@havesomecode/kibana-mcp-server 1.3.1 → 1.4.1

package/dist/src/profiles/context.js

@@ -0,0 +1,15 @@
+import { AsyncLocalStorage } from "node:async_hooks";
+const profileRuntimeStorage = new AsyncLocalStorage();
+export function runWithProfileRuntime(runtime, operation) {
+    return profileRuntimeStorage.run(runtime, operation);
+}
+export function getProfileRuntime() {
+    return profileRuntimeStorage.getStore();
+}
+export function requireProfileRuntime() {
+    const runtime = profileRuntimeStorage.getStore();
+    if (!runtime) {
+        throw new Error("No profile is bound to the current tool call.");
+    }
+    return runtime;
+}

package/dist/src/profiles/names.d.ts

@@ -0,0 +1,10 @@
+/**
+ * Normalizes a profile name supplied by the transport identity or the startup configuration.
+ */
+export declare function normalizeProfileName(value: string): string;
+/**
+ * Derives a filesystem-safe key from a profile name. Names that are not already a plain slug get a
+ * digest suffix. Literal names ending in that suffix are hashed too, reserving the generated
+ * namespace so that they cannot impersonate another identity's key.
+ */
+export declare function toProfileKey(profileName: string): string;

package/dist/src/profiles/names.js

@@ -0,0 +1,35 @@
+import { createHash } from "node:crypto";
+const MAX_PROFILE_NAME_LENGTH = 256;
+const MAX_PROFILE_SLUG_LENGTH = 64;
+/**
+ * Normalizes a profile name supplied by the transport identity or the startup configuration.
+ */
+export function normalizeProfileName(value) {
+    const name = value.trim();
+    if (!name) {
+        throw new Error("Profile name must not be empty.");
+    }
+    if (name.length > MAX_PROFILE_NAME_LENGTH) {
+        throw new Error(`Profile name must not exceed ${MAX_PROFILE_NAME_LENGTH} characters.`);
+    }
+    return name;
+}
+/**
+ * Derives a filesystem-safe key from a profile name. Names that are not already a plain slug get a
+ * digest suffix. Literal names ending in that suffix are hashed too, reserving the generated
+ * namespace so that they cannot impersonate another identity's key.
+ */
+export function toProfileKey(profileName) {
+    const name = normalizeProfileName(profileName);
+    const slug = name
+        .toLowerCase()
+        .replace(/[^a-z0-9]+/g, "-")
+        .replace(/^-+|-+$/g, "")
+        .slice(0, MAX_PROFILE_SLUG_LENGTH)
+        .replace(/-+$/g, "");
+    if (slug === name && !/-[a-f0-9]{12}$/.test(name)) {
+        return slug;
+    }
+    const digest = createHash("sha256").update(name).digest("hex").slice(0, 12);
+    return `${slug || "profile"}-${digest}`;
+}

package/dist/src/profiles/paths.d.ts

@@ -0,0 +1,9 @@
+export declare const MACHINE_STATE_DIR_ENV = "KIBANA_STATE_DIR";
+export declare const APP_STATE_DIRECTORY_NAME = "kibana-mcp-server";
+export interface ProfilePaths {
+    stateRoot: string;
+    profilesPath: string;
+    sourceCatalogsDir: string;
+}
+export declare function resolveMachineStateRoot(envInput?: NodeJS.ProcessEnv, platform?: NodeJS.Platform, homeDirectory?: string): string;
+export declare function resolveProfilePaths(envInput?: NodeJS.ProcessEnv, platform?: NodeJS.Platform, homeDirectory?: string): ProfilePaths;

package/dist/src/profiles/runtime.d.ts

@@ -0,0 +1,43 @@
+import { KibanaClient } from "../kibana/client.js";
+import { SchemaCatalog } from "../kibana/schema_catalog.js";
+import { SourceCatalog } from "../kibana/source_catalog.js";
+import type { AppConfig, ResolvedAppConfig, SourceDefinition } from "../types.js";
+export type ProfileConfigLoader = (profileName: string) => Promise<ResolvedAppConfig>;
+export interface ProfileRuntime {
+    config: ResolvedAppConfig;
+    sourceCatalog: SourceCatalog;
+    kibanaClient: KibanaClient;
+    schemaCatalog: SchemaCatalog;
+    /** Content of the store-backed catalog the sources were last built from. */
+    catalogContent?: string;
+}
+export interface ProfileRuntimeRegistryOptions {
+    defaultConfig?: ResolvedAppConfig;
+    defaultKibanaClient?: KibanaClient;
+    loadProfileConfig?: ProfileConfigLoader;
+    kibanaClientFactory?: (config: AppConfig["kibana"]) => KibanaClient;
+    maxProfiles?: number;
+}
+export declare class ProfileRuntimeRegistry {
+    private readonly kibanaClientFactory;
+    private readonly loadProfileConfig?;
+    private readonly maxProfiles;
+    private readonly runtimes;
+    private readonly inFlight;
+    private readonly clients;
+    private readonly refreshes;
+    private defaultRuntime?;
+    constructor(options?: ProfileRuntimeRegistryOptions);
+    get hasDefault(): boolean;
+    get supportsNamedProfiles(): boolean;
+    /** False only for a server started without any configuration, waiting for the legacy 'configure' tool. */
+    get isConfigured(): boolean;
+    getDefault(): ProfileRuntime | undefined;
+    setDefault(config: ResolvedAppConfig): ProfileRuntime;
+    resolve(profileName?: string): Promise<ProfileRuntime>;
+    private refresh;
+    replaceSources(runtime: ProfileRuntime, sources: SourceDefinition[], catalogContent?: string | undefined): void;
+    private createRuntime;
+    private clientFor;
+    private evictLeastRecentlyUsed;
+}

package/dist/src/profiles/runtime.js

@@ -0,0 +1,150 @@
+import { createHash } from "node:crypto";
+import { sourceCatalogSchema } from "../config/environment.js";
+import { KibanaClient } from "../kibana/client.js";
+import { SchemaCatalog } from "../kibana/schema_catalog.js";
+import { SourceCatalog } from "../kibana/source_catalog.js";
+import { normalizeProfileName } from "./names.js";
+const DEFAULT_MAX_PROFILES = 200;
+export class ProfileRuntimeRegistry {
+    kibanaClientFactory;
+    loadProfileConfig;
+    maxProfiles;
+    runtimes = new Map();
+    inFlight = new Map();
+    clients = new Map();
+    refreshes = new WeakMap();
+    defaultRuntime;
+    constructor(options = {}) {
+        this.kibanaClientFactory =
+            options.kibanaClientFactory ?? ((config) => new KibanaClient(config));
+        this.loadProfileConfig = options.loadProfileConfig;
+        this.maxProfiles = options.maxProfiles ?? DEFAULT_MAX_PROFILES;
+        if (options.defaultConfig) {
+            this.defaultRuntime = this.createRuntime(options.defaultConfig, options.defaultKibanaClient);
+        }
+    }
+    get hasDefault() {
+        return this.defaultRuntime !== undefined;
+    }
+    get supportsNamedProfiles() {
+        return this.loadProfileConfig !== undefined;
+    }
+    /** False only for a server started without any configuration, waiting for the legacy 'configure' tool. */
+    get isConfigured() {
+        return this.hasDefault || this.supportsNamedProfiles;
+    }
+    getDefault() {
+        return this.defaultRuntime;
+    }
+    setDefault(config) {
+        this.defaultRuntime = this.createRuntime(config);
+        return this.defaultRuntime;
+    }
+    async resolve(profileName) {
+        if (profileName === undefined) {
+            if (this.defaultRuntime) {
+                return this.refresh(this.defaultRuntime);
+            }
+            throw new Error(this.loadProfileConfig
+                ? "No profile was supplied for this call and no default profile is configured."
+                : "Server is not configured. Call the 'configure' tool first.");
+        }
+        // Names are compared exactly: two identities differing only by case are two profiles, each
+        // with its own catalog.
+        const key = normalizeProfileName(profileName);
+        if (this.defaultRuntime?.config.profileName === key) {
+            return this.refresh(this.defaultRuntime);
+        }
+        if (!this.loadProfileConfig) {
+            throw new Error("Profile selection is not available on this server.");
+        }
+        const cached = this.runtimes.get(key);
+        if (cached) {
+            // Refresh recency for the least-recently-used eviction.
+            this.runtimes.delete(key);
+            this.runtimes.set(key, cached);
+            return this.refresh(cached);
+        }
+        const pending = this.inFlight.get(key);
+        if (pending) {
+            return this.refresh(await pending);
+        }
+        const loading = this.loadProfileConfig(key).then((config) => {
+            const runtime = this.createRuntime(config);
+            this.runtimes.set(key, runtime);
+            this.evictLeastRecentlyUsed();
+            return runtime;
+        });
+        this.inFlight.set(key, loading);
+        try {
+            return await this.refresh(await loading);
+        }
+        finally {
+            this.inFlight.delete(key);
+        }
+    }
+    // Store-backed catalogs are re-read on every call, so that every process sharing the store
+    // serves the same sources; the parsed catalog and schema cache are kept while it is unchanged.
+    async refresh(runtime) {
+        const catalog = runtime.config.catalog;
+        if (!catalog) {
+            return runtime;
+        }
+        const refresh = this.refreshes.get(runtime) ?? { started: 0, applied: 0 };
+        this.refreshes.set(runtime, refresh);
+        const generation = ++refresh.started;
+        const content = await catalog.read();
+        // Only an applied newer read or configure_index replacement supersedes this snapshot.
+        if (this.refreshes.get(runtime) !== refresh || generation < refresh.applied) {
+            return runtime;
+        }
+        if (content !== runtime.catalogContent) {
+            this.replaceSources(runtime, content === undefined
+                ? []
+                : sourceCatalogSchema.parse(JSON.parse(content)).sources, content);
+            // A refresh retains its generation; explicit replacements fence all pending reads.
+            this.refreshes.set(runtime, refresh);
+        }
+        refresh.applied = generation;
+        return runtime;
+    }
+    replaceSources(runtime, sources, catalogContent = runtime.catalogContent) {
+        this.refreshes.delete(runtime);
+        runtime.config = { ...runtime.config, sources };
+        runtime.catalogContent = catalogContent;
+        runtime.sourceCatalog = new SourceCatalog(sources);
+        runtime.schemaCatalog = new SchemaCatalog(runtime.kibanaClient);
+    }
+    createRuntime(config, kibanaClient) {
+        const client = kibanaClient ?? this.clientFor(config.kibana);
+        return {
+            config,
+            sourceCatalog: new SourceCatalog(config.sources),
+            kibanaClient: client,
+            schemaCatalog: new SchemaCatalog(client),
+        };
+    }
+    // Profiles that share one connection share one client, hence one backend concurrency budget.
+    clientFor(config) {
+        // Hashed so that the map does not keep credentials alive as keys.
+        const key = createHash("sha256")
+            .update(JSON.stringify([config.baseUrl, config.username, config.password, config.timeoutMs]))
+            .digest("hex");
+        const existing = this.clients.get(key);
+        if (existing) {
+            return existing;
+        }
+        const client = this.kibanaClientFactory(config);
+        this.clients.set(key, client);
+        return client;
+    }
+    evictLeastRecentlyUsed() {
+        while (this.runtimes.size > this.maxProfiles) {
+            const oldest = this.runtimes.keys().next().value;
+            if (oldest === undefined) {
+                return;
+            }
+            this.runtimes.delete(oldest);
+        }
+    }
+}

package/dist/src/profiles/secret_store.d.ts

@@ -0,0 +1,20 @@
+import type { SavedSecret } from "../types.js";
+export declare class SecretStoreError extends Error {
+    readonly code: "UNAVAILABLE" | "NOT_FOUND" | "OPERATION_FAILED";
+    constructor(message: string, code: "UNAVAILABLE" | "NOT_FOUND" | "OPERATION_FAILED");
+}
+export interface SecretStore {
+    load(profileId: string): Promise<SavedSecret>;
+    save(profileId: string, secret: SavedSecret): Promise<void>;
+    delete(profileId: string): Promise<void>;
+}
+interface CommandResult {
+    stdout: string;
+    stderr: string;
+    exitCode: number;
+}
+type CommandRunner = (command: string, args: string[], options?: {
+    stdin?: string;
+}) => Promise<CommandResult>;
+export declare function createSecretStore(platform?: NodeJS.Platform, runner?: CommandRunner, serviceName?: string): SecretStore;
+export {};

package/dist/src/profiles/state_lock.d.ts

@@ -0,0 +1,13 @@
+export interface StateLockOptions {
+    signal?: AbortSignal;
+    /** Override the directory name for a catalog-specific lock in the same parent directory. */
+    lockName?: string;
+    timeoutMs?: number;
+    staleMs?: number;
+    retryMs?: number;
+    reclaimGraceMs?: number;
+    releaseGraceMs?: number;
+    releaseTimeoutMs?: number;
+    heartbeatMs?: number;
+}
+export declare function acquireStateLock(stateRoot: string, options?: StateLockOptions): Promise<() => Promise<void>>;

package/dist/src/{state_lock.js → profiles/state_lock.js}

@@ -1,12 +1,14 @@
 import { randomUUID } from "node:crypto";
 import { mkdir, open, readFile, readdir, rename, rm, stat, utimes, writeFile, } from "node:fs/promises";
 import { join } from "node:path";
+import { setTimeout as delay } from "node:timers/promises";
 const DEFAULT_TIMEOUT_MS = 30000;
 const DEFAULT_STALE_MS = 5 * 60 * 1000;
 const DEFAULT_RETRY_MS = 50;
 const DEFAULT_RECLAIM_GRACE_MS = 25;
 const LOCK_DIRECTORY_NAME = ".state.lock";
 export async function acquireStateLock(stateRoot, options = {}) {
+    options.signal?.throwIfAborted();
     const timeoutMs = options.timeoutMs ?? DEFAULT_TIMEOUT_MS;
     const staleMs = options.staleMs ?? DEFAULT_STALE_MS;
     const retryMs = options.retryMs ?? DEFAULT_RETRY_MS;
@@ -14,10 +16,11 @@ export async function acquireStateLock(stateRoot, options = {}) {
     const releaseGraceMs = options.releaseGraceMs ?? 0;
     const releaseTimeoutMs = options.releaseTimeoutMs ?? Math.max(1000, reclaimGraceMs * 4);
     const startedAt = Date.now();
-    const lockPath = join(stateRoot, LOCK_DIRECTORY_NAME);
+    const lockName = options.lockName ?? LOCK_DIRECTORY_NAME;
+    const lockPath = join(stateRoot, lockName);
     const ownerPath = join(lockPath, "owner.json");
     const token = randomUUID();
-    const pendingPath = join(stateRoot, `${LOCK_DIRECTORY_NAME}.${token}.pending`);
+    const pendingPath = join(stateRoot, `${lockName}.${token}.pending`);
     const pendingOwnerPath = join(pendingPath, "owner.json");
     const owner = {
         token,
@@ -32,6 +35,7 @@ export async function acquireStateLock(stateRoot, options = {}) {
             mode: 0o600,
         });
         while (true) {
+            options.signal?.throwIfAborted();
             try {
                 await rename(pendingPath, lockPath);
             }
@@ -41,7 +45,7 @@ export async function acquireStateLock(stateRoot, options = {}) {
                 if (!(await lockExists(lockPath))) {
                     if (Date.now() - startedAt >= timeoutMs)
                         throw error;
-                    await sleep(retryMs);
+                    await delay(retryMs, undefined, { signal: options.signal });
                     continue;
                 }
                 if (await tryReclaimStaleLock(lockPath, ownerPath, staleMs, token, reclaimGraceMs)) {
@@ -50,7 +54,7 @@ export async function acquireStateLock(stateRoot, options = {}) {
                 if (Date.now() - startedAt >= timeoutMs) {
                     throw new Error(`Timed out waiting for another Kibana MCP setup process to release '${lockPath}'.`);
                 }
-                await sleep(retryMs);
+                await delay(retryMs, undefined, { signal: options.signal });
                 continue;
             }
             const heartbeatMs = options.heartbeatMs ?? Math.min(30000, Math.max(1000, Math.floor(staleMs / 3)));
@@ -62,13 +66,18 @@ export async function acquireStateLock(stateRoot, options = {}) {
                     .catch(() => { });
             }, heartbeatMs);
             heartbeat.unref();
-            return async () => {
+            const release = async () => {
                 clearInterval(heartbeat);
                 await heartbeatInFlight;
                 // The critical section has already committed or rolled back. Release is best effort;
                 // lease recovery handles any remaining lock without changing that outcome.
                 await releaseOwnedLock(lockPath, ownerPath, token, staleMs, retryMs, reclaimGraceMs, releaseGraceMs, releaseTimeoutMs).catch(() => { });
             };
+            if (options.signal?.aborted) {
+                await release();
+                options.signal.throwIfAborted();
+            }
+            return release;
         }
     }
     catch (error) {

package/dist/src/profiles/store.d.ts

@@ -0,0 +1,34 @@
+import { mkdir, readFile, writeFile } from "node:fs/promises";
+import type { SavedProfile, SavedProfileStoreState } from "../types.js";
+import { type ProfilePaths } from "./paths.js";
+export interface UpsertProfileInput {
+    id?: string;
+    name: string;
+    baseUrl: string;
+    timeoutMs: number;
+    sourceCatalogPath: string;
+}
+export declare class ProfileStore {
+    private readonly paths;
+    private readonly io;
+    constructor(paths?: ProfilePaths, io?: {
+        readFile?: typeof readFile;
+        writeFile?: typeof writeFile;
+        mkdir?: typeof mkdir;
+    });
+    load(): Promise<SavedProfileStoreState>;
+    listProfiles(): Promise<SavedProfile[]>;
+    getDefaultProfile(): Promise<SavedProfile | null>;
+    findProfile(query: string, options?: {
+        exactName?: boolean;
+    }): Promise<SavedProfile | null>;
+    upsertProfile(input: UpsertProfileInput, options?: {
+        makeDefault?: boolean;
+        now?: Date;
+    }): Promise<SavedProfile>;
+    setDefaultProfile(profileId: string): Promise<void>;
+    replaceState(state: SavedProfileStoreState): Promise<void>;
+    private save;
+}
+export declare function normalizeProfileId(name: string): string;
+export declare function deriveProfileId(name: string, existingIds: string[]): string;

package/dist/src/{profile_store.js → profiles/store.js}

@@ -2,7 +2,7 @@ import { randomUUID } from "node:crypto";
 import { mkdir, readFile, rename, rm, writeFile } from "node:fs/promises";
 import { dirname } from "node:path";
 import { z } from "zod";
-import { resolveProfilePaths } from "./profile_paths.js";
+import { resolveProfilePaths } from "./paths.js";
 const PROFILE_STORE_VERSION = 1;
 const savedProfileSchema = z.object({
     id: z.string().min(1),
@@ -52,14 +52,16 @@ export class ProfileStore {
         }
         return state.profiles.find((profile) => profile.id === state.defaultProfileId) ?? null;
     }
-    async findProfile(query) {
-        const normalizedQuery = query.trim().toLowerCase();
+    async findProfile(query, options = {}) {
+        const normalizedQuery = options.exactName ? query.trim() : query.trim().toLowerCase();
         if (!normalizedQuery) {
             return null;
         }
         const state = await this.load();
-        return (state.profiles.find((profile) => profile.id.toLowerCase() === normalizedQuery ||
-            profile.name.toLowerCase() === normalizedQuery) ?? null);
+        return (state.profiles.find((profile) => options.exactName
+            ? profile.name === normalizedQuery
+            : profile.id.toLowerCase() === normalizedQuery ||
+                profile.name.toLowerCase() === normalizedQuery) ?? null);
     }
     async upsertProfile(input, options = {}) {
         const state = await this.load();

package/dist/src/query/compiler.d.ts

@@ -0,0 +1,9 @@
+import type { QueryPlan, QueryRequest, SourceDefinition, SourceFieldDescriptor } from "../types.js";
+interface CompileQueryOptions {
+    resolveFieldAliases?: boolean;
+    resolvePreferredExactFields?: boolean;
+    sourceSchemas?: Map<string, SourceFieldDescriptor[]>;
+    sourceSchemaErrors?: Map<string, string>;
+}
+export declare function compileQueryPlan(request: QueryRequest, sources: SourceDefinition[], options?: CompileQueryOptions): QueryPlan;
+export {};

package/dist/src/query/cursor.d.ts

@@ -0,0 +1,8 @@
+export interface QueryCursorPayload {
+    source_id: string;
+    sort: "asc" | "desc";
+    sort_by: string;
+    values: unknown[];
+}
+export declare function encodeQueryCursor(payload: QueryCursorPayload): string;
+export declare function decodeQueryCursor(cursor: string): QueryCursorPayload;

package/dist/src/query/normalize.d.ts

@@ -0,0 +1,2 @@
+import type { KibanaSearchExecutionResult, QueryPlan, QueryStructuredResponse } from "../types.js";
+export declare function normalizeQueryResponse(plan: QueryPlan, executions: KibanaSearchExecutionResult[]): QueryStructuredResponse;

package/dist/src/server.d.ts

@@ -0,0 +1,29 @@
+import { McpServer } from "@modelcontextprotocol/server";
+import { type KibanaClient } from "./kibana/client.js";
+import { ProfileRuntimeRegistry } from "./profiles/runtime.js";
+import { executeConfigure } from "./tools/configure.js";
+import { executeConfigureIndex } from "./tools/configure_index.js";
+import { executeDescribeFields } from "./tools/describe_fields.js";
+import { executeDiscover } from "./tools/discover.js";
+import { executeFilter } from "./tools/filter.js";
+import { executeQuery } from "./tools/query.js";
+import type { AppConfig } from "./types.js";
+import type { ResolvedAppConfig } from "./types.js";
+export interface Application {
+    server: McpServer;
+    handlers: {
+        configure: (input: unknown) => Promise<Awaited<ReturnType<typeof executeConfigure>>["result"]>;
+        configure_index: (input: unknown, callerSignal?: AbortSignal) => Promise<Awaited<ReturnType<typeof executeConfigureIndex>>["result"]>;
+        describe_fields: (input: unknown, callerSignal?: AbortSignal) => Promise<Awaited<ReturnType<typeof executeDescribeFields>>>;
+        discover: (input: unknown) => Promise<ReturnType<typeof executeDiscover>>;
+        filter: (input: unknown, callerSignal?: AbortSignal) => ReturnType<typeof executeFilter>;
+        query: (input: unknown, callerSignal?: AbortSignal) => ReturnType<typeof executeQuery>;
+    };
+}
+export declare function createApplication(initialConfig?: ResolvedAppConfig, dependencies?: {
+    kibanaClient?: KibanaClient;
+    kibanaClientFactory?: (config: AppConfig["kibana"]) => KibanaClient;
+    configureIndexFn?: typeof executeConfigureIndex;
+    profileRegistry?: ProfileRuntimeRegistry;
+    requestProfile?: string;
+}): Application;

package/dist/src/server.js

@@ -1,7 +1,7 @@
 import { McpServer } from "@modelcontextprotocol/server";
-import { KibanaClient, KibanaRequestError } from "./kibana_client.js";
-import { SchemaCatalog } from "./schema_catalog.js";
-import { SourceCatalog } from "./source_catalog.js";
+import { KibanaRequestError } from "./kibana/client.js";
+import { requireProfileRuntime, runWithProfileRuntime } from "./profiles/context.js";
+import { ProfileRuntimeRegistry } from "./profiles/runtime.js";
 import { configureInputSchema, configureOutputSchema, createConfigureCallToolResult, executeConfigure, } from "./tools/configure.js";
 import { configureIndexInputSchema, configureIndexOutputSchema, createConfigureIndexCallToolResult, executeConfigureIndex, } from "./tools/configure_index.js";
 import { createDescribeFieldsCallToolResult, describeFieldsInputSchema, describeFieldsOutputSchema, executeDescribeFields, } from "./tools/describe_fields.js";
@@ -37,19 +37,19 @@ export function createApplication(initialConfig, dependencies) {
         name: "kibana-log-investigation",
         version: "0.1.0",
     });
-    const kibanaClientFactory = dependencies?.kibanaClientFactory ??
-        ((config) => new KibanaClient(config));
-    let activeConfig = initialConfig;
-    let sourceCatalog = activeConfig ? new SourceCatalog(activeConfig.sources) : null;
-    let kibanaClient = activeConfig
-        ? (dependencies?.kibanaClient ?? kibanaClientFactory(activeConfig.kibana))
-        : null;
-    let schemaCatalog = kibanaClient ? new SchemaCatalog(kibanaClient) : null;
+    const registry = dependencies?.profileRegistry ??
+        new ProfileRuntimeRegistry({
+            defaultConfig: initialConfig,
+            defaultKibanaClient: dependencies?.kibanaClient,
+            kibanaClientFactory: dependencies?.kibanaClientFactory,
+        });
+    // The profile is resolved once per tool call, then read back through the async context.
+    async function withProfile(operation) {
+        const runtime = await registry.resolve(dependencies?.requestProfile);
+        return runWithProfileRuntime(runtime, () => operation(runtime));
+    }
     async function withKibanaToolDeadline(callerSignal, operation) {
-        const timeoutMs = activeConfig?.kibana.timeoutMs;
-        if (timeoutMs === undefined) {
-            throw new Error("Server is not configured. Call the 'configure' tool first.");
-        }
+        const timeoutMs = requireProfileRuntime().config.kibana.timeoutMs;
         const timeoutSignal = AbortSignal.timeout(timeoutMs);
         const signal = callerSignal ? AbortSignal.any([callerSignal, timeoutSignal]) : timeoutSignal;
         try {
@@ -63,55 +63,45 @@ export function createApplication(initialConfig, dependencies) {
             throw new KibanaRequestError("KIBANA_TIMEOUT", requestError?.phase ?? "request", requestError?.sourceId, timeoutMs, `Kibana tool call exceeded its ${timeoutMs} ms backend deadline.`, error, requestError?.status, requestError?.causeCode);
         }
     }
-    function requireConfigured() {
-        if (!sourceCatalog || !kibanaClient || !schemaCatalog) {
-            throw new Error("Server is not configured. Call the 'configure' tool first.");
-        }
-        return { sourceCatalog, kibanaClient, schemaCatalog };
-    }
     const configureHandler = async (input) => {
+        const current = registry.getDefault()?.config;
         const { nextConfig, result } = await executeConfigure(configureInputSchema.parse(input), {
-            sourceCatalogPath: activeConfig?.sourceCatalogPath,
+            sourceCatalogPath: current?.sourceCatalogPath,
         });
-        activeConfig = {
+        registry.setDefault({
             ...nextConfig,
             sourceCatalogPath: result.source_catalog_path,
-            profileName: activeConfig?.profileName,
-            sourceCatalogOrigin: activeConfig?.sourceCatalogOrigin,
-        };
-        sourceCatalog = new SourceCatalog(nextConfig.sources);
-        kibanaClient = kibanaClientFactory(nextConfig.kibana);
-        schemaCatalog = new SchemaCatalog(kibanaClient);
+            profileName: current?.profileName,
+            sourceCatalogOrigin: current?.sourceCatalogOrigin,
+        });
         return result;
     };
     const configureIndexHandler = async (input, callerSignal) => {
-        if (!activeConfig || !kibanaClient) {
+        if (!registry.isConfigured) {
             throw new Error("No saved Kibana connection is available. Run connection bootstrap first.");
         }
-        const configured = activeConfig;
-        const client = kibanaClient;
         const configureIndexFn = dependencies?.configureIndexFn ?? executeConfigureIndex;
-        const { sources, result } = await withKibanaToolDeadline(callerSignal, (signal) => configureIndexFn(configureIndexInputSchema.parse(input), {
-            config: configured,
-            kibanaClient: client,
-            callerSignal: signal,
+        return withProfile((runtime) => withKibanaToolDeadline(callerSignal, async (signal) => {
+            const { sources, result, catalogContent } = await configureIndexFn(configureIndexInputSchema.parse(input), {
+                config: runtime.config,
+                kibanaClient: runtime.kibanaClient,
+                callerSignal: signal,
+            });
+            registry.replaceSources(runtime, sources, catalogContent);
+            return result;
         }));
-        activeConfig = { ...activeConfig, sources };
-        sourceCatalog = new SourceCatalog(sources);
-        schemaCatalog = new SchemaCatalog(client);
-        return result;
     };
-    const describeFieldsHandler = (input, callerSignal) => withKibanaToolDeadline(callerSignal, (signal) => executeDescribeFields(describeFieldsInputSchema.parse(input), requireConfigured().sourceCatalog, requireConfigured().schemaCatalog, signal));
-    const discoverHandler = (input) => executeDiscover(discoverInputSchema.parse(input), requireConfigured().sourceCatalog);
-    const filterHandler = (input, callerSignal) => withKibanaToolDeadline(callerSignal, (signal) => executeFilter(filterInputSchema.parse(input), requireConfigured().sourceCatalog, requireConfigured().kibanaClient, {
-        schemaCatalog: requireConfigured().schemaCatalog,
+    const describeFieldsHandler = (input, callerSignal) => withProfile((runtime) => withKibanaToolDeadline(callerSignal, (signal) => executeDescribeFields(describeFieldsInputSchema.parse(input), runtime.sourceCatalog, runtime.schemaCatalog, signal)));
+    const discoverHandler = (input) => withProfile((runtime) => executeDiscover(discoverInputSchema.parse(input), runtime.sourceCatalog));
+    const filterHandler = (input, callerSignal) => withProfile((runtime) => withKibanaToolDeadline(callerSignal, (signal) => executeFilter(filterInputSchema.parse(input), runtime.sourceCatalog, runtime.kibanaClient, {
+        schemaCatalog: runtime.schemaCatalog,
         callerSignal: signal,
-    }));
-    const queryHandler = (input, callerSignal) => withKibanaToolDeadline(callerSignal, (signal) => executeQuery(queryInputSchema.parse(input), requireConfigured().sourceCatalog, requireConfigured().kibanaClient, {
-        schemaCatalog: requireConfigured().schemaCatalog,
+    })));
+    const queryHandler = (input, callerSignal) => withProfile((runtime) => withKibanaToolDeadline(callerSignal, (signal) => executeQuery(queryInputSchema.parse(input), runtime.sourceCatalog, runtime.kibanaClient, {
+        schemaCatalog: runtime.schemaCatalog,
         callerSignal: signal,
-    }));
-    if (!initialConfig) {
+    })));
+    if (!registry.isConfigured) {
         server.registerTool("configure", {
             description: "Advanced legacy setup for a server started without a saved profile. Replaces the Kibana connection and full source catalog.",
             inputSchema: configureInputSchema,
@@ -134,7 +124,7 @@ export function createApplication(initialConfig, dependencies) {
         description: "List configured logical log sources and field hints for investigation work.",
         inputSchema: discoverInputSchema,
         outputSchema: discoverOutputSchema,
-    }, async (input) => createDiscoverCallToolResult(discoverHandler(input)));
+    }, async (input) => createDiscoverCallToolResult(await discoverHandler(input)));
     server.registerTool("filter", {
         description: "Run an exact-field filter when the field name is already known, bypassing alias resolution.",
         inputSchema: filterInputSchema,