toolception 0.2.5 → 0.3.0

package/dist/index.js

@@ -1,10 +1,16 @@
-import { z as f } from "zod";
-import p from "fastify";
-import A from "@fastify/cors";
-import { randomUUID as m } from "node:crypto";
-import { StreamableHTTPServerTransport as w } from "@modelcontextprotocol/sdk/server/streamableHttp.js";
-import { isInitializeRequest as b } from "@modelcontextprotocol/sdk/types.js";
-const g = {
+var w = (r) => {
+  throw TypeError(r);
+};
+var B = (r, e, t) => e.has(r) || w("Cannot " + t);
+var v = (r, e, t) => e.has(r) ? w("Cannot add the same private member more than once") : e instanceof WeakSet ? e.add(r) : e.set(r, t);
+var u = (r, e, t) => (B(r, e, "access private method"), t);
+import { z as T } from "zod";
+import S from "fastify";
+import M from "@fastify/cors";
+import { randomUUID as p } from "node:crypto";
+import { StreamableHTTPServerTransport as C } from "@modelcontextprotocol/sdk/server/streamableHttp.js";
+import { isInitializeRequest as x } from "@modelcontextprotocol/sdk/types.js";
+const b = {
   dynamic: [
     "dynamic-tool-discovery",
     "dynamicToolDiscovery",
@@ -12,89 +18,89 @@ const g = {
   ],
   toolsets: ["tool-sets", "toolSets", "FMP_TOOL_SETS"]
 };
-class S {
+class Y {
   constructor(e = {}) {
     this.keys = {
-      dynamic: e.keys?.dynamic ?? g.dynamic,
-      toolsets: e.keys?.toolsets ?? g.toolsets
+      dynamic: e.keys?.dynamic ?? b.dynamic,
+      toolsets: e.keys?.toolsets ?? b.toolsets
     };
   }
-  resolveMode(e, s) {
-    return this.isDynamicEnabled(s) ? "DYNAMIC" : this.getToolsetsString(s) ? "STATIC" : this.isDynamicEnabled(e) ? "DYNAMIC" : this.getToolsetsString(e) ? "STATIC" : null;
+  resolveMode(e, t) {
+    return this.isDynamicEnabled(t) ? "DYNAMIC" : this.getToolsetsString(t) ? "STATIC" : this.isDynamicEnabled(e) ? "DYNAMIC" : this.getToolsetsString(e) ? "STATIC" : null;
   }
-  parseCommaSeparatedToolSets(e, s) {
+  parseCommaSeparatedToolSets(e, t) {
     if (!e || typeof e != "string") return [];
-    const t = e.split(",").map((i) => i.trim()).filter((i) => i.length > 0), o = new Set(Object.keys(s)), r = [];
-    for (const i of t)
-      o.has(i) ? r.push(i) : console.warn(
-        `Invalid toolset '${i}' ignored. Available: ${Array.from(
+    const s = e.split(",").map((a) => a.trim()).filter((a) => a.length > 0), o = new Set(Object.keys(t)), i = [];
+    for (const a of s)
+      o.has(a) ? i.push(a) : console.warn(
+        `Invalid toolset '${a}' ignored. Available: ${Array.from(
           o
         ).join(", ")}`
       );
-    return r;
+    return i;
   }
-  getModulesForToolSets(e, s) {
-    const t = /* @__PURE__ */ new Set();
+  getModulesForToolSets(e, t) {
+    const s = /* @__PURE__ */ new Set();
     for (const o of e) {
-      const r = s[o];
-      r && (r.modules || []).forEach((i) => t.add(i));
+      const i = t[o];
+      i && (i.modules || []).forEach((a) => s.add(a));
     }
-    return Array.from(t);
+    return Array.from(s);
   }
-  validateToolsetName(e, s) {
+  validateToolsetName(e, t) {
     if (!e || typeof e != "string")
       return {
         isValid: !1,
         error: `Invalid toolset name provided. Must be a non-empty string. Available toolsets: ${Object.keys(
-          s
+          t
         ).join(", ")}`
       };
-    const t = e.trim();
-    return t.length === 0 ? {
+    const s = e.trim();
+    return s.length === 0 ? {
       isValid: !1,
       error: `Empty toolset name provided. Available toolsets: ${Object.keys(
-        s
+        t
       ).join(", ")}`
-    } : s[t] ? { isValid: !0, sanitized: t } : {
+    } : t[s] ? { isValid: !0, sanitized: s } : {
       isValid: !1,
-      error: `Toolset '${t}' not found. Available toolsets: ${Object.keys(
-        s
+      error: `Toolset '${s}' not found. Available toolsets: ${Object.keys(
+        t
       ).join(", ")}`
     };
   }
-  validateToolsetModules(e, s) {
+  validateToolsetModules(e, t) {
     try {
-      const t = this.getModulesForToolSets(e, s);
-      return !t || t.length === 0 ? {
+      const s = this.getModulesForToolSets(e, t);
+      return !s || s.length === 0 ? {
         isValid: !1,
         error: `No modules found for toolsets: ${e.join(", ")}`
-      } : { isValid: !0, modules: t };
-    } catch (t) {
+      } : { isValid: !0, modules: s };
+    } catch (s) {
       return {
         isValid: !1,
-        error: `Error resolving modules for ${e.join(", ")}: ${t instanceof Error ? t.message : "Unknown error"}`
+        error: `Error resolving modules for ${e.join(", ")}: ${s instanceof Error ? s.message : "Unknown error"}`
       };
     }
   }
   isDynamicEnabled(e) {
     if (!e) return !1;
-    for (const s of this.keys.dynamic) {
-      const t = e[s];
-      if (t === !0 || typeof t == "string" && t.trim().toLowerCase() === "true")
+    for (const t of this.keys.dynamic) {
+      const s = e[t];
+      if (s === !0 || typeof s == "string" && s.trim().toLowerCase() === "true")
         return !0;
     }
     return !1;
   }
   getToolsetsString(e) {
     if (e)
-      for (const s of this.keys.toolsets) {
-        const t = e[s];
-        if (typeof t == "string" && t.trim().length > 0)
-          return t;
+      for (const t of this.keys.toolsets) {
+        const s = e[t];
+        if (typeof s == "string" && s.trim().length > 0)
+          return s;
       }
   }
 }
-class x {
+class U {
   constructor(e) {
     this.catalog = e.catalog, this.moduleLoaders = e.moduleLoaders ?? {};
   }
@@ -112,80 +118,80 @@ class x {
           ", "
         )}`
       };
-    const s = e.trim();
-    return s.length === 0 ? {
+    const t = e.trim();
+    return t.length === 0 ? {
       isValid: !1,
       error: `Empty toolset name provided. Available toolsets: ${this.getAvailableToolsets().join(
         ", "
       )}`
-    } : this.catalog[s] ? { isValid: !0, sanitized: s } : {
+    } : this.catalog[t] ? { isValid: !0, sanitized: t } : {
       isValid: !1,
-      error: `Toolset '${s}' not found. Available toolsets: ${this.getAvailableToolsets().join(
+      error: `Toolset '${t}' not found. Available toolsets: ${this.getAvailableToolsets().join(
         ", "
       )}`
     };
   }
-  async resolveToolsForToolsets(e, s) {
-    const t = [];
+  async resolveToolsForToolsets(e, t) {
+    const s = [];
     for (const o of e) {
-      const r = this.catalog[o];
-      if (r && (Array.isArray(r.tools) && r.tools.length > 0 && t.push(...r.tools), Array.isArray(r.modules) && r.modules.length > 0))
-        for (const i of r.modules) {
-          const l = this.moduleLoaders[i];
+      const i = this.catalog[o];
+      if (i && (Array.isArray(i.tools) && i.tools.length > 0 && s.push(...i.tools), Array.isArray(i.modules) && i.modules.length > 0))
+        for (const a of i.modules) {
+          const l = this.moduleLoaders[a];
           if (l)
             try {
-              const n = await l(s);
-              Array.isArray(n) && n.length > 0 && t.push(...n);
+              const n = await l(t);
+              Array.isArray(n) && n.length > 0 && s.push(...n);
             } catch (n) {
               console.warn(
-                `Module loader '${i}' failed for toolset '${o}':`,
+                `Module loader '${a}' failed for toolset '${o}':`,
                 n
               );
             }
         }
     }
-    return t;
+    return s;
   }
 }
-class T extends Error {
-  constructor(e, s, t, o) {
-    super(e), this.name = "ToolingError", this.code = s, this.details = t;
+class A extends Error {
+  constructor(e, t, s, o) {
+    super(e), this.name = "ToolingError", this.code = t, this.details = s;
   }
 }
-class v {
+class I {
   constructor(e = {}) {
     this.names = /* @__PURE__ */ new Set(), this.toolsetToNames = /* @__PURE__ */ new Map(), this.options = {
       namespaceWithToolset: e.namespaceWithToolset ?? !0
     };
   }
-  getSafeName(e, s) {
-    return !this.options.namespaceWithToolset || s.startsWith(`${e}.`) ? s : `${e}.${s}`;
+  getSafeName(e, t) {
+    return !this.options.namespaceWithToolset || t.startsWith(`${e}.`) ? t : `${e}.${t}`;
   }
   has(e) {
     return this.names.has(e);
   }
   add(e) {
     if (this.names.has(e))
-      throw new T(
+      throw new A(
         `Tool name collision: '${e}' already registered`,
         "E_TOOL_NAME_CONFLICT"
       );
     this.names.add(e);
   }
-  addForToolset(e, s) {
-    this.add(s);
-    const t = this.toolsetToNames.get(e) ?? /* @__PURE__ */ new Set();
-    t.add(s), this.toolsetToNames.set(e, t);
+  addForToolset(e, t) {
+    this.add(t);
+    const s = this.toolsetToNames.get(e) ?? /* @__PURE__ */ new Set();
+    s.add(t), this.toolsetToNames.set(e, s);
   }
-  mapAndValidate(e, s) {
-    return s.map((t) => {
-      const o = this.getSafeName(e, t.name);
+  mapAndValidate(e, t) {
+    return t.map((s) => {
+      const o = this.getSafeName(e, s.name);
       if (this.has(o))
-        throw new T(
+        throw new A(
           `Tool name collision for '${o}'`,
           "E_TOOL_NAME_CONFLICT"
         );
-      return { ...t, name: o };
+      return { ...s, name: o };
     });
   }
   list() {
@@ -193,14 +199,14 @@ class v {
   }
   listByToolset() {
     const e = {};
-    for (const [s, t] of this.toolsetToNames.entries())
-      e[s] = Array.from(t);
+    for (const [t, s] of this.toolsetToNames.entries())
+      e[t] = Array.from(s);
     return e;
   }
 }
-class C {
+class W {
   constructor(e) {
-    this.activeToolsets = /* @__PURE__ */ new Set(), this.server = e.server, this.resolver = e.resolver, this.context = e.context, this.onToolsListChanged = e.onToolsListChanged, this.exposurePolicy = e.exposurePolicy, this.toolRegistry = e.toolRegistry ?? new v({ namespaceWithToolset: !0 });
+    this.activeToolsets = /* @__PURE__ */ new Set(), this.server = e.server, this.resolver = e.resolver, this.context = e.context, this.onToolsListChanged = e.onToolsListChanged, this.exposurePolicy = e.exposurePolicy, this.toolRegistry = e.toolRegistry ?? new I({ namespaceWithToolset: !0 });
   }
   getAvailableToolsets() {
     return this.resolver.getAvailableToolsets();
@@ -215,81 +221,81 @@ class C {
     return this.activeToolsets.has(e);
   }
   async enableToolset(e) {
-    const s = this.resolver.validateToolsetName(e);
-    if (!s.isValid || !s.sanitized)
+    const t = this.resolver.validateToolsetName(e);
+    if (!t.isValid || !t.sanitized)
       return {
         success: !1,
-        message: s.error || "Unknown validation error"
+        message: t.error || "Unknown validation error"
       };
-    const t = s.sanitized;
-    if (this.activeToolsets.has(t))
+    const s = t.sanitized;
+    if (this.activeToolsets.has(s))
       return {
         success: !1,
-        message: `Toolset '${t}' is already enabled.`
+        message: `Toolset '${s}' is already enabled.`
       };
     try {
       const o = await this.resolver.resolveToolsForToolsets(
-        [t],
+        [s],
         this.context
       );
-      if (this.exposurePolicy?.allowlist && !this.exposurePolicy.allowlist.includes(t))
+      if (this.exposurePolicy?.allowlist && !this.exposurePolicy.allowlist.includes(s))
         return {
           success: !1,
-          message: `Toolset '${t}' is not allowed by policy.`
+          message: `Toolset '${s}' is not allowed by policy.`
         };
-      if (this.exposurePolicy?.denylist && this.exposurePolicy.denylist.includes(t))
+      if (this.exposurePolicy?.denylist && this.exposurePolicy.denylist.includes(s))
         return {
           success: !1,
-          message: `Toolset '${t}' is denied by policy.`
+          message: `Toolset '${s}' is denied by policy.`
         };
       if (this.exposurePolicy?.maxActiveToolsets !== void 0 && this.activeToolsets.size + 1 > this.exposurePolicy.maxActiveToolsets)
         return this.exposurePolicy.onLimitExceeded?.(
-          [t],
+          [s],
           Array.from(this.activeToolsets)
         ), {
           success: !1,
           message: `Activation exceeds maxActiveToolsets (${this.exposurePolicy.maxActiveToolsets}).`
         };
       if (o && o.length > 0) {
-        const r = this.toolRegistry.mapAndValidate(
-          t,
+        const i = this.toolRegistry.mapAndValidate(
+          s,
           o
         );
-        this.registerDirectTools(r, t);
+        this.registerDirectTools(i, s);
       }
-      this.activeToolsets.add(t);
+      this.activeToolsets.add(s);
       try {
         await this.onToolsListChanged?.();
-      } catch (r) {
-        console.warn("Failed to send tool list change notification:", r);
+      } catch (i) {
+        console.warn("Failed to send tool list change notification:", i);
       }
       return {
         success: !0,
-        message: `Toolset '${t}' enabled successfully. Registered ${o?.length ?? 0} tools.`
+        message: `Toolset '${s}' enabled successfully. Registered ${o?.length ?? 0} tools.`
       };
     } catch (o) {
-      return this.activeToolsets.delete(t), {
+      return this.activeToolsets.delete(s), {
         success: !1,
-        message: `Failed to enable toolset '${t}': ${o instanceof Error ? o.message : "Unknown error"}`
+        message: `Failed to enable toolset '${s}': ${o instanceof Error ? o.message : "Unknown error"}`
       };
     }
   }
   async disableToolset(e) {
-    const s = this.resolver.validateToolsetName(e);
-    if (!s.isValid || !s.sanitized) {
+    const t = this.resolver.validateToolsetName(e);
+    if (!t.isValid || !t.sanitized) {
       const o = Array.from(this.activeToolsets).join(", ") || "none";
       return {
         success: !1,
-        message: `${s.error || "Unknown validation error"} Active toolsets: ${o}`
+        message: `${t.error || "Unknown validation error"} Active toolsets: ${o}`
       };
     }
-    const t = s.sanitized;
-    if (!this.activeToolsets.has(t))
+    const s = t.sanitized;
+    if (!this.activeToolsets.has(s))
       return {
         success: !1,
-        message: `Toolset '${t}' is not currently active. Active toolsets: ${Array.from(this.activeToolsets).join(", ") || "none"}`
+        message: `Toolset '${s}' is not currently active. Active toolsets: ${Array.from(this.activeToolsets).join(", ") || "none"}`
       };
-    this.activeToolsets.delete(t);
+    this.activeToolsets.delete(s);
     try {
       await this.onToolsListChanged?.();
     } catch (o) {
@@ -297,7 +303,7 @@ class C {
     }
     return {
       success: !0,
-      message: `Toolset '${t}' disabled successfully. Individual tools remain registered due to MCP limitations.`
+      message: `Toolset '${s}' disabled successfully. Individual tools remain registered due to MCP limitations.`
     };
   }
   getStatus() {
@@ -312,38 +318,38 @@ class C {
     };
   }
   async enableToolsets(e) {
-    const s = [];
-    for (const r of e)
+    const t = [];
+    for (const i of e)
       try {
-        const i = await this.enableToolset(r);
-        s.push({ name: r, ...i });
-      } catch (i) {
-        s.push({
-          name: r,
+        const a = await this.enableToolset(i);
+        t.push({ name: i, ...a });
+      } catch (a) {
+        t.push({
+          name: i,
           success: !1,
-          message: i instanceof Error ? i.message : "Unknown error",
+          message: a instanceof Error ? a.message : "Unknown error",
           code: "E_INTERNAL"
         });
       }
-    const t = s.every((r) => r.success), o = t ? "All toolsets enabled" : "Some toolsets failed to enable";
-    if (s.length > 0)
+    const s = t.every((i) => i.success), o = s ? "All toolsets enabled" : "Some toolsets failed to enable";
+    if (t.length > 0)
       try {
         await this.onToolsListChanged?.();
       } catch {
       }
-    return { success: t, results: s, message: o };
+    return { success: s, results: t, message: o };
   }
-  registerDirectTools(e, s) {
-    for (const t of e)
+  registerDirectTools(e, t) {
+    for (const s of e)
       try {
         this.server.tool(
-          t.name,
-          t.description,
-          t.inputSchema,
-          async (o) => await t.handler(o)
-        ), s ? this.toolRegistry.addForToolset(s, t.name) : this.toolRegistry.add(t.name);
+          s.name,
+          s.description,
+          s.inputSchema,
+          async (o) => await s.handler(o)
+        ), t ? this.toolRegistry.addForToolset(t, s.name) : this.toolRegistry.add(s.name);
       } catch (o) {
-        throw console.error(`Failed to register direct tool '${t.name}':`, o), o;
+        throw console.error(`Failed to register direct tool '${s.name}':`, o), o;
       }
   }
   async enableAllToolsets() {
@@ -351,34 +357,34 @@ class C {
     return this.enableToolsets(e);
   }
 }
-function I(a, e, s) {
-  const t = s?.mode ?? "DYNAMIC";
-  a.tool(
+function H(r, e, t) {
+  const s = t?.mode ?? "DYNAMIC";
+  r.tool(
     "enable_toolset",
     "Enable a toolset by name",
-    { name: f.string().describe("Toolset name") },
+    { name: T.string().describe("Toolset name") },
     async (o) => {
-      const { name: r } = o, i = await e.enableToolset(r);
+      const { name: i } = o, a = await e.enableToolset(i);
       return {
-        content: [{ type: "text", text: JSON.stringify(i) }]
+        content: [{ type: "text", text: JSON.stringify(a) }]
       };
     }
-  ), a.tool(
+  ), r.tool(
     "disable_toolset",
     "Disable a toolset by name (state only)",
-    { name: f.string().describe("Toolset name") },
+    { name: T.string().describe("Toolset name") },
     async (o) => {
-      const { name: r } = o, i = await e.disableToolset(r);
+      const { name: i } = o, a = await e.disableToolset(i);
       return {
-        content: [{ type: "text", text: JSON.stringify(i) }]
+        content: [{ type: "text", text: JSON.stringify(a) }]
       };
     }
-  ), t === "DYNAMIC" && (a.tool(
+  ), s === "DYNAMIC" && (r.tool(
     "list_toolsets",
     "List available toolsets with active status and definitions",
     {},
     async () => {
-      const o = e.getAvailableToolsets(), r = e.getStatus().toolsetToTools, i = o.map((l) => {
+      const o = e.getAvailableToolsets(), i = e.getStatus().toolsetToTools, a = o.map((l) => {
         const n = e.getToolsetDefinition(l);
         return {
           key: l,
@@ -389,95 +395,95 @@ function I(a, e, s) {
             modules: n.modules ?? [],
             decisionCriteria: n.decisionCriteria ?? void 0
           } : null,
-          tools: r[l] ?? []
+          tools: i[l] ?? []
         };
       });
       return {
         content: [
-          { type: "text", text: JSON.stringify({ toolsets: i }) }
+          { type: "text", text: JSON.stringify({ toolsets: a }) }
         ]
       };
     }
-  ), a.tool(
+  ), r.tool(
     "describe_toolset",
     "Describe a toolset with definition, active status and tools",
-    { name: f.string().describe("Toolset name") },
+    { name: T.string().describe("Toolset name") },
     async (o) => {
-      const { name: r } = o, i = e.getToolsetDefinition(r), l = e.getStatus().toolsetToTools;
-      if (!i)
+      const { name: i } = o, a = e.getToolsetDefinition(i), l = e.getStatus().toolsetToTools;
+      if (!a)
         return {
           content: [
             {
               type: "text",
-              text: JSON.stringify({ error: `Unknown toolset '${r}'` })
+              text: JSON.stringify({ error: `Unknown toolset '${i}'` })
             }
           ]
         };
       const n = {
-        key: r,
-        active: e.isActive(r),
+        key: i,
+        active: e.isActive(i),
         definition: {
-          name: i.name,
-          description: i.description,
-          modules: i.modules ?? [],
-          decisionCriteria: i.decisionCriteria ?? void 0
+          name: a.name,
+          description: a.description,
+          modules: a.modules ?? [],
+          decisionCriteria: a.decisionCriteria ?? void 0
         },
-        tools: l[r] ?? []
+        tools: l[i] ?? []
       };
       return {
         content: [{ type: "text", text: JSON.stringify(n) }]
       };
     }
-  )), a.tool(
+  )), r.tool(
     "list_tools",
     "List currently registered tool names (best effort)",
     {},
     async () => {
-      const o = e.getStatus(), r = {
+      const o = e.getStatus(), i = {
         tools: o.tools,
         toolsetToTools: o.toolsetToTools
       };
       return {
-        content: [{ type: "text", text: JSON.stringify(r) }]
+        content: [{ type: "text", text: JSON.stringify(i) }]
       };
     }
   );
 }
 class y {
   constructor(e) {
-    this.toolsetValidator = new S();
-    const s = e.startup ?? {}, t = this.resolveStartupConfig(s, e.catalog);
-    this.mode = t.mode, this.resolver = new x({
+    this.toolsetValidator = new Y();
+    const t = e.startup ?? {}, s = this.resolveStartupConfig(t, e.catalog);
+    this.mode = s.mode, this.resolver = new U({
       catalog: e.catalog,
       moduleLoaders: e.moduleLoaders
     });
-    const o = new v({
+    const o = new I({
       namespaceWithToolset: e.exposurePolicy?.namespaceToolsWithSetKey ?? !0
     });
-    this.manager = new C({
+    this.manager = new W({
       server: e.server,
       resolver: this.resolver,
       context: e.context,
       onToolsListChanged: e.notifyToolsListChanged,
       exposurePolicy: e.exposurePolicy,
       toolRegistry: o
-    }), e.registerMetaTools !== !1 && I(e.server, this.manager, { mode: this.mode });
-    const r = t.toolsets;
-    r === "ALL" ? this.manager.enableToolsets(this.resolver.getAvailableToolsets()) : Array.isArray(r) && r.length > 0 && this.manager.enableToolsets(r);
+    }), e.registerMetaTools !== !1 && H(e.server, this.manager, { mode: this.mode });
+    const i = s.toolsets;
+    i === "ALL" ? this.manager.enableToolsets(this.resolver.getAvailableToolsets()) : Array.isArray(i) && i.length > 0 && this.manager.enableToolsets(i);
   }
-  resolveStartupConfig(e, s) {
+  resolveStartupConfig(e, t) {
     if (e.mode) {
       if (e.mode === "DYNAMIC" && e.toolsets)
         return console.warn("startup.toolsets provided but ignored in DYNAMIC mode"), { mode: "DYNAMIC" };
       if (e.mode === "STATIC") {
         if (e.toolsets === "ALL")
           return { mode: "STATIC", toolsets: "ALL" };
-        const t = Array.isArray(e.toolsets) ? e.toolsets : [], o = [];
-        for (const r of t) {
-          const { isValid: i, sanitized: l, error: n } = this.toolsetValidator.validateToolsetName(r, s);
-          i && l ? o.push(l) : n && console.warn(n);
+        const s = Array.isArray(e.toolsets) ? e.toolsets : [], o = [];
+        for (const i of s) {
+          const { isValid: a, sanitized: l, error: n } = this.toolsetValidator.validateToolsetName(i, t);
+          a && l ? o.push(l) : n && console.warn(n);
         }
-        if (t.length > 0 && o.length === 0)
+        if (s.length > 0 && o.length === 0)
           throw new Error(
             "STATIC mode requires valid toolsets or 'ALL'; none were valid"
           );
@@ -487,16 +493,16 @@ class y {
     }
     if (e.toolsets === "ALL") return { mode: "STATIC", toolsets: "ALL" };
     if (Array.isArray(e.toolsets) && e.toolsets.length > 0) {
-      const t = [];
+      const s = [];
       for (const o of e.toolsets) {
-        const { isValid: r, sanitized: i, error: l } = this.toolsetValidator.validateToolsetName(o, s);
-        r && i ? t.push(i) : l && console.warn(l);
+        const { isValid: i, sanitized: a, error: l } = this.toolsetValidator.validateToolsetName(o, t);
+        i && a ? s.push(a) : l && console.warn(l);
       }
-      if (t.length === 0)
+      if (s.length === 0)
         throw new Error(
           "STATIC mode requires valid toolsets or 'ALL'; none were valid"
         );
-      return { mode: "STATIC", toolsets: t };
+      return { mode: "STATIC", toolsets: s };
     }
     return { mode: "DYNAMIC" };
   }
@@ -507,11 +513,11 @@ class y {
     return this.manager;
   }
 }
-class M {
+class P {
   constructor(e = {}) {
     this.storage = /* @__PURE__ */ new Map(), this.maxSize = e.maxSize ?? 1e3, this.ttlMs = e.ttlMs ?? 1e3 * 60 * 60;
-    const s = e.pruneIntervalMs ?? 1e3 * 60 * 10;
-    this.pruneInterval = setInterval(() => this.pruneExpired(), s);
+    const t = e.pruneIntervalMs ?? 1e3 * 60 * 10;
+    this.pruneInterval = setInterval(() => this.pruneExpired(), t);
   }
   getEntryCount() {
     return this.storage.size;
@@ -523,13 +529,13 @@ class M {
     return this.ttlMs;
   }
   get(e) {
-    const s = this.storage.get(e);
-    return s ? Date.now() - s.lastAccessed > this.ttlMs ? (this.delete(e), null) : (s.lastAccessed = Date.now(), this.storage.delete(e), this.storage.set(e, s), s.resource) : null;
+    const t = this.storage.get(e);
+    return t ? Date.now() - t.lastAccessed > this.ttlMs ? (this.delete(e), null) : (t.lastAccessed = Date.now(), this.storage.delete(e), this.storage.set(e, t), t.resource) : null;
   }
-  set(e, s) {
+  set(e, t) {
     this.storage.size >= this.maxSize && this.evictLeastRecentlyUsed();
-    const t = { resource: s, lastAccessed: Date.now() };
-    this.storage.set(e, t);
+    const s = { resource: t, lastAccessed: Date.now() };
+    this.storage.set(e, s);
   }
   delete(e) {
     this.storage.delete(e);
@@ -543,27 +549,27 @@ class M {
   }
   pruneExpired() {
     const e = Date.now();
-    for (const [s, t] of this.storage.entries())
-      e - t.lastAccessed > this.ttlMs && this.delete(s);
+    for (const [t, s] of this.storage.entries())
+      e - s.lastAccessed > this.ttlMs && this.delete(t);
   }
 }
-class L {
-  constructor(e, s, t = {}, o) {
-    this.app = null, this.clientCache = new M(), this.defaultManager = e, this.createBundle = s, this.options = {
-      host: t.host ?? "0.0.0.0",
-      port: t.port ?? 3e3,
-      basePath: t.basePath ?? "/",
-      cors: t.cors ?? !0,
-      logger: t.logger ?? !1,
-      app: t.app
+class J {
+  constructor(e, t, s = {}, o) {
+    this.app = null, this.clientCache = new P(), this.defaultManager = e, this.createBundle = t, this.options = {
+      host: s.host ?? "0.0.0.0",
+      port: s.port ?? 3e3,
+      basePath: s.basePath ?? "/",
+      cors: s.cors ?? !0,
+      logger: s.logger ?? !1,
+      app: s.app
     }, this.configSchema = o;
   }
   async start() {
     if (this.app) return;
-    const e = this.options.app ?? p({ logger: this.options.logger });
-    this.options.cors && await e.register(A, { origin: !0 });
-    const s = this.options.basePath.endsWith("/") ? this.options.basePath.slice(0, -1) : this.options.basePath;
-    e.get(`${s}/healthz`, async () => ({ ok: !0 })), e.get(`${s}/tools`, async () => this.defaultManager.getStatus()), e.get(`${s}/.well-known/mcp-config`, async (t, o) => (o.header("Content-Type", "application/schema+json; charset=utf-8"), this.configSchema ?? {
+    const e = this.options.app ?? S({ logger: this.options.logger });
+    this.options.cors && await e.register(M, { origin: !0 });
+    const t = this.options.basePath.endsWith("/") ? this.options.basePath.slice(0, -1) : this.options.basePath;
+    e.get(`${t}/healthz`, async () => ({ ok: !0 })), e.get(`${t}/tools`, async () => this.defaultManager.getStatus()), e.get(`${t}/.well-known/mcp-config`, async (s, o) => (o.header("Content-Type", "application/schema+json; charset=utf-8"), this.configSchema ?? {
       $schema: "https://json-schema.org/draft/2020-12/schema",
       title: "MCP Session Configuration",
       description: "Schema for the /mcp endpoint configuration",
@@ -573,32 +579,32 @@ class L {
       "x-mcp-version": "1.0",
       "x-query-style": "dot+bracket"
     })), e.post(
-      `${s}/mcp`,
-      async (t, o) => {
-        const r = t.headers["mcp-client-id"]?.trim(), i = r && r.length > 0 ? r : `anon-${m()}`, l = !i.startsWith("anon-");
-        let n = l ? this.clientCache.get(i) : null;
+      `${t}/mcp`,
+      async (s, o) => {
+        const i = s.headers["mcp-client-id"]?.trim(), a = i && i.length > 0 ? i : `anon-${p()}`, l = !a.startsWith("anon-");
+        let n = l ? this.clientCache.get(a) : null;
         if (!n) {
-          const h = this.createBundle(), u = h.sessions;
+          const f = this.createBundle(), g = f.sessions;
           n = {
-            server: h.server,
-            orchestrator: h.orchestrator,
-            sessions: u instanceof Map ? u : /* @__PURE__ */ new Map()
-          }, l && this.clientCache.set(i, n);
+            server: f.server,
+            orchestrator: f.orchestrator,
+            sessions: g instanceof Map ? g : /* @__PURE__ */ new Map()
+          }, l && this.clientCache.set(a, n);
         }
-        const c = t.headers["mcp-session-id"];
-        let d;
+        const c = s.headers["mcp-session-id"];
+        let h;
         if (c && n.sessions.get(c))
-          d = n.sessions.get(c);
-        else if (!c && b(t.body)) {
-          const h = m();
-          d = new w({
-            sessionIdGenerator: () => h,
-            onsessioninitialized: (u) => {
-              n.sessions.set(u, d);
+          h = n.sessions.get(c);
+        else if (!c && x(s.body)) {
+          const f = p();
+          h = new C({
+            sessionIdGenerator: () => f,
+            onsessioninitialized: (g) => {
+              n.sessions.set(g, h);
             }
           });
           try {
-            await n.server.connect(d);
+            await n.server.connect(h);
           } catch {
             return o.code(500), {
               jsonrpc: "2.0",
@@ -606,8 +612,8 @@ class L {
               id: null
             };
           }
-          d.onclose = () => {
-            d?.sessionId && n.sessions.delete(d.sessionId);
+          h.onclose = () => {
+            h?.sessionId && n.sessions.delete(h.sessionId);
           };
         } else
           return o.code(400), {
@@ -615,29 +621,29 @@ class L {
             error: { code: -32e3, message: "Session not found or expired" },
             id: null
           };
-        return await d.handleRequest(
-          t.raw,
+        return await h.handleRequest(
+          s.raw,
           o.raw,
-          t.body
+          s.body
         ), o;
       }
-    ), e.get(`${s}/mcp`, async (t, o) => {
-      const r = t.headers["mcp-client-id"]?.trim(), i = r && r.length > 0 ? r : "";
-      if (!i)
+    ), e.get(`${t}/mcp`, async (s, o) => {
+      const i = s.headers["mcp-client-id"]?.trim(), a = i && i.length > 0 ? i : "";
+      if (!a)
         return o.code(400), "Missing mcp-client-id";
-      const l = this.clientCache.get(i);
+      const l = this.clientCache.get(a);
       if (!l)
         return o.code(400), "Invalid or expired client";
-      const n = t.headers["mcp-session-id"];
+      const n = s.headers["mcp-session-id"];
       if (!n)
         return o.code(400), "Missing mcp-session-id";
       const c = l.sessions.get(n);
-      return c ? (await c.handleRequest(t.raw, o.raw), o) : (o.code(400), "Invalid or expired session ID");
+      return c ? (await c.handleRequest(s.raw, o.raw), o) : (o.code(400), "Invalid or expired session ID");
     }), e.delete(
-      `${s}/mcp`,
-      async (t, o) => {
-        const r = t.headers["mcp-client-id"]?.trim(), i = r && r.length > 0 ? r : "", l = t.headers["mcp-session-id"];
-        if (!i || !l)
+      `${t}/mcp`,
+      async (s, o) => {
+        const i = s.headers["mcp-client-id"]?.trim(), a = i && i.length > 0 ? i : "", l = s.headers["mcp-session-id"];
+        if (!a || !l)
           return o.code(400), {
             jsonrpc: "2.0",
             error: {
@@ -646,7 +652,7 @@ class L {
             },
             id: null
           };
-        const n = this.clientCache.get(i), c = n?.sessions.get(l);
+        const n = this.clientCache.get(a), c = n?.sessions.get(l);
         if (!n || !c)
           return o.code(404), {
             jsonrpc: "2.0",
@@ -670,13 +676,13 @@ class L {
     this.app && (this.options.app || await this.app.close(), this.app = null);
   }
 }
-async function O(a) {
-  const e = a.startup?.mode ?? "DYNAMIC";
-  if (typeof a.createServer != "function")
+async function de(r) {
+  const e = r.startup?.mode ?? "DYNAMIC";
+  if (typeof r.createServer != "function")
     throw new Error("createMcpServer: `createServer` (factory) is required");
-  const s = a.createServer(), t = (n) => typeof n?.server?.notification == "function", o = (n) => typeof n?.notifyToolsListChanged == "function", r = async (n) => {
+  const t = r.createServer(), s = (n) => typeof n?.server?.notification == "function", o = (n) => typeof n?.notifyToolsListChanged == "function", i = async (n) => {
     try {
-      if (t(n)) {
+      if (s(n)) {
         await n.server.notification({
           method: "notifications/tools/list_changed"
         });
@@ -685,37 +691,37 @@ async function O(a) {
       o(n) && await n.notifyToolsListChanged();
     } catch {
     }
-  }, i = new y({
-    server: s,
-    catalog: a.catalog,
-    moduleLoaders: a.moduleLoaders,
-    exposurePolicy: a.exposurePolicy,
-    context: a.context,
-    notifyToolsListChanged: async () => r(s),
-    startup: a.startup,
-    registerMetaTools: a.registerMetaTools !== void 0 ? a.registerMetaTools : e === "DYNAMIC"
-  }), l = new L(
-    i.getManager(),
+  }, a = new y({
+    server: t,
+    catalog: r.catalog,
+    moduleLoaders: r.moduleLoaders,
+    exposurePolicy: r.exposurePolicy,
+    context: r.context,
+    notifyToolsListChanged: async () => i(t),
+    startup: r.startup,
+    registerMetaTools: r.registerMetaTools !== void 0 ? r.registerMetaTools : e === "DYNAMIC"
+  }), l = new J(
+    a.getManager(),
     () => {
       if (e === "STATIC")
-        return { server: s, orchestrator: i };
-      const n = a.createServer(), c = new y({
+        return { server: t, orchestrator: a };
+      const n = r.createServer(), c = new y({
         server: n,
-        catalog: a.catalog,
-        moduleLoaders: a.moduleLoaders,
-        exposurePolicy: a.exposurePolicy,
-        context: a.context,
-        notifyToolsListChanged: async () => r(n),
-        startup: a.startup,
-        registerMetaTools: a.registerMetaTools !== void 0 ? a.registerMetaTools : e === "DYNAMIC"
+        catalog: r.catalog,
+        moduleLoaders: r.moduleLoaders,
+        exposurePolicy: r.exposurePolicy,
+        context: r.context,
+        notifyToolsListChanged: async () => i(n),
+        startup: r.startup,
+        registerMetaTools: r.registerMetaTools !== void 0 ? r.registerMetaTools : e === "DYNAMIC"
       });
       return { server: n, orchestrator: c };
     },
-    a.http,
-    a.configSchema
+    r.http,
+    r.configSchema
   );
   return {
-    server: s,
+    server: t,
     start: async () => {
       await l.start();
     },
@@ -724,7 +730,476 @@ async function O(a) {
     }
   };
 }
+function q(r) {
+  G(r), K(r), Q(r), X(r);
+}
+function G(r) {
+  if (!r || typeof r != "object")
+    throw new Error(
+      "Permission configuration is required for createPermissionBasedMcpServer"
+    );
+}
+function K(r) {
+  if (!r.source)
+    throw new Error('Permission source must be either "headers" or "config"');
+  if (r.source !== "headers" && r.source !== "config")
+    throw new Error(
+      `Invalid permission source: "${r.source}". Must be either "headers" or "config"`
+    );
+}
+function Q(r) {
+  if (r.source === "config" && !r.staticMap && !r.resolver)
+    throw new Error(
+      "Config-based permissions require at least one of: staticMap or resolver function"
+    );
+}
+function X(r) {
+  if (r.staticMap !== void 0) {
+    if (typeof r.staticMap != "object" || r.staticMap === null)
+      throw new Error(
+        "staticMap must be an object mapping client IDs to toolset arrays"
+      );
+    Z(r.staticMap);
+  }
+  if (r.resolver !== void 0 && typeof r.resolver != "function")
+    throw new Error(
+      "resolver must be a synchronous function: (clientId: string) => string[]"
+    );
+  if (r.defaultPermissions !== void 0 && !Array.isArray(r.defaultPermissions))
+    throw new Error("defaultPermissions must be an array of toolset names");
+  if (r.headerName !== void 0 && (typeof r.headerName != "string" || r.headerName.length === 0))
+    throw new Error("headerName must be a non-empty string");
+}
+function Z(r) {
+  for (const [e, t] of Object.entries(r))
+    if (!Array.isArray(t))
+      throw new Error(
+        `staticMap value for client "${e}" must be an array of toolset names`
+      );
+}
+var m, $, E, L, N;
+class ee {
+  /**
+   * Creates a new PermissionResolver instance.
+   * @param config - The permission configuration defining how permissions are resolved
+   */
+  constructor(e) {
+    v(this, m);
+    this.config = e, this.cache = /* @__PURE__ */ new Map();
+  }
+  /**
+   * Resolves permissions for a client based on the configured source.
+   * Results are cached to improve performance for subsequent requests from the same client.
+   * Handles all errors gracefully by returning empty permissions on failure.
+   * @param clientId - The unique identifier for the client
+   * @param headers - Optional request headers (required for header-based permissions)
+   * @returns Array of toolset names the client is allowed to access
+   */
+  resolvePermissions(e, t) {
+    if (this.cache.has(e))
+      return this.cache.get(e);
+    let s;
+    try {
+      this.config.source === "headers" ? s = u(this, m, $).call(this, t) : s = u(this, m, E).call(this, e), Array.isArray(s) || (console.warn(
+        `Permission resolution returned non-array for client ${e}, using empty permissions`
+      ), s = []), s = s.filter(
+        (o) => typeof o == "string" && o.trim().length > 0
+      );
+    } catch (o) {
+      console.error(
+        `Unexpected error resolving permissions for client ${e}:`,
+        o
+      ), s = [];
+    }
+    return this.cache.set(e, s), s;
+  }
+  /**
+   * Clears the permission cache.
+   * Useful for cleanup during server shutdown or when permissions need to be refreshed.
+   */
+  clearCache() {
+    this.cache.clear();
+  }
+}
+m = new WeakSet(), /**
+ * Parses permissions from request headers.
+ * Extracts comma-separated toolset names from the configured header.
+ * Handles malformed headers gracefully by returning empty permissions.
+ * @param headers - Request headers containing permission data
+ * @returns Array of toolset names from headers, or empty array if header is missing/malformed
+ * @private
+ */
+$ = function(e) {
+  const t = this.config.headerName || "mcp-toolset-permissions", s = e?.[t];
+  if (!s)
+    return [];
+  try {
+    return s.split(",").map((o) => o.trim()).filter((o) => o.length > 0);
+  } catch (o) {
+    return console.warn(
+      `Failed to parse permission header '${t}':`,
+      o
+    ), [];
+  }
+}, /**
+ * Resolves permissions from server-side configuration.
+ * Tries resolver function first (if provided), then falls back to static map,
+ * and finally to default permissions. Handles errors gracefully.
+ * @param clientId - The unique identifier for the client
+ * @returns Array of toolset names from configuration
+ * @private
+ */
+E = function(e) {
+  if (this.config.resolver) {
+    const t = u(this, m, L).call(this, e);
+    if (t !== null)
+      return t;
+  }
+  if (this.config.staticMap) {
+    const t = u(this, m, N).call(this, e);
+    if (t !== null)
+      return t;
+  }
+  return this.config.defaultPermissions || [];
+}, /**
+ * Attempts to resolve permissions using the configured resolver function.
+ * Handles errors gracefully and returns null on failure to allow fallback.
+ * @param clientId - The unique identifier for the client
+ * @returns Array of toolset names if successful, null if resolver fails or returns invalid data
+ * @private
+ */
+L = function(e) {
+  try {
+    const t = this.config.resolver(e);
+    return Array.isArray(t) ? t : (console.warn(
+      `Permission resolver returned non-array for client ${e}, using fallback`
+    ), null);
+  } catch (t) {
+    const s = t instanceof Error ? t.message : String(t);
+    return console.warn(
+      `Permission resolver declined client ${e} (${s}), trying fallback`
+    ), null;
+  }
+}, /**
+ * Looks up permissions in the static map configuration.
+ * Returns null if client is not found to allow fallback to defaults.
+ * @param clientId - The unique identifier for the client
+ * @returns Array of toolset names if found, null if client not in map
+ * @private
+ */
+N = function(e) {
+  const t = this.config.staticMap[e];
+  return t !== void 0 ? Array.isArray(t) ? t : [] : null;
+};
+function se(r, e) {
+  return async (t) => {
+    const s = e.resolvePermissions(
+      t.clientId,
+      t.headers
+    ), o = r(s), i = o.orchestrator.getManager();
+    return s.length > 0 && await i.enableToolsets(s), {
+      server: o.server,
+      orchestrator: o.orchestrator,
+      allowedToolsets: s
+    };
+  };
+}
+var d, D, j, z, O, R, k, F, V, _;
+class te {
+  /**
+   * Creates a new PermissionAwareFastifyTransport instance.
+   * @param defaultManager - Default tool manager for status endpoints
+   * @param createPermissionAwareBundle - Function to create permission-aware bundles
+   * @param options - Transport configuration options
+   * @param configSchema - Optional JSON schema for configuration discovery
+   */
+  constructor(e, t, s = {}, o) {
+    v(this, d);
+    this.app = null, this.clientCache = new P(), this.defaultManager = e, this.createPermissionAwareBundle = t, this.options = {
+      host: s.host ?? "0.0.0.0",
+      port: s.port ?? 3e3,
+      basePath: s.basePath ?? "/",
+      cors: s.cors ?? !0,
+      logger: s.logger ?? !1,
+      app: s.app
+    }, this.configSchema = o;
+  }
+  /**
+   * Starts the Fastify server and registers all MCP endpoints.
+   * Sets up routes for health checks, tool status, and MCP protocol handling.
+   */
+  async start() {
+    if (this.app) return;
+    const e = this.options.app ?? S({ logger: this.options.logger });
+    this.options.cors && await e.register(M, { origin: !0 });
+    const t = u(this, d, D).call(this, this.options.basePath);
+    u(this, d, j).call(this, e, t), u(this, d, z).call(this, e, t), u(this, d, O).call(this, e, t), u(this, d, R).call(this, e, t), u(this, d, k).call(this, e, t), u(this, d, F).call(this, e, t), this.options.app || await e.listen({ host: this.options.host, port: this.options.port }), this.app = e;
+  }
+  /**
+   * Stops the Fastify server and cleans up resources.
+   */
+  async stop() {
+    this.app && (this.options.app || await this.app.close(), this.app = null);
+  }
+}
+d = new WeakSet(), /**
+ * Normalizes the base path by removing trailing slashes.
+ * @param basePath - The base path to normalize
+ * @returns Normalized base path without trailing slash
+ * @private
+ */
+D = function(e) {
+  return e.endsWith("/") ? e.slice(0, -1) : e;
+}, /**
+ * Registers the health check endpoint.
+ * @param app - Fastify instance
+ * @param base - Base path for routes
+ * @private
+ */
+j = function(e, t) {
+  e.get(`${t}/healthz`, async () => ({ ok: !0 }));
+}, /**
+ * Registers the tools status endpoint.
+ * @param app - Fastify instance
+ * @param base - Base path for routes
+ * @private
+ */
+z = function(e, t) {
+  e.get(`${t}/tools`, async () => this.defaultManager.getStatus());
+}, /**
+ * Registers the MCP configuration discovery endpoint.
+ * @param app - Fastify instance
+ * @param base - Base path for routes
+ * @private
+ */
+O = function(e, t) {
+  e.get(`${t}/.well-known/mcp-config`, async (s, o) => (o.header("Content-Type", "application/schema+json; charset=utf-8"), this.configSchema ?? {
+    $schema: "https://json-schema.org/draft/2020-12/schema",
+    title: "MCP Session Configuration",
+    description: "Schema for the /mcp endpoint configuration",
+    type: "object",
+    properties: {},
+    required: [],
+    "x-mcp-version": "1.0",
+    "x-query-style": "dot+bracket"
+  }));
+}, /**
+ * Registers the POST /mcp endpoint for JSON-RPC requests.
+ * Extracts client context, resolves permissions, and handles MCP protocol.
+ * @param app - Fastify instance
+ * @param base - Base path for routes
+ * @private
+ */
+R = function(e, t) {
+  e.post(
+    `${t}/mcp`,
+    async (s, o) => {
+      const i = u(this, d, V).call(this, s), a = !i.clientId.startsWith("anon-");
+      let l = a ? this.clientCache.get(i.clientId) : null;
+      if (!l)
+        try {
+          const h = await this.createPermissionAwareBundle(i), f = h.sessions;
+          l = {
+            server: h.server,
+            orchestrator: h.orchestrator,
+            allowedToolsets: h.allowedToolsets,
+            sessions: f instanceof Map ? f : /* @__PURE__ */ new Map()
+          }, a && this.clientCache.set(i.clientId, l);
+        } catch (h) {
+          return console.error(
+            `Failed to create permission-aware bundle for client ${i.clientId}:`,
+            h
+          ), o.code(403), u(this, d, _).call(this, "Access denied");
+        }
+      const n = s.headers["mcp-session-id"];
+      let c;
+      if (n && l.sessions.get(n))
+        c = l.sessions.get(n);
+      else if (!n && x(s.body)) {
+        const h = p();
+        c = new C({
+          sessionIdGenerator: () => h,
+          onsessioninitialized: (f) => {
+            l.sessions.set(f, c);
+          }
+        });
+        try {
+          await l.server.connect(c);
+        } catch {
+          return o.code(500), {
+            jsonrpc: "2.0",
+            error: { code: -32603, message: "Error initializing server." },
+            id: null
+          };
+        }
+        c.onclose = () => {
+          c?.sessionId && l.sessions.delete(c.sessionId);
+        };
+      } else
+        return o.code(400), {
+          jsonrpc: "2.0",
+          error: { code: -32e3, message: "Session not found or expired" },
+          id: null
+        };
+      return await c.handleRequest(
+        s.raw,
+        o.raw,
+        s.body
+      ), o;
+    }
+  );
+}, /**
+ * Registers the GET /mcp endpoint for SSE notifications.
+ * @param app - Fastify instance
+ * @param base - Base path for routes
+ * @private
+ */
+k = function(e, t) {
+  e.get(`${t}/mcp`, async (s, o) => {
+    const i = s.headers["mcp-client-id"]?.trim(), a = i && i.length > 0 ? i : "";
+    if (!a)
+      return o.code(400), "Missing mcp-client-id";
+    const l = this.clientCache.get(a);
+    if (!l)
+      return o.code(400), "Invalid or expired client";
+    const n = s.headers["mcp-session-id"];
+    if (!n)
+      return o.code(400), "Missing mcp-session-id";
+    const c = l.sessions.get(n);
+    return c ? (await c.handleRequest(s.raw, o.raw), o) : (o.code(400), "Invalid or expired session ID");
+  });
+}, /**
+ * Registers the DELETE /mcp endpoint for session termination.
+ * @param app - Fastify instance
+ * @param base - Base path for routes
+ * @private
+ */
+F = function(e, t) {
+  e.delete(
+    `${t}/mcp`,
+    async (s, o) => {
+      const i = s.headers["mcp-client-id"]?.trim(), a = i && i.length > 0 ? i : "", l = s.headers["mcp-session-id"];
+      if (!a || !l)
+        return o.code(400), {
+          jsonrpc: "2.0",
+          error: {
+            code: -32600,
+            message: "Missing mcp-client-id or mcp-session-id header"
+          },
+          id: null
+        };
+      const n = this.clientCache.get(a), c = n?.sessions.get(l);
+      if (!n || !c)
+        return o.code(404), {
+          jsonrpc: "2.0",
+          error: { code: -32e3, message: "Session not found or expired" },
+          id: null
+        };
+      try {
+        if (typeof c.close == "function")
+          try {
+            await c.close();
+          } catch {
+          }
+      } finally {
+        c?.sessionId ? n.sessions.delete(c.sessionId) : n.sessions.delete(l);
+      }
+      return o.code(204).send(), o;
+    }
+  );
+}, /**
+ * Extracts client context from the request.
+ * Generates anonymous client ID if not provided in headers.
+ * @param req - Fastify request object
+ * @returns Client request context with ID and headers
+ * @private
+ */
+V = function(e) {
+  const t = e.headers["mcp-client-id"]?.trim(), s = t && t.length > 0 ? t : `anon-${p()}`, o = {};
+  for (const [i, a] of Object.entries(e.headers))
+    typeof a == "string" && (o[i] = a);
+  return { clientId: s, headers: o };
+}, /**
+ * Creates a safe error response that doesn't expose unauthorized toolset information.
+ * Used for permission-related errors to prevent information leakage.
+ * @param message - Generic error message to return to client
+ * @param code - JSON-RPC error code (default: -32000 for server error)
+ * @returns JSON-RPC error response object
+ * @private
+ */
+_ = function(e = "Access denied", t = -32e3) {
+  return {
+    jsonrpc: "2.0",
+    error: {
+      code: t,
+      message: e
+    },
+    id: null
+  };
+};
+async function he(r) {
+  if (!r.permissions)
+    throw new Error(
+      "Permission configuration is required for createPermissionBasedMcpServer. Please provide a 'permissions' field in the options."
+    );
+  if (q(r.permissions), r.startup)
+    throw new Error(
+      "Permission-based servers determine toolsets from client permissions. The 'startup' option is not allowed. Remove it from your configuration."
+    );
+  if (typeof r.createServer != "function")
+    throw new Error(
+      "createPermissionBasedMcpServer: `createServer` (factory) is required"
+    );
+  const e = new ee(r.permissions), t = r.createServer(), s = new y({
+    server: t,
+    catalog: r.catalog,
+    moduleLoaders: r.moduleLoaders,
+    exposurePolicy: r.exposurePolicy,
+    context: r.context,
+    notifyToolsListChanged: void 0,
+    // No notifications in STATIC mode
+    startup: { mode: "STATIC", toolsets: [] },
+    registerMetaTools: !1
+  }), o = se(
+    (a) => {
+      const l = r.createServer(), n = new y({
+        server: l,
+        catalog: r.catalog,
+        moduleLoaders: r.moduleLoaders,
+        exposurePolicy: r.exposurePolicy,
+        context: r.context,
+        notifyToolsListChanged: void 0,
+        // No notifications in STATIC mode
+        startup: { mode: "STATIC", toolsets: [] },
+        // Empty - we'll enable manually
+        registerMetaTools: !1
+        // No meta-tools - toolsets are fixed per client
+      });
+      return { server: l, orchestrator: n };
+    },
+    e
+  ), i = new te(
+    s.getManager(),
+    o,
+    r.http,
+    r.configSchema
+  );
+  return {
+    server: t,
+    start: async () => {
+      await i.start();
+    },
+    close: async () => {
+      try {
+        await i.stop();
+      } finally {
+        e.clearCache();
+      }
+    }
+  };
+}
 export {
-  O as createMcpServer
+  de as createMcpServer,
+  he as createPermissionBasedMcpServer
 };
 //# sourceMappingURL=index.js.map