@ggui-ai/mcp-server 0.1.0-rc.3 → 0.2.0-alpha.3

package/dist/storage.d.ts

@@ -1,10 +1,10 @@
-import type { SessionStore, ThreadStore, VectorStore } from '@ggui-ai/mcp-server-core';
+import type { RenderStore, ThreadStore, VectorStore } from '@ggui-ai/mcp-server-core';
 import type { StorageConfig } from '@ggui-ai/project-config';
 export interface ResolveStorageFromConfigOptions {
     /**
      * Directory used to resolve relative `path` values in the storage
      * config. Typically the directory containing `ggui.json` so a
-     * manifest saying `"path": "./ggui-sessions.sqlite"` lands next to
+     * manifest saying `"path": "./ggui-renders.sqlite"` lands next to
      * the manifest (not CWD, which would silently create a file wherever
      * the process happened to be started).
      *
@@ -16,9 +16,9 @@ export interface ResolveStorageFromConfigOptions {
     readonly baseDir?: string;
 }
 export interface ResolvedStorageStores {
-    /** Concrete SessionStore, iff the config declared one. Undefined =
+    /** Concrete RenderStore, iff the config declared one. Undefined =
      * caller falls back to createGguiServer's in-memory default. */
-    readonly sessionStore?: SessionStore;
+    readonly renderStore?: RenderStore;
     /** Concrete VectorStore, iff the config declared one. Undefined =
      * caller falls back to createGguiServer's in-memory default. */
     readonly vectors?: VectorStore;
@@ -33,7 +33,7 @@ export interface ResolvedStorageStores {
      *     real; routes mount and work until restart).
      *   - `driver: 'sqlite'` → `SqliteThreadStore` (durable).
      *
-     * This is the one semantic deviation from sessions/vectors, which
+     * This is the one semantic deviation from renders/vectors, which
      * treat `driver: 'memory'` as a no-op because `createGguiServer`
      * already defaults those to in-memory stores internally. Threads
      * don't have an implicit default — the whole route family is
@@ -60,13 +60,13 @@ export interface ResolvedStorageStores {
  *                                         case of `threads:`, no thread
  *                                         routes at all).
  *
- *   - `sessions` / `vectors`:
+ *   - `renders` / `vectors`:
  *       - `driver: 'memory'`            → omitted from the bundle
  *                                         (same fallback — declaring
  *                                         memory is the same outcome
  *                                         as omitting it; present
  *                                         for intent visibility).
- *       - `driver: 'sqlite'`            → `SqliteSessionStore` /
+ *       - `driver: 'sqlite'`            → `SqliteRenderStore` /
  *                                         `SqliteVectorStore`.
  *
  *   - `threads`:

package/dist/storage.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"storage.d.ts","sourceRoot":"","sources":["../src/storage.ts"],"names":[],"mappings":"AAqDA,OAAO,KAAK,EACV,YAAY,EACZ,WAAW,EACX,WAAW,EACZ,MAAM,0BAA0B,CAAC;AAQlC,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,yBAAyB,CAAC;AAE7D,MAAM,WAAW,+BAA+B;IAC9C;;;;;;;;;;;OAWG;IACH,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC;CAC3B;AAED,MAAM,WAAW,qBAAqB;IACpC;oEACgE;IAChE,QAAQ,CAAC,YAAY,CAAC,EAAE,YAAY,CAAC;IACrC;oEACgE;IAChE,QAAQ,CAAC,OAAO,CAAC,EAAE,WAAW,CAAC;IAC/B;;;;;;;;;;;;;;;;;yCAiBqC;IACrC,QAAQ,CAAC,WAAW,CAAC,EAAE,WAAW,CAAC;IACnC;;;;;;OAMG;IACH,QAAQ,CAAC,gBAAgB,CAAC,EAAE,SAAS,GAAG,WAAW,CAAC;CACrD;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAkCG;AACH,wBAAsB,wBAAwB,CAC5C,MAAM,EAAE,aAAa,GAAG,SAAS,EACjC,IAAI,GAAE,+BAAoC,GACzC,OAAO,CAAC,qBAAqB,CAAC,CAgDhC"}
+{"version":3,"file":"storage.d.ts","sourceRoot":"","sources":["../src/storage.ts"],"names":[],"mappings":"AAqDA,OAAO,KAAK,EACV,WAAW,EACX,WAAW,EACX,WAAW,EACZ,MAAM,0BAA0B,CAAC;AAQlC,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,yBAAyB,CAAC;AAE7D,MAAM,WAAW,+BAA+B;IAC9C;;;;;;;;;;;OAWG;IACH,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC;CAC3B;AAED,MAAM,WAAW,qBAAqB;IACpC;oEACgE;IAChE,QAAQ,CAAC,WAAW,CAAC,EAAE,WAAW,CAAC;IACnC;oEACgE;IAChE,QAAQ,CAAC,OAAO,CAAC,EAAE,WAAW,CAAC;IAC/B;;;;;;;;;;;;;;;;;yCAiBqC;IACrC,QAAQ,CAAC,WAAW,CAAC,EAAE,WAAW,CAAC;IACnC;;;;;;OAMG;IACH,QAAQ,CAAC,gBAAgB,CAAC,EAAE,SAAS,GAAG,WAAW,CAAC;CACrD;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAkCG;AACH,wBAAsB,wBAAwB,CAC5C,MAAM,EAAE,aAAa,GAAG,SAAS,EACjC,IAAI,GAAE,+BAAoC,GACzC,OAAO,CAAC,qBAAqB,CAAC,CAgDhC"}

package/dist/storage.js

@@ -27,12 +27,12 @@
  * ## Why `better-sqlite3` gets imported dynamically
  *
  * `better-sqlite3` is an optional peer dep of `@ggui-ai/mcp-server-core`.
- * If we `import { SqliteSessionStore } from '@ggui-ai/mcp-server-core/sqlite'`
+ * If we `import { SqliteRenderStore } from '@ggui-ai/mcp-server-core/sqlite'`
  * at the top of this file, any consumer that doesn't opt into SQLite
  * storage still pays the peer-dep cost (the module graph resolves the
  * subpath at import time, which tries to load better-sqlite3's N-API
  * binary). Dynamic `await import(...)` keeps the cost truly optional:
- * SQLite is loaded only when `storage.sessions.driver === 'sqlite'` or
+ * SQLite is loaded only when `storage.renders.driver === 'sqlite'` or
  * `storage.vectors.driver === 'sqlite'`.
  *
  * ## Why this is async + returns a bundle instead of augmenting createGguiServer
@@ -41,9 +41,9 @@
  * who want storage from config write:
  *
  * ```ts
- * const { sessionStore, vectors } =
+ * const { renderStore, vectors } =
  *   await resolveStorageFromConfig(manifest.storage, { baseDir: projectRoot });
- * const server = createGguiServer({ sessionStore, vectors });
+ * const server = createGguiServer({ renderStore, vectors });
  * ```
  *
  * Explicit instances passed to `createGguiServer` still win — this
@@ -68,13 +68,13 @@ import { InMemoryThreadStore } from '@ggui-ai/mcp-server-core/in-memory';
  *                                         case of `threads:`, no thread
  *                                         routes at all).
  *
- *   - `sessions` / `vectors`:
+ *   - `renders` / `vectors`:
  *       - `driver: 'memory'`            → omitted from the bundle
  *                                         (same fallback — declaring
  *                                         memory is the same outcome
  *                                         as omitting it; present
  *                                         for intent visibility).
- *       - `driver: 'sqlite'`            → `SqliteSessionStore` /
+ *       - `driver: 'sqlite'`            → `SqliteRenderStore` /
  *                                         `SqliteVectorStore`.
  *
  *   - `threads`:
@@ -96,7 +96,7 @@ import { InMemoryThreadStore } from '@ggui-ai/mcp-server-core/in-memory';
 export async function resolveStorageFromConfig(config, opts = {}) {
     if (!config)
         return {};
-    const sessionsSqlite = config.sessions?.driver === 'sqlite';
+    const rendersSqlite = config.renders?.driver === 'sqlite';
     const vectorsSqlite = config.vectors?.driver === 'sqlite';
     const threadsSqlite = config.threads?.driver === 'sqlite';
     const threadsMemory = config.threads?.driver === 'memory';
@@ -108,16 +108,16 @@ export async function resolveStorageFromConfig(config, opts = {}) {
         result.threadStore = new InMemoryThreadStore();
         result.threadDurability = 'ephemeral';
     }
-    if (!sessionsSqlite && !vectorsSqlite && !threadsSqlite)
+    if (!rendersSqlite && !vectorsSqlite && !threadsSqlite)
         return result;
     // Single dynamic import serves every sqlite adapter — better-sqlite3's
     // N-API binding loads once even if the import lands twice; the
     // subpath barrel is cached by Node's module loader.
-    const { SqliteSessionStore, SqliteVectorStore, SqliteThreadStore } = await import('@ggui-ai/mcp-server-core/sqlite');
-    if (config.sessions && config.sessions.driver === 'sqlite') {
-        const filename = resolveStoragePath(config.sessions.path, opts.baseDir);
+    const { SqliteRenderStore, SqliteVectorStore, SqliteThreadStore } = await import('@ggui-ai/mcp-server-core/sqlite');
+    if (config.renders && config.renders.driver === 'sqlite') {
+        const filename = resolveStoragePath(config.renders.path, opts.baseDir);
         ensureParentDir(filename);
-        result.sessionStore = new SqliteSessionStore({ filename });
+        result.renderStore = new SqliteRenderStore({ filename });
     }
     if (config.vectors && config.vectors.driver === 'sqlite') {
         const filename = resolveStoragePath(config.vectors.path, opts.baseDir);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ggui-ai/mcp-server",
-  "version": "0.1.0-rc.3",
+  "version": "0.2.0-alpha.3",
   "description": "Self-hosted MCP server for the ggui protocol. An HTTP/MCP binding layer over @ggui-ai/mcp-server-handlers and the reference adapters from @ggui-ai/mcp-server-core — run it via `ggui serve`.",
   "keywords": [
     "ggui",
@@ -25,22 +25,23 @@
     }
   },
   "dependencies": {
+    "@modelcontextprotocol/ext-apps": "^1.7.2",
     "@modelcontextprotocol/sdk": "^1.27.0",
     "express": "^4.21.0",
     "nodemailer": "^8.0.7",
     "resend": "^6.12.2",
     "ws": "^8.20.1",
     "zod": "^4.3.6",
-    "@ggui-ai/iframe-runtime": "0.1.0-rc.3",
-    "@ggui-ai/mcp-server-core": "0.1.0-rc.3",
-    "@ggui-ai/mcp-server-handlers": "0.1.0-rc.3",
-    "@ggui-ai/console": "0.1.0-rc.3",
-    "@ggui-ai/negotiator": "0.1.0-rc.3",
-    "@ggui-ai/project-config": "0.1.0-rc.3",
-    "@ggui-ai/preview-a2ui": "0.1.0-rc.3",
-    "@ggui-ai/protocol": "0.1.0-rc.3",
-    "@ggui-ai/ui-gen": "0.1.0-rc.3",
-    "@ggui-ai/ui-registry": "0.1.0-rc.3"
+    "@ggui-ai/console": "0.2.0-alpha.3",
+    "@ggui-ai/mcp-server-core": "0.2.0-alpha.3",
+    "@ggui-ai/mcp-server-handlers": "0.2.0-alpha.3",
+    "@ggui-ai/iframe-runtime": "0.2.0-alpha.3",
+    "@ggui-ai/negotiator": "0.2.0-alpha.3",
+    "@ggui-ai/preview-a2ui": "0.2.0-alpha.3",
+    "@ggui-ai/project-config": "0.2.0-alpha.3",
+    "@ggui-ai/protocol": "0.2.0-alpha.3",
+    "@ggui-ai/ui-gen": "0.2.0-alpha.3",
+    "@ggui-ai/ui-registry": "0.2.0-alpha.3"
   },
   "devDependencies": {
     "@types/express": "^4.17.21",

package/dist/render-gate.d.ts

@@ -1,87 +0,0 @@
-/**
- * `gateShortCode` — the single chokepoint for capability-URL routes.
- *
- * `/r/<code>` and `/api/bootstrap/<code>` are sibling surfaces that
- * expose the same render state via different content types (HTML
- * shell vs JSON bootstrap envelope). Before this gate, each route
- * implemented its own lookup + session resolve + 404 mapping, which
- * meant: hardening one route (revoke checks, sig verify, rate limit,
- * audit log) silently left the other unhardened. Capability URLs are
- * the credential — drift across the two routes is a defense gap.
- *
- * This module centralizes the gate logic. Routes ask the gate for
- * an outcome; content-type rendering stays on the route.
- *
- * Outcomes today:
- *   - `ok` — binding lookup + session resolve both succeeded
- *   - `not_found` — shortCode unknown OR revoked (lookup returned null)
- *   - `session_missing` — binding present but session record absent
- *
- * Outcomes reserved for future slices (sig verify, rate limit, etc.):
- *   - `invalid_signature` (HMAC slice)
- *   - `expired` (TTL slice)
- *   - `rate_limited` (per-code throttle slice)
- *
- * Each future slice extends the union; routes can map new codes to
- * appropriate status codes (403, 410, 429) without re-implementing
- * the lookup.
- */
-import type { Session } from '@ggui-ai/protocol';
-import type { ShortCodeIndex } from '@ggui-ai/mcp-server-core';
-import type { RenderSigner } from './render-signing.js';
-/** Minimal SessionStore surface the gate uses — narrower than the
- *  full interface so test fakes stay tiny. */
-interface GateSessionStore {
-    get(id: string): Promise<Session | null>;
-}
-/** The single failure surface the gate emits. New codes added here
- *  grow the discriminated union; consumers exhaustively match. */
-export type RenderGateFailureCode = 'not_found' | 'session_missing' | 'invalid_signature' | 'expired' | 'malformed_signature';
-export type RenderGateOutcome = {
-    readonly ok: true;
-    readonly binding: NonNullable<Awaited<ReturnType<ShortCodeIndex['lookup']>>>;
-    readonly session: Session;
-} | {
-    readonly ok: false;
-    readonly code: RenderGateFailureCode;
-    /** Optional context that's safe to pass to a structured logger
-     *  but MUST NOT leak to the wire — error responses stay generic
-     *  ("shortCode not recognised") to avoid info-leak amplification
-     *  on brute-force attempts. */
-    readonly logContext?: Record<string, unknown>;
-};
-export interface GateShortCodeInput {
-    readonly shortCode: string;
-    readonly shortCodeIndex: ShortCodeIndex;
-    readonly sessionStore: GateSessionStore;
-    /**
-     * Optional render-URL signer. When wired, the gate verifies the
-     * incoming `sig`+`exp` query pair BEFORE lookup; an invalid or
-     * expired signature short-circuits with a tagged failure code so
-     * the route can map to an appropriate status (403/410). Absent =
-     * signing disabled (legacy or `--no-render-signing` boot).
-     */
-    readonly signer?: RenderSigner;
-    /**
-     * Raw `sig`+`exp` from the request query string. When `signer` is
-     * wired but these are missing, the gate fails with
-     * `malformed_signature`. When `signer` is absent, both fields are
-     * ignored.
-     */
-    readonly signedQuery?: {
-        readonly sig?: string | undefined;
-        readonly exp?: string | undefined;
-    };
-}
-/**
- * Look up a shortCode + resolve its session. Idempotent + side-
- * effect-free; safe to call from any HTTP handler. Returns a tagged
- * outcome the caller maps to its content-type-appropriate response.
- *
- * Empty input MUST be caught upstream (path-param validation) — the
- * gate assumes a non-empty shortCode arrives because the route
- * pattern requires it.
- */
-export declare function gateShortCode(input: GateShortCodeInput): Promise<RenderGateOutcome>;
-export {};
-//# sourceMappingURL=render-gate.d.ts.map

package/dist/render-gate.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"render-gate.d.ts","sourceRoot":"","sources":["../src/render-gate.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AAEH,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,mBAAmB,CAAC;AACjD,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,0BAA0B,CAAC;AAC/D,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,qBAAqB,CAAC;AAExD;8CAC8C;AAC9C,UAAU,gBAAgB;IACxB,GAAG,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,GAAG,IAAI,CAAC,CAAC;CAC1C;AAED;kEACkE;AAClE,MAAM,MAAM,qBAAqB,GAC7B,WAAW,GACX,iBAAiB,GACjB,mBAAmB,GACnB,SAAS,GACT,qBAAqB,CAAC;AAE1B,MAAM,MAAM,iBAAiB,GACzB;IACE,QAAQ,CAAC,EAAE,EAAE,IAAI,CAAC;IAClB,QAAQ,CAAC,OAAO,EAAE,WAAW,CAC3B,OAAO,CAAC,UAAU,CAAC,cAAc,CAAC,QAAQ,CAAC,CAAC,CAAC,CAC9C,CAAC;IACF,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC;CAC3B,GACD;IACE,QAAQ,CAAC,EAAE,EAAE,KAAK,CAAC;IACnB,QAAQ,CAAC,IAAI,EAAE,qBAAqB,CAAC;IACrC;;;mCAG+B;IAC/B,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CAC/C,CAAC;AAEN,MAAM,WAAW,kBAAkB;IACjC,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,cAAc,EAAE,cAAc,CAAC;IACxC,QAAQ,CAAC,YAAY,EAAE,gBAAgB,CAAC;IACxC;;;;;;OAMG;IACH,QAAQ,CAAC,MAAM,CAAC,EAAE,YAAY,CAAC;IAC/B;;;;;OAKG;IACH,QAAQ,CAAC,WAAW,CAAC,EAAE;QACrB,QAAQ,CAAC,GAAG,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;QAClC,QAAQ,CAAC,GAAG,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;KACnC,CAAC;CACH;AAED;;;;;;;;GAQG;AACH,wBAAsB,aAAa,CACjC,KAAK,EAAE,kBAAkB,GACxB,OAAO,CAAC,iBAAiB,CAAC,CAwC5B"}

package/dist/render-gate.js

@@ -1,77 +0,0 @@
-/**
- * `gateShortCode` — the single chokepoint for capability-URL routes.
- *
- * `/r/<code>` and `/api/bootstrap/<code>` are sibling surfaces that
- * expose the same render state via different content types (HTML
- * shell vs JSON bootstrap envelope). Before this gate, each route
- * implemented its own lookup + session resolve + 404 mapping, which
- * meant: hardening one route (revoke checks, sig verify, rate limit,
- * audit log) silently left the other unhardened. Capability URLs are
- * the credential — drift across the two routes is a defense gap.
- *
- * This module centralizes the gate logic. Routes ask the gate for
- * an outcome; content-type rendering stays on the route.
- *
- * Outcomes today:
- *   - `ok` — binding lookup + session resolve both succeeded
- *   - `not_found` — shortCode unknown OR revoked (lookup returned null)
- *   - `session_missing` — binding present but session record absent
- *
- * Outcomes reserved for future slices (sig verify, rate limit, etc.):
- *   - `invalid_signature` (HMAC slice)
- *   - `expired` (TTL slice)
- *   - `rate_limited` (per-code throttle slice)
- *
- * Each future slice extends the union; routes can map new codes to
- * appropriate status codes (403, 410, 429) without re-implementing
- * the lookup.
- */
-/**
- * Look up a shortCode + resolve its session. Idempotent + side-
- * effect-free; safe to call from any HTTP handler. Returns a tagged
- * outcome the caller maps to its content-type-appropriate response.
- *
- * Empty input MUST be caught upstream (path-param validation) — the
- * gate assumes a non-empty shortCode arrives because the route
- * pattern requires it.
- */
-export async function gateShortCode(input) {
-    // Signature verification runs BEFORE the lookup so a flood of
-    // requests with garbage shortCodes can be rejected without hitting
-    // the index. The signer also gates information-leak: revealing
-    // "this code doesn't exist" vs "your sig is wrong" lets an
-    // attacker probe shortCodes via timing differences. Rejecting on
-    // signature first keeps the response timing uniform for any code
-    // an attacker hasn't seen a valid sig for.
-    if (input.signer) {
-        const verify = input.signer.verify({
-            shortCode: input.shortCode,
-            sig: input.signedQuery?.sig,
-            exp: input.signedQuery?.exp,
-        });
-        if (!verify.ok) {
-            return {
-                ok: false,
-                code: verify.code === 'malformed'
-                    ? 'malformed_signature'
-                    : verify.code,
-            };
-        }
-    }
-    const binding = await input.shortCodeIndex.lookup(input.shortCode);
-    if (!binding) {
-        return { ok: false, code: 'not_found' };
-    }
-    const session = await input.sessionStore.get(binding.sessionId);
-    if (!session) {
-        return {
-            ok: false,
-            code: 'session_missing',
-            logContext: {
-                shortCode: input.shortCode,
-                sessionId: binding.sessionId,
-            },
-        };
-    }
-    return { ok: true, binding, session };
-}

package/dist/render-rate-limit.d.ts

@@ -1,59 +0,0 @@
-/**
- * Per-shortCode rate limiter.
- *
- * Brute-force attempts on `/r/<code>` or `/api/bootstrap/<code>` are
- * trivially detected at the wire by per-shortCode call counts. Even
- * with high-entropy shortCodes and HMAC-signed render URLs, the gate
- * still hits a real backend on every request — so DoS resistance +
- * abuse-signal logging matter independently of entropy.
- *
- * **Design choice — rate-limit by shortCode, not by peer.**
- * Cross-origin iframes (claude.ai) NAT every user through the host's
- * outbound proxy, so per-peer limits would either rate-limit the whole
- * host (false-positive flood) or accept every peer (no signal). Per-
- * shortCode is the right granularity: 30 hits/minute on a single
- * code is abuse no matter who sent them; 30 hits/minute spread across
- * 30 unique codes is normal traffic.
- *
- * In-memory + per-process by default. Operator-grade deployments
- * back this with a shared store (Redis bucket counter) — wire via the
- * {@link RenderRateLimiter} interface; the OSS reference uses a
- * `Map<shortCode, {windowStart, count}>` with periodic cleanup.
- */
-/** Configuration knobs. Operators tune via boot options. */
-export interface RenderRateLimiterConfig {
-    /** Window size in seconds. Each shortCode gets `limit` hits per
-     *  rolling window. Default 60s. */
-    readonly windowSeconds?: number;
-    /** Per-shortCode hit cap inside the window. Default 30. */
-    readonly limit?: number;
-    /** Clock seam for tests. */
-    readonly now?: () => number;
-}
-export type RenderRateLimitResult = {
-    readonly allowed: true;
-} | {
-    readonly allowed: false;
-    readonly retryAfterSeconds: number;
-};
-export interface RenderRateLimiter {
-    /** Record a hit on `shortCode`. Returns the gate decision + (when
-     *  rejected) a Retry-After hint in seconds. */
-    check(shortCode: string): RenderRateLimitResult;
-}
-/**
- * In-memory reference implementation. Cleanup runs lazily on each
- * call — entries past their window-end are reaped before the count is
- * read. Worst-case heap: bounded by the number of distinct shortCodes
- * hit within the last `windowSeconds`; pre-launch OSS workloads stay
- * tiny enough that the periodic pass is sufficient.
- */
-export declare function createInMemoryRenderRateLimiter(cfg?: RenderRateLimiterConfig): RenderRateLimiter;
-/**
- * Mask a shortCode for log output. The full code is the credential —
- * log it verbatim and a leaked log line becomes a leaked URL. Show
- * just enough (first 3 chars) to correlate within a session without
- * giving the credential away.
- */
-export declare function maskShortCode(shortCode: string): string;
-//# sourceMappingURL=render-rate-limit.d.ts.map

package/dist/render-rate-limit.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"render-rate-limit.d.ts","sourceRoot":"","sources":["../src/render-rate-limit.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;GAqBG;AAEH,4DAA4D;AAC5D,MAAM,WAAW,uBAAuB;IACtC;uCACmC;IACnC,QAAQ,CAAC,aAAa,CAAC,EAAE,MAAM,CAAC;IAChC,2DAA2D;IAC3D,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC;IACxB,4BAA4B;IAC5B,QAAQ,CAAC,GAAG,CAAC,EAAE,MAAM,MAAM,CAAC;CAC7B;AAED,MAAM,MAAM,qBAAqB,GAC7B;IAAE,QAAQ,CAAC,OAAO,EAAE,IAAI,CAAA;CAAE,GAC1B;IAAE,QAAQ,CAAC,OAAO,EAAE,KAAK,CAAC;IAAC,QAAQ,CAAC,iBAAiB,EAAE,MAAM,CAAA;CAAE,CAAC;AAEpE,MAAM,WAAW,iBAAiB;IAChC;mDAC+C;IAC/C,KAAK,CAAC,SAAS,EAAE,MAAM,GAAG,qBAAqB,CAAC;CACjD;AAED;;;;;;GAMG;AACH,wBAAgB,+BAA+B,CAC7C,GAAG,GAAE,uBAA4B,GAChC,iBAAiB,CAmCnB;AAED;;;;;GAKG;AACH,wBAAgB,aAAa,CAAC,SAAS,EAAE,MAAM,GAAG,MAAM,CAIvD"}

package/dist/render-rate-limit.js

@@ -1,73 +0,0 @@
-/**
- * Per-shortCode rate limiter.
- *
- * Brute-force attempts on `/r/<code>` or `/api/bootstrap/<code>` are
- * trivially detected at the wire by per-shortCode call counts. Even
- * with high-entropy shortCodes and HMAC-signed render URLs, the gate
- * still hits a real backend on every request — so DoS resistance +
- * abuse-signal logging matter independently of entropy.
- *
- * **Design choice — rate-limit by shortCode, not by peer.**
- * Cross-origin iframes (claude.ai) NAT every user through the host's
- * outbound proxy, so per-peer limits would either rate-limit the whole
- * host (false-positive flood) or accept every peer (no signal). Per-
- * shortCode is the right granularity: 30 hits/minute on a single
- * code is abuse no matter who sent them; 30 hits/minute spread across
- * 30 unique codes is normal traffic.
- *
- * In-memory + per-process by default. Operator-grade deployments
- * back this with a shared store (Redis bucket counter) — wire via the
- * {@link RenderRateLimiter} interface; the OSS reference uses a
- * `Map<shortCode, {windowStart, count}>` with periodic cleanup.
- */
-/**
- * In-memory reference implementation. Cleanup runs lazily on each
- * call — entries past their window-end are reaped before the count is
- * read. Worst-case heap: bounded by the number of distinct shortCodes
- * hit within the last `windowSeconds`; pre-launch OSS workloads stay
- * tiny enough that the periodic pass is sufficient.
- */
-export function createInMemoryRenderRateLimiter(cfg = {}) {
-    const windowMs = (cfg.windowSeconds ?? 60) * 1000;
-    const limit = cfg.limit ?? 30;
-    const now = cfg.now ?? (() => Date.now());
-    const buckets = new Map();
-    return {
-        check(shortCode) {
-            if (!shortCode) {
-                // Empty shortCode is upstream's path-validation problem; we
-                // still return allowed:true to keep the contract uniform.
-                return { allowed: true };
-            }
-            const t = now();
-            const existing = buckets.get(shortCode);
-            if (!existing || t - existing.windowStart >= windowMs) {
-                // Window expired or never opened — start a fresh window.
-                buckets.set(shortCode, { windowStart: t, count: 1 });
-                return { allowed: true };
-            }
-            if (existing.count >= limit) {
-                const retryMs = windowMs - (t - existing.windowStart);
-                return {
-                    allowed: false,
-                    retryAfterSeconds: Math.max(1, Math.ceil(retryMs / 1000)),
-                };
-            }
-            existing.count += 1;
-            return { allowed: true };
-        },
-    };
-}
-/**
- * Mask a shortCode for log output. The full code is the credential —
- * log it verbatim and a leaked log line becomes a leaked URL. Show
- * just enough (first 3 chars) to correlate within a session without
- * giving the credential away.
- */
-export function maskShortCode(shortCode) {
-    if (!shortCode || shortCode.length === 0)
-        return '<empty>';
-    if (shortCode.length <= 3)
-        return `${shortCode}***`;
-    return `${shortCode.slice(0, 3)}***`;
-}

package/dist/render-signing.d.ts

@@ -1,98 +0,0 @@
-/**
- * HMAC-signed render URL helpers (capability-URL hardening).
- *
- * The shortCode IS the credential under the capability-URL model.
- * Signed render URLs add three properties on top of the base model
- * (entropy + revoke + parity gate):
- *
- *   1. **Time-bound.** Each minted URL carries `?exp=<unix>`. Past
- *      that timestamp, the gate refuses even if the binding still
- *      exists. A leaked URL stops working without operator action.
- *   2. **Tamper-evident.** Each minted URL carries `?sig=<hmac>` over
- *      `(shortCode, exp)`. Changing either invalidates the sig.
- *      Attackers who learn ONE valid shortCode can't generate URLs
- *      for shortCodes they're guessing.
- *   3. **Nuclear revoke (operational).** Rotating the signing secret
- *      invalidates every outstanding URL across the whole server in
- *      one move. Useful for incident response.
- *
- * **Threat model — what this is NOT.** The signature does not bind
- * the URL to a user, IP, or session. Anyone with the URL still has
- * full access until it expires. That's the Google-Docs-share-link
- * model. It's the only viable model when the URL must be embeddable
- * in cross-origin iframes (claude.ai), which can't attach auth
- * headers — see plan audit dated 2026-05-15.
- *
- * **Key lifecycle.** Operators set `--render-signing-secret <hex>` to
- * pin a stable key (URLs survive restarts; rotation is opt-in). When
- * omitted, the secret is auto-generated at boot — restart = every
- * outstanding URL dies. Document both behaviors so operators choose
- * deliberately.
- *
- * **Opt-out.** `--no-render-signing` (operator boots without a signer)
- * disables the layer entirely. The gate skips the verify step and
- * behavior reverts to plain (unsigned) capability URLs. Useful for
- * legacy hosts that strip query strings or tooling that pre-records
- * URLs.
- */
-export type RenderSignerVerifyResult = {
-    readonly ok: true;
-} | {
-    readonly ok: false;
-    readonly code: 'invalid_signature' | 'expired' | 'malformed';
-};
-export interface RenderSigner {
-    /**
-     * Mint a `{sig, exp}` pair for `shortCode`. `expSeconds` overrides
-     * the configured TTL. The returned `exp` is a unix-epoch second
-     * timestamp so URLs stay short.
-     */
-    sign(shortCode: string, expSecondsOverride?: number): {
-        readonly sig: string;
-        readonly exp: number;
-    };
-    /**
-     * Verify a `sig` + `exp` against `shortCode`. Returns `{ok: true}`
-     * on success; tagged failure otherwise. `malformed` covers missing
-     * fields, non-numeric `exp`, sig-length mismatches — distinguishing
-     * those from `invalid_signature` keeps the audit log informative
-     * without leaking detail to the wire (the response code stays
-     * uniform).
-     */
-    verify(args: {
-        readonly shortCode: string;
-        readonly sig: string | undefined;
-        readonly exp: string | undefined;
-    }): RenderSignerVerifyResult;
-    /** Encode `{sig, exp}` as a `?sig=...&exp=...` query string suitable
-     *  for appending to a render URL. Returns the suffix WITHOUT a
-     *  leading `?` or `&` — callers join with whatever separator their
-     *  URL already has. */
-    toQuerySuffix(args: {
-        readonly sig: string;
-        readonly exp: number;
-    }): string;
-}
-export interface CreateRenderSignerInput {
-    /**
-     * 32-byte hex key. When omitted, a fresh random key is minted —
-     * stable for the lifetime of this process, lost on restart.
-     * Operators wanting URLs that survive restarts MUST pass an
-     * explicit key (typically from a sealed-secret store).
-     */
-    readonly secret?: string;
-    /**
-     * Default URL lifetime in seconds. Override per-call via
-     * {@link RenderSigner.sign}'s `expSecondsOverride`.
-     */
-    readonly ttlSeconds?: number;
-    /** Clock seam for tests. Defaults to `Date.now()`. */
-    readonly now?: () => number;
-}
-/**
- * Build a {@link RenderSigner}. Memoize the result on the server-boot
- * scope; the secret rotates only when the operator restarts (or sets
- * a new explicit `--render-signing-secret`).
- */
-export declare function createRenderSigner(input?: CreateRenderSignerInput): RenderSigner;
-//# sourceMappingURL=render-signing.d.ts.map

package/dist/render-signing.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"render-signing.d.ts","sourceRoot":"","sources":["../src/render-signing.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAoCG;AAUH,MAAM,MAAM,wBAAwB,GAChC;IAAE,QAAQ,CAAC,EAAE,EAAE,IAAI,CAAA;CAAE,GACrB;IACE,QAAQ,CAAC,EAAE,EAAE,KAAK,CAAC;IACnB,QAAQ,CAAC,IAAI,EAAE,mBAAmB,GAAG,SAAS,GAAG,WAAW,CAAC;CAC9D,CAAC;AAEN,MAAM,WAAW,YAAY;IAC3B;;;;OAIG;IACH,IAAI,CAAC,SAAS,EAAE,MAAM,EAAE,kBAAkB,CAAC,EAAE,MAAM,GAAG;QACpD,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;QACrB,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;KACtB,CAAC;IAEF;;;;;;;OAOG;IACH,MAAM,CAAC,IAAI,EAAE;QACX,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;QAC3B,QAAQ,CAAC,GAAG,EAAE,MAAM,GAAG,SAAS,CAAC;QACjC,QAAQ,CAAC,GAAG,EAAE,MAAM,GAAG,SAAS,CAAC;KAClC,GAAG,wBAAwB,CAAC;IAE7B;;;2BAGuB;IACvB,aAAa,CAAC,IAAI,EAAE;QAClB,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;QACrB,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;KACtB,GAAG,MAAM,CAAC;CACZ;AAED,MAAM,WAAW,uBAAuB;IACtC;;;;;OAKG;IACH,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;IACzB;;;OAGG;IACH,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAC;IAC7B,sDAAsD;IACtD,QAAQ,CAAC,GAAG,CAAC,EAAE,MAAM,MAAM,CAAC;CAC7B;AAED;;;;GAIG;AACH,wBAAgB,kBAAkB,CAChC,KAAK,GAAE,uBAA4B,GAClC,YAAY,CA0Ed"}