@ggui-ai/mcp-server-handlers 0.25.0 → 0.27.0

package/README.md

@@ -1,8 +1,8 @@
 # @ggui-ai/mcp-server-handlers
 
-MCP tool handler logic for the **ggui protocol**.
+MCP tool handler logic for the **GGUI protocol**.
 
-This package implements the actual behavior behind every ggui MCP tool — render
+This package implements the actual behavior behind every GGUI MCP tool — render
 lifecycle, the contract handshake, UI emission, blueprint management, threads, app
 discovery, and the operator (`ggui_ops_*`) tools. The handlers are written purely
 over the seam interfaces in

package/dist/credits/index.d.ts

@@ -25,6 +25,6 @@
  */
 export { createGetCreditBalanceHandler, } from './get-credit-balance.js';
 export type { CreditBalanceSource, CreditBalanceView, GetCreditBalanceDeps, GetCreditBalanceOutput, } from './get-credit-balance.js';
-export { createListCreditTransactionsHandler, } from './list-credit-transactions.js';
-export type { CreditTransactionSource, CreditTransactionView, ListCreditTransactionsDeps, ListCreditTransactionsOutput, } from './list-credit-transactions.js';
+export { createListCreditTransactionsHandler, KNOWN_CREDIT_TRANSACTION_KINDS, } from './list-credit-transactions.js';
+export type { CreditTransactionKind, CreditTransactionSource, CreditTransactionView, KnownCreditTransactionKind, ListCreditTransactionsDeps, ListCreditTransactionsOutput, } from './list-credit-transactions.js';
 //# sourceMappingURL=index.d.ts.map

package/dist/credits/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/credits/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AAEH,OAAO,EACL,6BAA6B,GAC9B,MAAM,yBAAyB,CAAC;AACjC,YAAY,EACV,mBAAmB,EACnB,iBAAiB,EACjB,oBAAoB,EACpB,sBAAsB,GACvB,MAAM,yBAAyB,CAAC;AAEjC,OAAO,EACL,mCAAmC,GACpC,MAAM,+BAA+B,CAAC;AACvC,YAAY,EACV,uBAAuB,EACvB,qBAAqB,EACrB,0BAA0B,EAC1B,4BAA4B,GAC7B,MAAM,+BAA+B,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/credits/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AAEH,OAAO,EACL,6BAA6B,GAC9B,MAAM,yBAAyB,CAAC;AACjC,YAAY,EACV,mBAAmB,EACnB,iBAAiB,EACjB,oBAAoB,EACpB,sBAAsB,GACvB,MAAM,yBAAyB,CAAC;AAEjC,OAAO,EACL,mCAAmC,EACnC,8BAA8B,GAC/B,MAAM,+BAA+B,CAAC;AACvC,YAAY,EACV,qBAAqB,EACrB,uBAAuB,EACvB,qBAAqB,EACrB,0BAA0B,EAC1B,0BAA0B,EAC1B,4BAA4B,GAC7B,MAAM,+BAA+B,CAAC"}

package/dist/credits/index.js

@@ -24,4 +24,4 @@
  * side-channel — same posture as the blueprint family.
  */
 export { createGetCreditBalanceHandler, } from './get-credit-balance.js';
-export { createListCreditTransactionsHandler, } from './list-credit-transactions.js';
+export { createListCreditTransactionsHandler, KNOWN_CREDIT_TRANSACTION_KINDS, } from './list-credit-transactions.js';

package/dist/credits/list-credit-transactions.d.ts

@@ -34,9 +34,28 @@ export interface CreditTransactionSource {
         nextCursor?: string;
     }>;
 }
+/**
+ * The ledger kinds this package names (ggui#1532). The vocabulary is OPEN: a
+ * deployment's ledger may carry kinds not listed here, and a reader MUST accept
+ * one it does not know, keep it as named, and never read it as a render charge.
+ * Listing a kind here documents it; it is not the set of kinds that may appear.
+ */
+export declare const KNOWN_CREDIT_TRANSACTION_KINDS: readonly ["free_credit", "render_charge", "topup", "refund"];
+/** One of the kinds this package names. */
+export type KnownCreditTransactionKind = (typeof KNOWN_CREDIT_TRANSACTION_KINDS)[number];
+/**
+ * A ledger entry's kind: a known kind, or any other non-empty kind a
+ * deployment names. The `string & {}` arm keeps the set OPEN while editors
+ * still offer the known kinds and a `switch` can name them (it needs a default).
+ */
+export type CreditTransactionKind = KnownCreditTransactionKind | (string & {});
 export interface CreditTransactionView {
     readonly transactionId: string;
-    readonly kind: 'free_credit' | 'render_charge' | 'topup' | 'refund';
+    /**
+     * The entry's kind: one of {@link KNOWN_CREDIT_TRANSACTION_KINDS}, or a kind
+     * the deployment names that this package does not. Open vocabulary.
+     */
+    readonly kind: CreditTransactionKind;
     readonly deltaCents: number;
     readonly balanceAfterCents: number;
     readonly reason: string;
@@ -58,12 +77,7 @@ export declare function createListCreditTransactionsHandler(deps: ListCreditTran
 }, {
     transactions: z.ZodArray<z.ZodObject<{
         transactionId: z.ZodString;
-        kind: z.ZodEnum<{
-            free_credit: "free_credit";
-            render_charge: "render_charge";
-            topup: "topup";
-            refund: "refund";
-        }>;
+        kind: z.ZodString;
         deltaCents: z.ZodNumber;
         balanceAfterCents: z.ZodNumber;
         reason: z.ZodString;

package/dist/credits/list-credit-transactions.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"list-credit-transactions.d.ts","sourceRoot":"","sources":["../../src/credits/list-credit-transactions.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AACH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAGxB;;;;GAIG;AACH,MAAM,WAAW,uBAAuB;IACtC,IAAI,CAAC,IAAI,EAAE;QACT,MAAM,EAAE,MAAM,CAAC;QACf,oCAAoC;QACpC,KAAK,EAAE,MAAM,CAAC;QACd,4EAA4E;QAC5E,MAAM,CAAC,EAAE,MAAM,CAAC;KACjB,GAAG,OAAO,CAAC;QACV,YAAY,EAAE,qBAAqB,EAAE,CAAC;QACtC,6CAA6C;QAC7C,UAAU,CAAC,EAAE,MAAM,CAAC;KACrB,CAAC,CAAC;CACJ;AAED,MAAM,WAAW,qBAAqB;IACpC,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;IAC/B,QAAQ,CAAC,IAAI,EAAE,aAAa,GAAG,eAAe,GAAG,OAAO,GAAG,QAAQ,CAAC;IACpE,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,iBAAiB,EAAE,MAAM,CAAC;IACnC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,gBAAgB,CAAC,EAAE,MAAM,CAAC;CACpC;AAED,MAAM,WAAW,0BAA0B;IACzC,QAAQ,CAAC,kBAAkB,EAAE,uBAAuB,CAAC;CACtD;AAyBD,MAAM,WAAW,4BAA4B;IAC3C,QAAQ,CAAC,YAAY,EAAE,qBAAqB,EAAE,CAAC;IAC/C,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAC;CAC9B;AAED,wBAAgB,mCAAmC,CACjD,IAAI,EAAE,0BAA0B;IA5BhC,2BAA2B;;IAE3B,kEAAkE;;;;;;;;;;;;;;;;;IAgBlE,oFAAoF;;;;;GAgDrF"}
+{"version":3,"file":"list-credit-transactions.d.ts","sourceRoot":"","sources":["../../src/credits/list-credit-transactions.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AACH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAGxB;;;;GAIG;AACH,MAAM,WAAW,uBAAuB;IACtC,IAAI,CAAC,IAAI,EAAE;QACT,MAAM,EAAE,MAAM,CAAC;QACf,oCAAoC;QACpC,KAAK,EAAE,MAAM,CAAC;QACd,4EAA4E;QAC5E,MAAM,CAAC,EAAE,MAAM,CAAC;KACjB,GAAG,OAAO,CAAC;QACV,YAAY,EAAE,qBAAqB,EAAE,CAAC;QACtC,6CAA6C;QAC7C,UAAU,CAAC,EAAE,MAAM,CAAC;KACrB,CAAC,CAAC;CACJ;AAED;;;;;GAKG;AACH,eAAO,MAAM,8BAA8B,8DAA+D,CAAC;AAE3G,2CAA2C;AAC3C,MAAM,MAAM,0BAA0B,GAAG,CAAC,OAAO,8BAA8B,CAAC,CAAC,MAAM,CAAC,CAAC;AAEzF;;;;GAIG;AACH,MAAM,MAAM,qBAAqB,GAAG,0BAA0B,GAAG,CAAC,MAAM,GAAG,EAAE,CAAC,CAAC;AAE/E,MAAM,WAAW,qBAAqB;IACpC,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;IAC/B;;;OAGG;IACH,QAAQ,CAAC,IAAI,EAAE,qBAAqB,CAAC;IACrC,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,iBAAiB,EAAE,MAAM,CAAC;IACnC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,gBAAgB,CAAC,EAAE,MAAM,CAAC;CACpC;AAED,MAAM,WAAW,0BAA0B;IACzC,QAAQ,CAAC,kBAAkB,EAAE,uBAAuB,CAAC;CACtD;AA8BD,MAAM,WAAW,4BAA4B;IAC3C,QAAQ,CAAC,YAAY,EAAE,qBAAqB,EAAE,CAAC;IAC/C,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAC;CAC9B;AAED,wBAAgB,mCAAmC,CACjD,IAAI,EAAE,0BAA0B;IAjChC,2BAA2B;;IAE3B,kEAAkE;;;;;;;;;;;;IAqBlE,oFAAoF;;;;;GAgDrF"}

package/dist/credits/list-credit-transactions.js

@@ -17,6 +17,13 @@
  */
 import { z } from 'zod';
 import { defineHandler } from '../types.js';
+/**
+ * The ledger kinds this package names (ggui#1532). The vocabulary is OPEN: a
+ * deployment's ledger may carry kinds not listed here, and a reader MUST accept
+ * one it does not know, keep it as named, and never read it as a render charge.
+ * Listing a kind here documents it; it is not the set of kinds that may appear.
+ */
+export const KNOWN_CREDIT_TRANSACTION_KINDS = ['free_credit', 'render_charge', 'topup', 'refund'];
 const inputSchema = {
     /** Default 20. Cap 100. */
     limit: z.number().int().min(1).max(100).optional(),
@@ -26,7 +33,10 @@ const inputSchema = {
 const outputSchema = {
     transactions: z.array(z.object({
         transactionId: z.string(),
-        kind: z.enum(['free_credit', 'render_charge', 'topup', 'refund']),
+        kind: z
+            .string()
+            .min(1)
+            .describe("The ledger entry's kind, an open vocabulary. Known kinds: 'free_credit', 'render_charge', 'topup', 'refund'. A deployment may add others: accept a kind you do not know, keep it as named, and never read it as a render charge."),
         deltaCents: z.number().int(),
         balanceAfterCents: z.number().int(),
         reason: z.string(),
@@ -41,7 +51,7 @@ export function createListCreditTransactionsHandler(deps) {
         name: 'ggui_ops_list_credit_transactions',
         title: 'List credit transactions',
         audience: ['ops'],
-        description: "Returns the calling user's credit transaction ledger, newest-first. Each row carries kind ('free_credit' | 'render_charge' | 'topup' | 'refund'), deltaCents (signed — positive for grants/topups, negative for charges), balanceAfterCents (snapshot at time of write), reason (human-readable), and optional relatedSessionId for render_charge rows. Default limit 20, cap 100; pass `cursor` from the previous response's `nextCursor` for paging.",
+        description: "Returns the calling user's credit transaction ledger, newest-first. Each row carries kind (an open vocabulary: known kinds are 'free_credit', 'render_charge', 'topup' and 'refund', and a deployment may add others; treat an unknown kind as a ledger entry of that name, never as a render charge), deltaCents (signed — positive for grants/topups, negative for charges), balanceAfterCents (snapshot at time of write), reason (human-readable), and optional relatedSessionId for render_charge rows. Default limit 20, cap 100; pass `cursor` from the previous response's `nextCursor` for paging.",
         inputSchema,
         outputSchema,
         // No `allowedFor` — same toolset on every deployment kind. Callers

package/dist/index.d.ts

@@ -15,8 +15,8 @@
  */
 export * from "./blueprints/index.js";
 export * from "./renders/index.js";
-export { AuthRequiredError, HANDLER_FAILURE_MARKER, defineHandler, handlerFailure, isHandlerFailure, } from "./types.js";
-export type { AudienceTag, EnvelopedHandlerDefinition, EnvelopeFor, HandlerContext, HandlerDefinition, HandlerFailure, ShapeOutput, SharedHandler, SharedHandlerOutputBound, SharedHandlerOutputData, SharedHandlerResult, } from "./types.js";
+export { AuthRequiredError, HANDLER_FAILURE_MARKER, createSessionRowReads, defineHandler, handlerFailure, isHandlerFailure, readSessionRow, viewProofUseFor, } from "./types.js";
+export type { AudienceTag, EnvelopedHandlerDefinition, EnvelopeFor, HandlerContext, HandlerDefinition, HandlerFailure, SessionRowReads, ShapeOutput, SharedHandler, SharedHandlerOutputBound, SharedHandlerOutputData, SharedHandlerResult, ViewProofDeclaration, ViewProofUse, } from "./types.js";
 export * from "./threads/index.js";
 export * from "./credits/index.js";
 export * from "./app-discovery/index.js";

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAEH,cAAc,uBAAuB,CAAC;AACtC,cAAc,oBAAoB,CAAC;AACnC,OAAO,EACL,iBAAiB,EACjB,sBAAsB,EACtB,aAAa,EACb,cAAc,EACd,gBAAgB,GACjB,MAAM,YAAY,CAAC;AACpB,YAAY,EACV,WAAW,EACX,0BAA0B,EAC1B,WAAW,EACX,cAAc,EACd,iBAAiB,EACjB,cAAc,EACd,WAAW,EACX,aAAa,EACb,wBAAwB,EACxB,uBAAuB,EACvB,mBAAmB,GACpB,MAAM,YAAY,CAAC;AAIpB,cAAc,oBAAoB,CAAC;AAInC,cAAc,oBAAoB,CAAC;AAInC,cAAc,0BAA0B,CAAC;AAIzC,cAAc,0BAA0B,CAAC;AAKzC,cAAc,qBAAqB,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAEH,cAAc,uBAAuB,CAAC;AACtC,cAAc,oBAAoB,CAAC;AACnC,OAAO,EACL,iBAAiB,EACjB,sBAAsB,EACtB,qBAAqB,EACrB,aAAa,EACb,cAAc,EACd,gBAAgB,EAChB,cAAc,EACd,eAAe,GAChB,MAAM,YAAY,CAAC;AACpB,YAAY,EACV,WAAW,EACX,0BAA0B,EAC1B,WAAW,EACX,cAAc,EACd,iBAAiB,EACjB,cAAc,EACd,eAAe,EACf,WAAW,EACX,aAAa,EACb,wBAAwB,EACxB,uBAAuB,EACvB,mBAAmB,EACnB,oBAAoB,EACpB,YAAY,GACb,MAAM,YAAY,CAAC;AAIpB,cAAc,oBAAoB,CAAC;AAInC,cAAc,oBAAoB,CAAC;AAInC,cAAc,0BAA0B,CAAC;AAIzC,cAAc,0BAA0B,CAAC;AAKzC,cAAc,qBAAqB,CAAC"}

package/dist/index.js

@@ -15,7 +15,7 @@
  */
 export * from "./blueprints/index.js";
 export * from "./renders/index.js";
-export { AuthRequiredError, HANDLER_FAILURE_MARKER, defineHandler, handlerFailure, isHandlerFailure, } from "./types.js";
+export { AuthRequiredError, HANDLER_FAILURE_MARKER, createSessionRowReads, defineHandler, handlerFailure, isHandlerFailure, readSessionRow, viewProofUseFor, } from "./types.js";
 // Persistent-chat handler family — thread storage and message
 // history MCP tools. Thin over @ggui-ai/mcp-server-core ThreadStore.
 // Available under `@ggui-ai/mcp-server-handlers/threads` subpath too.

package/dist/ops-blueprint/cache-mirror.d.ts

@@ -0,0 +1,41 @@
+/**
+ * How an ops writer mirrors its durable row into the cache registry
+ * (ggui#1497): under ONE id.
+ *
+ * `ggui_ops_register_blueprint` (with `createRegisterGeneratedBlueprint`,
+ * which shares its core) and `ggui_ops_generate_blueprint` each put the
+ * durable row first, then mirror it into the cache so the exact-key probe
+ * finds it. The mirror used to mint an id of its own, so a render served
+ * from that cache row recorded an id the writer's store never held. The
+ * mirror now takes the writer's id (`mintId`), and what else it writes
+ * depends on where re-mint reads:
+ *
+ * - The mirror's registry writes through to a durable store OTHER than the
+ *   writer's (a server that keeps its re-mint store apart from the ops
+ *   store): the full write-through runs, now under the shared id, so the
+ *   store re-mint reads holds the row and the compiled body under the id
+ *   the cache serves.
+ * - It writes through to the writer's OWN store: the row is already there
+ *   under this id, and the store refuses a second put of it, so the mirror
+ *   skips the row but still puts the compiled body into its code store,
+ *   where re-mint reads it.
+ * - No durable store (a code store at most): nothing more is written; the
+ *   writer's own store and body are what re-mint reads.
+ *
+ * The authored source still reaches a bound code store in every case
+ * (ggui#1493). A dedup is unchanged: an exact key already bound returns its
+ * existing id, and nothing more is written for it.
+ */
+import type { BlueprintStore } from "@ggui-ai/mcp-server-core";
+import { type BlueprintRegistryDeps, type RegisterBlueprintInput, type RegisteredBlueprint } from "../renders/blueprint-registry.js";
+export declare function mirrorIntoCache(args: {
+    /** The cache registry the writer mirrors into. */
+    readonly cacheRegistry: BlueprintRegistryDeps;
+    /** The store the writer already put the durable row in, under `blueprintId`. */
+    readonly writerStore: BlueprintStore;
+    readonly appId: string;
+    /** The writer's durable row id: the cache row takes it. */
+    readonly blueprintId: string;
+    readonly input: RegisterBlueprintInput;
+}): Promise<RegisteredBlueprint>;
+//# sourceMappingURL=cache-mirror.d.ts.map

package/dist/ops-blueprint/cache-mirror.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"cache-mirror.d.ts","sourceRoot":"","sources":["../../src/ops-blueprint/cache-mirror.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AACH,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,0BAA0B,CAAC;AAC/D,OAAO,EAEL,KAAK,qBAAqB,EAC1B,KAAK,sBAAsB,EAC3B,KAAK,mBAAmB,EACzB,MAAM,kCAAkC,CAAC;AAE1C,wBAAsB,eAAe,CAAC,IAAI,EAAE;IAC1C,kDAAkD;IAClD,QAAQ,CAAC,aAAa,EAAE,qBAAqB,CAAC;IAC9C,gFAAgF;IAChF,QAAQ,CAAC,WAAW,EAAE,cAAc,CAAC;IACrC,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,2DAA2D;IAC3D,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,KAAK,EAAE,sBAAsB,CAAC;CACxC,GAAG,OAAO,CAAC,mBAAmB,CAAC,CAkB/B"}

package/dist/ops-blueprint/cache-mirror.js

@@ -0,0 +1,19 @@
+import { registerBlueprint, } from "../renders/blueprint-registry.js";
+export async function mirrorIntoCache(args) {
+    const durability = args.cacheRegistry.durability;
+    const sharesWriterStore = durability?.blueprintStore !== undefined && durability.blueprintStore === args.writerStore;
+    const deps = sharesWriterStore
+        ? {
+            ...args.cacheRegistry,
+            durability: durability.codeStore !== undefined ? { codeStore: durability.codeStore } : {},
+        }
+        : args.cacheRegistry;
+    const registered = await registerBlueprint(deps, args.appId, args.input, {
+        mintId: () => args.blueprintId,
+    });
+    const codeStore = durability?.codeStore;
+    if (sharesWriterStore && !registered.deduped && codeStore !== undefined && args.input.componentCode.length > 0) {
+        await codeStore.put(codeStore.hashOf(args.input.componentCode), args.input.componentCode);
+    }
+    return registered;
+}

package/dist/ops-blueprint/delete.d.ts

@@ -18,12 +18,23 @@
  * a foreign `appId` input the authorizer denies surfaces the denial
  * error before the row lookup ever runs.
  *
+ * ## Out of reuse (ggui#1541)
+ *
+ * `ggui_ops_register_blueprint` and `ggui_ops_generate_blueprint` write a
+ * blueprint twice: the durable row, and a mirror in the cache registry, the
+ * store the handshake's exact-key probe matches from. So a delete removes
+ * both, the cache row first: a cache delete that fails fails the call
+ * before the durable row goes, and a retry completes it. An id whose
+ * durable row is already gone still has its cache row cleared in the
+ * caller's own app scope, which heals a row an earlier delete left behind.
+ *
  * ## Audience
  *
  * `['ops']` — served on `/control`. NOT visible to agents on `/mcp`.
  */
 import { z } from 'zod';
 import type { BlueprintStore } from '@ggui-ai/mcp-server-core';
+import { type BlueprintRegistryDeps } from '../renders/blueprint-registry.js';
 import { type OpsBlueprintAppAuthorizer } from './app-access.js';
 /**
  * Deps for `ggui_ops_delete_blueprint`.
@@ -45,6 +56,13 @@ export interface GguiOpsDeleteBlueprintDeps {
      * the target row belongs to a different app (no existence leak).
      */
     readonly authorizeAppAccess?: OpsBlueprintAppAuthorizer;
+    /**
+     * The cache registry the writers mirror into (ggui#1541): the SAME one
+     * `ggui_ops_register_blueprint` and `ggui_ops_generate_blueprint` are
+     * given. When bound, a delete removes the blueprint's cache row (its
+     * vector and its exact-key binding) so the handshake stops reusing it.
+     */
+    readonly cacheRegistry?: Pick<BlueprintRegistryDeps, 'vectorStore' | 'index'>;
 }
 export declare function createGguiOpsDeleteBlueprintHandler(deps: GguiOpsDeleteBlueprintDeps): import("../types.js").SharedHandler<{
     appId: z.ZodOptional<z.ZodString>;

package/dist/ops-blueprint/delete.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"delete.d.ts","sourceRoot":"","sources":["../../src/ops-blueprint/delete.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAMxB,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,0BAA0B,CAAC;AAE/D,OAAO,EAAyB,KAAK,yBAAyB,EAAE,MAAM,iBAAiB,CAAC;AAOxF;;GAEG;AACH,MAAM,WAAW,0BAA0B;IACzC,QAAQ,CAAC,cAAc,EAAE,cAAc,CAAC;IACxC;;;;;;;;;;;;;OAaG;IACH,QAAQ,CAAC,kBAAkB,CAAC,EAAE,yBAAyB,CAAC;CACzD;AAED,wBAAgB,mCAAmC,CACjD,IAAI,EAAE,0BAA0B;;;;;;;GAwCjC"}
+{"version":3,"file":"delete.d.ts","sourceRoot":"","sources":["../../src/ops-blueprint/delete.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAiCG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAMxB,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,0BAA0B,CAAC;AAC/D,OAAO,EAAmB,KAAK,qBAAqB,EAAE,MAAM,kCAAkC,CAAC;AAE/F,OAAO,EAAyB,KAAK,yBAAyB,EAAE,MAAM,iBAAiB,CAAC;AAOxF;;GAEG;AACH,MAAM,WAAW,0BAA0B;IACzC,QAAQ,CAAC,cAAc,EAAE,cAAc,CAAC;IACxC;;;;;;;;;;;;;OAaG;IACH,QAAQ,CAAC,kBAAkB,CAAC,EAAE,yBAAyB,CAAC;IACxD;;;;;OAKG;IACH,QAAQ,CAAC,aAAa,CAAC,EAAE,IAAI,CAAC,qBAAqB,EAAE,aAAa,GAAG,OAAO,CAAC,CAAC;CAC/E;AAED,wBAAgB,mCAAmC,CACjD,IAAI,EAAE,0BAA0B;;;;;;;GA8CjC"}

package/dist/ops-blueprint/delete.js

@@ -18,12 +18,23 @@
  * a foreign `appId` input the authorizer denies surfaces the denial
  * error before the row lookup ever runs.
  *
+ * ## Out of reuse (ggui#1541)
+ *
+ * `ggui_ops_register_blueprint` and `ggui_ops_generate_blueprint` write a
+ * blueprint twice: the durable row, and a mirror in the cache registry, the
+ * store the handshake's exact-key probe matches from. So a delete removes
+ * both, the cache row first: a cache delete that fails fails the call
+ * before the durable row goes, and a retry completes it. An id whose
+ * durable row is already gone still has its cache row cleared in the
+ * caller's own app scope, which heals a row an earlier delete left behind.
+ *
  * ## Audience
  *
  * `['ops']` — served on `/control`. NOT visible to agents on `/mcp`.
  */
 import { z } from 'zod';
 import { opsDeleteBlueprintInputSchema, } from '@ggui-ai/protocol';
+import { deleteBlueprint } from '../renders/blueprint-registry.js';
 import { defineHandler } from '../types.js';
 import { resolveEffectiveAppId } from './app-access.js';
 const opsInputSchema = opsDeleteBlueprintInputSchema.shape;
@@ -35,7 +46,7 @@ export function createGguiOpsDeleteBlueprintHandler(deps) {
         name: 'ggui_ops_delete_blueprint',
         title: 'Delete blueprint',
         audience: ['ops'],
-        description: "Remove a blueprint row by id. Idempotent — a second delete for the same id returns `{deleted: true}` without throwing. Cross-app probes return the same shape (no existence leak across apps). Mirrors `BlueprintStore.delete`'s no-throw contract. App-scoped variant curation for an app you operate — distinct from the personal saved-blueprint library (the _my_ tools).",
+        description: "Remove a blueprint by id: its durable row, and its entry in the cache the handshake reuses blueprints from, so it is no longer reused. Idempotent — a second delete for the same id returns `{deleted: true}` without throwing. Cross-app probes return the same shape (no existence leak across apps). Mirrors `BlueprintStore.delete`'s no-throw contract. App-scoped variant curation for an app you operate — distinct from the personal saved-blueprint library (the _my_ tools).",
         inputSchema: opsInputSchema,
         outputSchema: opsOutputSchema,
         async handler(rawInput, ctx) {
@@ -48,7 +59,11 @@ export function createGguiOpsDeleteBlueprintHandler(deps) {
             });
             const existing = await deps.blueprintStore.get(parsed.blueprintId);
             if (existing === null) {
-                // Unknown id — idempotent. Return the success shape.
+                // Unknown id — idempotent. Its cache row may outlive it (an earlier
+                // delete removed the durable row only): clear it in the caller's
+                // own app scope, which says nothing about any other app.
+                if (deps.cacheRegistry)
+                    await deleteBlueprint(deps.cacheRegistry, appId, parsed.blueprintId);
                 return { deleted: true };
             }
             if (existing.appId !== appId) {
@@ -58,6 +73,10 @@ export function createGguiOpsDeleteBlueprintHandler(deps) {
                 // leak across app boundaries.
                 return { deleted: true };
             }
+            // Out of reuse first, then the durable row: a cache delete that fails
+            // fails the call with the durable row intact, so a retry completes it.
+            if (deps.cacheRegistry)
+                await deleteBlueprint(deps.cacheRegistry, appId, parsed.blueprintId);
             await deps.blueprintStore.delete(parsed.blueprintId);
             return { deleted: true };
         },

package/dist/ops-blueprint/errors.d.ts

@@ -57,6 +57,17 @@ export declare class DirectionScopeWithoutDigestError extends Error {
     readonly code: "direction_scope_without_digest";
     constructor();
 }
+/**
+ * ggui#1570 — a registration named a parent (`clonedFrom`) this registration
+ * cannot record: an empty id, the row's own id, or an id that is not a row of
+ * the registering app in the durable store. One answer for all of them, and
+ * the same text for a missing row and another app's, so the refusal says
+ * nothing about another app's rows. Refused before anything is persisted.
+ */
+export declare class ClonedFromRefusedError extends Error {
+    readonly code: "cloned_from_refused";
+    constructor(clonedFrom: string);
+}
 export declare class MissingCredentialsError extends Error {
     readonly code: "missing_credentials";
     constructor(message?: string);

package/dist/ops-blueprint/errors.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"errors.d.ts","sourceRoot":"","sources":["../../src/ops-blueprint/errors.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAEH;;;;;;;;;;;;;;;;;;;GAmBG;AACH,qBAAa,sBAAuB,SAAQ,KAAK;IAC/C,QAAQ,CAAC,IAAI,EAAG,qBAAqB,CAAU;gBACnC,IAAI,EAAE,MAAM,EAAE,eAAe,EAAE,SAAS,MAAM,EAAE;CAM7D;AAED;;;;;;;;;;GAUG;AACH;;;;;;;GAOG;AACH,qBAAa,gCAAiC,SAAQ,KAAK;IACzD,QAAQ,CAAC,IAAI,EAAG,gCAAgC,CAAU;;CAO3D;AAED,qBAAa,uBAAwB,SAAQ,KAAK;IAChD,QAAQ,CAAC,IAAI,EAAG,qBAAqB,CAAU;gBACnC,OAAO,CAAC,EAAE,MAAM;CAO7B;AAED;;;;;GAKG;AACH,qBAAa,qBAAsB,SAAQ,KAAK;IAC9C,QAAQ,CAAC,IAAI,EAAG,mBAAmB,CAAU;IAC7C,QAAQ,CAAC,KAAK,EAAE,OAAO,CAAC;gBACZ,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO;CAK5C"}
+{"version":3,"file":"errors.d.ts","sourceRoot":"","sources":["../../src/ops-blueprint/errors.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAEH;;;;;;;;;;;;;;;;;;;GAmBG;AACH,qBAAa,sBAAuB,SAAQ,KAAK;IAC/C,QAAQ,CAAC,IAAI,EAAG,qBAAqB,CAAU;gBACnC,IAAI,EAAE,MAAM,EAAE,eAAe,EAAE,SAAS,MAAM,EAAE;CAM7D;AAED;;;;;;;;;;GAUG;AACH;;;;;;;GAOG;AACH,qBAAa,gCAAiC,SAAQ,KAAK;IACzD,QAAQ,CAAC,IAAI,EAAG,gCAAgC,CAAU;;CAO3D;AAED;;;;;;GAMG;AACH,qBAAa,sBAAuB,SAAQ,KAAK;IAC/C,QAAQ,CAAC,IAAI,EAAG,qBAAqB,CAAU;gBACnC,UAAU,EAAE,MAAM;CAM/B;AAED,qBAAa,uBAAwB,SAAQ,KAAK;IAChD,QAAQ,CAAC,IAAI,EAAG,qBAAqB,CAAU;gBACnC,OAAO,CAAC,EAAE,MAAM;CAO7B;AAED;;;;;GAKG;AACH,qBAAa,qBAAsB,SAAQ,KAAK;IAC9C,QAAQ,CAAC,IAAI,EAAG,mBAAmB,CAAU;IAC7C,QAAQ,CAAC,KAAK,EAAE,OAAO,CAAC;gBACZ,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO;CAK5C"}

package/dist/ops-blueprint/errors.js

@@ -63,6 +63,20 @@ export class DirectionScopeWithoutDigestError extends Error {
         this.name = "DirectionScopeWithoutDigestError";
     }
 }
+/**
+ * ggui#1570 — a registration named a parent (`clonedFrom`) this registration
+ * cannot record: an empty id, the row's own id, or an id that is not a row of
+ * the registering app in the durable store. One answer for all of them, and
+ * the same text for a missing row and another app's, so the refusal says
+ * nothing about another app's rows. Refused before anything is persisted.
+ */
+export class ClonedFromRefusedError extends Error {
+    code = "cloned_from_refused";
+    constructor(clonedFrom) {
+        super(`cloned_from_refused: clonedFrom "${clonedFrom}" is not another row of this app — a copy names a row of its own app, other than itself, that the store holds.`);
+        this.name = "ClonedFromRefusedError";
+    }
+}
 export class MissingCredentialsError extends Error {
     code = "missing_credentials";
     constructor(message) {

package/dist/ops-blueprint/generate.d.ts

@@ -3,7 +3,7 @@
  *
  * Operator UX entry point. Dispatches through the bound
  * {@link GeneratorRegistry} to mint a blueprint variant with
- * operator-authored variance tags + optional default-pin.
+ * operator-authored variance tags + an optional operator-default mark.
  *
  * ## Behavior
  *
@@ -177,7 +177,6 @@ export declare function createGguiOpsGenerateBlueprintHandler(deps: GguiOpsGener
 }, {
     blueprintId: z.ZodString;
     codeHash: z.ZodOptional<z.ZodString>;
-    validatorScore: z.ZodOptional<z.ZodNumber>;
     source: z.ZodObject<{
         kind: z.ZodLiteral<"llm">;
         generator: z.ZodString;
@@ -187,6 +186,5 @@ export declare function createGguiOpsGenerateBlueprintHandler(deps: GguiOpsGener
     blueprintId: string;
     source: import("@ggui-ai/protocol").LlmBlueprintSource;
     codeHash?: string | undefined;
-    validatorScore?: number | undefined;
 }>;
 //# sourceMappingURL=generate.d.ts.map

package/dist/ops-blueprint/generate.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"generate.d.ts","sourceRoot":"","sources":["../../src/ops-blueprint/generate.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+CG;AAEH,OAAO,KAAK,EACV,gBAAgB,EAChB,iBAAiB,EACjB,cAAc,EACd,iBAAiB,EACjB,aAAa,EAGd,MAAM,0BAA0B,CAAC;AAClC,OAAO,EAGL,KAAK,SAAS,EACd,KAAK,YAAY,EAIlB,MAAM,mBAAmB,CAAC;AAG3B,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAGxB,OAAO,EAEL,KAAK,qBAAqB,EAC1B,KAAK,qBAAqB,EAC3B,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EAAiB,KAAK,cAAc,EAAE,MAAM,aAAa,CAAC;AACjE,OAAO,EAAyB,KAAK,yBAAyB,EAAE,MAAM,iBAAiB,CAAC;AAsBxF;;;;;;GAMG;AACH,MAAM,WAAW,WAAW;IAC1B,CAAC,QAAQ,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CACxD;AAED;;GAEG;AACH,MAAM,WAAW,4BAA4B;IAC3C;;;;OAIG;IACH,QAAQ,CAAC,QAAQ,EAAE,iBAAiB,CAAC;IACrC;;;OAGG;IACH,QAAQ,CAAC,cAAc,EAAE,cAAc,CAAC;IACxC;;;;;;;OAOG;IACH,QAAQ,CAAC,aAAa,CAAC,EAAE,CAAC,KAAK,EAAE,MAAM,KAAK,OAAO,CAAC,SAAS,SAAS,EAAE,CAAC,CAAC;IAC1E;;;;;;;OAOG;IACH,QAAQ,CAAC,gBAAgB,CAAC,EAAE,gBAAgB,CAAC;IAC7C;;;;;OAKG;IACH,QAAQ,CAAC,UAAU,EAAE,CACnB,GAAG,EAAE,cAAc,KAChB,OAAO,CAAC,qBAAqB,GAAG,IAAI,CAAC,GAAG,qBAAqB,GAAG,IAAI,CAAC;IAC1E;;;;OAIG;IACH,QAAQ,CAAC,UAAU,EAAE,iBAAiB,CAAC;IACvC;;;;;;OAMG;IACH,QAAQ,CAAC,OAAO,CAAC,EAAE,WAAW,CAAC;IAC/B;;;;;;;;;;;;;;;;;;;;OAoBG;IACH,QAAQ,CAAC,aAAa,CAAC,EAAE,qBAAqB,CAAC;IAC/C;;;;OAIG;IACH,QAAQ,CAAC,SAAS,CAAC,EAAE,aAAa,CAAC;IACnC;;;OAGG;IACH,QAAQ,CAAC,GAAG,CAAC,EAAE,MAAM,MAAM,CAAC;IAC5B;;;OAGG;IACH,QAAQ,CAAC,eAAe,CAAC,EAAE,MAAM,MAAM,CAAC;IACxC;;;;;;;OAOG;IACH,QAAQ,CAAC,kBAAkB,CAAC,EAAE,yBAAyB,CAAC;CACzD;AA2CD,wBAAgB,qCAAqC,CACnD,IAAI,EAAE,4BAA4B;;;;;;;;;;;;;;;;;;;;;;;;GA0SnC"}
+{"version":3,"file":"generate.d.ts","sourceRoot":"","sources":["../../src/ops-blueprint/generate.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+CG;AAEH,OAAO,KAAK,EACV,gBAAgB,EAChB,iBAAiB,EACjB,cAAc,EACd,iBAAiB,EACjB,aAAa,EAGd,MAAM,0BAA0B,CAAC;AAClC,OAAO,EAGL,KAAK,SAAS,EACd,KAAK,YAAY,EAIlB,MAAM,mBAAmB,CAAC;AAG3B,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAGxB,OAAO,EAEL,KAAK,qBAAqB,EAC1B,KAAK,qBAAqB,EAC3B,MAAM,qBAAqB,CAAC;AAE7B,OAAO,EAAiB,KAAK,cAAc,EAAE,MAAM,aAAa,CAAC;AACjE,OAAO,EAAyB,KAAK,yBAAyB,EAAE,MAAM,iBAAiB,CAAC;AAqBxF;;;;;;GAMG;AACH,MAAM,WAAW,WAAW;IAC1B,CAAC,QAAQ,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CACxD;AAED;;GAEG;AACH,MAAM,WAAW,4BAA4B;IAC3C;;;;OAIG;IACH,QAAQ,CAAC,QAAQ,EAAE,iBAAiB,CAAC;IACrC;;;OAGG;IACH,QAAQ,CAAC,cAAc,EAAE,cAAc,CAAC;IACxC;;;;;;;OAOG;IACH,QAAQ,CAAC,aAAa,CAAC,EAAE,CAAC,KAAK,EAAE,MAAM,KAAK,OAAO,CAAC,SAAS,SAAS,EAAE,CAAC,CAAC;IAC1E;;;;;;;OAOG;IACH,QAAQ,CAAC,gBAAgB,CAAC,EAAE,gBAAgB,CAAC;IAC7C;;;;;OAKG;IACH,QAAQ,CAAC,UAAU,EAAE,CACnB,GAAG,EAAE,cAAc,KAChB,OAAO,CAAC,qBAAqB,GAAG,IAAI,CAAC,GAAG,qBAAqB,GAAG,IAAI,CAAC;IAC1E;;;;OAIG;IACH,QAAQ,CAAC,UAAU,EAAE,iBAAiB,CAAC;IACvC;;;;;;OAMG;IACH,QAAQ,CAAC,OAAO,CAAC,EAAE,WAAW,CAAC;IAC/B;;;;;;;;;;;;;;;;;;;;OAoBG;IACH,QAAQ,CAAC,aAAa,CAAC,EAAE,qBAAqB,CAAC;IAC/C;;;;OAIG;IACH,QAAQ,CAAC,SAAS,CAAC,EAAE,aAAa,CAAC;IACnC;;;OAGG;IACH,QAAQ,CAAC,GAAG,CAAC,EAAE,MAAM,MAAM,CAAC;IAC5B;;;OAGG;IACH,QAAQ,CAAC,eAAe,CAAC,EAAE,MAAM,MAAM,CAAC;IACxC;;;;;;;OAOG;IACH,QAAQ,CAAC,kBAAkB,CAAC,EAAE,yBAAyB,CAAC;CACzD;AA0BD,wBAAgB,qCAAqC,CACnD,IAAI,EAAE,4BAA4B;;;;;;;;;;;;;;;;;;;;;;GAkTnC"}

package/dist/ops-blueprint/generate.js

@@ -3,7 +3,7 @@
  *
  * Operator UX entry point. Dispatches through the bound
  * {@link GeneratorRegistry} to mint a blueprint variant with
- * operator-authored variance tags + optional default-pin.
+ * operator-authored variance tags + an optional operator-default mark.
  *
  * ## Behavior
  *
@@ -52,7 +52,8 @@ import { createHash, randomUUID } from "node:crypto";
 import { z } from "zod";
 import { assertContractNoRetiredFields } from "../renders/assert-contract-no-retired-fields.js";
 import { assertGadgetsRegistered } from "../renders/assert-gadgets.js";
-import { registerBlueprint, } from "../renders/index.js";
+import { admitGeneratorBuild, } from "../renders/index.js";
+import { mirrorIntoCache } from "./cache-mirror.js";
 import { defineHandler } from "../types.js";
 import { resolveEffectiveAppId } from "./app-access.js";
 import { GenerationFailedError, GeneratorNotFoundError, MissingCredentialsError, } from "./errors.js";
@@ -61,7 +62,6 @@ const opsInputSchema = opsGenerateBlueprintInputSchema.shape;
 const opsOutputSchema = z.object({
     blueprintId: z.string().min(1),
     codeHash: z.string().optional(),
-    validatorScore: z.number().min(0).max(1).optional(),
     source: z
         .object({
         kind: z.literal("llm"),
@@ -70,26 +70,6 @@ const opsOutputSchema = z.object({
     })
         .strict(),
 }).shape;
-/**
- * Read the optional `validatorScore` carried on
- * {@link GenerationMetadata} by the advanced generator, which does
- * not yet have an explicit field on the canonical interface. Until
- * that lands the score arrives as a structural pass-through on
- * `metadata` — the read is type-guarded here so the cast is
- * confined to one place and the call sites stay clean.
- */
-function readValidatorScore(metadata) {
-    if (!metadata || typeof metadata !== "object")
-        return undefined;
-    const candidate = metadata.validatorScore;
-    if (typeof candidate !== "number")
-        return undefined;
-    if (!Number.isFinite(candidate))
-        return undefined;
-    if (candidate < 0 || candidate > 1)
-        return undefined;
-    return candidate;
-}
 /**
  * Resolve which generator to dispatch. Throws {@link GeneratorNotFoundError}
  * with a clear "did you mean…" payload when the slug is unknown.
@@ -117,7 +97,7 @@ export function createGguiOpsGenerateBlueprintHandler(deps) {
         name: "ggui_ops_generate_blueprint",
         title: "Generate blueprint",
         audience: ["ops"],
-        description: "Author a new blueprint variant for the target app (the caller's bound app by default, or an explicitly named app the deployment's authorization policy accepts). Dispatches through the registry's selected generator (defaults to `registry.defaultGenerator()` when the slug is omitted) and persists the resulting code body + metadata against a fresh `blueprintId`. Optionally pins the new blueprint as the operator default for its `(appId, contractHash)` group. Persona tags are normalized (lowercase + trim); near-duplicates surface a warning via telemetry. Returns the new id + content-hash + validator score + the stamped provenance (`source`, llm arm: engine generator slug + model, from the engine's own metadata stamp) — code body lives in the bound store, fetched via render's fast-path on cache hit. App-scoped variant curation for an app you operate — distinct from the personal saved-blueprint library (the _my_ tools).",
+        description: "Author a new blueprint variant for the target app (the caller's bound app by default, or an explicitly named app the deployment's authorization policy accepts). Dispatches through the registry's selected generator (defaults to `registry.defaultGenerator()` when the slug is omitted) and persists the resulting code body + metadata against a fresh `blueprintId`. Optionally marks the new blueprint as the operator default for its `(appId, contractHash)` group (the mark orders blueprint listings; it does not decide which blueprint serves a render). Persona tags are normalized (lowercase + trim); near-duplicates surface a warning via telemetry. Returns the new id + content-hash + validator score + the stamped provenance (`source`, llm arm: engine generator slug + model, from the engine's own metadata stamp) — code body lives in the bound store, fetched via render's fast-path on cache hit. App-scoped variant curation for an app you operate — distinct from the personal saved-blueprint library (the _my_ tools).",
         inputSchema: opsInputSchema,
         outputSchema: opsOutputSchema,
         async handler(rawInput, ctx) {
@@ -255,12 +235,6 @@ export function createGguiOpsGenerateBlueprintHandler(deps) {
             // bytes. A 32-hex prefix here (ggui#1287) was refused by every
             // conforming code store.
             const codeHash = createHash("sha256").update(componentCode).digest("hex");
-            // The advanced generator tunnels `validatorScore` through
-            // `metadata` until the UiGenerator interface widens to carry
-            // it explicitly. Read it via the typed helper so the default
-            // generator (which never sets it) and the advanced generator
-            // (which does) both round-trip cleanly.
-            const validatorScore = readValidatorScore(result.metadata);
             // Engine-GENERATED code: provenance is the llm arm, stamped from
             // the engine's own metadata claim — the SAME values the cache-
             // registry mirror below records, so the two stores can never
@@ -270,6 +244,13 @@ export function createGguiOpsGenerateBlueprintHandler(deps) {
                 generator: result.metadata.generator,
                 model: result.metadata.model,
             };
+            // ggui#1280 — the minting engine's build, through the registry's one
+            // admission rule. The durable row below carries it. The cache mirror's
+            // registration receives the same value: it rides that registry's
+            // vector-store row (ggui#1476) and, when the mirror writes through to a
+            // separate durable store, the row it writes there under this same id
+            // (ggui#1497, see `mirrorIntoCache`).
+            const build = admitGeneratorBuild(source, result.metadata.build);
             const blueprintId = mintBlueprintId();
             const blueprint = {
                 blueprintId,
@@ -286,7 +267,7 @@ export function createGguiOpsGenerateBlueprintHandler(deps) {
                 createdAt: now(),
                 createdBy: "operator",
                 contract,
-                ...(validatorScore !== undefined ? { validatorScore } : {}),
+                ...(build !== undefined ? { build } : {}),
             };
             await deps.blueprintStore.put(blueprint);
             if (deps.putCode) {
@@ -305,31 +286,40 @@ export function createGguiOpsGenerateBlueprintHandler(deps) {
                         parsed.seedPrompt ??
                         normalizedPersona ??
                         `operator-authored blueprint (${blueprintId})`;
-                    await registerBlueprint(deps.cacheRegistry, appId, {
-                        kind: "template",
-                        contract,
-                        intent: intentForCache,
-                        // ggui#1275 — an explicit intent or a seed prompt states the
-                        // UI's task; a persona or the placeholder is a stand-in the
-                        // matcher's judge never sees.
-                        intentSource: parsed.intent !== undefined || parsed.seedPrompt !== undefined
-                            ? "authored"
-                            : "fallback",
-                        componentCode,
-                        // The cache row MUST carry the same variance as the MVB
-                        // row: `registerBlueprint` keys the exact-lookup on
-                        // `variantKey(variance)`, so omitting it here filed every
-                        // operator-authored variant under the default-variant
-                        // sentinel — invisible to any request that asks for the
-                        // persona it was minted for.
-                        variance: blueprint.variance,
-                        // Operator-DISPATCHED but engine-GENERATED: the code came
-                        // out of `generator.generate(...)`, so provenance is the
-                        // llm arm — the same `source` stamped on the MVB row above.
-                        // The two axes disagree here on purpose, which is exactly
-                        // why `createdBy` cannot be derived from `source`.
-                        source,
-                        createdBy: "operator",
+                    // ggui#1497 — ONE id per generation: the cache row serves the
+                    // durable row's id (see `mirrorIntoCache` for what else it writes).
+                    await mirrorIntoCache({
+                        cacheRegistry: deps.cacheRegistry,
+                        writerStore: deps.blueprintStore,
+                        appId,
+                        blueprintId,
+                        input: {
+                            kind: "template",
+                            contract,
+                            intent: intentForCache,
+                            // ggui#1275 — an explicit intent or a seed prompt states the
+                            // UI's task; a persona or the placeholder is a stand-in the
+                            // matcher's judge never sees.
+                            intentSource: parsed.intent !== undefined || parsed.seedPrompt !== undefined
+                                ? "authored"
+                                : "fallback",
+                            componentCode,
+                            // The cache row MUST carry the same variance as the MVB
+                            // row: `registerBlueprint` keys the exact-lookup on
+                            // `variantKey(variance)`, so omitting it here filed every
+                            // operator-authored variant under the default-variant
+                            // sentinel — invisible to any request that asks for the
+                            // persona it was minted for.
+                            variance: blueprint.variance,
+                            // Operator-DISPATCHED but engine-GENERATED: the code came
+                            // out of `generator.generate(...)`, so provenance is the
+                            // llm arm — the same `source` stamped on the MVB row above.
+                            // The two axes disagree here on purpose, which is exactly
+                            // why `createdBy` cannot be derived from `source`.
+                            source,
+                            ...(build !== undefined ? { build } : {}),
+                            createdBy: "operator",
+                        },
                     });
                 }
                 catch (err) {
@@ -352,7 +342,7 @@ export function createGguiOpsGenerateBlueprintHandler(deps) {
                     }
                 }
             }
-            // 7. Pin as operator default when requested.
+            // 7. Mark as operator default when requested.
             if (parsed.setAsOperatorDefault === true) {
                 await deps.blueprintStore.setOperatorDefault(blueprintId);
             }
@@ -381,7 +371,6 @@ export function createGguiOpsGenerateBlueprintHandler(deps) {
                 blueprintId,
                 codeHash,
                 source,
-                ...(validatorScore !== undefined ? { validatorScore } : {}),
             };
             return output;
         },

package/dist/ops-blueprint/list.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"list.d.ts","sourceRoot":"","sources":["../../src/ops-blueprint/list.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgCG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAGL,KAAK,SAAS,EAGf,MAAM,mBAAmB,CAAC;AAC3B,OAAO,KAAK,EACV,eAAe,EACf,cAAc,EACf,MAAM,0BAA0B,CAAC;AAElC,OAAO,EAAyB,KAAK,yBAAyB,EAAE,MAAM,iBAAiB,CAAC;AAQxF;;GAEG;AACH,MAAM,WAAW,yBAAyB;IACxC;;;OAGG;IACH,QAAQ,CAAC,cAAc,EAAE,cAAc,CAAC;IACxC;;;;;;OAMG;IACH,QAAQ,CAAC,eAAe,EAAE,eAAe,CAAC;IAC1C;;;;;;;OAOG;IACH,QAAQ,CAAC,kBAAkB,CAAC,EAAE,yBAAyB,CAAC;CACzD;AAmBD,wBAAgB,kCAAkC,CAChD,IAAI,EAAE,yBAAyB;;;;;;;;;;GAyFhC"}
+{"version":3,"file":"list.d.ts","sourceRoot":"","sources":["../../src/ops-blueprint/list.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgCG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAGL,KAAK,SAAS,EAGf,MAAM,mBAAmB,CAAC;AAC3B,OAAO,KAAK,EACV,eAAe,EACf,cAAc,EACf,MAAM,0BAA0B,CAAC;AAElC,OAAO,EAAyB,KAAK,yBAAyB,EAAE,MAAM,iBAAiB,CAAC;AAQxF;;GAEG;AACH,MAAM,WAAW,yBAAyB;IACxC;;;OAGG;IACH,QAAQ,CAAC,cAAc,EAAE,cAAc,CAAC;IACxC;;;;;;OAMG;IACH,QAAQ,CAAC,eAAe,EAAE,eAAe,CAAC;IAC1C;;;;;;;OAOG;IACH,QAAQ,CAAC,kBAAkB,CAAC,EAAE,yBAAyB,CAAC;CACzD;AAkBD,wBAAgB,kCAAkC,CAChD,IAAI,EAAE,yBAAyB;;;;;;;;;;GAyFhC"}

package/dist/ops-blueprint/list.js

@@ -42,8 +42,7 @@ const opsOutputSchema = {
 };
 /**
  * Sort blueprints by `createdAt desc`, then `blueprintId asc` as
- * stable tiebreaker. Mirrors the `BlueprintSelector` deterministic
- * ladder ordering (see `@ggui-ai/mcp-server-core/blueprint-selector`).
+ * stable tiebreaker.
  */
 function sortBlueprintsByCreatedAtDesc(rows) {
     return [...rows].sort((a, b) => {