@ggui-ai/mcp-server 0.24.0 → 0.26.0

package/dist/server.js

@@ -39,7 +39,7 @@
  */
 import { CONSOLE_DIST_DIR } from "@ggui-ai/console/server";
 import { RUNTIME_BUNDLE_FILE, RUNTIME_BUNDLE_URL_PATH, RUNTIME_SHIMS_DIR, RUNTIME_SHIMS_URL_PREFIX, } from "@ggui-ai/iframe-runtime/server";
-import { createDeterministicBlueprintSelector, isTokenRegisteringAuthAdapter, mintSessionToken, mintWsToken, refreshWsToken, verifyToken, } from "@ggui-ai/mcp-server-core";
+import { isTokenRegisteringAuthAdapter, DEFAULT_WS_TOKEN_REFRESH_WINDOW_MULTIPLIER, DEFAULT_WS_TOKEN_TTL_SEC, mintViewRoot, mintWsToken, verifyWsTokenSignature, verifyToken, } from "@ggui-ai/mcp-server-core";
 import { createInMemoryBlueprintSearch, createInMemoryGeneratorRegistry, FixedWindowRateLimiter, InMemoryActiveConsumerRegistry, InMemoryAppMetadataStore, InMemoryAuthAdapter, InMemoryBlueprintIndex, InMemoryBlueprintStore, InMemoryKeyValueStore, InMemoryPairingService, InMemoryPendingEventConsumer, InMemoryQuotaStore, InMemoryGguiSessionStore, InMemoryGguiSessionStreamBuffer, InMemoryVectorStore, MockEmbeddingProvider, NoopAuditSink, NoopRateLimiter, NoopTelemetrySink, } from "@ggui-ai/mcp-server-core/in-memory";
 import { createGguiListGadgetsHandler, createGguiListThemesHandler, } from "@ggui-ai/mcp-server-handlers/app-discovery";
 import { createDescribeBlueprintFormatHandler, createDescribeDataContractFormatHandler, createGetBlueprintBoilerplateHandler, createGetExampleBlueprintsHandler, createListAvailablePrimitivesHandler, createListFeaturedBlueprintsHandler, createRenderBlueprintHandler, createSearchBlueprintsHandler, createValidateBlueprintHandler, } from "@ggui-ai/mcp-server-handlers/blueprints";
@@ -62,20 +62,17 @@ import { mountDevtoolThemeRoutes, } from "./console-theme-routes.js";
 import { mountConsoleTimelineRoutes } from "./console-timeline.js";
 import { buildInlineRenderShellHtml, } from "./mcp-apps-outbound.js";
 import { BoundedValidatorTraceSink, mountConsoleValidatorRoutes } from "./console-validator.js";
-// Operator-class MCP handlers — twelve `ggui_ops_*` handlers across
-// four domains (apps / orgs / connector-keys / coupon). Every factory
-// binds a deps seam; deployments that don't wire the seam simply
-// don't register the tool (matching `ggui_ops_get_credit_balance`'s
-// pattern).
+// Operator-class MCP handlers — the six `ggui_ops_*` apps handlers.
+// Every factory binds a deps seam; deployments that don't wire the
+// seam simply don't register the tool (matching
+// `ggui_ops_get_credit_balance`'s pattern).
 import { createCreateAppHandler, createDeleteAppHandler, createListAppsHandler, createSetAppThemeHandler, createSetDefaultAppHandler, createUpdateAppHandler, } from "@ggui-ai/mcp-server-handlers/ops-apps";
 import { fontFaceRules, validateOverlayCoverage } from "@ggui-ai/design/themes";
-import { createIssueConnectorKeyHandler, createListConnectorKeysHandler, createRevokeConnectorKeyHandler, } from "@ggui-ai/mcp-server-handlers/ops-connector-keys";
-import { createRedeemCouponHandler, } from "@ggui-ai/mcp-server-handlers/ops-coupon";
-import { createCreateOrgHandler, createGetOrgBalanceHandler, createInviteToOrgHandler, createListOrgsHandler, createRemoveOrgMemberHandler, createRenameOrgHandler, createRevokeInviteHandler, } from "@ggui-ai/mcp-server-handlers/ops-orgs";
-import { createGguiConsumeHandler, createGguiDeclareToolCatalogHandler, createGguiEmitHandler, createGguiGetRenderSourceHandler, createGguiGetSessionHandler, createGguiHandshakeHandler, createGguiListSessionsHandler, createGguiRefreshWsTokenHandler, createGguiRenderHandler, createGguiRuntimePullHandler, createGguiRuntimeTelemetryHandler, createGguiSubmitActionHandler, createGguiSyncContextHandler, createGguiUpdateHandler, createGguiAmendHandler, InMemoryToolIdentityCatalogStore, createInMemoryProvisionalPreviewRegistry, } from "@ggui-ai/mcp-server-handlers/renders";
+import { createGguiConsumeHandler, createGguiDeclareToolCatalogHandler, createGguiEmitHandler, createGguiGetRenderSourceHandler, createGguiGetSessionHandler, createGguiHandshakeHandler, createGguiListSessionsHandler, createGguiRefreshWsTokenHandler, createGguiRenderHandler, createGguiReportRenderFailureHandler, createGguiRuntimePullHandler, createGguiRuntimeTelemetryHandler, createGguiSubmitActionHandler, createGguiSyncContextHandler, createGguiUpdateHandler, createGguiAmendHandler, InMemoryToolIdentityCatalogStore, createInMemoryProvisionalPreviewRegistry, } from "@ggui-ai/mcp-server-handlers/renders";
 import { DEFAULT_ADMIN_BLUEPRINTS_PATH, mountAdminBlueprintsTransport, } from "./admin-blueprints-transport.js";
 import { mountAdminOAuthProvidersTransport } from "./admin-oauth-providers-transport.js";
 import { DEFAULT_BUILDER_APP_ID, defaultAppIdFromIdentity } from "./auth.js";
+import { assertViewProofDeclarations, createViewProofGate, unverifiableViewProofTools, } from "./view-proof-gate.js";
 import { mountMcpEndpoints } from "./mcp-endpoint-routes.js";
 import { mountApiRendersRoutes } from "./api-renders-routes.js";
 import { mountApiRendersStreamRoute } from "./api-renders-stream-route.js";
@@ -100,7 +97,7 @@ import { computeRuntimeBundleHash, insertRuntimeBundleHash, } from "./runtime-bu
 import { createCsrfMiddleware, mountCsrfTokenRoute } from "./csrf-middleware.js";
 import { mountEmailLoginRoutes } from "./email-login.js";
 import { resolveMcpInstructions } from "./instructions-presets.js";
-import { buildLlmCaller, createLlmBackedHandshakeNegotiator } from "./llm-backed-negotiator.js";
+import { createLlmBackedHandshakeNegotiator } from "./llm-backed-negotiator.js";
 import { createConsoleLogger } from "./logger.js";
 import { buildControlService, CONTROL_PATH } from "./control-service.js";
 import { createBrowserCorsMiddleware, createPreflightFallback } from "./browser-cors.js";
@@ -234,6 +231,9 @@ export function buildOpsBlueprintHandlers(input) {
     }));
     handlers.push(createGguiOpsDeleteBlueprintHandler({
         blueprintStore: bundle.blueprintStore,
+        // ggui#1541 — the registry generate and register mirror into, so a
+        // delete takes the blueprint out of the handshake's reuse too.
+        ...(bundle.cacheRegistry ? { cacheRegistry: bundle.cacheRegistry } : {}),
         authorizeAppAccess: bundle.authorizeAppAccess,
     }));
     return handlers;
@@ -366,15 +366,25 @@ export function defaultHandlers(deps) {
         handlers.push(createGguiRuntimeTelemetryHandler({
             ...(deps.logger ? { logger: deps.logger } : {}),
         }));
-        // `ggui_runtime_refresh_ws_token` — G14 (2026-05-23) signed-
-        // envelope refresh tool. Registered only when a refresh seam is
-        // wired (typically `channelBootstrap.refresh` from the
-        // mcpAppsEnabled branch). Without the seam, the tool would always
-        // return BOOTSTRAP_NOT_SUPPORTED, which is honest but useless on
-        // tools/list — skip registration entirely.
-        if (deps.render.bootstrapRefresh) {
+        // `ggui_runtime_report_render_failure` (ggui#1609) — a card whose render
+        // failed says so, for the session its view proof binds. Unlike
+        // telemetry it is recorded, so its session is proven, never claimed;
+        // this server names each proven report (`render_failed`) and stores
+        // nothing — a deployment that keeps a per-session mark supplies
+        // `recordRenderFailure` when it composes its own handler set.
+        handlers.push(createGguiReportRenderFailureHandler({
+            renderStore: deps.render.renderStore,
+        }));
+        // `ggui_runtime_refresh_ws_token` — the authorized re-mint of a
+        // view's live credential (ggui#1496 part B). Registered only when the
+        // deployment can both verify an envelope and mint a credential;
+        // without either, the tool would answer BOOTSTRAP_NOT_SUPPORTED on
+        // every call, which is honest but useless on tools/list.
+        if (deps.render.wsTokenVerify && deps.render.mintBootstrap) {
             handlers.push(createGguiRefreshWsTokenHandler({
-                refreshSeam: deps.render.bootstrapRefresh,
+                renderStore: deps.render.renderStore,
+                verify: deps.render.wsTokenVerify,
+                mint: deps.render.mintBootstrap,
             }));
         }
         // Phase B (flatten-render-identity): the session lifetime entry
@@ -453,7 +463,13 @@ export function defaultHandlers(deps) {
             // Bootstrap-emission deps mirror render so MCP Apps hosts that
             // forward `ui/notifications/tool-result` via postMessage can
             // re-apply patched props on the live mount without a WS round-trip.
-            ...(deps.update.mintBootstrap ? { mintWsToken: deps.update.mintBootstrap } : {}),
+            // The result door issues a view key when a key-issuing minter is
+            // wired (ggui#1415); otherwise it mints the live credential alone.
+            ...(deps.update.mintViewRoot
+                ? { mintWsToken: deps.update.mintViewRoot }
+                : deps.update.mintBootstrap
+                    ? { mintWsToken: deps.update.mintBootstrap }
+                    : {}),
             ...(deps.update.runtimeUrl !== undefined ? { runtimeUrl: deps.update.runtimeUrl } : {}),
             ...(deps.update.sessionApiBaseUrl !== undefined
                 ? { sessionApiBaseUrl: deps.update.sessionApiBaseUrl }
@@ -637,7 +653,13 @@ export function defaultHandlers(deps) {
             ...(deps.render.streamWebSocketLocalTools !== undefined
                 ? { streamWebSocketLocalTools: deps.render.streamWebSocketLocalTools }
                 : {}),
-            ...(deps.render.mintBootstrap ? { mintWsToken: deps.render.mintBootstrap } : {}),
+            // The result door issues a view key when a key-issuing minter is
+            // wired (ggui#1415); otherwise it mints the live credential alone.
+            ...(deps.render.mintViewRoot
+                ? { mintWsToken: deps.render.mintViewRoot }
+                : deps.render.mintBootstrap
+                    ? { mintWsToken: deps.render.mintBootstrap }
+                    : {}),
             ...(deps.render.runtimeUrl !== undefined ? { runtimeUrl: deps.render.runtimeUrl } : {}),
             ...(deps.render.sessionApiBaseUrl !== undefined
                 ? { sessionApiBaseUrl: deps.render.sessionApiBaseUrl }
@@ -719,8 +741,8 @@ export function defaultHandlers(deps) {
     return handlers;
 }
 /**
- * Build the operator-class handlers for the apps / orgs /
- * connector-keys / coupon / blueprint domains. Each domain materializes
+ * Build the operator-class handlers for the apps and blueprint
+ * domains. Each domain materializes
  * independently when its deps seam is bound; deployments that wired
  * none get an empty list.
  *
@@ -742,19 +764,6 @@ export function buildOpsBundleHandlers(deps) {
         // REST/AppSync doors refuse the same overlay for the same reason.
         createSetAppThemeHandler({ apps, overlayCoverage: (overlay) => validateOverlayCoverage(overlay) }), createDeleteAppHandler({ apps, userDefaultApp }), createSetDefaultAppHandler({ apps, userDefaultApp }));
     }
-    if (deps.opsOrgs) {
-        const { orgs, invites } = deps.opsOrgs;
-        handlers.push(createListOrgsHandler({ orgs }), createCreateOrgHandler({ orgs }), createRenameOrgHandler({ orgs }), createRemoveOrgMemberHandler({ orgs }), createGetOrgBalanceHandler({ orgs }), createInviteToOrgHandler({ invites }), createRevokeInviteHandler({ invites }));
-    }
-    if (deps.opsConnectorKeys) {
-        const { connectorKeys } = deps.opsConnectorKeys;
-        handlers.push(createListConnectorKeysHandler({ connectorKeys }), createIssueConnectorKeyHandler({ connectorKeys }), createRevokeConnectorKeyHandler({ connectorKeys }));
-    }
-    if (deps.opsCoupon) {
-        handlers.push(createRedeemCouponHandler({
-            coupons: deps.opsCoupon.coupons,
-        }));
-    }
     if (deps.opsBlueprint) {
         // No server-level `appMetadataStore` fallback on this path — the
         // bundle's own field governs, since a deployment that binds its own
@@ -766,12 +775,49 @@ export function buildOpsBundleHandlers(deps) {
     }
     return handlers;
 }
+/**
+ * How long {@link GguiServer.close} lets active connections finish before
+ * it ends them (ggui#1631), in milliseconds.
+ */
+export const DEFAULT_CLOSE_GRACE_MS = 5000;
+/**
+ * The ws-token TTL and refresh window a server mints with (ggui#1496 part
+ * B). Both are positive whole seconds, and the window is at least the TTL:
+ * then every token this server mints, root and renewal alike, is past its
+ * `exp` by `rootIat + window`, so every gate refuses it in the same second.
+ * (A token minted while the window was longer, or by a server sharing the
+ * secret with a longer window, can outlive that second on the other gates;
+ * only `/state` refuses it.)
+ */
+function resolveWsTokenLifetimes(opts) {
+    const wholePositive = (v) => Number.isInteger(v) && v > 0;
+    const ttlSec = opts.wsTokenTtlSec ?? DEFAULT_WS_TOKEN_TTL_SEC;
+    if (!wholePositive(ttlSec)) {
+        throw new Error(`createGguiServer: wsTokenTtlSec must be a positive whole number of seconds (got ${String(ttlSec)}).`);
+    }
+    const windowSec = opts.wsTokenRefreshWindowSec ?? DEFAULT_WS_TOKEN_REFRESH_WINDOW_MULTIPLIER * ttlSec;
+    if (!wholePositive(windowSec)) {
+        throw new Error(`createGguiServer: wsTokenRefreshWindowSec must be a positive whole number of seconds (got ${String(windowSec)}).`);
+    }
+    if (windowSec < ttlSec) {
+        throw new Error(`createGguiServer: wsTokenRefreshWindowSec (${windowSec}) must be at least wsTokenTtlSec (${ttlSec}); a shorter window would let a root token outlive its own renewal chain.`);
+    }
+    return { ttlSec, windowSec };
+}
 /**
  * Build a runnable OSS MCP server. Every option has a sensible default
  * so `createGguiServer()` with no arguments boots a working in-memory
  * server on demand.
  */
 export function createGguiServer(opts = {}) {
+    if ((opts.perAppRouting?.perAppOnlySources?.length ?? 0) > 0 && !opts.perAppRouting?.authorize) {
+        throw new Error("createGguiServer: perAppRouting.perAppOnlySources lists credential sources that are valid only at their app's endpoint, but perAppRouting.authorize is not wired");
+    }
+    const { ttlSec: wsTokenTtlSec, windowSec: wsTokenRefreshWindowSec } = resolveWsTokenLifetimes(opts);
+    const keyedSince = opts.viewProof?.keyedSince;
+    if (keyedSince !== undefined && (!Number.isFinite(keyedSince) || keyedSince < 0)) {
+        throw new Error(`createGguiServer: viewProof.keyedSince must be a finite, non-negative epoch in milliseconds (got ${String(keyedSince)}).`);
+    }
     const info = { ...DEFAULT_INFO, ...opts.info };
     const logger = opts.logger ?? createConsoleLogger({ server: info.name });
     const bodyLimit = opts.bodyLimit ?? "4mb";
@@ -986,9 +1032,23 @@ export function createGguiServer(opts = {}) {
     // (which always call this on the live-mode path) get clean strings
     // without per-callsite narrowing.
     let mintBootstrap;
+    // The key-issuing doors' minters (ggui#1415): a root ws token stamped
+    // with the secret's key id and the door, and the view key rooted in it.
+    // Only the render/update results (`result`) and the data-plane read door
+    // (`read`), on a read that issues the key, use them; every bearer door,
+    // and every read that issues no key, mints through `mintBootstrap`.
+    let mintResultViewRoot;
+    let mintReadViewRoot;
+    // `/state`'s one minter (ggui#1496 part B, slice 2): a possession renewal
+    // that carries its chain's root forward. Every other door mints a root
+    // through `mintBootstrap`.
+    let mintChainedBootstrap;
     let channelBootstrap;
-    // Shared HMAC secret for server-minted creds (bootstrap tokens,
-    // session tokens, console cookies). Distinct `kind` claims
+    // The authorized refresh's envelope check (ggui#1496 part B): signature,
+    // shape and kind at ANY age, over the same secret the minter signs with.
+    let wsTokenVerify;
+    // Shared HMAC secret for server-minted creds (ws bootstrap tokens,
+    // console cookies). Distinct `kind` claims
     // prevent cross-kind confusion; sharing the secret keeps the
     // config surface small and means operators rotate ONE value.
     // Resolved here so both the MCP Apps block and the console
@@ -1009,7 +1069,7 @@ export function createGguiServer(opts = {}) {
         // from `@ggui-ai/mcp-server-core` for callers that need explicit
         // single-use semantics (one-time-link share, etc.).
         const syncMinter = (sessionId, appId) => {
-            const { token, claims } = mintWsToken({ sessionId, appId }, secret);
+            const { token, claims } = mintWsToken({ sessionId, appId, ttlSec: wsTokenTtlSec }, secret);
             return {
                 wsUrl,
                 token,
@@ -1017,6 +1077,36 @@ export function createGguiServer(opts = {}) {
             };
         };
         mintBootstrap = syncMinter;
+        const viewRootMinter = (src) => (sessionId, appId) => {
+            const minted = mintViewRoot({ sessionId, appId, ttlSec: wsTokenTtlSec, src }, secret);
+            if (minted.viewKeyNotIssued !== undefined) {
+                logger.info("view_key_not_issued", { sessionId, src, reason: minted.viewKeyNotIssued });
+            }
+            return {
+                wsUrl,
+                token: minted.token,
+                expiresAt: new Date(minted.claims.exp * 1000).toISOString(),
+                viewKey: minted.viewKey,
+            };
+        };
+        mintResultViewRoot = viewRootMinter("result");
+        mintReadViewRoot = viewRootMinter("read");
+        // The renewal's `exp` is capped at `rootIat + window` by the mint
+        // itself (`notAfter`), from the same clock read that stamps its `iat`.
+        // No second left means nothing to renew (`undefined`, answered as the
+        // ordinary expiry). That happens when the bound's second arrives between
+        // the route's expiry check and this mint (the route awaits the store in
+        // between), or for a token minted while the window was longer.
+        mintChainedBootstrap = (sessionId, appId, rootIat) => {
+            const { token, claims } = mintWsToken({ sessionId, appId, ttlSec: wsTokenTtlSec, rootIat, notAfter: rootIat + wsTokenRefreshWindowSec }, secret);
+            if (claims.exp <= claims.iat)
+                return undefined;
+            return {
+                wsUrl,
+                token,
+                expiresAt: new Date(claims.exp * 1000).toISOString(),
+            };
+        };
         channelBootstrap = {
             verify: (token) => {
                 const result = verifyToken(token, secret, "ws");
@@ -1035,28 +1125,17 @@ export function createGguiServer(opts = {}) {
                 }
                 return { ok: false, reason: "invalid" };
             },
-            issueSessionToken: (sessionId, appId) => {
-                const { token } = mintSessionToken({ sessionId, appId }, secret);
-                return token;
-            },
-            refresh: (token) => {
-                const result = refreshWsToken(token, secret);
-                if (result.ok) {
-                    return {
-                        ok: true,
-                        token: result.token,
-                        expiresAt: new Date(result.claims.exp * 1000).toISOString(),
-                    };
-                }
-                if (result.reason === "refresh_window_closed") {
-                    return { ok: false, reason: "window_closed" };
+        };
+        wsTokenVerify = (envelope) => {
+            const result = verifyWsTokenSignature(envelope, secret);
+            return result.ok
+                ? {
+                    ok: true,
+                    sessionId: result.claims.sessionId,
+                    appId: result.claims.appId,
+                    rootIat: result.claims.rootIat ?? result.claims.iat,
                 }
-                // Tamper / format / kind / shape failures collapse into a
-                // single `invalid` — the iframe MUST re-handshake; the exact
-                // breakage type is logged server-side, not surfaced on the
-                // wire (would be useful only to attackers probing the surface).
-                return { ok: false, reason: "invalid" };
-            },
+                : { ok: false };
         };
     }
     // Live-channel render endpoint reference. Declared here (not at the
@@ -1162,7 +1241,6 @@ export function createGguiServer(opts = {}) {
         new InMemoryBlueprintStore({
             embeddingProvider: opts.embedding,
         });
-    const blueprintSelector = opts.blueprintSelector ?? createDeterministicBlueprintSelector();
     // Auto-seed the multi-axis search against the resolved store.
     // Type-narrowed at the call site: when the caller passed
     // their own store we can't assume it implements `listAllForApp`,
@@ -1445,15 +1523,11 @@ export function createGguiServer(opts = {}) {
                             ? { postFailureHook: opts.renderPostFailureHook }
                             : {}),
                         ...(mintBootstrap ? { mintBootstrap } : {}),
-                        // G14 (2026-05-23) refresh seam. Same `channelBootstrap`
-                        // the WS upgrade path uses — sharing it means one HMAC
-                        // secret + one refresh-window policy across the verify
-                        // path and the `ggui_runtime_refresh_ws_token` tool.
-                        // Absent when MCP Apps isn't enabled or no bootstrap
-                        // secret is wired; the tool isn't registered in that case.
-                        ...(channelBootstrap
-                            ? { bootstrapRefresh: { refresh: channelBootstrap.refresh } }
-                            : {}),
+                        ...(mintResultViewRoot ? { mintViewRoot: mintResultViewRoot } : {}),
+                        // The authorized refresh's envelope check (ggui#1496 part B),
+                        // over the same secret as `mintBootstrap`. Absent when MCP
+                        // Apps isn't enabled; the tool isn't registered then.
+                        ...(wsTokenVerify ? { wsTokenVerify } : {}),
                         // Iframe-runtime bundle URL — padded onto the
                         // `ai.ggui/render.runtimeUrl` slice field by the render
                         // handler's resultMeta. C8 made this required on
@@ -1526,25 +1600,7 @@ export function createGguiServer(opts = {}) {
                         // every story-path render + emits `cache.hit /
                         // similarity / cachedBlueprintId / llmCallsAvoided` on
                         // structuredContent.
-                        ...(generationWithCache
-                            ? {
-                                generation: {
-                                    ...generationWithCache,
-                                    // Thread an LLMCaller resolver into
-                                    // render so the registry-based three-tier matcher
-                                    // can fire its rerank step. Per-call resolution
-                                    // because BYOK creds depend on ctx.
-                                    resolveLlmCaller: async (ctx) => {
-                                        if (!generationWithCache.resolveLlm)
-                                            return null;
-                                        const creds = await generationWithCache.resolveLlm(ctx);
-                                        if (!creds)
-                                            return null;
-                                        return buildLlmCaller(creds.selection, creds.providerKey);
-                                    },
-                                },
-                            }
-                            : {}),
+                        ...(generationWithCache ? { generation: generationWithCache } : {}),
                         // Live-subscriber notifier. Late-binds to the
                         // GguiSessionChannelServer created further down (`channel`
                         // / `channelForHealth`) — the channel doesn't exist yet
@@ -1678,6 +1734,7 @@ export function createGguiServer(opts = {}) {
                         // resolvers keeps the two transports byte-identical at the
                         // bootstrap-projection boundary.
                         ...(mintBootstrap ? { mintBootstrap } : {}),
+                        ...(mintResultViewRoot ? { mintViewRoot: mintResultViewRoot } : {}),
                         // Function form: matches render so ggui_update emits the
                         // same absolute URL when the server sits behind a tunnel
                         // / reverse proxy.
@@ -1771,12 +1828,12 @@ export function createGguiServer(opts = {}) {
             // same sink as the rest of the server.
             logger,
         });
-    // Operator-class domain handlers (apps / orgs / connector-keys /
-    // coupon / blueprints). Built on EVERY path — they hang off their own
-    // explicit options, so a deployment that supplies a custom base
-    // handler list still gets the domains it wired. A name already claimed
-    // by the base list wins: that's how a hosted deployment ships its own
-    // `ggui_ops_create_app` while still picking up the rest of the family,
+    // Operator-class domain handlers (apps / blueprints). Built on EVERY
+    // path — they hang off their own explicit options, so a deployment
+    // that supplies a custom base handler list still gets the domains it
+    // wired. A name already claimed by the base list wins: that's how a
+    // deployment ships its own `ggui_ops_create_app` while still picking
+    // up the rest of the family,
     // and it is what keeps the blueprint family single-registered when the
     // default handler set already built it from the same bundle.
     const baseHandlerNames = new Set(baseHandlers.map((h) => h.name));
@@ -1789,6 +1846,30 @@ export function createGguiServer(opts = {}) {
     // construction instead of at first `tools/call`. The actual route
     // mounting happens below alongside the canonical routes.
     const mcpServices = validateMcpServices(opts.mcpServices);
+    // ggui#1415 — the view-origin proof's measuring gate, over every handler
+    // this server serves (the data and control planes, mounts, and isolated
+    // services). Every declared proof must be one a view can sign (refused at
+    // boot otherwise). The gate runs where views are keyed (MCP Apps on);
+    // without it, a declared call's line says `viewProofUnverifiable`, named
+    // once here.
+    const servedHandlers = [...handlers, ...mcpServices.flatMap((service) => service.handlers)];
+    assertViewProofDeclarations(servedHandlers);
+    const viewProofGate = mcpAppsEnabled && sharedTokenSecret !== undefined
+        ? createViewProofGate({
+            secret: sharedTokenSecret,
+            sessionStore: renderStore,
+            ...(keyedSince !== undefined ? { keyedSince } : {}),
+        })
+        : undefined;
+    if (viewProofGate === undefined) {
+        const unverifiable = unverifiableViewProofTools(servedHandlers);
+        if (unverifiable.length > 0) {
+            logger.warn("view_proof_unverifiable", {
+                tools: unverifiable,
+                hint: "These tools declare a view proof. MCP Apps is off, so this server keys no view and does not verify proofs.",
+            });
+        }
+    }
     // The control plane — every `protocol`- and `ops`-tagged handler,
     // projected onto one anonymous-capable route with per-tool auth and
     // confirmation gates. Built from the SAME composed `handlers` array
@@ -1887,10 +1968,12 @@ export function createGguiServer(opts = {}) {
     // pass a stable `csrfSecret` so tokens survive a restart.
     app.use(createSecurityHeadersMiddleware());
     // Resolved once at boot — every per-request `buildMcpServer` call
-    // receives the same string, so `tools/list` + `initialize` stay
-    // consistent across the lifetime of the process. Operators tune
-    // via `mcpInstructions: 'default' | 'aggressive' | 'minimal' | 'off'`
-    // or a custom string. See `instructions-presets.ts` for full copy.
+    // receives the same string, so every `initialize` result carries the
+    // same instructions for the life of the process. Operators opt in via
+    // `mcpInstructions: 'default' | 'aggressive' | 'always' | 'minimal'` or
+    // a custom string; unset or `'off'` sends none (ggui#1579). The boot
+    // line says what is SENT, so it can never again name text no host got.
+    // See `instructions-presets.ts` for the copy.
     const resolvedInstructions = resolveMcpInstructions(opts.mcpInstructions);
     if (resolvedInstructions) {
         logger.info("mcp_instructions_set", {
@@ -1901,15 +1984,19 @@ export function createGguiServer(opts = {}) {
                     opts.mcpInstructions === "minimal" ||
                     opts.mcpInstructions === "off")
                 ? opts.mcpInstructions
-                : opts.mcpInstructions === undefined
-                    ? "default (no-preset fallback)"
-                    : "custom",
+                : "custom",
             length: resolvedInstructions.length,
+            sentInInitialize: true,
         });
     }
     else {
         logger.info("mcp_instructions_off", {
-            reason: opts.mcpInstructions === "off" ? "preset=off" : "empty custom string",
+            reason: opts.mcpInstructions === undefined
+                ? "unset (the default is off)"
+                : opts.mcpInstructions === "off"
+                    ? "preset=off"
+                    : "empty custom string",
+            sentInInitialize: false,
         });
     }
     const csrfSecret = opts.csrfSecret && opts.csrfSecret.length >= 32
@@ -2053,6 +2140,7 @@ export function createGguiServer(opts = {}) {
     // endpoint family spreads a fresh copy per request.
     const buildMcpOptions = {
         mcpAppsOutbound: mcpAppsEnabled,
+        ...(viewProofGate !== undefined ? { viewProofGate } : {}),
         // Caller-provided `shellHtml` overrides the default (and the
         // inline-runtime shell); `installMcpAppsOutbound` falls back to
         // its baked `GGUI_RENDER_SHELL_HTML` constant when both are
@@ -2225,6 +2313,10 @@ export function createGguiServer(opts = {}) {
                     // Mirrors the per-tool `mintBootstrap` plumbed into
                     // the handler factory above.
                     ...(mintBootstrap ? { mintWsToken: mintBootstrap } : {}),
+                    // The data-plane read door issues a view key (ggui#1415); every
+                    // other mount, and an anonymous caller, mints through
+                    // `mintBootstrap` alone.
+                    ...(mintReadViewRoot ? { mintViewRoot: mintReadViewRoot } : {}),
                 },
             }
             : {}),
@@ -2294,9 +2386,10 @@ export function createGguiServer(opts = {}) {
     // R6 /state snapshot + R7 /events cursor-replay reads — see
     // `./api-renders-routes.ts` for the wsToken auth posture, binding +
     // app-scope gates, and response taxonomy. Mounted only when MCP Apps is on,
-    // a render store is resolved, and a token secret exists (the same
-    // preconditions the credential minter needs).
-    if (mcpAppsEnabled && renderStore && sharedTokenSecret !== undefined) {
+    // a render store is resolved, and a token secret exists. MCP Apps being on
+    // is also what assigns the two minters, so the last conjunct only narrows
+    // the type: it never keeps a deployment from mounting.
+    if (mcpAppsEnabled && renderStore && sharedTokenSecret !== undefined && mintChainedBootstrap) {
         mountApiRendersRoutes({
             app,
             renderStore,
@@ -2314,7 +2407,7 @@ export function createGguiServer(opts = {}) {
             // composes (ggui#522) — session-API URLs keep the public origin.
             ...(opts.codeBaseUrl !== undefined ? { codeBaseUrl: opts.codeBaseUrl } : {}),
             ...(mintCodeModuleUrl !== undefined ? { mintCodeModuleUrl } : {}),
-            ...(mintBootstrap ? { mintBootstrap } : {}),
+            mintChainedBootstrap,
             resolveRuntimeUrl: resolveRuntimeUrlForResultMeta,
             logger,
         });
@@ -3031,6 +3124,14 @@ export function createGguiServer(opts = {}) {
             // above — subscribes that omit `payload.appId` resolve their
             // identity-default through the identical rule (SPEC §12.2).
             appIdFromIdentity,
+            // ggui#1480 — a subscribe that declares an app other than its
+            // identity's own passes the same per-app authorization the
+            // `/mcp` endpoint runs on a URL-addressed app.
+            ...(opts.perAppRouting?.authorize ? { authorizeApp: opts.perAppRouting.authorize } : {}),
+            // ggui#1482 — a listed source is authorized on every subscribe.
+            ...(opts.perAppRouting?.perAppOnlySources
+                ? { perAppOnlySources: opts.perAppRouting.perAppOnlySources }
+                : {}),
             logger: logger.child({ component: "render-channel" }),
             path: typeof opts.renderChannel === "object" ? opts.renderChannel.path : undefined,
             streamBuffer: streamBuffer ??
@@ -3157,7 +3258,6 @@ export function createGguiServer(opts = {}) {
         adminToken: resolvedAdminToken,
         generators: generators ?? null,
         blueprintStore,
-        blueprintSelector,
         blueprintSearch,
         async listen(port = 0, host = opts.host ?? "127.0.0.1") {
             // The Origin/Host validation policy (ggui#438a) was built above
@@ -3241,14 +3341,28 @@ export function createGguiServer(opts = {}) {
                 }
             });
         },
-        async close() {
+        async close(options = {}) {
             if (channel)
                 await channel.close();
             const server = httpServer;
             if (!server)
                 return;
+            const graceMs = options.graceMs ?? DEFAULT_CLOSE_GRACE_MS;
             await new Promise((resolve, reject) => {
-                server.close((err) => (err ? reject(err) : resolve()));
+                // ggui#1631: after the grace, end what is still open. The timer is
+                // unref'd so it never keeps the process alive on its own.
+                const deadline = Number.isFinite(graceMs)
+                    ? setTimeout(() => server.closeAllConnections(), Math.max(0, graceMs))
+                    : undefined;
+                deadline?.unref();
+                server.close((err) => {
+                    if (deadline !== undefined)
+                        clearTimeout(deadline);
+                    if (err)
+                        reject(err);
+                    else
+                        resolve();
+                });
             });
             httpServer = null;
         },

package/dist/storage.d.ts

@@ -1,4 +1,4 @@
-import type { GguiSessionStore, ThreadStore, VectorStore } from '@ggui-ai/mcp-server-core';
+import type { GguiSessionStore, GguiSessionStreamBuffer, ThreadStore, VectorStore } from '@ggui-ai/mcp-server-core';
 import type { StorageConfig } from '@ggui-ai/project-config';
 export interface ResolveStorageFromConfigOptions {
     /**
@@ -49,6 +49,14 @@ export interface ResolvedStorageStores {
      * `/ggui/health` advertisement matches the active store.
      */
     readonly threadDurability?: 'durable' | 'ephemeral';
+    /**
+     * The live channel's stream buffer, present iff `renders` declares
+     * sqlite: a `SqliteGguiSessionStreamBuffer` on the same database file,
+     * so a session that survives a restart also keeps its stream `seq`, its
+     * epoch and its retained envelopes (ggui#1534). Absent otherwise, and
+     * `createGguiServer` keeps its in-memory buffer.
+     */
+    readonly streamBuffer?: GguiSessionStreamBuffer;
 }
 /**
  * Instantiate the concrete storage adapters declared in a parsed

package/dist/storage.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"storage.d.ts","sourceRoot":"","sources":["../src/storage.ts"],"names":[],"mappings":"AAqDA,OAAO,KAAK,EACV,gBAAgB,EAChB,WAAW,EACX,WAAW,EACZ,MAAM,0BAA0B,CAAC;AAQlC,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,yBAAyB,CAAC;AAE7D,MAAM,WAAW,+BAA+B;IAC9C;;;;;;;;;;;OAWG;IACH,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC;CAC3B;AAED,MAAM,WAAW,qBAAqB;IACpC;oEACgE;IAChE,QAAQ,CAAC,WAAW,CAAC,EAAE,gBAAgB,CAAC;IACxC;oEACgE;IAChE,QAAQ,CAAC,OAAO,CAAC,EAAE,WAAW,CAAC;IAC/B;;;;;;;;;;;;;;;;;yCAiBqC;IACrC,QAAQ,CAAC,WAAW,CAAC,EAAE,WAAW,CAAC;IACnC;;;;;;OAMG;IACH,QAAQ,CAAC,gBAAgB,CAAC,EAAE,SAAS,GAAG,WAAW,CAAC;CACrD;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAkCG;AACH,wBAAsB,wBAAwB,CAC5C,MAAM,EAAE,aAAa,GAAG,SAAS,EACjC,IAAI,GAAE,+BAAoC,GACzC,OAAO,CAAC,qBAAqB,CAAC,CAgDhC"}
+{"version":3,"file":"storage.d.ts","sourceRoot":"","sources":["../src/storage.ts"],"names":[],"mappings":"AAqDA,OAAO,KAAK,EACV,gBAAgB,EAChB,uBAAuB,EACvB,WAAW,EACX,WAAW,EACZ,MAAM,0BAA0B,CAAC;AAQlC,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,yBAAyB,CAAC;AAE7D,MAAM,WAAW,+BAA+B;IAC9C;;;;;;;;;;;OAWG;IACH,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC;CAC3B;AAED,MAAM,WAAW,qBAAqB;IACpC;oEACgE;IAChE,QAAQ,CAAC,WAAW,CAAC,EAAE,gBAAgB,CAAC;IACxC;oEACgE;IAChE,QAAQ,CAAC,OAAO,CAAC,EAAE,WAAW,CAAC;IAC/B;;;;;;;;;;;;;;;;;yCAiBqC;IACrC,QAAQ,CAAC,WAAW,CAAC,EAAE,WAAW,CAAC;IACnC;;;;;;OAMG;IACH,QAAQ,CAAC,gBAAgB,CAAC,EAAE,SAAS,GAAG,WAAW,CAAC;IACpD;;;;;;OAMG;IACH,QAAQ,CAAC,YAAY,CAAC,EAAE,uBAAuB,CAAC;CACjD;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAkCG;AACH,wBAAsB,wBAAwB,CAC5C,MAAM,EAAE,aAAa,GAAG,SAAS,EACjC,IAAI,GAAE,+BAAoC,GACzC,OAAO,CAAC,qBAAqB,CAAC,CAkDhC"}

package/dist/storage.js

@@ -41,9 +41,9 @@
  * who want storage from config write:
  *
  * ```ts
- * const { renderStore, vectors } =
+ * const { renderStore, vectors, streamBuffer } =
  *   await resolveStorageFromConfig(manifest.storage, { baseDir: projectRoot });
- * const server = createGguiServer({ renderStore, vectors });
+ * const server = createGguiServer({ renderStore, vectors, streamBuffer });
  * ```
  *
  * Explicit instances passed to `createGguiServer` still win — this
@@ -113,11 +113,12 @@ export async function resolveStorageFromConfig(config, opts = {}) {
     // Single dynamic import serves every sqlite adapter — better-sqlite3's
     // N-API binding loads once even if the import lands twice; the
     // subpath barrel is cached by Node's module loader.
-    const { SqliteGguiSessionStore, SqliteVectorStore, SqliteThreadStore } = await import('@ggui-ai/mcp-server-core/sqlite');
+    const { SqliteGguiSessionStore, SqliteGguiSessionStreamBuffer, SqliteVectorStore, SqliteThreadStore } = await import('@ggui-ai/mcp-server-core/sqlite');
     if (config.renders && config.renders.driver === 'sqlite') {
         const filename = resolveStoragePath(config.renders.path, opts.baseDir);
         ensureParentDir(filename);
         result.renderStore = new SqliteGguiSessionStore({ filename });
+        result.streamBuffer = new SqliteGguiSessionStreamBuffer({ filename });
     }
     if (config.vectors && config.vectors.driver === 'sqlite') {
         const filename = resolveStoragePath(config.vectors.path, opts.baseDir);