@nitrostack/core 1.0.16 → 1.1.0-beta.0

package/dist/core/transforms/tool-cache-key.js

@@ -0,0 +1,61 @@
+import { createHash } from 'node:crypto';
+/**
+ * Schema and visibility material for catalog cache keys.
+ * Name and description alone reuse a stale index when a parameter list changes.
+ */
+export function toolCacheFields(tool) {
+    return {
+        schema: schemaKey(tool.inputSchema),
+        visibility: `${tool.visibility ?? ''}:${tool.annotations?.destructiveHint === true ? '1' : '0'}`,
+    };
+}
+function schemaKey(schema) {
+    if (!schema || typeof schema !== 'object')
+        return '';
+    const record = schema;
+    if (record.properties && typeof record.properties === 'object') {
+        const keys = Object.keys(record.properties)
+            .sort()
+            .map((key) => {
+            const type = record.properties[key]?.type;
+            return `${key}:${typeof type === 'string' ? type : ''}`;
+        })
+            .join(',');
+        const required = Array.isArray(record.required) ? [...record.required].sort().join(',') : '';
+        return `json:${keys}:req:${required}`;
+    }
+    const shape = typeof record._def?.shape === 'function'
+        ? record._def.shape()
+        : record.shape || (record._def?.shape && typeof record._def.shape === 'object' ? record._def.shape : undefined);
+    if (shape && typeof shape === 'object') {
+        const keys = Object.keys(shape)
+            .sort()
+            .map((key) => {
+            const typeName = shape[key]?._def?.typeName ?? '';
+            return `${key}:${typeName}`;
+        })
+            .join(',');
+        return `zod:${keys}`;
+    }
+    return record._def?.typeName ?? '';
+}
+/**
+ * Length-prefixed catalog fingerprint. Without a delimiter, ('ab','c') and ('a','bc')
+ * hash to the same key and a transform can serve a stale tool list.
+ */
+export function catalogCacheKey(tools, visibleNames) {
+    const hash = createHash('sha256');
+    const feed = (value) => hash.update(`${value.length}:${value}`);
+    for (const tool of tools) {
+        feed(tool.name);
+        feed(tool.description || '');
+        const identity = toolCacheFields(tool);
+        feed(identity.schema);
+        feed(identity.visibility);
+    }
+    hash.update('|visible|');
+    for (const name of visibleNames)
+        feed(name);
+    return hash.digest('hex');
+}
+//# sourceMappingURL=tool-cache-key.js.map

package/dist/core/transforms/tool-cache-key.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"tool-cache-key.js","sourceRoot":"","sources":["../../../src/core/transforms/tool-cache-key.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAGzC;;;GAGG;AACH,MAAM,UAAU,eAAe,CAAC,IAAU;IACxC,OAAO;QACL,MAAM,EAAE,SAAS,CAAC,IAAI,CAAC,WAAW,CAAC;QACnC,UAAU,EAAE,GAAG,IAAI,CAAC,UAAU,IAAI,EAAE,IAAI,IAAI,CAAC,WAAW,EAAE,eAAe,KAAK,IAAI,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,EAAE;KACjG,CAAC;AACJ,CAAC;AAED,SAAS,SAAS,CAAC,MAAe;IAChC,IAAI,CAAC,MAAM,IAAI,OAAO,MAAM,KAAK,QAAQ;QAAE,OAAO,EAAE,CAAC;IACrD,MAAM,MAAM,GAAG,MAKd,CAAC;IAEF,IAAI,MAAM,CAAC,UAAU,IAAI,OAAO,MAAM,CAAC,UAAU,KAAK,QAAQ,EAAE,CAAC;QAC/D,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,UAAU,CAAC;aACxC,IAAI,EAAE;aACN,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE;YACX,MAAM,IAAI,GAAI,MAAM,CAAC,UAAiD,CAAC,GAAG,CAAC,EAAE,IAAI,CAAC;YAClF,OAAO,GAAG,GAAG,IAAI,OAAO,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC;QAC1D,CAAC,CAAC;aACD,IAAI,CAAC,GAAG,CAAC,CAAC;QACb,MAAM,QAAQ,GAAG,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,MAAM,CAAC,QAAQ,CAAC,CAAC,IAAI,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QAC7F,OAAO,QAAQ,IAAI,QAAQ,QAAQ,EAAE,CAAC;IACxC,CAAC;IAED,MAAM,KAAK,GACT,OAAO,MAAM,CAAC,IAAI,EAAE,KAAK,KAAK,UAAU;QACtC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,EAAE;QACrB,CAAC,CAAC,MAAM,CAAC,KAAK,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE,KAAK,IAAI,OAAO,MAAM,CAAC,IAAI,CAAC,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;IAEpH,IAAI,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QACvC,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC;aAC5B,IAAI,EAAE;aACN,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE;YACX,MAAM,QAAQ,GAAI,KAA0D,CAAC,GAAG,CAAC,EAAE,IAAI,EAAE,QAAQ,IAAI,EAAE,CAAC;YACxG,OAAO,GAAG,GAAG,IAAI,QAAQ,EAAE,CAAC;QAC9B,CAAC,CAAC;aACD,IAAI,CAAC,GAAG,CAAC,CAAC;QACb,OAAO,OAAO,IAAI,EAAE,CAAC;IACvB,CAAC;IAED,OAAO,MAAM,CAAC,IAAI,EAAE,QAAQ,IAAI,EAAE,CAAC;AACrC,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,eAAe,CAAC,KAAa,EAAE,YAAsB;IACnE,MAAM,IAAI,GAAG,UAAU,CAAC,QAAQ,CAAC,CAAC;IAClC,MAAM,IAAI,GAAG,CAAC,KAAa,EAAE,EAAE,CAAC,IAAI,CAAC,MAAM,CAAC,GAAG,KAAK,CAAC,MAAM,IAAI,KAAK,EAAE,CAAC,CAAC;IACxE,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAChB,IAAI,CAAC,IAAI,CAAC,WAAW,IAAI,EAAE,CAAC,CAAC;QAC7B,MAAM,QAAQ,GAAG,eAAe,CAAC,IAAI,CAAC,CAAC;QACvC,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;QACtB,IAAI,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAC;IAC5B,CAAC;IACD,IAAI,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC;IACzB,KAAK,MAAM,IAAI,IAAI,YAAY;QAAE,IAAI,CAAC,IAAI,CAAC,CAAC;IAC5C,OAAO,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AAC5B,CAAC"}

package/dist/core/transforms/transform.interface.d.ts

@@ -0,0 +1,34 @@
+import { Tool } from '../tool.js';
+import { ExecutionContext } from '../types.js';
+export type NextToolHandler = (name: string, context?: ExecutionContext) => Promise<Tool | undefined>;
+/**
+ * The slice of NitroStackServer a transform is allowed to reach back into.
+ * `resolveTool` walks the full transform chain, so transforms that dispatch
+ * tools themselves (e.g. Code Mode) route through it rather than holding a
+ * private catalog, which would bypass downstream authorization transforms.
+ */
+export interface TransformRegistry {
+    resolveTool(name: string, context?: ExecutionContext): Promise<Tool | undefined>;
+    getTools(): Map<string, Tool>;
+}
+export interface McpTransform {
+    readonly name: string;
+    /**
+     * Called once when the transform is attached to a server.
+     */
+    onRegister?(registry: TransformRegistry): void;
+    /**
+     * Releases resources held by the transform (worker threads, timers).
+     * Invoked by NitroStackServer.stop().
+     */
+    dispose?(): Promise<void> | void;
+    /**
+     * Reshapes, filters, or augments the catalog during tools/list.
+     */
+    transformTools?(tools: Tool[], context?: ExecutionContext): Promise<Tool[]> | Tool[];
+    /**
+     * Resolves synthetic or re-routed tools during tools/call.
+     */
+    resolveTool?(name: string, next: NextToolHandler, context?: ExecutionContext): Promise<Tool | undefined>;
+}
+//# sourceMappingURL=transform.interface.d.ts.map

package/dist/core/transforms/transform.interface.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"transform.interface.d.ts","sourceRoot":"","sources":["../../../src/core/transforms/transform.interface.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,IAAI,EAAE,MAAM,YAAY,CAAC;AAClC,OAAO,EAAE,gBAAgB,EAAE,MAAM,aAAa,CAAC;AAE/C,MAAM,MAAM,eAAe,GAAG,CAC5B,IAAI,EAAE,MAAM,EACZ,OAAO,CAAC,EAAE,gBAAgB,KACvB,OAAO,CAAC,IAAI,GAAG,SAAS,CAAC,CAAC;AAE/B;;;;;GAKG;AACH,MAAM,WAAW,iBAAiB;IAChC,WAAW,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,gBAAgB,GAAG,OAAO,CAAC,IAAI,GAAG,SAAS,CAAC,CAAC;IACjF,QAAQ,IAAI,GAAG,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;CAC/B;AAED,MAAM,WAAW,YAAY;IAC3B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IAEtB;;OAEG;IACH,UAAU,CAAC,CAAC,QAAQ,EAAE,iBAAiB,GAAG,IAAI,CAAC;IAE/C;;;OAGG;IACH,OAAO,CAAC,IAAI,OAAO,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC;IAEjC;;OAEG;IACH,cAAc,CAAC,CACb,KAAK,EAAE,IAAI,EAAE,EACb,OAAO,CAAC,EAAE,gBAAgB,GACzB,OAAO,CAAC,IAAI,EAAE,CAAC,GAAG,IAAI,EAAE,CAAC;IAE5B;;OAEG;IACH,WAAW,CAAC,CACV,IAAI,EAAE,MAAM,EACZ,IAAI,EAAE,eAAe,EACrB,OAAO,CAAC,EAAE,gBAAgB,GACzB,OAAO,CAAC,IAAI,GAAG,SAAS,CAAC,CAAC;CAC9B"}

package/dist/core/transforms/transform.interface.js

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=transform.interface.js.map

package/dist/core/transforms/transform.interface.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"transform.interface.js","sourceRoot":"","sources":["../../../src/core/transforms/transform.interface.ts"],"names":[],"mappings":""}

package/dist/core/transforms/validate-tool-arguments.d.ts

@@ -0,0 +1,10 @@
+import { Tool } from '../tool.js';
+/**
+ * Validates an argument object against a tool's declared input schema.
+ *
+ * Shared by every transform that dispatches tools on behalf of a model
+ * (`call_tool`, Code Mode `callTool`), where arguments are model-authored and
+ * benefit from a named, self-correcting failure ahead of execution.
+ */
+export declare function validateToolArguments(tool: Tool, args: Record<string, unknown>): Record<string, unknown>;
+//# sourceMappingURL=validate-tool-arguments.d.ts.map

package/dist/core/transforms/validate-tool-arguments.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"validate-tool-arguments.d.ts","sourceRoot":"","sources":["../../../src/core/transforms/validate-tool-arguments.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,IAAI,EAAE,MAAM,YAAY,CAAC;AAElC;;;;;;GAMG;AACH,wBAAgB,qBAAqB,CAAC,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAmCxG"}

package/dist/core/transforms/validate-tool-arguments.js

@@ -0,0 +1,62 @@
+/**
+ * Validates an argument object against a tool's declared input schema.
+ *
+ * Shared by every transform that dispatches tools on behalf of a model
+ * (`call_tool`, Code Mode `callTool`), where arguments are model-authored and
+ * benefit from a named, self-correcting failure ahead of execution.
+ */
+export function validateToolArguments(tool, args) {
+    // 1. Zod Schema Validation
+    const schema = tool.inputSchema;
+    if (schema && typeof schema.safeParse === 'function') {
+        const result = schema.safeParse(args);
+        if (!result.success) {
+            const issues = result.error.issues
+                .map((i) => `Parameter '${i.path.join('.')}': ${i.message}`)
+                .join('; ');
+            throw new Error(`Argument validation failed for tool '${tool.name}': ${issues}`);
+        }
+        return result.data;
+    }
+    // 2. JSON Schema required properties and declared types on any present field.
+    if (schema && typeof schema === 'object' && (Array.isArray(schema.required) || schema.properties)) {
+        const properties = schema.properties;
+        if (Array.isArray(schema.required)) {
+            for (const req of schema.required) {
+                if (args[req] === undefined) {
+                    throw new Error(`Missing required parameter '${req}' for tool '${tool.name}'`);
+                }
+            }
+        }
+        if (properties) {
+            for (const [key, prop] of Object.entries(properties)) {
+                if (args[key] === undefined)
+                    continue;
+                const expected = prop?.type;
+                if (typeof expected === 'string' && !jsonTypeMatches(expected, args[key])) {
+                    throw new Error(`Parameter '${key}' for tool '${tool.name}' must be ${expected}`);
+                }
+            }
+        }
+    }
+    return args;
+}
+function jsonTypeMatches(expected, value) {
+    switch (expected) {
+        case 'string':
+            return typeof value === 'string';
+        case 'integer':
+            return typeof value === 'number' && Number.isInteger(value);
+        case 'number':
+            return typeof value === 'number' && Number.isFinite(value);
+        case 'boolean':
+            return typeof value === 'boolean';
+        case 'object':
+            return typeof value === 'object' && value !== null && !Array.isArray(value);
+        case 'array':
+            return Array.isArray(value);
+        default:
+            return true;
+    }
+}
+//# sourceMappingURL=validate-tool-arguments.js.map

package/dist/core/transforms/validate-tool-arguments.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"validate-tool-arguments.js","sourceRoot":"","sources":["../../../src/core/transforms/validate-tool-arguments.ts"],"names":[],"mappings":"AAEA;;;;;;GAMG;AACH,MAAM,UAAU,qBAAqB,CAAC,IAAU,EAAE,IAA6B;IAC7E,2BAA2B;IAC3B,MAAM,MAAM,GAAG,IAAI,CAAC,WAAkB,CAAC;IACvC,IAAI,MAAM,IAAI,OAAO,MAAM,CAAC,SAAS,KAAK,UAAU,EAAE,CAAC;QACrD,MAAM,MAAM,GAAG,MAAM,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC;QACtC,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;YACpB,MAAM,MAAM,GAAG,MAAM,CAAC,KAAK,CAAC,MAAM;iBAC/B,GAAG,CAAC,CAAC,CAAM,EAAE,EAAE,CAAC,cAAc,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,OAAO,EAAE,CAAC;iBAChE,IAAI,CAAC,IAAI,CAAC,CAAC;YACd,MAAM,IAAI,KAAK,CAAC,wCAAwC,IAAI,CAAC,IAAI,MAAM,MAAM,EAAE,CAAC,CAAC;QACnF,CAAC;QACD,OAAO,MAAM,CAAC,IAA+B,CAAC;IAChD,CAAC;IAED,8EAA8E;IAC9E,IAAI,MAAM,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,IAAI,MAAM,CAAC,UAAU,CAAC,EAAE,CAAC;QAClG,MAAM,UAAU,GAAG,MAAM,CAAC,UAA4D,CAAC;QACvF,IAAI,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,EAAE,CAAC;YACnC,KAAK,MAAM,GAAG,IAAI,MAAM,CAAC,QAAQ,EAAE,CAAC;gBAClC,IAAI,IAAI,CAAC,GAAG,CAAC,KAAK,SAAS,EAAE,CAAC;oBAC5B,MAAM,IAAI,KAAK,CAAC,+BAA+B,GAAG,eAAe,IAAI,CAAC,IAAI,GAAG,CAAC,CAAC;gBACjF,CAAC;YACH,CAAC;QACH,CAAC;QACD,IAAI,UAAU,EAAE,CAAC;YACf,KAAK,MAAM,CAAC,GAAG,EAAE,IAAI,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,UAAU,CAAC,EAAE,CAAC;gBACrD,IAAI,IAAI,CAAC,GAAG,CAAC,KAAK,SAAS;oBAAE,SAAS;gBACtC,MAAM,QAAQ,GAAG,IAAI,EAAE,IAAI,CAAC;gBAC5B,IAAI,OAAO,QAAQ,KAAK,QAAQ,IAAI,CAAC,eAAe,CAAC,QAAQ,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC;oBAC1E,MAAM,IAAI,KAAK,CAAC,cAAc,GAAG,eAAe,IAAI,CAAC,IAAI,aAAa,QAAQ,EAAE,CAAC,CAAC;gBACpF,CAAC;YACH,CAAC;QACH,CAAC;IACH,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,SAAS,eAAe,CAAC,QAAgB,EAAE,KAAc;IACvD,QAAQ,QAAQ,EAAE,CAAC;QACjB,KAAK,QAAQ;YACX,OAAO,OAAO,KAAK,KAAK,QAAQ,CAAC;QACnC,KAAK,SAAS;YACZ,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,MAAM,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;QAC9D,KAAK,QAAQ;YACX,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;QAC7D,KAAK,SAAS;YACZ,OAAO,OAAO,KAAK,KAAK,SAAS,CAAC;QACpC,KAAK,QAAQ;YACX,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;QAC9E,KAAK,OAAO;YACV,OAAO,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;QAC9B;YACE,OAAO,IAAI,CAAC;IAChB,CAAC;AACH,CAAC"}

package/dist/core/transforms/visibility/index.d.ts

@@ -0,0 +1,3 @@
+export * from './session-store.js';
+export * from './visibility.transform.js';
+//# sourceMappingURL=index.d.ts.map

package/dist/core/transforms/visibility/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../src/core/transforms/visibility/index.ts"],"names":[],"mappings":"AAAA,cAAc,oBAAoB,CAAC;AACnC,cAAc,2BAA2B,CAAC"}

package/dist/core/transforms/visibility/index.js

@@ -0,0 +1,3 @@
+export * from './session-store.js';
+export * from './visibility.transform.js';
+//# sourceMappingURL=index.js.map

package/dist/core/transforms/visibility/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../../src/core/transforms/visibility/index.ts"],"names":[],"mappings":"AAAA,cAAc,oBAAoB,CAAC;AACnC,cAAc,2BAA2B,CAAC"}

package/dist/core/transforms/visibility/session-store.d.ts

@@ -0,0 +1,132 @@
+/**
+ * Per-session visibility state recording explicit tool reveals and hides.
+ */
+export interface SessionVisibilityState {
+    sessionId: string;
+    enabledTools: Set<string>;
+    disabledTools: Set<string>;
+    lastActive: number;
+}
+export interface SessionVisibilityStoreOptions {
+    /**
+     * Time-to-live for inactive sessions in minutes (default: 60).
+     */
+    ttlMinutes?: number;
+    /**
+     * Maximum concurrent sessions held in memory before oldest inactive is evicted (default: 10,000).
+     */
+    maxSessions?: number;
+    /**
+     * Background sweep interval in seconds (default: 300).
+     */
+    sweepIntervalSeconds?: number;
+    /**
+     * Called when a new revocation is refused because the cap is full.
+     */
+    logger?: {
+        warn(message: string, meta?: unknown): void;
+    };
+}
+/**
+ * Manages per-session dynamic visibility state for MCP tools with memory bounds,
+ * TTL expiry, and LRU pruning.
+ */
+export declare class SessionVisibilityStore {
+    private readonly sessions;
+    /**
+     * Explicit revokes survive LRU eviction of the session record so disableTools
+     * does not fail open while the entry is still inside its TTL. The same TTL
+     * sweeps them; they are also capped at maxSessions.
+     */
+    private readonly revocations;
+    /**
+     * Denies that follow a verified subject across session ids.
+     * Anonymous callers have no entry here. A full map refuses a new subject
+     * rather than dropping a live deny.
+     */
+    private readonly subjectDenies;
+    private readonly ttlMs;
+    private readonly maxSessions;
+    private readonly sweepTimer;
+    private logger?;
+    constructor(options?: SessionVisibilityStoreOptions);
+    setLogger(logger: {
+        warn(message: string, meta?: unknown): void;
+    }): void;
+    /**
+     * Retrieves active session state or initializes a new entry.
+     * Updates lastActive timestamp and maintains Map insertion order for LRU.
+     */
+    getOrCreateSession(sessionId: string): SessionVisibilityState;
+    /**
+     * Retrieves active session state without creating one if absent.
+     * Updates lastActive timestamp and LRU order if found.
+     */
+    getSession(sessionId: string): SessionVisibilityState | undefined;
+    /**
+     * Explicitly enables (reveals) tools for a given session.
+     */
+    enableTools(sessionId: string, toolNames: string[]): void;
+    /**
+     * Explicitly disables (hides) tools for a given session.
+     * Throws when a new session cannot be recorded without dropping another live deny.
+     */
+    disableTools(sessionId: string, toolNames: string[]): void;
+    /**
+     * Returns whether a tool is explicitly enabled for a session.
+     */
+    hasEnabled(sessionId: string, toolName: string): boolean;
+    /**
+     * Returns whether a tool is explicitly disabled for a session.
+     */
+    hasDisabled(sessionId: string, toolName: string): boolean;
+    /**
+     * Hides tools for a verified subject. The deny survives a new session id.
+     * Throws when a new subject cannot be recorded without dropping another live deny.
+     */
+    disableSubject(subject: string, toolNames: string[]): void;
+    /**
+     * Lifts a subject-scoped deny and the same names on every session key for
+     * that subject, so a grant on a later session restores the earlier one.
+     */
+    enableSubject(subject: string, toolNames: string[]): void;
+    hasSubjectDisabled(subject: string, toolName: string): boolean;
+    hasSubjectDenies(subject: string): boolean;
+    /**
+     * True when this session still has at least one unexpired revocation.
+     * Used after the session record itself has been evicted.
+     */
+    hasRevocations(sessionId: string): boolean;
+    /**
+     * Clears visibility state for a session.
+     */
+    clearSession(sessionId: string): void;
+    /**
+     * Total number of tracked sessions currently in memory.
+     */
+    get activeSessionCount(): number;
+    /**
+     * Sweeps and purges sessions and revocations that have exceeded the TTL limit.
+     */
+    cleanupExpired(): void;
+    /**
+     * Evicts the least-recently used session entry.
+     * Revocations are left in place until their own TTL.
+     */
+    private evictOldest;
+    private liveRevocation;
+    private touchRevocation;
+    private liveSubjectDeny;
+    private touchSubjectDeny;
+    /**
+     * Sweeps expired subject denies. A new subject is refused when the map is still
+     * at the cap, so a live deny is never dropped to make room.
+     */
+    private makeSubjectRoom;
+    private makeRevocationRoom;
+    /**
+     * Cleans up timers and drops all session records.
+     */
+    destroy(): void;
+}
+//# sourceMappingURL=session-store.d.ts.map

package/dist/core/transforms/visibility/session-store.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"session-store.d.ts","sourceRoot":"","sources":["../../../../src/core/transforms/visibility/session-store.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH,MAAM,WAAW,sBAAsB;IACrC,SAAS,EAAE,MAAM,CAAC;IAClB,YAAY,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC;IAC1B,aAAa,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC;IAC3B,UAAU,EAAE,MAAM,CAAC;CACpB;AAYD,MAAM,WAAW,6BAA6B;IAC5C;;OAEG;IACH,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB;;OAEG;IACH,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB;;OAEG;IACH,oBAAoB,CAAC,EAAE,MAAM,CAAC;IAC9B;;OAEG;IACH,MAAM,CAAC,EAAE;QAAE,IAAI,CAAC,OAAO,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,OAAO,GAAG,IAAI,CAAA;KAAE,CAAC;CAC1D;AAED;;;GAGG;AACH,qBAAa,sBAAsB;IACjC,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAA6C;IACtE;;;;OAIG;IACH,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAsC;IAClE;;;;OAIG;IACH,OAAO,CAAC,QAAQ,CAAC,aAAa,CAAuC;IACrE,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAS;IAC/B,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAS;IACrC,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAiB;IAC5C,OAAO,CAAC,MAAM,CAAC,CAAkD;gBAErD,OAAO,GAAE,6BAAkC;IAavD,SAAS,CAAC,MAAM,EAAE;QAAE,IAAI,CAAC,OAAO,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,OAAO,GAAG,IAAI,CAAA;KAAE,GAAG,IAAI;IAIxE;;;OAGG;IACH,kBAAkB,CAAC,SAAS,EAAE,MAAM,GAAG,sBAAsB;IAuB7D;;;OAGG;IACH,UAAU,CAAC,SAAS,EAAE,MAAM,GAAG,sBAAsB,GAAG,SAAS;IAWjE;;OAEG;IACH,WAAW,CAAC,SAAS,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,GAAG,IAAI;IAezD;;;OAGG;IACH,YAAY,CAAC,SAAS,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,GAAG,IAAI;IAiB1D;;OAEG;IACH,UAAU,CAAC,SAAS,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO;IAIxD;;OAEG;IACH,WAAW,CAAC,SAAS,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO;IAKzD;;;OAGG;IACH,cAAc,CAAC,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,GAAG,IAAI;IAW1D;;;OAGG;IACH,aAAa,CAAC,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,GAAG,IAAI;IAmBzD,kBAAkB,CAAC,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO;IAO9D,gBAAgB,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO;IAK1C;;;OAGG;IACH,cAAc,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO;IAK1C;;OAEG;IACH,YAAY,CAAC,SAAS,EAAE,MAAM,GAAG,IAAI;IAKrC;;OAEG;IACH,IAAI,kBAAkB,IAAI,MAAM,CAE/B;IAED;;OAEG;IACH,cAAc,IAAI,IAAI;IA+BtB;;;OAGG;IACH,OAAO,CAAC,WAAW;IAOnB,OAAO,CAAC,cAAc;IAUtB,OAAO,CAAC,eAAe;IAQvB,OAAO,CAAC,eAAe;IAUvB,OAAO,CAAC,gBAAgB;IAMxB;;;OAGG;IACH,OAAO,CAAC,eAAe;IAmBvB,OAAO,CAAC,kBAAkB;IAmB1B;;OAEG;IACH,OAAO,IAAI,IAAI;CAMhB"}