@ggui-ai/protocol 0.15.0 → 0.17.0

package/dist/schemas/mcp.js

@@ -7,7 +7,7 @@
  * Two consumption patterns, both anchored here:
  *
  *   - **Wired raw shapes** (`*InputShape`): handlers in
- *     `@ggui-ai/mcp-server-handlers` (and the hosted pod's discover
+ *     `@ggui-ai/mcp-server-handlers` (and a hosted deployment's discover
  *     tool) import the SHAPE directly as their `inputSchema` and
  *     validate with `z.object(shape)` — unknown keys are STRIPPED.
  *     The shape is the one authored copy of the validation rules AND
@@ -48,14 +48,14 @@ export const consumeInputShape = {
     sessionId: z
         .string()
         .min(1)
-        .describe('Globally-unique sessionId to consume events from. Cross-tenant access surfaces uniformly as session_not_found.'),
+        .describe('Globally-unique sessionId to consume events from. Cross-app access surfaces uniformly as session_not_found.'),
     timeout: z
         .number()
         .int()
         .min(0)
         .max(25)
         .optional()
-        .describe('Inline long-poll seconds, integer in [0, 25]. 0 = immediate. Values outside the bound reject INVALID_PARAMS. Returns on first event OR timeout; re-call on empty to keep waiting — longer waits are your loop, not a bigger timeout.'),
+        .describe('Inline long-poll seconds, integer in [0, 25]. 0 = immediate. Values outside the bound reject INVALID_PARAMS. Returns on first event OR timeout; on empty you may re-call once, then end your turn — a later gesture arrives as a new user message carrying its own consume directive.'),
 };
 export const consumeInputSchema = z.object(consumeInputShape);
 /**
@@ -220,7 +220,7 @@ export const handshakeInputSchema = z.object({
  * `'declined'` cover every legal outcome.
  */
 export const handshakeOutputSchema = z.object({
-    handshakeId: z.string().describe('Stable id — pass to ggui_render / ggui_update'),
+    handshakeId: z.string().describe('Stable id — pass to ggui_render'),
     action: z.enum(['create', 'reuse', 'update', 'replace', 'declined']),
     /**
      * The handshake suggestion — see `handshakeSuggestionSchema`. The
@@ -330,7 +330,7 @@ export const renderInputShape = {
             .string()
             .min(1)
             .optional()
-            .describe('Model route in either wire form — canonical `anthropic:claude-haiku-4-5-20251001` or LiteLLM `anthropic/claude-haiku-4-5` (aliases resolve in both); generator-specific prefixes (e.g. `bedrock/...`) route to that transport. A value that parses in neither form fails the handler input parse at `infra.model`, before any pre-generation gate; `model_not_in_tier` is only ever a well-formed route with no rate row on the effective tier.'),
+            .describe('Model route in either wire form — canonical `anthropic:claude-haiku-4-5-20251001` or LiteLLM `anthropic/claude-haiku-4-5` (aliases resolve in both); generator-specific prefixes (e.g. `bedrock/...`) route to that transport. A value that parses in neither form fails the handler input parse at `infra.model`, before any pre-generation gate; `model_not_allowed` is only ever a well-formed route with no rate row on the effective tier.'),
     })
         .strict()
         .optional(),
@@ -516,13 +516,23 @@ export const renderRefusalSchema = z.object({
  * from {@link MCP_ENDPOINT_REFUSAL_CODES} — today exactly
  * `app_deprovisioned`, the one refusal with a tenant-side fix and
  * therefore the one that MUST be legible where a deleted app and a bad
- * credential would otherwise look alike.
+ * credential would otherwise look alike. `appId` (ggui#870) is the app
+ * the refused endpoint serves, as DATA — equal to the path's `{appId}`
+ * — so a tenant's repair loop keys on it and never parses prose; it is
+ * the ggui id the bound caller already holds, never the tenant's own
+ * `ownerRef`. The typed refusal answers a correctly bound federated
+ * identity only (identity first): an anonymous request is refused by the
+ * auth adapter before this arm, and learns nothing about the app.
  */
 export const transportRefusalSchema = z.strictObject({
     code: z
         .enum(MCP_ENDPOINT_REFUSAL_CODES)
         .describe("Registered refusal state on the per-app endpoint. Look the code up in the protocol's refusal registry for its retry class and which party can act."),
     ...refusalProjectionFields,
+    appId: z
+        .string()
+        .min(1)
+        .describe('The app id the refused endpoint serves — equals the {appId} of the endpoint path. Structured here so a repair loop keys on it instead of parsing the message.'),
 });
 /**
  * The JSON-RPC error object a per-app MCP endpoint answers with when it
@@ -532,7 +542,7 @@ export const transportRefusalSchema = z.strictObject({
  * proxy 403) and `message` `App not found`, plus `data.refusal`, which
  * makes it legible. `data` is strict: it carries the refusal and nothing
  * else. An authorization failure that is not a registry state answers
- * HTTP 403 with `-32001` (`UNAUTHORIZED`) and NO `data` — the three
+ * HTTP 403 with `-32007` (`UNAUTHORIZED`) and NO `data` — the three
  * untyped arms stay indistinguishable among themselves by contract:
  * naming any of them would say which is true. A first-party server
  * never chooses `-32000`: it is the SDK client's `ConnectionClosed`, so
@@ -851,7 +861,7 @@ export const renderOutputSchema = z.object({
  *     wise). Use when most props stay the same and the agent only
  *     needs to send a small delta — common after a single domain-tool
  *     mutation. RFC 7396 chosen because it has a published spec and
- *     wide library support (GitHub API, Kubernetes strategic-merge).
+ *     wide library support (GitHub API's merge semantics, strategic-merge-patch).
  *
  * Anti-patterns (the discriminated union rejects these structurally,
  * but they're a common author mistake when copy-pasting):
@@ -864,7 +874,7 @@ export const renderOutputSchema = z.object({
  * partial patches that would break required fields, type-mismatch
  * values, etc. all reject pre-persist.
  *
- * `sessionId` is globally unique; the server tenancy-checks via
+ * `sessionId` is globally unique; the server checks the app scope via
  * `ctx.appId`.
  */
 export const updateInputSchema = z.discriminatedUnion('kind', [
@@ -1084,11 +1094,20 @@ export const declareToolCatalogOutputSchema = z
  */
 export const RUNTIME_PULL_MAX_LIMIT = 100;
 /**
- * Server-side ceiling on `ggui_runtime_pull`'s `wait` hold, in seconds.
- * Chosen under `ggui_consume`'s proven 25-second host tolerance for
- * held tool calls — the hold must resolve before any host-side
- * `tools/call` timeout fires, or the transport counts a failure the
- * server intended as a quiet success.
+ * Server-side ceiling on `ggui_runtime_pull`'s `wait` hold, in seconds —
+ * the LONGEST hold the server will honour, never a promise that every
+ * host tolerates it (ggui#1030).
+ *
+ * The contract has two sides. SERVER: honour `wait` up to this ceiling,
+ * return the empty page as a normal result when the hold elapses, and
+ * end the hold when the caller's transport closes. CALLER (the pulling
+ * runtime): choose a `wait` that does not exceed the `tools/call`
+ * timeout of the host relaying the call, minus a margin; a host that
+ * relays a pull clamps the forwarded `wait` to its own timeout minus one
+ * second. A host timeout below the hold is a caller-side failure — the
+ * server's `success` after the socket closed is not a server fault, and
+ * a caller that keeps pulling through such failures must demote to
+ * sparse un-held pulls exactly as it does after consecutive empties.
  */
 export const RUNTIME_PULL_MAX_WAIT_SECONDS = 20;
 /**
@@ -1138,15 +1157,15 @@ export const gguiSessionEventSchema = z.object({
  * OPTIONAL here (the bridge rung owns its cursor and seeds from 0; the
  * route requires it because a bare browser GET has no cursor owner),
  * and `limit` is clamped to {@link RUNTIME_PULL_MAX_LIMIT} instead of
- * rejecting above it. Tenancy violations and unknown sessionIds
+ * rejecting above it. Cross-app access and unknown sessionIds
  * surface uniformly as the `session_not_found` error — existence of
- * other tenants' renders is never leaked.
+ * other apps' renders is never leaked.
  */
 export const runtimePullInputShape = {
     sessionId: z
         .string()
         .min(1)
-        .describe('Active render id — sourced from `_meta["ai.ggui/render"].sessionId` on the iframe boot envelope. Unknown and cross-tenant ids surface uniformly as session_not_found.'),
+        .describe('Active render id — sourced from `_meta["ai.ggui/render"].sessionId` on the iframe boot envelope. Unknown and cross-app ids surface uniformly as session_not_found.'),
     sinceSequence: z
         .number()
         .int()
@@ -1163,7 +1182,7 @@ export const runtimePullInputShape = {
         .number()
         .min(0)
         .optional()
-        .describe(`Subscription-mode hold, in seconds. When set and the cursor page is empty, the server holds this call until an event lands or the hold elapses (values above ${RUNTIME_PULL_MAX_WAIT_SECONDS} are clamped to ${RUNTIME_PULL_MAX_WAIT_SECONDS}). An empty page after a full hold is a NORMAL result — immediately re-pull to stay subscribed, or back off to sparse un-held pulls after a few consecutive empties. Omit (= 0) for an immediate return.`),
+        .describe(`Subscription-mode hold, in seconds. When set and the cursor page is empty, the server holds this call until an event lands or the hold elapses (values above ${RUNTIME_PULL_MAX_WAIT_SECONDS} are clamped to ${RUNTIME_PULL_MAX_WAIT_SECONDS}). CALLER OBLIGATION: your \`wait\` MUST NOT exceed the tools/call timeout of the host relaying this call, minus a margin — a host that relays a pull MUST clamp the forwarded \`wait\` to its own timeout minus one second; a host timeout below the hold is a caller-side failure (the server's success after the socket closed is not a server fault), and a caller seeing such failures MUST demote to sparse un-held pulls as it would after consecutive empties. An empty page after a full hold is a NORMAL result — immediately re-pull to stay subscribed, or back off to sparse un-held pulls after a few consecutive empties. Omit (= 0) for an immediate return.`),
 };
 export const runtimePullInputSchema = z.object(runtimePullInputShape);
 /**
@@ -1332,9 +1351,9 @@ export const gguiSessionStatusSchema = z.enum(['active', 'expired']);
 /**
  * One drained row of `ggui_consume` — a user action that reached the
  * pipe (ggui#817 part C2). Closed on the wire: an unknown key is
- * stripped at the transport, a missing key refuses the row at the seam
- * (`parsePendingEnvelope`), so a malformed pipe entry never ships to an
- * agent typed as a good one.
+ * stripped at the transport, a missing key refuses the row at the store
+ * boundary (`pendingEventSchema`, ggui#839), so a malformed pipe entry
+ * never ships to an agent typed as a good one.
  */
 export const consumeEventEntrySchema = z.object({
     type: z.literal('action'),
@@ -1345,6 +1364,25 @@ export const consumeEventEntrySchema = z.object({
     actionId: z.string(),
     firedAt: z.string(),
 });
+/**
+ * One stored row of the consume pipe — what a producer appends and
+ * `consumeAndClear` drains, the same shape on every store (ggui#839; a
+ * store-boundary contract, never wire — `ggui_consume` returns the
+ * entries, never the wrapper). `id` is the drain_ack key and the
+ * idempotency key per `(sessionId, id)`; `envelope` is the
+ * {@link consumeEventEntrySchema} entry, always the object (every writer
+ * passes one; a store that serializes the row serializes the whole row);
+ * `createdAt` is when the row was appended — a string, never `.datetime()`:
+ * the relay copies the client's `firedAt`, which the ingress accepts as a
+ * diagnostic. `PendingEventConsumer` adapters validate every row through
+ * this schema on append and, when rows come back from a serialization, on
+ * drain — a malformed row never reaches an agent typed as a good entry.
+ */
+export const pendingEventSchema = z.object({
+    id: z.string().min(1),
+    envelope: consumeEventEntrySchema,
+    createdAt: z.string(),
+});
 /**
  * `ggui_consume`'s output — the drained rows, the session's state, and the
  * client's observations when the host sent any (ggui#817 part C2). The

package/dist/schemas/ops-blueprint.d.ts

@@ -7,7 +7,7 @@
  *     persisting the result. Optionally pins as the operator default
  *     for its `(appId, contractHash)` group.
  *   - `ggui_ops_list_blueprints` — enumerate blueprint metadata
- *     (no code body) under tenancy + optional filters. Sorted by
+ *     (no code body) under the caller's app scope + optional filters. Sorted by
  *     `createdAt desc`.
  *   - `ggui_ops_update_blueprint` — toggle the operator-default flag
  *     and/or patch variance tags. Immutable fields (contractHash,
@@ -19,7 +19,7 @@
  * The schemas live in `@ggui-ai/protocol` (not the handler package)
  * for the same reason all wire-shape schemas do: the protocol package
  * is the source of truth for every MCP wire surface, and consumers
- * (cloud pod handlers, console UI, fixture authors) can import from
+ * (a hosted deployment's handlers, console UI, fixture authors) can import from
  * one place. Handler package wraps these into `SharedHandler`
  * factories.
  */
@@ -39,6 +39,12 @@ import { z } from 'zod';
  * caller's bound app identity; cross-app calls are subject to the
  * deployment's authorization policy.
  */
+/**
+ * Bound on `intent` (ggui#1046), in characters — one exported number the
+ * door checks and readers may cap at; standalone (not tied to any other
+ * text bound: they move independently).
+ */
+export declare const OPS_GENERATE_BLUEPRINT_INTENT_MAX_CHARS = 2000;
 export declare const opsGenerateBlueprintInputSchema: z.ZodObject<{
     appId: z.ZodOptional<z.ZodString>;
     contract: z.ZodType<import("../index.js").DataContract, unknown, z.core.$ZodTypeInternals<import("../index.js").DataContract, unknown>>;
@@ -47,6 +53,7 @@ export declare const opsGenerateBlueprintInputSchema: z.ZodObject<{
     aesthetic: z.ZodOptional<z.ZodString>;
     context: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodType<import("../index.js").JsonValue, unknown, z.core.$ZodTypeInternals<import("../index.js").JsonValue, unknown>>>>;
     seedPrompt: z.ZodOptional<z.ZodString>;
+    intent: z.ZodOptional<z.ZodString>;
     setAsOperatorDefault: z.ZodOptional<z.ZodBoolean>;
 }, z.core.$strict>;
 /**
@@ -69,11 +76,11 @@ export declare const opsGenerateBlueprintOutputSchema: z.ZodObject<{
  *   - Seeding pre-vetted blueprints at deploy time (fixture corpus,
  *     migration imports).
  *   - Round-tripping export+reimport — operator exports a blueprint
- *     from one tenant and re-registers it in another.
+ *     from one app (or one deployment) and re-registers it in another.
  *   - Reapplying a fixed version of a blueprint after live edits
  *     (manual recovery from a bad generate run).
  *
- * Same tenancy + variance + default-pin semantics as
+ * Same app-scoping + variance + default-pin semantics as
  * `*_generate_*`; the only difference is the LLM/generator dispatch
  * is replaced with a verbatim accept of the operator's
  * `componentCode` string.

package/dist/schemas/ops-blueprint.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"ops-blueprint.d.ts","sourceRoot":"","sources":["../../src/schemas/ops-blueprint.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAYxB;;;;;;;;;;;;;;GAcG;AACH,eAAO,MAAM,+BAA+B;;;;;;;;;kBAgDjC,CAAC;AAEZ;;;;GAIG;AACH,eAAO,MAAM,gCAAgC;;;;;kBAqBlC,CAAC;AAEZ;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AACH,eAAO,MAAM,+BAA+B;;;;;;;;;kBA+CjC,CAAC;AAEZ;;;;GAIG;AACH,eAAO,MAAM,gCAAgC;;;;kBAalC,CAAC;AAEZ;;;;;;;;;;;;;;;;;;;GAmBG;AACH,eAAO,MAAM,4BAA4B;;;;;;kBAoC9B,CAAC;AAEZ,eAAO,MAAM,6BAA6B;;kBAI/B,CAAC;AAEZ;;;;;;;;GAQG;AACH,eAAO,MAAM,6BAA6B;;;;;kBAsB/B,CAAC;AAEZ,eAAO,MAAM,8BAA8B;;;kBAKhC,CAAC;AAEZ;;;;GAIG;AACH,eAAO,MAAM,6BAA6B;;;kBAW/B,CAAC;AAEZ,eAAO,MAAM,8BAA8B;;kBAIhC,CAAC;AAEZ;;;;GAIG;AACH,MAAM,MAAM,yBAAyB,GAAG,CAAC,CAAC,KAAK,CAC7C,OAAO,+BAA+B,CACvC,CAAC;AACF,MAAM,MAAM,0BAA0B,GAAG,CAAC,CAAC,KAAK,CAC9C,OAAO,gCAAgC,CACxC,CAAC;AACF,MAAM,MAAM,yBAAyB,GAAG,CAAC,CAAC,KAAK,CAC7C,OAAO,+BAA+B,CACvC,CAAC;AACF,MAAM,MAAM,0BAA0B,GAAG,CAAC,CAAC,KAAK,CAC9C,OAAO,gCAAgC,CACxC,CAAC;AACF,MAAM,MAAM,sBAAsB,GAAG,CAAC,CAAC,KAAK,CAC1C,OAAO,4BAA4B,CACpC,CAAC;AACF,MAAM,MAAM,uBAAuB,GAAG,CAAC,CAAC,KAAK,CAC3C,OAAO,6BAA6B,CACrC,CAAC;AACF,MAAM,MAAM,uBAAuB,GAAG,CAAC,CAAC,KAAK,CAC3C,OAAO,6BAA6B,CACrC,CAAC;AACF,MAAM,MAAM,wBAAwB,GAAG,CAAC,CAAC,KAAK,CAC5C,OAAO,8BAA8B,CACtC,CAAC;AACF,MAAM,MAAM,uBAAuB,GAAG,CAAC,CAAC,KAAK,CAC3C,OAAO,6BAA6B,CACrC,CAAC;AACF,MAAM,MAAM,wBAAwB,GAAG,CAAC,CAAC,KAAK,CAC5C,OAAO,8BAA8B,CACtC,CAAC"}
+{"version":3,"file":"ops-blueprint.d.ts","sourceRoot":"","sources":["../../src/schemas/ops-blueprint.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAaxB;;;;;;;;;;;;;;GAcG;AACH;;;;GAIG;AACH,eAAO,MAAM,uCAAuC,OAAO,CAAC;AAE5D,eAAO,MAAM,+BAA+B;;;;;;;;;;kBA0DjC,CAAC;AAEZ;;;;GAIG;AACH,eAAO,MAAM,gCAAgC;;;;;kBAqBlC,CAAC;AAEZ;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AACH,eAAO,MAAM,+BAA+B;;;;;;;;;kBA+CjC,CAAC;AAEZ;;;;GAIG;AACH,eAAO,MAAM,gCAAgC;;;;kBAalC,CAAC;AAEZ;;;;;;;;;;;;;;;;;;;GAmBG;AACH,eAAO,MAAM,4BAA4B;;;;;;kBAsC9B,CAAC;AAEZ,eAAO,MAAM,6BAA6B;;kBAI/B,CAAC;AAEZ;;;;;;;;GAQG;AACH,eAAO,MAAM,6BAA6B;;;;;kBAsB/B,CAAC;AAEZ,eAAO,MAAM,8BAA8B;;;kBAKhC,CAAC;AAEZ;;;;GAIG;AACH,eAAO,MAAM,6BAA6B;;;kBAW/B,CAAC;AAEZ,eAAO,MAAM,8BAA8B;;kBAIhC,CAAC;AAEZ;;;;GAIG;AACH,MAAM,MAAM,yBAAyB,GAAG,CAAC,CAAC,KAAK,CAC7C,OAAO,+BAA+B,CACvC,CAAC;AACF,MAAM,MAAM,0BAA0B,GAAG,CAAC,CAAC,KAAK,CAC9C,OAAO,gCAAgC,CACxC,CAAC;AACF,MAAM,MAAM,yBAAyB,GAAG,CAAC,CAAC,KAAK,CAC7C,OAAO,+BAA+B,CACvC,CAAC;AACF,MAAM,MAAM,0BAA0B,GAAG,CAAC,CAAC,KAAK,CAC9C,OAAO,gCAAgC,CACxC,CAAC;AACF,MAAM,MAAM,sBAAsB,GAAG,CAAC,CAAC,KAAK,CAC1C,OAAO,4BAA4B,CACpC,CAAC;AACF,MAAM,MAAM,uBAAuB,GAAG,CAAC,CAAC,KAAK,CAC3C,OAAO,6BAA6B,CACrC,CAAC;AACF,MAAM,MAAM,uBAAuB,GAAG,CAAC,CAAC,KAAK,CAC3C,OAAO,6BAA6B,CACrC,CAAC;AACF,MAAM,MAAM,wBAAwB,GAAG,CAAC,CAAC,KAAK,CAC5C,OAAO,8BAA8B,CACtC,CAAC;AACF,MAAM,MAAM,uBAAuB,GAAG,CAAC,CAAC,KAAK,CAC3C,OAAO,6BAA6B,CACrC,CAAC;AACF,MAAM,MAAM,wBAAwB,GAAG,CAAC,CAAC,KAAK,CAC5C,OAAO,8BAA8B,CACtC,CAAC"}

package/dist/schemas/ops-blueprint.js

@@ -7,7 +7,7 @@
  *     persisting the result. Optionally pins as the operator default
  *     for its `(appId, contractHash)` group.
  *   - `ggui_ops_list_blueprints` — enumerate blueprint metadata
- *     (no code body) under tenancy + optional filters. Sorted by
+ *     (no code body) under the caller's app scope + optional filters. Sorted by
  *     `createdAt desc`.
  *   - `ggui_ops_update_blueprint` — toggle the operator-default flag
  *     and/or patch variance tags. Immutable fields (contractHash,
@@ -19,11 +19,12 @@
  * The schemas live in `@ggui-ai/protocol` (not the handler package)
  * for the same reason all wire-shape schemas do: the protocol package
  * is the source of truth for every MCP wire surface, and consumers
- * (cloud pod handlers, console UI, fixture authors) can import from
+ * (a hosted deployment's handlers, console UI, fixture authors) can import from
  * one place. Handler package wraps these into `SharedHandler`
  * factories.
  */
 import { z } from 'zod';
+import { GENERATOR_ID_PATTERN } from '../types/blueprint-source.js';
 import { dataContractSchema, jsonValueSchema, } from './data-contract.js';
 import { blueprintSchema, blueprintVarianceSchema, llmBlueprintSourceSchema, userBlueprintSourceSchema, } from './blueprint.js';
 /**
@@ -41,6 +42,12 @@ import { blueprintSchema, blueprintVarianceSchema, llmBlueprintSourceSchema, use
  * caller's bound app identity; cross-app calls are subject to the
  * deployment's authorization policy.
  */
+/**
+ * Bound on `intent` (ggui#1046), in characters — one exported number the
+ * door checks and readers may cap at; standalone (not tied to any other
+ * text bound: they move independently).
+ */
+export const OPS_GENERATE_BLUEPRINT_INTENT_MAX_CHARS = 2000;
 export const opsGenerateBlueprintInputSchema = z
     .object({
     appId: z
@@ -51,9 +58,11 @@ export const opsGenerateBlueprintInputSchema = z
     contract: dataContractSchema,
     generator: z
         .string()
-        .min(1)
+        .regex(GENERATOR_ID_PATTERN, {
+        error: 'generator is an identity `ui-gen-<tier>` — one tier token, no model segment (ggui#924)',
+    })
         .optional()
-        .describe('Generator slug (e.g. `ui-gen-default-haiku-4-5`). When omitted, dispatches through `GeneratorRegistry.defaultGenerator()`.'),
+        .describe('Generator identity (e.g. `ui-gen-default`; the model is chosen by the deployment and reported on `source.model`). When omitted, dispatches through `GeneratorRegistry.defaultGenerator()`.'),
     persona: z
         .string()
         .optional()
@@ -70,6 +79,12 @@ export const opsGenerateBlueprintInputSchema = z
         .string()
         .optional()
         .describe("The raw operator prompt that produced this variant. Round-trip input for the variant-selector + audit trail."),
+    intent: z
+        .string()
+        .trim()
+        .max(OPS_GENERATE_BLUEPRINT_INTENT_MAX_CHARS)
+        .optional()
+        .describe(`What the operator wants generated for this contract, in plain words — the prompt the generator composes from (at most ${OPS_GENERATE_BLUEPRINT_INTENT_MAX_CHARS} characters). Not part of the cache identity: two calls that differ only in \`intent\` share a variant key. When omitted, the generator falls back to \`seedPrompt\`; omitting both is a caller gap that a future release refuses.`),
     setAsOperatorDefault: z
         .boolean()
         .optional()
@@ -106,11 +121,11 @@ export const opsGenerateBlueprintOutputSchema = z
  *   - Seeding pre-vetted blueprints at deploy time (fixture corpus,
  *     migration imports).
  *   - Round-tripping export+reimport — operator exports a blueprint
- *     from one tenant and re-registers it in another.
+ *     from one app (or one deployment) and re-registers it in another.
  *   - Reapplying a fixed version of a blueprint after live edits
  *     (manual recovery from a bad generate run).
  *
- * Same tenancy + variance + default-pin semantics as
+ * Same app-scoping + variance + default-pin semantics as
  * `*_generate_*`; the only difference is the LLM/generator dispatch
  * is replaced with a verbatim accept of the operator's
  * `componentCode` string.
@@ -206,9 +221,11 @@ export const opsListBlueprintsInputSchema = z
         .describe('Filter to a single `(appId, contractHash)` group. Combine with `generator` / `persona` to narrow within the group.'),
     generator: z
         .string()
-        .min(1)
+        .regex(GENERATOR_ID_PATTERN, {
+        error: 'generator is an identity `ui-gen-<tier>` — one tier token, no model segment (ggui#924)',
+    })
         .optional()
-        .describe('Filter to engine-generated blueprints (`source.kind === "llm"`) whose `source.generator` equals this slug. `user`-sourced rows never match (they carry no engine provenance).'),
+        .describe('Filter to engine-generated blueprints (`source.kind === "llm"`) whose `source.generator` equals this identity (`ui-gen-<tier>`, e.g. `ui-gen-advanced`). `user`-sourced rows never match (they carry no engine provenance).'),
     persona: z
         .string()
         .optional()

package/dist/schemas/render-input-envelope.js

@@ -7,7 +7,7 @@ import { renderInputShape } from './mcp.js';
  * either wire form (canonical `provider:model` or LiteLLM `provider/model`;
  * aliases resolve in both). The render handler parses this BEFORE its
  * pre-generation gate, so a malformed route is a contract error at zod path
- * `infra.model` — never a policy refusal (`model_not_in_tier` is reserved
+ * `infra.model` — never a policy refusal (`model_not_allowed` is reserved
  * for a well-formed route with no rate row on the effective tier).
  *
  * Kept OUT of the registered shape on purpose: `@ggui-ai/iframe-runtime`

package/dist/schemas/rendering-context.d.ts

@@ -0,0 +1,48 @@
+import { z } from 'zod';
+/**
+ * The rendering-context vocabulary — how and where a generated component
+ * will be displayed (ggui#1000, `items[].rendering?` on the bootstrap door).
+ *
+ * ONE vocabulary. It used to exist twice as hand-declared unions
+ * (`@ggui-ai/mcp-server-core` `UiGenerateInput.rendering`, `@ggui-ai/ui-gen`
+ * `RenderingContext`) and nowhere as a schema; a wire that carries it needs
+ * a validator, so it lives here and every consumer derives its type from
+ * this schema — never a second spelling, never a narrower one at a door.
+ *
+ * Parties and obligations: a SENDER (a host announcing where the
+ * component renders; a provisioning caller pre-minting for a chip) sends
+ * `{ shell, device, viewport? }` from this vocabulary and nothing else; a
+ * RECEIVER validates with this schema and answers an invalid value with its
+ * surface's typed refusal (the bootstrap door: `400 invalid_rendering`);
+ * what a lane can JUDGE for a given shell/device (its canvas pair) is that
+ * lane's policy, reported on its receipt — never a trimmed vocabulary.
+ * Absent ⇒ the receiver's default behaviour, unchanged.
+ */
+export declare const RENDERING_SHELLS: readonly ["chat", "fullscreen", "partial"];
+export declare const RENDERING_DEVICES: readonly ["mobile", "tablet", "desktop", "spatial"];
+export type RenderingShell = (typeof RENDERING_SHELLS)[number];
+export type RenderingDevice = (typeof RENDERING_DEVICES)[number];
+/** Viewport in CSS pixels — both dimensions, finite and positive. */
+export declare const renderingViewportSchema: z.ZodObject<{
+    width: z.ZodNumber;
+    height: z.ZodNumber;
+}, z.core.$strict>;
+export declare const renderingContextSchema: z.ZodObject<{
+    device: z.ZodEnum<{
+        desktop: "desktop";
+        mobile: "mobile";
+        tablet: "tablet";
+        spatial: "spatial";
+    }>;
+    shell: z.ZodEnum<{
+        fullscreen: "fullscreen";
+        chat: "chat";
+        partial: "partial";
+    }>;
+    viewport: z.ZodOptional<z.ZodObject<{
+        width: z.ZodNumber;
+        height: z.ZodNumber;
+    }, z.core.$strict>>;
+}, z.core.$strict>;
+export type RenderingContext = z.infer<typeof renderingContextSchema>;
+//# sourceMappingURL=rendering-context.d.ts.map

package/dist/schemas/rendering-context.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"rendering-context.d.ts","sourceRoot":"","sources":["../../src/schemas/rendering-context.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB;;;;;;;;;;;;;;;;;;GAkBG;AACH,eAAO,MAAM,gBAAgB,4CAA6C,CAAC;AAC3E,eAAO,MAAM,iBAAiB,qDAAsD,CAAC;AAErF,MAAM,MAAM,cAAc,GAAG,CAAC,OAAO,gBAAgB,CAAC,CAAC,MAAM,CAAC,CAAC;AAC/D,MAAM,MAAM,eAAe,GAAG,CAAC,OAAO,iBAAiB,CAAC,CAAC,MAAM,CAAC,CAAC;AAEjE,qEAAqE;AACrE,eAAO,MAAM,uBAAuB;;;kBAKzB,CAAC;AAEZ,eAAO,MAAM,sBAAsB;;;;;;;;;;;;;;;;kBASxB,CAAC;AAEZ,MAAM,MAAM,gBAAgB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,sBAAsB,CAAC,CAAC"}

package/dist/schemas/rendering-context.js

@@ -0,0 +1,39 @@
+import { z } from 'zod';
+/**
+ * The rendering-context vocabulary — how and where a generated component
+ * will be displayed (ggui#1000, `items[].rendering?` on the bootstrap door).
+ *
+ * ONE vocabulary. It used to exist twice as hand-declared unions
+ * (`@ggui-ai/mcp-server-core` `UiGenerateInput.rendering`, `@ggui-ai/ui-gen`
+ * `RenderingContext`) and nowhere as a schema; a wire that carries it needs
+ * a validator, so it lives here and every consumer derives its type from
+ * this schema — never a second spelling, never a narrower one at a door.
+ *
+ * Parties and obligations: a SENDER (a host announcing where the
+ * component renders; a provisioning caller pre-minting for a chip) sends
+ * `{ shell, device, viewport? }` from this vocabulary and nothing else; a
+ * RECEIVER validates with this schema and answers an invalid value with its
+ * surface's typed refusal (the bootstrap door: `400 invalid_rendering`);
+ * what a lane can JUDGE for a given shell/device (its canvas pair) is that
+ * lane's policy, reported on its receipt — never a trimmed vocabulary.
+ * Absent ⇒ the receiver's default behaviour, unchanged.
+ */
+export const RENDERING_SHELLS = ['chat', 'fullscreen', 'partial'];
+export const RENDERING_DEVICES = ['mobile', 'tablet', 'desktop', 'spatial'];
+/** Viewport in CSS pixels — both dimensions, finite and positive. */
+export const renderingViewportSchema = z
+    .object({
+    width: z.number().finite().positive(),
+    height: z.number().finite().positive(),
+})
+    .strict();
+export const renderingContextSchema = z
+    .object({
+    /** Device category — affects touch targets, column count, density. */
+    device: z.enum(RENDERING_DEVICES),
+    /** Shell type — the container the component renders in. */
+    shell: z.enum(RENDERING_SHELLS),
+    /** Viewport dimensions in CSS pixels (optional). */
+    viewport: renderingViewportSchema.optional(),
+})
+    .strict();

package/dist/types/blueprint-source.d.ts

@@ -11,7 +11,7 @@
  *
  *   - `llm` — engine-generated. `generator` is the slug of the
  *     {@link UiGenerator} that produced the component code; `model` is
- *     the LLM model id the engine called. Both REQUIRED: every
+ *     the route the engine called, as a `ModelRef`. Both REQUIRED: every
  *     generation mint site has them in scope, and an engine-generated
  *     artifact without them is not a real state.
  *   - `user` — developer-registered / hand-authored. Covers
@@ -30,21 +30,41 @@
  * cache (invalidation = regeneration, never data loss), so unlabeled
  * rows are dropped at the trust boundary, never coerced.
  */
+import { type ModelRef } from "./llm-route.js";
 /** Closed list of `BlueprintSource` discriminants. */
 export declare const BLUEPRINT_SOURCE_KINDS: readonly ["llm", "user", "curated"];
 /** Discriminant of {@link BlueprintSource}. */
 export type BlueprintSourceKind = (typeof BLUEPRINT_SOURCE_KINDS)[number];
+/**
+ * The de-modeled generator identity (ggui#924): `ui-gen-` + ONE tier token
+ * — `ui-gen-default`, `ui-gen-advanced`, or an operator-defined tier. No
+ * model segment: the model is its own field, so a model retirement never
+ * renames an identity or re-keys a stored record. The template admits any
+ * `ui-gen-*` at the type level; {@link isGeneratorId} is the grammar.
+ */
+export declare const GENERATOR_ID_PATTERN: RegExp;
+/** A generator identity — see {@link GENERATOR_ID_PATTERN}. */
+export type GeneratorId = `ui-gen-${string}`;
+/** Whether `value` is a generator identity: one tier token, no model segment. */
+export declare function isGeneratorId(value: string): value is GeneratorId;
 /** Engine-generated — full engine provenance is mandatory. */
 export interface LlmBlueprintSource {
     readonly kind: "llm";
     /**
-     * Slug of the generator that produced the component code (e.g.
-     * `'ui-gen-default-haiku-4-5'`). The server's `GeneratorRegistry` is
-     * the authority for which slugs exist on a given deployment.
+     * The generator identity that produced the component code (e.g.
+     * `'ui-gen-default'`), de-modeled — see {@link GENERATOR_ID_PATTERN}.
+     * The server's `GeneratorRegistry` is the authority for which
+     * identities exist on a given deployment.
+     */
+    readonly generator: GeneratorId;
+    /**
+     * The route the generator's LLM call used, rendered in the registry's
+     * spelling (`<prefix>/<model>`; {@link ModelRef}, composed only by
+     * `modelRefOfRoute`). Registry ids (`'anthropic/claude-haiku-4-5'`) are
+     * the subset the registry lists; a self-hoster's bedrock or OpenRouter
+     * route is a ref too. One spelling per route: a dated wire id is refused.
      */
-    readonly generator: string;
-    /** Model id of the LLM call the generator made. */
-    readonly model: string;
+    readonly model: ModelRef;
 }
 /** Developer-registered / hand-authored — no engine provenance exists. */
 export interface UserBlueprintSource {

package/dist/types/blueprint-source.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"blueprint-source.d.ts","sourceRoot":"","sources":["../../src/types/blueprint-source.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+BG;AAIH,sDAAsD;AACtD,eAAO,MAAM,sBAAsB,qCAAsC,CAAC;AAE1E,+CAA+C;AAC/C,MAAM,MAAM,mBAAmB,GAAG,CAAC,OAAO,sBAAsB,CAAC,CAAC,MAAM,CAAC,CAAC;AAE1E,8DAA8D;AAC9D,MAAM,WAAW,kBAAkB;IACjC,QAAQ,CAAC,IAAI,EAAE,KAAK,CAAC;IACrB;;;;OAIG;IACH,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,mDAAmD;IACnD,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;CACxB;AAED,0EAA0E;AAC1E,MAAM,WAAW,mBAAmB;IAClC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;CACvB;AAED,0EAA0E;AAC1E,MAAM,WAAW,sBAAsB;IACrC,QAAQ,CAAC,IAAI,EAAE,SAAS,CAAC;CAC1B;AAED,MAAM,MAAM,eAAe,GACvB,kBAAkB,GAClB,mBAAmB,GACnB,sBAAsB,CAAC;AAE3B;;;;;;;GAOG;AACH,wBAAgB,oBAAoB,CAAC,KAAK,EAAE,OAAO,GAAG,eAAe,GAAG,IAAI,CAoB3E;AAED,uDAAuD;AACvD,wBAAgB,iBAAiB,CAAC,KAAK,EAAE,OAAO,GAAG,KAAK,IAAI,eAAe,CAE1E;AAMD;;;;;;;;;;;;;;;;GAgBG;AACH,eAAO,MAAM,0BAA0B;;;;CAI7B,CAAC;AAEX;;;;;GAKG;AACH,MAAM,WAAW,mBAAmB;IAClC,QAAQ,CAAC,UAAU,EAAE,mBAAmB,CAAC;IACzC,QAAQ,CAAC,eAAe,CAAC,EAAE,MAAM,CAAC;IAClC,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAC;CAC/B;AAED,qEAAqE;AACrE,wBAAgB,qBAAqB,CACnC,MAAM,EAAE,eAAe,GACtB,mBAAmB,CAQrB;AAED;;;;;;;;;;;;;GAaG;AACH,wBAAgB,qBAAqB,CAAC,GAAG,EAAE;IACzC,QAAQ,CAAC,UAAU,CAAC,EAAE,OAAO,CAAC;IAC9B,QAAQ,CAAC,eAAe,CAAC,EAAE,OAAO,CAAC;IACnC,QAAQ,CAAC,WAAW,CAAC,EAAE,OAAO,CAAC;CAChC,GAAG,eAAe,GAAG,IAAI,CAMzB"}
+{"version":3,"file":"blueprint-source.d.ts","sourceRoot":"","sources":["../../src/types/blueprint-source.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+BG;AAGH,OAAO,EAAc,KAAK,QAAQ,EAAE,MAAM,aAAa,CAAC;AAExD,sDAAsD;AACtD,eAAO,MAAM,sBAAsB,qCAAsC,CAAC;AAE1E,+CAA+C;AAC/C,MAAM,MAAM,mBAAmB,GAAG,CAAC,OAAO,sBAAsB,CAAC,CAAC,MAAM,CAAC,CAAC;AAE1E;;;;;;GAMG;AACH,eAAO,MAAM,oBAAoB,QAAuB,CAAC;AAEzD,+DAA+D;AAC/D,MAAM,MAAM,WAAW,GAAG,UAAU,MAAM,EAAE,CAAC;AAE7C,iFAAiF;AACjF,wBAAgB,aAAa,CAAC,KAAK,EAAE,MAAM,GAAG,KAAK,IAAI,WAAW,CAEjE;AAED,8DAA8D;AAC9D,MAAM,WAAW,kBAAkB;IACjC,QAAQ,CAAC,IAAI,EAAE,KAAK,CAAC;IACrB;;;;;OAKG;IACH,QAAQ,CAAC,SAAS,EAAE,WAAW,CAAC;IAChC;;;;;;OAMG;IACH,QAAQ,CAAC,KAAK,EAAE,QAAQ,CAAC;CAC1B;AAED,0EAA0E;AAC1E,MAAM,WAAW,mBAAmB;IAClC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;CACvB;AAED,0EAA0E;AAC1E,MAAM,WAAW,sBAAsB;IACrC,QAAQ,CAAC,IAAI,EAAE,SAAS,CAAC;CAC1B;AAED,MAAM,MAAM,eAAe,GACvB,kBAAkB,GAClB,mBAAmB,GACnB,sBAAsB,CAAC;AAE3B;;;;;;;GAOG;AACH,wBAAgB,oBAAoB,CAAC,KAAK,EAAE,OAAO,GAAG,eAAe,GAAG,IAAI,CAuB3E;AAED,uDAAuD;AACvD,wBAAgB,iBAAiB,CAAC,KAAK,EAAE,OAAO,GAAG,KAAK,IAAI,eAAe,CAE1E;AAMD;;;;;;;;;;;;;;;;GAgBG;AACH,eAAO,MAAM,0BAA0B;;;;CAI7B,CAAC;AAEX;;;;;GAKG;AACH,MAAM,WAAW,mBAAmB;IAClC,QAAQ,CAAC,UAAU,EAAE,mBAAmB,CAAC;IACzC,QAAQ,CAAC,eAAe,CAAC,EAAE,MAAM,CAAC;IAClC,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAC;CAC/B;AAED,qEAAqE;AACrE,wBAAgB,qBAAqB,CACnC,MAAM,EAAE,eAAe,GACtB,mBAAmB,CAQrB;AAED;;;;;;;;;;;;;GAaG;AACH,wBAAgB,qBAAqB,CAAC,GAAG,EAAE;IACzC,QAAQ,CAAC,UAAU,CAAC,EAAE,OAAO,CAAC;IAC9B,QAAQ,CAAC,eAAe,CAAC,EAAE,OAAO,CAAC;IACnC,QAAQ,CAAC,WAAW,CAAC,EAAE,OAAO,CAAC;CAChC,GAAG,eAAe,GAAG,IAAI,CAMzB"}

package/dist/types/blueprint-source.js

@@ -11,7 +11,7 @@
  *
  *   - `llm` — engine-generated. `generator` is the slug of the
  *     {@link UiGenerator} that produced the component code; `model` is
- *     the LLM model id the engine called. Both REQUIRED: every
+ *     the route the engine called, as a `ModelRef`. Both REQUIRED: every
  *     generation mint site has them in scope, and an engine-generated
  *     artifact without them is not a real state.
  *   - `user` — developer-registered / hand-authored. Covers
@@ -31,8 +31,21 @@
  * rows are dropped at the trust boundary, never coerced.
  */
 import { isRecord } from "../validation/is-record.js";
+import { isModelRef } from "./llm-route.js";
 /** Closed list of `BlueprintSource` discriminants. */
 export const BLUEPRINT_SOURCE_KINDS = ["llm", "user", "curated"];
+/**
+ * The de-modeled generator identity (ggui#924): `ui-gen-` + ONE tier token
+ * — `ui-gen-default`, `ui-gen-advanced`, or an operator-defined tier. No
+ * model segment: the model is its own field, so a model retirement never
+ * renames an identity or re-keys a stored record. The template admits any
+ * `ui-gen-*` at the type level; {@link isGeneratorId} is the grammar.
+ */
+export const GENERATOR_ID_PATTERN = /^ui-gen-[a-z0-9]+$/;
+/** Whether `value` is a generator identity: one tier token, no model segment. */
+export function isGeneratorId(value) {
+    return GENERATOR_ID_PATTERN.test(value);
+}
 /**
  * Validating narrower for trust boundaries (DB row → union, JSON
  * artifact → union). Returns a CANONICAL rebuild of the union value —
@@ -50,9 +63,12 @@ export function parseBlueprintSource(value) {
         case "llm": {
             const generator = v["generator"];
             const model = v["model"];
-            if (typeof generator !== "string" || generator.length === 0)
+            // ggui#924: a modeled identity (`ui-gen-default-haiku-4-5`) or a
+            // non-route model (a bare `claude-…`, a dated API name) is not a
+            // provenance — null.
+            if (typeof generator !== "string" || !isGeneratorId(generator))
                 return null;
-            if (typeof model !== "string" || model.length === 0)
+            if (typeof model !== "string" || !isModelRef(model))
                 return null;
             return { kind: "llm", generator, model };
         }

package/dist/types/blueprint.d.ts

@@ -18,7 +18,7 @@
  *     advanced-generator iterative-loop output routinely exceeds
  *     them). The in-memory adapter skips the body store (in-process
  *     `Map<codeHash, string>`).
- *   - **Tenancy.** Scoped per `(appId, contractHash)`. Different apps'
+ *   - **App scope.** Scoped per `(appId, contractHash)`. Different apps'
  *     contract may coincidentally hash the same; their blueprints
  *     must never cross-pollinate. Rows are keyed by `blueprintId`;
  *     lookups go through an indexed `(appId, contractHash)` query.
@@ -127,7 +127,7 @@ export interface Blueprint {
      * key.
      */
     readonly contractHash: string;
-    /** Tenancy scope. Composite secondary key with `contractHash`. */
+    /** App scope. Composite secondary key with `contractHash`. */
     readonly appId: string;
     /**
      * S3 URL (`s3://<bucket>/<key>`) of the generated code body when

package/dist/types/blueprint.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"blueprint.d.ts","sourceRoot":"","sources":["../../src/types/blueprint.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgCG;AACH,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,uBAAuB,CAAC;AAC7D,OAAO,KAAK,EAAE,YAAY,EAAE,UAAU,EAAE,MAAM,oBAAoB,CAAC;AAEnE;;;;;;;;;;;;GAYG;AACH,MAAM,WAAW,sBAAsB;IACrC;;qDAEiD;IACjD,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,uEAAuE;IACvE,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB;0CACsC;IACtC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB;yCACqC;IACrC,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B;yCACqC;IACrC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;CACzB;AAED;;;;;;;;GAQG;AACH,MAAM,WAAW,wBAAwB;IACvC;8CAC0C;IAC1C,QAAQ,CAAC,OAAO,CAAC,EAAE,OAAO,CAAC,sBAAsB,CAAC,CAAC;IACnD;yCACqC;IACrC,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC;IAC5B,0DAA0D;IAC1D,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC;CACxB;AAED;;;;;;GAMG;AACH,MAAM,WAAW,iBAAiB;IAChC;;;OAGG;IACH,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC;IAC1B;;;;;;OAMG;IACH,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC;IAC5B;;;OAGG;IACH,QAAQ,CAAC,OAAO,CAAC,EAAE,UAAU,CAAC;IAC9B;;;OAGG;IACH,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAC;CAC9B;AAED;;;GAGG;AACH,MAAM,WAAW,SAAS;IACxB,mEAAmE;IACnE,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B;;;;OAIG;IACH,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;IAC9B,kEAAkE;IAClE,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB;;;;;;OAMG;IACH,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC;IAC5B;;;OAGG;IACH,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAC3B;;;;;;;;;;OAUG;IACH,QAAQ,CAAC,cAAc,CAAC,EAAE,MAAM,CAAC;IACjC;;;;;;;;;OASG;IACH,QAAQ,CAAC,MAAM,EAAE,eAAe,CAAC;IACjC;;;;OAIG;IACH,QAAQ,CAAC,cAAc,CAAC,EAAE,MAAM,CAAC;IACjC;;;OAGG;IACH,QAAQ,CAAC,QAAQ,EAAE,iBAAiB,CAAC;IACrC;;;;;;;;;OASG;IACH,QAAQ,CAAC,iBAAiB,CAAC,EAAE,IAAI,CAAC;IAClC,qDAAqD;IACrD,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B;;;;OAIG;IACH,QAAQ,CAAC,SAAS,EAAE,OAAO,GAAG,UAAU,CAAC;IACzC;;;;;OAKG;IACH,QAAQ,CAAC,QAAQ,EAAE,YAAY,CAAC;IAChC;;;;;;;;;;;;;;;;;OAiBG;IACH,QAAQ,CAAC,iBAAiB,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;CAChD"}
+{"version":3,"file":"blueprint.d.ts","sourceRoot":"","sources":["../../src/types/blueprint.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgCG;AACH,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,uBAAuB,CAAC;AAC7D,OAAO,KAAK,EAAE,YAAY,EAAE,UAAU,EAAE,MAAM,oBAAoB,CAAC;AAEnE;;;;;;;;;;;;GAYG;AACH,MAAM,WAAW,sBAAsB;IACrC;;qDAEiD;IACjD,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,uEAAuE;IACvE,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB;0CACsC;IACtC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB;yCACqC;IACrC,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B;yCACqC;IACrC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;CACzB;AAED;;;;;;;;GAQG;AACH,MAAM,WAAW,wBAAwB;IACvC;8CAC0C;IAC1C,QAAQ,CAAC,OAAO,CAAC,EAAE,OAAO,CAAC,sBAAsB,CAAC,CAAC;IACnD;yCACqC;IACrC,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC;IAC5B,0DAA0D;IAC1D,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC;CACxB;AAED;;;;;;GAMG;AACH,MAAM,WAAW,iBAAiB;IAChC;;;OAGG;IACH,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC;IAC1B;;;;;;OAMG;IACH,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC;IAC5B;;;OAGG;IACH,QAAQ,CAAC,OAAO,CAAC,EAAE,UAAU,CAAC;IAC9B;;;OAGG;IACH,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAC;CAC9B;AAED;;;GAGG;AACH,MAAM,WAAW,SAAS;IACxB,mEAAmE;IACnE,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B;;;;OAIG;IACH,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;IAC9B,8DAA8D;IAC9D,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB;;;;;;OAMG;IACH,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC;IAC5B;;;OAGG;IACH,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAC3B;;;;;;;;;;OAUG;IACH,QAAQ,CAAC,cAAc,CAAC,EAAE,MAAM,CAAC;IACjC;;;;;;;;;OASG;IACH,QAAQ,CAAC,MAAM,EAAE,eAAe,CAAC;IACjC;;;;OAIG;IACH,QAAQ,CAAC,cAAc,CAAC,EAAE,MAAM,CAAC;IACjC;;;OAGG;IACH,QAAQ,CAAC,QAAQ,EAAE,iBAAiB,CAAC;IACrC;;;;;;;;;OASG;IACH,QAAQ,CAAC,iBAAiB,CAAC,EAAE,IAAI,CAAC;IAClC,qDAAqD;IACrD,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B;;;;OAIG;IACH,QAAQ,CAAC,SAAS,EAAE,OAAO,GAAG,UAAU,CAAC;IACzC;;;;;OAKG;IACH,QAAQ,CAAC,QAAQ,EAAE,YAAY,CAAC;IAChC;;;;;;;;;;;;;;;;;OAiBG;IACH,QAAQ,CAAC,iBAAiB,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;CAChD"}

package/dist/types/data-contract.d.ts

@@ -188,7 +188,7 @@ export interface StreamChannelEntry {
      * `CTR_SCHEMA_INCOMPAT` linter additionally checks that the feed
      * tool's declared return schema is a subset of this schema — see
      * the docstring on {@link ActionEntry.schema} for the schema-subset
-     * algorithm and the `SCHEMA_MISMATCH_ERROR` failure surface.
+     * algorithm and the `schema_mismatch_error` failure surface.
      */
     schema: JsonSchema;
     /** Example payload (used for documentation and smoke testing). Typed as {@link JsonValue}. */
@@ -276,7 +276,7 @@ export interface ActionEntry {
      * advisory — the agent owns the actual tool call on its next turn
      * and is responsible for shaping the payload as the tool expects.
      * For tools registered on THIS server, the F4 schema-compat checker
-     * surfaces a `SCHEMA_MISMATCH_ERROR` at render-time / blueprint-
+     * surfaces a `schema_mismatch_error` at render-time / blueprint-
      * registration-time so authors get fail-loud feedback.
      *
      * The canonical algorithm lives in
@@ -610,7 +610,7 @@ export interface GadgetDescriptor {
     package: string;
     /**
      * ggui-hosted bundle URL — the preferred distribution path. Same
-     * origin as the iframe in single-tenant OSS deployments (served
+     * origin as the iframe in single-deployment installs (served
      * from `/_ggui/libs/<libId>/bundle.js`) and the ggui marketplace
      * CDN in cloud deployments. CSP `script-src` allowlists only the
      * ggui origin — no per-plugin third-party origins.