@ggui-ai/mcp-server-handlers 0.24.0 → 0.25.0

package/dist/blueprints/search-blueprints.d.ts

@@ -58,11 +58,11 @@ import type { BlueprintProvider, EmbeddingProvider, VectorStore } from '@ggui-ai
  * `score`.
  *
  * The handshake matcher (`matchBlueprint`) gates its judge with its own
- * number (0.2), not this one, because the two are not on one scale: the
- * matcher's retrieval query embeds a request's intent without its
- * contract while stored vectors embed both, which depresses its cosines
- * (ggui#606, ggui#1275). One shared number returns when the matcher's
- * query is composed like the stored side.
+ * numbers, not this one, because its query comes in two kinds on two
+ * scales (ggui#606): a request that carries a contract composes its query
+ * like the stored vectors (contract summary + intent) and is gated at 0.50;
+ * a request without one embeds its intent alone, on a lower scale, and is
+ * gated at 0.2 (ggui#1275). Neither is this tool's intent-only search.
  */
 export declare const MIN_SIMILARITY_SCORE = 0.3;
 /**

package/dist/blueprints/search-blueprints.js

@@ -59,11 +59,11 @@ import { defineHandler } from '../types.js';
  * `score`.
  *
  * The handshake matcher (`matchBlueprint`) gates its judge with its own
- * number (0.2), not this one, because the two are not on one scale: the
- * matcher's retrieval query embeds a request's intent without its
- * contract while stored vectors embed both, which depresses its cosines
- * (ggui#606, ggui#1275). One shared number returns when the matcher's
- * query is composed like the stored side.
+ * numbers, not this one, because its query comes in two kinds on two
+ * scales (ggui#606): a request that carries a contract composes its query
+ * like the stored vectors (contract summary + intent) and is gated at 0.50;
+ * a request without one embeds its intent alone, on a lower scale, and is
+ * gated at 0.2 (ggui#1275). Neither is this tool's intent-only search.
  */
 export const MIN_SIMILARITY_SCORE = 0.3;
 /**

package/dist/index.d.ts

@@ -22,7 +22,4 @@ export * from "./credits/index.js";
 export * from "./app-discovery/index.js";
 export * from "./ops-blueprint/index.js";
 export * from "./ops-apps/index.js";
-export * from "./ops-connector-keys/index.js";
-export * from "./ops-coupon/index.js";
-export * from "./ops-orgs/index.js";
 //# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAEH,cAAc,uBAAuB,CAAC;AACtC,cAAc,oBAAoB,CAAC;AACnC,OAAO,EACL,iBAAiB,EACjB,sBAAsB,EACtB,aAAa,EACb,cAAc,EACd,gBAAgB,GACjB,MAAM,YAAY,CAAC;AACpB,YAAY,EACV,WAAW,EACX,0BAA0B,EAC1B,WAAW,EACX,cAAc,EACd,iBAAiB,EACjB,cAAc,EACd,WAAW,EACX,aAAa,EACb,wBAAwB,EACxB,uBAAuB,EACvB,mBAAmB,GACpB,MAAM,YAAY,CAAC;AAIpB,cAAc,oBAAoB,CAAC;AAInC,cAAc,oBAAoB,CAAC;AAInC,cAAc,0BAA0B,CAAC;AAIzC,cAAc,0BAA0B,CAAC;AAMzC,cAAc,qBAAqB,CAAC;AACpC,cAAc,+BAA+B,CAAC;AAC9C,cAAc,uBAAuB,CAAC;AACtC,cAAc,qBAAqB,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAEH,cAAc,uBAAuB,CAAC;AACtC,cAAc,oBAAoB,CAAC;AACnC,OAAO,EACL,iBAAiB,EACjB,sBAAsB,EACtB,aAAa,EACb,cAAc,EACd,gBAAgB,GACjB,MAAM,YAAY,CAAC;AACpB,YAAY,EACV,WAAW,EACX,0BAA0B,EAC1B,WAAW,EACX,cAAc,EACd,iBAAiB,EACjB,cAAc,EACd,WAAW,EACX,aAAa,EACb,wBAAwB,EACxB,uBAAuB,EACvB,mBAAmB,GACpB,MAAM,YAAY,CAAC;AAIpB,cAAc,oBAAoB,CAAC;AAInC,cAAc,oBAAoB,CAAC;AAInC,cAAc,0BAA0B,CAAC;AAIzC,cAAc,0BAA0B,CAAC;AAKzC,cAAc,qBAAqB,CAAC"}

package/dist/index.js

@@ -32,12 +32,8 @@ export * from "./app-discovery/index.js";
 // served on the `/control` plane. Available under
 // `@ggui-ai/mcp-server-handlers/ops-blueprint` subpath too.
 export * from "./ops-blueprint/index.js";
-// Operator-class apps, orgs, connector-keys, and coupon handler
-// families — `ggui_ops_*` tools backing the console's management
-// surfaces, each pure over a deps seam. Subpaths:
-// `@ggui-ai/mcp-server-handlers/ops-apps`, `…/ops-orgs`,
-// `…/ops-connector-keys`, `…/ops-coupon`.
+// Operator-class apps handler family — `ggui_ops_*` tools that
+// manage a deployment's apps, pure over the `AppsSource` seam the
+// deployment binds. Available under
+// `@ggui-ai/mcp-server-handlers/ops-apps` subpath too.
 export * from "./ops-apps/index.js";
-export * from "./ops-connector-keys/index.js";
-export * from "./ops-coupon/index.js";
-export * from "./ops-orgs/index.js";

package/dist/ops-apps/create-app.d.ts

@@ -1,16 +1,15 @@
 /**
- * `ggui_ops_create_app` — provision a fresh `GguiApp` owned by the
- * calling user. Sibling of the `provisionGguiApp` AppSync mutation
- * (`backend/amplify/data/create-app/handler.ts`); same identity gate
- * (caller's sub, NEVER an argument-supplied userId), same default
- * displayName, same server-side appId allocation — exposed through
- * the `ops` MCP surface so an LLM agent in the console can create an
- * app without a custom GraphQL call.
+ * `ggui_ops_create_app` — create a new app owned by the calling user.
  *
- * Pure over the {@link AppsSource} seam. AppId minting + collision
- * retry is the adapter's responsibility — the in-memory test fake
- * picks any unique string; the cloud adapter calls the existing
- * `provisionGguiApp` Lambda which already enforces base62 + retry.
+ * The owner is always the caller's own identity (`resolveOwnerSub`),
+ * never a userId passed as an argument, so an operator agent can only
+ * create apps for the account it acts for. The appId is minted by the
+ * deployment's {@link AppsSource}: the handler never takes one from the
+ * caller, and uniqueness (including any retry on a collision) is the
+ * store's job. An in-memory store can use any unique string; a store
+ * over a database mints ids in whatever format that database keys on.
+ *
+ * Pure over the {@link AppsSource} seam.
  */
 import { z } from 'zod';
 import { type ShapeOutput } from '../types.js';

package/dist/ops-apps/create-app.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"create-app.d.ts","sourceRoot":"","sources":["../../src/ops-apps/create-app.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AACH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAiB,KAAK,WAAW,EAAuB,MAAM,aAAa,CAAC;AAEnF,OAAO,KAAK,EAAa,UAAU,EAAE,MAAM,YAAY,CAAC;AAaxD,QAAA,MAAM,YAAY;;;;;;;CAYR,CAAC;AAEX,oFAAoF;AACpF,MAAM,MAAM,eAAe,GAAG,WAAW,CAAC,OAAO,YAAY,CAAC,CAAC;AAE/D,MAAM,WAAW,aAAa;IAC5B,QAAQ,CAAC,IAAI,EAAE,UAAU,CAAC;CAC3B;AAED,wBAAgB,sBAAsB,CACpC,IAAI,EAAE,aAAa;;;;;;;;;;;;;;;;GAiCpB"}
+{"version":3,"file":"create-app.d.ts","sourceRoot":"","sources":["../../src/ops-apps/create-app.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AACH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAiB,KAAK,WAAW,EAAuB,MAAM,aAAa,CAAC;AAEnF,OAAO,KAAK,EAAa,UAAU,EAAE,MAAM,YAAY,CAAC;AAaxD,QAAA,MAAM,YAAY;;;;;;;CAYR,CAAC;AAEX,oFAAoF;AACpF,MAAM,MAAM,eAAe,GAAG,WAAW,CAAC,OAAO,YAAY,CAAC,CAAC;AAE/D,MAAM,WAAW,aAAa;IAC5B,QAAQ,CAAC,IAAI,EAAE,UAAU,CAAC;CAC3B;AAED,wBAAgB,sBAAsB,CACpC,IAAI,EAAE,aAAa;;;;;;;;;;;;;;;;GAiCpB"}

package/dist/ops-apps/create-app.js

@@ -1,16 +1,15 @@
 /**
- * `ggui_ops_create_app` — provision a fresh `GguiApp` owned by the
- * calling user. Sibling of the `provisionGguiApp` AppSync mutation
- * (`backend/amplify/data/create-app/handler.ts`); same identity gate
- * (caller's sub, NEVER an argument-supplied userId), same default
- * displayName, same server-side appId allocation — exposed through
- * the `ops` MCP surface so an LLM agent in the console can create an
- * app without a custom GraphQL call.
+ * `ggui_ops_create_app` — create a new app owned by the calling user.
  *
- * Pure over the {@link AppsSource} seam. AppId minting + collision
- * retry is the adapter's responsibility — the in-memory test fake
- * picks any unique string; the cloud adapter calls the existing
- * `provisionGguiApp` Lambda which already enforces base62 + retry.
+ * The owner is always the caller's own identity (`resolveOwnerSub`),
+ * never a userId passed as an argument, so an operator agent can only
+ * create apps for the account it acts for. The appId is minted by the
+ * deployment's {@link AppsSource}: the handler never takes one from the
+ * caller, and uniqueness (including any retry on a collision) is the
+ * store's job. An in-memory store can use any unique string; a store
+ * over a database mints ids in whatever format that database keys on.
+ *
+ * Pure over the {@link AppsSource} seam.
  */
 import { z } from 'zod';
 import { defineHandler } from '../types.js';
@@ -21,7 +20,7 @@ const inputSchema = {
         .min(1)
         .max(120)
         .optional()
-        .describe("Human-friendly label for the new app. Defaults to 'My ggui app' when absent — the same label the deployment's first-load auto-create uses."),
+        .describe("Human-friendly label for the new app. Defaults to 'My ggui app' when absent."),
 };
 const outputSchema = {
     appId: z.string(),
@@ -39,7 +38,7 @@ export function createCreateAppHandler(deps) {
         name: 'ggui_ops_create_app',
         title: 'Create app',
         audience: ['ops'],
-        description: "Provision a fresh `GguiApp` owned by the calling user: an opaque base62 appId is minted server-side, the row is owned by the caller's identity, displayName defaults to 'My ggui app' when absent (cap 120 chars). Returns the persisted shape — call `ggui_ops_set_default_app({appId})` afterwards to promote the new app to the user's default.",
+        description: "Create a new app owned by the calling user. The server mints the appId (it is never an argument), displayName defaults to 'My ggui app' when absent (max 120 chars). Returns the stored app — call `ggui_ops_set_default_app({appId})` afterwards to make it the caller's default.",
         inputSchema,
         outputSchema,
         async handler(rawInput, ctx) {

package/dist/ops-apps/identity.d.ts

@@ -1,15 +1,16 @@
 /**
- * Per-call identity resolution for `ops-apps` handlers. The console
- * surfaces these tools call against `kind: 'user'` identities — the
- * upstream `AuthAdapter` populates `ctx.userId` directly. OSS
- * single-app mode (where the auth adapter collapses `appId =
- * workspaceId ?? userId`) leaves `ctx.userId` undefined and the same
- * value sits on `ctx.appId`. Read whichever is set; fail when neither
- * is.
+ * Per-call identity resolution for `ops-apps` handlers. A deployment
+ * with per-user accounts calls these tools as `kind: 'user'`
+ * identities — the upstream `AuthAdapter` populates `ctx.userId`
+ * directly. Single-app mode (where the auth adapter collapses
+ * `appId = workspaceId ?? userId`) leaves `ctx.userId` undefined and
+ * the same value sits on `ctx.appId`. Read whichever is set; fail when
+ * neither is.
  */
 import type { HandlerContext } from '../types.js';
 /**
- * Resolve the caller's Cognito sub (or OSS-mode equivalent). Throws
+ * Resolve the caller's owner id (`ctx.userId`, or `ctx.appId` in
+ * single-app mode). Throws
  * when neither field is set — that means an unauthenticated caller
  * slipped past the upstream auth adapter, which is a real bug worth
  * surfacing as a 5xx rather than masking as "empty list".

package/dist/ops-apps/identity.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"identity.d.ts","sourceRoot":"","sources":["../../src/ops-apps/identity.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AACH,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,aAAa,CAAC;AAElD;;;;;GAKG;AACH,wBAAgB,eAAe,CAC7B,QAAQ,EAAE,MAAM,EAChB,GAAG,EAAE,cAAc,GAClB,MAAM,CAQR"}
+{"version":3,"file":"identity.d.ts","sourceRoot":"","sources":["../../src/ops-apps/identity.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AACH,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,aAAa,CAAC;AAElD;;;;;;GAMG;AACH,wBAAgB,eAAe,CAC7B,QAAQ,EAAE,MAAM,EAChB,GAAG,EAAE,cAAc,GAClB,MAAM,CAQR"}

package/dist/ops-apps/identity.js

@@ -1,5 +1,6 @@
 /**
- * Resolve the caller's Cognito sub (or OSS-mode equivalent). Throws
+ * Resolve the caller's owner id (`ctx.userId`, or `ctx.appId` in
+ * single-app mode). Throws
  * when neither field is set — that means an unauthenticated caller
  * slipped past the upstream auth adapter, which is a real bug worth
  * surfacing as a 5xx rather than masking as "empty list".

package/dist/ops-apps/index.d.ts

@@ -3,8 +3,8 @@
  *
  * Six MCP tools, all `audience: ['ops']`, all served on `/control`. Pure
  * over the {@link AppsSource} + {@link UserDefaultAppSource} seams —
- * NO AWS imports. Cloud deployments bind AWS-backed adapters; tests
- * use in-memory fakes.
+ * no storage imports. A deployment binds adapters over its own store;
+ * tests use in-memory fakes.
  *
  *   - `createListAppsHandler` → `ggui_ops_list_apps`
  *   - `createCreateAppHandler` → `ggui_ops_create_app`

package/dist/ops-apps/index.js

@@ -3,8 +3,8 @@
  *
  * Six MCP tools, all `audience: ['ops']`, all served on `/control`. Pure
  * over the {@link AppsSource} + {@link UserDefaultAppSource} seams —
- * NO AWS imports. Cloud deployments bind AWS-backed adapters; tests
- * use in-memory fakes.
+ * no storage imports. A deployment binds adapters over its own store;
+ * tests use in-memory fakes.
  *
  *   - `createListAppsHandler` → `ggui_ops_list_apps`
  *   - `createCreateAppHandler` → `ggui_ops_create_app`

package/dist/ops-apps/list-apps.d.ts

@@ -1,13 +1,12 @@
 /**
  * `ggui_ops_list_apps` — enumerate the calling user's `GguiApp` rows.
  *
- * Sibling of the console's Apps section (`apps/console/src/.../apps/`)
- * — same data, MCP surface. Pure over the {@link AppsSource} seam; a
- * production deployment binds its own implementation, tests bind an
- * in-memory Map.
+ * The MCP door onto the same data an app-management UI lists. Pure over
+ * the {@link AppsSource} seam; a production deployment binds its own
+ * implementation, tests bind an in-memory Map.
  *
- * Identity scope: caller's Cognito sub from `ctx.userId` (or
- * `ctx.appId` in OSS single-app mode). Cross-user list is impossible
+ * Identity scope: the caller's owner id from `ctx.userId` (or
+ * `ctx.appId` in single-app mode). Cross-user list is impossible
  * by construction — `AppsSource.list` only returns rows whose
  * `ownerSub` matches.
  */

package/dist/ops-apps/list-apps.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"list-apps.d.ts","sourceRoot":"","sources":["../../src/ops-apps/list-apps.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AACH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAsC,KAAK,WAAW,EAAE,MAAM,aAAa,CAAC;AAEnF,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,YAAY,CAAC;AAI7C,QAAA,MAAM,YAAY;;;;;;;;CAUR,CAAC;AAEX,oFAAoF;AACpF,MAAM,MAAM,cAAc,GAAG,WAAW,CAAC,OAAO,YAAY,CAAC,CAAC;AAE9D,MAAM,WAAW,YAAY;IAC3B,QAAQ,CAAC,IAAI,EAAE,UAAU,CAAC;CAC3B;AAED,wBAAgB,qBAAqB,CAAC,IAAI,EAAE,YAAY;;;;;;;;;;;;;;;;GA4BvD"}
+{"version":3,"file":"list-apps.d.ts","sourceRoot":"","sources":["../../src/ops-apps/list-apps.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AACH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAsC,KAAK,WAAW,EAAE,MAAM,aAAa,CAAC;AAEnF,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,YAAY,CAAC;AAI7C,QAAA,MAAM,YAAY;;;;;;;;CAUR,CAAC;AAEX,oFAAoF;AACpF,MAAM,MAAM,cAAc,GAAG,WAAW,CAAC,OAAO,YAAY,CAAC,CAAC;AAE9D,MAAM,WAAW,YAAY;IAC3B,QAAQ,CAAC,IAAI,EAAE,UAAU,CAAC;CAC3B;AAED,wBAAgB,qBAAqB,CAAC,IAAI,EAAE,YAAY;;;;;;;;;;;;;;;;GA4BvD"}

package/dist/ops-apps/list-apps.js

@@ -1,13 +1,12 @@
 /**
  * `ggui_ops_list_apps` — enumerate the calling user's `GguiApp` rows.
  *
- * Sibling of the console's Apps section (`apps/console/src/.../apps/`)
- * — same data, MCP surface. Pure over the {@link AppsSource} seam; a
- * production deployment binds its own implementation, tests bind an
- * in-memory Map.
+ * The MCP door onto the same data an app-management UI lists. Pure over
+ * the {@link AppsSource} seam; a production deployment binds its own
+ * implementation, tests bind an in-memory Map.
  *
- * Identity scope: caller's Cognito sub from `ctx.userId` (or
- * `ctx.appId` in OSS single-app mode). Cross-user list is impossible
+ * Identity scope: the caller's owner id from `ctx.userId` (or
+ * `ctx.appId` in single-app mode). Cross-user list is impossible
  * by construction — `AppsSource.list` only returns rows whose
  * `ownerSub` matches.
  */
@@ -29,7 +28,7 @@ export function createListAppsHandler(deps) {
         name: 'ggui_ops_list_apps',
         title: 'List apps',
         audience: ['ops'],
-        description: "Enumerate every `GguiApp` row owned by the calling user. Returns metadata only (appId, displayName, optional systemPrompt, createdAt, updatedAt). Same data the console's Apps section renders. Use to discover ids before calling `ggui_ops_update_app` / `ggui_ops_set_default_app` / `ggui_ops_delete_app`.",
+        description: "Enumerate every `GguiApp` row owned by the calling user. Returns metadata only (appId, displayName, optional systemPrompt, createdAt, updatedAt). Use to discover ids before calling `ggui_ops_update_app` / `ggui_ops_set_default_app` / `ggui_ops_delete_app`.",
         inputSchema,
         outputSchema,
         async handler(_input, ctx) {

package/dist/ops-apps/set-app-theme.d.ts

@@ -15,15 +15,19 @@
  *   2. attestation — `overlayHash` is recomputed with
  *      `canonicalOverlayHash` and a mismatch is refused;
  *   3. coverage — the injected overlay validator judges each mode's
- *      set against the consumed-token manifest: a key outside the
- *      manifest (`unknown`) or a consumed token left unset
- *      (`uncovered`) is refused, per mode.
+ *      set against the consumed-token manifest: a consumed token left
+ *      unset (`uncovered`) is refused, per mode. A key outside the
+ *      manifest (`unknown`) is ADMITTED, never refused (ggui#1286): the
+ *      theme is stored verbatim and the write logs the names
+ *      (`app_theme_unknown_overlay_names`).
  *
  * A refusal is a schema-conformant `{ ok: false, code:
  * 'invalid_app_config', refusal }` RESULT (not a thrown error): the
- * body is one of the four the protocol names
- * (`appThemeRefusalBodySchema`), so a client reads the same refusal
- * from REST, AppSync and this door.
+ * body is one the protocol names (`appThemeRefusalBodySchema`, five
+ * bodies; this door raises three of them: `refused: 'v1 shape'`,
+ * `overlayHash: 'mismatch'` and `uncovered`), so a client reads the
+ * same refusal from every write door a deployment offers, this one
+ * included. A body the schema itself rejects carries `issues` instead.
  *
  * Ownership: `AppsSource.get` first (scoped by `ownerSub`); cross-user
  * probes return the uniform "not found" shape. The store scopes the
@@ -102,7 +106,7 @@ declare const outputSchema: {
     readonly updatedAt: z.ZodOptional<z.ZodString>;
     /** Present on a refusal: the one refusal class this door emits. */
     readonly code: z.ZodOptional<z.ZodLiteral<"invalid_app_config">>;
-    /** Present on a coverage / attestation / v1-shape refusal — one of the four protocol-named bodies. */
+    /** Present on a coverage / attestation / v1-shape refusal — a protocol-named body (`appThemeRefusalBodySchema`). */
     readonly refusal: z.ZodOptional<z.ZodUnion<readonly [z.ZodObject<{
         uncovered: z.ZodObject<{
             light: z.ZodArray<z.ZodString>;
@@ -265,7 +269,7 @@ export declare function createSetAppThemeHandler(deps: SetAppThemeDeps): import(
     readonly updatedAt: z.ZodOptional<z.ZodString>;
     /** Present on a refusal: the one refusal class this door emits. */
     readonly code: z.ZodOptional<z.ZodLiteral<"invalid_app_config">>;
-    /** Present on a coverage / attestation / v1-shape refusal — one of the four protocol-named bodies. */
+    /** Present on a coverage / attestation / v1-shape refusal — a protocol-named body (`appThemeRefusalBodySchema`). */
     readonly refusal: z.ZodOptional<z.ZodUnion<readonly [z.ZodObject<{
         uncovered: z.ZodObject<{
             light: z.ZodArray<z.ZodString>;

package/dist/ops-apps/set-app-theme.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"set-app-theme.d.ts","sourceRoot":"","sources":["../../src/ops-apps/set-app-theme.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgCG;AACH,OAAO,EAIL,KAAK,QAAQ,EACb,KAAK,mBAAmB,EAEzB,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAIL,KAAK,mBAAmB,EACzB,MAAM,aAAa,CAAC;AAGrB,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,YAAY,CAAC;AAE7C;;;;GAIG;AACH,MAAM,MAAM,wBAAwB,GAAG,CAAC,OAAO,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,KAAK;IACpF,QAAQ,CAAC,SAAS,EAAE,SAAS,MAAM,EAAE,CAAC;IACtC,QAAQ,CAAC,OAAO,EAAE,SAAS,MAAM,EAAE,CAAC;IACpC,QAAQ,CAAC,QAAQ,EAAE,SAAS,MAAM,EAAE,CAAC;CACtC,CAAC;AAcF,QAAA,MAAM,YAAY;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;IAKhB,mEAAmE;;IAEnE,sGAAsG;;;;;;;;;;;;;;;;;;IAEtG,yFAAyF;;CAEjF,CAAC;AAEX,uEAAuE;AACvE,MAAM,MAAM,iBAAiB,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC,OAAO,YAAY,CAAC,CAAC,CAAC;AAE1E,MAAM,WAAW,eAAe;IAC9B,QAAQ,CAAC,IAAI,EAAE,UAAU,CAAC;IAC1B,8FAA8F;IAC9F,QAAQ,CAAC,eAAe,EAAE,wBAAwB,CAAC;CACpD;AAED,0EAA0E;AAC1E,MAAM,MAAM,iBAAiB,GACzB;IACE,QAAQ,CAAC,EAAE,EAAE,IAAI,CAAC;IAClB,QAAQ,CAAC,KAAK,EAAE,QAAQ,CAAC;IACzB,8GAA8G;IAC9G,QAAQ,CAAC,OAAO,EAAE;QAAE,QAAQ,CAAC,KAAK,EAAE,SAAS,MAAM,EAAE,CAAC;QAAC,QAAQ,CAAC,IAAI,EAAE,SAAS,MAAM,EAAE,CAAA;KAAE,CAAC;CAC3F,GACD;IAAE,QAAQ,CAAC,EAAE,EAAE,KAAK,CAAC;IAAC,QAAQ,CAAC,OAAO,EAAE,mBAAmB,CAAA;CAAE,GAC7D;IAAE,QAAQ,CAAC,EAAE,EAAE,KAAK,CAAC;IAAC,QAAQ,CAAC,MAAM,EAAE,SAAS,MAAM,EAAE,CAAA;CAAE,CAAC;AAY/D;;;;;;;GAOG;AACH,wBAAsB,aAAa,CACjC,GAAG,EAAE,OAAO,EACZ,eAAe,EAAE,wBAAwB,GACxC,OAAO,CAAC,iBAAiB,CAAC,CAmB5B;AAqBD,wBAAgB,wBAAwB,CAAC,IAAI,EAAE,eAAe;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;IAzF5D,mEAAmE;;IAEnE,sGAAsG;;;;;;;;;;;;;;;;;;IAEtG,yFAAyF;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;IAmI1F"}
+{"version":3,"file":"set-app-theme.d.ts","sourceRoot":"","sources":["../../src/ops-apps/set-app-theme.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAoCG;AACH,OAAO,EAIL,KAAK,QAAQ,EACb,KAAK,mBAAmB,EAEzB,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAIL,KAAK,mBAAmB,EACzB,MAAM,aAAa,CAAC;AAGrB,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,YAAY,CAAC;AAE7C;;;;GAIG;AACH,MAAM,MAAM,wBAAwB,GAAG,CAAC,OAAO,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,KAAK;IACpF,QAAQ,CAAC,SAAS,EAAE,SAAS,MAAM,EAAE,CAAC;IACtC,QAAQ,CAAC,OAAO,EAAE,SAAS,MAAM,EAAE,CAAC;IACpC,QAAQ,CAAC,QAAQ,EAAE,SAAS,MAAM,EAAE,CAAC;CACtC,CAAC;AAcF,QAAA,MAAM,YAAY;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;IAKhB,mEAAmE;;IAEnE,oHAAoH;;;;;;;;;;;;;;;;;;IAEpH,yFAAyF;;CAEjF,CAAC;AAEX,uEAAuE;AACvE,MAAM,MAAM,iBAAiB,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC,OAAO,YAAY,CAAC,CAAC,CAAC;AAE1E,MAAM,WAAW,eAAe;IAC9B,QAAQ,CAAC,IAAI,EAAE,UAAU,CAAC;IAC1B,8FAA8F;IAC9F,QAAQ,CAAC,eAAe,EAAE,wBAAwB,CAAC;CACpD;AAED,0EAA0E;AAC1E,MAAM,MAAM,iBAAiB,GACzB;IACE,QAAQ,CAAC,EAAE,EAAE,IAAI,CAAC;IAClB,QAAQ,CAAC,KAAK,EAAE,QAAQ,CAAC;IACzB,8GAA8G;IAC9G,QAAQ,CAAC,OAAO,EAAE;QAAE,QAAQ,CAAC,KAAK,EAAE,SAAS,MAAM,EAAE,CAAC;QAAC,QAAQ,CAAC,IAAI,EAAE,SAAS,MAAM,EAAE,CAAA;KAAE,CAAC;CAC3F,GACD;IAAE,QAAQ,CAAC,EAAE,EAAE,KAAK,CAAC;IAAC,QAAQ,CAAC,OAAO,EAAE,mBAAmB,CAAA;CAAE,GAC7D;IAAE,QAAQ,CAAC,EAAE,EAAE,KAAK,CAAC;IAAC,QAAQ,CAAC,MAAM,EAAE,SAAS,MAAM,EAAE,CAAA;CAAE,CAAC;AAY/D;;;;;;;GAOG;AACH,wBAAsB,aAAa,CACjC,GAAG,EAAE,OAAO,EACZ,eAAe,EAAE,wBAAwB,GACxC,OAAO,CAAC,iBAAiB,CAAC,CAmB5B;AAqBD,wBAAgB,wBAAwB,CAAC,IAAI,EAAE,eAAe;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;IAzF5D,mEAAmE;;IAEnE,oHAAoH;;;;;;;;;;;;;;;;;;IAEpH,yFAAyF;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;IAmI1F"}

package/dist/ops-apps/set-app-theme.js

@@ -15,15 +15,19 @@
  *   2. attestation — `overlayHash` is recomputed with
  *      `canonicalOverlayHash` and a mismatch is refused;
  *   3. coverage — the injected overlay validator judges each mode's
- *      set against the consumed-token manifest: a key outside the
- *      manifest (`unknown`) or a consumed token left unset
- *      (`uncovered`) is refused, per mode.
+ *      set against the consumed-token manifest: a consumed token left
+ *      unset (`uncovered`) is refused, per mode. A key outside the
+ *      manifest (`unknown`) is ADMITTED, never refused (ggui#1286): the
+ *      theme is stored verbatim and the write logs the names
+ *      (`app_theme_unknown_overlay_names`).
  *
  * A refusal is a schema-conformant `{ ok: false, code:
  * 'invalid_app_config', refusal }` RESULT (not a thrown error): the
- * body is one of the four the protocol names
- * (`appThemeRefusalBodySchema`), so a client reads the same refusal
- * from REST, AppSync and this door.
+ * body is one the protocol names (`appThemeRefusalBodySchema`, five
+ * bodies; this door raises three of them: `refused: 'v1 shape'`,
+ * `overlayHash: 'mismatch'` and `uncovered`), so a client reads the
+ * same refusal from every write door a deployment offers, this one
+ * included. A body the schema itself rejects carries `issues` instead.
  *
  * Ownership: `AppsSource.get` first (scoped by `ownerSub`); cross-user
  * probes return the uniform "not found" shape. The store scopes the
@@ -50,7 +54,7 @@ const outputSchema = {
     updatedAt: z.string().optional(),
     /** Present on a refusal: the one refusal class this door emits. */
     code: z.literal('invalid_app_config').optional(),
-    /** Present on a coverage / attestation / v1-shape refusal — one of the four protocol-named bodies. */
+    /** Present on a coverage / attestation / v1-shape refusal — a protocol-named body (`appThemeRefusalBodySchema`). */
     refusal: appThemeRefusalBodySchema.optional(),
     /** Present on a shape refusal the schema itself raised — its messages, one per issue. */
     issues: z.array(z.string()).optional(),

package/dist/ops-apps/set-default-app.d.ts

@@ -2,8 +2,7 @@
  * `ggui_ops_set_default_app` — write the calling user's
  * `GguiUser.defaultAppId` column.
  *
- * Sibling of the `useGguiUser` first-load hook (`apps/console/.../use-ggui-user`).
- * Same column, MCP surface. The handler chains `AppsSource.get` first
+ * The MCP door onto the user's default-app setting. The handler chains `AppsSource.get` first
  * (verify the user owns the target appId) before writing
  * `UserDefaultAppSource.setDefault` — invariant: `defaultAppId` MUST
  * point at an app the user owns.

package/dist/ops-apps/set-default-app.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"set-default-app.d.ts","sourceRoot":"","sources":["../../src/ops-apps/set-default-app.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AACH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAIxB,OAAO,KAAK,EAAE,UAAU,EAAE,oBAAoB,EAAE,MAAM,YAAY,CAAC;AAenE,MAAM,WAAW,mBAAmB;IAClC,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;CAC/B;AAED,MAAM,WAAW,iBAAiB;IAChC,QAAQ,CAAC,IAAI,EAAE,UAAU,CAAC;IAC1B,QAAQ,CAAC,cAAc,EAAE,oBAAoB,CAAC;CAC/C;AAED,wBAAgB,0BAA0B,CACxC,IAAI,EAAE,iBAAiB;;;;wBA8BxB"}
+{"version":3,"file":"set-default-app.d.ts","sourceRoot":"","sources":["../../src/ops-apps/set-default-app.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AACH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAIxB,OAAO,KAAK,EAAE,UAAU,EAAE,oBAAoB,EAAE,MAAM,YAAY,CAAC;AAenE,MAAM,WAAW,mBAAmB;IAClC,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;CAC/B;AAED,MAAM,WAAW,iBAAiB;IAChC,QAAQ,CAAC,IAAI,EAAE,UAAU,CAAC;IAC1B,QAAQ,CAAC,cAAc,EAAE,oBAAoB,CAAC;CAC/C;AAED,wBAAgB,0BAA0B,CACxC,IAAI,EAAE,iBAAiB;;;;wBA8BxB"}

package/dist/ops-apps/set-default-app.js

@@ -2,8 +2,7 @@
  * `ggui_ops_set_default_app` — write the calling user's
  * `GguiUser.defaultAppId` column.
  *
- * Sibling of the `useGguiUser` first-load hook (`apps/console/.../use-ggui-user`).
- * Same column, MCP surface. The handler chains `AppsSource.get` first
+ * The MCP door onto the user's default-app setting. The handler chains `AppsSource.get` first
  * (verify the user owns the target appId) before writing
  * `UserDefaultAppSource.setDefault` — invariant: `defaultAppId` MUST
  * point at an app the user owns.

package/dist/ops-apps/types.d.ts

@@ -1,26 +1,25 @@
 /**
- * Seam types for the `ops-apps` MCP tool family. Mirrors the
- * data-model rows that back the console's Apps + Account surfaces
- * (the `GguiApp` and `GguiUser` records). Pure over
- * `@ggui-ai/protocol` shapes — NO AWS / database imports. Cloud
- * deployments bind an AWS-backed implementation; tests bind
+ * Seam types for the `ops-apps` MCP tool family: an app record
+ * (`GguiApp`) and the user's default-app setting (`GguiUser`). Pure over
+ * `@ggui-ai/protocol` shapes — no storage or database imports. A
+ * deployment binds an implementation over its own store; tests bind
  * in-memory fakes.
  *
  * Why an explicit seam vs threading a database client directly: the
- * shared-handler layer must be the same code path with or without a
- * cloud backend. The `AppsSource` interface IS the boundary — wired
- * to a real datastore in production, wired to a Map in tests.
+ * shared-handler layer must be the same code path whatever store sits
+ * behind it. The `AppsSource` interface IS the boundary — wired to a
+ * real datastore in production, wired to a Map in tests.
  */
 import type { AppTheme } from '@ggui-ai/protocol';
 /**
  * One app record, projected for MCP-tool readers. Pure data — no
- * relations, no backend-internal fields. Cloud adapters map the
- * stored model row onto this shape; tests construct it directly.
+ * relations, no store-internal fields. An adapter maps its stored row
+ * onto this shape; tests construct it directly.
  */
 export interface AppRecord {
-    /** Opaque base62 `<8 chars>` — server-minted when the app is provisioned. */
+    /** Opaque id, minted by the store when the app is created; never caller-supplied. */
     readonly appId: string;
-    /** FK to the owning user's Cognito sub. Used for ownership gates. */
+    /** The owning user's id (`resolveOwnerSub`). Used for ownership gates. */
     readonly ownerSub: string;
     /** User-editable label. */
     readonly displayName: string;
@@ -58,7 +57,7 @@ export interface AppUpdatePatch {
     readonly rateLimitPerMinute?: number;
 }
 /**
- * Read+write seam for `GguiApp` rows. Cloud deployments bind a
+ * Read+write seam for `GguiApp` rows. A deployment binds a
  * datastore-backed implementation; tests implement it against
  * in-memory state.
  *
@@ -66,8 +65,8 @@ export interface AppUpdatePatch {
  *   - `list(ownerSub)` returns only the rows the caller owns. The
  *     implementation does NOT leak rows from other users.
  *   - `create({ ownerSub, displayName })` mints a fresh `appId`
- *     server-side (cloud: base62 + collision retry; in-memory: any
- *     unique string). Argument-supplied appIds are NOT honored — that
+ *     server-side (a database store: its own id format, with a retry
+ *     on collision; in-memory: any unique string). Argument-supplied appIds are NOT honored — that
  *     would be an app-takeover vector.
  *   - `update`, `delete`, `setTheme` reject when the row's
  *     `ownerSub` doesn't match the caller's. Implementations either
@@ -138,8 +137,8 @@ export interface AppsSource {
 /**
  * Read+write seam for the `defaultAppId` column on `GguiUser`. Separate
  * interface from `AppsSource` because the column lives on a different
- * table — keeping the seams disjoint lets the cloud adapter bind two
- * unrelated mutations without one interface dragging in the other.
+ * record — keeping the seams disjoint lets an adapter bind two
+ * unrelated writes without one interface dragging in the other.
  *
  * The handler chains `AppsSource.get` (verify the user owns the target)
  * before calling `setDefault` so writes never point at a foreign app.
@@ -166,9 +165,8 @@ export declare class AppNotFoundError extends Error {
  *
  * `defaultAppId` is what the universal route resolves on every
  * request; deleting the app it names would leave that route pointing
- * at a row that no longer exists. Same lock the console's Delete
- * enforces — the operator picks a different default first, then
- * deletes.
+ * at a row that no longer exists. A UI's delete should enforce the same
+ * lock — the operator picks a different default first, then deletes.
  */
 export declare class DefaultAppDeleteBlockedError extends Error {
     readonly code: "default_app_delete_blocked";
@@ -177,9 +175,8 @@ export declare class DefaultAppDeleteBlockedError extends Error {
 /**
  * Thrown by adapters that prefer surfacing access denial over the
  * "treat as not-found" privacy posture. Handlers translate to the
- * uniform "not found" shape — the error class exists so cloud
- * adapters can be specific in their logs without callers parsing
- * strings.
+ * uniform "not found" shape — the error class exists so adapters can
+ * be specific in their logs without callers parsing strings.
  */
 export declare class OpsAppsAccessDeniedError extends Error {
     readonly code: "ops_apps_access_denied";

package/dist/ops-apps/types.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../src/ops-apps/types.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AACH,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,mBAAmB,CAAC;AAElD;;;;GAIG;AACH,MAAM,WAAW,SAAS;IACxB,6EAA6E;IAC7E,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,qEAAqE;IACrE,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,2BAA2B;IAC3B,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,+CAA+C;IAC/C,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM,CAAC;IAC/B;;;;OAIG;IACH,QAAQ,CAAC,kBAAkB,CAAC,EAAE,MAAM,CAAC;IACrC,sDAAsD;IACtD,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,+CAA+C;IAC/C,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;CAC5B;AAED;;;;;;;;;;;GAWG;AACH,MAAM,WAAW,cAAc;IAC7B,0DAA0D;IAC1D,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAC;IAC9B,wEAAwE;IACxE,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM,CAAC;IAC/B,oEAAoE;IACpE,QAAQ,CAAC,kBAAkB,CAAC,EAAE,MAAM,CAAC;CACtC;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,MAAM,WAAW,UAAU;IACzB,2DAA2D;IAC3D,IAAI,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,SAAS,SAAS,EAAE,CAAC,CAAC;IACtD,0FAA0F;IAC1F,GAAG,CAAC,IAAI,EAAE;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,QAAQ,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC,SAAS,GAAG,IAAI,CAAC,CAAC;IAC1E,0DAA0D;IAC1D,MAAM,CAAC,IAAI,EAAE;QAAE,QAAQ,EAAE,MAAM,CAAC;QAAC,WAAW,CAAC,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC,SAAS,CAAC,CAAC;IAC7E;;;;;OAKG;IACH,MAAM,CAAC,IAAI,EAAE;QACX,KAAK,EAAE,MAAM,CAAC;QACd,QAAQ,EAAE,MAAM,CAAC;QACjB,KAAK,EAAE,cAAc,CAAC;KACvB,GAAG,OAAO,CAAC,SAAS,CAAC,CAAC;IACvB;;;;;;;;;;;;;;;;;;OAkBG;IACH,MAAM,CAAC,IAAI,EAAE;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,QAAQ,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACjE;;;OAGG;IACH,QAAQ,CAAC,IAAI,EAAE;QACb,KAAK,EAAE,MAAM,CAAC;QACd,QAAQ,EAAE,MAAM,CAAC;QACjB,KAAK,EAAE,QAAQ,CAAC;KACjB,GAAG,OAAO,CAAC;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,SAAS,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;CACnD;AAED;;;;;;;;GAQG;AACH,MAAM,WAAW,oBAAoB;IACnC,gEAAgE;IAChE,UAAU,CAAC,IAAI,EAAE;QAAE,QAAQ,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACrE,0EAA0E;IAC1E,UAAU,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAAC;CACtD;AAED;;;GAGG;AACH,qBAAa,gBAAiB,SAAQ,KAAK;IACzC,QAAQ,CAAC,IAAI,EAAG,eAAe,CAAU;gBAC7B,KAAK,EAAE,MAAM;CAI1B;AAED;;;;;;;;GAQG;AACH,qBAAa,4BAA6B,SAAQ,KAAK;IACrD,QAAQ,CAAC,IAAI,EAAG,4BAA4B,CAAU;gBAC1C,KAAK,EAAE,MAAM;CAM1B;AAED;;;;;;GAMG;AACH,qBAAa,wBAAyB,SAAQ,KAAK;IACjD,QAAQ,CAAC,IAAI,EAAG,wBAAwB,CAAU;gBACtC,OAAO,EAAE,MAAM;CAI5B"}
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../src/ops-apps/types.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AACH,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,mBAAmB,CAAC;AAElD;;;;GAIG;AACH,MAAM,WAAW,SAAS;IACxB,qFAAqF;IACrF,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,0EAA0E;IAC1E,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,2BAA2B;IAC3B,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,+CAA+C;IAC/C,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM,CAAC;IAC/B;;;;OAIG;IACH,QAAQ,CAAC,kBAAkB,CAAC,EAAE,MAAM,CAAC;IACrC,sDAAsD;IACtD,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,+CAA+C;IAC/C,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;CAC5B;AAED;;;;;;;;;;;GAWG;AACH,MAAM,WAAW,cAAc;IAC7B,0DAA0D;IAC1D,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAC;IAC9B,wEAAwE;IACxE,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM,CAAC;IAC/B,oEAAoE;IACpE,QAAQ,CAAC,kBAAkB,CAAC,EAAE,MAAM,CAAC;CACtC;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,MAAM,WAAW,UAAU;IACzB,2DAA2D;IAC3D,IAAI,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,SAAS,SAAS,EAAE,CAAC,CAAC;IACtD,0FAA0F;IAC1F,GAAG,CAAC,IAAI,EAAE;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,QAAQ,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC,SAAS,GAAG,IAAI,CAAC,CAAC;IAC1E,0DAA0D;IAC1D,MAAM,CAAC,IAAI,EAAE;QAAE,QAAQ,EAAE,MAAM,CAAC;QAAC,WAAW,CAAC,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC,SAAS,CAAC,CAAC;IAC7E;;;;;OAKG;IACH,MAAM,CAAC,IAAI,EAAE;QACX,KAAK,EAAE,MAAM,CAAC;QACd,QAAQ,EAAE,MAAM,CAAC;QACjB,KAAK,EAAE,cAAc,CAAC;KACvB,GAAG,OAAO,CAAC,SAAS,CAAC,CAAC;IACvB;;;;;;;;;;;;;;;;;;OAkBG;IACH,MAAM,CAAC,IAAI,EAAE;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,QAAQ,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACjE;;;OAGG;IACH,QAAQ,CAAC,IAAI,EAAE;QACb,KAAK,EAAE,MAAM,CAAC;QACd,QAAQ,EAAE,MAAM,CAAC;QACjB,KAAK,EAAE,QAAQ,CAAC;KACjB,GAAG,OAAO,CAAC;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,SAAS,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;CACnD;AAED;;;;;;;;GAQG;AACH,MAAM,WAAW,oBAAoB;IACnC,gEAAgE;IAChE,UAAU,CAAC,IAAI,EAAE;QAAE,QAAQ,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACrE,0EAA0E;IAC1E,UAAU,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAAC;CACtD;AAED;;;GAGG;AACH,qBAAa,gBAAiB,SAAQ,KAAK;IACzC,QAAQ,CAAC,IAAI,EAAG,eAAe,CAAU;gBAC7B,KAAK,EAAE,MAAM;CAI1B;AAED;;;;;;;GAOG;AACH,qBAAa,4BAA6B,SAAQ,KAAK;IACrD,QAAQ,CAAC,IAAI,EAAG,4BAA4B,CAAU;gBAC1C,KAAK,EAAE,MAAM;CAM1B;AAED;;;;;GAKG;AACH,qBAAa,wBAAyB,SAAQ,KAAK;IACjD,QAAQ,CAAC,IAAI,EAAG,wBAAwB,CAAU;gBACtC,OAAO,EAAE,MAAM;CAI5B"}

package/dist/ops-apps/types.js

@@ -14,9 +14,8 @@ export class AppNotFoundError extends Error {
  *
  * `defaultAppId` is what the universal route resolves on every
  * request; deleting the app it names would leave that route pointing
- * at a row that no longer exists. Same lock the console's Delete
- * enforces — the operator picks a different default first, then
- * deletes.
+ * at a row that no longer exists. A UI's delete should enforce the same
+ * lock — the operator picks a different default first, then deletes.
  */
 export class DefaultAppDeleteBlockedError extends Error {
     code = 'default_app_delete_blocked';
@@ -28,9 +27,8 @@ export class DefaultAppDeleteBlockedError extends Error {
 /**
  * Thrown by adapters that prefer surfacing access denial over the
  * "treat as not-found" privacy posture. Handlers translate to the
- * uniform "not found" shape — the error class exists so cloud
- * adapters can be specific in their logs without callers parsing
- * strings.
+ * uniform "not found" shape — the error class exists so adapters can
+ * be specific in their logs without callers parsing strings.
  */
 export class OpsAppsAccessDeniedError extends Error {
     code = 'ops_apps_access_denied';

package/dist/ops-blueprint/errors.d.ts

@@ -45,6 +45,18 @@ export declare class GeneratorNotFoundError extends Error {
  * `ggui_ops_set_provider_key`, or run the handler in an environment
  * whose `resolveLlm` dep returns a pool credential.
  */
+/**
+ * ggui#1427 — `directionScope` names which direction `directionDigest`
+ * hashes; sent without a digest it is a scope for nothing, and the door
+ * refuses it rather than storing a fact about a value it does not have. A
+ * digest without a scope is accepted (absent = no scope). Enforced here
+ * because the handler mounts the input schema's raw shape, where a
+ * cross-field rule cannot live.
+ */
+export declare class DirectionScopeWithoutDigestError extends Error {
+    readonly code: "direction_scope_without_digest";
+    constructor();
+}
 export declare class MissingCredentialsError extends Error {
     readonly code: "missing_credentials";
     constructor(message?: string);

package/dist/ops-blueprint/errors.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"errors.d.ts","sourceRoot":"","sources":["../../src/ops-blueprint/errors.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAEH;;;;;;;;;;;;;;;;;;;GAmBG;AACH,qBAAa,sBAAuB,SAAQ,KAAK;IAC/C,QAAQ,CAAC,IAAI,EAAG,qBAAqB,CAAU;gBACnC,IAAI,EAAE,MAAM,EAAE,eAAe,EAAE,SAAS,MAAM,EAAE;CAM7D;AAED;;;;;;;;;;GAUG;AACH,qBAAa,uBAAwB,SAAQ,KAAK;IAChD,QAAQ,CAAC,IAAI,EAAG,qBAAqB,CAAU;gBACnC,OAAO,CAAC,EAAE,MAAM;CAO7B;AAED;;;;;GAKG;AACH,qBAAa,qBAAsB,SAAQ,KAAK;IAC9C,QAAQ,CAAC,IAAI,EAAG,mBAAmB,CAAU;IAC7C,QAAQ,CAAC,KAAK,EAAE,OAAO,CAAC;gBACZ,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO;CAK5C"}
+{"version":3,"file":"errors.d.ts","sourceRoot":"","sources":["../../src/ops-blueprint/errors.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAEH;;;;;;;;;;;;;;;;;;;GAmBG;AACH,qBAAa,sBAAuB,SAAQ,KAAK;IAC/C,QAAQ,CAAC,IAAI,EAAG,qBAAqB,CAAU;gBACnC,IAAI,EAAE,MAAM,EAAE,eAAe,EAAE,SAAS,MAAM,EAAE;CAM7D;AAED;;;;;;;;;;GAUG;AACH;;;;;;;GAOG;AACH,qBAAa,gCAAiC,SAAQ,KAAK;IACzD,QAAQ,CAAC,IAAI,EAAG,gCAAgC,CAAU;;CAO3D;AAED,qBAAa,uBAAwB,SAAQ,KAAK;IAChD,QAAQ,CAAC,IAAI,EAAG,qBAAqB,CAAU;gBACnC,OAAO,CAAC,EAAE,MAAM;CAO7B;AAED;;;;;GAKG;AACH,qBAAa,qBAAsB,SAAQ,KAAK;IAC9C,QAAQ,CAAC,IAAI,EAAG,mBAAmB,CAAU;IAC7C,QAAQ,CAAC,KAAK,EAAE,OAAO,CAAC;gBACZ,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO;CAK5C"}

package/dist/ops-blueprint/errors.js

@@ -48,6 +48,21 @@ export class GeneratorNotFoundError extends Error {
  * `ggui_ops_set_provider_key`, or run the handler in an environment
  * whose `resolveLlm` dep returns a pool credential.
  */
+/**
+ * ggui#1427 — `directionScope` names which direction `directionDigest`
+ * hashes; sent without a digest it is a scope for nothing, and the door
+ * refuses it rather than storing a fact about a value it does not have. A
+ * digest without a scope is accepted (absent = no scope). Enforced here
+ * because the handler mounts the input schema's raw shape, where a
+ * cross-field rule cannot live.
+ */
+export class DirectionScopeWithoutDigestError extends Error {
+    code = "direction_scope_without_digest";
+    constructor() {
+        super("direction_scope_without_digest: `directionScope` was sent without `directionDigest` — a scope names which direction the digest hashes, so send both or neither.");
+        this.name = "DirectionScopeWithoutDigestError";
+    }
+}
 export class MissingCredentialsError extends Error {
     code = "missing_credentials";
     constructor(message) {

package/dist/ops-blueprint/index.d.ts

@@ -27,7 +27,7 @@
  * enforces their ownership model.
  */
 export { createGguiOpsGenerateBlueprintHandler, type GguiOpsGenerateBlueprintDeps, type PutCodeHook, } from './generate.js';
-export { createGguiOpsRegisterBlueprintHandler, type GguiOpsRegisterBlueprintDeps, } from './register.js';
+export { createGguiOpsRegisterBlueprintHandler, createRegisterGeneratedBlueprint, type GeneratedBlueprintBytes, type GguiOpsRegisterBlueprintDeps, type RegisterGeneratedBlueprint, type RegisterGeneratedBlueprintOutput, } from './register.js';
 export { createGguiOpsListBlueprintsHandler, type GguiOpsListBlueprintsDeps, } from './list.js';
 export { createGguiOpsUpdateBlueprintHandler, type GguiOpsUpdateBlueprintDeps, BlueprintAppMismatchError, } from './update.js';
 export { createGguiOpsDeleteBlueprintHandler, type GguiOpsDeleteBlueprintDeps, } from './delete.js';

package/dist/ops-blueprint/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/ops-blueprint/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AAEH,OAAO,EACL,qCAAqC,EACrC,KAAK,4BAA4B,EACjC,KAAK,WAAW,GACjB,MAAM,eAAe,CAAC;AACvB,OAAO,EACL,qCAAqC,EACrC,KAAK,4BAA4B,GAClC,MAAM,eAAe,CAAC;AACvB,OAAO,EACL,kCAAkC,EAClC,KAAK,yBAAyB,GAC/B,MAAM,WAAW,CAAC;AACnB,OAAO,EACL,mCAAmC,EACnC,KAAK,0BAA0B,EAC/B,yBAAyB,GAC1B,MAAM,aAAa,CAAC;AACrB,OAAO,EACL,mCAAmC,EACnC,KAAK,0BAA0B,GAChC,MAAM,aAAa,CAAC;AACrB,OAAO,EACL,sBAAsB,EACtB,uBAAuB,EACvB,qBAAqB,GACtB,MAAM,aAAa,CAAC;AACrB,OAAO,EACL,gBAAgB,EAChB,WAAW,EACX,wBAAwB,EACxB,KAAK,yBAAyB,GAC/B,MAAM,4BAA4B,CAAC;AACpC,OAAO,EACL,qBAAqB,EACrB,gCAAgC,EAChC,sBAAsB,EACtB,KAAK,qBAAqB,EAC1B,KAAK,yBAAyB,GAC/B,MAAM,iBAAiB,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/ops-blueprint/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AAEH,OAAO,EACL,qCAAqC,EACrC,KAAK,4BAA4B,EACjC,KAAK,WAAW,GACjB,MAAM,eAAe,CAAC;AACvB,OAAO,EACL,qCAAqC,EACrC,gCAAgC,EAChC,KAAK,uBAAuB,EAC5B,KAAK,4BAA4B,EACjC,KAAK,0BAA0B,EAC/B,KAAK,gCAAgC,GACtC,MAAM,eAAe,CAAC;AACvB,OAAO,EACL,kCAAkC,EAClC,KAAK,yBAAyB,GAC/B,MAAM,WAAW,CAAC;AACnB,OAAO,EACL,mCAAmC,EACnC,KAAK,0BAA0B,EAC/B,yBAAyB,GAC1B,MAAM,aAAa,CAAC;AACrB,OAAO,EACL,mCAAmC,EACnC,KAAK,0BAA0B,GAChC,MAAM,aAAa,CAAC;AACrB,OAAO,EACL,sBAAsB,EACtB,uBAAuB,EACvB,qBAAqB,GACtB,MAAM,aAAa,CAAC;AACrB,OAAO,EACL,gBAAgB,EAChB,WAAW,EACX,wBAAwB,EACxB,KAAK,yBAAyB,GAC/B,MAAM,4BAA4B,CAAC;AACpC,OAAO,EACL,qBAAqB,EACrB,gCAAgC,EAChC,sBAAsB,EACtB,KAAK,qBAAqB,EAC1B,KAAK,yBAAyB,GAC/B,MAAM,iBAAiB,CAAC"}

package/dist/ops-blueprint/index.js

@@ -27,7 +27,7 @@
  * enforces their ownership model.
  */
 export { createGguiOpsGenerateBlueprintHandler, } from './generate.js';
-export { createGguiOpsRegisterBlueprintHandler, } from './register.js';
+export { createGguiOpsRegisterBlueprintHandler, createRegisterGeneratedBlueprint, } from './register.js';
 export { createGguiOpsListBlueprintsHandler, } from './list.js';
 export { createGguiOpsUpdateBlueprintHandler, BlueprintAppMismatchError, } from './update.js';
 export { createGguiOpsDeleteBlueprintHandler, } from './delete.js';