@ggui-ai/protocol 0.1.0-rc.1

package/dist/schemas/mcp.js

@@ -0,0 +1,373 @@
+/**
+ * MCP Tool Zod Schemas — Single Source of Truth
+ *
+ * These schemas define the validation rules for MCP tool inputs.
+ * TypeScript types in types/mcp.ts are derived from these via z.infer.
+ * The server handler imports these for runtime validation.
+ */
+import { z } from 'zod';
+import { blueprintDraftSchema, handshakeSuggestionSchema, pushDecisionSchema, } from './handshake-suggestion.js';
+// ── Shared Sub-Schemas ──
+export const viewportSchema = z.object({
+    width: z.number(),
+    height: z.number(),
+});
+export const interfaceContextSchema = z.object({
+    viewport: viewportSchema,
+    platform: z.enum(['web', 'mobile', 'desktop']),
+    deviceType: z.enum(['phone', 'tablet', 'desktop']),
+    orientation: z.enum(['portrait', 'landscape']),
+    devicePixelRatio: z.number().optional(),
+    touchPrimary: z.boolean().optional(),
+    shellType: z.enum(['chat', 'fullscreen', 'spatial']).optional(),
+    colorScheme: z.enum(['light', 'dark']).optional(),
+    reducedMotion: z.boolean().optional(),
+}).passthrough();
+// ── Other Tool Schemas ──
+// Input schemas: pre-launch posture is `.strict()` — unknown keys reject.
+// Pre-fix all of these had `.passthrough()` as forward-compat shims. Pre-
+// launch No Backward Compatibility (CLAUDE.md) supersedes — typos in agent
+// args (`stackItemid`, `sesssionId`, etc.) surface immediately at the wire
+// boundary instead of silently no-op-ing because the server stripped them.
+export const popInputSchema = z.object({
+    sessionId: z.string().describe('Session opaque id from ggui_new_session.'),
+}).strict();
+export const consumeInputSchema = z.object({
+    stackItemId: z.string().describe('Stack item opaque id (UUID) — returned by ggui_push.'),
+    timeout: z.number().min(0).max(25).optional()
+        .describe('Long-poll timeout in seconds (default short; max 25).'),
+}).strict();
+/**
+ * Input schema for `ggui_emit` — emit a stamped delivery on a declared
+ * `streamSpec[channel]`.
+ */
+export const emitInputSchema = z.object({
+    sessionId: z.string().describe('Session opaque id from ggui_new_session.'),
+    channel: z.string()
+        .describe('Channel name declared on the active stack item streamSpec.'),
+    payload: z.unknown().describe('Payload — must match streamSpec[channel].schema.'),
+    complete: z.boolean().optional()
+        .describe('True marks the stream complete; subsequent emits on this channel reject.'),
+    stackItemId: z.string().optional()
+        .describe('Stack item to scope this emit to; defaults to session top.'),
+}).strict();
+export const getSessionInputSchema = z.object({
+    sessionId: z.string().describe('Session opaque id from ggui_new_session.'),
+}).strict();
+export const getStackInputSchema = z.object({
+    sessionId: z.string().describe('Session opaque id from ggui_new_session.'),
+}).strict();
+export const closeInputSchema = z.object({
+    sessionId: z.string().describe('Session opaque id from ggui_new_session.'),
+}).strict();
+export const listFeaturedBlueprintsInputSchema = z.object({
+    level: z.enum(['primitive', 'component', 'composite', 'template']).optional(),
+    category: z.string().optional(),
+    tags: z.array(z.string()).optional(),
+    limit: z.number().optional(),
+}).strict();
+export const searchBlueprintsInputSchema = z.object({
+    query: z.string(),
+    limit: z.number().optional(),
+}).strict();
+export const renderBlueprintInputSchema = z.object({
+    blueprintId: z.string(),
+    props: z.record(z.string(), z.unknown()).optional(),
+}).strict();
+export const discoverInputSchema = z.object({}).strict();
+export const requestCredentialInputSchema = z.object({
+    serviceId: z.string().describe('OAuth service ID (e.g., "bashdoor", "ubot")'),
+    reason: z.string().optional().describe('Why the agent needs this credential (shown to user)'),
+    sessionId: z.string().optional().describe('Existing session ID to push consent UI into'),
+}).strict();
+// ── Protocol v1.1 — canonical tool quartet ──
+//
+// `ggui_new_session` + `ggui_handshake` + `ggui_push` + `ggui_update`.
+// The session lifecycle is decoupled from the push lifecycle: agents
+// mint a sessionId via `ggui_new_session` ONCE per chat, then thread
+// it across every subsequent `ggui_handshake`. `ggui_update` mutates
+// stack-item props addressed by the globally-unique `stackItemId` — no
+// sessionId required (server resolves via the SessionStore's stackItemId
+// secondary index, with appId tenancy enforced from `ctx.appId`).
+//
+/**
+ * `ggui_new_session` — mint or resolve a chat-scoped session handle.
+ *
+ * Server-mints, agent-threads. SEP-2567 aligned ("Sessionless MCP",
+ * Final 2026-03-11): the MCP spec deliberately removes Mcp-Session-Id
+ * because hosts can't agree on what a session means; the recommended
+ * pattern is exactly this — server returns explicit handles, agent
+ * threads them through subsequent calls.
+ *
+ * No inputs — every call mints a fresh random sessionId. (A prior
+ * optional `seed` for deterministic derivation was retired because
+ * LLMs were passing the same seed across user turns and getting back
+ * the same sessionId, defeating the "new" in the tool name.)
+ */
+export const newSessionInputSchema = z.object({}).strict();
+export const newSessionOutputSchema = z.object({
+    sessionId: z.string()
+        .describe('Thread this through every subsequent ggui_handshake / ggui_update call in this chat.'),
+    appId: z.string(),
+    createdAt: z.string()
+        .describe('ISO 8601 — creation timestamp of the freshly-minted session.'),
+    nextStep: z.object({
+        tool: z.literal('ggui_handshake'),
+        description: z.string(),
+        example: z.string(),
+    }).describe('Wire-shape recovery hint — a worked literal example of the next call.'),
+});
+//
+// `ggui_handshake` + `ggui_push` + `ggui_update` follow.
+//
+/**
+ * `ggui_handshake` — three-step suggestion protocol.
+ *
+ * Step 1 (this input): the agent posts a draft — its idea: contract +
+ * optional variance + optional generator hint.
+ *
+ * Step 2 (server-side, see `handshakeOutputSchema`): the server runs
+ * `BlueprintSearch` and contract-validation in parallel and returns a
+ * `HandshakeSuggestion` routed by `origin: cache | agent | synth`.
+ *
+ * Step 3 (paired `ggui_push`): the agent accepts (reuses the
+ * provisional `blueprintId` minted in step-2) OR overrides (mints a
+ * fresh `blueprintId` against a NEW draft).
+ *
+ * Locked decisions:
+ *
+ *   - `blueprintDraft` is the single-field input wrapping contract +
+ *     variance + generator hint.
+ *   - The agent is the contract authority; synth amends only when
+ *     validation fails.
+ */
+export const handshakeInputSchema = z.object({
+    /**
+     * Required. Mint via `ggui_new_session` once per chat, then thread
+     * through every subsequent handshake. Server validates existence +
+     * tenant ownership; unknown / cross-tenant ids surface as
+     * session_not_found.
+     */
+    sessionId: z.string()
+        .min(1)
+        .describe('Session handle minted by ggui_new_session. Required — call ggui_new_session({seed?}) first to obtain one. Reuse the same sessionId across multiple handshake/push pairs in the same chat to grow the session stack.'),
+    /**
+     * Concise semantic identity of the UI. Same intent across calls =
+     * same component reused. Required — drives blueprint-search keying
+     * (intent tokens contribute to the intent axis).
+     * @example "Gmail inbox for email triage"
+     * @example "Current weather conditions"
+     */
+    intent: z.string().min(1).describe('Concise purpose — same intent = same component reused. e.g. "Gmail inbox for email triage"'),
+    /**
+     * Agent's draft — contract (required) + variance + generator hint.
+     * The contract drives the blueprint-search embed/structural axes
+     * and the contract validators; variance feeds the variance axis
+     * and rides through to the suggestion's `blueprintMeta`.
+     */
+    blueprintDraft: blueprintDraftSchema
+        .describe('Agent\'s draft: contract (required) + optional variance + optional generator slug hint. The server combines this with cached blueprints + validator outcomes to produce a three-mode suggestion (cache / agent / synth).'),
+    /**
+     * Skip blueprint-search on step-2 and route straight to validation
+     * + (if validation passes) agent-mode suggestion against the draft.
+     * Used after a prior handshake returned an unwanted cache suggestion
+     * and the agent wants to force a fresh-gen path on the paired push.
+     */
+    forceCreate: z.boolean().optional(),
+}).strict();
+/**
+ * Three-step handshake output. Single `suggestion` carries
+ * `origin: cache | agent | synth`, `blueprintMeta` (always present),
+ * and optional `amendments` (synth-only) / `validationFindings`
+ * (soft on cache).
+ *
+ * The agent reads `suggestion.origin` to branch the paired push:
+ *
+ *   - `cache`  → push `{decision: {kind: 'accept'}}` for cache delivery.
+ *   - `agent`  → push `{decision: {kind: 'accept'}}` to gen against the draft.
+ *   - `synth`  → push `{decision: {kind: 'accept'}}` to gen against the amended contract.
+ *
+ * Any origin → push `{decision: {kind: 'override', blueprintDraft: {...}}}` to
+ * discard the suggestion and gen against a fresh draft (mints a new
+ * `blueprintId` server-side).
+ *
+ * Wire-output is intentionally lean. The handler carries `reason`,
+ * `target`, `alternatives`, `contractHash`, `serverCapabilities` on
+ * its internal `HandshakeOutput` TS shape for telemetry / post-classify
+ * tracing — zod strips them before structuredContent serialization.
+ *
+ * `serverCapabilities` reaches the iframe via `_meta.ggui.bootstrap`
+ * (see `bootstrap-meta-derivation.ts`), not via this response.
+ */
+export const handshakeOutputSchema = z.object({
+    handshakeId: z.string().describe('Stable id — pass to ggui_push / ggui_update'),
+    action: z.enum(['create', 'reuse', 'update', 'replace', 'compose', 'declined']),
+    /**
+     * The handshake suggestion — see `handshakeSuggestionSchema`. The
+     * routing discriminator is `suggestion.origin`; `blueprintMeta` is
+     * ALWAYS present; `amendments` / `validationFindings` are
+     * conditional on the routing outcome.
+     */
+    suggestion: handshakeSuggestionSchema
+        .describe('Server\'s suggestion — origin-routed (cache | agent | synth). Always carries a provisional `blueprintMeta` the agent reuses by sending `decision: \'accept\'` on push.'),
+    /**
+     * Truncated human-readable rationale for the `action` value. Helps
+     * the agent and the operator narrate why the server chose to reuse a cached
+     * blueprint vs synth a fresh one vs decline. Internal-only
+     * `target`, `alternatives`, `contractHash`, `serverCapabilities`
+     * stay off the wire — they're telemetry, not agent-actionable.
+     */
+    reason: z
+        .string()
+        .max(280)
+        .optional()
+        .describe('Short rationale (≤280 chars) for the `action` value. Surfaced for agent + operator visibility; truncated to keep the structuredContent payload predictable.'),
+    nextStep: z.object({
+        tool: z.literal('ggui_push'),
+        description: z.string(),
+        example: z.string(),
+    }).optional().describe('Wire-shape recovery hint. A worked literal example of the next ggui_push call the agent should emit — the example string can be copied verbatim and tweaked (e.g. fill in `props` placeholders). Top-level field so a skimming agent finds it immediately.'),
+});
+/**
+ * `ggui_push` — materialises a UI emission. Step 3 of the three-step
+ * handshake protocol.
+ *
+ * The agent commits its decision relative to the prior handshake's
+ * suggestion: ACCEPT (use the provisional `blueprintMeta` from
+ * step-2 verbatim) or OVERRIDE (mint a fresh blueprintId with a NEW
+ * `blueprintDraft`).
+ *
+ * Locked decisions:
+ *
+ *   - `decision` discriminator: `{kind: 'accept'} |
+ *     {kind: 'override', blueprintDraft: {...}}`.
+ *   - `accept` reuses `handshake.suggestion.blueprintMeta.blueprintId`
+ *     exactly; `override` discards the provisional id and mints fresh.
+ *
+ * There is no separate `ggui_commit` — push absorbs that responsibility.
+ */
+export const pushInputSchema = z.object({
+    handshakeId: z
+        .string({
+        message: 'ggui_push: handshakeId is REQUIRED. Call ggui_handshake({sessionId, intent, blueprintDraft}) first to negotiate — handshake returns a handshakeId + suggestion. Then push with {handshakeId, decision: {kind: \'accept\'}} (accept the suggestion) or {handshakeId, decision: {kind: \'override\', blueprintDraft: {...}}} (override with a fresh draft). Direct-push without a handshakeId is not supported.',
+    })
+        .min(1, 'ggui_push: handshakeId must be a non-empty string from a prior ggui_handshake call.'),
+    /**
+     * Runtime prop values for THIS render. Validated against the
+     * effective contract's `propsSpec` — required-field checks + type
+     * checks per spec entry. Validation failures fail the push with a
+     * recoverable `ContractViolationError`.
+     */
+    props: z.record(z.string(), z.unknown()).optional(),
+    /**
+     * Decision discriminator (REQUIRED).
+     *
+     *   - `{kind: 'accept'}` — use the handshake's
+     *     `suggestion.blueprintMeta` verbatim. Cache delivery (origin
+     *     === 'cache') or gen-against-suggestion (origin === 'agent' /
+     *     'synth'). Reuses the provisional `blueprintId`.
+     *   - `{kind: 'override', blueprintDraft: {...}}` — mint a fresh
+     *     `blueprintId` and gen against the agent's NEW draft. The
+     *     provisional id from the handshake is discarded. Telemetry
+     *     threads via `handshakeId`.
+     */
+    decision: pushDecisionSchema
+        .describe('Accept the handshake suggestion (use provisional blueprintId verbatim) or override with a fresh draft (mint new blueprintId).'),
+}).strict();
+/**
+ * Wire-output shape — intentionally lean: `{stackItemId, nextStep?,
+ * url, action}`. The handler carries `sessionId`, `shortCode`,
+ * `codeReady`, `handshakeId`, `decision`, `contract`, `contractHash`,
+ * `cache`, `codeUrl`, `codeHash` on its internal `PushOutput` TS shape
+ * for telemetry / post-classify tracing — zod strips them before
+ * structuredContent serialization.
+ *
+ * The iframe receives bootstrap credentials (`wsUrl`, `token`,
+ * `expiresAt`) via `_meta.ggui.bootstrap`, not via this response.
+ */
+export const pushOutputSchema = z.object({
+    stackItemId: z.string(),
+    url: z.string().url(),
+    action: z.enum(['create', 'reuse', 'update', 'replace', 'compose', 'declined']),
+    /**
+     * Wire-shape recovery hint for the next call. Emitted ONLY when the
+     * pushed contract has a non-empty `actionSpec` — i.e. the agent will
+     * receive user-action events on this stack item. Pure-display pushes
+     * (props only) get no `nextStep` because there is nothing to consume.
+     *
+     * Mirrors the chain at `new_session.nextStep` (→ handshake) and
+     * `handshake.nextStep` (→ push). Closes the loop with consume.
+     *
+     * `args.stackItemId` is the literal value the agent passes to
+     * `ggui_consume` — copy-paste shape.
+     */
+    nextStep: z.object({
+        tool: z.literal('ggui_consume'),
+        description: z.string(),
+        example: z.string(),
+        args: z.object({
+            stackItemId: z.string(),
+        }),
+    }).optional().describe('Recovery hint — when the pushed contract has actions, points the agent at ggui_consume({stackItemId}) for the inbound action loop. Absent for pure-display pushes.'),
+});
+/**
+ * `ggui_update` — refresh the rendered UI with new state.
+ *
+ * Discriminated on `kind`:
+ *
+ *   - `kind: 'replace'` + `props` — full props replacement. The new
+ *     map IS the new state. Use when most props change OR when you
+ *     want deterministic state restoration (no merge ambiguity).
+ *
+ *   - `kind: 'merge'` + `patch` — RFC 7396 JSON Merge Patch semantics.
+ *     Top-level keys merge shallow; nested objects merge recursively;
+ *     a `null` value DELETES the key; arrays fully replace (NOT element-
+ *     wise). Use when most props stay the same and the agent only
+ *     needs to send a small delta — common after a single domain-tool
+ *     mutation. RFC 7396 chosen because it has a published spec and
+ *     wide library support (GitHub API, Kubernetes strategic-merge).
+ *
+ * Anti-patterns (the discriminated union rejects these structurally,
+ * but they're a common author mistake when copy-pasting):
+ *
+ *   - Do NOT send `props` on `kind: 'merge'` — use `patch`.
+ *   - Do NOT send `patch` on `kind: 'replace'` — use `props`.
+ *
+ * Both modes validate the FINAL props state (post-merge for `merge`)
+ * against the stack item's `propsSpec` and reject on violation —
+ * partial patches that would break required fields, type-mismatch
+ * values, etc. all reject pre-persist.
+ *
+ * `stackItemId` is globally unique; the server resolves the owning
+ * session via its secondary index and tenancy-checks via `ctx.appId`.
+ * NO `sessionId` on the wire.
+ */
+export const updateInputSchema = z.discriminatedUnion('kind', [
+    z.object({
+        stackItemId: z.string().describe('Stack item opaque id (UUID) — returned by ggui_push.'),
+        kind: z.literal('replace'),
+        props: z.record(z.string(), z.unknown())
+            .describe('Full replacement props map. New map IS the new state.'),
+    }).strict(),
+    z.object({
+        stackItemId: z.string().describe('Stack item opaque id (UUID) — returned by ggui_push.'),
+        kind: z.literal('merge'),
+        patch: z.record(z.string(), z.unknown())
+            .describe('RFC 7396 JSON Merge Patch — null deletes a key; arrays fully replace.'),
+    }).strict(),
+]);
+/**
+ * Wire-output shape — minimal acknowledgement. The handler carries
+ * `sessionId`, `decision`, `contract`, `contractHash` on its internal
+ * `UpdateOutput` TS shape — zod strips them before structuredContent
+ * serialization.
+ *
+ * Post-update the iframe receives the new props via the live-channel
+ * `props_update` WS frame; the cross-host fallback path receives them
+ * via `_meta.ggui.bootstrap.propsJson` (see `update.resultMeta`). The
+ * wire response itself is just acknowledgement.
+ */
+export const updateOutputSchema = z.object({
+    stackItemId: z.string(),
+    updated: z.boolean(),
+});

package/dist/schemas/ops-blueprint.d.ts

@@ -0,0 +1,176 @@
+/**
+ * Zod input + output schemas for the operator-class blueprint tools.
+ * Four tools, all `audience: 'ops'`, all served on `/ops`:
+ *
+ *   - `ggui_ops_generate_blueprint` — author a new blueprint by
+ *     dispatching through the registry's selected generator and
+ *     persisting the result. Optionally pins as the operator default
+ *     for its `(appId, contractHash)` group.
+ *   - `ggui_ops_list_blueprints` — enumerate blueprint metadata
+ *     (no code body) under tenancy + optional filters. Sorted by
+ *     `createdAt desc`.
+ *   - `ggui_ops_update_blueprint` — toggle the operator-default flag
+ *     and/or patch variance tags. Immutable fields (contractHash,
+ *     appId, codeS3Url, codeHash, generator, createdAt, createdBy)
+ *     never mutate; the tool MUST refuse them on input.
+ *   - `ggui_ops_delete_blueprint` — idempotent removal. Second delete
+ *     for the same id returns `{deleted: true}` — never throws.
+ *
+ * The schemas live in `@ggui-ai/protocol` (not the handler package)
+ * for the same reason all wire-shape schemas do: the protocol package
+ * is the source of truth for every MCP wire surface, and consumers
+ * (cloud pod handlers, console UI, fixture authors) can import from
+ * one place. Handler package wraps these into `SharedHandler`
+ * factories.
+ */
+import { z } from 'zod';
+/**
+ * `ggui_ops_generate_blueprint` input. Operator picks the contract +
+ * optional generator override + variance tags. `setAsOperatorDefault`
+ * pins the newly-minted blueprint as the default for its
+ * `(appId, contractHash)` group (the store clears any prior default
+ * in the same group, mirroring `BlueprintStore.setOperatorDefault`).
+ *
+ * `persona` is a top-level convenience field — handlers fold it into
+ * the `variance.persona` slot after normalization (lowercase + trim
+ * + Levenshtein near-dup warning).
+ *
+ * `appId` is NOT on the input shape — the handler reads it off
+ * `ctx.appId` resolved by the upstream auth adapter. Cross-tenant
+ * authorship would be a security-boundary violation.
+ */
+export declare const opsGenerateBlueprintInputSchema: z.ZodObject<{
+    contract: z.ZodType<import("../index.js").DataContract, unknown, z.core.$ZodTypeInternals<import("../index.js").DataContract, unknown>>;
+    generator: z.ZodOptional<z.ZodString>;
+    persona: z.ZodOptional<z.ZodString>;
+    aesthetic: z.ZodOptional<z.ZodString>;
+    context: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodType<import("../index.js").JsonValue, unknown, z.core.$ZodTypeInternals<import("../index.js").JsonValue, unknown>>>>;
+    seedPrompt: z.ZodOptional<z.ZodString>;
+    setAsOperatorDefault: z.ZodOptional<z.ZodBoolean>;
+}, z.core.$strict>;
+/**
+ * `ggui_ops_generate_blueprint` output. Metadata-only — the code body
+ * lives in S3 (cloud) or the in-memory code map (OSS) and is fetched
+ * via the existing push fast-path on cache hit.
+ */
+export declare const opsGenerateBlueprintOutputSchema: z.ZodObject<{
+    blueprintId: z.ZodString;
+    codeHash: z.ZodOptional<z.ZodString>;
+    validatorScore: z.ZodOptional<z.ZodNumber>;
+    generator: z.ZodString;
+}, z.core.$strict>;
+/**
+ * `ggui_ops_register_blueprint` input. Sibling of `*_generate_*` — no
+ * LLM dispatch, no generator. The operator supplies the COMPONENT
+ * CODE BYTES directly and the handler persists them under the same
+ * `(appId, contractHash)` slot. Use cases:
+ *
+ *   - Seeding pre-vetted blueprints at deploy time (fixture corpus,
+ *     migration imports).
+ *   - Round-tripping export+reimport — operator exports a blueprint
+ *     from one tenant and re-registers it in another.
+ *   - Reapplying a fixed version of a blueprint after live edits
+ *     (manual recovery from a bad generate run).
+ *
+ * Same tenancy + variance + default-pin semantics as
+ * `*_generate_*`; the only difference is the LLM/generator dispatch
+ * is replaced with a verbatim accept of the operator's
+ * `componentCode` string.
+ *
+ * `generator` is OPTIONAL here too — when omitted, the handler stamps
+ * the registry default's slug onto the persisted Blueprint so
+ * downstream `*_list_blueprints` consumers see a stable provenance
+ * field. `validatorScore` is never populated (no validator ran);
+ * operators wanting validator metadata should round-trip through
+ * `*_generate_*` instead.
+ */
+export declare const opsRegisterBlueprintInputSchema: z.ZodObject<{
+    contract: z.ZodType<import("../index.js").DataContract, unknown, z.core.$ZodTypeInternals<import("../index.js").DataContract, unknown>>;
+    componentCode: z.ZodString;
+    generator: z.ZodOptional<z.ZodString>;
+    persona: z.ZodOptional<z.ZodString>;
+    aesthetic: z.ZodOptional<z.ZodString>;
+    context: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodType<import("../index.js").JsonValue, unknown, z.core.$ZodTypeInternals<import("../index.js").JsonValue, unknown>>>>;
+    seedPrompt: z.ZodOptional<z.ZodString>;
+    setAsOperatorDefault: z.ZodOptional<z.ZodBoolean>;
+}, z.core.$strict>;
+/**
+ * `ggui_ops_register_blueprint` output. Same shape as
+ * `*_generate_*` minus `validatorScore` (no validator runs on the
+ * register path).
+ */
+export declare const opsRegisterBlueprintOutputSchema: z.ZodObject<{
+    blueprintId: z.ZodString;
+    codeHash: z.ZodString;
+    generator: z.ZodString;
+}, z.core.$strict>;
+/**
+ * `ggui_ops_list_blueprints` input. `appId` is NOT carried on the
+ * wire — handlers scope from `ctx.appId`. The filters below are AND-
+ * composed against the matching `(appId, *)` view of the store.
+ *
+ * Behavior split:
+ *   - When `contractHash` is the ONLY filter (no semantic keywords
+ *     or persona), handlers dispatch through
+ *     `BlueprintStore.list(appId, contractHash)` for the indexed
+ *     fast path.
+ *   - When `intentKeywords` or `persona` carry semantic intent,
+ *     handlers dispatch through `BlueprintSearch.search()` and
+ *     return the matching rows (sorted by score desc, then
+ *     `createdAt desc`).
+ *   - When no filter is supplied, handlers enumerate every blueprint
+ *     under `appId` via the search seam (which scopes by appId
+ *     internally), sorted `createdAt desc`.
+ */
+export declare const opsListBlueprintsInputSchema: z.ZodObject<{
+    contractHash: z.ZodOptional<z.ZodString>;
+    generator: z.ZodOptional<z.ZodString>;
+    persona: z.ZodOptional<z.ZodString>;
+    intentKeywords: z.ZodOptional<z.ZodArray<z.ZodString>>;
+}, z.core.$strict>;
+export declare const opsListBlueprintsOutputSchema: z.ZodObject<{
+    blueprints: z.ZodArray<z.ZodType<import("../index.js").Blueprint, unknown, z.core.$ZodTypeInternals<import("../index.js").Blueprint, unknown>>>;
+}, z.core.$strict>;
+/**
+ * `ggui_ops_update_blueprint` input. Only mutable fields are present
+ * here — `contractHash`, `appId`, `codeS3Url`, `codeHash`,
+ * `generator`, `createdAt`, `createdBy` are immutable invariants
+ * and the schema does NOT accept them. Operators who want to
+ * "replace" a row delete + re-generate.
+ */
+export declare const opsUpdateBlueprintInputSchema: z.ZodObject<{
+    blueprintId: z.ZodString;
+    isOperatorDefault: z.ZodOptional<z.ZodLiteral<true>>;
+    variance: z.ZodOptional<z.ZodType<import("../index.js").BlueprintVariance, unknown, z.core.$ZodTypeInternals<import("../index.js").BlueprintVariance, unknown>>>;
+}, z.core.$strict>;
+export declare const opsUpdateBlueprintOutputSchema: z.ZodObject<{
+    blueprintId: z.ZodString;
+    updatedAt: z.ZodString;
+}, z.core.$strict>;
+/**
+ * `ggui_ops_delete_blueprint` input + output. Idempotent: the handler
+ * returns `{deleted: true}` regardless of whether the row existed,
+ * matching `BlueprintStore.delete`'s no-throw contract.
+ */
+export declare const opsDeleteBlueprintInputSchema: z.ZodObject<{
+    blueprintId: z.ZodString;
+}, z.core.$strict>;
+export declare const opsDeleteBlueprintOutputSchema: z.ZodObject<{
+    deleted: z.ZodLiteral<true>;
+}, z.core.$strict>;
+/**
+ * Inferred TS types — exposed so handler factories and tests share
+ * one source of truth with the wire shape. Pre-launch posture: no
+ * `@deprecated` aliases — these are the canonical names.
+ */
+export type OpsGenerateBlueprintInput = z.infer<typeof opsGenerateBlueprintInputSchema>;
+export type OpsGenerateBlueprintOutput = z.infer<typeof opsGenerateBlueprintOutputSchema>;
+export type OpsRegisterBlueprintInput = z.infer<typeof opsRegisterBlueprintInputSchema>;
+export type OpsRegisterBlueprintOutput = z.infer<typeof opsRegisterBlueprintOutputSchema>;
+export type OpsListBlueprintsInput = z.infer<typeof opsListBlueprintsInputSchema>;
+export type OpsListBlueprintsOutput = z.infer<typeof opsListBlueprintsOutputSchema>;
+export type OpsUpdateBlueprintInput = z.infer<typeof opsUpdateBlueprintInputSchema>;
+export type OpsUpdateBlueprintOutput = z.infer<typeof opsUpdateBlueprintOutputSchema>;
+export type OpsDeleteBlueprintInput = z.infer<typeof opsDeleteBlueprintInputSchema>;
+export type OpsDeleteBlueprintOutput = z.infer<typeof opsDeleteBlueprintOutputSchema>;
+//# sourceMappingURL=ops-blueprint.d.ts.map

package/dist/schemas/ops-blueprint.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"ops-blueprint.d.ts","sourceRoot":"","sources":["../../src/schemas/ops-blueprint.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAOxB;;;;;;;;;;;;;;GAcG;AACH,eAAO,MAAM,+BAA+B;;;;;;;;kBAyCjC,CAAC;AAEZ;;;;GAIG;AACH,eAAO,MAAM,gCAAgC;;;;;kBAsBlC,CAAC;AAEZ;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,eAAO,MAAM,+BAA+B;;;;;;;;;kBA+CjC,CAAC;AAEZ;;;;GAIG;AACH,eAAO,MAAM,gCAAgC;;;;kBAgBlC,CAAC;AAEZ;;;;;;;;;;;;;;;;;GAiBG;AACH,eAAO,MAAM,4BAA4B;;;;;kBA6B9B,CAAC;AAEZ,eAAO,MAAM,6BAA6B;;kBAI/B,CAAC;AAEZ;;;;;;GAMG;AACH,eAAO,MAAM,6BAA6B;;;;kBAe/B,CAAC;AAEZ,eAAO,MAAM,8BAA8B;;;kBAKhC,CAAC;AAEZ;;;;GAIG;AACH,eAAO,MAAM,6BAA6B;;kBAI/B,CAAC;AAEZ,eAAO,MAAM,8BAA8B;;kBAIhC,CAAC;AAEZ;;;;GAIG;AACH,MAAM,MAAM,yBAAyB,GAAG,CAAC,CAAC,KAAK,CAC7C,OAAO,+BAA+B,CACvC,CAAC;AACF,MAAM,MAAM,0BAA0B,GAAG,CAAC,CAAC,KAAK,CAC9C,OAAO,gCAAgC,CACxC,CAAC;AACF,MAAM,MAAM,yBAAyB,GAAG,CAAC,CAAC,KAAK,CAC7C,OAAO,+BAA+B,CACvC,CAAC;AACF,MAAM,MAAM,0BAA0B,GAAG,CAAC,CAAC,KAAK,CAC9C,OAAO,gCAAgC,CACxC,CAAC;AACF,MAAM,MAAM,sBAAsB,GAAG,CAAC,CAAC,KAAK,CAC1C,OAAO,4BAA4B,CACpC,CAAC;AACF,MAAM,MAAM,uBAAuB,GAAG,CAAC,CAAC,KAAK,CAC3C,OAAO,6BAA6B,CACrC,CAAC;AACF,MAAM,MAAM,uBAAuB,GAAG,CAAC,CAAC,KAAK,CAC3C,OAAO,6BAA6B,CACrC,CAAC;AACF,MAAM,MAAM,wBAAwB,GAAG,CAAC,CAAC,KAAK,CAC5C,OAAO,8BAA8B,CACtC,CAAC;AACF,MAAM,MAAM,uBAAuB,GAAG,CAAC,CAAC,KAAK,CAC3C,OAAO,6BAA6B,CACrC,CAAC;AACF,MAAM,MAAM,wBAAwB,GAAG,CAAC,CAAC,KAAK,CAC5C,OAAO,8BAA8B,CACtC,CAAC"}