@ggui-ai/mcp-server 0.1.0-rc.3 → 0.2.0-alpha.3

package/dist/render-signing.js

@@ -1,113 +0,0 @@
-/**
- * HMAC-signed render URL helpers (capability-URL hardening).
- *
- * The shortCode IS the credential under the capability-URL model.
- * Signed render URLs add three properties on top of the base model
- * (entropy + revoke + parity gate):
- *
- *   1. **Time-bound.** Each minted URL carries `?exp=<unix>`. Past
- *      that timestamp, the gate refuses even if the binding still
- *      exists. A leaked URL stops working without operator action.
- *   2. **Tamper-evident.** Each minted URL carries `?sig=<hmac>` over
- *      `(shortCode, exp)`. Changing either invalidates the sig.
- *      Attackers who learn ONE valid shortCode can't generate URLs
- *      for shortCodes they're guessing.
- *   3. **Nuclear revoke (operational).** Rotating the signing secret
- *      invalidates every outstanding URL across the whole server in
- *      one move. Useful for incident response.
- *
- * **Threat model — what this is NOT.** The signature does not bind
- * the URL to a user, IP, or session. Anyone with the URL still has
- * full access until it expires. That's the Google-Docs-share-link
- * model. It's the only viable model when the URL must be embeddable
- * in cross-origin iframes (claude.ai), which can't attach auth
- * headers — see plan audit dated 2026-05-15.
- *
- * **Key lifecycle.** Operators set `--render-signing-secret <hex>` to
- * pin a stable key (URLs survive restarts; rotation is opt-in). When
- * omitted, the secret is auto-generated at boot — restart = every
- * outstanding URL dies. Document both behaviors so operators choose
- * deliberately.
- *
- * **Opt-out.** `--no-render-signing` (operator boots without a signer)
- * disables the layer entirely. The gate skips the verify step and
- * behavior reverts to plain (unsigned) capability URLs. Useful for
- * legacy hosts that strip query strings or tooling that pre-records
- * URLs.
- */
-import { createHmac, randomBytes, timingSafeEqual } from 'node:crypto';
-/** Default TTL when the operator doesn't override. 24h matches the
- *  cloud pod's ShortCode row TTL — long enough for a back-to-the-tab
- *  user pattern, short enough that a leaked URL doesn't outlive a
- *  reasonable incident-response window. */
-const DEFAULT_TTL_SECONDS = 24 * 60 * 60;
-/**
- * Build a {@link RenderSigner}. Memoize the result on the server-boot
- * scope; the secret rotates only when the operator restarts (or sets
- * a new explicit `--render-signing-secret`).
- */
-export function createRenderSigner(input = {}) {
-    const secret = input.secret !== undefined && input.secret.length > 0
-        ? input.secret
-        : randomBytes(32).toString('hex');
-    const ttl = input.ttlSeconds !== undefined && input.ttlSeconds > 0
-        ? Math.floor(input.ttlSeconds)
-        : DEFAULT_TTL_SECONDS;
-    const now = input.now ?? (() => Date.now());
-    const secretBuffer = Buffer.from(secret, 'utf8');
-    function computeSig(shortCode, exp) {
-        // HMAC-SHA256 over `<shortCode>.<exp>`. Fixed separator + numeric
-        // exp keeps the input unambiguous (no length-extension or
-        // collision risk via overloaded encoding). Hex output stays
-        // URL-safe without percent-encoding.
-        return createHmac('sha256', secretBuffer)
-            .update(`${shortCode}.${exp}`)
-            .digest('hex');
-    }
-    return {
-        sign(shortCode, expSecondsOverride) {
-            const ttlForCall = expSecondsOverride !== undefined && expSecondsOverride > 0
-                ? Math.floor(expSecondsOverride)
-                : ttl;
-            const exp = Math.floor(now() / 1000) + ttlForCall;
-            return { sig: computeSig(shortCode, exp), exp };
-        },
-        verify({ shortCode, sig, exp }) {
-            if (typeof sig !== 'string' ||
-                typeof exp !== 'string' ||
-                sig.length === 0 ||
-                exp.length === 0) {
-                return { ok: false, code: 'malformed' };
-            }
-            const expNum = Number.parseInt(exp, 10);
-            if (!Number.isFinite(expNum) || expNum <= 0) {
-                return { ok: false, code: 'malformed' };
-            }
-            // Expired? Check BEFORE the HMAC compare. Expiry is a cheap
-            // numeric compare; bailing here on stale URLs avoids the more
-            // expensive constant-time sig compare on every drive-by stale
-            // hit. Information-leak concern: an attacker can probe `exp`
-            // independently of sig — but `exp` is already in the URL and
-            // not secret.
-            const nowSeconds = Math.floor(now() / 1000);
-            if (expNum < nowSeconds) {
-                return { ok: false, code: 'expired' };
-            }
-            const expected = computeSig(shortCode, expNum);
-            // Constant-time compare. Buffer length mismatch → fail without
-            // exposing length information via `timingSafeEqual` (which
-            // throws on length mismatch).
-            const a = Buffer.from(sig, 'hex');
-            const b = Buffer.from(expected, 'hex');
-            if (a.length !== b.length || a.length === 0) {
-                return { ok: false, code: 'invalid_signature' };
-            }
-            return timingSafeEqual(a, b)
-                ? { ok: true }
-                : { ok: false, code: 'invalid_signature' };
-        },
-        toQuerySuffix({ sig, exp }) {
-            return `sig=${sig}&exp=${exp}`;
-        },
-    };
-}

package/dist/session-channel.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"session-channel.d.ts","sourceRoot":"","sources":["../src/session-channel.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAqCG;AAGH,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,WAAW,CAAC;AACjD,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,aAAa,CAAC;AAG1C,OAAO,KAAK,EAOV,UAAU,EAEV,wBAAwB,EACxB,gBAAgB,EAChB,iBAAiB,EAIlB,MAAM,mBAAmB,CAAC;AAU3B,OAAO,KAAK,EACV,WAAW,EAIX,YAAY,EACZ,mBAAmB,EACnB,mBAAmB,EACnB,YAAY,EACZ,aAAa,EACd,MAAM,0BAA0B,CAAC;AAgBlC,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,aAAa,CAAC;AAE1C,yEAAyE;AACzE,eAAO,MAAM,4BAA4B,QAAQ,CAAC;AA8FlD;;;;;;;GAOG;AACH,MAAM,WAAW,+BAA+B;IAC9C;;;;;;;OAOG;IACH,QAAQ,CAAC,SAAS,EAAE,SAAS,MAAM,EAAE,CAAC;IACtC;;;;;;;;;;OAUG;IACH,MAAM,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IACvD;;;;;OAKG;IACH,QAAQ,CAAC,WAAW,CAAC,EAAE;QACrB,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC;QAC1B,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC;QAC5B,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC;KAC7B,CAAC;CACH;AAED;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH;;;;;;;;;;GAUG;AACH,MAAM,MAAM,mCAAmC,GAC3C;IACE,QAAQ,CAAC,EAAE,EAAE,IAAI,CAAC;IAClB,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;CACxB,GACD;IAAE,QAAQ,CAAC,EAAE,EAAE,KAAK,CAAC;IAAC,QAAQ,CAAC,MAAM,EAAE,SAAS,GAAG,SAAS,CAAA;CAAE,CAAC;AAEnE;;;;;;GAMG;AACH,MAAM,MAAM,oCAAoC,GAC5C;IACE,QAAQ,CAAC,EAAE,EAAE,IAAI,CAAC;IAClB,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;CAC5B,GACD;IAAE,QAAQ,CAAC,EAAE,EAAE,KAAK,CAAC;IAAC,QAAQ,CAAC,MAAM,EAAE,eAAe,GAAG,SAAS,CAAA;CAAE,CAAC;AAEzE,MAAM,WAAW,uBAAuB;IACtC;;;;;;;;OAQG;IACH,MAAM,CAAC,KAAK,EAAE,MAAM,GAAG,mCAAmC,CAAC;IAC3D;;;;OAIG;IACH,iBAAiB,CAAC,SAAS,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,MAAM,CAAC;IAC5D;;;;;;;;;;;;;OAaG;IACH,OAAO,CAAC,KAAK,EAAE,MAAM,GAAG,oCAAoC,CAAC;CAC9D;AAED;;;;;GAKG;AACH,eAAO,MAAM,6BAA6B,QAAS,CAAC;AAEpD;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AACH;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AACH,MAAM,WAAW,kBAAkB;IACjC;uEACmE;IACnE,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B;;;iCAG6B;IAC7B,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B;;;;;;;;;;;OAWG;IACH,eAAe,CAAC,WAAW,EAAE,MAAM,EAAE,KAAK,EAAE,UAAU,GAAG,IAAI,CAAC;CAC/D;AAED,MAAM,WAAW,iBAAiB;IAChC;;;mDAG+C;IAC/C,GAAG,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC;IAC/B;;;;;;;;;;;;OAYG;IACH,MAAM,CACJ,QAAQ,EAAE,MAAM,EAChB,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAC9B,GAAG,EAAE,kBAAkB,GACtB,OAAO,CAAC,OAAO,CAAC,CAAC;CACrB;AAED,MAAM,WAAW,qBAAqB;IACpC,+EAA+E;IAC/E,QAAQ,CAAC,YAAY,EAAE,YAAY,CAAC;IACpC;;;OAGG;IACH,QAAQ,CAAC,IAAI,EAAE,WAAW,CAAC;IAC3B;;;OAGG;IACH,yBAAyB;IACzB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,+CAA+C;IAC/C,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC;IACvB;;;;;;;;;OASG;IACH,QAAQ,CAAC,YAAY,CAAC,EAAE,mBAAmB,CAAC;IAC5C;;;;;;;;;OASG;IACH,QAAQ,CAAC,YAAY,CAAC,EAAE,YAAY,CAAC;IACrC;;;;;OAKG;IACH,QAAQ,CAAC,SAAS,CAAC,EAAE,uBAAuB,CAAC;IAE7C;;;;;;;;;;;;;;;OAeG;IACH,QAAQ,CAAC,UAAU,CAAC,EAAE,wBAAwB,CAAC;IAC/C;;;;;;;;;;OAUG;IACH,QAAQ,CAAC,iBAAiB,CAAC,EAAE,iBAAiB,CAAC;IAC/C;;;;;;OAMG;IACH,QAAQ,CAAC,oBAAoB,CAAC,EAAE,MAAM,CAAC;IACvC;;;;;;;;;;;;;;;;OAgBG;IACH,QAAQ,CAAC,gBAAgB,CAAC,EAAE,gBAAgB,CAAC;IAC7C;;;;;;;;;;;;;;;;;OAiBG;IACH,QAAQ,CAAC,uBAAuB,CAAC,EAAE,WAAW,CAC5C,MAAM,EACN,wBAAwB,CACzB,CAAC;IACF;;;;;;;;;;;OAWG;IACH,QAAQ,CAAC,SAAS,CAAC,EAAE,aAAa,CAAC;IACnC;;;;;;;;;;;OAWG;IACH,QAAQ,CAAC,yBAAyB,CAAC,EAAE,+BAA+B,CAAC;IACrE;;;;;;;;;;;;;;;;;;;;;;;;OAwBG;IACH,QAAQ,CAAC,aAAa,CAAC,EAAE,UAAU,GAAG,QAAQ,CAAC;CAChD;AAED;;;;GAIG;AACH,MAAM,WAAW,wBAAwB;IACvC;;;;OAIG;IACH,UAAU,CAAC,OAAO,EAAE,OAAO,WAAW,EAAE,mBAAmB,GAAG,MAAM,GAAG,IAAI,CAAC;IAC5E;;;;OAIG;IACH,MAAM,CAAC,WAAW,EAAE,MAAM,GAAG;QAAE,SAAS,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAA;KAAE,GAAG,IAAI,CAAC;CAC1E;AAED,MAAM,WAAW,oBAAoB;IACnC,4DAA4D;IAC5D,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB;;;;OAIG;IACH,aAAa,CACX,GAAG,EAAE,eAAe,EACpB,MAAM,EAAE,MAAM,EACd,IAAI,EAAE,MAAM,GACX,IAAI,CAAC;IACR;;;;;;;;;;;;;;;;;;;;;;;;;;;OA2BG;IACH,aAAa,CAAC,QAAQ,EAAE,mBAAmB,GAAG,OAAO,CAAC;QAAE,GAAG,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IACvE;;;;;;;;;;;;;;;;;;;;;;;;;;;;OA4BG;IACH,eAAe,CACb,SAAS,EAAE,MAAM,EACjB,SAAS,EAAE,iBAAiB,EAC5B,SAAS,CAAC,EAAE,MAAM,GACjB,IAAI,CAAC;IACR;;;;;;;;;;;;;;;;;;;;;;;;;OAyBG;IACH,YAAY,CAAC,SAAS,EAAE,MAAM,EAAE,SAAS,EAAE,iBAAiB,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC7E;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OAqCG;IACH,eAAe,CACb,SAAS,EAAE,MAAM,EACjB,WAAW,EAAE,MAAM,EACnB,KAAK,EAAE,UAAU,GAChB,OAAO,CAAC,IAAI,CAAC,CAAC;IACjB;;;;;;;;;;;;;;;;OAgBG;IACH,YAAY,CAAC,IAAI,EAAE;QACjB,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;QAC3B,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;QACvB,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;QAC7B,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;QACzB,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;KAC5B,GAAG,IAAI,CAAC;IACT,2EAA2E;IAC3E,QAAQ,CAAC,eAAe,EAAE,MAAM,CAAC;IACjC,gEAAgE;IAChE,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;IAC9B;;OAEG;IACH,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;CACxB;AAmBD;;;GAGG;AACH,wBAAgB,0BAA0B,CACxC,IAAI,EAAE,qBAAqB,GAC1B,oBAAoB,CA6/DtB;AAED,qEAAqE;AACrE,wBAAgB,YAAY,IAAI,MAAM,CAErC"}