@n24q02m/mcp-relay-server 0.1.0 → 1.0.6

package/README.md

@@ -0,0 +1,65 @@
+# @n24q02m/mcp-relay-server
+
+Zero-config MCP credential relay server -- ECDH P-256 + AES-256-GCM, rate-limited, zero-knowledge.
+
+The relay server never sees plaintext credentials. It only stores and forwards opaque encrypted blobs between the browser and the MCP server CLI.
+
+## Installation
+
+```bash
+npm install @n24q02m/mcp-relay-server
+```
+
+## Usage
+
+### Start the server
+
+```typescript
+import { createApp } from "@n24q02m/mcp-relay-server";
+
+const app = createApp();
+app.listen(3000, () => {
+  console.log("Relay server listening on port 3000");
+});
+```
+
+### Start a local relay (ephemeral, random port)
+
+```typescript
+import { startLocalRelay } from "@n24q02m/mcp-relay-server";
+
+const relay = await startLocalRelay("/path/to/pages");
+console.log(`Relay running at ${relay.url}`);
+
+// When done:
+relay.close();
+```
+
+### Docker
+
+```bash
+docker build -t mcp-relay-server .
+docker run -p 3000:8080 mcp-relay-server
+```
+
+### Environment variables
+
+| Variable | Default | Description |
+|----------|---------|-------------|
+| `PORT` | `3000` | Server listen port |
+| `PAGES_DIR` | - | Directory for static relay form pages |
+| `CORS_ORIGIN` | `*` | CORS allowed origin |
+
+## Security properties
+
+- Zero-knowledge: server never sees plaintext credentials
+- Sessions: 10-minute TTL, one-shot consumption, max 5 per IP
+- Rate-limited API routes
+
+## Documentation
+
+See the [main repository](https://github.com/n24q02m/mcp-relay-core) for full documentation, architecture, and security properties.
+
+## License
+
+MIT

package/build/app.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"app.d.ts","sourceRoot":"","sources":["../src/app.ts"],"names":[],"mappings":"AACA,OAAO,OAAO,MAAM,SAAS,CAAA;AAI7B,wBAAgB,SAAS,IAAI,OAAO,CAAC,OAAO,CAgB3C"}
+{"version":3,"file":"app.d.ts","sourceRoot":"","sources":["../src/app.ts"],"names":[],"mappings":"AACA,OAAO,OAAO,MAAM,SAAS,CAAA;AAI7B,wBAAgB,SAAS,IAAI,OAAO,CAAC,OAAO,CAqB3C"}

package/build/app.js

@@ -1,13 +1,17 @@
 import cors from 'cors';
 import express from 'express';
-import { rateLimiter } from './middleware/rate-limit.js';
+import { mutationLimiter, pollingLimiter } from './middleware/rate-limit.js';
 import { sessionsRouter } from './routes/sessions.js';
 export function createApp() {
     const app = express();
     const corsOrigin = process.env.CORS_ORIGIN ?? '*';
     app.use(cors({ origin: corsOrigin }));
     app.use(express.json({ limit: '1mb' }));
-    app.use(rateLimiter);
+    // Split rate limits: stricter for mutations, relaxed for polling
+    app.use('/api', pollingLimiter); // GET requests (polling) — 120/min
+    app.post('/api/sessions', mutationLimiter); // Create session — 30/min
+    app.post('/api/sessions/:id/result', mutationLimiter); // Submit credentials — 30/min
+    app.post('/api/sessions/:id/skip', mutationLimiter); // Skip — 30/min
     app.use('/api/sessions', sessionsRouter);
     const pagesDir = process.env.PAGES_DIR;
     if (pagesDir) {

package/build/app.js.map

@@ -1 +1 @@
-{"version":3,"file":"app.js","sourceRoot":"","sources":["../src/app.ts"],"names":[],"mappings":"AAAA,OAAO,IAAI,MAAM,MAAM,CAAA;AACvB,OAAO,OAAO,MAAM,SAAS,CAAA;AAC7B,OAAO,EAAE,WAAW,EAAE,MAAM,4BAA4B,CAAA;AACxD,OAAO,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAA;AAErD,MAAM,UAAU,SAAS;IACvB,MAAM,GAAG,GAAG,OAAO,EAAE,CAAA;IAErB,MAAM,UAAU,GAAG,OAAO,CAAC,GAAG,CAAC,WAAW,IAAI,GAAG,CAAA;IACjD,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,UAAU,EAAE,CAAC,CAAC,CAAA;IACrC,GAAG,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,CAAC,CAAA;IACvC,GAAG,CAAC,GAAG,CAAC,WAAW,CAAC,CAAA;IAEpB,GAAG,CAAC,GAAG,CAAC,eAAe,EAAE,cAAc,CAAC,CAAA;IAExC,MAAM,QAAQ,GAAG,OAAO,CAAC,GAAG,CAAC,SAAS,CAAA;IACtC,IAAI,QAAQ,EAAE,CAAC;QACb,GAAG,CAAC,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAA;IACnC,CAAC;IAED,OAAO,GAAG,CAAA;AACZ,CAAC"}
+{"version":3,"file":"app.js","sourceRoot":"","sources":["../src/app.ts"],"names":[],"mappings":"AAAA,OAAO,IAAI,MAAM,MAAM,CAAA;AACvB,OAAO,OAAO,MAAM,SAAS,CAAA;AAC7B,OAAO,EAAE,eAAe,EAAE,cAAc,EAAE,MAAM,4BAA4B,CAAA;AAC5E,OAAO,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAA;AAErD,MAAM,UAAU,SAAS;IACvB,MAAM,GAAG,GAAG,OAAO,EAAE,CAAA;IAErB,MAAM,UAAU,GAAG,OAAO,CAAC,GAAG,CAAC,WAAW,IAAI,GAAG,CAAA;IACjD,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,UAAU,EAAE,CAAC,CAAC,CAAA;IACrC,GAAG,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,CAAC,CAAA;IAEvC,iEAAiE;IACjE,GAAG,CAAC,GAAG,CAAC,MAAM,EAAE,cAAc,CAAC,CAAA,CAAC,mCAAmC;IACnE,GAAG,CAAC,IAAI,CAAC,eAAe,EAAE,eAAe,CAAC,CAAA,CAAC,0BAA0B;IACrE,GAAG,CAAC,IAAI,CAAC,0BAA0B,EAAE,eAAe,CAAC,CAAA,CAAC,8BAA8B;IACpF,GAAG,CAAC,IAAI,CAAC,wBAAwB,EAAE,eAAe,CAAC,CAAA,CAAC,gBAAgB;IAEpE,GAAG,CAAC,GAAG,CAAC,eAAe,EAAE,cAAc,CAAC,CAAA;IAExC,MAAM,QAAQ,GAAG,OAAO,CAAC,GAAG,CAAC,SAAS,CAAA;IACtC,IAAI,QAAQ,EAAE,CAAC;QACb,GAAG,CAAC,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAA;IACnC,CAAC;IAED,OAAO,GAAG,CAAA;AACZ,CAAC"}

package/build/middleware/rate-limit.d.ts

@@ -1,2 +1,3 @@
-export declare const rateLimiter: import("express-rate-limit").RateLimitRequestHandler;
+export declare const mutationLimiter: import("express-rate-limit").RateLimitRequestHandler;
+export declare const pollingLimiter: import("express-rate-limit").RateLimitRequestHandler;
 //# sourceMappingURL=rate-limit.d.ts.map

package/build/middleware/rate-limit.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"rate-limit.d.ts","sourceRoot":"","sources":["../../src/middleware/rate-limit.ts"],"names":[],"mappings":"AAEA,eAAO,MAAM,WAAW,sDAMtB,CAAA"}
+{"version":3,"file":"rate-limit.d.ts","sourceRoot":"","sources":["../../src/middleware/rate-limit.ts"],"names":[],"mappings":"AAGA,eAAO,MAAM,eAAe,sDAM1B,CAAA;AAIF,eAAO,MAAM,cAAc,sDAMzB,CAAA"}

package/build/middleware/rate-limit.js

@@ -1,9 +1,19 @@
 import rateLimit from 'express-rate-limit';
-export const rateLimiter = rateLimit({
-    windowMs: 60 * 1000, // 1 minute
+// Session mutations (create, submit result, skip) — stricter limit
+export const mutationLimiter = rateLimit({
+    windowMs: 60 * 1000,
     limit: 30,
     standardHeaders: 'draft-7',
     legacyHeaders: false,
     message: { error: 'Too many requests, please try again later' }
 });
+// Polling endpoints (GET sessions, messages, responses) — higher limit
+// Browser polls every 2s = 30 requests/min per session
+export const pollingLimiter = rateLimit({
+    windowMs: 60 * 1000,
+    limit: 120,
+    standardHeaders: 'draft-7',
+    legacyHeaders: false,
+    message: { error: 'Too many requests, please try again later' }
+});
 //# sourceMappingURL=rate-limit.js.map

package/build/middleware/rate-limit.js.map

@@ -1 +1 @@
-{"version":3,"file":"rate-limit.js","sourceRoot":"","sources":["../../src/middleware/rate-limit.ts"],"names":[],"mappings":"AAAA,OAAO,SAAS,MAAM,oBAAoB,CAAA;AAE1C,MAAM,CAAC,MAAM,WAAW,GAAG,SAAS,CAAC;IACnC,QAAQ,EAAE,EAAE,GAAG,IAAI,EAAE,WAAW;IAChC,KAAK,EAAE,EAAE;IACT,eAAe,EAAE,SAAS;IAC1B,aAAa,EAAE,KAAK;IACpB,OAAO,EAAE,EAAE,KAAK,EAAE,2CAA2C,EAAE;CAChE,CAAC,CAAA"}
+{"version":3,"file":"rate-limit.js","sourceRoot":"","sources":["../../src/middleware/rate-limit.ts"],"names":[],"mappings":"AAAA,OAAO,SAAS,MAAM,oBAAoB,CAAA;AAE1C,mEAAmE;AACnE,MAAM,CAAC,MAAM,eAAe,GAAG,SAAS,CAAC;IACvC,QAAQ,EAAE,EAAE,GAAG,IAAI;IACnB,KAAK,EAAE,EAAE;IACT,eAAe,EAAE,SAAS;IAC1B,aAAa,EAAE,KAAK;IACpB,OAAO,EAAE,EAAE,KAAK,EAAE,2CAA2C,EAAE;CAChE,CAAC,CAAA;AAEF,uEAAuE;AACvE,uDAAuD;AACvD,MAAM,CAAC,MAAM,cAAc,GAAG,SAAS,CAAC;IACtC,QAAQ,EAAE,EAAE,GAAG,IAAI;IACnB,KAAK,EAAE,GAAG;IACV,eAAe,EAAE,SAAS;IAC1B,aAAa,EAAE,KAAK;IACpB,OAAO,EAAE,EAAE,KAAK,EAAE,2CAA2C,EAAE;CAChE,CAAC,CAAA"}

package/build/routes/sessions.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"sessions.d.ts","sourceRoot":"","sources":["../../src/routes/sessions.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,MAAM,EAAE,MAAM,SAAS,CAAA;AAQhC,eAAO,MAAM,cAAc,EAAE,UAAU,CAAC,OAAO,MAAM,CAAY,CAAA"}
+{"version":3,"file":"sessions.d.ts","sourceRoot":"","sources":["../../src/routes/sessions.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,MAAM,EAAE,MAAM,SAAS,CAAA;AAmBhC,eAAO,MAAM,cAAc,EAAE,UAAU,CAAC,OAAO,MAAM,CAAY,CAAA"}

package/build/routes/sessions.js

@@ -1,5 +1,5 @@
 import { Router } from 'express';
-import { createSession, deleteSession, getSession, setSessionResult } from '../store.js';
+import { addMessage, addResponse, createSession, deleteSession, getMessages, getResponses, getSession, setSessionResult, skipSession } from '../store.js';
 function paramId(req) {
     const id = req.params.id;
     return Array.isArray(id) ? id[0] : id;
@@ -25,6 +25,10 @@ sessionsRouter.get('/:id', (req, res) => {
         res.status(404).json({ error: 'Session not found or expired' });
         return;
     }
+    if (session.skipped) {
+        res.status(200).json({ status: 'skipped' });
+        return;
+    }
     if (session.result === null) {
         res
             .status(202)
@@ -51,6 +55,81 @@ sessionsRouter.post('/:id/result', (req, res) => {
     }
     res.status(200).json({ ok: true });
 });
+sessionsRouter.post('/:id/skip', (req, res) => {
+    const session = getSession(paramId(req));
+    if (!session) {
+        res.status(404).json({ error: 'Session not found or expired' });
+        return;
+    }
+    const success = skipSession(paramId(req));
+    if (!success) {
+        res.status(409).json({ error: 'Session already has a result or is already skipped' });
+        return;
+    }
+    res.status(200).json({ ok: true });
+});
+// Server pushes a message to the browser
+sessionsRouter.post('/:id/messages', (req, res) => {
+    const { type, text, data } = req.body;
+    if (!type || !text) {
+        res.status(400).json({ error: 'type and text are required' });
+        return;
+    }
+    const session = getSession(paramId(req));
+    if (!session) {
+        res.status(404).json({ error: 'Session not found or expired' });
+        return;
+    }
+    const messageId = crypto.randomUUID();
+    const message = { id: messageId, type, text, data };
+    const success = addMessage(paramId(req), message);
+    if (!success) {
+        res.status(404).json({ error: 'Session not found or expired' });
+        return;
+    }
+    res.status(201).json({ id: messageId });
+});
+// Browser polls for messages from server
+sessionsRouter.get('/:id/messages', (req, res) => {
+    const session = getSession(paramId(req));
+    if (!session) {
+        res.status(404).json({ error: 'Session not found or expired' });
+        return;
+    }
+    const after = Number.parseInt(req.query.after, 10);
+    const afterIndex = Number.isNaN(after) ? 0 : after;
+    const messages = getMessages(paramId(req), afterIndex);
+    res.status(200).json({ messages });
+});
+// Browser sends a response to a message
+sessionsRouter.post('/:id/responses', (req, res) => {
+    const { messageId, value } = req.body;
+    if (!messageId || value === undefined) {
+        res.status(400).json({ error: 'messageId and value are required' });
+        return;
+    }
+    const session = getSession(paramId(req));
+    if (!session) {
+        res.status(404).json({ error: 'Session not found or expired' });
+        return;
+    }
+    const success = addResponse(paramId(req), { messageId, value });
+    if (!success) {
+        res.status(404).json({ error: 'Session not found or expired' });
+        return;
+    }
+    res.status(200).json({ ok: true });
+});
+// Server polls for responses from browser
+sessionsRouter.get('/:id/responses', (req, res) => {
+    const session = getSession(paramId(req));
+    if (!session) {
+        res.status(404).json({ error: 'Session not found or expired' });
+        return;
+    }
+    const responses = getResponses(paramId(req));
+    res.status(200).json({ responses });
+});
 sessionsRouter.delete('/:id', (req, res) => {
     deleteSession(paramId(req));
     res.status(204).send();

package/build/routes/sessions.js.map

@@ -1 +1 @@
-{"version":3,"file":"sessions.js","sourceRoot":"","sources":["../../src/routes/sessions.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,MAAM,EAAE,MAAM,SAAS,CAAA;AAChC,OAAO,EAAE,aAAa,EAAE,aAAa,EAAE,UAAU,EAAE,gBAAgB,EAAE,MAAM,aAAa,CAAA;AAExF,SAAS,OAAO,CAAC,GAAY;IAC3B,MAAM,EAAE,GAAG,GAAG,CAAC,MAAM,CAAC,EAAE,CAAA;IACxB,OAAO,KAAK,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAA;AACvC,CAAC;AAED,MAAM,CAAC,MAAM,cAAc,GAA8B,MAAM,EAAE,CAAA;AAEjE,cAAc,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,GAAY,EAAE,GAAa,EAAE,EAAE;IACvD,MAAM,EAAE,SAAS,EAAE,UAAU,EAAE,MAAM,EAAE,GAAG,GAAG,CAAC,IAI7C,CAAA;IAED,IAAI,CAAC,SAAS,IAAI,CAAC,UAAU,EAAE,CAAC;QAC9B,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,uCAAuC,EAAE,CAAC,CAAA;QACxE,OAAM;IACR,CAAC;IAED,MAAM,QAAQ,GAAG,GAAG,CAAC,EAAE,IAAI,GAAG,CAAC,MAAM,CAAC,aAAa,IAAI,SAAS,CAAA;IAChE,MAAM,OAAO,GAAG,aAAa,CAAC,SAAS,EAAE,UAAU,EAAE,MAAM,EAAE,QAAQ,CAAC,CAAA;IAEtE,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,sCAAsC,EAAE,CAAC,CAAA;QACvE,OAAM;IACR,CAAC;IAED,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,SAAS,EAAE,OAAO,CAAC,EAAE,EAAE,CAAC,CAAA;AACjD,CAAC,CAAC,CAAA;AAEF,cAAc,CAAC,GAAG,CAAC,MAAM,EAAE,CAAC,GAAY,EAAE,GAAa,EAAE,EAAE;IACzD,MAAM,OAAO,GAAG,UAAU,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAA;IAExC,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,8BAA8B,EAAE,CAAC,CAAA;QAC/D,OAAM;IACR,CAAC;IAED,IAAI,OAAO,CAAC,MAAM,KAAK,IAAI,EAAE,CAAC;QAC5B,GAAG;aACA,MAAM,CAAC,GAAG,CAAC;aACX,IAAI,CAAC,EAAE,MAAM,EAAE,SAAS,EAAE,SAAS,EAAE,OAAO,CAAC,EAAE,EAAE,UAAU,EAAE,OAAO,CAAC,UAAU,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,CAAC,CAAA;QAC7G,OAAM;IACR,CAAC;IAED,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,CAAC,CAAA;AACnE,CAAC,CAAC,CAAA;AAEF,cAAc,CAAC,IAAI,CAAC,aAAa,EAAE,CAAC,GAAY,EAAE,GAAa,EAAE,EAAE;IACjE,MAAM,EAAE,UAAU,EAAE,UAAU,EAAE,EAAE,EAAE,GAAG,EAAE,GAAG,GAAG,CAAC,IAK/C,CAAA;IAED,IAAI,CAAC,UAAU,IAAI,CAAC,UAAU,IAAI,CAAC,EAAE,IAAI,CAAC,GAAG,EAAE,CAAC;QAC9C,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,kDAAkD,EAAE,CAAC,CAAA;QACnF,OAAM;IACR,CAAC;IAED,MAAM,OAAO,GAAG,UAAU,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAA;IACxC,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,8BAA8B,EAAE,CAAC,CAAA;QAC/D,OAAM;IACR,CAAC;IAED,MAAM,OAAO,GAAG,gBAAgB,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,EAAE,UAAU,EAAE,UAAU,EAAE,EAAE,EAAE,GAAG,EAAE,CAAC,CAAA;IACnF,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,0BAA0B,EAAE,CAAC,CAAA;QAC3D,OAAM;IACR,CAAC;IAED,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC,CAAA;AACpC,CAAC,CAAC,CAAA;AAEF,cAAc,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC,GAAY,EAAE,GAAa,EAAE,EAAE;IAC5D,aAAa,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAA;IAC3B,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,CAAA;AACxB,CAAC,CAAC,CAAA"}
+{"version":3,"file":"sessions.js","sourceRoot":"","sources":["../../src/routes/sessions.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,MAAM,EAAE,MAAM,SAAS,CAAA;AAEhC,OAAO,EACL,UAAU,EACV,WAAW,EACX,aAAa,EACb,aAAa,EACb,WAAW,EACX,YAAY,EACZ,UAAU,EACV,gBAAgB,EAChB,WAAW,EACZ,MAAM,aAAa,CAAA;AAEpB,SAAS,OAAO,CAAC,GAAY;IAC3B,MAAM,EAAE,GAAG,GAAG,CAAC,MAAM,CAAC,EAAE,CAAA;IACxB,OAAO,KAAK,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAA;AACvC,CAAC;AAED,MAAM,CAAC,MAAM,cAAc,GAA8B,MAAM,EAAE,CAAA;AAEjE,cAAc,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,GAAY,EAAE,GAAa,EAAE,EAAE;IACvD,MAAM,EAAE,SAAS,EAAE,UAAU,EAAE,MAAM,EAAE,GAAG,GAAG,CAAC,IAI7C,CAAA;IAED,IAAI,CAAC,SAAS,IAAI,CAAC,UAAU,EAAE,CAAC;QAC9B,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,uCAAuC,EAAE,CAAC,CAAA;QACxE,OAAM;IACR,CAAC;IAED,MAAM,QAAQ,GAAG,GAAG,CAAC,EAAE,IAAI,GAAG,CAAC,MAAM,CAAC,aAAa,IAAI,SAAS,CAAA;IAChE,MAAM,OAAO,GAAG,aAAa,CAAC,SAAS,EAAE,UAAU,EAAE,MAAM,EAAE,QAAQ,CAAC,CAAA;IAEtE,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,sCAAsC,EAAE,CAAC,CAAA;QACvE,OAAM;IACR,CAAC;IAED,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,SAAS,EAAE,OAAO,CAAC,EAAE,EAAE,CAAC,CAAA;AACjD,CAAC,CAAC,CAAA;AAEF,cAAc,CAAC,GAAG,CAAC,MAAM,EAAE,CAAC,GAAY,EAAE,GAAa,EAAE,EAAE;IACzD,MAAM,OAAO,GAAG,UAAU,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAA;IAExC,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,8BAA8B,EAAE,CAAC,CAAA;QAC/D,OAAM;IACR,CAAC;IAED,IAAI,OAAO,CAAC,OAAO,EAAE,CAAC;QACpB,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC,CAAA;QAC3C,OAAM;IACR,CAAC;IAED,IAAI,OAAO,CAAC,MAAM,KAAK,IAAI,EAAE,CAAC;QAC5B,GAAG;aACA,MAAM,CAAC,GAAG,CAAC;aACX,IAAI,CAAC,EAAE,MAAM,EAAE,SAAS,EAAE,SAAS,EAAE,OAAO,CAAC,EAAE,EAAE,UAAU,EAAE,OAAO,CAAC,UAAU,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,CAAC,CAAA;QAC7G,OAAM;IACR,CAAC;IAED,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,CAAC,CAAA;AACnE,CAAC,CAAC,CAAA;AAEF,cAAc,CAAC,IAAI,CAAC,aAAa,EAAE,CAAC,GAAY,EAAE,GAAa,EAAE,EAAE;IACjE,MAAM,EAAE,UAAU,EAAE,UAAU,EAAE,EAAE,EAAE,GAAG,EAAE,GAAG,GAAG,CAAC,IAK/C,CAAA;IAED,IAAI,CAAC,UAAU,IAAI,CAAC,UAAU,IAAI,CAAC,EAAE,IAAI,CAAC,GAAG,EAAE,CAAC;QAC9C,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,kDAAkD,EAAE,CAAC,CAAA;QACnF,OAAM;IACR,CAAC;IAED,MAAM,OAAO,GAAG,UAAU,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAA;IACxC,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,8BAA8B,EAAE,CAAC,CAAA;QAC/D,OAAM;IACR,CAAC;IAED,MAAM,OAAO,GAAG,gBAAgB,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,EAAE,UAAU,EAAE,UAAU,EAAE,EAAE,EAAE,GAAG,EAAE,CAAC,CAAA;IACnF,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,0BAA0B,EAAE,CAAC,CAAA;QAC3D,OAAM;IACR,CAAC;IAED,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC,CAAA;AACpC,CAAC,CAAC,CAAA;AAEF,cAAc,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC,GAAY,EAAE,GAAa,EAAE,EAAE;IAC/D,MAAM,OAAO,GAAG,UAAU,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAA;IACxC,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,8BAA8B,EAAE,CAAC,CAAA;QAC/D,OAAM;IACR,CAAC;IAED,MAAM,OAAO,GAAG,WAAW,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAA;IACzC,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,oDAAoD,EAAE,CAAC,CAAA;QACrF,OAAM;IACR,CAAC;IAED,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC,CAAA;AACpC,CAAC,CAAC,CAAA;AAEF,yCAAyC;AACzC,cAAc,CAAC,IAAI,CAAC,eAAe,EAAE,CAAC,GAAY,EAAE,GAAa,EAAE,EAAE;IACnE,MAAM,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,GAAG,GAAG,CAAC,IAIhC,CAAA;IAED,IAAI,CAAC,IAAI,IAAI,CAAC,IAAI,EAAE,CAAC;QACnB,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,4BAA4B,EAAE,CAAC,CAAA;QAC7D,OAAM;IACR,CAAC;IAED,MAAM,OAAO,GAAG,UAAU,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAA;IACxC,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,8BAA8B,EAAE,CAAC,CAAA;QAC/D,OAAM;IACR,CAAC;IAED,MAAM,SAAS,GAAG,MAAM,CAAC,UAAU,EAAE,CAAA;IACrC,MAAM,OAAO,GAAiB,EAAE,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,CAAA;IACjE,MAAM,OAAO,GAAG,UAAU,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,OAAO,CAAC,CAAA;IACjD,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,8BAA8B,EAAE,CAAC,CAAA;QAC/D,OAAM;IACR,CAAC;IAED,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,SAAS,EAAE,CAAC,CAAA;AACzC,CAAC,CAAC,CAAA;AAEF,yCAAyC;AACzC,cAAc,CAAC,GAAG,CAAC,eAAe,EAAE,CAAC,GAAY,EAAE,GAAa,EAAE,EAAE;IAClE,MAAM,OAAO,GAAG,UAAU,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAA;IACxC,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,8BAA8B,EAAE,CAAC,CAAA;QAC/D,OAAM;IACR,CAAC;IAED,MAAM,KAAK,GAAG,MAAM,CAAC,QAAQ,CAAC,GAAG,CAAC,KAAK,CAAC,KAAe,EAAE,EAAE,CAAC,CAAA;IAC5D,MAAM,UAAU,GAAG,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAA;IAClD,MAAM,QAAQ,GAAG,WAAW,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,UAAU,CAAC,CAAA;IACtD,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAA;AACpC,CAAC,CAAC,CAAA;AAEF,wCAAwC;AACxC,cAAc,CAAC,IAAI,CAAC,gBAAgB,EAAE,CAAC,GAAY,EAAE,GAAa,EAAE,EAAE;IACpE,MAAM,EAAE,SAAS,EAAE,KAAK,EAAE,GAAG,GAAG,CAAC,IAGhC,CAAA;IAED,IAAI,CAAC,SAAS,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;QACtC,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,kCAAkC,EAAE,CAAC,CAAA;QACnE,OAAM;IACR,CAAC;IAED,MAAM,OAAO,GAAG,UAAU,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAA;IACxC,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,8BAA8B,EAAE,CAAC,CAAA;QAC/D,OAAM;IACR,CAAC;IAED,MAAM,OAAO,GAAG,WAAW,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,EAAE,SAAS,EAAE,KAAK,EAAE,CAAC,CAAA;IAC/D,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,8BAA8B,EAAE,CAAC,CAAA;QAC/D,OAAM;IACR,CAAC;IAED,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC,CAAA;AACpC,CAAC,CAAC,CAAA;AAEF,0CAA0C;AAC1C,cAAc,CAAC,GAAG,CAAC,gBAAgB,EAAE,CAAC,GAAY,EAAE,GAAa,EAAE,EAAE;IACnE,MAAM,OAAO,GAAG,UAAU,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAA;IACxC,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,8BAA8B,EAAE,CAAC,CAAA;QAC/D,OAAM;IACR,CAAC;IAED,MAAM,SAAS,GAAG,YAAY,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAA;IAC5C,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,SAAS,EAAE,CAAC,CAAA;AACrC,CAAC,CAAC,CAAA;AAEF,cAAc,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC,GAAY,EAAE,GAAa,EAAE,EAAE;IAC5D,aAAa,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAA;IAC3B,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,CAAA;AACxB,CAAC,CAAC,CAAA"}

package/build/store.d.ts

@@ -4,18 +4,36 @@ export interface SessionResult {
     iv: string;
     tag: string;
 }
+export interface RelayMessage {
+    id: string;
+    type: 'info' | 'oauth_device_code' | 'input_required' | 'complete' | 'error';
+    text: string;
+    data?: Record<string, unknown>;
+}
+export interface RelayResponse {
+    messageId: string;
+    value: string;
+}
 export interface Session {
     id: string;
     serverName: string;
     schema: unknown;
     result: SessionResult | null;
+    skipped: boolean;
     createdAt: number;
     sourceIp: string;
+    messages: RelayMessage[];
+    responses: RelayResponse[];
 }
 export declare function getSession(id: string): Session | undefined;
 export declare function createSession(id: string, serverName: string, schema: unknown, sourceIp: string): Session | null;
 export declare function setSessionResult(id: string, result: SessionResult): boolean;
+export declare function skipSession(id: string): boolean;
 export declare function deleteSession(id: string): boolean;
+export declare function addMessage(id: string, message: RelayMessage): boolean;
+export declare function getMessages(id: string, afterIndex?: number): RelayMessage[];
+export declare function addResponse(id: string, response: RelayResponse): boolean;
+export declare function getResponses(id: string): RelayResponse[];
 export declare function startCleanup(): void;
 export declare function stopCleanup(): void;
 export declare function clearAllSessions(): void;

package/build/store.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"store.d.ts","sourceRoot":"","sources":["../src/store.ts"],"names":[],"mappings":"AAAA,MAAM,WAAW,aAAa;IAC5B,UAAU,EAAE,MAAM,CAAA;IAClB,UAAU,EAAE,MAAM,CAAA;IAClB,EAAE,EAAE,MAAM,CAAA;IACV,GAAG,EAAE,MAAM,CAAA;CACZ;AAED,MAAM,WAAW,OAAO;IACtB,EAAE,EAAE,MAAM,CAAA;IACV,UAAU,EAAE,MAAM,CAAA;IAClB,MAAM,EAAE,OAAO,CAAA;IACf,MAAM,EAAE,aAAa,GAAG,IAAI,CAAA;IAC5B,SAAS,EAAE,MAAM,CAAA;IACjB,QAAQ,EAAE,MAAM,CAAA;CACjB;AASD,wBAAgB,UAAU,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,GAAG,SAAS,CAO1D;AAED,wBAAgB,aAAa,CAAC,EAAE,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,GAAG,IAAI,CAgB/G;AAED,wBAAgB,gBAAgB,CAAC,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,aAAa,GAAG,OAAO,CAM3E;AAED,wBAAgB,aAAa,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAEjD;AAsBD,wBAAgB,YAAY,IAAI,IAAI,CAKnC;AAED,wBAAgB,WAAW,IAAI,IAAI,CAKlC;AAED,wBAAgB,gBAAgB,IAAI,IAAI,CAEvC"}
+{"version":3,"file":"store.d.ts","sourceRoot":"","sources":["../src/store.ts"],"names":[],"mappings":"AAAA,MAAM,WAAW,aAAa;IAC5B,UAAU,EAAE,MAAM,CAAA;IAClB,UAAU,EAAE,MAAM,CAAA;IAClB,EAAE,EAAE,MAAM,CAAA;IACV,GAAG,EAAE,MAAM,CAAA;CACZ;AAED,MAAM,WAAW,YAAY;IAC3B,EAAE,EAAE,MAAM,CAAA;IACV,IAAI,EAAE,MAAM,GAAG,mBAAmB,GAAG,gBAAgB,GAAG,UAAU,GAAG,OAAO,CAAA;IAC5E,IAAI,EAAE,MAAM,CAAA;IACZ,IAAI,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;CAC/B;AAED,MAAM,WAAW,aAAa;IAC5B,SAAS,EAAE,MAAM,CAAA;IACjB,KAAK,EAAE,MAAM,CAAA;CACd;AAED,MAAM,WAAW,OAAO;IACtB,EAAE,EAAE,MAAM,CAAA;IACV,UAAU,EAAE,MAAM,CAAA;IAClB,MAAM,EAAE,OAAO,CAAA;IACf,MAAM,EAAE,aAAa,GAAG,IAAI,CAAA;IAC5B,OAAO,EAAE,OAAO,CAAA;IAChB,SAAS,EAAE,MAAM,CAAA;IACjB,QAAQ,EAAE,MAAM,CAAA;IAChB,QAAQ,EAAE,YAAY,EAAE,CAAA;IACxB,SAAS,EAAE,aAAa,EAAE,CAAA;CAC3B;AAWD,wBAAgB,UAAU,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,GAAG,SAAS,CAO1D;AAED,wBAAgB,aAAa,CAAC,EAAE,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,GAAG,IAAI,CAmB/G;AAED,wBAAgB,gBAAgB,CAAC,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,aAAa,GAAG,OAAO,CAO3E;AAED,wBAAgB,WAAW,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAO/C;AAED,wBAAgB,aAAa,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAEjD;AAED,wBAAgB,UAAU,CAAC,EAAE,EAAE,MAAM,EAAE,OAAO,EAAE,YAAY,GAAG,OAAO,CAMrE;AAED,wBAAgB,WAAW,CAAC,EAAE,EAAE,MAAM,EAAE,UAAU,CAAC,EAAE,MAAM,GAAG,YAAY,EAAE,CAK3E;AAED,wBAAgB,WAAW,CAAC,EAAE,EAAE,MAAM,EAAE,QAAQ,EAAE,aAAa,GAAG,OAAO,CAMxE;AAED,wBAAgB,YAAY,CAAC,EAAE,EAAE,MAAM,GAAG,aAAa,EAAE,CAIxD;AAsBD,wBAAgB,YAAY,IAAI,IAAI,CAKnC;AAED,wBAAgB,WAAW,IAAI,IAAI,CAKlC;AAED,wBAAgB,gBAAgB,IAAI,IAAI,CAEvC"}

package/build/store.js

@@ -1,6 +1,8 @@
 const SESSION_TTL_MS = 10 * 60 * 1000; // 10 minutes
 const CLEANUP_INTERVAL_MS = 60 * 1000; // 60 seconds
-const MAX_SESSIONS_PER_IP = 5;
+const MAX_SESSIONS_PER_IP = 10;
+const MAX_MESSAGES_PER_SESSION = 50;
+const MAX_RESPONSES_PER_SESSION = 50;
 const sessions = new Map();
 let cleanupTimer = null;
 export function getSession(id) {
@@ -21,8 +23,11 @@ export function createSession(id, serverName, schema, sourceIp) {
         serverName,
         schema,
         result: null,
+        skipped: false,
         createdAt: Date.now(),
-        sourceIp
+        sourceIp,
+        messages: [],
+        responses: []
     };
     sessions.set(id, session);
     return session;
@@ -33,12 +38,56 @@ export function setSessionResult(id, result) {
         return false;
     if (session.result !== null)
         return false;
+    if (session.skipped)
+        return false;
     session.result = result;
     return true;
 }
+export function skipSession(id) {
+    const session = getSession(id);
+    if (!session)
+        return false;
+    if (session.result !== null)
+        return false;
+    if (session.skipped)
+        return false;
+    session.skipped = true;
+    return true;
+}
 export function deleteSession(id) {
     return sessions.delete(id);
 }
+export function addMessage(id, message) {
+    const session = getSession(id);
+    if (!session)
+        return false;
+    if (session.messages.length >= MAX_MESSAGES_PER_SESSION)
+        return false;
+    session.messages.push(message);
+    return true;
+}
+export function getMessages(id, afterIndex) {
+    const session = getSession(id);
+    if (!session)
+        return [];
+    const start = afterIndex ?? 0;
+    return session.messages.slice(start);
+}
+export function addResponse(id, response) {
+    const session = getSession(id);
+    if (!session)
+        return false;
+    if (session.responses.length >= MAX_RESPONSES_PER_SESSION)
+        return false;
+    session.responses.push(response);
+    return true;
+}
+export function getResponses(id) {
+    const session = getSession(id);
+    if (!session)
+        return [];
+    return session.responses;
+}
 function countSessionsByIp(ip) {
     const now = Date.now();
     let count = 0;

package/build/store.js.map

@@ -1 +1 @@
-{"version":3,"file":"store.js","sourceRoot":"","sources":["../src/store.ts"],"names":[],"mappings":"AAgBA,MAAM,cAAc,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAA,CAAC,aAAa;AACnD,MAAM,mBAAmB,GAAG,EAAE,GAAG,IAAI,CAAA,CAAC,aAAa;AACnD,MAAM,mBAAmB,GAAG,CAAC,CAAA;AAE7B,MAAM,QAAQ,GAAG,IAAI,GAAG,EAAmB,CAAA;AAC3C,IAAI,YAAY,GAA0C,IAAI,CAAA;AAE9D,MAAM,UAAU,UAAU,CAAC,EAAU;IACnC,MAAM,OAAO,GAAG,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC,CAAA;IAChC,IAAI,OAAO,IAAI,IAAI,CAAC,GAAG,EAAE,GAAG,OAAO,CAAC,SAAS,GAAG,cAAc,EAAE,CAAC;QAC/D,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC,CAAA;QACnB,OAAO,SAAS,CAAA;IAClB,CAAC;IACD,OAAO,OAAO,CAAA;AAChB,CAAC;AAED,MAAM,UAAU,aAAa,CAAC,EAAU,EAAE,UAAkB,EAAE,MAAe,EAAE,QAAgB;IAC7F,MAAM,OAAO,GAAG,iBAAiB,CAAC,QAAQ,CAAC,CAAA;IAC3C,IAAI,OAAO,IAAI,mBAAmB,EAAE,CAAC;QACnC,OAAO,IAAI,CAAA;IACb,CAAC;IAED,MAAM,OAAO,GAAY;QACvB,EAAE;QACF,UAAU;QACV,MAAM;QACN,MAAM,EAAE,IAAI;QACZ,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE;QACrB,QAAQ;KACT,CAAA;IACD,QAAQ,CAAC,GAAG,CAAC,EAAE,EAAE,OAAO,CAAC,CAAA;IACzB,OAAO,OAAO,CAAA;AAChB,CAAC;AAED,MAAM,UAAU,gBAAgB,CAAC,EAAU,EAAE,MAAqB;IAChE,MAAM,OAAO,GAAG,UAAU,CAAC,EAAE,CAAC,CAAA;IAC9B,IAAI,CAAC,OAAO;QAAE,OAAO,KAAK,CAAA;IAC1B,IAAI,OAAO,CAAC,MAAM,KAAK,IAAI;QAAE,OAAO,KAAK,CAAA;IACzC,OAAO,CAAC,MAAM,GAAG,MAAM,CAAA;IACvB,OAAO,IAAI,CAAA;AACb,CAAC;AAED,MAAM,UAAU,aAAa,CAAC,EAAU;IACtC,OAAO,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC,CAAA;AAC5B,CAAC;AAED,SAAS,iBAAiB,CAAC,EAAU;IACnC,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAA;IACtB,IAAI,KAAK,GAAG,CAAC,CAAA;IACb,KAAK,MAAM,OAAO,IAAI,QAAQ,CAAC,MAAM,EAAE,EAAE,CAAC;QACxC,IAAI,OAAO,CAAC,QAAQ,KAAK,EAAE,IAAI,GAAG,GAAG,OAAO,CAAC,SAAS,IAAI,cAAc,EAAE,CAAC;YACzE,KAAK,EAAE,CAAA;QACT,CAAC;IACH,CAAC;IACD,OAAO,KAAK,CAAA;AACd,CAAC;AAED,SAAS,OAAO;IACd,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAA;IACtB,KAAK,MAAM,CAAC,EAAE,EAAE,OAAO,CAAC,IAAI,QAAQ,EAAE,CAAC;QACrC,IAAI,GAAG,GAAG,OAAO,CAAC,SAAS,GAAG,cAAc,EAAE,CAAC;YAC7C,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC,CAAA;QACrB,CAAC;IACH,CAAC;AACH,CAAC;AAED,MAAM,UAAU,YAAY;IAC1B,IAAI,CAAC,YAAY,EAAE,CAAC;QAClB,YAAY,GAAG,WAAW,CAAC,OAAO,EAAE,mBAAmB,CAAC,CAAA;QACxD,YAAY,CAAC,KAAK,EAAE,EAAE,CAAA;IACxB,CAAC;AACH,CAAC;AAED,MAAM,UAAU,WAAW;IACzB,IAAI,YAAY,EAAE,CAAC;QACjB,aAAa,CAAC,YAAY,CAAC,CAAA;QAC3B,YAAY,GAAG,IAAI,CAAA;IACrB,CAAC;AACH,CAAC;AAED,MAAM,UAAU,gBAAgB;IAC9B,QAAQ,CAAC,KAAK,EAAE,CAAA;AAClB,CAAC"}
+{"version":3,"file":"store.js","sourceRoot":"","sources":["../src/store.ts"],"names":[],"mappings":"AA+BA,MAAM,cAAc,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAA,CAAC,aAAa;AACnD,MAAM,mBAAmB,GAAG,EAAE,GAAG,IAAI,CAAA,CAAC,aAAa;AACnD,MAAM,mBAAmB,GAAG,EAAE,CAAA;AAC9B,MAAM,wBAAwB,GAAG,EAAE,CAAA;AACnC,MAAM,yBAAyB,GAAG,EAAE,CAAA;AAEpC,MAAM,QAAQ,GAAG,IAAI,GAAG,EAAmB,CAAA;AAC3C,IAAI,YAAY,GAA0C,IAAI,CAAA;AAE9D,MAAM,UAAU,UAAU,CAAC,EAAU;IACnC,MAAM,OAAO,GAAG,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC,CAAA;IAChC,IAAI,OAAO,IAAI,IAAI,CAAC,GAAG,EAAE,GAAG,OAAO,CAAC,SAAS,GAAG,cAAc,EAAE,CAAC;QAC/D,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC,CAAA;QACnB,OAAO,SAAS,CAAA;IAClB,CAAC;IACD,OAAO,OAAO,CAAA;AAChB,CAAC;AAED,MAAM,UAAU,aAAa,CAAC,EAAU,EAAE,UAAkB,EAAE,MAAe,EAAE,QAAgB;IAC7F,MAAM,OAAO,GAAG,iBAAiB,CAAC,QAAQ,CAAC,CAAA;IAC3C,IAAI,OAAO,IAAI,mBAAmB,EAAE,CAAC;QACnC,OAAO,IAAI,CAAA;IACb,CAAC;IAED,MAAM,OAAO,GAAY;QACvB,EAAE;QACF,UAAU;QACV,MAAM;QACN,MAAM,EAAE,IAAI;QACZ,OAAO,EAAE,KAAK;QACd,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE;QACrB,QAAQ;QACR,QAAQ,EAAE,EAAE;QACZ,SAAS,EAAE,EAAE;KACd,CAAA;IACD,QAAQ,CAAC,GAAG,CAAC,EAAE,EAAE,OAAO,CAAC,CAAA;IACzB,OAAO,OAAO,CAAA;AAChB,CAAC;AAED,MAAM,UAAU,gBAAgB,CAAC,EAAU,EAAE,MAAqB;IAChE,MAAM,OAAO,GAAG,UAAU,CAAC,EAAE,CAAC,CAAA;IAC9B,IAAI,CAAC,OAAO;QAAE,OAAO,KAAK,CAAA;IAC1B,IAAI,OAAO,CAAC,MAAM,KAAK,IAAI;QAAE,OAAO,KAAK,CAAA;IACzC,IAAI,OAAO,CAAC,OAAO;QAAE,OAAO,KAAK,CAAA;IACjC,OAAO,CAAC,MAAM,GAAG,MAAM,CAAA;IACvB,OAAO,IAAI,CAAA;AACb,CAAC;AAED,MAAM,UAAU,WAAW,CAAC,EAAU;IACpC,MAAM,OAAO,GAAG,UAAU,CAAC,EAAE,CAAC,CAAA;IAC9B,IAAI,CAAC,OAAO;QAAE,OAAO,KAAK,CAAA;IAC1B,IAAI,OAAO,CAAC,MAAM,KAAK,IAAI;QAAE,OAAO,KAAK,CAAA;IACzC,IAAI,OAAO,CAAC,OAAO;QAAE,OAAO,KAAK,CAAA;IACjC,OAAO,CAAC,OAAO,GAAG,IAAI,CAAA;IACtB,OAAO,IAAI,CAAA;AACb,CAAC;AAED,MAAM,UAAU,aAAa,CAAC,EAAU;IACtC,OAAO,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC,CAAA;AAC5B,CAAC;AAED,MAAM,UAAU,UAAU,CAAC,EAAU,EAAE,OAAqB;IAC1D,MAAM,OAAO,GAAG,UAAU,CAAC,EAAE,CAAC,CAAA;IAC9B,IAAI,CAAC,OAAO;QAAE,OAAO,KAAK,CAAA;IAC1B,IAAI,OAAO,CAAC,QAAQ,CAAC,MAAM,IAAI,wBAAwB;QAAE,OAAO,KAAK,CAAA;IACrE,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC,CAAA;IAC9B,OAAO,IAAI,CAAA;AACb,CAAC;AAED,MAAM,UAAU,WAAW,CAAC,EAAU,EAAE,UAAmB;IACzD,MAAM,OAAO,GAAG,UAAU,CAAC,EAAE,CAAC,CAAA;IAC9B,IAAI,CAAC,OAAO;QAAE,OAAO,EAAE,CAAA;IACvB,MAAM,KAAK,GAAG,UAAU,IAAI,CAAC,CAAA;IAC7B,OAAO,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAC,KAAK,CAAC,CAAA;AACtC,CAAC;AAED,MAAM,UAAU,WAAW,CAAC,EAAU,EAAE,QAAuB;IAC7D,MAAM,OAAO,GAAG,UAAU,CAAC,EAAE,CAAC,CAAA;IAC9B,IAAI,CAAC,OAAO;QAAE,OAAO,KAAK,CAAA;IAC1B,IAAI,OAAO,CAAC,SAAS,CAAC,MAAM,IAAI,yBAAyB;QAAE,OAAO,KAAK,CAAA;IACvE,OAAO,CAAC,SAAS,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAA;IAChC,OAAO,IAAI,CAAA;AACb,CAAC;AAED,MAAM,UAAU,YAAY,CAAC,EAAU;IACrC,MAAM,OAAO,GAAG,UAAU,CAAC,EAAE,CAAC,CAAA;IAC9B,IAAI,CAAC,OAAO;QAAE,OAAO,EAAE,CAAA;IACvB,OAAO,OAAO,CAAC,SAAS,CAAA;AAC1B,CAAC;AAED,SAAS,iBAAiB,CAAC,EAAU;IACnC,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAA;IACtB,IAAI,KAAK,GAAG,CAAC,CAAA;IACb,KAAK,MAAM,OAAO,IAAI,QAAQ,CAAC,MAAM,EAAE,EAAE,CAAC;QACxC,IAAI,OAAO,CAAC,QAAQ,KAAK,EAAE,IAAI,GAAG,GAAG,OAAO,CAAC,SAAS,IAAI,cAAc,EAAE,CAAC;YACzE,KAAK,EAAE,CAAA;QACT,CAAC;IACH,CAAC;IACD,OAAO,KAAK,CAAA;AACd,CAAC;AAED,SAAS,OAAO;IACd,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAA;IACtB,KAAK,MAAM,CAAC,EAAE,EAAE,OAAO,CAAC,IAAI,QAAQ,EAAE,CAAC;QACrC,IAAI,GAAG,GAAG,OAAO,CAAC,SAAS,GAAG,cAAc,EAAE,CAAC;YAC7C,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC,CAAA;QACrB,CAAC;IACH,CAAC;AACH,CAAC;AAED,MAAM,UAAU,YAAY;IAC1B,IAAI,CAAC,YAAY,EAAE,CAAC;QAClB,YAAY,GAAG,WAAW,CAAC,OAAO,EAAE,mBAAmB,CAAC,CAAA;QACxD,YAAY,CAAC,KAAK,EAAE,EAAE,CAAA;IACxB,CAAC;AACH,CAAC;AAED,MAAM,UAAU,WAAW;IACzB,IAAI,YAAY,EAAE,CAAC;QACjB,aAAa,CAAC,YAAY,CAAC,CAAA;QAC3B,YAAY,GAAG,IAAI,CAAA;IACrB,CAAC;AACH,CAAC;AAED,MAAM,UAAU,gBAAgB;IAC9B,QAAQ,CAAC,KAAK,EAAE,CAAA;AAClB,CAAC"}

package/package.json

@@ -1,6 +1,32 @@
 {
   "name": "@n24q02m/mcp-relay-server",
-  "version": "0.1.0",
+  "version": "1.0.6",
+  "description": "Zero-config MCP credential relay server — ECDH P-256 + AES-256-GCM, rate-limited, zero-knowledge",
+  "keywords": [
+    "mcp",
+    "relay",
+    "server",
+    "credentials",
+    "encryption",
+    "zero-knowledge"
+  ],
+  "author": {
+    "name": "n24q02m",
+    "url": "https://github.com/n24q02m"
+  },
+  "license": "MIT",
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/n24q02m/mcp-relay-core.git",
+    "directory": "packages/relay-server"
+  },
+  "homepage": "https://github.com/n24q02m/mcp-relay-core",
+  "bugs": {
+    "url": "https://github.com/n24q02m/mcp-relay-core/issues"
+  },
+  "publishConfig": {
+    "access": "public"
+  },
   "type": "module",
   "main": "build/index.js",
   "scripts": {

package/src/app.ts

@@ -1,6 +1,6 @@
 import cors from 'cors'
 import express from 'express'
-import { rateLimiter } from './middleware/rate-limit.js'
+import { mutationLimiter, pollingLimiter } from './middleware/rate-limit.js'
 import { sessionsRouter } from './routes/sessions.js'
 
 export function createApp(): express.Express {
@@ -9,7 +9,12 @@ export function createApp(): express.Express {
   const corsOrigin = process.env.CORS_ORIGIN ?? '*'
   app.use(cors({ origin: corsOrigin }))
   app.use(express.json({ limit: '1mb' }))
-  app.use(rateLimiter)
+
+  // Split rate limits: stricter for mutations, relaxed for polling
+  app.use('/api', pollingLimiter) // GET requests (polling) — 120/min
+  app.post('/api/sessions', mutationLimiter) // Create session — 30/min
+  app.post('/api/sessions/:id/result', mutationLimiter) // Submit credentials — 30/min
+  app.post('/api/sessions/:id/skip', mutationLimiter) // Skip — 30/min
 
   app.use('/api/sessions', sessionsRouter)
 

package/src/middleware/rate-limit.ts

@@ -1,9 +1,20 @@
 import rateLimit from 'express-rate-limit'
 
-export const rateLimiter = rateLimit({
-  windowMs: 60 * 1000, // 1 minute
+// Session mutations (create, submit result, skip) — stricter limit
+export const mutationLimiter = rateLimit({
+  windowMs: 60 * 1000,
   limit: 30,
   standardHeaders: 'draft-7',
   legacyHeaders: false,
   message: { error: 'Too many requests, please try again later' }
 })
+
+// Polling endpoints (GET sessions, messages, responses) — higher limit
+// Browser polls every 2s = 30 requests/min per session
+export const pollingLimiter = rateLimit({
+  windowMs: 60 * 1000,
+  limit: 120,
+  standardHeaders: 'draft-7',
+  legacyHeaders: false,
+  message: { error: 'Too many requests, please try again later' }
+})

package/src/routes/sessions.ts

@@ -1,6 +1,17 @@
 import type { Request, Response } from 'express'
 import { Router } from 'express'
-import { createSession, deleteSession, getSession, setSessionResult } from '../store.js'
+import type { RelayMessage } from '../store.js'
+import {
+  addMessage,
+  addResponse,
+  createSession,
+  deleteSession,
+  getMessages,
+  getResponses,
+  getSession,
+  setSessionResult,
+  skipSession
+} from '../store.js'
 
 function paramId(req: Request): string {
   const id = req.params.id
@@ -40,6 +51,11 @@ sessionsRouter.get('/:id', (req: Request, res: Response) => {
     return
   }
 
+  if (session.skipped) {
+    res.status(200).json({ status: 'skipped' })
+    return
+  }
+
   if (session.result === null) {
     res
       .status(202)
@@ -78,6 +94,105 @@ sessionsRouter.post('/:id/result', (req: Request, res: Response) => {
   res.status(200).json({ ok: true })
 })
 
+sessionsRouter.post('/:id/skip', (req: Request, res: Response) => {
+  const session = getSession(paramId(req))
+  if (!session) {
+    res.status(404).json({ error: 'Session not found or expired' })
+    return
+  }
+
+  const success = skipSession(paramId(req))
+  if (!success) {
+    res.status(409).json({ error: 'Session already has a result or is already skipped' })
+    return
+  }
+
+  res.status(200).json({ ok: true })
+})
+
+// Server pushes a message to the browser
+sessionsRouter.post('/:id/messages', (req: Request, res: Response) => {
+  const { type, text, data } = req.body as {
+    type?: RelayMessage['type']
+    text?: string
+    data?: Record<string, unknown>
+  }
+
+  if (!type || !text) {
+    res.status(400).json({ error: 'type and text are required' })
+    return
+  }
+
+  const session = getSession(paramId(req))
+  if (!session) {
+    res.status(404).json({ error: 'Session not found or expired' })
+    return
+  }
+
+  const messageId = crypto.randomUUID()
+  const message: RelayMessage = { id: messageId, type, text, data }
+  const success = addMessage(paramId(req), message)
+  if (!success) {
+    res.status(404).json({ error: 'Session not found or expired' })
+    return
+  }
+
+  res.status(201).json({ id: messageId })
+})
+
+// Browser polls for messages from server
+sessionsRouter.get('/:id/messages', (req: Request, res: Response) => {
+  const session = getSession(paramId(req))
+  if (!session) {
+    res.status(404).json({ error: 'Session not found or expired' })
+    return
+  }
+
+  const after = Number.parseInt(req.query.after as string, 10)
+  const afterIndex = Number.isNaN(after) ? 0 : after
+  const messages = getMessages(paramId(req), afterIndex)
+  res.status(200).json({ messages })
+})
+
+// Browser sends a response to a message
+sessionsRouter.post('/:id/responses', (req: Request, res: Response) => {
+  const { messageId, value } = req.body as {
+    messageId?: string
+    value?: string
+  }
+
+  if (!messageId || value === undefined) {
+    res.status(400).json({ error: 'messageId and value are required' })
+    return
+  }
+
+  const session = getSession(paramId(req))
+  if (!session) {
+    res.status(404).json({ error: 'Session not found or expired' })
+    return
+  }
+
+  const success = addResponse(paramId(req), { messageId, value })
+  if (!success) {
+    res.status(404).json({ error: 'Session not found or expired' })
+    return
+  }
+
+  res.status(200).json({ ok: true })
+})
+
+// Server polls for responses from browser
+sessionsRouter.get('/:id/responses', (req: Request, res: Response) => {
+  const session = getSession(paramId(req))
+  if (!session) {
+    res.status(404).json({ error: 'Session not found or expired' })
+    return
+  }
+
+  const responses = getResponses(paramId(req))
+  res.status(200).json({ responses })
+})
+
 sessionsRouter.delete('/:id', (req: Request, res: Response) => {
   deleteSession(paramId(req))
   res.status(204).send()

package/src/store.ts

@@ -5,18 +5,35 @@ export interface SessionResult {
   tag: string
 }
 
+export interface RelayMessage {
+  id: string
+  type: 'info' | 'oauth_device_code' | 'input_required' | 'complete' | 'error'
+  text: string
+  data?: Record<string, unknown>
+}
+
+export interface RelayResponse {
+  messageId: string
+  value: string
+}
+
 export interface Session {
   id: string
   serverName: string
   schema: unknown
   result: SessionResult | null
+  skipped: boolean
   createdAt: number
   sourceIp: string
+  messages: RelayMessage[]
+  responses: RelayResponse[]
 }
 
 const SESSION_TTL_MS = 10 * 60 * 1000 // 10 minutes
 const CLEANUP_INTERVAL_MS = 60 * 1000 // 60 seconds
-const MAX_SESSIONS_PER_IP = 5
+const MAX_SESSIONS_PER_IP = 10
+const MAX_MESSAGES_PER_SESSION = 50
+const MAX_RESPONSES_PER_SESSION = 50
 
 const sessions = new Map<string, Session>()
 let cleanupTimer: ReturnType<typeof setInterval> | null = null
@@ -41,8 +58,11 @@ export function createSession(id: string, serverName: string, schema: unknown, s
     serverName,
     schema,
     result: null,
+    skipped: false,
     createdAt: Date.now(),
-    sourceIp
+    sourceIp,
+    messages: [],
+    responses: []
   }
   sessions.set(id, session)
   return session
@@ -52,14 +72,53 @@ export function setSessionResult(id: string, result: SessionResult): boolean {
   const session = getSession(id)
   if (!session) return false
   if (session.result !== null) return false
+  if (session.skipped) return false
   session.result = result
   return true
 }
 
+export function skipSession(id: string): boolean {
+  const session = getSession(id)
+  if (!session) return false
+  if (session.result !== null) return false
+  if (session.skipped) return false
+  session.skipped = true
+  return true
+}
+
 export function deleteSession(id: string): boolean {
   return sessions.delete(id)
 }
 
+export function addMessage(id: string, message: RelayMessage): boolean {
+  const session = getSession(id)
+  if (!session) return false
+  if (session.messages.length >= MAX_MESSAGES_PER_SESSION) return false
+  session.messages.push(message)
+  return true
+}
+
+export function getMessages(id: string, afterIndex?: number): RelayMessage[] {
+  const session = getSession(id)
+  if (!session) return []
+  const start = afterIndex ?? 0
+  return session.messages.slice(start)
+}
+
+export function addResponse(id: string, response: RelayResponse): boolean {
+  const session = getSession(id)
+  if (!session) return false
+  if (session.responses.length >= MAX_RESPONSES_PER_SESSION) return false
+  session.responses.push(response)
+  return true
+}
+
+export function getResponses(id: string): RelayResponse[] {
+  const session = getSession(id)
+  if (!session) return []
+  return session.responses
+}
+
 function countSessionsByIp(ip: string): number {
   const now = Date.now()
   let count = 0

package/tests/rate-limit.test.ts

@@ -30,20 +30,38 @@ afterAll(async () => {
 })
 
 describe('Rate limiting', () => {
-  it('rate limit kicks in after 30 requests per minute', async () => {
-    // Send 30 requests (all should succeed with 404 since no session exists)
+  it('mutation rate limit kicks in after 30 POST requests per minute', async () => {
+    // POST requests go through mutationLimiter (30/min)
     const results: number[] = []
     for (let i = 0; i < 31; i++) {
-      const res = await fetch(`${baseUrl}/api/sessions/rate-test-${i}`)
+      const res = await fetch(`${baseUrl}/api/sessions`, {
+        method: 'POST',
+        headers: { 'Content-Type': 'application/json' },
+        body: JSON.stringify({ serverName: `test-${i}`, schema: {} })
+      })
       results.push(res.status)
     }
 
-    // First 30 should be 404 (valid response, session not found)
-    for (let i = 0; i < 30; i++) {
-      expect(results[i]).toBe(404)
-    }
+    // First 30 should succeed (201 created)
+    const successCount = results.filter((s) => s === 201).length
+    expect(successCount).toBeLessThanOrEqual(30)
 
     // 31st should be rate limited
     expect(results[30]).toBe(429)
   })
+
+  it('polling rate limit allows 120 GET requests per minute', async () => {
+    // GET requests go through pollingLimiter (120/min)
+    // Send 31 GETs — all should be 404 (no rate limit at this count)
+    const results: number[] = []
+    for (let i = 0; i < 31; i++) {
+      const res = await fetch(`${baseUrl}/api/sessions/poll-test-${i}`)
+      results.push(res.status)
+    }
+
+    // All 31 should be 404 (not rate limited — limit is 120)
+    for (const status of results) {
+      expect(status).toBe(404)
+    }
+  })
 })