@ggui-ai/mcp-server-handlers 0.6.3 → 0.8.0

package/dist/ops-apps/types.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../src/ops-apps/types.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AACH,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,mBAAmB,CAAC;AAElD;;;;GAIG;AACH,MAAM,WAAW,SAAS;IACxB,6EAA6E;IAC7E,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,mEAAmE;IACnE,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,2BAA2B;IAC3B,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,+CAA+C;IAC/C,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM,CAAC;IAC/B;;;;OAIG;IACH,QAAQ,CAAC,kBAAkB,CAAC,EAAE,MAAM,CAAC;IACrC,sDAAsD;IACtD,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,+CAA+C;IAC/C,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;CAC5B;AAED;;;;;;;;;;;GAWG;AACH,MAAM,WAAW,cAAc;IAC7B,0DAA0D;IAC1D,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAC;IAC9B,wEAAwE;IACxE,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM,CAAC;IAC/B,oEAAoE;IACpE,QAAQ,CAAC,kBAAkB,CAAC,EAAE,MAAM,CAAC;CACtC;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,MAAM,WAAW,UAAU;IACzB,2DAA2D;IAC3D,IAAI,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,SAAS,SAAS,EAAE,CAAC,CAAC;IACtD,0FAA0F;IAC1F,GAAG,CAAC,IAAI,EAAE;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,QAAQ,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC,SAAS,GAAG,IAAI,CAAC,CAAC;IAC1E,0DAA0D;IAC1D,MAAM,CAAC,IAAI,EAAE;QAAE,QAAQ,EAAE,MAAM,CAAC;QAAC,WAAW,CAAC,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC,SAAS,CAAC,CAAC;IAC7E;;;;;OAKG;IACH,MAAM,CAAC,IAAI,EAAE;QACX,KAAK,EAAE,MAAM,CAAC;QACd,QAAQ,EAAE,MAAM,CAAC;QACjB,KAAK,EAAE,cAAc,CAAC;KACvB,GAAG,OAAO,CAAC,SAAS,CAAC,CAAC;IACvB,gFAAgF;IAChF,MAAM,CAAC,IAAI,EAAE;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,QAAQ,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACjE;;;OAGG;IACH,QAAQ,CAAC,IAAI,EAAE;QACb,KAAK,EAAE,MAAM,CAAC;QACd,QAAQ,EAAE,MAAM,CAAC;QACjB,KAAK,EAAE,QAAQ,CAAC;KACjB,GAAG,OAAO,CAAC;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,SAAS,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;CACnD;AAED;;;;;;;;GAQG;AACH,MAAM,WAAW,oBAAoB;IACnC,gEAAgE;IAChE,UAAU,CAAC,IAAI,EAAE;QAAE,QAAQ,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACrE,0EAA0E;IAC1E,UAAU,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAAC;CACtD;AAED;;;GAGG;AACH,qBAAa,gBAAiB,SAAQ,KAAK;IACzC,QAAQ,CAAC,IAAI,EAAG,eAAe,CAAU;gBAC7B,KAAK,EAAE,MAAM;CAI1B;AAED;;;;;;GAMG;AACH,qBAAa,wBAAyB,SAAQ,KAAK;IACjD,QAAQ,CAAC,IAAI,EAAG,wBAAwB,CAAU;gBACtC,OAAO,EAAE,MAAM;CAI5B"}
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../src/ops-apps/types.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AACH,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,mBAAmB,CAAC;AAElD;;;;GAIG;AACH,MAAM,WAAW,SAAS;IACxB,6EAA6E;IAC7E,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,mEAAmE;IACnE,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,2BAA2B;IAC3B,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,+CAA+C;IAC/C,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM,CAAC;IAC/B;;;;OAIG;IACH,QAAQ,CAAC,kBAAkB,CAAC,EAAE,MAAM,CAAC;IACrC,sDAAsD;IACtD,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,+CAA+C;IAC/C,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;CAC5B;AAED;;;;;;;;;;;GAWG;AACH,MAAM,WAAW,cAAc;IAC7B,0DAA0D;IAC1D,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAC;IAC9B,wEAAwE;IACxE,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM,CAAC;IAC/B,oEAAoE;IACpE,QAAQ,CAAC,kBAAkB,CAAC,EAAE,MAAM,CAAC;CACtC;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,MAAM,WAAW,UAAU;IACzB,2DAA2D;IAC3D,IAAI,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,SAAS,SAAS,EAAE,CAAC,CAAC;IACtD,0FAA0F;IAC1F,GAAG,CAAC,IAAI,EAAE;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,QAAQ,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC,SAAS,GAAG,IAAI,CAAC,CAAC;IAC1E,0DAA0D;IAC1D,MAAM,CAAC,IAAI,EAAE;QAAE,QAAQ,EAAE,MAAM,CAAC;QAAC,WAAW,CAAC,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC,SAAS,CAAC,CAAC;IAC7E;;;;;OAKG;IACH,MAAM,CAAC,IAAI,EAAE;QACX,KAAK,EAAE,MAAM,CAAC;QACd,QAAQ,EAAE,MAAM,CAAC;QACjB,KAAK,EAAE,cAAc,CAAC;KACvB,GAAG,OAAO,CAAC,SAAS,CAAC,CAAC;IACvB;;;;;;;;;;;;;;;;;;OAkBG;IACH,MAAM,CAAC,IAAI,EAAE;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,QAAQ,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACjE;;;OAGG;IACH,QAAQ,CAAC,IAAI,EAAE;QACb,KAAK,EAAE,MAAM,CAAC;QACd,QAAQ,EAAE,MAAM,CAAC;QACjB,KAAK,EAAE,QAAQ,CAAC;KACjB,GAAG,OAAO,CAAC;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,SAAS,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;CACnD;AAED;;;;;;;;GAQG;AACH,MAAM,WAAW,oBAAoB;IACnC,gEAAgE;IAChE,UAAU,CAAC,IAAI,EAAE;QAAE,QAAQ,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACrE,0EAA0E;IAC1E,UAAU,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAAC;CACtD;AAED;;;GAGG;AACH,qBAAa,gBAAiB,SAAQ,KAAK;IACzC,QAAQ,CAAC,IAAI,EAAG,eAAe,CAAU;gBAC7B,KAAK,EAAE,MAAM;CAI1B;AAED;;;;;;;;GAQG;AACH,qBAAa,4BAA6B,SAAQ,KAAK;IACrD,QAAQ,CAAC,IAAI,EAAG,4BAA4B,CAAU;gBAC1C,KAAK,EAAE,MAAM;CAM1B;AAED;;;;;;GAMG;AACH,qBAAa,wBAAyB,SAAQ,KAAK;IACjD,QAAQ,CAAC,IAAI,EAAG,wBAAwB,CAAU;gBACtC,OAAO,EAAE,MAAM;CAI5B"}

package/dist/ops-apps/types.js

@@ -9,6 +9,22 @@ export class AppNotFoundError extends Error {
         this.name = 'AppNotFoundError';
     }
 }
+/**
+ * Thrown when the delete target IS the caller's default app.
+ *
+ * `defaultAppId` is what the universal route resolves on every
+ * request; deleting the app it names would leave that route pointing
+ * at a row that no longer exists. Same lock the console's Delete
+ * enforces — the operator picks a different default first, then
+ * deletes.
+ */
+export class DefaultAppDeleteBlockedError extends Error {
+    code = 'default_app_delete_blocked';
+    constructor(appId) {
+        super(`default_app_delete_blocked: app ${JSON.stringify(appId)} is the calling user's default — set a different default app first, then delete this one`);
+        this.name = 'DefaultAppDeleteBlockedError';
+    }
+}
 /**
  * Thrown by adapters that prefer surfacing access denial over the
  * "treat as not-found" privacy posture. Handlers translate to the

package/dist/ops-blueprint/generate.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"generate.d.ts","sourceRoot":"","sources":["../../src/ops-blueprint/generate.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8CG;AAEH,OAAO,KAAK,EACV,gBAAgB,EAChB,iBAAiB,EACjB,cAAc,EACd,iBAAiB,EACjB,aAAa,EAGd,MAAM,0BAA0B,CAAC;AAClC,OAAO,EAGL,KAAK,SAAS,EACd,KAAK,YAAY,EAGjB,KAAK,0BAA0B,EAChC,MAAM,mBAAmB,CAAC;AAG3B,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAGxB,OAAO,EAEL,KAAK,qBAAqB,EAC1B,KAAK,qBAAqB,EAC3B,MAAM,qBAAqB,CAAC;AAC7B,OAAO,KAAK,EAAE,cAAc,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AAQjE,QAAA,MAAM,cAAc;;;;;;;;CAAwC,CAAC;AAC7D,QAAA,MAAM,eAAe;;;;;;;;;CAWb,CAAC;AAET;;;;;;GAMG;AACH,MAAM,WAAW,WAAW;IAC1B,CAAC,QAAQ,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CACxD;AAED;;GAEG;AACH,MAAM,WAAW,4BAA4B;IAC3C;;;;OAIG;IACH,QAAQ,CAAC,QAAQ,EAAE,iBAAiB,CAAC;IACrC;;;OAGG;IACH,QAAQ,CAAC,cAAc,EAAE,cAAc,CAAC;IACxC;;;;;;;OAOG;IACH,QAAQ,CAAC,aAAa,CAAC,EAAE,CAAC,KAAK,EAAE,MAAM,KAAK,OAAO,CAAC,SAAS,SAAS,EAAE,CAAC,CAAC;IAC1E;;;;;;;OAOG;IACH,QAAQ,CAAC,gBAAgB,CAAC,EAAE,gBAAgB,CAAC;IAC7C;;;;;OAKG;IACH,QAAQ,CAAC,UAAU,EAAE,CACnB,GAAG,EAAE,cAAc,KAChB,OAAO,CAAC,qBAAqB,GAAG,IAAI,CAAC,GAAG,qBAAqB,GAAG,IAAI,CAAC;IAC1E;;;;OAIG;IACH,QAAQ,CAAC,UAAU,EAAE,iBAAiB,CAAC;IACvC;;;;;;OAMG;IACH,QAAQ,CAAC,OAAO,CAAC,EAAE,WAAW,CAAC;IAC/B;;;;;;;;;;;;;;;;;;;;OAoBG;IACH,QAAQ,CAAC,aAAa,CAAC,EAAE,qBAAqB,CAAC;IAC/C;;;;OAIG;IACH,QAAQ,CAAC,SAAS,CAAC,EAAE,aAAa,CAAC;IACnC;;;OAGG;IACH,QAAQ,CAAC,GAAG,CAAC,EAAE,MAAM,MAAM,CAAC;IAC5B;;;OAGG;IACH,QAAQ,CAAC,eAAe,CAAC,EAAE,MAAM,MAAM,CAAC;CACzC;AAmCD,wBAAgB,qCAAqC,CACnD,IAAI,EAAE,4BAA4B,GACjC,aAAa,CAAC,OAAO,cAAc,EAAE,OAAO,eAAe,EAAE,0BAA0B,CAAC,CAqP1F"}
+{"version":3,"file":"generate.d.ts","sourceRoot":"","sources":["../../src/ops-blueprint/generate.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8CG;AAEH,OAAO,KAAK,EACV,gBAAgB,EAChB,iBAAiB,EACjB,cAAc,EACd,iBAAiB,EACjB,aAAa,EAGd,MAAM,0BAA0B,CAAC;AAClC,OAAO,EAGL,KAAK,SAAS,EACd,KAAK,YAAY,EAGjB,KAAK,0BAA0B,EAChC,MAAM,mBAAmB,CAAC;AAG3B,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAGxB,OAAO,EAEL,KAAK,qBAAqB,EAC1B,KAAK,qBAAqB,EAC3B,MAAM,qBAAqB,CAAC;AAC7B,OAAO,KAAK,EAAE,cAAc,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AAQjE,QAAA,MAAM,cAAc;;;;;;;;CAAwC,CAAC;AAC7D,QAAA,MAAM,eAAe;;;;;;;;;CAWb,CAAC;AAET;;;;;;GAMG;AACH,MAAM,WAAW,WAAW;IAC1B,CAAC,QAAQ,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CACxD;AAED;;GAEG;AACH,MAAM,WAAW,4BAA4B;IAC3C;;;;OAIG;IACH,QAAQ,CAAC,QAAQ,EAAE,iBAAiB,CAAC;IACrC;;;OAGG;IACH,QAAQ,CAAC,cAAc,EAAE,cAAc,CAAC;IACxC;;;;;;;OAOG;IACH,QAAQ,CAAC,aAAa,CAAC,EAAE,CAAC,KAAK,EAAE,MAAM,KAAK,OAAO,CAAC,SAAS,SAAS,EAAE,CAAC,CAAC;IAC1E;;;;;;;OAOG;IACH,QAAQ,CAAC,gBAAgB,CAAC,EAAE,gBAAgB,CAAC;IAC7C;;;;;OAKG;IACH,QAAQ,CAAC,UAAU,EAAE,CACnB,GAAG,EAAE,cAAc,KAChB,OAAO,CAAC,qBAAqB,GAAG,IAAI,CAAC,GAAG,qBAAqB,GAAG,IAAI,CAAC;IAC1E;;;;OAIG;IACH,QAAQ,CAAC,UAAU,EAAE,iBAAiB,CAAC;IACvC;;;;;;OAMG;IACH,QAAQ,CAAC,OAAO,CAAC,EAAE,WAAW,CAAC;IAC/B;;;;;;;;;;;;;;;;;;;;OAoBG;IACH,QAAQ,CAAC,aAAa,CAAC,EAAE,qBAAqB,CAAC;IAC/C;;;;OAIG;IACH,QAAQ,CAAC,SAAS,CAAC,EAAE,aAAa,CAAC;IACnC;;;OAGG;IACH,QAAQ,CAAC,GAAG,CAAC,EAAE,MAAM,MAAM,CAAC;IAC5B;;;OAGG;IACH,QAAQ,CAAC,eAAe,CAAC,EAAE,MAAM,MAAM,CAAC;CACzC;AAmCD,wBAAgB,qCAAqC,CACnD,IAAI,EAAE,4BAA4B,GACjC,aAAa,CAAC,OAAO,cAAc,EAAE,OAAO,eAAe,EAAE,0BAA0B,CAAC,CAyP1F"}

package/dist/ops-blueprint/generate.js

@@ -123,8 +123,9 @@ export function createGguiOpsGenerateBlueprintHandler(deps) {
             // in `renders/`.
             assertContractNoRetiredFields(parsed.contract);
             // 0. Every `contract.clientCapabilities.gadgets[*]` MUST
-            // resolve in `App.gadgets` by the full `(hook, package,
-            // version)` tuple. Throws a precise reject when an
+            // resolve in `App.gadgets` by `(package, export name)` — the
+            // wire carries no version; the operator's catalog is the
+            // version pin. Throws a precise reject when an
             // unregistered wrapper is referenced. No-op when
             // `appMetadataStore` is unset.
             //
@@ -268,7 +269,10 @@ export function createGguiOpsGenerateBlueprintHandler(deps) {
                         // Operator-DISPATCHED but engine-GENERATED: the code came
                         // out of `generator.generate(...)`, so provenance is the
                         // llm arm — the same `source` stamped on the MVB row above.
+                        // The two axes disagree here on purpose, which is exactly
+                        // why `createdBy` cannot be derived from `source`.
                         source,
+                        createdBy: "operator",
                     });
                 }
                 catch (err) {

package/dist/ops-blueprint/register.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"register.d.ts","sourceRoot":"","sources":["../../src/ops-blueprint/register.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAoCG;AAEH,OAAO,KAAK,EACV,gBAAgB,EAChB,cAAc,EACd,aAAa,EACd,MAAM,0BAA0B,CAAC;AAClC,OAAO,EAEL,KAAK,SAAS,EACd,KAAK,YAAY,EAEjB,KAAK,0BAA0B,EAEhC,MAAM,mBAAmB,CAAC;AAG3B,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAGxB,OAAO,EAAqB,KAAK,qBAAqB,EAAE,MAAM,qBAAqB,CAAC;AACpF,OAAO,KAAK,EAAkB,aAAa,EAAE,MAAM,aAAa,CAAC;AACjE,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,eAAe,CAAC;AAGjD,QAAA,MAAM,cAAc;;;;;;;;CAAwC,CAAC;AAC7D,QAAA,MAAM,eAAe;;;;;;CAIb,CAAC;AAST;;;;;GAKG;AACH,MAAM,WAAW,4BAA4B;IAC3C;;;OAGG;IACH,QAAQ,CAAC,cAAc,EAAE,cAAc,CAAC;IACxC;;;OAGG;IACH,QAAQ,CAAC,aAAa,CAAC,EAAE,CAAC,KAAK,EAAE,MAAM,KAAK,OAAO,CAAC,SAAS,SAAS,EAAE,CAAC,CAAC;IAC1E;;;;;;;OAOG;IACH,QAAQ,CAAC,gBAAgB,CAAC,EAAE,gBAAgB,CAAC;IAC7C;;;;;;OAMG;IACH,QAAQ,CAAC,OAAO,CAAC,EAAE,WAAW,CAAC;IAC/B;;;;;;;;OAQG;IACH,QAAQ,CAAC,aAAa,CAAC,EAAE,qBAAqB,CAAC;IAC/C;;;;OAIG;IACH,QAAQ,CAAC,SAAS,CAAC,EAAE,aAAa,CAAC;IACnC;;OAEG;IACH,QAAQ,CAAC,GAAG,CAAC,EAAE,MAAM,MAAM,CAAC;IAC5B;;OAEG;IACH,QAAQ,CAAC,eAAe,CAAC,EAAE,MAAM,MAAM,CAAC;CACzC;AAED,wBAAgB,qCAAqC,CACnD,IAAI,EAAE,4BAA4B,GACjC,aAAa,CAAC,OAAO,cAAc,EAAE,OAAO,eAAe,EAAE,0BAA0B,CAAC,CA8K1F"}
+{"version":3,"file":"register.d.ts","sourceRoot":"","sources":["../../src/ops-blueprint/register.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAoCG;AAEH,OAAO,KAAK,EACV,gBAAgB,EAChB,cAAc,EACd,aAAa,EACd,MAAM,0BAA0B,CAAC;AAClC,OAAO,EAEL,KAAK,SAAS,EACd,KAAK,YAAY,EAEjB,KAAK,0BAA0B,EAEhC,MAAM,mBAAmB,CAAC;AAG3B,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAGxB,OAAO,EAAqB,KAAK,qBAAqB,EAAE,MAAM,qBAAqB,CAAC;AACpF,OAAO,KAAK,EAAkB,aAAa,EAAE,MAAM,aAAa,CAAC;AACjE,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,eAAe,CAAC;AAGjD,QAAA,MAAM,cAAc;;;;;;;;CAAwC,CAAC;AAC7D,QAAA,MAAM,eAAe;;;;;;CAIb,CAAC;AAST;;;;;GAKG;AACH,MAAM,WAAW,4BAA4B;IAC3C;;;OAGG;IACH,QAAQ,CAAC,cAAc,EAAE,cAAc,CAAC;IACxC;;;OAGG;IACH,QAAQ,CAAC,aAAa,CAAC,EAAE,CAAC,KAAK,EAAE,MAAM,KAAK,OAAO,CAAC,SAAS,SAAS,EAAE,CAAC,CAAC;IAC1E;;;;;;;OAOG;IACH,QAAQ,CAAC,gBAAgB,CAAC,EAAE,gBAAgB,CAAC;IAC7C;;;;;;OAMG;IACH,QAAQ,CAAC,OAAO,CAAC,EAAE,WAAW,CAAC;IAC/B;;;;;;;;OAQG;IACH,QAAQ,CAAC,aAAa,CAAC,EAAE,qBAAqB,CAAC;IAC/C;;;;OAIG;IACH,QAAQ,CAAC,SAAS,CAAC,EAAE,aAAa,CAAC;IACnC;;OAEG;IACH,QAAQ,CAAC,GAAG,CAAC,EAAE,MAAM,MAAM,CAAC;IAC5B;;OAEG;IACH,QAAQ,CAAC,eAAe,CAAC,EAAE,MAAM,MAAM,CAAC;CACzC;AAED,wBAAgB,qCAAqC,CACnD,IAAI,EAAE,4BAA4B,GACjC,aAAa,CAAC,OAAO,cAAc,EAAE,OAAO,eAAe,EAAE,0BAA0B,CAAC,CAmL1F"}

package/dist/ops-blueprint/register.js

@@ -78,8 +78,9 @@ export function createGguiOpsRegisterBlueprintHandler(deps) {
             // in `renders/`.
             assertContractNoRetiredFields(parsed.contract);
             // Every `contract.clientCapabilities.gadgets[*]` MUST resolve
-            // in `App.gadgets` by the full `(hook, package, version)`
-            // tuple. Fails fast with a precise reject before any state
+            // in `App.gadgets` by `(package, export name)` — the wire
+            // carries no version; the operator's catalog is the version
+            // pin. Fails fast with a precise reject before any state
             // mutation. No-op when no `appMetadataStore` is bound.
             if (deps.appMetadataStore) {
                 const appRecord = await deps.appMetadataStore.get(ctx.appId);
@@ -166,6 +167,10 @@ export function createGguiOpsRegisterBlueprintHandler(deps) {
                         // Same user-arm provenance as the MVB row above — one
                         // handler call, one provenance claim across both stores.
                         source: USER_SOURCE,
+                        // An operator invoked this tool. Without it the durable
+                        // record would claim the standard agent flow minted a row
+                        // that is retained permanently.
+                        createdBy: "operator",
                     });
                 }
                 catch (err) {

package/dist/ops-connector-keys/types.d.ts

@@ -57,6 +57,13 @@ export interface IssueConnectorKeyResult {
  *   - `revoke` is idempotent — re-revoking a `revoked` row returns the
  *     same row with `alreadyRevoked: true`. Cross-user revoke is
  *     rejected with `ConnectorKeyAccessDeniedError`.
+ *   - When `issue` is asked to bind the key to an app (`appId` set),
+ *     the implementation MUST verify the subject owns that app before
+ *     minting, and MUST reject with `ConnectorKeyAccessDeniedError`
+ *     when it does not or when the deployment cannot verify. A key
+ *     bound to an app the subject does not own is a credential for
+ *     someone else's data — refusing the mint is the contract, not a
+ *     quality-of-implementation choice.
  */
 export interface ConnectorKeysSource {
     list(ownerSub: string): Promise<readonly ConnectorKeySummary[]>;

package/dist/ops-connector-keys/types.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../src/ops-connector-keys/types.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH;;;;GAIG;AACH,MAAM,WAAW,mBAAmB;IAClC,8CAA8C;IAC9C,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;IACpB,qEAAqE;IACrE,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;IAC9B,2BAA2B;IAC3B,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC;IACvB,uEAAuE;IACvE,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC;IACxB,gCAAgC;IAChC,QAAQ,CAAC,MAAM,EAAE,QAAQ,GAAG,SAAS,CAAC;IACtC,qBAAqB;IACrB,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,0DAA0D;IAC1D,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAC;IAC7B,mEAAmE;IACnE,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC;CAC7B;AAED,MAAM,WAAW,uBAAuB;IACtC,kCAAkC;IAClC,QAAQ,CAAC,OAAO,EAAE,mBAAmB,CAAC;IACtC;;;;;OAKG;IACH,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;CAC/B;AAED;;;;;;;;;;;;;;;GAeG;AACH,MAAM,WAAW,mBAAmB;IAClC,IAAI,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,SAAS,mBAAmB,EAAE,CAAC,CAAC;IAChE,KAAK,CAAC,IAAI,EAAE;QACV,QAAQ,EAAE,MAAM,CAAC;QACjB,IAAI,CAAC,EAAE,MAAM,CAAC;QACd,KAAK,CAAC,EAAE,MAAM,CAAC;QACf,SAAS,CAAC,EAAE,MAAM,CAAC;KACpB,GAAG,OAAO,CAAC,uBAAuB,CAAC,CAAC;IACrC,MAAM,CAAC,IAAI,EAAE;QACX,QAAQ,EAAE,MAAM,CAAC;QACjB,KAAK,EAAE,MAAM,CAAC;KACf,GAAG,OAAO,CAAC;QAAE,OAAO,EAAE,mBAAmB,CAAC;QAAC,cAAc,EAAE,OAAO,CAAA;KAAE,CAAC,CAAC;CACxE;AAED,qBAAa,6BAA8B,SAAQ,KAAK;IACtD,QAAQ,CAAC,IAAI,EAAG,6BAA6B,CAAU;gBAC3C,OAAO,EAAE,MAAM;CAI5B;AAED,qBAAa,yBAA0B,SAAQ,KAAK;IAClD,QAAQ,CAAC,IAAI,EAAG,yBAAyB,CAAU;gBACvC,KAAK,EAAE,MAAM;CAM1B"}
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../src/ops-connector-keys/types.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH;;;;GAIG;AACH,MAAM,WAAW,mBAAmB;IAClC,8CAA8C;IAC9C,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;IACpB,qEAAqE;IACrE,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;IAC9B,2BAA2B;IAC3B,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC;IACvB,uEAAuE;IACvE,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC;IACxB,gCAAgC;IAChC,QAAQ,CAAC,MAAM,EAAE,QAAQ,GAAG,SAAS,CAAC;IACtC,qBAAqB;IACrB,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,0DAA0D;IAC1D,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAC;IAC7B,mEAAmE;IACnE,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC;CAC7B;AAED,MAAM,WAAW,uBAAuB;IACtC,kCAAkC;IAClC,QAAQ,CAAC,OAAO,EAAE,mBAAmB,CAAC;IACtC;;;;;OAKG;IACH,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;CAC/B;AAED;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,MAAM,WAAW,mBAAmB;IAClC,IAAI,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,SAAS,mBAAmB,EAAE,CAAC,CAAC;IAChE,KAAK,CAAC,IAAI,EAAE;QACV,QAAQ,EAAE,MAAM,CAAC;QACjB,IAAI,CAAC,EAAE,MAAM,CAAC;QACd,KAAK,CAAC,EAAE,MAAM,CAAC;QACf,SAAS,CAAC,EAAE,MAAM,CAAC;KACpB,GAAG,OAAO,CAAC,uBAAuB,CAAC,CAAC;IACrC,MAAM,CAAC,IAAI,EAAE;QACX,QAAQ,EAAE,MAAM,CAAC;QACjB,KAAK,EAAE,MAAM,CAAC;KACf,GAAG,OAAO,CAAC;QAAE,OAAO,EAAE,mBAAmB,CAAC;QAAC,cAAc,EAAE,OAAO,CAAA;KAAE,CAAC,CAAC;CACxE;AAED,qBAAa,6BAA8B,SAAQ,KAAK;IACtD,QAAQ,CAAC,IAAI,EAAG,6BAA6B,CAAU;gBAC3C,OAAO,EAAE,MAAM;CAI5B;AAED,qBAAa,yBAA0B,SAAQ,KAAK;IAClD,QAAQ,CAAC,IAAI,EAAG,yBAAyB,CAAU;gBACvC,KAAK,EAAE,MAAM;CAM1B"}

package/dist/renders/blueprint-durability.d.ts

@@ -0,0 +1,111 @@
+/**
+ * Durable write-through for freshly registered blueprints (#430 slice
+ * 2).
+ *
+ * The blueprint registry (`blueprint-registry.ts`) is a CAPPED vector
+ * store: registering past `maxPerKind` evicts the lowest-hit entry, and
+ * a deployment whose vector store is process-local loses the whole
+ * bucket on restart. That is the right shape for a match cache — a miss
+ * costs one regeneration. It is the wrong shape for anything that needs
+ * to resolve a blueprint by id LATER, because "later" is exactly when
+ * the entry is gone.
+ *
+ * So a registration that mints a fresh row also writes it through to a
+ * durable pair: metadata to a {@link BlueprintStore}, the compiled body
+ * to a {@link CodeStore} keyed by content hash. Deployments that bind
+ * neither keep today's behavior exactly.
+ *
+ * ## Two `Blueprint` types, and the projection between them
+ *
+ * The registry's {@link RegistryBlueprint} and the protocol's
+ * `Blueprint` share a name and almost nothing else. The registry row is
+ * a match candidate: `id`, `kind`, `intent`, `componentCode` inline, a
+ * `hitCount`. The protocol row is a persistence record: `blueprintId`,
+ * `appId`, `contractHash`, a `codeHash` POINTER to the body. The
+ * projection below is where they meet on the DURABLE-WRITE path, and
+ * it is where the registry's `contractKey` becomes the protocol's
+ * `contractHash` — one value, two spellings, same 16-char blueprintKey
+ * domain.
+ *
+ * Not the only such hop in the codebase: `decide-handshake.ts` makes
+ * the same translation projecting a matched blueprint onto
+ * `blueprintMeta`, and predates this module. The claim is scoped on
+ * purpose — a docstring that overstates its reach is how a reader
+ * concludes a rename is contained when it is not.
+ *
+ * ## Best-effort, and what "best" means when it fails
+ *
+ * Registration must never fail because durability hiccuped: the render
+ * that triggered it already produced working code and already
+ * committed. Both writes are therefore try/caught into named events.
+ *
+ * The order is body first, then metadata, and that is load-bearing. A
+ * body with no row is an orphan — invisible, reclaimable, harmless. A
+ * row naming a `codeHash` with no object behind it is a LIE: a later
+ * resolve finds the record, fetches the body, gets nothing, and fails
+ * at the point where it looked like it would succeed. So when the body
+ * write fails, the row is still written but WITHOUT `codeHash`, which
+ * reads as "metadata recorded, no body stored" — a state the protocol
+ * type already models and consumers already branch on.
+ *
+ * ## Backfill posture — documented, not built
+ *
+ * Blueprints registered before this shipped exist only in the capped
+ * vector registry. Their records carry a `blueprintId` that resolves to
+ * nothing durable, so a re-mint against them lands in
+ * `blueprint_unresolvable`. No backfill job exists, deliberately: the
+ * affected rows are sandbox-only, the cost of the miss is one
+ * regeneration, and a job to walk a capped in-memory registry would be
+ * writing whatever survived rather than what was actually registered.
+ * If real data ever needs it, the job is a scope scan of the vector
+ * store through this same projection — but not until then.
+ */
+import type { BlueprintStore, CodeStore } from '@ggui-ai/mcp-server-core';
+import type { Blueprint as DurableBlueprint } from '@ggui-ai/protocol';
+import type { Blueprint as RegistryBlueprint } from './blueprint-registry.js';
+/**
+ * Every event this module can emit. Closed union — a new emitter picks
+ * from these or extends the type, which is what makes a rename a
+ * compile error rather than an alert filter that quietly stops
+ * matching.
+ */
+export type BlueprintDurabilityEvent = 'blueprint_durable_write_failed' | 'blueprint_code_write_failed';
+/**
+ * The event names as values, so every emitter — in this package or a
+ * storage backend elsewhere — spells them from one place.
+ */
+export declare const BLUEPRINT_DURABILITY_EVENTS: {
+    /** Metadata row rejected. The blueprint is not durably resolvable. */
+    readonly durableWriteFailed: "blueprint_durable_write_failed";
+    /** Body rejected. The row still lands, without a `codeHash`. */
+    readonly codeWriteFailed: "blueprint_code_write_failed";
+};
+/**
+ * The durable pair. Both optional at the binding site — a deployment
+ * may have neither (no durability), or metadata without a body store
+ * (rows persist, bodies do not).
+ */
+export interface BlueprintDurabilityDeps {
+    readonly blueprintStore?: BlueprintStore;
+    readonly codeStore?: CodeStore;
+}
+/**
+ * Project a registry row onto the durable record.
+ *
+ * `codeHash` is passed rather than derived so the caller can omit it
+ * when the body write failed — the record then honestly says no body
+ * is stored. `codeS3Url` is deliberately NOT set here: it names a
+ * location only the storage adapter knows, and the adapter composes it
+ * on read.
+ */
+export declare function projectDurableBlueprint(blueprint: RegistryBlueprint, appId: string, codeHash: string | undefined, createdBy?: DurableBlueprint['createdBy']): DurableBlueprint;
+/**
+ * Write a freshly minted blueprint through to durable storage.
+ *
+ * Never throws and never retries: one round-trip per store, both
+ * try/caught. An unbound store is a no-op — not an error, and not an
+ * event, because a deployment that never bound one is not failing at
+ * anything.
+ */
+export declare function writeBlueprintDurably(deps: BlueprintDurabilityDeps | undefined, appId: string, blueprint: RegistryBlueprint, createdBy?: DurableBlueprint['createdBy']): Promise<void>;
+//# sourceMappingURL=blueprint-durability.d.ts.map

package/dist/renders/blueprint-durability.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"blueprint-durability.d.ts","sourceRoot":"","sources":["../../src/renders/blueprint-durability.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6DG;AACH,OAAO,KAAK,EAAE,cAAc,EAAE,SAAS,EAAE,MAAM,0BAA0B,CAAC;AAC1E,OAAO,KAAK,EAAE,SAAS,IAAI,gBAAgB,EAAE,MAAM,mBAAmB,CAAC;AACvE,OAAO,KAAK,EAAE,SAAS,IAAI,iBAAiB,EAAE,MAAM,yBAAyB,CAAC;AAE9E;;;;;GAKG;AACH,MAAM,MAAM,wBAAwB,GAChC,gCAAgC,GAChC,6BAA6B,CAAC;AAElC;;;GAGG;AACH,eAAO,MAAM,2BAA2B;IACtC,sEAAsE;;IAEtE,gEAAgE;;CAEL,CAAC;AAQ9D;;;;GAIG;AACH,MAAM,WAAW,uBAAuB;IACtC,QAAQ,CAAC,cAAc,CAAC,EAAE,cAAc,CAAC;IACzC,QAAQ,CAAC,SAAS,CAAC,EAAE,SAAS,CAAC;CAChC;AAED;;;;;;;;GAQG;AACH,wBAAgB,uBAAuB,CACrC,SAAS,EAAE,iBAAiB,EAC5B,KAAK,EAAE,MAAM,EACb,QAAQ,EAAE,MAAM,GAAG,SAAS,EAC5B,SAAS,GAAE,gBAAgB,CAAC,WAAW,CAAW,GACjD,gBAAgB,CAmBlB;AAED;;;;;;;GAOG;AACH,wBAAsB,qBAAqB,CACzC,IAAI,EAAE,uBAAuB,GAAG,SAAS,EACzC,KAAK,EAAE,MAAM,EACb,SAAS,EAAE,iBAAiB,EAC5B,SAAS,GAAE,gBAAgB,CAAC,WAAW,CAAW,GACjD,OAAO,CAAC,IAAI,CAAC,CAyBf"}

package/dist/renders/blueprint-durability.js

@@ -0,0 +1,85 @@
+/**
+ * The event names as values, so every emitter — in this package or a
+ * storage backend elsewhere — spells them from one place.
+ */
+export const BLUEPRINT_DURABILITY_EVENTS = {
+    /** Metadata row rejected. The blueprint is not durably resolvable. */
+    durableWriteFailed: 'blueprint_durable_write_failed',
+    /** Body rejected. The row still lands, without a `codeHash`. */
+    codeWriteFailed: 'blueprint_code_write_failed',
+};
+const DURABLE_WRITE_FAILED = BLUEPRINT_DURABILITY_EVENTS.durableWriteFailed;
+const CODE_WRITE_FAILED = BLUEPRINT_DURABILITY_EVENTS.codeWriteFailed;
+/**
+ * Project a registry row onto the durable record.
+ *
+ * `codeHash` is passed rather than derived so the caller can omit it
+ * when the body write failed — the record then honestly says no body
+ * is stored. `codeS3Url` is deliberately NOT set here: it names a
+ * location only the storage adapter knows, and the adapter composes it
+ * on read.
+ */
+export function projectDurableBlueprint(blueprint, appId, codeHash, createdBy = 'agent') {
+    return {
+        blueprintId: blueprint.id,
+        appId,
+        // Registry `contractKey` → protocol `contractHash`. Same 16-char
+        // blueprintKey value; see the module docstring.
+        contractHash: blueprint.contractKey,
+        source: blueprint.source,
+        variance: blueprint.variance,
+        createdAt: blueprint.createdAt,
+        // WHO initiated the mint — a different axis from `source`, which
+        // records what produced the code. An operator-invoked registration
+        // is `createdBy: 'operator'` even when `source.kind` is `'llm'`.
+        // Defaulted rather than derived: the registry row does not carry
+        // this, and only the caller knows which tool it is serving.
+        createdBy,
+        contract: blueprint.contract,
+        ...(codeHash !== undefined ? { codeHash } : {}),
+    };
+}
+/**
+ * Write a freshly minted blueprint through to durable storage.
+ *
+ * Never throws and never retries: one round-trip per store, both
+ * try/caught. An unbound store is a no-op — not an error, and not an
+ * event, because a deployment that never bound one is not failing at
+ * anything.
+ */
+export async function writeBlueprintDurably(deps, appId, blueprint, createdBy = 'agent') {
+    const blueprintStore = deps?.blueprintStore;
+    if (!blueprintStore)
+        return;
+    // Body first — see the module docstring on why an orphan body beats a
+    // row that points at nothing.
+    let codeHash;
+    const codeStore = deps?.codeStore;
+    if (codeStore && blueprint.componentCode.length > 0) {
+        try {
+            const hash = codeStore.hashOf(blueprint.componentCode);
+            await codeStore.put(hash, blueprint.componentCode);
+            codeHash = hash;
+        }
+        catch (err) {
+            logDurabilityFailure(CODE_WRITE_FAILED, blueprint, appId, err);
+        }
+    }
+    try {
+        await blueprintStore.put(projectDurableBlueprint(blueprint, appId, codeHash, createdBy));
+    }
+    catch (err) {
+        logDurabilityFailure(DURABLE_WRITE_FAILED, blueprint, appId, err);
+    }
+}
+function logDurabilityFailure(event, blueprint, appId, err) {
+    // eslint-disable-next-line no-console -- structured single-line event for log-pipeline pickup
+    console.warn(JSON.stringify({
+        msg: event,
+        blueprintId: blueprint.id,
+        contractKey: blueprint.contractKey,
+        appId,
+        source: blueprint.source.kind,
+        error: err instanceof Error ? err.message : String(err),
+    }));
+}

package/dist/renders/blueprint-registry.d.ts

@@ -2,6 +2,7 @@ import type { BlueprintIndex, EmbeddingProvider, EnumerableVectorStore, VectorSt
 export type { BlueprintIndex } from '@ggui-ai/mcp-server-core';
 import { type BlueprintSource, type BlueprintVariance, type DataContract } from '@ggui-ai/protocol';
 import { type ContractValidationFinding, type ContractValidationResult } from '@ggui-ai/negotiator';
+import { type BlueprintDurabilityDeps } from './blueprint-durability.js';
 /**
  * Atomic-design level. The runtime currently writes only
  * `'template'` — the full-component case. Smaller-grain kinds are
@@ -112,6 +113,17 @@ export interface BlueprintRegistryDeps {
      * indexed exact lookup that consume it land next wave.
      */
     readonly index: BlueprintIndex;
+    /**
+     * Durable write-through target (#430 slice 2). When bound, a fresh
+     * mint is also written to a {@link BlueprintStore} (+ optional
+     * {@link CodeStore} for the body) so it stays resolvable by id after
+     * the capped registry has evicted it or the process has restarted.
+     *
+     * Optional and best-effort: absent ⇒ no write, no event; present and
+     * failing ⇒ a named event and a registration that still succeeds.
+     * See `blueprint-durability.ts`.
+     */
+    readonly durability?: BlueprintDurabilityDeps;
 }
 /** Input for {@link registerBlueprint}. */
 export interface RegisterBlueprintInput {
@@ -140,6 +152,18 @@ export interface RegisterBlueprintInput {
      * empty variance as one stable sentinel.
      */
     readonly variance?: BlueprintVariance;
+    /**
+     * WHO initiated this mint, for the durable record. `'agent'` is the
+     * standard handshake → render flow; the operator tools
+     * (`ggui_ops_register_blueprint` / `ggui_ops_generate_blueprint`)
+     * pass `'operator'`.
+     *
+     * A different axis from {@link source}, which records what PRODUCED
+     * the code: an operator-invoked generation is `createdBy: 'operator'`
+     * AND `source.kind: 'llm'`. Defaults to `'agent'` — the registry row
+     * itself does not carry the field, so only the caller knows.
+     */
+    readonly createdBy?: 'agent' | 'operator';
 }
 /**
  * Compose the deterministic exact-lookup key — the `(scope, exactKey)`

package/dist/renders/blueprint-registry.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"blueprint-registry.d.ts","sourceRoot":"","sources":["../../src/renders/blueprint-registry.ts"],"names":[],"mappings":"AAyCA,OAAO,KAAK,EACV,cAAc,EACd,iBAAiB,EACjB,qBAAqB,EAGrB,WAAW,EACZ,MAAM,0BAA0B,CAAC;AAKlC,YAAY,EAAE,cAAc,EAAE,MAAM,0BAA0B,CAAC;AAC/D,OAAO,EAIL,KAAK,eAAe,EACpB,KAAK,iBAAiB,EACtB,KAAK,YAAY,EAClB,MAAM,mBAAmB,CAAC;AAK3B,OAAO,EAEL,KAAK,yBAAyB,EAC9B,KAAK,wBAAwB,EAC9B,MAAM,qBAAqB,CAAC;AAE7B;;;;GAIG;AACH,MAAM,MAAM,aAAa,GAAG,UAAU,GAAG,UAAU,GAAG,UAAU,GAAG,MAAM,CAAC;AAE1E,mDAAmD;AACnD,MAAM,WAAW,SAAS;IACxB;;;;;OAKG;IACH,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;IACpB,QAAQ,CAAC,IAAI,EAAE,aAAa,CAAC;IAC7B,uEAAuE;IACvE,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B;;;;;;OAMG;IACH,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B;;;;OAIG;IACH,QAAQ,CAAC,QAAQ,EAAE,iBAAiB,CAAC;IACrC,QAAQ,CAAC,QAAQ,EAAE,YAAY,CAAC;IAChC,2EAA2E;IAC3E,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,oFAAoF;IACpF,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;IAC/B,qCAAqC;IACrC,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,sFAAsF;IACtF,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,oEAAoE;IACpE,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC;IAC5B;;;;;;;;;OASG;IACH,QAAQ,CAAC,MAAM,EAAE,eAAe,CAAC;IACjC;;;;;;;OAOG;IACH,QAAQ,CAAC,SAAS,CAAC,EAAE,OAAO,CAAC;IAC7B;;;;;;;OAOG;IACH,QAAQ,CAAC,kBAAkB,CAAC,EAAE,SAAS,yBAAyB,EAAE,CAAC;CACpE;AAED;;;;;GAKG;AACH,MAAM,MAAM,iBAAiB,GAAG,CAC9B,QAAQ,EAAE,YAAY,KACnB,wBAAwB,CAAC;AAE9B;;;;;;;;;;;;GAYG;AACH,qBAAa,sBAAuB,SAAQ,KAAK;IAC/C,QAAQ,CAAC,IAAI,EAAG,oBAAoB,CAAU;IAC9C,QAAQ,CAAC,QAAQ,EAAE,SAAS,yBAAyB,EAAE,CAAC;gBAC5C,QAAQ,EAAE,SAAS,yBAAyB,EAAE;CAQ3D;AAED,gFAAgF;AAChF,MAAM,WAAW,qBAAqB;IACpC,QAAQ,CAAC,SAAS,EAAE,iBAAiB,CAAC;IACtC,QAAQ,CAAC,WAAW,EAAE,WAAW,CAAC;IAClC;;;;;;OAMG;IACH,QAAQ,CAAC,KAAK,EAAE,cAAc,CAAC;CAChC;AAED,2CAA2C;AAC3C,MAAM,WAAW,sBAAsB;IACrC,QAAQ,CAAC,IAAI,EAAE,aAAa,CAAC;IAC7B,QAAQ,CAAC,QAAQ,EAAE,YAAY,CAAC;IAChC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;IAC/B;;;;;;;OAOG;IACH,QAAQ,CAAC,MAAM,EAAE,eAAe,CAAC;IACjC;;;OAGG;IACH,QAAQ,CAAC,SAAS,CAAC,EAAE,OAAO,CAAC;IAC7B;;;;;OAKG;IACH,QAAQ,CAAC,QAAQ,CAAC,EAAE,iBAAiB,CAAC;CACvC;AAED;;;;;;;;GAQG;AACH,wBAAgB,eAAe,CAC7B,IAAI,EAAE,aAAa,EACnB,WAAW,EAAE,MAAM,EACnB,UAAU,EAAE,MAAM,GACjB,MAAM,CAER;AAED;;;;;;;;GAQG;AACH,wBAAgB,qBAAqB,CACnC,QAAQ,EAAE,YAAY,GAAG,SAAS,EAClC,MAAM,EAAE,MAAM,GACb,MAAM,CAER;AAyMD;;;;;;;;;;GAUG;AACH,eAAO,MAAM,+BAA+B,MAAM,CAAC;AAEnD,MAAM,WAAW,wBAAwB;IACvC;;;;;;;OAOG;IACH,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAC;IAC7B;;;;;;OAMG;IACH,QAAQ,CAAC,SAAS,CAAC,EAAE,iBAAiB,CAAC;IACvC;;;;;OAKG;IACH,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,MAAM,CAAC;CAChC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AACH,wBAAsB,iBAAiB,CACrC,IAAI,EAAE,qBAAqB,EAC3B,KAAK,EAAE,MAAM,EACb,KAAK,EAAE,sBAAsB,EAC7B,OAAO,GAAE,wBAA6B,GACrC,OAAO,CAAC,SAAS,CAAC,CAiEpB;AAoGD;;;;;;;;;;;;GAYG;AACH,wBAAsB,kBAAkB,CACtC,IAAI,EAAE;IAAE,WAAW,EAAE,WAAW,CAAC;IAAC,KAAK,EAAE,cAAc,CAAA;CAAE,EACzD,KAAK,EAAE,MAAM,EACb,IAAI,EAAE,aAAa,EACnB,WAAW,EAAE,MAAM,EACnB,WAAW,CAAC,EAAE,MAAM,GACnB,OAAO,CAAC,SAAS,GAAG,IAAI,CAAC,CAM3B;AAsCD;;;;;GAKG;AACH,wBAAsB,iBAAiB,CACrC,IAAI,EAAE;IAAE,WAAW,EAAE,WAAW,CAAA;CAAE,EAClC,KAAK,EAAE,MAAM,EACb,EAAE,EAAE,MAAM,GACT,OAAO,CAAC,SAAS,GAAG,IAAI,CAAC,CAE3B;AAED;;;;;;;;;;;GAWG;AACH,MAAM,WAAW,kBAAkB;IACjC,QAAQ,CAAC,SAAS,EAAE,SAAS,CAAC;IAC9B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;CACzB;AAED,wBAAsB,yBAAyB,CAC7C,IAAI,EAAE,qBAAqB,EAC3B,KAAK,EAAE,MAAM,EACb,KAAK,EAAE;IAAE,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,YAAY,CAAA;CAAE,EACpE,OAAO,GAAE;IAAE,QAAQ,CAAC,IAAI,CAAC,EAAE,aAAa,CAAC;IAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,CAAA;CAAO,GACtE,OAAO,CAAC,SAAS,kBAAkB,EAAE,CAAC,CAaxC;AAED;;;;GAIG;AACH,wBAAsB,cAAc,CAClC,IAAI,EAAE;IAAE,WAAW,EAAE,qBAAqB,CAAA;CAAE,EAC5C,KAAK,EAAE,MAAM,EACb,IAAI,CAAC,EAAE,aAAa,GACnB,OAAO,CAAC,SAAS,SAAS,EAAE,CAAC,CAU/B;AAED;;;;;GAKG;AACH,wBAAsB,kBAAkB,CACtC,IAAI,EAAE;IAAE,WAAW,EAAE,WAAW,CAAA;CAAE,GAAG,OAAO,CAAC,qBAAqB,CAAC,EACnE,KAAK,EAAE,MAAM,EACb,EAAE,EAAE,MAAM,GACT,OAAO,CAAC,IAAI,CAAC,CAoCf;AAoBD;;;;;;;;GAQG;AACH,wBAAsB,eAAe,CACnC,IAAI,EAAE;IAAE,WAAW,EAAE,WAAW,CAAC;IAAC,KAAK,EAAE,cAAc,CAAA;CAAE,EACzD,KAAK,EAAE,MAAM,EACb,EAAE,EAAE,MAAM,GACT,OAAO,CAAC,IAAI,CAAC,CAaf"}
+{"version":3,"file":"blueprint-registry.d.ts","sourceRoot":"","sources":["../../src/renders/blueprint-registry.ts"],"names":[],"mappings":"AAyCA,OAAO,KAAK,EACV,cAAc,EACd,iBAAiB,EACjB,qBAAqB,EAGrB,WAAW,EACZ,MAAM,0BAA0B,CAAC;AAKlC,YAAY,EAAE,cAAc,EAAE,MAAM,0BAA0B,CAAC;AAC/D,OAAO,EAIL,KAAK,eAAe,EACpB,KAAK,iBAAiB,EACtB,KAAK,YAAY,EAClB,MAAM,mBAAmB,CAAC;AAK3B,OAAO,EAEL,KAAK,yBAAyB,EAC9B,KAAK,wBAAwB,EAC9B,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EAEL,KAAK,uBAAuB,EAC7B,MAAM,2BAA2B,CAAC;AAEnC;;;;GAIG;AACH,MAAM,MAAM,aAAa,GAAG,UAAU,GAAG,UAAU,GAAG,UAAU,GAAG,MAAM,CAAC;AAE1E,mDAAmD;AACnD,MAAM,WAAW,SAAS;IACxB;;;;;OAKG;IACH,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;IACpB,QAAQ,CAAC,IAAI,EAAE,aAAa,CAAC;IAC7B,uEAAuE;IACvE,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B;;;;;;OAMG;IACH,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B;;;;OAIG;IACH,QAAQ,CAAC,QAAQ,EAAE,iBAAiB,CAAC;IACrC,QAAQ,CAAC,QAAQ,EAAE,YAAY,CAAC;IAChC,2EAA2E;IAC3E,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,oFAAoF;IACpF,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;IAC/B,qCAAqC;IACrC,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,sFAAsF;IACtF,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,oEAAoE;IACpE,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC;IAC5B;;;;;;;;;OASG;IACH,QAAQ,CAAC,MAAM,EAAE,eAAe,CAAC;IACjC;;;;;;;OAOG;IACH,QAAQ,CAAC,SAAS,CAAC,EAAE,OAAO,CAAC;IAC7B;;;;;;;OAOG;IACH,QAAQ,CAAC,kBAAkB,CAAC,EAAE,SAAS,yBAAyB,EAAE,CAAC;CACpE;AAED;;;;;GAKG;AACH,MAAM,MAAM,iBAAiB,GAAG,CAC9B,QAAQ,EAAE,YAAY,KACnB,wBAAwB,CAAC;AAE9B;;;;;;;;;;;;GAYG;AACH,qBAAa,sBAAuB,SAAQ,KAAK;IAC/C,QAAQ,CAAC,IAAI,EAAG,oBAAoB,CAAU;IAC9C,QAAQ,CAAC,QAAQ,EAAE,SAAS,yBAAyB,EAAE,CAAC;gBAC5C,QAAQ,EAAE,SAAS,yBAAyB,EAAE;CAQ3D;AAED,gFAAgF;AAChF,MAAM,WAAW,qBAAqB;IACpC,QAAQ,CAAC,SAAS,EAAE,iBAAiB,CAAC;IACtC,QAAQ,CAAC,WAAW,EAAE,WAAW,CAAC;IAClC;;;;;;OAMG;IACH,QAAQ,CAAC,KAAK,EAAE,cAAc,CAAC;IAC/B;;;;;;;;;OASG;IACH,QAAQ,CAAC,UAAU,CAAC,EAAE,uBAAuB,CAAC;CAC/C;AAED,2CAA2C;AAC3C,MAAM,WAAW,sBAAsB;IACrC,QAAQ,CAAC,IAAI,EAAE,aAAa,CAAC;IAC7B,QAAQ,CAAC,QAAQ,EAAE,YAAY,CAAC;IAChC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;IAC/B;;;;;;;OAOG;IACH,QAAQ,CAAC,MAAM,EAAE,eAAe,CAAC;IACjC;;;OAGG;IACH,QAAQ,CAAC,SAAS,CAAC,EAAE,OAAO,CAAC;IAC7B;;;;;OAKG;IACH,QAAQ,CAAC,QAAQ,CAAC,EAAE,iBAAiB,CAAC;IACtC;;;;;;;;;;OAUG;IACH,QAAQ,CAAC,SAAS,CAAC,EAAE,OAAO,GAAG,UAAU,CAAC;CAC3C;AAED;;;;;;;;GAQG;AACH,wBAAgB,eAAe,CAC7B,IAAI,EAAE,aAAa,EACnB,WAAW,EAAE,MAAM,EACnB,UAAU,EAAE,MAAM,GACjB,MAAM,CAER;AAED;;;;;;;;GAQG;AACH,wBAAgB,qBAAqB,CACnC,QAAQ,EAAE,YAAY,GAAG,SAAS,EAClC,MAAM,EAAE,MAAM,GACb,MAAM,CAER;AAyMD;;;;;;;;;;GAUG;AACH,eAAO,MAAM,+BAA+B,MAAM,CAAC;AAEnD,MAAM,WAAW,wBAAwB;IACvC;;;;;;;OAOG;IACH,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAC;IAC7B;;;;;;OAMG;IACH,QAAQ,CAAC,SAAS,CAAC,EAAE,iBAAiB,CAAC;IACvC;;;;;OAKG;IACH,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,MAAM,CAAC;CAChC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AACH,wBAAsB,iBAAiB,CACrC,IAAI,EAAE,qBAAqB,EAC3B,KAAK,EAAE,MAAM,EACb,KAAK,EAAE,sBAAsB,EAC7B,OAAO,GAAE,wBAA6B,GACrC,OAAO,CAAC,SAAS,CAAC,CA8EpB;AAoGD;;;;;;;;;;;;GAYG;AACH,wBAAsB,kBAAkB,CACtC,IAAI,EAAE;IAAE,WAAW,EAAE,WAAW,CAAC;IAAC,KAAK,EAAE,cAAc,CAAA;CAAE,EACzD,KAAK,EAAE,MAAM,EACb,IAAI,EAAE,aAAa,EACnB,WAAW,EAAE,MAAM,EACnB,WAAW,CAAC,EAAE,MAAM,GACnB,OAAO,CAAC,SAAS,GAAG,IAAI,CAAC,CAM3B;AAsCD;;;;;GAKG;AACH,wBAAsB,iBAAiB,CACrC,IAAI,EAAE;IAAE,WAAW,EAAE,WAAW,CAAA;CAAE,EAClC,KAAK,EAAE,MAAM,EACb,EAAE,EAAE,MAAM,GACT,OAAO,CAAC,SAAS,GAAG,IAAI,CAAC,CAE3B;AAED;;;;;;;;;;;GAWG;AACH,MAAM,WAAW,kBAAkB;IACjC,QAAQ,CAAC,SAAS,EAAE,SAAS,CAAC;IAC9B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;CACzB;AAED,wBAAsB,yBAAyB,CAC7C,IAAI,EAAE,qBAAqB,EAC3B,KAAK,EAAE,MAAM,EACb,KAAK,EAAE;IAAE,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,YAAY,CAAA;CAAE,EACpE,OAAO,GAAE;IAAE,QAAQ,CAAC,IAAI,CAAC,EAAE,aAAa,CAAC;IAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,CAAA;CAAO,GACtE,OAAO,CAAC,SAAS,kBAAkB,EAAE,CAAC,CAaxC;AAED;;;;GAIG;AACH,wBAAsB,cAAc,CAClC,IAAI,EAAE;IAAE,WAAW,EAAE,qBAAqB,CAAA;CAAE,EAC5C,KAAK,EAAE,MAAM,EACb,IAAI,CAAC,EAAE,aAAa,GACnB,OAAO,CAAC,SAAS,SAAS,EAAE,CAAC,CAU/B;AAED;;;;;GAKG;AACH,wBAAsB,kBAAkB,CACtC,IAAI,EAAE;IAAE,WAAW,EAAE,WAAW,CAAA;CAAE,GAAG,OAAO,CAAC,qBAAqB,CAAC,EACnE,KAAK,EAAE,MAAM,EACb,EAAE,EAAE,MAAM,GACT,OAAO,CAAC,IAAI,CAAC,CAoCf;AAoBD;;;;;;;;GAQG;AACH,wBAAsB,eAAe,CACnC,IAAI,EAAE;IAAE,WAAW,EAAE,WAAW,CAAC;IAAC,KAAK,EAAE,cAAc,CAAA;CAAE,EACzD,KAAK,EAAE,MAAM,EACb,EAAE,EAAE,MAAM,GACT,OAAO,CAAC,IAAI,CAAC,CAaf"}

package/dist/renders/blueprint-registry.js

@@ -45,6 +45,7 @@ import { blueprintSourceToFlat, flatToBlueprintSource, summarizeContract, } from
 // can't bundle.
 import { blueprintKey, variantKey } from '@ggui-ai/protocol/blueprint-key';
 import { validateContractRedundancy, } from '@ggui-ai/negotiator';
+import { writeBlueprintDurably, } from './blueprint-durability.js';
 /**
  * Thrown by {@link registerBlueprint} when the structural validator
  * emits one or more `severity: 'error'` findings. Carries the full
@@ -361,6 +362,14 @@ export async function registerBlueprint(deps, scope, input, options = {}) {
         metadata: blueprintToMetadata(blueprint),
     });
     await deps.index.putId(scope, exactKey, id);
+    // Durable write-through for the fresh mint only. The dedup return
+    // above skips it deliberately: that row was written through when it
+    // was first minted, and re-writing it would fail the durable store's
+    // already-exists guard on every cache hit.
+    //
+    // `scope` is the appId at every call site — the registry's tenancy
+    // unit and the durable record's are the same thing.
+    await writeBlueprintDurably(deps.durability, scope, blueprint, input.createdBy ?? 'agent');
     return blueprint;
 }
 /**

package/dist/renders/code-delivery-events.d.ts

@@ -0,0 +1,92 @@
+/**
+ * Named events for the content-addressable code-delivery channel.
+ *
+ * `codeUrl` is the CACHE-ADDRESSABLE static delivery surface of a
+ * COMPILED-COMPONENT envelope — since #471 it is no longer the only
+ * static one: `deriveRenderMeta` also stamps the size-capped inline
+ * `codeB64` twin, independent of this channel's store. A failed
+ * `codeUrl` mint therefore usually IS absorbed by the inline channel;
+ * what it still costs is deployment-shaped:
+ *
+ *   - Every under-cap compiled render keeps mounting via `codeB64`
+ *     (and, when minted, the live trio). The loss is the browser-
+ *     cacheable content-addressable URL — repeat renders of the same
+ *     bytes re-ship them inline instead of hitting HTTP cache.
+ *   - An OVER-CAP render (no `codeB64`) falls back to exactly the
+ *     pre-#471 posture: live trio mounts it; a host that resolves
+ *     `resourceUri` re-mints `codeUrl` at READ time; a deployment
+ *     with neither loses the mount for that one envelope.
+ *
+ * None of this is distinguishable from the wire — the render reports
+ * success either way — which is why the failure is emitted under a
+ * name instead of swallowed. The event carries whether a live channel
+ * is wired; combined with the render's size class it separates
+ * "slower / uncacheable delivery" from "this envelope cannot mount".
+ */
+/**
+ * Every event this module can emit. Closed union — a new emitter picks
+ * from these or extends the type, which is what makes a rename a
+ * compile error rather than an alert filter that quietly stops
+ * matching.
+ */
+export type CodeDeliveryEvent = 'render_code_write_failed' | 'render_code_b64_over_cap';
+/**
+ * The event names as values, so every emitter — in this package or a
+ * storage backend elsewhere — spells them from one place.
+ */
+export declare const CODE_DELIVERY_EVENTS: {
+    /**
+     * The `codeUrl` mint failed for a render envelope. That envelope
+     * loses the cache-addressable static channel; see the module
+     * docstring for what survives.
+     */
+    readonly renderCodeWriteFailed: "render_code_write_failed";
+    /**
+     * A compiled render's source exceeded the inline `codeB64` cap, so
+     * the slice was emitted WITHOUT the fetch-free channel. On hosts
+     * whose iframe CSP blocks fetches AND WebSockets, that render
+     * cannot paint — the omission must be visible, not silent.
+     */
+    readonly renderCodeB64OverCap: "render_code_b64_over_cap";
+};
+/**
+ * What an emitter knows at the point the mint failed.
+ */
+export interface RenderCodeWriteFailure {
+    /** Render whose envelope lost its static channel. */
+    readonly sessionId: string;
+    /** Owning app, so the event joins the rest of a deployment's logs. */
+    readonly appId: string;
+    /**
+     * Whether this deployment mints live-channel credentials.
+     *
+     * `true` ⇒ the render still mounts over the WS subscribe; the loss
+     * is the instant first paint. `false` ⇒ the envelope mounts only
+     * through the inline `codeB64` channel (present for every under-cap
+     * compiled render, independent of this store); an OVER-CAP render
+     * with `false` here truly has no mount mode, and only a host that
+     * resolves `resourceUri` will still produce a card.
+     */
+    readonly liveChannelWired: boolean;
+    /** Whatever the store threw. Unshaped by construction. */
+    readonly cause: unknown;
+}
+/**
+ * Emit {@link CODE_DELIVERY_EVENTS.renderCodeWriteFailed}.
+ *
+ * Never throws: a render that already produced valid code and already
+ * committed must not fail because its delivery-channel telemetry did.
+ */
+export declare function reportRenderCodeWriteFailed(failure: RenderCodeWriteFailure): void;
+/**
+ * Emit {@link CODE_DELIVERY_EVENTS.renderCodeB64OverCap}.
+ *
+ * Never throws — same posture as the write-failure emitter above.
+ */
+export declare function reportRenderCodeB64OverCap(over: {
+    readonly sessionId: string;
+    readonly appId: string;
+    /** UTF-8 byte length of the compiled source that exceeded the cap. */
+    readonly sourceBytes: number;
+}): void;
+//# sourceMappingURL=code-delivery-events.d.ts.map

package/dist/renders/code-delivery-events.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"code-delivery-events.d.ts","sourceRoot":"","sources":["../../src/renders/code-delivery-events.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AAEH;;;;;GAKG;AACH,MAAM,MAAM,iBAAiB,GACzB,0BAA0B,GAC1B,0BAA0B,CAAC;AAE/B;;;GAGG;AACH,eAAO,MAAM,oBAAoB;IAC/B;;;;OAIG;;IAEH;;;;;OAKG;;CAEiD,CAAC;AAEvD;;GAEG;AACH,MAAM,WAAW,sBAAsB;IACrC,qDAAqD;IACrD,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,sEAAsE;IACtE,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB;;;;;;;;;OASG;IACH,QAAQ,CAAC,gBAAgB,EAAE,OAAO,CAAC;IACnC,0DAA0D;IAC1D,QAAQ,CAAC,KAAK,EAAE,OAAO,CAAC;CACzB;AAED;;;;;GAKG;AACH,wBAAgB,2BAA2B,CACzC,OAAO,EAAE,sBAAsB,GAC9B,IAAI,CAgBN;AAED;;;;GAIG;AACH,wBAAgB,0BAA0B,CAAC,IAAI,EAAE;IAC/C,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,sEAAsE;IACtE,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;CAC9B,GAAG,IAAI,CAUP"}

package/dist/renders/code-delivery-events.js

@@ -0,0 +1,77 @@
+/**
+ * Named events for the content-addressable code-delivery channel.
+ *
+ * `codeUrl` is the CACHE-ADDRESSABLE static delivery surface of a
+ * COMPILED-COMPONENT envelope — since #471 it is no longer the only
+ * static one: `deriveRenderMeta` also stamps the size-capped inline
+ * `codeB64` twin, independent of this channel's store. A failed
+ * `codeUrl` mint therefore usually IS absorbed by the inline channel;
+ * what it still costs is deployment-shaped:
+ *
+ *   - Every under-cap compiled render keeps mounting via `codeB64`
+ *     (and, when minted, the live trio). The loss is the browser-
+ *     cacheable content-addressable URL — repeat renders of the same
+ *     bytes re-ship them inline instead of hitting HTTP cache.
+ *   - An OVER-CAP render (no `codeB64`) falls back to exactly the
+ *     pre-#471 posture: live trio mounts it; a host that resolves
+ *     `resourceUri` re-mints `codeUrl` at READ time; a deployment
+ *     with neither loses the mount for that one envelope.
+ *
+ * None of this is distinguishable from the wire — the render reports
+ * success either way — which is why the failure is emitted under a
+ * name instead of swallowed. The event carries whether a live channel
+ * is wired; combined with the render's size class it separates
+ * "slower / uncacheable delivery" from "this envelope cannot mount".
+ */
+/**
+ * The event names as values, so every emitter — in this package or a
+ * storage backend elsewhere — spells them from one place.
+ */
+export const CODE_DELIVERY_EVENTS = {
+    /**
+     * The `codeUrl` mint failed for a render envelope. That envelope
+     * loses the cache-addressable static channel; see the module
+     * docstring for what survives.
+     */
+    renderCodeWriteFailed: 'render_code_write_failed',
+    /**
+     * A compiled render's source exceeded the inline `codeB64` cap, so
+     * the slice was emitted WITHOUT the fetch-free channel. On hosts
+     * whose iframe CSP blocks fetches AND WebSockets, that render
+     * cannot paint — the omission must be visible, not silent.
+     */
+    renderCodeB64OverCap: 'render_code_b64_over_cap',
+};
+/**
+ * Emit {@link CODE_DELIVERY_EVENTS.renderCodeWriteFailed}.
+ *
+ * Never throws: a render that already produced valid code and already
+ * committed must not fail because its delivery-channel telemetry did.
+ */
+export function reportRenderCodeWriteFailed(failure) {
+    // eslint-disable-next-line no-console -- structured single-line event for log-pipeline pickup
+    console.warn(JSON.stringify({
+        msg: CODE_DELIVERY_EVENTS.renderCodeWriteFailed,
+        sessionId: failure.sessionId,
+        appId: failure.appId,
+        liveChannelWired: failure.liveChannelWired,
+        error: failure.cause instanceof Error
+            ? failure.cause.message
+            : String(failure.cause),
+        errorName: failure.cause instanceof Error ? failure.cause.name : undefined,
+    }));
+}
+/**
+ * Emit {@link CODE_DELIVERY_EVENTS.renderCodeB64OverCap}.
+ *
+ * Never throws — same posture as the write-failure emitter above.
+ */
+export function reportRenderCodeB64OverCap(over) {
+    // eslint-disable-next-line no-console -- structured single-line event for log-pipeline pickup
+    console.warn(JSON.stringify({
+        msg: CODE_DELIVERY_EVENTS.renderCodeB64OverCap,
+        sessionId: over.sessionId,
+        appId: over.appId,
+        sourceBytes: over.sourceBytes,
+    }));
+}

package/dist/renders/fetch-gadget-types.d.ts

@@ -14,9 +14,13 @@
  * Behavior:
  *   - Stdlib (`@ggui-ai/gadgets`) is skipped — the sandbox VFS already
  *     carries its types directly.
- *   - Descriptors without a `typesUrl` are skipped (pre-launch the
- *     `registeredGadgetDescriptorSchema` makes `typesUrl` required for
- *     non-stdlib, so this only spares a stdlib / hand-authored ref).
+ *   - Descriptors without a `typesUrl` are skipped — the catalog's
+ *     `strict` posture keeps `typesUrl` optional (nothing in the
+ *     publish→install chain stamps it yet), so generation degrades
+ *     gracefully to no-types codegen for such packages. The
+ *     types-pipeline follow-up (publish stamps `typesUrl` + `typesSri`;
+ *     `registeredGadgetDescriptorSchema` becomes the registration
+ *     posture again) turns this skip back into a rare case.
  *   - Unique `typesUrl`s are fetched in parallel (`Promise.all`).
  *   - Each fetched body is SHA-384-verified against the descriptor's
  *     `typesSri` when present — a CDN-compromise defense symmetric

package/dist/renders/fetch-gadget-types.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"fetch-gadget-types.d.ts","sourceRoot":"","sources":["../../src/renders/fetch-gadget-types.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AAGH,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,mBAAmB,CAAC;AAG1D;;;;GAIG;AACH,qBAAa,qBAAsB,SAAQ,KAAK;IAC9C,QAAQ,CAAC,IAAI,EAAG,2BAA2B,CAAU;IACrD,QAAQ,CAAC,QAAQ,EAAE,aAAa,CAAC;QAC/B,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;QACzB,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;QAC1B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;KACzB,CAAC,CAAC;gBAED,QAAQ,EAAE,aAAa,CAAC;QACtB,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;QACzB,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;QAC1B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;KACzB,CAAC;CAaL;AAOD;;;;;;;;;;GAUG;AACH,wBAAsB,gBAAgB,CACpC,WAAW,EAAE,SAAS,gBAAgB,EAAE,EACxC,SAAS,GAAE,OAAO,KAAa,GAC9B,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAkEjC"}
+{"version":3,"file":"fetch-gadget-types.d.ts","sourceRoot":"","sources":["../../src/renders/fetch-gadget-types.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+BG;AAGH,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,mBAAmB,CAAC;AAG1D;;;;GAIG;AACH,qBAAa,qBAAsB,SAAQ,KAAK;IAC9C,QAAQ,CAAC,IAAI,EAAG,2BAA2B,CAAU;IACrD,QAAQ,CAAC,QAAQ,EAAE,aAAa,CAAC;QAC/B,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;QACzB,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;QAC1B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;KACzB,CAAC,CAAC;gBAED,QAAQ,EAAE,aAAa,CAAC;QACtB,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;QACzB,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;QAC1B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;KACzB,CAAC;CAaL;AAOD;;;;;;;;;;GAUG;AACH,wBAAsB,gBAAgB,CACpC,WAAW,EAAE,SAAS,gBAAgB,EAAE,EACxC,SAAS,GAAE,OAAO,KAAa,GAC9B,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAkEjC"}

package/dist/renders/fetch-gadget-types.js

@@ -14,9 +14,13 @@
  * Behavior:
  *   - Stdlib (`@ggui-ai/gadgets`) is skipped — the sandbox VFS already
  *     carries its types directly.
- *   - Descriptors without a `typesUrl` are skipped (pre-launch the
- *     `registeredGadgetDescriptorSchema` makes `typesUrl` required for
- *     non-stdlib, so this only spares a stdlib / hand-authored ref).
+ *   - Descriptors without a `typesUrl` are skipped — the catalog's
+ *     `strict` posture keeps `typesUrl` optional (nothing in the
+ *     publish→install chain stamps it yet), so generation degrades
+ *     gracefully to no-types codegen for such packages. The
+ *     types-pipeline follow-up (publish stamps `typesUrl` + `typesSri`;
+ *     `registeredGadgetDescriptorSchema` becomes the registration
+ *     posture again) turns this skip back into a rare case.
  *   - Unique `typesUrl`s are fetched in parallel (`Promise.all`).
  *   - Each fetched body is SHA-384-verified against the descriptor's
  *     `typesSri` when present — a CDN-compromise defense symmetric