,EAAE,4BAA4B;;;;;;;;;;;;;;;;;;;;;;;;GA+RnC"}

package/dist/ops-blueprint/generate.js

@@ -103,6 +103,13 @@ function resolveGenerator(registry, slug) {
     }
     return found;
 }
+/**
+ * The generation prompt when a call carries neither `intent` nor
+ * `seedPrompt`. Kept for one release with the observable
+ * `blueprint.generate_prompt_placeholder` event; the following release
+ * refuses such a call (`prompt_required`) instead.
+ */
+const GENERATION_PROMPT_PLACEHOLDER = "Operator-authored blueprint variant";
 export function createGguiOpsGenerateBlueprintHandler(deps) {
     const now = deps.now ?? (() => new Date().toISOString());
     const mintBlueprintId = deps.mintBlueprintId ?? (() => `bp_${randomUUID()}`);
@@ -194,11 +201,30 @@ export function createGguiOpsGenerateBlueprintHandler(deps) {
             if (creds === null) {
                 throw new MissingCredentialsError();
             }
-            // 5. Dispatch through the generator.
+            // 5. Dispatch through the generator. The generation prompt is the
+            // request's own sentence: `intent` (prompt-only, never persisted —
+            // not a variance member, so the cache identity is unchanged), else
+            // the variance's `seedPrompt`. Neither present: the placeholder,
+            // made observable — the classifier reads the render axis from THIS
+            // prompt, and a placeholder reads every board as a list.
+            const generationPrompt = parsed.intent ?? parsed.seedPrompt;
+            if (generationPrompt === undefined) {
+                try {
+                    deps.telemetry?.emit({
+                        name: "blueprint.generate_prompt_placeholder",
+                        at: Date.now(),
+                        attributes: { appId, requestId: ctx.requestId, reason: "no-intent-no-seedPrompt" },
+                    });
+                }
+                catch {
+                    // Swallow telemetry-side throws — they MUST NOT affect
+                    // handler correctness.
+                }
+            }
             const generateInput = {
                 request: {
                     sessionId: `ops_gen_${randomUUID()}`,
-                    prompt: parsed.seedPrompt ?? "Operator-authored blueprint variant",
+                    prompt: generationPrompt ?? GENERATION_PROMPT_PLACEHOLDER,
                 },
                 blueprints: deps.blueprints,
                 contract,
@@ -271,7 +297,8 @@ export function createGguiOpsGenerateBlueprintHandler(deps) {
             // ops call since the primary store.put already succeeded.
             if (deps.cacheRegistry) {
                 try {
-                    const intentForCache = parsed.seedPrompt ??
+                    const intentForCache = parsed.intent ??
+                        parsed.seedPrompt ??
                         normalizedPersona ??
                         `operator-authored blueprint (${blueprintId})`;
                     await registerBlueprint(deps.cacheRegistry, appId, {

package/dist/ops-blueprint/register.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"register.d.ts","sourceRoot":"","sources":["../../src/ops-blueprint/register.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAoCG;AAEH,OAAO,KAAK,EACV,gBAAgB,EAChB,cAAc,EACd,aAAa,EACd,MAAM,0BAA0B,CAAC;AAClC,OAAO,EAEL,KAAK,SAAS,EACd,KAAK,YAAY,EAGjB,KAAK,mBAAmB,EACzB,MAAM,mBAAmB,CAAC;AAG3B,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAGxB,OAAO,EAAqB,KAAK,qBAAqB,EAAE,MAAM,qBAAqB,CAAC;AAEpF,OAAO,EAAyB,KAAK,yBAAyB,EAAE,MAAM,iBAAiB,CAAC;AACxF,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,eAAe,CAAC;AAiBjD;;;;;GAKG;AACH,MAAM,WAAW,4BAA4B;IAC3C;;;OAGG;IACH,QAAQ,CAAC,cAAc,EAAE,cAAc,CAAC;IACxC;;;OAGG;IACH,QAAQ,CAAC,aAAa,CAAC,EAAE,CAAC,KAAK,EAAE,MAAM,KAAK,OAAO,CAAC,SAAS,SAAS,EAAE,CAAC,CAAC;IAC1E;;;;;;;OAOG;IACH,QAAQ,CAAC,gBAAgB,CAAC,EAAE,gBAAgB,CAAC;IAC7C;;;;;;OAMG;IACH,QAAQ,CAAC,OAAO,CAAC,EAAE,WAAW,CAAC;IAC/B;;;;;;;;OAQG;IACH,QAAQ,CAAC,aAAa,CAAC,EAAE,qBAAqB,CAAC;IAC/C;;;;OAIG;IACH,QAAQ,CAAC,SAAS,CAAC,EAAE,aAAa,CAAC;IACnC;;OAEG;IACH,QAAQ,CAAC,GAAG,CAAC,EAAE,MAAM,MAAM,CAAC;IAC5B;;OAEG;IACH,QAAQ,CAAC,eAAe,CAAC,EAAE,MAAM,MAAM,CAAC;IACxC;;;;;;;OAOG;IACH,QAAQ,CAAC,kBAAkB,CAAC,EAAE,yBAAyB,CAAC;CACzD;AAED,wBAAgB,qCAAqC,CACnD,IAAI,EAAE,4BAA4B;;;;;;;;;;;;;;;;;;;GAwLnC"}
+{"version":3,"file":"register.d.ts","sourceRoot":"","sources":["../../src/ops-blueprint/register.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAoCG;AAEH,OAAO,KAAK,EACV,gBAAgB,EAChB,cAAc,EACd,aAAa,EACd,MAAM,0BAA0B,CAAC;AAClC,OAAO,EAEL,KAAK,SAAS,EACd,KAAK,YAAY,EAGjB,KAAK,mBAAmB,EACzB,MAAM,mBAAmB,CAAC;AAG3B,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAGxB,OAAO,EAAqB,KAAK,qBAAqB,EAAE,MAAM,qBAAqB,CAAC;AAEpF,OAAO,EAAyB,KAAK,yBAAyB,EAAE,MAAM,iBAAiB,CAAC;AACxF,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,eAAe,CAAC;AAiBjD;;;;;GAKG;AACH,MAAM,WAAW,4BAA4B;IAC3C;;;OAGG;IACH,QAAQ,CAAC,cAAc,EAAE,cAAc,CAAC;IACxC;;;OAGG;IACH,QAAQ,CAAC,aAAa,CAAC,EAAE,CAAC,KAAK,EAAE,MAAM,KAAK,OAAO,CAAC,SAAS,SAAS,EAAE,CAAC,CAAC;IAC1E;;;;;;;OAOG;IACH,QAAQ,CAAC,gBAAgB,CAAC,EAAE,gBAAgB,CAAC;IAC7C;;;;;;OAMG;IACH,QAAQ,CAAC,OAAO,CAAC,EAAE,WAAW,CAAC;IAC/B;;;;;;;;OAQG;IACH,QAAQ,CAAC,aAAa,CAAC,EAAE,qBAAqB,CAAC;IAC/C;;;;OAIG;IACH,QAAQ,CAAC,SAAS,CAAC,EAAE,aAAa,CAAC;IACnC;;OAEG;IACH,QAAQ,CAAC,GAAG,CAAC,EAAE,MAAM,MAAM,CAAC;IAC5B;;OAEG;IACH,QAAQ,CAAC,eAAe,CAAC,EAAE,MAAM,MAAM,CAAC;IACxC;;;;;;;OAOG;IACH,QAAQ,CAAC,kBAAkB,CAAC,EAAE,yBAAyB,CAAC;CACzD;AAED,wBAAgB,qCAAqC,CACnD,IAAI,EAAE,4BAA4B;;;;;;;;;;;;;;;;;;;GAkMnC"}

package/dist/ops-blueprint/register.js

@@ -131,6 +131,18 @@ export function createGguiOpsRegisterBlueprintHandler(deps) {
             const componentCode = parsed.componentCode;
             const codeHash = createHash("sha256").update(componentCode).digest("hex");
             const blueprintId = mintBlueprintId();
+            // ONE variance for BOTH stores. The cache row's exact key is
+            // `variantKey(variance)`; omitting it on the cache call filed every
+            // variant under the default-variant key, where an earlier registration
+            // of the same contract already sat — the mirror then returned THAT row
+            // and the new variant was never bound (the durable row said one thing,
+            // the served index another). Same rule as ops_generate.
+            const variance = {
+                ...(normalizedPersona !== undefined ? { persona: normalizedPersona } : {}),
+                ...(parsed.aesthetic !== undefined ? { aesthetic: parsed.aesthetic } : {}),
+                ...(parsed.context !== undefined ? { context: parsed.context } : {}),
+                ...(parsed.seedPrompt !== undefined ? { seedPrompt: parsed.seedPrompt } : {}),
+            };
             const blueprint = {
                 blueprintId,
                 contractHash,
@@ -140,12 +152,7 @@ export function createGguiOpsRegisterBlueprintHandler(deps) {
                 // user arm on BOTH stores this handler writes (MVB row here,
                 // cache mirror below). No engine claim exists to record.
                 source: USER_SOURCE,
-                variance: {
-                    ...(normalizedPersona !== undefined ? { persona: normalizedPersona } : {}),
-                    ...(parsed.aesthetic !== undefined ? { aesthetic: parsed.aesthetic } : {}),
-                    ...(parsed.context !== undefined ? { context: parsed.context } : {}),
-                    ...(parsed.seedPrompt !== undefined ? { seedPrompt: parsed.seedPrompt } : {}),
-                },
+                variance,
                 createdAt: now(),
                 createdBy: "operator",
                 contract,
@@ -172,6 +179,9 @@ export function createGguiOpsRegisterBlueprintHandler(deps) {
                         // Same user-arm provenance as the MVB row above — one
                         // handler call, one provenance claim across both stores.
                         source: USER_SOURCE,
+                        // The cache row MUST carry the same variance as the MVB row —
+                        // its exact key is `variantKey(variance)`.
+                        variance,
                         // An operator invoked this tool. Without it the durable
                         // record would claim the standard agent flow minted a row
                         // that is retained permanently.

package/dist/renders/consume.js

@@ -68,7 +68,7 @@ export function createGguiConsumeHandler(deps) {
         name: 'ggui_consume',
         title: 'Consume',
         audience: ['agent'],
-        description: 'Long-poll for buffered events on a GguiSession. CALL THIS RIGHT AFTER EVERY `ggui_render` THAT RETURNS `nextStep.tool === "ggui_consume"` — that hint is your cue to start listening for the user\'s gesture. Keyed by sessionId (global UUID); app-scoped via ctx.appId. Inline long-poll: `timeout` is an integer in [0, 25] seconds (default 0 — an instant non-blocking drain; values outside reject INVALID_PARAMS — host MCP clients abort longer tool calls; pick 5-15s typical, 25 max). Returns `{events, status}` — each event carries `{type: "action", sessionId, intent, actionData, uiContext, actionId, firedAt}`: `actionData` is WHAT the user did, `uiContext` is the iframe-local snapshot of the contract\'s contextSpec slots AT THE MOMENT they did it. Both inform your reaction without a second round trip. Returns immediately when an action event arrives OR the render completes OR the timeout elapses. On timeout with no event you may re-call once, then end your turn — a later gesture arrives as a new user message.  THE LOOP: when `events` is non-empty, REACT, then re-call `ggui_consume` for the next gesture; when `events` is empty, end your turn — a later gesture arrives as a new user message carrying its own consume directive. status:"expired" means the render is gone.  IMPORTANT — the iframe state is independent of your backend state: after you mutate via domain tools (todo_toggle, cart_add, etc.), the UI still shows the OLD props until you call `ggui_amend`. If the events caused observable state changes the user is looking at, your reaction MUST include `ggui_amend` somewhere before re-consuming; otherwise the user sees stale props (the #1 wire compliance bug). Pure-info events that don\'t change displayed state can skip it. `ggui_amend` repaints the SAME card in place (the default move in this loop); `ggui_update` instead renders the state as a NEW card and advances the history number — reserve it for milestones worth a card in the transcript.  HOSTS WITH PROGRESSIVE TOOL DISCOVERY (claude.ai-style connectors): if a call here errors with "tool not loaded yet" or "wrong parameter names," call `tool_search({query:"ggui_consume"})` once to warm the tool, then retry with the same args. DO NOT skip the consume — silent gesture drops are the worst protocol failure.',
+        description: 'Long-poll for buffered events on a GguiSession. CALL THIS RIGHT AFTER EVERY `ggui_render` THAT RETURNS `nextStep.tool === "ggui_consume"` — that hint is your cue to start listening for the user\'s gesture. Keyed by sessionId (global UUID); app-scoped via ctx.appId. Inline long-poll: `timeout` is an integer in [0, 25] seconds (default 0 — an instant non-blocking drain; values outside reject INVALID_PARAMS — host MCP clients abort longer tool calls; pick 5-15s typical, 25 max). Returns `{events, status}` — each event carries `{type: "action", sessionId, intent, actionData, uiContext, actionId, firedAt}`: `actionData` is WHAT the user did, `uiContext` is the iframe-local snapshot of the contract\'s contextSpec slots AT THE MOMENT they did it. Both inform your reaction without a second round trip. Returns immediately when an action event arrives OR the render completes OR the timeout elapses. On timeout with no event you may re-call once, then end your turn — a later gesture arrives as a new user message.  THE LOOP: when `events` is non-empty, REACT, then re-call `ggui_consume` for the next gesture; when `events` is empty, end your turn — a later gesture arrives as a new user message carrying its own consume directive. status:"expired" means the render is gone.  IMPORTANT — the iframe state is independent of your backend state: after you mutate via domain tools (todo_toggle, cart_add, etc.), the UI still shows the OLD props until you call `ggui_amend`. If the events caused observable state changes the user is looking at, your reaction MUST include `ggui_amend` somewhere before re-consuming; otherwise the user sees stale props (the #1 wire compliance bug). Pure-info events that don\'t change displayed state can skip it. `ggui_amend` repaints the SAME card in place (the default move in this loop); `ggui_update` instead renders the state as a NEW card and advances the history number — reserve it for milestones worth a card in the transcript.  HOSTS WITH PROGRESSIVE TOOL DISCOVERY (claude.ai-style connectors): if a call here errors with "tool not loaded yet" or "wrong parameter names," call `tool_search({query:"ggui_consume"})` once to warm the tool, then retry with the same args. DO NOT skip the consume — silent gesture drops are the worst protocol failure. IDEMPOTENCY: treat the `actionId` on each entry as an idempotency key and apply a side-effecting action AT MOST ONCE per `actionId` — the same id delivered twice is one gesture replayed, never two. This holds for EVERY action, not only those a contract marks `oneShot`: a card served mid-rollout may be running a runtime that suppresses nothing, and keying on the marker would leave a hole exactly there. Two DISTINCT ids are two distinct gestures and both are real.',
         inputSchema,
         outputSchema,
         async handler(rawInput, ctx) {

package/dist/renders/runtime-pull.d.ts

@@ -48,6 +48,15 @@
  *     retention window). Client recovery: re-mount from a fresh
  *     snapshot and reset the cursor to `currentSequence`.
  *
+ * **The puller's obligation (ggui#1030).** `wait` MUST NOT exceed the
+ * `tools/call` timeout of the host relaying the call, minus a margin; a
+ * host that relays a pull MUST clamp the forwarded `wait` to its own
+ * timeout − 1 s. A host timeout below the hold is a CALLER-side failure:
+ * the server's `success` after the socket closed is not a server fault,
+ * and the rung MUST demote to sparse un-held pulls on such failures as it
+ * does on consecutive empties — otherwise a hot `wait` under a short host
+ * timeout is a polling storm that never demotes.
+ *
  * **Failure modes:**
  *   - Unknown sessionId, cross-app sessionId, and a render deleted
  *     mid-read all surface uniformly as

package/dist/renders/runtime-pull.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"runtime-pull.d.ts","sourceRoot":"","sources":["../../src/renders/runtime-pull.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAqEG;AACH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAQxB,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,0BAA0B,CAAC;AAiCjE,MAAM,WAAW,0BAA0B;IACzC;;;;OAIG;IACH,QAAQ,CAAC,WAAW,EAAE,gBAAgB,CAAC;IACvC;;;;;;;;OAQG;IACH,QAAQ,CAAC,mBAAmB,CAAC,EAAE,MAAM,CAAC;CACvC;AAED;;;GAGG;AACH,wBAAgB,4BAA4B,CAAC,IAAI,EAAE,0BAA0B;;;;;;IArC3E,4EAA4E;;;;;;;IAE5E,6FAA6F;;IAE7F,sFAAsF;;IAEtF,qGAAqG;;IAErG,kFAAkF;;;;;;;;;;;;;GAgInF"}
+{"version":3,"file":"runtime-pull.d.ts","sourceRoot":"","sources":["../../src/renders/runtime-pull.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8EG;AACH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAQxB,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,0BAA0B,CAAC;AAiCjE,MAAM,WAAW,0BAA0B;IACzC;;;;OAIG;IACH,QAAQ,CAAC,WAAW,EAAE,gBAAgB,CAAC;IACvC;;;;;;;;OAQG;IACH,QAAQ,CAAC,mBAAmB,CAAC,EAAE,MAAM,CAAC;CACvC;AAED;;;GAGG;AACH,wBAAgB,4BAA4B,CAAC,IAAI,EAAE,0BAA0B;;;;;;IArC3E,4EAA4E;;;;;;;IAE5E,6FAA6F;;IAE7F,sFAAsF;;IAEtF,qGAAqG;;IAErG,kFAAkF;;;;;;;;;;;;;GAwJnF"}

package/dist/renders/runtime-pull.js

@@ -48,6 +48,15 @@
  *     retention window). Client recovery: re-mount from a fresh
  *     snapshot and reset the cursor to `currentSequence`.
  *
+ * **The puller's obligation (ggui#1030).** `wait` MUST NOT exceed the
+ * `tools/call` timeout of the host relaying the call, minus a margin; a
+ * host that relays a pull MUST clamp the forwarded `wait` to its own
+ * timeout − 1 s. A host timeout below the hold is a CALLER-side failure:
+ * the server's `success` after the socket closed is not a server fault,
+ * and the rung MUST demote to sparse un-held pulls on such failures as it
+ * does on consecutive empties — otherwise a hot `wait` under a short host
+ * timeout is a polling storm that never demotes.
+ *
  * **Failure modes:**
  *   - Unknown sessionId, cross-app sessionId, and a render deleted
  *     mid-read all surface uniformly as
@@ -137,8 +146,14 @@ export function createGguiRuntimePullHandler(deps) {
             }
             const deadline = Date.now() + waitMs;
             // Hold loop: one immediate read, then — empty page + time left —
-            // probe the store at `probeIntervalMs` until an event lands or
-            // the hold elapses. The probe is a STORE read on purpose: the
+            // probe the store at `probeIntervalMs` until an event lands, the
+            // hold elapses, or the CALLER GOES AWAY (`ctx.signal`: the MCP
+            // cancel notification or the transport closing — ggui#1026: a
+            // relay that times out its own call at 5 s used to leave this
+            // loop probing the store into a closed socket for the full hold).
+            // An aborted hold resolves the empty page — never a throw — so
+            // the caller-side contract is the same as a hold that elapsed.
+            // The probe is a STORE read on purpose: the
             // event that ends this hold may be committed by another replica, and
             // the store is the only cross-replica truth available here. Horizon
             // results and non-empty pages return immediately regardless of
@@ -164,7 +179,9 @@ export function createGguiRuntimePullHandler(deps) {
                         currentSequence: result.lastSequence,
                     };
                 }
-                if (result.events.length > 0 || Date.now() >= deadline) {
+                if (result.events.length > 0 ||
+                    Date.now() >= deadline ||
+                    ctx.signal?.aborted === true) {
                     // Events to deliver, or the hold elapsed — an empty page
                     // after a full hold is a NORMAL result (the client stays
                     // subscribed by immediately re-pulling).
@@ -175,8 +192,24 @@ export function createGguiRuntimePullHandler(deps) {
                         hasMore: result.hasMore,
                     };
                 }
+                // Sleep one probe interval, or less: the caller aborting ends
+                // the wait immediately (the loop then returns the empty page).
                 await new Promise((resolve) => {
-                    setTimeout(resolve, probeIntervalMs);
+                    const signal = ctx.signal;
+                    const onAbort = () => {
+                        clearTimeout(timer);
+                        resolve();
+                    };
+                    const timer = setTimeout(() => {
+                        signal?.removeEventListener('abort', onAbort);
+                        resolve();
+                    }, probeIntervalMs);
+                    if (signal !== undefined) {
+                        if (signal.aborted)
+                            onAbort();
+                        else
+                            signal.addEventListener('abort', onAbort, { once: true });
+                    }
                 });
             }
         },

package/dist/renders/slice-meta-derivation.d.ts

@@ -288,7 +288,15 @@ export declare function deriveBundleOrigins(item: GguiSession): {
  * doesn't need to know about CSP directive serialization details;
  * this is the one place that maps the buckets to header syntax.
  */
-export declare function composeContentSecurityPolicy(origins: ReturnType<typeof deriveBundleOrigins>): string | undefined;
+export declare function composeContentSecurityPolicy(origins: ReturnType<typeof deriveBundleOrigins>, 
+/**
+ * The render's stored theme (ggui#1093): a declared face's origin is
+ * admitted under `font-src`, an imagery slot's under `img-src`. The
+ * schema already guarantees `https:` + a well-formed host, so the
+ * origin is read, never re-validated. Absent, or a theme declaring
+ * neither, leaves the CSP byte-identical to the gadget-only form.
+ */
+theme?: Pick<AppTheme, 'fonts' | 'imagery'>): string | undefined;
 /**
  * JSON-stringify the active render's `props` field. Returns
  * `undefined` when no props are present or when serialization fails

package/dist/renders/slice-meta-derivation.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"slice-meta-derivation.d.ts","sourceRoot":"","sources":["../../src/renders/slice-meta-derivation.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAoCG;AACH,OAAO,EAKL,KAAK,QAAQ,EACb,KAAK,gBAAgB,EACrB,KAAK,UAAU,EACf,KAAK,SAAS,EACd,KAAK,WAAW,EACjB,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EAGL,KAAK,sBAAsB,EAC5B,MAAM,yCAAyC,CAAC;AACjD,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,mBAAmB,CAAC;AAMhE;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAoDG;AACH,wBAAgB,iBAAiB,CAC/B,KAAK,EAAE,OAAO,CACZ,IAAI,CACF,gBAAgB,EAChB,WAAW,GAAG,YAAY,GAAG,UAAU,GAAG,SAAS,GAAG,SAAS,CAChE,CACF,GACA;IAAE,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAA;CAAE,CAY7D;AA6ED;;;;GAIG;AACH,eAAO,MAAM,qBAAqB,sBAAsB,CAAC;AAEzD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAkCG;AACH,wBAAsB,wBAAwB,CAC5C,IAAI,EAAE,WAAW,EACjB,OAAO,CAAC,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,OAAO,CAAC,MAAM,CAAC,GACzC,OAAO,CAAC,WAAW,CAAC,CAoCtB;AAED;;;;;;;;;;;;;;;;;;GAkBG;AACH,wBAAgB,kBAAkB,CAChC,IAAI,EAAE,WAAW,GAChB,aAAa,CAAC;IACf,IAAI,EAAE,MAAM,CAAC;IACb,WAAW,EAAE,MAAM,CAAC;IACpB,MAAM,EAAE,UAAU,CAAC;IACnB,OAAO,EAAE,SAAS,CAAC;IACnB,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB,CAAC,GAAG,SAAS,CA+Cb;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6BG;AACH,wBAAgB,uBAAuB,CACrC,IAAI,EAAE,WAAW,GAChB,SAAS,MAAM,EAAE,GAAG,SAAS,CA4B/B;AAED;;;;;;;;;GASG;AACH,wBAAgB,WAAW,CAAC,IAAI,EAAE,WAAW,GAAG,QAAQ,GAAG,SAAS,CAEnE;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAmCG;AACH,wBAAgB,mBAAmB,CACjC,IAAI,EAAE,WAAW,GAChB;IAAE,MAAM,EAAE,SAAS,MAAM,EAAE,CAAC;IAAC,KAAK,EAAE,SAAS,MAAM,EAAE,CAAC;IAAC,OAAO,EAAE,SAAS,MAAM,EAAE,CAAA;CAAE,GAAG,SAAS,CA+DjG;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAyCG;AACH,wBAAgB,4BAA4B,CAC1C,OAAO,EAAE,UAAU,CAAC,OAAO,mBAAmB,CAAC,GAC9C,MAAM,GAAG,SAAS,CAiBpB;AAED;;;;;;;;;;;;GAYG;AACH,wBAAgB,eAAe,CAAC,IAAI,EAAE,WAAW,GAAG,MAAM,GAAG,SAAS,CAOrE;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,MAAM,WAAW,cAAc;IAC7B,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC;IACvB,8EAA8E;IAC9E,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC;IAC5B;;;;;;;;;;;OAWG;IACH,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,YAAY,CAAC,EAAE,aAAa,CAAC;QACpC,IAAI,EAAE,MAAM,CAAC;QACb,WAAW,EAAE,MAAM,CAAC;QACpB,MAAM,EAAE,UAAU,CAAC;QACnB,OAAO,EAAE,SAAS,CAAC;QACnB,UAAU,CAAC,EAAE,MAAM,CAAC;KACrB,CAAC,CAAC;IACH;;;;;;;;;;;;;;;;OAgBG;IACH,QAAQ,CAAC,iBAAiB,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IAC/C;;;;;;;;;;;OAWG;IACH,QAAQ,CAAC,qBAAqB,CAAC,EAAE,MAAM,CAAC;IACxC;;;;;;;;;;;;;;;OAeG;IACH,QAAQ,CAAC,OAAO,CAAC,EAAE,aAAa,CAAC;QAC/B,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;QACzB,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC;QAC5B;;;2BAGmB;QACnB,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC;KAC7B,CAAC,CAAC;IACH;;;;;;;;;;;OAWG;IACH,QAAQ,CAAC,KAAK,CAAC,EAAE,QAAQ,CAAC;CAS3B;AAED;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,wBAAgB,yBAAyB,CACvC,IAAI,EAAE,WAAW,EACjB,YAAY,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,GAAG,SAAS,GACzD,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,GAAG,SAAS,CA0B9C;AAED;;;;;;;;;;;;;;;;;;;GAmBG;AACH,wBAAgB,yBAAyB,CACvC,IAAI,EAAE,WAAW,GAChB,aAAa,CAAC;IACf,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC;CAC7B,CAAC,GAAG,SAAS,CAwCb;AAED;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,wBAAsB,oBAAoB,CACxC,IAAI,EAAE,WAAW,GAChB,OAAO,CACN;IACE,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;IAC9B,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;IAC9B,QAAQ,CAAC,UAAU,EAAE,sBAAsB,CAAC;CAC7C,GACD,SAAS,CACZ,CAQA;AAED;;;;;;GAMG;AACH,eAAO,MAAM,kBAAkB,SAAU,CAAC;AAgB1C;;;;;;;;;;;GAWG;AACH;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAgB,6BAA6B,CAC3C,IAAI,EAAE,cAAc,GAAG,SAAS,GAC/B,IAAI,CACL,sBAAsB,EACtB,OAAO,GAAG,WAAW,GAAG,cAAc,GAAG,mBAAmB,GAAG,OAAO,GAAG,SAAS,CACnF,CAgBA;AAED,wBAAgB,gBAAgB,CAC9B,IAAI,EAAE,WAAW,GAChB,cAAc,CAsDhB;AAED;;;;;;;;;;GAUG;AACH,MAAM,WAAW,mBAAmB;IAClC;;;;;;;;;;;;;;;OAeG;IACH,QAAQ,CAAC,WAAW,CAAC,EAAE,CACrB,SAAS,EAAE,MAAM,EACjB,KAAK,EAAE,MAAM,KACV;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAC;QAAC,SAAS,EAAE,MAAM,CAAA;KAAE,CAAC;IACzD;;;;;;;;;;;;;;;;;OAiBG;IACH,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,GAAG,CAAC,MAAM,MAAM,GAAG,SAAS,CAAC,CAAC;IAC1D;;;;;;;OAOG;IACH,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC;IAC1B,6DAA6D;IAC7D,QAAQ,CAAC,SAAS,CAAC,EAAE,OAAO,GAAG,MAAM,CAAC;IACtC;;;;;;;;OAQG;IACH,QAAQ,CAAC,aAAa,CAAC,EAAE,MACrB;QACE,QAAQ,CAAC,EAAE,CAAC,EAAE,MAAM,CAAC;QACrB,QAAQ,CAAC,IAAI,CAAC,EAAE,OAAO,GAAG,MAAM,CAAC;KAClC,GACD,SAAS,CAAC;IACd;;;;;;;;;;;;;OAaG;IACH,QAAQ,CAAC,uBAAuB,CAAC,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,OAAO,CAAC,MAAM,CAAC,CAAC;IACpE;;;;;;;;;;;;;;;;;OAiBG;IACH,QAAQ,CAAC,iBAAiB,CAAC,EAAE,MAAM,GAAG,CAAC,MAAM,MAAM,GAAG,SAAS,CAAC,CAAC;CAClE;AAED;;;;;;;;GAQG;AACH,wBAAgB,oBAAoB,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAMtE;AAED;;;GAGG;AACH,MAAM,WAAW,eAAe;IAC9B,wEAAwE;IACxE,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B;;;OAGG;IACH,QAAQ,CAAC,UAAU,EAAE,OAAO,CAC1B,IAAI,CAAC,sBAAsB,EAAE,OAAO,GAAG,SAAS,GAAG,WAAW,CAAC,CAChE,CAAC;IACF;;;;;;OAMG;IACH,QAAQ,CAAC,WAAW,EAAE,OAAO,CAC3B,IAAI,CAAC,sBAAsB,EAAE,YAAY,GAAG,QAAQ,CAAC,CACtD,CAAC;IACF,6DAA6D;IAC7D,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC;IAC1B,wDAAwD;IACxD,QAAQ,CAAC,SAAS,CAAC,EAAE,OAAO,GAAG,MAAM,CAAC;CACvC;AAED;;;;;GAKG;AACH,MAAM,MAAM,cAAc,GAAG,IAAI,CAC/B,mBAAmB,EACnB,SAAS,GAAG,WAAW,GAAG,eAAe,CAC1C,CAAC;AAEF,oFAAoF;AACpF,MAAM,MAAM,UAAU,GAAG,IAAI,CAAC,eAAe,EAAE,SAAS,GAAG,WAAW,CAAC,CAAC;AAExE;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgCG;AACH,wBAAgB,iBAAiB,CAC/B,IAAI,EAAE,cAAc,EACpB,aAAa,EAAE,MAAM,GAAG,SAAS,EACjC,gBAAgB,EAAE,OAAO,GAAG,MAAM,GAAG,SAAS,GAC7C,UAAU,CAqBZ;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAgB,uBAAuB,CACrC,IAAI,EAAE,mBAAmB,EACzB,IAAI,EAAE;IACJ,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,kEAAkE;IAClE,QAAQ,CAAC,aAAa,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAC5C;;;;;;OAMG;IACH,QAAQ,CAAC,gBAAgB,EAAE,OAAO,GAAG,MAAM,GAAG,SAAS,CAAC;CACzD,GACA,eAAe,CA4CjB"}
+{"version":3,"file":"slice-meta-derivation.d.ts","sourceRoot":"","sources":["../../src/renders/slice-meta-derivation.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAoCG;AACH,OAAO,EAKL,KAAK,QAAQ,EACb,KAAK,gBAAgB,EACrB,KAAK,UAAU,EACf,KAAK,SAAS,EACd,KAAK,WAAW,EACjB,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EAGL,KAAK,sBAAsB,EAC5B,MAAM,yCAAyC,CAAC;AACjD,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,mBAAmB,CAAC;AAMhE;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAoDG;AACH,wBAAgB,iBAAiB,CAC/B,KAAK,EAAE,OAAO,CACZ,IAAI,CACF,gBAAgB,EAChB,WAAW,GAAG,YAAY,GAAG,UAAU,GAAG,SAAS,GAAG,SAAS,CAChE,CACF,GACA;IAAE,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAA;CAAE,CAY7D;AA6ED;;;;GAIG;AACH,eAAO,MAAM,qBAAqB,sBAAsB,CAAC;AAEzD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAkCG;AACH,wBAAsB,wBAAwB,CAC5C,IAAI,EAAE,WAAW,EACjB,OAAO,CAAC,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,OAAO,CAAC,MAAM,CAAC,GACzC,OAAO,CAAC,WAAW,CAAC,CAoCtB;AAED;;;;;;;;;;;;;;;;;;GAkBG;AACH,wBAAgB,kBAAkB,CAChC,IAAI,EAAE,WAAW,GAChB,aAAa,CAAC;IACf,IAAI,EAAE,MAAM,CAAC;IACb,WAAW,EAAE,MAAM,CAAC;IACpB,MAAM,EAAE,UAAU,CAAC;IACnB,OAAO,EAAE,SAAS,CAAC;IACnB,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB,CAAC,GAAG,SAAS,CA+Cb;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6BG;AACH,wBAAgB,uBAAuB,CACrC,IAAI,EAAE,WAAW,GAChB,SAAS,MAAM,EAAE,GAAG,SAAS,CA4B/B;AAED;;;;;;;;;GASG;AACH,wBAAgB,WAAW,CAAC,IAAI,EAAE,WAAW,GAAG,QAAQ,GAAG,SAAS,CAEnE;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAmCG;AACH,wBAAgB,mBAAmB,CACjC,IAAI,EAAE,WAAW,GAChB;IAAE,MAAM,EAAE,SAAS,MAAM,EAAE,CAAC;IAAC,KAAK,EAAE,SAAS,MAAM,EAAE,CAAC;IAAC,OAAO,EAAE,SAAS,MAAM,EAAE,CAAA;CAAE,GAAG,SAAS,CA+DjG;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAyCG;AACH,wBAAgB,4BAA4B,CAC1C,OAAO,EAAE,UAAU,CAAC,OAAO,mBAAmB,CAAC;AAC/C;;;;;;GAMG;AACH,KAAK,CAAC,EAAE,IAAI,CAAC,QAAQ,EAAE,OAAO,GAAG,SAAS,CAAC,GAC1C,MAAM,GAAG,SAAS,CA8BpB;AAMD;;;;;;;;;;;;GAYG;AACH,wBAAgB,eAAe,CAAC,IAAI,EAAE,WAAW,GAAG,MAAM,GAAG,SAAS,CAOrE;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,MAAM,WAAW,cAAc;IAC7B,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC;IACvB,8EAA8E;IAC9E,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC;IAC5B;;;;;;;;;;;OAWG;IACH,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,YAAY,CAAC,EAAE,aAAa,CAAC;QACpC,IAAI,EAAE,MAAM,CAAC;QACb,WAAW,EAAE,MAAM,CAAC;QACpB,MAAM,EAAE,UAAU,CAAC;QACnB,OAAO,EAAE,SAAS,CAAC;QACnB,UAAU,CAAC,EAAE,MAAM,CAAC;KACrB,CAAC,CAAC;IACH;;;;;;;;;;;;;;;;OAgBG;IACH,QAAQ,CAAC,iBAAiB,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IAC/C;;;;;;;;;;;OAWG;IACH,QAAQ,CAAC,qBAAqB,CAAC,EAAE,MAAM,CAAC;IACxC;;;;;;;;;;;;;;;OAeG;IACH,QAAQ,CAAC,OAAO,CAAC,EAAE,aAAa,CAAC;QAC/B,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;QACzB,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC;QAC5B;;;2BAGmB;QACnB,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC;KAC7B,CAAC,CAAC;IACH;;;;;;;;;;;OAWG;IACH,QAAQ,CAAC,KAAK,CAAC,EAAE,QAAQ,CAAC;CAS3B;AAED;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,wBAAgB,yBAAyB,CACvC,IAAI,EAAE,WAAW,EACjB,YAAY,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,GAAG,SAAS,GACzD,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,GAAG,SAAS,CA0B9C;AAED;;;;;;;;;;;;;;;;;;;GAmBG;AACH,wBAAgB,yBAAyB,CACvC,IAAI,EAAE,WAAW,GAChB,aAAa,CAAC;IACf,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC;CAC7B,CAAC,GAAG,SAAS,CAwCb;AAED;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,wBAAsB,oBAAoB,CACxC,IAAI,EAAE,WAAW,GAChB,OAAO,CACN;IACE,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;IAC9B,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;IAC9B,QAAQ,CAAC,UAAU,EAAE,sBAAsB,CAAC;CAC7C,GACD,SAAS,CACZ,CAQA;AAED;;;;;;GAMG;AACH,eAAO,MAAM,kBAAkB,SAAU,CAAC;AAgB1C;;;;;;;;;;;GAWG;AACH;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAgB,6BAA6B,CAC3C,IAAI,EAAE,cAAc,GAAG,SAAS,GAC/B,IAAI,CACL,sBAAsB,EACtB,OAAO,GAAG,WAAW,GAAG,cAAc,GAAG,mBAAmB,GAAG,OAAO,GAAG,SAAS,CACnF,CAgBA;AAED,wBAAgB,gBAAgB,CAC9B,IAAI,EAAE,WAAW,GAChB,cAAc,CAyDhB;AAED;;;;;;;;;;GAUG;AACH,MAAM,WAAW,mBAAmB;IAClC;;;;;;;;;;;;;;;OAeG;IACH,QAAQ,CAAC,WAAW,CAAC,EAAE,CACrB,SAAS,EAAE,MAAM,EACjB,KAAK,EAAE,MAAM,KACV;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAC;QAAC,SAAS,EAAE,MAAM,CAAA;KAAE,CAAC;IACzD;;;;;;;;;;;;;;;;;OAiBG;IACH,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,GAAG,CAAC,MAAM,MAAM,GAAG,SAAS,CAAC,CAAC;IAC1D;;;;;;;OAOG;IACH,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC;IAC1B,6DAA6D;IAC7D,QAAQ,CAAC,SAAS,CAAC,EAAE,OAAO,GAAG,MAAM,CAAC;IACtC;;;;;;;;OAQG;IACH,QAAQ,CAAC,aAAa,CAAC,EAAE,MACrB;QACE,QAAQ,CAAC,EAAE,CAAC,EAAE,MAAM,CAAC;QACrB,QAAQ,CAAC,IAAI,CAAC,EAAE,OAAO,GAAG,MAAM,CAAC;KAClC,GACD,SAAS,CAAC;IACd;;;;;;;;;;;;;OAaG;IACH,QAAQ,CAAC,uBAAuB,CAAC,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,OAAO,CAAC,MAAM,CAAC,CAAC;IACpE;;;;;;;;;;;;;;;;;OAiBG;IACH,QAAQ,CAAC,iBAAiB,CAAC,EAAE,MAAM,GAAG,CAAC,MAAM,MAAM,GAAG,SAAS,CAAC,CAAC;CAClE;AAED;;;;;;;;GAQG;AACH,wBAAgB,oBAAoB,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAMtE;AAED;;;GAGG;AACH,MAAM,WAAW,eAAe;IAC9B,wEAAwE;IACxE,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B;;;OAGG;IACH,QAAQ,CAAC,UAAU,EAAE,OAAO,CAC1B,IAAI,CAAC,sBAAsB,EAAE,OAAO,GAAG,SAAS,GAAG,WAAW,CAAC,CAChE,CAAC;IACF;;;;;;OAMG;IACH,QAAQ,CAAC,WAAW,EAAE,OAAO,CAC3B,IAAI,CAAC,sBAAsB,EAAE,YAAY,GAAG,QAAQ,CAAC,CACtD,CAAC;IACF,6DAA6D;IAC7D,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC;IAC1B,wDAAwD;IACxD,QAAQ,CAAC,SAAS,CAAC,EAAE,OAAO,GAAG,MAAM,CAAC;CACvC;AAED;;;;;GAKG;AACH,MAAM,MAAM,cAAc,GAAG,IAAI,CAC/B,mBAAmB,EACnB,SAAS,GAAG,WAAW,GAAG,eAAe,CAC1C,CAAC;AAEF,oFAAoF;AACpF,MAAM,MAAM,UAAU,GAAG,IAAI,CAAC,eAAe,EAAE,SAAS,GAAG,WAAW,CAAC,CAAC;AAExE;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgCG;AACH,wBAAgB,iBAAiB,CAC/B,IAAI,EAAE,cAAc,EACpB,aAAa,EAAE,MAAM,GAAG,SAAS,EACjC,gBAAgB,EAAE,OAAO,GAAG,MAAM,GAAG,SAAS,GAC7C,UAAU,CAqBZ;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAgB,uBAAuB,CACrC,IAAI,EAAE,mBAAmB,EACzB,IAAI,EAAE;IACJ,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,kEAAkE;IAClE,QAAQ,CAAC,aAAa,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAC5C;;;;;;OAMG;IACH,QAAQ,CAAC,gBAAgB,EAAE,OAAO,GAAG,MAAM,GAAG,SAAS,CAAC;CACzD,GACA,eAAe,CA4CjB"}

package/dist/renders/slice-meta-derivation.js

@@ -499,24 +499,45 @@ export function deriveBundleOrigins(item) {
  * doesn't need to know about CSP directive serialization details;
  * this is the one place that maps the buckets to header syntax.
  */
-export function composeContentSecurityPolicy(origins) {
-    if (origins === undefined)
-        return undefined;
+export function composeContentSecurityPolicy(origins, 
+/**
+ * The render's stored theme (ggui#1093): a declared face's origin is
+ * admitted under `font-src`, an imagery slot's under `img-src`. The
+ * schema already guarantees `https:` + a well-formed host, so the
+ * origin is read, never re-validated. Absent, or a theme declaring
+ * neither, leaves the CSP byte-identical to the gadget-only form.
+ */
+theme) {
     const directives = [];
-    if (origins.script.length > 0) {
+    if (origins !== undefined && origins.script.length > 0) {
         directives.push(`script-src 'self' 'unsafe-inline' ${origins.script.join(' ')}`);
     }
-    if (origins.style.length > 0) {
+    if (origins !== undefined && origins.style.length > 0) {
         directives.push(`style-src 'self' 'unsafe-inline' ${origins.style.join(' ')}`);
     }
-    if (origins.connect.length > 0) {
+    if (origins !== undefined && origins.connect.length > 0) {
         directives.push(`connect-src 'self' ${origins.connect.join(' ')}`);
-        directives.push(`img-src 'self' data: ${origins.connect.join(' ')}`);
+    }
+    // `img-src` is the union of the connect origins (a gadget's tiles)
+    // and the theme's imagery origins — deduped, declaration order.
+    const imageOrigins = dedupe([
+        ...(origins?.connect ?? []),
+        ...Object.values(theme?.imagery ?? {}).flatMap((slot) => slot !== undefined ? [new URL(slot.src).origin] : []),
+    ]);
+    if (imageOrigins.length > 0) {
+        directives.push(`img-src 'self' data: ${imageOrigins.join(' ')}`);
+    }
+    const fontOrigins = dedupe((theme?.fonts ?? []).map((face) => new URL(face.src).origin));
+    if (fontOrigins.length > 0) {
+        directives.push(`font-src 'self' data: ${fontOrigins.join(' ')}`);
     }
     if (directives.length === 0)
         return undefined;
     return directives.join('; ');
 }
+function dedupe(values) {
+    return [...new Set(values)];
+}
 /**
  * JSON-stringify the active render's `props` field. Returns
  * `undefined` when no props are present or when serialization fails
@@ -784,12 +805,14 @@ export function deriveRenderMeta(item) {
     // Component variant.
     const slots = deriveContextSlots(item);
     const permissionsPolicy = derivePermissionsPolicy(item);
-    const contentSecurityPolicy = composeContentSecurityPolicy(deriveBundleOrigins(item));
-    const gadgets = deriveGadgetRegistrations(item);
     // Per-app theme overlay (sidecar). Component-only for this stage —
     // system cards theme via the SystemCardHost→ThemeProvider path, not
     // this slice, so `SystemGguiSession` never carries a `theme` sidecar.
+    // Derived before the CSP: the theme's faces and imagery are inputs to
+    // it (ggui#1093).
     const theme = deriveTheme(item);
+    const contentSecurityPolicy = composeContentSecurityPolicy(deriveBundleOrigins(item), theme);
+    const gadgets = deriveGadgetRegistrations(item);
     const codeB64 = deriveCodeB64(item);
     return {
         // History head epoch (#483) — the mount reads this as its OWN

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ggui-ai/mcp-server-handlers",
-  "version": "0.16.0",
+  "version": "0.18.0",
   "description": "MCP tool handler logic for the ggui protocol. Pure over @ggui-ai/mcp-server-core seams and consumed by @ggui-ai/mcp-server. Never imports AWS, HTTP transports, or CLI concerns.",
   "keywords": [
     "ggui",
@@ -70,18 +70,18 @@
   "dependencies": {
     "canonicalize": "^2.0.0",
     "zod": "^4.3.6",
-    "@ggui-ai/mcp-server-core": "0.16.0",
-    "@ggui-ai/negotiator": "0.16.0",
-    "@ggui-ai/protocol": "0.16.0",
-    "@ggui-ai/ui-gen": "0.16.0",
-    "@ggui-ai/ui-registry": "0.16.0"
+    "@ggui-ai/mcp-server-core": "0.18.0",
+    "@ggui-ai/negotiator": "0.18.0",
+    "@ggui-ai/ui-gen": "0.18.0",
+    "@ggui-ai/protocol": "0.18.0",
+    "@ggui-ai/ui-registry": "0.18.0"
   },
   "devDependencies": {
     "@types/node": "^22.0.0",
     "typescript": "^5.0.0",
     "vitest": "^3.2.6",
-    "@ggui-ai/embedding-local": "0.16.0",
-    "@ggui-ai/protocol-conformance": "0.16.0"
+    "@ggui-ai/embedding-local": "0.18.0",
+    "@ggui-ai/protocol-conformance": "0.18.0"
   },
   "repository": {
     "type": "git",