@greatstore/cli 0.0.42 → 0.0.43

package/CHANGELOG.md

@@ -3,6 +3,22 @@
 All notable changes to `@greatstore/cli` are recorded here. The format
 follows [Keep a Changelog](https://keepachangelog.com/).
 
+## 0.0.43 — 2026-08-18
+
+### Added
+- `gs apps build` and `gs apps push` now check each component before
+  building or uploading it. Findings are reported as **errors** (a
+  blocker — the component isn't built or uploaded) or **warnings** (it
+  builds and is ready to publish, but something is worth improving),
+  and a single run reports everything it found rather than stopping at
+  the first problem.
+- New check: a component's props and its `inputSchema.properties` must
+  agree. A schema field the component doesn't accept is an error; a prop
+  the schema doesn't declare is a warning, since nothing will ever pass
+  it. The props GreatStore injects (`onSendMessage`, `onCallTool`,
+  `onUpdateModelContext`, `onShowLightbox`, `onClose`, `storeData`,
+  `Image`) are exempt.
+
 ## 0.0.42 — 2026-08-15
 
 ### Changed

package/README.md

@@ -60,7 +60,7 @@ working.
 | Command                                                | What it does                                      |
 | ------------------------------------------------------ | -------------------------------------------------- |
 | `gs apps init <name> [--out <dir>] [--store <s>]`      | Scaffold a working component project.              |
-| `gs apps build [<name>]`                               | Build component bundle(s); no args = all.          |
+| `gs apps build [<name>]`                               | Check and build component bundle(s); no args = all. |
 | `gs apps list [--json]`                                | List components in the current store.              |
 | `gs apps pull <name> [--draft\|--live\|--version N] [-o <dir>]` | Download a component to disk.              |
 | `gs apps push [<name>] [--manifest path] [--bundle path]` | Upload local changes.                            |
@@ -68,6 +68,25 @@ working.
 | `gs apps unpublish <name>`                             | Hide a published component.                        |
 | `gs apps delete <name> [--yes]`                        | Remove the component.                              |
 
+### Component checks
+
+`gs apps build` and `gs apps push` check each component before they do
+their work, and report what they find as either:
+
+- **error** — a blocker. The component isn't built or uploaded until it's
+  fixed.
+- **warning** — the component builds and is ready to publish, but
+  something is worth improving.
+
+The checks cover the manifest (valid JSON, a `name` matching the folder,
+an `inputSchema` simple enough for the assistant to fill reliably) and
+the component's props: every prop it declares should be a field in
+`inputSchema.properties`, apart from the props GreatStore injects
+(`onSendMessage`, `onCallTool`, `onUpdateModelContext`,
+`onShowLightbox`, `onClose`, `storeData`, `Image`). A prop nothing
+declares is a warning — nothing will ever pass it. A schema field the
+component doesn't accept is an error.
+
 ### Agent skill
 
 | Command                              | What it does                                             |

package/dist/cli.js

@@ -643,7 +643,7 @@ import { fileURLToPath } from "url";
 var cache = null;
 function loadTemplate() {
   if (cache) return cache;
-  cache = true ? JSON.parse('{"component/component.tsx":"import React from \\"react\\";\\n\\n// Add your tool args (matching manifest.json#inputSchema.properties)\\n// alongside the GreatStore-injected lifecycle props. See AGENTS.md for\\n// what each lifecycle prop does.\\ninterface Props {\\n  onSendMessage: (text: string) => void;\\n  onCallTool: (name: string, args: Record<string, unknown>) => void;\\n  onUpdateModelContext: (context: string) => void;\\n  onShowLightbox: (options: { src: string; originRect?: DOMRect }) => void;\\n  onClose: () => void;\\n  // Drop-in for <img>: `<Image src=\u2026 alt=\u2026 />`. See AGENTS.md.\\n  Image: React.ElementType<React.ComponentProps<\\"img\\">>;\\n}\\n\\n// See AGENTS.md for the design rules (em-based sizing, brand CSS\\n// variables), the lifecycle props, and how to write an async,\\n// backend-backed component.\\nexport default function __GS_PASCAL__(_props: Props): React.ReactElement {\\n  return (\\n    <div\\n      style={{\\n        padding: \\"1em\\",\\n        border: \\"1px solid var(--color-border-default)\\",\\n        borderRadius: \\"var(--radius-lg)\\",\\n        background: \\"var(--color-surface)\\",\\n        color: \\"var(--color-foreground)\\",\\n        fontFamily: \\"var(--font-primary)\\",\\n      }}\\n    >\\n      <strong>__GS_NAME__</strong> \u2014 hello from your component!\\n    </div>\\n  );\\n}\\n","component/manifest.json":"{\\n  \\"name\\": \\"__GS_NAME__\\",\\n  \\"displayName\\": \\"__GS_DISPLAY_NAME__\\",\\n  \\"description\\": \\"Renders the __GS_NAME__ widget.\\",\\n  \\"displayMode\\": \\"inline\\",\\n  \\"inputSchema\\": {\\n    \\"type\\": \\"object\\",\\n    \\"properties\\": {}\\n  }\\n}\\n","root/.gitignore":"node_modules/\\ncomponents/*/bundle.js\\ncomponents/*/.gssync.json\\n*.tsbuildinfo\\n.DS_Store\\n","root/.gsrc":"{\\n  \\"store\\": \\"__GS_STORE__\\"\\n}\\n","root/AGENTS.md":"# AGENTS.md\\n\\nGuidance for AI coding agents working on the components in this project.\\n`CLAUDE.md` and `GEMINI.md` are symlinks to this file.\\n\\nThese components render inside arbitrary publisher websites (the embed\\nwidget mounts on a host page) as well as the GreatStore storefront. You\\ncontrol neither the host page\'s base font size nor its color scheme, and\\nthe store owner controls the look from GreatStore theme settings. The\\nrules below keep components portable across both.\\n\\n## Design requirements\\n\\n### Never use `rem` for fonts and sizing \u2014 always use `em`\\n\\n`rem` resolves against the host page\'s root font size, which is\\narbitrary and outside our control. A host that sets `html { font-size:\\n8px }` (or 200%) will shrink or blow up every `rem`-based dimension.\\n`em` resolves against the component\'s own font size, so it stays\\nself-consistent wherever the component is mounted.\\n\\nUse `em` for font sizes, padding, margins, gaps, widths, heights,\\nand any other length. Borders may stay in `px` (hairlines should not\\nscale with text).\\n\\n```tsx\\n// Bad \u2014 breaks on hosts with a non-default root font size\\n<div style={{ padding: \\"1rem\\", fontSize: \\"0.875rem\\" }} />\\n\\n// Good\\n<div style={{ padding: \\"1em\\", fontSize: \\"0.875em\\" }} />\\n```\\n\\n### Don\'t hardcode colors, fonts, or corner radius \u2014 use GreatStore brand variables\\n\\nThe store owner themes the assistant from GreatStore settings. Hardcoded\\nvalues ignore that and make the component clash with the rest of the\\nstore. Read from the CSS variables GreatStore injects on the surface\\ninstead, so the component restyles itself when the theme changes.\\n\\nAvailable variables:\\n\\n| Purpose | Variable |\\n| --- | --- |\\n| Surface background | `--color-surface` |\\n| Secondary surface | `--color-surface-secondary` |\\n| Accent surface | `--color-surface-accent` |\\n| Hover surface | `--color-surface-hover` |\\n| Foreground text | `--color-foreground` |\\n| Secondary text | `--color-foreground-secondary` |\\n| Muted text | `--color-foreground-muted` |\\n| Accent text | `--color-foreground-accent` |\\n| Border | `--color-border-default` |\\n| Focus border | `--color-border-focus` |\\n| Primary / brand | `--color-primary` |\\n| Text on primary | `--color-primary-foreground` |\\n| Primary hover | `--color-primary-hover` |\\n| Primary muted | `--color-primary-muted` |\\n| Text on primary muted | `--color-primary-muted-foreground` |\\n| Primary tint | `--color-primary-tint` |\\n| Link | `--color-link` |\\n| Font family | `--font-primary` |\\n| Secondary font family | `--font-secondary` |\\n| Corner radius (scale) | `--radius-xs` \u2026 `--radius-4xl`, `--radius-pill` |\\n\\nThe store owner can set a secondary font family in their GreatStore\\ntheme settings, exposed as `--font-secondary` (it falls back to\\n`--font-primary` when unset). Reach for it to add a tasteful second\\nlayer of typography \u2014 pair `--font-primary` for body copy with\\n`--font-secondary` for headings, prices, or other accents \u2014 so the\\ncomponent reflects the store\'s full type system instead of a single\\nface.\\n\\n```tsx\\n// Bad \u2014 hardcoded, ignores the store\'s theme\\n<button style={{ background: \\"#4f46e5\\", borderRadius: 8, fontFamily: \\"Inter\\" }} />\\n\\n// Good\\n<button\\n  style={{\\n    background: \\"var(--color-primary)\\",\\n    color: \\"var(--color-primary-foreground)\\",\\n    borderRadius: \\"var(--radius-lg)\\",\\n    fontFamily: \\"var(--font-primary)\\",\\n  }}\\n/>\\n```\\n\\nProvide a sensible fallback only when a value might be absent, e.g.\\n`var(--color-primary, currentColor)`.\\n\\n## Component props\\n\\nEach component receives its tool args (the fields you declare in\\n`manifest.json#inputSchema.properties`) plus these GreatStore-injected\\nlifecycle props, which are always present:\\n\\n| Prop | What it does |\\n| --- | --- |\\n| `onSendMessage(text)` | Send text into the chat as if the shopper typed it. |\\n| `onCallTool(name, args)` | Chain into another remote-component tool by name. |\\n| `onUpdateModelContext(context)` | Inject invisible background context for the model (selected variant, configured options, current step). Replaces the prior value \u2014 never appends; pass `\\"\\"` to clear. Read on the next chat turn. Use it when the assistant should *know* in-component state without a visible message; use `onSendMessage` when you want a turn to happen now. |\\n| `onShowLightbox({ src, originRect? })` | Expand an image in the chat\'s shared full-screen lightbox \u2014 an on-brand zoom overlay your component can\'t render itself (it\'s boxed inside its own bounds and shadow root). Pass the image `src`; for a smooth zoom, also pass the clicked element\'s `getBoundingClientRect()` as `originRect` (omit it and the image grows from the viewport centre). |\\n| `onClose()` | Dismiss the host slot. Over-input clears the overlay, fullscreen reverts the pane, inline is a no-op. |\\n| `Image` | A drop-in for `<img>`: render `<Image src=\u2026 alt=\u2026 />` instead of `<img>` and your images are automatically served at the right size for the store. Takes the same props as `<img>` (`src`, `alt`, `style`, `loading`, `onClick`, \u2026). Previewing the component outside the store? Pass `Image={\\"img\\"}` (or your own component) to render a plain image. |\\n\\n## Async components (backend-backed, render-blocking data)\\n\\nIf a component must load data from a backend/API before it can render\\ncorrectly, make it async \u2014 don\'t render an empty shell and fetch in a\\n`useEffect`. Set `\\"async\\": true` in `manifest.json` and export an async\\ndefault. GreatStore waits for your promise (showing a normal loading\\nstate, so you don\'t render your own placeholder), then renders what it\\nresolves to. Components that render purely from their props stay\\nsynchronous.\\n\\nA thrown error is a **retry signal**: the in-store AI sees it and\\nusually re-calls the tool. So only throw when a *different* call could\\nhelp:\\n\\n1. `await` the backend call, then return the finished JSX.\\n2. Validate the AI-passed props first and throw on bad input \u2014 the AI\\n   can fix the args and retry. (Don\'t validate the API\'s *output* and\\n   throw: the AI can\'t fix the backend, it\'ll just loop.)\\n3. Broadcast a backend failure ONLY when retrying differently could\\n   succeed, and say what to change (e.g. empty search \u2192 \\"try a broader\\n   keyword\\"). For idempotent failures (500, timeout, missing record)\\n   re-running the same call changes nothing \u2014 render a graceful fallback\\n   instead of throwing.\\n\\n```tsx\\nexport default async function Example(props: Props) {\\n  if (!props.query?.trim()) throw new Error(\\"missing required prop: query\\");\\n  const res = await fetch(`/api/search?q=${encodeURIComponent(props.query)}`);\\n  if (res.ok) {\\n    const { results } = await res.json();\\n    if (results.length === 0)\\n      throw new Error(`no results for \\"${props.query}\\" \u2014 try a broader keyword`);\\n    return <ul>{/* render results */}</ul>;\\n  }\\n  return <p>Couldn\'t load results right now.</p>; // idempotent: don\'t throw\\n}\\n```\\n","root/README.md":"# GreatStore components\\n\\nCustom React components published to your GreatStore tenant. Each\\ncomponent lives in its own folder under `components/`.\\n\\n```\\nnpm install\\ngs apps init <component_name>      # add a new component\\ngs apps build                      # builds every components/<name>/bundle.js\\ngs apps push                       # uploads every changed component as a draft\\ngs apps publish <component_name>   # promote a specific component to live\\n```\\n\\n- `gs apps push` (no args) hashes each component and only uploads the ones\\n  that have changed since the last sync.\\n- `gs apps pull` (no args) refreshes every remote component into\\n  `components/<name>/`. Components with unsaved local edits are skipped\\n  with a warning; pass `--force` to overwrite.\\n\\nSee `AGENTS.md` for the design rules every component must follow\\n(em-based sizing, brand CSS variables) \u2014 it doubles as guidance for AI\\ncoding agents (`CLAUDE.md` / `GEMINI.md` symlink to it).\\n","root/package.json":"{\\n  \\"name\\": \\"greatstore-components\\",\\n  \\"version\\": \\"0.0.1\\",\\n  \\"private\\": true,\\n  \\"type\\": \\"module\\",\\n  \\"scripts\\": {\\n    \\"build\\": \\"gs apps build\\",\\n    \\"push\\": \\"gs apps build && gs apps push\\"\\n  },\\n  \\"dependencies\\": {\\n    \\"react\\": \\"^19.0.0\\",\\n    \\"react-dom\\": \\"^19.0.0\\"\\n  },\\n  \\"devDependencies\\": {\\n    \\"@types/react\\": \\"^19.0.0\\",\\n    \\"@types/react-dom\\": \\"^19.0.0\\",\\n    \\"@vitejs/plugin-react\\": \\"^4.3.0\\",\\n    \\"typescript\\": \\"^5.6.0\\",\\n    \\"vite\\": \\"^5.4.0\\"\\n  }\\n}\\n","root/tsconfig.json":"{\\n  \\"compilerOptions\\": {\\n    \\"target\\": \\"ES2022\\",\\n    \\"module\\": \\"ESNext\\",\\n    \\"moduleResolution\\": \\"Bundler\\",\\n    \\"jsx\\": \\"react-jsx\\",\\n    \\"lib\\": [\\"ES2022\\", \\"DOM\\"],\\n    \\"strict\\": true,\\n    \\"esModuleInterop\\": true,\\n    \\"skipLibCheck\\": true,\\n    \\"isolatedModules\\": true,\\n    \\"noEmit\\": true\\n  },\\n  \\"include\\": [\\"components/**/component.tsx\\", \\"vite.config.ts\\"]\\n}\\n","root/vite.config.ts":"import { defineConfig } from \\"vite\\";\\nimport react from \\"@vitejs/plugin-react\\";\\n\\n// Real builds happen in `gs build` (one Vite invocation per\\n// component, externals + runtime shim paths owned by the CLI). This\\n// file exists only so editors / language servers can resolve the\\n// React plugin when inspecting components/*/component.tsx.\\nexport default defineConfig({\\n  plugins: [react()],\\n});\\n"}') : readTreeFromDisk(new URL("../template/", import.meta.url));
+  cache = true ? JSON.parse('{"component/component.tsx":"import React from \\"react\\";\\n\\n// Add your tool args (matching manifest.json#inputSchema.properties)\\n// alongside the GreatStore-injected lifecycle props. See AGENTS.md for\\n// what each lifecycle prop does.\\ninterface Props {\\n  onSendMessage: (text: string) => void;\\n  onCallTool: (name: string, args: Record<string, unknown>) => void;\\n  onUpdateModelContext: (context: string) => void;\\n  onShowLightbox: (options: { src: string; originRect?: DOMRect }) => void;\\n  onClose: () => void;\\n  // Drop-in for <img>: `<Image src=\u2026 alt=\u2026 />`. See AGENTS.md.\\n  Image: React.ElementType<React.ComponentProps<\\"img\\">>;\\n}\\n\\n// See AGENTS.md for the design rules (em-based sizing, brand CSS\\n// variables), the lifecycle props, and how to write an async,\\n// backend-backed component.\\nexport default function __GS_PASCAL__(_props: Props): React.ReactElement {\\n  return (\\n    <div\\n      style={{\\n        padding: \\"1em\\",\\n        border: \\"1px solid var(--color-border-default)\\",\\n        borderRadius: \\"var(--radius-lg)\\",\\n        background: \\"var(--color-surface)\\",\\n        color: \\"var(--color-foreground)\\",\\n        fontFamily: \\"var(--font-primary)\\",\\n      }}\\n    >\\n      <strong>__GS_NAME__</strong> \u2014 hello from your component!\\n    </div>\\n  );\\n}\\n","component/manifest.json":"{\\n  \\"name\\": \\"__GS_NAME__\\",\\n  \\"displayName\\": \\"__GS_DISPLAY_NAME__\\",\\n  \\"description\\": \\"Renders the __GS_NAME__ widget.\\",\\n  \\"displayMode\\": \\"inline\\",\\n  \\"inputSchema\\": {\\n    \\"type\\": \\"object\\",\\n    \\"properties\\": {}\\n  }\\n}\\n","root/.gitignore":"node_modules/\\ncomponents/*/bundle.js\\ncomponents/*/.gssync.json\\n*.tsbuildinfo\\n.DS_Store\\n","root/.gsrc":"{\\n  \\"store\\": \\"__GS_STORE__\\"\\n}\\n","root/AGENTS.md":"# AGENTS.md\\n\\nGuidance for AI coding agents working on the components in this project.\\n`CLAUDE.md` and `GEMINI.md` are symlinks to this file.\\n\\nThese components render inside arbitrary publisher websites (the embed\\nwidget mounts on a host page) as well as the GreatStore storefront. You\\ncontrol neither the host page\'s base font size nor its color scheme, and\\nthe store owner controls the look from GreatStore theme settings. The\\nrules below keep components portable across both.\\n\\n## Design requirements\\n\\n### Never use `rem` for fonts and sizing \u2014 always use `em`\\n\\n`rem` resolves against the host page\'s root font size, which is\\narbitrary and outside our control. A host that sets `html { font-size:\\n8px }` (or 200%) will shrink or blow up every `rem`-based dimension.\\n`em` resolves against the component\'s own font size, so it stays\\nself-consistent wherever the component is mounted.\\n\\nUse `em` for font sizes, padding, margins, gaps, widths, heights,\\nand any other length. Borders may stay in `px` (hairlines should not\\nscale with text).\\n\\n```tsx\\n// Bad \u2014 breaks on hosts with a non-default root font size\\n<div style={{ padding: \\"1rem\\", fontSize: \\"0.875rem\\" }} />\\n\\n// Good\\n<div style={{ padding: \\"1em\\", fontSize: \\"0.875em\\" }} />\\n```\\n\\n### Don\'t hardcode colors, fonts, or corner radius \u2014 use GreatStore brand variables\\n\\nThe store owner themes the assistant from GreatStore settings. Hardcoded\\nvalues ignore that and make the component clash with the rest of the\\nstore. Read from the CSS variables GreatStore injects on the surface\\ninstead, so the component restyles itself when the theme changes.\\n\\nAvailable variables:\\n\\n| Purpose | Variable |\\n| --- | --- |\\n| Surface background | `--color-surface` |\\n| Secondary surface | `--color-surface-secondary` |\\n| Accent surface | `--color-surface-accent` |\\n| Hover surface | `--color-surface-hover` |\\n| Foreground text | `--color-foreground` |\\n| Secondary text | `--color-foreground-secondary` |\\n| Muted text | `--color-foreground-muted` |\\n| Accent text | `--color-foreground-accent` |\\n| Border | `--color-border-default` |\\n| Focus border | `--color-border-focus` |\\n| Primary / brand | `--color-primary` |\\n| Text on primary | `--color-primary-foreground` |\\n| Primary hover | `--color-primary-hover` |\\n| Primary muted | `--color-primary-muted` |\\n| Text on primary muted | `--color-primary-muted-foreground` |\\n| Primary tint | `--color-primary-tint` |\\n| Link | `--color-link` |\\n| Font family | `--font-primary` |\\n| Secondary font family | `--font-secondary` |\\n| Corner radius (scale) | `--radius-xs` \u2026 `--radius-4xl`, `--radius-pill` |\\n\\nThe store owner can set a secondary font family in their GreatStore\\ntheme settings, exposed as `--font-secondary` (it falls back to\\n`--font-primary` when unset). Reach for it to add a tasteful second\\nlayer of typography \u2014 pair `--font-primary` for body copy with\\n`--font-secondary` for headings, prices, or other accents \u2014 so the\\ncomponent reflects the store\'s full type system instead of a single\\nface.\\n\\n```tsx\\n// Bad \u2014 hardcoded, ignores the store\'s theme\\n<button style={{ background: \\"#4f46e5\\", borderRadius: 8, fontFamily: \\"Inter\\" }} />\\n\\n// Good\\n<button\\n  style={{\\n    background: \\"var(--color-primary)\\",\\n    color: \\"var(--color-primary-foreground)\\",\\n    borderRadius: \\"var(--radius-lg)\\",\\n    fontFamily: \\"var(--font-primary)\\",\\n  }}\\n/>\\n```\\n\\nProvide a sensible fallback only when a value might be absent, e.g.\\n`var(--color-primary, currentColor)`.\\n\\n## Component props\\n\\nEach component receives its tool args (the fields you declare in\\n`manifest.json#inputSchema.properties`) plus these GreatStore-injected\\nlifecycle props, which are always present:\\n\\n| Prop | What it does |\\n| --- | --- |\\n| `onSendMessage(text)` | Send text into the chat as if the shopper typed it. |\\n| `onCallTool(name, args)` | Chain into another remote-component tool by name. |\\n| `onUpdateModelContext(context)` | Inject invisible background context for the model (selected variant, configured options, current step). Replaces the prior value \u2014 never appends; pass `\\"\\"` to clear. Read on the next chat turn. Use it when the assistant should *know* in-component state without a visible message; use `onSendMessage` when you want a turn to happen now. |\\n| `onShowLightbox({ src, originRect? })` | Expand an image in the chat\'s shared full-screen lightbox \u2014 an on-brand zoom overlay your component can\'t render itself (it\'s boxed inside its own bounds and shadow root). Pass the image `src`; for a smooth zoom, also pass the clicked element\'s `getBoundingClientRect()` as `originRect` (omit it and the image grows from the viewport centre). |\\n| `onClose()` | Dismiss the host slot. Over-input clears the overlay, fullscreen reverts the pane, inline is a no-op. |\\n| `Image` | A drop-in for `<img>`: render `<Image src=\u2026 alt=\u2026 />` instead of `<img>` and your images are automatically served at the right size for the store. Takes the same props as `<img>` (`src`, `alt`, `style`, `loading`, `onClick`, \u2026). Previewing the component outside the store? Pass `Image={\\"img\\"}` (or your own component) to render a plain image. |\\n\\nYour props and `inputSchema.properties` must line up: `gs apps build`\\nerrors if the schema declares a field your component doesn\'t accept, and\\nwarns if your component declares a prop the schema doesn\'t (nothing will\\never pass it). The injected props above are exempt.\\n\\n## Async components (backend-backed, render-blocking data)\\n\\nIf a component must load data from a backend/API before it can render\\ncorrectly, make it async \u2014 don\'t render an empty shell and fetch in a\\n`useEffect`. Set `\\"async\\": true` in `manifest.json` and export an async\\ndefault. GreatStore waits for your promise (showing a normal loading\\nstate, so you don\'t render your own placeholder), then renders what it\\nresolves to. Components that render purely from their props stay\\nsynchronous.\\n\\nA thrown error is a **retry signal**: the in-store AI sees it and\\nusually re-calls the tool. So only throw when a *different* call could\\nhelp:\\n\\n1. `await` the backend call, then return the finished JSX.\\n2. Validate the AI-passed props first and throw on bad input \u2014 the AI\\n   can fix the args and retry. (Don\'t validate the API\'s *output* and\\n   throw: the AI can\'t fix the backend, it\'ll just loop.)\\n3. Broadcast a backend failure ONLY when retrying differently could\\n   succeed, and say what to change (e.g. empty search \u2192 \\"try a broader\\n   keyword\\"). For idempotent failures (500, timeout, missing record)\\n   re-running the same call changes nothing \u2014 render a graceful fallback\\n   instead of throwing.\\n\\n```tsx\\nexport default async function Example(props: Props) {\\n  if (!props.query?.trim()) throw new Error(\\"missing required prop: query\\");\\n  const res = await fetch(`/api/search?q=${encodeURIComponent(props.query)}`);\\n  if (res.ok) {\\n    const { results } = await res.json();\\n    if (results.length === 0)\\n      throw new Error(`no results for \\"${props.query}\\" \u2014 try a broader keyword`);\\n    return <ul>{/* render results */}</ul>;\\n  }\\n  return <p>Couldn\'t load results right now.</p>; // idempotent: don\'t throw\\n}\\n```\\n","root/README.md":"# GreatStore components\\n\\nCustom React components published to your GreatStore tenant. Each\\ncomponent lives in its own folder under `components/`.\\n\\n```\\nnpm install\\ngs apps init <component_name>      # add a new component\\ngs apps build                      # builds every components/<name>/bundle.js\\ngs apps push                       # uploads every changed component as a draft\\ngs apps publish <component_name>   # promote a specific component to live\\n```\\n\\n- `gs apps push` (no args) hashes each component and only uploads the ones\\n  that have changed since the last sync.\\n- `gs apps pull` (no args) refreshes every remote component into\\n  `components/<name>/`. Components with unsaved local edits are skipped\\n  with a warning; pass `--force` to overwrite.\\n\\nSee `AGENTS.md` for the design rules every component must follow\\n(em-based sizing, brand CSS variables) \u2014 it doubles as guidance for AI\\ncoding agents (`CLAUDE.md` / `GEMINI.md` symlink to it).\\n","root/package.json":"{\\n  \\"name\\": \\"greatstore-components\\",\\n  \\"version\\": \\"0.0.1\\",\\n  \\"private\\": true,\\n  \\"type\\": \\"module\\",\\n  \\"scripts\\": {\\n    \\"build\\": \\"gs apps build\\",\\n    \\"push\\": \\"gs apps build && gs apps push\\"\\n  },\\n  \\"dependencies\\": {\\n    \\"react\\": \\"^19.0.0\\",\\n    \\"react-dom\\": \\"^19.0.0\\"\\n  },\\n  \\"devDependencies\\": {\\n    \\"@types/react\\": \\"^19.0.0\\",\\n    \\"@types/react-dom\\": \\"^19.0.0\\",\\n    \\"@vitejs/plugin-react\\": \\"^4.3.0\\",\\n    \\"typescript\\": \\"^5.6.0\\",\\n    \\"vite\\": \\"^5.4.0\\"\\n  }\\n}\\n","root/tsconfig.json":"{\\n  \\"compilerOptions\\": {\\n    \\"target\\": \\"ES2022\\",\\n    \\"module\\": \\"ESNext\\",\\n    \\"moduleResolution\\": \\"Bundler\\",\\n    \\"jsx\\": \\"react-jsx\\",\\n    \\"lib\\": [\\"ES2022\\", \\"DOM\\"],\\n    \\"strict\\": true,\\n    \\"esModuleInterop\\": true,\\n    \\"skipLibCheck\\": true,\\n    \\"isolatedModules\\": true,\\n    \\"noEmit\\": true\\n  },\\n  \\"include\\": [\\"components/**/component.tsx\\", \\"vite.config.ts\\"]\\n}\\n","root/vite.config.ts":"import { defineConfig } from \\"vite\\";\\nimport react from \\"@vitejs/plugin-react\\";\\n\\n// Real builds happen in `gs build` (one Vite invocation per\\n// component, externals + runtime shim paths owned by the CLI). This\\n// file exists only so editors / language servers can resolve the\\n// React plugin when inspecting components/*/component.tsx.\\nexport default defineConfig({\\n  plugins: [react()],\\n});\\n"}') : readTreeFromDisk(new URL("../template/", import.meta.url));
   return cache;
 }
 var TOKENS = {
@@ -876,13 +876,424 @@ function pascal(name) {
 }
 
 // src/commands/apps/build.ts
+import * as fs6 from "fs";
+import * as path7 from "path";
+import { createRequire as createRequire2 } from "module";
+
+// src/validation/context.ts
 import * as fs5 from "fs";
-import * as path5 from "path";
+import * as path6 from "path";
+
+// src/validation/ast.ts
 import { createRequire } from "module";
+import * as path5 from "path";
+function analyzeComponentProps(root, sourcePath, sourceText) {
+  const ts = loadTypeScript(root);
+  if (!ts) {
+    return {
+      ok: false,
+      reason: "couldn't check props against the manifest \u2014 `typescript` isn't installed in this project (run `npm install`)"
+    };
+  }
+  try {
+    const sourceFile = ts.createSourceFile(
+      sourcePath,
+      sourceText,
+      ts.ScriptTarget.Latest,
+      true,
+      ts.ScriptKind.TSX
+    );
+    const fn = findDefaultExport(ts, sourceFile);
+    if (!fn) {
+      return {
+        ok: false,
+        reason: "couldn't find a default-exported component function to check props against \u2014 export the component as `export default function \u2026`"
+      };
+    }
+    return propsOfParameter(ts, sourceFile, fn);
+  } catch (err) {
+    return {
+      ok: false,
+      reason: `couldn't check props against the manifest \u2014 ${path5.basename(sourcePath)} could not be parsed (${err.message})`
+    };
+  }
+}
+function loadTypeScript(root) {
+  const localRequire = createRequire(path5.join(root, "package.json"));
+  try {
+    return localRequire("typescript");
+  } catch {
+    return null;
+  }
+}
+function findDefaultExport(ts, sourceFile) {
+  let assigned = null;
+  for (const statement of sourceFile.statements) {
+    if (ts.isFunctionDeclaration(statement) && hasDefaultModifier(ts, statement)) {
+      return statement;
+    }
+    if (ts.isExportAssignment(statement) && !statement.isExportEquals) {
+      assigned = statement.expression;
+    }
+  }
+  if (!assigned) return null;
+  const expression = unwrap(ts, assigned);
+  if (ts.isArrowFunction(expression) || ts.isFunctionExpression(expression)) {
+    return expression;
+  }
+  if (ts.isIdentifier(expression)) {
+    return findLocalFunction(ts, sourceFile, expression.text);
+  }
+  return null;
+}
+function hasDefaultModifier(ts, node) {
+  return node.modifiers?.some((m) => m.kind === ts.SyntaxKind.DefaultKeyword) ?? false;
+}
+function unwrap(ts, node) {
+  let current = node;
+  while (ts.isParenthesizedExpression(current) || ts.isAsExpression(current) || ts.isSatisfiesExpression(current)) {
+    current = current.expression;
+  }
+  return current;
+}
+function findLocalFunction(ts, sourceFile, name) {
+  for (const statement of sourceFile.statements) {
+    if (ts.isFunctionDeclaration(statement) && statement.name?.text === name) {
+      return statement;
+    }
+    if (!ts.isVariableStatement(statement)) continue;
+    for (const declaration of statement.declarationList.declarations) {
+      if (!ts.isIdentifier(declaration.name) || declaration.name.text !== name) continue;
+      if (!declaration.initializer) continue;
+      const initializer = unwrap(ts, declaration.initializer);
+      if (ts.isArrowFunction(initializer) || ts.isFunctionExpression(initializer)) {
+        return initializer;
+      }
+    }
+  }
+  return null;
+}
+function propsOfParameter(ts, sourceFile, fn) {
+  const parameter = fn.parameters[0];
+  if (!parameter) return { ok: true, props: { names: [], open: false } };
+  if (parameter.type) {
+    const fromType = namesFromTypeNode(ts, sourceFile, parameter.type, /* @__PURE__ */ new Set());
+    if (fromType) return { ok: true, props: fromType };
+  }
+  if (ts.isObjectBindingPattern(parameter.name)) {
+    return { ok: true, props: namesFromBindingPattern(ts, parameter.name) };
+  }
+  return {
+    ok: false,
+    reason: "couldn't check props against the manifest \u2014 declare the component's props as a local `interface`/`type` or destructure them in the signature"
+  };
+}
+function namesFromTypeNode(ts, sourceFile, node, seen) {
+  if (ts.isTypeLiteralNode(node)) {
+    return propsFromMembers(ts, node.members);
+  }
+  if (ts.isTypeReferenceNode(node) && ts.isIdentifier(node.typeName)) {
+    return namesFromTypeName(ts, sourceFile, node.typeName.text, seen);
+  }
+  if (ts.isIntersectionTypeNode(node)) {
+    const parts = node.types.map((t) => namesFromTypeNode(ts, sourceFile, t, seen));
+    if (parts.every((p) => p === null)) return null;
+    return mergeProps(parts.map((p) => p ?? { names: [], open: true }));
+  }
+  return null;
+}
+function namesFromTypeName(ts, sourceFile, name, seen) {
+  if (seen.has(name)) return { names: [], open: false };
+  seen.add(name);
+  for (const statement of sourceFile.statements) {
+    if (ts.isInterfaceDeclaration(statement) && statement.name.text === name) {
+      const own = propsFromMembers(ts, statement.members);
+      const bases = (statement.heritageClauses ?? []).flatMap(
+        (clause) => clause.types.map(
+          (base) => ts.isIdentifier(base.expression) ? namesFromTypeName(ts, sourceFile, base.expression.text, seen) ?? {
+            names: [],
+            open: true
+          } : { names: [], open: true }
+        )
+      );
+      return mergeProps([own, ...bases]);
+    }
+    if (ts.isTypeAliasDeclaration(statement) && statement.name.text === name) {
+      return namesFromTypeNode(ts, sourceFile, statement.type, seen);
+    }
+  }
+  return null;
+}
+function propsFromMembers(ts, members) {
+  const names = [];
+  let open = false;
+  for (const member of members) {
+    if (ts.isIndexSignatureDeclaration(member)) {
+      open = true;
+      continue;
+    }
+    if (!ts.isPropertySignature(member) && !ts.isMethodSignature(member)) continue;
+    const memberName = staticMemberName(ts, member.name);
+    if (memberName === null) {
+      open = true;
+      continue;
+    }
+    names.push(memberName);
+  }
+  return { names, open };
+}
+function namesFromBindingPattern(ts, pattern) {
+  const names = [];
+  let open = false;
+  for (const element of pattern.elements) {
+    if (element.dotDotDotToken) {
+      open = true;
+      continue;
+    }
+    const key = element.propertyName ?? element.name;
+    const name = staticMemberName(ts, key);
+    if (name === null) open = true;
+    else names.push(name);
+  }
+  return { names, open };
+}
+function staticMemberName(ts, name) {
+  if (ts.isIdentifier(name)) return name.text;
+  if (ts.isStringLiteral(name)) return name.text;
+  return null;
+}
+function mergeProps(parts) {
+  const names = [];
+  let open = false;
+  for (const part of parts) {
+    for (const name of part.names) {
+      if (!names.includes(name)) names.push(name);
+    }
+    open ||= part.open;
+  }
+  return { names, open };
+}
+
+// src/validation/context.ts
+function buildContext(paths) {
+  const { root, name } = paths;
+  const componentDir = path6.join(root, "components", name);
+  const manifestPath = paths.manifestPath ?? path6.join(componentDir, "manifest.json");
+  const sourcePath = paths.sourcePath ?? path6.join(componentDir, "component.tsx");
+  const manifestFile = relative4(root, manifestPath);
+  const sourceFile = relative4(root, sourcePath);
+  const diagnostics = [];
+  let manifest = null;
+  const manifestText = readIfPresent(manifestPath);
+  if (manifestText === null) {
+    diagnostics.push({
+      severity: "error",
+      rule: "manifest/missing",
+      file: manifestFile,
+      message: "manifest not found."
+    });
+  } else {
+    try {
+      const parsed = JSON.parse(manifestText);
+      if (!parsed || typeof parsed !== "object" || Array.isArray(parsed)) {
+        diagnostics.push({
+          severity: "error",
+          rule: "manifest/invalid",
+          file: manifestFile,
+          message: "manifest must be a JSON object."
+        });
+      } else {
+        manifest = parsed;
+      }
+    } catch (err) {
+      diagnostics.push({
+        severity: "error",
+        rule: "manifest/invalid",
+        file: manifestFile,
+        message: `manifest is not valid JSON: ${err.message}`
+      });
+    }
+  }
+  const sourceText = readIfPresent(sourcePath);
+  const props = sourceText === null ? { ok: false, reason: `couldn't check props against the manifest \u2014 ${sourceFile} not found` } : analyzeComponentProps(root, sourcePath, sourceText);
+  return {
+    ctx: { name, manifestFile, sourceFile, manifest, props },
+    diagnostics
+  };
+}
+function readIfPresent(file) {
+  try {
+    return fs5.readFileSync(file, "utf8");
+  } catch {
+    return null;
+  }
+}
+function relative4(root, target) {
+  const rel = path6.relative(root, target);
+  return rel.startsWith("..") ? target : rel.split(path6.sep).join("/");
+}
+
+// src/validation/injected-props.ts
+var INJECTED_PROPS = /* @__PURE__ */ new Set([
+  "onSendMessage",
+  "onCallTool",
+  "onClose",
+  "onUpdateModelContext",
+  "onShowLightbox",
+  "storeData",
+  "Image"
+]);
+
+// src/validation/rules/component-props.ts
+function componentPropsRule(ctx) {
+  if (!ctx.manifest) return [];
+  const schemaFields = schemaFieldNames(ctx.manifest.inputSchema);
+  if (schemaFields === null) return [];
+  if (!ctx.props.ok) {
+    return [
+      {
+        severity: "warning",
+        rule: "props/not-analyzable",
+        file: ctx.sourceFile,
+        message: `${ctx.props.reason}.`
+      }
+    ];
+  }
+  if (ctx.props.props.open) return [];
+  const declared = new Set(ctx.props.props.names);
+  const schema = new Set(schemaFields);
+  const diagnostics = [];
+  for (const prop of ctx.props.props.names) {
+    if (INJECTED_PROPS.has(prop) || schema.has(prop)) continue;
+    diagnostics.push({
+      severity: "warning",
+      rule: "props/undeclared",
+      file: ctx.sourceFile,
+      message: `prop \`${prop}\` is not declared in ${ctx.manifestFile}#inputSchema.properties, so nothing will ever pass it. Declare it in the schema, or drop it from the component.`
+    });
+  }
+  for (const field of schemaFields) {
+    if (declared.has(field)) continue;
+    diagnostics.push({
+      severity: "error",
+      rule: "props/missing",
+      file: ctx.sourceFile,
+      message: `${ctx.manifestFile} declares inputSchema field \`${field}\`, but the component does not accept a \`${field}\` prop. Add it to the component's props, or remove it from the schema.`
+    });
+  }
+  return diagnostics;
+}
+function schemaFieldNames(inputSchema) {
+  if (!inputSchema || typeof inputSchema !== "object") return null;
+  const properties = inputSchema["properties"];
+  if (!properties || typeof properties !== "object" || Array.isArray(properties)) {
+    return null;
+  }
+  return Object.keys(properties);
+}
+
+// src/validation/rules/input-schema-complexity.ts
+var MAX_SCHEMA_BYTES = 8 * 1024;
+var MAX_SCHEMA_FIELDS = 50;
+var UNION_KEYWORDS = ["anyOf", "oneOf", "allOf", "$ref", "not"];
+function measure(node, path14, acc) {
+  if (Array.isArray(node)) {
+    node.forEach((entry, i) => measure(entry, `${path14}[${i}]`, acc));
+    return;
+  }
+  if (!node || typeof node !== "object") return;
+  const record = node;
+  for (const keyword of UNION_KEYWORDS) {
+    if (keyword in record) acc.unionPaths.push(`${path14}.${keyword}`);
+  }
+  const properties = record["properties"];
+  if (properties && typeof properties === "object" && !Array.isArray(properties)) {
+    for (const [name, sub] of Object.entries(properties)) {
+      acc.fields += 1;
+      measure(sub, `${path14}.${name}`, acc);
+    }
+  }
+  if ("items" in record) measure(record["items"], `${path14}[]`, acc);
+}
+function inputSchemaComplexityRule(ctx) {
+  const inputSchema = ctx.manifest?.inputSchema;
+  if (!inputSchema || typeof inputSchema !== "object") return [];
+  const acc = {
+    bytes: Buffer.byteLength(JSON.stringify(inputSchema), "utf8"),
+    fields: 0,
+    unionPaths: []
+  };
+  measure(inputSchema, "inputSchema", acc);
+  const problems = [];
+  if (acc.unionPaths.length > 0) {
+    const shown = acc.unionPaths.slice(0, 3).join(", ");
+    const more = acc.unionPaths.length > 3 ? ` (+${acc.unionPaths.length - 3} more)` : "";
+    problems.push(
+      `uses ${shown}${more} \u2014 declare exactly one type per field; accept alternate shapes in component code instead`
+    );
+  }
+  if (acc.bytes > MAX_SCHEMA_BYTES) {
+    problems.push(
+      `is ${(acc.bytes / 1024).toFixed(1)} KB serialized (limit ${MAX_SCHEMA_BYTES / 1024} KB)`
+    );
+  }
+  if (acc.fields > MAX_SCHEMA_FIELDS) {
+    problems.push(`declares ${acc.fields} fields (limit ${MAX_SCHEMA_FIELDS})`);
+  }
+  if (problems.length === 0) return [];
+  return [
+    {
+      severity: "error",
+      rule: "manifest/input-schema-too-complex",
+      file: ctx.manifestFile,
+      message: `inputSchema ${problems.join("; ")}.
+A schema this complex is usually a sign the component is overengineered, and the assistant will fill it unreliably or stop calling the tool altogether. Keep it to a small set of flat, single-type fields (one canonical name per concept \u2014 no aliases), and let component code handle formatting, fallbacks, and edge cases.`
+    }
+  ];
+}
+
+// src/validation/rules/manifest-name.ts
+function manifestNameRule(ctx) {
+  const declared = ctx.manifest?.name;
+  if (typeof declared !== "string" || declared === ctx.name) return [];
+  return [
+    {
+      severity: "error",
+      rule: "manifest/name-mismatch",
+      file: ctx.manifestFile,
+      message: `manifest name "${declared}" does not match folder name "${ctx.name}".`
+    }
+  ];
+}
+
+// src/validation/types.ts
+function errorsIn(diagnostics) {
+  return diagnostics.filter((d) => d.severity === "error");
+}
+function warningsIn(diagnostics) {
+  return diagnostics.filter((d) => d.severity === "warning");
+}
+function formatDiagnostic(d) {
+  return `${d.severity === "error" ? "error" : "warning"}  ${d.file}: ${d.message}`;
+}
+
+// src/validation/index.ts
+var RULES = [
+  manifestNameRule,
+  inputSchemaComplexityRule,
+  componentPropsRule
+];
+function validateComponent(paths) {
+  const { ctx, diagnostics } = buildContext(paths);
+  for (const rule of RULES) diagnostics.push(...rule(ctx));
+  return { diagnostics, ok: errorsIn(diagnostics).length === 0 };
+}
+
+// src/commands/apps/build.ts
 var COMPONENTS_DIR = "components";
 async function buildCommand(args) {
   const root = process.cwd();
-  if (!fs5.existsSync(path5.join(root, "package.json")) || !fs5.existsSync(path5.join(root, COMPONENTS_DIR))) {
+  if (!fs6.existsSync(path7.join(root, "package.json")) || !fs6.existsSync(path7.join(root, COMPONENTS_DIR))) {
     throw new Error(
       `\`gs apps build\` must run from a project root (contains \`package.json\` and \`${COMPONENTS_DIR}/\`). Current dir: ${root}`
     );
@@ -900,16 +1311,33 @@ async function buildCommand(args) {
   if (target && queue.length === 0) {
     throw new Error(`No component named "${target}" in ./${COMPONENTS_DIR}`);
   }
-  const { build, reactPlugin, transformWithEsbuild } = await loadVite(root);
+  const invalid = [];
+  const buildable = [];
   for (const name of queue) {
-    const dir = path5.join(root, COMPONENTS_DIR, name);
-    const bundlePath = path5.join(dir, "bundle.js");
+    const report = validateComponent({ root, name });
+    for (const diagnostic of report.diagnostics) {
+      process.stdout.write(`  ${formatDiagnostic(diagnostic)}
+`);
+    }
+    (report.ok ? buildable : invalid).push(name);
+  }
+  if (buildable.length === 0) {
+    process.stdout.write(`
+Nothing built \u2014 fix the errors above.
+`);
+    process.exitCode = 1;
+    return;
+  }
+  const { build, reactPlugin, transformWithEsbuild } = await loadVite(root);
+  for (const name of buildable) {
+    const dir = path7.join(root, COMPONENTS_DIR, name);
+    const bundlePath = path7.join(dir, "bundle.js");
     await build({
       plugins: [reactPlugin()],
       logLevel: "warn",
       build: {
         lib: {
-          entry: path5.join(dir, "component.tsx"),
+          entry: path7.join(dir, "component.tsx"),
           formats: ["es"],
           fileName: () => "bundle.js"
         },
@@ -930,8 +1358,8 @@ async function buildCommand(args) {
         sourcemap: false
       }
     });
-    const beforeBytes = fs5.statSync(bundlePath).size;
-    const src = fs5.readFileSync(bundlePath, "utf8");
+    const beforeBytes = fs6.statSync(bundlePath).size;
+    const src = fs6.readFileSync(bundlePath, "utf8");
     const { code } = await transformWithEsbuild(src, bundlePath, {
       minify: true,
       legalComments: "none",
@@ -939,13 +1367,22 @@ async function buildCommand(args) {
       loader: "js",
       sourcemap: false
     });
-    fs5.writeFileSync(bundlePath, code);
+    fs6.writeFileSync(bundlePath, code);
     const afterBytes = Buffer.byteLength(code, "utf8");
     process.stdout.write(
       `built ${COMPONENTS_DIR}/${name}/bundle.js (${formatBytes(afterBytes)}, ${pctSmaller(beforeBytes, afterBytes)} smaller)
 `
     );
   }
+  if (invalid.length > 0) {
+    process.stdout.write(
+      `
+Not built (fix the errors above): ${invalid.join(", ")}
+`
+    );
+    process.exitCode = 1;
+    return;
+  }
   process.stdout.write(
     `
 Built locally \u2014 nothing uploaded yet. Next: \`gs apps push\` to upload, then \`gs apps publish <name>\` to ship. If you're an AI assistant: confirm with the user before running these (or just run them if they already asked you to ship end-to-end).
@@ -953,10 +1390,10 @@ Built locally \u2014 nothing uploaded yet. Next: \`gs apps push\` to upload, the
   );
 }
 function listComponents(root) {
-  const dir = path5.join(root, COMPONENTS_DIR);
-  return fs5.readdirSync(dir).filter((entry) => {
-    const candidate = path5.join(dir, entry);
-    return fs5.statSync(candidate).isDirectory() && fs5.existsSync(path5.join(candidate, "component.tsx"));
+  const dir = path7.join(root, COMPONENTS_DIR);
+  return fs6.readdirSync(dir).filter((entry) => {
+    const candidate = path7.join(dir, entry);
+    return fs6.statSync(candidate).isDirectory() && fs6.existsSync(path7.join(candidate, "component.tsx"));
   }).sort();
 }
 function formatBytes(n) {
@@ -968,7 +1405,7 @@ function pctSmaller(before, after) {
   return `${Math.round((1 - after / before) * 100)}%`;
 }
 async function loadVite(root) {
-  const localRequire = createRequire(path5.join(root, "package.json"));
+  const localRequire = createRequire2(path7.join(root, "package.json"));
   const vitePath = resolveEsmEntry(localRequire, "vite");
   if (!vitePath) {
     throw new Error(
@@ -1016,30 +1453,30 @@ function resolveEsmEntry(req, specifier) {
   }
   const pkgJsonPath = findOwningPackageJson(anchor, specifier);
   if (!pkgJsonPath) return null;
-  const pkgDir = path5.dirname(pkgJsonPath);
+  const pkgDir = path7.dirname(pkgJsonPath);
   let pkg;
   try {
-    pkg = JSON.parse(fs5.readFileSync(pkgJsonPath, "utf8"));
+    pkg = JSON.parse(fs6.readFileSync(pkgJsonPath, "utf8"));
   } catch {
     return null;
   }
   const fromExports = pickImportEntry(pkg.exports);
   const entry = fromExports ?? (typeof pkg.module === "string" ? pkg.module : null) ?? (typeof pkg.main === "string" ? pkg.main : null);
   if (!entry) return null;
-  return path5.resolve(pkgDir, entry);
+  return path7.resolve(pkgDir, entry);
 }
 function findOwningPackageJson(start, specifier) {
-  let dir = path5.dirname(start);
+  let dir = path7.dirname(start);
   while (true) {
-    const candidate = path5.join(dir, "package.json");
-    if (fs5.existsSync(candidate)) {
+    const candidate = path7.join(dir, "package.json");
+    if (fs6.existsSync(candidate)) {
       try {
-        const parsed = JSON.parse(fs5.readFileSync(candidate, "utf8"));
+        const parsed = JSON.parse(fs6.readFileSync(candidate, "utf8"));
         if (parsed.name === specifier) return candidate;
       } catch {
       }
     }
-    const parent = path5.dirname(dir);
+    const parent = path7.dirname(dir);
     if (parent === dir) return null;
     dir = parent;
   }
@@ -1099,36 +1536,36 @@ function pad(s, width) {
 }
 
 // src/commands/apps/pull.ts
-import * as fs7 from "fs";
-import * as path7 from "path";
+import * as fs8 from "fs";
+import * as path9 from "path";
 
 // src/sync.ts
 import * as crypto2 from "crypto";
-import * as fs6 from "fs";
-import * as path6 from "path";
+import * as fs7 from "fs";
+import * as path8 from "path";
 var SYNC_FILE = ".gssync.json";
 function hashString(text) {
   return crypto2.createHash("sha256").update(text).digest("hex");
 }
 function hashFile(filePath) {
-  if (!fs6.existsSync(filePath)) return null;
-  return hashString(fs6.readFileSync(filePath, "utf8"));
+  if (!fs7.existsSync(filePath)) return null;
+  return hashString(fs7.readFileSync(filePath, "utf8"));
 }
 function computeComponentHashes(componentDir) {
-  const manifestHash = hashFile(path6.join(componentDir, "manifest.json"));
+  const manifestHash = hashFile(path8.join(componentDir, "manifest.json"));
   if (manifestHash === null) {
     throw new Error(`Missing manifest.json in ${componentDir}`);
   }
   return {
     manifestHash,
-    sourceHash: hashFile(path6.join(componentDir, "component.tsx"))
+    sourceHash: hashFile(path8.join(componentDir, "component.tsx"))
   };
 }
 function readSyncState(componentDir) {
-  const file = path6.join(componentDir, SYNC_FILE);
-  if (!fs6.existsSync(file)) return null;
+  const file = path8.join(componentDir, SYNC_FILE);
+  if (!fs7.existsSync(file)) return null;
   try {
-    const parsed = JSON.parse(fs6.readFileSync(file, "utf8"));
+    const parsed = JSON.parse(fs7.readFileSync(file, "utf8"));
     if (typeof parsed.version === "number" && typeof parsed.manifestHash === "string" && typeof parsed.sourceHash === "string") {
       return {
         version: parsed.version,
@@ -1142,8 +1579,8 @@ function readSyncState(componentDir) {
   }
 }
 function writeSyncState(componentDir, state) {
-  fs6.writeFileSync(
-    path6.join(componentDir, SYNC_FILE),
+  fs7.writeFileSync(
+    path8.join(componentDir, SYNC_FILE),
     JSON.stringify(state, null, 2) + "\n"
   );
 }
@@ -1184,7 +1621,7 @@ async function pullCommand(args) {
   for (const name of targets) {
     const outcome = await pullOne({
       slug,
-      componentDir: path7.join(root, "components", name),
+      componentDir: path9.join(root, "components", name),
       name,
       revisionQuery,
       force
@@ -1213,7 +1650,7 @@ async function pullAll(opts) {
   }
   const outcomes = [];
   for (const entry of list.components) {
-    const componentDir = path7.join(root, "components", entry.name);
+    const componentDir = path9.join(root, "components", entry.name);
     const outcome = await pullOne({
       slug,
       componentDir,
@@ -1241,7 +1678,7 @@ ${summary.join(", ")} (of ${outcomes.length}) \u2190 ${slug}
 }
 async function pullOne(opts) {
   const { slug, componentDir, name, revisionQuery, force } = opts;
-  if (!force && fs7.existsSync(componentDir)) {
+  if (!force && fs8.existsSync(componentDir)) {
     const sync = readSyncState(componentDir);
     if (hasLocalChanges(componentDir, sync)) {
       return {
@@ -1262,14 +1699,14 @@ async function pullOne(opts) {
       message: err instanceof Error ? err.message : String(err)
     };
   }
-  fs7.mkdirSync(componentDir, { recursive: true });
+  fs8.mkdirSync(componentDir, { recursive: true });
   const manifestText = JSON.stringify(data.manifest, null, 2) + "\n";
-  fs7.writeFileSync(path7.join(componentDir, "manifest.json"), manifestText);
-  fs7.writeFileSync(path7.join(componentDir, "bundle.js"), data.bundle);
+  fs8.writeFileSync(path9.join(componentDir, "manifest.json"), manifestText);
+  fs8.writeFileSync(path9.join(componentDir, "bundle.js"), data.bundle);
   const wrote = ["manifest.json", "bundle.js"];
   let sourceHash = "";
   if (data.source !== null) {
-    fs7.writeFileSync(path7.join(componentDir, "component.tsx"), data.source);
+    fs8.writeFileSync(path9.join(componentDir, "component.tsx"), data.source);
     wrote.push("component.tsx");
     sourceHash = hashString(data.source);
   }
@@ -1287,7 +1724,7 @@ async function pullOne(opts) {
   return { name, status: "pulled", version: data.version, wrote };
 }
 function ensureComponentsDir(root) {
-  fs7.mkdirSync(path7.join(root, "components"), { recursive: true });
+  fs8.mkdirSync(path9.join(root, "components"), { recursive: true });
 }
 function buildRevisionQuery(args) {
   const version = flagString(args.flags, "version");
@@ -1321,72 +1758,14 @@ function printOutcome(outcome, force) {
 }
 
 // src/commands/apps/push.ts
-import * as fs8 from "fs";
-import * as path8 from "path";
-
-// src/commands/apps/manifest-lint.ts
-var MAX_SCHEMA_BYTES = 8 * 1024;
-var MAX_SCHEMA_FIELDS = 50;
-var UNION_KEYWORDS = ["anyOf", "oneOf", "allOf", "$ref", "not"];
-function measure(node, path12, acc) {
-  if (Array.isArray(node)) {
-    node.forEach((entry, i) => measure(entry, `${path12}[${i}]`, acc));
-    return;
-  }
-  if (!node || typeof node !== "object") return;
-  const record = node;
-  for (const keyword of UNION_KEYWORDS) {
-    if (keyword in record) acc.unionPaths.push(`${path12}.${keyword}`);
-  }
-  const properties = record["properties"];
-  if (properties && typeof properties === "object" && !Array.isArray(properties)) {
-    for (const [name, sub] of Object.entries(properties)) {
-      acc.fields += 1;
-      measure(sub, `${path12}.${name}`, acc);
-    }
-  }
-  if ("items" in record) measure(record["items"], `${path12}[]`, acc);
-}
-function assertSaneInputSchema(label, inputSchema) {
-  if (!inputSchema || typeof inputSchema !== "object") return;
-  const acc = {
-    bytes: Buffer.byteLength(JSON.stringify(inputSchema), "utf8"),
-    fields: 0,
-    unionPaths: []
-  };
-  measure(inputSchema, "inputSchema", acc);
-  const problems = [];
-  if (acc.unionPaths.length > 0) {
-    const shown = acc.unionPaths.slice(0, 3).join(", ");
-    const more = acc.unionPaths.length > 3 ? ` (+${acc.unionPaths.length - 3} more)` : "";
-    problems.push(
-      `uses ${shown}${more} \u2014 declare exactly one type per field; accept alternate shapes in component code instead`
-    );
-  }
-  if (acc.bytes > MAX_SCHEMA_BYTES) {
-    problems.push(
-      `is ${(acc.bytes / 1024).toFixed(1)} KB serialized (limit ${MAX_SCHEMA_BYTES / 1024} KB)`
-    );
-  }
-  if (acc.fields > MAX_SCHEMA_FIELDS) {
-    problems.push(
-      `declares ${acc.fields} fields (limit ${MAX_SCHEMA_FIELDS})`
-    );
-  }
-  if (problems.length === 0) return;
-  throw new Error(
-    `${label}: inputSchema ${problems.join("; ")}.
-A schema this complex is usually a sign the component is overengineered, and the assistant will fill it unreliably or stop calling the tool altogether. Keep it to a small set of flat, single-type fields (one canonical name per concept \u2014 no aliases), and let component code handle formatting, fallbacks, and edge cases.`
-  );
-}
-
-// src/commands/apps/push.ts
+import * as fs9 from "fs";
+import * as path10 from "path";
 async function pushCommand(args) {
   const slug = requireProjectStore();
   const root = process.cwd();
   rejectLegacyLayout(root);
-  const componentsDir = path8.join(root, "components");
-  if (!fs8.existsSync(componentsDir)) {
+  const componentsDir = path10.join(root, "components");
+  if (!fs9.existsSync(componentsDir)) {
     throw new Error(
       "No components/ directory here. Run `gs apps init <name>` to scaffold the project root and your first component."
     );
@@ -1445,53 +1824,43 @@ ${summary.join(", ")} (of ${outcomes.length}) \u2192 ${slug}
 }
 async function pushOne(opts) {
   const { slug, root, name, force } = opts;
-  const componentDir = path8.join(root, "components", name);
-  if (!fs8.existsSync(componentDir)) {
+  const componentDir = path10.join(root, "components", name);
+  if (!fs9.existsSync(componentDir)) {
     return {
       name,
       status: "failed",
       message: `components/${name}/ does not exist`
     };
   }
-  const manifestPath = opts.manifestPath ? path8.resolve(opts.manifestPath) : path8.join(componentDir, "manifest.json");
-  const bundlePath = opts.bundlePath ? path8.resolve(opts.bundlePath) : path8.join(componentDir, "bundle.js");
-  const sourcePath = path8.join(componentDir, "component.tsx");
-  if (!fs8.existsSync(manifestPath)) {
-    return { name, status: "failed", message: `manifest not found: ${manifestPath}` };
-  }
-  if (!fs8.existsSync(bundlePath)) {
+  const manifestPath = opts.manifestPath ? path10.resolve(opts.manifestPath) : path10.join(componentDir, "manifest.json");
+  const bundlePath = opts.bundlePath ? path10.resolve(opts.bundlePath) : path10.join(componentDir, "bundle.js");
+  const sourcePath = path10.join(componentDir, "component.tsx");
+  if (!fs9.existsSync(bundlePath)) {
     return {
       name,
       status: "failed",
       message: `bundle not found: ${bundlePath} (did you run \`npm run build\`?)`
     };
   }
-  const manifestText = fs8.readFileSync(manifestPath, "utf8");
-  let manifestName;
-  let manifestInputSchema;
-  try {
-    const parsed = JSON.parse(manifestText);
-    if (typeof parsed.name === "string") manifestName = parsed.name;
-    manifestInputSchema = parsed.inputSchema;
-  } catch (err) {
-    return {
-      name,
-      status: "failed",
-      message: `manifest is not valid JSON: ${err.message}`
-    };
+  const report = validateComponent({
+    root,
+    name,
+    manifestPath,
+    sourcePath
+  });
+  for (const diagnostic of warningsIn(report.diagnostics)) {
+    process.stdout.write(`  ${formatDiagnostic(diagnostic)}
+`);
   }
-  if (manifestName && manifestName !== name) {
+  if (!report.ok) {
     return {
       name,
       status: "failed",
-      message: `manifest name "${manifestName}" does not match folder name "${name}"`
+      message: errorsIn(report.diagnostics).map((d) => `${d.file}: ${d.message}`).join(`
+${OUTCOME_INDENT}`)
     };
   }
-  try {
-    assertSaneInputSchema(`components/${name}/manifest.json`, manifestInputSchema);
-  } catch (err) {
-    return { name, status: "failed", message: err.message };
-  }
+  const manifestText = fs9.readFileSync(manifestPath, "utf8");
   if (!force) {
     const hashes2 = computeComponentHashes(componentDir);
     const sync = readSyncState(componentDir);
@@ -1500,8 +1869,8 @@ async function pushOne(opts) {
       return { name, status: "unchanged" };
     }
   }
-  const bundleText = fs8.readFileSync(bundlePath, "utf8");
-  const sourceText = fs8.existsSync(sourcePath) ? fs8.readFileSync(sourcePath, "utf8") : null;
+  const bundleText = fs9.readFileSync(bundlePath, "utf8");
+  const sourceText = fs9.existsSync(sourcePath) ? fs9.readFileSync(sourcePath, "utf8") : null;
   const form = new FormData();
   form.append(
     "manifest",
@@ -1545,15 +1914,15 @@ async function pushOne(opts) {
   };
 }
 function listLocalComponents(componentsDir) {
-  return fs8.readdirSync(componentsDir).filter((entry) => {
-    const dir = path8.join(componentsDir, entry);
-    return fs8.statSync(dir).isDirectory() && fs8.existsSync(path8.join(dir, "manifest.json"));
+  return fs9.readdirSync(componentsDir).filter((entry) => {
+    const dir = path10.join(componentsDir, entry);
+    return fs9.statSync(dir).isDirectory() && fs9.existsSync(path10.join(dir, "manifest.json"));
   }).sort();
 }
 function rejectLegacyLayout(root) {
-  const rootManifest = path8.join(root, "manifest.json");
-  const componentsDir = path8.join(root, "components");
-  if (fs8.existsSync(rootManifest) && !fs8.existsSync(componentsDir)) {
+  const rootManifest = path10.join(root, "manifest.json");
+  const componentsDir = path10.join(root, "components");
+  if (fs9.existsSync(rootManifest) && !fs9.existsSync(componentsDir)) {
     throw new Error(
       [
         "Detected the old single-component layout (manifest.json at the project root).",
@@ -1564,6 +1933,7 @@ function rejectLegacyLayout(root) {
     );
   }
 }
+var OUTCOME_INDENT = " ".repeat("  failed    ".length);
 function printOutcome2(outcome) {
   switch (outcome.status) {
     case "pushed":
@@ -1794,8 +2164,8 @@ function formatList(list) {
 }
 
 // src/commands/configure/set.ts
-import * as fs9 from "fs";
-import * as path9 from "path";
+import * as fs10 from "fs";
+import * as path11 from "path";
 var TEXT_FIELDS = [
   "displayName",
   "assistantName",
@@ -1855,11 +2225,11 @@ async function setConfig(args) {
 `);
 }
 function readTextFile(filePath, flag) {
-  const resolved = path9.resolve(filePath);
-  if (!fs9.existsSync(resolved)) {
+  const resolved = path11.resolve(filePath);
+  if (!fs10.existsSync(resolved)) {
     throw new Error(`${flag}: file not found: ${resolved}`);
   }
-  return fs9.readFileSync(resolved, "utf8");
+  return fs10.readFileSync(resolved, "utf8");
 }
 function parseThemeJson(raw, flag) {
   let parsed;
@@ -1875,8 +2245,8 @@ function parseThemeJson(raw, flag) {
 }
 
 // src/commands/configure/upload.ts
-import * as fs10 from "fs";
-import * as path10 from "path";
+import * as fs11 from "fs";
+import * as path12 from "path";
 
 // src/commands/configure/shared.ts
 var ASSET_KINDS = ["icon", "logoLight", "logoDark"];
@@ -1901,20 +2271,20 @@ async function uploadAsset(args) {
   if (!filePath) {
     throw new Error(`Usage: gs configure upload <${ASSET_KINDS.join("|")}> <file>`);
   }
-  const resolved = path10.resolve(filePath);
-  if (!fs10.existsSync(resolved)) {
+  const resolved = path12.resolve(filePath);
+  if (!fs11.existsSync(resolved)) {
     throw new Error(`File not found: ${resolved}`);
   }
-  const mime = MIME_BY_EXT[path10.extname(resolved).toLowerCase()];
+  const mime = MIME_BY_EXT[path12.extname(resolved).toLowerCase()];
   if (!mime) {
     throw new Error("Unsupported image type. Use .png, .jpg, or .webp.");
   }
-  const bytes = fs10.readFileSync(resolved);
+  const bytes = fs11.readFileSync(resolved);
   const form = new FormData();
   form.append(
     "file",
     new Blob([new Uint8Array(bytes)], { type: mime }),
-    path10.basename(resolved)
+    path12.basename(resolved)
   );
   const url = `${adminApiBase(slug)}/configure/upload/${kind}`;
   const data = await request(url, {
@@ -2232,9 +2602,9 @@ function recentChangelog(text, minItems = 15) {
 }
 
 // src/version-check.ts
-import * as fs11 from "fs";
+import * as fs12 from "fs";
 import * as os3 from "os";
-import * as path11 from "path";
+import * as path13 from "path";
 var REFRESH_COMMAND = "__refresh-version-cache";
 var PKG = "@greatstore/cli";
 var REGISTRY_URL = `https://registry.npmjs.org/${PKG}/latest`;
@@ -2295,11 +2665,11 @@ async function fetchLatest() {
   }
 }
 function cachePath(home) {
-  return path11.join(home, ".greatstore", "version-check.json");
+  return path13.join(home, ".greatstore", "version-check.json");
 }
 function readCache(home) {
   try {
-    const raw = fs11.readFileSync(cachePath(home), "utf8");
+    const raw = fs12.readFileSync(cachePath(home), "utf8");
     const parsed = JSON.parse(raw);
     if (typeof parsed.latest === "string" && typeof parsed.checkedAt === "number") {
       return { latest: parsed.latest, checkedAt: parsed.checkedAt };
@@ -2311,8 +2681,8 @@ function readCache(home) {
 function writeCache(home, cache3) {
   try {
     const file = cachePath(home);
-    fs11.mkdirSync(path11.dirname(file), { recursive: true });
-    fs11.writeFileSync(file, JSON.stringify(cache3));
+    fs12.mkdirSync(path13.dirname(file), { recursive: true });
+    fs12.writeFileSync(file, JSON.stringify(cache3));
   } catch {
   }
 }
@@ -2334,8 +2704,8 @@ function parseVer(v) {
 }
 
 // src/index.ts
-var VERSION = true ? "0.0.42" : "0.0.0-dev";
-var CHANGELOG = true ? "# Changelog\n\nAll notable changes to `@greatstore/cli` are recorded here. The format\nfollows [Keep a Changelog](https://keepachangelog.com/).\n\n## 0.0.42 \u2014 2026-08-15\n\n### Changed\n- `gs apps list` now works outside a project. With no `.gsrc` it lists the\n  components of the store you're signed in to, instead of erroring. The\n  commands that write files or change the store \u2014 `push`, `pull`, `publish`,\n  `unpublish`, `delete` \u2014 still require a project.\n\n## 0.0.41 \u2014 2026-08-14\n\n### Changed\n- Internal authentication rework. Re-run `gs login` after updating.\n\n## 0.0.40 \u2014 2026-07-24\n\n### Removed\n- `gs configure set` no longer accepts `--salesGuide` or\n  `--salesGuideFile`, and `gs configure show` no longer lists the field.\n\n## 0.0.39 \u2014 2026-07-21\n\n### Added\n- Components now receive an `Image` prop \u2014 a drop-in for `<img>` that\n  serves images at the size they're displayed. Render `<Image src=\u2026 />`\n  instead of `<img>`; pass `Image={\"img\"}` to preview a component\n  outside a store. Scaffolded into `gs apps init` and documented in\n  `AGENTS.md`.\n\n## 0.0.38 \u2014 2026-07-13\n\n### Added\n- `gs login --store <slug>` skips the store picker and signs in\n  directly to that store \u2014 fails immediately if your account doesn't\n  have access to it, instead of falling back to the picker.\n\n## 0.0.37 \u2014 2026-07-10\n\n### Added\n- Signing in now ends by choosing which store to work on \u2014 skipped\n  automatically when your account has exactly one. Commands default to\n  that store, so `--store` is rarely needed anymore.\n- `gs switch [<slug>]` changes the working store without signing in\n  again.\n- `gs apps init` no longer requires `--store` when your sign-in already\n  selected a store.\n\n### Changed\n- A `--store` flag or project `.gsrc` that names a different store than\n  the one you signed in to is now an error, so work can't accidentally\n  target the wrong store. Run `gs switch` to change stores.\n\n## 0.0.33 \u2014 2026-07-10\n\n### Changed\n- `gs apps push` now rejects a component whose `inputSchema` is too\n  complex for the assistant to call reliably: union keywords\n  (`anyOf`/`oneOf`/`allOf`/`$ref`/`not`), more than 8 KB serialized, or\n  more than 50 declared fields. Keep schemas to a small set of flat,\n  single-type fields \u2014 one canonical name per concept \u2014 and handle\n  aliases or edge cases in component code instead.\n\n## 0.0.32 \u2014 2026-06-18\n\n### Added\n- Chat components can expand an image into a full-screen, on-brand\n  lightbox via a new `onShowLightbox({ src, originRect })` prop. Wire it\n  to an image's `onClick` \u2014 pass the image URL and, for a smooth zoom,\n  the clicked element's `getBoundingClientRect()`. Use it for product\n  photos, swatches, or size charts the shopper may want to inspect up\n  close, instead of building your own overlay.\n\n## 0.0.31 \u2014 2026-06-18\n\n### Added\n- Components can read a secondary brand font from `--font-secondary`,\n  for a second layer of typography. Falls back to the primary font.\n\n### Changed\n- The brand font variable is now `--font-primary` (was `--font-sans`).\n\n## 0.0.30 \u2014 2026-06-17\n\n### Added\n- The agent skill documents a new way to give the assistant background\n  context without sending a visible message:\n  `window.GreatStore.updateModelContext(text)` on the page, and the\n  matching `onUpdateModelContext(text)` prop inside a chat component. Use\n  it to keep the assistant aware of what the shopper is doing \u2014 the\n  product they're viewing, what's in their cart, the variant they just\n  selected \u2014 so its replies stay on point. Each call replaces the previous\n  value, and nothing renders in the chat.\n\n## 0.0.29 \u2014 2026-06-12\n\n### Fixed\n- The \"update available\" notice actually fires now. It previously raced\n  a 1-second timeout against the npm registry and usually lost, so most\n  installs never saw it. The notice is now served instantly from a local\n  cache, refreshed in the background after each day's first invocation \u2014\n  it can lag one run behind a release, but it no longer adds latency or\n  goes silent on slow networks.\n\n## 0.0.28 \u2014 2026-06-12\n\n### Added\n- `gs configure` \u2014 view and edit the store configuration from the CLI:\n  display name, assistant name, sales guide, store link, extra origins,\n  theme, CSP host lists, and icon/logo uploads. Same fields and\n  behaviour as the dashboard's Configure panel.\n- `gs connectors` \u2014 manage the store's MCP connectors: list, add (with\n  a discovery probe before saving), remove, enable/disable, toggle the\n  Maker MCP, and health-check. Same behaviour as the dashboard's\n  Connectors panel.\n- `--store <slug>` on the new admin commands, so they work outside a\n  scaffolded component project (a `.gsrc` is still used when present).\n- The agent skill gains a store-administration reference: coding agents\n  can read the store's configuration and connectors to ground their\n  work, self-serve additive changes like origin allowlists and CSP\n  hosts (read-merge-write), and are told which changes need the\n  merchant's go-ahead first.\n\n### Changed\n- Component commands now live under `gs apps` (`gs apps push`,\n  `gs apps build`, \u2026), matching the dashboard's Apps panel. The old\n  top-level forms keep working as aliases, so existing scripts and\n  scaffolded projects are unaffected.\n- The skill's structured-content guide now teaches \"point, don't\n  paste\": name the SKU/product/collection and let GreatStore research\n  the catalog itself instead of inlining fetched specs; validate with\n  `gs connectors` that a connector exists for the data a prompt or\n  schema depends on (research can't exceed the wired-up connectors);\n  and never put shopper data in prompts \u2014 GreatStore already knows the\n  shopper, and identified shoppers get per-shopper cached responses.\n\n## 0.0.27 \u2014 2026-06-11\n\n### Changed\n- Skill code samples now carry an explicit reference-only disclaimer:\n  coding agents are told to re-express the logic in the host repo's\n  framework (React, Vue, Shopify Liquid, Svelte, \u2026) instead of\n  retrofitting the framework-free samples as-is.\n\n## 0.0.26 \u2014 2026-06-11\n\n### Added\n- The agent skill gains a \"GreatStore launchers\" recipe: a horizontally\n  scrollable row of AI-generated chips, each an engaging first-person\n  question about the current page that's sent to the assistant on tap.\n\n### Changed\n- Skill recipes are now one file each under `recipes/`, indexed from\n  SKILL.md by a table with description and use-case columns.\n\n## 0.0.25 \u2014 2026-06-11\n\n### Added\n- `gs skill` installs the GreatStore agent skill \u2014 a guide AI coding\n  agents use to build with GreatStore: AI content for your own UI, chat\n  entry points, page tools, custom in-chat components, push\n  notifications, and the store's MCP endpoints. Installs into\n  `./.claude/skills/`; use `--global` for `~/.claude/skills/`, or\n  `--dir <path>` for agents that read skills from somewhere else. Run\n  it again any time to update an installed copy.\n\n## 0.0.24 \u2014 2026-06-03\n\n### Changed\n- `gs init` in an existing project now fills in any scaffold files that\n  are missing (for example, the `AGENTS.md` design guide added in\n  0.0.23) and leaves your own files alone. Pass `--force` to refresh\n  every scaffold file to the latest version. Your pinned store\n  (`.gsrc`) is never rewritten either way.\n\n## 0.0.23 \u2014 2026-06-03\n\n### Added\n- `gs init` now scaffolds an `AGENTS.md` (with `CLAUDE.md` and\n  `GEMINI.md` symlinked to it) documenting the design rules every\n  component should follow \u2014 use `em` rather than `rem` for sizing, and\n  style from the provided brand CSS variables so components match the\n  store's theme. It doubles as guidance for AI coding agents.\n\n## 0.0.22 \u2014 2026-06-02\n\n### Added\n- `gs list` now shows a link to each component's page in the dashboard,\n  so you can jump straight to a component to preview or publish it. The\n  link is also included in `gs list --json`.\n\n## 0.0.21 \u2014 2026-05-31\n\n### Changed\n- The `gs init` component scaffold now shows how to write **async**\n  components that load data before they render \u2014 including validating\n  inputs up front and signalling a failure by throwing. The scaffolded\n  component no longer includes an `onError` prop; throw from an async\n  component to report a failure instead.\n\n## 0.0.20 \u2014 2026-05-29\n\n### Added\n- `gs pull`, `gs push`, and `gs publish` now accept several component\n  names at once (e.g. `gs publish header footer cart`). Each component\n  is reported on its own line and one failure no longer stops the rest.\n\n## 0.0.19 \u2014 2026-05-28\n\n### Fixed\n- `gs login` on Windows no longer opens a sign-in URL with parameters\n  stripped, which surfaced as a \"Missing redirect_uri or state\n  parameter\" page in the browser.\n\n## 0.0.18 \u2014 2026-05-28\n\n### Changed\n- Push and publish errors now name the specific reason \u2014 including\n  every failing field in `manifest.json` \u2014 instead of the previous\n  generic message.\n\n## 0.0.17 \u2014 2026-05-28\n\n### Added\n- Each command now prints a one-line upgrade notice when a newer\n  `@greatstore/cli` is available on npm.\n\n## 0.0.16 \u2014 2026-05-28\n\n### Changed\n- Simplified error messages.\n\n## 0.0.15 \u2014 2026-05-24\n\n### Added\n- Scaffolded `component.tsx` now declares the four injected lifecycle\n  props (`onSendMessage`, `onCallTool`, `onClose`, `onError`) on\n  `Props`. Use `onError(message)` to report expected failures (failed\n  fetch, host action rejected, invalid host state) so the AI can\n  recover on its next turn. Render-time crashes are reported for you.\n\n## 0.0.14 \u2014 2026-05-24\n\n### Changed\n- `gs build` output is now whitespace-minified \u2014 typically ~50% smaller.\n\n## 0.0.13 \u2014 2026-05-24\n\n### Changed\n- `gs build` prints the next-step hint (`gs push`, then `gs publish`).\n\n## 0.0.12 \u2014 2026-05-24\n\n### Fixed\n- `gs build` failing to load Vite in some setups.\n\n## 0.0.11 \u2014 2026-05-24\n\n### Added\n- Multi-component projects. `gs init` (no args) scaffolds the project\n  root; `gs init <name>` adds a component under `components/<name>/`.\n- `gs build [<name>]` \u2014 compiles every `components/<name>/bundle.js`.\n- `gs push` (no args) uploads only the components that changed.\n- `gs pull` (no args, or `*`) downloads every component. Locally\n  edited components are skipped; pass `--force` to overwrite.\n- Public `CHANGELOG.md`; `gs --version` prints recent entries.\n\n### Changed\n- A project folder ships to exactly one store. Only `gs init` accepts\n  `--store`; every other command reads the slug from `.gsrc`. The old\n  single-component layout is rejected with a migration hint.\n- `gs init` requires `--store <slug>` for a fresh root, and rejects\n  `--store` on an existing root.\n- `gs init` no longer writes `build.mjs` \u2014 scripts call `gs build`.\n\n## 0.0.10 \u2014 2026-05-23\n\n### Changed\n- The sign-in browser tab auto-closes once `gs login` finishes.\n\n## 0.0.9 \u2014 2026-05-23\n\n### Changed\n- Scaffolded manifests include a `displayName` so the admin UI has a\n  friendlier label.\n\n## 0.0.8 \u2014 2026-05-23\n\n### Changed\n- `gs push` and `gs publish` print a link to view the component.\n\n## 0.0.6 \u2014 2026-05-23\n\n### Changed\n- `gs --version` reads from the published package version.\n\n## 0.0.4 \u2014 2026-05-23\n\n### Changed\n- Scaffolded projects produce browser-ready bundles out of the box.\n\n## 0.0.3 \u2014 2026-05-23\n\n### Changed\n- Trimmed public README to the essentials.\n\n## 0.0.2 \u2014 2026-05-23\n\n### Fixed\n- Sign-in callback parameter handling.\n" : "";
+var VERSION = true ? "0.0.43" : "0.0.0-dev";
+var CHANGELOG = true ? "# Changelog\n\nAll notable changes to `@greatstore/cli` are recorded here. The format\nfollows [Keep a Changelog](https://keepachangelog.com/).\n\n## 0.0.43 \u2014 2026-08-18\n\n### Added\n- `gs apps build` and `gs apps push` now check each component before\n  building or uploading it. Findings are reported as **errors** (a\n  blocker \u2014 the component isn't built or uploaded) or **warnings** (it\n  builds and is ready to publish, but something is worth improving),\n  and a single run reports everything it found rather than stopping at\n  the first problem.\n- New check: a component's props and its `inputSchema.properties` must\n  agree. A schema field the component doesn't accept is an error; a prop\n  the schema doesn't declare is a warning, since nothing will ever pass\n  it. The props GreatStore injects (`onSendMessage`, `onCallTool`,\n  `onUpdateModelContext`, `onShowLightbox`, `onClose`, `storeData`,\n  `Image`) are exempt.\n\n## 0.0.42 \u2014 2026-08-15\n\n### Changed\n- `gs apps list` now works outside a project. With no `.gsrc` it lists the\n  components of the store you're signed in to, instead of erroring. The\n  commands that write files or change the store \u2014 `push`, `pull`, `publish`,\n  `unpublish`, `delete` \u2014 still require a project.\n\n## 0.0.41 \u2014 2026-08-14\n\n### Changed\n- Internal authentication rework. Re-run `gs login` after updating.\n\n## 0.0.40 \u2014 2026-07-24\n\n### Removed\n- `gs configure set` no longer accepts `--salesGuide` or\n  `--salesGuideFile`, and `gs configure show` no longer lists the field.\n\n## 0.0.39 \u2014 2026-07-21\n\n### Added\n- Components now receive an `Image` prop \u2014 a drop-in for `<img>` that\n  serves images at the size they're displayed. Render `<Image src=\u2026 />`\n  instead of `<img>`; pass `Image={\"img\"}` to preview a component\n  outside a store. Scaffolded into `gs apps init` and documented in\n  `AGENTS.md`.\n\n## 0.0.38 \u2014 2026-07-13\n\n### Added\n- `gs login --store <slug>` skips the store picker and signs in\n  directly to that store \u2014 fails immediately if your account doesn't\n  have access to it, instead of falling back to the picker.\n\n## 0.0.37 \u2014 2026-07-10\n\n### Added\n- Signing in now ends by choosing which store to work on \u2014 skipped\n  automatically when your account has exactly one. Commands default to\n  that store, so `--store` is rarely needed anymore.\n- `gs switch [<slug>]` changes the working store without signing in\n  again.\n- `gs apps init` no longer requires `--store` when your sign-in already\n  selected a store.\n\n### Changed\n- A `--store` flag or project `.gsrc` that names a different store than\n  the one you signed in to is now an error, so work can't accidentally\n  target the wrong store. Run `gs switch` to change stores.\n\n## 0.0.33 \u2014 2026-07-10\n\n### Changed\n- `gs apps push` now rejects a component whose `inputSchema` is too\n  complex for the assistant to call reliably: union keywords\n  (`anyOf`/`oneOf`/`allOf`/`$ref`/`not`), more than 8 KB serialized, or\n  more than 50 declared fields. Keep schemas to a small set of flat,\n  single-type fields \u2014 one canonical name per concept \u2014 and handle\n  aliases or edge cases in component code instead.\n\n## 0.0.32 \u2014 2026-06-18\n\n### Added\n- Chat components can expand an image into a full-screen, on-brand\n  lightbox via a new `onShowLightbox({ src, originRect })` prop. Wire it\n  to an image's `onClick` \u2014 pass the image URL and, for a smooth zoom,\n  the clicked element's `getBoundingClientRect()`. Use it for product\n  photos, swatches, or size charts the shopper may want to inspect up\n  close, instead of building your own overlay.\n\n## 0.0.31 \u2014 2026-06-18\n\n### Added\n- Components can read a secondary brand font from `--font-secondary`,\n  for a second layer of typography. Falls back to the primary font.\n\n### Changed\n- The brand font variable is now `--font-primary` (was `--font-sans`).\n\n## 0.0.30 \u2014 2026-06-17\n\n### Added\n- The agent skill documents a new way to give the assistant background\n  context without sending a visible message:\n  `window.GreatStore.updateModelContext(text)` on the page, and the\n  matching `onUpdateModelContext(text)` prop inside a chat component. Use\n  it to keep the assistant aware of what the shopper is doing \u2014 the\n  product they're viewing, what's in their cart, the variant they just\n  selected \u2014 so its replies stay on point. Each call replaces the previous\n  value, and nothing renders in the chat.\n\n## 0.0.29 \u2014 2026-06-12\n\n### Fixed\n- The \"update available\" notice actually fires now. It previously raced\n  a 1-second timeout against the npm registry and usually lost, so most\n  installs never saw it. The notice is now served instantly from a local\n  cache, refreshed in the background after each day's first invocation \u2014\n  it can lag one run behind a release, but it no longer adds latency or\n  goes silent on slow networks.\n\n## 0.0.28 \u2014 2026-06-12\n\n### Added\n- `gs configure` \u2014 view and edit the store configuration from the CLI:\n  display name, assistant name, sales guide, store link, extra origins,\n  theme, CSP host lists, and icon/logo uploads. Same fields and\n  behaviour as the dashboard's Configure panel.\n- `gs connectors` \u2014 manage the store's MCP connectors: list, add (with\n  a discovery probe before saving), remove, enable/disable, toggle the\n  Maker MCP, and health-check. Same behaviour as the dashboard's\n  Connectors panel.\n- `--store <slug>` on the new admin commands, so they work outside a\n  scaffolded component project (a `.gsrc` is still used when present).\n- The agent skill gains a store-administration reference: coding agents\n  can read the store's configuration and connectors to ground their\n  work, self-serve additive changes like origin allowlists and CSP\n  hosts (read-merge-write), and are told which changes need the\n  merchant's go-ahead first.\n\n### Changed\n- Component commands now live under `gs apps` (`gs apps push`,\n  `gs apps build`, \u2026), matching the dashboard's Apps panel. The old\n  top-level forms keep working as aliases, so existing scripts and\n  scaffolded projects are unaffected.\n- The skill's structured-content guide now teaches \"point, don't\n  paste\": name the SKU/product/collection and let GreatStore research\n  the catalog itself instead of inlining fetched specs; validate with\n  `gs connectors` that a connector exists for the data a prompt or\n  schema depends on (research can't exceed the wired-up connectors);\n  and never put shopper data in prompts \u2014 GreatStore already knows the\n  shopper, and identified shoppers get per-shopper cached responses.\n\n## 0.0.27 \u2014 2026-06-11\n\n### Changed\n- Skill code samples now carry an explicit reference-only disclaimer:\n  coding agents are told to re-express the logic in the host repo's\n  framework (React, Vue, Shopify Liquid, Svelte, \u2026) instead of\n  retrofitting the framework-free samples as-is.\n\n## 0.0.26 \u2014 2026-06-11\n\n### Added\n- The agent skill gains a \"GreatStore launchers\" recipe: a horizontally\n  scrollable row of AI-generated chips, each an engaging first-person\n  question about the current page that's sent to the assistant on tap.\n\n### Changed\n- Skill recipes are now one file each under `recipes/`, indexed from\n  SKILL.md by a table with description and use-case columns.\n\n## 0.0.25 \u2014 2026-06-11\n\n### Added\n- `gs skill` installs the GreatStore agent skill \u2014 a guide AI coding\n  agents use to build with GreatStore: AI content for your own UI, chat\n  entry points, page tools, custom in-chat components, push\n  notifications, and the store's MCP endpoints. Installs into\n  `./.claude/skills/`; use `--global` for `~/.claude/skills/`, or\n  `--dir <path>` for agents that read skills from somewhere else. Run\n  it again any time to update an installed copy.\n\n## 0.0.24 \u2014 2026-06-03\n\n### Changed\n- `gs init` in an existing project now fills in any scaffold files that\n  are missing (for example, the `AGENTS.md` design guide added in\n  0.0.23) and leaves your own files alone. Pass `--force` to refresh\n  every scaffold file to the latest version. Your pinned store\n  (`.gsrc`) is never rewritten either way.\n\n## 0.0.23 \u2014 2026-06-03\n\n### Added\n- `gs init` now scaffolds an `AGENTS.md` (with `CLAUDE.md` and\n  `GEMINI.md` symlinked to it) documenting the design rules every\n  component should follow \u2014 use `em` rather than `rem` for sizing, and\n  style from the provided brand CSS variables so components match the\n  store's theme. It doubles as guidance for AI coding agents.\n\n## 0.0.22 \u2014 2026-06-02\n\n### Added\n- `gs list` now shows a link to each component's page in the dashboard,\n  so you can jump straight to a component to preview or publish it. The\n  link is also included in `gs list --json`.\n\n## 0.0.21 \u2014 2026-05-31\n\n### Changed\n- The `gs init` component scaffold now shows how to write **async**\n  components that load data before they render \u2014 including validating\n  inputs up front and signalling a failure by throwing. The scaffolded\n  component no longer includes an `onError` prop; throw from an async\n  component to report a failure instead.\n\n## 0.0.20 \u2014 2026-05-29\n\n### Added\n- `gs pull`, `gs push`, and `gs publish` now accept several component\n  names at once (e.g. `gs publish header footer cart`). Each component\n  is reported on its own line and one failure no longer stops the rest.\n\n## 0.0.19 \u2014 2026-05-28\n\n### Fixed\n- `gs login` on Windows no longer opens a sign-in URL with parameters\n  stripped, which surfaced as a \"Missing redirect_uri or state\n  parameter\" page in the browser.\n\n## 0.0.18 \u2014 2026-05-28\n\n### Changed\n- Push and publish errors now name the specific reason \u2014 including\n  every failing field in `manifest.json` \u2014 instead of the previous\n  generic message.\n\n## 0.0.17 \u2014 2026-05-28\n\n### Added\n- Each command now prints a one-line upgrade notice when a newer\n  `@greatstore/cli` is available on npm.\n\n## 0.0.16 \u2014 2026-05-28\n\n### Changed\n- Simplified error messages.\n\n## 0.0.15 \u2014 2026-05-24\n\n### Added\n- Scaffolded `component.tsx` now declares the four injected lifecycle\n  props (`onSendMessage`, `onCallTool`, `onClose`, `onError`) on\n  `Props`. Use `onError(message)` to report expected failures (failed\n  fetch, host action rejected, invalid host state) so the AI can\n  recover on its next turn. Render-time crashes are reported for you.\n\n## 0.0.14 \u2014 2026-05-24\n\n### Changed\n- `gs build` output is now whitespace-minified \u2014 typically ~50% smaller.\n\n## 0.0.13 \u2014 2026-05-24\n\n### Changed\n- `gs build` prints the next-step hint (`gs push`, then `gs publish`).\n\n## 0.0.12 \u2014 2026-05-24\n\n### Fixed\n- `gs build` failing to load Vite in some setups.\n\n## 0.0.11 \u2014 2026-05-24\n\n### Added\n- Multi-component projects. `gs init` (no args) scaffolds the project\n  root; `gs init <name>` adds a component under `components/<name>/`.\n- `gs build [<name>]` \u2014 compiles every `components/<name>/bundle.js`.\n- `gs push` (no args) uploads only the components that changed.\n- `gs pull` (no args, or `*`) downloads every component. Locally\n  edited components are skipped; pass `--force` to overwrite.\n- Public `CHANGELOG.md`; `gs --version` prints recent entries.\n\n### Changed\n- A project folder ships to exactly one store. Only `gs init` accepts\n  `--store`; every other command reads the slug from `.gsrc`. The old\n  single-component layout is rejected with a migration hint.\n- `gs init` requires `--store <slug>` for a fresh root, and rejects\n  `--store` on an existing root.\n- `gs init` no longer writes `build.mjs` \u2014 scripts call `gs build`.\n\n## 0.0.10 \u2014 2026-05-23\n\n### Changed\n- The sign-in browser tab auto-closes once `gs login` finishes.\n\n## 0.0.9 \u2014 2026-05-23\n\n### Changed\n- Scaffolded manifests include a `displayName` so the admin UI has a\n  friendlier label.\n\n## 0.0.8 \u2014 2026-05-23\n\n### Changed\n- `gs push` and `gs publish` print a link to view the component.\n\n## 0.0.6 \u2014 2026-05-23\n\n### Changed\n- `gs --version` reads from the published package version.\n\n## 0.0.4 \u2014 2026-05-23\n\n### Changed\n- Scaffolded projects produce browser-ready bundles out of the box.\n\n## 0.0.3 \u2014 2026-05-23\n\n### Changed\n- Trimmed public README to the essentials.\n\n## 0.0.2 \u2014 2026-05-23\n\n### Fixed\n- Sign-in callback parameter handling.\n" : "";
 var HELP = `gs \u2014 GreatStore CLI (v${VERSION})
 
 Usage:

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@greatstore/cli",
-  "version": "0.0.42",
+  "version": "0.0.43",
   "description": "CLI for administering GreatStore stores and authoring custom components.",
   "license": "UNLICENSED",
   "type": "module",