@ggui-ai/mcp-server 0.15.0 → 0.17.0

package/dist/api-renders-routes.d.ts

@@ -44,7 +44,6 @@
  *     or the render was reset). Clients re-mount from /state.
  */
 import type { AppMetadataStore, CodeStore, GguiSessionStore } from "@ggui-ai/mcp-server-core";
-import { type AppThemeBase } from "@ggui-ai/mcp-server-handlers/renders";
 import { type McpAppAiGguiRenderMeta } from "@ggui-ai/protocol/integrations/mcp-apps";
 import type { Express } from "express";
 import type { Logger } from "./logger.js";
@@ -57,12 +56,6 @@ interface MountOptions {
     readonly secret: string;
     /** Per-app metadata store for the publicEnv projection (optional). */
     readonly appMetadataStore?: AppMetadataStore;
-    /**
-     * Runtime theme-registration resolver (ggui#598-C) — same contract
-     * as `RenderSliceMetaDeps.themeBaseProvider`; bound by the server
-     * composer so /state cannot drift from the result-meta emitters.
-     */
-    readonly themeBaseProvider?: (appId: string, themeName: string) => Promise<AppThemeBase | null> | AppThemeBase | null;
     /** Operator-picked theme preset id stamped on /state reads. */
     readonly themeId?: string;
     /** Operator-picked theme mode stamped on /state reads. */

package/dist/api-renders-routes.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"api-renders-routes.d.ts","sourceRoot":"","sources":["../src/api-renders-routes.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4CG;AAEH,OAAO,KAAK,EAAE,gBAAgB,EAAE,SAAS,EAAE,gBAAgB,EAAE,MAAM,0BAA0B,CAAC;AAE9F,OAAO,EAKL,KAAK,YAAY,EAElB,MAAM,sCAAsC,CAAC;AAC9C,OAAO,EAGL,KAAK,sBAAsB,EAC5B,MAAM,yCAAyC,CAAC;AACjD,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,SAAS,CAAC;AACvC,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,aAAa,CAAC;AAE1C,UAAU,YAAY;IACpB,iCAAiC;IACjC,QAAQ,CAAC,GAAG,EAAE,OAAO,CAAC;IACtB,+CAA+C;IAC/C,QAAQ,CAAC,WAAW,EAAE,gBAAgB,CAAC;IACvC,wEAAwE;IACxE,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,sEAAsE;IACtE,QAAQ,CAAC,gBAAgB,CAAC,EAAE,gBAAgB,CAAC;IAC7C;;;;OAIG;IACH,QAAQ,CAAC,iBAAiB,CAAC,EAAE,CAC3B,KAAK,EAAE,MAAM,EACb,SAAS,EAAE,MAAM,KACd,OAAO,CAAC,YAAY,GAAG,IAAI,CAAC,GAAG,YAAY,GAAG,IAAI,CAAC;IACxD,+DAA+D;IAC/D,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC;IAC1B,0DAA0D;IAC1D,QAAQ,CAAC,SAAS,CAAC,EAAE,sBAAsB,CAAC,WAAW,CAAC,CAAC;IACzD,sEAAsE;IACtE,QAAQ,CAAC,SAAS,CAAC,EAAE,SAAS,CAAC;IAC/B,sEAAsE;IACtE,QAAQ,CAAC,aAAa,CAAC,EAAE,MAAM,CAAC;IAChC;;;;;;;OAOG;IACH,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAC;IAC9B;;;;;;OAMG;IACH,QAAQ,CAAC,iBAAiB,CAAC,EAAE,CAAC,IAAI,EAAE;QAClC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;QACtB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;QACtB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;KACvB,KAAK,MAAM,GAAG,SAAS,CAAC;IACzB,qEAAqE;IACrE,QAAQ,CAAC,aAAa,CAAC,EAAE,CACvB,SAAS,EAAE,MAAM,EACjB,KAAK,EAAE,MAAM,KACV;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAC;QAAC,SAAS,EAAE,MAAM,CAAA;KAAE,CAAC;IACzD,oEAAoE;IACpE,QAAQ,CAAC,iBAAiB,EAAE,MAAM,MAAM,CAAC;IACzC,iDAAiD;IACjD,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;CACzB;AAED;;;;GAIG;AACH,wBAAgB,qBAAqB,CAAC,IAAI,EAAE,YAAY,GAAG,IAAI,CAgX9D"}
+{"version":3,"file":"api-renders-routes.d.ts","sourceRoot":"","sources":["../src/api-renders-routes.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4CG;AAEH,OAAO,KAAK,EAAE,gBAAgB,EAAE,SAAS,EAAE,gBAAgB,EAAE,MAAM,0BAA0B,CAAC;AAQ9F,OAAO,EAGL,KAAK,sBAAsB,EAC5B,MAAM,yCAAyC,CAAC;AACjD,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,SAAS,CAAC;AACvC,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,aAAa,CAAC;AAE1C,UAAU,YAAY;IACpB,iCAAiC;IACjC,QAAQ,CAAC,GAAG,EAAE,OAAO,CAAC;IACtB,+CAA+C;IAC/C,QAAQ,CAAC,WAAW,EAAE,gBAAgB,CAAC;IACvC,wEAAwE;IACxE,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,sEAAsE;IACtE,QAAQ,CAAC,gBAAgB,CAAC,EAAE,gBAAgB,CAAC;IAC7C,+DAA+D;IAC/D,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC;IAC1B,0DAA0D;IAC1D,QAAQ,CAAC,SAAS,CAAC,EAAE,sBAAsB,CAAC,WAAW,CAAC,CAAC;IACzD,sEAAsE;IACtE,QAAQ,CAAC,SAAS,CAAC,EAAE,SAAS,CAAC;IAC/B,sEAAsE;IACtE,QAAQ,CAAC,aAAa,CAAC,EAAE,MAAM,CAAC;IAChC;;;;;;;OAOG;IACH,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAC;IAC9B;;;;;;OAMG;IACH,QAAQ,CAAC,iBAAiB,CAAC,EAAE,CAAC,IAAI,EAAE;QAClC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;QACtB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;QACtB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;KACvB,KAAK,MAAM,GAAG,SAAS,CAAC;IACzB,qEAAqE;IACrE,QAAQ,CAAC,aAAa,CAAC,EAAE,CACvB,SAAS,EAAE,MAAM,EACjB,KAAK,EAAE,MAAM,KACV;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAC;QAAC,SAAS,EAAE,MAAM,CAAA;KAAE,CAAC;IACzD,oEAAoE;IACpE,QAAQ,CAAC,iBAAiB,EAAE,MAAM,MAAM,CAAC;IACzC,iDAAiD;IACjD,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;CACzB;AAED;;;;GAIG;AACH,wBAAgB,qBAAqB,CAAC,IAAI,EAAE,YAAY,GAAG,IAAI,CAgX9D"}

package/dist/api-renders-routes.js

@@ -44,7 +44,7 @@
  *     or the render was reset). Clients re-mount from /state.
  */
 import { verifyToken } from "@ggui-ai/mcp-server-core";
-import { deriveContractBundle, derivePublicEnvProjection, deriveRenderMeta, withResolvedThemeBase, spreadRenderMetaViewOntoSlice, } from "@ggui-ai/mcp-server-handlers/renders";
+import { deriveContractBundle, derivePublicEnvProjection, deriveRenderMeta, spreadRenderMetaViewOntoSlice, } from "@ggui-ai/mcp-server-handlers/renders";
 import { composeSessionApiUrls, MCP_APP_AI_GGUI_RENDER_META_KEY, } from "@ggui-ai/protocol/integrations/mcp-apps";
 /**
  * Mount `GET /api/sessions/:sessionId/state` +
@@ -90,7 +90,7 @@ export function mountApiRendersRoutes(opts) {
             res.status(401).type("text/plain").send("wsToken invalid");
             return;
         }
-        // Tenancy gate: the wsToken's claimed sessionId MUST match the
+        // Binding gate: the wsToken's claimed sessionId MUST match the
         // URL's sessionId. A wsToken minted for render A MUST NOT read
         // render B's state.
         if (verify.claims.sessionId !== sessionId) {
@@ -116,7 +116,7 @@ export function mountApiRendersRoutes(opts) {
             res.status(404).type("text/plain").send("render not found");
             return;
         }
-        // Tenancy gate (round 2): the wsToken's appId MUST match the
+        // App-scope gate (round 2): the wsToken's appId MUST match the
         // render's appId. Closes the case where a render is created
         // under a different appId than the token was minted for.
         if (verify.claims.appId !== stored.appId) {
@@ -137,7 +137,7 @@ export function mountApiRendersRoutes(opts) {
         // R6 addition: polling clients use it to initialize the R7 /events
         // cursor (`?sinceSequence=N`) aligned with the WS stream.
         const view = !isMcpApps
-            ? await withResolvedThemeBase(deriveRenderMeta(render), opts, render.appId)
+            ? deriveRenderMeta(render)
             : undefined;
         let statePublicEnv;
         if (appMetadataStore && !isMcpApps) {
@@ -361,7 +361,7 @@ export function mountApiRendersRoutes(opts) {
             res.status(404).type("text/plain").send("render not found");
             return;
         }
-        // Tenancy gate (round 2): the wsToken's appId MUST match the
+        // App-scope gate (round 2): the wsToken's appId MUST match the
         // render's appId. We need the render record to check — fetch
         // it. listEventsSince validated the render exists.
         const stored = await renderStore.get(sessionId);

package/dist/api-renders-stream-route.js

@@ -63,7 +63,7 @@ class SseSink {
     /**
      * Invoked exactly once, from `end()`, BEFORE the response closes —
      * the route assigns its teardown (clear heartbeat + detach) here so
-     * a channel-initiated `end` (pod shutdown, expiry probe) tears the
+     * a channel-initiated `end` (server shutdown, expiry probe) tears the
      * subscriber down through the same single path as a client close.
      */
     onEnd;
@@ -141,7 +141,7 @@ export function mountApiRendersStreamRoute(opts) {
             res.status(401).type("text/plain").send("wsToken invalid");
             return;
         }
-        // Tenancy gate: the wsToken's claimed sessionId MUST match the
+        // Binding gate: the wsToken's claimed sessionId MUST match the
         // URL's sessionId.
         if (verify.claims.sessionId !== sessionId) {
             res.status(401).type("text/plain").send("wsToken scope mismatch");
@@ -203,7 +203,7 @@ export function mountApiRendersStreamRoute(opts) {
             res.status(404).type("text/plain").send("render not found");
             return;
         }
-        // Tenancy gate (round 2): the wsToken's appId MUST match the
+        // App-scope gate (round 2): the wsToken's appId MUST match the
         // render's appId.
         if (verify.claims.appId !== stored.appId) {
             res.status(401).type("text/plain").send("wsToken scope mismatch");
@@ -229,7 +229,7 @@ export function mountApiRendersStreamRoute(opts) {
         res.write("retry: 3000\n\n");
         const sink = new SseSink(res, logger);
         // Single idempotent teardown shared by every exit path: client
-        // close, channel-initiated sink.end (pod shutdown / expiry probe),
+        // close, channel-initiated sink.end (server shutdown / expiry probe),
         // attach failure.
         let detachFn = null;
         let torn = false;

package/dist/auth.d.ts

@@ -29,10 +29,10 @@ export declare function resolveIdentity(adapter: AuthAdapter, req: Request): Pro
  * Derive a stable `appId` from an auth result.
  *
  * In OSS single-user mode every identity collapses to `{kind:'builder'}`
- * which doesn't carry a tenant id. We fold these into a single
+ * which doesn't carry an app id. We fold these into a single
  * well-known value (`DEFAULT_BUILDER_APP_ID`) so blueprint / vector
- * scoping still works. Multi-tenant bindings (a hosted closed runtime)
- * override this by passing `appIdFromIdentity` on `createGguiServer`.
+ * scoping still works. A multi-app production deployment overrides
+ * this by passing `appIdFromIdentity` on `createGguiServer`.
  */
 export declare const DEFAULT_BUILDER_APP_ID = "builder";
 export declare function defaultAppIdFromIdentity(result: AuthResult): string;

package/dist/auth.js

@@ -47,10 +47,10 @@ export async function resolveIdentity(adapter, req) {
  * Derive a stable `appId` from an auth result.
  *
  * In OSS single-user mode every identity collapses to `{kind:'builder'}`
- * which doesn't carry a tenant id. We fold these into a single
+ * which doesn't carry an app id. We fold these into a single
  * well-known value (`DEFAULT_BUILDER_APP_ID`) so blueprint / vector
- * scoping still works. Multi-tenant bindings (a hosted closed runtime)
- * override this by passing `appIdFromIdentity` on `createGguiServer`.
+ * scoping still works. A multi-app production deployment overrides
+ * this by passing `appIdFromIdentity` on `createGguiServer`.
  */
 export const DEFAULT_BUILDER_APP_ID = 'builder';
 export function defaultAppIdFromIdentity(result) {
@@ -65,9 +65,9 @@ export function defaultAppIdFromIdentity(result) {
             result.identity.userId);
     }
     // `kind: 'app'` carries the appId directly — surfaced by API-key /
-    // OAuth-bearer adapters (e.g. an ApiKeyAuthAdapter on a hosted
-    // multi-tenant deployment). Falling through to DEFAULT_BUILDER_APP_ID
-    // here would discard the very tenant id the adapter just proved.
+    // OAuth-bearer adapters (e.g. an API-key adapter proving an app-scoped
+    // bearer on a multi-app deployment). Falling through to DEFAULT_BUILDER_APP_ID
+    // here would discard the very app id the adapter just proved.
     if (result.identity.kind === 'app') {
         return result.identity.appId;
     }

package/dist/build-mcp.d.ts

@@ -65,7 +65,7 @@ export interface BuildMcpServerOptions {
     /**
      * Live-channel origins for the static shell's CSP declaration —
      * forwarded to `installMcpAppsOutbound`. Deployments that set no
-     * `publicBaseUrl` (the cloud pod) pass their `wsUrl` + its ws→http
+     * `publicBaseUrl` (a hosted deployment) pass their `wsUrl` + its ws→http
      * origin flip here so the mounted iframe's `connect-src` covers the
      * SSE / HTTP-polling session API and the WebSocket; otherwise
      * cross-origin hosts CSP-block every network rung of the failover

package/dist/console-blueprint-routes.js

@@ -121,8 +121,8 @@ export function mountConsoleBlueprintRoutes(opts) {
                     code = out;
                 }
                 // Same default appId the CLI's pairing-authenticated /mcp
-                // ingress resolves for single-tenant OSS — the render is
-                // scoped to the same tenant.
+                // ingress resolves for single-app OSS — the render is
+                // scoped to the same app.
                 const appId = DEFAULT_BUILDER_APP_ID;
                 // Phase B: a render IS the addressable unit; the prior
                 // (sessionId, stackItemId) pair collapses to a single

package/dist/console-chat-routes.d.ts

@@ -30,7 +30,7 @@
  * serve` instance; adding bearer auth here would block the
  * dev-page-is-usable claim without meaningful security gain.
  *
- * The render invocation uses `DEFAULT_BUILDER_APP_ID` for tenant
+ * The render invocation uses `DEFAULT_BUILDER_APP_ID` for app
  * scope — same well-known value the `/mcp` endpoint collapses to
  * in OSS single-user mode. Matches blueprint + vector scoping
  * applied by the generator / cache seams.

package/dist/console-chat-routes.js

@@ -30,7 +30,7 @@
  * serve` instance; adding bearer auth here would block the
  * dev-page-is-usable claim without meaningful security gain.
  *
- * The render invocation uses `DEFAULT_BUILDER_APP_ID` for tenant
+ * The render invocation uses `DEFAULT_BUILDER_APP_ID` for app
  * scope — same well-known value the `/mcp` endpoint collapses to
  * in OSS single-user mode. Matches blueprint + vector scoping
  * applied by the generator / cache seams.

package/dist/console-keys-routes.js

@@ -38,7 +38,7 @@ export function mountConsoleKeysRoutes(opts) {
     const { app, adminToken, pairing, logger } = opts;
     const requestHasAdminAuth = (req) => {
         // Header path — `Authorization: Bearer <token>`. Constant-time
-        // compare not needed: this is single-tenant local-host with a
+        // compare not needed: this is single-operator local-host with a
         // local network attacker model; the token also has 72 bits of
         // entropy, so a timing-side-channel attack would still need
         // ~2^36 attempts on average to materialize. Skip the cost.
@@ -72,7 +72,7 @@ export function mountConsoleKeysRoutes(opts) {
     // For zero-config local-host, trust-proxy is OFF and req.secure
     // reflects the literal socket. Operators behind a tunnel with
     // TLS termination at the edge get the cookie WITHOUT Secure
-    // (intended — the in-pod request is plaintext HTTP). Browsers
+    // (intended — the request reaching the server is plaintext HTTP). Browsers
     // still scope it to the origin via SameSite, which is the
     // primary CSRF protection here; Secure is a defense-in-depth
     // attribute, not load-bearing for this token.

package/dist/console-llm-keys-routes.d.ts

@@ -4,7 +4,7 @@
  *   - `gateMode: 'admin-token'` (default — OSS-personal):
  *     gate accepts the admin bearer. Single global keyset; the
  *     /settings UI lets the operator paste keys for everyone.
- *   - `gateMode: 'auth-adapter'` (multi-tenant): gate
+ *   - `gateMode: 'auth-adapter'` (multi-app): gate
  *     calls the server's `AuthAdapter`. Each user's keys are
  *     scoped by `scopeFromRequest` (default: `userId`/`appId`).
  *

package/dist/console-llm-keys-routes.js

@@ -4,7 +4,7 @@
  *   - `gateMode: 'admin-token'` (default — OSS-personal):
  *     gate accepts the admin bearer. Single global keyset; the
  *     /settings UI lets the operator paste keys for everyone.
- *   - `gateMode: 'auth-adapter'` (multi-tenant): gate
+ *   - `gateMode: 'auth-adapter'` (multi-app): gate
  *     calls the server's `AuthAdapter`. Each user's keys are
  *     scoped by `scopeFromRequest` (default: `userId`/`appId`).
  *
@@ -103,7 +103,7 @@ export function mountConsoleLlmKeysRoutes(opts) {
     //   admin-token → same shape as /keys (Bearer admin OR
     //                 ggui_console_admin cookie).
     //   auth-adapter → calls `resolveIdentity(auth, req)`. `kind:'builder'`
-    //                  is rejected with 401 — the multi-tenant posture
+    //                  is rejected with 401 — the multi-app posture
     //                  is meaningless without a real per-caller id.
     app.use("/ggui/console/llm-keys", (req, res, next) => {
         if (gateMode === "admin-token") {
@@ -113,14 +113,14 @@ export function mountConsoleLlmKeysRoutes(opts) {
             res.status(401).json({ error: "admin_auth_required" });
             return;
         }
-        // 'auth-adapter' — the multi-tenant gate.
+        // 'auth-adapter' — the multi-app gate.
         resolveIdentity(auth, req)
             .then((identity) => {
             if (identity.identity.kind === "builder") {
                 applyDevtoolSecurityHeaders(res);
                 res.status(401).json({
-                    error: "tenant_required",
-                    message: "Multi-tenant /llm-keys requires an end-user or app identity. " +
+                    error: "user_or_app_identity_required",
+                    message: "Multi-app /llm-keys requires an end-user or app identity. " +
                         'The configured AuthAdapter resolved kind:"builder" — pair a ' +
                         'real user/app bearer or use providerKeysGate:"admin-token".',
                 });

package/dist/console-registry-routes.d.ts

@@ -26,7 +26,7 @@
  * Scope: read-only on `/registry` (authoring happens on disk and the
  * server re-reads on boot; zero-config is an honest empty shape).
  * The cache/registry surfaces are scoped to `DEFAULT_BUILDER_APP_ID`
- * because the OSS server is single-tenant by construction — same
+ * because the OSS server is single-app by construction — same
  * scope the render handler writes to, so list/invalidate/clear see
  * what the real cache writes.
  *

package/dist/console-registry-routes.js

@@ -26,7 +26,7 @@
  * Scope: read-only on `/registry` (authoring happens on disk and the
  * server re-reads on boot; zero-config is an honest empty shape).
  * The cache/registry surfaces are scoped to `DEFAULT_BUILDER_APP_ID`
- * because the OSS server is single-tenant by construction — same
+ * because the OSS server is single-app by construction — same
  * scope the render handler writes to, so list/invalidate/clear see
  * what the real cache writes.
  *

package/dist/console-theme-routes.d.ts

@@ -22,7 +22,7 @@
  * routes use — operator-only since the value persists to ggui.json,
  * which the OSS server treats as trusted manifest input. End-users
  * who paired into a render don't get to mutate the project's
- * theme. Multi-tenant deployments may relax this in a follow-up by
+ * theme. Multi-app deployments may relax this in a follow-up by
  * scoping overrides per user (overrides become server state, not
  * file state).
  */

package/dist/console-theme-routes.js

@@ -22,7 +22,7 @@
  * routes use — operator-only since the value persists to ggui.json,
  * which the OSS server treats as trusted manifest input. End-users
  * who paired into a render don't get to mutate the project's
- * theme. Multi-tenant deployments may relax this in a follow-up by
+ * theme. Multi-app deployments may relax this in a follow-up by
  * scoping overrides per user (overrides become server state, not
  * file state).
  */

package/dist/control-service.d.ts

@@ -4,7 +4,7 @@
  * ggui serves exactly TWO MCP surfaces:
  *
  *   - **Data plane** — the agent routes (`universalMcpPath`, plus the
- *     per-tenant `${pathPrefix}/:appId` variant when configured). Carries
+ *     per-app `${pathPrefix}/:appId` variant when configured). Carries
  *     the `agent` + `runtime` audiences: the tools an agent calls while a
  *     session is running.
  *   - **Control plane** — this service. Carries the `protocol` + `ops`
@@ -93,7 +93,7 @@ export declare function filterHandlersByAudience(set: ReadonlyArray<AnyHandler>,
  * ruling (ggui#525, 2026-08-16). The argument that it is safe on the
  * first call: the save is idempotent under the name-collapse rule (same
  * slug ⇒ one row, a repeat is a no-op), it writes only to the CALLER's
- * own library (no cross-tenant or account-wide effect), and its caller
+ * own library (no cross-app or account-wide effect), and its caller
  * is the console helper agent auto-saving after a render — the
  * "confirm" it performed was an agent self-confirm with no human in
  * the loop, which bought no safety and cost one extra tool round trip
@@ -116,7 +116,7 @@ export declare function stripAudience<I extends ZodRawShape, O extends ZodRawSha
  * credential — or presented one the adapter rejected. An un-gated ops
  * handler would then run against that synthetic rather than refusing,
  * which is how a caller with no account would read and write a phantom
- * shared tenant.
+ * shared app.
  *
  * The gate is on `ctx.authSource`, not on which identity FIELDS are
  * populated: every deployment tier proves identity differently

package/dist/control-service.js

@@ -4,7 +4,7 @@
  * ggui serves exactly TWO MCP surfaces:
  *
  *   - **Data plane** — the agent routes (`universalMcpPath`, plus the
- *     per-tenant `${pathPrefix}/:appId` variant when configured). Carries
+ *     per-app `${pathPrefix}/:appId` variant when configured). Carries
  *     the `agent` + `runtime` audiences: the tools an agent calls while a
  *     session is running.
  *   - **Control plane** — this service. Carries the `protocol` + `ops`
@@ -94,7 +94,7 @@ export function filterHandlersByAudience(set, allowed) {
  * ruling (ggui#525, 2026-08-16). The argument that it is safe on the
  * first call: the save is idempotent under the name-collapse rule (same
  * slug ⇒ one row, a repeat is a no-op), it writes only to the CALLER's
- * own library (no cross-tenant or account-wide effect), and its caller
+ * own library (no cross-app or account-wide effect), and its caller
  * is the console helper agent auto-saving after a render — the
  * "confirm" it performed was an agent self-confirm with no human in
  * the loop, which bought no safety and cost one extra tool round trip
@@ -137,7 +137,7 @@ export function stripAudience(h) {
  * credential — or presented one the adapter rejected. An un-gated ops
  * handler would then run against that synthetic rather than refusing,
  * which is how a caller with no account would read and write a phantom
- * shared tenant.
+ * shared app.
  *
  * The gate is on `ctx.authSource`, not on which identity FIELDS are
  * populated: every deployment tier proves identity differently

package/dist/ggui-session-channel/socket-router.js

@@ -72,7 +72,7 @@ export function attachSocketRouter(wss, deps) {
         releasePending(ws);
     }
     /**
-     * Tenancy guard for client-emitted observation messages
+     * Binding guard for client-emitted observation messages
      * (`host_context_observed` today). Returns `false`
      * AND emits the appropriate error frame when:
      *
@@ -80,7 +80,7 @@ export function attachSocketRouter(wss, deps) {
      *   - payload.sessionId doesn't match the subscriber binding
      *     (SESSION_MISMATCH)
      *
-     * Subscriber binding is the authoritative tenancy scope. The wire
+     * Subscriber binding is the authoritative scope. The wire
      * payload's sessionId is belt-and-suspenders so the error message
      * can be specific; appId narrows transparently via the binding.
      */

package/dist/ggui-session-channel/subscribe.d.ts

@@ -138,7 +138,7 @@ export interface SubscribeDeps {
     readonly bootstrap?: GguiSessionChannelBootstrap;
     /** Console cookie plumbing — see `GguiSessionChannelOptions.cookieAuth`. */
     readonly cookieAuth?: GguiSessionChannelCookieAuth;
-    /** Identity → tenant appId mapping — see `GguiSessionChannelOptions.appIdFromIdentity`. */
+    /** Identity → appId mapping — see `GguiSessionChannelOptions.appIdFromIdentity`. */
     readonly appIdFromIdentity?: (result: AuthResult) => string;
     /** Version-handshake policy — see `GguiSessionChannelOptions.versionPolicy`. */
     readonly versionPolicy?: "advisory" | "reject";

package/dist/ggui-session-channel/subscribe.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"subscribe.d.ts","sourceRoot":"","sources":["../../src/ggui-session-channel/subscribe.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,KAAK,EACV,WAAW,EACX,UAAU,EACV,gBAAgB,EAChB,uBAAuB,EACvB,iBAAiB,EACjB,YAAY,EACb,MAAM,0BAA0B,CAAC;AAGlC,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,uCAAuC,CAAC;AAC9E,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,WAAW,CAAC;AACjD,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,IAAI,CAAC;AAMpC,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,cAAc,CAAC;AAC3C,OAAO,KAAK,EAGV,cAAc,EAEf,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EAAgB,KAAK,QAAQ,EAAE,MAAM,eAAe,CAAC;AAC5D,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,2BAA2B,CAAC;AAErE;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH;;;;;;;;;;GAUG;AACH,MAAM,MAAM,uCAAuC,GAC/C;IACE,QAAQ,CAAC,EAAE,EAAE,IAAI,CAAC;IAClB,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;CACxB,GACD;IAAE,QAAQ,CAAC,EAAE,EAAE,KAAK,CAAC;IAAC,QAAQ,CAAC,MAAM,EAAE,SAAS,GAAG,SAAS,CAAA;CAAE,CAAC;AAEnE;;;;;;GAMG;AACH,MAAM,MAAM,wCAAwC,GAChD;IACE,QAAQ,CAAC,EAAE,EAAE,IAAI,CAAC;IAClB,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;CAC5B,GACD;IAAE,QAAQ,CAAC,EAAE,EAAE,KAAK,CAAC;IAAC,QAAQ,CAAC,MAAM,EAAE,eAAe,GAAG,SAAS,CAAA;CAAE,CAAC;AAEzE,MAAM,WAAW,2BAA2B;IAC1C;;;;;;;;OAQG;IACH,MAAM,CAAC,KAAK,EAAE,MAAM,GAAG,uCAAuC,CAAC;IAC/D;;;;OAIG;IACH,iBAAiB,CAAC,SAAS,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,MAAM,CAAC;IAC5D;;;;;;;;;;;;;OAaG;IACH,OAAO,CAAC,KAAK,EAAE,MAAM,GAAG,wCAAwC,CAAC;CAClE;AAED;;;;GAIG;AACH,MAAM,WAAW,4BAA4B;IAC3C;;;;OAIG;IACH,UAAU,CAAC,OAAO,EAAE,OAAO,WAAW,EAAE,mBAAmB,GAAG,MAAM,GAAG,IAAI,CAAC;IAC5E;;;;OAIG;IACH,MAAM,CAAC,WAAW,EAAE,MAAM,GAAG;QAAE,SAAS,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAA;KAAE,GAAG,IAAI,CAAC;CAC1E;AAED,MAAM,WAAW,aAAa;IAC5B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,kEAAkE;IAClE,QAAQ,CAAC,IAAI,EAAE,WAAW,CAAC;IAC3B,QAAQ,CAAC,WAAW,EAAE,gBAAgB,CAAC;IACvC,sEAAsE;IACtE,QAAQ,CAAC,YAAY,EAAE,uBAAuB,CAAC;IAC/C,mEAAmE;IACnE,QAAQ,CAAC,YAAY,EAAE,YAAY,CAAC;IACpC,iFAAiF;IACjF,QAAQ,CAAC,SAAS,CAAC,EAAE,2BAA2B,CAAC;IACjD,4EAA4E;IAC5E,QAAQ,CAAC,UAAU,CAAC,EAAE,4BAA4B,CAAC;IACnD,2FAA2F;IAC3F,QAAQ,CAAC,iBAAiB,CAAC,EAAE,CAAC,MAAM,EAAE,UAAU,KAAK,MAAM,CAAC;IAC5D,gFAAgF;IAChF,QAAQ,CAAC,aAAa,CAAC,EAAE,UAAU,GAAG,QAAQ,CAAC;IAC/C,QAAQ,CAAC,SAAS,EAAE,QAAQ,CAAC,WAAW,CAAC,CAAC;IAC1C,QAAQ,CAAC,QAAQ,EAAE,mBAAmB,CAAC,UAAU,CAAC,CAAC;IACnD,QAAQ,CAAC,UAAU,EAAE,mBAAmB,CAAC,YAAY,CAAC,CAAC;CACxD;AAED;;;;;;GAMG;AACH,MAAM,MAAM,qBAAqB,GAAG;IAClC,mDAAmD;IACnD,QAAQ,CAAC,MAAM,EAAE,iBAAiB,CAAC;IACnC,wDAAwD;IACxD,QAAQ,CAAC,QAAQ,EAAE,UAAU,CAAC;IAC9B,qEAAqE;IACrE,QAAQ,CAAC,IAAI,EAAE,cAAc,CAAC;IAC9B,+EAA+E;IAC/E,QAAQ,CAAC,aAAa,CAAC,EAAE,MAAM,CAAC;IAChC,wEAAwE;IACxE,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC;IAC1B,uEAAuE;IACvE,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC;IAC5B,iEAAiE;IACjE,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM,CAAC;CAChC,GAAG,CACA;IACE,QAAQ,CAAC,SAAS,EAAE,IAAI,CAAC;IACzB,oEAAoE;IACpE,QAAQ,CAAC,EAAE,EAAE,SAAS,CAAC;CACxB,GACD;IAAE,QAAQ,CAAC,SAAS,EAAE,KAAK,CAAA;CAAE,CAChC,CAAC;AAEF,MAAM,WAAW,iBAAiB;IAChC;;;;;OAKG;IACH,0BAA0B,CAAC,GAAG,EAAE,eAAe,GAAG,OAAO,CAAC,UAAU,CAAC,CAAC;IACtE,iEAAiE;IACjE,eAAe,CACb,EAAE,EAAE,SAAS,EACb,QAAQ,EAAE,UAAU,EACpB,OAAO,EAAE,gBAAgB,GAAG;QAAE,IAAI,EAAE,WAAW,CAAA;KAAE,EACjD,WAAW,CAAC,EAAE;QAAE,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAA;KAAE,GACnE,OAAO,CAAC,IAAI,CAAC,CAAC;IACjB;;;;;;;;;;;OAWG;IACH,iBAAiB,CAAC,IAAI,EAAE,qBAAqB,GAAG,OAAO,CAAC;QAAE,QAAQ,CAAC,MAAM,EAAE,MAAM,IAAI,CAAA;KAAE,CAAC,CAAC;CAC1F;AAkBD,wBAAgB,uBAAuB,CAAC,IAAI,EAAE,aAAa,GAAG,iBAAiB,CA+gB9E"}
+{"version":3,"file":"subscribe.d.ts","sourceRoot":"","sources":["../../src/ggui-session-channel/subscribe.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,KAAK,EACV,WAAW,EACX,UAAU,EACV,gBAAgB,EAChB,uBAAuB,EACvB,iBAAiB,EACjB,YAAY,EACb,MAAM,0BAA0B,CAAC;AAGlC,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,uCAAuC,CAAC;AAC9E,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,WAAW,CAAC;AACjD,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,IAAI,CAAC;AAMpC,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,cAAc,CAAC;AAC3C,OAAO,KAAK,EAGV,cAAc,EAEf,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EAAgB,KAAK,QAAQ,EAAE,MAAM,eAAe,CAAC;AAC5D,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,2BAA2B,CAAC;AAErE;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH;;;;;;;;;;GAUG;AACH,MAAM,MAAM,uCAAuC,GAC/C;IACE,QAAQ,CAAC,EAAE,EAAE,IAAI,CAAC;IAClB,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;CACxB,GACD;IAAE,QAAQ,CAAC,EAAE,EAAE,KAAK,CAAC;IAAC,QAAQ,CAAC,MAAM,EAAE,SAAS,GAAG,SAAS,CAAA;CAAE,CAAC;AAEnE;;;;;;GAMG;AACH,MAAM,MAAM,wCAAwC,GAChD;IACE,QAAQ,CAAC,EAAE,EAAE,IAAI,CAAC;IAClB,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;CAC5B,GACD;IAAE,QAAQ,CAAC,EAAE,EAAE,KAAK,CAAC;IAAC,QAAQ,CAAC,MAAM,EAAE,eAAe,GAAG,SAAS,CAAA;CAAE,CAAC;AAEzE,MAAM,WAAW,2BAA2B;IAC1C;;;;;;;;OAQG;IACH,MAAM,CAAC,KAAK,EAAE,MAAM,GAAG,uCAAuC,CAAC;IAC/D;;;;OAIG;IACH,iBAAiB,CAAC,SAAS,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,MAAM,CAAC;IAC5D;;;;;;;;;;;;;OAaG;IACH,OAAO,CAAC,KAAK,EAAE,MAAM,GAAG,wCAAwC,CAAC;CAClE;AAED;;;;GAIG;AACH,MAAM,WAAW,4BAA4B;IAC3C;;;;OAIG;IACH,UAAU,CAAC,OAAO,EAAE,OAAO,WAAW,EAAE,mBAAmB,GAAG,MAAM,GAAG,IAAI,CAAC;IAC5E;;;;OAIG;IACH,MAAM,CAAC,WAAW,EAAE,MAAM,GAAG;QAAE,SAAS,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAA;KAAE,GAAG,IAAI,CAAC;CAC1E;AAED,MAAM,WAAW,aAAa;IAC5B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,kEAAkE;IAClE,QAAQ,CAAC,IAAI,EAAE,WAAW,CAAC;IAC3B,QAAQ,CAAC,WAAW,EAAE,gBAAgB,CAAC;IACvC,sEAAsE;IACtE,QAAQ,CAAC,YAAY,EAAE,uBAAuB,CAAC;IAC/C,mEAAmE;IACnE,QAAQ,CAAC,YAAY,EAAE,YAAY,CAAC;IACpC,iFAAiF;IACjF,QAAQ,CAAC,SAAS,CAAC,EAAE,2BAA2B,CAAC;IACjD,4EAA4E;IAC5E,QAAQ,CAAC,UAAU,CAAC,EAAE,4BAA4B,CAAC;IACnD,oFAAoF;IACpF,QAAQ,CAAC,iBAAiB,CAAC,EAAE,CAAC,MAAM,EAAE,UAAU,KAAK,MAAM,CAAC;IAC5D,gFAAgF;IAChF,QAAQ,CAAC,aAAa,CAAC,EAAE,UAAU,GAAG,QAAQ,CAAC;IAC/C,QAAQ,CAAC,SAAS,EAAE,QAAQ,CAAC,WAAW,CAAC,CAAC;IAC1C,QAAQ,CAAC,QAAQ,EAAE,mBAAmB,CAAC,UAAU,CAAC,CAAC;IACnD,QAAQ,CAAC,UAAU,EAAE,mBAAmB,CAAC,YAAY,CAAC,CAAC;CACxD;AAED;;;;;;GAMG;AACH,MAAM,MAAM,qBAAqB,GAAG;IAClC,mDAAmD;IACnD,QAAQ,CAAC,MAAM,EAAE,iBAAiB,CAAC;IACnC,wDAAwD;IACxD,QAAQ,CAAC,QAAQ,EAAE,UAAU,CAAC;IAC9B,qEAAqE;IACrE,QAAQ,CAAC,IAAI,EAAE,cAAc,CAAC;IAC9B,+EAA+E;IAC/E,QAAQ,CAAC,aAAa,CAAC,EAAE,MAAM,CAAC;IAChC,wEAAwE;IACxE,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC;IAC1B,uEAAuE;IACvE,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC;IAC5B,iEAAiE;IACjE,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM,CAAC;CAChC,GAAG,CACA;IACE,QAAQ,CAAC,SAAS,EAAE,IAAI,CAAC;IACzB,oEAAoE;IACpE,QAAQ,CAAC,EAAE,EAAE,SAAS,CAAC;CACxB,GACD;IAAE,QAAQ,CAAC,SAAS,EAAE,KAAK,CAAA;CAAE,CAChC,CAAC;AAEF,MAAM,WAAW,iBAAiB;IAChC;;;;;OAKG;IACH,0BAA0B,CAAC,GAAG,EAAE,eAAe,GAAG,OAAO,CAAC,UAAU,CAAC,CAAC;IACtE,iEAAiE;IACjE,eAAe,CACb,EAAE,EAAE,SAAS,EACb,QAAQ,EAAE,UAAU,EACpB,OAAO,EAAE,gBAAgB,GAAG;QAAE,IAAI,EAAE,WAAW,CAAA;KAAE,EACjD,WAAW,CAAC,EAAE;QAAE,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAA;KAAE,GACnE,OAAO,CAAC,IAAI,CAAC,CAAC;IACjB;;;;;;;;;;;OAWG;IACH,iBAAiB,CAAC,IAAI,EAAE,qBAAqB,GAAG,OAAO,CAAC;QAAE,QAAQ,CAAC,MAAM,EAAE,MAAM,IAAI,CAAA;KAAE,CAAC,CAAC;CAC1F;AAkBD,wBAAgB,uBAAuB,CAAC,IAAI,EAAE,aAAa,GAAG,iBAAiB,CA+gB9E"}

package/dist/ggui-session-channel/subscribe.js

@@ -238,8 +238,8 @@ export function createSubscribeHandlers(deps) {
         // cookie binds the same pair), else the deployment's identity →
         // appId mapping (`appIdFromIdentity`, defaulting to
         // `defaultAppIdFromIdentity`). The resolved value then flows
-        // through the EXISTING tenancy gate + provisioning below — never
-        // an `undefined` tenant on a stored row.
+        // through the EXISTING app-scope gate + provisioning below — never
+        // an `undefined` appId on a stored row.
         const effectiveAppId = payload.appId ??
             tokenBoundAppId ??
             cookieBound?.appId ??

package/dist/ggui-session-channel/subscriber-lifecycle.d.ts

@@ -14,7 +14,7 @@
  * Owns the per-render subscriber counter that drives the
  * `onFirstSubscriber` / `onLastSubscriberGone` 0↔1 transition hooks —
  * no other module reads it. The hooks fire for SSE attaches too:
- * hosted cross-pod pubsub scoping keys on "does this pod hold any
+ * hosted cross-replica pubsub scoping keys on "does this replica hold any
  * subscriber for this render", regardless of transport.
  */
 import type { WebSocket } from "ws";

package/dist/ggui-session-channel/subscriber-lifecycle.js

@@ -14,7 +14,7 @@
  * Owns the per-render subscriber counter that drives the
  * `onFirstSubscriber` / `onLastSubscriberGone` 0↔1 transition hooks —
  * no other module reads it. The hooks fire for SSE attaches too:
- * hosted cross-pod pubsub scoping keys on "does this pod hold any
+ * hosted cross-replica pubsub scoping keys on "does this replica hold any
  * subscriber for this render", regardless of transport.
  */
 export function createSubscriberLifecycle(deps) {

package/dist/ggui-session-channel.d.ts

@@ -159,7 +159,7 @@ export interface GguiSessionChannelOptions {
      */
     readonly auth: AuthAdapter;
     /**
-     * Maps resolved identity → tenant appId for subscribes that omit
+     * Maps resolved identity → the appId for subscribes that omit
      * `payload.appId` (SPEC §12.2 identity-default resolution). Defaults
      * to `defaultAppIdFromIdentity` — same mapping the `/mcp` endpoint
      * uses. Token-bound subscribes (wsToken / console cookie) never
@@ -348,12 +348,12 @@ export interface GguiSessionChannelOptions {
      * render connects to this server instance).
      *
      * Hosted deployments use this to lazily SUBSCRIBE to the per-render
-     * cross-pod broadcast channel (e.g. Redis pub/sub); OSS has no use
+     * cross-replica broadcast channel (e.g. Redis pub/sub); OSS has no use
      * for it (in-process broadcasts already route via
      * {@link GguiSessionChannelServer.sendPropsUpdate}). Bounding pubsub
-     * fan-in to only renders a pod actually holds connections for is a
+     * fan-in to only renders a replica actually holds connections for is a
      * correctness requirement, not an optimization — without it every
-     * pod receives every other pod's broadcast for every active render.
+     * replica receives every other replica's broadcast for every active render.
      *
      * Best-effort: a thrown callback is logged and swallowed.
      * `register()` MUST NOT fail because of a hook error or the

package/dist/ggui-session-channel.js

@@ -339,18 +339,18 @@ export function createGguiSessionChannelServer(opts) {
             // Close code 1012 ("Service Restart", RFC 6455 + IANA registry)
             // signals to clients that the server is restarting and they
             // should reconnect immediately rather than treat the close as
-            // permanent. The pod's K8s rolling update fits this exactly:
-            // a new pod is already accepting connections behind the same
+            // permanent. A rolling update of the deployment fits this exactly:
+            // a new replica is already accepting connections behind the same
             // load balancer; iframe-runtime + console viewer should
             // reconnect on next message instead of blinking "disconnected".
             // Code 1001 (used previously) means "endpoint going away" with
-            // no reconnect hint — semantically inaccurate for the pod-roll
+            // no reconnect hint — semantically inaccurate for the rolling-update
             // case and the wrong signal for client reconnect logic.
             const sessionIds = new Set();
             for (const sub of wsSubscribers) {
                 sessionIds.add(sub.sessionId);
                 // Transport-neutral shutdown: WS maps to close(1012), SSE ends
-                // the response so EventSource auto-reconnects to the new pod —
+                // the response so EventSource auto-reconnects to the new replica —
                 // exactly the 1012 semantics. `sink.end` is best-effort by
                 // contract (never throws on an already-closing transport).
                 sub.sink.end("service_restart");

package/dist/health-routes.d.ts

@@ -14,16 +14,17 @@
  *                          401 otherwise (with `WWW-Authenticate` when
  *                          OAuth is enabled).
  *
- * Why live and health are separate: K8s livenessProbe + readinessProbe
- * have distinct semantics. Liveness asks "is the process alive?" and
- * a failure tells the kubelet to RESTART the pod. Readiness asks "is
- * the pod ready to receive traffic?" and a failure tells the service
+ * Why live and health are separate: an orchestrator's liveness and
+ * readiness probes have distinct semantics. Liveness asks "is the process alive?" and
+ * a failure tells the orchestrator to RESTART the container. Readiness
+ * asks "is the replica ready to receive traffic?" and a failure tells the service
  * to STOP ROUTING. Tying both probes to a single endpoint that gates
  * on dependency health (Redis, DDB, RAG) means a transient upstream
- * blip kills the pod entirely instead of just removing it from
+ * blip kills the replica entirely instead of just removing it from
  * rotation.
  *
- * Self-hoster wiring (K8s):
+ * Self-hoster wiring (probe-spec shape; any orchestrator with separate
+ * liveness and readiness probes works the same way):
  *
  *   livenessProbe:  { httpGet: { path: '/ggui/live',   port } }
  *   readinessProbe: { httpGet: { path: '/ggui/health', port } }

package/dist/health-routes.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"health-routes.d.ts","sourceRoot":"","sources":["../src/health-routes.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6BG;AAEH,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,0BAA0B,CAAC;AAC5D,OAAO,KAAK,EAAE,OAAO,EAAqB,MAAM,SAAS,CAAC;AAE1D,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,gBAAgB,CAAC;AACjD,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,2BAA2B,CAAC;AAC1E,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,aAAa,CAAC;AAW1C,UAAU,YAAY;IACpB,iCAAiC;IACjC,QAAQ,CAAC,GAAG,EAAE,OAAO,CAAC;IACtB,+DAA+D;IAC/D,QAAQ,CAAC,IAAI,EAAE,UAAU,CAAC;IAC1B,wDAAwD;IACxD,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,iEAAiE;IACjE,QAAQ,CAAC,eAAe,EAAE,aAAa,CAAC;QACtC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;QACtB,QAAQ,CAAC,KAAK,EAAE,MAAM,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;KAClD,CAAC,CAAC;IACH;;;;;;;;;;OAUG;IACH,QAAQ,CAAC,cAAc,CAAC,EAAE,aAAa,CAAC;QACtC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;QACtB,QAAQ,CAAC,KAAK,EAAE,MAAM,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;KAClD,CAAC,CAAC;IACH;;;;OAIG;IACH,QAAQ,CAAC,UAAU,EAAE,MAAM,wBAAwB,GAAG,IAAI,CAAC;IAC3D;;;;OAIG;IACH,QAAQ,CAAC,OAAO,CAAC,EAAE;QAAE,QAAQ,CAAC,UAAU,CAAC,EAAE,SAAS,GAAG,WAAW,CAAA;KAAE,CAAC;IACrE,gEAAgE;IAChE,QAAQ,CAAC,IAAI,EAAE,WAAW,CAAC;IAC3B,iEAAiE;IACjE,QAAQ,CAAC,YAAY,EAAE,OAAO,CAAC;IAC/B,uDAAuD;IACvD,QAAQ,CAAC,cAAc,CAAC,EAAE,MAAM,CAAC;IACjC,4DAA4D;IAC5D,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB;gEAC4D;IAC5D,QAAQ,CAAC,WAAW,CAAC,EAAE,aAAa,CAAC,MAAM,CAAC,CAAC;CAC9C;AAED;;;GAGG;AACH,wBAAgB,iBAAiB,CAAC,IAAI,EAAE,YAAY,GAAG,IAAI,CAmJ1D"}
+{"version":3,"file":"health-routes.d.ts","sourceRoot":"","sources":["../src/health-routes.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8BG;AAEH,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,0BAA0B,CAAC;AAC5D,OAAO,KAAK,EAAE,OAAO,EAAqB,MAAM,SAAS,CAAC;AAE1D,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,gBAAgB,CAAC;AACjD,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,2BAA2B,CAAC;AAC1E,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,aAAa,CAAC;AAW1C,UAAU,YAAY;IACpB,iCAAiC;IACjC,QAAQ,CAAC,GAAG,EAAE,OAAO,CAAC;IACtB,+DAA+D;IAC/D,QAAQ,CAAC,IAAI,EAAE,UAAU,CAAC;IAC1B,wDAAwD;IACxD,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,iEAAiE;IACjE,QAAQ,CAAC,eAAe,EAAE,aAAa,CAAC;QACtC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;QACtB,QAAQ,CAAC,KAAK,EAAE,MAAM,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;KAClD,CAAC,CAAC;IACH;;;;;;;;;;OAUG;IACH,QAAQ,CAAC,cAAc,CAAC,EAAE,aAAa,CAAC;QACtC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;QACtB,QAAQ,CAAC,KAAK,EAAE,MAAM,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;KAClD,CAAC,CAAC;IACH;;;;OAIG;IACH,QAAQ,CAAC,UAAU,EAAE,MAAM,wBAAwB,GAAG,IAAI,CAAC;IAC3D;;;;OAIG;IACH,QAAQ,CAAC,OAAO,CAAC,EAAE;QAAE,QAAQ,CAAC,UAAU,CAAC,EAAE,SAAS,GAAG,WAAW,CAAA;KAAE,CAAC;IACrE,gEAAgE;IAChE,QAAQ,CAAC,IAAI,EAAE,WAAW,CAAC;IAC3B,iEAAiE;IACjE,QAAQ,CAAC,YAAY,EAAE,OAAO,CAAC;IAC/B,uDAAuD;IACvD,QAAQ,CAAC,cAAc,CAAC,EAAE,MAAM,CAAC;IACjC,4DAA4D;IAC5D,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB;gEAC4D;IAC5D,QAAQ,CAAC,WAAW,CAAC,EAAE,aAAa,CAAC,MAAM,CAAC,CAAC;CAC9C;AAED;;;GAGG;AACH,wBAAgB,iBAAiB,CAAC,IAAI,EAAE,YAAY,GAAG,IAAI,CAmJ1D"}

package/dist/health-routes.js

@@ -14,16 +14,17 @@
  *                          401 otherwise (with `WWW-Authenticate` when
  *                          OAuth is enabled).
  *
- * Why live and health are separate: K8s livenessProbe + readinessProbe
- * have distinct semantics. Liveness asks "is the process alive?" and
- * a failure tells the kubelet to RESTART the pod. Readiness asks "is
- * the pod ready to receive traffic?" and a failure tells the service
+ * Why live and health are separate: an orchestrator's liveness and
+ * readiness probes have distinct semantics. Liveness asks "is the process alive?" and
+ * a failure tells the orchestrator to RESTART the container. Readiness
+ * asks "is the replica ready to receive traffic?" and a failure tells the service
  * to STOP ROUTING. Tying both probes to a single endpoint that gates
  * on dependency health (Redis, DDB, RAG) means a transient upstream
- * blip kills the pod entirely instead of just removing it from
+ * blip kills the replica entirely instead of just removing it from
  * rotation.
  *
- * Self-hoster wiring (K8s):
+ * Self-hoster wiring (probe-spec shape; any orchestrator with separate
+ * liveness and readiness probes works the same way):
  *
  *   livenessProbe:  { httpGet: { path: '/ggui/live',   port } }
  *   readinessProbe: { httpGet: { path: '/ggui/health', port } }
@@ -31,7 +32,7 @@
 import { resolveIdentity, UnauthenticatedError } from "./auth.js";
 import { buildWwwAuthenticate, resolveIssuerUrl } from "./oauth.js";
 /**
- * 1s per-check timeout — a hung dependency must not block the K8s
+ * 1s per-check timeout — a hung dependency must not block the orchestrator's
  * readiness probe (/ggui/health), which itself runs on a short period.
  * A timeout is treated as a failed check; the dependency is degraded
  * either way.

package/dist/index.js

@@ -44,7 +44,7 @@ export { buildControlService, CONTROL_PATH, filterHandlersByAudience, SINGLE_CAL
 // one derivation, no drift against the route the factory mounts.
 export { computeRuntimeBundleHash, insertRuntimeBundleHash, resolveHashedRuntimeBundleUrl, resolveRuntimeBundleHash, } from './runtime-bundle-hash.js';
 // Strict-CSP module-variant delivery (ggui#522 slice 2). The minter is
-// exported for the same composed-handler deployments: a pod that binds
+// exported for the same composed-handler deployments: a deployment that binds
 // `codeStore`/`codeBaseUrl` on its own render tool builds the minter
 // from `resolveRuntimeBundleHash()` so its `codeModuleUrl`s name the
 // exact variant family the co-resident factory routes serve.