@ggui-ai/mcp-server-handlers 0.8.0 → 0.10.0

package/dist/blueprints/describe-data-contract-format.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"describe-data-contract-format.d.ts","sourceRoot":"","sources":["../../src/blueprints/describe-data-contract-format.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AACH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AAEjD,QAAA,MAAM,WAAW,IAAK,CAAC;AAEvB,QAAA,MAAM,YAAY;;;;;;;CASjB,CAAC;AAEF,UAAU,gCAAgC;IACxC,QAAQ,CAAC,MAAM,EAAE,cAAc,CAAC;IAChC,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;IAC/B,QAAQ,CAAC,QAAQ,EAAE,aAAa,CAAC;QAC/B,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;QACvB,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;KAC5C,CAAC,CAAC;CACJ;AA+RD,wBAAgB,uCAAuC,IAAI,aAAa,CACtE,OAAO,WAAW,EAClB,OAAO,YAAY,EACnB,gCAAgC,CACjC,CAiBA"}
+{"version":3,"file":"describe-data-contract-format.d.ts","sourceRoot":"","sources":["../../src/blueprints/describe-data-contract-format.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AACH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AAEjD,QAAA,MAAM,WAAW,IAAK,CAAC;AAEvB,QAAA,MAAM,YAAY;;;;;;;CASjB,CAAC;AAEF,UAAU,gCAAgC;IACxC,QAAQ,CAAC,MAAM,EAAE,cAAc,CAAC;IAChC,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;IAC/B,QAAQ,CAAC,QAAQ,EAAE,aAAa,CAAC;QAC/B,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;QACvB,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;KAC5C,CAAC,CAAC;CACJ;AAyUD,wBAAgB,uCAAuC,IAAI,aAAa,CACtE,OAAO,WAAW,EAClB,OAAO,YAAY,EACnB,gCAAgC,CACjC,CAiBA"}

package/dist/blueprints/describe-data-contract-format.js

@@ -8,6 +8,7 @@
  * what Claude composes and what `ggui_protocol_validate_blueprint` expects.
  */
 import { z } from 'zod';
+import { RETIRED_CONTRACT_FIELDS } from '@ggui-ai/protocol';
 const inputSchema = {};
 const outputSchema = {
     format: z.literal('DataContract'),
@@ -17,6 +18,12 @@ const outputSchema = {
         contract: z.record(z.string(), z.unknown()),
     })),
 };
+/** The retired-field table, derived from the protocol's own list. */
+function retiredFieldsBlock() {
+    return Object.entries(RETIRED_CONTRACT_FIELDS)
+        .map(([field, replacement]) => `- \`${field}\` → \`${replacement}\``)
+        .join('\n');
+}
 const DOCUMENTATION = `# DataContract format
 
 Top-level shape on every blueprint's \`contract\` field:
@@ -62,7 +69,7 @@ interface PropsSpec {
   description?: string;
   properties: Record<string, {
     schema: JsonSchema;       // draft-07 subset: type, enum, items, properties
-    required?: boolean;       // default true
+    required?: boolean;       // required at the wire gate ONLY when \`true\`; omitted ⇒ optional
     description?: string;
     default?: JsonValue;
     example?: JsonValue;
@@ -70,16 +77,19 @@ interface PropsSpec {
 }
 \`\`\`
 
-The boilerplate generator turns each \`properties\` entry into a typed
-TypeScript field on \`Props\`. \`required: false\` becomes \`field?:\`.
-\`schema.nullable: true\` becomes \`| null\`.
+\`required\` is opt-in: the render gate (\`validateContract\` → props
+validation) treats a prop as required only when the entry says
+\`required: true\`; an omitted \`required\` means the render MAY leave
+that prop out. Declare \`required: true\` on every prop the component
+cannot paint without. (The boilerplate generator types the TypeScript
+field from the same flag; \`schema.nullable: true\` becomes \`| null\`.)
 
 ## ActionSpec entry
 
 \`\`\`ts
 interface ActionEntry {
-  /** Human label — drives button copy / accessibility name. */
-  label?: string;
+  /** Human label — drives button copy / accessibility name. REQUIRED. */
+  label: string;
   description?: string;
   /** Optional payload schema. Action with a payload becomes useAction<T>. */
   schema?: JsonSchema;
@@ -209,6 +219,38 @@ UI-side lifecycle; the agent never invokes them. Values reach the
 agent only when threaded into a contextSpec slot or actionSpec
 payload.
 
+## Retired top-level fields (hard errors)
+
+These names were retired by the flatten and are REJECTED by the
+contract gate at handshake and render — not ignored, not migrated.
+Each maps to where the same intent lives now:
+
+${retiredFieldsBlock()}
+
+## What the contract gate checks (handshake AND render, same gate)
+
+The one deterministic gate (\`validateContract\`) runs at the handshake
+(the forgiving path repairs what it can and reports the rest as
+\`validationFindings\`; on the render's STRICT \`override.contract\` it
+fails the call). Every rule below is enforced there:
+
+- **Wrapper shape** — every entry under \`propsSpec.properties\` /
+  \`actionSpec\` / \`streamSpec\` / \`contextSpec\` is a WRAPPER with the
+  JSON Schema in its \`schema:\` field; wrappers reject unrecognized keys.
+- **Inner schemas compile** — each \`schema:\` must be a valid draft-07
+  JSON Schema under strict meta-validation (\`type\` present, no unknown
+  keywords).
+- **References resolve** — \`actionSpec[*].nextStep\` and
+  \`streamSpec[*].source.tool\` MUST name a key of
+  \`agentCapabilities.tools\` on the same contract.
+- **Schema compat** — an \`actionSpec[*].schema\` must be a SUBSET of the
+  referenced tool's \`inputSchema\` (payloads travel UI → tool), and a
+  \`streamSpec[*].schema\` a SUPERSET of the referenced tool's
+  \`outputSchema\` (payloads travel tool → channel).
+- **Reserved channels** — \`streamSpec\` names may not use the
+  \`_ggui:\` prefix (server-owned channels).
+- **Retired fields** — the list above.
+
 ## defineContract helper (TypeScript only)
 
 \`\`\`ts

package/dist/credits/get-credit-balance.d.ts

@@ -9,12 +9,17 @@
  * deployment backs it with a real credit-balance datastore; tests
  * inject an in-memory fake.
  *
- * Identity scope: the handler reads the caller's userId from
- * `ctx.appId`. The auth adapter resolves `appId = workspaceId ?? userId`,
- * which IS the userId for the end-user single-tenant default. See
- * `packages/mcp-server/src/auth.ts#defaultAppIdFromIdentity`. The tool
- * is registered on every deployment kind; callers without a credit
- * account (e.g. agent-builder identities) get the zero-row
+ * Identity scope: credit rows are keyed by USER identity, so the
+ * handler reads `ctx.userId` when the host's auth layer resolves a
+ * distinct per-user identity (multi-tenant hosts where `ctx.appId`
+ * names the caller's active app, not the caller), and falls back to
+ * `ctx.appId` for single-tenant hosts whose auth adapter folds the
+ * user into the app slot (`appId = workspaceId ?? userId` — see
+ * `packages/mcp-server/src/auth.ts#defaultAppIdFromIdentity`).
+ * Reading `ctx.appId` alone silently returns the zero-row fallback
+ * for every multi-tenant caller — an app id never keys a credit row.
+ * The tool is registered on every deployment kind; callers without a
+ * credit account (e.g. agent-builder identities) get the zero-row
  * fallback.
  */
 import { z } from 'zod';

package/dist/credits/get-credit-balance.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"get-credit-balance.d.ts","sourceRoot":"","sources":["../../src/credits/get-credit-balance.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AACH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AAEjD;;;;;;;;GAQG;AACH,MAAM,WAAW,mBAAmB;IAClC,yFAAyF;IACzF,UAAU,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,iBAAiB,GAAG,IAAI,CAAC,CAAC;CAC/D;AAED,MAAM,WAAW,iBAAiB;IAChC,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;IAC9B,QAAQ,CAAC,oBAAoB,EAAE,MAAM,CAAC;IACtC,QAAQ,CAAC,kBAAkB,EAAE,MAAM,CAAC;IACpC,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;CAC5B;AAED,MAAM,WAAW,oBAAoB;IACnC;;;;;;OAMG;IACH,QAAQ,CAAC,aAAa,EAAE,mBAAmB,CAAC;CAC7C;AAED,QAAA,MAAM,WAAW,IAAqC,CAAC;AAEvD,QAAA,MAAM,YAAY;IAChB,yDAAyD;;IAEzD,0DAA0D;;IAE1D,4CAA4C;;IAE5C,+CAA+C;;CAEhD,CAAC;AAEF,MAAM,WAAW,sBAAsB;IACrC,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;IAC9B,QAAQ,CAAC,oBAAoB,EAAE,MAAM,CAAC;IACtC,QAAQ,CAAC,kBAAkB,EAAE,MAAM,CAAC;IACpC,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;CAC5B;AAED,wBAAgB,6BAA6B,CAC3C,IAAI,EAAE,oBAAoB,GACzB,aAAa,CAAC,OAAO,WAAW,EAAE,OAAO,YAAY,EAAE,sBAAsB,CAAC,CAwChF"}
+{"version":3,"file":"get-credit-balance.d.ts","sourceRoot":"","sources":["../../src/credits/get-credit-balance.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AAEjD;;;;;;;;GAQG;AACH,MAAM,WAAW,mBAAmB;IAClC,yFAAyF;IACzF,UAAU,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,iBAAiB,GAAG,IAAI,CAAC,CAAC;CAC/D;AAED,MAAM,WAAW,iBAAiB;IAChC,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;IAC9B,QAAQ,CAAC,oBAAoB,EAAE,MAAM,CAAC;IACtC,QAAQ,CAAC,kBAAkB,EAAE,MAAM,CAAC;IACpC,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;CAC5B;AAED,MAAM,WAAW,oBAAoB;IACnC;;;;;;OAMG;IACH,QAAQ,CAAC,aAAa,EAAE,mBAAmB,CAAC;CAC7C;AAED,QAAA,MAAM,WAAW,IAAqC,CAAC;AAEvD,QAAA,MAAM,YAAY;IAChB,yDAAyD;;IAEzD,0DAA0D;;IAE1D,4CAA4C;;IAE5C,+CAA+C;;CAEhD,CAAC;AAEF,MAAM,WAAW,sBAAsB;IACrC,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;IAC9B,QAAQ,CAAC,oBAAoB,EAAE,MAAM,CAAC;IACtC,QAAQ,CAAC,kBAAkB,EAAE,MAAM,CAAC;IACpC,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;CAC5B;AAED,wBAAgB,6BAA6B,CAC3C,IAAI,EAAE,oBAAoB,GACzB,aAAa,CAAC,OAAO,WAAW,EAAE,OAAO,YAAY,EAAE,sBAAsB,CAAC,CA4ChF"}

package/dist/credits/get-credit-balance.js

@@ -9,12 +9,17 @@
  * deployment backs it with a real credit-balance datastore; tests
  * inject an in-memory fake.
  *
- * Identity scope: the handler reads the caller's userId from
- * `ctx.appId`. The auth adapter resolves `appId = workspaceId ?? userId`,
- * which IS the userId for the end-user single-tenant default. See
- * `packages/mcp-server/src/auth.ts#defaultAppIdFromIdentity`. The tool
- * is registered on every deployment kind; callers without a credit
- * account (e.g. agent-builder identities) get the zero-row
+ * Identity scope: credit rows are keyed by USER identity, so the
+ * handler reads `ctx.userId` when the host's auth layer resolves a
+ * distinct per-user identity (multi-tenant hosts where `ctx.appId`
+ * names the caller's active app, not the caller), and falls back to
+ * `ctx.appId` for single-tenant hosts whose auth adapter folds the
+ * user into the app slot (`appId = workspaceId ?? userId` — see
+ * `packages/mcp-server/src/auth.ts#defaultAppIdFromIdentity`).
+ * Reading `ctx.appId` alone silently returns the zero-row fallback
+ * for every multi-tenant caller — an app id never keys a credit row.
+ * The tool is registered on every deployment kind; callers without a
+ * credit account (e.g. agent-builder identities) get the zero-row
  * fallback.
  */
 import { z } from 'zod';
@@ -41,9 +46,13 @@ export function createGetCreditBalanceHandler(deps) {
         // without a credit account get the zero-row fallback below; no
         // separate "tool not registered" UX needed.
         async handler(_input, ctx) {
-            const userId = ctx.appId;
+            // USER identity first — on multi-tenant hosts `ctx.appId` is the
+            // caller's active app, which never keys a credit row (see the
+            // module docstring). Single-tenant hosts leave `ctx.userId`
+            // unset and fold the user into the app slot.
+            const userId = ctx.userId ?? ctx.appId;
             if (!userId) {
-                throw new Error('ggui_get_credit_balance: missing caller identity (ctx.appId unset)');
+                throw new Error('ggui_get_credit_balance: missing caller identity (ctx.userId and ctx.appId both unset)');
             }
             const balance = await deps.creditBalance.getBalance(userId);
             if (!balance) {

package/dist/credits/list-credit-transactions.d.ts

@@ -10,8 +10,10 @@
  * `(userId, transactionId)` key, newest-first sort); tests inject an
  * in-memory fake.
  *
- * Identity scope mirrors get-credit-balance: `ctx.appId` IS the
- * userId for end-user callers.
+ * Identity scope mirrors get-credit-balance: `ctx.userId` when the
+ * host resolves a distinct per-user identity, else `ctx.appId` (the
+ * single-tenant fold) — see that module's docstring for why reading
+ * `ctx.appId` alone loses every multi-tenant caller.
  */
 import { z } from 'zod';
 import type { SharedHandler } from '../types.js';

package/dist/credits/list-credit-transactions.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"list-credit-transactions.d.ts","sourceRoot":"","sources":["../../src/credits/list-credit-transactions.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AACH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AAEjD;;;;;GAKG;AACH,MAAM,WAAW,uBAAuB;IACtC,IAAI,CAAC,IAAI,EAAE;QACT,MAAM,EAAE,MAAM,CAAC;QACf,oCAAoC;QACpC,KAAK,EAAE,MAAM,CAAC;QACd,4EAA4E;QAC5E,MAAM,CAAC,EAAE,MAAM,CAAC;KACjB,GAAG,OAAO,CAAC;QACV,YAAY,EAAE,qBAAqB,EAAE,CAAC;QACtC,6CAA6C;QAC7C,UAAU,CAAC,EAAE,MAAM,CAAC;KACrB,CAAC,CAAC;CACJ;AAED,MAAM,WAAW,qBAAqB;IACpC,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;IAC/B,QAAQ,CAAC,IAAI,EAAE,aAAa,GAAG,eAAe,GAAG,OAAO,GAAG,QAAQ,CAAC;IACpE,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,iBAAiB,EAAE,MAAM,CAAC;IACnC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,gBAAgB,CAAC,EAAE,MAAM,CAAC;CACpC;AAED,MAAM,WAAW,0BAA0B;IACzC,QAAQ,CAAC,kBAAkB,EAAE,uBAAuB,CAAC;CACtD;AAED,QAAA,MAAM,WAAW;IACf,2BAA2B;;IAE3B,kEAAkE;;CAEnE,CAAC;AAEF,QAAA,MAAM,YAAY;;;;;;;;;;;;;;;IAYhB,oFAAoF;;CAErF,CAAC;AAEF,MAAM,WAAW,4BAA4B;IAC3C,QAAQ,CAAC,YAAY,EAAE,qBAAqB,EAAE,CAAC;IAC/C,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAC;CAC9B;AAED,wBAAgB,mCAAmC,CACjD,IAAI,EAAE,0BAA0B,GAC/B,aAAa,CAAC,OAAO,WAAW,EAAE,OAAO,YAAY,EAAE,4BAA4B,CAAC,CAkCtF"}
+{"version":3,"file":"list-credit-transactions.d.ts","sourceRoot":"","sources":["../../src/credits/list-credit-transactions.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AACH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AAEjD;;;;;GAKG;AACH,MAAM,WAAW,uBAAuB;IACtC,IAAI,CAAC,IAAI,EAAE;QACT,MAAM,EAAE,MAAM,CAAC;QACf,oCAAoC;QACpC,KAAK,EAAE,MAAM,CAAC;QACd,4EAA4E;QAC5E,MAAM,CAAC,EAAE,MAAM,CAAC;KACjB,GAAG,OAAO,CAAC;QACV,YAAY,EAAE,qBAAqB,EAAE,CAAC;QACtC,6CAA6C;QAC7C,UAAU,CAAC,EAAE,MAAM,CAAC;KACrB,CAAC,CAAC;CACJ;AAED,MAAM,WAAW,qBAAqB;IACpC,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;IAC/B,QAAQ,CAAC,IAAI,EAAE,aAAa,GAAG,eAAe,GAAG,OAAO,GAAG,QAAQ,CAAC;IACpE,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,iBAAiB,EAAE,MAAM,CAAC;IACnC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,gBAAgB,CAAC,EAAE,MAAM,CAAC;CACpC;AAED,MAAM,WAAW,0BAA0B;IACzC,QAAQ,CAAC,kBAAkB,EAAE,uBAAuB,CAAC;CACtD;AAED,QAAA,MAAM,WAAW;IACf,2BAA2B;;IAE3B,kEAAkE;;CAEnE,CAAC;AAEF,QAAA,MAAM,YAAY;;;;;;;;;;;;;;;IAYhB,oFAAoF;;CAErF,CAAC;AAEF,MAAM,WAAW,4BAA4B;IAC3C,QAAQ,CAAC,YAAY,EAAE,qBAAqB,EAAE,CAAC;IAC/C,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAC;CAC9B;AAED,wBAAgB,mCAAmC,CACjD,IAAI,EAAE,0BAA0B,GAC/B,aAAa,CAAC,OAAO,WAAW,EAAE,OAAO,YAAY,EAAE,4BAA4B,CAAC,CAqCtF"}

package/dist/credits/list-credit-transactions.js

@@ -10,8 +10,10 @@
  * `(userId, transactionId)` key, newest-first sort); tests inject an
  * in-memory fake.
  *
- * Identity scope mirrors get-credit-balance: `ctx.appId` IS the
- * userId for end-user callers.
+ * Identity scope mirrors get-credit-balance: `ctx.userId` when the
+ * host resolves a distinct per-user identity, else `ctx.appId` (the
+ * single-tenant fold) — see that module's docstring for why reading
+ * `ctx.appId` alone loses every multi-tenant caller.
  */
 import { z } from 'zod';
 const inputSchema = {
@@ -44,9 +46,12 @@ export function createListCreditTransactionsHandler(deps) {
         // No `allowedFor` — same toolset on every pod kind. Callers
         // without a credit account see an empty ledger.
         async handler(rawInput, ctx) {
-            const userId = ctx.appId;
+            // USER identity first — `ctx.appId` is the active app on
+            // multi-tenant hosts and never keys a ledger row (see
+            // get-credit-balance's module docstring).
+            const userId = ctx.userId ?? ctx.appId;
             if (!userId) {
-                throw new Error('ggui_list_credit_transactions: missing caller identity (ctx.appId unset)');
+                throw new Error('ggui_list_credit_transactions: missing caller identity (ctx.userId and ctx.appId both unset)');
             }
             const parsed = z.object(inputSchema).parse(rawInput);
             const limit = parsed.limit ?? 20;

package/dist/ops-blueprint/app-access.d.ts

@@ -0,0 +1,37 @@
+import type { HandlerContext } from "../types.js";
+export type OpsBlueprintAppAccess = {
+    readonly allowed: true;
+} | {
+    readonly allowed: false;
+    readonly reason: "not_found" | "not_owner";
+};
+export interface OpsBlueprintAppAuthorizer {
+    (ctx: HandlerContext, appId: string): Promise<OpsBlueprintAppAccess>;
+}
+export declare class CrossAppCurationUnavailableError extends Error {
+    readonly code: "cross_app_curation_unavailable";
+    constructor(toolName: string);
+}
+export declare class AppCurationDeniedError extends Error {
+    readonly reason: "not_found" | "not_owner";
+    readonly code: "app_curation_denied";
+    constructor(toolName: string, appId: string, reason: "not_found" | "not_owner");
+}
+export interface ResolveEffectiveAppIdArgs {
+    readonly toolName: string;
+    readonly inputAppId: string | undefined;
+    readonly ctx: HandlerContext;
+    readonly authorize?: OpsBlueprintAppAuthorizer;
+}
+/**
+ * One resolution rule for the whole ops-blueprint family.
+ *
+ * Seam bound → the authorizer is the single authority on app access:
+ * it is consulted on EVERY call (input omitted or equal included), so
+ * fast paths live inside the deployment's authorizer where its trust
+ * model is visible — never here.
+ *
+ * Seam unbound → legacy bound-only posture, fail closed on cross-app.
+ */
+export declare function resolveEffectiveAppId(args: ResolveEffectiveAppIdArgs): Promise<string>;
+//# sourceMappingURL=app-access.d.ts.map

package/dist/ops-blueprint/app-access.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"app-access.d.ts","sourceRoot":"","sources":["../../src/ops-blueprint/app-access.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,aAAa,CAAC;AAElD,MAAM,MAAM,qBAAqB,GAC7B;IAAE,QAAQ,CAAC,OAAO,EAAE,IAAI,CAAA;CAAE,GAC1B;IAAE,QAAQ,CAAC,OAAO,EAAE,KAAK,CAAC;IAAC,QAAQ,CAAC,MAAM,EAAE,WAAW,GAAG,WAAW,CAAA;CAAE,CAAC;AAE5E,MAAM,WAAW,yBAAyB;IACxC,CAAC,GAAG,EAAE,cAAc,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,qBAAqB,CAAC,CAAC;CACtE;AAED,qBAAa,gCAAiC,SAAQ,KAAK;IACzD,QAAQ,CAAC,IAAI,EAAG,gCAAgC,CAAU;gBAC9C,QAAQ,EAAE,MAAM;CAM7B;AAED,qBAAa,sBAAuB,SAAQ,KAAK;IAK7C,QAAQ,CAAC,MAAM,EAAE,WAAW,GAAG,WAAW;IAJ5C,QAAQ,CAAC,IAAI,EAAG,qBAAqB,CAAU;gBAE7C,QAAQ,EAAE,MAAM,EAChB,KAAK,EAAE,MAAM,EACJ,MAAM,EAAE,WAAW,GAAG,WAAW;CAS7C;AAED,MAAM,WAAW,yBAAyB;IACxC,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,UAAU,EAAE,MAAM,GAAG,SAAS,CAAC;IACxC,QAAQ,CAAC,GAAG,EAAE,cAAc,CAAC;IAC7B,QAAQ,CAAC,SAAS,CAAC,EAAE,yBAAyB,CAAC;CAChD;AAED;;;;;;;;;GASG;AACH,wBAAsB,qBAAqB,CAAC,IAAI,EAAE,yBAAyB,GAAG,OAAO,CAAC,MAAM,CAAC,CAiB5F"}

package/dist/ops-blueprint/app-access.js

@@ -0,0 +1,45 @@
+export class CrossAppCurationUnavailableError extends Error {
+    code = "cross_app_curation_unavailable";
+    constructor(toolName) {
+        super(`${toolName}: cross_app_curation_unavailable — this deployment does not accept an appId different from the caller's bound app. Bind an app-access authorizer to enable cross-app curation.`);
+        this.name = "CrossAppCurationUnavailableError";
+    }
+}
+export class AppCurationDeniedError extends Error {
+    reason;
+    code = "app_curation_denied";
+    constructor(toolName, appId, reason) {
+        super(reason === "not_found"
+            ? `${toolName}: app ${JSON.stringify(appId)} not found.`
+            : `${toolName}: app ${JSON.stringify(appId)} is not curatable by this caller — variant curation is limited to the app's operator.`);
+        this.reason = reason;
+        this.name = "AppCurationDeniedError";
+    }
+}
+/**
+ * One resolution rule for the whole ops-blueprint family.
+ *
+ * Seam bound → the authorizer is the single authority on app access:
+ * it is consulted on EVERY call (input omitted or equal included), so
+ * fast paths live inside the deployment's authorizer where its trust
+ * model is visible — never here.
+ *
+ * Seam unbound → legacy bound-only posture, fail closed on cross-app.
+ */
+export async function resolveEffectiveAppId(args) {
+    const { toolName, inputAppId, ctx, authorize } = args;
+    const effective = inputAppId ?? (ctx.appId !== "" ? ctx.appId : undefined);
+    if (effective === undefined) {
+        throw new Error(`${toolName}: missing caller identity (appId empty) — bind an app identity or pass the appId input.`);
+    }
+    if (authorize !== undefined) {
+        const access = await authorize(ctx, effective);
+        if (!access.allowed)
+            throw new AppCurationDeniedError(toolName, effective, access.reason);
+        return effective;
+    }
+    if (inputAppId !== undefined && inputAppId !== ctx.appId) {
+        throw new CrossAppCurationUnavailableError(toolName);
+    }
+    return effective;
+}

package/dist/ops-blueprint/delete.d.ts

@@ -8,11 +8,15 @@
  * ## Tenancy
  *
  * The blueprint id is globally unique, but the delete path scopes
- * by `ctx.appId`: if the row exists AND its `appId` doesn't match
- * the caller's, the handler treats it as "not found from the
- * caller's perspective" and returns `{deleted: true}` — a uniform
- * shape that doesn't leak whether the id exists in another tenant.
- * The store's underlying delete is NOT invoked in that case.
+ * by the resolved effective appId (see {@link resolveEffectiveAppId}):
+ * if the row exists AND its `appId` doesn't match, the handler
+ * treats it as "not found from the caller's perspective" and
+ * returns `{deleted: true}` — a uniform shape that doesn't leak
+ * whether the id exists in another tenant. The store's underlying
+ * delete is NOT invoked in that case. This row-level uniformity is
+ * separate from (and downstream of) the app-level authorizer check:
+ * a foreign `appId` input the authorizer denies surfaces the denial
+ * error before the row lookup ever runs.
  *
  * ## Audience
  *
@@ -22,7 +26,9 @@ import { z } from 'zod';
 import { type OpsDeleteBlueprintOutput } from '@ggui-ai/protocol';
 import type { BlueprintStore } from '@ggui-ai/mcp-server-core';
 import type { SharedHandler } from '../types.js';
+import { type OpsBlueprintAppAuthorizer } from './app-access.js';
 declare const opsInputSchema: {
+    appId: z.ZodOptional<z.ZodString>;
     blueprintId: z.ZodString;
 };
 declare const opsOutputSchema: {
@@ -33,6 +39,21 @@ declare const opsOutputSchema: {
  */
 export interface GguiOpsDeleteBlueprintDeps {
     readonly blueprintStore: BlueprintStore;
+    /**
+     * Optional app-access authorizer — when bound, consulted on EVERY
+     * resolution (see {@link resolveEffectiveAppId}) to decide whether
+     * the caller may curate the effective `appId`, including cross-app
+     * calls that supply an explicit `appId` input different from
+     * `ctx.appId`. Unbound: legacy bound-only posture, cross-app input
+     * fails closed with `CrossAppCurationUnavailableError`.
+     *
+     * This app-level check runs BEFORE the row-level tenancy lookup
+     * below: a foreign `appId` INPUT denied by the authorizer surfaces
+     * the denial error, while an authorizer-approved effective appId
+     * still hits the row-level uniform `{deleted: true}` posture when
+     * the target row belongs to a different app (no existence leak).
+     */
+    readonly authorizeAppAccess?: OpsBlueprintAppAuthorizer;
 }
 export declare function createGguiOpsDeleteBlueprintHandler(deps: GguiOpsDeleteBlueprintDeps): SharedHandler<typeof opsInputSchema, typeof opsOutputSchema, OpsDeleteBlueprintOutput>;
 export {};

package/dist/ops-blueprint/delete.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"delete.d.ts","sourceRoot":"","sources":["../../src/ops-blueprint/delete.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;GAmBG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAGL,KAAK,wBAAwB,EAC9B,MAAM,mBAAmB,CAAC;AAC3B,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,0BAA0B,CAAC;AAC/D,OAAO,KAAK,EAAkB,aAAa,EAAE,MAAM,aAAa,CAAC;AAEjE,QAAA,MAAM,cAAc;;CAAsC,CAAC;AAC3D,QAAA,MAAM,eAAe;;CAEX,CAAC;AAEX;;GAEG;AACH,MAAM,WAAW,0BAA0B;IACzC,QAAQ,CAAC,cAAc,EAAE,cAAc,CAAC;CACzC;AAED,wBAAgB,mCAAmC,CACjD,IAAI,EAAE,0BAA0B,GAC/B,aAAa,CACd,OAAO,cAAc,EACrB,OAAO,eAAe,EACtB,wBAAwB,CACzB,CAqCA"}
+{"version":3,"file":"delete.d.ts","sourceRoot":"","sources":["../../src/ops-blueprint/delete.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAGL,KAAK,wBAAwB,EAC9B,MAAM,mBAAmB,CAAC;AAC3B,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,0BAA0B,CAAC;AAC/D,OAAO,KAAK,EAAkB,aAAa,EAAE,MAAM,aAAa,CAAC;AACjE,OAAO,EAAyB,KAAK,yBAAyB,EAAE,MAAM,iBAAiB,CAAC;AAExF,QAAA,MAAM,cAAc;;;CAAsC,CAAC;AAC3D,QAAA,MAAM,eAAe;;CAEX,CAAC;AAEX;;GAEG;AACH,MAAM,WAAW,0BAA0B;IACzC,QAAQ,CAAC,cAAc,EAAE,cAAc,CAAC;IACxC;;;;;;;;;;;;;OAaG;IACH,QAAQ,CAAC,kBAAkB,CAAC,EAAE,yBAAyB,CAAC;CACzD;AAED,wBAAgB,mCAAmC,CACjD,IAAI,EAAE,0BAA0B,GAC/B,aAAa,CACd,OAAO,cAAc,EACrB,OAAO,eAAe,EACtB,wBAAwB,CACzB,CAuCA"}

package/dist/ops-blueprint/delete.js

@@ -8,11 +8,15 @@
  * ## Tenancy
  *
  * The blueprint id is globally unique, but the delete path scopes
- * by `ctx.appId`: if the row exists AND its `appId` doesn't match
- * the caller's, the handler treats it as "not found from the
- * caller's perspective" and returns `{deleted: true}` — a uniform
- * shape that doesn't leak whether the id exists in another tenant.
- * The store's underlying delete is NOT invoked in that case.
+ * by the resolved effective appId (see {@link resolveEffectiveAppId}):
+ * if the row exists AND its `appId` doesn't match, the handler
+ * treats it as "not found from the caller's perspective" and
+ * returns `{deleted: true}` — a uniform shape that doesn't leak
+ * whether the id exists in another tenant. The store's underlying
+ * delete is NOT invoked in that case. This row-level uniformity is
+ * separate from (and downstream of) the app-level authorizer check:
+ * a foreign `appId` input the authorizer denies surfaces the denial
+ * error before the row lookup ever runs.
  *
  * ## Audience
  *
@@ -20,6 +24,7 @@
  */
 import { z } from 'zod';
 import { opsDeleteBlueprintInputSchema, } from '@ggui-ai/protocol';
+import { resolveEffectiveAppId } from './app-access.js';
 const opsInputSchema = opsDeleteBlueprintInputSchema.shape;
 const opsOutputSchema = {
     deleted: z.literal(true),
@@ -29,20 +34,23 @@ export function createGguiOpsDeleteBlueprintHandler(deps) {
         name: 'ggui_ops_delete_blueprint',
         title: 'Delete blueprint',
         audience: ['ops'],
-        description: "Remove a blueprint row by id. Idempotent — a second delete for the same id returns `{deleted: true}` without throwing. Cross-tenant probes return the same shape (no existence leak across apps). Mirrors `BlueprintStore.delete`'s no-throw contract.",
+        description: "Remove a blueprint row by id. Idempotent — a second delete for the same id returns `{deleted: true}` without throwing. Cross-tenant probes return the same shape (no existence leak across apps). Mirrors `BlueprintStore.delete`'s no-throw contract. App-scoped variant curation for an app you operate — distinct from the personal saved-blueprint library (the _my_ tools).",
         inputSchema: opsInputSchema,
         outputSchema: opsOutputSchema,
         async handler(rawInput, ctx) {
-            if (!ctx.appId) {
-                throw new Error('ggui_ops_delete_blueprint: missing caller identity (appId empty)');
-            }
             const parsed = opsDeleteBlueprintInputSchema.parse(rawInput);
+            const appId = await resolveEffectiveAppId({
+                toolName: 'ggui_ops_delete_blueprint',
+                inputAppId: parsed.appId,
+                ctx,
+                ...(deps.authorizeAppAccess ? { authorize: deps.authorizeAppAccess } : {}),
+            });
             const existing = await deps.blueprintStore.get(parsed.blueprintId);
             if (existing === null) {
                 // Unknown id — idempotent. Return the success shape.
                 return { deleted: true };
             }
-            if (existing.appId !== ctx.appId) {
+            if (existing.appId !== appId) {
                 // Cross-tenant probe — return the success shape WITHOUT
                 // actually deleting. Uniform shape across "doesn't exist"
                 // and "exists in another tenant" prevents id-existence

package/dist/ops-blueprint/generate.d.ts

@@ -17,7 +17,8 @@
  *      early-detection signal, not a gate.
  *   3. Compute `contractHash` via the canonical RFC 8785 (JCS)
  *      helper `blueprintKey(contract)`.
- *   4. Resolve LLM credentials via `deps.resolveLlm(ctx)`. Throw
+ *   4. Resolve LLM credentials via `deps.resolveLlm({...ctx, appId})`
+ *      — `ctx` widened with the resolved effective appId. Throw
  *      {@link MissingCredentialsError} when `null`.
  *   5. Dispatch through `generator.generate({...})`.
  *   6. On `result.ok === true`, persist via `BlueprintStore.put({...})`
@@ -50,7 +51,9 @@ import { type Blueprint, type DataContract, type OpsGenerateBlueprintOutput } fr
 import { z } from "zod";
 import { type BlueprintRegistryDeps, type GenerationCredentials } from "../renders/index.js";
 import type { HandlerContext, SharedHandler } from "../types.js";
+import { type OpsBlueprintAppAuthorizer } from "./app-access.js";
 declare const opsInputSchema: {
+    appId: z.ZodOptional<z.ZodString>;
     contract: z.ZodType<import("@ggui-ai/protocol").DataContract, unknown, z.core.$ZodTypeInternals<import("@ggui-ai/protocol").DataContract, unknown>>;
     generator: z.ZodOptional<z.ZodString>;
     persona: z.ZodOptional<z.ZodString>;
@@ -96,10 +99,10 @@ export interface GguiOpsGenerateBlueprintDeps {
     readonly blueprintStore: BlueprintStore;
     /**
      * Per-app blueprint enumerator — used for the persona near-dup
-     * check. Reads every blueprint under `ctx.appId` to gather the
-     * existing persona tag set. Optional — when omitted, the
-     * near-dup check is skipped (cloud adapters that bind their own
-     * AppListableBlueprintStore via the search seam supply this
+     * check. Reads every blueprint under the resolved `appId` to
+     * gather the existing persona tag set. Optional — when omitted,
+     * the near-dup check is skipped (cloud adapters that bind their
+     * own AppListableBlueprintStore via the search seam supply this
      * explicitly).
      */
     readonly listAllForApp?: (appId: string) => Promise<readonly Blueprint[]>;
@@ -171,6 +174,15 @@ export interface GguiOpsGenerateBlueprintDeps {
      * Tests override to produce stable blueprint ids.
      */
     readonly mintBlueprintId?: () => string;
+    /**
+     * Optional app-access authorizer — when bound, consulted on EVERY
+     * resolution (see {@link resolveEffectiveAppId}) to decide whether
+     * the caller may curate the effective `appId`, including cross-app
+     * calls that supply an explicit `appId` input different from
+     * `ctx.appId`. Unbound: legacy bound-only posture, cross-app input
+     * fails closed with `CrossAppCurationUnavailableError`.
+     */
+    readonly authorizeAppAccess?: OpsBlueprintAppAuthorizer;
 }
 export declare function createGguiOpsGenerateBlueprintHandler(deps: GguiOpsGenerateBlueprintDeps): SharedHandler<typeof opsInputSchema, typeof opsOutputSchema, OpsGenerateBlueprintOutput>;
 export {};

package/dist/ops-blueprint/generate.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"generate.d.ts","sourceRoot":"","sources":["../../src/ops-blueprint/generate.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8CG;AAEH,OAAO,KAAK,EACV,gBAAgB,EAChB,iBAAiB,EACjB,cAAc,EACd,iBAAiB,EACjB,aAAa,EAGd,MAAM,0BAA0B,CAAC;AAClC,OAAO,EAGL,KAAK,SAAS,EACd,KAAK,YAAY,EAGjB,KAAK,0BAA0B,EAChC,MAAM,mBAAmB,CAAC;AAG3B,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAGxB,OAAO,EAEL,KAAK,qBAAqB,EAC1B,KAAK,qBAAqB,EAC3B,MAAM,qBAAqB,CAAC;AAC7B,OAAO,KAAK,EAAE,cAAc,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AAQjE,QAAA,MAAM,cAAc;;;;;;;;CAAwC,CAAC;AAC7D,QAAA,MAAM,eAAe;;;;;;;;;CAWb,CAAC;AAET;;;;;;GAMG;AACH,MAAM,WAAW,WAAW;IAC1B,CAAC,QAAQ,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CACxD;AAED;;GAEG;AACH,MAAM,WAAW,4BAA4B;IAC3C;;;;OAIG;IACH,QAAQ,CAAC,QAAQ,EAAE,iBAAiB,CAAC;IACrC;;;OAGG;IACH,QAAQ,CAAC,cAAc,EAAE,cAAc,CAAC;IACxC;;;;;;;OAOG;IACH,QAAQ,CAAC,aAAa,CAAC,EAAE,CAAC,KAAK,EAAE,MAAM,KAAK,OAAO,CAAC,SAAS,SAAS,EAAE,CAAC,CAAC;IAC1E;;;;;;;OAOG;IACH,QAAQ,CAAC,gBAAgB,CAAC,EAAE,gBAAgB,CAAC;IAC7C;;;;;OAKG;IACH,QAAQ,CAAC,UAAU,EAAE,CACnB,GAAG,EAAE,cAAc,KAChB,OAAO,CAAC,qBAAqB,GAAG,IAAI,CAAC,GAAG,qBAAqB,GAAG,IAAI,CAAC;IAC1E;;;;OAIG;IACH,QAAQ,CAAC,UAAU,EAAE,iBAAiB,CAAC;IACvC;;;;;;OAMG;IACH,QAAQ,CAAC,OAAO,CAAC,EAAE,WAAW,CAAC;IAC/B;;;;;;;;;;;;;;;;;;;;OAoBG;IACH,QAAQ,CAAC,aAAa,CAAC,EAAE,qBAAqB,CAAC;IAC/C;;;;OAIG;IACH,QAAQ,CAAC,SAAS,CAAC,EAAE,aAAa,CAAC;IACnC;;;OAGG;IACH,QAAQ,CAAC,GAAG,CAAC,EAAE,MAAM,MAAM,CAAC;IAC5B;;;OAGG;IACH,QAAQ,CAAC,eAAe,CAAC,EAAE,MAAM,MAAM,CAAC;CACzC;AAmCD,wBAAgB,qCAAqC,CACnD,IAAI,EAAE,4BAA4B,GACjC,aAAa,CAAC,OAAO,cAAc,EAAE,OAAO,eAAe,EAAE,0BAA0B,CAAC,CAyP1F"}
+{"version":3,"file":"generate.d.ts","sourceRoot":"","sources":["../../src/ops-blueprint/generate.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+CG;AAEH,OAAO,KAAK,EACV,gBAAgB,EAChB,iBAAiB,EACjB,cAAc,EACd,iBAAiB,EACjB,aAAa,EAGd,MAAM,0BAA0B,CAAC;AAClC,OAAO,EAGL,KAAK,SAAS,EACd,KAAK,YAAY,EAGjB,KAAK,0BAA0B,EAChC,MAAM,mBAAmB,CAAC;AAG3B,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAGxB,OAAO,EAEL,KAAK,qBAAqB,EAC1B,KAAK,qBAAqB,EAC3B,MAAM,qBAAqB,CAAC;AAC7B,OAAO,KAAK,EAAE,cAAc,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AACjE,OAAO,EAAyB,KAAK,yBAAyB,EAAE,MAAM,iBAAiB,CAAC;AAQxF,QAAA,MAAM,cAAc;;;;;;;;;CAAwC,CAAC;AAC7D,QAAA,MAAM,eAAe;;;;;;;;;CAWb,CAAC;AAET;;;;;;GAMG;AACH,MAAM,WAAW,WAAW;IAC1B,CAAC,QAAQ,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CACxD;AAED;;GAEG;AACH,MAAM,WAAW,4BAA4B;IAC3C;;;;OAIG;IACH,QAAQ,CAAC,QAAQ,EAAE,iBAAiB,CAAC;IACrC;;;OAGG;IACH,QAAQ,CAAC,cAAc,EAAE,cAAc,CAAC;IACxC;;;;;;;OAOG;IACH,QAAQ,CAAC,aAAa,CAAC,EAAE,CAAC,KAAK,EAAE,MAAM,KAAK,OAAO,CAAC,SAAS,SAAS,EAAE,CAAC,CAAC;IAC1E;;;;;;;OAOG;IACH,QAAQ,CAAC,gBAAgB,CAAC,EAAE,gBAAgB,CAAC;IAC7C;;;;;OAKG;IACH,QAAQ,CAAC,UAAU,EAAE,CACnB,GAAG,EAAE,cAAc,KAChB,OAAO,CAAC,qBAAqB,GAAG,IAAI,CAAC,GAAG,qBAAqB,GAAG,IAAI,CAAC;IAC1E;;;;OAIG;IACH,QAAQ,CAAC,UAAU,EAAE,iBAAiB,CAAC;IACvC;;;;;;OAMG;IACH,QAAQ,CAAC,OAAO,CAAC,EAAE,WAAW,CAAC;IAC/B;;;;;;;;;;;;;;;;;;;;OAoBG;IACH,QAAQ,CAAC,aAAa,CAAC,EAAE,qBAAqB,CAAC;IAC/C;;;;OAIG;IACH,QAAQ,CAAC,SAAS,CAAC,EAAE,aAAa,CAAC;IACnC;;;OAGG;IACH,QAAQ,CAAC,GAAG,CAAC,EAAE,MAAM,MAAM,CAAC;IAC5B;;;OAGG;IACH,QAAQ,CAAC,eAAe,CAAC,EAAE,MAAM,MAAM,CAAC;IACxC;;;;;;;OAOG;IACH,QAAQ,CAAC,kBAAkB,CAAC,EAAE,yBAAyB,CAAC;CACzD;AAmCD,wBAAgB,qCAAqC,CACnD,IAAI,EAAE,4BAA4B,GACjC,aAAa,CAAC,OAAO,cAAc,EAAE,OAAO,eAAe,EAAE,0BAA0B,CAAC,CAmQ1F"}

package/dist/ops-blueprint/generate.js

@@ -17,7 +17,8 @@
  *      early-detection signal, not a gate.
  *   3. Compute `contractHash` via the canonical RFC 8785 (JCS)
  *      helper `blueprintKey(contract)`.
- *   4. Resolve LLM credentials via `deps.resolveLlm(ctx)`. Throw
+ *   4. Resolve LLM credentials via `deps.resolveLlm({...ctx, appId})`
+ *      — `ctx` widened with the resolved effective appId. Throw
  *      {@link MissingCredentialsError} when `null`.
  *   5. Dispatch through `generator.generate({...})`.
  *   6. On `result.ok === true`, persist via `BlueprintStore.put({...})`
@@ -52,6 +53,7 @@ import { z } from "zod";
 import { assertContractNoRetiredFields } from "../renders/assert-contract-no-retired-fields.js";
 import { assertGadgetsRegistered } from "../renders/assert-gadgets.js";
 import { registerBlueprint, } from "../renders/index.js";
+import { resolveEffectiveAppId } from "./app-access.js";
 import { GenerationFailedError, GeneratorNotFoundError, MissingCredentialsError, } from "./errors.js";
 import { findNearDuplicatePersona, normalizePersona } from "./persona-normalization.js";
 const opsInputSchema = opsGenerateBlueprintInputSchema.shape;
@@ -107,14 +109,17 @@ export function createGguiOpsGenerateBlueprintHandler(deps) {
         name: "ggui_ops_generate_blueprint",
         title: "Generate blueprint",
         audience: ["ops"],
-        description: "Author a new blueprint variant for the caller's app. Dispatches through the registry's selected generator (defaults to `registry.defaultGenerator()` when the slug is omitted) and persists the resulting code body + metadata against a fresh `blueprintId`. Optionally pins the new blueprint as the operator default for its `(appId, contractHash)` group. Persona tags are normalized (lowercase + trim); near-duplicates surface a warning via telemetry. Returns the new id + content-hash + validator score + the stamped provenance (`source`, llm arm: engine generator slug + model, from the engine's own metadata stamp) — code body lives in the bound store, fetched via render's fast-path on cache hit.",
+        description: "Author a new blueprint variant for the target app (the caller's bound app by default, or an explicitly named app the deployment's authorization policy accepts). Dispatches through the registry's selected generator (defaults to `registry.defaultGenerator()` when the slug is omitted) and persists the resulting code body + metadata against a fresh `blueprintId`. Optionally pins the new blueprint as the operator default for its `(appId, contractHash)` group. Persona tags are normalized (lowercase + trim); near-duplicates surface a warning via telemetry. Returns the new id + content-hash + validator score + the stamped provenance (`source`, llm arm: engine generator slug + model, from the engine's own metadata stamp) — code body lives in the bound store, fetched via render's fast-path on cache hit. App-scoped variant curation for an app you operate — distinct from the personal saved-blueprint library (the _my_ tools).",
         inputSchema: opsInputSchema,
         outputSchema: opsOutputSchema,
         async handler(rawInput, ctx) {
-            if (!ctx.appId) {
-                throw new Error("ggui_ops_generate_blueprint: missing caller identity (appId empty)");
-            }
             const parsed = opsGenerateBlueprintInputSchema.parse(rawInput);
+            const appId = await resolveEffectiveAppId({
+                toolName: "ggui_ops_generate_blueprint",
+                inputAppId: parsed.appId,
+                ctx,
+                ...(deps.authorizeAppAccess ? { authorize: deps.authorizeAppAccess } : {}),
+            });
             // Reject retired top-level contract fields BEFORE any
             // persistence so an operator-supplied row can't smuggle
             // deprecated vocabulary (`terminal`, `consumeSpec`,
@@ -136,7 +141,7 @@ export function createGguiOpsGenerateBlueprintHandler(deps) {
             // instead of just the STDLIB seed.
             let resolvedAppLibraries;
             if (deps.appMetadataStore) {
-                const appRecord = await deps.appMetadataStore.get(ctx.appId);
+                const appRecord = await deps.appMetadataStore.get(appId);
                 assertGadgetsRegistered(parsed.contract, appRecord?.gadgets);
                 resolvedAppLibraries = appRecord?.gadgets;
             }
@@ -146,7 +151,7 @@ export function createGguiOpsGenerateBlueprintHandler(deps) {
             const normalizedPersona = normalizePersona(parsed.persona);
             if (normalizedPersona !== undefined && deps.listAllForApp) {
                 try {
-                    const allForApp = await deps.listAllForApp(ctx.appId);
+                    const allForApp = await deps.listAllForApp(appId);
                     const existingPersonas = new Set();
                     for (const row of allForApp) {
                         if (row.variance.persona)
@@ -161,7 +166,7 @@ export function createGguiOpsGenerateBlueprintHandler(deps) {
                                 name: "blueprint.near_duplicate_persona",
                                 at: Date.now(),
                                 attributes: {
-                                    appId: ctx.appId,
+                                    appId,
                                     requestId: ctx.requestId,
                                     newPersona: check.newPersona,
                                     nearestExisting: check.nearestExisting ?? "",
@@ -184,7 +189,7 @@ export function createGguiOpsGenerateBlueprintHandler(deps) {
             const contract = parsed.contract;
             const contractHash = blueprintKey(contract);
             // 4. Resolve LLM credentials.
-            const creds = await deps.resolveLlm(ctx);
+            const creds = await deps.resolveLlm({ ...ctx, appId });
             if (creds === null) {
                 throw new MissingCredentialsError();
             }
@@ -198,6 +203,12 @@ export function createGguiOpsGenerateBlueprintHandler(deps) {
                 contract,
                 llm: creds.selection,
                 providerKey: creds.providerKey,
+                // The EFFECTIVE app — the one being curated, which may differ
+                // from `ctx.appId`. Generators resolve their gadget catalog from
+                // it when `appGadgets` wasn't pre-fetched, and deployments that
+                // meter generation per app attribute the call by it. Always
+                // threaded: a generator that never reads it is unaffected.
+                appId,
                 ...(resolvedAppLibraries !== undefined ? { appGadgets: resolvedAppLibraries } : {}),
             };
             let result;
@@ -232,7 +243,7 @@ export function createGguiOpsGenerateBlueprintHandler(deps) {
             const blueprint = {
                 blueprintId,
                 contractHash,
-                appId: ctx.appId,
+                appId,
                 codeHash,
                 source,
                 variance: {
@@ -261,7 +272,7 @@ export function createGguiOpsGenerateBlueprintHandler(deps) {
                     const intentForCache = parsed.seedPrompt ??
                         normalizedPersona ??
                         `operator-authored blueprint (${blueprintId})`;
-                    await registerBlueprint(deps.cacheRegistry, ctx.appId, {
+                    await registerBlueprint(deps.cacheRegistry, appId, {
                         kind: "template",
                         contract,
                         intent: intentForCache,
@@ -281,7 +292,7 @@ export function createGguiOpsGenerateBlueprintHandler(deps) {
                             name: "blueprint.cache_mirror_failed",
                             at: Date.now(),
                             attributes: {
-                                appId: ctx.appId,
+                                appId,
                                 requestId: ctx.requestId,
                                 blueprintId,
                                 contractHash,
@@ -304,7 +315,7 @@ export function createGguiOpsGenerateBlueprintHandler(deps) {
                     name: "blueprint.generated",
                     at: Date.now(),
                     attributes: {
-                        appId: ctx.appId,
+                        appId,
                         requestId: ctx.requestId,
                         blueprintId,
                         contractHash,