@ggui-ai/mcp-server 0.24.0 → 0.26.0

package/dist/console-auth.d.ts

@@ -1,13 +1,13 @@
 /**
  * Embedded-ui cookie auth plane.
  *
- * This module owns the THIRD of the three token kinds the server
- * tracks for the embedded UI:
+ * This module owns the second of the two token kinds the server mints
+ * for the embedded UI (a third, the reconnect "session" token, is minted
+ * by no server since ggui#1488):
  *
- *   1. bootstrap tokens       — short-TTL, single-use, MCP Apps iframes.
- *   2. session tokens         — longer-TTL, reusable, post-bootstrap
- *                               reconnect creds.
- *   3. console cookies    — longer-TTL, reusable, same-origin
+ *   1. ws (bootstrap) tokens  — short-TTL, reusable within TTL, MCP Apps
+ *                               iframes.
+ *   2. console cookies    — longer-TTL, reusable, same-origin
  *                               browser-only, issued by this server
  *                               for ITS OWN console landing/viewer
  *                               pages. **Scoped narrowly**: consumed
@@ -17,10 +17,10 @@
  *                               `/threads`, or any other ingress.
  *
  * Isolation invariant (load-bearing). The cookie uses the SAME HMAC
- * shape as the bootstrap/session tokens but a distinct `kind` claim
+ * shape as the ws (bootstrap) token but a distinct `kind` claim
  * (`'console-session'`). That makes cross-kind confusion
- * impossible: a cookie value CAN'T verify as a bootstrap or session
- * token. Secrets are shared across kinds because they live in the
+ * impossible: a cookie value CAN'T verify as a ws token, nor any
+ * other kind as a cookie. Secrets are shared across kinds because they live in the
  * same trust domain (server-minted same-origin creds) and kind
  * discrimination is sufficient.
  *
@@ -63,7 +63,7 @@ export interface DevtoolCookieMint {
 export interface MintDevtoolCookieInput {
     readonly sessionId: string;
     readonly appId: string;
-    /** HMAC secret. Shared with bootstrap + session tokens by design. */
+    /** HMAC secret. Shared with the ws (bootstrap) tokens by design. */
     readonly secret: string;
     /** Cookie TTL in seconds. Defaults to 8 hours. */
     readonly ttlSec?: number;

package/dist/console-auth.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"console-auth.d.ts","sourceRoot":"","sources":["../src/console-auth.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAwCG;AACH,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,WAAW,CAAC;AAOrD;;;;;GAKG;AACH,eAAO,MAAM,mBAAmB,yBAAyB,CAAC;AAE1D;;;;;GAKG;AACH,MAAM,WAAW,iBAAiB;IAChC,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,eAAe,EAAE,MAAM,CAAC;IACjC,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;CACxB;AAED,MAAM,WAAW,sBAAsB;IACrC,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,qEAAqE;IACrE,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,kDAAkD;IAClD,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;IACzB;;;;;OAKG;IACH,QAAQ,CAAC,MAAM,CAAC,EAAE,OAAO,CAAC;IAC1B,oCAAoC;IACpC,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC;IACvB;;;;OAIG;IACH,QAAQ,CAAC,QAAQ,CAAC,EAAE,QAAQ,GAAG,KAAK,GAAG,MAAM,CAAC;CAC/C;AAED;;;;GAIG;AACH,wBAAgB,iBAAiB,CAC/B,KAAK,EAAE,sBAAsB,GAC5B,iBAAiB,CAqBnB;AAED;;;;;;;;;GASG;AACH,wBAAgB,oBAAoB,CAClC,YAAY,EAAE,MAAM,GAAG,SAAS,GAC/B,MAAM,GAAG,IAAI,CAcf;AAED;;;;;;;;;;;;;GAaG;AACH,wBAAgB,4BAA4B,CAC1C,OAAO,EAAE,mBAAmB,GAC3B,MAAM,GAAG,IAAI,CAIf;AAED;;;;GAIG;AACH,MAAM,WAAW,mBAAmB;IAClC,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;CACxB;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,mBAAmB,CACjC,WAAW,EAAE,MAAM,EACnB,MAAM,EAAE,MAAM,GACb,mBAAmB,GAAG,IAAI,CAO5B"}
+{"version":3,"file":"console-auth.d.ts","sourceRoot":"","sources":["../src/console-auth.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAwCG;AACH,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,WAAW,CAAC;AAOrD;;;;;GAKG;AACH,eAAO,MAAM,mBAAmB,yBAAyB,CAAC;AAE1D;;;;;GAKG;AACH,MAAM,WAAW,iBAAiB;IAChC,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,eAAe,EAAE,MAAM,CAAC;IACjC,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;CACxB;AAED,MAAM,WAAW,sBAAsB;IACrC,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,oEAAoE;IACpE,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,kDAAkD;IAClD,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;IACzB;;;;;OAKG;IACH,QAAQ,CAAC,MAAM,CAAC,EAAE,OAAO,CAAC;IAC1B,oCAAoC;IACpC,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC;IACvB;;;;OAIG;IACH,QAAQ,CAAC,QAAQ,CAAC,EAAE,QAAQ,GAAG,KAAK,GAAG,MAAM,CAAC;CAC/C;AAED;;;;GAIG;AACH,wBAAgB,iBAAiB,CAC/B,KAAK,EAAE,sBAAsB,GAC5B,iBAAiB,CAqBnB;AAED;;;;;;;;;GASG;AACH,wBAAgB,oBAAoB,CAClC,YAAY,EAAE,MAAM,GAAG,SAAS,GAC/B,MAAM,GAAG,IAAI,CAcf;AAED;;;;;;;;;;;;;GAaG;AACH,wBAAgB,4BAA4B,CAC1C,OAAO,EAAE,mBAAmB,GAC3B,MAAM,GAAG,IAAI,CAIf;AAED;;;;GAIG;AACH,MAAM,WAAW,mBAAmB;IAClC,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;CACxB;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,mBAAmB,CACjC,WAAW,EAAE,MAAM,EACnB,MAAM,EAAE,MAAM,GACb,mBAAmB,GAAG,IAAI,CAO5B"}

package/dist/control-service.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"control-service.d.ts","sourceRoot":"","sources":["../src/control-service.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2CG;AACH,OAAO,EAGL,KAAK,aAAa,EAClB,KAAK,wBAAwB,EAC9B,MAAM,8BAA8B,CAAC;AACtC,OAAO,EAAK,KAAK,WAAW,EAAmB,MAAM,KAAK,CAAC;AAC3D,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,iBAAiB,CAAC;AAElD,KAAK,UAAU,GAAG,aAAa,CAAC,WAAW,EAAE,WAAW,CAAC,CAAC;AAE1D,gDAAgD;AAChD,MAAM,MAAM,WAAW,GAAG,OAAO,GAAG,SAAS,GAAG,UAAU,GAAG,KAAK,CAAC;AAEnE,6CAA6C;AAC7C,eAAO,MAAM,YAAY,aAAa,CAAC;AAEvC,+EAA+E;AAC/E,eAAO,MAAM,oBAAoB,YAAY,CAAC;AAE9C,sDAAsD;AACtD,eAAO,MAAM,oBAAoB,EAAE,aAAa,CAAC,WAAW,CAAwB,CAAC;AAErF,0CAA0C;AAC1C,eAAO,MAAM,uBAAuB,EAAE,aAAa,CAAC,WAAW,CAAuB,CAAC;AAEvF;;;;;;;;GAQG;AACH,wBAAgB,wBAAwB,CACtC,GAAG,EAAE,aAAa,CAAC,UAAU,CAAC,EAC9B,OAAO,EAAE,aAAa,CAAC,WAAW,CAAC,GAClC,aAAa,CAAC,UAAU,CAAC,CAK3B;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAkCG;AACH,eAAO,MAAM,eAAe,EAAE,WAAW,CAAC,MAAM,CAiB9C,CAAC;AAEH;;;GAGG;AACH,wBAAgB,aAAa,CAAC,CAAC,SAAS,WAAW,EAAE,CAAC,SAAS,WAAW,EAAE,CAAC,SAAS,wBAAwB,CAAC,CAAC,CAAC,EAC/G,CAAC,EAAE,aAAa,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,GACxB,aAAa,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,CAGxB;AAED;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,wBAAgB,YAAY,CAAC,CAAC,SAAS,WAAW,EAAE,CAAC,SAAS,WAAW,EAAE,CAAC,SAAS,wBAAwB,CAAC,CAAC,CAAC,EAC9G,CAAC,EAAE,aAAa,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,GACxB,aAAa,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,CAYxB;AASD;;;;;;;;;;;;;;;GAeG;AACH,wBAAgB,eAAe,CAAC,CAAC,SAAS,WAAW,EAAE,CAAC,SAAS,WAAW,EAAE,CAAC,SAAS,wBAAwB,CAAC,CAAC,CAAC,EACjH,CAAC,EAAE,aAAa,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,GACxB,aAAa,CAAC,WAAW,EAAE,WAAW,CAAC,CAkCzC;AAED,MAAM,WAAW,uBAAuB;IACtC;;;;OAIG;IACH,QAAQ,CAAC,QAAQ,EAAE,aAAa,CAAC,UAAU,CAAC,CAAC;IAC7C;;;;;OAKG;IACH,QAAQ,CAAC,aAAa,CAAC,EAAE,aAAa,CAAC,MAAM,CAAC,CAAC;CAChD;AAED;;;;;;;;GAQG;AACH,wBAAgB,mBAAmB,CAAC,IAAI,EAAE,uBAAuB,GAAG,cAAc,CAwBjF;AAED;;;;;;GAMG;AACH,MAAM,WAAW,cAAe,SAAQ,UAAU;IAChD,QAAQ,CAAC,YAAY,EAAE,WAAW,CAAC,MAAM,CAAC,CAAC;CAC5C"}
+{"version":3,"file":"control-service.d.ts","sourceRoot":"","sources":["../src/control-service.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2CG;AACH,OAAO,EAGL,KAAK,aAAa,EAClB,KAAK,wBAAwB,EAC9B,MAAM,8BAA8B,CAAC;AACtC,OAAO,EAAK,KAAK,WAAW,EAAmB,MAAM,KAAK,CAAC;AAC3D,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,iBAAiB,CAAC;AAElD,KAAK,UAAU,GAAG,aAAa,CAAC,WAAW,EAAE,WAAW,CAAC,CAAC;AAE1D,gDAAgD;AAChD,MAAM,MAAM,WAAW,GAAG,OAAO,GAAG,SAAS,GAAG,UAAU,GAAG,KAAK,CAAC;AAEnE,6CAA6C;AAC7C,eAAO,MAAM,YAAY,aAAa,CAAC;AAEvC,+EAA+E;AAC/E,eAAO,MAAM,oBAAoB,YAAY,CAAC;AAE9C,sDAAsD;AACtD,eAAO,MAAM,oBAAoB,EAAE,aAAa,CAAC,WAAW,CAAwB,CAAC;AAErF,0CAA0C;AAC1C,eAAO,MAAM,uBAAuB,EAAE,aAAa,CAAC,WAAW,CAAuB,CAAC;AAEvF;;;;;;;;GAQG;AACH,wBAAgB,wBAAwB,CACtC,GAAG,EAAE,aAAa,CAAC,UAAU,CAAC,EAC9B,OAAO,EAAE,aAAa,CAAC,WAAW,CAAC,GAClC,aAAa,CAAC,UAAU,CAAC,CAK3B;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAkCG;AACH,eAAO,MAAM,eAAe,EAAE,WAAW,CAAC,MAAM,CAc9C,CAAC;AAEH;;;GAGG;AACH,wBAAgB,aAAa,CAAC,CAAC,SAAS,WAAW,EAAE,CAAC,SAAS,WAAW,EAAE,CAAC,SAAS,wBAAwB,CAAC,CAAC,CAAC,EAC/G,CAAC,EAAE,aAAa,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,GACxB,aAAa,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,CAGxB;AAED;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,wBAAgB,YAAY,CAAC,CAAC,SAAS,WAAW,EAAE,CAAC,SAAS,WAAW,EAAE,CAAC,SAAS,wBAAwB,CAAC,CAAC,CAAC,EAC9G,CAAC,EAAE,aAAa,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,GACxB,aAAa,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,CAYxB;AASD;;;;;;;;;;;;;;;GAeG;AACH,wBAAgB,eAAe,CAAC,CAAC,SAAS,WAAW,EAAE,CAAC,SAAS,WAAW,EAAE,CAAC,SAAS,wBAAwB,CAAC,CAAC,CAAC,EACjH,CAAC,EAAE,aAAa,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,GACxB,aAAa,CAAC,WAAW,EAAE,WAAW,CAAC,CAkCzC;AAED,MAAM,WAAW,uBAAuB;IACtC;;;;OAIG;IACH,QAAQ,CAAC,QAAQ,EAAE,aAAa,CAAC,UAAU,CAAC,CAAC;IAC7C;;;;;OAKG;IACH,QAAQ,CAAC,aAAa,CAAC,EAAE,aAAa,CAAC,MAAM,CAAC,CAAC;CAChD;AAED;;;;;;;;GAQG;AACH,wBAAgB,mBAAmB,CAAC,IAAI,EAAE,uBAAuB,GAAG,cAAc,CAwBjF;AAED;;;;;;GAMG;AACH,MAAM,WAAW,cAAe,SAAQ,UAAU;IAChD,QAAQ,CAAC,YAAY,EAAE,WAAW,CAAC,MAAM,CAAC,CAAC;CAC5C"}

package/dist/control-service.js

@@ -105,15 +105,12 @@ export function filterHandlersByAudience(set, allowed) {
 export const SINGLE_CALL_OPS = new Set([
     "ggui_ops_get_credit_balance",
     "ggui_ops_get_my_blueprint_source",
-    "ggui_ops_get_org_balance",
     "ggui_ops_get_render_source",
     "ggui_ops_list_apps",
     "ggui_ops_list_blueprints",
-    "ggui_ops_list_connector_keys",
     "ggui_ops_list_credit_transactions",
     "ggui_ops_list_my_apps",
     "ggui_ops_list_my_blueprints",
-    "ggui_ops_list_orgs",
     "ggui_ops_list_provider_keys",
     "ggui_ops_list_themes",
     "ggui_ops_list_recent_renders",

package/dist/first-seen.d.ts

@@ -0,0 +1,14 @@
+/**
+ * A bounded "seen before?" set, for a log line that should fire once per key
+ * per server process without growing with the number of keys.
+ *
+ * Insertion-ordered: at capacity, the oldest key is forgotten, so a key
+ * offered again after `capacity` newer keys counts as new and its line fires
+ * a second time. A reader of such a line takes the earliest per key.
+ */
+export interface FirstSeen {
+    /** True the first time `key` is offered (or once it has been forgotten); false after. */
+    first(key: string): boolean;
+}
+export declare function createFirstSeen(capacity: number): FirstSeen;
+//# sourceMappingURL=first-seen.d.ts.map

package/dist/first-seen.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"first-seen.d.ts","sourceRoot":"","sources":["../src/first-seen.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AACH,MAAM,WAAW,SAAS;IACxB,yFAAyF;IACzF,KAAK,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC;CAC7B;AAED,wBAAgB,eAAe,CAAC,QAAQ,EAAE,MAAM,GAAG,SAAS,CAgB3D"}

package/dist/first-seen.js

@@ -0,0 +1,19 @@
+export function createFirstSeen(capacity) {
+    if (!Number.isInteger(capacity) || capacity < 1) {
+        throw new RangeError(`capacity must be a positive integer, got ${capacity}`);
+    }
+    const seen = new Set();
+    return {
+        first(key) {
+            if (seen.has(key))
+                return false;
+            if (seen.size >= capacity) {
+                const oldest = seen.values().next();
+                if (!oldest.done)
+                    seen.delete(oldest.value);
+            }
+            seen.add(key);
+            return true;
+        },
+    };
+}

package/dist/ggui-session-channel/action-ingress.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"action-ingress.d.ts","sourceRoot":"","sources":["../../src/ggui-session-channel/action-ingress.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,KAAK,EAAE,gBAAgB,EAAE,oBAAoB,EAAE,MAAM,0BAA0B,CAAC;AAOvF,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,uCAAuC,CAAC;AAE9E,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,IAAI,CAAC;AACpC,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,cAAc,CAAC;AAC3C,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,qBAAqB,CAAC;AACxD,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,eAAe,CAAC;AA+G9C,MAAM,WAAW,iBAAiB;IAChC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,WAAW,EAAE,gBAAgB,CAAC;IACvC;;;;OAIG;IACH,QAAQ,CAAC,oBAAoB,CAAC,EAAE,oBAAoB,CAAC;IACrD,QAAQ,CAAC,IAAI,EAAE,QAAQ,CAAC,MAAM,CAAC,CAAC;IAChC,QAAQ,CAAC,SAAS,EAAE,QAAQ,CAAC,WAAW,CAAC,CAAC;CAC3C;AAED,MAAM,WAAW,aAAa;IAC5B;;;;;;;;;;;;;;;;;;;;;OAqBG;IACH,mBAAmB,CACjB,EAAE,EAAE,SAAS,EACb,GAAG,EAAE,YAAY,EACjB,OAAO,EAAE,gBAAgB,GAAG;QAAE,IAAI,EAAE,QAAQ,CAAA;KAAE,GAC7C,OAAO,CAAC,IAAI,CAAC,CAAC;CAClB;AAED,wBAAgB,mBAAmB,CAAC,IAAI,EAAE,iBAAiB,GAAG,aAAa,CA+K1E"}
+{"version":3,"file":"action-ingress.d.ts","sourceRoot":"","sources":["../../src/ggui-session-channel/action-ingress.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,KAAK,EACV,gBAAgB,EAEhB,oBAAoB,EACrB,MAAM,0BAA0B,CAAC;AAOlC,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,uCAAuC,CAAC;AAE9E,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,IAAI,CAAC;AACpC,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,cAAc,CAAC;AAC3C,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,qBAAqB,CAAC;AACxD,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,eAAe,CAAC;AA+G9C,MAAM,WAAW,iBAAiB;IAChC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,WAAW,EAAE,gBAAgB,CAAC;IACvC;;;;OAIG;IACH,QAAQ,CAAC,oBAAoB,CAAC,EAAE,oBAAoB,CAAC;IACrD,QAAQ,CAAC,IAAI,EAAE,QAAQ,CAAC,MAAM,CAAC,CAAC;IAChC,QAAQ,CAAC,SAAS,EAAE,QAAQ,CAAC,WAAW,CAAC,CAAC;CAC3C;AAED,MAAM,WAAW,aAAa;IAC5B;;;;;;;;;;;;;;;;;;;;;OAqBG;IACH,mBAAmB,CACjB,EAAE,EAAE,SAAS,EACb,GAAG,EAAE,YAAY,EACjB,OAAO,EAAE,gBAAgB,GAAG;QAAE,IAAI,EAAE,QAAQ,CAAA;KAAE,GAC7C,OAAO,CAAC,IAAI,CAAC,CAAC;CAClB;AAED,wBAAgB,mBAAmB,CAAC,IAAI,EAAE,iBAAiB,GAAG,aAAa,CA6O1E"}

package/dist/ggui-session-channel/action-ingress.js

@@ -177,13 +177,63 @@ export function createActionIngress(deps) {
         // reaped) degrades to ledger-only with a warn — the WS client has
         // no `ui/message` fallback to branch on, so a new error frame
         // would be vocabulary without a consumer.
+        //
+        // The append's outcome (ggui#1517) is not read here: this path mints
+        // the pipe id per frame (`toConsumeEventEntry`), so a duplicate cannot
+        // arise, and the ledger write is this path's load-bearing one.
+        // The pipe entry (and its minted actionId, which also names the holder of
+        // a oneShot spend, ggui#1424) is built once per frame.
+        const entry = envelope.type === "data:submit" ? toConsumeEventEntry(envelope, sub.sessionId) : null;
+        // ggui#1424 — the channel door refuses a second gesture on a spent
+        // oneShot too, so the server's refusal holds at both doors. The claim is
+        // taken BEFORE the writes under this frame's minted actionId; the answer
+        // decides as it does on the tool door (`claimDispatchSpend` there):
+        // already-spent by another holder whose delivery is marked → refused with
+        // the channel's existing CONTRACT_VIOLATION error frame (#1358), one
+        // violation at `actionSpec.<name>.oneShot`, no ledger row, no pipe entry,
+        // one named line; an unmarked holder is taken over; the same holder, no
+        // holder, a non-oneShot action, a store that answers no claim, or a store
+        // failure (fail-open, named) → the frame goes on as before. The store
+        // enforces `delivered`: the refusal arm reads it only as the store
+        // answers it. Delivery is marked after the writes below.
+        const framePayload = envelope.payload;
+        const oneShotPayload = entry !== null &&
+            activeItem !== undefined &&
+            framePayload !== null &&
+            typeof framePayload === "object" &&
+            !Array.isArray(framePayload) &&
+            typeof framePayload.action === "string"
+            ? { action: framePayload.action, data: framePayload.data }
+            : null;
+        if (oneShotPayload !== null && entry !== null && activeItem !== undefined) {
+            const verdict = await claimChannelSpend(deps, sub.sessionId, activeItem, oneShotPayload, entry.actionId);
+            if (verdict.kind === "refuse") {
+                deps.logger.warn("render_channel_one_shot_refused", {
+                    sessionId: sub.sessionId,
+                    action: oneShotPayload.action,
+                    actionId: entry.actionId,
+                    by: verdict.by,
+                });
+                deps.sendError(ws, "CONTRACT_VIOLATION", `actionSpec.${oneShotPayload.action} is declared oneShot and already fired on this card; a second gesture is refused`, message.requestId, {
+                    error: "contract_violation",
+                    violations: [
+                        {
+                            field: `actionSpec.${oneShotPayload.action}.oneShot`,
+                            keyword: "oneShot",
+                            message: "this one-shot action already fired on this card",
+                            expected: verdict.by,
+                            received: entry.actionId,
+                        },
+                    ],
+                    hint: "The action already fired on this card. Render a new card to fire it again.",
+                });
+                return;
+            }
+        }
         const consumeWrite = (() => {
-            if (deps.pendingEventConsumer === undefined || envelope.type !== "data:submit") {
+            if (deps.pendingEventConsumer === undefined || entry === null) {
                 return Promise.resolve();
             }
-            const entry = toConsumeEventEntry(envelope, sub.sessionId);
-            if (entry === null)
-                return Promise.resolve();
             return deps.pendingEventConsumer.append(sub.sessionId, {
                 // The pipe entry's stable id doubles as the `drain_ack` key —
                 // same convention as the relay path's iframe-supplied id.
@@ -218,10 +268,12 @@ export function createActionIngress(deps) {
             return;
         }
         const seq = ledgerResult.value;
-        // ggui#1223 / #1305 — the gesture is in the ledger, so a committed
-        // `oneShot` now spends its card durably, BEFORE the ack: a client that
-        // holds the ack can reload and find the card spent. FAIL-OPEN, as on the
-        // tool path: a failed record is named and never withholds the ack.
+        // ggui#1223 / #1305 / #1424 — the gesture is in the ledger, so the
+        // holder MARKS its spend delivered (claimed above, before the writes),
+        // BEFORE the ack: a client that holds the ack can reload and find the
+        // card spent. FAIL-OPEN, as on the tool path: a failed record is named
+        // and never withholds the ack. With no pipe entry (the frame did not
+        // parse as a dispatch) the spend is recorded held by nobody, as before.
         if (envelope.type === "data:submit" && activeItem !== undefined) {
             const payload = envelope.payload;
             if (payload !== null &&
@@ -235,6 +287,7 @@ export function createActionIngress(deps) {
                         render: activeItem,
                         action: payload.action,
                         data: payload.data,
+                        ...(entry !== null ? { actionId: entry.actionId, delivered: true } : {}),
                     });
                 }
                 catch (err) {
@@ -254,3 +307,38 @@ export function createActionIngress(deps) {
     }
     return { handleInboundAction };
 }
+async function claimChannelSpend(deps, sessionId, render, payload, actionId) {
+    const claimOnce = async (spend) => {
+        try {
+            return await recordCommittedOneShot({
+                store: deps.renderStore,
+                sessionId,
+                render,
+                action: payload.action,
+                data: payload.data,
+                ...spend,
+            });
+        }
+        catch (err) {
+            deps.logger.warn("render_channel_spent_oneshot_persist_failed", {
+                sessionId,
+                action: payload.action,
+                error: err instanceof Error ? err.message : String(err),
+            });
+            return undefined;
+        }
+    };
+    const first = await claimOnce({ actionId });
+    const claim = first?.claim;
+    if (claim === undefined || claim.outcome !== "already-spent" || claim.by === undefined || claim.by === actionId) {
+        return { kind: "proceed" };
+    }
+    if (claim.delivered === true)
+        return { kind: "refuse", by: claim.by };
+    const retaken = await claimOnce({ actionId, reclaimFrom: claim.by });
+    const second = retaken?.claim;
+    if (second === undefined || second.outcome !== "already-spent" || second.by === undefined || second.by === actionId) {
+        return { kind: "proceed" };
+    }
+    return { kind: "refuse", by: second.by };
+}

package/dist/ggui-session-channel/channel-subscriptions.d.ts

@@ -69,7 +69,6 @@ export interface ChannelSubscriptionsDeps {
      * subscriber.
      */
     readonly subscribersByWs: WeakMap<WebSocket, WsSubscriber>;
-    readonly send: Outbound["send"];
     readonly sendChannelError: Outbound["sendChannelError"];
 }
 export interface ChannelSubscriptions {

package/dist/ggui-session-channel/channel-subscriptions.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"channel-subscriptions.d.ts","sourceRoot":"","sources":["../../src/ggui-session-channel/channel-subscriptions.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,0BAA0B,CAAC;AAGjE,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,uCAAuC,CAAC;AAC9E,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,IAAI,CAAC;AACpC,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,cAAc,CAAC;AAC3C,OAAO,KAAK,EAA4B,YAAY,EAAE,MAAM,qBAAqB,CAAC;AAClF,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,eAAe,CAAC;AAa9C;;;;;;;GAOG;AACH,MAAM,WAAW,mCAAmC;IAClD;;;;;;;OAOG;IACH,QAAQ,CAAC,SAAS,EAAE,SAAS,MAAM,EAAE,CAAC;IACtC;;;;;;;;;;OAUG;IACH,MAAM,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IACvD;;;;;OAKG;IACH,QAAQ,CAAC,WAAW,CAAC,EAAE;QACrB,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC;QAC1B,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC;QAC5B,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC;KAC7B,CAAC;CACH;AAED,MAAM,WAAW,wBAAwB;IACvC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,WAAW,EAAE,gBAAgB,CAAC;IACvC;;;;OAIG;IACH,QAAQ,CAAC,UAAU,EAAE,mCAAmC,GAAG,SAAS,CAAC;IACrE;;;;OAIG;IACH,QAAQ,CAAC,eAAe,EAAE,OAAO,CAAC,SAAS,EAAE,YAAY,CAAC,CAAC;IAC3D,QAAQ,CAAC,IAAI,EAAE,QAAQ,CAAC,MAAM,CAAC,CAAC;IAChC,QAAQ,CAAC,gBAAgB,EAAE,QAAQ,CAAC,kBAAkB,CAAC,CAAC;CACzD;AAED,MAAM,WAAW,oBAAoB;IACnC;;;;;;OAMG;IACH,sBAAsB,CACpB,EAAE,EAAE,SAAS,EACb,GAAG,EAAE,YAAY,EACjB,OAAO,EAAE,gBAAgB,GAAG;QAAE,IAAI,EAAE,mBAAmB,CAAA;KAAE,GACxD,OAAO,CAAC,IAAI,CAAC,CAAC;IACjB;;;;;OAKG;IACH,wBAAwB,CACtB,EAAE,EAAE,SAAS,EACb,GAAG,EAAE,YAAY,EACjB,OAAO,EAAE,gBAAgB,GAAG;QAAE,IAAI,EAAE,qBAAqB,CAAA;KAAE,GAC1D,IAAI,CAAC;CACT;AAED,wBAAgB,0BAA0B,CAAC,IAAI,EAAE,wBAAwB,GAAG,oBAAoB,CAiQ/F"}
+{"version":3,"file":"channel-subscriptions.d.ts","sourceRoot":"","sources":["../../src/ggui-session-channel/channel-subscriptions.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,0BAA0B,CAAC;AAGjE,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,uCAAuC,CAAC;AAC9E,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,IAAI,CAAC;AACpC,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,cAAc,CAAC;AAC3C,OAAO,KAAK,EAA4B,YAAY,EAAE,MAAM,qBAAqB,CAAC;AAClF,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,eAAe,CAAC;AAa9C;;;;;;;GAOG;AACH,MAAM,WAAW,mCAAmC;IAClD;;;;;;;OAOG;IACH,QAAQ,CAAC,SAAS,EAAE,SAAS,MAAM,EAAE,CAAC;IACtC;;;;;;;;;;OAUG;IACH,MAAM,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IACvD;;;;;OAKG;IACH,QAAQ,CAAC,WAAW,CAAC,EAAE;QACrB,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC;QAC1B,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC;QAC5B,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC;KAC7B,CAAC;CACH;AAED,MAAM,WAAW,wBAAwB;IACvC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,WAAW,EAAE,gBAAgB,CAAC;IACvC;;;;OAIG;IACH,QAAQ,CAAC,UAAU,EAAE,mCAAmC,GAAG,SAAS,CAAC;IACrE;;;;OAIG;IACH,QAAQ,CAAC,eAAe,EAAE,OAAO,CAAC,SAAS,EAAE,YAAY,CAAC,CAAC;IAC3D,QAAQ,CAAC,gBAAgB,EAAE,QAAQ,CAAC,kBAAkB,CAAC,CAAC;CACzD;AAED,MAAM,WAAW,oBAAoB;IACnC;;;;;;OAMG;IACH,sBAAsB,CACpB,EAAE,EAAE,SAAS,EACb,GAAG,EAAE,YAAY,EACjB,OAAO,EAAE,gBAAgB,GAAG;QAAE,IAAI,EAAE,mBAAmB,CAAA;KAAE,GACxD,OAAO,CAAC,IAAI,CAAC,CAAC;IACjB;;;;;OAKG;IACH,wBAAwB,CACtB,EAAE,EAAE,SAAS,EACb,GAAG,EAAE,YAAY,EACjB,OAAO,EAAE,gBAAgB,GAAG;QAAE,IAAI,EAAE,qBAAqB,CAAA;KAAE,GAC1D,IAAI,CAAC;CACT;AAED,wBAAgB,0BAA0B,CAAC,IAAI,EAAE,wBAAwB,GAAG,oBAAoB,CAoQ/F"}

package/dist/ggui-session-channel/channel-subscriptions.js

@@ -68,7 +68,10 @@ export function createChannelSubscriptions(deps) {
             if (sub.ws.readyState !== sub.ws.OPEN)
                 return;
             state.seq += 1;
-            deps.send(sub.ws, {
+            // Through the subscriber's sink, like every data-carrying writer,
+            // so a poll that lands while the subscribe tail is still writing
+            // its replay is held until after it (ggui#1525).
+            sub.sink.write({
                 type: "channel_payload",
                 payload: {
                     sessionId: sub.sessionId,

package/dist/ggui-session-channel/internal-types.d.ts

@@ -3,6 +3,7 @@
  * of the package's public surface — everything publishable is exported
  * (or re-exported) from `../ggui-session-channel.ts`.
  */
+import type { StreamReplayCursor } from './stream-epoch.js';
 import type { AuthResult, BufferedStreamEnvelope } from "@ggui-ai/mcp-server-core";
 import type { JsonObject } from "@ggui-ai/protocol";
 import type { WebSocketMessage } from "@ggui-ai/protocol/transport/websocket";
@@ -30,12 +31,16 @@ export interface SubscriberSink {
     }): void;
     /**
      * Terminate the transport. WS maps `service_restart` → close 1012
-     * (reconnect immediately — same server family is still up) and
+     * (reconnect immediately — same server family is still up),
      * `session_expired` → close 1008 (policy violation — do not blind-
-     * reconnect); SSE ends the response, letting `EventSource`
-     * auto-reconnect hit the HTTP pre-gate for the authoritative verdict.
+     * reconnect), and `internal_error` → close 1011 (the server could not
+     * complete the subscribe; a client reconnects with its ordinary
+     * backoff, since a failure that may repeat must not invite an
+     * immediate retry, ggui#1528). SSE ends the response for every reason,
+     * letting `EventSource` auto-reconnect hit the HTTP pre-gate for the
+     * authoritative verdict.
      */
-    end(reason: "service_restart" | "session_expired"): void;
+    end(reason: "service_restart" | "session_expired" | "internal_error"): void;
 }
 /**
  * Fields shared by every subscriber regardless of transport (one
@@ -48,16 +53,19 @@ interface SubscriberBase {
     readonly identity: AuthResult;
     readonly connectedAt: number;
     /**
-     * Largest outbound `seq` the initial replay (or subscribe snapshot)
-     * covered for this subscriber. Live fan-out skips envelopes with
-     * `seq <= replayCompletedSeq` to prevent double delivery — those
-     * were (or will be) delivered via the replay phase.
+     * The replay boundary: the largest outbound `seq` the initial replay
+     * (or subscribe snapshot) covered for this subscriber, and the epoch
+     * that `seq` counts in (ggui#1531). Live fan-out skips envelopes of the
+     * same epoch with `seq <= replayCursor.seq` to prevent double delivery,
+     * since those were (or will be) delivered via the replay phase. A live
+     * envelope of another epoch means the counter restarted: it is
+     * delivered and moves the cursor (`admitLiveEnvelope`).
      *
-     * For fresh subscribers (no `fromSeq`), this is the stream cursor
-     * at subscribe time; they never see the pre-existing buffer, only
-     * new deliveries.
+     * For fresh subscribers (no `fromSeq`), `seq` is the stream cursor at
+     * subscribe time; they never see the pre-existing buffer, only new
+     * deliveries.
      */
-    readonly replayCompletedSeq: number;
+    readonly replayCursor: StreamReplayCursor;
     /**
      * Per-subscriber live-tail iterator from `streamFanout.subscribe`.
      * Owned by the subscriber for its full lifetime; ending it (via

package/dist/ggui-session-channel/internal-types.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"internal-types.d.ts","sourceRoot":"","sources":["../../src/ggui-session-channel/internal-types.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,KAAK,EAAE,UAAU,EAAE,sBAAsB,EAAE,MAAM,0BAA0B,CAAC;AACnF,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,mBAAmB,CAAC;AACpD,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,uCAAuC,CAAC;AAC9E,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,IAAI,CAAC;AAEpC;;;;;;;GAOG;AACH,MAAM,WAAW,cAAc;IAC7B,iFAAiF;IACjF,MAAM,IAAI,OAAO,CAAC;IAClB;;;;;;OAMG;IACH,KAAK,CAAC,KAAK,EAAE,gBAAgB,EAAE,IAAI,CAAC,EAAE;QAAE,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAA;KAAE,GAAG,IAAI,CAAC;IAC5E;;;;;;OAMG;IACH,GAAG,CAAC,MAAM,EAAE,iBAAiB,GAAG,iBAAiB,GAAG,IAAI,CAAC;CAC1D;AAED;;;;GAIG;AACH,UAAU,cAAc;IACtB,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,QAAQ,EAAE,UAAU,CAAC;IAC9B,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B;;;;;;;;;OASG;IACH,QAAQ,CAAC,kBAAkB,EAAE,MAAM,CAAC;IACpC;;;;;;OAMG;IACH,QAAQ,CAAC,IAAI,EAAE,aAAa,CAAC,sBAAsB,CAAC,CAAC;IACrD;;;;;;;;;;;;OAYG;IACH,QAAQ,CAAC,WAAW,EAAE,GAAG,CAAC,MAAM,EAAE,wBAAwB,CAAC,CAAC;IAC5D,gFAAgF;IAChF,QAAQ,CAAC,IAAI,EAAE,cAAc,CAAC;CAC/B;AAED;;;;GAIG;AACH,MAAM,WAAW,YAAa,SAAQ,cAAc;IAClD,QAAQ,CAAC,SAAS,EAAE,IAAI,CAAC;IACzB,QAAQ,CAAC,EAAE,EAAE,SAAS,CAAC;CACxB;AAED;;;;;GAKG;AACH,MAAM,WAAW,aAAc,SAAQ,cAAc;IACnD,QAAQ,CAAC,SAAS,EAAE,KAAK,CAAC;CAC3B;AAED,mEAAmE;AACnE,MAAM,MAAM,UAAU,GAAG,YAAY,GAAG,aAAa,CAAC;AAEtD;;;;;;;;;;GAUG;AACH,MAAM,WAAW,wBAAwB;IACvC,2EAA2E;IAC3E,QAAQ,CAAC,cAAc,EAAE,MAAM,CAAC;IAChC,4EAA4E;IAC5E,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,uEAAuE;IACvE,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,4CAA4C;IAC5C,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B;;;;OAIG;IACH,QAAQ,CAAC,IAAI,EAAE,UAAU,CAAC;IAC1B;;;;OAIG;IACH,GAAG,EAAE,MAAM,CAAC;IACZ,yDAAyD;IACzD,QAAQ,CAAC,KAAK,EAAE,UAAU,CAAC,OAAO,WAAW,CAAC,CAAC;CAChD;AAED;;;;;;GAMG;AACH,MAAM,WAAW,eAAe;IAC9B,cAAc,CAAC,EAAE,UAAU,CAAC;IAC5B,iBAAiB,CAAC,EAAE;QAAE,SAAS,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAA;KAAE,CAAC;CAC1D"}
+{"version":3,"file":"internal-types.d.ts","sourceRoot":"","sources":["../../src/ggui-session-channel/internal-types.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,mBAAmB,CAAC;AAC5D,OAAO,KAAK,EAAE,UAAU,EAAE,sBAAsB,EAAE,MAAM,0BAA0B,CAAC;AACnF,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,mBAAmB,CAAC;AACpD,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,uCAAuC,CAAC;AAC9E,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,IAAI,CAAC;AAEpC;;;;;;;GAOG;AACH,MAAM,WAAW,cAAc;IAC7B,iFAAiF;IACjF,MAAM,IAAI,OAAO,CAAC;IAClB;;;;;;OAMG;IACH,KAAK,CAAC,KAAK,EAAE,gBAAgB,EAAE,IAAI,CAAC,EAAE;QAAE,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAA;KAAE,GAAG,IAAI,CAAC;IAC5E;;;;;;;;;;OAUG;IACH,GAAG,CAAC,MAAM,EAAE,iBAAiB,GAAG,iBAAiB,GAAG,gBAAgB,GAAG,IAAI,CAAC;CAC7E;AAED;;;;GAIG;AACH,UAAU,cAAc;IACtB,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,QAAQ,EAAE,UAAU,CAAC;IAC9B,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B;;;;;;;;;;;;OAYG;IACH,QAAQ,CAAC,YAAY,EAAE,kBAAkB,CAAC;IAC1C;;;;;;OAMG;IACH,QAAQ,CAAC,IAAI,EAAE,aAAa,CAAC,sBAAsB,CAAC,CAAC;IACrD;;;;;;;;;;;;OAYG;IACH,QAAQ,CAAC,WAAW,EAAE,GAAG,CAAC,MAAM,EAAE,wBAAwB,CAAC,CAAC;IAC5D,gFAAgF;IAChF,QAAQ,CAAC,IAAI,EAAE,cAAc,CAAC;CAC/B;AAED;;;;GAIG;AACH,MAAM,WAAW,YAAa,SAAQ,cAAc;IAClD,QAAQ,CAAC,SAAS,EAAE,IAAI,CAAC;IACzB,QAAQ,CAAC,EAAE,EAAE,SAAS,CAAC;CACxB;AAED;;;;;GAKG;AACH,MAAM,WAAW,aAAc,SAAQ,cAAc;IACnD,QAAQ,CAAC,SAAS,EAAE,KAAK,CAAC;CAC3B;AAED,mEAAmE;AACnE,MAAM,MAAM,UAAU,GAAG,YAAY,GAAG,aAAa,CAAC;AAEtD;;;;;;;;;;GAUG;AACH,MAAM,WAAW,wBAAwB;IACvC,2EAA2E;IAC3E,QAAQ,CAAC,cAAc,EAAE,MAAM,CAAC;IAChC,4EAA4E;IAC5E,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,uEAAuE;IACvE,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,4CAA4C;IAC5C,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B;;;;OAIG;IACH,QAAQ,CAAC,IAAI,EAAE,UAAU,CAAC;IAC1B;;;;OAIG;IACH,GAAG,EAAE,MAAM,CAAC;IACZ,yDAAyD;IACzD,QAAQ,CAAC,KAAK,EAAE,UAAU,CAAC,OAAO,WAAW,CAAC,CAAC;CAChD;AAED;;;;;;GAMG;AACH,MAAM,WAAW,eAAe;IAC9B,cAAc,CAAC,EAAE,UAAU,CAAC;IAC5B,iBAAiB,CAAC,EAAE;QAAE,SAAS,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAA;KAAE,CAAC;CAC1D"}

package/dist/ggui-session-channel/outbound.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"outbound.d.ts","sourceRoot":"","sources":["../../src/ggui-session-channel/outbound.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAEH,OAAO,KAAK,EACV,gBAAgB,EAChB,uBAAuB,EACvB,mBAAmB,EACnB,YAAY,EACb,MAAM,0BAA0B,CAAC;AAElC,OAAO,KAAK,EACV,YAAY,EACZ,WAAW,EACX,UAAU,EACV,wBAAwB,EAEzB,MAAM,mBAAmB,CAAC;AAC3B,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,uCAAuC,CAAC;AAC9E,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,IAAI,CAAC;AACpC,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,cAAc,CAAC;AAC3C,OAAO,KAAK,EAAE,UAAU,EAAE,cAAc,EAAE,MAAM,qBAAqB,CAAC;AAEtE,oEAAoE;AACpE,MAAM,MAAM,gBAAgB,GACxB,iBAAiB,GACjB,mBAAmB,GACnB,mBAAmB,GACnB,wBAAwB,GACxB,aAAa,CAAC;AAElB,MAAM,WAAW,YAAY;IAC3B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,6EAA6E;IAC7E,QAAQ,CAAC,WAAW,EAAE,gBAAgB,CAAC;IACvC,oEAAoE;IACpE,QAAQ,CAAC,YAAY,EAAE,uBAAuB,CAAC;IAC/C,0DAA0D;IAC1D,QAAQ,CAAC,YAAY,EAAE,YAAY,CAAC;IACpC;;;;;;OAMG;IACH,QAAQ,CAAC,aAAa,EAAE,WAAW,CAAC,UAAU,CAAC,CAAC;IAChD;;;;OAIG;IACH,QAAQ,CAAC,uBAAuB,CAAC,EAAE,WAAW,CAAC,MAAM,EAAE,wBAAwB,CAAC,CAAC;CAClF;AAgBD;;;;;;;GAOG;AACH,wBAAgB,YAAY,CAAC,EAAE,EAAE,SAAS,EAAE,MAAM,EAAE,MAAM,GAAG,cAAc,CAc1E;AAED,+DAA+D;AAC/D,MAAM,WAAW,QAAQ;IACvB,4EAA4E;IAC5E,IAAI,CAAC,EAAE,EAAE,SAAS,EAAE,GAAG,EAAE,gBAAgB,GAAG,IAAI,CAAC;IACjD,8DAA8D;IAC9D,SAAS,CACP,EAAE,EAAE,SAAS,EACb,IAAI,EAAE,MAAM,EACZ,OAAO,EAAE,MAAM,EACf,SAAS,CAAC,EAAE,MAAM,EAClB,OAAO,CAAC,EAAE,YAAY,CAAC,SAAS,CAAC,GAChC,IAAI,CAAC;IACR;;;;;;;;;;OAUG;IACH,gBAAgB,CACd,EAAE,EAAE,SAAS,EACb,SAAS,EAAE,MAAM,EACjB,WAAW,EAAE,MAAM,EACnB,IAAI,EAAE,gBAAgB,EACtB,OAAO,EAAE,MAAM,EACf,SAAS,CAAC,EAAE,MAAM,EAClB,OAAO,CAAC,EAAE,YAAY,CAAC,SAAS,CAAC,GAChC,IAAI,CAAC;IACR,sEAAsE;IACtE,iBAAiB,CAAC,QAAQ,EAAE,mBAAmB,GAAG,OAAO,CAAC;QAAE,GAAG,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IAC3E,4EAA4E;IAC5E,uBAAuB,CAAC,SAAS,EAAE,MAAM,EAAE,MAAM,EAAE,WAAW,EAAE,SAAS,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1F,oEAAoE;IACpE,eAAe,CAAC,SAAS,EAAE,MAAM,EAAE,KAAK,EAAE,UAAU,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACpF,iEAAiE;IACjE,YAAY,CAAC,IAAI,EAAE;QACjB,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;QAC3B,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;QACvB,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;QACzB,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;KAC5B,GAAG,IAAI,CAAC;IACT,sEAAsE;IACtE,iBAAiB,CAAC,SAAS,EAAE,MAAM,EAAE,KAAK,EAAE,gBAAgB,GAAG,IAAI,CAAC;CACrE;AAED,wBAAgB,cAAc,CAAC,IAAI,EAAE,YAAY,GAAG,QAAQ,CA2N3D"}
+{"version":3,"file":"outbound.d.ts","sourceRoot":"","sources":["../../src/ggui-session-channel/outbound.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAGH,OAAO,KAAK,EACV,gBAAgB,EAChB,uBAAuB,EACvB,mBAAmB,EACnB,YAAY,EACb,MAAM,0BAA0B,CAAC;AAElC,OAAO,KAAK,EACV,YAAY,EACZ,WAAW,EACX,UAAU,EACV,wBAAwB,EAEzB,MAAM,mBAAmB,CAAC;AAC3B,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,uCAAuC,CAAC;AAC9E,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,IAAI,CAAC;AACpC,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,cAAc,CAAC;AAC3C,OAAO,KAAK,EAAE,UAAU,EAAE,cAAc,EAAE,MAAM,qBAAqB,CAAC;AAEtE,oEAAoE;AACpE,MAAM,MAAM,gBAAgB,GACxB,iBAAiB,GACjB,mBAAmB,GACnB,mBAAmB,GACnB,wBAAwB,GACxB,aAAa,CAAC;AAElB,MAAM,WAAW,YAAY;IAC3B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,6EAA6E;IAC7E,QAAQ,CAAC,WAAW,EAAE,gBAAgB,CAAC;IACvC,oEAAoE;IACpE,QAAQ,CAAC,YAAY,EAAE,uBAAuB,CAAC;IAC/C,0DAA0D;IAC1D,QAAQ,CAAC,YAAY,EAAE,YAAY,CAAC;IACpC;;;;;;OAMG;IACH,QAAQ,CAAC,aAAa,EAAE,WAAW,CAAC,UAAU,CAAC,CAAC;IAChD;;;;OAIG;IACH,QAAQ,CAAC,uBAAuB,CAAC,EAAE,WAAW,CAAC,MAAM,EAAE,wBAAwB,CAAC,CAAC;CAClF;AAgBD;;;;;;;GAOG;AACH,wBAAgB,YAAY,CAAC,EAAE,EAAE,SAAS,EAAE,MAAM,EAAE,MAAM,GAAG,cAAc,CAc1E;AAED,+DAA+D;AAC/D,MAAM,WAAW,QAAQ;IACvB,4EAA4E;IAC5E,IAAI,CAAC,EAAE,EAAE,SAAS,EAAE,GAAG,EAAE,gBAAgB,GAAG,IAAI,CAAC;IACjD,8DAA8D;IAC9D,SAAS,CACP,EAAE,EAAE,SAAS,EACb,IAAI,EAAE,MAAM,EACZ,OAAO,EAAE,MAAM,EACf,SAAS,CAAC,EAAE,MAAM,EAClB,OAAO,CAAC,EAAE,YAAY,CAAC,SAAS,CAAC,GAChC,IAAI,CAAC;IACR;;;;;;;;;;OAUG;IACH,gBAAgB,CACd,EAAE,EAAE,SAAS,EACb,SAAS,EAAE,MAAM,EACjB,WAAW,EAAE,MAAM,EACnB,IAAI,EAAE,gBAAgB,EACtB,OAAO,EAAE,MAAM,EACf,SAAS,CAAC,EAAE,MAAM,EAClB,OAAO,CAAC,EAAE,YAAY,CAAC,SAAS,CAAC,GAChC,IAAI,CAAC;IACR,sEAAsE;IACtE,iBAAiB,CAAC,QAAQ,EAAE,mBAAmB,GAAG,OAAO,CAAC;QAAE,GAAG,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IAC3E,4EAA4E;IAC5E,uBAAuB,CAAC,SAAS,EAAE,MAAM,EAAE,MAAM,EAAE,WAAW,EAAE,SAAS,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1F,oEAAoE;IACpE,eAAe,CAAC,SAAS,EAAE,MAAM,EAAE,KAAK,EAAE,UAAU,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACpF,iEAAiE;IACjE,YAAY,CAAC,IAAI,EAAE;QACjB,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;QAC3B,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;QACvB,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;QACzB,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;KAC5B,GAAG,IAAI,CAAC;IACT,sEAAsE;IACtE,iBAAiB,CAAC,SAAS,EAAE,MAAM,EAAE,KAAK,EAAE,gBAAgB,GAAG,IAAI,CAAC;CACrE;AAED,wBAAgB,cAAc,CAAC,IAAI,EAAE,YAAY,GAAG,QAAQ,CAmO3D"}

package/dist/ggui-session-channel/outbound.js

@@ -11,6 +11,7 @@
  * `GguiSessionChannelServer` interface in `../ggui-session-channel.ts`;
  * inline comments here cover impl-level decisions only.
  */
+import { admitLiveEnvelope } from "./stream-epoch.js";
 import { assertStreamContract } from "@ggui-ai/mcp-server-handlers/renders";
 /**
  * Low-level ws wire write shared by the closure-bound `send` helper and
@@ -43,7 +44,7 @@ export function createWsSink(ws, logger) {
         },
         end: (reason) => {
             try {
-                ws.close(reason === "service_restart" ? 1012 : 1008, reason);
+                ws.close(reason === "service_restart" ? 1012 : reason === "internal_error" ? 1011 : 1008, reason);
             }
             catch {
                 /* best-effort — socket may already be closing */
@@ -204,11 +205,22 @@ export function createOutbound(deps) {
             // subscribe-replay (policy 'all'/'latest') or is deliberately
             // invisible to late subscribers (policy 'none') — never re-send.
             // Unstamped frames were never buffered; replay cannot duplicate
-            // them, so they pass. Non-data frames carry no seq semantics.
-            if (frame.type === "data" &&
-                typeof frame.payload.seq === "number" &&
-                frame.payload.seq <= sub.replayCompletedSeq) {
-                continue;
+            // them, so they pass. A frame of another epoch means the counter
+            // restarted: it passes and moves the subscriber's cursor, by the
+            // same rule as the pump (ggui#1531). Non-data frames carry no seq
+            // semantics.
+            if (frame.type === "data") {
+                const admission = admitLiveEnvelope(sub.replayCursor, frame.payload);
+                if (admission.epochChanged !== undefined) {
+                    deps.logger.info("stream_epoch_changed", {
+                        sessionId,
+                        from: admission.epochChanged.from,
+                        to: admission.epochChanged.to,
+                        transport: sub.transport,
+                    });
+                }
+                if (!admission.deliver)
+                    continue;
             }
             sub.sink.write(frame);
         }

package/dist/ggui-session-channel/stream-epoch.d.ts

@@ -0,0 +1,61 @@
+/**
+ * The live tail's replay boundary, with the stream counter's epoch
+ * (ggui#1531). One rule, shared by the two places a live data frame is
+ * filtered against a subscriber's replay: the in-process pump
+ * (`subscriber-lifecycle.ts`) and the cross-replica direct walk
+ * (`outbound.ts`, `externalBroadcast`).
+ *
+ * A `seq` counts within one counter. When the counter restarts while a
+ * subscriber stays attached (a hosted counter evicted or expired, a
+ * server restarted over a persistent session store), the next frame
+ * arrives at a low `seq` with a new epoch. Filtering it by the old
+ * boundary would drop it, and every later one, with no signal: the
+ * frame of another epoch is delivered instead, and the subscriber moves
+ * to the new epoch with an empty boundary.
+ */
+/**
+ * A subscriber's replay boundary: the latest `seq` its snapshot and
+ * replay covered, and the epoch that `seq` counts in (`undefined` when
+ * the snapshot had none: no counter yet, or a buffer that predates
+ * epochs). Mutable: a live frame of another epoch moves it.
+ */
+export interface StreamReplayCursor {
+    seq: number;
+    epoch: string | undefined;
+    /**
+     * The epochs this cursor has moved away from, newest last, at most
+     * {@link RETIRED_EPOCHS_KEPT}. A late frame of one of them (a
+     * cross-replica frame published just before the restart) is dropped, so
+     * it cannot move the cursor back and empty its boundary again.
+     */
+    retired?: string[];
+}
+/** How many epochs a cursor remembers having left. */
+export declare const RETIRED_EPOCHS_KEPT = 4;
+/** What to do with one live data frame for one subscriber. */
+export interface LiveAdmission {
+    readonly deliver: boolean;
+    /** Set when the frame moved the subscriber to another epoch. */
+    readonly epochChanged?: {
+        readonly from: string;
+        readonly to: string;
+    };
+}
+/**
+ * Decide whether a live data frame reaches a subscriber, and move its
+ * cursor when the frame's epoch differs:
+ *   - an unstamped frame (no `seq`) was never buffered and always passes;
+ *   - a late frame of an epoch the cursor has left is dropped;
+ *   - a frame of another epoch than the cursor's is delivered, and the
+ *     cursor moves to that epoch with an empty boundary (a restart);
+ *   - the first epoch a cursor without one sees is adopted, and its seq
+ *     boundary stands (the snapshot simply had no epoch yet);
+ *   - otherwise a frame at or below the boundary was, or will be, sent
+ *     by the replay, and is skipped.
+ * An absent epoch on the frame is unknown, never a mismatch.
+ */
+export declare function admitLiveEnvelope(cursor: StreamReplayCursor, envelope: {
+    readonly seq?: number;
+    readonly streamEpoch?: string;
+}): LiveAdmission;
+//# sourceMappingURL=stream-epoch.d.ts.map

package/dist/ggui-session-channel/stream-epoch.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"stream-epoch.d.ts","sourceRoot":"","sources":["../../src/ggui-session-channel/stream-epoch.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAEH;;;;;GAKG;AACH,MAAM,WAAW,kBAAkB;IACjC,GAAG,EAAE,MAAM,CAAC;IACZ,KAAK,EAAE,MAAM,GAAG,SAAS,CAAC;IAC1B;;;;;OAKG;IACH,OAAO,CAAC,EAAE,MAAM,EAAE,CAAC;CACpB;AAED,sDAAsD;AACtD,eAAO,MAAM,mBAAmB,IAAI,CAAC;AAErC,8DAA8D;AAC9D,MAAM,WAAW,aAAa;IAC5B,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC;IAC1B,gEAAgE;IAChE,QAAQ,CAAC,YAAY,CAAC,EAAE;QAAE,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAA;KAAE,CAAC;CACxE;AAED;;;;;;;;;;;;GAYG;AACH,wBAAgB,iBAAiB,CAC/B,MAAM,EAAE,kBAAkB,EAC1B,QAAQ,EAAE;IAAE,QAAQ,CAAC,GAAG,CAAC,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAA;CAAE,GACjE,aAAa,CAcf"}

package/dist/ggui-session-channel/stream-epoch.js

@@ -0,0 +1,47 @@
+/**
+ * The live tail's replay boundary, with the stream counter's epoch
+ * (ggui#1531). One rule, shared by the two places a live data frame is
+ * filtered against a subscriber's replay: the in-process pump
+ * (`subscriber-lifecycle.ts`) and the cross-replica direct walk
+ * (`outbound.ts`, `externalBroadcast`).
+ *
+ * A `seq` counts within one counter. When the counter restarts while a
+ * subscriber stays attached (a hosted counter evicted or expired, a
+ * server restarted over a persistent session store), the next frame
+ * arrives at a low `seq` with a new epoch. Filtering it by the old
+ * boundary would drop it, and every later one, with no signal: the
+ * frame of another epoch is delivered instead, and the subscriber moves
+ * to the new epoch with an empty boundary.
+ */
+/** How many epochs a cursor remembers having left. */
+export const RETIRED_EPOCHS_KEPT = 4;
+/**
+ * Decide whether a live data frame reaches a subscriber, and move its
+ * cursor when the frame's epoch differs:
+ *   - an unstamped frame (no `seq`) was never buffered and always passes;
+ *   - a late frame of an epoch the cursor has left is dropped;
+ *   - a frame of another epoch than the cursor's is delivered, and the
+ *     cursor moves to that epoch with an empty boundary (a restart);
+ *   - the first epoch a cursor without one sees is adopted, and its seq
+ *     boundary stands (the snapshot simply had no epoch yet);
+ *   - otherwise a frame at or below the boundary was, or will be, sent
+ *     by the replay, and is skipped.
+ * An absent epoch on the frame is unknown, never a mismatch.
+ */
+export function admitLiveEnvelope(cursor, envelope) {
+    if (envelope.seq === undefined)
+        return { deliver: true };
+    const epoch = envelope.streamEpoch;
+    if (epoch !== undefined && cursor.retired?.includes(epoch) === true)
+        return { deliver: false };
+    if (epoch !== undefined && epoch !== cursor.epoch) {
+        const from = cursor.epoch;
+        cursor.epoch = epoch;
+        if (from !== undefined) {
+            cursor.retired = [...(cursor.retired ?? []), from].slice(-RETIRED_EPOCHS_KEPT);
+            cursor.seq = 0;
+            return { deliver: true, epochChanged: { from, to: epoch } };
+        }
+    }
+    return { deliver: envelope.seq > cursor.seq };
+}