@ggui-ai/mcp-server 0.25.0 → 0.26.0

package/dist/ggui-session-channel/subscribe.js

@@ -2,8 +2,8 @@
  * Subscribe / credential-path family for the live channel — upgrade-
  * time identity resolution across the three auth planes (bearer via
  * the AuthAdapter, ws-token bootstrap, console cookie) and the
- * `subscribe` handler itself: version handshake, bootstrap verify +
- * reconnect-credential mint, identity-default appId resolution,
+ * `subscribe` handler itself: version handshake, bootstrap verify,
+ * identity-default appId resolution,
  * dev-mode render provisioning, replay, registration, and the ack.
  */
 import { PROTOCOL_SCHEMA_VERSION, UPGRADE_REQUIRED } from "@ggui-ai/protocol";
@@ -23,6 +23,56 @@ const BOOTSTRAP_PENDING_MARKER = "__bootstrap_pending__";
 function isBootstrapPendingIdentity(identity) {
     return identity.identity.kind === "user" && identity.identity.userId === BOOTSTRAP_PENDING_MARKER;
 }
+/**
+ * A subscriber's sink as every writer other than the subscribe tail sees it
+ * (ggui#1525). Until {@link release}, frames are held in arrival order;
+ * `release` flushes them and passes every later write straight through.
+ *
+ * The tail writes the ack and the replay frames through the raw sink, and
+ * awaits the ledger read in between when `sinceSequence` is set. Meanwhile
+ * the subscriber is registered, so the live pump, the direct walks (a
+ * `render` or `props_update`, a `drain_ack`, a cross-replica
+ * `externalBroadcast`) and a source-fed `channel_payload` poll can already
+ * write to it. Held here, their frames reach the wire after the replay,
+ * which is the order the ack promises: ack → replay → live.
+ *
+ * One writer stays outside, by design: `channel_error` goes straight to
+ * the socket, both when it answers the client's own `channel_subscribe`
+ * and when a source poll reports `POLL_FAILED`. It carries no stream
+ * state, and neither can precede the release: a poll exists only after a
+ * processed `channel_subscribe`, which the per-socket inbound chain
+ * handles after the subscribe resolves.
+ *
+ * A read that stalls holds these frames for as long as it stalls; the
+ * store's own read timeout is what bounds it.
+ */
+function holdUntilReplayed(sink) {
+    let held = [];
+    return {
+        sink: {
+            isOpen: () => sink.isOpen(),
+            end: (reason) => sink.end(reason),
+            write: (frame, opts) => {
+                if (held !== undefined) {
+                    held.push({ frame, opts });
+                    return;
+                }
+                sink.write(frame, opts);
+            },
+        },
+        release: () => {
+            const queue = held;
+            held = undefined;
+            if (queue === undefined)
+                return;
+            for (const { frame, opts } of queue) {
+                if (!sink.isOpen())
+                    return;
+                sink.write(frame, opts);
+            }
+        },
+    };
+}
 export function createSubscribeHandlers(deps) {
     async function resolveIdentityFromUpgrade(req) {
         const url = new URL(req.url ?? "/", "http://localhost");
@@ -166,7 +216,7 @@ export function createSubscribeHandlers(deps) {
         // AuthAdapter identity — iframes don't carry bearer tokens.
         // Mutually-exclusive on purpose.
         let effectiveIdentity = identity;
-        let mintedSessionToken;
+        let viaWsToken = false;
         let tokenBoundAppId;
         if (typeof payload.wsToken === "string" && payload.wsToken.length > 0) {
             if (!deps.bootstrap) {
@@ -221,10 +271,7 @@ export function createSubscribeHandlers(deps) {
                 },
                 source: "apikey",
             };
-            // Mint the reconnect credential now — before create/observe
-            // work — so a downstream failure doesn't leave the client with
-            // no way to resume.
-            mintedSessionToken = deps.bootstrap.issueSessionToken(bound.sessionId, bound.appId);
+            viaWsToken = true;
             deps.logger.info("render_channel_bootstrap_accepted", {
                 sessionId: bound.sessionId,
                 appId: bound.appId,
@@ -331,8 +378,13 @@ export function createSubscribeHandlers(deps) {
             ws,
             ...(payload.sinceSequence !== undefined ? { sinceSequence: payload.sinceSequence } : {}),
             ...(payload.fromSeq !== undefined ? { fromSeq: payload.fromSeq } : {}),
+            ...(typeof payload.fromEpoch === "string" && payload.fromEpoch !== "" ? { fromEpoch: payload.fromEpoch } : {}),
             ...(message.requestId ? { requestId: message.requestId } : {}),
-            ...(mintedSessionToken !== undefined ? { sessionToken: mintedSessionToken } : {}),
+            ...(viaWsToken
+                ? { credential: "ws_token" }
+                : cookieBound !== undefined
+                    ? { credential: "console_cookie" }
+                    : {}),
         });
     }
     async function completeSubscribe(args) {
@@ -342,10 +394,18 @@ export function createSubscribeHandlers(deps) {
         // between here and registration gets seq > snapshotSeq, so the
         // subscriber will receive it via live fan-out (not via replay).
         //
-        // This is race-safe in single-threaded JS: the next few lines run
-        // synchronously up to `register(sub)`, and fan-out's per-subscriber
-        // `seq <= replayCompletedSeq` guard takes care of the window.
-        const snapshotSeq = await deps.streamBuffer.currentSeq(stored.id);
+        // This is race-safe: a delivery landing between this read and
+        // `register(sub)` (the replay read below is awaited) is either in the
+        // replay or published to the fan-out iterator subscribed below, and
+        // the per-subscriber `seq <= replayCompletedSeq` guard drops the
+        // copies the replay already carries.
+        //
+        // The seq and the epoch it counts in are read at once when the buffer
+        // can (ggui#1531); a buffer that predates epochs gives the seq alone.
+        const snapshot = deps.streamBuffer.currentCursor !== undefined
+            ? await deps.streamBuffer.currentCursor(stored.id)
+            : { seq: await deps.streamBuffer.currentSeq(stored.id) };
+        const snapshotSeq = snapshot.seq;
         // Phase B: a render IS the addressable unit, so the active item
         // is the resolved render's visible-bits surface itself.
         const activeItem = stored.render;
@@ -360,8 +420,16 @@ export function createSubscribeHandlers(deps) {
         const activeStreamSpec = activeItem.type !== "mcpApps" && activeItem.type !== "system"
             ? activeItem.streamSpec
             : undefined;
+        //
+        // A resume whose cursor belongs to a counter that has since restarted
+        // (ggui#1531) replays everything retained, from 0, and reports the gap:
+        // its epoch differs from the session's, or, from a client that sent no
+        // epoch, its `fromSeq` is above anything the counter has assigned.
+        const counterRestarted = args.fromSeq !== undefined &&
+            ((args.fromEpoch !== undefined && snapshot.epoch !== undefined && args.fromEpoch !== snapshot.epoch) ||
+                args.fromSeq > snapshotSeq);
         const replay = args.fromSeq !== undefined
-            ? await deps.streamBuffer.replay(stored.id, args.fromSeq, activeStreamSpec)
+            ? await deps.streamBuffer.replay(stored.id, counterRestarted ? 0 : args.fromSeq, activeStreamSpec)
             : await deps.streamBuffer.replay(stored.id, 0, undefined);
         // Subscribe to the StreamFanout BEFORE constructing the Subscriber:
         // the seam returns an AsyncIterable whose iterator we hand off; the
@@ -370,139 +438,194 @@ export function createSubscribeHandlers(deps) {
         // point onward queues into our iterator — paired with the
         // replayCompletedSeq cursor below, that's race-free.
         const fanoutIter = deps.streamFanout.subscribe(stored.id)[Symbol.asyncIterator]();
+        const gate = holdUntilReplayed(sink);
         const base = {
             sessionId: stored.id,
             appId: stored.appId,
             identity: args.identity,
             connectedAt: Date.now(),
-            replayCompletedSeq: snapshotSeq,
+            replayCursor: { seq: snapshotSeq, epoch: snapshot.epoch },
             iter: fanoutIter,
             // Per-subscriber channel-subscribe tracker. Populated
             // lazily by the `channel_subscribe` handler when the operator
             // wired `streamWebSocketLocalTools`; stays empty otherwise
             // (structurally so for SSE — no inbound channel).
             channelSubs: new Map(),
-            sink,
+            // Every writer but this tail goes through the gate until the
+            // replay is on the wire (ggui#1525); the tail writes to `sink`.
+            sink: gate.sink,
         };
         const sub = args.transport === "ws"
             ? { ...base, transport: "ws", ws: args.ws }
             : { ...base, transport: "sse" };
         deps.register(sub);
-        deps.logger.info("render_channel_subscribed", {
-            sessionId: stored.id,
-            appId: stored.appId,
-            identityKind: args.identity.identity.kind,
-            transport: args.transport,
-            fromSeq: args.fromSeq,
-            snapshotSeq,
-            replayCount: replay?.envelopes.length ?? 0,
-            replayTruncated: replay?.truncated ?? false,
-            bootstrap: args.sessionToken !== undefined,
-        });
-        const ackPayload = {
-            sequence: stored.eventSequence,
-            timestamp: Date.now(),
-            session: stored.render,
-            streamSeq: snapshotSeq,
-            // Advertise the server's protocol version on every successful
-            // subscribe ack (SPEC §11.2.2). Clients whose
-            // CLIENT_SUPPORTED_VERSIONS doesn't contain this string surface
-            // UpgradeRequiredError to their caller; clients that don't wire
-            // the handshake ignore the field (legacy-pass-through).
-            serverVersion: PROTOCOL_SCHEMA_VERSION,
-            ...(replay?.truncated ? { replayTruncated: true } : {}),
-            ...(args.sessionToken !== undefined ? { sessionToken: args.sessionToken } : {}),
-        };
-        sink.write({
-            type: "ack",
-            payload: ackPayload,
-            ...(args.requestId ? { requestId: args.requestId } : {}),
-        });
-        // R7 — GguiSessionEvent ledger replay. When `args.sinceSequence` is
-        // present, fetch events with `seq > sinceSequence` from the per-
-        // render ledger and emit each as a `render_event` wire frame
-        // BEFORE the per-channel stream-buffer replay. Consumers dispatch
-        // by `event.type` to fold the wire-frame-equivalent handler
-        // (render/props_update/etc.) — same cursor model as the HTTP
-        // `/api/sessions/:id/events?sinceSequence=N` endpoint.
-        //
-        // Each replay frame carries `resumeId` = the ledger seq — the SSE
-        // sink stamps it as the `id:` field so the browser's Last-Event-ID
-        // lands on the exact same cursor space; the WS sink ignores it.
+        // From here the subscriber is registered, so the live pump and the
+        // direct walks can write to it; the gate holds their frames until the
+        // ack and every replay frame below are written (ggui#1525), and the
+        // `finally` always releases them.
         //
-        // Pagination: a hasMore-loop over 100-event pages (the HTTP
-        // route's default page size). Strict superset of the previous
-        // single-page-100 WS behavior.
-        //
-        // Horizon gate: a cursor below the server's replay horizon OR
-        // above `lastSequence` (stale from a different deployment) emits
-        // an error frame with `code: 'REPLAY_HORIZON_PASSED'` and skips
-        // the replay. The frame carries `resumeId` = lastSequence — a
-        // dispatched id-bearing frame advances the browser's Last-Event-ID
-        // to the fresh high-water mark, and the ack snapshot already
-        // re-mounted state. Client recovery: re-mount from a fresh /state
-        // read (WS) / the already-delivered ack (SSE).
-        if (args.sinceSequence !== undefined) {
-            const sinceSeq = args.sinceSequence;
-            if (sinceSeq < 0 || !Number.isInteger(sinceSeq)) {
-                sink.write({
-                    type: "error",
-                    payload: {
-                        code: "INVALID_SINCE_SEQUENCE",
-                        message: "sinceSequence must be a non-negative integer",
-                    },
-                    ...(args.requestId ? { requestId: args.requestId } : {}),
-                });
-            }
-            else {
-                let cursor = sinceSeq;
-                let firstPage = true;
-                for (;;) {
-                    const ledger = await deps.renderStore.listEventsSince(stored.id, cursor, 100);
-                    if (ledger === null) {
-                        // GguiSession disappeared between resolve and ledger read —
-                        // already handled by the broader error envelope path;
-                        // nothing to do here.
-                        break;
-                    }
-                    if (firstPage && (sinceSeq > ledger.lastSequence || sinceSeq < ledger.horizonSeq)) {
-                        sink.write({
-                            type: "error",
-                            payload: {
-                                code: "REPLAY_HORIZON_PASSED",
-                                message: `cursor ${sinceSeq} is outside replayable range [${ledger.horizonSeq}, ${ledger.lastSequence}]`,
-                                details: { currentSequence: ledger.lastSequence },
-                            },
-                            ...(args.requestId ? { requestId: args.requestId } : {}),
-                        }, { resumeId: String(ledger.lastSequence) });
-                        break;
-                    }
-                    firstPage = false;
-                    for (const event of ledger.events) {
-                        // GguiSessionEvent is now the wire-shape ledger primitive
-                        // (Wave 7 of flatten-render-identity, 2026-05-28); no
-                        // projection — emit the store's row directly.
-                        sink.write({ type: "render_event", payload: event }, { resumeId: String(event.seq) });
-                        cursor = event.seq;
+        // A subscribe that throws past this point (a ledger read that fails)
+        // is not left registered (ggui#1528). The client may already hold the
+        // ack and would run on a partial replay with no signal, and on SSE
+        // nothing else would ever unregister it. So the subscriber is
+        // unregistered and its transport ended with `internal_error` (WS
+        // close 1011; the SSE stream ends), the client re-subscribes with a
+        // fresh replay, and the error still reaches the caller. Not
+        // `service_restart`: its 1012 invites an immediate reconnect, and a
+        // failure that repeats for one render (a row the store cannot read)
+        // would become a tight reconnect loop per open view.
+        try {
+            // The first ledger page is read BEFORE the ack (ggui#1528). It is the
+            // read that can fail for a row the store cannot read, and failing
+            // before the ack means the client gets no ack for a subscribe that
+            // could not complete: a client whose retry budget resets on an
+            // accepted ack then counts the attempt as failed and backs off to
+            // its cap, instead of reconnecting once a second forever. Only the
+            // first page: every SSE open carries `sinceSequence`, often 0, so
+            // reading every page first would hold a render's whole ledger in
+            // memory per open. Later pages stream after the ack as before.
+            const sinceSeqValid = args.sinceSequence !== undefined && Number.isInteger(args.sinceSequence) && args.sinceSequence >= 0
+                ? args.sinceSequence
+                : undefined;
+            const firstLedgerPage = sinceSeqValid !== undefined ? await deps.renderStore.listEventsSince(stored.id, sinceSeqValid, 100) : undefined;
+            const resumeTruncated = args.fromSeq !== undefined && (replay?.truncated === true || counterRestarted);
+            deps.logger.info("render_channel_subscribed", {
+                sessionId: stored.id,
+                appId: stored.appId,
+                identityKind: args.identity.identity.kind,
+                transport: args.transport,
+                fromSeq: args.fromSeq,
+                snapshotSeq,
+                replayCount: replay?.envelopes.length ?? 0,
+                replayTruncated: resumeTruncated,
+                ...(counterRestarted ? { counterRestarted: true } : {}),
+                // The credential the subscribe came on (ggui#1488): a wsToken, the
+                // console cookie, or the adapter's bearer source. The first two ride
+                // a synthetic identity whose own `source` would misreport them.
+                bootstrap: args.credential === "ws_token",
+                source: args.credential ?? args.identity.source,
+            });
+            const ackPayload = {
+                sequence: stored.eventSequence,
+                timestamp: Date.now(),
+                session: stored.render,
+                streamSeq: snapshotSeq,
+                // The epoch `streamSeq` counts in (ggui#1531), when the buffer has one.
+                ...(snapshot.epoch !== undefined ? { streamEpoch: snapshot.epoch } : {}),
+                // Advertise the server's protocol version on every successful
+                // subscribe ack (SPEC §11.2.2). Clients whose
+                // CLIENT_SUPPORTED_VERSIONS doesn't contain this string surface
+                // UpgradeRequiredError to their caller; clients that don't wire
+                // the handshake ignore the field (legacy-pass-through).
+                serverVersion: PROTOCOL_SCHEMA_VERSION,
+                // Only a resume can have a gap: `replayTruncated` is "absent on
+                // fresh subscribes" (`AckPayload`). A fresh subscribe still walks the
+                // reserved channels from 0, and a buffer whose retention expired
+                // reports that walk truncated, which says nothing to this client.
+                ...(resumeTruncated ? { replayTruncated: true } : {}),
+            };
+            sink.write({
+                type: "ack",
+                payload: ackPayload,
+                ...(args.requestId ? { requestId: args.requestId } : {}),
+            });
+            // R7 — GguiSessionEvent ledger replay. When `args.sinceSequence` is
+            // present, fetch events with `seq > sinceSequence` from the per-
+            // render ledger and emit each as a `render_event` wire frame
+            // BEFORE the per-channel stream-buffer replay. Consumers dispatch
+            // by `event.type` to fold the wire-frame-equivalent handler
+            // (render/props_update/etc.) — same cursor model as the HTTP
+            // `/api/sessions/:id/events?sinceSequence=N` endpoint.
+            //
+            // Each replay frame carries `resumeId` = the ledger seq — the SSE
+            // sink stamps it as the `id:` field so the browser's Last-Event-ID
+            // lands on the exact same cursor space; the WS sink ignores it.
+            //
+            // Pagination: a hasMore-loop over 100-event pages (the HTTP
+            // route's default page size). Strict superset of the previous
+            // single-page-100 WS behavior.
+            //
+            // Horizon gate: a cursor below the server's replay horizon OR
+            // above `lastSequence` (stale from a different deployment) emits
+            // an error frame with `code: 'REPLAY_HORIZON_PASSED'` and skips
+            // the replay. The frame carries `resumeId` = lastSequence — a
+            // dispatched id-bearing frame advances the browser's Last-Event-ID
+            // to the fresh high-water mark, and the ack snapshot already
+            // re-mounted state. Client recovery: re-mount from a fresh /state
+            // read (WS) / the already-delivered ack (SSE).
+            if (args.sinceSequence !== undefined) {
+                if (sinceSeqValid === undefined) {
+                    sink.write({
+                        type: "error",
+                        payload: {
+                            code: "INVALID_SINCE_SEQUENCE",
+                            message: "sinceSequence must be a non-negative integer",
+                        },
+                        ...(args.requestId ? { requestId: args.requestId } : {}),
+                    });
+                }
+                else {
+                    const sinceSeq = sinceSeqValid;
+                    let cursor = sinceSeq;
+                    let firstPage = true;
+                    for (;;) {
+                        // The first page was read before the ack; later pages are read here.
+                        const ledger = firstPage
+                            ? firstLedgerPage
+                            : await deps.renderStore.listEventsSince(stored.id, cursor, 100);
+                        if (ledger === null || ledger === undefined) {
+                            // GguiSession disappeared between resolve and ledger read —
+                            // already handled by the broader error envelope path;
+                            // nothing to do here.
+                            break;
+                        }
+                        if (firstPage && (sinceSeq > ledger.lastSequence || sinceSeq < ledger.horizonSeq)) {
+                            sink.write({
+                                type: "error",
+                                payload: {
+                                    code: "REPLAY_HORIZON_PASSED",
+                                    message: `cursor ${sinceSeq} is outside replayable range [${ledger.horizonSeq}, ${ledger.lastSequence}]`,
+                                    details: { currentSequence: ledger.lastSequence },
+                                },
+                                ...(args.requestId ? { requestId: args.requestId } : {}),
+                            }, { resumeId: String(ledger.lastSequence) });
+                            break;
+                        }
+                        firstPage = false;
+                        for (const event of ledger.events) {
+                            // GguiSessionEvent is now the wire-shape ledger primitive
+                            // (Wave 7 of flatten-render-identity, 2026-05-28); no
+                            // projection — emit the store's row directly.
+                            sink.write({ type: "render_event", payload: event }, { resumeId: String(event.seq) });
+                            cursor = event.seq;
+                        }
+                        // Defensive: an empty page with hasMore would loop forever;
+                        // the store contract never produces it, but a broken adapter
+                        // must not spin the server.
+                        if (!ledger.hasMore || ledger.events.length === 0)
+                            break;
                     }
-                    // Defensive: an empty page with hasMore would loop forever;
-                    // the store contract never produces it, but a broken adapter
-                    // must not spin the server.
-                    if (!ledger.hasMore || ledger.events.length === 0)
-                        break;
                 }
             }
-        }
-        // Send replay frames AFTER the ack. Ordering by `seq` ASC — the
-        // buffer returns them pre-sorted. Client sees ack(streamSeq=N) →
-        // up to N replay `data` frames → live tail (seq > N). No explicit
-        // "replay end" marker is needed; the client uses envelope.seq as
-        // the single source of truth for ordering.
-        if (replay) {
-            for (const env of replay.envelopes) {
-                sink.write({ type: "data", payload: env });
+            // Send replay frames AFTER the ack. Ordering by `seq` ASC — the
+            // buffer returns them pre-sorted. Client sees ack(streamSeq=N) →
+            // up to N replay `data` frames → live tail (seq > N). No explicit
+            // "replay end" marker is needed; the client uses envelope.seq as
+            // the single source of truth for ordering.
+            if (replay) {
+                for (const env of replay.envelopes) {
+                    sink.write({ type: "data", payload: env });
+                }
             }
         }
+        catch (err) {
+            deps.unregister(sub);
+            sink.end("internal_error");
+            throw err;
+        }
+        finally {
+            gate.release();
+        }
         return {
             detach: () => {
                 deps.unregister(sub);

package/dist/ggui-session-channel/subscriber-lifecycle.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"subscriber-lifecycle.d.ts","sourceRoot":"","sources":["../../src/ggui-session-channel/subscriber-lifecycle.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AAEH,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,IAAI,CAAC;AACpC,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,cAAc,CAAC;AAC3C,OAAO,KAAK,EAAE,UAAU,EAAE,YAAY,EAAE,MAAM,qBAAqB,CAAC;AAEpE,MAAM,WAAW,uBAAuB;IACtC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,2EAA2E;IAC3E,QAAQ,CAAC,aAAa,EAAE,GAAG,CAAC,UAAU,CAAC,CAAC;IACxC;;;;OAIG;IACH,QAAQ,CAAC,eAAe,EAAE,OAAO,CAAC,SAAS,EAAE,YAAY,CAAC,CAAC;IAC3D,+EAA+E;IAC/E,QAAQ,CAAC,iBAAiB,CAAC,EAAE,CAAC,SAAS,EAAE,MAAM,KAAK,IAAI,CAAC;IACzD,kFAAkF;IAClF,QAAQ,CAAC,oBAAoB,CAAC,EAAE,CAAC,SAAS,EAAE,MAAM,KAAK,IAAI,CAAC;CAC7D;AAED,MAAM,WAAW,mBAAmB;IAClC,gEAAgE;IAChE,QAAQ,CAAC,GAAG,EAAE,UAAU,GAAG,IAAI,CAAC;IAChC;;;;;OAKG;IACH,UAAU,CAAC,GAAG,EAAE,UAAU,GAAG,IAAI,CAAC;CACnC;AAED,wBAAgB,yBAAyB,CAAC,IAAI,EAAE,uBAAuB,GAAG,mBAAmB,CAiH5F"}
+{"version":3,"file":"subscriber-lifecycle.d.ts","sourceRoot":"","sources":["../../src/ggui-session-channel/subscriber-lifecycle.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AAGH,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,IAAI,CAAC;AACpC,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,cAAc,CAAC;AAC3C,OAAO,KAAK,EAAE,UAAU,EAAE,YAAY,EAAE,MAAM,qBAAqB,CAAC;AAEpE,MAAM,WAAW,uBAAuB;IACtC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,2EAA2E;IAC3E,QAAQ,CAAC,aAAa,EAAE,GAAG,CAAC,UAAU,CAAC,CAAC;IACxC;;;;OAIG;IACH,QAAQ,CAAC,eAAe,EAAE,OAAO,CAAC,SAAS,EAAE,YAAY,CAAC,CAAC;IAC3D,+EAA+E;IAC/E,QAAQ,CAAC,iBAAiB,CAAC,EAAE,CAAC,SAAS,EAAE,MAAM,KAAK,IAAI,CAAC;IACzD,kFAAkF;IAClF,QAAQ,CAAC,oBAAoB,CAAC,EAAE,CAAC,SAAS,EAAE,MAAM,KAAK,IAAI,CAAC;CAC7D;AAED,MAAM,WAAW,mBAAmB;IAClC,gEAAgE;IAChE,QAAQ,CAAC,GAAG,EAAE,UAAU,GAAG,IAAI,CAAC;IAChC;;;;;OAKG;IACH,UAAU,CAAC,GAAG,EAAE,UAAU,GAAG,IAAI,CAAC;CACnC;AAED,wBAAgB,yBAAyB,CAAC,IAAI,EAAE,uBAAuB,GAAG,mBAAmB,CA0H5F"}

package/dist/ggui-session-channel/subscriber-lifecycle.js

@@ -17,6 +17,7 @@
  * hosted cross-replica pubsub scoping keys on "does this replica hold any
  * subscriber for this render", regardless of transport.
  */
+import { admitLiveEnvelope } from './stream-epoch.js';
 export function createSubscriberLifecycle(deps) {
     /**
      * Per-render local subscriber count. Drives the
@@ -35,12 +36,12 @@ export function createSubscriberLifecycle(deps) {
      * frames with `seq <= replayCompletedSeq` were (or will be)
      * delivered via the replay path on subscribe.
      *
-     * The pump's first action is `await iter.next()`, which yields
-     * control back to the event loop. This is what preserves the
-     * subscribe-handler ordering invariant: ack → replay frames →
-     * live frames. The replay-frame send loop completes synchronously
-     * before the pump can ever send anything, regardless of fanout
-     * timing.
+     * The ordering invariant ack → replay frames → live frames is kept by
+     * the subscribe tail, not by timing: `sub.sink` is gated until the
+     * tail has written the ack and every replay frame, so whatever the
+     * pump writes meanwhile is held and flushed after them. The tail is
+     * NOT synchronous when `sinceSequence` is set (it awaits the ledger
+     * read), which is why the gate exists (ggui#1525).
      */
     async function pumpSubscriber(sub) {
         try {
@@ -48,7 +49,16 @@ export function createSubscriberLifecycle(deps) {
                 const { value, done } = await sub.iter.next();
                 if (done)
                     return;
-                if (value.seq <= sub.replayCompletedSeq)
+                const admission = admitLiveEnvelope(sub.replayCursor, value);
+                if (admission.epochChanged !== undefined) {
+                    deps.logger.info("stream_epoch_changed", {
+                        sessionId: sub.sessionId,
+                        from: admission.epochChanged.from,
+                        to: admission.epochChanged.to,
+                        transport: sub.transport,
+                    });
+                }
+                if (!admission.deliver)
                     continue;
                 if (!sub.sink.isOpen()) {
                     await sub.iter.return?.();

package/dist/ggui-session-channel.d.ts

@@ -59,7 +59,7 @@ import type { IncomingMessage } from "node:http";
 import type { Duplex } from "node:stream";
 import { type GguiSessionChannelLocalToolsOptions } from "./ggui-session-channel/channel-subscriptions.js";
 import type { SubscriberSink } from "./ggui-session-channel/internal-types.js";
-import { type GguiSessionChannelBootstrap, type GguiSessionChannelCookieAuth } from "./ggui-session-channel/subscribe.js";
+import { type GguiSessionChannelBootstrap, type GguiSessionChannelCookieAuth, type SubscribeCredential } from "./ggui-session-channel/subscribe.js";
 import type { Logger } from "./logger.js";
 /** Default URL path for the channel endpoint. Operators can override. */
 export declare const DEFAULT_RENDER_CHANNEL_PATH = "/ws";
@@ -112,7 +112,7 @@ export declare const DEFAULT_PRE_SUBSCRIBE_IDLE_MS = 30000;
  */
 export declare const DEFAULT_MAX_PRE_SUBSCRIBE_CONNECTIONS = 1024;
 export type { GguiSessionChannelLocalToolsOptions } from "./ggui-session-channel/channel-subscriptions.js";
-export type { GguiSessionChannelBootstrap, GguiSessionChannelBootstrapVerifyResult, GguiSessionChannelCookieAuth, } from "./ggui-session-channel/subscribe.js";
+export type { GguiSessionChannelBootstrap, GguiSessionChannelBootstrapVerifyResult, GguiSessionChannelCookieAuth, SubscribeCredential, } from "./ggui-session-channel/subscribe.js";
 export type { SubscriberSink } from "./ggui-session-channel/internal-types.js";
 /**
  * Thrown by {@link GguiSessionChannelServer.attachExternalSubscriber}
@@ -223,9 +223,9 @@ export interface GguiSessionChannelOptions {
     readonly streamFanout?: StreamFanout;
     /**
      * Optional bootstrap-auth plumbing. When present, the channel
-     * accepts `SubscribePayload.wsToken` and issues reconnect
-     * credentials in `AckPayload.sessionToken`. When absent, bootstrap
-     * tokens are rejected with `BOOTSTRAP_NOT_SUPPORTED`.
+     * accepts `SubscribePayload.wsToken`; it mints no reconnect
+     * credential (ggui#1488). When absent, bootstrap tokens are rejected
+     * with `BOOTSTRAP_NOT_SUPPORTED`.
      */
     readonly bootstrap?: GguiSessionChannelBootstrap;
     /**
@@ -580,6 +580,14 @@ export interface GguiSessionChannelServer {
         readonly sink: SubscriberSink;
         readonly sinceSequence?: number;
         readonly fromSeq?: number;
+        /** The epoch `fromSeq` was counted in (ggui#1531); read only beside it. */
+        readonly fromEpoch?: string;
+        /**
+         * The credential the transport authenticated (ggui#1488), logged as
+         * `render_channel_subscribed.source`; the SSE route passes
+         * `"ws_token"`. Absent: the identity's own auth source.
+         */
+        readonly credential?: SubscribeCredential;
     }): Promise<{
         readonly detach: () => void;
     }>;

package/dist/ggui-session-channel.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"ggui-session-channel.d.ts","sourceRoot":"","sources":["../src/ggui-session-channel.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAqDG;AAEH,OAAO,KAAK,EACV,WAAW,EACX,UAAU,EACV,oBAAoB,EACpB,gBAAgB,EAChB,uBAAuB,EACvB,mBAAmB,EACnB,YAAY,EACZ,aAAa,EACd,MAAM,0BAA0B,CAAC;AAKlC,OAAO,KAAK,EAAE,UAAU,EAAE,WAAW,EAAE,wBAAwB,EAAE,MAAM,mBAAmB,CAAC;AAC3F,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,uCAAuC,CAAC;AAC9E,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,WAAW,CAAC;AACjD,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,aAAa,CAAC;AAI1C,OAAO,EAEL,KAAK,mCAAmC,EACzC,MAAM,iDAAiD,CAAC;AACzD,OAAO,KAAK,EAEV,cAAc,EAGf,MAAM,0CAA0C,CAAC;AAGlD,OAAO,EAEL,KAAK,2BAA2B,EAChC,KAAK,4BAA4B,EAClC,MAAM,qCAAqC,CAAC;AAE7C,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,aAAa,CAAC;AAE1C,yEAAyE;AACzE,eAAO,MAAM,2BAA2B,QAAQ,CAAC;AAEjD;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,eAAO,MAAM,4BAA4B,UAAY,CAAC;AACtD;;;;;;GAMG;AACH,eAAO,MAAM,uCAAuC,QAAS,CAAC;AAC9D;;;;;GAKG;AACH,eAAO,MAAM,6BAA6B,QAAS,CAAC;AACpD;;;;;;GAMG;AACH,eAAO,MAAM,qCAAqC,OAAQ,CAAC;AAK3D,YAAY,EAAE,mCAAmC,EAAE,MAAM,iDAAiD,CAAC;AAK3G,YAAY,EACV,2BAA2B,EAC3B,uCAAuC,EACvC,4BAA4B,GAC7B,MAAM,qCAAqC,CAAC;AAM7C,YAAY,EAAE,cAAc,EAAE,MAAM,0CAA0C,CAAC;AAE/E;;;;;;GAMG;AACH,qBAAa,2BAA4B,SAAQ,KAAK;gBACxC,SAAS,EAAE,MAAM;CAI9B;AAED,MAAM,WAAW,yBAAyB;IACxC,kFAAkF;IAClF,QAAQ,CAAC,WAAW,EAAE,gBAAgB,CAAC;IACvC;;;;;;;;;;;;;;;;;;;;;;;;OAwBG;IACH,QAAQ,CAAC,oBAAoB,CAAC,EAAE,oBAAoB,CAAC;IACrD;;;OAGG;IACH,QAAQ,CAAC,IAAI,EAAE,WAAW,CAAC;IAC3B;;;;;;;;OAQG;IACH,QAAQ,CAAC,iBAAiB,CAAC,EAAE,CAAC,MAAM,EAAE,UAAU,KAAK,MAAM,CAAC;IAC5D;;;;;;;;;;;;;OAaG;IACH,QAAQ,CAAC,YAAY,CAAC,EAAE,CAAC,KAAK,EAAE,MAAM,EAAE,QAAQ,EAAE,UAAU,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IAC/E;;;;;;;;;OASG;IACH,QAAQ,CAAC,iBAAiB,CAAC,EAAE,SAAS,UAAU,CAAC,QAAQ,CAAC,EAAE,CAAC;IAC7D,yBAAyB;IACzB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,+CAA+C;IAC/C,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC;IACvB;;;;;;;;;OASG;IACH,QAAQ,CAAC,YAAY,CAAC,EAAE,uBAAuB,CAAC;IAChD;;;;;;;;;;OAUG;IACH,QAAQ,CAAC,YAAY,CAAC,EAAE,YAAY,CAAC;IACrC;;;;;OAKG;IACH,QAAQ,CAAC,SAAS,CAAC,EAAE,2BAA2B,CAAC;IAEjD;;;;;;;;;;;;;;;OAeG;IACH,QAAQ,CAAC,UAAU,CAAC,EAAE,4BAA4B,CAAC;IACnD;;;;;;;;;;;;;;;;;OAiBG;IACH,QAAQ,CAAC,uBAAuB,CAAC,EAAE,WAAW,CAAC,MAAM,EAAE,wBAAwB,CAAC,CAAC;IACjF;;;;;;;;;;;;;OAaG;IACH,QAAQ,CAAC,SAAS,CAAC,EAAE,aAAa,CAAC;IACnC;;;;;;;;;;;OAWG;IACH,QAAQ,CAAC,yBAAyB,CAAC,EAAE,mCAAmC,CAAC;IACzE;;;;;;;;;;;;;;;;;;;;;;;;OAwBG;IACH,QAAQ,CAAC,aAAa,CAAC,EAAE,UAAU,GAAG,QAAQ,CAAC;IAC/C;;;;;;;;;;;;;;;;;;;;OAoBG;IACH,QAAQ,CAAC,eAAe,CAAC,EAAE,MAAM,CAAC;IAClC;;;;;;;;OAQG;IACH,QAAQ,CAAC,2BAA2B,CAAC,EAAE,MAAM,CAAC;IAC9C;;;;;;;;OAQG;IACH,QAAQ,CAAC,kBAAkB,CAAC,EAAE,MAAM,CAAC;IACrC;;;;;;;;OAQG;IACH,QAAQ,CAAC,0BAA0B,CAAC,EAAE,MAAM,CAAC;IAC7C;;;;;;;;;;;;;;;;;;;;;OAqBG;IACH,QAAQ,CAAC,iBAAiB,CAAC,EAAE,CAAC,SAAS,EAAE,MAAM,KAAK,IAAI,CAAC;IACzD;;;;;;;OAOG;IACH,QAAQ,CAAC,oBAAoB,CAAC,EAAE,CAAC,SAAS,EAAE,MAAM,KAAK,IAAI,CAAC;CAC7D;AAED,MAAM,WAAW,wBAAwB;IACvC,4DAA4D;IAC5D,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB;;;;OAIG;IACH,aAAa,CAAC,GAAG,EAAE,eAAe,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC;IACxE;;;;;;;;;;;;;;;;;;;;;;;;;;;OA2BG;IACH,iBAAiB,CAAC,QAAQ,EAAE,mBAAmB,GAAG,OAAO,CAAC;QAAE,GAAG,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IAC3E;;;;;;;;;;;;;;;;;;;;;;;;;;;;OA4BG;IACH,uBAAuB,CAAC,SAAS,EAAE,MAAM,EAAE,MAAM,EAAE,WAAW,EAAE,SAAS,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1F;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OAkCG;IACH,eAAe,CAAC,SAAS,EAAE,MAAM,EAAE,KAAK,EAAE,UAAU,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACpF;;;;;;;;;;;;;;;;OAgBG;IACH,YAAY,CAAC,IAAI,EAAE;QACjB,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;QAC3B,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;QACvB,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;QACzB,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;KAC5B,GAAG,IAAI,CAAC;IACT;;;;;;;;;;;;;;;;;;OAkBG;IACH,iBAAiB,CAAC,SAAS,EAAE,MAAM,EAAE,KAAK,EAAE,gBAAgB,GAAG,IAAI,CAAC;IACpE;;;;;;;;;;;;;;;;;;;;OAoBG;IACH,wBAAwB,CAAC,IAAI,EAAE;QAC7B,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;QAC3B,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;QACvB,QAAQ,CAAC,QAAQ,EAAE,UAAU,CAAC;QAC9B,QAAQ,CAAC,IAAI,EAAE,cAAc,CAAC;QAC9B,QAAQ,CAAC,aAAa,CAAC,EAAE,MAAM,CAAC;QAChC,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC;KAC3B,GAAG,OAAO,CAAC;QAAE,QAAQ,CAAC,MAAM,EAAE,MAAM,IAAI,CAAA;KAAE,CAAC,CAAC;IAC7C,2EAA2E;IAC3E,QAAQ,CAAC,eAAe,EAAE,MAAM,CAAC;IACjC,+DAA+D;IAC/D,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B;;;;;;;;OAQG;IACH,QAAQ,CAAC,sBAAsB,EAAE;QAC/B,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;QACzB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;QACtB,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;KAC7B,CAAC;IACF;;OAEG;IACH,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;CACxB;AAED;;;GAGG;AACH,wBAAgB,8BAA8B,CAC5C,IAAI,EAAE,yBAAyB,GAC9B,wBAAwB,CA0Q1B"}
+{"version":3,"file":"ggui-session-channel.d.ts","sourceRoot":"","sources":["../src/ggui-session-channel.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAqDG;AAEH,OAAO,KAAK,EACV,WAAW,EACX,UAAU,EACV,oBAAoB,EACpB,gBAAgB,EAChB,uBAAuB,EACvB,mBAAmB,EACnB,YAAY,EACZ,aAAa,EACd,MAAM,0BAA0B,CAAC;AAKlC,OAAO,KAAK,EAAE,UAAU,EAAE,WAAW,EAAE,wBAAwB,EAAE,MAAM,mBAAmB,CAAC;AAC3F,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,uCAAuC,CAAC;AAC9E,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,WAAW,CAAC;AACjD,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,aAAa,CAAC;AAI1C,OAAO,EAEL,KAAK,mCAAmC,EACzC,MAAM,iDAAiD,CAAC;AACzD,OAAO,KAAK,EAEV,cAAc,EAGf,MAAM,0CAA0C,CAAC;AAGlD,OAAO,EAEL,KAAK,2BAA2B,EAChC,KAAK,4BAA4B,EACjC,KAAK,mBAAmB,EACzB,MAAM,qCAAqC,CAAC;AAE7C,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,aAAa,CAAC;AAE1C,yEAAyE;AACzE,eAAO,MAAM,2BAA2B,QAAQ,CAAC;AAEjD;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,eAAO,MAAM,4BAA4B,UAAY,CAAC;AACtD;;;;;;GAMG;AACH,eAAO,MAAM,uCAAuC,QAAS,CAAC;AAC9D;;;;;GAKG;AACH,eAAO,MAAM,6BAA6B,QAAS,CAAC;AACpD;;;;;;GAMG;AACH,eAAO,MAAM,qCAAqC,OAAQ,CAAC;AAK3D,YAAY,EAAE,mCAAmC,EAAE,MAAM,iDAAiD,CAAC;AAK3G,YAAY,EACV,2BAA2B,EAC3B,uCAAuC,EACvC,4BAA4B,EAC5B,mBAAmB,GACpB,MAAM,qCAAqC,CAAC;AAM7C,YAAY,EAAE,cAAc,EAAE,MAAM,0CAA0C,CAAC;AAE/E;;;;;;GAMG;AACH,qBAAa,2BAA4B,SAAQ,KAAK;gBACxC,SAAS,EAAE,MAAM;CAI9B;AAED,MAAM,WAAW,yBAAyB;IACxC,kFAAkF;IAClF,QAAQ,CAAC,WAAW,EAAE,gBAAgB,CAAC;IACvC;;;;;;;;;;;;;;;;;;;;;;;;OAwBG;IACH,QAAQ,CAAC,oBAAoB,CAAC,EAAE,oBAAoB,CAAC;IACrD;;;OAGG;IACH,QAAQ,CAAC,IAAI,EAAE,WAAW,CAAC;IAC3B;;;;;;;;OAQG;IACH,QAAQ,CAAC,iBAAiB,CAAC,EAAE,CAAC,MAAM,EAAE,UAAU,KAAK,MAAM,CAAC;IAC5D;;;;;;;;;;;;;OAaG;IACH,QAAQ,CAAC,YAAY,CAAC,EAAE,CAAC,KAAK,EAAE,MAAM,EAAE,QAAQ,EAAE,UAAU,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IAC/E;;;;;;;;;OASG;IACH,QAAQ,CAAC,iBAAiB,CAAC,EAAE,SAAS,UAAU,CAAC,QAAQ,CAAC,EAAE,CAAC;IAC7D,yBAAyB;IACzB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,+CAA+C;IAC/C,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC;IACvB;;;;;;;;;OASG;IACH,QAAQ,CAAC,YAAY,CAAC,EAAE,uBAAuB,CAAC;IAChD;;;;;;;;;;OAUG;IACH,QAAQ,CAAC,YAAY,CAAC,EAAE,YAAY,CAAC;IACrC;;;;;OAKG;IACH,QAAQ,CAAC,SAAS,CAAC,EAAE,2BAA2B,CAAC;IAEjD;;;;;;;;;;;;;;;OAeG;IACH,QAAQ,CAAC,UAAU,CAAC,EAAE,4BAA4B,CAAC;IACnD;;;;;;;;;;;;;;;;;OAiBG;IACH,QAAQ,CAAC,uBAAuB,CAAC,EAAE,WAAW,CAAC,MAAM,EAAE,wBAAwB,CAAC,CAAC;IACjF;;;;;;;;;;;;;OAaG;IACH,QAAQ,CAAC,SAAS,CAAC,EAAE,aAAa,CAAC;IACnC;;;;;;;;;;;OAWG;IACH,QAAQ,CAAC,yBAAyB,CAAC,EAAE,mCAAmC,CAAC;IACzE;;;;;;;;;;;;;;;;;;;;;;;;OAwBG;IACH,QAAQ,CAAC,aAAa,CAAC,EAAE,UAAU,GAAG,QAAQ,CAAC;IAC/C;;;;;;;;;;;;;;;;;;;;OAoBG;IACH,QAAQ,CAAC,eAAe,CAAC,EAAE,MAAM,CAAC;IAClC;;;;;;;;OAQG;IACH,QAAQ,CAAC,2BAA2B,CAAC,EAAE,MAAM,CAAC;IAC9C;;;;;;;;OAQG;IACH,QAAQ,CAAC,kBAAkB,CAAC,EAAE,MAAM,CAAC;IACrC;;;;;;;;OAQG;IACH,QAAQ,CAAC,0BAA0B,CAAC,EAAE,MAAM,CAAC;IAC7C;;;;;;;;;;;;;;;;;;;;;OAqBG;IACH,QAAQ,CAAC,iBAAiB,CAAC,EAAE,CAAC,SAAS,EAAE,MAAM,KAAK,IAAI,CAAC;IACzD;;;;;;;OAOG;IACH,QAAQ,CAAC,oBAAoB,CAAC,EAAE,CAAC,SAAS,EAAE,MAAM,KAAK,IAAI,CAAC;CAC7D;AAED,MAAM,WAAW,wBAAwB;IACvC,4DAA4D;IAC5D,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB;;;;OAIG;IACH,aAAa,CAAC,GAAG,EAAE,eAAe,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC;IACxE;;;;;;;;;;;;;;;;;;;;;;;;;;;OA2BG;IACH,iBAAiB,CAAC,QAAQ,EAAE,mBAAmB,GAAG,OAAO,CAAC;QAAE,GAAG,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IAC3E;;;;;;;;;;;;;;;;;;;;;;;;;;;;OA4BG;IACH,uBAAuB,CAAC,SAAS,EAAE,MAAM,EAAE,MAAM,EAAE,WAAW,EAAE,SAAS,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1F;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OAkCG;IACH,eAAe,CAAC,SAAS,EAAE,MAAM,EAAE,KAAK,EAAE,UAAU,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACpF;;;;;;;;;;;;;;;;OAgBG;IACH,YAAY,CAAC,IAAI,EAAE;QACjB,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;QAC3B,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;QACvB,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;QACzB,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;KAC5B,GAAG,IAAI,CAAC;IACT;;;;;;;;;;;;;;;;;;OAkBG;IACH,iBAAiB,CAAC,SAAS,EAAE,MAAM,EAAE,KAAK,EAAE,gBAAgB,GAAG,IAAI,CAAC;IACpE;;;;;;;;;;;;;;;;;;;;OAoBG;IACH,wBAAwB,CAAC,IAAI,EAAE;QAC7B,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;QAC3B,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;QACvB,QAAQ,CAAC,QAAQ,EAAE,UAAU,CAAC;QAC9B,QAAQ,CAAC,IAAI,EAAE,cAAc,CAAC;QAC9B,QAAQ,CAAC,aAAa,CAAC,EAAE,MAAM,CAAC;QAChC,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC;QAC1B,2EAA2E;QAC3E,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC;QAC5B;;;;WAIG;QACH,QAAQ,CAAC,UAAU,CAAC,EAAE,mBAAmB,CAAC;KAC3C,GAAG,OAAO,CAAC;QAAE,QAAQ,CAAC,MAAM,EAAE,MAAM,IAAI,CAAA;KAAE,CAAC,CAAC;IAC7C,2EAA2E;IAC3E,QAAQ,CAAC,eAAe,EAAE,MAAM,CAAC;IACjC,+DAA+D;IAC/D,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B;;;;;;;;OAQG;IACH,QAAQ,CAAC,sBAAsB,EAAE;QAC/B,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;QACzB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;QACtB,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;KAC7B,CAAC;IACF;;OAEG;IACH,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;CACxB;AAED;;;GAGG;AACH,wBAAgB,8BAA8B,CAC5C,IAAI,EAAE,yBAAyB,GAC9B,wBAAwB,CA2Q1B"}

package/dist/ggui-session-channel.js

@@ -204,7 +204,6 @@ export function createGguiSessionChannelServer(opts) {
         renderStore: opts.renderStore,
         localTools: opts.streamWebSocketLocalTools,
         subscribersByWs,
-        send,
         sendChannelError,
     });
     // Action ingress + consume bridge — contract gate, ledger + pipe
@@ -312,6 +311,8 @@ export function createGguiSessionChannelServer(opts) {
                 transport: "sse",
                 ...(args.sinceSequence !== undefined ? { sinceSequence: args.sinceSequence } : {}),
                 ...(args.fromSeq !== undefined ? { fromSeq: args.fromSeq } : {}),
+                ...(args.fromEpoch !== undefined ? { fromEpoch: args.fromEpoch } : {}),
+                ...(args.credential !== undefined ? { credential: args.credential } : {}),
             });
         },
         get subscriberCount() {

package/dist/index.d.ts

@@ -29,7 +29,7 @@ export type { HandlerContext, SharedHandler } from '@ggui-ai/mcp-server-handlers
 export type { GadgetDescriptor, McpUiDisplayMode, GguiSession, SystemGguiSession, } from '@ggui-ai/protocol';
 export type { GenerationDeps } from '@ggui-ai/mcp-server-handlers';
 export { buildNoCredentialsGguiSession } from '@ggui-ai/mcp-server-handlers';
-export { buildOpsBundleHandlers, createGguiServer, defaultHandlers } from './server.js';
+export { buildOpsBundleHandlers, createGguiServer, defaultHandlers, DEFAULT_CLOSE_GRACE_MS } from './server.js';
 export type { CreateGguiServerOptions, ErrorMapperResult, GguiServer, OpsBundleDeps, } from './server.js';
 export { AnthropicStructuredCallError, buildLlmCaller } from './llm-backed-negotiator.js';
 export type { AnthropicStructuredCallFailureKind, BuildLlmCallerOptions, } from './llm-backed-negotiator.js';