@softure-ai/mcp-access 0.3.0 → 0.5.0

package/dist/server/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/server/index.ts"],"names":[],"mappings":"AAAA,wFAAwF;AACxF,+FAA+F;AAC/F,OAAO,EACL,iBAAiB,EACjB,qBAAqB,EACrB,qBAAqB,EACrB,cAAc,EACd,eAAe,GAIhB,MAAM,eAAe,CAAC;AACvB,OAAO,EAAE,UAAU,EAAE,UAAU,EAAkD,MAAM,kBAAkB,CAAC;AAC1G,OAAO,EACL,kBAAkB,EAClB,uBAAuB,EACvB,iBAAiB,EACjB,gCAAgC,EAChC,8BAA8B,EAC9B,sBAAsB,EACtB,eAAe,EACf,gBAAgB,GAMjB,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EAAE,sBAAsB,EAAE,MAAM,cAAc,CAAC;AACtD,OAAO,EAAE,gBAAgB,EAAE,MAAM,oBAAoB,CAAC;AACtD,OAAO,EAAE,sBAAsB,EAAE,MAAM,aAAa,CAAC;AACrD,OAAO,EACL,uBAAuB,EACvB,4BAA4B,EAC5B,wBAAwB,EACxB,+BAA+B,EAC/B,sBAAsB,GAGvB,MAAM,0BAA0B,CAAC;AAClC,OAAO,EACL,mBAAmB,EACnB,oBAAoB,EACpB,uBAAuB,EACvB,yBAAyB,EACzB,eAAe,EACf,mBAAmB,EACnB,eAAe,EACf,iBAAiB,EACjB,oBAAoB,EACpB,eAAe,EACf,iBAAiB,EACjB,gBAAgB,GASjB,MAAM,YAAY,CAAC;AACpB,OAAO,EACL,oBAAoB,EACpB,oBAAoB,EACpB,kCAAkC,EAClC,mBAAmB,EACnB,8BAA8B,EAC9B,cAAc,EACd,cAAc,EACd,4BAA4B,EAC5B,+BAA+B,EAC/B,gCAAgC,EAChC,2BAA2B,EAC3B,wBAAwB,EACxB,kBAAkB,EAClB,oBAAoB,EACpB,cAAc,EACd,qBAAqB,EACrB,2BAA2B,EAC3B,YAAY,EACZ,gCAAgC,EAChC,uBAAuB,EACvB,sBAAsB,EACtB,4BAA4B,GAK7B,MAAM,iBAAiB,CAAC;AACzB,OAAO,EAAE,wBAAwB,EAAE,eAAe,EAAE,iBAAiB,EAA0C,MAAM,eAAe,CAAC;AACrI,OAAO,EAAE,iBAAiB,EAAE,MAAM,cAAc,CAAC;AAEjD,OAAO,EAAE,mBAAmB,EAAE,oBAAoB,EAAE,sBAAsB,EAAE,uBAAuB,EAAyD,MAAM,uBAAuB,CAAC;AAC1L,OAAO,EAAE,gBAAgB,EAAE,mBAAmB,EAAE,oBAAoB,EAAE,WAAW,EAAE,MAAM,WAAW,CAAC;AACrG,OAAO,EAAE,oBAAoB,EAAE,mBAAmB,EAAE,kBAAkB,EAAE,iBAAiB,EAAwB,MAAM,cAAc,CAAC;AACtI,OAAO,EAAE,cAAc,EAAE,mBAAmB,EAA+B,MAAM,YAAY,CAAC;AAC9F,OAAO,EACL,uBAAuB,EACvB,uBAAuB,EACvB,2BAA2B,GAE5B,MAAM,cAAc,CAAC;AACtB,OAAO,EACL,mBAAmB,EACnB,eAAe,EACf,kBAAkB,EAClB,gBAAgB,EAChB,gBAAgB,EAChB,iBAAiB,EACjB,mBAAmB,EACnB,iBAAiB,EACjB,iBAAiB,GAOlB,MAAM,aAAa,CAAC;AACrB,OAAO,EACL,qBAAqB,EACrB,2BAA2B,EAC3B,qBAAqB,EACrB,kBAAkB,EAClB,eAAe,EACf,aAAa,EACb,eAAe,EACf,cAAc,GAMf,MAAM,iBAAiB,CAAC;AACzB,OAAO,EAAE,sBAAsB,EAAgC,MAAM,qBAAqB,CAAC;AAC3F,OAAO,EACL,sBAAsB,EACtB,qBAAqB,GAMtB,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EAAE,iBAAiB,EAAE,mBAAmB,EAAiF,MAAM,mBAAmB,CAAC;AAC1J,OAAO,EACL,yBAAyB,EACzB,gBAAgB,EAChB,mBAAmB,EACnB,eAAe,EACf,eAAe,GAKhB,MAAM,gBAAgB,CAAC;AACxB,OAAO,EACL,SAAS,EACT,UAAU,EACV,cAAc,GAOf,MAAM,YAAY,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/server/index.ts"],"names":[],"mappings":"AAAA,wFAAwF;AACxF,+FAA+F;AAC/F,OAAO,EACL,iBAAiB,EACjB,qBAAqB,EACrB,qBAAqB,EACrB,cAAc,EACd,eAAe,GAMhB,MAAM,eAAe,CAAC;AACvB,OAAO,EAAE,UAAU,EAAE,UAAU,EAAkD,MAAM,kBAAkB,CAAC;AAC1G,OAAO,EACL,kBAAkB,EAClB,uBAAuB,EACvB,iBAAiB,EACjB,gCAAgC,EAChC,8BAA8B,EAC9B,sBAAsB,EACtB,eAAe,EACf,gBAAgB,GAMjB,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EAAE,sBAAsB,EAAE,MAAM,cAAc,CAAC;AACtD,OAAO,EAAE,gBAAgB,EAAE,MAAM,oBAAoB,CAAC;AACtD,OAAO,EAAE,sBAAsB,EAAE,MAAM,aAAa,CAAC;AACrD,OAAO,EACL,uBAAuB,EACvB,4BAA4B,EAC5B,wBAAwB,EACxB,+BAA+B,EAC/B,sBAAsB,GAGvB,MAAM,0BAA0B,CAAC;AAClC,OAAO,EACL,mBAAmB,EACnB,oBAAoB,EACpB,uBAAuB,EACvB,yBAAyB,EACzB,eAAe,EACf,mBAAmB,EACnB,eAAe,EACf,iBAAiB,EACjB,oBAAoB,EACpB,eAAe,EACf,iBAAiB,EACjB,gBAAgB,GASjB,MAAM,YAAY,CAAC;AACpB,OAAO,EACL,oBAAoB,EACpB,oBAAoB,EACpB,kCAAkC,EAClC,mBAAmB,EACnB,8BAA8B,EAC9B,cAAc,EACd,cAAc,EACd,4BAA4B,EAC5B,+BAA+B,EAC/B,gCAAgC,EAChC,2BAA2B,EAC3B,wBAAwB,EACxB,kBAAkB,EAClB,oBAAoB,EACpB,cAAc,EACd,qBAAqB,EACrB,2BAA2B,EAC3B,YAAY,EACZ,gCAAgC,EAChC,uBAAuB,EACvB,sBAAsB,EACtB,4BAA4B,GAK7B,MAAM,iBAAiB,CAAC;AACzB,OAAO,EAAE,wBAAwB,EAAE,eAAe,EAAE,iBAAiB,EAA0C,MAAM,eAAe,CAAC;AACrI,OAAO,EAAE,iBAAiB,EAAE,MAAM,cAAc,CAAC;AAEjD,OAAO,EAAE,mBAAmB,EAAE,oBAAoB,EAAE,sBAAsB,EAAE,uBAAuB,EAAyD,MAAM,uBAAuB,CAAC;AAC1L,OAAO,EAAE,gBAAgB,EAAE,mBAAmB,EAAE,oBAAoB,EAAE,WAAW,EAAE,MAAM,WAAW,CAAC;AACrG,OAAO,EAAE,oBAAoB,EAAE,mBAAmB,EAAE,kBAAkB,EAAE,iBAAiB,EAAwB,MAAM,cAAc,CAAC;AACtI,OAAO,EAAE,cAAc,EAAE,mBAAmB,EAA+B,MAAM,YAAY,CAAC;AAC9F,OAAO,EACL,uBAAuB,EACvB,uBAAuB,EACvB,2BAA2B,GAE5B,MAAM,cAAc,CAAC;AACtB,OAAO,EACL,mBAAmB,EACnB,eAAe,EACf,kBAAkB,EAClB,gBAAgB,EAChB,gBAAgB,EAChB,iBAAiB,EACjB,mBAAmB,EACnB,iBAAiB,EACjB,iBAAiB,GAOlB,MAAM,aAAa,CAAC;AACrB,OAAO,EACL,qBAAqB,EACrB,2BAA2B,EAC3B,qBAAqB,EACrB,kBAAkB,EAClB,eAAe,EACf,aAAa,EACb,eAAe,EACf,cAAc,GAMf,MAAM,iBAAiB,CAAC;AACzB,OAAO,EAAE,sBAAsB,EAAgC,MAAM,qBAAqB,CAAC;AAC3F,OAAO,EACL,sBAAsB,EACtB,qBAAqB,GAMtB,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EAAE,iBAAiB,EAAE,mBAAmB,EAAiF,MAAM,mBAAmB,CAAC;AAC1J,OAAO,EACL,yBAAyB,EACzB,gBAAgB,EAChB,mBAAmB,EACnB,eAAe,EACf,eAAe,GAKhB,MAAM,gBAAgB,CAAC;AACxB,OAAO,EACL,uBAAuB,EACvB,wBAAwB,EACxB,qBAAqB,EACrB,0BAA0B,GAC3B,MAAM,wBAAwB,CAAC;AAChC,OAAO,EACL,SAAS,EACT,UAAU,EACV,cAAc,GAOf,MAAM,YAAY,CAAC"}

package/dist/server/server-factory.d.ts

@@ -1,6 +1,6 @@
 import { McpServer, type McpServerOptions } from "@modelcontextprotocol/server";
 import type { McpServerIdentity } from "../contract.js";
-import type { McpServerFactory } from "./endpoint.js";
+import type { VersionedMcpServerFactory } from "./endpoint.js";
 import { type StrictToolInputOptions } from "./strict-input.js";
 import { type ServerInfoToolOptions } from "./server-info.js";
 export interface McpServerFactoryOptions {
@@ -26,6 +26,10 @@ export interface McpServerFactoryOptions {
      */
     readonly serverInfoTool?: ServerInfoToolOptions;
 }
-/** An `McpServerFactory` whose servers carry the tool list's version for the identity's access level. */
-export declare function createMcpServerFactory(options: McpServerFactoryOptions): McpServerFactory;
+/**
+ * An `McpServerFactory` whose servers carry the tool list's version for the identity's access level. Its
+ * `toolListVersion(identity)` reads that version without building a server, so `createMcpEndpoint` ties each session
+ * to it (#1055).
+ */
+export declare function createMcpServerFactory(options: McpServerFactoryOptions): VersionedMcpServerFactory;
 //# sourceMappingURL=server-factory.d.ts.map

package/dist/server/server-factory.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"server-factory.d.ts","sourceRoot":"","sources":["../../src/server/server-factory.ts"],"names":[],"mappings":"AAUA,OAAO,EAAE,SAAS,EAAE,KAAK,gBAAgB,EAAE,MAAM,8BAA8B,CAAC;AAChF,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,gBAAgB,CAAC;AACxD,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,eAAe,CAAC;AACtD,OAAO,EAAuB,KAAK,sBAAsB,EAAE,MAAM,mBAAmB,CAAC;AACrF,OAAO,EAA0B,KAAK,qBAAqB,EAAE,MAAM,kBAAkB,CAAC;AAGtF,MAAM,WAAW,uBAAuB;IACtC,yBAAyB;IACzB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,mDAAmD;IACnD,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC;IACxB,kEAAkE;IAClE,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC;IAC1B,gEAAgE;IAChE,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,aAAa,CAAC,EAAE,gBAAgB,CAAC;IAC1C;;;OAGG;IACH,QAAQ,CAAC,aAAa,EAAE,CAAC,MAAM,EAAE,SAAS,EAAE,QAAQ,EAAE,iBAAiB,KAAK,OAAO,CAAC;IACpF,yGAAyG;IACzG,QAAQ,CAAC,eAAe,CAAC,EAAE,OAAO,GAAG,sBAAsB,CAAC;IAC5D;;;OAGG;IACH,QAAQ,CAAC,cAAc,CAAC,EAAE,qBAAqB,CAAC;CACjD;AAED,yGAAyG;AACzG,wBAAgB,sBAAsB,CAAC,OAAO,EAAE,uBAAuB,GAAG,gBAAgB,CAmCzF"}
+{"version":3,"file":"server-factory.d.ts","sourceRoot":"","sources":["../../src/server/server-factory.ts"],"names":[],"mappings":"AAUA,OAAO,EAAE,SAAS,EAAE,KAAK,gBAAgB,EAAE,MAAM,8BAA8B,CAAC;AAChF,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,gBAAgB,CAAC;AACxD,OAAO,KAAK,EAAE,yBAAyB,EAAE,MAAM,eAAe,CAAC;AAC/D,OAAO,EAAuB,KAAK,sBAAsB,EAAE,MAAM,mBAAmB,CAAC;AACrF,OAAO,EAA0B,KAAK,qBAAqB,EAAE,MAAM,kBAAkB,CAAC;AAGtF,MAAM,WAAW,uBAAuB;IACtC,yBAAyB;IACzB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,mDAAmD;IACnD,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC;IACxB,kEAAkE;IAClE,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC;IAC1B,gEAAgE;IAChE,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,aAAa,CAAC,EAAE,gBAAgB,CAAC;IAC1C;;;OAGG;IACH,QAAQ,CAAC,aAAa,EAAE,CAAC,MAAM,EAAE,SAAS,EAAE,QAAQ,EAAE,iBAAiB,KAAK,OAAO,CAAC;IACpF,yGAAyG;IACzG,QAAQ,CAAC,eAAe,CAAC,EAAE,OAAO,GAAG,sBAAsB,CAAC;IAC5D;;;OAGG;IACH,QAAQ,CAAC,cAAc,CAAC,EAAE,qBAAqB,CAAC;CACjD;AAED;;;;GAIG;AACH,wBAAgB,sBAAsB,CAAC,OAAO,EAAE,uBAAuB,GAAG,yBAAyB,CAqClG"}

package/dist/server/server-factory.js

@@ -12,7 +12,11 @@ import { McpServer } from "@modelcontextprotocol/server";
 import { withStrictToolInput } from "./strict-input.js";
 import { registerServerInfoTool } from "./server-info.js";
 import { measureToolList } from "./tool-list.js";
-/** An `McpServerFactory` whose servers carry the tool list's version for the identity's access level. */
+/**
+ * An `McpServerFactory` whose servers carry the tool list's version for the identity's access level. Its
+ * `toolListVersion(identity)` reads that version without building a server, so `createMcpEndpoint` ties each session
+ * to it (#1055).
+ */
 export function createMcpServerFactory(options) {
     const strictOptions = options.strictToolInput === true ? {} : options.strictToolInput === false ? undefined : options.strictToolInput;
     // The served version reaches `get_server_info` here; the recording server registers it with a placeholder, since
@@ -39,11 +43,13 @@ export function createMcpServerFactory(options) {
         void measurement.catch(() => measurements.delete(identity.canWrite));
         return measurement;
     };
-    return async (identity) => {
-        const version = options.version ?? (await measure(identity)).toolListVersion;
+    const toolListVersion = async (identity) => options.version ?? (await measure(identity)).toolListVersion;
+    const factory = async (identity) => {
+        const version = await toolListVersion(identity);
         const server = new McpServer({ name: options.name, version, ...(options.title === undefined ? {} : { title: options.title }) }, options.serverOptions);
         await registerTools(server, identity, version);
         return server;
     };
+    return Object.assign(factory, { toolListVersion });
 }
 //# sourceMappingURL=server-factory.js.map

package/dist/server/server-factory.js.map

@@ -1 +1 @@
-{"version":3,"file":"server-factory.js","sourceRoot":"","sources":["../../src/server/server-factory.ts"],"names":[],"mappings":"AAAA,sGAAsG;AACtG,kGAAkG;AAClG,mGAAmG;AACnG,qGAAqG;AACrG,6CAA6C;AAC7C,EAAE;AACF,yDAAyD;AACzD,oBAAoB;AACpB,gFAAgF;AAChF,QAAQ;AACR,OAAO,EAAE,SAAS,EAAyB,MAAM,8BAA8B,CAAC;AAGhF,OAAO,EAAE,mBAAmB,EAA+B,MAAM,mBAAmB,CAAC;AACrF,OAAO,EAAE,sBAAsB,EAA8B,MAAM,kBAAkB,CAAC;AACtF,OAAO,EAAE,eAAe,EAA4B,MAAM,gBAAgB,CAAC;AA0B3E,yGAAyG;AACzG,MAAM,UAAU,sBAAsB,CAAC,OAAgC;IACrE,MAAM,aAAa,GAAG,OAAO,CAAC,eAAe,KAAK,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,eAAe,KAAK,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,OAAO,CAAC,eAAe,CAAC;IACtI,iHAAiH;IACjH,+EAA+E;IAC/E,MAAM,aAAa,GAAG,KAAK,EAAE,MAAiB,EAAE,QAA2B,EAAE,OAAO,GAAG,EAAE,EAAiB,EAAE;QAC1G,MAAM,MAAM,GAAG,aAAa,KAAK,SAAS,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,mBAAmB,CAAC,MAAM,EAAE,aAAa,CAAC,CAAC;QACjG,MAAM,OAAO,CAAC,aAAa,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC;QAC9C,IAAI,OAAO,CAAC,cAAc,KAAK,SAAS;YAAE,sBAAsB,CAAC,MAAM,EAAE,EAAE,GAAG,OAAO,CAAC,cAAc,EAAE,MAAM,EAAE,EAAE,IAAI,EAAE,OAAO,CAAC,IAAI,EAAE,OAAO,EAAE,EAAE,CAAC,CAAC;IACnJ,CAAC,CAAC;IACF,MAAM,YAAY,GAAG,IAAI,GAAG,EAAyC,CAAC;IAEtE,qGAAqG;IACrG,4DAA4D;IAC5D,MAAM,OAAO,GAAG,CAAC,QAA2B,EAAgC,EAAE;QAC5E,MAAM,MAAM,GAAG,YAAY,CAAC,GAAG,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;QACnD,IAAI,MAAM,KAAK,SAAS;YAAE,OAAO,MAAM,CAAC;QACxC,MAAM,WAAW,GAAG,eAAe,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,aAAa,CAAC,MAAM,EAAE,QAAQ,CAAC,EAAE;YAC/E,GAAG,CAAC,OAAO,CAAC,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,OAAO,CAAC,OAAO,EAAE,CAAC;YACtE,IAAI,EAAE,OAAO,CAAC,IAAI;YAClB,GAAG,CAAC,OAAO,CAAC,aAAa,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,aAAa,EAAE,OAAO,CAAC,aAAa,EAAE,CAAC;SACzF,CAAC,CAAC;QACH,YAAY,CAAC,GAAG,CAAC,QAAQ,CAAC,QAAQ,EAAE,WAAW,CAAC,CAAC;QACjD,KAAK,WAAW,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,YAAY,CAAC,MAAM,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC,CAAC;QACrE,OAAO,WAAW,CAAC;IACrB,CAAC,CAAC;IAEF,OAAO,KAAK,EAAE,QAAQ,EAAE,EAAE;QACxB,MAAM,OAAO,GAAG,OAAO,CAAC,OAAO,IAAI,CAAC,MAAM,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC,eAAe,CAAC;QAC7E,MAAM,MAAM,GAAG,IAAI,SAAS,CAC1B,EAAE,IAAI,EAAE,OAAO,CAAC,IAAI,EAAE,OAAO,EAAE,GAAG,CAAC,OAAO,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,OAAO,CAAC,KAAK,EAAE,CAAC,EAAE,EACjG,OAAO,CAAC,aAAa,CACtB,CAAC;QACF,MAAM,aAAa,CAAC,MAAM,EAAE,QAAQ,EAAE,OAAO,CAAC,CAAC;QAC/C,OAAO,MAAM,CAAC;IAChB,CAAC,CAAC;AACJ,CAAC"}
+{"version":3,"file":"server-factory.js","sourceRoot":"","sources":["../../src/server/server-factory.ts"],"names":[],"mappings":"AAAA,sGAAsG;AACtG,kGAAkG;AAClG,mGAAmG;AACnG,qGAAqG;AACrG,6CAA6C;AAC7C,EAAE;AACF,yDAAyD;AACzD,oBAAoB;AACpB,gFAAgF;AAChF,QAAQ;AACR,OAAO,EAAE,SAAS,EAAyB,MAAM,8BAA8B,CAAC;AAGhF,OAAO,EAAE,mBAAmB,EAA+B,MAAM,mBAAmB,CAAC;AACrF,OAAO,EAAE,sBAAsB,EAA8B,MAAM,kBAAkB,CAAC;AACtF,OAAO,EAAE,eAAe,EAA4B,MAAM,gBAAgB,CAAC;AA0B3E;;;;GAIG;AACH,MAAM,UAAU,sBAAsB,CAAC,OAAgC;IACrE,MAAM,aAAa,GAAG,OAAO,CAAC,eAAe,KAAK,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,eAAe,KAAK,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,OAAO,CAAC,eAAe,CAAC;IACtI,iHAAiH;IACjH,+EAA+E;IAC/E,MAAM,aAAa,GAAG,KAAK,EAAE,MAAiB,EAAE,QAA2B,EAAE,OAAO,GAAG,EAAE,EAAiB,EAAE;QAC1G,MAAM,MAAM,GAAG,aAAa,KAAK,SAAS,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,mBAAmB,CAAC,MAAM,EAAE,aAAa,CAAC,CAAC;QACjG,MAAM,OAAO,CAAC,aAAa,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC;QAC9C,IAAI,OAAO,CAAC,cAAc,KAAK,SAAS;YAAE,sBAAsB,CAAC,MAAM,EAAE,EAAE,GAAG,OAAO,CAAC,cAAc,EAAE,MAAM,EAAE,EAAE,IAAI,EAAE,OAAO,CAAC,IAAI,EAAE,OAAO,EAAE,EAAE,CAAC,CAAC;IACnJ,CAAC,CAAC;IACF,MAAM,YAAY,GAAG,IAAI,GAAG,EAAyC,CAAC;IAEtE,qGAAqG;IACrG,4DAA4D;IAC5D,MAAM,OAAO,GAAG,CAAC,QAA2B,EAAgC,EAAE;QAC5E,MAAM,MAAM,GAAG,YAAY,CAAC,GAAG,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;QACnD,IAAI,MAAM,KAAK,SAAS;YAAE,OAAO,MAAM,CAAC;QACxC,MAAM,WAAW,GAAG,eAAe,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,aAAa,CAAC,MAAM,EAAE,QAAQ,CAAC,EAAE;YAC/E,GAAG,CAAC,OAAO,CAAC,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,OAAO,CAAC,OAAO,EAAE,CAAC;YACtE,IAAI,EAAE,OAAO,CAAC,IAAI;YAClB,GAAG,CAAC,OAAO,CAAC,aAAa,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,aAAa,EAAE,OAAO,CAAC,aAAa,EAAE,CAAC;SACzF,CAAC,CAAC;QACH,YAAY,CAAC,GAAG,CAAC,QAAQ,CAAC,QAAQ,EAAE,WAAW,CAAC,CAAC;QACjD,KAAK,WAAW,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,YAAY,CAAC,MAAM,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC,CAAC;QACrE,OAAO,WAAW,CAAC;IACrB,CAAC,CAAC;IAEF,MAAM,eAAe,GAAG,KAAK,EAAE,QAA2B,EAAmB,EAAE,CAAC,OAAO,CAAC,OAAO,IAAI,CAAC,MAAM,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC,eAAe,CAAC;IAC7I,MAAM,OAAO,GAAG,KAAK,EAAE,QAA2B,EAAsB,EAAE;QACxE,MAAM,OAAO,GAAG,MAAM,eAAe,CAAC,QAAQ,CAAC,CAAC;QAChD,MAAM,MAAM,GAAG,IAAI,SAAS,CAC1B,EAAE,IAAI,EAAE,OAAO,CAAC,IAAI,EAAE,OAAO,EAAE,GAAG,CAAC,OAAO,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,OAAO,CAAC,KAAK,EAAE,CAAC,EAAE,EACjG,OAAO,CAAC,aAAa,CACtB,CAAC;QACF,MAAM,aAAa,CAAC,MAAM,EAAE,QAAQ,EAAE,OAAO,CAAC,CAAC;QAC/C,OAAO,MAAM,CAAC;IAChB,CAAC,CAAC;IACF,OAAO,MAAM,CAAC,MAAM,CAAC,OAAO,EAAE,EAAE,eAAe,EAAE,CAAC,CAAC;AACrD,CAAC"}

package/dist/server/tool-list-session.d.ts

@@ -0,0 +1,22 @@
+/** The header that carries the session id, both ways. */
+export declare const MCP_SESSION_ID_HEADER = "mcp-session-id";
+/** A new session id for the version: `<base64url(version)>.<32 hex>`, visible ASCII whatever the version holds. */
+export declare function createToolListSessionId(toolListVersion: string): string;
+/** The tool list version a session id carries, or `null` when the id is not one the endpoint issues. */
+export declare function readToolListSessionVersion(sessionId: string): string | null;
+/** Whether a request in this session may be served: its version is the current one. */
+export declare function isToolListSessionCurrent(sessionId: string, toolListVersion: string): boolean;
+/** The answer to a request in a session from another tool list version: the client starts a new session. */
+export declare function createSessionRenewalResponse(): Response;
+/**
+ * Whether the request is a JSON-RPC `initialize`: a POST without a session id whose JSON body asks for it. The body
+ * is read from a clone, and a body over `maxBytes` is not read (the SDK refuses it with 413 anyway).
+ */
+export declare function isInitializeRequest(request: Request, maxBytes: number): Promise<boolean>;
+/**
+ * The `initialize` answer with `capabilities.tools.listChanged: false`, since no answer of the endpoint ever carries
+ * the notification, and with the session id when there is one. The body keeps its format (JSON or one SSE event);
+ * an answer that is not a successful `InitializeResult` is returned as it is.
+ */
+export declare function rewriteInitializeAnswer(response: Response, sessionId: string | null): Promise<Response>;
+//# sourceMappingURL=tool-list-session.d.ts.map

package/dist/server/tool-list-session.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"tool-list-session.d.ts","sourceRoot":"","sources":["../../src/server/tool-list-session.ts"],"names":[],"mappings":"AAQA,yDAAyD;AACzD,eAAO,MAAM,qBAAqB,mBAAmB,CAAC;AAOtD,mHAAmH;AACnH,wBAAgB,uBAAuB,CAAC,eAAe,EAAE,MAAM,GAAG,MAAM,CAEvE;AAED,wGAAwG;AACxG,wBAAgB,0BAA0B,CAAC,SAAS,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAI3E;AAED,uFAAuF;AACvF,wBAAgB,wBAAwB,CAAC,SAAS,EAAE,MAAM,EAAE,eAAe,EAAE,MAAM,GAAG,OAAO,CAE5F;AAED,4GAA4G;AAC5G,wBAAgB,4BAA4B,IAAI,QAAQ,CAKvD;AAED;;;GAGG;AACH,wBAAsB,mBAAmB,CAAC,OAAO,EAAE,OAAO,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAc9F;AAED;;;;GAIG;AACH,wBAAsB,uBAAuB,CAAC,QAAQ,EAAE,QAAQ,EAAE,SAAS,EAAE,MAAM,GAAG,IAAI,GAAG,OAAO,CAAC,QAAQ,CAAC,CAsB7G"}

package/dist/server/tool-list-session.js

@@ -0,0 +1,97 @@
+// Sessions tied to the tool list version (#1055). A hosted client keeps its cached `tools/list` for as long as its
+// connection lives, even after a release changed a tool, and the endpoint has no channel to send
+// `notifications/tools/list_changed`. So the endpoint answers `initialize` with an `Mcp-Session-Id` that carries the
+// tool list version of the identity's access level, and a later request whose session carries another version gets
+// `404 Not Found`: Streamable HTTP defines that as "start a new session", so the client initializes again and lists
+// the tools again. Nothing is stored: the id itself holds the version, so any instance can check it.
+import { randomBytes } from "node:crypto";
+/** The header that carries the session id, both ways. */
+export const MCP_SESSION_ID_HEADER = "mcp-session-id";
+/** Random bytes after the version, as hex. */
+const RANDOM_BYTES = 16;
+const SESSION_ID_PATTERN = /^([A-Za-z0-9_-]+)\.[0-9a-f]+$/;
+const SSE_DATA_PREFIX = "data: ";
+/** A new session id for the version: `<base64url(version)>.<32 hex>`, visible ASCII whatever the version holds. */
+export function createToolListSessionId(toolListVersion) {
+    return `${Buffer.from(toolListVersion, "utf8").toString("base64url")}.${randomBytes(RANDOM_BYTES).toString("hex")}`;
+}
+/** The tool list version a session id carries, or `null` when the id is not one the endpoint issues. */
+export function readToolListSessionVersion(sessionId) {
+    const match = SESSION_ID_PATTERN.exec(sessionId);
+    if (match?.[1] === undefined)
+        return null;
+    return Buffer.from(match[1], "base64url").toString("utf8");
+}
+/** Whether a request in this session may be served: its version is the current one. */
+export function isToolListSessionCurrent(sessionId, toolListVersion) {
+    return readToolListSessionVersion(sessionId) === toolListVersion;
+}
+/** The answer to a request in a session from another tool list version: the client starts a new session. */
+export function createSessionRenewalResponse() {
+    return Response.json({ jsonrpc: "2.0", error: { code: -32001, message: "Session not found: the tool list changed, initialize again" }, id: null }, { status: 404, headers: { "cache-control": "no-store" } });
+}
+/**
+ * Whether the request is a JSON-RPC `initialize`: a POST without a session id whose JSON body asks for it. The body
+ * is read from a clone, and a body over `maxBytes` is not read (the SDK refuses it with 413 anyway).
+ */
+export async function isInitializeRequest(request, maxBytes) {
+    if (request.method !== "POST" || request.headers.has(MCP_SESSION_ID_HEADER))
+        return false;
+    const length = Number(request.headers.get("content-length") ?? "0");
+    if (!Number.isFinite(length) || length > maxBytes)
+        return false;
+    let body;
+    try {
+        const text = await request.clone().text();
+        if (text.length > maxBytes)
+            return false;
+        body = JSON.parse(text);
+    }
+    catch {
+        // Not JSON: the SDK answers the parse error itself.
+        return false;
+    }
+    return typeof body === "object" && body !== null && !Array.isArray(body) && body.method === "initialize";
+}
+/**
+ * The `initialize` answer with `capabilities.tools.listChanged: false`, since no answer of the endpoint ever carries
+ * the notification, and with the session id when there is one. The body keeps its format (JSON or one SSE event);
+ * an answer that is not a successful `InitializeResult` is returned as it is.
+ */
+export async function rewriteInitializeAnswer(response, sessionId) {
+    if (response.status !== 200)
+        return response;
+    const text = await response.text();
+    const isEventStream = (response.headers.get("content-type") ?? "").includes("text/event-stream");
+    const lines = text.split("\n");
+    const dataIndex = isEventStream ? lines.findIndex((line) => line.startsWith(SSE_DATA_PREFIX)) : -1;
+    const json = isEventStream ? (dataIndex === -1 ? null : (lines[dataIndex] ?? "").slice(SSE_DATA_PREFIX.length)) : text;
+    const answer = parseInitializeAnswer(json);
+    const headers = new Headers(response.headers);
+    // The body changes length, so the old one would be wrong.
+    headers.delete("content-length");
+    const tools = answer?.result?.capabilities?.tools;
+    if (answer === null || answer.result?.protocolVersion === undefined) {
+        return new Response(text, { status: response.status, statusText: response.statusText, headers });
+    }
+    if (tools !== undefined && tools !== null && typeof tools === "object")
+        tools.listChanged = false;
+    if (sessionId !== null)
+        headers.set(MCP_SESSION_ID_HEADER, sessionId);
+    const rewritten = JSON.stringify(answer);
+    if (isEventStream)
+        lines[dataIndex] = `${SSE_DATA_PREFIX}${rewritten}`;
+    return new Response(isEventStream ? lines.join("\n") : rewritten, { status: response.status, statusText: response.statusText, headers });
+}
+/** The answer as JSON, or `null` when there is none or it is not JSON (the SDK's own error text). */
+function parseInitializeAnswer(json) {
+    if (json === null)
+        return null;
+    try {
+        return JSON.parse(json);
+    }
+    catch {
+        return null;
+    }
+}
+//# sourceMappingURL=tool-list-session.js.map

package/dist/server/tool-list-session.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"tool-list-session.js","sourceRoot":"","sources":["../../src/server/tool-list-session.ts"],"names":[],"mappings":"AAAA,mHAAmH;AACnH,iGAAiG;AACjG,qHAAqH;AACrH,mHAAmH;AACnH,oHAAoH;AACpH,qGAAqG;AACrG,OAAO,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAE1C,yDAAyD;AACzD,MAAM,CAAC,MAAM,qBAAqB,GAAG,gBAAgB,CAAC;AAEtD,8CAA8C;AAC9C,MAAM,YAAY,GAAG,EAAE,CAAC;AACxB,MAAM,kBAAkB,GAAG,+BAA+B,CAAC;AAC3D,MAAM,eAAe,GAAG,QAAQ,CAAC;AAEjC,mHAAmH;AACnH,MAAM,UAAU,uBAAuB,CAAC,eAAuB;IAC7D,OAAO,GAAG,MAAM,CAAC,IAAI,CAAC,eAAe,EAAE,MAAM,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,IAAI,WAAW,CAAC,YAAY,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;AACtH,CAAC;AAED,wGAAwG;AACxG,MAAM,UAAU,0BAA0B,CAAC,SAAiB;IAC1D,MAAM,KAAK,GAAG,kBAAkB,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;IACjD,IAAI,KAAK,EAAE,CAAC,CAAC,CAAC,KAAK,SAAS;QAAE,OAAO,IAAI,CAAC;IAC1C,OAAO,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,WAAW,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;AAC7D,CAAC;AAED,uFAAuF;AACvF,MAAM,UAAU,wBAAwB,CAAC,SAAiB,EAAE,eAAuB;IACjF,OAAO,0BAA0B,CAAC,SAAS,CAAC,KAAK,eAAe,CAAC;AACnE,CAAC;AAED,4GAA4G;AAC5G,MAAM,UAAU,4BAA4B;IAC1C,OAAO,QAAQ,CAAC,IAAI,CAClB,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,CAAC,KAAK,EAAE,OAAO,EAAE,4DAA4D,EAAE,EAAE,EAAE,EAAE,IAAI,EAAE,EAC5H,EAAE,MAAM,EAAE,GAAG,EAAE,OAAO,EAAE,EAAE,eAAe,EAAE,UAAU,EAAE,EAAE,CAC1D,CAAC;AACJ,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,mBAAmB,CAAC,OAAgB,EAAE,QAAgB;IAC1E,IAAI,OAAO,CAAC,MAAM,KAAK,MAAM,IAAI,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,qBAAqB,CAAC;QAAE,OAAO,KAAK,CAAC;IAC1F,MAAM,MAAM,GAAG,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,gBAAgB,CAAC,IAAI,GAAG,CAAC,CAAC;IACpE,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,MAAM,GAAG,QAAQ;QAAE,OAAO,KAAK,CAAC;IAChE,IAAI,IAAa,CAAC;IAClB,IAAI,CAAC;QACH,MAAM,IAAI,GAAG,MAAM,OAAO,CAAC,KAAK,EAAE,CAAC,IAAI,EAAE,CAAC;QAC1C,IAAI,IAAI,CAAC,MAAM,GAAG,QAAQ;YAAE,OAAO,KAAK,CAAC;QACzC,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IAC1B,CAAC;IAAC,MAAM,CAAC;QACP,oDAAoD;QACpD,OAAO,KAAK,CAAC;IACf,CAAC;IACD,OAAO,OAAO,IAAI,KAAK,QAAQ,IAAI,IAAI,KAAK,IAAI,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,IAAK,IAA6B,CAAC,MAAM,KAAK,YAAY,CAAC;AACrI,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,uBAAuB,CAAC,QAAkB,EAAE,SAAwB;IACxF,IAAI,QAAQ,CAAC,MAAM,KAAK,GAAG;QAAE,OAAO,QAAQ,CAAC;IAC7C,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC;IACnC,MAAM,aAAa,GAAG,CAAC,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,cAAc,CAAC,IAAI,EAAE,CAAC,CAAC,QAAQ,CAAC,mBAAmB,CAAC,CAAC;IACjG,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IAC/B,MAAM,SAAS,GAAG,aAAa,CAAC,CAAC,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,UAAU,CAAC,eAAe,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IACnG,MAAM,IAAI,GAAG,aAAa,CAAC,CAAC,CAAC,CAAC,SAAS,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,SAAS,CAAC,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,eAAe,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IAEvH,MAAM,MAAM,GAAG,qBAAqB,CAAC,IAAI,CAAC,CAAC;IAC3C,MAAM,OAAO,GAAG,IAAI,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;IAC9C,0DAA0D;IAC1D,OAAO,CAAC,MAAM,CAAC,gBAAgB,CAAC,CAAC;IACjC,MAAM,KAAK,GAAG,MAAM,EAAE,MAAM,EAAE,YAAY,EAAE,KAAK,CAAC;IAClD,IAAI,MAAM,KAAK,IAAI,IAAI,MAAM,CAAC,MAAM,EAAE,eAAe,KAAK,SAAS,EAAE,CAAC;QACpE,OAAO,IAAI,QAAQ,CAAC,IAAI,EAAE,EAAE,MAAM,EAAE,QAAQ,CAAC,MAAM,EAAE,UAAU,EAAE,QAAQ,CAAC,UAAU,EAAE,OAAO,EAAE,CAAC,CAAC;IACnG,CAAC;IACD,IAAI,KAAK,KAAK,SAAS,IAAI,KAAK,KAAK,IAAI,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,KAAK,CAAC,WAAW,GAAG,KAAK,CAAC;IAClG,IAAI,SAAS,KAAK,IAAI;QAAE,OAAO,CAAC,GAAG,CAAC,qBAAqB,EAAE,SAAS,CAAC,CAAC;IAEtE,MAAM,SAAS,GAAG,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC;IACzC,IAAI,aAAa;QAAE,KAAK,CAAC,SAAS,CAAC,GAAG,GAAG,eAAe,GAAG,SAAS,EAAE,CAAC;IACvE,OAAO,IAAI,QAAQ,CAAC,aAAa,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,SAAS,EAAE,EAAE,MAAM,EAAE,QAAQ,CAAC,MAAM,EAAE,UAAU,EAAE,QAAQ,CAAC,UAAU,EAAE,OAAO,EAAE,CAAC,CAAC;AAC3I,CAAC;AAED,qGAAqG;AACrG,SAAS,qBAAqB,CAAC,IAAmB;IAChD,IAAI,IAAI,KAAK,IAAI;QAAE,OAAO,IAAI,CAAC;IAC/B,IAAI,CAAC;QACH,OAAO,IAAI,CAAC,KAAK,CAAC,IAAI,CAAqB,CAAC;IAC9C,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC"}

package/dist/testing/index.d.ts

@@ -1,2 +1,3 @@
 export { expectToolCatalogMatchesServer, getToolCatalogDifferences, measureServedToolLists, type ServedToolLists, type ToolCatalogDifferences, } from "./catalog.js";
+export { expectToolListSessionRenewed } from "./sessions.js";
 //# sourceMappingURL=index.d.ts.map

package/dist/testing/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/testing/index.ts"],"names":[],"mappings":"AACA,OAAO,EACL,8BAA8B,EAC9B,yBAAyB,EACzB,sBAAsB,EACtB,KAAK,eAAe,EACpB,KAAK,sBAAsB,GAC5B,MAAM,cAAc,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/testing/index.ts"],"names":[],"mappings":"AACA,OAAO,EACL,8BAA8B,EAC9B,yBAAyB,EACzB,sBAAsB,EACtB,KAAK,eAAe,EACpB,KAAK,sBAAsB,GAC5B,MAAM,cAAc,CAAC;AACtB,OAAO,EAAE,4BAA4B,EAAE,MAAM,eAAe,CAAC"}

package/dist/testing/index.js

@@ -1,3 +1,4 @@
 // `@softure-ai/mcp-access/testing`: checks for an app's own tests.
 export { expectToolCatalogMatchesServer, getToolCatalogDifferences, measureServedToolLists, } from "./catalog.js";
+export { expectToolListSessionRenewed } from "./sessions.js";
 //# sourceMappingURL=index.js.map

package/dist/testing/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/testing/index.ts"],"names":[],"mappings":"AAAA,mEAAmE;AACnE,OAAO,EACL,8BAA8B,EAC9B,yBAAyB,EACzB,sBAAsB,GAGvB,MAAM,cAAc,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/testing/index.ts"],"names":[],"mappings":"AAAA,mEAAmE;AACnE,OAAO,EACL,8BAA8B,EAC9B,yBAAyB,EACzB,sBAAsB,GAGvB,MAAM,cAAc,CAAC;AACtB,OAAO,EAAE,4BAA4B,EAAE,MAAM,eAAe,CAAC"}

package/dist/testing/sessions.d.ts

@@ -0,0 +1,8 @@
+import type { McpServerFactory } from "../server/endpoint.js";
+/**
+ * Throws unless a session opened under `before` (the previous release's factory) is renewed under `after` for every
+ * access level whose served tool list changed, and kept for every level whose list did not. A pair where no level
+ * changed throws too: the check would prove nothing.
+ */
+export declare function expectToolListSessionRenewed(before: McpServerFactory, after: McpServerFactory): Promise<void>;
+//# sourceMappingURL=sessions.d.ts.map

package/dist/testing/sessions.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sessions.d.ts","sourceRoot":"","sources":["../../src/testing/sessions.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,gBAAgB,EAA6B,MAAM,uBAAuB,CAAC;AAWzF;;;;GAIG;AACH,wBAAsB,4BAA4B,CAAC,MAAM,EAAE,gBAAgB,EAAE,KAAK,EAAE,gBAAgB,GAAG,OAAO,CAAC,IAAI,CAAC,CAanH"}

package/dist/testing/sessions.js

@@ -0,0 +1,40 @@
+import { createToolListSessionId, isToolListSessionCurrent } from "../server/tool-list-session.js";
+import { fingerprintToolList, listServedTools } from "../server/tool-list.js";
+const READER = { userId: "00000000-0000-4000-8000-000000000001", canWrite: false, tokenId: "session-check" };
+const WRITER = { ...READER, canWrite: true };
+const LEVELS = [
+    ["read", READER],
+    ["write", WRITER],
+];
+/**
+ * Throws unless a session opened under `before` (the previous release's factory) is renewed under `after` for every
+ * access level whose served tool list changed, and kept for every level whose list did not. A pair where no level
+ * changed throws too: the check would prove nothing.
+ */
+export async function expectToolListSessionRenewed(before, after) {
+    const problems = [];
+    const unchanged = [];
+    for (const [level, identity] of LEVELS) {
+        const sessionId = createToolListSessionId(await readVersion(before, identity));
+        const isCurrent = isToolListSessionCurrent(sessionId, await readVersion(after, identity));
+        const hasChanged = fingerprintToolList(await listServedTools(() => before(identity))) !== fingerprintToolList(await listServedTools(() => after(identity)));
+        if (!hasChanged)
+            unchanged.push(level);
+        if (hasChanged && isCurrent)
+            problems.push(`the ${level} tool list changed but a session opened before is kept`);
+        if (!hasChanged && !isCurrent)
+            problems.push(`the ${level} tool list did not change but a session opened before is renewed`);
+    }
+    if (unchanged.length === LEVELS.length)
+        problems.push(`the tool list did not change for any access level (${unchanged.join(", ")})`);
+    if (problems.length > 0)
+        throw new Error(`@softure-ai/mcp-access: sessions do not follow the tool list: ${problems.join("; ")}`);
+}
+async function readVersion(factory, identity) {
+    const reader = factory.toolListVersion;
+    if (typeof reader !== "function") {
+        throw new Error("@softure-ai/mcp-access: the factory has no toolListVersion; build it with createMcpServerFactory or pass toolListVersion to createMcpEndpoint");
+    }
+    return reader(identity);
+}
+//# sourceMappingURL=sessions.js.map

package/dist/testing/sessions.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sessions.js","sourceRoot":"","sources":["../../src/testing/sessions.ts"],"names":[],"mappings":"AAIA,OAAO,EAAE,uBAAuB,EAAE,wBAAwB,EAAE,MAAM,gCAAgC,CAAC;AACnG,OAAO,EAAE,mBAAmB,EAAE,eAAe,EAAE,MAAM,wBAAwB,CAAC;AAE9E,MAAM,MAAM,GAAsB,EAAE,MAAM,EAAE,sCAAsC,EAAE,QAAQ,EAAE,KAAK,EAAE,OAAO,EAAE,eAAe,EAAE,CAAC;AAChI,MAAM,MAAM,GAAsB,EAAE,GAAG,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC;AAChE,MAAM,MAAM,GAAG;IACb,CAAC,MAAM,EAAE,MAAM,CAAC;IAChB,CAAC,OAAO,EAAE,MAAM,CAAC;CACT,CAAC;AAEX;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,4BAA4B,CAAC,MAAwB,EAAE,KAAuB;IAClG,MAAM,QAAQ,GAAa,EAAE,CAAC;IAC9B,MAAM,SAAS,GAAa,EAAE,CAAC;IAC/B,KAAK,MAAM,CAAC,KAAK,EAAE,QAAQ,CAAC,IAAI,MAAM,EAAE,CAAC;QACvC,MAAM,SAAS,GAAG,uBAAuB,CAAC,MAAM,WAAW,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC,CAAC;QAC/E,MAAM,SAAS,GAAG,wBAAwB,CAAC,SAAS,EAAE,MAAM,WAAW,CAAC,KAAK,EAAE,QAAQ,CAAC,CAAC,CAAC;QAC1F,MAAM,UAAU,GAAG,mBAAmB,CAAC,MAAM,eAAe,CAAC,GAAG,EAAE,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,KAAK,mBAAmB,CAAC,MAAM,eAAe,CAAC,GAAG,EAAE,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC;QAC5J,IAAI,CAAC,UAAU;YAAE,SAAS,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QACvC,IAAI,UAAU,IAAI,SAAS;YAAE,QAAQ,CAAC,IAAI,CAAC,OAAO,KAAK,wDAAwD,CAAC,CAAC;QACjH,IAAI,CAAC,UAAU,IAAI,CAAC,SAAS;YAAE,QAAQ,CAAC,IAAI,CAAC,OAAO,KAAK,kEAAkE,CAAC,CAAC;IAC/H,CAAC;IACD,IAAI,SAAS,CAAC,MAAM,KAAK,MAAM,CAAC,MAAM;QAAE,QAAQ,CAAC,IAAI,CAAC,sDAAsD,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IACrI,IAAI,QAAQ,CAAC,MAAM,GAAG,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,iEAAiE,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;AACnI,CAAC;AAED,KAAK,UAAU,WAAW,CAAC,OAAyB,EAAE,QAA2B;IAC/E,MAAM,MAAM,GAAI,OAA8C,CAAC,eAAe,CAAC;IAC/E,IAAI,OAAO,MAAM,KAAK,UAAU,EAAE,CAAC;QACjC,MAAM,IAAI,KAAK,CAAC,+IAA+I,CAAC,CAAC;IACnK,CAAC;IACD,OAAO,MAAM,CAAC,QAAQ,CAAC,CAAC;AAC1B,CAAC"}

package/module.json

@@ -1,6 +1,6 @@
 {
   "id": "mcp-access",
-  "version": "0.3.0",
+  "version": "0.5.0",
   "dependsOn": { "security": "^0.2.0", "auth": "^0.2.0", "jobs": "^0.1.1?", "ops": "^0.2.0?" },
   "dbSchema": "mcp",
   "tables": ["access_tokens", "oauth_clients", "oauth_authorization_codes", "oauth_grants", "oauth_registration_window", "used_confirmations", "operation_tasks"],

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@softure-ai/mcp-access",
-  "version": "0.3.0",
+  "version": "0.5.0",
   "description": "SOFTURE AI MCP access module: hashed, scoped, expiring access tokens, a rate-limited Bearer endpoint around the app's MCP server factory, and a token page with client setup instructions for Next.js; tool result helpers with a safe error boundary, a stdio entry, a catalog parity check and the softure-mcp prune command.",
   "license": "MIT",
   "type": "module",

package/src/index.ts

@@ -51,7 +51,7 @@ export const API_TOKEN_RATE_LIMIT_BUCKETS = {
 export const mcpAccess = defineModule({
   manifest: {
     id: MODULE_ID,
-    version: "0.3.0",
+    version: "0.5.0",
     dependsOn: { security: "^0.2.0", auth: "^0.2.0", jobs: "^0.1.1?", ops: "^0.2.0?" },
     dbSchema: "mcp",
     tables: ["access_tokens", "oauth_clients", "oauth_authorization_codes", "oauth_grants", "oauth_registration_window", "used_confirmations", "operation_tasks"],

package/src/jobs/index.ts

@@ -26,6 +26,7 @@ export const mcpAccessJobSchedules = {
 export {
   cancelOperation,
   getOperation,
+  getOperationErrorHints,
   getOperationStatus,
   getPollAfterSeconds,
   MAX_OPERATION_DEDUP_KEY_LENGTH,
@@ -44,6 +45,7 @@ export {
   type OperationPollOptions,
   type OperationStatus,
   type OperationStatusToolOptions,
+  type OperationToolContext,
   type ReadOperationResult,
   type StartOperationInput,
 } from "./operations.js";

package/src/jobs/operation-tasks.ts

@@ -70,14 +70,17 @@ export interface OperationTask {
   readonly result?: CallToolResult;
 }
 
-export interface OperationTasksOptions {
-  /** `{ db, clock, config }` of the request. */
-  readonly ctx: JobsContext;
+/** `ctx`, or `getContext` resolved inside each task request (see `OperationToolContext`). */
+export type OperationTasksOptions = OperationTaskContext & {
   /** The request's identity: a task is found only for its owner, and only a writer may cancel it. */
   readonly identity: McpServerIdentity;
   readonly readResult?: ReadOperationResult;
   readonly poll?: OperationPollOptions;
-}
+};
+
+type OperationTaskContext =
+  | { readonly ctx: JobsContext; readonly getContext?: never }
+  | { readonly ctx?: never; readonly getContext: () => Promise<JobsContext> };
 
 export interface AnswerOperationTaskInput {
   readonly jobId: string;
@@ -133,24 +136,26 @@ export async function getOperationTask(
  * `tasks/cancel` for the request's account. Register it on every server whose tools pass `taskRequest`.
  */
 export function registerOperationTasks(server: McpServer, options: OperationTasksOptions): void {
-  const { ctx, identity } = options;
+  const { identity } = options;
+  const resolveContext = (): Promise<JobsContext> => (options.getContext === undefined ? Promise.resolve(options.ctx) : options.getContext());
   const describeOptions = { ...(options.readResult === undefined ? {} : { readResult: options.readResult }), ...(options.poll === undefined ? {} : { poll: options.poll }) };
   server.server.registerCapabilities({ extensions: { [TASKS_EXTENSION]: {} } });
 
   server.server.setRequestHandler("tasks/get", { params: taskIdParams, result: taskResult }, async ({ taskId }, request) => {
     requireTasksCapability(request);
-    return { ...(await requireTask(ctx, identity, taskId, describeOptions)) };
+    return { ...(await requireTask(await resolveContext(), identity, taskId, describeOptions)) };
   });
 
   // Operations never ask for input, so there is nothing to update; an owned task is acknowledged, as the spec asks.
   server.server.setRequestHandler("tasks/update", { params: taskIdParams, result: taskResult }, async ({ taskId }, request) => {
     requireTasksCapability(request);
-    await requireTask(ctx, identity, taskId, describeOptions);
+    await requireTask(await resolveContext(), identity, taskId, describeOptions);
     return {};
   });
 
   server.server.setRequestHandler("tasks/cancel", { params: taskIdParams, result: taskResult }, async ({ taskId }, request) => {
     requireTasksCapability(request);
+    const ctx = await resolveContext();
     const found = await findTask(ctx, identity, taskId);
     if (found === null) throw new ProtocolError(ProtocolErrorCode.InvalidParams, TASK_NOT_FOUND);
     if (found === "expired") throw new ProtocolError(ProtocolErrorCode.InvalidParams, TASK_EXPIRED);

package/src/jobs/operations.ts

@@ -11,13 +11,13 @@
 // keeps after the job ends. Any other job, or another account's, is "not found".
 import { randomUUID } from "node:crypto";
 import type { CallToolResult, McpServer } from "@modelcontextprotocol/server";
-import { err, ok, type Err, type Ok } from "@softure-ai/core";
+import { err, ok, type Err, type Ok, type SoftureConfig } from "@softure-ai/core";
 import { enqueueJob, requestJobCancel, type JobsContext } from "@softure-ai/jobs/server";
 import { z } from "zod";
 import type { McpServerIdentity } from "../contract.js";
-import type { McpAccessMessages } from "../messages/index.js";
+import { mcpAccessMessages, type McpAccessMessages } from "../messages/index.js";
 import { getMcpAccessMessages } from "../server/options.js";
-import { toolResult, withToolErrors, type ToolErrorHints } from "../server/tools.js";
+import { answerValue, toolResult, withToolErrors, type ToolErrorHints } from "../server/tools.js";
 import { answerOperationTask, isTasksRequest, isTaskTtlValid, MAX_TASK_TTL_SECONDS, type OperationTaskRequest } from "./operation-tasks.js";
 import {
   describeOperation,
@@ -76,29 +76,47 @@ export interface StartOperationInput {
   readonly taskTtlSeconds?: number;
 }
 
-interface OperationToolOptions {
-  /** `{ db, clock, config }` of the request. */
-  readonly ctx: JobsContext;
+/**
+ * Where an operation tool finds its `{ db, clock, config }`: the request's context as a value, or a getter resolved
+ * inside each call (for a server factory that opens the database per call, so registering and listing the tools
+ * opens nothing).
+ */
+export type OperationToolContext =
+  | {
+      /** `{ db, clock, config }` of the request. */
+      readonly ctx: JobsContext;
+      readonly getContext?: never;
+      readonly config?: never;
+    }
+  | {
+      readonly ctx?: never;
+      /** Resolves `{ db, clock, config }` inside each call, once per call. */
+      readonly getContext: () => Promise<JobsContext>;
+      /** The app's config for the tool description at registration. Default: the built-in English dictionary. */
+      readonly config?: SoftureConfig;
+    };
+
+type OperationToolOptions = OperationToolContext & {
   /** The request's identity: operations are scoped to `identity.userId`. */
   readonly identity: McpServerIdentity;
   /** Default: the module dictionary's description. */
   readonly description?: string;
-}
+};
 
-export interface OperationStatusToolOptions extends OperationToolOptions {
+export type OperationStatusToolOptions = OperationToolOptions & {
   /** Default `get_operation`. */
   readonly name?: string;
   readonly readResult?: ReadOperationResult;
   readonly poll?: OperationPollOptions;
-}
+};
 
-export interface OperationCancelToolOptions extends OperationToolOptions {
+export type OperationCancelToolOptions = OperationToolOptions & {
   /** Default `cancel_operation`. */
   readonly name?: string;
   /** The status tool the answer points to. Default `get_operation`. */
   readonly statusToolName?: string;
   readonly poll?: OperationPollOptions;
-}
+};
 
 const operationInput = z.object({ operationId: z.string().min(1).max(100) });
 
@@ -171,7 +189,7 @@ export async function cancelOperation(
 /** Registers the read-only status tool (`get_operation`) for the request's account. */
 export function registerOperationStatusTool(server: McpServer, options: OperationStatusToolOptions): void {
   const name = options.name ?? OPERATION_STATUS_TOOL_NAME;
-  const messages = getMcpAccessMessages(options.ctx.config).operations;
+  const messages = getRegistrationMessages(options);
   const getOptions: GetOperationOptions = {
     statusToolName: name,
     ...(options.readResult === undefined ? {} : { readResult: options.readResult }),
@@ -185,7 +203,13 @@ export function registerOperationStatusTool(server: McpServer, options: Operatio
       annotations: { readOnlyHint: true, idempotentHint: true, openWorldHint: false },
     },
     ({ operationId }) =>
-      withToolErrors(() => getOperation(options.ctx, options.identity, operationId, getOptions), { hints: getOperationHints(messages), label: name }),
+      withToolErrors(
+        async () => {
+          const ctx = await resolveOperationContext(options);
+          return answerValue(await getOperation(ctx, options.identity, operationId, getOptions), getOperationErrorHints(ctx.config));
+        },
+        { label: name },
+      ),
   );
 }
 
@@ -193,7 +217,7 @@ export function registerOperationStatusTool(server: McpServer, options: Operatio
 export function registerOperationCancelTool(server: McpServer, options: OperationCancelToolOptions): void {
   if (!options.identity.canWrite) return;
   const name = options.name ?? OPERATION_CANCEL_TOOL_NAME;
-  const messages = getMcpAccessMessages(options.ctx.config).operations;
+  const messages = getRegistrationMessages(options);
   const cancelOptions = { statusToolName: options.statusToolName ?? OPERATION_STATUS_TOOL_NAME, ...(options.poll === undefined ? {} : { poll: options.poll }) };
   server.registerTool(
     name,
@@ -203,11 +227,32 @@ export function registerOperationCancelTool(server: McpServer, options: Operatio
       annotations: { readOnlyHint: false, destructiveHint: true, idempotentHint: true, openWorldHint: false },
     },
     ({ operationId }) =>
-      withToolErrors(() => cancelOperation(options.ctx, options.identity, operationId, cancelOptions), { hints: getOperationHints(messages), label: name }),
+      withToolErrors(
+        async () => {
+          const ctx = await resolveOperationContext(options);
+          return answerValue(await cancelOperation(ctx, options.identity, operationId, cancelOptions), getOperationErrorHints(ctx.config));
+        },
+        { label: name },
+      ),
   );
 }
 
-
-function getOperationHints(messages: McpAccessMessages["operations"]): ToolErrorHints {
+/**
+ * The module's sentences for the operation error codes, as `withToolErrors({ hints })` takes them: for an app that
+ * wraps `getOperation` or `cancelOperation` in tools of its own.
+ */
+export function getOperationErrorHints(config: SoftureConfig): ToolErrorHints {
+  const messages = getMcpAccessMessages(config).operations;
   return { "mcp-access.operation_not_found": messages.notFound, "mcp-access.operation_finished": messages.finished };
 }
+
+/** The context of this call: the value given, or the getter resolved now. */
+function resolveOperationContext(source: OperationToolContext): Promise<JobsContext> {
+  return source.getContext === undefined ? Promise.resolve(source.ctx) : source.getContext();
+}
+
+/** The texts a registration needs before any call: from the context or config given, else the English dictionary. */
+function getRegistrationMessages(source: OperationToolContext): McpAccessMessages["operations"] {
+  const config = source.getContext === undefined ? source.ctx.config : source.config;
+  return config === undefined ? mcpAccessMessages.en.operations : getMcpAccessMessages(config).operations;
+}