@ggui-ai/mcp-server-handlers 0.6.3 → 0.7.0

package/dist/ops-apps/delete-app.d.ts

@@ -1,23 +1,38 @@
 /**
- * `ggui_ops_delete_app` — hard-delete a `GguiApp` row owned by the
+ * `ggui_ops_delete_app` — hard-delete an app record owned by the
  * caller.
  *
  * Tenancy: cross-tenant probes return the success shape WITHOUT
  * touching the row (uniform shape; no existence leak). Idempotent —
  * a second delete of the same id resolves cleanly.
  *
- * What the cloud adapter additionally does on top of this seam (NOT
- * the responsibility of the handler):
- *   - Cascade-revoke per-app `GguiUserApiKey` rows
- *   - Cascade-clean per-app provider keys, blueprints, renders
- * The handler stays narrow; the adapter's `delete()` implementation
- * orchestrates the cascade.
+ * Default-app lock: REJECTED when the target is the caller's default
+ * app. `defaultAppId` is what the universal route resolves on every
+ * request, so deleting the app it names strands that route.
  *
- * Pure over the {@link AppsSource} seam.
+ * The check runs AFTER the ownership read. `getDefault(ownerSub)`
+ * only ever reads the caller's own row, so ordering is not what keeps
+ * another tenant's default secret — nothing here could read it under
+ * any ordering. What ordering buys is SHAPE UNIFORMITY in the one
+ * state where the two branches disagree: the caller's own default
+ * naming an app the caller does not own. Ownership first answers that
+ * with the same `{deleted: true}` every other foreign id gets;
+ * lock-first would answer with a distinguishable error, and the
+ * difference is itself the signal.
+ *
+ * Scope: this handler removes the APP RECORD, through
+ * {@link AppsSource.delete}, and claims nothing beyond it. Whether
+ * data other stores hold for the same app disappears with it is the
+ * bound implementation's business, spelled out in that method's
+ * contract. `{deleted: true}` means the app record is gone — read no
+ * cascade into it.
+ *
+ * Pure over the {@link AppsSource} + {@link UserDefaultAppSource}
+ * seams.
  */
 import { z } from 'zod';
 import type { SharedHandler } from '../types.js';
-import type { AppsSource } from './types.js';
+import type { AppsSource, UserDefaultAppSource } from './types.js';
 declare const inputSchema: {
     readonly appId: z.ZodString;
 };
@@ -29,6 +44,8 @@ export interface DeleteAppOutput {
 }
 export interface DeleteAppDeps {
     readonly apps: AppsSource;
+    /** Read side only — the default-app lock reads `defaultAppId`, never writes it. */
+    readonly userDefaultApp: UserDefaultAppSource;
 }
 export declare function createDeleteAppHandler(deps: DeleteAppDeps): SharedHandler<typeof inputSchema, typeof outputSchema, DeleteAppOutput>;
 export {};

package/dist/ops-apps/delete-app.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"delete-app.d.ts","sourceRoot":"","sources":["../../src/ops-apps/delete-app.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AACH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,KAAK,EAAkB,aAAa,EAAE,MAAM,aAAa,CAAC;AAEjE,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,YAAY,CAAC;AAE7C,QAAA,MAAM,WAAW;;CAOP,CAAC;AAEX,QAAA,MAAM,YAAY;;CAER,CAAC;AAEX,MAAM,WAAW,eAAe;IAC9B,QAAQ,CAAC,OAAO,EAAE,IAAI,CAAC;CACxB;AAED,MAAM,WAAW,aAAa;IAC5B,QAAQ,CAAC,IAAI,EAAE,UAAU,CAAC;CAC3B;AAED,wBAAgB,sBAAsB,CACpC,IAAI,EAAE,aAAa,GAClB,aAAa,CAAC,OAAO,WAAW,EAAE,OAAO,YAAY,EAAE,eAAe,CAAC,CA8BzE"}
+{"version":3,"file":"delete-app.d.ts","sourceRoot":"","sources":["../../src/ops-apps/delete-app.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+BG;AACH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,KAAK,EAAkB,aAAa,EAAE,MAAM,aAAa,CAAC;AAGjE,OAAO,KAAK,EAAE,UAAU,EAAE,oBAAoB,EAAE,MAAM,YAAY,CAAC;AAEnE,QAAA,MAAM,WAAW;;CAOP,CAAC;AAEX,QAAA,MAAM,YAAY;;CAER,CAAC;AAEX,MAAM,WAAW,eAAe;IAC9B,QAAQ,CAAC,OAAO,EAAE,IAAI,CAAC;CACxB;AAED,MAAM,WAAW,aAAa;IAC5B,QAAQ,CAAC,IAAI,EAAE,UAAU,CAAC;IAC1B,mFAAmF;IACnF,QAAQ,CAAC,cAAc,EAAE,oBAAoB,CAAC;CAC/C;AAED,wBAAgB,sBAAsB,CACpC,IAAI,EAAE,aAAa,GAClB,aAAa,CAAC,OAAO,WAAW,EAAE,OAAO,YAAY,EAAE,eAAe,CAAC,CAqCzE"}

package/dist/ops-apps/delete-app.js

@@ -1,22 +1,38 @@
 /**
- * `ggui_ops_delete_app` — hard-delete a `GguiApp` row owned by the
+ * `ggui_ops_delete_app` — hard-delete an app record owned by the
  * caller.
  *
  * Tenancy: cross-tenant probes return the success shape WITHOUT
  * touching the row (uniform shape; no existence leak). Idempotent —
  * a second delete of the same id resolves cleanly.
  *
- * What the cloud adapter additionally does on top of this seam (NOT
- * the responsibility of the handler):
- *   - Cascade-revoke per-app `GguiUserApiKey` rows
- *   - Cascade-clean per-app provider keys, blueprints, renders
- * The handler stays narrow; the adapter's `delete()` implementation
- * orchestrates the cascade.
+ * Default-app lock: REJECTED when the target is the caller's default
+ * app. `defaultAppId` is what the universal route resolves on every
+ * request, so deleting the app it names strands that route.
  *
- * Pure over the {@link AppsSource} seam.
+ * The check runs AFTER the ownership read. `getDefault(ownerSub)`
+ * only ever reads the caller's own row, so ordering is not what keeps
+ * another tenant's default secret — nothing here could read it under
+ * any ordering. What ordering buys is SHAPE UNIFORMITY in the one
+ * state where the two branches disagree: the caller's own default
+ * naming an app the caller does not own. Ownership first answers that
+ * with the same `{deleted: true}` every other foreign id gets;
+ * lock-first would answer with a distinguishable error, and the
+ * difference is itself the signal.
+ *
+ * Scope: this handler removes the APP RECORD, through
+ * {@link AppsSource.delete}, and claims nothing beyond it. Whether
+ * data other stores hold for the same app disappears with it is the
+ * bound implementation's business, spelled out in that method's
+ * contract. `{deleted: true}` means the app record is gone — read no
+ * cascade into it.
+ *
+ * Pure over the {@link AppsSource} + {@link UserDefaultAppSource}
+ * seams.
  */
 import { z } from 'zod';
 import { resolveOwnerSub } from './identity.js';
+import { DefaultAppDeleteBlockedError } from './types.js';
 const inputSchema = {
     appId: z
         .string()
@@ -31,7 +47,7 @@ export function createDeleteAppHandler(deps) {
         name: 'ggui_ops_delete_app',
         title: 'Delete app',
         audience: ['ops'],
-        description: "Hard-delete an app owned by the calling user. Idempotent — a second delete returns `{deleted: true}`. Cross-tenant probes return the same shape without touching foreign rows (no existence leak). Cascades per-app keys / blueprints / renders at the cloud adapter layer.",
+        description: "Hard-delete an app owned by the calling user. Removes the APP RECORD only — data other stores hold for that app (saved blueprints, per-app provider keys, marketplace installs, issued keys) is not removed by this call, and whether the deployment cleans it up separately is the deployment's own policy. Idempotent — a second delete returns `{deleted: true}`. Cross-tenant probes return the same shape without touching foreign rows (no existence leak). Throws `default_app_delete_blocked` when the target is the caller's default app — set a different default first.",
         inputSchema,
         outputSchema,
         async handler(rawInput, ctx) {
@@ -44,10 +60,17 @@ export function createDeleteAppHandler(deps) {
             if (!existing) {
                 // Either the row doesn't exist or it lives under a different
                 // owner. Either way: return the success shape without
-                // touching DDB. Uniform across "missing" and "cross-tenant"
-                // prevents id-existence leak.
+                // touching the store. Uniform across "missing" and
+                // "cross-tenant" prevents id-existence leak.
                 return { deleted: true };
             }
+            // AFTER the ownership read, so a caller whose own default names
+            // a foreign app gets the same uniform shape as any other foreign
+            // id rather than a distinguishable lock error.
+            const currentDefault = await deps.userDefaultApp.getDefault(ownerSub);
+            if (currentDefault === parsed.appId) {
+                throw new DefaultAppDeleteBlockedError(parsed.appId);
+            }
             await deps.apps.delete({ appId: parsed.appId, ownerSub });
             return { deleted: true };
         },

package/dist/ops-apps/index.d.ts

@@ -14,7 +14,7 @@
  *   - `createSetDefaultAppHandler` → `ggui_ops_set_default_app`
  */
 export type { AppRecord, AppsSource, AppUpdatePatch, UserDefaultAppSource, } from './types.js';
-export { AppNotFoundError, OpsAppsAccessDeniedError } from './types.js';
+export { AppNotFoundError, DefaultAppDeleteBlockedError, OpsAppsAccessDeniedError, } from './types.js';
 export { createListAppsHandler } from './list-apps.js';
 export type { ListAppsDeps, ListAppsOutput } from './list-apps.js';
 export { createCreateAppHandler } from './create-app.js';

package/dist/ops-apps/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/ops-apps/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAEH,YAAY,EACV,SAAS,EACT,UAAU,EACV,cAAc,EACd,oBAAoB,GACrB,MAAM,YAAY,CAAC;AACpB,OAAO,EAAE,gBAAgB,EAAE,wBAAwB,EAAE,MAAM,YAAY,CAAC;AAExE,OAAO,EAAE,qBAAqB,EAAE,MAAM,gBAAgB,CAAC;AACvD,YAAY,EAAE,YAAY,EAAE,cAAc,EAAE,MAAM,gBAAgB,CAAC;AAEnE,OAAO,EAAE,sBAAsB,EAAE,MAAM,iBAAiB,CAAC;AACzD,YAAY,EAAE,aAAa,EAAE,eAAe,EAAE,MAAM,iBAAiB,CAAC;AAEtE,OAAO,EAAE,sBAAsB,EAAE,MAAM,iBAAiB,CAAC;AACzD,YAAY,EAAE,aAAa,EAAE,eAAe,EAAE,MAAM,iBAAiB,CAAC;AAEtE,OAAO,EAAE,wBAAwB,EAAE,MAAM,oBAAoB,CAAC;AAC9D,YAAY,EACV,eAAe,EACf,iBAAiB,GAClB,MAAM,oBAAoB,CAAC;AAE5B,OAAO,EAAE,sBAAsB,EAAE,MAAM,iBAAiB,CAAC;AACzD,YAAY,EAAE,aAAa,EAAE,eAAe,EAAE,MAAM,iBAAiB,CAAC;AAEtE,OAAO,EAAE,0BAA0B,EAAE,MAAM,sBAAsB,CAAC;AAClE,YAAY,EACV,iBAAiB,EACjB,mBAAmB,GACpB,MAAM,sBAAsB,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/ops-apps/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAEH,YAAY,EACV,SAAS,EACT,UAAU,EACV,cAAc,EACd,oBAAoB,GACrB,MAAM,YAAY,CAAC;AACpB,OAAO,EACL,gBAAgB,EAChB,4BAA4B,EAC5B,wBAAwB,GACzB,MAAM,YAAY,CAAC;AAEpB,OAAO,EAAE,qBAAqB,EAAE,MAAM,gBAAgB,CAAC;AACvD,YAAY,EAAE,YAAY,EAAE,cAAc,EAAE,MAAM,gBAAgB,CAAC;AAEnE,OAAO,EAAE,sBAAsB,EAAE,MAAM,iBAAiB,CAAC;AACzD,YAAY,EAAE,aAAa,EAAE,eAAe,EAAE,MAAM,iBAAiB,CAAC;AAEtE,OAAO,EAAE,sBAAsB,EAAE,MAAM,iBAAiB,CAAC;AACzD,YAAY,EAAE,aAAa,EAAE,eAAe,EAAE,MAAM,iBAAiB,CAAC;AAEtE,OAAO,EAAE,wBAAwB,EAAE,MAAM,oBAAoB,CAAC;AAC9D,YAAY,EACV,eAAe,EACf,iBAAiB,GAClB,MAAM,oBAAoB,CAAC;AAE5B,OAAO,EAAE,sBAAsB,EAAE,MAAM,iBAAiB,CAAC;AACzD,YAAY,EAAE,aAAa,EAAE,eAAe,EAAE,MAAM,iBAAiB,CAAC;AAEtE,OAAO,EAAE,0BAA0B,EAAE,MAAM,sBAAsB,CAAC;AAClE,YAAY,EACV,iBAAiB,EACjB,mBAAmB,GACpB,MAAM,sBAAsB,CAAC"}

package/dist/ops-apps/index.js

@@ -13,7 +13,7 @@
  *   - `createDeleteAppHandler` → `ggui_ops_delete_app`
  *   - `createSetDefaultAppHandler` → `ggui_ops_set_default_app`
  */
-export { AppNotFoundError, OpsAppsAccessDeniedError } from './types.js';
+export { AppNotFoundError, DefaultAppDeleteBlockedError, OpsAppsAccessDeniedError, } from './types.js';
 export { createListAppsHandler } from './list-apps.js';
 export { createCreateAppHandler } from './create-app.js';
 export { createUpdateAppHandler } from './update-app.js';

package/dist/ops-apps/types.d.ts

@@ -99,7 +99,25 @@ export interface AppsSource {
         ownerSub: string;
         patch: AppUpdatePatch;
     }): Promise<AppRecord>;
-    /** Hard delete. No-throw idempotent — second delete of the same id resolves. */
+    /**
+     * Hard delete. No-throw idempotent — a second delete of the same id
+     * resolves. Rejects cross-tenant.
+     *
+     * Scope of the obligation, stated because a caller cannot see it:
+     * this seam owns the APP RECORD and nothing else. Whatever other
+     * stores hold keyed by the same `appId` — saved blueprints, per-app
+     * provider keys, marketplace installs, issued keys — is outside it.
+     *
+     * An implementation MAY cascade those away inside its own `delete`,
+     * and MAY complete that cascade asynchronously after resolving. One
+     * that leaves rows behind — permanently or until an asynchronous
+     * sweep lands — MUST make that observable: a named, structured event
+     * naming the row classes left in place, emitted on the delete that
+     * orphaned them, carrying an indication of whether asynchronous
+     * completion was arranged. Returning silently is the contract
+     * violation — not the orphaning itself. Orphaned rows an operator
+     * can enumerate are debt; orphaned rows nobody can find are loss.
+     */
     delete(args: {
         appId: string;
         ownerSub: string;
@@ -143,6 +161,19 @@ export declare class AppNotFoundError extends Error {
     readonly code: "app_not_found";
     constructor(appId: string);
 }
+/**
+ * Thrown when the delete target IS the caller's default app.
+ *
+ * `defaultAppId` is what the universal route resolves on every
+ * request; deleting the app it names would leave that route pointing
+ * at a row that no longer exists. Same lock the console's Delete
+ * enforces — the operator picks a different default first, then
+ * deletes.
+ */
+export declare class DefaultAppDeleteBlockedError extends Error {
+    readonly code: "default_app_delete_blocked";
+    constructor(appId: string);
+}
 /**
  * Thrown by adapters that prefer surfacing access denial over the
  * "treat as not-found" privacy posture. Handlers translate to the

package/dist/ops-apps/types.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../src/ops-apps/types.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AACH,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,mBAAmB,CAAC;AAElD;;;;GAIG;AACH,MAAM,WAAW,SAAS;IACxB,6EAA6E;IAC7E,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,mEAAmE;IACnE,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,2BAA2B;IAC3B,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,+CAA+C;IAC/C,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM,CAAC;IAC/B;;;;OAIG;IACH,QAAQ,CAAC,kBAAkB,CAAC,EAAE,MAAM,CAAC;IACrC,sDAAsD;IACtD,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,+CAA+C;IAC/C,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;CAC5B;AAED;;;;;;;;;;;GAWG;AACH,MAAM,WAAW,cAAc;IAC7B,0DAA0D;IAC1D,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAC;IAC9B,wEAAwE;IACxE,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM,CAAC;IAC/B,oEAAoE;IACpE,QAAQ,CAAC,kBAAkB,CAAC,EAAE,MAAM,CAAC;CACtC;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,MAAM,WAAW,UAAU;IACzB,2DAA2D;IAC3D,IAAI,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,SAAS,SAAS,EAAE,CAAC,CAAC;IACtD,0FAA0F;IAC1F,GAAG,CAAC,IAAI,EAAE;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,QAAQ,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC,SAAS,GAAG,IAAI,CAAC,CAAC;IAC1E,0DAA0D;IAC1D,MAAM,CAAC,IAAI,EAAE;QAAE,QAAQ,EAAE,MAAM,CAAC;QAAC,WAAW,CAAC,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC,SAAS,CAAC,CAAC;IAC7E;;;;;OAKG;IACH,MAAM,CAAC,IAAI,EAAE;QACX,KAAK,EAAE,MAAM,CAAC;QACd,QAAQ,EAAE,MAAM,CAAC;QACjB,KAAK,EAAE,cAAc,CAAC;KACvB,GAAG,OAAO,CAAC,SAAS,CAAC,CAAC;IACvB,gFAAgF;IAChF,MAAM,CAAC,IAAI,EAAE;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,QAAQ,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACjE;;;OAGG;IACH,QAAQ,CAAC,IAAI,EAAE;QACb,KAAK,EAAE,MAAM,CAAC;QACd,QAAQ,EAAE,MAAM,CAAC;QACjB,KAAK,EAAE,QAAQ,CAAC;KACjB,GAAG,OAAO,CAAC;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,SAAS,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;CACnD;AAED;;;;;;;;GAQG;AACH,MAAM,WAAW,oBAAoB;IACnC,gEAAgE;IAChE,UAAU,CAAC,IAAI,EAAE;QAAE,QAAQ,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACrE,0EAA0E;IAC1E,UAAU,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAAC;CACtD;AAED;;;GAGG;AACH,qBAAa,gBAAiB,SAAQ,KAAK;IACzC,QAAQ,CAAC,IAAI,EAAG,eAAe,CAAU;gBAC7B,KAAK,EAAE,MAAM;CAI1B;AAED;;;;;;GAMG;AACH,qBAAa,wBAAyB,SAAQ,KAAK;IACjD,QAAQ,CAAC,IAAI,EAAG,wBAAwB,CAAU;gBACtC,OAAO,EAAE,MAAM;CAI5B"}
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../src/ops-apps/types.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AACH,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,mBAAmB,CAAC;AAElD;;;;GAIG;AACH,MAAM,WAAW,SAAS;IACxB,6EAA6E;IAC7E,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,mEAAmE;IACnE,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,2BAA2B;IAC3B,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,+CAA+C;IAC/C,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM,CAAC;IAC/B;;;;OAIG;IACH,QAAQ,CAAC,kBAAkB,CAAC,EAAE,MAAM,CAAC;IACrC,sDAAsD;IACtD,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,+CAA+C;IAC/C,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;CAC5B;AAED;;;;;;;;;;;GAWG;AACH,MAAM,WAAW,cAAc;IAC7B,0DAA0D;IAC1D,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAC;IAC9B,wEAAwE;IACxE,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM,CAAC;IAC/B,oEAAoE;IACpE,QAAQ,CAAC,kBAAkB,CAAC,EAAE,MAAM,CAAC;CACtC;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,MAAM,WAAW,UAAU;IACzB,2DAA2D;IAC3D,IAAI,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,SAAS,SAAS,EAAE,CAAC,CAAC;IACtD,0FAA0F;IAC1F,GAAG,CAAC,IAAI,EAAE;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,QAAQ,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC,SAAS,GAAG,IAAI,CAAC,CAAC;IAC1E,0DAA0D;IAC1D,MAAM,CAAC,IAAI,EAAE;QAAE,QAAQ,EAAE,MAAM,CAAC;QAAC,WAAW,CAAC,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC,SAAS,CAAC,CAAC;IAC7E;;;;;OAKG;IACH,MAAM,CAAC,IAAI,EAAE;QACX,KAAK,EAAE,MAAM,CAAC;QACd,QAAQ,EAAE,MAAM,CAAC;QACjB,KAAK,EAAE,cAAc,CAAC;KACvB,GAAG,OAAO,CAAC,SAAS,CAAC,CAAC;IACvB;;;;;;;;;;;;;;;;;;OAkBG;IACH,MAAM,CAAC,IAAI,EAAE;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,QAAQ,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACjE;;;OAGG;IACH,QAAQ,CAAC,IAAI,EAAE;QACb,KAAK,EAAE,MAAM,CAAC;QACd,QAAQ,EAAE,MAAM,CAAC;QACjB,KAAK,EAAE,QAAQ,CAAC;KACjB,GAAG,OAAO,CAAC;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,SAAS,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;CACnD;AAED;;;;;;;;GAQG;AACH,MAAM,WAAW,oBAAoB;IACnC,gEAAgE;IAChE,UAAU,CAAC,IAAI,EAAE;QAAE,QAAQ,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACrE,0EAA0E;IAC1E,UAAU,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAAC;CACtD;AAED;;;GAGG;AACH,qBAAa,gBAAiB,SAAQ,KAAK;IACzC,QAAQ,CAAC,IAAI,EAAG,eAAe,CAAU;gBAC7B,KAAK,EAAE,MAAM;CAI1B;AAED;;;;;;;;GAQG;AACH,qBAAa,4BAA6B,SAAQ,KAAK;IACrD,QAAQ,CAAC,IAAI,EAAG,4BAA4B,CAAU;gBAC1C,KAAK,EAAE,MAAM;CAM1B;AAED;;;;;;GAMG;AACH,qBAAa,wBAAyB,SAAQ,KAAK;IACjD,QAAQ,CAAC,IAAI,EAAG,wBAAwB,CAAU;gBACtC,OAAO,EAAE,MAAM;CAI5B"}

package/dist/ops-apps/types.js

@@ -9,6 +9,22 @@ export class AppNotFoundError extends Error {
         this.name = 'AppNotFoundError';
     }
 }
+/**
+ * Thrown when the delete target IS the caller's default app.
+ *
+ * `defaultAppId` is what the universal route resolves on every
+ * request; deleting the app it names would leave that route pointing
+ * at a row that no longer exists. Same lock the console's Delete
+ * enforces — the operator picks a different default first, then
+ * deletes.
+ */
+export class DefaultAppDeleteBlockedError extends Error {
+    code = 'default_app_delete_blocked';
+    constructor(appId) {
+        super(`default_app_delete_blocked: app ${JSON.stringify(appId)} is the calling user's default — set a different default app first, then delete this one`);
+        this.name = 'DefaultAppDeleteBlockedError';
+    }
+}
 /**
  * Thrown by adapters that prefer surfacing access denial over the
  * "treat as not-found" privacy posture. Handlers translate to the

package/dist/ops-blueprint/generate.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"generate.d.ts","sourceRoot":"","sources":["../../src/ops-blueprint/generate.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8CG;AAEH,OAAO,KAAK,EACV,gBAAgB,EAChB,iBAAiB,EACjB,cAAc,EACd,iBAAiB,EACjB,aAAa,EAGd,MAAM,0BAA0B,CAAC;AAClC,OAAO,EAGL,KAAK,SAAS,EACd,KAAK,YAAY,EAGjB,KAAK,0BAA0B,EAChC,MAAM,mBAAmB,CAAC;AAG3B,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAGxB,OAAO,EAEL,KAAK,qBAAqB,EAC1B,KAAK,qBAAqB,EAC3B,MAAM,qBAAqB,CAAC;AAC7B,OAAO,KAAK,EAAE,cAAc,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AAQjE,QAAA,MAAM,cAAc;;;;;;;;CAAwC,CAAC;AAC7D,QAAA,MAAM,eAAe;;;;;;;;;CAWb,CAAC;AAET;;;;;;GAMG;AACH,MAAM,WAAW,WAAW;IAC1B,CAAC,QAAQ,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CACxD;AAED;;GAEG;AACH,MAAM,WAAW,4BAA4B;IAC3C;;;;OAIG;IACH,QAAQ,CAAC,QAAQ,EAAE,iBAAiB,CAAC;IACrC;;;OAGG;IACH,QAAQ,CAAC,cAAc,EAAE,cAAc,CAAC;IACxC;;;;;;;OAOG;IACH,QAAQ,CAAC,aAAa,CAAC,EAAE,CAAC,KAAK,EAAE,MAAM,KAAK,OAAO,CAAC,SAAS,SAAS,EAAE,CAAC,CAAC;IAC1E;;;;;;;OAOG;IACH,QAAQ,CAAC,gBAAgB,CAAC,EAAE,gBAAgB,CAAC;IAC7C;;;;;OAKG;IACH,QAAQ,CAAC,UAAU,EAAE,CACnB,GAAG,EAAE,cAAc,KAChB,OAAO,CAAC,qBAAqB,GAAG,IAAI,CAAC,GAAG,qBAAqB,GAAG,IAAI,CAAC;IAC1E;;;;OAIG;IACH,QAAQ,CAAC,UAAU,EAAE,iBAAiB,CAAC;IACvC;;;;;;OAMG;IACH,QAAQ,CAAC,OAAO,CAAC,EAAE,WAAW,CAAC;IAC/B;;;;;;;;;;;;;;;;;;;;OAoBG;IACH,QAAQ,CAAC,aAAa,CAAC,EAAE,qBAAqB,CAAC;IAC/C;;;;OAIG;IACH,QAAQ,CAAC,SAAS,CAAC,EAAE,aAAa,CAAC;IACnC;;;OAGG;IACH,QAAQ,CAAC,GAAG,CAAC,EAAE,MAAM,MAAM,CAAC;IAC5B;;;OAGG;IACH,QAAQ,CAAC,eAAe,CAAC,EAAE,MAAM,MAAM,CAAC;CACzC;AAmCD,wBAAgB,qCAAqC,CACnD,IAAI,EAAE,4BAA4B,GACjC,aAAa,CAAC,OAAO,cAAc,EAAE,OAAO,eAAe,EAAE,0BAA0B,CAAC,CAqP1F"}
+{"version":3,"file":"generate.d.ts","sourceRoot":"","sources":["../../src/ops-blueprint/generate.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8CG;AAEH,OAAO,KAAK,EACV,gBAAgB,EAChB,iBAAiB,EACjB,cAAc,EACd,iBAAiB,EACjB,aAAa,EAGd,MAAM,0BAA0B,CAAC;AAClC,OAAO,EAGL,KAAK,SAAS,EACd,KAAK,YAAY,EAGjB,KAAK,0BAA0B,EAChC,MAAM,mBAAmB,CAAC;AAG3B,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAGxB,OAAO,EAEL,KAAK,qBAAqB,EAC1B,KAAK,qBAAqB,EAC3B,MAAM,qBAAqB,CAAC;AAC7B,OAAO,KAAK,EAAE,cAAc,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AAQjE,QAAA,MAAM,cAAc;;;;;;;;CAAwC,CAAC;AAC7D,QAAA,MAAM,eAAe;;;;;;;;;CAWb,CAAC;AAET;;;;;;GAMG;AACH,MAAM,WAAW,WAAW;IAC1B,CAAC,QAAQ,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CACxD;AAED;;GAEG;AACH,MAAM,WAAW,4BAA4B;IAC3C;;;;OAIG;IACH,QAAQ,CAAC,QAAQ,EAAE,iBAAiB,CAAC;IACrC;;;OAGG;IACH,QAAQ,CAAC,cAAc,EAAE,cAAc,CAAC;IACxC;;;;;;;OAOG;IACH,QAAQ,CAAC,aAAa,CAAC,EAAE,CAAC,KAAK,EAAE,MAAM,KAAK,OAAO,CAAC,SAAS,SAAS,EAAE,CAAC,CAAC;IAC1E;;;;;;;OAOG;IACH,QAAQ,CAAC,gBAAgB,CAAC,EAAE,gBAAgB,CAAC;IAC7C;;;;;OAKG;IACH,QAAQ,CAAC,UAAU,EAAE,CACnB,GAAG,EAAE,cAAc,KAChB,OAAO,CAAC,qBAAqB,GAAG,IAAI,CAAC,GAAG,qBAAqB,GAAG,IAAI,CAAC;IAC1E;;;;OAIG;IACH,QAAQ,CAAC,UAAU,EAAE,iBAAiB,CAAC;IACvC;;;;;;OAMG;IACH,QAAQ,CAAC,OAAO,CAAC,EAAE,WAAW,CAAC;IAC/B;;;;;;;;;;;;;;;;;;;;OAoBG;IACH,QAAQ,CAAC,aAAa,CAAC,EAAE,qBAAqB,CAAC;IAC/C;;;;OAIG;IACH,QAAQ,CAAC,SAAS,CAAC,EAAE,aAAa,CAAC;IACnC;;;OAGG;IACH,QAAQ,CAAC,GAAG,CAAC,EAAE,MAAM,MAAM,CAAC;IAC5B;;;OAGG;IACH,QAAQ,CAAC,eAAe,CAAC,EAAE,MAAM,MAAM,CAAC;CACzC;AAmCD,wBAAgB,qCAAqC,CACnD,IAAI,EAAE,4BAA4B,GACjC,aAAa,CAAC,OAAO,cAAc,EAAE,OAAO,eAAe,EAAE,0BAA0B,CAAC,CAyP1F"}

package/dist/ops-blueprint/generate.js

@@ -123,8 +123,9 @@ export function createGguiOpsGenerateBlueprintHandler(deps) {
             // in `renders/`.
             assertContractNoRetiredFields(parsed.contract);
             // 0. Every `contract.clientCapabilities.gadgets[*]` MUST
-            // resolve in `App.gadgets` by the full `(hook, package,
-            // version)` tuple. Throws a precise reject when an
+            // resolve in `App.gadgets` by `(package, export name)` — the
+            // wire carries no version; the operator's catalog is the
+            // version pin. Throws a precise reject when an
             // unregistered wrapper is referenced. No-op when
             // `appMetadataStore` is unset.
             //
@@ -268,7 +269,10 @@ export function createGguiOpsGenerateBlueprintHandler(deps) {
                         // Operator-DISPATCHED but engine-GENERATED: the code came
                         // out of `generator.generate(...)`, so provenance is the
                         // llm arm — the same `source` stamped on the MVB row above.
+                        // The two axes disagree here on purpose, which is exactly
+                        // why `createdBy` cannot be derived from `source`.
                         source,
+                        createdBy: "operator",
                     });
                 }
                 catch (err) {

package/dist/ops-blueprint/register.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"register.d.ts","sourceRoot":"","sources":["../../src/ops-blueprint/register.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAoCG;AAEH,OAAO,KAAK,EACV,gBAAgB,EAChB,cAAc,EACd,aAAa,EACd,MAAM,0BAA0B,CAAC;AAClC,OAAO,EAEL,KAAK,SAAS,EACd,KAAK,YAAY,EAEjB,KAAK,0BAA0B,EAEhC,MAAM,mBAAmB,CAAC;AAG3B,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAGxB,OAAO,EAAqB,KAAK,qBAAqB,EAAE,MAAM,qBAAqB,CAAC;AACpF,OAAO,KAAK,EAAkB,aAAa,EAAE,MAAM,aAAa,CAAC;AACjE,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,eAAe,CAAC;AAGjD,QAAA,MAAM,cAAc;;;;;;;;CAAwC,CAAC;AAC7D,QAAA,MAAM,eAAe;;;;;;CAIb,CAAC;AAST;;;;;GAKG;AACH,MAAM,WAAW,4BAA4B;IAC3C;;;OAGG;IACH,QAAQ,CAAC,cAAc,EAAE,cAAc,CAAC;IACxC;;;OAGG;IACH,QAAQ,CAAC,aAAa,CAAC,EAAE,CAAC,KAAK,EAAE,MAAM,KAAK,OAAO,CAAC,SAAS,SAAS,EAAE,CAAC,CAAC;IAC1E;;;;;;;OAOG;IACH,QAAQ,CAAC,gBAAgB,CAAC,EAAE,gBAAgB,CAAC;IAC7C;;;;;;OAMG;IACH,QAAQ,CAAC,OAAO,CAAC,EAAE,WAAW,CAAC;IAC/B;;;;;;;;OAQG;IACH,QAAQ,CAAC,aAAa,CAAC,EAAE,qBAAqB,CAAC;IAC/C;;;;OAIG;IACH,QAAQ,CAAC,SAAS,CAAC,EAAE,aAAa,CAAC;IACnC;;OAEG;IACH,QAAQ,CAAC,GAAG,CAAC,EAAE,MAAM,MAAM,CAAC;IAC5B;;OAEG;IACH,QAAQ,CAAC,eAAe,CAAC,EAAE,MAAM,MAAM,CAAC;CACzC;AAED,wBAAgB,qCAAqC,CACnD,IAAI,EAAE,4BAA4B,GACjC,aAAa,CAAC,OAAO,cAAc,EAAE,OAAO,eAAe,EAAE,0BAA0B,CAAC,CA8K1F"}
+{"version":3,"file":"register.d.ts","sourceRoot":"","sources":["../../src/ops-blueprint/register.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAoCG;AAEH,OAAO,KAAK,EACV,gBAAgB,EAChB,cAAc,EACd,aAAa,EACd,MAAM,0BAA0B,CAAC;AAClC,OAAO,EAEL,KAAK,SAAS,EACd,KAAK,YAAY,EAEjB,KAAK,0BAA0B,EAEhC,MAAM,mBAAmB,CAAC;AAG3B,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAGxB,OAAO,EAAqB,KAAK,qBAAqB,EAAE,MAAM,qBAAqB,CAAC;AACpF,OAAO,KAAK,EAAkB,aAAa,EAAE,MAAM,aAAa,CAAC;AACjE,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,eAAe,CAAC;AAGjD,QAAA,MAAM,cAAc;;;;;;;;CAAwC,CAAC;AAC7D,QAAA,MAAM,eAAe;;;;;;CAIb,CAAC;AAST;;;;;GAKG;AACH,MAAM,WAAW,4BAA4B;IAC3C;;;OAGG;IACH,QAAQ,CAAC,cAAc,EAAE,cAAc,CAAC;IACxC;;;OAGG;IACH,QAAQ,CAAC,aAAa,CAAC,EAAE,CAAC,KAAK,EAAE,MAAM,KAAK,OAAO,CAAC,SAAS,SAAS,EAAE,CAAC,CAAC;IAC1E;;;;;;;OAOG;IACH,QAAQ,CAAC,gBAAgB,CAAC,EAAE,gBAAgB,CAAC;IAC7C;;;;;;OAMG;IACH,QAAQ,CAAC,OAAO,CAAC,EAAE,WAAW,CAAC;IAC/B;;;;;;;;OAQG;IACH,QAAQ,CAAC,aAAa,CAAC,EAAE,qBAAqB,CAAC;IAC/C;;;;OAIG;IACH,QAAQ,CAAC,SAAS,CAAC,EAAE,aAAa,CAAC;IACnC;;OAEG;IACH,QAAQ,CAAC,GAAG,CAAC,EAAE,MAAM,MAAM,CAAC;IAC5B;;OAEG;IACH,QAAQ,CAAC,eAAe,CAAC,EAAE,MAAM,MAAM,CAAC;CACzC;AAED,wBAAgB,qCAAqC,CACnD,IAAI,EAAE,4BAA4B,GACjC,aAAa,CAAC,OAAO,cAAc,EAAE,OAAO,eAAe,EAAE,0BAA0B,CAAC,CAmL1F"}

package/dist/ops-blueprint/register.js

@@ -78,8 +78,9 @@ export function createGguiOpsRegisterBlueprintHandler(deps) {
             // in `renders/`.
             assertContractNoRetiredFields(parsed.contract);
             // Every `contract.clientCapabilities.gadgets[*]` MUST resolve
-            // in `App.gadgets` by the full `(hook, package, version)`
-            // tuple. Fails fast with a precise reject before any state
+            // in `App.gadgets` by `(package, export name)` — the wire
+            // carries no version; the operator's catalog is the version
+            // pin. Fails fast with a precise reject before any state
             // mutation. No-op when no `appMetadataStore` is bound.
             if (deps.appMetadataStore) {
                 const appRecord = await deps.appMetadataStore.get(ctx.appId);
@@ -166,6 +167,10 @@ export function createGguiOpsRegisterBlueprintHandler(deps) {
                         // Same user-arm provenance as the MVB row above — one
                         // handler call, one provenance claim across both stores.
                         source: USER_SOURCE,
+                        // An operator invoked this tool. Without it the durable
+                        // record would claim the standard agent flow minted a row
+                        // that is retained permanently.
+                        createdBy: "operator",
                     });
                 }
                 catch (err) {

package/dist/ops-connector-keys/types.d.ts

@@ -57,6 +57,13 @@ export interface IssueConnectorKeyResult {
  *   - `revoke` is idempotent — re-revoking a `revoked` row returns the
  *     same row with `alreadyRevoked: true`. Cross-user revoke is
  *     rejected with `ConnectorKeyAccessDeniedError`.
+ *   - When `issue` is asked to bind the key to an app (`appId` set),
+ *     the implementation MUST verify the subject owns that app before
+ *     minting, and MUST reject with `ConnectorKeyAccessDeniedError`
+ *     when it does not or when the deployment cannot verify. A key
+ *     bound to an app the subject does not own is a credential for
+ *     someone else's data — refusing the mint is the contract, not a
+ *     quality-of-implementation choice.
  */
 export interface ConnectorKeysSource {
     list(ownerSub: string): Promise<readonly ConnectorKeySummary[]>;

package/dist/ops-connector-keys/types.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../src/ops-connector-keys/types.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH;;;;GAIG;AACH,MAAM,WAAW,mBAAmB;IAClC,8CAA8C;IAC9C,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;IACpB,qEAAqE;IACrE,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;IAC9B,2BAA2B;IAC3B,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC;IACvB,uEAAuE;IACvE,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC;IACxB,gCAAgC;IAChC,QAAQ,CAAC,MAAM,EAAE,QAAQ,GAAG,SAAS,CAAC;IACtC,qBAAqB;IACrB,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,0DAA0D;IAC1D,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAC;IAC7B,mEAAmE;IACnE,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC;CAC7B;AAED,MAAM,WAAW,uBAAuB;IACtC,kCAAkC;IAClC,QAAQ,CAAC,OAAO,EAAE,mBAAmB,CAAC;IACtC;;;;;OAKG;IACH,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;CAC/B;AAED;;;;;;;;;;;;;;;GAeG;AACH,MAAM,WAAW,mBAAmB;IAClC,IAAI,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,SAAS,mBAAmB,EAAE,CAAC,CAAC;IAChE,KAAK,CAAC,IAAI,EAAE;QACV,QAAQ,EAAE,MAAM,CAAC;QACjB,IAAI,CAAC,EAAE,MAAM,CAAC;QACd,KAAK,CAAC,EAAE,MAAM,CAAC;QACf,SAAS,CAAC,EAAE,MAAM,CAAC;KACpB,GAAG,OAAO,CAAC,uBAAuB,CAAC,CAAC;IACrC,MAAM,CAAC,IAAI,EAAE;QACX,QAAQ,EAAE,MAAM,CAAC;QACjB,KAAK,EAAE,MAAM,CAAC;KACf,GAAG,OAAO,CAAC;QAAE,OAAO,EAAE,mBAAmB,CAAC;QAAC,cAAc,EAAE,OAAO,CAAA;KAAE,CAAC,CAAC;CACxE;AAED,qBAAa,6BAA8B,SAAQ,KAAK;IACtD,QAAQ,CAAC,IAAI,EAAG,6BAA6B,CAAU;gBAC3C,OAAO,EAAE,MAAM;CAI5B;AAED,qBAAa,yBAA0B,SAAQ,KAAK;IAClD,QAAQ,CAAC,IAAI,EAAG,yBAAyB,CAAU;gBACvC,KAAK,EAAE,MAAM;CAM1B"}
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../src/ops-connector-keys/types.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH;;;;GAIG;AACH,MAAM,WAAW,mBAAmB;IAClC,8CAA8C;IAC9C,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;IACpB,qEAAqE;IACrE,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;IAC9B,2BAA2B;IAC3B,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC;IACvB,uEAAuE;IACvE,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC;IACxB,gCAAgC;IAChC,QAAQ,CAAC,MAAM,EAAE,QAAQ,GAAG,SAAS,CAAC;IACtC,qBAAqB;IACrB,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,0DAA0D;IAC1D,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAC;IAC7B,mEAAmE;IACnE,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC;CAC7B;AAED,MAAM,WAAW,uBAAuB;IACtC,kCAAkC;IAClC,QAAQ,CAAC,OAAO,EAAE,mBAAmB,CAAC;IACtC;;;;;OAKG;IACH,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;CAC/B;AAED;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,MAAM,WAAW,mBAAmB;IAClC,IAAI,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,SAAS,mBAAmB,EAAE,CAAC,CAAC;IAChE,KAAK,CAAC,IAAI,EAAE;QACV,QAAQ,EAAE,MAAM,CAAC;QACjB,IAAI,CAAC,EAAE,MAAM,CAAC;QACd,KAAK,CAAC,EAAE,MAAM,CAAC;QACf,SAAS,CAAC,EAAE,MAAM,CAAC;KACpB,GAAG,OAAO,CAAC,uBAAuB,CAAC,CAAC;IACrC,MAAM,CAAC,IAAI,EAAE;QACX,QAAQ,EAAE,MAAM,CAAC;QACjB,KAAK,EAAE,MAAM,CAAC;KACf,GAAG,OAAO,CAAC;QAAE,OAAO,EAAE,mBAAmB,CAAC;QAAC,cAAc,EAAE,OAAO,CAAA;KAAE,CAAC,CAAC;CACxE;AAED,qBAAa,6BAA8B,SAAQ,KAAK;IACtD,QAAQ,CAAC,IAAI,EAAG,6BAA6B,CAAU;gBAC3C,OAAO,EAAE,MAAM;CAI5B;AAED,qBAAa,yBAA0B,SAAQ,KAAK;IAClD,QAAQ,CAAC,IAAI,EAAG,yBAAyB,CAAU;gBACvC,KAAK,EAAE,MAAM;CAM1B"}

package/dist/renders/blueprint-durability.d.ts

@@ -0,0 +1,111 @@
+/**
+ * Durable write-through for freshly registered blueprints (#430 slice
+ * 2).
+ *
+ * The blueprint registry (`blueprint-registry.ts`) is a CAPPED vector
+ * store: registering past `maxPerKind` evicts the lowest-hit entry, and
+ * a deployment whose vector store is process-local loses the whole
+ * bucket on restart. That is the right shape for a match cache — a miss
+ * costs one regeneration. It is the wrong shape for anything that needs
+ * to resolve a blueprint by id LATER, because "later" is exactly when
+ * the entry is gone.
+ *
+ * So a registration that mints a fresh row also writes it through to a
+ * durable pair: metadata to a {@link BlueprintStore}, the compiled body
+ * to a {@link CodeStore} keyed by content hash. Deployments that bind
+ * neither keep today's behavior exactly.
+ *
+ * ## Two `Blueprint` types, and the projection between them
+ *
+ * The registry's {@link RegistryBlueprint} and the protocol's
+ * `Blueprint` share a name and almost nothing else. The registry row is
+ * a match candidate: `id`, `kind`, `intent`, `componentCode` inline, a
+ * `hitCount`. The protocol row is a persistence record: `blueprintId`,
+ * `appId`, `contractHash`, a `codeHash` POINTER to the body. The
+ * projection below is where they meet on the DURABLE-WRITE path, and
+ * it is where the registry's `contractKey` becomes the protocol's
+ * `contractHash` — one value, two spellings, same 16-char blueprintKey
+ * domain.
+ *
+ * Not the only such hop in the codebase: `decide-handshake.ts` makes
+ * the same translation projecting a matched blueprint onto
+ * `blueprintMeta`, and predates this module. The claim is scoped on
+ * purpose — a docstring that overstates its reach is how a reader
+ * concludes a rename is contained when it is not.
+ *
+ * ## Best-effort, and what "best" means when it fails
+ *
+ * Registration must never fail because durability hiccuped: the render
+ * that triggered it already produced working code and already
+ * committed. Both writes are therefore try/caught into named events.
+ *
+ * The order is body first, then metadata, and that is load-bearing. A
+ * body with no row is an orphan — invisible, reclaimable, harmless. A
+ * row naming a `codeHash` with no object behind it is a LIE: a later
+ * resolve finds the record, fetches the body, gets nothing, and fails
+ * at the point where it looked like it would succeed. So when the body
+ * write fails, the row is still written but WITHOUT `codeHash`, which
+ * reads as "metadata recorded, no body stored" — a state the protocol
+ * type already models and consumers already branch on.
+ *
+ * ## Backfill posture — documented, not built
+ *
+ * Blueprints registered before this shipped exist only in the capped
+ * vector registry. Their records carry a `blueprintId` that resolves to
+ * nothing durable, so a re-mint against them lands in
+ * `blueprint_unresolvable`. No backfill job exists, deliberately: the
+ * affected rows are sandbox-only, the cost of the miss is one
+ * regeneration, and a job to walk a capped in-memory registry would be
+ * writing whatever survived rather than what was actually registered.
+ * If real data ever needs it, the job is a scope scan of the vector
+ * store through this same projection — but not until then.
+ */
+import type { BlueprintStore, CodeStore } from '@ggui-ai/mcp-server-core';
+import type { Blueprint as DurableBlueprint } from '@ggui-ai/protocol';
+import type { Blueprint as RegistryBlueprint } from './blueprint-registry.js';
+/**
+ * Every event this module can emit. Closed union — a new emitter picks
+ * from these or extends the type, which is what makes a rename a
+ * compile error rather than an alert filter that quietly stops
+ * matching.
+ */
+export type BlueprintDurabilityEvent = 'blueprint_durable_write_failed' | 'blueprint_code_write_failed';
+/**
+ * The event names as values, so every emitter — in this package or a
+ * storage backend elsewhere — spells them from one place.
+ */
+export declare const BLUEPRINT_DURABILITY_EVENTS: {
+    /** Metadata row rejected. The blueprint is not durably resolvable. */
+    readonly durableWriteFailed: "blueprint_durable_write_failed";
+    /** Body rejected. The row still lands, without a `codeHash`. */
+    readonly codeWriteFailed: "blueprint_code_write_failed";
+};
+/**
+ * The durable pair. Both optional at the binding site — a deployment
+ * may have neither (no durability), or metadata without a body store
+ * (rows persist, bodies do not).
+ */
+export interface BlueprintDurabilityDeps {
+    readonly blueprintStore?: BlueprintStore;
+    readonly codeStore?: CodeStore;
+}
+/**
+ * Project a registry row onto the durable record.
+ *
+ * `codeHash` is passed rather than derived so the caller can omit it
+ * when the body write failed — the record then honestly says no body
+ * is stored. `codeS3Url` is deliberately NOT set here: it names a
+ * location only the storage adapter knows, and the adapter composes it
+ * on read.
+ */
+export declare function projectDurableBlueprint(blueprint: RegistryBlueprint, appId: string, codeHash: string | undefined, createdBy?: DurableBlueprint['createdBy']): DurableBlueprint;
+/**
+ * Write a freshly minted blueprint through to durable storage.
+ *
+ * Never throws and never retries: one round-trip per store, both
+ * try/caught. An unbound store is a no-op — not an error, and not an
+ * event, because a deployment that never bound one is not failing at
+ * anything.
+ */
+export declare function writeBlueprintDurably(deps: BlueprintDurabilityDeps | undefined, appId: string, blueprint: RegistryBlueprint, createdBy?: DurableBlueprint['createdBy']): Promise<void>;
+//# sourceMappingURL=blueprint-durability.d.ts.map

package/dist/renders/blueprint-durability.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"blueprint-durability.d.ts","sourceRoot":"","sources":["../../src/renders/blueprint-durability.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6DG;AACH,OAAO,KAAK,EAAE,cAAc,EAAE,SAAS,EAAE,MAAM,0BAA0B,CAAC;AAC1E,OAAO,KAAK,EAAE,SAAS,IAAI,gBAAgB,EAAE,MAAM,mBAAmB,CAAC;AACvE,OAAO,KAAK,EAAE,SAAS,IAAI,iBAAiB,EAAE,MAAM,yBAAyB,CAAC;AAE9E;;;;;GAKG;AACH,MAAM,MAAM,wBAAwB,GAChC,gCAAgC,GAChC,6BAA6B,CAAC;AAElC;;;GAGG;AACH,eAAO,MAAM,2BAA2B;IACtC,sEAAsE;;IAEtE,gEAAgE;;CAEL,CAAC;AAQ9D;;;;GAIG;AACH,MAAM,WAAW,uBAAuB;IACtC,QAAQ,CAAC,cAAc,CAAC,EAAE,cAAc,CAAC;IACzC,QAAQ,CAAC,SAAS,CAAC,EAAE,SAAS,CAAC;CAChC;AAED;;;;;;;;GAQG;AACH,wBAAgB,uBAAuB,CACrC,SAAS,EAAE,iBAAiB,EAC5B,KAAK,EAAE,MAAM,EACb,QAAQ,EAAE,MAAM,GAAG,SAAS,EAC5B,SAAS,GAAE,gBAAgB,CAAC,WAAW,CAAW,GACjD,gBAAgB,CAmBlB;AAED;;;;;;;GAOG;AACH,wBAAsB,qBAAqB,CACzC,IAAI,EAAE,uBAAuB,GAAG,SAAS,EACzC,KAAK,EAAE,MAAM,EACb,SAAS,EAAE,iBAAiB,EAC5B,SAAS,GAAE,gBAAgB,CAAC,WAAW,CAAW,GACjD,OAAO,CAAC,IAAI,CAAC,CAyBf"}

package/dist/renders/blueprint-durability.js

@@ -0,0 +1,85 @@
+/**
+ * The event names as values, so every emitter — in this package or a
+ * storage backend elsewhere — spells them from one place.
+ */
+export const BLUEPRINT_DURABILITY_EVENTS = {
+    /** Metadata row rejected. The blueprint is not durably resolvable. */
+    durableWriteFailed: 'blueprint_durable_write_failed',
+    /** Body rejected. The row still lands, without a `codeHash`. */
+    codeWriteFailed: 'blueprint_code_write_failed',
+};
+const DURABLE_WRITE_FAILED = BLUEPRINT_DURABILITY_EVENTS.durableWriteFailed;
+const CODE_WRITE_FAILED = BLUEPRINT_DURABILITY_EVENTS.codeWriteFailed;
+/**
+ * Project a registry row onto the durable record.
+ *
+ * `codeHash` is passed rather than derived so the caller can omit it
+ * when the body write failed — the record then honestly says no body
+ * is stored. `codeS3Url` is deliberately NOT set here: it names a
+ * location only the storage adapter knows, and the adapter composes it
+ * on read.
+ */
+export function projectDurableBlueprint(blueprint, appId, codeHash, createdBy = 'agent') {
+    return {
+        blueprintId: blueprint.id,
+        appId,
+        // Registry `contractKey` → protocol `contractHash`. Same 16-char
+        // blueprintKey value; see the module docstring.
+        contractHash: blueprint.contractKey,
+        source: blueprint.source,
+        variance: blueprint.variance,
+        createdAt: blueprint.createdAt,
+        // WHO initiated the mint — a different axis from `source`, which
+        // records what produced the code. An operator-invoked registration
+        // is `createdBy: 'operator'` even when `source.kind` is `'llm'`.
+        // Defaulted rather than derived: the registry row does not carry
+        // this, and only the caller knows which tool it is serving.
+        createdBy,
+        contract: blueprint.contract,
+        ...(codeHash !== undefined ? { codeHash } : {}),
+    };
+}
+/**
+ * Write a freshly minted blueprint through to durable storage.
+ *
+ * Never throws and never retries: one round-trip per store, both
+ * try/caught. An unbound store is a no-op — not an error, and not an
+ * event, because a deployment that never bound one is not failing at
+ * anything.
+ */
+export async function writeBlueprintDurably(deps, appId, blueprint, createdBy = 'agent') {
+    const blueprintStore = deps?.blueprintStore;
+    if (!blueprintStore)
+        return;
+    // Body first — see the module docstring on why an orphan body beats a
+    // row that points at nothing.
+    let codeHash;
+    const codeStore = deps?.codeStore;
+    if (codeStore && blueprint.componentCode.length > 0) {
+        try {
+            const hash = codeStore.hashOf(blueprint.componentCode);
+            await codeStore.put(hash, blueprint.componentCode);
+            codeHash = hash;
+        }
+        catch (err) {
+            logDurabilityFailure(CODE_WRITE_FAILED, blueprint, appId, err);
+        }
+    }
+    try {
+        await blueprintStore.put(projectDurableBlueprint(blueprint, appId, codeHash, createdBy));
+    }
+    catch (err) {
+        logDurabilityFailure(DURABLE_WRITE_FAILED, blueprint, appId, err);
+    }
+}
+function logDurabilityFailure(event, blueprint, appId, err) {
+    // eslint-disable-next-line no-console -- structured single-line event for log-pipeline pickup
+    console.warn(JSON.stringify({
+        msg: event,
+        blueprintId: blueprint.id,
+        contractKey: blueprint.contractKey,
+        appId,
+        source: blueprint.source.kind,
+        error: err instanceof Error ? err.message : String(err),
+    }));
+}

package/dist/renders/blueprint-registry.d.ts

@@ -2,6 +2,7 @@ import type { BlueprintIndex, EmbeddingProvider, EnumerableVectorStore, VectorSt
 export type { BlueprintIndex } from '@ggui-ai/mcp-server-core';
 import { type BlueprintSource, type BlueprintVariance, type DataContract } from '@ggui-ai/protocol';
 import { type ContractValidationFinding, type ContractValidationResult } from '@ggui-ai/negotiator';
+import { type BlueprintDurabilityDeps } from './blueprint-durability.js';
 /**
  * Atomic-design level. The runtime currently writes only
  * `'template'` — the full-component case. Smaller-grain kinds are
@@ -112,6 +113,17 @@ export interface BlueprintRegistryDeps {
      * indexed exact lookup that consume it land next wave.
      */
     readonly index: BlueprintIndex;
+    /**
+     * Durable write-through target (#430 slice 2). When bound, a fresh
+     * mint is also written to a {@link BlueprintStore} (+ optional
+     * {@link CodeStore} for the body) so it stays resolvable by id after
+     * the capped registry has evicted it or the process has restarted.
+     *
+     * Optional and best-effort: absent ⇒ no write, no event; present and
+     * failing ⇒ a named event and a registration that still succeeds.
+     * See `blueprint-durability.ts`.
+     */
+    readonly durability?: BlueprintDurabilityDeps;
 }
 /** Input for {@link registerBlueprint}. */
 export interface RegisterBlueprintInput {
@@ -140,6 +152,18 @@ export interface RegisterBlueprintInput {
      * empty variance as one stable sentinel.
      */
     readonly variance?: BlueprintVariance;
+    /**
+     * WHO initiated this mint, for the durable record. `'agent'` is the
+     * standard handshake → render flow; the operator tools
+     * (`ggui_ops_register_blueprint` / `ggui_ops_generate_blueprint`)
+     * pass `'operator'`.
+     *
+     * A different axis from {@link source}, which records what PRODUCED
+     * the code: an operator-invoked generation is `createdBy: 'operator'`
+     * AND `source.kind: 'llm'`. Defaults to `'agent'` — the registry row
+     * itself does not carry the field, so only the caller knows.
+     */
+    readonly createdBy?: 'agent' | 'operator';
 }
 /**
  * Compose the deterministic exact-lookup key — the `(scope, exactKey)`

package/dist/renders/blueprint-registry.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"blueprint-registry.d.ts","sourceRoot":"","sources":["../../src/renders/blueprint-registry.ts"],"names":[],"mappings":"AAyCA,OAAO,KAAK,EACV,cAAc,EACd,iBAAiB,EACjB,qBAAqB,EAGrB,WAAW,EACZ,MAAM,0BAA0B,CAAC;AAKlC,YAAY,EAAE,cAAc,EAAE,MAAM,0BAA0B,CAAC;AAC/D,OAAO,EAIL,KAAK,eAAe,EACpB,KAAK,iBAAiB,EACtB,KAAK,YAAY,EAClB,MAAM,mBAAmB,CAAC;AAK3B,OAAO,EAEL,KAAK,yBAAyB,EAC9B,KAAK,wBAAwB,EAC9B,MAAM,qBAAqB,CAAC;AAE7B;;;;GAIG;AACH,MAAM,MAAM,aAAa,GAAG,UAAU,GAAG,UAAU,GAAG,UAAU,GAAG,MAAM,CAAC;AAE1E,mDAAmD;AACnD,MAAM,WAAW,SAAS;IACxB;;;;;OAKG;IACH,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;IACpB,QAAQ,CAAC,IAAI,EAAE,aAAa,CAAC;IAC7B,uEAAuE;IACvE,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B;;;;;;OAMG;IACH,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B;;;;OAIG;IACH,QAAQ,CAAC,QAAQ,EAAE,iBAAiB,CAAC;IACrC,QAAQ,CAAC,QAAQ,EAAE,YAAY,CAAC;IAChC,2EAA2E;IAC3E,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,oFAAoF;IACpF,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;IAC/B,qCAAqC;IACrC,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,sFAAsF;IACtF,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,oEAAoE;IACpE,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC;IAC5B;;;;;;;;;OASG;IACH,QAAQ,CAAC,MAAM,EAAE,eAAe,CAAC;IACjC;;;;;;;OAOG;IACH,QAAQ,CAAC,SAAS,CAAC,EAAE,OAAO,CAAC;IAC7B;;;;;;;OAOG;IACH,QAAQ,CAAC,kBAAkB,CAAC,EAAE,SAAS,yBAAyB,EAAE,CAAC;CACpE;AAED;;;;;GAKG;AACH,MAAM,MAAM,iBAAiB,GAAG,CAC9B,QAAQ,EAAE,YAAY,KACnB,wBAAwB,CAAC;AAE9B;;;;;;;;;;;;GAYG;AACH,qBAAa,sBAAuB,SAAQ,KAAK;IAC/C,QAAQ,CAAC,IAAI,EAAG,oBAAoB,CAAU;IAC9C,QAAQ,CAAC,QAAQ,EAAE,SAAS,yBAAyB,EAAE,CAAC;gBAC5C,QAAQ,EAAE,SAAS,yBAAyB,EAAE;CAQ3D;AAED,gFAAgF;AAChF,MAAM,WAAW,qBAAqB;IACpC,QAAQ,CAAC,SAAS,EAAE,iBAAiB,CAAC;IACtC,QAAQ,CAAC,WAAW,EAAE,WAAW,CAAC;IAClC;;;;;;OAMG;IACH,QAAQ,CAAC,KAAK,EAAE,cAAc,CAAC;CAChC;AAED,2CAA2C;AAC3C,MAAM,WAAW,sBAAsB;IACrC,QAAQ,CAAC,IAAI,EAAE,aAAa,CAAC;IAC7B,QAAQ,CAAC,QAAQ,EAAE,YAAY,CAAC;IAChC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;IAC/B;;;;;;;OAOG;IACH,QAAQ,CAAC,MAAM,EAAE,eAAe,CAAC;IACjC;;;OAGG;IACH,QAAQ,CAAC,SAAS,CAAC,EAAE,OAAO,CAAC;IAC7B;;;;;OAKG;IACH,QAAQ,CAAC,QAAQ,CAAC,EAAE,iBAAiB,CAAC;CACvC;AAED;;;;;;;;GAQG;AACH,wBAAgB,eAAe,CAC7B,IAAI,EAAE,aAAa,EACnB,WAAW,EAAE,MAAM,EACnB,UAAU,EAAE,MAAM,GACjB,MAAM,CAER;AAED;;;;;;;;GAQG;AACH,wBAAgB,qBAAqB,CACnC,QAAQ,EAAE,YAAY,GAAG,SAAS,EAClC,MAAM,EAAE,MAAM,GACb,MAAM,CAER;AAyMD;;;;;;;;;;GAUG;AACH,eAAO,MAAM,+BAA+B,MAAM,CAAC;AAEnD,MAAM,WAAW,wBAAwB;IACvC;;;;;;;OAOG;IACH,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAC;IAC7B;;;;;;OAMG;IACH,QAAQ,CAAC,SAAS,CAAC,EAAE,iBAAiB,CAAC;IACvC;;;;;OAKG;IACH,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,MAAM,CAAC;CAChC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AACH,wBAAsB,iBAAiB,CACrC,IAAI,EAAE,qBAAqB,EAC3B,KAAK,EAAE,MAAM,EACb,KAAK,EAAE,sBAAsB,EAC7B,OAAO,GAAE,wBAA6B,GACrC,OAAO,CAAC,SAAS,CAAC,CAiEpB;AAoGD;;;;;;;;;;;;GAYG;AACH,wBAAsB,kBAAkB,CACtC,IAAI,EAAE;IAAE,WAAW,EAAE,WAAW,CAAC;IAAC,KAAK,EAAE,cAAc,CAAA;CAAE,EACzD,KAAK,EAAE,MAAM,EACb,IAAI,EAAE,aAAa,EACnB,WAAW,EAAE,MAAM,EACnB,WAAW,CAAC,EAAE,MAAM,GACnB,OAAO,CAAC,SAAS,GAAG,IAAI,CAAC,CAM3B;AAsCD;;;;;GAKG;AACH,wBAAsB,iBAAiB,CACrC,IAAI,EAAE;IAAE,WAAW,EAAE,WAAW,CAAA;CAAE,EAClC,KAAK,EAAE,MAAM,EACb,EAAE,EAAE,MAAM,GACT,OAAO,CAAC,SAAS,GAAG,IAAI,CAAC,CAE3B;AAED;;;;;;;;;;;GAWG;AACH,MAAM,WAAW,kBAAkB;IACjC,QAAQ,CAAC,SAAS,EAAE,SAAS,CAAC;IAC9B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;CACzB;AAED,wBAAsB,yBAAyB,CAC7C,IAAI,EAAE,qBAAqB,EAC3B,KAAK,EAAE,MAAM,EACb,KAAK,EAAE;IAAE,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,YAAY,CAAA;CAAE,EACpE,OAAO,GAAE;IAAE,QAAQ,CAAC,IAAI,CAAC,EAAE,aAAa,CAAC;IAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,CAAA;CAAO,GACtE,OAAO,CAAC,SAAS,kBAAkB,EAAE,CAAC,CAaxC;AAED;;;;GAIG;AACH,wBAAsB,cAAc,CAClC,IAAI,EAAE;IAAE,WAAW,EAAE,qBAAqB,CAAA;CAAE,EAC5C,KAAK,EAAE,MAAM,EACb,IAAI,CAAC,EAAE,aAAa,GACnB,OAAO,CAAC,SAAS,SAAS,EAAE,CAAC,CAU/B;AAED;;;;;GAKG;AACH,wBAAsB,kBAAkB,CACtC,IAAI,EAAE;IAAE,WAAW,EAAE,WAAW,CAAA;CAAE,GAAG,OAAO,CAAC,qBAAqB,CAAC,EACnE,KAAK,EAAE,MAAM,EACb,EAAE,EAAE,MAAM,GACT,OAAO,CAAC,IAAI,CAAC,CAoCf;AAoBD;;;;;;;;GAQG;AACH,wBAAsB,eAAe,CACnC,IAAI,EAAE;IAAE,WAAW,EAAE,WAAW,CAAC;IAAC,KAAK,EAAE,cAAc,CAAA;CAAE,EACzD,KAAK,EAAE,MAAM,EACb,EAAE,EAAE,MAAM,GACT,OAAO,CAAC,IAAI,CAAC,CAaf"}
+{"version":3,"file":"blueprint-registry.d.ts","sourceRoot":"","sources":["../../src/renders/blueprint-registry.ts"],"names":[],"mappings":"AAyCA,OAAO,KAAK,EACV,cAAc,EACd,iBAAiB,EACjB,qBAAqB,EAGrB,WAAW,EACZ,MAAM,0BAA0B,CAAC;AAKlC,YAAY,EAAE,cAAc,EAAE,MAAM,0BAA0B,CAAC;AAC/D,OAAO,EAIL,KAAK,eAAe,EACpB,KAAK,iBAAiB,EACtB,KAAK,YAAY,EAClB,MAAM,mBAAmB,CAAC;AAK3B,OAAO,EAEL,KAAK,yBAAyB,EAC9B,KAAK,wBAAwB,EAC9B,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EAEL,KAAK,uBAAuB,EAC7B,MAAM,2BAA2B,CAAC;AAEnC;;;;GAIG;AACH,MAAM,MAAM,aAAa,GAAG,UAAU,GAAG,UAAU,GAAG,UAAU,GAAG,MAAM,CAAC;AAE1E,mDAAmD;AACnD,MAAM,WAAW,SAAS;IACxB;;;;;OAKG;IACH,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;IACpB,QAAQ,CAAC,IAAI,EAAE,aAAa,CAAC;IAC7B,uEAAuE;IACvE,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B;;;;;;OAMG;IACH,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B;;;;OAIG;IACH,QAAQ,CAAC,QAAQ,EAAE,iBAAiB,CAAC;IACrC,QAAQ,CAAC,QAAQ,EAAE,YAAY,CAAC;IAChC,2EAA2E;IAC3E,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,oFAAoF;IACpF,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;IAC/B,qCAAqC;IACrC,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,sFAAsF;IACtF,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,oEAAoE;IACpE,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC;IAC5B;;;;;;;;;OASG;IACH,QAAQ,CAAC,MAAM,EAAE,eAAe,CAAC;IACjC;;;;;;;OAOG;IACH,QAAQ,CAAC,SAAS,CAAC,EAAE,OAAO,CAAC;IAC7B;;;;;;;OAOG;IACH,QAAQ,CAAC,kBAAkB,CAAC,EAAE,SAAS,yBAAyB,EAAE,CAAC;CACpE;AAED;;;;;GAKG;AACH,MAAM,MAAM,iBAAiB,GAAG,CAC9B,QAAQ,EAAE,YAAY,KACnB,wBAAwB,CAAC;AAE9B;;;;;;;;;;;;GAYG;AACH,qBAAa,sBAAuB,SAAQ,KAAK;IAC/C,QAAQ,CAAC,IAAI,EAAG,oBAAoB,CAAU;IAC9C,QAAQ,CAAC,QAAQ,EAAE,SAAS,yBAAyB,EAAE,CAAC;gBAC5C,QAAQ,EAAE,SAAS,yBAAyB,EAAE;CAQ3D;AAED,gFAAgF;AAChF,MAAM,WAAW,qBAAqB;IACpC,QAAQ,CAAC,SAAS,EAAE,iBAAiB,CAAC;IACtC,QAAQ,CAAC,WAAW,EAAE,WAAW,CAAC;IAClC;;;;;;OAMG;IACH,QAAQ,CAAC,KAAK,EAAE,cAAc,CAAC;IAC/B;;;;;;;;;OASG;IACH,QAAQ,CAAC,UAAU,CAAC,EAAE,uBAAuB,CAAC;CAC/C;AAED,2CAA2C;AAC3C,MAAM,WAAW,sBAAsB;IACrC,QAAQ,CAAC,IAAI,EAAE,aAAa,CAAC;IAC7B,QAAQ,CAAC,QAAQ,EAAE,YAAY,CAAC;IAChC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;IAC/B;;;;;;;OAOG;IACH,QAAQ,CAAC,MAAM,EAAE,eAAe,CAAC;IACjC;;;OAGG;IACH,QAAQ,CAAC,SAAS,CAAC,EAAE,OAAO,CAAC;IAC7B;;;;;OAKG;IACH,QAAQ,CAAC,QAAQ,CAAC,EAAE,iBAAiB,CAAC;IACtC;;;;;;;;;;OAUG;IACH,QAAQ,CAAC,SAAS,CAAC,EAAE,OAAO,GAAG,UAAU,CAAC;CAC3C;AAED;;;;;;;;GAQG;AACH,wBAAgB,eAAe,CAC7B,IAAI,EAAE,aAAa,EACnB,WAAW,EAAE,MAAM,EACnB,UAAU,EAAE,MAAM,GACjB,MAAM,CAER;AAED;;;;;;;;GAQG;AACH,wBAAgB,qBAAqB,CACnC,QAAQ,EAAE,YAAY,GAAG,SAAS,EAClC,MAAM,EAAE,MAAM,GACb,MAAM,CAER;AAyMD;;;;;;;;;;GAUG;AACH,eAAO,MAAM,+BAA+B,MAAM,CAAC;AAEnD,MAAM,WAAW,wBAAwB;IACvC;;;;;;;OAOG;IACH,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAC;IAC7B;;;;;;OAMG;IACH,QAAQ,CAAC,SAAS,CAAC,EAAE,iBAAiB,CAAC;IACvC;;;;;OAKG;IACH,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,MAAM,CAAC;CAChC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AACH,wBAAsB,iBAAiB,CACrC,IAAI,EAAE,qBAAqB,EAC3B,KAAK,EAAE,MAAM,EACb,KAAK,EAAE,sBAAsB,EAC7B,OAAO,GAAE,wBAA6B,GACrC,OAAO,CAAC,SAAS,CAAC,CA8EpB;AAoGD;;;;;;;;;;;;GAYG;AACH,wBAAsB,kBAAkB,CACtC,IAAI,EAAE;IAAE,WAAW,EAAE,WAAW,CAAC;IAAC,KAAK,EAAE,cAAc,CAAA;CAAE,EACzD,KAAK,EAAE,MAAM,EACb,IAAI,EAAE,aAAa,EACnB,WAAW,EAAE,MAAM,EACnB,WAAW,CAAC,EAAE,MAAM,GACnB,OAAO,CAAC,SAAS,GAAG,IAAI,CAAC,CAM3B;AAsCD;;;;;GAKG;AACH,wBAAsB,iBAAiB,CACrC,IAAI,EAAE;IAAE,WAAW,EAAE,WAAW,CAAA;CAAE,EAClC,KAAK,EAAE,MAAM,EACb,EAAE,EAAE,MAAM,GACT,OAAO,CAAC,SAAS,GAAG,IAAI,CAAC,CAE3B;AAED;;;;;;;;;;;GAWG;AACH,MAAM,WAAW,kBAAkB;IACjC,QAAQ,CAAC,SAAS,EAAE,SAAS,CAAC;IAC9B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;CACzB;AAED,wBAAsB,yBAAyB,CAC7C,IAAI,EAAE,qBAAqB,EAC3B,KAAK,EAAE,MAAM,EACb,KAAK,EAAE;IAAE,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,YAAY,CAAA;CAAE,EACpE,OAAO,GAAE;IAAE,QAAQ,CAAC,IAAI,CAAC,EAAE,aAAa,CAAC;IAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,CAAA;CAAO,GACtE,OAAO,CAAC,SAAS,kBAAkB,EAAE,CAAC,CAaxC;AAED;;;;GAIG;AACH,wBAAsB,cAAc,CAClC,IAAI,EAAE;IAAE,WAAW,EAAE,qBAAqB,CAAA;CAAE,EAC5C,KAAK,EAAE,MAAM,EACb,IAAI,CAAC,EAAE,aAAa,GACnB,OAAO,CAAC,SAAS,SAAS,EAAE,CAAC,CAU/B;AAED;;;;;GAKG;AACH,wBAAsB,kBAAkB,CACtC,IAAI,EAAE;IAAE,WAAW,EAAE,WAAW,CAAA;CAAE,GAAG,OAAO,CAAC,qBAAqB,CAAC,EACnE,KAAK,EAAE,MAAM,EACb,EAAE,EAAE,MAAM,GACT,OAAO,CAAC,IAAI,CAAC,CAoCf;AAoBD;;;;;;;;GAQG;AACH,wBAAsB,eAAe,CACnC,IAAI,EAAE;IAAE,WAAW,EAAE,WAAW,CAAC;IAAC,KAAK,EAAE,cAAc,CAAA;CAAE,EACzD,KAAK,EAAE,MAAM,EACb,EAAE,EAAE,MAAM,GACT,OAAO,CAAC,IAAI,CAAC,CAaf"}