@helm-protocol/ttt-mcp 0.4.2 → 0.4.4

package/dist/auth.js

@@ -29,6 +29,7 @@ var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: tru
 var auth_exports = {};
 __export(auth_exports, {
   FREE_TIER_LIMIT: () => FREE_TIER_LIMIT,
+  FREE_TIER_PER_MIN: () => FREE_TIER_PER_MIN,
   checkRateLimit: () => checkRateLimit,
   resolveApiKey: () => resolveApiKey
 });
@@ -37,6 +38,8 @@ var fs = __toESM(require("fs"));
 var path = __toESM(require("path"));
 var os = __toESM(require("os"));
 const FREE_TIER_LIMIT = parseInt(process.env.FREE_TIER_LIMIT ?? "100", 10);
+const FREE_TIER_PER_MIN = parseInt(process.env.FREE_TIER_PER_MIN ?? "120", 10);
+const perMinBuckets = /* @__PURE__ */ new Map();
 const USAGE_DIR = path.join(os.homedir(), ".ttt-mcp");
 const USAGE_FILE = path.join(USAGE_DIR, "usage.json");
 const buckets = /* @__PURE__ */ new Map();
@@ -81,6 +84,18 @@ function checkRateLimit(apiKey, clientIp) {
     writeUsageFile(entry2);
     return { allowed: true, remaining: FREE_TIER_LIMIT - entry2.count, tier: "free" };
   }
+  if (FREE_TIER_PER_MIN > 0) {
+    const mk = `ip:${clientIp}`;
+    let m = perMinBuckets.get(mk);
+    if (!m || now >= m.resetAt) {
+      m = { count: 0, resetAt: now + 6e4 };
+      perMinBuckets.set(mk, m);
+    }
+    m.count += 1;
+    if (m.count > FREE_TIER_PER_MIN) {
+      return { allowed: false, remaining: 0, tier: "free" };
+    }
+  }
   const bucketKey = `ip:${clientIp}`;
   let entry = buckets.get(bucketKey);
   if (!entry || now >= entry.resetAt) {
@@ -99,6 +114,7 @@ function resolveApiKey(headerValue) {
 // Annotate the CommonJS export names for ESM import in node:
 0 && (module.exports = {
   FREE_TIER_LIMIT,
+  FREE_TIER_PER_MIN,
   checkRateLimit,
   resolveApiKey
 });

package/dist/index.js

@@ -105,7 +105,7 @@ function toolSuccess(result) {
   return { content: [{ type: "text", text: JSON.stringify(result, null, 2) }] };
 }
 function buildMcpServer() {
-  const s = new import_mcp.McpServer({ name: "ttt-mcp", version: "0.4.2" });
+  const s = new import_mcp.McpServer({ name: "ttt-mcp", version: "0.4.4" });
   const registerTool = s.tool.bind(s);
   registerTool(
     "pot_generate",
@@ -304,12 +304,13 @@ async function main() {
     const requestHandler = async (req, res) => {
       if (req.method === "GET" && (req.url === "/health" || req.url === "/ping")) {
         res.writeHead(200, { "Content-Type": "application/json" });
-        res.end(JSON.stringify({ status: "ok", server: "ttt-mcp", version: "0.4.2" }));
+        res.end(JSON.stringify({ status: "ok", server: "ttt-mcp", version: "0.4.4" }));
         return;
       }
       if (req.method === "POST") {
         const apiKey = (0, import_auth.resolveApiKey)(req.headers["x-api-key"]);
-        const clientIp = req.headers["x-forwarded-for"]?.split(",")[0].trim() || req.socket.remoteAddress || "unknown";
+        const trustProxy = process.env.TTTPS_TRUST_PROXY === "1";
+        const clientIp = (trustProxy ? req.headers["x-forwarded-for"]?.split(",")[0].trim() : "") || req.socket.remoteAddress || "unknown";
         const rl = (0, import_auth.checkRateLimit)(apiKey, clientIp);
         if (!rl.allowed) {
           res.writeHead(429, {

package/dist/tools.js

@@ -477,9 +477,9 @@ async function potVerifyV2Core(args) {
       return serialize({ verdict: "rejected", reason: "roughtime chain quorum unavailable" });
     }
   }
-  const freshness = process.env.TTTPS_ENFORCE_FRESHNESS === "1" ? { nowTaiUs: BigInt(Date.now()) * 1000n, maxSkewUs: BigInt(process.env.TTTPS_MAX_SKEW_US ?? "60000000") } : args.nowTaiUs !== void 0 && args.maxSkewUs !== void 0 ? { nowTaiUs: BigInt(args.nowTaiUs), maxSkewUs: BigInt(args.maxSkewUs) } : void 0;
+  const freshness = process.env.TTTPS_ENFORCE_FRESHNESS !== "0" ? { nowTaiUs: BigInt(Date.now()) * 1000n, maxSkewUs: BigInt(process.env.TTTPS_MAX_SKEW_US ?? "60000000") } : args.nowTaiUs !== void 0 && args.maxSkewUs !== void 0 ? { nowTaiUs: BigInt(args.nowTaiUs), maxSkewUs: BigInt(args.maxSkewUs) } : void 0;
   const trustedIssuers = trustedKeyList("TTTPS_TRUSTED_ISSUERS");
-  const pinSelfIssuer = process.env.TTTPS_PIN_SELF_ISSUER === "1";
+  const pinSelfIssuer = process.env.TTTPS_PIN_SELF_ISSUER !== "0";
   const candidates = trustedIssuers.length > 0 ? trustedIssuers : pinSelfIssuer ? [potSignerPublicKeyRawV08] : [args.issuerPubKey ? Buffer.from(args.issuerPubKey, "hex") : potSignerPublicKeyRawV08];
   let result = (0, import_pot_record_v2.verifyPotRecordV2)(record, candidates[0], freshness);
   for (let i = 1; i < candidates.length && result.verdict === "rejected" && result.reason === "issuer signature invalid"; i++) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@helm-protocol/ttt-mcp",
-  "version": "0.4.2",
+  "version": "0.4.4",
   "description": "Proof-of-Time attestation — Ed25519-signed timestamps with multi-source corroboration and explicit error bounds. IETF draft-helmprotocol-tttps",
   "main": "dist/index.js",
   "bin": {