@happyvertical/smrt-web 0.43.2 → 0.43.4

package/dist/chunks/{src-CDdW9uYx.js → src-n14q6RHC.js}

@@ -1343,6 +1343,425 @@ function persistCollection(config) {
 	};
 }
 //#endregion
+//#region src/remote-query.ts
+function canonicalize(value) {
+	if (Array.isArray(value)) return value.map(canonicalize);
+	if (value && typeof value === "object") {
+		const record = value;
+		return Object.fromEntries(Object.keys(record).sort().map((key) => [key, canonicalize(record[key])]));
+	}
+	return value;
+}
+function keyFor(request) {
+	const { requestId: _requestId, ...semantic } = request;
+	return JSON.stringify(canonicalize(semantic));
+}
+function rebindRequestId(result, request) {
+	return result.requestId === request.requestId ? result : {
+		...result,
+		requestId: request.requestId
+	};
+}
+function abortError() {
+	if (typeof DOMException !== "undefined") return new DOMException("The operation was aborted", "AbortError");
+	const error = /* @__PURE__ */ new Error("The operation was aborted");
+	error.name = "AbortError";
+	return error;
+}
+function isAbort(error) {
+	return !!error && typeof error === "object" && error.name === "AbortError";
+}
+function pageOf(result) {
+	if (!result.page) return void 0;
+	return result.page.kind === "offset" ? { ...result.page } : { ...result.page };
+}
+function createSmrtWebQuery(_collection, transport, options = {}) {
+	const staleTimeMs = options.staleTimeMs ?? 3e4;
+	const cache = /* @__PURE__ */ new Map();
+	const inFlight = /* @__PURE__ */ new Map();
+	const latestSuccessfulFlight = /* @__PURE__ */ new Map();
+	let flightSequence = 0;
+	const listeners = /* @__PURE__ */ new Set();
+	let request;
+	let visibleController;
+	const runControllers = /* @__PURE__ */ new Set();
+	let generation = 0;
+	let live;
+	let liveIntent;
+	let liveGeneration = 0;
+	let disposed = false;
+	let state = {
+		rows: [],
+		page: void 0,
+		total: void 0,
+		loading: false,
+		refreshing: false,
+		stale: false,
+		error: null,
+		lastUpdated: void 0,
+		result: void 0
+	};
+	const publish = (next) => {
+		state = next;
+		for (const listener of listeners) listener(state);
+	};
+	const cached = (key) => cache.get(key);
+	const cacheSuccess = (key, result, sequence, updatedAt = Date.now()) => {
+		if (disposed) return false;
+		const latest = latestSuccessfulFlight.get(key);
+		if (latest === void 0 || sequence > latest) {
+			latestSuccessfulFlight.set(key, sequence);
+			cache.set(key, {
+				result,
+				updatedAt
+			});
+			return true;
+		}
+		return false;
+	};
+	const apply = (result, candidate, updatedAt = Date.now(), successSequence) => {
+		if (successSequence !== void 0 && !cacheSuccess(keyFor(candidate), result, successSequence, updatedAt)) return;
+		publish({
+			rows: result.rows,
+			page: pageOf(result),
+			total: result.total,
+			loading: false,
+			refreshing: false,
+			stale: result.freshness.state === "stale",
+			error: null,
+			lastUpdated: updatedAt,
+			result
+		});
+	};
+	const runTransport = async (candidate, controller) => {
+		runControllers.add(controller);
+		try {
+			const result = await executeSmrtWebDataQuery(transport, candidate, { signal: controller.signal });
+			if (controller.signal.aborted) throw abortError();
+			return result;
+		} catch (error) {
+			if (controller.signal.aborted) throw abortError();
+			throw error;
+		} finally {
+			runControllers.delete(controller);
+		}
+	};
+	const execute = async (candidate, runOptions = {}) => {
+		if (disposed) throw abortError();
+		const mode = runOptions.mode ?? "visible";
+		const key = keyFor(candidate);
+		if (runOptions.signal?.aborted || (runOptions.deadlineMs ?? 1) <= 0) throw abortError();
+		const rebindIntent = mode === "visible" && liveIntent?.active && (!live || request !== void 0 && keyFor(request) !== key) ? liveIntent : void 0;
+		const entry = cached(key);
+		const fresh = entry !== void 0 && Date.now() - entry.updatedAt < staleTimeMs;
+		if (mode !== "visible" && !runOptions.force && fresh) return rebindRequestId(entry.result, candidate);
+		if (mode === "visible" && !runOptions.force && fresh) {
+			generation += 1;
+			visibleController?.abort(abortError());
+			if (disposed) throw abortError();
+			visibleController = void 0;
+			request = candidate;
+			if (rebindIntent) live?.disconnect();
+			const result = rebindRequestId(entry.result, candidate);
+			apply(result, candidate, entry.updatedAt);
+			if (disposed) throw abortError();
+			if (rebindIntent?.active && !live) resumeLive(rebindIntent);
+			return result;
+		}
+		if (mode === "visible") {
+			generation += 1;
+			visibleController?.abort(abortError());
+			if (disposed) throw abortError();
+			const invocationController = new AbortController();
+			visibleController = invocationController;
+			request = candidate;
+			if (rebindIntent) live?.disconnect();
+			const current = generation;
+			const signal = runOptions.signal;
+			let removeCallerAbort;
+			if (signal?.aborted) invocationController.abort(signal.reason);
+			else if (signal) {
+				const abortCaller = () => invocationController.abort(signal.reason);
+				signal.addEventListener("abort", abortCaller, { once: true });
+				removeCallerAbort = () => signal.removeEventListener("abort", abortCaller);
+			}
+			if (entry) {
+				const cachedResult = rebindRequestId(entry.result, candidate);
+				publish({
+					rows: cachedResult.rows,
+					page: pageOf(cachedResult),
+					total: cachedResult.total,
+					loading: false,
+					refreshing: true,
+					stale: true,
+					error: null,
+					lastUpdated: entry.updatedAt,
+					result: cachedResult
+				});
+			} else publish({
+				...state,
+				loading: true,
+				refreshing: false,
+				stale: false,
+				error: null
+			});
+			runOptions = {
+				...runOptions,
+				signal: invocationController.signal,
+				force: true
+			};
+			try {
+				if (disposed) throw abortError();
+				const result = await runShared(candidate, key, runOptions);
+				if (current === generation) {
+					if (cached(key)?.result === result) apply(result, candidate);
+					else publish({
+						...state,
+						loading: false,
+						refreshing: false
+					});
+					if (rebindIntent?.active && !live) resumeLive(rebindIntent);
+				}
+				return result;
+			} catch (error) {
+				if (current === generation) if (isAbort(error)) publish({
+					...state,
+					loading: false,
+					refreshing: false
+				});
+				else publish({
+					...state,
+					loading: false,
+					refreshing: false,
+					stale: entry !== void 0,
+					error
+				});
+				throw error;
+			} finally {
+				removeCallerAbort?.();
+				if (visibleController === invocationController) visibleController = void 0;
+			}
+		}
+		return runShared(candidate, key, runOptions);
+	};
+	const waitForFlight = (flight, key, candidate, runOptions) => {
+		if (runOptions.signal?.aborted || (runOptions.deadlineMs ?? 1) <= 0) return Promise.reject(abortError());
+		return new Promise((resolve, reject) => {
+			let settled = false;
+			const settle = () => {
+				if (settled) return;
+				settled = true;
+				flight.waiters -= 1;
+				if (timer) clearTimeout(timer);
+				runOptions.signal?.removeEventListener("abort", cancel);
+			};
+			const cancel = () => {
+				if (settled) return;
+				settle();
+				if (flight.waiters === 0 && !flight.settled) {
+					flight.controller.abort(abortError());
+					if (inFlight.get(key) === flight) inFlight.delete(key);
+				}
+				reject(abortError());
+			};
+			const timer = runOptions.deadlineMs === void 0 ? void 0 : setTimeout(cancel, runOptions.deadlineMs);
+			flight.waiters += 1;
+			runOptions.signal?.addEventListener("abort", cancel, { once: true });
+			flight.promise.then((result) => {
+				if (settled) return;
+				settle();
+				resolve(rebindRequestId(result, candidate));
+			}, (error) => {
+				if (settled) return;
+				settle();
+				reject(error);
+			});
+		});
+	};
+	const runShared = async (candidate, key, runOptions) => {
+		if (runOptions.signal?.aborted || (runOptions.deadlineMs ?? 1) <= 0) throw abortError();
+		if (!runOptions.force) {
+			const existing = inFlight.get(key);
+			if (existing) return waitForFlight(existing, key, candidate, runOptions);
+		}
+		const flight = ++flightSequence;
+		const controller = new AbortController();
+		const running = runTransport(candidate, controller).then((result) => {
+			if (controller.signal.aborted) throw abortError();
+			cacheSuccess(key, result, flight);
+			return result;
+		});
+		const shared = {
+			controller,
+			promise: running,
+			waiters: 0,
+			settled: false
+		};
+		inFlight.set(key, shared);
+		running.then(() => {
+			shared.settled = true;
+			if (inFlight.get(key) === shared) inFlight.delete(key);
+		}, () => {
+			shared.settled = true;
+			if (inFlight.get(key) === shared) inFlight.delete(key);
+		});
+		return waitForFlight(shared, key, candidate, runOptions);
+	};
+	const refresh = (refreshOptions = {}) => {
+		if (!request) return Promise.resolve(void 0);
+		return execute(request, {
+			...refreshOptions,
+			mode: "visible",
+			force: true
+		});
+	};
+	const startLive = (intent) => {
+		if (disposed || !intent.active || !request || !transport.subscribe) return void 0;
+		const candidate = request;
+		const currentGeneration = ++liveGeneration;
+		const controller = new AbortController();
+		let connected = true;
+		let subscription;
+		let handle;
+		const disconnect = () => {
+			if (!connected) return;
+			connected = false;
+			controller.abort();
+			subscription.unsubscribe();
+			if (live === handle) live = void 0;
+		};
+		const unsubscribe = () => {
+			if (!intent.active) return;
+			intent.active = false;
+			disconnect();
+			if (liveIntent === intent) liveIntent = void 0;
+			if (live?.intent === intent) live.disconnect();
+		};
+		const reconnect = () => {
+			if (!intent.active || disposed) return;
+			if (!connected) {
+				if (live?.intent === intent) live.reconnect();
+				return;
+			}
+			if (currentGeneration !== liveGeneration) return;
+			disconnect();
+			const reconnectRequest = request;
+			if (!reconnectRequest || keyFor(reconnectRequest) !== keyFor(candidate)) return;
+			execute(reconnectRequest, {
+				mode: "visible",
+				force: true
+			}).catch(() => void 0).finally(() => {
+				if (intent.active && !disposed && liveIntent === intent && !live && request && keyFor(request) === keyFor(candidate)) resumeLive(intent);
+			});
+		};
+		handle = {
+			intent,
+			disconnect,
+			unsubscribe,
+			reconnect
+		};
+		subscription = transport.subscribe(candidate, (raw) => {
+			if (!connected || !intent.active || disposed || currentGeneration !== liveGeneration || controller.signal.aborted) return;
+			const liveFlight = ++flightSequence;
+			(async () => {
+				const result = await executeSmrtWebDataQuery({ query: async () => raw }, candidate);
+				if (connected && intent.active && !disposed && currentGeneration === liveGeneration && request && keyFor(request) === keyFor(candidate)) apply(rebindRequestId(result, request), request, Date.now(), liveFlight);
+			})().catch((error) => {
+				const latestSuccessful = latestSuccessfulFlight.get(keyFor(candidate));
+				if (!isAbort(error) && connected && intent.active && !disposed && currentGeneration === liveGeneration && request && keyFor(request) === keyFor(candidate) && (latestSuccessful === void 0 || liveFlight > latestSuccessful)) publish({
+					...state,
+					error
+				});
+			});
+		}, { signal: controller.signal });
+		if (disposed || !intent.active) {
+			disconnect();
+			return;
+		}
+		live = handle;
+		return handle;
+	};
+	const clearLiveIntent = (intent) => {
+		intent.active = false;
+		if (liveIntent === intent) liveIntent = void 0;
+	};
+	const resumeLive = (intent) => {
+		try {
+			startLive(intent);
+		} catch (error) {
+			clearLiveIntent(intent);
+			if (!disposed) publish({
+				...state,
+				error
+			});
+		}
+	};
+	const subscribeLive = () => {
+		if (disposed || !request || !transport.subscribe) return void 0;
+		if (liveIntent) {
+			liveIntent.active = false;
+			live?.disconnect();
+		}
+		const intent = { active: true };
+		liveIntent = intent;
+		try {
+			return startLive(intent);
+		} catch (error) {
+			clearLiveIntent(intent);
+			throw error;
+		}
+	};
+	return {
+		get state() {
+			return state;
+		},
+		get request() {
+			return request;
+		},
+		execute,
+		refresh,
+		retry: () => refresh(),
+		subscribe(listener) {
+			listeners.add(listener);
+			listener(state);
+			return () => listeners.delete(listener);
+		},
+		subscribeLive,
+		invalidate() {
+			if (!request) return;
+			const key = keyFor(request);
+			const entry = cache.get(key);
+			latestSuccessfulFlight.set(key, ++flightSequence);
+			if (entry) cache.set(key, {
+				...entry,
+				updatedAt: 0
+			});
+			publish({
+				...state,
+				loading: false,
+				refreshing: false,
+				stale: true
+			});
+		},
+		dispose() {
+			disposed = true;
+			generation += 1;
+			liveGeneration += 1;
+			visibleController?.abort(abortError());
+			for (const controller of runControllers) controller.abort(abortError());
+			if (liveIntent) liveIntent.active = false;
+			live?.disconnect();
+			live = void 0;
+			liveIntent = void 0;
+			request = void 0;
+			listeners.clear();
+			cache.clear();
+			latestSuccessfulFlight.clear();
+			inFlight.clear();
+		}
+	};
+}
+//#endregion
 //#region src/sse-client.ts
 var EVENT_SOURCE_CLOSED = 2;
 function defaultEventSourceFactory(url, init) {
@@ -1697,38 +2116,266 @@ function getModelContext() {
 	if (mc && typeof mc.registerTool === "function") return mc;
 }
 function registerWebMcpTools(definitions, options = {}) {
+	const exposure = validateExposurePolicy(options);
 	const ctx = getModelContext();
-	if (!ctx) return () => {};
+	if (!ctx) return registrationDisposer(() => {}, Promise.resolve());
 	const basePath = options.basePath ?? "/api/v1";
+	const client = options.client;
+	const { tools, allowedEffects } = selectProspectiveTools(definitions, options, exposure);
+	if (client && tools.some((tool) => tool.kind === "canonical" && tool.effect !== "read")) validateSmrtWebClient(client);
 	const controller = new AbortController();
 	const collections = /* @__PURE__ */ new Map();
-	for (const definition of definitions) {
-		const descriptors = definition.toolDescriptors;
-		if (!descriptors || descriptors.length === 0) continue;
-		const fetchers = options.resolveFetchers ? options.resolveFetchers(definition) : createDefinitionFetchers(definition, basePath, options.fetchFn);
-		const collection = createSmrtCollection(definition, {
-			fetchers,
-			basePath,
-			fetchFn: options.fetchFn,
-			...options.client ? { client: options.client } : {},
-			...options.scope ? { scope: options.scope } : {}
-		});
-		collections.set(definition, collection);
-		for (const descriptor of descriptors) {
-			if (options.filter && !options.filter(definition, descriptor)) continue;
-			ctx.registerTool({
-				name: descriptor.name,
-				description: descriptor.description,
-				inputSchema: descriptor.inputSchema,
-				annotations: { readOnlyHint: descriptor.readOnly },
-				execute: (args) => dispatch(fetchers, collection, definition, descriptor.action, descriptor.route, args ?? {})
-			}, { signal: controller.signal });
-		}
-	}
-	return () => {
+	const collectionFetchers = /* @__PURE__ */ new Map();
+	let disposed = false;
+	const dispose = () => {
+		if (disposed) return;
+		disposed = true;
 		controller.abort();
 		for (const collection of collections.values()) collection.cleanup().catch(() => void 0);
 	};
+	const registrations = [];
+	try {
+		for (const tool of tools) {
+			if (tool.kind === "legacy") {
+				const { definition: definition2, descriptor } = tool;
+				let fetchers2 = collectionFetchers.get(definition2);
+				let collection = collections.get(definition2);
+				if (!fetchers2 || !collection) {
+					fetchers2 = options.resolveFetchers ? options.resolveFetchers(snapshotLegacyDefinition(definition2)) : createDefinitionFetchers(definition2, basePath, options.fetchFn);
+					collection = createSmrtCollection(definition2, {
+						fetchers: fetchers2,
+						basePath,
+						fetchFn: options.fetchFn,
+						...client ? { client } : {},
+						...options.scope ? { scope: options.scope } : {}
+					});
+					collectionFetchers.set(definition2, fetchers2);
+					collections.set(definition2, collection);
+				}
+				registrations.push(Promise.resolve(ctx.registerTool({
+					name: tool.name,
+					description: descriptor.description,
+					inputSchema: descriptor.inputSchema,
+					annotations: annotationsFor(tool),
+					execute: guardedExecute(tool, allowedEffects, () => disposed, (args) => dispatchCollection(fetchers2, collection, definition2, descriptor.action, descriptor.route, args))
+				}, { signal: controller.signal })));
+				continue;
+			}
+			const { definition } = tool;
+			const fetchers = options.resolveToolFetchers ? options.resolveToolFetchers(snapshotCanonicalDefinition(definition, {
+				effect: tool.effect,
+				destructive: tool.destructive,
+				idempotent: tool.idempotent,
+				openWorld: tool.openWorld
+			})) : createDefinitionFetchers({
+				name: definition.collection,
+				endpoint: definition.endpoint
+			}, basePath, options.fetchFn);
+			registrations.push(Promise.resolve(ctx.registerTool({
+				name: tool.name,
+				description: definition.description,
+				inputSchema: definition.inputSchema,
+				annotations: annotationsFor(tool),
+				execute: guardedExecute(tool, allowedEffects, () => disposed, (args) => dispatchDirect(fetchers, definition, args, client))
+			}, { signal: controller.signal })));
+		}
+	} catch (error) {
+		Promise.all(registrations).catch(() => void 0);
+		dispose();
+		throw error;
+	}
+	const ready = Promise.all(registrations).then(() => void 0).catch((error) => {
+		dispose();
+		throw error;
+	});
+	ready.catch(() => void 0);
+	return registrationDisposer(dispose, ready);
+}
+function registrationDisposer(dispose, ready) {
+	return Object.assign(dispose, { ready });
+}
+var VALID_EFFECTS = [
+	"read",
+	"write",
+	"destructive"
+];
+var NAMESPACE_PATTERN = /^[A-Za-z0-9][A-Za-z0-9_-]*$/;
+function validateExposurePolicy(options) {
+	const effects = options.effects ?? ["read"];
+	for (const effect of effects) if (!VALID_EFFECTS.includes(effect)) throw new Error(`Invalid WebMCP effect: ${String(effect)}`);
+	const maxTools = options.maxTools;
+	if (maxTools !== void 0 && (!Number.isSafeInteger(maxTools) || maxTools < 0)) throw new Error("WebMCP maxTools must be a non-negative safe integer");
+	const namespace = options.namespace;
+	if (namespace !== void 0 && !NAMESPACE_PATTERN.test(namespace)) throw new Error("WebMCP namespace must start with an alphanumeric character and contain only letters, numbers, underscores, or hyphens");
+	return {
+		allowedEffects: new Set(effects),
+		...maxTools !== void 0 ? { maxTools } : {},
+		...namespace !== void 0 ? { namespace } : {}
+	};
+}
+function selectProspectiveTools(definitions, options, exposure) {
+	const { allowedEffects, maxTools, namespace } = exposure;
+	const stableDefinitions = definitions.map((definition) => snapshotValue(definition));
+	const tools = [];
+	for (const definition of stableDefinitions) {
+		if (isCanonicalToolDefinition(definition)) {
+			const semantics = actionSemantics(definition.action, definition);
+			if (!allowedEffects.has(semantics.effect)) continue;
+			if (options.filter && !options.filterTool) throw new Error("[smrt-web] canonical WebMCP definitions require filterTool when filter is configured");
+			const stableDefinition2 = snapshotCanonicalDefinition(definition, semantics);
+			if (options.filterTool && !options.filterTool(snapshotCanonicalDefinition(stableDefinition2, semantics))) continue;
+			tools.push({
+				kind: "canonical",
+				definition: stableDefinition2,
+				descriptor: stableDefinition2,
+				name: qualifiedToolName(stableDefinition2.name, namespace),
+				identity: `${stableDefinition2.collection}#${stableDefinition2.action}`,
+				...semantics
+			});
+			continue;
+		}
+		const stableDefinition = snapshotLegacyDefinition(definition);
+		for (const descriptor of stableDefinition.toolDescriptors ?? []) {
+			if (!stableDefinition.actions.includes(descriptor.action)) throw new Error(`WebMCP tool ${descriptor.name} exposes action ${descriptor.action} outside ${stableDefinition.name}'s allowed actions`);
+			const semantics = actionSemantics(descriptor.action, descriptor);
+			if (!allowedEffects.has(semantics.effect)) continue;
+			if (options.filterTool && !options.filter) throw new Error("[smrt-web] legacy WebMCP definitions require filter when filterTool is configured");
+			const stableDescriptor = snapshotLegacyDescriptor(descriptor, semantics);
+			if (options.filter && !options.filter(snapshotLegacyDefinition(stableDefinition), snapshotLegacyDescriptor(stableDescriptor, semantics))) continue;
+			tools.push({
+				kind: "legacy",
+				definition: stableDefinition,
+				descriptor: stableDescriptor,
+				name: qualifiedToolName(stableDescriptor.name, namespace),
+				identity: `${stableDefinition.name}#${stableDescriptor.action}`,
+				...semantics
+			});
+		}
+	}
+	validateProspectiveTools(tools, maxTools);
+	return {
+		tools,
+		allowedEffects
+	};
+}
+function qualifiedToolName(name, namespace) {
+	return namespace ? `${namespace}_${name}` : name;
+}
+function actionSemantics(action, declared) {
+	switch (action) {
+		case "list":
+		case "get": return {
+			effect: "read",
+			destructive: false,
+			idempotent: true,
+			openWorld: false
+		};
+		case "create": return {
+			effect: "write",
+			destructive: true,
+			idempotent: false,
+			openWorld: false
+		};
+		case "update": return {
+			effect: "write",
+			destructive: true,
+			idempotent: true,
+			openWorld: false
+		};
+		case "delete": return {
+			effect: "destructive",
+			destructive: true,
+			idempotent: true,
+			openWorld: false
+		};
+		default: {
+			const effect = VALID_EFFECTS.includes(declared.effect) ? declared.effect : "destructive";
+			return {
+				effect,
+				destructive: effect !== "read",
+				idempotent: declared.idempotent ?? false,
+				openWorld: declared.openWorld ?? true
+			};
+		}
+	}
+}
+function snapshotRoute(route) {
+	return route ? snapshotValue(route) : void 0;
+}
+function snapshotValue(value, active = /* @__PURE__ */ new WeakSet(), path = "$") {
+	if (value && typeof value === "object") {
+		if (active.has(value)) throw new Error(`[smrt-web] WebMCP definitions must be acyclic (cycle at ${path})`);
+		active.add(value);
+	}
+	try {
+		if (Array.isArray(value)) return value.map((entry, index) => snapshotValue(entry, active, `${path}[${index}]`));
+		if (value && typeof value === "object") {
+			const snapshot = {};
+			for (const [key, entry] of Object.entries(value)) snapshot[key] = snapshotValue(entry, active, `${path}.${key}`);
+			return snapshot;
+		}
+		return value;
+	} finally {
+		if (value && typeof value === "object") active.delete(value);
+	}
+}
+function snapshotLegacyDescriptor(descriptor, semantics) {
+	return snapshotValue({
+		...descriptor,
+		effect: semantics.effect,
+		idempotent: semantics.idempotent,
+		openWorld: semantics.openWorld,
+		readOnly: semantics.effect === "read",
+		route: snapshotRoute(descriptor.route)
+	});
+}
+function snapshotLegacyDefinition(definition) {
+	const snapshot = snapshotValue({
+		...definition,
+		actions: [...definition.actions]
+	});
+	snapshot.toolDescriptors = snapshot.toolDescriptors?.map((descriptor) => snapshotLegacyDescriptor(descriptor, actionSemantics(descriptor.action, descriptor)));
+	return snapshot;
+}
+function snapshotCanonicalDefinition(definition, semantics) {
+	return snapshotValue({
+		...definition,
+		effect: semantics.effect,
+		idempotent: semantics.idempotent,
+		openWorld: semantics.openWorld,
+		readOnly: semantics.effect === "read",
+		route: snapshotRoute(definition.route)
+	});
+}
+function validateProspectiveTools(tools, maxTools) {
+	if (maxTools !== void 0 && tools.length > maxTools) throw new Error(`WebMCP tool budget exceeded: ${tools.length} tools selected, maximum is ${maxTools}`);
+	const names = /* @__PURE__ */ new Set();
+	const identities = /* @__PURE__ */ new Set();
+	for (const tool of tools) {
+		if (names.has(tool.name)) throw new Error(`Duplicate WebMCP tool name: ${tool.name}`);
+		names.add(tool.name);
+		if (identities.has(tool.identity)) throw new Error(`Duplicate WebMCP tool identity: ${tool.identity}`);
+		identities.add(tool.identity);
+	}
+}
+function annotationsFor(tool) {
+	return {
+		readOnlyHint: tool.effect === "read",
+		destructiveHint: tool.destructive,
+		idempotentHint: tool.idempotent,
+		openWorldHint: tool.openWorld,
+		untrustedContentHint: true
+	};
+}
+function guardedExecute(tool, allowedEffects, isDisposed, execute) {
+	return (args) => {
+		if (isDisposed()) throw new Error(`WebMCP tool ${tool.name} is no longer registered`);
+		if (!allowedEffects.has(tool.effect)) throw new Error(`WebMCP policy no longer allows ${tool.effect} tool ${tool.name}`);
+		return execute(args ?? {});
+	};
+}
+function isCanonicalToolDefinition(definition) {
+	return "collection" in definition && "readOnly" in definition;
 }
 function requireId(args, action) {
 	const id = args.id;
@@ -1748,7 +2395,7 @@ function listParams(args) {
 	if (args.where !== void 0) params.where = args.where;
 	return params;
 }
-async function dispatch(fetchers, collection, definition, action, route, args) {
+async function dispatchCollection(fetchers, collection, definition, action, route, args) {
 	switch (action) {
 		case "list": {
 			const rows = unwrapListResult(await fetchers.list(listParams(args)), definition.name);
@@ -1789,6 +2436,45 @@ async function dispatch(fetchers, collection, definition, action, route, args) {
 			return JSON.stringify(await collection.action(action, args, route));
 	}
 }
+async function dispatchDirect(fetchers, definition, args, client) {
+	let result;
+	switch (definition.action) {
+		case "list":
+			if (!fetchers.list) throw new Error(`${definition.collection} has no list action`);
+			result = unwrapListResult(await fetchers.list(listParams(args)), definition.collection);
+			break;
+		case "get":
+			if (!fetchers.get) throw new Error(`${definition.collection} has no get action`);
+			result = unwrapItemResult(await fetchers.get(requireIdentifier(args)), `get(${definition.collection})`);
+			break;
+		case "create":
+			if (!fetchers.create) throw new Error(`${definition.collection} has no create action`);
+			result = unwrapItemResult(await fetchers.create(args), `create(${definition.collection})`);
+			break;
+		case "update": {
+			if (!fetchers.update) throw new Error(`${definition.collection} has no update action`);
+			const id = requireId(args, "update");
+			const { id: _id, ...body } = args;
+			result = unwrapItemResult(await fetchers.update(id, body), `update(${definition.collection})`);
+			break;
+		}
+		case "delete": {
+			if (!fetchers.delete) throw new Error(`${definition.collection} has no delete action`);
+			const id = requireId(args, "delete");
+			throwIfSmrtWebError(await fetchers.delete(id), `delete(${definition.collection})`);
+			result = {
+				success: true,
+				id
+			};
+			break;
+		}
+		default:
+			if (!fetchers.custom) throw new Error(`${definition.collection} has no custom action fetcher`);
+			result = throwIfSmrtWebError(await fetchers.custom(definition.action, args, definition.route), `${definition.action}(${definition.collection})`);
+	}
+	if (!definition.readOnly && client) invalidateSmrtWebCollections(client, [definition.collection, ...definition.relationships.map((relationship) => relationship.relatedCollection)]);
+	return JSON.stringify(result);
+}
 async function settleTransaction(transaction, collection, key, fallback) {
 	await transaction.isPersisted.promise;
 	const persisted = persistedMutationResults.get(collection)?.get(key);
@@ -1837,23 +2523,34 @@ function createHttpRequestError(collectionName, status, payload) {
 	return new SmrtWebRequestError(`[smrt-web] ${collectionName} request failed: ${detail.message ?? `HTTP ${status}`}`, payload, status, detail.code);
 }
 function unwrapListResult(result, collectionName) {
+	throwIfSmrtWebError(result, `list(${collectionName})`);
 	if (Array.isArray(result)) return result;
 	if (result && typeof result === "object") {
 		const record = result;
-		if (typeof record.error === "string") throw new SmrtWebRequestError(`[smrt-web] list(${collectionName}) failed: ${record.error}`, result);
 		if (Array.isArray(record.data)) return record.data;
 	}
 	throw new SmrtWebRequestError(`[smrt-web] list(${collectionName}) returned an unexpected payload shape`, result);
 }
 function unwrapItemResult(result, context) {
+	throwIfSmrtWebError(result, context);
 	if (result && typeof result === "object" && !Array.isArray(result)) {
 		const record = result;
-		if (typeof record.error === "string") throw new SmrtWebRequestError(`[smrt-web] ${context} failed: ${record.error}`, result);
 		if (record.data && typeof record.data === "object" && !Array.isArray(record.data)) return record.data;
 		return record;
 	}
 	throw new SmrtWebRequestError(`[smrt-web] ${context} returned an unexpected payload shape`, result);
 }
+function throwIfSmrtWebError(result, context) {
+	if (!result || typeof result !== "object" || Array.isArray(result)) return result;
+	const error = result.error;
+	if (typeof error === "string") throw new SmrtWebRequestError(`[smrt-web] ${context} failed: ${error}`, result);
+	if (!error || typeof error !== "object" || Array.isArray(error)) return result;
+	const failure = error;
+	if (failure.ok !== false || typeof failure.code !== "string" || typeof failure.message !== "string") return result;
+	const status = typeof failure.status === "number" && Number.isInteger(failure.status) && failure.status >= 400 && failure.status <= 599 ? failure.status : void 0;
+	if (status !== void 0 && status >= 500) throw new SmrtWebRequestError(`[smrt-web] ${context} failed: server error`, void 0, status);
+	throw new SmrtWebRequestError(`[smrt-web] ${context} failed: ${failure.message}`, result, status, failure.code);
+}
 var SMRT_TO_REST_OPERATOR = {
 	">": "gt",
 	">=": "gte",
@@ -1955,12 +2652,12 @@ function createDefinitionFetchers(definition, basePath = "/api/v1", fetchFn = (.
 			if (customRoute.method !== "GET") init.body = JSON.stringify(body);
 			else {
 				const queryParams = new URLSearchParams();
-				if (optionsBag) if (optionsValue === void 0) queryParams.set(CUSTOM_OPTIONS_QUERY_MARKER, "undefined");
-				else if (optionsValue === null) queryParams.set(CUSTOM_OPTIONS_QUERY_MARKER, "null");
+				if (optionsBag) if (optionsValue === void 0 && pathArgs.size === 0) queryParams.set(CUSTOM_OPTIONS_QUERY_MARKER, "undefined");
+				else if (optionsValue === null && pathArgs.size === 0) queryParams.set(CUSTOM_OPTIONS_QUERY_MARKER, "null");
 				else {
-					const entries = Object.entries(typeof optionsValue === "object" && !Array.isArray(optionsValue) ? optionsValue : {}).filter(([, value]) => value !== void 0 && value !== null);
+					const entries = Object.entries(optionsValue !== null && typeof optionsValue === "object" && !Array.isArray(optionsValue) ? optionsValue : {}).filter(([, value]) => value !== void 0 && value !== null);
 					for (const [key, value] of entries) queryParams.set(key, typeof value === "object" ? JSON.stringify(value) : String(value));
-					if (entries.length === 0) queryParams.set(CUSTOM_OPTIONS_QUERY_MARKER, "object");
+					if (entries.length === 0 && pathArgs.size === 0) queryParams.set(CUSTOM_OPTIONS_QUERY_MARKER, "object");
 				}
 				else {
 					const queryBody = body !== null && typeof body === "object" && !Array.isArray(body) ? body : {};
@@ -1981,18 +2678,36 @@ function newLocalId() {
 	if (cryptoRef?.randomUUID) return cryptoRef.randomUUID();
 	return `local-${Date.now()}-${Math.random().toString(36).slice(2)}`;
 }
+var smrtWebClientHandles = /* @__PURE__ */ new WeakSet();
 function createSmrtWebClient() {
-	return {
+	const engine = {
 		__smrtWebClient: "SmrtWebClient",
 		queryClient: new QueryClient()
 	};
+	smrtWebClientHandles.add(engine);
+	return engine;
 }
 function resolveQueryClient(client) {
 	if (!client) return new QueryClient();
 	const engine = client;
-	if (engine.__smrtWebClient !== "SmrtWebClient" || !engine.queryClient) throw new SmrtWebRequestError("[smrt-web] options.client must be a handle from createSmrtWebClient()");
+	if (!smrtWebClientHandles.has(engine) || engine.__smrtWebClient !== "SmrtWebClient" || !engine.queryClient) throw new SmrtWebRequestError("[smrt-web] options.client must be a handle from createSmrtWebClient()");
 	return engine.queryClient;
 }
+function validateSmrtWebClient(client) {
+	resolveQueryClient(client);
+}
+function invalidateCollectionQueries(queryClient, collectionNames) {
+	if (collectionNames.size === 0) return;
+	queryClient.invalidateQueries({ predicate: (query) => {
+		const key = query.queryKey;
+		if (!Array.isArray(key) || key.length === 0) return false;
+		const collectionSegment = key[key.length - 1];
+		return typeof collectionSegment === "string" && collectionNames.has(collectionSegment);
+	} });
+}
+function invalidateSmrtWebCollections(client, collectionNames) {
+	invalidateCollectionQueries(resolveQueryClient(client), new Set(collectionNames));
+}
 function toPlainRow(row) {
 	const plain = {};
 	for (const [key, value] of Object.entries(row)) if (key.charCodeAt(0) !== 36) plain[key] = value;
@@ -2041,12 +2756,7 @@ function createSmrtCollection(definition, options) {
 	const invalidationTargets = /* @__PURE__ */ new Set([definition.name]);
 	for (const relationship of definition.relationships ?? []) invalidationTargets.add(relationship.relatedCollection);
 	const invalidateRelated = () => {
-		queryClient.invalidateQueries({ predicate: (query) => {
-			const key = query.queryKey;
-			if (!Array.isArray(key) || key.length === 0) return false;
-			const collectionSegment = key[key.length - 1];
-			return typeof collectionSegment === "string" && invalidationTargets.has(collectionSegment);
-		} });
+		invalidateCollectionQueries(queryClient, invalidationTargets);
 	};
 	const ctx = {
 		definition,
@@ -2210,7 +2920,7 @@ function createSmrtCollection(definition, options) {
 					data: {},
 					baseUpdatedAt: getBaseUpdatedAt(mutation.original)
 				};
-				const outcome = await persistMutation(envelope, async () => fetchers.delete(key));
+				const outcome = await persistMutation(envelope, async () => throwIfSmrtWebError(await fetchers.delete(key), `delete(${definition.name})`));
 				mutationResults.set(envelope.key, outcome.result);
 				anyHandled = anyHandled || outcome.handled;
 			}
@@ -2269,6 +2979,7 @@ function createSmrtCollection(definition, options) {
 		async action(action, args, route) {
 			if (!fetchers.custom) throw new Error(`${definition.name} has no custom action fetcher`);
 			const result = route === void 0 ? await fetchers.custom(action, args) : await fetchers.custom(action, args, route);
+			throwIfSmrtWebError(result, `${action}(${definition.name})`);
 			invalidateRelated();
 			return result;
 		}
@@ -2287,6 +2998,6 @@ function createSmrtCollection(definition, options) {
 	return handle;
 }
 //#endregion
-export { executeSmrtWebDataQuery as A, MAX_SMRT_WEB_DATA_QUERY_FACET_VALUES as C, MAX_SMRT_WEB_DATA_QUERY_ROWS as D, MAX_SMRT_WEB_DATA_QUERY_RESULT_BYTES as E, runWrapMutation as M, MAX_SMRT_WEB_DATA_QUERY_STRING_LENGTH as O, MAX_SMRT_WEB_DATA_QUERY_FACETS as S, MAX_SMRT_WEB_DATA_QUERY_PAGE_LIMIT as T, offlineOutbox as _, createSmrtWebClient as a, wipeDurableStore as b, unwrapItemResult as c, createUpdateState as d, createSmrtWebEventSubscriber as f, getOutboxHandle as g, persistCollection as h, createSmrtCollection as i, normalizeSmrtWebDataQueryResult as j, MAX_SMRT_WEB_DATA_QUERY_WARNINGS as k, unwrapListResult as l, DEFAULT_PERSIST_DEBOUNCE_MS as m, buildListQuery as n, getEngineCollection as o, liveInvalidation as p, createDefinitionFetchers as r, newLocalId as s, SmrtWebRequestError as t, registerWebMcpTools as u, durableStoreNamespace as v, MAX_SMRT_WEB_DATA_QUERY_OFFSET as w, MAX_SMRT_WEB_DATA_QUERY_CONTAINER_ITEMS as x, registerDurableResource as y };
+export { MAX_SMRT_WEB_DATA_QUERY_RESULT_BYTES as A, registerDurableResource as C, MAX_SMRT_WEB_DATA_QUERY_FACET_VALUES as D, MAX_SMRT_WEB_DATA_QUERY_FACETS as E, normalizeSmrtWebDataQueryResult as F, runWrapMutation as I, MAX_SMRT_WEB_DATA_QUERY_STRING_LENGTH as M, MAX_SMRT_WEB_DATA_QUERY_WARNINGS as N, MAX_SMRT_WEB_DATA_QUERY_OFFSET as O, executeSmrtWebDataQuery as P, durableStoreNamespace as S, MAX_SMRT_WEB_DATA_QUERY_CONTAINER_ITEMS as T, createSmrtWebQuery as _, createSmrtWebClient as a, getOutboxHandle as b, newLocalId as c, unwrapListResult as d, validateSmrtWebClient as f, liveInvalidation as g, createSmrtWebEventSubscriber as h, createSmrtCollection as i, MAX_SMRT_WEB_DATA_QUERY_ROWS as j, MAX_SMRT_WEB_DATA_QUERY_PAGE_LIMIT as k, throwIfSmrtWebError as l, createUpdateState as m, buildListQuery as n, getEngineCollection as o, registerWebMcpTools as p, createDefinitionFetchers as r, invalidateSmrtWebCollections as s, SmrtWebRequestError as t, unwrapItemResult as u, DEFAULT_PERSIST_DEBOUNCE_MS as v, wipeDurableStore as w, offlineOutbox as x, persistCollection as y };
 
-//# sourceMappingURL=src-CDdW9uYx.js.map
+//# sourceMappingURL=src-n14q6RHC.js.map