@ggui-ai/mcp-server 0.28.0 → 0.29.0

package/README.md

@@ -47,9 +47,11 @@ separate packages and protocol flows.
 
 ### `tsc` under `moduleResolution: NodeNext` reports errors inside `node_modules/@modelcontextprotocol/ext-apps`
 
-Your own code is fine; the errors sit in a dependency's declarations. With `moduleResolution: "NodeNext"` (or `Node16`), `tsc` reports TS2834 and TS2339 inside `node_modules/@modelcontextprotocol/ext-apps/dist/src/app.d.ts`, and TS2305 / TS2460 on `@ggui-ai/protocol`'s `host-context.d.ts` for the three names it re-exports from there (`McpUiDisplayMode`, `McpUiHostContext`, `McpUiHostCapabilities`).
+Your own code is fine; the errors sit in a dependency's declarations. With `moduleResolution: "NodeNext"` (or `Node16`), `tsc` reports TS2834 and TS2339 inside `node_modules/@modelcontextprotocol/ext-apps/dist/src/app.d.ts`, and, before #847, TS2305 / TS2460 on `@ggui-ai/protocol`'s `host-context.d.ts` for the three names it then re-exported from there.
 
-**Cause.** `@modelcontextprotocol/ext-apps` 1.7.5 ships extensionless relative specifiers in its own `.d.ts` files — a defect in the published package, tracked upstream at [modelcontextprotocol/ext-apps#704](https://github.com/modelcontextprotocol/ext-apps/issues/704). `@ggui-ai/*` re-exports those names rather than forking a frozen spec surface, so the defect surfaces on our line. Every `@ggui-ai/*` declaration itself carries explicit `.js` extensions since 0.15.0.
+**Cause.** `@modelcontextprotocol/ext-apps` 1.7.5 ships extensionless relative specifiers in its own `.d.ts` files — a defect in the published package, tracked upstream at [modelcontextprotocol/ext-apps#704](https://github.com/modelcontextprotocol/ext-apps/issues/704). `@ggui-ai/mcp-server` and `@ggui-ai/iframe-runtime` depend on ext-apps, so the defect surfaces in a program that includes them (`@ggui-ai/protocol` alone no longer references ext-apps, #847). Every `@ggui-ai/*` declaration itself carries explicit `.js` extensions since 0.15.0.
+
+**Scope.** The errors come from ext-apps' own declarations, which this package (and `@ggui-ai/iframe-runtime`) depends on. `@ggui-ai/protocol` alone does not: its declarations reference nothing from ext-apps, so a NodeNext consumer of the protocol package typechecks clean without the switch.
 
 **Fix.** Until ext-apps ships the upstream fix, set the TypeScript switch for third-party declaration defects in your `tsconfig.json`:
 

package/dist/build-mcp.d.ts

@@ -9,17 +9,38 @@
  * tool return advertises its shape — wire consumers can trust the output.
  */
 import { McpServer } from '@modelcontextprotocol/sdk/server/mcp.js';
-import { type ZodRawShape } from 'zod';
+import type { Transport } from '@modelcontextprotocol/sdk/shared/transport.js';
+import * as z from 'zod';
+import type { ZodRawShape } from 'zod';
 import { type HandlerContext, type SharedHandler } from '@ggui-ai/mcp-server-handlers';
 import type { Logger } from './logger.js';
 import { type LoadingIndicatorOption, type GguiRenderResourceTemplateOptions } from './mcp-apps-outbound.js';
 import { type ViewProofGate } from './view-proof-gate.js';
+/**
+ * The output object a tool ADVERTISES in `tools/list` (ggui#1333): the
+ * handler's shape with every object node open. Throws at server build if
+ * the derivation left a closed object anywhere in the projection the SDK
+ * will publish — the MUST is enforced where the document is made, not
+ * only where a test happens to look.
+ */
+export declare function openOutputObject(toolName: string, shape: ZodRawShape): z.ZodObject;
 export interface ServerInfo {
     readonly name: string;
     readonly version: string;
     readonly description?: string;
 }
 export interface BuildMcpServerOptions {
+    /**
+     * How many array elements and object members one `tools/call`'s
+     * `arguments` may carry before the SDK refuses the call ahead of any
+     * handler (ggui#1993). Default {@link MAX_TOOL_INPUT_ELEMENTS}; `Infinity`
+     * is the SDK's "no limit", leaving the request body limit as the only
+     * bound. A value below 1 or NaN is refused by the SDK at construction
+     * (`RangeError`); `createGguiServer` refuses it earlier, at composition,
+     * so a misconfigured deployment fails at boot and not at its first call
+     * (ggui#1996).
+     */
+    readonly maxToolInputElements?: number;
     /**
      * The view-origin proof's measuring gate (ggui#1415), built once per
      * server with the secret its ws envelopes are signed with. For a tool
@@ -183,5 +204,67 @@ export interface BuildMcpServerOptions {
      */
     readonly withholdResultMeta?: boolean;
 }
+/**
+ * Largest combined number of array elements and object members one
+ * `tools/call` may carry in its `arguments` (ggui#1993). The MCP SDK
+ * counts them before any schema runs and before the handler is reached;
+ * a call over the ceiling takes the invalid-input door it already has —
+ * `isError: true` with one text block naming the tool and the ceiling —
+ * and the handler never sees it. A call at or under it is unaffected.
+ *
+ * The number: the largest legitimate tool input in this repository's
+ * corpora is about a thousand elements (a benchmark render of a
+ * 41-element contract with 945 elements of props; conformance-kit cases
+ * stay under 120; a theme document is ~325), so ten thousand is an order
+ * of magnitude of headroom over anything the surface is asked to carry
+ * today. Strings do not count toward it, however long. It bounds the
+ * work a request can ask of schema validation; the request body limit
+ * bounds everything else, and lives with the transport.
+ */
+export declare const MAX_TOOL_INPUT_ELEMENTS = 10000;
 export declare function buildMcpServer(info: ServerInfo, handlers: ReadonlyArray<SharedHandler<ZodRawShape, ZodRawShape>>, getContext: () => HandlerContext, logger: Logger, opts?: BuildMcpServerOptions): McpServer;
+/**
+ * Why an SDK-level `tools/call` refusal was refused, as far as the server
+ * can tell without the SDK exposing it (ggui#1995):
+ *
+ *   - `elements_over_ceiling` — the SDK's element-count door
+ *     (`maxToolInputElements`, {@link MAX_TOOL_INPUT_ELEMENTS}). Classified
+ *     by the SDK's own sentence, which `build-mcp.test.ts` pins as the
+ *     refusal text — an SDK wording change reds that pin before it could
+ *     silently reclassify every over-ceiling refusal here.
+ *   - `unknown_tool` — a name this server never registered.
+ *   - `input_rejected` — every other `isError` answer the handler never saw:
+ *     the SDK's input-schema validation, a disabled tool.
+ *   - `rpc_error` — answered as a JSON-RPC `error` member rather than a
+ *     tool result (in SDK 1.32.1 only `UrlElicitationRequired` leaves this
+ *     way).
+ */
+export type ToolCallRefusalReason = 'elements_over_ceiling' | 'unknown_tool' | 'input_rejected' | 'rpc_error';
+/**
+ * ggui#1995 — every answered `tools/call` produces exactly one `tool_invoked`
+ * line. The SDK refuses an over-ceiling or schema-failing call inside its
+ * own handler, before the callback {@link buildMcpServer} registers, so the
+ * refusal is observable on the wire (`isError`) yet, without this, invisible
+ * in ops logs. There is no pre-dispatch seam in the SDK (`registerTool`
+ * takes zod only; the element counter is module-private), so the rule is
+ * structural and read at the transport: **a `tools/call` answered — by
+ * `result.isError` or by a JSON-RPC `error` — whose request id the callback
+ * never saw is an SDK-level refusal**, logged as `tool_invoked` with
+ * `outcome: 'refused'` and a {@link ToolCallRefusalReason}. The same event
+ * name as every other call, so an operator's per-tool counts include the
+ * refusals; the fields are the tool name, the request id and the app —
+ * never the arguments or the SDK's message (a schema message can carry
+ * received values).
+ *
+ * A decorator, not a patch: it implements `Transport` around the real one
+ * and is what `McpServer.connect` receives, so nothing on the SDK's object
+ * is replaced and the order of `connect` does not matter. A `tools/call`
+ * whose transport closes before an answer is a non-event here — the
+ * obligation is on answered calls.
+ *
+ * Parties: this server ↔ its operator's log consumer. Failure mode: a
+ * refusal with no line. Observable violation: `build-mcp.test.ts`
+ * (ggui#1995) and the route test over HTTP.
+ */
+export declare function observeToolCallRefusals(inner: Transport, server: McpServer, logger: Logger, getContext: () => HandlerContext): Transport;
 //# sourceMappingURL=build-mcp.d.ts.map

package/dist/build-mcp.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"build-mcp.d.ts","sourceRoot":"","sources":["../src/build-mcp.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,OAAO,EAAE,SAAS,EAAE,MAAM,yCAAyC,CAAC;AAIpE,OAAO,EAAK,KAAK,WAAW,EAAE,MAAM,KAAK,CAAC;AAC1C,OAAO,EAEL,KAAK,cAAc,EACnB,KAAK,aAAa,EACnB,MAAM,8BAA8B,CAAC;AACtC,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,aAAa,CAAC;AAE1C,OAAO,EACL,KAAK,sBAAsB,EAE3B,KAAK,iCAAiC,EACvC,MAAM,wBAAwB,CAAC;AAChC,OAAO,EAAoB,KAAK,aAAa,EAAE,MAAM,sBAAsB,CAAC;AAE5E,MAAM,WAAW,UAAU;IACzB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAC;CAC/B;AAED,MAAM,WAAW,qBAAqB;IACpC;;;;;;;OAOG;IACH,QAAQ,CAAC,aAAa,CAAC,EAAE,aAAa,CAAC;IACvC;;;;OAIG;IACH,QAAQ,CAAC,aAAa,CAAC,EAAE,OAAO,CAAC;IACjC;;;;;;;;;;OAUG;IACH,QAAQ,CAAC,eAAe,CAAC,EAAE,OAAO,CAAC;IACnC;;;;OAIG;IACH,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC;IAC5B,8DAA8D;IAC9D,QAAQ,CAAC,gBAAgB,CAAC,EAAE,sBAAsB,CAAC;IACnD;;;;;;;;;;OAUG;IACH,QAAQ,CAAC,aAAa,CAAC,EAAE,iCAAiC,CAAC;IAC3D;;;;;;;;;OASG;IACH,QAAQ,CAAC,aAAa,CAAC,EAAE,MAAM,CAAC;IAChC;;;;;;;;OAQG;IACH,QAAQ,CAAC,gBAAgB,CAAC,EAAE,SAAS,CAAC,MAAM,GAAG,SAAS,CAAC,EAAE,CAAC;IAC5D;;;;;;;;;;;;;;;;;;OAkBG;IACH,QAAQ,CAAC,YAAY,CAAC,EAAE,aAAa,CAAC,KAAK,GAAG,MAAM,GAAG,SAAS,CAAC,CAAC;IAElE;;;;;;;;;;;;;;OAcG;IACH,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM,CAAC;IAE/B;;;;;;;;;;;;;;;;;;OAkBG;IACH,QAAQ,CAAC,cAAc,CAAC,EAAE,aAAa,CAAC,CAAC,MAAM,EAAE,SAAS,KAAK,IAAI,CAAC,CAAC;IAErE;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OAoCG;IACH,QAAQ,CAAC,kBAAkB,CAAC,EAAE,OAAO,CAAC;CACvC;AAqPD,wBAAgB,cAAc,CAC5B,IAAI,EAAE,UAAU,EAChB,QAAQ,EAAE,aAAa,CAAC,aAAa,CAAC,WAAW,EAAE,WAAW,CAAC,CAAC,EAChE,UAAU,EAAE,MAAM,cAAc,EAChC,MAAM,EAAE,MAAM,EACd,IAAI,GAAE,qBAA0B,GAC/B,SAAS,CAkSX"}
+{"version":3,"file":"build-mcp.d.ts","sourceRoot":"","sources":["../src/build-mcp.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,OAAO,EAAE,SAAS,EAAE,MAAM,yCAAyC,CAAC;AACpE,OAAO,KAAK,EAAE,SAAS,EAAwB,MAAM,+CAA+C,CAAC;AAYrG,OAAO,KAAK,CAAC,MAAM,KAAK,CAAC;AACzB,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,KAAK,CAAC;AACvC,OAAO,EAEL,KAAK,cAAc,EACnB,KAAK,aAAa,EACnB,MAAM,8BAA8B,CAAC;AACtC,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,aAAa,CAAC;AAE1C,OAAO,EACL,KAAK,sBAAsB,EAE3B,KAAK,iCAAiC,EACvC,MAAM,wBAAwB,CAAC;AAChC,OAAO,EAAoB,KAAK,aAAa,EAAE,MAAM,sBAAsB,CAAC;AAsH5E;;;;;;GAMG;AACH,wBAAgB,gBAAgB,CAAC,QAAQ,EAAE,MAAM,EAAE,KAAK,EAAE,WAAW,GAAG,CAAC,CAAC,SAAS,CAUlF;AAED,MAAM,WAAW,UAAU;IACzB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAC;CAC/B;AAED,MAAM,WAAW,qBAAqB;IACpC;;;;;;;;;OASG;IACH,QAAQ,CAAC,oBAAoB,CAAC,EAAE,MAAM,CAAC;IACvC;;;;;;;OAOG;IACH,QAAQ,CAAC,aAAa,CAAC,EAAE,aAAa,CAAC;IACvC;;;;OAIG;IACH,QAAQ,CAAC,aAAa,CAAC,EAAE,OAAO,CAAC;IACjC;;;;;;;;;;OAUG;IACH,QAAQ,CAAC,eAAe,CAAC,EAAE,OAAO,CAAC;IACnC;;;;OAIG;IACH,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC;IAC5B,8DAA8D;IAC9D,QAAQ,CAAC,gBAAgB,CAAC,EAAE,sBAAsB,CAAC;IACnD;;;;;;;;;;OAUG;IACH,QAAQ,CAAC,aAAa,CAAC,EAAE,iCAAiC,CAAC;IAC3D;;;;;;;;;OASG;IACH,QAAQ,CAAC,aAAa,CAAC,EAAE,MAAM,CAAC;IAChC;;;;;;;;OAQG;IACH,QAAQ,CAAC,gBAAgB,CAAC,EAAE,SAAS,CAAC,MAAM,GAAG,SAAS,CAAC,EAAE,CAAC;IAC5D;;;;;;;;;;;;;;;;;;OAkBG;IACH,QAAQ,CAAC,YAAY,CAAC,EAAE,aAAa,CAAC,KAAK,GAAG,MAAM,GAAG,SAAS,CAAC,CAAC;IAElE;;;;;;;;;;;;;;OAcG;IACH,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM,CAAC;IAE/B;;;;;;;;;;;;;;;;;;OAkBG;IACH,QAAQ,CAAC,cAAc,CAAC,EAAE,aAAa,CAAC,CAAC,MAAM,EAAE,SAAS,KAAK,IAAI,CAAC,CAAC;IAErE;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OAoCG;IACH,QAAQ,CAAC,kBAAkB,CAAC,EAAE,OAAO,CAAC;CACvC;AA2PD;;;;;;;;;;;;;;;;GAgBG;AACH,eAAO,MAAM,uBAAuB,QAAS,CAAC;AAE9C,wBAAgB,cAAc,CAC5B,IAAI,EAAE,UAAU,EAChB,QAAQ,EAAE,aAAa,CAAC,aAAa,CAAC,WAAW,EAAE,WAAW,CAAC,CAAC,EAChE,UAAU,EAAE,MAAM,cAAc,EAChC,MAAM,EAAE,MAAM,EACd,IAAI,GAAE,qBAA0B,GAC/B,SAAS,CAoTX;AA0CD;;;;;;;;;;;;;;;GAeG;AACH,MAAM,MAAM,qBAAqB,GAAG,uBAAuB,GAAG,cAAc,GAAG,gBAAgB,GAAG,WAAW,CAAC;AAI9G;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AACH,wBAAgB,uBAAuB,CACrC,KAAK,EAAE,SAAS,EAChB,MAAM,EAAE,SAAS,EACjB,MAAM,EAAE,MAAM,EACd,UAAU,EAAE,MAAM,cAAc,GAC/B,SAAS,CAMX"}

package/dist/build-mcp.js

@@ -9,13 +9,152 @@
  * tool return advertises its shape — wire consumers can trust the output.
  */
 import { McpServer } from '@modelcontextprotocol/sdk/server/mcp.js';
+import { isJSONRPCErrorResponse, isJSONRPCRequest, isJSONRPCResponse, } from '@modelcontextprotocol/sdk/types.js';
 import { registerAppTool } from '@modelcontextprotocol/ext-apps/server';
 import { isRecord } from '@ggui-ai/protocol';
-import { z } from 'zod';
+import * as z from 'zod';
 import { isHandlerFailure, } from '@ggui-ai/mcp-server-handlers';
 import { GGUI_RENDER_RESOURCE_URI } from '@ggui-ai/protocol/integrations/mcp-apps';
 import { installMcpAppsOutbound, } from './mcp-apps-outbound.js';
 import { runViewProofGate } from './view-proof-gate.js';
+// =============================================================================
+// Advertised output objects are OPEN (ggui#1333)
+//
+// The SDK projects a tool's registered output object into `tools/list` in
+// zod's OUTPUT mode, which closes every object (`additionalProperties:
+// false`) whether or not the zod object is strict. A host that caches that
+// document and validates results — the TS SDK client does — then refuses a
+// result carrying a member it does not name, so an optional output field
+// added in release N failed every host that listed tools against N−1, and
+// an additive field could only ship by declaring it one release before
+// emitting it (ggui#1336). The MUST this section enforces: an advertised
+// output object MUST NOT be closed, at any depth.
+//
+// The ADVERTISED document is therefore decoupled from the PARSE: what the
+// server registers is an open derivation of the handler's shape (every
+// object node loose, the top level included), while
+// {@link validateOutputPayload} keeps validating with the handler's own
+// shape, so an undeclared member is still stripped before the wire. The SDK's
+// own output validation runs the loose object over the already-stripped
+// payload and passes. `assertAdvertisedOpen` makes the obligation
+// self-enforcing at server build — a node kind the derivation does not open
+// fails loudly here, never silently as a closed object on the wire.
+// =============================================================================
+/**
+ * A node reached through a schema's definition is typed as zod's CORE
+ * `$ZodType`; every schema a handler builds with `z.*` is a classic
+ * `ZodType` instance, so this is a real check at the one place a core node
+ * is handed back, and a non-classic node is a definition-site bug.
+ */
+function asClassic(node) {
+    if (node instanceof z.ZodType)
+        return node;
+    throw new Error('a tool output shape holds a schema node that is not a zod classic ZodType');
+}
+/**
+ * One open derivation per source node (ggui#1333): the memo is what keeps a
+ * recursive schema (`z.lazy`) from looping, and it keeps a node shared by two
+ * fields shared in the derivation too.
+ */
+const OPENED = new WeakMap();
+/** The open derivation of one node: every object under it becomes loose. */
+function openNode(schema) {
+    const seen = OPENED.get(schema);
+    if (seen !== undefined)
+        return seen;
+    const meta = z.globalRegistry.get(schema);
+    const unmetered = openNodeUnmetered(schema);
+    const opened = unmetered === schema || meta === undefined ? unmetered : unmetered.meta(meta);
+    OPENED.set(schema, opened);
+    return opened;
+}
+function openNodes(nodes) {
+    return nodes.map((node) => openNode(asClassic(node)));
+}
+/** The inner node of a wrapper, as the classic type the derivation rebuilds with. */
+function inner(node) {
+    return openNode(asClassic(node));
+}
+function openNodeUnmetered(schema) {
+    if (schema instanceof z.ZodObject)
+        return z.looseObject(openShape(schema.shape));
+    if (schema instanceof z.ZodArray)
+        return z.array(inner(schema.element));
+    // A discriminated union is a union in the projection (`anyOf`); the
+    // discriminator only speeds the parse, which stays on the original.
+    if (schema instanceof z.ZodUnion) {
+        const [first, ...rest] = openNodes(schema.options);
+        if (first === undefined)
+            return schema;
+        return z.union([first, ...rest]);
+    }
+    if (schema instanceof z.ZodIntersection) {
+        const { left, right } = schema._zod.def;
+        return z.intersection(inner(left), inner(right));
+    }
+    if (schema instanceof z.ZodTuple) {
+        const { items, rest } = schema._zod.def;
+        const [first, ...others] = openNodes(items);
+        if (first === undefined)
+            return rest === null ? z.tuple([]) : schema;
+        return rest === null ? z.tuple([first, ...others]) : z.tuple([first, ...others], inner(rest));
+    }
+    if (schema instanceof z.ZodRecord)
+        return z.record(schema.keyType, inner(schema.valueType));
+    if (schema instanceof z.ZodOptional)
+        return inner(schema.unwrap()).optional();
+    if (schema instanceof z.ZodNullable)
+        return inner(schema.unwrap()).nullable();
+    if (schema instanceof z.ZodNonOptional)
+        return inner(schema.unwrap()).nonoptional();
+    if (schema instanceof z.ZodReadonly)
+        return inner(schema.unwrap()).readonly();
+    if (schema instanceof z.ZodDefault) {
+        return inner(schema.unwrap()).default(schema._zod.def.defaultValue);
+    }
+    if (schema instanceof z.ZodCatch) {
+        return inner(schema.unwrap()).catch(schema._zod.def.catchValue);
+    }
+    if (schema instanceof z.ZodLazy)
+        return z.lazy(() => inner(schema.unwrap()));
+    if (schema instanceof z.ZodPipe)
+        return z.pipe(schema.in, inner(schema.out));
+    return schema;
+}
+function openShape(shape) {
+    return Object.fromEntries(Object.entries(shape).map(([key, member]) => [key, inner(member)]));
+}
+/** Every `additionalProperties: false` under a JSON Schema document, by path. */
+function closedObjectsIn(node, path) {
+    if (Array.isArray(node)) {
+        return node.flatMap((item, i) => closedObjectsIn(item, `${path}[${i}]`));
+    }
+    if (!isRecord(node))
+        return [];
+    const closed = [];
+    for (const [key, value] of Object.entries(node)) {
+        if (key === 'additionalProperties' && value === false)
+            closed.push(path);
+        closed.push(...closedObjectsIn(value, `${path}.${key}`));
+    }
+    return closed;
+}
+/**
+ * The output object a tool ADVERTISES in `tools/list` (ggui#1333): the
+ * handler's shape with every object node open. Throws at server build if
+ * the derivation left a closed object anywhere in the projection the SDK
+ * will publish — the MUST is enforced where the document is made, not
+ * only where a test happens to look.
+ */
+export function openOutputObject(toolName, shape) {
+    const advertised = z.looseObject(openShape(shape));
+    const closed = closedObjectsIn(z.toJSONSchema(advertised, { io: 'output' }), '$');
+    if (closed.length > 0) {
+        throw new Error(`Tool ${toolName} would advertise a closed output object at ${closed.join(', ')} — ` +
+            `an advertised output object MUST NOT be closed (ggui#1333); extend openNode for this node kind.`);
+    }
+    return advertised;
+}
 /**
  * Build a fresh MCP server with every handler registered.
  *
@@ -88,6 +227,12 @@ function validateOutputPayload(handler, payload) {
  * The thrown path is untouched (`outcome: 'error'` + `errorClass`),
  * which is what makes "a gate that throws instead of returning a
  * refusal is a conformance failure" observable in ops.
+ *
+ * `outcome: 'refused'` has a second door since ggui#1995: a `tools/call`
+ * the SDK refused before any handler ran (element ceiling, input schema,
+ * unknown tool) logs the same outcome from {@link observeToolCallRefusals},
+ * carrying a `reason` instead of a registry `code`. One outcome, two
+ * fields: `code` names a handler's refusal, `reason` an SDK-level one.
  */
 function classifyFailurePayload(payload) {
     if (!declaresRefusedOutcome(payload) || !isRecord(payload)) {
@@ -231,15 +376,46 @@ function claimedSessionField(tool, input) {
         claimedSessionIdTruncated: true,
     };
 }
+/**
+ * Largest combined number of array elements and object members one
+ * `tools/call` may carry in its `arguments` (ggui#1993). The MCP SDK
+ * counts them before any schema runs and before the handler is reached;
+ * a call over the ceiling takes the invalid-input door it already has —
+ * `isError: true` with one text block naming the tool and the ceiling —
+ * and the handler never sees it. A call at or under it is unaffected.
+ *
+ * The number: the largest legitimate tool input in this repository's
+ * corpora is about a thousand elements (a benchmark render of a
+ * 41-element contract with 945 elements of props; conformance-kit cases
+ * stay under 120; a theme document is ~325), so ten thousand is an order
+ * of magnitude of headroom over anything the surface is asked to carry
+ * today. Strings do not count toward it, however long. It bounds the
+ * work a request can ask of schema validation; the request body limit
+ * bounds everything else, and lives with the transport.
+ */
+export const MAX_TOOL_INPUT_ELEMENTS = 10_000;
 export function buildMcpServer(info, handlers, getContext, logger, opts = {}) {
     // `instructions` is a ServerOptions field (the SECOND argument): the
     // SDK sends it in the `initialize` result. In the first argument (the
     // Implementation) it was dropped, and no host ever received it (ggui#1579).
+    // The element ceiling rides the same options object: every server this
+    // function builds carries it, on every mount (ggui#1993).
     const server = new McpServer({
         name: info.name,
         version: info.version,
         ...(info.description ? { description: info.description } : {}),
-    }, opts.instructions ? { instructions: opts.instructions } : undefined);
+    }, {
+        maxToolInputElements: opts.maxToolInputElements ?? MAX_TOOL_INPUT_ELEMENTS,
+        ...(opts.instructions ? { instructions: opts.instructions } : {}),
+    });
+    // ggui#1995 — what `observeToolCallRefusals` pairs a `tools/call` answer
+    // against: the request ids whose registered callback ran, and the names
+    // this server registered (an unknown name is refused by the SDK too).
+    const accounting = {
+        invoked: new Set(),
+        tools: new Set(handlers.map((h) => h.name)),
+    };
+    TOOL_CALL_ACCOUNTING.set(server, accounting);
     // Content-addressed shell URI (stale-shell bust) — when MCP Apps
     // outbound wiring registers the shell, declarations advertising the
     // BARE `ui://ggui/render` are rewritten to the versioned twin below
@@ -295,6 +471,10 @@ export function buildMcpServer(info, handlers, getContext, logger, opts = {}) {
             continue;
         }
         const cb = async (input, extra) => {
+            // ggui#1995 — the callback ran for this request: whatever answer
+            // leaves for this id is the handler's, not an SDK-level refusal.
+            if (extra?.requestId !== undefined)
+                accounting.invoked.add(extra.requestId);
             // Thread per-request `_meta` AND the cancellation `signal` onto the
             // canonical context. The MCP SDK already parses `params._meta` for
             // us and exposes it on `RequestHandlerExtra._meta`; handlers that
@@ -454,7 +634,9 @@ export function buildMcpServer(info, handlers, getContext, logger, opts = {}) {
             ...(handler.title ? { title: handler.title } : {}),
             description: handler.description,
             inputSchema: handler.inputSchema,
-            outputSchema: handler.outputSchema,
+            // Advertised OPEN (ggui#1333); the parse stays the handler's own shape
+            // in `validateOutputPayload`.
+            outputSchema: openOutputObject(handler.name, handler.outputSchema),
         };
         // Dispatch on declaration-level UI meta presence. `registerAppTool`
         // (from `@modelcontextprotocol/ext-apps/server`) normalizes the
@@ -527,3 +709,124 @@ function errorClassName(err) {
     }
     return 'Unknown';
 }
+const TOOL_CALL_ACCOUNTING = new WeakMap();
+const CEILING_SENTENCE = 'arguments contain more than the maximum of';
+/**
+ * ggui#1995 — every answered `tools/call` produces exactly one `tool_invoked`
+ * line. The SDK refuses an over-ceiling or schema-failing call inside its
+ * own handler, before the callback {@link buildMcpServer} registers, so the
+ * refusal is observable on the wire (`isError`) yet, without this, invisible
+ * in ops logs. There is no pre-dispatch seam in the SDK (`registerTool`
+ * takes zod only; the element counter is module-private), so the rule is
+ * structural and read at the transport: **a `tools/call` answered — by
+ * `result.isError` or by a JSON-RPC `error` — whose request id the callback
+ * never saw is an SDK-level refusal**, logged as `tool_invoked` with
+ * `outcome: 'refused'` and a {@link ToolCallRefusalReason}. The same event
+ * name as every other call, so an operator's per-tool counts include the
+ * refusals; the fields are the tool name, the request id and the app —
+ * never the arguments or the SDK's message (a schema message can carry
+ * received values).
+ *
+ * A decorator, not a patch: it implements `Transport` around the real one
+ * and is what `McpServer.connect` receives, so nothing on the SDK's object
+ * is replaced and the order of `connect` does not matter. A `tools/call`
+ * whose transport closes before an answer is a non-event here — the
+ * obligation is on answered calls.
+ *
+ * Parties: this server ↔ its operator's log consumer. Failure mode: a
+ * refusal with no line. Observable violation: `build-mcp.test.ts`
+ * (ggui#1995) and the route test over HTTP.
+ */
+export function observeToolCallRefusals(inner, server, logger, getContext) {
+    const accounting = TOOL_CALL_ACCOUNTING.get(server);
+    if (!accounting) {
+        throw new Error('observeToolCallRefusals: the server was not built by buildMcpServer');
+    }
+    return new ToolCallRefusalObserver(inner, accounting, logger, getContext);
+}
+class ToolCallRefusalObserver {
+    inner;
+    accounting;
+    logger;
+    getContext;
+    /** `tools/call` requests seen inbound and not yet answered: id → tool name. */
+    pending = new Map();
+    onclose;
+    onerror;
+    onmessage;
+    constructor(inner, accounting, logger, getContext) {
+        this.inner = inner;
+        this.accounting = accounting;
+        this.logger = logger;
+        this.getContext = getContext;
+        inner.onmessage = (message, extra) => {
+            if (isJSONRPCRequest(message) && message.method === 'tools/call') {
+                const name = message.params?.['name'];
+                this.pending.set(message.id, typeof name === 'string' ? name : '');
+            }
+            this.onmessage?.(message, extra);
+        };
+        inner.onclose = () => {
+            this.pending.clear();
+            this.onclose?.();
+        };
+        inner.onerror = (error) => this.onerror?.(error);
+    }
+    get sessionId() {
+        return this.inner.sessionId;
+    }
+    setProtocolVersion(version) {
+        this.inner.setProtocolVersion?.(version);
+    }
+    start() {
+        return this.inner.start();
+    }
+    close() {
+        return this.inner.close();
+    }
+    send(message, options) {
+        this.observe(message);
+        return this.inner.send(message, options);
+    }
+    observe(message) {
+        let id;
+        let reason;
+        if (isJSONRPCResponse(message)) {
+            id = message.id;
+            const result = message.result;
+            if (result['isError'] !== true) {
+                this.pending.delete(id);
+                return;
+            }
+            reason = 'input_rejected';
+            const content = result['content'];
+            const first = Array.isArray(content) ? content[0] : undefined;
+            const text = isRecord(first) && typeof first['text'] === 'string' ? first['text'] : '';
+            if (text.includes(CEILING_SENTENCE))
+                reason = 'elements_over_ceiling';
+        }
+        else if (isJSONRPCErrorResponse(message)) {
+            // An error response may carry no id (a parse error); nothing to pair.
+            if (message.id === undefined)
+                return;
+            id = message.id;
+            reason = 'rpc_error';
+        }
+        else {
+            return;
+        }
+        const tool = this.pending.get(id);
+        this.pending.delete(id);
+        if (tool === undefined || this.accounting.invoked.has(id))
+            return;
+        if (reason !== 'rpc_error' && !this.accounting.tools.has(tool))
+            reason = 'unknown_tool';
+        this.logger.warn('tool_invoked', {
+            tool,
+            appId: this.getContext().appId,
+            outcome: 'refused',
+            reason,
+            requestId: String(id),
+        });
+    }
+}

package/dist/console-config-routes.js

@@ -23,7 +23,7 @@
 import { GguiJsonV1 } from "@ggui-ai/project-config";
 import { findGguiJson, safeLoadGguiJson } from "@ggui-ai/project-config/node";
 import { readFileSync } from "node:fs";
-import { z } from "zod";
+import * as z from "zod";
 import { applyDevtoolSecurityHeaders } from "./console-headers.js";
 /**
  * Mount `GET /ggui/console/config` onto the express app. Returns

package/dist/console-mcp-tools-routes.d.ts

@@ -22,7 +22,7 @@
  */
 import type { SharedHandler } from "@ggui-ai/mcp-server-handlers";
 import type { Express } from "express";
-import { type ZodRawShape } from "zod";
+import type { ZodRawShape } from "zod";
 import type { Logger } from "./logger.js";
 interface MountOptions {
     /** Express app to mount onto. */

package/dist/console-mcp-tools-routes.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"console-mcp-tools-routes.d.ts","sourceRoot":"","sources":["../src/console-mcp-tools-routes.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;GAqBG;AAEH,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,8BAA8B,CAAC;AAClE,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,SAAS,CAAC;AACvC,OAAO,EAAK,KAAK,WAAW,EAAE,MAAM,KAAK,CAAC;AAE1C,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,aAAa,CAAC;AAE1C,UAAU,YAAY;IACpB,iCAAiC;IACjC,QAAQ,CAAC,GAAG,EAAE,OAAO,CAAC;IACtB,oDAAoD;IACpD,QAAQ,CAAC,QAAQ,EAAE,aAAa,CAAC,aAAa,CAAC,WAAW,EAAE,WAAW,CAAC,CAAC,CAAC;IAC1E,wDAAwD;IACxD,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;CACzB;AAED;;;GAGG;AACH,wBAAgB,0BAA0B,CAAC,IAAI,EAAE,YAAY,GAAG,IAAI,CAwCnE"}
+{"version":3,"file":"console-mcp-tools-routes.d.ts","sourceRoot":"","sources":["../src/console-mcp-tools-routes.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;GAqBG;AAEH,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,8BAA8B,CAAC;AAClE,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,SAAS,CAAC;AAEvC,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,KAAK,CAAC;AAEvC,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,aAAa,CAAC;AAE1C,UAAU,YAAY;IACpB,iCAAiC;IACjC,QAAQ,CAAC,GAAG,EAAE,OAAO,CAAC;IACtB,oDAAoD;IACpD,QAAQ,CAAC,QAAQ,EAAE,aAAa,CAAC,aAAa,CAAC,WAAW,EAAE,WAAW,CAAC,CAAC,CAAC;IAC1E,wDAAwD;IACxD,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;CACzB;AAED;;;GAGG;AACH,wBAAgB,0BAA0B,CAAC,IAAI,EAAE,YAAY,GAAG,IAAI,CAwCnE"}

package/dist/console-mcp-tools-routes.js

@@ -20,7 +20,7 @@
  * and warn-logs — operators still see name + description, just
  * without typed input/output detail.
  */
-import { z } from "zod";
+import * as z from "zod";
 import { applyDevtoolSecurityHeaders } from "./console-headers.js";
 /**
  * Mount `GET /ggui/console/mcp/tools` onto the express app. Returns

package/dist/control-service.d.ts

@@ -43,7 +43,7 @@
  * preview that leaks which operations exist against which account.
  */
 import { type SharedHandler, type SharedHandlerOutputBound } from "@ggui-ai/mcp-server-handlers";
-import { type ZodRawShape } from "zod";
+import type { ZodRawShape } from "zod";
 import type { McpService } from "./mcp-mounts.js";
 type AnyHandler = SharedHandler<ZodRawShape, ZodRawShape>;
 /** Every audience tag a handler may declare. */

package/dist/control-service.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"control-service.d.ts","sourceRoot":"","sources":["../src/control-service.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2CG;AACH,OAAO,EAGL,KAAK,aAAa,EAClB,KAAK,wBAAwB,EAC9B,MAAM,8BAA8B,CAAC;AACtC,OAAO,EAAK,KAAK,WAAW,EAAmB,MAAM,KAAK,CAAC;AAC3D,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,iBAAiB,CAAC;AAElD,KAAK,UAAU,GAAG,aAAa,CAAC,WAAW,EAAE,WAAW,CAAC,CAAC;AAE1D,gDAAgD;AAChD,MAAM,MAAM,WAAW,GAAG,OAAO,GAAG,SAAS,GAAG,UAAU,GAAG,KAAK,CAAC;AAEnE,6CAA6C;AAC7C,eAAO,MAAM,YAAY,aAAa,CAAC;AAEvC,+EAA+E;AAC/E,eAAO,MAAM,oBAAoB,YAAY,CAAC;AAE9C,sDAAsD;AACtD,eAAO,MAAM,oBAAoB,EAAE,aAAa,CAAC,WAAW,CAAwB,CAAC;AAErF,0CAA0C;AAC1C,eAAO,MAAM,uBAAuB,EAAE,aAAa,CAAC,WAAW,CAAuB,CAAC;AAEvF;;;;;;;;GAQG;AACH,wBAAgB,wBAAwB,CACtC,GAAG,EAAE,aAAa,CAAC,UAAU,CAAC,EAC9B,OAAO,EAAE,aAAa,CAAC,WAAW,CAAC,GAClC,aAAa,CAAC,UAAU,CAAC,CAK3B;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAkCG;AACH,eAAO,MAAM,eAAe,EAAE,WAAW,CAAC,MAAM,CAc9C,CAAC;AAEH;;;GAGG;AACH,wBAAgB,aAAa,CAAC,CAAC,SAAS,WAAW,EAAE,CAAC,SAAS,WAAW,EAAE,CAAC,SAAS,wBAAwB,CAAC,CAAC,CAAC,EAC/G,CAAC,EAAE,aAAa,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,GACxB,aAAa,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,CAGxB;AAED;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,wBAAgB,YAAY,CAAC,CAAC,SAAS,WAAW,EAAE,CAAC,SAAS,WAAW,EAAE,CAAC,SAAS,wBAAwB,CAAC,CAAC,CAAC,EAC9G,CAAC,EAAE,aAAa,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,GACxB,aAAa,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,CAYxB;AASD;;;;;;;;;;;;;;;GAeG;AACH,wBAAgB,eAAe,CAAC,CAAC,SAAS,WAAW,EAAE,CAAC,SAAS,WAAW,EAAE,CAAC,SAAS,wBAAwB,CAAC,CAAC,CAAC,EACjH,CAAC,EAAE,aAAa,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,GACxB,aAAa,CAAC,WAAW,EAAE,WAAW,CAAC,CAkCzC;AAED,MAAM,WAAW,uBAAuB;IACtC;;;;OAIG;IACH,QAAQ,CAAC,QAAQ,EAAE,aAAa,CAAC,UAAU,CAAC,CAAC;IAC7C;;;;;OAKG;IACH,QAAQ,CAAC,aAAa,CAAC,EAAE,aAAa,CAAC,MAAM,CAAC,CAAC;CAChD;AAED;;;;;;;;GAQG;AACH,wBAAgB,mBAAmB,CAAC,IAAI,EAAE,uBAAuB,GAAG,cAAc,CAwBjF;AAED;;;;;;GAMG;AACH,MAAM,WAAW,cAAe,SAAQ,UAAU;IAChD,QAAQ,CAAC,YAAY,EAAE,WAAW,CAAC,MAAM,CAAC,CAAC;CAC5C"}
+{"version":3,"file":"control-service.d.ts","sourceRoot":"","sources":["../src/control-service.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2CG;AACH,OAAO,EAGL,KAAK,aAAa,EAClB,KAAK,wBAAwB,EAC9B,MAAM,8BAA8B,CAAC;AAEtC,OAAO,KAAK,EAAE,WAAW,EAAc,MAAM,KAAK,CAAC;AACnD,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,iBAAiB,CAAC;AAElD,KAAK,UAAU,GAAG,aAAa,CAAC,WAAW,EAAE,WAAW,CAAC,CAAC;AAE1D,gDAAgD;AAChD,MAAM,MAAM,WAAW,GAAG,OAAO,GAAG,SAAS,GAAG,UAAU,GAAG,KAAK,CAAC;AAEnE,6CAA6C;AAC7C,eAAO,MAAM,YAAY,aAAa,CAAC;AAEvC,+EAA+E;AAC/E,eAAO,MAAM,oBAAoB,YAAY,CAAC;AAE9C,sDAAsD;AACtD,eAAO,MAAM,oBAAoB,EAAE,aAAa,CAAC,WAAW,CAAwB,CAAC;AAErF,0CAA0C;AAC1C,eAAO,MAAM,uBAAuB,EAAE,aAAa,CAAC,WAAW,CAAuB,CAAC;AAEvF;;;;;;;;GAQG;AACH,wBAAgB,wBAAwB,CACtC,GAAG,EAAE,aAAa,CAAC,UAAU,CAAC,EAC9B,OAAO,EAAE,aAAa,CAAC,WAAW,CAAC,GAClC,aAAa,CAAC,UAAU,CAAC,CAK3B;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAkCG;AACH,eAAO,MAAM,eAAe,EAAE,WAAW,CAAC,MAAM,CAc9C,CAAC;AAEH;;;GAGG;AACH,wBAAgB,aAAa,CAAC,CAAC,SAAS,WAAW,EAAE,CAAC,SAAS,WAAW,EAAE,CAAC,SAAS,wBAAwB,CAAC,CAAC,CAAC,EAC/G,CAAC,EAAE,aAAa,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,GACxB,aAAa,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,CAGxB;AAED;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,wBAAgB,YAAY,CAAC,CAAC,SAAS,WAAW,EAAE,CAAC,SAAS,WAAW,EAAE,CAAC,SAAS,wBAAwB,CAAC,CAAC,CAAC,EAC9G,CAAC,EAAE,aAAa,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,GACxB,aAAa,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,CAYxB;AASD;;;;;;;;;;;;;;;GAeG;AACH,wBAAgB,eAAe,CAAC,CAAC,SAAS,WAAW,EAAE,CAAC,SAAS,WAAW,EAAE,CAAC,SAAS,wBAAwB,CAAC,CAAC,CAAC,EACjH,CAAC,EAAE,aAAa,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,GACxB,aAAa,CAAC,WAAW,EAAE,WAAW,CAAC,CAkCzC;AAED,MAAM,WAAW,uBAAuB;IACtC;;;;OAIG;IACH,QAAQ,CAAC,QAAQ,EAAE,aAAa,CAAC,UAAU,CAAC,CAAC;IAC7C;;;;;OAKG;IACH,QAAQ,CAAC,aAAa,CAAC,EAAE,aAAa,CAAC,MAAM,CAAC,CAAC;CAChD;AAED;;;;;;;;GAQG;AACH,wBAAgB,mBAAmB,CAAC,IAAI,EAAE,uBAAuB,GAAG,cAAc,CAwBjF;AAED;;;;;;GAMG;AACH,MAAM,WAAW,cAAe,SAAQ,UAAU;IAChD,QAAQ,CAAC,YAAY,EAAE,WAAW,CAAC,MAAM,CAAC,CAAC;CAC5C"}

package/dist/control-service.js

@@ -43,7 +43,7 @@
  * preview that leaks which operations exist against which account.
  */
 import { AuthRequiredError, } from "@ggui-ai/mcp-server-handlers";
-import { z } from "zod";
+import * as z from "zod";
 /** HTTP path the control plane mounts at. */
 export const CONTROL_PATH = "/control";
 /** Service name the control plane reports in validation errors + telemetry. */

package/dist/ggui-session-channel/subscribe.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"subscribe.d.ts","sourceRoot":"","sources":["../../src/ggui-session-channel/subscribe.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,KAAK,EACV,WAAW,EACX,UAAU,EACV,gBAAgB,EAChB,uBAAuB,EACvB,iBAAiB,EACjB,YAAY,EAEb,MAAM,0BAA0B,CAAC;AAGlC,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,uCAAuC,CAAC;AAC9E,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,WAAW,CAAC;AACjD,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,IAAI,CAAC;AAMpC,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,cAAc,CAAC;AAC3C,OAAO,KAAK,EAGV,cAAc,EAEf,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EAAgB,KAAK,QAAQ,EAAE,MAAM,eAAe,CAAC;AAC5D,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,2BAA2B,CAAC;AAErE;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH;;;;;;;;;;;GAWG;AACH,MAAM,MAAM,uCAAuC,GAC/C;IACE,QAAQ,CAAC,EAAE,EAAE,IAAI,CAAC;IAClB,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;CACxB,GACD;IAAE,QAAQ,CAAC,EAAE,EAAE,KAAK,CAAC;IAAC,QAAQ,CAAC,MAAM,EAAE,SAAS,GAAG,SAAS,CAAA;CAAE,CAAC;AAEnE,MAAM,WAAW,2BAA2B;IAC1C;;;;;;;;OAQG;IACH,MAAM,CAAC,KAAK,EAAE,MAAM,GAAG,uCAAuC,CAAC;CAChE;AAED;;;;GAIG;AACH,MAAM,WAAW,4BAA4B;IAC3C;;;;OAIG;IACH,UAAU,CAAC,OAAO,EAAE,OAAO,WAAW,EAAE,mBAAmB,GAAG,MAAM,GAAG,IAAI,CAAC;IAC5E;;;;OAIG;IACH,MAAM,CAAC,WAAW,EAAE,MAAM,GAAG;QAAE,SAAS,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAA;KAAE,GAAG,IAAI,CAAC;CAC1E;AAED,MAAM,WAAW,aAAa;IAC5B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,kEAAkE;IAClE,QAAQ,CAAC,IAAI,EAAE,WAAW,CAAC;IAC3B,QAAQ,CAAC,WAAW,EAAE,gBAAgB,CAAC;IACvC,sEAAsE;IACtE,QAAQ,CAAC,YAAY,EAAE,uBAAuB,CAAC;IAC/C,mEAAmE;IACnE,QAAQ,CAAC,YAAY,EAAE,YAAY,CAAC;IACpC,iFAAiF;IACjF,QAAQ,CAAC,SAAS,CAAC,EAAE,2BAA2B,CAAC;IACjD,4EAA4E;IAC5E,QAAQ,CAAC,UAAU,CAAC,EAAE,4BAA4B,CAAC;IACnD,oFAAoF;IACpF,QAAQ,CAAC,iBAAiB,CAAC,EAAE,CAAC,MAAM,EAAE,UAAU,KAAK,MAAM,CAAC;IAC5D,iGAAiG;IACjG,QAAQ,CAAC,YAAY,CAAC,EAAE,CAAC,KAAK,EAAE,MAAM,EAAE,QAAQ,EAAE,UAAU,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IAC/E,iGAAiG;IACjG,QAAQ,CAAC,iBAAiB,CAAC,EAAE,SAAS,UAAU,CAAC,QAAQ,CAAC,EAAE,CAAC;IAC7D,gFAAgF;IAChF,QAAQ,CAAC,aAAa,CAAC,EAAE,UAAU,GAAG,QAAQ,CAAC;IAC/C,QAAQ,CAAC,SAAS,EAAE,QAAQ,CAAC,WAAW,CAAC,CAAC;IAC1C,QAAQ,CAAC,QAAQ,EAAE,mBAAmB,CAAC,UAAU,CAAC,CAAC;IACnD,QAAQ,CAAC,UAAU,EAAE,mBAAmB,CAAC,YAAY,CAAC,CAAC;CACxD;AAED;;;;;;GAMG;AACH;;;;GAIG;AACH,MAAM,MAAM,mBAAmB,GAAG,UAAU,GAAG,gBAAgB,CAAC;AAEhE,MAAM,MAAM,qBAAqB,GAAG;IAClC,mDAAmD;IACnD,QAAQ,CAAC,MAAM,EAAE,iBAAiB,CAAC;IACnC,wDAAwD;IACxD,QAAQ,CAAC,QAAQ,EAAE,UAAU,CAAC;IAC9B,qEAAqE;IACrE,QAAQ,CAAC,IAAI,EAAE,cAAc,CAAC;IAC9B,+EAA+E;IAC/E,QAAQ,CAAC,aAAa,CAAC,EAAE,MAAM,CAAC;IAChC,wEAAwE;IACxE,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC;IAC1B,2EAA2E;IAC3E,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC;IAC5B,uEAAuE;IACvE,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC;IAC5B;;;;;OAKG;IACH,QAAQ,CAAC,UAAU,CAAC,EAAE,mBAAmB,CAAC;CAC3C,GAAG,CACA;IACE,QAAQ,CAAC,SAAS,EAAE,IAAI,CAAC;IACzB,oEAAoE;IACpE,QAAQ,CAAC,EAAE,EAAE,SAAS,CAAC;CACxB,GACD;IAAE,QAAQ,CAAC,SAAS,EAAE,KAAK,CAAA;CAAE,CAChC,CAAC;AAEF,MAAM,WAAW,iBAAiB;IAChC;;;;;OAKG;IACH,0BAA0B,CAAC,GAAG,EAAE,eAAe,GAAG,OAAO,CAAC,UAAU,CAAC,CAAC;IACtE,iEAAiE;IACjE,eAAe,CACb,EAAE,EAAE,SAAS,EACb,QAAQ,EAAE,UAAU,EACpB,OAAO,EAAE,gBAAgB,GAAG;QAAE,IAAI,EAAE,WAAW,CAAA;KAAE,EACjD,WAAW,CAAC,EAAE;QAAE,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAA;KAAE,GACnE,OAAO,CAAC,IAAI,CAAC,CAAC;IACjB;;;;;;;;;;;;;;;OAeG;IACH,iBAAiB,CAAC,IAAI,EAAE,qBAAqB,GAAG,OAAO,CAAC;QAAE,QAAQ,CAAC,MAAM,EAAE,MAAM,IAAI,CAAA;KAAE,CAAC,CAAC;CAC1F;AAwED,wBAAgB,uBAAuB,CAAC,IAAI,EAAE,aAAa,GAAG,iBAAiB,CAyoB9E"}
+{"version":3,"file":"subscribe.d.ts","sourceRoot":"","sources":["../../src/ggui-session-channel/subscribe.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,KAAK,EACV,WAAW,EACX,UAAU,EACV,gBAAgB,EAChB,uBAAuB,EACvB,iBAAiB,EACjB,YAAY,EAEb,MAAM,0BAA0B,CAAC;AAGlC,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,uCAAuC,CAAC;AAE9E,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,WAAW,CAAC;AACjD,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,IAAI,CAAC;AAMpC,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,cAAc,CAAC;AAC3C,OAAO,KAAK,EAGV,cAAc,EAEf,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EAAgB,KAAK,QAAQ,EAAE,MAAM,eAAe,CAAC;AAC5D,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,2BAA2B,CAAC;AAErE;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH;;;;;;;;;;;GAWG;AACH,MAAM,MAAM,uCAAuC,GAC/C;IACE,QAAQ,CAAC,EAAE,EAAE,IAAI,CAAC;IAClB,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;CACxB,GACD;IAAE,QAAQ,CAAC,EAAE,EAAE,KAAK,CAAC;IAAC,QAAQ,CAAC,MAAM,EAAE,SAAS,GAAG,SAAS,CAAA;CAAE,CAAC;AAEnE,MAAM,WAAW,2BAA2B;IAC1C;;;;;;;;OAQG;IACH,MAAM,CAAC,KAAK,EAAE,MAAM,GAAG,uCAAuC,CAAC;CAChE;AAED;;;;GAIG;AACH,MAAM,WAAW,4BAA4B;IAC3C;;;;OAIG;IACH,UAAU,CAAC,OAAO,EAAE,OAAO,WAAW,EAAE,mBAAmB,GAAG,MAAM,GAAG,IAAI,CAAC;IAC5E;;;;OAIG;IACH,MAAM,CAAC,WAAW,EAAE,MAAM,GAAG;QAAE,SAAS,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAA;KAAE,GAAG,IAAI,CAAC;CAC1E;AAED,MAAM,WAAW,aAAa;IAC5B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,kEAAkE;IAClE,QAAQ,CAAC,IAAI,EAAE,WAAW,CAAC;IAC3B,QAAQ,CAAC,WAAW,EAAE,gBAAgB,CAAC;IACvC,sEAAsE;IACtE,QAAQ,CAAC,YAAY,EAAE,uBAAuB,CAAC;IAC/C,mEAAmE;IACnE,QAAQ,CAAC,YAAY,EAAE,YAAY,CAAC;IACpC,iFAAiF;IACjF,QAAQ,CAAC,SAAS,CAAC,EAAE,2BAA2B,CAAC;IACjD,4EAA4E;IAC5E,QAAQ,CAAC,UAAU,CAAC,EAAE,4BAA4B,CAAC;IACnD,oFAAoF;IACpF,QAAQ,CAAC,iBAAiB,CAAC,EAAE,CAAC,MAAM,EAAE,UAAU,KAAK,MAAM,CAAC;IAC5D,iGAAiG;IACjG,QAAQ,CAAC,YAAY,CAAC,EAAE,CAAC,KAAK,EAAE,MAAM,EAAE,QAAQ,EAAE,UAAU,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IAC/E,iGAAiG;IACjG,QAAQ,CAAC,iBAAiB,CAAC,EAAE,SAAS,UAAU,CAAC,QAAQ,CAAC,EAAE,CAAC;IAC7D,gFAAgF;IAChF,QAAQ,CAAC,aAAa,CAAC,EAAE,UAAU,GAAG,QAAQ,CAAC;IAC/C,QAAQ,CAAC,SAAS,EAAE,QAAQ,CAAC,WAAW,CAAC,CAAC;IAC1C,QAAQ,CAAC,QAAQ,EAAE,mBAAmB,CAAC,UAAU,CAAC,CAAC;IACnD,QAAQ,CAAC,UAAU,EAAE,mBAAmB,CAAC,YAAY,CAAC,CAAC;CACxD;AAED;;;;;;GAMG;AACH;;;;GAIG;AACH,MAAM,MAAM,mBAAmB,GAAG,UAAU,GAAG,gBAAgB,CAAC;AAEhE,MAAM,MAAM,qBAAqB,GAAG;IAClC,mDAAmD;IACnD,QAAQ,CAAC,MAAM,EAAE,iBAAiB,CAAC;IACnC,wDAAwD;IACxD,QAAQ,CAAC,QAAQ,EAAE,UAAU,CAAC;IAC9B,qEAAqE;IACrE,QAAQ,CAAC,IAAI,EAAE,cAAc,CAAC;IAC9B,+EAA+E;IAC/E,QAAQ,CAAC,aAAa,CAAC,EAAE,MAAM,CAAC;IAChC,wEAAwE;IACxE,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC;IAC1B,2EAA2E;IAC3E,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC;IAC5B,uEAAuE;IACvE,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC;IAC5B;;;;;OAKG;IACH,QAAQ,CAAC,UAAU,CAAC,EAAE,mBAAmB,CAAC;CAC3C,GAAG,CACA;IACE,QAAQ,CAAC,SAAS,EAAE,IAAI,CAAC;IACzB,oEAAoE;IACpE,QAAQ,CAAC,EAAE,EAAE,SAAS,CAAC;CACxB,GACD;IAAE,QAAQ,CAAC,SAAS,EAAE,KAAK,CAAA;CAAE,CAChC,CAAC;AAEF,MAAM,WAAW,iBAAiB;IAChC;;;;;OAKG;IACH,0BAA0B,CAAC,GAAG,EAAE,eAAe,GAAG,OAAO,CAAC,UAAU,CAAC,CAAC;IACtE,iEAAiE;IACjE,eAAe,CACb,EAAE,EAAE,SAAS,EACb,QAAQ,EAAE,UAAU,EACpB,OAAO,EAAE,gBAAgB,GAAG;QAAE,IAAI,EAAE,WAAW,CAAA;KAAE,EACjD,WAAW,CAAC,EAAE;QAAE,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAA;KAAE,GACnE,OAAO,CAAC,IAAI,CAAC,CAAC;IACjB;;;;;;;;;;;;;;;OAeG;IACH,iBAAiB,CAAC,IAAI,EAAE,qBAAqB,GAAG,OAAO,CAAC;QAAE,QAAQ,CAAC,MAAM,EAAE,MAAM,IAAI,CAAA;KAAE,CAAC,CAAC;CAC1F;AAwED,wBAAgB,uBAAuB,CAAC,IAAI,EAAE,aAAa,GAAG,iBAAiB,CAsqB9E"}

package/dist/ggui-session-channel/subscribe.js

@@ -7,6 +7,7 @@
  * dev-mode render provisioning, replay, registration, and the ack.
  */
 import { PROTOCOL_SCHEMA_VERSION, UPGRADE_REQUIRED } from "@ggui-ai/protocol";
+import { renderReadAllowed } from "@ggui-ai/mcp-server-handlers/renders";
 import { defaultAppIdFromIdentity, resolveIdentityFromHeaders, UnauthenticatedError, } from "../auth.js";
 import { createWsSink } from "./outbound.js";
 /**
@@ -344,6 +345,29 @@ export function createSubscribeHandlers(deps) {
                 deps.sendError(ws, "APP_MISMATCH", `GguiSession ${payload.sessionId} belongs to a different app`, message.requestId);
                 return;
             }
+            // A bearer that carries an end-user identity attaches only to its
+            // own sessions (ggui#1483, SPEC §12.2): the render read door's
+            // predicate, the app and then the subject, on the stored row —
+            // before anything registers, acks or replays, since an accepted
+            // subscribe both reads the session and carries `action` frames
+            // into it. The token path is exempt, not forgotten: a `wsToken` is a
+            // bearer capability bound to one session (SPEC §5.5.1.1), holding it
+            // is the authorization, and its synthesized identity names the
+            // session, not a person (ggui#446). A refusal answers
+            // SESSION_NOT_FOUND (§7.9.1's one code for a session this caller
+            // cannot use) with a fixed message naming no one. Because an unknown
+            // id is provisioned here rather than refused, the refusal tells the
+            // caller the id exists and is not theirs (ggui#1554).
+            const endUserId = effectiveIdentity.identity.kind === "user" ? effectiveIdentity.identity.userId : undefined;
+            if (!viaWsToken && !renderReadAllowed(stored, { appId: effectiveAppId, userId: endUserId })) {
+                deps.logger.warn("render_channel_subject_refused", {
+                    sessionId: payload.sessionId,
+                    appId: effectiveAppId,
+                    source: effectiveIdentity.source,
+                });
+                deps.sendError(ws, "SESSION_NOT_FOUND", "No GguiSession with this id is usable by this credential", message.requestId);
+                return;
+            }
         }
         else {
             try {