@ggui-ai/mcp-server 0.24.0 → 0.26.0

package/README.md

@@ -1,8 +1,8 @@
 # @ggui-ai/mcp-server
 
-Self-hosted [MCP](https://modelcontextprotocol.io) server for the **ggui protocol** —
+Self-hosted [MCP](https://modelcontextprotocol.io) server for the **GGUI protocol** —
 the interface layer that lets AI agents describe UIs in natural language and have
-ggui generate ephemeral interfaces for them.
+GGUI generate ephemeral interfaces for them.
 
 This package is the HTTP/MCP binding layer. It composes
 [`@ggui-ai/mcp-server-handlers`](https://www.npmjs.com/package/@ggui-ai/mcp-server-handlers)

package/dist/api-renders-routes.d.ts

@@ -13,7 +13,27 @@
  * wsToken-gated: same credential as the live-channel WS upgrade
  * (`?wsToken=<token>` on `/ws`). Drift-free with the WS surface —
  * the iframe-runtime already has the token from the bootstrap
- * envelope; no separate refresh path needed.
+ * envelope.
+ *
+ * Each read renews the token for its holder: a POSSESSION renewal
+ * (ggui#1496 part B, slice 2). The renewal carries its chain's root
+ * forward (`rootIat`: the presented token's, or its `iat` when it is
+ * itself a root) and its `exp` never passes `rootIat + refresh window`,
+ * so a chain of `/state` renewals ends one window after its root was
+ * minted, at the same second on every gate (for a token minted under the
+ * current window: one minted under a longer window, by an earlier config or
+ * another server sharing the secret, stays live on the other gates until
+ * its own `exp`). Past it, a new credential needs an authorized door, such
+ * as `ggui_runtime_refresh_ws_token`.
+ *
+ * Responses (/state):
+ *   - 200 — the slice envelope, with the renewed trio and the
+ *     token-bearing `pollingUrl` / `sseUrl`.
+ *   - 401 — wsToken missing / invalid / wrong-scope.
+ *   - 404 — sessionId does not resolve.
+ *   - 410 — `wsToken expired`: past its `exp`, or its chain has no second
+ *     left (the bound's second arrived after the expiry check, or the
+ *     token was minted under a longer window).
  *
  * Distinct from `/r/:shortCode` (JSON branch):
  *   - `/r/...` was shortCode-gated (bearer-by-obscurity; anyone with
@@ -42,6 +62,15 @@
  *     `sinceSequence` is below the server's replay horizon OR strictly
  *     greater than `lastSequence` (cursor is from a stale deployment
  *     or the render was reset). Clients re-mount from /state.
+ *
+ * Log (/events): the first 200 per server process, session and kind logs
+ * `render_channel_polled_first {sessionId, appId, kind}`, so a view on the
+ * HTTP polling rung leaves a mount mark tagged with its app, as
+ * `render_channel_subscribed` does for the ws and sse rungs. `kind` is
+ * `cold-mount` for the boot fetch (`sinceSequence=0&limit=1`) and `poll`
+ * otherwise. It fires after every gate, so the `sessionId` is one the
+ * token's app owns, and never carries the query string (the wsToken
+ * rides there).
  */
 import type { AppMetadataStore, CodeStore, GguiSessionStore } from "@ggui-ai/mcp-server-core";
 import { type McpAppAiGguiRenderMeta } from "@ggui-ai/protocol/integrations/mcp-apps";
@@ -85,15 +114,27 @@ interface MountOptions {
         readonly hash: string;
         readonly base: string;
     }) => string | undefined;
-    /** Live-mode credential minter — fresh trio on every /state read. */
-    readonly mintBootstrap?: (sessionId: string, appId: string) => {
+    /**
+     * `/state`'s one live-credential minter (ggui#1496 part B, slice 2): a
+     * possession renewal. It mints a ws token that carries the presented
+     * chain's `rootIat` forward, with its `exp` clamped to
+     * `rootIat + refresh window`, so a chain of `/state` renewals ends there.
+     * `undefined` means the chain has no second left, answered as the ordinary
+     * expiry.
+     */
+    readonly mintChainedBootstrap: (sessionId: string, appId: string, rootIat: number) => {
         wsUrl: string;
         token: string;
         expiresAt: string;
-    };
+    } | undefined;
     /** Per-request runtime-bundle URL resolver (tunnel/proxy aware). */
     readonly resolveRuntimeUrl: () => string;
-    /** Structured logger for store-read failures. */
+    /**
+     * Structured logger for store-read failures, for the `/state`
+     * renewals refused because a chain expired (`state_chain_expired`),
+     * and for the first successful `/events` read per session and kind
+     * (`render_channel_polled_first`).
+     */
     readonly logger: Logger;
 }
 /**

package/dist/api-renders-routes.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"api-renders-routes.d.ts","sourceRoot":"","sources":["../src/api-renders-routes.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4CG;AAEH,OAAO,KAAK,EAAE,gBAAgB,EAAE,SAAS,EAAE,gBAAgB,EAAE,MAAM,0BAA0B,CAAC;AAQ9F,OAAO,EAGL,KAAK,sBAAsB,EAC5B,MAAM,yCAAyC,CAAC;AACjD,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,SAAS,CAAC;AACvC,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,aAAa,CAAC;AAG1C,UAAU,YAAY;IACpB,iCAAiC;IACjC,QAAQ,CAAC,GAAG,EAAE,OAAO,CAAC;IACtB,+CAA+C;IAC/C,QAAQ,CAAC,WAAW,EAAE,gBAAgB,CAAC;IACvC,wEAAwE;IACxE,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,sEAAsE;IACtE,QAAQ,CAAC,gBAAgB,CAAC,EAAE,gBAAgB,CAAC;IAC7C,+DAA+D;IAC/D,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC;IAC1B,0DAA0D;IAC1D,QAAQ,CAAC,SAAS,CAAC,EAAE,sBAAsB,CAAC,WAAW,CAAC,CAAC;IACzD,sEAAsE;IACtE,QAAQ,CAAC,SAAS,CAAC,EAAE,SAAS,CAAC;IAC/B,sEAAsE;IACtE,QAAQ,CAAC,aAAa,CAAC,EAAE,MAAM,CAAC;IAChC;;;;;;;OAOG;IACH,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAC;IAC9B;;;;;;OAMG;IACH,QAAQ,CAAC,iBAAiB,CAAC,EAAE,CAAC,IAAI,EAAE;QAClC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;QACtB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;QACtB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;KACvB,KAAK,MAAM,GAAG,SAAS,CAAC;IACzB,qEAAqE;IACrE,QAAQ,CAAC,aAAa,CAAC,EAAE,CACvB,SAAS,EAAE,MAAM,EACjB,KAAK,EAAE,MAAM,KACV;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAC;QAAC,SAAS,EAAE,MAAM,CAAA;KAAE,CAAC;IACzD,oEAAoE;IACpE,QAAQ,CAAC,iBAAiB,EAAE,MAAM,MAAM,CAAC;IACzC,iDAAiD;IACjD,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;CACzB;AAED;;;;GAIG;AACH,wBAAgB,qBAAqB,CAAC,IAAI,EAAE,YAAY,GAAG,IAAI,CAoX9D"}
+{"version":3,"file":"api-renders-routes.d.ts","sourceRoot":"","sources":["../src/api-renders-routes.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAyEG;AAEH,OAAO,KAAK,EAAE,gBAAgB,EAAE,SAAS,EAAE,gBAAgB,EAAE,MAAM,0BAA0B,CAAC;AAQ9F,OAAO,EAGL,KAAK,sBAAsB,EAC5B,MAAM,yCAAyC,CAAC;AACjD,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,SAAS,CAAC;AAEvC,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,aAAa,CAAC;AAM1C,UAAU,YAAY;IACpB,iCAAiC;IACjC,QAAQ,CAAC,GAAG,EAAE,OAAO,CAAC;IACtB,+CAA+C;IAC/C,QAAQ,CAAC,WAAW,EAAE,gBAAgB,CAAC;IACvC,wEAAwE;IACxE,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,sEAAsE;IACtE,QAAQ,CAAC,gBAAgB,CAAC,EAAE,gBAAgB,CAAC;IAC7C,+DAA+D;IAC/D,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC;IAC1B,0DAA0D;IAC1D,QAAQ,CAAC,SAAS,CAAC,EAAE,sBAAsB,CAAC,WAAW,CAAC,CAAC;IACzD,sEAAsE;IACtE,QAAQ,CAAC,SAAS,CAAC,EAAE,SAAS,CAAC;IAC/B,sEAAsE;IACtE,QAAQ,CAAC,aAAa,CAAC,EAAE,MAAM,CAAC;IAChC;;;;;;;OAOG;IACH,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAC;IAC9B;;;;;;OAMG;IACH,QAAQ,CAAC,iBAAiB,CAAC,EAAE,CAAC,IAAI,EAAE;QAClC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;QACtB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;QACtB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;KACvB,KAAK,MAAM,GAAG,SAAS,CAAC;IACzB;;;;;;;OAOG;IACH,QAAQ,CAAC,oBAAoB,EAAE,CAC7B,SAAS,EAAE,MAAM,EACjB,KAAK,EAAE,MAAM,EACb,OAAO,EAAE,MAAM,KACZ;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAC;QAAC,SAAS,EAAE,MAAM,CAAA;KAAE,GAAG,SAAS,CAAC;IACrE,oEAAoE;IACpE,QAAQ,CAAC,iBAAiB,EAAE,MAAM,MAAM,CAAC;IACzC;;;;;OAKG;IACH,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;CACzB;AAED;;;;GAIG;AACH,wBAAgB,qBAAqB,CAAC,IAAI,EAAE,YAAY,GAAG,IAAI,CAkZ9D"}

package/dist/api-renders-routes.js

@@ -13,7 +13,27 @@
  * wsToken-gated: same credential as the live-channel WS upgrade
  * (`?wsToken=<token>` on `/ws`). Drift-free with the WS surface —
  * the iframe-runtime already has the token from the bootstrap
- * envelope; no separate refresh path needed.
+ * envelope.
+ *
+ * Each read renews the token for its holder: a POSSESSION renewal
+ * (ggui#1496 part B, slice 2). The renewal carries its chain's root
+ * forward (`rootIat`: the presented token's, or its `iat` when it is
+ * itself a root) and its `exp` never passes `rootIat + refresh window`,
+ * so a chain of `/state` renewals ends one window after its root was
+ * minted, at the same second on every gate (for a token minted under the
+ * current window: one minted under a longer window, by an earlier config or
+ * another server sharing the secret, stays live on the other gates until
+ * its own `exp`). Past it, a new credential needs an authorized door, such
+ * as `ggui_runtime_refresh_ws_token`.
+ *
+ * Responses (/state):
+ *   - 200 — the slice envelope, with the renewed trio and the
+ *     token-bearing `pollingUrl` / `sseUrl`.
+ *   - 401 — wsToken missing / invalid / wrong-scope.
+ *   - 404 — sessionId does not resolve.
+ *   - 410 — `wsToken expired`: past its `exp`, or its chain has no second
+ *     left (the bound's second arrived after the expiry check, or the
+ *     token was minted under a longer window).
  *
  * Distinct from `/r/:shortCode` (JSON branch):
  *   - `/r/...` was shortCode-gated (bearer-by-obscurity; anyone with
@@ -42,23 +62,60 @@
  *     `sinceSequence` is below the server's replay horizon OR strictly
  *     greater than `lastSequence` (cursor is from a stale deployment
  *     or the render was reset). Clients re-mount from /state.
+ *
+ * Log (/events): the first 200 per server process, session and kind logs
+ * `render_channel_polled_first {sessionId, appId, kind}`, so a view on the
+ * HTTP polling rung leaves a mount mark tagged with its app, as
+ * `render_channel_subscribed` does for the ws and sse rungs. `kind` is
+ * `cold-mount` for the boot fetch (`sinceSequence=0&limit=1`) and `poll`
+ * otherwise. It fires after every gate, so the `sessionId` is one the
+ * token's app owns, and never carries the query string (the wsToken
+ * rides there).
  */
-import { verifyToken } from "@ggui-ai/mcp-server-core";
+import { verifyToken, verifyWsTokenSignature } from "@ggui-ai/mcp-server-core";
 import { deriveContractBundle, derivePublicEnvProjection, deriveRenderMeta, spreadRenderMetaViewOntoSlice, } from "@ggui-ai/mcp-server-handlers/renders";
 import { composeSessionApiUrls, MCP_APP_AI_GGUI_RENDER_META_KEY, } from "@ggui-ai/protocol/integrations/mcp-apps";
+import { createFirstSeen } from "./first-seen.js";
 import { createPublicReadPreflight } from "./browser-cors.js";
+/** How many (kind, session) pairs `/events` remembers for its first-success line. */
+const POLLED_FIRST_CAPACITY = 10_000;
 /**
  * Mount `GET /api/sessions/:sessionId/state` +
  * `GET /api/sessions/:sessionId/events` onto the express app.
  * Returns nothing — the routes self-register.
  */
 export function mountApiRendersRoutes(opts) {
-    const { app, renderStore, secret, appMetadataStore, themeId, themeMode, codeStore, publicBaseUrl, codeBaseUrl, mintBootstrap, resolveRuntimeUrl, logger, } = opts;
+    const { app, renderStore, secret, appMetadataStore, themeId, themeMode, codeStore, publicBaseUrl, codeBaseUrl, mintChainedBootstrap, resolveRuntimeUrl, logger, } = opts;
     // The origin the content-addressable routes are reached at (asset
     // host if fronted separately, else the public origin); the request
     // host is the last resort for local/tunnel deployments.
     const staticBase = codeBaseUrl ?? publicBaseUrl;
+    // Which (kind, session) pairs `/events` has already logged a first
+    // success for. Bounded, so a long-running process never grows with its
+    // session count; a session forgotten under that bound logs again.
+    const polledFirst = createFirstSeen(POLLED_FIRST_CAPACITY);
     // ggui#1231 — a public `*` read owns its preflight (null-origin frames).
+    /**
+     * One line per `/state` renewal refused because its chain expired
+     * (ggui#1496 S6, ggui#1540): the presented token is past its `exp`, or
+     * its chain has no second left. Its signature is checked at any age, so
+     * only a token this server signed is counted, and the line carries ids
+     * only: the session and how old the chain's root is. A chain ends at its
+     * bound (the last renewal's `exp` is clamped to `rootIat + window`), so a
+     * `rootAgeSec` at or past the refresh window is a chain that reached it,
+     * and a smaller one a token that went unrenewed. Both answer the same 410,
+     * whose documented action is the authorized refresh.
+     */
+    function logStateChainExpired(token) {
+        const signed = verifyWsTokenSignature(token, secret);
+        if (!signed.ok)
+            return;
+        const rootIat = signed.claims.rootIat ?? signed.claims.iat;
+        logger.info("state_chain_expired", {
+            sessionId: signed.claims.sessionId,
+            rootAgeSec: Math.max(0, Math.floor(Date.now() / 1000) - rootIat),
+        });
+    }
     app.options("/api/sessions/:sessionId/state", createPublicReadPreflight());
     app.get("/api/sessions/:sessionId/state", async (req, res) => {
         // CORS on EVERY response, gates included: cross-origin frames can
@@ -85,6 +142,7 @@ export function mountApiRendersRoutes(opts) {
             // surface a refresh-vs-rehandshake prompt instead of treating
             // it as a hostile request.
             if (verify.reason === "expired") {
+                logStateChainExpired(wsToken);
                 res.status(410).type("text/plain").send("wsToken expired");
                 return;
             }
@@ -152,31 +210,36 @@ export function mountApiRendersRoutes(opts) {
                 // Silent — wrappers calling getPublicEnv throw clearly.
             }
         }
-        // Live-mode credential trio. Always minted fresh on /state reads
-        // so the iframe-runtime gets a long-TTL token + the host learns
-        // `wsUrl` (the CSP-permitted WebSocket origin). Without this,
-        // any caller of /state — including the restore-bootstrap path in
-        // every host (claude.ai, ChatGPT, our sample-agent) — receives a
-        // render slice missing `wsUrl`. CSP `connect-src` then omits the
-        // `ws://` scheme, the browser blocks the upgrade, and props_update
-        // never reaches the iframe. The render-commit handler already
-        // stamps this trio on its resultMeta; mirroring here closes the
-        // drift.
-        const liveTrio = mintBootstrap ? mintBootstrap(stored.id, stored.appId) : undefined;
+        // Live-mode credential trio, renewed on every /state read so the
+        // iframe-runtime gets a live token + the host learns `wsUrl` (the
+        // CSP-permitted WebSocket origin). Without `wsUrl`, any caller of
+        // /state — including the restore-bootstrap path in every host
+        // (claude.ai, ChatGPT, our sample-agent) — gets a slice whose CSP
+        // `connect-src` omits the `ws://` scheme, the browser blocks the
+        // upgrade, and props_update never reaches the iframe. The
+        // render-commit handler stamps the same trio on its resultMeta.
+        //
+        // This read is a POSSESSION renewal (ggui#1496 part B, slice 2): the
+        // presented token is the only credential, so the renewal carries the
+        // chain's root forward (its `rootIat`, or its `iat` when it is itself
+        // a root) and never outlives `rootIat + refresh window`. A chain with
+        // no second left is the ordinary expiry: the same 410 and body as a
+        // token past its `exp`, whose documented action is the authorized
+        // refresh (`ggui_runtime_refresh_ws_token`).
+        const liveTrio = mintChainedBootstrap(stored.id, stored.appId, verify.claims.rootIat ?? verify.claims.iat);
+        if (liveTrio === undefined) {
+            logStateChainExpired(wsToken);
+            res.status(410).type("text/plain").send("wsToken expired");
+            return;
+        }
         // Token-bearing session-API URL pair (pollingUrl → /events,
         // sseUrl → /stream), composed via the protocol's ONE composer so
         // this surface cannot drift from the render/update resultMeta
-        // stamping. Stamped ONLY when the live trio above was minted —
-        // both URLs embed the fresh long-TTL token, so a minter-less
-        // deployment honestly omits them (the old unconditional
-        // token-less `/state`-shaped pollingUrl could only 401 through
-        // the iframe-runtime's /events composer).
+        // stamping. Both embed the renewed token.
         const sessionApiBase = publicBaseUrl
             ? publicBaseUrl.replace(/\/$/, "")
             : `${req.protocol}://${req.get("host") ?? ""}`;
-        const sessionApiUrls = liveTrio !== undefined
-            ? composeSessionApiUrls(sessionApiBase, stored.id, liveTrio.token)
-            : undefined;
+        const sessionApiUrls = composeSessionApiUrls(sessionApiBase, stored.id, liveTrio.token);
         // Static-component delivery via codeUrl (the same content-addressable
         // channel the code routes serve). Polling clients are render-capable
         // and need the URL to mount/refresh the static-component variant.
@@ -210,13 +273,8 @@ export function mountApiRendersRoutes(opts) {
                 catch {
                     // Silent — the caller falls back to live-mode delivery, and
                     // here that fallback is structural rather than hoped for:
-                    // `mintBootstrap` is optional on the options type, but these
-                    // routes mount only under `mcpAppsEnabled` + a render store
-                    // + a token secret, which are the same preconditions that
-                    // assign the minter. So a reader of THIS file cannot see the
-                    // guarantee — it lives at the mount site, and it is what
-                    // keeps the silence honest. Lose that pairing and this catch
-                    // becomes a swallow.
+                    // `mintChainedBootstrap` is required on the options type and
+                    // this response always carries the live trio minted above.
                 }
                 try {
                     const bundle = await deriveContractBundle(render);
@@ -241,16 +299,11 @@ export function mountApiRendersRoutes(opts) {
             sessionId: stored.id,
             appId: stored.appId,
             runtimeUrl: resolveRuntimeUrl(),
-            ...(liveTrio !== undefined
-                ? {
-                    wsUrl: liveTrio.wsUrl,
-                    wsToken: liveTrio.token,
-                    expiresAt: liveTrio.expiresAt,
-                }
-                : {}),
-            ...(sessionApiUrls !== undefined
-                ? { pollingUrl: sessionApiUrls.pollingUrl, sseUrl: sessionApiUrls.sseUrl }
-                : {}),
+            wsUrl: liveTrio.wsUrl,
+            wsToken: liveTrio.token,
+            expiresAt: liveTrio.expiresAt,
+            pollingUrl: sessionApiUrls.pollingUrl,
+            sseUrl: sessionApiUrls.sseUrl,
             ...(themeId !== undefined ? { themeId } : {}),
             ...(themeMode !== undefined ? { themeMode } : {}),
             ...(statePublicEnv !== undefined && Object.keys(statePublicEnv).length > 0
@@ -402,6 +455,12 @@ export function mountApiRendersRoutes(opts) {
         // (Wave 7 of flatten-render-identity, 2026-05-28). The store
         // returns events in protocol-canonical shape (seq + type +
         // timestamp[ISO] + data); no projection needed.
+        // The polling rung's mount mark (see the header): once per server
+        // process, session and kind, and only here, past every gate.
+        const kind = sinceSequence === 0 && limit === 1 ? "cold-mount" : "poll";
+        if (polledFirst.first(`${kind}:${sessionId}`)) {
+            logger.info("render_channel_polled_first", { sessionId, appId: stored.appId, kind });
+        }
         res.setHeader("Cache-Control", "no-store, no-cache, must-revalidate");
         res.setHeader("Content-Type", "application/json; charset=utf-8");
         res.status(200).json({

package/dist/api-renders-stream-route.d.ts

@@ -31,7 +31,8 @@
  * Cursor spaces: `Last-Event-ID` (browser-stamped on auto-reconnect)
  * WINS over `?sinceSequence=`; the query seeds the first connect
  * (EventSource cannot set headers). `?fromSeq=` mirrors
- * `SubscribePayload.fromSeq` for the stream-buffer plane — note it is
+ * `SubscribePayload.fromSeq` for the stream-buffer plane (and
+ * `?fromEpoch=` its `fromEpoch`, ggui#1531) — note it is
  * frozen in the EventSource URL, so duplicate `data` frames after an
  * auto-reconnect are expected; ledger + stream deliveries are
  * documented at-least-once and clients dedupe by seq.

package/dist/api-renders-stream-route.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"api-renders-stream-route.d.ts","sourceRoot":"","sources":["../src/api-renders-stream-route.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4CG;AAEH,OAAO,KAAK,EAAc,gBAAgB,EAAE,MAAM,0BAA0B,CAAC;AAG7E,OAAO,KAAK,EAAE,OAAO,EAAY,MAAM,SAAS,CAAC;AACjD,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,2BAA2B,CAAC;AAE1E,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,aAAa,CAAC;AAG1C;;;;GAIG;AACH,eAAO,MAAM,gBAAgB,QAAS,CAAC;AA2DvC,MAAM,WAAW,iCAAiC;IAChD,iCAAiC;IACjC,QAAQ,CAAC,GAAG,EAAE,OAAO,CAAC;IACtB,2DAA2D;IAC3D,QAAQ,CAAC,WAAW,EAAE,gBAAgB,CAAC;IACvC,wEAAwE;IACxE,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB;;;;;OAKG;IACH,QAAQ,CAAC,eAAe,EAAE,MAAM,wBAAwB,GAAG,IAAI,CAAC;IAChE,0EAA0E;IAC1E,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAC;IAC9B,yBAAyB;IACzB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;CACzB;AAED;;;GAGG;AACH,wBAAgB,0BAA0B,CAAC,IAAI,EAAE,iCAAiC,GAAG,IAAI,CA4MxF"}
+{"version":3,"file":"api-renders-stream-route.d.ts","sourceRoot":"","sources":["../src/api-renders-stream-route.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6CG;AAEH,OAAO,KAAK,EAAc,gBAAgB,EAAE,MAAM,0BAA0B,CAAC;AAG7E,OAAO,KAAK,EAAE,OAAO,EAAY,MAAM,SAAS,CAAC;AACjD,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,2BAA2B,CAAC;AAE1E,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,aAAa,CAAC;AAG1C;;;;GAIG;AACH,eAAO,MAAM,gBAAgB,QAAS,CAAC;AA2DvC,MAAM,WAAW,iCAAiC;IAChD,iCAAiC;IACjC,QAAQ,CAAC,GAAG,EAAE,OAAO,CAAC;IACtB,2DAA2D;IAC3D,QAAQ,CAAC,WAAW,EAAE,gBAAgB,CAAC;IACvC,wEAAwE;IACxE,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB;;;;;OAKG;IACH,QAAQ,CAAC,eAAe,EAAE,MAAM,wBAAwB,GAAG,IAAI,CAAC;IAChE,0EAA0E;IAC1E,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAC;IAC9B,yBAAyB;IACzB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;CACzB;AAED;;;GAGG;AACH,wBAAgB,0BAA0B,CAAC,IAAI,EAAE,iCAAiC,GAAG,IAAI,CAuNxF"}

package/dist/api-renders-stream-route.js

@@ -31,7 +31,8 @@
  * Cursor spaces: `Last-Event-ID` (browser-stamped on auto-reconnect)
  * WINS over `?sinceSequence=`; the query seeds the first connect
  * (EventSource cannot set headers). `?fromSeq=` mirrors
- * `SubscribePayload.fromSeq` for the stream-buffer plane — note it is
+ * `SubscribePayload.fromSeq` for the stream-buffer plane (and
+ * `?fromEpoch=` its `fromEpoch`, ggui#1531) — note it is
  * frozen in the EventSource URL, so duplicate `data` frames after an
  * auto-reconnect are expected; ledger + stream deliveries are
  * documented at-least-once and clients dedupe by seq.
@@ -172,6 +173,11 @@ export function mountApiRendersStreamRoute(opts) {
             }
             fromSeq = parsed;
         }
+        // The epoch `fromSeq` was counted in (ggui#1531). Opaque and
+        // server-minted: any non-empty value is compared as it is, and one
+        // that does not match the session's replays everything retained.
+        const fromEpochRaw = req.query["fromEpoch"];
+        const fromEpoch = typeof fromEpochRaw === "string" && fromEpochRaw.length > 0 ? fromEpochRaw : undefined;
         // Last-Event-ID (browser-stamped on auto-reconnect) WINS over the
         // query seed. Malformed header → warn + fall back to the query
         // (never a 4xx: the header is browser-controlled, and failing the
@@ -291,8 +297,11 @@ export function mountApiRendersStreamRoute(opts) {
                 appId: stored.appId,
                 identity,
                 sink,
+                // The stream is wsToken-only; the identity above is synthetic.
+                credential: "ws_token",
                 ...(sinceSequence !== undefined ? { sinceSequence } : {}),
                 ...(fromSeq !== undefined ? { fromSeq } : {}),
+                ...(fromEpoch !== undefined ? { fromEpoch } : {}),
             });
             detachFn = detach;
             if (torn) {
@@ -305,7 +314,10 @@ export function mountApiRendersStreamRoute(opts) {
             // Lost race with render eviction (the pre-gate passed moments
             // ago) or a store failure inside the subscribe tail. Headers are
             // out, so no status rewrite — end the stream; the reconnect gets
-            // the authoritative pre-gate verdict.
+            // the authoritative pre-gate verdict. A tail that failed after
+            // registering has already unregistered its subscriber and ended
+            // the sink with `internal_error` (ggui#1528); `teardown` has no
+            // handle to add, and a second `end` is a no-op.
             logger.warn("sse_attach_failed", { sessionId, error: String(err) });
             teardown();
             sink.end("service_restart");

package/dist/build-mcp.d.ts

@@ -13,12 +13,28 @@ import { type ZodRawShape } from 'zod';
 import { type HandlerContext, type SharedHandler } from '@ggui-ai/mcp-server-handlers';
 import type { Logger } from './logger.js';
 import { type LoadingIndicatorOption, type GguiRenderResourceTemplateOptions } from './mcp-apps-outbound.js';
+import { type ViewProofGate } from './view-proof-gate.js';
 export interface ServerInfo {
     readonly name: string;
     readonly version: string;
     readonly description?: string;
 }
 export interface BuildMcpServerOptions {
+    /**
+     * The view-origin proof's measuring gate (ggui#1415), built once per
+     * server with the secret its ws envelopes are signed with. For a tool
+     * that declares a view proof, the gate verifies the call's proof before
+     * the handler runs, puts the verdict on the handler's context and names
+     * it on the `tool_invoked` line. It never refuses or fails a call.
+     * Absent: a declared call's line says `viewProofUnverifiable: true`.
+     */
+    readonly viewProofGate?: ViewProofGate;
+    /**
+     * Whether this mount's read door (`resources/read` of a render
+     * locator) may issue a view key (ggui#1415). Set only for the data
+     * plane, the mount that delivers a view to an app-credentialed caller.
+     */
+    readonly issueViewKeys?: boolean;
     /**
      * When set, register the MCP Apps outbound wiring on every fresh
      * server instance — advertises the `io.modelcontextprotocol/ui`

package/dist/build-mcp.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"build-mcp.d.ts","sourceRoot":"","sources":["../src/build-mcp.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,OAAO,EAAE,SAAS,EAAE,MAAM,yCAAyC,CAAC;AAIpE,OAAO,EAAK,KAAK,WAAW,EAAE,MAAM,KAAK,CAAC;AAC1C,OAAO,EAEL,KAAK,cAAc,EACnB,KAAK,aAAa,EACnB,MAAM,8BAA8B,CAAC;AACtC,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,aAAa,CAAC;AAE1C,OAAO,EACL,KAAK,sBAAsB,EAE3B,KAAK,iCAAiC,EACvC,MAAM,wBAAwB,CAAC;AAEhC,MAAM,WAAW,UAAU;IACzB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAC;CAC/B;AAED,MAAM,WAAW,qBAAqB;IACpC;;;;;;;;;;OAUG;IACH,QAAQ,CAAC,eAAe,CAAC,EAAE,OAAO,CAAC;IACnC;;;;OAIG;IACH,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC;IAC5B,8DAA8D;IAC9D,QAAQ,CAAC,gBAAgB,CAAC,EAAE,sBAAsB,CAAC;IACnD;;;;;;;;;;OAUG;IACH,QAAQ,CAAC,aAAa,CAAC,EAAE,iCAAiC,CAAC;IAC3D;;;;;;;;;OASG;IACH,QAAQ,CAAC,aAAa,CAAC,EAAE,MAAM,CAAC;IAChC;;;;;;;;OAQG;IACH,QAAQ,CAAC,gBAAgB,CAAC,EAAE,SAAS,CAAC,MAAM,GAAG,SAAS,CAAC,EAAE,CAAC;IAC5D;;;;;;;;;;;;;;;;;;OAkBG;IACH,QAAQ,CAAC,YAAY,CAAC,EAAE,aAAa,CAAC,KAAK,GAAG,MAAM,GAAG,SAAS,CAAC,CAAC;IAElE;;;;;;;;;;;;;;OAcG;IACH,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM,CAAC;IAE/B;;;;;;;;;;;;;;;;;;OAkBG;IACH,QAAQ,CAAC,cAAc,CAAC,EAAE,aAAa,CAAC,CAAC,MAAM,EAAE,SAAS,KAAK,IAAI,CAAC,CAAC;IAErE;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OAoCG;IACH,QAAQ,CAAC,kBAAkB,CAAC,EAAE,OAAO,CAAC;CACvC;AA4MD,wBAAgB,cAAc,CAC5B,IAAI,EAAE,UAAU,EAChB,QAAQ,EAAE,aAAa,CAAC,aAAa,CAAC,WAAW,EAAE,WAAW,CAAC,CAAC,EAChE,UAAU,EAAE,MAAM,cAAc,EAChC,MAAM,EAAE,MAAM,EACd,IAAI,GAAE,qBAA0B,GAC/B,SAAS,CAkQX"}
+{"version":3,"file":"build-mcp.d.ts","sourceRoot":"","sources":["../src/build-mcp.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,OAAO,EAAE,SAAS,EAAE,MAAM,yCAAyC,CAAC;AAIpE,OAAO,EAAK,KAAK,WAAW,EAAE,MAAM,KAAK,CAAC;AAC1C,OAAO,EAEL,KAAK,cAAc,EACnB,KAAK,aAAa,EACnB,MAAM,8BAA8B,CAAC;AACtC,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,aAAa,CAAC;AAE1C,OAAO,EACL,KAAK,sBAAsB,EAE3B,KAAK,iCAAiC,EACvC,MAAM,wBAAwB,CAAC;AAChC,OAAO,EAAoB,KAAK,aAAa,EAAE,MAAM,sBAAsB,CAAC;AAE5E,MAAM,WAAW,UAAU;IACzB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAC;CAC/B;AAED,MAAM,WAAW,qBAAqB;IACpC;;;;;;;OAOG;IACH,QAAQ,CAAC,aAAa,CAAC,EAAE,aAAa,CAAC;IACvC;;;;OAIG;IACH,QAAQ,CAAC,aAAa,CAAC,EAAE,OAAO,CAAC;IACjC;;;;;;;;;;OAUG;IACH,QAAQ,CAAC,eAAe,CAAC,EAAE,OAAO,CAAC;IACnC;;;;OAIG;IACH,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC;IAC5B,8DAA8D;IAC9D,QAAQ,CAAC,gBAAgB,CAAC,EAAE,sBAAsB,CAAC;IACnD;;;;;;;;;;OAUG;IACH,QAAQ,CAAC,aAAa,CAAC,EAAE,iCAAiC,CAAC;IAC3D;;;;;;;;;OASG;IACH,QAAQ,CAAC,aAAa,CAAC,EAAE,MAAM,CAAC;IAChC;;;;;;;;OAQG;IACH,QAAQ,CAAC,gBAAgB,CAAC,EAAE,SAAS,CAAC,MAAM,GAAG,SAAS,CAAC,EAAE,CAAC;IAC5D;;;;;;;;;;;;;;;;;;OAkBG;IACH,QAAQ,CAAC,YAAY,CAAC,EAAE,aAAa,CAAC,KAAK,GAAG,MAAM,GAAG,SAAS,CAAC,CAAC;IAElE;;;;;;;;;;;;;;OAcG;IACH,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM,CAAC;IAE/B;;;;;;;;;;;;;;;;;;OAkBG;IACH,QAAQ,CAAC,cAAc,CAAC,EAAE,aAAa,CAAC,CAAC,MAAM,EAAE,SAAS,KAAK,IAAI,CAAC,CAAC;IAErE;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OAoCG;IACH,QAAQ,CAAC,kBAAkB,CAAC,EAAE,OAAO,CAAC;CACvC;AAqPD,wBAAgB,cAAc,CAC5B,IAAI,EAAE,UAAU,EAChB,QAAQ,EAAE,aAAa,CAAC,aAAa,CAAC,WAAW,EAAE,WAAW,CAAC,CAAC,EAChE,UAAU,EAAE,MAAM,cAAc,EAChC,MAAM,EAAE,MAAM,EACd,IAAI,GAAE,qBAA0B,GAC/B,SAAS,CAkSX"}

package/dist/build-mcp.js

@@ -15,6 +15,7 @@ import { z } from 'zod';
 import { isHandlerFailure, } from '@ggui-ai/mcp-server-handlers';
 import { GGUI_RENDER_RESOURCE_URI } from '@ggui-ai/protocol/integrations/mcp-apps';
 import { installMcpAppsOutbound, } from './mcp-apps-outbound.js';
+import { runViewProofGate } from './view-proof-gate.js';
 /**
  * Build a fresh MCP server with every handler registered.
  *
@@ -100,8 +101,10 @@ function classifyFailurePayload(payload) {
     };
 }
 /**
- * Per-session fields on the `tool_invoked` line of the three session-keyed
- * runtime tools (ggui#1377 for pull; ggui#1395 for consume and submit).
+ * Per-session fields on the `tool_invoked` line of the session-keyed tools:
+ * the three runtime tools (ggui#1377 for pull; ggui#1395 for consume and
+ * submit) and the mutation and render tools (ggui#1474 — amend, update,
+ * render), so an instrument joins a reaction to its tap by session.
  *
  * In a composition that wires no logger into these handlers, this line is
  * their whole trace. ggui#1376 had to be read per app and minute; these
@@ -111,7 +114,7 @@ function classifyFailurePayload(payload) {
  * never a spread.
  *
  * What a `sessionId` on a SUCCESS line proves, per tool — never raw caller
- * input in any of the three:
+ * input in any of them:
  *   - pull and consume: a session the caller's app owns. Both throw on an
  *     unknown or cross-app session before they return (the visibility gate),
  *     so every success line of theirs qualifies.
@@ -122,23 +125,59 @@ function classifyFailurePayload(payload) {
  *     so the claim stops there. An audit kind (`openLink`,
  *     `requestDisplayMode`, an extension kind) touches no pipe and carries no
  *     session at all: its `sessionId` was never read by anything.
+ *   - amend and update: a session the caller's app owns, read from the
+ *     OUTPUT. Both run the shared mutation core, which app-scope-gates the
+ *     session (`renderStore.get` + an `appId` match) and throws
+ *     `GguiSessionNotFoundError` on a missing or cross-app one before any
+ *     return — so the output's `sessionId` is the gated one, including when
+ *     an in-process caller threads it through the context rather than the
+ *     input.
+ *   - render: the session id this call MINTED for the caller's app, read
+ *     from the OUTPUT (never caller input — render's input names no
+ *     session). A `rendered` result carries it, and so does a `failed` one
+ *     (on the in-result failure line); a `refused` result mints none. It
+ *     proves the id is this call's, NOT that a row backs it: the handler
+ *     swallows a render-store commit rejection (the placeholder, probe,
+ *     cache-hit and error-record commits, and the cold-generation success
+ *     commit, which then answers `failed`), so on those paths the id names
+ *     no row, or only a provisional placeholder — the claim stops there,
+ *     and a consumer that needs the row reads it from the store.
  *
  * Consume adds `eventCount`, `status`, `timeoutS` (the requested timeout; 0
  * when omitted, the handler's own default) and `aborted: true` when the
  * request's signal is aborted by the time the line is written — a superset
  * of "cancelled mid-poll", read at log time, never a false negative. A
  * committed dispatch adds `consumerPresent`, the doorbell's gate.
+ *
+ * `ggui_runtime_sync_context` is not a session tool here: a refused sync's
+ * session is only claimed. Its line names a refusal (`ok: false` and the
+ * `code`) and nothing else from this function. A tool that declares a view
+ * proof (ggui#1415) also carries the measuring gate's fields and
+ * `authSource` on every one of its lines (`view-proof-gate.ts`).
  */
 const SESSION_TOOLS = new Set([
     'ggui_runtime_pull',
     'ggui_consume',
     'ggui_runtime_submit_action',
+    'ggui_amend',
+    'ggui_update',
+    'ggui_render',
 ]);
+/** ggui#1474 — session tools whose logged session is the OUTPUT's (the gated or committed one), not the input's. */
+const OUTPUT_SESSION_TOOLS = new Set(['ggui_amend', 'ggui_update', 'ggui_render']);
 function sessionFields(tool, input, output, ctx) {
+    // ggui#1415: a sync names its refusal (`ok: false` and the code) so a
+    // refused call is countable. Its session is not logged as owned: a
+    // refused call's session is only claimed (the gate's `claimedSessionId`).
+    if (tool === 'ggui_runtime_sync_context') {
+        if (output['ok'] === true)
+            return {};
+        return typeof output['code'] === 'string' ? { ok: false, code: output['code'] } : { ok: false };
+    }
     if (!SESSION_TOOLS.has(tool))
         return {};
-    const sessionId = input['sessionId'];
-    if (typeof sessionId !== 'string')
+    const sessionId = OUTPUT_SESSION_TOOLS.has(tool) ? output['sessionId'] : input['sessionId'];
+    if (typeof sessionId !== 'string' || sessionId === '')
         return {};
     if (tool === 'ggui_runtime_submit_action') {
         if (input['kind'] !== 'dispatch')
@@ -168,8 +207,10 @@ function sessionFields(tool, input, output, ctx) {
 /** Bound on `claimedSessionId`: a real id is a UUID; anything longer is not one. */
 const CLAIMED_SESSION_ID_MAX_CHARS = 128;
 /**
- * The caller's CLAIMED session on an `outcome: 'error'` line of the same
- * three tools (ggui#1395). A refused consume — unknown or cross-app
+ * The caller's CLAIMED session on an `outcome: 'error'` line of the session
+ * tools (ggui#1395; amend and update since ggui#1474). Render's input schema
+ * declares no `sessionId` and the MCP SDK strips undeclared keys before the
+ * handler runs, so a render line never carries a claim. A refused consume — unknown or cross-app
  * session, the visibility gate — is the one failure of the tap → consume
  * chain that is otherwise invisible per session. It is raw caller input,
  * the first on this line: named as a claim so it never reads as an owned
@@ -191,12 +232,14 @@ function claimedSessionField(tool, input) {
     };
 }
 export function buildMcpServer(info, handlers, getContext, logger, opts = {}) {
+    // `instructions` is a ServerOptions field (the SECOND argument): the
+    // SDK sends it in the `initialize` result. In the first argument (the
+    // Implementation) it was dropped, and no host ever received it (ggui#1579).
     const server = new McpServer({
         name: info.name,
         version: info.version,
         ...(info.description ? { description: info.description } : {}),
-        ...(opts.instructions ? { instructions: opts.instructions } : {}),
-    });
+    }, opts.instructions ? { instructions: opts.instructions } : undefined);
     // Content-addressed shell URI (stale-shell bust) — when MCP Apps
     // outbound wiring registers the shell, declarations advertising the
     // BARE `ui://ggui/render` are rewritten to the versioned twin below
@@ -212,9 +255,16 @@ export function buildMcpServer(info, handlers, getContext, logger, opts = {}) {
             // Thread the same per-request context accessor + logger the tool
             // path uses (`getContext`, param 3 of `buildMcpServer`) so the
             // per-session resource handler's render-read gate sees the
-            // caller (render-read-gate.ts).
+            // caller (`renderReadAllowed`, @ggui-ai/mcp-server-handlers/renders).
             ...(opts.selfContained !== undefined
-                ? { selfContained: { ...opts.selfContained, getContext, logger } }
+                ? {
+                    selfContained: {
+                        ...opts.selfContained,
+                        getContext,
+                        logger,
+                        ...(opts.issueViewKeys === true ? { issueViewKeys: true } : {}),
+                    },
+                }
                 : {}),
             ...(opts.publicBaseUrl !== undefined
                 ? { publicBaseUrl: opts.publicBaseUrl }
@@ -265,12 +315,24 @@ export function buildMcpServer(info, handlers, getContext, logger, opts = {}) {
             // an object, so narrow with the validating predicate and DROP
             // anything else rather than asserting.
             const requestMeta = extra?._meta;
-            const ctx = {
+            const requestCtx = {
                 ...baseCtx,
                 ...(isRecord(requestMeta) ? { requestMeta } : {}),
                 ...(extra?.signal !== undefined ? { signal: extra.signal } : {}),
             };
             const start = Date.now();
+            // ggui#1415: the measuring gate. For a tool that declares a view
+            // proof it verifies the proof, puts the verdict (and the request's
+            // row-read memo) on the context and returns the line's proof fields.
+            // Total: it never throws and never changes the handler's answer.
+            const gated = await runViewProofGate(opts.viewProofGate, handler, input, requestCtx);
+            const ctx = gated.ctx;
+            const proofFields = {
+                ...gated.fields,
+                ...(ctx.authSource !== undefined && (handler.viewProof !== undefined || handler.name === 'ggui_runtime_declare_tool_catalog')
+                    ? { authSource: ctx.authSource }
+                    : {}),
+            };
             try {
                 const data = await handler.handler(input, ctx);
                 // First-class in-result failure channel. A handler that
@@ -293,6 +355,7 @@ export function buildMcpServer(info, handlers, getContext, logger, opts = {}) {
                         // malformed-row refusal, ggui#839), so its session is owned and
                         // the per-session fields apply (ggui#1395).
                         ...sessionFields(handler.name, input, validated, ctx),
+                        ...proofFields,
                         elapsedMs: Date.now() - start,
                     });
                     return {
@@ -315,6 +378,7 @@ export function buildMcpServer(info, handlers, getContext, logger, opts = {}) {
                     appId: ctx.appId,
                     outcome: 'success',
                     ...sessionFields(handler.name, input, validated, ctx),
+                    ...proofFields,
                     elapsedMs: Date.now() - start,
                 });
                 // When the handler's output carries a `nextStep`, lead the
@@ -343,6 +407,11 @@ export function buildMcpServer(info, handlers, getContext, logger, opts = {}) {
                 const gestureHint = nextStepHint !== undefined && nextStepHint.includes('ggui_consume')
                     ? nextStepHint
                     : undefined;
+                // The consume → amend hint (ggui#1399 step 2) rides `nextStep` in
+                // the structured result only, with NO plain-text lead (ggui#1397):
+                // a lead ("repaint … then re-call ggui_consume") was measured as the
+                // carrier of informational taps left unanswered on gpt-6-luna, and
+                // removing it held every repaint. Probes 3 and 4 are on #1397.
                 return {
                     structuredContent: validated,
                     content: [
@@ -375,6 +444,7 @@ export function buildMcpServer(info, handlers, getContext, logger, opts = {}) {
                     outcome: 'error',
                     errorClass: errorClassName(err),
                     ...claimedSessionField(handler.name, input),
+                    ...proofFields,
                     elapsedMs: Date.now() - start,
                 });
                 throw err;