@ggui-ai/protocol 0.16.0 → 0.18.0

package/dist/schemas/app-theme.js

@@ -102,6 +102,64 @@ const keyframesText = z
     .string()
     .max(8192)
     .refine(isKeyframesText, 'keyframes must be `@keyframes <name> { … }` blocks and nothing else');
+/**
+ * https-only asset URL with a well-formed host — the theme document's rule
+ * for a declared face (ggui#987 §5), now the wire's rule for every asset an
+ * AppTheme names. Grammar only: nothing here is fetched.
+ */
+function isHttpsAssetUrl(src) {
+    let url;
+    try {
+        url = new URL(src);
+    }
+    catch {
+        return false;
+    }
+    return url.protocol === 'https:' && /^[a-z0-9.-]+$/i.test(url.hostname) && url.hostname.includes('.');
+}
+const httpsAssetUrl = z.string().min(1).refine(isHttpsAssetUrl, 'src must be an https: URL with a well-formed host');
+/**
+ * One declared font face (ggui#987 §5; lifted here for ggui#1093 / #990 so the
+ * theme DOCUMENT's `typography.faces` and the AppTheme WIRE's `fonts` share
+ * ONE grammar — `@ggui-ai/project-config` imports this schema for the
+ * document door). `src` MUST be `https:` with a well-formed host; the face is
+ * DECLARED, never fetched by any door: the render host unions the origin into
+ * its `font-src`, the shell renders the `@font-face` rule, and a face that
+ * fails to load in the browser falls back down the family's stack.
+ */
+export const fontFaceDeclarationSchema = z.strictObject({
+    family: z.string().min(1).refine((f) => !/[\r\n]/.test(f), 'family must be one line'),
+    src: httpsAssetUrl,
+    weight: z.union([z.string().min(1), z.number().int().min(1).max(1000)]).optional(),
+    style: z.string().min(1).optional(),
+    display: z.string().min(1).optional(),
+});
+/** The most faces one theme may declare on the wire — a CSP and a `<style>` block stay bounded. */
+export const APP_THEME_FONTS_MAX = 16;
+/** The imagery slots a theme may fill (ggui#1093): a brand mark, a hero image, a repeating pattern. */
+export const APP_THEME_IMAGERY_KINDS = ['mark', 'hero', 'pattern'];
+/**
+ * One image asset: https-only `src` (never fetched by a door), an optional
+ * `alt` (≤ 200) and an optional `tone` — the image's own tonality (`light` /
+ * `dark`), so a composer can place ink over it without sampling pixels.
+ */
+export const appThemeImageAssetSchema = z.strictObject({
+    src: httpsAssetUrl,
+    alt: z.string().max(200).optional(),
+    tone: z.enum(['light', 'dark']).optional(),
+});
+/**
+ * The host's imagery, by slot (ggui#1093, #1075 Track C (a)). Parties: a
+ * WRITER (an operator's design tooling, or a harvest of the host page) declares; the WRITE door
+ * validates this grammar and nothing more; the render host unions every
+ * `src` origin into its `img-src`; the composer reads the slots through
+ * the design primitives. Absent ⇒ no imagery, today's card.
+ */
+export const appThemeImagerySchema = z.strictObject({
+    mark: appThemeImageAssetSchema.optional(),
+    hero: appThemeImageAssetSchema.optional(),
+    pattern: appThemeImageAssetSchema.optional(),
+});
 export const appThemeSchema = z
     .object({
     /**
@@ -140,17 +198,178 @@ export const appThemeSchema = z
      * root-children border-suppression rule.
      */
     frameless: z.boolean().optional(),
+    /**
+     * Declared font faces (ggui#1093 / #990 — the hosted carrier for the
+     * document's `typography.faces`): 1..{@link APP_THEME_FONTS_MAX} faces,
+     * each {@link fontFaceDeclarationSchema}. OUTSIDE the attestation:
+     * `overlayHash` covers `{ overlays, cssVariables, keyframes }` only
+     * (`integrations/overlay-hash.ts`, `OverlayHashInput`) — a face is a
+     * declared asset, not a derived projection. A reader on a release that
+     * does not name this member strips it at its read door and paints the
+     * colours without the faces (`appThemeReadSchema`, VERSION-POLICY §3.6).
+     */
+    fonts: z.array(fontFaceDeclarationSchema).min(1).max(APP_THEME_FONTS_MAX).optional(),
+    /** The host's imagery by slot — {@link appThemeImagerySchema}; outside the attestation, same as `fonts`. */
+    imagery: appThemeImagerySchema.optional(),
 })
     .strict();
+/**
+ * The READ-door posture (ggui#1093 belt, 2026-09-15; VERSION-POLICY §3.6).
+ *
+ * `appThemeSchema` is the WRITE door: strict, an unknown top-level member is
+ * refused (`invalid_app_config`). A READ door — a stored row turned into
+ * paint, a carried `_meta["ai.ggui/render"].theme` slice — parses with THIS
+ * schema instead: an unknown TOP-LEVEL member is stripped, the overlays are
+ * kept, and the caller reports what it stripped (one line per read, keys
+ * only, never theme content). Everything below the top level is unchanged —
+ * nested objects stay strict, token grammar and value safety still refuse,
+ * the v1 shape still refuses — and the attestation is untouched because
+ * `overlayHash` covers `{ overlays, cssVariables, keyframes }` only.
+ *
+ * Why: a reader on release N−1 meeting a member release N added would
+ * otherwise drop the WHOLE theme — colours and all — until it rolled
+ * (guuey#1266's class). Parties: every read door of an `AppTheme` MUST use
+ * this variant (or {@link parseAppThemeAtReadDoor}); every write door MUST
+ * stay on `appThemeSchema`. Observable violation: a read door dropping a
+ * theme whose overlays are valid because of an unknown top-level member —
+ * the kit's `n1-compat` forward case grades it.
+ */
+export const appThemeReadSchema = z.object(appThemeSchema.shape);
+/**
+ * Parse a stored or carried theme at a READ door: `ok` with the theme and
+ * the top-level members that were stripped (payload order, `[]` when none),
+ * or the issues in `path: message` form when the theme is refused for a
+ * reason the write door would also refuse.
+ *
+ * TWO READ PATHS, OPPOSITE OBLIGATIONS — they sit next to each other and
+ * they are NOT the same door (ggui#1124; do not "tidy" them into one):
+ *
+ *   **a read whose purpose is to INTERPRET state strips unknown members
+ *   and names what it stripped; a read whose purpose is to REPRODUCE
+ *   state must not strip at all.**
+ *
+ * This function is the INTERPRET side — a server painting a theme, an
+ * operator surface rendering one — and a reader must not be handed data it
+ * cannot validate.
+ * The REPRODUCE side is a writer's CARRY path, which receives the stored
+ * document VERBATIM, including members this release does not name: its job
+ * is fidelity, not interpretation. Applying THIS strip to a carry path is
+ * the ggui#1124 defect exactly — the writer carries a stripped document,
+ * writes it back, and destroys the members the belt exists to protect.
+ */
+export function parseAppThemeAtReadDoor(input) {
+    const r = appThemeReadSchema.safeParse(input);
+    if (!r.success) {
+        return { ok: false, issues: r.error.issues.map((i) => `${i.path.join('.')}: ${i.message}`) };
+    }
+    const known = new Set(Object.keys(appThemeSchema.shape));
+    const stripped = typeof input === 'object' && input !== null && !Array.isArray(input)
+        ? Object.keys(input).filter((k) => !known.has(k))
+        : [];
+    return { ok: true, theme: r.data, stripped };
+}
 /**
  * The ONE refusal body every write door returns for an overlay it will not
  * store (ggui#987 §3.4): REST 422 `invalid_app_config`, the AppSync
  * `errorInfo`, the MCP ops door's `{ ok: false }` structured content. A
  * discriminated union by key — exactly one of the four.
  */
+/**
+ * The top-level members the STORED theme holds that an incoming write does
+ * not carry — i.e. exactly what the write would destroy (ggui#1124).
+ *
+ * `putAppTheme` REPLACES the whole `theme` attribute (the shared writer's
+ * `SET theme = :theme`), so a writer that composes fewer members than the
+ * stored document silently deletes the rest. On 2026-09-10, 26 rows lost
+ * their theme outright and ~20 more lost members nobody can now name,
+ * because a writer believed the door merged. **The rule lives here because
+ * what makes a write destructive is a fact about the wire shape, not about
+ * a storage engine** — the shared writer enforces it at the choke point, so
+ * safety does not depend on each door remembering.
+ *
+ * Deliberately total and deliberately dumb: it compares TOP-LEVEL keys and
+ * nothing else. A changed VALUE is not a drop. An explicit `undefined` IS a
+ * drop, because absent and undefined are the same wire fact. A member this
+ * release does not name still counts — that is the whole point, since a
+ * strict schema cannot see the member a later release wrote, and a
+ * whole-column write is exactly what destroys it. Given anything that is not
+ * a plain object on either side it reports nothing rather than inventing a
+ * drop: a guard that guesses is worse than one that abstains.
+ *
+ * Parties: the SHARED WRITER calls this before writing and refuses a
+ * non-empty result with {@link appThemeRefusalBodySchema}'s `wouldDrop` arm,
+ * naming the members; the WRITER retries carrying them (read the stored
+ * document, carry what it does not own by REST OMISSION — never by
+ * enumerating what it knows — and hash after the carry). Observable
+ * violation: a stored member absent after a write that did not name it.
+ */
+export function appThemeDroppedMembers(stored, incoming) {
+    if (!isPlainObject(stored) || !isPlainObject(incoming))
+        return [];
+    return Object.keys(stored).filter((key) => incoming[key] === undefined);
+}
+function isPlainObject(value) {
+    return typeof value === 'object' && value !== null && !Array.isArray(value);
+}
+/**
+ * The ONE wording for a `wouldDrop` refusal (ggui#1124, founder's ruling
+ * 2026-09-16: *"the refusal names the clear-then-set path"*). Exported so
+ * every door that refuses a destructive theme write carries the SAME words
+ * rather than paraphrasing them — a writer meeting two different
+ * explanations of one rule learns neither.
+ *
+ * Why the wording is part of the contract and not decoration: **a refusal
+ * with no compliance path converts "we protected your data" into "we broke
+ * your write", and the writer cannot tell which happened to them.** Naming
+ * the path collapses that ambiguity — it turns the refusal from a VERDICT
+ * into an INSTRUCTION. So the text MUST do three things, and the tests pin
+ * each: name the members that would have been dropped (so a writer can see
+ * whether they meant it), give the carry path for a writer who did not, and
+ * give the clear-then-set path for a writer who did — stating plainly that
+ * the app has no theme between those two writes, because that is the kind
+ * of fact a caller must not discover in production.
+ *
+ * The CLEAR half names an OUTCOME, not a mechanism, and that is deliberate
+ * (ggui#1124, from cloud's per-door measurement): `theme: null` clears on
+ * exactly ONE of the four doors that write a theme — the provisioning theme
+ * door. On the other three a writer following a universal `theme: null`
+ * instruction gets a SECOND refusal, which is the verdict-without-a-path
+ * this ruling exists to prevent, reintroduced by the text meant to prevent
+ * it. The CARRY half needs no such hedge: it is implementable on every
+ * door, which is why it is stated first and unconditionally.
+ *
+ * The better end state is uniform — `theme: null` clearing at the shared
+ * writer so all four doors honour one mechanism — but that is a change to
+ * three doors' semantics and belongs to its own decision with cloud, not to
+ * a wording fix.
+ *
+ * Throws on an empty list: a refusal that names nothing is not an
+ * instruction.
+ */
+export function appThemeWouldDropRefusalText(wouldDrop) {
+    if (wouldDrop.length === 0) {
+        throw new Error('appThemeWouldDropRefusalText: a refusal must name at least one dropped member');
+    }
+    const members = wouldDrop.join(', ');
+    return (`this write would drop stored theme members it does not carry — [${members}]. ` +
+        `If you did not mean to drop them: read the stored theme and carry every member this write does not own, ` +
+        `then recompute the attestation over the result. ` +
+        `If you DID mean to drop them: CLEAR the stored theme first, then write the theme you want — ` +
+        `the app has NO theme between those two writes. How you clear DEPENDS ON THE DOOR: the provisioning ` +
+        `theme door clears on \`theme: null\`; other doors differ, so use the clear operation of the door you ` +
+        `are calling rather than assuming this one.`);
+}
 export const appThemeRefusalBodySchema = z.union([
     z.object({ uncovered: z.object({ light: z.array(z.string()), dark: z.array(z.string()) }).strict() }).strict(),
     z.object({ unknown: z.object({ light: z.array(z.string()), dark: z.array(z.string()) }).strict() }).strict(),
     z.object({ overlayHash: z.literal('mismatch') }).strict(),
     z.object({ refused: z.literal('v1 shape') }).strict(),
+    /**
+     * The write would have DESTROYED stored members it did not carry
+     * (ggui#1124) — the refusal names them so the writer can carry them on
+     * the retry. A refusal that named nothing would be an error message
+     * instead of a teaching one, which is why the list may not be empty:
+     * naming the members is how the console got fixed.
+     */
+    z.object({ wouldDrop: z.array(z.string().min(1)).min(1) }).strict(),
 ]);

package/dist/schemas/data-contract.d.ts

@@ -107,6 +107,7 @@ export declare const actionEntrySchema: z.ZodObject<{
     example: z.ZodOptional<z.ZodType<JsonValue, unknown, z.core.$ZodTypeInternals<JsonValue, unknown>>>;
     icon: z.ZodOptional<z.ZodString>;
     confirm: z.ZodOptional<z.ZodBoolean>;
+    oneShot: z.ZodOptional<z.ZodBoolean>;
     nextStep: z.ZodOptional<z.ZodString>;
 }, z.core.$strict>;
 /** {@link ActionSpec} — flat `Record<name, ActionEntry>`. */
@@ -117,6 +118,7 @@ export declare const actionSpecSchema: z.ZodRecord<z.ZodString, z.ZodObject<{
     example: z.ZodOptional<z.ZodType<JsonValue, unknown, z.core.$ZodTypeInternals<JsonValue, unknown>>>;
     icon: z.ZodOptional<z.ZodString>;
     confirm: z.ZodOptional<z.ZodBoolean>;
+    oneShot: z.ZodOptional<z.ZodBoolean>;
     nextStep: z.ZodOptional<z.ZodString>;
 }, z.core.$strict>>;
 /** {@link StreamChannelEntry} — per-channel metadata in a {@link StreamSpec}. */
@@ -789,5 +791,49 @@ export declare const DATA_CONTRACT_MINIMAL_EXAMPLE: {
         };
     };
 };
+/**
+ * The contract READ-door result (ggui#1115): the contract as this release
+ * can read it, plus the entry members it had to strip to get there.
+ */
+export type DataContractReadDoorResult = {
+    readonly ok: true;
+    readonly contract: DataContract;
+    readonly stripped: readonly string[];
+} | {
+    readonly ok: false;
+    readonly issues: readonly string[];
+};
+/**
+ * Parse a STORED contract at a READ door (ggui#1115).
+ *
+ * `dataContractSchema`'s outer object is `.passthrough()`, so a whole new
+ * top-level spec was never the hazard — but its ENTRY schemas are
+ * `.strict()`, and contracts are STORED (blueprint rows, artifact
+ * manifests). So a release that adds a member to an action / prop / stream /
+ * context / tool ENTRY makes every older reader fail the parse, and a reader
+ * that turns a failed parse into "no candidate" drops the row from the match
+ * set: the generator runs again, a different card is produced, and nothing
+ * anywhere says a stored blueprint was skipped. A silent cache miss, not a
+ * failure — which is why this door exists and why it NAMES what it stripped.
+ *
+ * WRITE doors keep entry strictness and MUST: it is what catches a typo in a
+ * generated contract before it is stored, and relaxing it globally would
+ * trade a silent cache miss for silently stored garbage. The asymmetry is by
+ * DOOR, exactly as for `AppTheme` (`schemas/app-theme.ts`, VERSION-POLICY
+ * §3.6): this is the INTERPRET side, so it strips and reports; a read whose
+ * purpose is to REPRODUCE state (a writer's carry path) must not strip at
+ * all.
+ *
+ * Everything the write door refuses is still refused — a missing required
+ * field, a wrong type, a malformed spec. Only members this release does not
+ * NAME are stripped, never members it finds INVALID.
+ *
+ * NOT COVERED, deliberately and named rather than discovered: the gadget
+ * family under `clientCapabilities`. Its descriptors are validated per row
+ * with their own salvage posture (`strictGadgetDescriptorSchema`), evolve on
+ * their own surface, and folding them in here would put two different
+ * evolution stories behind one door.
+ */
+export declare function parseDataContractAtReadDoor(input: unknown): DataContractReadDoorResult;
 export declare const dataContractSchema: z.ZodType<DataContract>;
 //# sourceMappingURL=data-contract.d.ts.map

package/dist/schemas/data-contract.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"data-contract.d.ts","sourceRoot":"","sources":["../../src/schemas/data-contract.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAmDG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAMxB,OAAO,KAAK,EACV,YAAY,EACZ,SAAS,EACT,UAAU,EACV,UAAU,EACX,MAAM,wBAAwB,CAAC;AAEhC;;;;GAIG;AACH,eAAO,MAAM,eAAe,EAAE,CAAC,CAAC,OAAO,CAAC,SAAS,CAYhD,CAAC;AAEF,0EAA0E;AAC1E,eAAO,MAAM,gBAAgB,EAAE,CAAC,CAAC,OAAO,CAAC,UAAU,CAAyC,CAAC;AAmB7F,eAAO,MAAM,gBAAgB,EAAE,CAAC,CAAC,OAAO,CAAC,UAAU,CA2BlD,CAAC;AAEF;;;;;;;GAOG;AACH,eAAO,MAAM,eAAe;;;;;;;kBASjB,CAAC;AAEZ,sFAAsF;AACtF,eAAO,MAAM,eAAe;;;;;;;;;;kBAKjB,CAAC;AAEZ;;;;;;;;;;GAUG;AACH,eAAO,MAAM,iBAAiB;;;;;;;;kBAUnB,CAAC;AAEZ,6DAA6D;AAC7D,eAAO,MAAM,gBAAgB;;;;;;;;mBAA0C,CAAC;AAExE,iFAAiF;AACjF,eAAO,MAAM,wBAAwB;;;;;;;;;;;;;;;;;;kBAgB1B,CAAC;AAEZ,uEAAuE;AACvE,eAAO,MAAM,gBAAgB;;;;;;;;;;;;;;;;;;mBAAiD,CAAC;AAE/E,yEAAyE;AACzE,eAAO,MAAM,kBAAkB;;;;;;kBAQpB,CAAC;AAEZ,+DAA+D;AAC/D,eAAO,MAAM,iBAAiB;;;;;;mBAA2C,CAAC;AAE1E,sFAAsF;AACtF,eAAO,MAAM,oBAAoB;;;;;;;;;;;;;;;kBAiBtB,CAAC;AAEZ,qEAAqE;AACrE,eAAO,MAAM,2BAA2B;;;;;;;;;;;;;;;;;iBAIxB,CAAC;AAGjB;;;;;;;;;;;;GAYG;AACH,eAAO,MAAM,oBAAoB,yBAAmD,CAAC;AAErF;;;;;;;;;;;;;;;;GAgBG;AACH,eAAO,MAAM,aAAa,QAA8B,CAAC;AAEzD;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,eAAO,MAAM,mBAAmB,QACsB,CAAC;AAEvD;;;;;;;;;;;;;;GAcG;AACH,eAAO,MAAM,aAAa,QAAyC,CAAC;AAEpE;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,eAAO,MAAM,cAAc,QAAyB,CAAC;AAErD;;;;;;GAMG;AACH,eAAO,MAAM,mBAAmB,qBAAqB,CAAC;AAEtD;;;;;;;;;;;;;;;;;GAiBG;AACH,eAAO,MAAM,gBAAgB,QAAiD,CAAC;AAE/E;;;;;;GAMG;AACH,wBAAgB,gBAAgB,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,GAAG,OAAO,CAE/D;AAED;;;;;;;;GAQG;AACH,OAAO,EAAE,YAAY,EAAE,iBAAiB,EAAE,MAAM,uBAAuB,CAAC;AAwExE;;;;;;;;GAQG;AACH,eAAO,MAAM,kBAAkB;;;;;;;;;;;;;;oBAa7B,CAAC;AAEH;;;;GAIG;AACH,eAAO,MAAM,wBAAwB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;oBAanC,CAAC;AAEH;;;;;;GAMG;AACH,eAAO,MAAM,sBAAsB;;;;;;;;;;;;;;;;;;;;;;;;;;kBAKxB,CAAC;AAEZ;;;;;;;;;;;;;GAaG;AACH,eAAO,MAAM,4BAA4B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;kBAK9B,CAAC;AAEZ;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AACH,eAAO,MAAM,gCAAgC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;kBAU1C,CAAC;AAQJ;;;;;;;;;;;;;;;;;GAiBG;AACH,eAAO,MAAM,qBAAqB;;;kBAKvB,CAAC;AAEZ;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,sBAAsB;;;mBAa/B,CAAC;AAEL;;;;;;;;;;;;;;;GAeG;AACH,eAAO,MAAM,4BAA4B;;;;;kBAO9B,CAAC;AAEZ;;;;;;;;;;;;GAYG;AACH,eAAO,MAAM,kBAAkB,uCAAgE,CAAC;AAEhG;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AACH;;;;;;;GAOG;AACH,eAAO,MAAM,wBAAwB,QAQa,CAAC;AAEnD;;;;;GAKG;AACH,eAAO,MAAM,6BAA6B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAehC,CAAC;AAEX,eAAO,MAAM,kBAAkB,EAAE,CAAC,CAAC,OAAO,CAAC,YAAY,CAiCZ,CAAC"}
+{"version":3,"file":"data-contract.d.ts","sourceRoot":"","sources":["../../src/schemas/data-contract.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAmDG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAMxB,OAAO,KAAK,EACV,YAAY,EACZ,SAAS,EACT,UAAU,EACV,UAAU,EACX,MAAM,wBAAwB,CAAC;AAEhC;;;;GAIG;AACH,eAAO,MAAM,eAAe,EAAE,CAAC,CAAC,OAAO,CAAC,SAAS,CAYhD,CAAC;AAEF,0EAA0E;AAC1E,eAAO,MAAM,gBAAgB,EAAE,CAAC,CAAC,OAAO,CAAC,UAAU,CAAyC,CAAC;AAmB7F,eAAO,MAAM,gBAAgB,EAAE,CAAC,CAAC,OAAO,CAAC,UAAU,CA2BlD,CAAC;AAEF;;;;;;;GAOG;AACH,eAAO,MAAM,eAAe;;;;;;;kBASjB,CAAC;AAEZ,sFAAsF;AACtF,eAAO,MAAM,eAAe;;;;;;;;;;kBAKjB,CAAC;AAEZ;;;;;;;;;;GAUG;AACH,eAAO,MAAM,iBAAiB;;;;;;;;;kBAwEnB,CAAC;AAEZ,6DAA6D;AAC7D,eAAO,MAAM,gBAAgB;;;;;;;;;mBAA0C,CAAC;AAExE,iFAAiF;AACjF,eAAO,MAAM,wBAAwB;;;;;;;;;;;;;;;;;;kBAgB1B,CAAC;AAEZ,uEAAuE;AACvE,eAAO,MAAM,gBAAgB;;;;;;;;;;;;;;;;;;mBAAiD,CAAC;AAE/E,yEAAyE;AACzE,eAAO,MAAM,kBAAkB;;;;;;kBAQpB,CAAC;AAEZ,+DAA+D;AAC/D,eAAO,MAAM,iBAAiB;;;;;;mBAA2C,CAAC;AAE1E,sFAAsF;AACtF,eAAO,MAAM,oBAAoB;;;;;;;;;;;;;;;kBAiBtB,CAAC;AAEZ,qEAAqE;AACrE,eAAO,MAAM,2BAA2B;;;;;;;;;;;;;;;;;iBAIxB,CAAC;AAGjB;;;;;;;;;;;;GAYG;AACH,eAAO,MAAM,oBAAoB,yBAAmD,CAAC;AAErF;;;;;;;;;;;;;;;;GAgBG;AACH,eAAO,MAAM,aAAa,QAA8B,CAAC;AAEzD;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,eAAO,MAAM,mBAAmB,QACsB,CAAC;AAEvD;;;;;;;;;;;;;;GAcG;AACH,eAAO,MAAM,aAAa,QAAyC,CAAC;AAEpE;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,eAAO,MAAM,cAAc,QAAyB,CAAC;AAErD;;;;;;GAMG;AACH,eAAO,MAAM,mBAAmB,qBAAqB,CAAC;AAEtD;;;;;;;;;;;;;;;;;GAiBG;AACH,eAAO,MAAM,gBAAgB,QAAiD,CAAC;AAE/E;;;;;;GAMG;AACH,wBAAgB,gBAAgB,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,GAAG,OAAO,CAE/D;AAED;;;;;;;;GAQG;AACH,OAAO,EAAE,YAAY,EAAE,iBAAiB,EAAE,MAAM,uBAAuB,CAAC;AAwExE;;;;;;;;GAQG;AACH,eAAO,MAAM,kBAAkB;;;;;;;;;;;;;;oBAa7B,CAAC;AAEH;;;;GAIG;AACH,eAAO,MAAM,wBAAwB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;oBAanC,CAAC;AAEH;;;;;;GAMG;AACH,eAAO,MAAM,sBAAsB;;;;;;;;;;;;;;;;;;;;;;;;;;kBAKxB,CAAC;AAEZ;;;;;;;;;;;;;GAaG;AACH,eAAO,MAAM,4BAA4B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;kBAK9B,CAAC;AAEZ;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AACH,eAAO,MAAM,gCAAgC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;kBAU1C,CAAC;AAQJ;;;;;;;;;;;;;;;;;GAiBG;AACH,eAAO,MAAM,qBAAqB;;;kBAKvB,CAAC;AAEZ;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,sBAAsB;;;mBAa/B,CAAC;AAEL;;;;;;;;;;;;;;;GAeG;AACH,eAAO,MAAM,4BAA4B;;;;;kBAO9B,CAAC;AAEZ;;;;;;;;;;;;GAYG;AACH,eAAO,MAAM,kBAAkB,uCAAgE,CAAC;AAEhG;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AACH;;;;;;;GAOG;AACH,eAAO,MAAM,wBAAwB,QAQa,CAAC;AAEnD;;;;;GAKG;AACH,eAAO,MAAM,6BAA6B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAehC,CAAC;AAEX;;;GAGG;AACH,MAAM,MAAM,0BAA0B,GAClC;IAAE,QAAQ,CAAC,EAAE,EAAE,IAAI,CAAC;IAAC,QAAQ,CAAC,QAAQ,EAAE,YAAY,CAAC;IAAC,QAAQ,CAAC,QAAQ,EAAE,SAAS,MAAM,EAAE,CAAA;CAAE,GAC5F;IAAE,QAAQ,CAAC,EAAE,EAAE,KAAK,CAAC;IAAC,QAAQ,CAAC,MAAM,EAAE,SAAS,MAAM,EAAE,CAAA;CAAE,CAAC;AA2C/D;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8BG;AACH,wBAAgB,2BAA2B,CAAC,KAAK,EAAE,OAAO,GAAG,0BAA0B,CAmEtF;AAED,eAAO,MAAM,kBAAkB,EAAE,CAAC,CAAC,OAAO,CAAC,YAAY,CAiCZ,CAAC"}

package/dist/schemas/data-contract.js

@@ -158,7 +158,69 @@ export const actionEntrySchema = z
     schema: jsonSchemaSchema.optional(),
     example: jsonValueSchema.optional(),
     icon: z.string().optional(),
+    /**
+     * The author marks this action GRAVE (ggui#1112).
+     *
+     * ADVISORY, and honoured by exactly one party: `@ggui-ai/ui-gen`'s
+     * contract context renders it to the composing model as INFORMATION —
+     * *"the author marked this action grave enough to confirm before it
+     * fires"* — alongside `label`, `description`, `example` and `nextStep`.
+     * The model decides what to do with it. That is the same standing
+     * `nextStep` has: a declared field with a named consumer and no
+     * mechanical enforcer, which is legitimate as long as it says so.
+     *
+     * DO NOT promote it to a rule without re-measuring. Citing `confirm` in
+     * the generator's terminal-actions section MEASURED ZERO — two wordings,
+     * n = 4 each, a `save` action carrying `confirm: true` came back armed
+     * 0/4 and 0/4 (rnd, ggui#1108 narrowing). The finding that explains it:
+     * the field says GRAVITY, not at-most-once, and the model reads it that
+     * way. `confirm` asks BEFORE firing; {@link ActionEntry.oneShot} bounds
+     * HOW OFTEN it may fire. Siblings in intent, different questions, and an
+     * action may declare either, both or neither.
+     *
+     * Emitted today by the shipped system blueprints on destructive ops
+     * (`ggui_ops_revoke_connector_key`), so it is a live author signal and
+     * not a vestigial field.
+     *
+     * Observable violation: a contract declaring `confirm: true` whose
+     * rendered contract context omits the flag — pinned in ui-gen's
+     * `design-mode.pin.test.ts`.
+     */
     confirm: z.boolean().optional(),
+    /**
+     * This action may fire AT MOST ONCE per render (ggui#1108).
+     *
+     * DECLARED, never inferred — that is the whole design. The runtime
+     * cannot infer terminality; the server cannot tell a double-fire from a
+     * legitimate second "add item"; and the component cannot GUARANTEE it,
+     * because whether a generated control disables itself is decided afresh
+     * by a model on every generation. Only the contract's author knows, so
+     * the contract is where it is said.
+     *
+     * Obligations: the RUNTIME suppresses a second dispatch of a declared
+     * one-shot action for the render's lifetime; the RELAY never collapses
+     * distinct `actionId`s — two gestures are two facts and the relay stays
+     * honest about them; the AGENT treats `actionId` as an idempotency key
+     * for EVERY action, which buys at-most-once per DISPATCH (a replay, a
+     * re-delivered buffer) and explicitly NOT per intent, since a second
+     * gesture mints a new `actionId`.
+     *
+     * THE WINDOW, stated because "the render's lifetime" is ambiguous
+     * otherwise: a fresh `ggui_render` RE-ARMS the action; a `ggui_update`
+     * or props amend of the SAME render does NOT. So an agent re-sending
+     * props after a submit ("confirmed, here is your receipt") cannot
+     * silently re-arm a terminal action. A flow that legitimately
+     * re-submits either does not declare the action one-shot, or renders a
+     * new card — the declarer's choice, which is the point of declaring.
+     *
+     * Sibling, not a pair: `confirm` asks BEFORE firing; `oneShot` bounds
+     * how often it may fire. An action may be either, both or neither.
+     *
+     * Failure mode: a duplicated side effect — a confirm card that writes
+     * twice. Observable violation: two consume entries with distinct
+     * `actionId`s for the same declared one-shot action inside one render.
+     */
+    oneShot: z.boolean().optional(),
     nextStep: z.string().min(1).optional(),
 })
     .strict();
@@ -687,6 +749,106 @@ export const DATA_CONTRACT_MINIMAL_EXAMPLE = {
         filter: { schema: { type: 'string' }, default: 'all' },
     },
 };
+function isEntryObject(value) {
+    return typeof value === 'object' && value !== null && !Array.isArray(value);
+}
+/**
+ * Strip the keys of one ENTRY that this release does not name, recording the
+ * path of each. Returns the entry unchanged when there is nothing to strip,
+ * so an untouched contract keeps object identity where it can.
+ */
+function stripEntry(entry, known, path, stripped) {
+    if (!isEntryObject(entry))
+        return entry;
+    const extra = Object.keys(entry).filter((k) => !known.has(k));
+    if (extra.length === 0)
+        return entry;
+    const out = {};
+    for (const [k, v] of Object.entries(entry)) {
+        if (known.has(k))
+            out[k] = v;
+        else
+            stripped.push(`${path}.${k}`);
+    }
+    return out;
+}
+/** Strip every entry of a `Record<name, Entry>` map. */
+function stripEntryMap(map, known, path, stripped) {
+    if (!isEntryObject(map))
+        return map;
+    const out = {};
+    for (const [name, entry] of Object.entries(map)) {
+        out[name] = stripEntry(entry, known, `${path}.${name}`, stripped);
+    }
+    return out;
+}
+/**
+ * Parse a STORED contract at a READ door (ggui#1115).
+ *
+ * `dataContractSchema`'s outer object is `.passthrough()`, so a whole new
+ * top-level spec was never the hazard — but its ENTRY schemas are
+ * `.strict()`, and contracts are STORED (blueprint rows, artifact
+ * manifests). So a release that adds a member to an action / prop / stream /
+ * context / tool ENTRY makes every older reader fail the parse, and a reader
+ * that turns a failed parse into "no candidate" drops the row from the match
+ * set: the generator runs again, a different card is produced, and nothing
+ * anywhere says a stored blueprint was skipped. A silent cache miss, not a
+ * failure — which is why this door exists and why it NAMES what it stripped.
+ *
+ * WRITE doors keep entry strictness and MUST: it is what catches a typo in a
+ * generated contract before it is stored, and relaxing it globally would
+ * trade a silent cache miss for silently stored garbage. The asymmetry is by
+ * DOOR, exactly as for `AppTheme` (`schemas/app-theme.ts`, VERSION-POLICY
+ * §3.6): this is the INTERPRET side, so it strips and reports; a read whose
+ * purpose is to REPRODUCE state (a writer's carry path) must not strip at
+ * all.
+ *
+ * Everything the write door refuses is still refused — a missing required
+ * field, a wrong type, a malformed spec. Only members this release does not
+ * NAME are stripped, never members it finds INVALID.
+ *
+ * NOT COVERED, deliberately and named rather than discovered: the gadget
+ * family under `clientCapabilities`. Its descriptors are validated per row
+ * with their own salvage posture (`strictGadgetDescriptorSchema`), evolve on
+ * their own surface, and folding them in here would put two different
+ * evolution stories behind one door.
+ */
+export function parseDataContractAtReadDoor(input) {
+    const issuesOf = (error) => error.issues.map((i) => `${i.path.join('.')}: ${i.message}`);
+    if (!isEntryObject(input)) {
+        const direct = dataContractSchema.safeParse(input);
+        return direct.success
+            ? { ok: true, contract: direct.data, stripped: [] }
+            : { ok: false, issues: issuesOf(direct.error) };
+    }
+    const stripped = [];
+    const cleaned = { ...input };
+    const propsSpec = cleaned['propsSpec'];
+    if (isEntryObject(propsSpec)) {
+        cleaned['propsSpec'] = {
+            ...propsSpec,
+            properties: stripEntryMap(propsSpec['properties'], new Set(Object.keys(propEntrySchema.shape)), 'propsSpec.properties', stripped),
+        };
+    }
+    cleaned['actionSpec'] = stripEntryMap(cleaned['actionSpec'], new Set(Object.keys(actionEntrySchema.shape)), 'actionSpec', stripped);
+    cleaned['streamSpec'] = stripEntryMap(cleaned['streamSpec'], new Set(Object.keys(streamChannelEntrySchema.shape)), 'streamSpec', stripped);
+    cleaned['contextSpec'] = stripEntryMap(cleaned['contextSpec'], new Set(Object.keys(contextEntrySchema.shape)), 'contextSpec', stripped);
+    const agentCapabilities = cleaned['agentCapabilities'];
+    if (isEntryObject(agentCapabilities)) {
+        cleaned['agentCapabilities'] = {
+            ...agentCapabilities,
+            tools: stripEntryMap(agentCapabilities['tools'], new Set(Object.keys(agentToolEntrySchema.shape)), 'agentCapabilities.tools', stripped),
+        };
+    }
+    for (const key of ['actionSpec', 'streamSpec', 'contextSpec']) {
+        if (cleaned[key] === undefined)
+            delete cleaned[key];
+    }
+    const parsed = dataContractSchema.safeParse(cleaned);
+    return parsed.success
+        ? { ok: true, contract: parsed.data, stripped }
+        : { ok: false, issues: issuesOf(parsed.error) };
+}
 export const dataContractSchema = z
     .object({
     propsSpec: propsSpecSchema

package/dist/schemas/mcp.d.ts

@@ -846,11 +846,20 @@ export declare const declareToolCatalogOutputSchema: z.ZodObject<{
  */
 export declare const RUNTIME_PULL_MAX_LIMIT = 100;
 /**
- * Server-side ceiling on `ggui_runtime_pull`'s `wait` hold, in seconds.
- * Chosen under `ggui_consume`'s proven 25-second host tolerance for
- * held tool calls — the hold must resolve before any host-side
- * `tools/call` timeout fires, or the transport counts a failure the
- * server intended as a quiet success.
+ * Server-side ceiling on `ggui_runtime_pull`'s `wait` hold, in seconds —
+ * the LONGEST hold the server will honour, never a promise that every
+ * host tolerates it (ggui#1030).
+ *
+ * The contract has two sides. SERVER: honour `wait` up to this ceiling,
+ * return the empty page as a normal result when the hold elapses, and
+ * end the hold when the caller's transport closes. CALLER (the pulling
+ * runtime): choose a `wait` that does not exceed the `tools/call`
+ * timeout of the host relaying the call, minus a margin; a host that
+ * relays a pull clamps the forwarded `wait` to its own timeout minus one
+ * second. A host timeout below the hold is a caller-side failure — the
+ * server's `success` after the socket closed is not a server fault, and
+ * a caller that keeps pulling through such failures must demote to
+ * sparse un-held pulls exactly as it does after consecutive empties.
  */
 export declare const RUNTIME_PULL_MAX_WAIT_SECONDS = 20;
 /**

package/dist/schemas/mcp.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"mcp.d.ts","sourceRoot":"","sources":["../../src/schemas/mcp.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAyBxB;;;;;GAKG;AACH,eAAO,MAAM,iBAAiB;;;CAgBpB,CAAC;AAEX,eAAO,MAAM,kBAAkB;;;iBAA8B,CAAC;AAE9D;;;GAGG;AACH,eAAO,MAAM,cAAc;;;;;CAKjB,CAAC;AAEX,eAAO,MAAM,eAAe;;;;;iBAA2B,CAAC;AAExD,eAAO,MAAM,oBAAoB;;CAKvB,CAAC;AAEX,eAAO,MAAM,qBAAqB;;iBAAiC,CAAC;AAEpE;;;;;;GAMG;AACH,eAAO,MAAM,yBAAyB;;CAK5B,CAAC;AAEX,eAAO,MAAM,0BAA0B;;iBAAsC,CAAC;AAE9E;;;;;GAKG;AACH,eAAO,MAAM,gCAAgC,IAAc,CAAC;AAE5D,eAAO,MAAM,iCAAiC,gCAE7C,CAAC;AAEF,eAAO,MAAM,0BAA0B;;;;;CAwB7B,CAAC;AAEX,eAAO,MAAM,2BAA2B;;;;;iBAAuC,CAAC;AAEhF,eAAO,MAAM,yBAAyB;;CAO5B,CAAC;AAEX,eAAO,MAAM,0BAA0B;;iBAAsC,CAAC;AAE9E,eAAO,MAAM,kBAAkB,IAAc,CAAC;AAE9C,eAAO,MAAM,mBAAmB,gCAA+B,CAAC;AAahE;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AACH,eAAO,MAAM,oBAAoB;;;;kBA0BtB,CAAC;AAEZ;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AACH,eAAO,MAAM,qBAAqB;;;;;;;;;;;;;;;;iBAgChC,CAAC;AAEH;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgCG;AACH,eAAO,MAAM,gBAAgB;;IAO3B;;;;;;;;OAQG;;IAEH;;;;;OAKG;;IAQH;;;;;;;;;;;;;;;OAeG;;;;IAaH;;;;;;;;;;;OAWG;;;;;CAuBK,CAAC;AAEX,eAAO,MAAM,iBAAiB;;;;;;;;;;;iBAA6B,CAAC;AAE5D;;;;;GAKG;AACH,eAAO,MAAM,uBAAuB;;;;;;;;;;iBAyBlC,CAAC;AAEH;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,eAAO,MAAM,qBAAqB;;;;;;EAMhC,CAAC;AAEH;;;;;GAKG;AACH,MAAM,MAAM,eAAe,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,qBAAqB,CAAC,CAAC;AAEpE;;;;;GAKG;AACH,eAAO,MAAM,iBAAiB;;;;;;;;;iBAS5B,CAAC;AAEH;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,eAAO,MAAM,mBAAmB;;;;EAA4C,CAAC;AAE7E,+DAA+D;AAC/D,MAAM,MAAM,aAAa,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,mBAAmB,CAAC,CAAC;AAyChE,eAAO,MAAM,mBAAmB;;;;;;;;;;;;;;;;;;;;;;;;iBAmB9B,CAAC;AAEH,oEAAoE;AACpE,MAAM,MAAM,oBAAoB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,mBAAmB,CAAC,CAAC;AAEvE;;;;;;;;;;;;;;;GAeG;AACH,eAAO,MAAM,sBAAsB;;;;;;;;;;;;;kBAajC,CAAC;AAEH,0FAA0F;AAC1F,MAAM,MAAM,gBAAgB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,sBAAsB,CAAC,CAAC;AAEtE;;;;;;;;;;;;;GAaG;AACH,eAAO,MAAM,2BAA2B;;;;;;;;;;;;;;;;;;;kBAItC,CAAC;AAEH,iGAAiG;AACjG,MAAM,MAAM,qBAAqB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,2BAA2B,CAAC,CAAC;AAEhF;;;;;;;;;;;;;;;;;;GAkBG;AACH,eAAO,MAAM,mBAAmB;;;;;;;;;;;;;;;;;;;;;;;;;;;kBAG9B,CAAC;AAqDH;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,eAAO,MAAM,2BAA2B;;;;;EAKtC,CAAC;AAEH;;;;;;;;;;GAUG;AACH,eAAO,MAAM,uBAAuB;;;;;;;;;iBAalC,CAAC;AAEH;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6CG;AACH,eAAO,MAAM,kBAAkB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;iBAiK7B,CAAC;AAEH;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8BG;AACH,eAAO,MAAM,iBAAiB;;;;;;;;4BAa5B,CAAC;AAEH;;;;;;GAMG;AACH,eAAO,MAAM,gBAAgB;;;;;;;;4BAa3B,CAAC;AAkBH;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,eAAO,MAAM,kBAAkB;;;;;;;;iBAgD7B,CAAC;AAEH;;;;;;;;;;GAUG;AACH,eAAO,MAAM,iBAAiB;;;;;;;iBAsC5B,CAAC;AAEH;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,eAAO,MAAM,6BAA6B;;;;;kBAW/B,CAAC;AAEZ,eAAO,MAAM,8BAA8B;;;kBAKhC,CAAC;AAIZ;;;;;;GAMG;AACH,eAAO,MAAM,sBAAsB,MAAM,CAAC;AAE1C;;;;;;GAMG;AACH,eAAO,MAAM,6BAA6B,KAAK,CAAC;AAEhD;;;;;GAKG;AACH,eAAO,MAAM,sBAAsB;;;;;iBAsBjC,CAAC;AAEH;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AACH,eAAO,MAAM,qBAAqB;;;;;CA8BxB,CAAC;AAEX,eAAO,MAAM,sBAAsB;;;;;iBAAkC,CAAC;AAEtE;;;;;;;GAOG;AACH,eAAO,MAAM,2BAA2B;;;;;;;;;iBAItC,CAAC;AAEH;;;;;;;;;GASG;AACH,eAAO,MAAM,wBAAwB;;;iBAGnC,CAAC;AAEH;;;;;;;;GAQG;AACH,eAAO,MAAM,uBAAuB;;;;;;;;;;;;mBAGlC,CAAC;AAGH;;;;;;;;;;;;;;;;;;GAkBG;AACH,eAAO,MAAM,0BAA0B;;;;;;;CA+B7B,CAAC;AAEX,eAAO,MAAM,2BAA2B;;;;;;;iBAAuC,CAAC;AAEhF,8DAA8D;AAC9D,eAAO,MAAM,4BAA4B;;iBAAoC,CAAC;AAW9E,KAAK,iBAAiB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,kBAAkB,CAAC,CAAC;AAE5D,kDAAkD;AAClD,KAAK,uBAAuB,GAAG,QAAQ,CACrC,IAAI,CACF,iBAAiB,EACjB,WAAW,GAAG,QAAQ,GAAG,cAAc,GAAG,aAAa,GAAG,YAAY,GAAG,OAAO,CACjF,CACF,CAAC;AAEF,qEAAqE;AACrE,wBAAgB,gBAAgB,CAC9B,MAAM,EAAE,iBAAiB,GACxB,MAAM,IAAI,iBAAiB,GAAG;IAAE,OAAO,EAAE,UAAU,CAAA;CAAE,GAAG,uBAAuB,CAEjF;AAED;;;GAGG;AACH,wBAAgB,oBAAoB,CAClC,MAAM,EAAE,iBAAiB,GACxB,MAAM,IAAI,iBAAiB,GAAG;IAC/B,OAAO,EAAE,QAAQ,CAAC;IAClB,KAAK,EAAE,CAAC,CAAC,KAAK,CAAC,OAAO,iBAAiB,CAAC,CAAC;CAC1C,GAAG,uBAAuB,CAE1B;AAED;;;;;GAKG;AACH,wBAAgB,qBAAqB,CACnC,MAAM,EAAE,iBAAiB,GACxB,MAAM,IAAI;IAAE,OAAO,EAAE,SAAS,CAAC;IAAC,OAAO,EAAE,oBAAoB,CAAA;CAAE,CAEjE;AAYD,iFAAiF;AACjF,eAAO,MAAM,sBAAsB;;;;EAA0C,CAAC;AAE9E;;;;GAIG;AACH,eAAO,MAAM,2BAA2B;;;;;;;;;;;;;;;;;;;;;;;;;;;;iBAiBtC,CAAC;AAEH,kFAAkF;AAClF,eAAO,MAAM,wBAAwB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;iBAEnC,CAAC;AAEH,mFAAmF;AACnF,eAAO,MAAM,4BAA4B;;;;;;;;;iBASvC,CAAC;AAEH;;;;GAIG;AACH,eAAO,MAAM,uBAAuB;;;EAAgC,CAAC;AAErE;;;;;;GAMG;AACH,eAAO,MAAM,uBAAuB;;;;;;;;iBAQlC,CAAC;AAEH;;;;;;;;;;;;;GAaG;AACH,eAAO,MAAM,kBAAkB;;;;;;;;;;;;iBAI7B,CAAC;AAEH;;;;;;GAMG;AACH,eAAO,MAAM,uBAAuB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;iBAIlC,CAAC;AAEH,iFAAiF;AACjF,eAAO,MAAM,4BAA4B;;;;;;;;;;;iBAEvC,CAAC;AAEH;;;;GAIG;AACH,eAAO,MAAM,oBAAoB;;;iBAU/B,CAAC;AAEH;;;;;;;;;GASG;AACH,eAAO,MAAM,0BAA0B;;;;;;;;;;;;iBAgBrC,CAAC;AAEH,wEAAwE;AACxE,eAAO,MAAM,6BAA6B;;;;EAA8C,CAAC;AAEzF,eAAO,MAAM,8BAA8B;;;;;;;;;iBAKzC,CAAC;AAEH,6GAA6G;AAC7G,eAAO,MAAM,+BAA+B;;;;;;;;;;;;;;;;;;;;;;;;;;;iBAK1C,CAAC;AAEH,mFAAmF;AACnF,eAAO,MAAM,wBAAwB;;;;;;;iBAOnC,CAAC;AAEH,eAAO,MAAM,sCAAsC;;;;;;;;;;iBAGjD,CAAC;AAEH,mFAAmF;AACnF,eAAO,MAAM,gCAAgC;;;;;;;;;;;;;;;;;;;;;;;;;;iBAiB3C,CAAC;AAEH,eAAO,MAAM,gCAAgC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;iBAY3C,CAAC"}
+{"version":3,"file":"mcp.d.ts","sourceRoot":"","sources":["../../src/schemas/mcp.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAyBxB;;;;;GAKG;AACH,eAAO,MAAM,iBAAiB;;;CAgBpB,CAAC;AAEX,eAAO,MAAM,kBAAkB;;;iBAA8B,CAAC;AAE9D;;;GAGG;AACH,eAAO,MAAM,cAAc;;;;;CAKjB,CAAC;AAEX,eAAO,MAAM,eAAe;;;;;iBAA2B,CAAC;AAExD,eAAO,MAAM,oBAAoB;;CAKvB,CAAC;AAEX,eAAO,MAAM,qBAAqB;;iBAAiC,CAAC;AAEpE;;;;;;GAMG;AACH,eAAO,MAAM,yBAAyB;;CAK5B,CAAC;AAEX,eAAO,MAAM,0BAA0B;;iBAAsC,CAAC;AAE9E;;;;;GAKG;AACH,eAAO,MAAM,gCAAgC,IAAc,CAAC;AAE5D,eAAO,MAAM,iCAAiC,gCAE7C,CAAC;AAEF,eAAO,MAAM,0BAA0B;;;;;CAwB7B,CAAC;AAEX,eAAO,MAAM,2BAA2B;;;;;iBAAuC,CAAC;AAEhF,eAAO,MAAM,yBAAyB;;CAO5B,CAAC;AAEX,eAAO,MAAM,0BAA0B;;iBAAsC,CAAC;AAE9E,eAAO,MAAM,kBAAkB,IAAc,CAAC;AAE9C,eAAO,MAAM,mBAAmB,gCAA+B,CAAC;AAahE;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AACH,eAAO,MAAM,oBAAoB;;;;kBA0BtB,CAAC;AAEZ;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AACH,eAAO,MAAM,qBAAqB;;;;;;;;;;;;;;;;iBAgChC,CAAC;AAEH;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgCG;AACH,eAAO,MAAM,gBAAgB;;IAO3B;;;;;;;;OAQG;;IAEH;;;;;OAKG;;IAQH;;;;;;;;;;;;;;;OAeG;;;;IAaH;;;;;;;;;;;OAWG;;;;;CAuBK,CAAC;AAEX,eAAO,MAAM,iBAAiB;;;;;;;;;;;iBAA6B,CAAC;AAE5D;;;;;GAKG;AACH,eAAO,MAAM,uBAAuB;;;;;;;;;;iBAyBlC,CAAC;AAEH;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,eAAO,MAAM,qBAAqB;;;;;;EAMhC,CAAC;AAEH;;;;;GAKG;AACH,MAAM,MAAM,eAAe,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,qBAAqB,CAAC,CAAC;AAEpE;;;;;GAKG;AACH,eAAO,MAAM,iBAAiB;;;;;;;;;iBAS5B,CAAC;AAEH;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,eAAO,MAAM,mBAAmB;;;;EAA4C,CAAC;AAE7E,+DAA+D;AAC/D,MAAM,MAAM,aAAa,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,mBAAmB,CAAC,CAAC;AAyChE,eAAO,MAAM,mBAAmB;;;;;;;;;;;;;;;;;;;;;;;;iBAmB9B,CAAC;AAEH,oEAAoE;AACpE,MAAM,MAAM,oBAAoB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,mBAAmB,CAAC,CAAC;AAEvE;;;;;;;;;;;;;;;GAeG;AACH,eAAO,MAAM,sBAAsB;;;;;;;;;;;;;kBAajC,CAAC;AAEH,0FAA0F;AAC1F,MAAM,MAAM,gBAAgB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,sBAAsB,CAAC,CAAC;AAEtE;;;;;;;;;;;;;GAaG;AACH,eAAO,MAAM,2BAA2B;;;;;;;;;;;;;;;;;;;kBAItC,CAAC;AAEH,iGAAiG;AACjG,MAAM,MAAM,qBAAqB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,2BAA2B,CAAC,CAAC;AAEhF;;;;;;;;;;;;;;;;;;GAkBG;AACH,eAAO,MAAM,mBAAmB;;;;;;;;;;;;;;;;;;;;;;;;;;;kBAG9B,CAAC;AAqDH;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,eAAO,MAAM,2BAA2B;;;;;EAKtC,CAAC;AAEH;;;;;;;;;;GAUG;AACH,eAAO,MAAM,uBAAuB;;;;;;;;;iBAalC,CAAC;AAEH;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6CG;AACH,eAAO,MAAM,kBAAkB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;iBAiK7B,CAAC;AAEH;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8BG;AACH,eAAO,MAAM,iBAAiB;;;;;;;;4BAa5B,CAAC;AAEH;;;;;;GAMG;AACH,eAAO,MAAM,gBAAgB;;;;;;;;4BAa3B,CAAC;AAkBH;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,eAAO,MAAM,kBAAkB;;;;;;;;iBAgD7B,CAAC;AAEH;;;;;;;;;;GAUG;AACH,eAAO,MAAM,iBAAiB;;;;;;;iBAsC5B,CAAC;AAEH;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,eAAO,MAAM,6BAA6B;;;;;kBAW/B,CAAC;AAEZ,eAAO,MAAM,8BAA8B;;;kBAKhC,CAAC;AAIZ;;;;;;GAMG;AACH,eAAO,MAAM,sBAAsB,MAAM,CAAC;AAE1C;;;;;;;;;;;;;;;GAeG;AACH,eAAO,MAAM,6BAA6B,KAAK,CAAC;AAEhD;;;;;GAKG;AACH,eAAO,MAAM,sBAAsB;;;;;iBAsBjC,CAAC;AAEH;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AACH,eAAO,MAAM,qBAAqB;;;;;CA8BxB,CAAC;AAEX,eAAO,MAAM,sBAAsB;;;;;iBAAkC,CAAC;AAEtE;;;;;;;GAOG;AACH,eAAO,MAAM,2BAA2B;;;;;;;;;iBAItC,CAAC;AAEH;;;;;;;;;GASG;AACH,eAAO,MAAM,wBAAwB;;;iBAGnC,CAAC;AAEH;;;;;;;;GAQG;AACH,eAAO,MAAM,uBAAuB;;;;;;;;;;;;mBAGlC,CAAC;AAGH;;;;;;;;;;;;;;;;;;GAkBG;AACH,eAAO,MAAM,0BAA0B;;;;;;;CA+B7B,CAAC;AAEX,eAAO,MAAM,2BAA2B;;;;;;;iBAAuC,CAAC;AAEhF,8DAA8D;AAC9D,eAAO,MAAM,4BAA4B;;iBAAoC,CAAC;AAW9E,KAAK,iBAAiB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,kBAAkB,CAAC,CAAC;AAE5D,kDAAkD;AAClD,KAAK,uBAAuB,GAAG,QAAQ,CACrC,IAAI,CACF,iBAAiB,EACjB,WAAW,GAAG,QAAQ,GAAG,cAAc,GAAG,aAAa,GAAG,YAAY,GAAG,OAAO,CACjF,CACF,CAAC;AAEF,qEAAqE;AACrE,wBAAgB,gBAAgB,CAC9B,MAAM,EAAE,iBAAiB,GACxB,MAAM,IAAI,iBAAiB,GAAG;IAAE,OAAO,EAAE,UAAU,CAAA;CAAE,GAAG,uBAAuB,CAEjF;AAED;;;GAGG;AACH,wBAAgB,oBAAoB,CAClC,MAAM,EAAE,iBAAiB,GACxB,MAAM,IAAI,iBAAiB,GAAG;IAC/B,OAAO,EAAE,QAAQ,CAAC;IAClB,KAAK,EAAE,CAAC,CAAC,KAAK,CAAC,OAAO,iBAAiB,CAAC,CAAC;CAC1C,GAAG,uBAAuB,CAE1B;AAED;;;;;GAKG;AACH,wBAAgB,qBAAqB,CACnC,MAAM,EAAE,iBAAiB,GACxB,MAAM,IAAI;IAAE,OAAO,EAAE,SAAS,CAAC;IAAC,OAAO,EAAE,oBAAoB,CAAA;CAAE,CAEjE;AAYD,iFAAiF;AACjF,eAAO,MAAM,sBAAsB;;;;EAA0C,CAAC;AAE9E;;;;GAIG;AACH,eAAO,MAAM,2BAA2B;;;;;;;;;;;;;;;;;;;;;;;;;;;;iBAiBtC,CAAC;AAEH,kFAAkF;AAClF,eAAO,MAAM,wBAAwB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;iBAEnC,CAAC;AAEH,mFAAmF;AACnF,eAAO,MAAM,4BAA4B;;;;;;;;;iBASvC,CAAC;AAEH;;;;GAIG;AACH,eAAO,MAAM,uBAAuB;;;EAAgC,CAAC;AAErE;;;;;;GAMG;AACH,eAAO,MAAM,uBAAuB;;;;;;;;iBAQlC,CAAC;AAEH;;;;;;;;;;;;;GAaG;AACH,eAAO,MAAM,kBAAkB;;;;;;;;;;;;iBAI7B,CAAC;AAEH;;;;;;GAMG;AACH,eAAO,MAAM,uBAAuB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;iBAIlC,CAAC;AAEH,iFAAiF;AACjF,eAAO,MAAM,4BAA4B;;;;;;;;;;;iBAEvC,CAAC;AAEH;;;;GAIG;AACH,eAAO,MAAM,oBAAoB;;;iBAU/B,CAAC;AAEH;;;;;;;;;GASG;AACH,eAAO,MAAM,0BAA0B;;;;;;;;;;;;iBAgBrC,CAAC;AAEH,wEAAwE;AACxE,eAAO,MAAM,6BAA6B;;;;EAA8C,CAAC;AAEzF,eAAO,MAAM,8BAA8B;;;;;;;;;iBAKzC,CAAC;AAEH,6GAA6G;AAC7G,eAAO,MAAM,+BAA+B;;;;;;;;;;;;;;;;;;;;;;;;;;;iBAK1C,CAAC;AAEH,mFAAmF;AACnF,eAAO,MAAM,wBAAwB;;;;;;;iBAOnC,CAAC;AAEH,eAAO,MAAM,sCAAsC;;;;;;;;;;iBAGjD,CAAC;AAEH,mFAAmF;AACnF,eAAO,MAAM,gCAAgC;;;;;;;;;;;;;;;;;;;;;;;;;;iBAiB3C,CAAC;AAEH,eAAO,MAAM,gCAAgC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;iBAY3C,CAAC"}

package/dist/schemas/mcp.js

@@ -1094,11 +1094,20 @@ export const declareToolCatalogOutputSchema = z
  */
 export const RUNTIME_PULL_MAX_LIMIT = 100;
 /**
- * Server-side ceiling on `ggui_runtime_pull`'s `wait` hold, in seconds.
- * Chosen under `ggui_consume`'s proven 25-second host tolerance for
- * held tool calls — the hold must resolve before any host-side
- * `tools/call` timeout fires, or the transport counts a failure the
- * server intended as a quiet success.
+ * Server-side ceiling on `ggui_runtime_pull`'s `wait` hold, in seconds —
+ * the LONGEST hold the server will honour, never a promise that every
+ * host tolerates it (ggui#1030).
+ *
+ * The contract has two sides. SERVER: honour `wait` up to this ceiling,
+ * return the empty page as a normal result when the hold elapses, and
+ * end the hold when the caller's transport closes. CALLER (the pulling
+ * runtime): choose a `wait` that does not exceed the `tools/call`
+ * timeout of the host relaying the call, minus a margin; a host that
+ * relays a pull clamps the forwarded `wait` to its own timeout minus one
+ * second. A host timeout below the hold is a caller-side failure — the
+ * server's `success` after the socket closed is not a server fault, and
+ * a caller that keeps pulling through such failures must demote to
+ * sparse un-held pulls exactly as it does after consecutive empties.
  */
 export const RUNTIME_PULL_MAX_WAIT_SECONDS = 20;
 /**
@@ -1173,7 +1182,7 @@ export const runtimePullInputShape = {
         .number()
         .min(0)
         .optional()
-        .describe(`Subscription-mode hold, in seconds. When set and the cursor page is empty, the server holds this call until an event lands or the hold elapses (values above ${RUNTIME_PULL_MAX_WAIT_SECONDS} are clamped to ${RUNTIME_PULL_MAX_WAIT_SECONDS}). An empty page after a full hold is a NORMAL result — immediately re-pull to stay subscribed, or back off to sparse un-held pulls after a few consecutive empties. Omit (= 0) for an immediate return.`),
+        .describe(`Subscription-mode hold, in seconds. When set and the cursor page is empty, the server holds this call until an event lands or the hold elapses (values above ${RUNTIME_PULL_MAX_WAIT_SECONDS} are clamped to ${RUNTIME_PULL_MAX_WAIT_SECONDS}). CALLER OBLIGATION: your \`wait\` MUST NOT exceed the tools/call timeout of the host relaying this call, minus a margin — a host that relays a pull MUST clamp the forwarded \`wait\` to its own timeout minus one second; a host timeout below the hold is a caller-side failure (the server's success after the socket closed is not a server fault), and a caller seeing such failures MUST demote to sparse un-held pulls as it would after consecutive empties. An empty page after a full hold is a NORMAL result — immediately re-pull to stay subscribed, or back off to sparse un-held pulls after a few consecutive empties. Omit (= 0) for an immediate return.`),
 };
 export const runtimePullInputSchema = z.object(runtimePullInputShape);
 /**

package/dist/schemas/ops-blueprint.d.ts

@@ -39,6 +39,12 @@ import { z } from 'zod';
  * caller's bound app identity; cross-app calls are subject to the
  * deployment's authorization policy.
  */
+/**
+ * Bound on `intent` (ggui#1046), in characters — one exported number the
+ * door checks and readers may cap at; standalone (not tied to any other
+ * text bound: they move independently).
+ */
+export declare const OPS_GENERATE_BLUEPRINT_INTENT_MAX_CHARS = 2000;
 export declare const opsGenerateBlueprintInputSchema: z.ZodObject<{
     appId: z.ZodOptional<z.ZodString>;
     contract: z.ZodType<import("../index.js").DataContract, unknown, z.core.$ZodTypeInternals<import("../index.js").DataContract, unknown>>;
@@ -47,6 +53,7 @@ export declare const opsGenerateBlueprintInputSchema: z.ZodObject<{
     aesthetic: z.ZodOptional<z.ZodString>;
     context: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodType<import("../index.js").JsonValue, unknown, z.core.$ZodTypeInternals<import("../index.js").JsonValue, unknown>>>>;
     seedPrompt: z.ZodOptional<z.ZodString>;
+    intent: z.ZodOptional<z.ZodString>;
     setAsOperatorDefault: z.ZodOptional<z.ZodBoolean>;
 }, z.core.$strict>;
 /**

package/dist/schemas/ops-blueprint.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"ops-blueprint.d.ts","sourceRoot":"","sources":["../../src/schemas/ops-blueprint.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAaxB;;;;;;;;;;;;;;GAcG;AACH,eAAO,MAAM,+BAA+B;;;;;;;;;kBAkDjC,CAAC;AAEZ;;;;GAIG;AACH,eAAO,MAAM,gCAAgC;;;;;kBAqBlC,CAAC;AAEZ;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AACH,eAAO,MAAM,+BAA+B;;;;;;;;;kBA+CjC,CAAC;AAEZ;;;;GAIG;AACH,eAAO,MAAM,gCAAgC;;;;kBAalC,CAAC;AAEZ;;;;;;;;;;;;;;;;;;;GAmBG;AACH,eAAO,MAAM,4BAA4B;;;;;;kBAsC9B,CAAC;AAEZ,eAAO,MAAM,6BAA6B;;kBAI/B,CAAC;AAEZ;;;;;;;;GAQG;AACH,eAAO,MAAM,6BAA6B;;;;;kBAsB/B,CAAC;AAEZ,eAAO,MAAM,8BAA8B;;;kBAKhC,CAAC;AAEZ;;;;GAIG;AACH,eAAO,MAAM,6BAA6B;;;kBAW/B,CAAC;AAEZ,eAAO,MAAM,8BAA8B;;kBAIhC,CAAC;AAEZ;;;;GAIG;AACH,MAAM,MAAM,yBAAyB,GAAG,CAAC,CAAC,KAAK,CAC7C,OAAO,+BAA+B,CACvC,CAAC;AACF,MAAM,MAAM,0BAA0B,GAAG,CAAC,CAAC,KAAK,CAC9C,OAAO,gCAAgC,CACxC,CAAC;AACF,MAAM,MAAM,yBAAyB,GAAG,CAAC,CAAC,KAAK,CAC7C,OAAO,+BAA+B,CACvC,CAAC;AACF,MAAM,MAAM,0BAA0B,GAAG,CAAC,CAAC,KAAK,CAC9C,OAAO,gCAAgC,CACxC,CAAC;AACF,MAAM,MAAM,sBAAsB,GAAG,CAAC,CAAC,KAAK,CAC1C,OAAO,4BAA4B,CACpC,CAAC;AACF,MAAM,MAAM,uBAAuB,GAAG,CAAC,CAAC,KAAK,CAC3C,OAAO,6BAA6B,CACrC,CAAC;AACF,MAAM,MAAM,uBAAuB,GAAG,CAAC,CAAC,KAAK,CAC3C,OAAO,6BAA6B,CACrC,CAAC;AACF,MAAM,MAAM,wBAAwB,GAAG,CAAC,CAAC,KAAK,CAC5C,OAAO,8BAA8B,CACtC,CAAC;AACF,MAAM,MAAM,uBAAuB,GAAG,CAAC,CAAC,KAAK,CAC3C,OAAO,6BAA6B,CACrC,CAAC;AACF,MAAM,MAAM,wBAAwB,GAAG,CAAC,CAAC,KAAK,CAC5C,OAAO,8BAA8B,CACtC,CAAC"}
+{"version":3,"file":"ops-blueprint.d.ts","sourceRoot":"","sources":["../../src/schemas/ops-blueprint.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAaxB;;;;;;;;;;;;;;GAcG;AACH;;;;GAIG;AACH,eAAO,MAAM,uCAAuC,OAAO,CAAC;AAE5D,eAAO,MAAM,+BAA+B;;;;;;;;;;kBA0DjC,CAAC;AAEZ;;;;GAIG;AACH,eAAO,MAAM,gCAAgC;;;;;kBAqBlC,CAAC;AAEZ;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AACH,eAAO,MAAM,+BAA+B;;;;;;;;;kBA+CjC,CAAC;AAEZ;;;;GAIG;AACH,eAAO,MAAM,gCAAgC;;;;kBAalC,CAAC;AAEZ;;;;;;;;;;;;;;;;;;;GAmBG;AACH,eAAO,MAAM,4BAA4B;;;;;;kBAsC9B,CAAC;AAEZ,eAAO,MAAM,6BAA6B;;kBAI/B,CAAC;AAEZ;;;;;;;;GAQG;AACH,eAAO,MAAM,6BAA6B;;;;;kBAsB/B,CAAC;AAEZ,eAAO,MAAM,8BAA8B;;;kBAKhC,CAAC;AAEZ;;;;GAIG;AACH,eAAO,MAAM,6BAA6B;;;kBAW/B,CAAC;AAEZ,eAAO,MAAM,8BAA8B;;kBAIhC,CAAC;AAEZ;;;;GAIG;AACH,MAAM,MAAM,yBAAyB,GAAG,CAAC,CAAC,KAAK,CAC7C,OAAO,+BAA+B,CACvC,CAAC;AACF,MAAM,MAAM,0BAA0B,GAAG,CAAC,CAAC,KAAK,CAC9C,OAAO,gCAAgC,CACxC,CAAC;AACF,MAAM,MAAM,yBAAyB,GAAG,CAAC,CAAC,KAAK,CAC7C,OAAO,+BAA+B,CACvC,CAAC;AACF,MAAM,MAAM,0BAA0B,GAAG,CAAC,CAAC,KAAK,CAC9C,OAAO,gCAAgC,CACxC,CAAC;AACF,MAAM,MAAM,sBAAsB,GAAG,CAAC,CAAC,KAAK,CAC1C,OAAO,4BAA4B,CACpC,CAAC;AACF,MAAM,MAAM,uBAAuB,GAAG,CAAC,CAAC,KAAK,CAC3C,OAAO,6BAA6B,CACrC,CAAC;AACF,MAAM,MAAM,uBAAuB,GAAG,CAAC,CAAC,KAAK,CAC3C,OAAO,6BAA6B,CACrC,CAAC;AACF,MAAM,MAAM,wBAAwB,GAAG,CAAC,CAAC,KAAK,CAC5C,OAAO,8BAA8B,CACtC,CAAC;AACF,MAAM,MAAM,uBAAuB,GAAG,CAAC,CAAC,KAAK,CAC3C,OAAO,6BAA6B,CACrC,CAAC;AACF,MAAM,MAAM,wBAAwB,GAAG,CAAC,CAAC,KAAK,CAC5C,OAAO,8BAA8B,CACtC,CAAC"}

package/dist/schemas/ops-blueprint.js

@@ -42,6 +42,12 @@ import { blueprintSchema, blueprintVarianceSchema, llmBlueprintSourceSchema, use
  * caller's bound app identity; cross-app calls are subject to the
  * deployment's authorization policy.
  */
+/**
+ * Bound on `intent` (ggui#1046), in characters — one exported number the
+ * door checks and readers may cap at; standalone (not tied to any other
+ * text bound: they move independently).
+ */
+export const OPS_GENERATE_BLUEPRINT_INTENT_MAX_CHARS = 2000;
 export const opsGenerateBlueprintInputSchema = z
     .object({
     appId: z
@@ -73,6 +79,12 @@ export const opsGenerateBlueprintInputSchema = z
         .string()
         .optional()
         .describe("The raw operator prompt that produced this variant. Round-trip input for the variant-selector + audit trail."),
+    intent: z
+        .string()
+        .trim()
+        .max(OPS_GENERATE_BLUEPRINT_INTENT_MAX_CHARS)
+        .optional()
+        .describe(`What the operator wants generated for this contract, in plain words — the prompt the generator composes from (at most ${OPS_GENERATE_BLUEPRINT_INTENT_MAX_CHARS} characters). Not part of the cache identity: two calls that differ only in \`intent\` share a variant key. When omitted, the generator falls back to \`seedPrompt\`; omitting both is a caller gap that a future release refuses.`),
     setAsOperatorDefault: z
         .boolean()
         .optional()