@ggui-ai/mcp-server-handlers 0.24.0 → 0.26.0

package/README.md

@@ -1,8 +1,8 @@
 # @ggui-ai/mcp-server-handlers
 
-MCP tool handler logic for the **ggui protocol**.
+MCP tool handler logic for the **GGUI protocol**.
 
-This package implements the actual behavior behind every ggui MCP tool — render
+This package implements the actual behavior behind every GGUI MCP tool — render
 lifecycle, the contract handshake, UI emission, blueprint management, threads, app
 discovery, and the operator (`ggui_ops_*`) tools. The handlers are written purely
 over the seam interfaces in

package/dist/blueprints/search-blueprints.d.ts

@@ -58,11 +58,11 @@ import type { BlueprintProvider, EmbeddingProvider, VectorStore } from '@ggui-ai
  * `score`.
  *
  * The handshake matcher (`matchBlueprint`) gates its judge with its own
- * number (0.2), not this one, because the two are not on one scale: the
- * matcher's retrieval query embeds a request's intent without its
- * contract while stored vectors embed both, which depresses its cosines
- * (ggui#606, ggui#1275). One shared number returns when the matcher's
- * query is composed like the stored side.
+ * numbers, not this one, because its query comes in two kinds on two
+ * scales (ggui#606): a request that carries a contract composes its query
+ * like the stored vectors (contract summary + intent) and is gated at 0.50;
+ * a request without one embeds its intent alone, on a lower scale, and is
+ * gated at 0.2 (ggui#1275). Neither is this tool's intent-only search.
  */
 export declare const MIN_SIMILARITY_SCORE = 0.3;
 /**

package/dist/blueprints/search-blueprints.js

@@ -59,11 +59,11 @@ import { defineHandler } from '../types.js';
  * `score`.
  *
  * The handshake matcher (`matchBlueprint`) gates its judge with its own
- * number (0.2), not this one, because the two are not on one scale: the
- * matcher's retrieval query embeds a request's intent without its
- * contract while stored vectors embed both, which depresses its cosines
- * (ggui#606, ggui#1275). One shared number returns when the matcher's
- * query is composed like the stored side.
+ * numbers, not this one, because its query comes in two kinds on two
+ * scales (ggui#606): a request that carries a contract composes its query
+ * like the stored vectors (contract summary + intent) and is gated at 0.50;
+ * a request without one embeds its intent alone, on a lower scale, and is
+ * gated at 0.2 (ggui#1275). Neither is this tool's intent-only search.
  */
 export const MIN_SIMILARITY_SCORE = 0.3;
 /**

package/dist/credits/index.d.ts

@@ -25,6 +25,6 @@
  */
 export { createGetCreditBalanceHandler, } from './get-credit-balance.js';
 export type { CreditBalanceSource, CreditBalanceView, GetCreditBalanceDeps, GetCreditBalanceOutput, } from './get-credit-balance.js';
-export { createListCreditTransactionsHandler, } from './list-credit-transactions.js';
-export type { CreditTransactionSource, CreditTransactionView, ListCreditTransactionsDeps, ListCreditTransactionsOutput, } from './list-credit-transactions.js';
+export { createListCreditTransactionsHandler, KNOWN_CREDIT_TRANSACTION_KINDS, } from './list-credit-transactions.js';
+export type { CreditTransactionKind, CreditTransactionSource, CreditTransactionView, KnownCreditTransactionKind, ListCreditTransactionsDeps, ListCreditTransactionsOutput, } from './list-credit-transactions.js';
 //# sourceMappingURL=index.d.ts.map

package/dist/credits/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/credits/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AAEH,OAAO,EACL,6BAA6B,GAC9B,MAAM,yBAAyB,CAAC;AACjC,YAAY,EACV,mBAAmB,EACnB,iBAAiB,EACjB,oBAAoB,EACpB,sBAAsB,GACvB,MAAM,yBAAyB,CAAC;AAEjC,OAAO,EACL,mCAAmC,GACpC,MAAM,+BAA+B,CAAC;AACvC,YAAY,EACV,uBAAuB,EACvB,qBAAqB,EACrB,0BAA0B,EAC1B,4BAA4B,GAC7B,MAAM,+BAA+B,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/credits/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AAEH,OAAO,EACL,6BAA6B,GAC9B,MAAM,yBAAyB,CAAC;AACjC,YAAY,EACV,mBAAmB,EACnB,iBAAiB,EACjB,oBAAoB,EACpB,sBAAsB,GACvB,MAAM,yBAAyB,CAAC;AAEjC,OAAO,EACL,mCAAmC,EACnC,8BAA8B,GAC/B,MAAM,+BAA+B,CAAC;AACvC,YAAY,EACV,qBAAqB,EACrB,uBAAuB,EACvB,qBAAqB,EACrB,0BAA0B,EAC1B,0BAA0B,EAC1B,4BAA4B,GAC7B,MAAM,+BAA+B,CAAC"}

package/dist/credits/index.js

@@ -24,4 +24,4 @@
  * side-channel — same posture as the blueprint family.
  */
 export { createGetCreditBalanceHandler, } from './get-credit-balance.js';
-export { createListCreditTransactionsHandler, } from './list-credit-transactions.js';
+export { createListCreditTransactionsHandler, KNOWN_CREDIT_TRANSACTION_KINDS, } from './list-credit-transactions.js';

package/dist/credits/list-credit-transactions.d.ts

@@ -34,9 +34,28 @@ export interface CreditTransactionSource {
         nextCursor?: string;
     }>;
 }
+/**
+ * The ledger kinds this package names (ggui#1532). The vocabulary is OPEN: a
+ * deployment's ledger may carry kinds not listed here, and a reader MUST accept
+ * one it does not know, keep it as named, and never read it as a render charge.
+ * Listing a kind here documents it; it is not the set of kinds that may appear.
+ */
+export declare const KNOWN_CREDIT_TRANSACTION_KINDS: readonly ["free_credit", "render_charge", "topup", "refund"];
+/** One of the kinds this package names. */
+export type KnownCreditTransactionKind = (typeof KNOWN_CREDIT_TRANSACTION_KINDS)[number];
+/**
+ * A ledger entry's kind: a known kind, or any other non-empty kind a
+ * deployment names. The `string & {}` arm keeps the set OPEN while editors
+ * still offer the known kinds and a `switch` can name them (it needs a default).
+ */
+export type CreditTransactionKind = KnownCreditTransactionKind | (string & {});
 export interface CreditTransactionView {
     readonly transactionId: string;
-    readonly kind: 'free_credit' | 'render_charge' | 'topup' | 'refund';
+    /**
+     * The entry's kind: one of {@link KNOWN_CREDIT_TRANSACTION_KINDS}, or a kind
+     * the deployment names that this package does not. Open vocabulary.
+     */
+    readonly kind: CreditTransactionKind;
     readonly deltaCents: number;
     readonly balanceAfterCents: number;
     readonly reason: string;
@@ -58,12 +77,7 @@ export declare function createListCreditTransactionsHandler(deps: ListCreditTran
 }, {
     transactions: z.ZodArray<z.ZodObject<{
         transactionId: z.ZodString;
-        kind: z.ZodEnum<{
-            free_credit: "free_credit";
-            render_charge: "render_charge";
-            topup: "topup";
-            refund: "refund";
-        }>;
+        kind: z.ZodString;
         deltaCents: z.ZodNumber;
         balanceAfterCents: z.ZodNumber;
         reason: z.ZodString;

package/dist/credits/list-credit-transactions.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"list-credit-transactions.d.ts","sourceRoot":"","sources":["../../src/credits/list-credit-transactions.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AACH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAGxB;;;;GAIG;AACH,MAAM,WAAW,uBAAuB;IACtC,IAAI,CAAC,IAAI,EAAE;QACT,MAAM,EAAE,MAAM,CAAC;QACf,oCAAoC;QACpC,KAAK,EAAE,MAAM,CAAC;QACd,4EAA4E;QAC5E,MAAM,CAAC,EAAE,MAAM,CAAC;KACjB,GAAG,OAAO,CAAC;QACV,YAAY,EAAE,qBAAqB,EAAE,CAAC;QACtC,6CAA6C;QAC7C,UAAU,CAAC,EAAE,MAAM,CAAC;KACrB,CAAC,CAAC;CACJ;AAED,MAAM,WAAW,qBAAqB;IACpC,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;IAC/B,QAAQ,CAAC,IAAI,EAAE,aAAa,GAAG,eAAe,GAAG,OAAO,GAAG,QAAQ,CAAC;IACpE,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,iBAAiB,EAAE,MAAM,CAAC;IACnC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,gBAAgB,CAAC,EAAE,MAAM,CAAC;CACpC;AAED,MAAM,WAAW,0BAA0B;IACzC,QAAQ,CAAC,kBAAkB,EAAE,uBAAuB,CAAC;CACtD;AAyBD,MAAM,WAAW,4BAA4B;IAC3C,QAAQ,CAAC,YAAY,EAAE,qBAAqB,EAAE,CAAC;IAC/C,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAC;CAC9B;AAED,wBAAgB,mCAAmC,CACjD,IAAI,EAAE,0BAA0B;IA5BhC,2BAA2B;;IAE3B,kEAAkE;;;;;;;;;;;;;;;;;IAgBlE,oFAAoF;;;;;GAgDrF"}
+{"version":3,"file":"list-credit-transactions.d.ts","sourceRoot":"","sources":["../../src/credits/list-credit-transactions.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AACH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAGxB;;;;GAIG;AACH,MAAM,WAAW,uBAAuB;IACtC,IAAI,CAAC,IAAI,EAAE;QACT,MAAM,EAAE,MAAM,CAAC;QACf,oCAAoC;QACpC,KAAK,EAAE,MAAM,CAAC;QACd,4EAA4E;QAC5E,MAAM,CAAC,EAAE,MAAM,CAAC;KACjB,GAAG,OAAO,CAAC;QACV,YAAY,EAAE,qBAAqB,EAAE,CAAC;QACtC,6CAA6C;QAC7C,UAAU,CAAC,EAAE,MAAM,CAAC;KACrB,CAAC,CAAC;CACJ;AAED;;;;;GAKG;AACH,eAAO,MAAM,8BAA8B,8DAA+D,CAAC;AAE3G,2CAA2C;AAC3C,MAAM,MAAM,0BAA0B,GAAG,CAAC,OAAO,8BAA8B,CAAC,CAAC,MAAM,CAAC,CAAC;AAEzF;;;;GAIG;AACH,MAAM,MAAM,qBAAqB,GAAG,0BAA0B,GAAG,CAAC,MAAM,GAAG,EAAE,CAAC,CAAC;AAE/E,MAAM,WAAW,qBAAqB;IACpC,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;IAC/B;;;OAGG;IACH,QAAQ,CAAC,IAAI,EAAE,qBAAqB,CAAC;IACrC,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,iBAAiB,EAAE,MAAM,CAAC;IACnC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,gBAAgB,CAAC,EAAE,MAAM,CAAC;CACpC;AAED,MAAM,WAAW,0BAA0B;IACzC,QAAQ,CAAC,kBAAkB,EAAE,uBAAuB,CAAC;CACtD;AA8BD,MAAM,WAAW,4BAA4B;IAC3C,QAAQ,CAAC,YAAY,EAAE,qBAAqB,EAAE,CAAC;IAC/C,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAC;CAC9B;AAED,wBAAgB,mCAAmC,CACjD,IAAI,EAAE,0BAA0B;IAjChC,2BAA2B;;IAE3B,kEAAkE;;;;;;;;;;;;IAqBlE,oFAAoF;;;;;GAgDrF"}

package/dist/credits/list-credit-transactions.js

@@ -17,6 +17,13 @@
  */
 import { z } from 'zod';
 import { defineHandler } from '../types.js';
+/**
+ * The ledger kinds this package names (ggui#1532). The vocabulary is OPEN: a
+ * deployment's ledger may carry kinds not listed here, and a reader MUST accept
+ * one it does not know, keep it as named, and never read it as a render charge.
+ * Listing a kind here documents it; it is not the set of kinds that may appear.
+ */
+export const KNOWN_CREDIT_TRANSACTION_KINDS = ['free_credit', 'render_charge', 'topup', 'refund'];
 const inputSchema = {
     /** Default 20. Cap 100. */
     limit: z.number().int().min(1).max(100).optional(),
@@ -26,7 +33,10 @@ const inputSchema = {
 const outputSchema = {
     transactions: z.array(z.object({
         transactionId: z.string(),
-        kind: z.enum(['free_credit', 'render_charge', 'topup', 'refund']),
+        kind: z
+            .string()
+            .min(1)
+            .describe("The ledger entry's kind, an open vocabulary. Known kinds: 'free_credit', 'render_charge', 'topup', 'refund'. A deployment may add others: accept a kind you do not know, keep it as named, and never read it as a render charge."),
         deltaCents: z.number().int(),
         balanceAfterCents: z.number().int(),
         reason: z.string(),
@@ -41,7 +51,7 @@ export function createListCreditTransactionsHandler(deps) {
         name: 'ggui_ops_list_credit_transactions',
         title: 'List credit transactions',
         audience: ['ops'],
-        description: "Returns the calling user's credit transaction ledger, newest-first. Each row carries kind ('free_credit' | 'render_charge' | 'topup' | 'refund'), deltaCents (signed — positive for grants/topups, negative for charges), balanceAfterCents (snapshot at time of write), reason (human-readable), and optional relatedSessionId for render_charge rows. Default limit 20, cap 100; pass `cursor` from the previous response's `nextCursor` for paging.",
+        description: "Returns the calling user's credit transaction ledger, newest-first. Each row carries kind (an open vocabulary: known kinds are 'free_credit', 'render_charge', 'topup' and 'refund', and a deployment may add others; treat an unknown kind as a ledger entry of that name, never as a render charge), deltaCents (signed — positive for grants/topups, negative for charges), balanceAfterCents (snapshot at time of write), reason (human-readable), and optional relatedSessionId for render_charge rows. Default limit 20, cap 100; pass `cursor` from the previous response's `nextCursor` for paging.",
         inputSchema,
         outputSchema,
         // No `allowedFor` — same toolset on every deployment kind. Callers

package/dist/index.d.ts

@@ -15,14 +15,11 @@
  */
 export * from "./blueprints/index.js";
 export * from "./renders/index.js";
-export { AuthRequiredError, HANDLER_FAILURE_MARKER, defineHandler, handlerFailure, isHandlerFailure, } from "./types.js";
-export type { AudienceTag, EnvelopedHandlerDefinition, EnvelopeFor, HandlerContext, HandlerDefinition, HandlerFailure, ShapeOutput, SharedHandler, SharedHandlerOutputBound, SharedHandlerOutputData, SharedHandlerResult, } from "./types.js";
+export { AuthRequiredError, HANDLER_FAILURE_MARKER, createSessionRowReads, defineHandler, handlerFailure, isHandlerFailure, readSessionRow, viewProofUseFor, } from "./types.js";
+export type { AudienceTag, EnvelopedHandlerDefinition, EnvelopeFor, HandlerContext, HandlerDefinition, HandlerFailure, SessionRowReads, ShapeOutput, SharedHandler, SharedHandlerOutputBound, SharedHandlerOutputData, SharedHandlerResult, ViewProofDeclaration, ViewProofUse, } from "./types.js";
 export * from "./threads/index.js";
 export * from "./credits/index.js";
 export * from "./app-discovery/index.js";
 export * from "./ops-blueprint/index.js";
 export * from "./ops-apps/index.js";
-export * from "./ops-connector-keys/index.js";
-export * from "./ops-coupon/index.js";
-export * from "./ops-orgs/index.js";
 //# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAEH,cAAc,uBAAuB,CAAC;AACtC,cAAc,oBAAoB,CAAC;AACnC,OAAO,EACL,iBAAiB,EACjB,sBAAsB,EACtB,aAAa,EACb,cAAc,EACd,gBAAgB,GACjB,MAAM,YAAY,CAAC;AACpB,YAAY,EACV,WAAW,EACX,0BAA0B,EAC1B,WAAW,EACX,cAAc,EACd,iBAAiB,EACjB,cAAc,EACd,WAAW,EACX,aAAa,EACb,wBAAwB,EACxB,uBAAuB,EACvB,mBAAmB,GACpB,MAAM,YAAY,CAAC;AAIpB,cAAc,oBAAoB,CAAC;AAInC,cAAc,oBAAoB,CAAC;AAInC,cAAc,0BAA0B,CAAC;AAIzC,cAAc,0BAA0B,CAAC;AAMzC,cAAc,qBAAqB,CAAC;AACpC,cAAc,+BAA+B,CAAC;AAC9C,cAAc,uBAAuB,CAAC;AACtC,cAAc,qBAAqB,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAEH,cAAc,uBAAuB,CAAC;AACtC,cAAc,oBAAoB,CAAC;AACnC,OAAO,EACL,iBAAiB,EACjB,sBAAsB,EACtB,qBAAqB,EACrB,aAAa,EACb,cAAc,EACd,gBAAgB,EAChB,cAAc,EACd,eAAe,GAChB,MAAM,YAAY,CAAC;AACpB,YAAY,EACV,WAAW,EACX,0BAA0B,EAC1B,WAAW,EACX,cAAc,EACd,iBAAiB,EACjB,cAAc,EACd,eAAe,EACf,WAAW,EACX,aAAa,EACb,wBAAwB,EACxB,uBAAuB,EACvB,mBAAmB,EACnB,oBAAoB,EACpB,YAAY,GACb,MAAM,YAAY,CAAC;AAIpB,cAAc,oBAAoB,CAAC;AAInC,cAAc,oBAAoB,CAAC;AAInC,cAAc,0BAA0B,CAAC;AAIzC,cAAc,0BAA0B,CAAC;AAKzC,cAAc,qBAAqB,CAAC"}

package/dist/index.js

@@ -15,7 +15,7 @@
  */
 export * from "./blueprints/index.js";
 export * from "./renders/index.js";
-export { AuthRequiredError, HANDLER_FAILURE_MARKER, defineHandler, handlerFailure, isHandlerFailure, } from "./types.js";
+export { AuthRequiredError, HANDLER_FAILURE_MARKER, createSessionRowReads, defineHandler, handlerFailure, isHandlerFailure, readSessionRow, viewProofUseFor, } from "./types.js";
 // Persistent-chat handler family — thread storage and message
 // history MCP tools. Thin over @ggui-ai/mcp-server-core ThreadStore.
 // Available under `@ggui-ai/mcp-server-handlers/threads` subpath too.
@@ -32,12 +32,8 @@ export * from "./app-discovery/index.js";
 // served on the `/control` plane. Available under
 // `@ggui-ai/mcp-server-handlers/ops-blueprint` subpath too.
 export * from "./ops-blueprint/index.js";
-// Operator-class apps, orgs, connector-keys, and coupon handler
-// families — `ggui_ops_*` tools backing the console's management
-// surfaces, each pure over a deps seam. Subpaths:
-// `@ggui-ai/mcp-server-handlers/ops-apps`, `…/ops-orgs`,
-// `…/ops-connector-keys`, `…/ops-coupon`.
+// Operator-class apps handler family — `ggui_ops_*` tools that
+// manage a deployment's apps, pure over the `AppsSource` seam the
+// deployment binds. Available under
+// `@ggui-ai/mcp-server-handlers/ops-apps` subpath too.
 export * from "./ops-apps/index.js";
-export * from "./ops-connector-keys/index.js";
-export * from "./ops-coupon/index.js";
-export * from "./ops-orgs/index.js";

package/dist/ops-apps/create-app.d.ts

@@ -1,16 +1,15 @@
 /**
- * `ggui_ops_create_app` — provision a fresh `GguiApp` owned by the
- * calling user. Sibling of the `provisionGguiApp` AppSync mutation
- * (`backend/amplify/data/create-app/handler.ts`); same identity gate
- * (caller's sub, NEVER an argument-supplied userId), same default
- * displayName, same server-side appId allocation — exposed through
- * the `ops` MCP surface so an LLM agent in the console can create an
- * app without a custom GraphQL call.
+ * `ggui_ops_create_app` — create a new app owned by the calling user.
  *
- * Pure over the {@link AppsSource} seam. AppId minting + collision
- * retry is the adapter's responsibility — the in-memory test fake
- * picks any unique string; the cloud adapter calls the existing
- * `provisionGguiApp` Lambda which already enforces base62 + retry.
+ * The owner is always the caller's own identity (`resolveOwnerSub`),
+ * never a userId passed as an argument, so an operator agent can only
+ * create apps for the account it acts for. The appId is minted by the
+ * deployment's {@link AppsSource}: the handler never takes one from the
+ * caller, and uniqueness (including any retry on a collision) is the
+ * store's job. An in-memory store can use any unique string; a store
+ * over a database mints ids in whatever format that database keys on.
+ *
+ * Pure over the {@link AppsSource} seam.
  */
 import { z } from 'zod';
 import { type ShapeOutput } from '../types.js';

package/dist/ops-apps/create-app.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"create-app.d.ts","sourceRoot":"","sources":["../../src/ops-apps/create-app.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AACH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAiB,KAAK,WAAW,EAAuB,MAAM,aAAa,CAAC;AAEnF,OAAO,KAAK,EAAa,UAAU,EAAE,MAAM,YAAY,CAAC;AAaxD,QAAA,MAAM,YAAY;;;;;;;CAYR,CAAC;AAEX,oFAAoF;AACpF,MAAM,MAAM,eAAe,GAAG,WAAW,CAAC,OAAO,YAAY,CAAC,CAAC;AAE/D,MAAM,WAAW,aAAa;IAC5B,QAAQ,CAAC,IAAI,EAAE,UAAU,CAAC;CAC3B;AAED,wBAAgB,sBAAsB,CACpC,IAAI,EAAE,aAAa;;;;;;;;;;;;;;;;GAiCpB"}
+{"version":3,"file":"create-app.d.ts","sourceRoot":"","sources":["../../src/ops-apps/create-app.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AACH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAiB,KAAK,WAAW,EAAuB,MAAM,aAAa,CAAC;AAEnF,OAAO,KAAK,EAAa,UAAU,EAAE,MAAM,YAAY,CAAC;AAaxD,QAAA,MAAM,YAAY;;;;;;;CAYR,CAAC;AAEX,oFAAoF;AACpF,MAAM,MAAM,eAAe,GAAG,WAAW,CAAC,OAAO,YAAY,CAAC,CAAC;AAE/D,MAAM,WAAW,aAAa;IAC5B,QAAQ,CAAC,IAAI,EAAE,UAAU,CAAC;CAC3B;AAED,wBAAgB,sBAAsB,CACpC,IAAI,EAAE,aAAa;;;;;;;;;;;;;;;;GAiCpB"}

package/dist/ops-apps/create-app.js

@@ -1,16 +1,15 @@
 /**
- * `ggui_ops_create_app` — provision a fresh `GguiApp` owned by the
- * calling user. Sibling of the `provisionGguiApp` AppSync mutation
- * (`backend/amplify/data/create-app/handler.ts`); same identity gate
- * (caller's sub, NEVER an argument-supplied userId), same default
- * displayName, same server-side appId allocation — exposed through
- * the `ops` MCP surface so an LLM agent in the console can create an
- * app without a custom GraphQL call.
+ * `ggui_ops_create_app` — create a new app owned by the calling user.
  *
- * Pure over the {@link AppsSource} seam. AppId minting + collision
- * retry is the adapter's responsibility — the in-memory test fake
- * picks any unique string; the cloud adapter calls the existing
- * `provisionGguiApp` Lambda which already enforces base62 + retry.
+ * The owner is always the caller's own identity (`resolveOwnerSub`),
+ * never a userId passed as an argument, so an operator agent can only
+ * create apps for the account it acts for. The appId is minted by the
+ * deployment's {@link AppsSource}: the handler never takes one from the
+ * caller, and uniqueness (including any retry on a collision) is the
+ * store's job. An in-memory store can use any unique string; a store
+ * over a database mints ids in whatever format that database keys on.
+ *
+ * Pure over the {@link AppsSource} seam.
  */
 import { z } from 'zod';
 import { defineHandler } from '../types.js';
@@ -21,7 +20,7 @@ const inputSchema = {
         .min(1)
         .max(120)
         .optional()
-        .describe("Human-friendly label for the new app. Defaults to 'My ggui app' when absent — the same label the deployment's first-load auto-create uses."),
+        .describe("Human-friendly label for the new app. Defaults to 'My ggui app' when absent."),
 };
 const outputSchema = {
     appId: z.string(),
@@ -39,7 +38,7 @@ export function createCreateAppHandler(deps) {
         name: 'ggui_ops_create_app',
         title: 'Create app',
         audience: ['ops'],
-        description: "Provision a fresh `GguiApp` owned by the calling user: an opaque base62 appId is minted server-side, the row is owned by the caller's identity, displayName defaults to 'My ggui app' when absent (cap 120 chars). Returns the persisted shape — call `ggui_ops_set_default_app({appId})` afterwards to promote the new app to the user's default.",
+        description: "Create a new app owned by the calling user. The server mints the appId (it is never an argument), displayName defaults to 'My ggui app' when absent (max 120 chars). Returns the stored app — call `ggui_ops_set_default_app({appId})` afterwards to make it the caller's default.",
         inputSchema,
         outputSchema,
         async handler(rawInput, ctx) {

package/dist/ops-apps/identity.d.ts

@@ -1,15 +1,16 @@
 /**
- * Per-call identity resolution for `ops-apps` handlers. The console
- * surfaces these tools call against `kind: 'user'` identities — the
- * upstream `AuthAdapter` populates `ctx.userId` directly. OSS
- * single-app mode (where the auth adapter collapses `appId =
- * workspaceId ?? userId`) leaves `ctx.userId` undefined and the same
- * value sits on `ctx.appId`. Read whichever is set; fail when neither
- * is.
+ * Per-call identity resolution for `ops-apps` handlers. A deployment
+ * with per-user accounts calls these tools as `kind: 'user'`
+ * identities — the upstream `AuthAdapter` populates `ctx.userId`
+ * directly. Single-app mode (where the auth adapter collapses
+ * `appId = workspaceId ?? userId`) leaves `ctx.userId` undefined and
+ * the same value sits on `ctx.appId`. Read whichever is set; fail when
+ * neither is.
  */
 import type { HandlerContext } from '../types.js';
 /**
- * Resolve the caller's Cognito sub (or OSS-mode equivalent). Throws
+ * Resolve the caller's owner id (`ctx.userId`, or `ctx.appId` in
+ * single-app mode). Throws
  * when neither field is set — that means an unauthenticated caller
  * slipped past the upstream auth adapter, which is a real bug worth
  * surfacing as a 5xx rather than masking as "empty list".

package/dist/ops-apps/identity.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"identity.d.ts","sourceRoot":"","sources":["../../src/ops-apps/identity.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AACH,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,aAAa,CAAC;AAElD;;;;;GAKG;AACH,wBAAgB,eAAe,CAC7B,QAAQ,EAAE,MAAM,EAChB,GAAG,EAAE,cAAc,GAClB,MAAM,CAQR"}
+{"version":3,"file":"identity.d.ts","sourceRoot":"","sources":["../../src/ops-apps/identity.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AACH,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,aAAa,CAAC;AAElD;;;;;;GAMG;AACH,wBAAgB,eAAe,CAC7B,QAAQ,EAAE,MAAM,EAChB,GAAG,EAAE,cAAc,GAClB,MAAM,CAQR"}

package/dist/ops-apps/identity.js

@@ -1,5 +1,6 @@
 /**
- * Resolve the caller's Cognito sub (or OSS-mode equivalent). Throws
+ * Resolve the caller's owner id (`ctx.userId`, or `ctx.appId` in
+ * single-app mode). Throws
  * when neither field is set — that means an unauthenticated caller
  * slipped past the upstream auth adapter, which is a real bug worth
  * surfacing as a 5xx rather than masking as "empty list".

package/dist/ops-apps/index.d.ts

@@ -3,8 +3,8 @@
  *
  * Six MCP tools, all `audience: ['ops']`, all served on `/control`. Pure
  * over the {@link AppsSource} + {@link UserDefaultAppSource} seams —
- * NO AWS imports. Cloud deployments bind AWS-backed adapters; tests
- * use in-memory fakes.
+ * no storage imports. A deployment binds adapters over its own store;
+ * tests use in-memory fakes.
  *
  *   - `createListAppsHandler` → `ggui_ops_list_apps`
  *   - `createCreateAppHandler` → `ggui_ops_create_app`

package/dist/ops-apps/index.js

@@ -3,8 +3,8 @@
  *
  * Six MCP tools, all `audience: ['ops']`, all served on `/control`. Pure
  * over the {@link AppsSource} + {@link UserDefaultAppSource} seams —
- * NO AWS imports. Cloud deployments bind AWS-backed adapters; tests
- * use in-memory fakes.
+ * no storage imports. A deployment binds adapters over its own store;
+ * tests use in-memory fakes.
  *
  *   - `createListAppsHandler` → `ggui_ops_list_apps`
  *   - `createCreateAppHandler` → `ggui_ops_create_app`

package/dist/ops-apps/list-apps.d.ts

@@ -1,13 +1,12 @@
 /**
  * `ggui_ops_list_apps` — enumerate the calling user's `GguiApp` rows.
  *
- * Sibling of the console's Apps section (`apps/console/src/.../apps/`)
- * — same data, MCP surface. Pure over the {@link AppsSource} seam; a
- * production deployment binds its own implementation, tests bind an
- * in-memory Map.
+ * The MCP door onto the same data an app-management UI lists. Pure over
+ * the {@link AppsSource} seam; a production deployment binds its own
+ * implementation, tests bind an in-memory Map.
  *
- * Identity scope: caller's Cognito sub from `ctx.userId` (or
- * `ctx.appId` in OSS single-app mode). Cross-user list is impossible
+ * Identity scope: the caller's owner id from `ctx.userId` (or
+ * `ctx.appId` in single-app mode). Cross-user list is impossible
  * by construction — `AppsSource.list` only returns rows whose
  * `ownerSub` matches.
  */

package/dist/ops-apps/list-apps.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"list-apps.d.ts","sourceRoot":"","sources":["../../src/ops-apps/list-apps.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AACH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAsC,KAAK,WAAW,EAAE,MAAM,aAAa,CAAC;AAEnF,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,YAAY,CAAC;AAI7C,QAAA,MAAM,YAAY;;;;;;;;CAUR,CAAC;AAEX,oFAAoF;AACpF,MAAM,MAAM,cAAc,GAAG,WAAW,CAAC,OAAO,YAAY,CAAC,CAAC;AAE9D,MAAM,WAAW,YAAY;IAC3B,QAAQ,CAAC,IAAI,EAAE,UAAU,CAAC;CAC3B;AAED,wBAAgB,qBAAqB,CAAC,IAAI,EAAE,YAAY;;;;;;;;;;;;;;;;GA4BvD"}
+{"version":3,"file":"list-apps.d.ts","sourceRoot":"","sources":["../../src/ops-apps/list-apps.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AACH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAsC,KAAK,WAAW,EAAE,MAAM,aAAa,CAAC;AAEnF,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,YAAY,CAAC;AAI7C,QAAA,MAAM,YAAY;;;;;;;;CAUR,CAAC;AAEX,oFAAoF;AACpF,MAAM,MAAM,cAAc,GAAG,WAAW,CAAC,OAAO,YAAY,CAAC,CAAC;AAE9D,MAAM,WAAW,YAAY;IAC3B,QAAQ,CAAC,IAAI,EAAE,UAAU,CAAC;CAC3B;AAED,wBAAgB,qBAAqB,CAAC,IAAI,EAAE,YAAY;;;;;;;;;;;;;;;;GA4BvD"}

package/dist/ops-apps/list-apps.js

@@ -1,13 +1,12 @@
 /**
  * `ggui_ops_list_apps` — enumerate the calling user's `GguiApp` rows.
  *
- * Sibling of the console's Apps section (`apps/console/src/.../apps/`)
- * — same data, MCP surface. Pure over the {@link AppsSource} seam; a
- * production deployment binds its own implementation, tests bind an
- * in-memory Map.
+ * The MCP door onto the same data an app-management UI lists. Pure over
+ * the {@link AppsSource} seam; a production deployment binds its own
+ * implementation, tests bind an in-memory Map.
  *
- * Identity scope: caller's Cognito sub from `ctx.userId` (or
- * `ctx.appId` in OSS single-app mode). Cross-user list is impossible
+ * Identity scope: the caller's owner id from `ctx.userId` (or
+ * `ctx.appId` in single-app mode). Cross-user list is impossible
  * by construction — `AppsSource.list` only returns rows whose
  * `ownerSub` matches.
  */
@@ -29,7 +28,7 @@ export function createListAppsHandler(deps) {
         name: 'ggui_ops_list_apps',
         title: 'List apps',
         audience: ['ops'],
-        description: "Enumerate every `GguiApp` row owned by the calling user. Returns metadata only (appId, displayName, optional systemPrompt, createdAt, updatedAt). Same data the console's Apps section renders. Use to discover ids before calling `ggui_ops_update_app` / `ggui_ops_set_default_app` / `ggui_ops_delete_app`.",
+        description: "Enumerate every `GguiApp` row owned by the calling user. Returns metadata only (appId, displayName, optional systemPrompt, createdAt, updatedAt). Use to discover ids before calling `ggui_ops_update_app` / `ggui_ops_set_default_app` / `ggui_ops_delete_app`.",
         inputSchema,
         outputSchema,
         async handler(_input, ctx) {

package/dist/ops-apps/set-app-theme.d.ts

@@ -15,15 +15,19 @@
  *   2. attestation — `overlayHash` is recomputed with
  *      `canonicalOverlayHash` and a mismatch is refused;
  *   3. coverage — the injected overlay validator judges each mode's
- *      set against the consumed-token manifest: a key outside the
- *      manifest (`unknown`) or a consumed token left unset
- *      (`uncovered`) is refused, per mode.
+ *      set against the consumed-token manifest: a consumed token left
+ *      unset (`uncovered`) is refused, per mode. A key outside the
+ *      manifest (`unknown`) is ADMITTED, never refused (ggui#1286): the
+ *      theme is stored verbatim and the write logs the names
+ *      (`app_theme_unknown_overlay_names`).
  *
  * A refusal is a schema-conformant `{ ok: false, code:
  * 'invalid_app_config', refusal }` RESULT (not a thrown error): the
- * body is one of the four the protocol names
- * (`appThemeRefusalBodySchema`), so a client reads the same refusal
- * from REST, AppSync and this door.
+ * body is one the protocol names (`appThemeRefusalBodySchema`, five
+ * bodies; this door raises three of them: `refused: 'v1 shape'`,
+ * `overlayHash: 'mismatch'` and `uncovered`), so a client reads the
+ * same refusal from every write door a deployment offers, this one
+ * included. A body the schema itself rejects carries `issues` instead.
  *
  * Ownership: `AppsSource.get` first (scoped by `ownerSub`); cross-user
  * probes return the uniform "not found" shape. The store scopes the
@@ -102,7 +106,7 @@ declare const outputSchema: {
     readonly updatedAt: z.ZodOptional<z.ZodString>;
     /** Present on a refusal: the one refusal class this door emits. */
     readonly code: z.ZodOptional<z.ZodLiteral<"invalid_app_config">>;
-    /** Present on a coverage / attestation / v1-shape refusal — one of the four protocol-named bodies. */
+    /** Present on a coverage / attestation / v1-shape refusal — a protocol-named body (`appThemeRefusalBodySchema`). */
     readonly refusal: z.ZodOptional<z.ZodUnion<readonly [z.ZodObject<{
         uncovered: z.ZodObject<{
             light: z.ZodArray<z.ZodString>;
@@ -265,7 +269,7 @@ export declare function createSetAppThemeHandler(deps: SetAppThemeDeps): import(
     readonly updatedAt: z.ZodOptional<z.ZodString>;
     /** Present on a refusal: the one refusal class this door emits. */
     readonly code: z.ZodOptional<z.ZodLiteral<"invalid_app_config">>;
-    /** Present on a coverage / attestation / v1-shape refusal — one of the four protocol-named bodies. */
+    /** Present on a coverage / attestation / v1-shape refusal — a protocol-named body (`appThemeRefusalBodySchema`). */
     readonly refusal: z.ZodOptional<z.ZodUnion<readonly [z.ZodObject<{
         uncovered: z.ZodObject<{
             light: z.ZodArray<z.ZodString>;

package/dist/ops-apps/set-app-theme.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"set-app-theme.d.ts","sourceRoot":"","sources":["../../src/ops-apps/set-app-theme.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgCG;AACH,OAAO,EAIL,KAAK,QAAQ,EACb,KAAK,mBAAmB,EAEzB,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAIL,KAAK,mBAAmB,EACzB,MAAM,aAAa,CAAC;AAGrB,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,YAAY,CAAC;AAE7C;;;;GAIG;AACH,MAAM,MAAM,wBAAwB,GAAG,CAAC,OAAO,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,KAAK;IACpF,QAAQ,CAAC,SAAS,EAAE,SAAS,MAAM,EAAE,CAAC;IACtC,QAAQ,CAAC,OAAO,EAAE,SAAS,MAAM,EAAE,CAAC;IACpC,QAAQ,CAAC,QAAQ,EAAE,SAAS,MAAM,EAAE,CAAC;CACtC,CAAC;AAcF,QAAA,MAAM,YAAY;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;IAKhB,mEAAmE;;IAEnE,sGAAsG;;;;;;;;;;;;;;;;;;IAEtG,yFAAyF;;CAEjF,CAAC;AAEX,uEAAuE;AACvE,MAAM,MAAM,iBAAiB,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC,OAAO,YAAY,CAAC,CAAC,CAAC;AAE1E,MAAM,WAAW,eAAe;IAC9B,QAAQ,CAAC,IAAI,EAAE,UAAU,CAAC;IAC1B,8FAA8F;IAC9F,QAAQ,CAAC,eAAe,EAAE,wBAAwB,CAAC;CACpD;AAED,0EAA0E;AAC1E,MAAM,MAAM,iBAAiB,GACzB;IACE,QAAQ,CAAC,EAAE,EAAE,IAAI,CAAC;IAClB,QAAQ,CAAC,KAAK,EAAE,QAAQ,CAAC;IACzB,8GAA8G;IAC9G,QAAQ,CAAC,OAAO,EAAE;QAAE,QAAQ,CAAC,KAAK,EAAE,SAAS,MAAM,EAAE,CAAC;QAAC,QAAQ,CAAC,IAAI,EAAE,SAAS,MAAM,EAAE,CAAA;KAAE,CAAC;CAC3F,GACD;IAAE,QAAQ,CAAC,EAAE,EAAE,KAAK,CAAC;IAAC,QAAQ,CAAC,OAAO,EAAE,mBAAmB,CAAA;CAAE,GAC7D;IAAE,QAAQ,CAAC,EAAE,EAAE,KAAK,CAAC;IAAC,QAAQ,CAAC,MAAM,EAAE,SAAS,MAAM,EAAE,CAAA;CAAE,CAAC;AAY/D;;;;;;;GAOG;AACH,wBAAsB,aAAa,CACjC,GAAG,EAAE,OAAO,EACZ,eAAe,EAAE,wBAAwB,GACxC,OAAO,CAAC,iBAAiB,CAAC,CAmB5B;AAqBD,wBAAgB,wBAAwB,CAAC,IAAI,EAAE,eAAe;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;IAzF5D,mEAAmE;;IAEnE,sGAAsG;;;;;;;;;;;;;;;;;;IAEtG,yFAAyF;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;IAmI1F"}
+{"version":3,"file":"set-app-theme.d.ts","sourceRoot":"","sources":["../../src/ops-apps/set-app-theme.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAoCG;AACH,OAAO,EAIL,KAAK,QAAQ,EACb,KAAK,mBAAmB,EAEzB,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAIL,KAAK,mBAAmB,EACzB,MAAM,aAAa,CAAC;AAGrB,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,YAAY,CAAC;AAE7C;;;;GAIG;AACH,MAAM,MAAM,wBAAwB,GAAG,CAAC,OAAO,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,KAAK;IACpF,QAAQ,CAAC,SAAS,EAAE,SAAS,MAAM,EAAE,CAAC;IACtC,QAAQ,CAAC,OAAO,EAAE,SAAS,MAAM,EAAE,CAAC;IACpC,QAAQ,CAAC,QAAQ,EAAE,SAAS,MAAM,EAAE,CAAC;CACtC,CAAC;AAcF,QAAA,MAAM,YAAY;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;IAKhB,mEAAmE;;IAEnE,oHAAoH;;;;;;;;;;;;;;;;;;IAEpH,yFAAyF;;CAEjF,CAAC;AAEX,uEAAuE;AACvE,MAAM,MAAM,iBAAiB,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC,OAAO,YAAY,CAAC,CAAC,CAAC;AAE1E,MAAM,WAAW,eAAe;IAC9B,QAAQ,CAAC,IAAI,EAAE,UAAU,CAAC;IAC1B,8FAA8F;IAC9F,QAAQ,CAAC,eAAe,EAAE,wBAAwB,CAAC;CACpD;AAED,0EAA0E;AAC1E,MAAM,MAAM,iBAAiB,GACzB;IACE,QAAQ,CAAC,EAAE,EAAE,IAAI,CAAC;IAClB,QAAQ,CAAC,KAAK,EAAE,QAAQ,CAAC;IACzB,8GAA8G;IAC9G,QAAQ,CAAC,OAAO,EAAE;QAAE,QAAQ,CAAC,KAAK,EAAE,SAAS,MAAM,EAAE,CAAC;QAAC,QAAQ,CAAC,IAAI,EAAE,SAAS,MAAM,EAAE,CAAA;KAAE,CAAC;CAC3F,GACD;IAAE,QAAQ,CAAC,EAAE,EAAE,KAAK,CAAC;IAAC,QAAQ,CAAC,OAAO,EAAE,mBAAmB,CAAA;CAAE,GAC7D;IAAE,QAAQ,CAAC,EAAE,EAAE,KAAK,CAAC;IAAC,QAAQ,CAAC,MAAM,EAAE,SAAS,MAAM,EAAE,CAAA;CAAE,CAAC;AAY/D;;;;;;;GAOG;AACH,wBAAsB,aAAa,CACjC,GAAG,EAAE,OAAO,EACZ,eAAe,EAAE,wBAAwB,GACxC,OAAO,CAAC,iBAAiB,CAAC,CAmB5B;AAqBD,wBAAgB,wBAAwB,CAAC,IAAI,EAAE,eAAe;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;IAzF5D,mEAAmE;;IAEnE,oHAAoH;;;;;;;;;;;;;;;;;;IAEpH,yFAAyF;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;IAmI1F"}

package/dist/ops-apps/set-app-theme.js

@@ -15,15 +15,19 @@
  *   2. attestation — `overlayHash` is recomputed with
  *      `canonicalOverlayHash` and a mismatch is refused;
  *   3. coverage — the injected overlay validator judges each mode's
- *      set against the consumed-token manifest: a key outside the
- *      manifest (`unknown`) or a consumed token left unset
- *      (`uncovered`) is refused, per mode.
+ *      set against the consumed-token manifest: a consumed token left
+ *      unset (`uncovered`) is refused, per mode. A key outside the
+ *      manifest (`unknown`) is ADMITTED, never refused (ggui#1286): the
+ *      theme is stored verbatim and the write logs the names
+ *      (`app_theme_unknown_overlay_names`).
  *
  * A refusal is a schema-conformant `{ ok: false, code:
  * 'invalid_app_config', refusal }` RESULT (not a thrown error): the
- * body is one of the four the protocol names
- * (`appThemeRefusalBodySchema`), so a client reads the same refusal
- * from REST, AppSync and this door.
+ * body is one the protocol names (`appThemeRefusalBodySchema`, five
+ * bodies; this door raises three of them: `refused: 'v1 shape'`,
+ * `overlayHash: 'mismatch'` and `uncovered`), so a client reads the
+ * same refusal from every write door a deployment offers, this one
+ * included. A body the schema itself rejects carries `issues` instead.
  *
  * Ownership: `AppsSource.get` first (scoped by `ownerSub`); cross-user
  * probes return the uniform "not found" shape. The store scopes the
@@ -50,7 +54,7 @@ const outputSchema = {
     updatedAt: z.string().optional(),
     /** Present on a refusal: the one refusal class this door emits. */
     code: z.literal('invalid_app_config').optional(),
-    /** Present on a coverage / attestation / v1-shape refusal — one of the four protocol-named bodies. */
+    /** Present on a coverage / attestation / v1-shape refusal — a protocol-named body (`appThemeRefusalBodySchema`). */
     refusal: appThemeRefusalBodySchema.optional(),
     /** Present on a shape refusal the schema itself raised — its messages, one per issue. */
     issues: z.array(z.string()).optional(),

package/dist/ops-apps/set-default-app.d.ts

@@ -2,8 +2,7 @@
  * `ggui_ops_set_default_app` — write the calling user's
  * `GguiUser.defaultAppId` column.
  *
- * Sibling of the `useGguiUser` first-load hook (`apps/console/.../use-ggui-user`).
- * Same column, MCP surface. The handler chains `AppsSource.get` first
+ * The MCP door onto the user's default-app setting. The handler chains `AppsSource.get` first
  * (verify the user owns the target appId) before writing
  * `UserDefaultAppSource.setDefault` — invariant: `defaultAppId` MUST
  * point at an app the user owns.

package/dist/ops-apps/set-default-app.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"set-default-app.d.ts","sourceRoot":"","sources":["../../src/ops-apps/set-default-app.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AACH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAIxB,OAAO,KAAK,EAAE,UAAU,EAAE,oBAAoB,EAAE,MAAM,YAAY,CAAC;AAenE,MAAM,WAAW,mBAAmB;IAClC,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;CAC/B;AAED,MAAM,WAAW,iBAAiB;IAChC,QAAQ,CAAC,IAAI,EAAE,UAAU,CAAC;IAC1B,QAAQ,CAAC,cAAc,EAAE,oBAAoB,CAAC;CAC/C;AAED,wBAAgB,0BAA0B,CACxC,IAAI,EAAE,iBAAiB;;;;wBA8BxB"}
+{"version":3,"file":"set-default-app.d.ts","sourceRoot":"","sources":["../../src/ops-apps/set-default-app.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AACH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAIxB,OAAO,KAAK,EAAE,UAAU,EAAE,oBAAoB,EAAE,MAAM,YAAY,CAAC;AAenE,MAAM,WAAW,mBAAmB;IAClC,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;CAC/B;AAED,MAAM,WAAW,iBAAiB;IAChC,QAAQ,CAAC,IAAI,EAAE,UAAU,CAAC;IAC1B,QAAQ,CAAC,cAAc,EAAE,oBAAoB,CAAC;CAC/C;AAED,wBAAgB,0BAA0B,CACxC,IAAI,EAAE,iBAAiB;;;;wBA8BxB"}

package/dist/ops-apps/set-default-app.js

@@ -2,8 +2,7 @@
  * `ggui_ops_set_default_app` — write the calling user's
  * `GguiUser.defaultAppId` column.
  *
- * Sibling of the `useGguiUser` first-load hook (`apps/console/.../use-ggui-user`).
- * Same column, MCP surface. The handler chains `AppsSource.get` first
+ * The MCP door onto the user's default-app setting. The handler chains `AppsSource.get` first
  * (verify the user owns the target appId) before writing
  * `UserDefaultAppSource.setDefault` — invariant: `defaultAppId` MUST
  * point at an app the user owns.