@helm-protocol/ttt-mcp 0.4.1 → 0.4.3

package/dist/auth.js

@@ -29,6 +29,7 @@ var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: tru
 var auth_exports = {};
 __export(auth_exports, {
   FREE_TIER_LIMIT: () => FREE_TIER_LIMIT,
+  FREE_TIER_PER_MIN: () => FREE_TIER_PER_MIN,
   checkRateLimit: () => checkRateLimit,
   resolveApiKey: () => resolveApiKey
 });
@@ -37,6 +38,8 @@ var fs = __toESM(require("fs"));
 var path = __toESM(require("path"));
 var os = __toESM(require("os"));
 const FREE_TIER_LIMIT = parseInt(process.env.FREE_TIER_LIMIT ?? "100", 10);
+const FREE_TIER_PER_MIN = parseInt(process.env.FREE_TIER_PER_MIN ?? "120", 10);
+const perMinBuckets = /* @__PURE__ */ new Map();
 const USAGE_DIR = path.join(os.homedir(), ".ttt-mcp");
 const USAGE_FILE = path.join(USAGE_DIR, "usage.json");
 const buckets = /* @__PURE__ */ new Map();
@@ -81,6 +84,18 @@ function checkRateLimit(apiKey, clientIp) {
     writeUsageFile(entry2);
     return { allowed: true, remaining: FREE_TIER_LIMIT - entry2.count, tier: "free" };
   }
+  if (FREE_TIER_PER_MIN > 0) {
+    const mk = `ip:${clientIp}`;
+    let m = perMinBuckets.get(mk);
+    if (!m || now >= m.resetAt) {
+      m = { count: 0, resetAt: now + 6e4 };
+      perMinBuckets.set(mk, m);
+    }
+    m.count += 1;
+    if (m.count > FREE_TIER_PER_MIN) {
+      return { allowed: false, remaining: 0, tier: "free" };
+    }
+  }
   const bucketKey = `ip:${clientIp}`;
   let entry = buckets.get(bucketKey);
   if (!entry || now >= entry.resetAt) {
@@ -99,6 +114,7 @@ function resolveApiKey(headerValue) {
 // Annotate the CommonJS export names for ESM import in node:
 0 && (module.exports = {
   FREE_TIER_LIMIT,
+  FREE_TIER_PER_MIN,
   checkRateLimit,
   resolveApiKey
 });

package/dist/index.js

@@ -105,7 +105,7 @@ function toolSuccess(result) {
   return { content: [{ type: "text", text: JSON.stringify(result, null, 2) }] };
 }
 function buildMcpServer() {
-  const s = new import_mcp.McpServer({ name: "ttt-mcp", version: "0.4.1" });
+  const s = new import_mcp.McpServer({ name: "ttt-mcp", version: "0.4.3" });
   const registerTool = s.tool.bind(s);
   registerTool(
     "pot_generate",
@@ -304,7 +304,7 @@ async function main() {
     const requestHandler = async (req, res) => {
       if (req.method === "GET" && (req.url === "/health" || req.url === "/ping")) {
         res.writeHead(200, { "Content-Type": "application/json" });
-        res.end(JSON.stringify({ status: "ok", server: "ttt-mcp", version: "0.4.1" }));
+        res.end(JSON.stringify({ status: "ok", server: "ttt-mcp", version: "0.4.3" }));
         return;
       }
       if (req.method === "POST") {

package/dist/tools.js

@@ -445,20 +445,23 @@ function trustedKeyList(envName) {
   return (process.env[envName] ?? "").split(",").map((s) => s.trim()).filter((s) => /^[0-9a-fA-F]{64}$/.test(s)).map((h) => Buffer.from(h, "hex"));
 }
 let roughtimeAdmitCache = null;
-async function roughtimeQuorumOk() {
+async function roughtimeChainStatus() {
   const url = process.env.TTTPS_ADMISSION_STATUS_URL ?? "https://api.kenosian.com/pot/status";
   const ttlMs = Number.parseInt(process.env.TTTPS_ADMISSION_TTL_MS ?? "5000", 10);
-  if (roughtimeAdmitCache && Date.now() - roughtimeAdmitCache.at < ttlMs) return roughtimeAdmitCache.ok;
+  if (roughtimeAdmitCache && Date.now() - roughtimeAdmitCache.at < ttlMs) {
+    return { ok: roughtimeAdmitCache.ok, digest: roughtimeAdmitCache.digest };
+  }
   try {
     const timeoutMs = Number.parseInt(process.env.TTTPS_ADMISSION_TIMEOUT_MS ?? "1500", 10);
     const res = await fetch(url, { signal: AbortSignal.timeout(timeoutMs) });
     const j = await res.json();
-    const ok = j?.roughtime_ok === true;
-    roughtimeAdmitCache = { ok, at: Date.now() };
-    return ok;
+    const ok = j?.chain_valid === true || j?.chain_valid === void 0 && j?.roughtime_ok === true;
+    const digest = typeof j?.d_chain_digest === "string" ? j.d_chain_digest : "";
+    roughtimeAdmitCache = { ok, digest, at: Date.now() };
+    return { ok, digest };
   } catch {
-    roughtimeAdmitCache = { ok: false, at: Date.now() };
-    return false;
+    roughtimeAdmitCache = { ok: false, digest: "", at: Date.now() };
+    return { ok: false, digest: "" };
   }
 }
 async function potVerifyV2Core(args) {
@@ -469,13 +472,14 @@ async function potVerifyV2Core(args) {
   }
   const record = Buffer.from(args.potRecordV2, "hex");
   if (process.env.TTTPS_REQUIRE_ROUGHTIME_QUORUM === "1") {
-    if (!await roughtimeQuorumOk()) {
-      return serialize({ verdict: "rejected", reason: "roughtime quorum unavailable" });
+    const chain = await roughtimeChainStatus();
+    if (!chain.ok) {
+      return serialize({ verdict: "rejected", reason: "roughtime chain quorum unavailable" });
     }
   }
-  const freshness = process.env.TTTPS_ENFORCE_FRESHNESS === "1" ? { nowTaiUs: BigInt(Date.now()) * 1000n, maxSkewUs: BigInt(process.env.TTTPS_MAX_SKEW_US ?? "60000000") } : args.nowTaiUs !== void 0 && args.maxSkewUs !== void 0 ? { nowTaiUs: BigInt(args.nowTaiUs), maxSkewUs: BigInt(args.maxSkewUs) } : void 0;
+  const freshness = process.env.TTTPS_ENFORCE_FRESHNESS !== "0" ? { nowTaiUs: BigInt(Date.now()) * 1000n, maxSkewUs: BigInt(process.env.TTTPS_MAX_SKEW_US ?? "60000000") } : args.nowTaiUs !== void 0 && args.maxSkewUs !== void 0 ? { nowTaiUs: BigInt(args.nowTaiUs), maxSkewUs: BigInt(args.maxSkewUs) } : void 0;
   const trustedIssuers = trustedKeyList("TTTPS_TRUSTED_ISSUERS");
-  const pinSelfIssuer = process.env.TTTPS_PIN_SELF_ISSUER === "1";
+  const pinSelfIssuer = process.env.TTTPS_PIN_SELF_ISSUER !== "0";
   const candidates = trustedIssuers.length > 0 ? trustedIssuers : pinSelfIssuer ? [potSignerPublicKeyRawV08] : [args.issuerPubKey ? Buffer.from(args.issuerPubKey, "hex") : potSignerPublicKeyRawV08];
   let result = (0, import_pot_record_v2.verifyPotRecordV2)(record, candidates[0], freshness);
   for (let i = 1; i < candidates.length && result.verdict === "rejected" && result.reason === "issuer signature invalid"; i++) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@helm-protocol/ttt-mcp",
-  "version": "0.4.1",
+  "version": "0.4.3",
   "description": "Proof-of-Time attestation — Ed25519-signed timestamps with multi-source corroboration and explicit error bounds. IETF draft-helmprotocol-tttps",
   "main": "dist/index.js",
   "bin": {