@ggui-ai/mcp-server 0.24.0 → 0.26.0

package/dist/ggui-session-channel/subscribe.d.ts

@@ -2,8 +2,8 @@
  * Subscribe / credential-path family for the live channel — upgrade-
  * time identity resolution across the three auth planes (bearer via
  * the AuthAdapter, ws-token bootstrap, console cookie) and the
- * `subscribe` handler itself: version handshake, bootstrap verify +
- * reconnect-credential mint, identity-default appId resolution,
+ * `subscribe` handler itself: version handshake, bootstrap verify,
+ * identity-default appId resolution,
  * dev-mode render provisioning, replay, registration, and the ack.
  */
 import type { AuthAdapter, AuthResult, GguiSessionStore, GguiSessionStreamBuffer, StoredGguiSession, StreamFanout } from "@ggui-ai/mcp-server-core";
@@ -25,10 +25,11 @@ import type { SubscriberLifecycle } from "./subscriber-lifecycle.js";
  *      (invalid sig, expired, wrong kind, replayed, etc.).
  *   2. The bound `sessionId` MUST match the one on the subscribe
  *      payload. Mismatches are rejected with a clean error.
- *   3. On success, the server mints a reconnect credential via
- *      `issueSessionToken(sessionId, appId)` and returns it in
- *      `AckPayload.sessionToken`. The iframe stores this for WS
- *      reconnects via the normal bearer path.
+ *   3. On success, the subscribe binds to that identity. No reconnect
+ *      credential is minted (ggui#1488): a reconnect presents a live
+ *      `wsToken` again, renewed before it expires through
+ *      `GET /api/sessions/:id/state`, or at any age through
+ *      `ggui_runtime_refresh_ws_token`.
  *
  * Bootstrap auth is MUTUALLY EXCLUSIVE with the upstream `AuthAdapter`
  * bearer path at subscribe time — when a bootstrap token is present,
@@ -44,8 +45,9 @@ import type { SubscriberLifecycle } from "./subscriber-lifecycle.js";
  * G14 (2026-05-23): bootstrap envelopes are no longer single-use. A
  * signature-valid + unexpired token authenticates EVERY subscribe
  * within the TTL window; transient WS drops reconnect without a fresh
- * handshake. Past expiry, the iframe MAY refresh via the
- * {@link refresh} surface; past the refresh window, fresh handshake.
+ * handshake. Past expiry, the view refreshes through
+ * `ggui_runtime_refresh_ws_token`, which re-mints only for a caller
+ * admitted to the session (ggui#1496 part B).
  */
 export type GguiSessionChannelBootstrapVerifyResult = {
     readonly ok: true;
@@ -55,53 +57,17 @@ export type GguiSessionChannelBootstrapVerifyResult = {
     readonly ok: false;
     readonly reason: "expired" | "invalid";
 };
-/**
- * Result of {@link GguiSessionChannelBootstrap.refresh}.
- *
- *   - `ok: true`: caller swaps the old envelope for `token` and resumes.
- *   - `ok: false`: caller MUST re-handshake (refresh window closed,
- *     tampered envelope, etc.).
- */
-export type GguiSessionChannelBootstrapRefreshResult = {
-    readonly ok: true;
-    readonly token: string;
-    readonly expiresAt: string;
-} | {
-    readonly ok: false;
-    readonly reason: "window_closed" | "invalid";
-};
 export interface GguiSessionChannelBootstrap {
     /**
      * Verify a `SubscribePayload.wsToken` token.
      *
      * Returns the bound identity on success, or a discriminated failure.
-     * The channel server maps `'expired'` to `BOOTSTRAP_EXPIRED` so the
-     * iframe can branch on refresh-vs-rehandshake, and `'invalid'` to
-     * `BOOTSTRAP_INVALID` for tamper / format / kind failures (no
-     * refresh on those).
+     * The channel server maps `'expired'` to `BOOTSTRAP_EXPIRED` (the view
+     * then refreshes through `ggui_runtime_refresh_ws_token`, an authorized
+     * re-mint), and `'invalid'` to `BOOTSTRAP_INVALID` for tamper, format or
+     * kind failures.
      */
     verify(token: string): GguiSessionChannelBootstrapVerifyResult;
-    /**
-     * Mint a longer-lived reconnect credential to return in
-     * `AckPayload.sessionToken`. Called only after a successful
-     * `verify()` on a bootstrap subscribe.
-     */
-    issueSessionToken(sessionId: string, appId: string): string;
-    /**
-     * Refresh a (possibly-expired-but-signature-valid) bootstrap envelope
-     * into a new envelope with a fresh TTL. Used by the
-     * `ggui_runtime_refresh_ws_token` MCP tool — iframes that see their
-     * bootstrap drift out of the TTL window swap in the refreshed
-     * envelope without going back through `ggui_render`.
-     *
-     * Stateless: verifies HMAC against the same secret used at mint,
-     * checks the refresh window against the ORIGINAL `iat`, and mints
-     * a fresh bootstrap envelope bound to the SAME `(sessionId, appId)`.
-     * Past the refresh window the result is `{ok:false, reason:
-     * 'window_closed'}`; tampered envelopes are `{ok:false, reason:
-     * 'invalid'}`.
-     */
-    refresh(token: string): GguiSessionChannelBootstrapRefreshResult;
 }
 /**
  * Cookie-based authentication for the live-channel upgrade. Used
@@ -140,6 +106,10 @@ export interface SubscribeDeps {
     readonly cookieAuth?: GguiSessionChannelCookieAuth;
     /** Identity → appId mapping — see `GguiSessionChannelOptions.appIdFromIdentity`. */
     readonly appIdFromIdentity?: (result: AuthResult) => string;
+    /** Per-app authorization for a declared appId — see `GguiSessionChannelOptions.authorizeApp`. */
+    readonly authorizeApp?: (appId: string, identity: AuthResult) => Promise<void>;
+    /** Sources authorized on every subscribe — see `GguiSessionChannelOptions.perAppOnlySources`. */
+    readonly perAppOnlySources?: readonly AuthResult["source"][];
     /** Version-handshake policy — see `GguiSessionChannelOptions.versionPolicy`. */
     readonly versionPolicy?: "advisory" | "reject";
     readonly sendError: Outbound["sendError"];
@@ -153,6 +123,12 @@ export interface SubscribeDeps {
  * `/api/sessions/:sessionId/stream`) runs BEFORE this; the tail trusts
  * `stored` + `identity` as already-authorized.
  */
+/**
+ * A subscribe's credential when it is not the auth adapter's bearer
+ * (ggui#1488): a `wsToken`, or the console cookie. Logged as
+ * `render_channel_subscribed.source`.
+ */
+export type SubscribeCredential = "ws_token" | "console_cookie";
 export type CompleteSubscribeArgs = {
     /** Resolved render row the subscriber binds to. */
     readonly stored: StoredGguiSession;
@@ -164,10 +140,17 @@ export type CompleteSubscribeArgs = {
     readonly sinceSequence?: number;
     /** Stream-buffer cursor — replays `data` frames per policy when set. */
     readonly fromSeq?: number;
+    /** The epoch `fromSeq` was counted in (ggui#1531); read only beside it. */
+    readonly fromEpoch?: string;
     /** Correlates the ack / error frames to a WS request. SSE has none. */
     readonly requestId?: string;
-    /** Bootstrap-minted reconnect credential to stamp on the ack. */
-    readonly sessionToken?: string;
+    /**
+     * The credential the subscribe came on, when it is not the auth
+     * adapter's bearer: a `wsToken` (the bootstrap path, on the WebSocket or
+     * the SSE stream) or the console cookie. Both resolve to a synthetic
+     * identity whose own `source` would misreport them.
+     */
+    readonly credential?: SubscribeCredential;
 } & ({
     readonly transport: "ws";
     /** The socket — kept on the subscriber row for inbound dispatch. */
@@ -193,9 +176,13 @@ export interface SubscribeHandlers {
     /**
      * The transport-neutral subscribe tail, order preserved exactly:
      * stream-cursor snapshot → stream-buffer replay read → StreamFanout
-     * iterator → register (pump starts) → ack → GguiSessionEvent-ledger
-     * replay (`render_event` frames, `resumeId` = ledger seq) →
-     * stream-replay `data` frames. WS `handleSubscribe` calls this after
+     * iterator → register (pump starts; every write to the subscriber's
+     * sink is held until the replay below is written, ggui#1525) → the
+     * first GguiSessionEvent-ledger page read, when `sinceSequence` is set
+     * (before the ack, so a failed read sends none, ggui#1528) → ack →
+     * ledger replay (`render_event` frames, `resumeId` = ledger seq; later
+     * pages read as they go) → stream-replay `data` frames → release of the
+     * held frames. WS `handleSubscribe` calls this after
      * its auth/provision head; SSE attaches call it via
      * `GguiSessionChannelServer.attachExternalSubscriber`.
      *

package/dist/ggui-session-channel/subscribe.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"subscribe.d.ts","sourceRoot":"","sources":["../../src/ggui-session-channel/subscribe.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,KAAK,EACV,WAAW,EACX,UAAU,EACV,gBAAgB,EAChB,uBAAuB,EACvB,iBAAiB,EACjB,YAAY,EACb,MAAM,0BAA0B,CAAC;AAGlC,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,uCAAuC,CAAC;AAC9E,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,WAAW,CAAC;AACjD,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,IAAI,CAAC;AAMpC,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,cAAc,CAAC;AAC3C,OAAO,KAAK,EAGV,cAAc,EAEf,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EAAgB,KAAK,QAAQ,EAAE,MAAM,eAAe,CAAC;AAC5D,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,2BAA2B,CAAC;AAErE;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH;;;;;;;;;;GAUG;AACH,MAAM,MAAM,uCAAuC,GAC/C;IACE,QAAQ,CAAC,EAAE,EAAE,IAAI,CAAC;IAClB,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;CACxB,GACD;IAAE,QAAQ,CAAC,EAAE,EAAE,KAAK,CAAC;IAAC,QAAQ,CAAC,MAAM,EAAE,SAAS,GAAG,SAAS,CAAA;CAAE,CAAC;AAEnE;;;;;;GAMG;AACH,MAAM,MAAM,wCAAwC,GAChD;IACE,QAAQ,CAAC,EAAE,EAAE,IAAI,CAAC;IAClB,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;CAC5B,GACD;IAAE,QAAQ,CAAC,EAAE,EAAE,KAAK,CAAC;IAAC,QAAQ,CAAC,MAAM,EAAE,eAAe,GAAG,SAAS,CAAA;CAAE,CAAC;AAEzE,MAAM,WAAW,2BAA2B;IAC1C;;;;;;;;OAQG;IACH,MAAM,CAAC,KAAK,EAAE,MAAM,GAAG,uCAAuC,CAAC;IAC/D;;;;OAIG;IACH,iBAAiB,CAAC,SAAS,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,MAAM,CAAC;IAC5D;;;;;;;;;;;;;OAaG;IACH,OAAO,CAAC,KAAK,EAAE,MAAM,GAAG,wCAAwC,CAAC;CAClE;AAED;;;;GAIG;AACH,MAAM,WAAW,4BAA4B;IAC3C;;;;OAIG;IACH,UAAU,CAAC,OAAO,EAAE,OAAO,WAAW,EAAE,mBAAmB,GAAG,MAAM,GAAG,IAAI,CAAC;IAC5E;;;;OAIG;IACH,MAAM,CAAC,WAAW,EAAE,MAAM,GAAG;QAAE,SAAS,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAA;KAAE,GAAG,IAAI,CAAC;CAC1E;AAED,MAAM,WAAW,aAAa;IAC5B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,kEAAkE;IAClE,QAAQ,CAAC,IAAI,EAAE,WAAW,CAAC;IAC3B,QAAQ,CAAC,WAAW,EAAE,gBAAgB,CAAC;IACvC,sEAAsE;IACtE,QAAQ,CAAC,YAAY,EAAE,uBAAuB,CAAC;IAC/C,mEAAmE;IACnE,QAAQ,CAAC,YAAY,EAAE,YAAY,CAAC;IACpC,iFAAiF;IACjF,QAAQ,CAAC,SAAS,CAAC,EAAE,2BAA2B,CAAC;IACjD,4EAA4E;IAC5E,QAAQ,CAAC,UAAU,CAAC,EAAE,4BAA4B,CAAC;IACnD,oFAAoF;IACpF,QAAQ,CAAC,iBAAiB,CAAC,EAAE,CAAC,MAAM,EAAE,UAAU,KAAK,MAAM,CAAC;IAC5D,gFAAgF;IAChF,QAAQ,CAAC,aAAa,CAAC,EAAE,UAAU,GAAG,QAAQ,CAAC;IAC/C,QAAQ,CAAC,SAAS,EAAE,QAAQ,CAAC,WAAW,CAAC,CAAC;IAC1C,QAAQ,CAAC,QAAQ,EAAE,mBAAmB,CAAC,UAAU,CAAC,CAAC;IACnD,QAAQ,CAAC,UAAU,EAAE,mBAAmB,CAAC,YAAY,CAAC,CAAC;CACxD;AAED;;;;;;GAMG;AACH,MAAM,MAAM,qBAAqB,GAAG;IAClC,mDAAmD;IACnD,QAAQ,CAAC,MAAM,EAAE,iBAAiB,CAAC;IACnC,wDAAwD;IACxD,QAAQ,CAAC,QAAQ,EAAE,UAAU,CAAC;IAC9B,qEAAqE;IACrE,QAAQ,CAAC,IAAI,EAAE,cAAc,CAAC;IAC9B,+EAA+E;IAC/E,QAAQ,CAAC,aAAa,CAAC,EAAE,MAAM,CAAC;IAChC,wEAAwE;IACxE,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC;IAC1B,uEAAuE;IACvE,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC;IAC5B,iEAAiE;IACjE,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM,CAAC;CAChC,GAAG,CACA;IACE,QAAQ,CAAC,SAAS,EAAE,IAAI,CAAC;IACzB,oEAAoE;IACpE,QAAQ,CAAC,EAAE,EAAE,SAAS,CAAC;CACxB,GACD;IAAE,QAAQ,CAAC,SAAS,EAAE,KAAK,CAAA;CAAE,CAChC,CAAC;AAEF,MAAM,WAAW,iBAAiB;IAChC;;;;;OAKG;IACH,0BAA0B,CAAC,GAAG,EAAE,eAAe,GAAG,OAAO,CAAC,UAAU,CAAC,CAAC;IACtE,iEAAiE;IACjE,eAAe,CACb,EAAE,EAAE,SAAS,EACb,QAAQ,EAAE,UAAU,EACpB,OAAO,EAAE,gBAAgB,GAAG;QAAE,IAAI,EAAE,WAAW,CAAA;KAAE,EACjD,WAAW,CAAC,EAAE;QAAE,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAA;KAAE,GACnE,OAAO,CAAC,IAAI,CAAC,CAAC;IACjB;;;;;;;;;;;OAWG;IACH,iBAAiB,CAAC,IAAI,EAAE,qBAAqB,GAAG,OAAO,CAAC;QAAE,QAAQ,CAAC,MAAM,EAAE,MAAM,IAAI,CAAA;KAAE,CAAC,CAAC;CAC1F;AAkBD,wBAAgB,uBAAuB,CAAC,IAAI,EAAE,aAAa,GAAG,iBAAiB,CA+gB9E"}
+{"version":3,"file":"subscribe.d.ts","sourceRoot":"","sources":["../../src/ggui-session-channel/subscribe.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,KAAK,EACV,WAAW,EACX,UAAU,EACV,gBAAgB,EAChB,uBAAuB,EACvB,iBAAiB,EACjB,YAAY,EAEb,MAAM,0BAA0B,CAAC;AAGlC,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,uCAAuC,CAAC;AAC9E,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,WAAW,CAAC;AACjD,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,IAAI,CAAC;AAMpC,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,cAAc,CAAC;AAC3C,OAAO,KAAK,EAGV,cAAc,EAEf,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EAAgB,KAAK,QAAQ,EAAE,MAAM,eAAe,CAAC;AAC5D,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,2BAA2B,CAAC;AAErE;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH;;;;;;;;;;;GAWG;AACH,MAAM,MAAM,uCAAuC,GAC/C;IACE,QAAQ,CAAC,EAAE,EAAE,IAAI,CAAC;IAClB,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;CACxB,GACD;IAAE,QAAQ,CAAC,EAAE,EAAE,KAAK,CAAC;IAAC,QAAQ,CAAC,MAAM,EAAE,SAAS,GAAG,SAAS,CAAA;CAAE,CAAC;AAEnE,MAAM,WAAW,2BAA2B;IAC1C;;;;;;;;OAQG;IACH,MAAM,CAAC,KAAK,EAAE,MAAM,GAAG,uCAAuC,CAAC;CAChE;AAED;;;;GAIG;AACH,MAAM,WAAW,4BAA4B;IAC3C;;;;OAIG;IACH,UAAU,CAAC,OAAO,EAAE,OAAO,WAAW,EAAE,mBAAmB,GAAG,MAAM,GAAG,IAAI,CAAC;IAC5E;;;;OAIG;IACH,MAAM,CAAC,WAAW,EAAE,MAAM,GAAG;QAAE,SAAS,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAA;KAAE,GAAG,IAAI,CAAC;CAC1E;AAED,MAAM,WAAW,aAAa;IAC5B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,kEAAkE;IAClE,QAAQ,CAAC,IAAI,EAAE,WAAW,CAAC;IAC3B,QAAQ,CAAC,WAAW,EAAE,gBAAgB,CAAC;IACvC,sEAAsE;IACtE,QAAQ,CAAC,YAAY,EAAE,uBAAuB,CAAC;IAC/C,mEAAmE;IACnE,QAAQ,CAAC,YAAY,EAAE,YAAY,CAAC;IACpC,iFAAiF;IACjF,QAAQ,CAAC,SAAS,CAAC,EAAE,2BAA2B,CAAC;IACjD,4EAA4E;IAC5E,QAAQ,CAAC,UAAU,CAAC,EAAE,4BAA4B,CAAC;IACnD,oFAAoF;IACpF,QAAQ,CAAC,iBAAiB,CAAC,EAAE,CAAC,MAAM,EAAE,UAAU,KAAK,MAAM,CAAC;IAC5D,iGAAiG;IACjG,QAAQ,CAAC,YAAY,CAAC,EAAE,CAAC,KAAK,EAAE,MAAM,EAAE,QAAQ,EAAE,UAAU,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IAC/E,iGAAiG;IACjG,QAAQ,CAAC,iBAAiB,CAAC,EAAE,SAAS,UAAU,CAAC,QAAQ,CAAC,EAAE,CAAC;IAC7D,gFAAgF;IAChF,QAAQ,CAAC,aAAa,CAAC,EAAE,UAAU,GAAG,QAAQ,CAAC;IAC/C,QAAQ,CAAC,SAAS,EAAE,QAAQ,CAAC,WAAW,CAAC,CAAC;IAC1C,QAAQ,CAAC,QAAQ,EAAE,mBAAmB,CAAC,UAAU,CAAC,CAAC;IACnD,QAAQ,CAAC,UAAU,EAAE,mBAAmB,CAAC,YAAY,CAAC,CAAC;CACxD;AAED;;;;;;GAMG;AACH;;;;GAIG;AACH,MAAM,MAAM,mBAAmB,GAAG,UAAU,GAAG,gBAAgB,CAAC;AAEhE,MAAM,MAAM,qBAAqB,GAAG;IAClC,mDAAmD;IACnD,QAAQ,CAAC,MAAM,EAAE,iBAAiB,CAAC;IACnC,wDAAwD;IACxD,QAAQ,CAAC,QAAQ,EAAE,UAAU,CAAC;IAC9B,qEAAqE;IACrE,QAAQ,CAAC,IAAI,EAAE,cAAc,CAAC;IAC9B,+EAA+E;IAC/E,QAAQ,CAAC,aAAa,CAAC,EAAE,MAAM,CAAC;IAChC,wEAAwE;IACxE,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC;IAC1B,2EAA2E;IAC3E,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC;IAC5B,uEAAuE;IACvE,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC;IAC5B;;;;;OAKG;IACH,QAAQ,CAAC,UAAU,CAAC,EAAE,mBAAmB,CAAC;CAC3C,GAAG,CACA;IACE,QAAQ,CAAC,SAAS,EAAE,IAAI,CAAC;IACzB,oEAAoE;IACpE,QAAQ,CAAC,EAAE,EAAE,SAAS,CAAC;CACxB,GACD;IAAE,QAAQ,CAAC,SAAS,EAAE,KAAK,CAAA;CAAE,CAChC,CAAC;AAEF,MAAM,WAAW,iBAAiB;IAChC;;;;;OAKG;IACH,0BAA0B,CAAC,GAAG,EAAE,eAAe,GAAG,OAAO,CAAC,UAAU,CAAC,CAAC;IACtE,iEAAiE;IACjE,eAAe,CACb,EAAE,EAAE,SAAS,EACb,QAAQ,EAAE,UAAU,EACpB,OAAO,EAAE,gBAAgB,GAAG;QAAE,IAAI,EAAE,WAAW,CAAA;KAAE,EACjD,WAAW,CAAC,EAAE;QAAE,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAA;KAAE,GACnE,OAAO,CAAC,IAAI,CAAC,CAAC;IACjB;;;;;;;;;;;;;;;OAeG;IACH,iBAAiB,CAAC,IAAI,EAAE,qBAAqB,GAAG,OAAO,CAAC;QAAE,QAAQ,CAAC,MAAM,EAAE,MAAM,IAAI,CAAA;KAAE,CAAC,CAAC;CAC1F;AAwED,wBAAgB,uBAAuB,CAAC,IAAI,EAAE,aAAa,GAAG,iBAAiB,CAyoB9E"}