@ggui-ai/mcp-server 0.24.0 → 0.26.0

package/dist/view-proof-gate.d.ts

@@ -0,0 +1,96 @@
+/**
+ * The view-origin proof's measuring gate (ggui#1415, release N): for a tool
+ * that declares a view proof, verify the call's proof before the handler
+ * runs, put the verdict on the handler context, and name it on the
+ * `tool_invoked` line. It never refuses a call and never fails one: at this
+ * release the proof is measured, not enforced.
+ *
+ * Built once per server (`createViewProofGate`, holding the secret the ws
+ * envelopes are signed with) and run per call (`runViewProofGate`) from
+ * `buildMcpServer`'s per-tool callback.
+ */
+import { ViewProofRepeatCache, type GguiSessionStore, type ViewProofVerdict, type VerifyViewProofInput } from '@ggui-ai/mcp-server-core';
+import { type HandlerContext, type SharedHandler } from '@ggui-ai/mcp-server-handlers';
+import { type ViewRootSrc } from '@ggui-ai/protocol/integrations/mcp-apps';
+import type { ZodRawShape } from 'zod';
+/**
+ * Which era a call's session belongs to, for a `required` call whose proof
+ * is not valid; the first match wins. `row_absent`: no store, no row, or
+ * the read failed. `foreign`: another app owns the row. `unkeyed`: the
+ * session's ids are too long for a view key. `legacy`: created before
+ * `keyedSince`, or `keyedSince` is unset. `current`: everything else.
+ */
+export type ViewProofEra = 'current' | 'legacy' | 'unkeyed' | 'foreign' | 'row_absent';
+/** How old the proof's root is on the server's clock (`now − rootIat`). */
+export type ViewProofRootAge = 'lt_3m' | 'lt_1h' | 'lt_1d' | 'lt_7d' | 'lt_30d' | 'ge_30d';
+/**
+ * The view clock against the server's (`vtime − now`), bucketed at 30 s,
+ * 5 min and 1 h on each side. Relay latency makes it negative (`behind`),
+ * so `ahead` can only be the view's clock running ahead.
+ */
+export type ViewProofSkew = 'behind_ge_1h' | 'behind_lt_1h' | 'behind_lt_5m' | 'within_30s' | 'ahead_lt_5m' | 'ahead_lt_1h' | 'ahead_ge_1h';
+/**
+ * The proof's fields on a `tool_invoked` line: ids, flags and buckets only.
+ * Never the proof, its root, its nonce, its tags, the view key or any
+ * argument.
+ */
+export interface ViewProofLineFields {
+    readonly viewProof?: ViewProofVerdict['verdict'];
+    readonly viewProofReason?: string;
+    readonly viewProofErrorClass?: string;
+    /** Valid only: the session the proof's root names (it equals the call's). */
+    readonly viewProofSessionId?: string;
+    /** Not valid: the call's session as the caller claims it, capped. */
+    readonly claimedSessionId?: string;
+    readonly claimedSessionIdTruncated?: true;
+    readonly viewProofRootAge?: ViewProofRootAge;
+    readonly viewProofRootSrc?: ViewRootSrc;
+    readonly viewProofSkew?: ViewProofSkew;
+    /** Dispatch only: the gesture's user-activation flag, self-asserted by any key holder. */
+    readonly viewProofActivation?: boolean;
+    /** This replica saw the same `(session, nonce)` within the repeat window. */
+    readonly viewProofRepeat?: true;
+    readonly viewProofEra?: ViewProofEra;
+    /** The tool declares a proof and the server has no verifier. */
+    readonly viewProofUnverifiable?: true;
+}
+/** A server's gate: its verifier, and what it reads to classify an era. */
+export interface ViewProofGate {
+    verify(input: VerifyViewProofInput): ViewProofVerdict;
+    /** Whether a session's ids fit a view key's root. */
+    keyable(sessionId: string, appId: string): boolean;
+    readonly sessionStore: GguiSessionStore | undefined;
+    /** Epoch ms from which every replica of this deployment issues view keys. */
+    readonly keyedSince: number | undefined;
+    readonly repeatCache: ViewProofRepeatCache;
+    now(): number;
+}
+export interface CreateViewProofGateOptions {
+    /** The secret the server's ws envelopes are signed with. */
+    readonly secret: string;
+    readonly sessionStore: GguiSessionStore | undefined;
+    readonly keyedSince?: number;
+    readonly now?: () => number;
+}
+/** Build a server's gate once; the secret stays in its closures. */
+export declare function createViewProofGate(opts: CreateViewProofGateOptions): ViewProofGate;
+/**
+ * Refuse, at boot, a handler that declares a view proof on a tool the
+ * proof's bound-argument table does not name: no view can sign a call to
+ * it, so every call would read `missing` for a reason no one could find.
+ */
+export declare function assertViewProofDeclarations(handlers: ReadonlyArray<Pick<SharedHandler<ZodRawShape, ZodRawShape>, 'name' | 'viewProof'>>): void;
+/** The tools whose declared proof a server without a verifier cannot check. */
+export declare function unverifiableViewProofTools(handlers: ReadonlyArray<Pick<SharedHandler<ZodRawShape, ZodRawShape>, 'name' | 'viewProof'>>): string[];
+/** What the gate hands back: the context the handler runs with, and the line fields. */
+export interface ViewProofGateResult {
+    readonly ctx: HandlerContext;
+    readonly fields: ViewProofLineFields;
+}
+/**
+ * Run the gate for one call. `gate` is undefined on a server with no
+ * verifier. Total: it never throws, and never changes what the handler
+ * answers; a declaration it cannot read leaves the call as it came.
+ */
+export declare function runViewProofGate(gate: ViewProofGate | undefined, handler: Pick<SharedHandler<ZodRawShape, ZodRawShape>, 'name' | 'viewProof'>, input: Record<string, unknown>, ctx: HandlerContext): Promise<ViewProofGateResult>;
+//# sourceMappingURL=view-proof-gate.d.ts.map

package/dist/view-proof-gate.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"view-proof-gate.d.ts","sourceRoot":"","sources":["../src/view-proof-gate.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AACH,OAAO,EACL,oBAAoB,EAGpB,KAAK,gBAAgB,EACrB,KAAK,gBAAgB,EACrB,KAAK,oBAAoB,EAC1B,MAAM,0BAA0B,CAAC;AAClC,OAAO,EAGL,KAAK,cAAc,EACnB,KAAK,aAAa,EAEnB,MAAM,8BAA8B,CAAC;AACtC,OAAO,EAAmB,KAAK,WAAW,EAAE,MAAM,yCAAyC,CAAC;AAC5F,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,KAAK,CAAC;AAEvC;;;;;;GAMG;AACH,MAAM,MAAM,YAAY,GAAG,SAAS,GAAG,QAAQ,GAAG,SAAS,GAAG,SAAS,GAAG,YAAY,CAAC;AAEvF,2EAA2E;AAC3E,MAAM,MAAM,gBAAgB,GAAG,OAAO,GAAG,OAAO,GAAG,OAAO,GAAG,OAAO,GAAG,QAAQ,GAAG,QAAQ,CAAC;AAE3F;;;;GAIG;AACH,MAAM,MAAM,aAAa,GACrB,cAAc,GACd,cAAc,GACd,cAAc,GACd,YAAY,GACZ,aAAa,GACb,aAAa,GACb,aAAa,CAAC;AAElB;;;;GAIG;AACH,MAAM,WAAW,mBAAmB;IAClC,QAAQ,CAAC,SAAS,CAAC,EAAE,gBAAgB,CAAC,SAAS,CAAC,CAAC;IACjD,QAAQ,CAAC,eAAe,CAAC,EAAE,MAAM,CAAC;IAClC,QAAQ,CAAC,mBAAmB,CAAC,EAAE,MAAM,CAAC;IACtC,6EAA6E;IAC7E,QAAQ,CAAC,kBAAkB,CAAC,EAAE,MAAM,CAAC;IACrC,qEAAqE;IACrE,QAAQ,CAAC,gBAAgB,CAAC,EAAE,MAAM,CAAC;IACnC,QAAQ,CAAC,yBAAyB,CAAC,EAAE,IAAI,CAAC;IAC1C,QAAQ,CAAC,gBAAgB,CAAC,EAAE,gBAAgB,CAAC;IAC7C,QAAQ,CAAC,gBAAgB,CAAC,EAAE,WAAW,CAAC;IACxC,QAAQ,CAAC,aAAa,CAAC,EAAE,aAAa,CAAC;IACvC,0FAA0F;IAC1F,QAAQ,CAAC,mBAAmB,CAAC,EAAE,OAAO,CAAC;IACvC,6EAA6E;IAC7E,QAAQ,CAAC,eAAe,CAAC,EAAE,IAAI,CAAC;IAChC,QAAQ,CAAC,YAAY,CAAC,EAAE,YAAY,CAAC;IACrC,gEAAgE;IAChE,QAAQ,CAAC,qBAAqB,CAAC,EAAE,IAAI,CAAC;CACvC;AAED,2EAA2E;AAC3E,MAAM,WAAW,aAAa;IAC5B,MAAM,CAAC,KAAK,EAAE,oBAAoB,GAAG,gBAAgB,CAAC;IACtD,qDAAqD;IACrD,OAAO,CAAC,SAAS,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC;IACnD,QAAQ,CAAC,YAAY,EAAE,gBAAgB,GAAG,SAAS,CAAC;IACpD,6EAA6E;IAC7E,QAAQ,CAAC,UAAU,EAAE,MAAM,GAAG,SAAS,CAAC;IACxC,QAAQ,CAAC,WAAW,EAAE,oBAAoB,CAAC;IAC3C,GAAG,IAAI,MAAM,CAAC;CACf;AAED,MAAM,WAAW,0BAA0B;IACzC,4DAA4D;IAC5D,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,YAAY,EAAE,gBAAgB,GAAG,SAAS,CAAC;IACpD,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,GAAG,CAAC,EAAE,MAAM,MAAM,CAAC;CAC7B;AAED,oEAAoE;AACpE,wBAAgB,mBAAmB,CAAC,IAAI,EAAE,0BAA0B,GAAG,aAAa,CAWnF;AAED;;;;GAIG;AACH,wBAAgB,2BAA2B,CACzC,QAAQ,EAAE,aAAa,CAAC,IAAI,CAAC,aAAa,CAAC,WAAW,EAAE,WAAW,CAAC,EAAE,MAAM,GAAG,WAAW,CAAC,CAAC,GAC3F,IAAI,CAON;AAED,+EAA+E;AAC/E,wBAAgB,0BAA0B,CACxC,QAAQ,EAAE,aAAa,CAAC,IAAI,CAAC,aAAa,CAAC,WAAW,EAAE,WAAW,CAAC,EAAE,MAAM,GAAG,WAAW,CAAC,CAAC,GAC3F,MAAM,EAAE,CAEV;AAwDD,wFAAwF;AACxF,MAAM,WAAW,mBAAmB;IAClC,QAAQ,CAAC,GAAG,EAAE,cAAc,CAAC;IAC7B,QAAQ,CAAC,MAAM,EAAE,mBAAmB,CAAC;CACtC;AAED;;;;GAIG;AACH,wBAAsB,gBAAgB,CACpC,IAAI,EAAE,aAAa,GAAG,SAAS,EAC/B,OAAO,EAAE,IAAI,CAAC,aAAa,CAAC,WAAW,EAAE,WAAW,CAAC,EAAE,MAAM,GAAG,WAAW,CAAC,EAC5E,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAC9B,GAAG,EAAE,cAAc,GAClB,OAAO,CAAC,mBAAmB,CAAC,CA+C9B"}

package/dist/view-proof-gate.js

@@ -0,0 +1,167 @@
+/**
+ * The view-origin proof's measuring gate (ggui#1415, release N): for a tool
+ * that declares a view proof, verify the call's proof before the handler
+ * runs, put the verdict on the handler context, and name it on the
+ * `tool_invoked` line. It never refuses a call and never fails one: at this
+ * release the proof is measured, not enforced.
+ *
+ * Built once per server (`createViewProofGate`, holding the secret the ws
+ * envelopes are signed with) and run per call (`runViewProofGate`) from
+ * `buildMcpServer`'s per-tool callback.
+ */
+import { ViewProofRepeatCache, mintViewRoot, verifyViewProof, } from '@ggui-ai/mcp-server-core';
+import { createSessionRowReads, viewProofUseFor, } from '@ggui-ai/mcp-server-handlers';
+import { isViewProofTool } from '@ggui-ai/protocol/integrations/mcp-apps';
+/** Build a server's gate once; the secret stays in its closures. */
+export function createViewProofGate(opts) {
+    const now = opts.now ?? Date.now;
+    return {
+        verify: (input) => verifyViewProof(input, opts.secret),
+        keyable: (sessionId, appId) => mintViewRoot({ sessionId, appId, src: 'result' }, opts.secret).viewKey !== undefined,
+        sessionStore: opts.sessionStore,
+        keyedSince: opts.keyedSince,
+        repeatCache: new ViewProofRepeatCache(10 * 60 * 1000, 10_000, now),
+        now,
+    };
+}
+/**
+ * Refuse, at boot, a handler that declares a view proof on a tool the
+ * proof's bound-argument table does not name: no view can sign a call to
+ * it, so every call would read `missing` for a reason no one could find.
+ */
+export function assertViewProofDeclarations(handlers) {
+    const unbound = handlers.filter((h) => h.viewProof !== undefined && !isViewProofTool(h.name)).map((h) => h.name);
+    if (unbound.length > 0) {
+        throw new Error(`A view proof is declared on ${unbound.join(', ')}, which the view proof's bound-argument table does not name, so no view can sign a call to it. Remove the declaration, or add the tool to the table in @ggui-ai/protocol.`);
+    }
+}
+/** The tools whose declared proof a server without a verifier cannot check. */
+export function unverifiableViewProofTools(handlers) {
+    return handlers.filter((h) => h.viewProof !== undefined).map((h) => h.name);
+}
+const CLAIMED_SESSION_ID_MAX_CHARS = 128;
+const SECOND = 1000;
+const MINUTE = 60 * SECOND;
+const HOUR = 60 * MINUTE;
+const DAY = 24 * HOUR;
+function rootAge(ageMs) {
+    if (ageMs < 3 * MINUTE)
+        return 'lt_3m';
+    if (ageMs < HOUR)
+        return 'lt_1h';
+    if (ageMs < DAY)
+        return 'lt_1d';
+    if (ageMs < 7 * DAY)
+        return 'lt_7d';
+    if (ageMs < 30 * DAY)
+        return 'lt_30d';
+    return 'ge_30d';
+}
+function skew(deltaMs) {
+    const size = Math.abs(deltaMs);
+    if (size < 30 * SECOND)
+        return 'within_30s';
+    const side = deltaMs < 0 ? 'behind' : 'ahead';
+    if (size < 5 * MINUTE)
+        return `${side}_lt_5m`;
+    if (size < HOUR)
+        return `${side}_lt_1h`;
+    return `${side}_ge_1h`;
+}
+function claimed(sessionId) {
+    if (sessionId === '')
+        return {};
+    if (sessionId.length <= CLAIMED_SESSION_ID_MAX_CHARS)
+        return { claimedSessionId: sessionId };
+    return { claimedSessionId: sessionId.slice(0, CLAIMED_SESSION_ID_MAX_CHARS), claimedSessionIdTruncated: true };
+}
+async function classifyEra(gate, ctx, sessionId) {
+    const store = gate.sessionStore;
+    if (store === undefined || ctx.sessionRows === undefined)
+        return 'row_absent';
+    let row;
+    try {
+        row = await ctx.sessionRows.read(store, sessionId);
+    }
+    catch {
+        // A failed read is `row_absent`. The handler reads the same memoized
+        // rejection and names the failure on its own ownership line.
+        return 'row_absent';
+    }
+    if (row === null)
+        return 'row_absent';
+    if (row.appId !== ctx.appId)
+        return 'foreign';
+    if (!gate.keyable(sessionId, row.appId))
+        return 'unkeyed';
+    if (gate.keyedSince === undefined)
+        return 'legacy';
+    // A component or system render's creation time is epoch ms; an embedded
+    // MCP App's is an ISO string. One this server cannot read is `legacy`,
+    // the era that is accepted for life.
+    const createdAt = row.render.createdAt;
+    const createdMs = typeof createdAt === 'number' ? createdAt : Date.parse(createdAt);
+    if (!Number.isFinite(createdMs) || createdMs < gate.keyedSince)
+        return 'legacy';
+    return 'current';
+}
+/**
+ * Run the gate for one call. `gate` is undefined on a server with no
+ * verifier. Total: it never throws, and never changes what the handler
+ * answers; a declaration it cannot read leaves the call as it came.
+ */
+export async function runViewProofGate(gate, handler, input, ctx) {
+    let use;
+    try {
+        use = viewProofUseFor(handler.viewProof, input);
+    }
+    catch (err) {
+        return {
+            ctx,
+            fields: { viewProof: 'invalid', viewProofReason: 'verifier_error', viewProofErrorClass: errorName(err) },
+        };
+    }
+    if (use === undefined)
+        return { ctx, fields: {} };
+    if (gate === undefined)
+        return { ctx, fields: { viewProofUnverifiable: true } };
+    const toolName = handler.name;
+    if (!isViewProofTool(toolName))
+        return { ctx, fields: { viewProofUnverifiable: true } };
+    const sessionId = typeof input['sessionId'] === 'string' ? input['sessionId'] : '';
+    const verdict = gate.verify({ requestMeta: ctx.requestMeta, toolName, args: input, sessionId, appId: ctx.appId });
+    const withProof = { ...ctx, viewProof: verdict, sessionRows: ctx.sessionRows ?? createSessionRowReads() };
+    if (verdict.verdict === 'valid') {
+        const t = gate.now();
+        return {
+            ctx: withProof,
+            fields: {
+                viewProof: 'valid',
+                viewProofSessionId: sessionId,
+                viewProofRootAge: rootAge(t - verdict.rootIat * SECOND),
+                ...(verdict.src !== undefined ? { viewProofRootSrc: verdict.src } : {}),
+                viewProofSkew: skew(verdict.vtime - t),
+                ...(toolName === 'ggui_runtime_submit_action' && input['kind'] === 'dispatch'
+                    ? { viewProofActivation: verdict.userActivation }
+                    : {}),
+                ...(gate.repeatCache.observe(sessionId, verdict.nonce) ? { viewProofRepeat: true } : {}),
+            },
+        };
+    }
+    const era = use === 'required' ? await classifyEra(gate, withProof, sessionId) : undefined;
+    return {
+        ctx: withProof,
+        fields: {
+            viewProof: verdict.verdict,
+            viewProofReason: verdict.reason,
+            ...(verdict.verdict === 'invalid' && verdict.reason === 'verifier_error'
+                ? { viewProofErrorClass: verdict.errorClass }
+                : {}),
+            ...claimed(sessionId),
+            ...(era !== undefined ? { viewProofEra: era } : {}),
+        },
+    };
+}
+function errorName(err) {
+    return (err instanceof Error ? err.name : typeof err).slice(0, 64);
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ggui-ai/mcp-server",
-  "version": "0.24.0",
+  "version": "0.26.0",
   "description": "Self-hosted MCP server for the ggui protocol. An HTTP/MCP binding layer over @ggui-ai/mcp-server-handlers and the reference adapters from @ggui-ai/mcp-server-core — run it via `ggui serve`.",
   "keywords": [
     "ggui",
@@ -28,30 +28,29 @@
     "@modelcontextprotocol/ext-apps": "^1.7.2",
     "@modelcontextprotocol/sdk": "^1.27.0",
     "express": "^5.2.1",
-    "nodemailer": "^9.1.1",
+    "nodemailer": "^10.0.13",
     "resend": "^6.12.2",
     "ws": "^8.20.1",
     "zod": "^4.3.6",
-    "@ggui-ai/console": "0.24.0",
-    "@ggui-ai/design": "0.24.0",
-    "@ggui-ai/iframe-runtime": "0.24.0",
-    "@ggui-ai/mcp-server-core": "0.24.0",
-    "@ggui-ai/mcp-server-handlers": "0.24.0",
-    "@ggui-ai/negotiator": "0.24.0",
-    "@ggui-ai/preview-a2ui": "0.24.0",
-    "@ggui-ai/project-config": "0.24.0",
-    "@ggui-ai/protocol": "0.24.0",
-    "@ggui-ai/ui-gen": "0.24.0",
-    "@ggui-ai/ui-registry": "0.24.0"
+    "@ggui-ai/console": "0.26.0",
+    "@ggui-ai/design": "0.26.0",
+    "@ggui-ai/mcp-server-core": "0.26.0",
+    "@ggui-ai/iframe-runtime": "0.26.0",
+    "@ggui-ai/mcp-server-handlers": "0.26.0",
+    "@ggui-ai/negotiator": "0.26.0",
+    "@ggui-ai/preview-a2ui": "0.26.0",
+    "@ggui-ai/project-config": "0.26.0",
+    "@ggui-ai/protocol": "0.26.0",
+    "@ggui-ai/ui-registry": "0.26.0",
+    "@ggui-ai/ui-gen": "0.26.0"
   },
   "devDependencies": {
     "@types/express": "^5.0.0",
     "@types/node": "^22.0.0",
-    "@types/nodemailer": "^8.0.0",
     "@types/ws": "^8.5.10",
     "typescript": "^5.0.0",
     "vitest": "^3.2.6",
-    "@ggui-ai/protocol-conformance": "0.24.0"
+    "@ggui-ai/protocol-conformance": "0.26.0"
   },
   "repository": {
     "type": "git",

package/dist/render-read-gate.d.ts

@@ -1,50 +0,0 @@
-import type { HandlerContext } from "@ggui-ai/mcp-server-handlers";
-/** The two row fields the read gate consults. */
-export interface RenderReadRowView {
-    readonly appId: string;
-    /**
-     * The row's SUBJECT — the end user a render belongs to, written at
-     * commit and nowhere else.
-     *
-     * `userId` rather than the richer `endUserIdentity` block, and that
-     * is the whole of #446. The gate used to read `endUserIdentity`,
-     * which no writer has populated since the repo split deleted the one
-     * that did (`f99b81c28`) — so the subject rung has been reading a
-     * field that is always absent, and passing every caller through as
-     * "row has no subject". Reading `userId` binds the rung for the
-     * first time.
-     *
-     * Absent stays a legitimate state: builder and anonymous
-     * single-app flows mint rows with no subject, and those still
-     * pass rung 4.
-     */
-    readonly userId?: string;
-}
-/**
- * Per-session render-resource read gate (rehydration access control).
- *
- * Rungs, in order (spec §3):
- *  1. Fail closed without a request context.
- *  2. App boundary — the row's appId must equal the caller's.
- *  3. Subject binding — a caller carrying an end-user identity (kind
- *     'user', any auth source) reading a subject-bound row must BE
- *     that subject. The row's subject is its `userId`, written at
- *     commit; see {@link RenderReadRowView.userId} for why this rung
- *     only starts binding now.
- *  4. Everything else same-app passes: app credentials (app trust —
- *     the app is obligated to enforce its own user-ownership before
- *     fetching on a user's behalf), builder/anonymous single-app
- *     flows, and rows with no subject.
- *
- * Deny is surfaced by the CALLER byte-identically to a missing row —
- * reads must not oracle which sessionIds exist. This function only
- * returns the boolean; making the two indistinguishable is the caller's
- * obligation, and it is a real one, because "refused" and "never
- * existed" travel completely different code paths to get there. The
- * resource handler discharges it by collapsing a refusal to "absent"
- * and letting every downstream branch run as it would for a locator
- * that never existed, so both arrive at the same typed failure with the
- * same bytes.
- */
-export declare function renderReadAllowed(row: RenderReadRowView, ctx: HandlerContext | undefined): boolean;
-//# sourceMappingURL=render-read-gate.d.ts.map

package/dist/render-read-gate.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"render-read-gate.d.ts","sourceRoot":"","sources":["../src/render-read-gate.ts"],"names":[],"mappings":"AAMA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,8BAA8B,CAAC;AAEnE,iDAAiD;AACjD,MAAM,WAAW,iBAAiB;IAChC,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB;;;;;;;;;;;;;;;OAeG;IACH,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;CAC1B;AAED;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AACH,wBAAgB,iBAAiB,CAC/B,GAAG,EAAE,iBAAiB,EACtB,GAAG,EAAE,cAAc,GAAG,SAAS,GAC9B,OAAO,CAOT"}

package/dist/render-read-gate.js

@@ -1,36 +0,0 @@
-/**
- * Per-session render-resource read gate (rehydration access control).
- *
- * Rungs, in order (spec §3):
- *  1. Fail closed without a request context.
- *  2. App boundary — the row's appId must equal the caller's.
- *  3. Subject binding — a caller carrying an end-user identity (kind
- *     'user', any auth source) reading a subject-bound row must BE
- *     that subject. The row's subject is its `userId`, written at
- *     commit; see {@link RenderReadRowView.userId} for why this rung
- *     only starts binding now.
- *  4. Everything else same-app passes: app credentials (app trust —
- *     the app is obligated to enforce its own user-ownership before
- *     fetching on a user's behalf), builder/anonymous single-app
- *     flows, and rows with no subject.
- *
- * Deny is surfaced by the CALLER byte-identically to a missing row —
- * reads must not oracle which sessionIds exist. This function only
- * returns the boolean; making the two indistinguishable is the caller's
- * obligation, and it is a real one, because "refused" and "never
- * existed" travel completely different code paths to get there. The
- * resource handler discharges it by collapsing a refusal to "absent"
- * and letting every downstream branch run as it would for a locator
- * that never existed, so both arrive at the same typed failure with the
- * same bytes.
- */
-export function renderReadAllowed(row, ctx) {
-    if (ctx === undefined)
-        return false;
-    if (ctx.appId !== row.appId)
-        return false;
-    if (row.userId !== undefined && ctx.userId !== undefined) {
-        return ctx.userId === row.userId;
-    }
-    return true;
-}