@ggui-ai/mcp-server-handlers 0.24.0 → 0.26.0

package/dist/ops-apps/types.d.ts

@@ -1,26 +1,25 @@
 /**
- * Seam types for the `ops-apps` MCP tool family. Mirrors the
- * data-model rows that back the console's Apps + Account surfaces
- * (the `GguiApp` and `GguiUser` records). Pure over
- * `@ggui-ai/protocol` shapes — NO AWS / database imports. Cloud
- * deployments bind an AWS-backed implementation; tests bind
+ * Seam types for the `ops-apps` MCP tool family: an app record
+ * (`GguiApp`) and the user's default-app setting (`GguiUser`). Pure over
+ * `@ggui-ai/protocol` shapes — no storage or database imports. A
+ * deployment binds an implementation over its own store; tests bind
  * in-memory fakes.
  *
  * Why an explicit seam vs threading a database client directly: the
- * shared-handler layer must be the same code path with or without a
- * cloud backend. The `AppsSource` interface IS the boundary — wired
- * to a real datastore in production, wired to a Map in tests.
+ * shared-handler layer must be the same code path whatever store sits
+ * behind it. The `AppsSource` interface IS the boundary — wired to a
+ * real datastore in production, wired to a Map in tests.
  */
 import type { AppTheme } from '@ggui-ai/protocol';
 /**
  * One app record, projected for MCP-tool readers. Pure data — no
- * relations, no backend-internal fields. Cloud adapters map the
- * stored model row onto this shape; tests construct it directly.
+ * relations, no store-internal fields. An adapter maps its stored row
+ * onto this shape; tests construct it directly.
  */
 export interface AppRecord {
-    /** Opaque base62 `<8 chars>` — server-minted when the app is provisioned. */
+    /** Opaque id, minted by the store when the app is created; never caller-supplied. */
     readonly appId: string;
-    /** FK to the owning user's Cognito sub. Used for ownership gates. */
+    /** The owning user's id (`resolveOwnerSub`). Used for ownership gates. */
     readonly ownerSub: string;
     /** User-editable label. */
     readonly displayName: string;
@@ -58,7 +57,7 @@ export interface AppUpdatePatch {
     readonly rateLimitPerMinute?: number;
 }
 /**
- * Read+write seam for `GguiApp` rows. Cloud deployments bind a
+ * Read+write seam for `GguiApp` rows. A deployment binds a
  * datastore-backed implementation; tests implement it against
  * in-memory state.
  *
@@ -66,8 +65,8 @@ export interface AppUpdatePatch {
  *   - `list(ownerSub)` returns only the rows the caller owns. The
  *     implementation does NOT leak rows from other users.
  *   - `create({ ownerSub, displayName })` mints a fresh `appId`
- *     server-side (cloud: base62 + collision retry; in-memory: any
- *     unique string). Argument-supplied appIds are NOT honored — that
+ *     server-side (a database store: its own id format, with a retry
+ *     on collision; in-memory: any unique string). Argument-supplied appIds are NOT honored — that
  *     would be an app-takeover vector.
  *   - `update`, `delete`, `setTheme` reject when the row's
  *     `ownerSub` doesn't match the caller's. Implementations either
@@ -138,8 +137,8 @@ export interface AppsSource {
 /**
  * Read+write seam for the `defaultAppId` column on `GguiUser`. Separate
  * interface from `AppsSource` because the column lives on a different
- * table — keeping the seams disjoint lets the cloud adapter bind two
- * unrelated mutations without one interface dragging in the other.
+ * record — keeping the seams disjoint lets an adapter bind two
+ * unrelated writes without one interface dragging in the other.
  *
  * The handler chains `AppsSource.get` (verify the user owns the target)
  * before calling `setDefault` so writes never point at a foreign app.
@@ -166,9 +165,8 @@ export declare class AppNotFoundError extends Error {
  *
  * `defaultAppId` is what the universal route resolves on every
  * request; deleting the app it names would leave that route pointing
- * at a row that no longer exists. Same lock the console's Delete
- * enforces — the operator picks a different default first, then
- * deletes.
+ * at a row that no longer exists. A UI's delete should enforce the same
+ * lock — the operator picks a different default first, then deletes.
  */
 export declare class DefaultAppDeleteBlockedError extends Error {
     readonly code: "default_app_delete_blocked";
@@ -177,9 +175,8 @@ export declare class DefaultAppDeleteBlockedError extends Error {
 /**
  * Thrown by adapters that prefer surfacing access denial over the
  * "treat as not-found" privacy posture. Handlers translate to the
- * uniform "not found" shape — the error class exists so cloud
- * adapters can be specific in their logs without callers parsing
- * strings.
+ * uniform "not found" shape — the error class exists so adapters can
+ * be specific in their logs without callers parsing strings.
  */
 export declare class OpsAppsAccessDeniedError extends Error {
     readonly code: "ops_apps_access_denied";

package/dist/ops-apps/types.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../src/ops-apps/types.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AACH,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,mBAAmB,CAAC;AAElD;;;;GAIG;AACH,MAAM,WAAW,SAAS;IACxB,6EAA6E;IAC7E,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,qEAAqE;IACrE,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,2BAA2B;IAC3B,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,+CAA+C;IAC/C,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM,CAAC;IAC/B;;;;OAIG;IACH,QAAQ,CAAC,kBAAkB,CAAC,EAAE,MAAM,CAAC;IACrC,sDAAsD;IACtD,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,+CAA+C;IAC/C,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;CAC5B;AAED;;;;;;;;;;;GAWG;AACH,MAAM,WAAW,cAAc;IAC7B,0DAA0D;IAC1D,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAC;IAC9B,wEAAwE;IACxE,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM,CAAC;IAC/B,oEAAoE;IACpE,QAAQ,CAAC,kBAAkB,CAAC,EAAE,MAAM,CAAC;CACtC;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,MAAM,WAAW,UAAU;IACzB,2DAA2D;IAC3D,IAAI,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,SAAS,SAAS,EAAE,CAAC,CAAC;IACtD,0FAA0F;IAC1F,GAAG,CAAC,IAAI,EAAE;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,QAAQ,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC,SAAS,GAAG,IAAI,CAAC,CAAC;IAC1E,0DAA0D;IAC1D,MAAM,CAAC,IAAI,EAAE;QAAE,QAAQ,EAAE,MAAM,CAAC;QAAC,WAAW,CAAC,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC,SAAS,CAAC,CAAC;IAC7E;;;;;OAKG;IACH,MAAM,CAAC,IAAI,EAAE;QACX,KAAK,EAAE,MAAM,CAAC;QACd,QAAQ,EAAE,MAAM,CAAC;QACjB,KAAK,EAAE,cAAc,CAAC;KACvB,GAAG,OAAO,CAAC,SAAS,CAAC,CAAC;IACvB;;;;;;;;;;;;;;;;;;OAkBG;IACH,MAAM,CAAC,IAAI,EAAE;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,QAAQ,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACjE;;;OAGG;IACH,QAAQ,CAAC,IAAI,EAAE;QACb,KAAK,EAAE,MAAM,CAAC;QACd,QAAQ,EAAE,MAAM,CAAC;QACjB,KAAK,EAAE,QAAQ,CAAC;KACjB,GAAG,OAAO,CAAC;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,SAAS,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;CACnD;AAED;;;;;;;;GAQG;AACH,MAAM,WAAW,oBAAoB;IACnC,gEAAgE;IAChE,UAAU,CAAC,IAAI,EAAE;QAAE,QAAQ,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACrE,0EAA0E;IAC1E,UAAU,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAAC;CACtD;AAED;;;GAGG;AACH,qBAAa,gBAAiB,SAAQ,KAAK;IACzC,QAAQ,CAAC,IAAI,EAAG,eAAe,CAAU;gBAC7B,KAAK,EAAE,MAAM;CAI1B;AAED;;;;;;;;GAQG;AACH,qBAAa,4BAA6B,SAAQ,KAAK;IACrD,QAAQ,CAAC,IAAI,EAAG,4BAA4B,CAAU;gBAC1C,KAAK,EAAE,MAAM;CAM1B;AAED;;;;;;GAMG;AACH,qBAAa,wBAAyB,SAAQ,KAAK;IACjD,QAAQ,CAAC,IAAI,EAAG,wBAAwB,CAAU;gBACtC,OAAO,EAAE,MAAM;CAI5B"}
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../src/ops-apps/types.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AACH,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,mBAAmB,CAAC;AAElD;;;;GAIG;AACH,MAAM,WAAW,SAAS;IACxB,qFAAqF;IACrF,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,0EAA0E;IAC1E,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,2BAA2B;IAC3B,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,+CAA+C;IAC/C,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM,CAAC;IAC/B;;;;OAIG;IACH,QAAQ,CAAC,kBAAkB,CAAC,EAAE,MAAM,CAAC;IACrC,sDAAsD;IACtD,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,+CAA+C;IAC/C,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;CAC5B;AAED;;;;;;;;;;;GAWG;AACH,MAAM,WAAW,cAAc;IAC7B,0DAA0D;IAC1D,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAC;IAC9B,wEAAwE;IACxE,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM,CAAC;IAC/B,oEAAoE;IACpE,QAAQ,CAAC,kBAAkB,CAAC,EAAE,MAAM,CAAC;CACtC;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,MAAM,WAAW,UAAU;IACzB,2DAA2D;IAC3D,IAAI,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,SAAS,SAAS,EAAE,CAAC,CAAC;IACtD,0FAA0F;IAC1F,GAAG,CAAC,IAAI,EAAE;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,QAAQ,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC,SAAS,GAAG,IAAI,CAAC,CAAC;IAC1E,0DAA0D;IAC1D,MAAM,CAAC,IAAI,EAAE;QAAE,QAAQ,EAAE,MAAM,CAAC;QAAC,WAAW,CAAC,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC,SAAS,CAAC,CAAC;IAC7E;;;;;OAKG;IACH,MAAM,CAAC,IAAI,EAAE;QACX,KAAK,EAAE,MAAM,CAAC;QACd,QAAQ,EAAE,MAAM,CAAC;QACjB,KAAK,EAAE,cAAc,CAAC;KACvB,GAAG,OAAO,CAAC,SAAS,CAAC,CAAC;IACvB;;;;;;;;;;;;;;;;;;OAkBG;IACH,MAAM,CAAC,IAAI,EAAE;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,QAAQ,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACjE;;;OAGG;IACH,QAAQ,CAAC,IAAI,EAAE;QACb,KAAK,EAAE,MAAM,CAAC;QACd,QAAQ,EAAE,MAAM,CAAC;QACjB,KAAK,EAAE,QAAQ,CAAC;KACjB,GAAG,OAAO,CAAC;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,SAAS,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;CACnD;AAED;;;;;;;;GAQG;AACH,MAAM,WAAW,oBAAoB;IACnC,gEAAgE;IAChE,UAAU,CAAC,IAAI,EAAE;QAAE,QAAQ,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACrE,0EAA0E;IAC1E,UAAU,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAAC;CACtD;AAED;;;GAGG;AACH,qBAAa,gBAAiB,SAAQ,KAAK;IACzC,QAAQ,CAAC,IAAI,EAAG,eAAe,CAAU;gBAC7B,KAAK,EAAE,MAAM;CAI1B;AAED;;;;;;;GAOG;AACH,qBAAa,4BAA6B,SAAQ,KAAK;IACrD,QAAQ,CAAC,IAAI,EAAG,4BAA4B,CAAU;gBAC1C,KAAK,EAAE,MAAM;CAM1B;AAED;;;;;GAKG;AACH,qBAAa,wBAAyB,SAAQ,KAAK;IACjD,QAAQ,CAAC,IAAI,EAAG,wBAAwB,CAAU;gBACtC,OAAO,EAAE,MAAM;CAI5B"}

package/dist/ops-apps/types.js

@@ -14,9 +14,8 @@ export class AppNotFoundError extends Error {
  *
  * `defaultAppId` is what the universal route resolves on every
  * request; deleting the app it names would leave that route pointing
- * at a row that no longer exists. Same lock the console's Delete
- * enforces — the operator picks a different default first, then
- * deletes.
+ * at a row that no longer exists. A UI's delete should enforce the same
+ * lock — the operator picks a different default first, then deletes.
  */
 export class DefaultAppDeleteBlockedError extends Error {
     code = 'default_app_delete_blocked';
@@ -28,9 +27,8 @@ export class DefaultAppDeleteBlockedError extends Error {
 /**
  * Thrown by adapters that prefer surfacing access denial over the
  * "treat as not-found" privacy posture. Handlers translate to the
- * uniform "not found" shape — the error class exists so cloud
- * adapters can be specific in their logs without callers parsing
- * strings.
+ * uniform "not found" shape — the error class exists so adapters can
+ * be specific in their logs without callers parsing strings.
  */
 export class OpsAppsAccessDeniedError extends Error {
     code = 'ops_apps_access_denied';

package/dist/ops-blueprint/cache-mirror.d.ts

@@ -0,0 +1,41 @@
+/**
+ * How an ops writer mirrors its durable row into the cache registry
+ * (ggui#1497): under ONE id.
+ *
+ * `ggui_ops_register_blueprint` (with `createRegisterGeneratedBlueprint`,
+ * which shares its core) and `ggui_ops_generate_blueprint` each put the
+ * durable row first, then mirror it into the cache so the exact-key probe
+ * finds it. The mirror used to mint an id of its own, so a render served
+ * from that cache row recorded an id the writer's store never held. The
+ * mirror now takes the writer's id (`mintId`), and what else it writes
+ * depends on where re-mint reads:
+ *
+ * - The mirror's registry writes through to a durable store OTHER than the
+ *   writer's (a server that keeps its re-mint store apart from the ops
+ *   store): the full write-through runs, now under the shared id, so the
+ *   store re-mint reads holds the row and the compiled body under the id
+ *   the cache serves.
+ * - It writes through to the writer's OWN store: the row is already there
+ *   under this id, and the store refuses a second put of it, so the mirror
+ *   skips the row but still puts the compiled body into its code store,
+ *   where re-mint reads it.
+ * - No durable store (a code store at most): nothing more is written; the
+ *   writer's own store and body are what re-mint reads.
+ *
+ * The authored source still reaches a bound code store in every case
+ * (ggui#1493). A dedup is unchanged: an exact key already bound returns its
+ * existing id, and nothing more is written for it.
+ */
+import type { BlueprintStore } from "@ggui-ai/mcp-server-core";
+import { type BlueprintRegistryDeps, type RegisterBlueprintInput, type RegisteredBlueprint } from "../renders/blueprint-registry.js";
+export declare function mirrorIntoCache(args: {
+    /** The cache registry the writer mirrors into. */
+    readonly cacheRegistry: BlueprintRegistryDeps;
+    /** The store the writer already put the durable row in, under `blueprintId`. */
+    readonly writerStore: BlueprintStore;
+    readonly appId: string;
+    /** The writer's durable row id: the cache row takes it. */
+    readonly blueprintId: string;
+    readonly input: RegisterBlueprintInput;
+}): Promise<RegisteredBlueprint>;
+//# sourceMappingURL=cache-mirror.d.ts.map

package/dist/ops-blueprint/cache-mirror.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"cache-mirror.d.ts","sourceRoot":"","sources":["../../src/ops-blueprint/cache-mirror.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AACH,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,0BAA0B,CAAC;AAC/D,OAAO,EAEL,KAAK,qBAAqB,EAC1B,KAAK,sBAAsB,EAC3B,KAAK,mBAAmB,EACzB,MAAM,kCAAkC,CAAC;AAE1C,wBAAsB,eAAe,CAAC,IAAI,EAAE;IAC1C,kDAAkD;IAClD,QAAQ,CAAC,aAAa,EAAE,qBAAqB,CAAC;IAC9C,gFAAgF;IAChF,QAAQ,CAAC,WAAW,EAAE,cAAc,CAAC;IACrC,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,2DAA2D;IAC3D,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,KAAK,EAAE,sBAAsB,CAAC;CACxC,GAAG,OAAO,CAAC,mBAAmB,CAAC,CAkB/B"}

package/dist/ops-blueprint/cache-mirror.js

@@ -0,0 +1,19 @@
+import { registerBlueprint, } from "../renders/blueprint-registry.js";
+export async function mirrorIntoCache(args) {
+    const durability = args.cacheRegistry.durability;
+    const sharesWriterStore = durability?.blueprintStore !== undefined && durability.blueprintStore === args.writerStore;
+    const deps = sharesWriterStore
+        ? {
+            ...args.cacheRegistry,
+            durability: durability.codeStore !== undefined ? { codeStore: durability.codeStore } : {},
+        }
+        : args.cacheRegistry;
+    const registered = await registerBlueprint(deps, args.appId, args.input, {
+        mintId: () => args.blueprintId,
+    });
+    const codeStore = durability?.codeStore;
+    if (sharesWriterStore && !registered.deduped && codeStore !== undefined && args.input.componentCode.length > 0) {
+        await codeStore.put(codeStore.hashOf(args.input.componentCode), args.input.componentCode);
+    }
+    return registered;
+}

package/dist/ops-blueprint/delete.d.ts

@@ -18,12 +18,23 @@
  * a foreign `appId` input the authorizer denies surfaces the denial
  * error before the row lookup ever runs.
  *
+ * ## Out of reuse (ggui#1541)
+ *
+ * `ggui_ops_register_blueprint` and `ggui_ops_generate_blueprint` write a
+ * blueprint twice: the durable row, and a mirror in the cache registry, the
+ * store the handshake's exact-key probe matches from. So a delete removes
+ * both, the cache row first: a cache delete that fails fails the call
+ * before the durable row goes, and a retry completes it. An id whose
+ * durable row is already gone still has its cache row cleared in the
+ * caller's own app scope, which heals a row an earlier delete left behind.
+ *
  * ## Audience
  *
  * `['ops']` — served on `/control`. NOT visible to agents on `/mcp`.
  */
 import { z } from 'zod';
 import type { BlueprintStore } from '@ggui-ai/mcp-server-core';
+import { type BlueprintRegistryDeps } from '../renders/blueprint-registry.js';
 import { type OpsBlueprintAppAuthorizer } from './app-access.js';
 /**
  * Deps for `ggui_ops_delete_blueprint`.
@@ -45,6 +56,13 @@ export interface GguiOpsDeleteBlueprintDeps {
      * the target row belongs to a different app (no existence leak).
      */
     readonly authorizeAppAccess?: OpsBlueprintAppAuthorizer;
+    /**
+     * The cache registry the writers mirror into (ggui#1541): the SAME one
+     * `ggui_ops_register_blueprint` and `ggui_ops_generate_blueprint` are
+     * given. When bound, a delete removes the blueprint's cache row (its
+     * vector and its exact-key binding) so the handshake stops reusing it.
+     */
+    readonly cacheRegistry?: Pick<BlueprintRegistryDeps, 'vectorStore' | 'index'>;
 }
 export declare function createGguiOpsDeleteBlueprintHandler(deps: GguiOpsDeleteBlueprintDeps): import("../types.js").SharedHandler<{
     appId: z.ZodOptional<z.ZodString>;

package/dist/ops-blueprint/delete.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"delete.d.ts","sourceRoot":"","sources":["../../src/ops-blueprint/delete.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAMxB,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,0BAA0B,CAAC;AAE/D,OAAO,EAAyB,KAAK,yBAAyB,EAAE,MAAM,iBAAiB,CAAC;AAOxF;;GAEG;AACH,MAAM,WAAW,0BAA0B;IACzC,QAAQ,CAAC,cAAc,EAAE,cAAc,CAAC;IACxC;;;;;;;;;;;;;OAaG;IACH,QAAQ,CAAC,kBAAkB,CAAC,EAAE,yBAAyB,CAAC;CACzD;AAED,wBAAgB,mCAAmC,CACjD,IAAI,EAAE,0BAA0B;;;;;;;GAwCjC"}
+{"version":3,"file":"delete.d.ts","sourceRoot":"","sources":["../../src/ops-blueprint/delete.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAiCG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAMxB,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,0BAA0B,CAAC;AAC/D,OAAO,EAAmB,KAAK,qBAAqB,EAAE,MAAM,kCAAkC,CAAC;AAE/F,OAAO,EAAyB,KAAK,yBAAyB,EAAE,MAAM,iBAAiB,CAAC;AAOxF;;GAEG;AACH,MAAM,WAAW,0BAA0B;IACzC,QAAQ,CAAC,cAAc,EAAE,cAAc,CAAC;IACxC;;;;;;;;;;;;;OAaG;IACH,QAAQ,CAAC,kBAAkB,CAAC,EAAE,yBAAyB,CAAC;IACxD;;;;;OAKG;IACH,QAAQ,CAAC,aAAa,CAAC,EAAE,IAAI,CAAC,qBAAqB,EAAE,aAAa,GAAG,OAAO,CAAC,CAAC;CAC/E;AAED,wBAAgB,mCAAmC,CACjD,IAAI,EAAE,0BAA0B;;;;;;;GA8CjC"}

package/dist/ops-blueprint/delete.js

@@ -18,12 +18,23 @@
  * a foreign `appId` input the authorizer denies surfaces the denial
  * error before the row lookup ever runs.
  *
+ * ## Out of reuse (ggui#1541)
+ *
+ * `ggui_ops_register_blueprint` and `ggui_ops_generate_blueprint` write a
+ * blueprint twice: the durable row, and a mirror in the cache registry, the
+ * store the handshake's exact-key probe matches from. So a delete removes
+ * both, the cache row first: a cache delete that fails fails the call
+ * before the durable row goes, and a retry completes it. An id whose
+ * durable row is already gone still has its cache row cleared in the
+ * caller's own app scope, which heals a row an earlier delete left behind.
+ *
  * ## Audience
  *
  * `['ops']` — served on `/control`. NOT visible to agents on `/mcp`.
  */
 import { z } from 'zod';
 import { opsDeleteBlueprintInputSchema, } from '@ggui-ai/protocol';
+import { deleteBlueprint } from '../renders/blueprint-registry.js';
 import { defineHandler } from '../types.js';
 import { resolveEffectiveAppId } from './app-access.js';
 const opsInputSchema = opsDeleteBlueprintInputSchema.shape;
@@ -35,7 +46,7 @@ export function createGguiOpsDeleteBlueprintHandler(deps) {
         name: 'ggui_ops_delete_blueprint',
         title: 'Delete blueprint',
         audience: ['ops'],
-        description: "Remove a blueprint row by id. Idempotent — a second delete for the same id returns `{deleted: true}` without throwing. Cross-app probes return the same shape (no existence leak across apps). Mirrors `BlueprintStore.delete`'s no-throw contract. App-scoped variant curation for an app you operate — distinct from the personal saved-blueprint library (the _my_ tools).",
+        description: "Remove a blueprint by id: its durable row, and its entry in the cache the handshake reuses blueprints from, so it is no longer reused. Idempotent — a second delete for the same id returns `{deleted: true}` without throwing. Cross-app probes return the same shape (no existence leak across apps). Mirrors `BlueprintStore.delete`'s no-throw contract. App-scoped variant curation for an app you operate — distinct from the personal saved-blueprint library (the _my_ tools).",
         inputSchema: opsInputSchema,
         outputSchema: opsOutputSchema,
         async handler(rawInput, ctx) {
@@ -48,7 +59,11 @@ export function createGguiOpsDeleteBlueprintHandler(deps) {
             });
             const existing = await deps.blueprintStore.get(parsed.blueprintId);
             if (existing === null) {
-                // Unknown id — idempotent. Return the success shape.
+                // Unknown id — idempotent. Its cache row may outlive it (an earlier
+                // delete removed the durable row only): clear it in the caller's
+                // own app scope, which says nothing about any other app.
+                if (deps.cacheRegistry)
+                    await deleteBlueprint(deps.cacheRegistry, appId, parsed.blueprintId);
                 return { deleted: true };
             }
             if (existing.appId !== appId) {
@@ -58,6 +73,10 @@ export function createGguiOpsDeleteBlueprintHandler(deps) {
                 // leak across app boundaries.
                 return { deleted: true };
             }
+            // Out of reuse first, then the durable row: a cache delete that fails
+            // fails the call with the durable row intact, so a retry completes it.
+            if (deps.cacheRegistry)
+                await deleteBlueprint(deps.cacheRegistry, appId, parsed.blueprintId);
             await deps.blueprintStore.delete(parsed.blueprintId);
             return { deleted: true };
         },

package/dist/ops-blueprint/errors.d.ts

@@ -45,6 +45,29 @@ export declare class GeneratorNotFoundError extends Error {
  * `ggui_ops_set_provider_key`, or run the handler in an environment
  * whose `resolveLlm` dep returns a pool credential.
  */
+/**
+ * ggui#1427 — `directionScope` names which direction `directionDigest`
+ * hashes; sent without a digest it is a scope for nothing, and the door
+ * refuses it rather than storing a fact about a value it does not have. A
+ * digest without a scope is accepted (absent = no scope). Enforced here
+ * because the handler mounts the input schema's raw shape, where a
+ * cross-field rule cannot live.
+ */
+export declare class DirectionScopeWithoutDigestError extends Error {
+    readonly code: "direction_scope_without_digest";
+    constructor();
+}
+/**
+ * ggui#1570 — a registration named a parent (`clonedFrom`) this registration
+ * cannot record: an empty id, the row's own id, or an id that is not a row of
+ * the registering app in the durable store. One answer for all of them, and
+ * the same text for a missing row and another app's, so the refusal says
+ * nothing about another app's rows. Refused before anything is persisted.
+ */
+export declare class ClonedFromRefusedError extends Error {
+    readonly code: "cloned_from_refused";
+    constructor(clonedFrom: string);
+}
 export declare class MissingCredentialsError extends Error {
     readonly code: "missing_credentials";
     constructor(message?: string);

package/dist/ops-blueprint/errors.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"errors.d.ts","sourceRoot":"","sources":["../../src/ops-blueprint/errors.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAEH;;;;;;;;;;;;;;;;;;;GAmBG;AACH,qBAAa,sBAAuB,SAAQ,KAAK;IAC/C,QAAQ,CAAC,IAAI,EAAG,qBAAqB,CAAU;gBACnC,IAAI,EAAE,MAAM,EAAE,eAAe,EAAE,SAAS,MAAM,EAAE;CAM7D;AAED;;;;;;;;;;GAUG;AACH,qBAAa,uBAAwB,SAAQ,KAAK;IAChD,QAAQ,CAAC,IAAI,EAAG,qBAAqB,CAAU;gBACnC,OAAO,CAAC,EAAE,MAAM;CAO7B;AAED;;;;;GAKG;AACH,qBAAa,qBAAsB,SAAQ,KAAK;IAC9C,QAAQ,CAAC,IAAI,EAAG,mBAAmB,CAAU;IAC7C,QAAQ,CAAC,KAAK,EAAE,OAAO,CAAC;gBACZ,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO;CAK5C"}
+{"version":3,"file":"errors.d.ts","sourceRoot":"","sources":["../../src/ops-blueprint/errors.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAEH;;;;;;;;;;;;;;;;;;;GAmBG;AACH,qBAAa,sBAAuB,SAAQ,KAAK;IAC/C,QAAQ,CAAC,IAAI,EAAG,qBAAqB,CAAU;gBACnC,IAAI,EAAE,MAAM,EAAE,eAAe,EAAE,SAAS,MAAM,EAAE;CAM7D;AAED;;;;;;;;;;GAUG;AACH;;;;;;;GAOG;AACH,qBAAa,gCAAiC,SAAQ,KAAK;IACzD,QAAQ,CAAC,IAAI,EAAG,gCAAgC,CAAU;;CAO3D;AAED;;;;;;GAMG;AACH,qBAAa,sBAAuB,SAAQ,KAAK;IAC/C,QAAQ,CAAC,IAAI,EAAG,qBAAqB,CAAU;gBACnC,UAAU,EAAE,MAAM;CAM/B;AAED,qBAAa,uBAAwB,SAAQ,KAAK;IAChD,QAAQ,CAAC,IAAI,EAAG,qBAAqB,CAAU;gBACnC,OAAO,CAAC,EAAE,MAAM;CAO7B;AAED;;;;;GAKG;AACH,qBAAa,qBAAsB,SAAQ,KAAK;IAC9C,QAAQ,CAAC,IAAI,EAAG,mBAAmB,CAAU;IAC7C,QAAQ,CAAC,KAAK,EAAE,OAAO,CAAC;gBACZ,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO;CAK5C"}

package/dist/ops-blueprint/errors.js

@@ -48,6 +48,35 @@ export class GeneratorNotFoundError extends Error {
  * `ggui_ops_set_provider_key`, or run the handler in an environment
  * whose `resolveLlm` dep returns a pool credential.
  */
+/**
+ * ggui#1427 — `directionScope` names which direction `directionDigest`
+ * hashes; sent without a digest it is a scope for nothing, and the door
+ * refuses it rather than storing a fact about a value it does not have. A
+ * digest without a scope is accepted (absent = no scope). Enforced here
+ * because the handler mounts the input schema's raw shape, where a
+ * cross-field rule cannot live.
+ */
+export class DirectionScopeWithoutDigestError extends Error {
+    code = "direction_scope_without_digest";
+    constructor() {
+        super("direction_scope_without_digest: `directionScope` was sent without `directionDigest` — a scope names which direction the digest hashes, so send both or neither.");
+        this.name = "DirectionScopeWithoutDigestError";
+    }
+}
+/**
+ * ggui#1570 — a registration named a parent (`clonedFrom`) this registration
+ * cannot record: an empty id, the row's own id, or an id that is not a row of
+ * the registering app in the durable store. One answer for all of them, and
+ * the same text for a missing row and another app's, so the refusal says
+ * nothing about another app's rows. Refused before anything is persisted.
+ */
+export class ClonedFromRefusedError extends Error {
+    code = "cloned_from_refused";
+    constructor(clonedFrom) {
+        super(`cloned_from_refused: clonedFrom "${clonedFrom}" is not another row of this app — a copy names a row of its own app, other than itself, that the store holds.`);
+        this.name = "ClonedFromRefusedError";
+    }
+}
 export class MissingCredentialsError extends Error {
     code = "missing_credentials";
     constructor(message) {

package/dist/ops-blueprint/generate.d.ts

@@ -3,7 +3,7 @@
  *
  * Operator UX entry point. Dispatches through the bound
  * {@link GeneratorRegistry} to mint a blueprint variant with
- * operator-authored variance tags + optional default-pin.
+ * operator-authored variance tags + an optional operator-default mark.
  *
  * ## Behavior
  *
@@ -177,7 +177,6 @@ export declare function createGguiOpsGenerateBlueprintHandler(deps: GguiOpsGener
 }, {
     blueprintId: z.ZodString;
     codeHash: z.ZodOptional<z.ZodString>;
-    validatorScore: z.ZodOptional<z.ZodNumber>;
     source: z.ZodObject<{
         kind: z.ZodLiteral<"llm">;
         generator: z.ZodString;
@@ -187,6 +186,5 @@ export declare function createGguiOpsGenerateBlueprintHandler(deps: GguiOpsGener
     blueprintId: string;
     source: import("@ggui-ai/protocol").LlmBlueprintSource;
     codeHash?: string | undefined;
-    validatorScore?: number | undefined;
 }>;
 //# sourceMappingURL=generate.d.ts.map

package/dist/ops-blueprint/generate.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"generate.d.ts","sourceRoot":"","sources":["../../src/ops-blueprint/generate.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+CG;AAEH,OAAO,KAAK,EACV,gBAAgB,EAChB,iBAAiB,EACjB,cAAc,EACd,iBAAiB,EACjB,aAAa,EAGd,MAAM,0BAA0B,CAAC;AAClC,OAAO,EAGL,KAAK,SAAS,EACd,KAAK,YAAY,EAIlB,MAAM,mBAAmB,CAAC;AAG3B,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAGxB,OAAO,EAEL,KAAK,qBAAqB,EAC1B,KAAK,qBAAqB,EAC3B,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EAAiB,KAAK,cAAc,EAAE,MAAM,aAAa,CAAC;AACjE,OAAO,EAAyB,KAAK,yBAAyB,EAAE,MAAM,iBAAiB,CAAC;AAsBxF;;;;;;GAMG;AACH,MAAM,WAAW,WAAW;IAC1B,CAAC,QAAQ,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CACxD;AAED;;GAEG;AACH,MAAM,WAAW,4BAA4B;IAC3C;;;;OAIG;IACH,QAAQ,CAAC,QAAQ,EAAE,iBAAiB,CAAC;IACrC;;;OAGG;IACH,QAAQ,CAAC,cAAc,EAAE,cAAc,CAAC;IACxC;;;;;;;OAOG;IACH,QAAQ,CAAC,aAAa,CAAC,EAAE,CAAC,KAAK,EAAE,MAAM,KAAK,OAAO,CAAC,SAAS,SAAS,EAAE,CAAC,CAAC;IAC1E;;;;;;;OAOG;IACH,QAAQ,CAAC,gBAAgB,CAAC,EAAE,gBAAgB,CAAC;IAC7C;;;;;OAKG;IACH,QAAQ,CAAC,UAAU,EAAE,CACnB,GAAG,EAAE,cAAc,KAChB,OAAO,CAAC,qBAAqB,GAAG,IAAI,CAAC,GAAG,qBAAqB,GAAG,IAAI,CAAC;IAC1E;;;;OAIG;IACH,QAAQ,CAAC,UAAU,EAAE,iBAAiB,CAAC;IACvC;;;;;;OAMG;IACH,QAAQ,CAAC,OAAO,CAAC,EAAE,WAAW,CAAC;IAC/B;;;;;;;;;;;;;;;;;;;;OAoBG;IACH,QAAQ,CAAC,aAAa,CAAC,EAAE,qBAAqB,CAAC;IAC/C;;;;OAIG;IACH,QAAQ,CAAC,SAAS,CAAC,EAAE,aAAa,CAAC;IACnC;;;OAGG;IACH,QAAQ,CAAC,GAAG,CAAC,EAAE,MAAM,MAAM,CAAC;IAC5B;;;OAGG;IACH,QAAQ,CAAC,eAAe,CAAC,EAAE,MAAM,MAAM,CAAC;IACxC;;;;;;;OAOG;IACH,QAAQ,CAAC,kBAAkB,CAAC,EAAE,yBAAyB,CAAC;CACzD;AA2CD,wBAAgB,qCAAqC,CACnD,IAAI,EAAE,4BAA4B;;;;;;;;;;;;;;;;;;;;;;;;GA0SnC"}
+{"version":3,"file":"generate.d.ts","sourceRoot":"","sources":["../../src/ops-blueprint/generate.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+CG;AAEH,OAAO,KAAK,EACV,gBAAgB,EAChB,iBAAiB,EACjB,cAAc,EACd,iBAAiB,EACjB,aAAa,EAGd,MAAM,0BAA0B,CAAC;AAClC,OAAO,EAGL,KAAK,SAAS,EACd,KAAK,YAAY,EAIlB,MAAM,mBAAmB,CAAC;AAG3B,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAGxB,OAAO,EAEL,KAAK,qBAAqB,EAC1B,KAAK,qBAAqB,EAC3B,MAAM,qBAAqB,CAAC;AAE7B,OAAO,EAAiB,KAAK,cAAc,EAAE,MAAM,aAAa,CAAC;AACjE,OAAO,EAAyB,KAAK,yBAAyB,EAAE,MAAM,iBAAiB,CAAC;AAqBxF;;;;;;GAMG;AACH,MAAM,WAAW,WAAW;IAC1B,CAAC,QAAQ,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CACxD;AAED;;GAEG;AACH,MAAM,WAAW,4BAA4B;IAC3C;;;;OAIG;IACH,QAAQ,CAAC,QAAQ,EAAE,iBAAiB,CAAC;IACrC;;;OAGG;IACH,QAAQ,CAAC,cAAc,EAAE,cAAc,CAAC;IACxC;;;;;;;OAOG;IACH,QAAQ,CAAC,aAAa,CAAC,EAAE,CAAC,KAAK,EAAE,MAAM,KAAK,OAAO,CAAC,SAAS,SAAS,EAAE,CAAC,CAAC;IAC1E;;;;;;;OAOG;IACH,QAAQ,CAAC,gBAAgB,CAAC,EAAE,gBAAgB,CAAC;IAC7C;;;;;OAKG;IACH,QAAQ,CAAC,UAAU,EAAE,CACnB,GAAG,EAAE,cAAc,KAChB,OAAO,CAAC,qBAAqB,GAAG,IAAI,CAAC,GAAG,qBAAqB,GAAG,IAAI,CAAC;IAC1E;;;;OAIG;IACH,QAAQ,CAAC,UAAU,EAAE,iBAAiB,CAAC;IACvC;;;;;;OAMG;IACH,QAAQ,CAAC,OAAO,CAAC,EAAE,WAAW,CAAC;IAC/B;;;;;;;;;;;;;;;;;;;;OAoBG;IACH,QAAQ,CAAC,aAAa,CAAC,EAAE,qBAAqB,CAAC;IAC/C;;;;OAIG;IACH,QAAQ,CAAC,SAAS,CAAC,EAAE,aAAa,CAAC;IACnC;;;OAGG;IACH,QAAQ,CAAC,GAAG,CAAC,EAAE,MAAM,MAAM,CAAC;IAC5B;;;OAGG;IACH,QAAQ,CAAC,eAAe,CAAC,EAAE,MAAM,MAAM,CAAC;IACxC;;;;;;;OAOG;IACH,QAAQ,CAAC,kBAAkB,CAAC,EAAE,yBAAyB,CAAC;CACzD;AA0BD,wBAAgB,qCAAqC,CACnD,IAAI,EAAE,4BAA4B;;;;;;;;;;;;;;;;;;;;;;GAkTnC"}

package/dist/ops-blueprint/generate.js

@@ -3,7 +3,7 @@
  *
  * Operator UX entry point. Dispatches through the bound
  * {@link GeneratorRegistry} to mint a blueprint variant with
- * operator-authored variance tags + optional default-pin.
+ * operator-authored variance tags + an optional operator-default mark.
  *
  * ## Behavior
  *
@@ -52,7 +52,8 @@ import { createHash, randomUUID } from "node:crypto";
 import { z } from "zod";
 import { assertContractNoRetiredFields } from "../renders/assert-contract-no-retired-fields.js";
 import { assertGadgetsRegistered } from "../renders/assert-gadgets.js";
-import { registerBlueprint, } from "../renders/index.js";
+import { admitGeneratorBuild, } from "../renders/index.js";
+import { mirrorIntoCache } from "./cache-mirror.js";
 import { defineHandler } from "../types.js";
 import { resolveEffectiveAppId } from "./app-access.js";
 import { GenerationFailedError, GeneratorNotFoundError, MissingCredentialsError, } from "./errors.js";
@@ -61,7 +62,6 @@ const opsInputSchema = opsGenerateBlueprintInputSchema.shape;
 const opsOutputSchema = z.object({
     blueprintId: z.string().min(1),
     codeHash: z.string().optional(),
-    validatorScore: z.number().min(0).max(1).optional(),
     source: z
         .object({
         kind: z.literal("llm"),
@@ -70,26 +70,6 @@ const opsOutputSchema = z.object({
     })
         .strict(),
 }).shape;
-/**
- * Read the optional `validatorScore` carried on
- * {@link GenerationMetadata} by the advanced generator, which does
- * not yet have an explicit field on the canonical interface. Until
- * that lands the score arrives as a structural pass-through on
- * `metadata` — the read is type-guarded here so the cast is
- * confined to one place and the call sites stay clean.
- */
-function readValidatorScore(metadata) {
-    if (!metadata || typeof metadata !== "object")
-        return undefined;
-    const candidate = metadata.validatorScore;
-    if (typeof candidate !== "number")
-        return undefined;
-    if (!Number.isFinite(candidate))
-        return undefined;
-    if (candidate < 0 || candidate > 1)
-        return undefined;
-    return candidate;
-}
 /**
  * Resolve which generator to dispatch. Throws {@link GeneratorNotFoundError}
  * with a clear "did you mean…" payload when the slug is unknown.
@@ -117,7 +97,7 @@ export function createGguiOpsGenerateBlueprintHandler(deps) {
         name: "ggui_ops_generate_blueprint",
         title: "Generate blueprint",
         audience: ["ops"],
-        description: "Author a new blueprint variant for the target app (the caller's bound app by default, or an explicitly named app the deployment's authorization policy accepts). Dispatches through the registry's selected generator (defaults to `registry.defaultGenerator()` when the slug is omitted) and persists the resulting code body + metadata against a fresh `blueprintId`. Optionally pins the new blueprint as the operator default for its `(appId, contractHash)` group. Persona tags are normalized (lowercase + trim); near-duplicates surface a warning via telemetry. Returns the new id + content-hash + validator score + the stamped provenance (`source`, llm arm: engine generator slug + model, from the engine's own metadata stamp) — code body lives in the bound store, fetched via render's fast-path on cache hit. App-scoped variant curation for an app you operate — distinct from the personal saved-blueprint library (the _my_ tools).",
+        description: "Author a new blueprint variant for the target app (the caller's bound app by default, or an explicitly named app the deployment's authorization policy accepts). Dispatches through the registry's selected generator (defaults to `registry.defaultGenerator()` when the slug is omitted) and persists the resulting code body + metadata against a fresh `blueprintId`. Optionally marks the new blueprint as the operator default for its `(appId, contractHash)` group (the mark orders blueprint listings; it does not decide which blueprint serves a render). Persona tags are normalized (lowercase + trim); near-duplicates surface a warning via telemetry. Returns the new id + content-hash + validator score + the stamped provenance (`source`, llm arm: engine generator slug + model, from the engine's own metadata stamp) — code body lives in the bound store, fetched via render's fast-path on cache hit. App-scoped variant curation for an app you operate — distinct from the personal saved-blueprint library (the _my_ tools).",
         inputSchema: opsInputSchema,
         outputSchema: opsOutputSchema,
         async handler(rawInput, ctx) {
@@ -255,12 +235,6 @@ export function createGguiOpsGenerateBlueprintHandler(deps) {
             // bytes. A 32-hex prefix here (ggui#1287) was refused by every
             // conforming code store.
             const codeHash = createHash("sha256").update(componentCode).digest("hex");
-            // The advanced generator tunnels `validatorScore` through
-            // `metadata` until the UiGenerator interface widens to carry
-            // it explicitly. Read it via the typed helper so the default
-            // generator (which never sets it) and the advanced generator
-            // (which does) both round-trip cleanly.
-            const validatorScore = readValidatorScore(result.metadata);
             // Engine-GENERATED code: provenance is the llm arm, stamped from
             // the engine's own metadata claim — the SAME values the cache-
             // registry mirror below records, so the two stores can never
@@ -270,6 +244,13 @@ export function createGguiOpsGenerateBlueprintHandler(deps) {
                 generator: result.metadata.generator,
                 model: result.metadata.model,
             };
+            // ggui#1280 — the minting engine's build, through the registry's one
+            // admission rule. The durable row below carries it. The cache mirror's
+            // registration receives the same value: it rides that registry's
+            // vector-store row (ggui#1476) and, when the mirror writes through to a
+            // separate durable store, the row it writes there under this same id
+            // (ggui#1497, see `mirrorIntoCache`).
+            const build = admitGeneratorBuild(source, result.metadata.build);
             const blueprintId = mintBlueprintId();
             const blueprint = {
                 blueprintId,
@@ -286,7 +267,7 @@ export function createGguiOpsGenerateBlueprintHandler(deps) {
                 createdAt: now(),
                 createdBy: "operator",
                 contract,
-                ...(validatorScore !== undefined ? { validatorScore } : {}),
+                ...(build !== undefined ? { build } : {}),
             };
             await deps.blueprintStore.put(blueprint);
             if (deps.putCode) {
@@ -305,31 +286,40 @@ export function createGguiOpsGenerateBlueprintHandler(deps) {
                         parsed.seedPrompt ??
                         normalizedPersona ??
                         `operator-authored blueprint (${blueprintId})`;
-                    await registerBlueprint(deps.cacheRegistry, appId, {
-                        kind: "template",
-                        contract,
-                        intent: intentForCache,
-                        // ggui#1275 — an explicit intent or a seed prompt states the
-                        // UI's task; a persona or the placeholder is a stand-in the
-                        // matcher's judge never sees.
-                        intentSource: parsed.intent !== undefined || parsed.seedPrompt !== undefined
-                            ? "authored"
-                            : "fallback",
-                        componentCode,
-                        // The cache row MUST carry the same variance as the MVB
-                        // row: `registerBlueprint` keys the exact-lookup on
-                        // `variantKey(variance)`, so omitting it here filed every
-                        // operator-authored variant under the default-variant
-                        // sentinel — invisible to any request that asks for the
-                        // persona it was minted for.
-                        variance: blueprint.variance,
-                        // Operator-DISPATCHED but engine-GENERATED: the code came
-                        // out of `generator.generate(...)`, so provenance is the
-                        // llm arm — the same `source` stamped on the MVB row above.
-                        // The two axes disagree here on purpose, which is exactly
-                        // why `createdBy` cannot be derived from `source`.
-                        source,
-                        createdBy: "operator",
+                    // ggui#1497 — ONE id per generation: the cache row serves the
+                    // durable row's id (see `mirrorIntoCache` for what else it writes).
+                    await mirrorIntoCache({
+                        cacheRegistry: deps.cacheRegistry,
+                        writerStore: deps.blueprintStore,
+                        appId,
+                        blueprintId,
+                        input: {
+                            kind: "template",
+                            contract,
+                            intent: intentForCache,
+                            // ggui#1275 — an explicit intent or a seed prompt states the
+                            // UI's task; a persona or the placeholder is a stand-in the
+                            // matcher's judge never sees.
+                            intentSource: parsed.intent !== undefined || parsed.seedPrompt !== undefined
+                                ? "authored"
+                                : "fallback",
+                            componentCode,
+                            // The cache row MUST carry the same variance as the MVB
+                            // row: `registerBlueprint` keys the exact-lookup on
+                            // `variantKey(variance)`, so omitting it here filed every
+                            // operator-authored variant under the default-variant
+                            // sentinel — invisible to any request that asks for the
+                            // persona it was minted for.
+                            variance: blueprint.variance,
+                            // Operator-DISPATCHED but engine-GENERATED: the code came
+                            // out of `generator.generate(...)`, so provenance is the
+                            // llm arm — the same `source` stamped on the MVB row above.
+                            // The two axes disagree here on purpose, which is exactly
+                            // why `createdBy` cannot be derived from `source`.
+                            source,
+                            ...(build !== undefined ? { build } : {}),
+                            createdBy: "operator",
+                        },
                     });
                 }
                 catch (err) {
@@ -352,7 +342,7 @@ export function createGguiOpsGenerateBlueprintHandler(deps) {
                     }
                 }
             }
-            // 7. Pin as operator default when requested.
+            // 7. Mark as operator default when requested.
             if (parsed.setAsOperatorDefault === true) {
                 await deps.blueprintStore.setOperatorDefault(blueprintId);
             }
@@ -381,7 +371,6 @@ export function createGguiOpsGenerateBlueprintHandler(deps) {
                 blueprintId,
                 codeHash,
                 source,
-                ...(validatorScore !== undefined ? { validatorScore } : {}),
             };
             return output;
         },

package/dist/ops-blueprint/index.d.ts

@@ -27,7 +27,7 @@
  * enforces their ownership model.
  */
 export { createGguiOpsGenerateBlueprintHandler, type GguiOpsGenerateBlueprintDeps, type PutCodeHook, } from './generate.js';
-export { createGguiOpsRegisterBlueprintHandler, type GguiOpsRegisterBlueprintDeps, } from './register.js';
+export { createGguiOpsRegisterBlueprintHandler, createRegisterGeneratedBlueprint, type GeneratedBlueprintBytes, type GguiOpsRegisterBlueprintDeps, type RegisterGeneratedBlueprint, type RegisterGeneratedBlueprintOutput, } from './register.js';
 export { createGguiOpsListBlueprintsHandler, type GguiOpsListBlueprintsDeps, } from './list.js';
 export { createGguiOpsUpdateBlueprintHandler, type GguiOpsUpdateBlueprintDeps, BlueprintAppMismatchError, } from './update.js';
 export { createGguiOpsDeleteBlueprintHandler, type GguiOpsDeleteBlueprintDeps, } from './delete.js';

package/dist/ops-blueprint/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/ops-blueprint/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AAEH,OAAO,EACL,qCAAqC,EACrC,KAAK,4BAA4B,EACjC,KAAK,WAAW,GACjB,MAAM,eAAe,CAAC;AACvB,OAAO,EACL,qCAAqC,EACrC,KAAK,4BAA4B,GAClC,MAAM,eAAe,CAAC;AACvB,OAAO,EACL,kCAAkC,EAClC,KAAK,yBAAyB,GAC/B,MAAM,WAAW,CAAC;AACnB,OAAO,EACL,mCAAmC,EACnC,KAAK,0BAA0B,EAC/B,yBAAyB,GAC1B,MAAM,aAAa,CAAC;AACrB,OAAO,EACL,mCAAmC,EACnC,KAAK,0BAA0B,GAChC,MAAM,aAAa,CAAC;AACrB,OAAO,EACL,sBAAsB,EACtB,uBAAuB,EACvB,qBAAqB,GACtB,MAAM,aAAa,CAAC;AACrB,OAAO,EACL,gBAAgB,EAChB,WAAW,EACX,wBAAwB,EACxB,KAAK,yBAAyB,GAC/B,MAAM,4BAA4B,CAAC;AACpC,OAAO,EACL,qBAAqB,EACrB,gCAAgC,EAChC,sBAAsB,EACtB,KAAK,qBAAqB,EAC1B,KAAK,yBAAyB,GAC/B,MAAM,iBAAiB,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/ops-blueprint/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AAEH,OAAO,EACL,qCAAqC,EACrC,KAAK,4BAA4B,EACjC,KAAK,WAAW,GACjB,MAAM,eAAe,CAAC;AACvB,OAAO,EACL,qCAAqC,EACrC,gCAAgC,EAChC,KAAK,uBAAuB,EAC5B,KAAK,4BAA4B,EACjC,KAAK,0BAA0B,EAC/B,KAAK,gCAAgC,GACtC,MAAM,eAAe,CAAC;AACvB,OAAO,EACL,kCAAkC,EAClC,KAAK,yBAAyB,GAC/B,MAAM,WAAW,CAAC;AACnB,OAAO,EACL,mCAAmC,EACnC,KAAK,0BAA0B,EAC/B,yBAAyB,GAC1B,MAAM,aAAa,CAAC;AACrB,OAAO,EACL,mCAAmC,EACnC,KAAK,0BAA0B,GAChC,MAAM,aAAa,CAAC;AACrB,OAAO,EACL,sBAAsB,EACtB,uBAAuB,EACvB,qBAAqB,GACtB,MAAM,aAAa,CAAC;AACrB,OAAO,EACL,gBAAgB,EAChB,WAAW,EACX,wBAAwB,EACxB,KAAK,yBAAyB,GAC/B,MAAM,4BAA4B,CAAC;AACpC,OAAO,EACL,qBAAqB,EACrB,gCAAgC,EAChC,sBAAsB,EACtB,KAAK,qBAAqB,EAC1B,KAAK,yBAAyB,GAC/B,MAAM,iBAAiB,CAAC"}

package/dist/ops-blueprint/index.js

@@ -27,7 +27,7 @@
  * enforces their ownership model.
  */
 export { createGguiOpsGenerateBlueprintHandler, } from './generate.js';
-export { createGguiOpsRegisterBlueprintHandler, } from './register.js';
+export { createGguiOpsRegisterBlueprintHandler, createRegisterGeneratedBlueprint, } from './register.js';
 export { createGguiOpsListBlueprintsHandler, } from './list.js';
 export { createGguiOpsUpdateBlueprintHandler, BlueprintAppMismatchError, } from './update.js';
 export { createGguiOpsDeleteBlueprintHandler, } from './delete.js';

package/dist/ops-blueprint/list.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"list.d.ts","sourceRoot":"","sources":["../../src/ops-blueprint/list.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgCG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAGL,KAAK,SAAS,EAGf,MAAM,mBAAmB,CAAC;AAC3B,OAAO,KAAK,EACV,eAAe,EACf,cAAc,EACf,MAAM,0BAA0B,CAAC;AAElC,OAAO,EAAyB,KAAK,yBAAyB,EAAE,MAAM,iBAAiB,CAAC;AAQxF;;GAEG;AACH,MAAM,WAAW,yBAAyB;IACxC;;;OAGG;IACH,QAAQ,CAAC,cAAc,EAAE,cAAc,CAAC;IACxC;;;;;;OAMG;IACH,QAAQ,CAAC,eAAe,EAAE,eAAe,CAAC;IAC1C;;;;;;;OAOG;IACH,QAAQ,CAAC,kBAAkB,CAAC,EAAE,yBAAyB,CAAC;CACzD;AAmBD,wBAAgB,kCAAkC,CAChD,IAAI,EAAE,yBAAyB;;;;;;;;;;GAyFhC"}
+{"version":3,"file":"list.d.ts","sourceRoot":"","sources":["../../src/ops-blueprint/list.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgCG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAGL,KAAK,SAAS,EAGf,MAAM,mBAAmB,CAAC;AAC3B,OAAO,KAAK,EACV,eAAe,EACf,cAAc,EACf,MAAM,0BAA0B,CAAC;AAElC,OAAO,EAAyB,KAAK,yBAAyB,EAAE,MAAM,iBAAiB,CAAC;AAQxF;;GAEG;AACH,MAAM,WAAW,yBAAyB;IACxC;;;OAGG;IACH,QAAQ,CAAC,cAAc,EAAE,cAAc,CAAC;IACxC;;;;;;OAMG;IACH,QAAQ,CAAC,eAAe,EAAE,eAAe,CAAC;IAC1C;;;;;;;OAOG;IACH,QAAQ,CAAC,kBAAkB,CAAC,EAAE,yBAAyB,CAAC;CACzD;AAkBD,wBAAgB,kCAAkC,CAChD,IAAI,EAAE,yBAAyB;;;;;;;;;;GAyFhC"}