toolception 0.5.1 → 0.5.3

package/dist/index.js

@@ -1,16 +1,18 @@
-var P = (r) => {
+var se = Object.defineProperty;
+var L = (r) => {
   throw TypeError(r);
 };
-var ee = (r, e, s) => e.has(r) || P("Cannot " + s);
-var T = (r, e, s) => e.has(r) ? P("Cannot add the same private member more than once") : e instanceof WeakSet ? e.add(r) : e.set(r, s);
-var f = (r, e, s) => (ee(r, e, "access private method"), s);
-import { z as b } from "zod";
-import N from "fastify";
-import j from "@fastify/cors";
-import { randomUUID as y } from "node:crypto";
-import { StreamableHTTPServerTransport as k } from "@modelcontextprotocol/sdk/server/streamableHttp.js";
-import { isInitializeRequest as D } from "@modelcontextprotocol/sdk/types.js";
-const L = {
+var te = (r, e, s) => e in r ? se(r, e, { enumerable: !0, configurable: !0, writable: !0, value: s }) : r[e] = s;
+var d = (r, e, s) => te(r, typeof e != "symbol" ? e + "" : e, s), oe = (r, e, s) => e.has(r) || L("Cannot " + s);
+var b = (r, e, s) => e.has(r) ? L("Cannot add the same private member more than once") : e instanceof WeakSet ? e.add(r) : e.set(r, s);
+var m = (r, e, s) => (oe(r, e, "access private method"), s);
+import { z as y } from "zod";
+import j from "fastify";
+import k from "@fastify/cors";
+import { randomUUID as T } from "node:crypto";
+import { StreamableHTTPServerTransport as D } from "@modelcontextprotocol/sdk/server/streamableHttp.js";
+import { isInitializeRequest as z } from "@modelcontextprotocol/sdk/types.js";
+const R = {
   dynamic: [
     "dynamic-tool-discovery",
     "dynamicToolDiscovery",
@@ -18,11 +20,12 @@ const L = {
   ],
   toolsets: ["tool-sets", "toolSets", "FMP_TOOL_SETS"]
 };
-class se {
+class re {
   constructor(e = {}) {
+    d(this, "keys");
     this.keys = {
-      dynamic: e.keys?.dynamic ?? L.dynamic,
-      toolsets: e.keys?.toolsets ?? L.toolsets
+      dynamic: e.keys?.dynamic ?? R.dynamic,
+      toolsets: e.keys?.toolsets ?? R.toolsets
     };
   }
   resolveMode(e, s) {
@@ -109,8 +112,10 @@ class se {
       }
   }
 }
-class te {
+class ie {
   constructor(e) {
+    d(this, "catalog");
+    d(this, "moduleLoaders");
     this.catalog = e.catalog, this.moduleLoaders = e.moduleLoaders ?? {};
   }
   getAvailableToolsets() {
@@ -162,14 +167,20 @@ class te {
     return t;
   }
 }
-class R extends Error {
-  constructor(e, s, t, o) {
-    super(e), this.name = "ToolingError", this.code = s, this.details = t;
+class N extends Error {
+  constructor(s, t, o, i) {
+    super(s);
+    d(this, "code");
+    d(this, "details");
+    this.name = "ToolingError", this.code = t, this.details = o;
   }
 }
-class z {
+class O {
   constructor(e = {}) {
-    this.names = /* @__PURE__ */ new Set(), this.toolsetToNames = /* @__PURE__ */ new Map(), this.options = {
+    d(this, "options");
+    d(this, "names", /* @__PURE__ */ new Set());
+    d(this, "toolsetToNames", /* @__PURE__ */ new Map());
+    this.options = {
       namespaceWithToolset: e.namespaceWithToolset ?? !0
     };
   }
@@ -181,7 +192,7 @@ class z {
   }
   add(e) {
     if (this.names.has(e))
-      throw new R(
+      throw new N(
         `Tool name collision: '${e}' already registered`,
         "E_TOOL_NAME_CONFLICT"
       );
@@ -196,7 +207,7 @@ class z {
     return s.map((t) => {
       const o = this.getSafeName(e, t.name);
       if (this.has(o))
-        throw new R(
+        throw new N(
           `Tool name collision for '${o}'`,
           "E_TOOL_NAME_CONFLICT"
         );
@@ -213,9 +224,16 @@ class z {
     return e;
   }
 }
-class oe {
+class ne {
   constructor(e) {
-    this.activeToolsets = /* @__PURE__ */ new Set(), this.server = e.server, this.resolver = e.resolver, this.context = e.context, this.onToolsListChanged = e.onToolsListChanged, this.exposurePolicy = e.exposurePolicy, this.toolRegistry = e.toolRegistry ?? new z({ namespaceWithToolset: !0 });
+    d(this, "server");
+    d(this, "resolver");
+    d(this, "context");
+    d(this, "onToolsListChanged");
+    d(this, "exposurePolicy");
+    d(this, "toolRegistry");
+    d(this, "activeToolsets", /* @__PURE__ */ new Set());
+    this.server = e.server, this.resolver = e.resolver, this.context = e.context, this.onToolsListChanged = e.onToolsListChanged, this.exposurePolicy = e.exposurePolicy, this.toolRegistry = e.toolRegistry ?? new O({ namespaceWithToolset: !0 });
   }
   /**
    * Sends a tool list change notification if configured.
@@ -395,11 +413,11 @@ class oe {
     return this.enableToolsets(e);
   }
 }
-function re(r, e, s) {
+function ae(r, e, s) {
   (s?.mode ?? "DYNAMIC") === "DYNAMIC" && (r.tool(
     "enable_toolset",
     "Enable a toolset by name",
-    { name: b.string().describe("Toolset name") },
+    { name: y.string().describe("Toolset name") },
     async (o) => {
       const i = await e.enableToolset(o.name);
       return {
@@ -409,7 +427,7 @@ function re(r, e, s) {
   ), r.tool(
     "disable_toolset",
     "Disable a toolset by name (state only)",
-    { name: b.string().describe("Toolset name") },
+    { name: y.string().describe("Toolset name") },
     async (o) => {
       const i = await e.disableToolset(o.name);
       return {
@@ -444,7 +462,7 @@ function re(r, e, s) {
   ), r.tool(
     "describe_toolset",
     "Describe a toolset with definition, active status and tools",
-    { name: b.string().describe("Toolset name") },
+    { name: y.string().describe("Toolset name") },
     async (o) => {
       const i = e.getToolsetDefinition(o.name), n = e.getStatus().toolsetToTools;
       if (!i)
@@ -486,25 +504,31 @@ function re(r, e, s) {
     }
   );
 }
-class w {
+class A {
   constructor(e) {
-    this.initError = null, this.toolsetValidator = new se();
+    d(this, "mode");
+    d(this, "resolver");
+    d(this, "manager");
+    d(this, "toolsetValidator");
+    d(this, "initPromise");
+    d(this, "initError", null);
+    this.toolsetValidator = new re();
     const s = e.startup ?? {}, t = this.resolveStartupConfig(s, e.catalog);
-    this.mode = t.mode, this.resolver = new te({
+    this.mode = t.mode, this.resolver = new ie({
       catalog: e.catalog,
       moduleLoaders: e.moduleLoaders
     });
-    const o = new z({
+    const o = new O({
       namespaceWithToolset: e.exposurePolicy?.namespaceToolsWithSetKey ?? !0
     });
-    this.manager = new oe({
+    this.manager = new ne({
       server: e.server,
       resolver: this.resolver,
       context: e.context,
       onToolsListChanged: e.notifyToolsListChanged,
       exposurePolicy: e.exposurePolicy,
       toolRegistry: o
-    }), e.registerMetaTools !== !1 && re(e.server, this.manager, { mode: this.mode });
+    }), e.registerMetaTools !== !1 && ae(e.server, this.manager, { mode: this.mode });
     const i = t.toolsets;
     this.initPromise = this.initializeToolsets(i);
   }
@@ -581,11 +605,17 @@ class w {
     return this.manager;
   }
 }
-var v, S;
-class O {
+var w, E;
+class V {
   constructor(e = {}) {
-    T(this, v);
-    this.storage = /* @__PURE__ */ new Map(), this.maxSize = e.maxSize ?? 1e3, this.ttlMs = e.ttlMs ?? 1e3 * 60 * 60, this.onEvict = e.onEvict;
+    b(this, w);
+    d(this, "storage", /* @__PURE__ */ new Map());
+    d(this, "maxSize");
+    d(this, "ttlMs");
+    d(this, "onEvict");
+    // Use ReturnType<typeof setInterval> for cross-env typings without NodeJS namespace
+    d(this, "pruneInterval");
+    this.maxSize = e.maxSize ?? 1e3, this.ttlMs = e.ttlMs ?? 1e3 * 60 * 60, this.onEvict = e.onEvict;
     const s = e.pruneIntervalMs ?? 1e3 * 60 * 10;
     this.pruneInterval = setInterval(() => this.pruneExpired(), s);
   }
@@ -614,7 +644,7 @@ class O {
    */
   delete(e) {
     const s = this.storage.get(e);
-    s && (this.storage.delete(e), f(this, v, S).call(this, e, s.resource));
+    s && (this.storage.delete(e), m(this, w, E).call(this, e, s.resource));
   }
   /**
    * Stops the background pruning interval and optionally clears all entries.
@@ -631,7 +661,7 @@ class O {
     const e = Array.from(this.storage.entries());
     this.storage.clear();
     for (const [s, t] of e)
-      f(this, v, S).call(this, s, t.resource);
+      m(this, w, E).call(this, s, t.resource);
   }
   /**
    * Evicts the least recently used entry from the cache.
@@ -653,13 +683,13 @@ class O {
       this.delete(t);
   }
 }
-v = new WeakSet(), /**
+w = new WeakSet(), /**
  * Safely calls the evict callback, catching and logging any errors.
  * @param key - The key being evicted
  * @param resource - The resource being evicted
  * @private
  */
-S = function(e, s) {
+E = function(e, s) {
   if (this.onEvict)
     try {
       const t = this.onEvict(e, s);
@@ -670,7 +700,7 @@ S = function(e, s) {
       console.warn(`Error in cache eviction callback for key '${e}':`, t);
     }
 };
-function V(r, e, s, t) {
+function F(r, e, s, t) {
   const o = ["/mcp", "/healthz", "/tools", "/.well-known/mcp-config"];
   for (const i of s) {
     const n = `${e}${i.path}`;
@@ -683,48 +713,48 @@ function V(r, e, s, t) {
       continue;
     }
     const a = i.method.toLowerCase();
-    r[a](n, async (c, d) => {
+    r[a](n, async (c, h) => {
       try {
-        const u = c.headers["mcp-client-id"]?.trim(), p = u && u.length > 0 ? u : `anon-${y()}`;
-        let C;
+        const f = c.headers["mcp-client-id"]?.trim(), v = f && f.length > 0 ? f : `anon-${T()}`;
+        let x;
         if (i.bodySchema) {
-          const m = i.bodySchema.safeParse(c.body);
-          if (!m.success)
-            return A(d, "body", m.error);
-          C = m.data;
+          const g = i.bodySchema.safeParse(c.body);
+          if (!g.success)
+            return S(h, "body", g.error);
+          x = g.data;
         }
-        let x = {};
+        let I = {};
         if (i.querySchema) {
-          const m = i.querySchema.safeParse(c.query);
-          if (!m.success)
-            return A(d, "query", m.error);
-          x = m.data;
+          const g = i.querySchema.safeParse(c.query);
+          if (!g.success)
+            return S(h, "query", g.error);
+          I = g.data;
         }
-        let I = {};
+        let M = {};
         if (i.paramsSchema) {
-          const m = i.paramsSchema.safeParse(c.params);
-          if (!m.success)
-            return A(d, "params", m.error);
-          I = m.data;
+          const g = i.paramsSchema.safeParse(c.params);
+          if (!g.success)
+            return S(h, "params", g.error);
+          M = g.data;
         }
-        const M = {
-          body: C,
-          query: x,
-          params: I,
+        const P = {
+          body: x,
+          query: I,
+          params: M,
           headers: c.headers,
-          clientId: p
+          clientId: v
         };
         if (t?.contextExtractor) {
-          const m = await t.contextExtractor(c);
-          Object.assign(M, m);
+          const g = await t.contextExtractor(c);
+          Object.assign(P, g);
         }
-        const $ = await i.handler(M);
+        const $ = await i.handler(P);
         if (i.responseSchema) {
-          const m = i.responseSchema.safeParse($);
-          return m.success ? m.data : (console.error(
+          const g = i.responseSchema.safeParse($);
+          return g.success ? g.data : (console.error(
             `Response validation failed for ${i.method} ${i.path}:`,
-            m.error
-          ), d.code(500), {
+            g.error
+          ), h.code(500), {
             error: {
               code: "RESPONSE_VALIDATION_ERROR",
               message: "Internal server error: invalid response format"
@@ -732,21 +762,21 @@ function V(r, e, s, t) {
           });
         }
         return $;
-      } catch (u) {
+      } catch (f) {
         return console.error(
           `Error in custom endpoint ${i.method} ${i.path}:`,
-          u
-        ), d.code(500), {
+          f
+        ), h.code(500), {
           error: {
             code: "INTERNAL_ERROR",
-            message: u instanceof Error ? u.message : "Internal server error"
+            message: f instanceof Error ? f.message : "Internal server error"
           }
         };
       }
     });
   }
 }
-function A(r, e, s) {
+function S(r, e, s) {
   return r.code(400), {
     error: {
       code: "VALIDATION_ERROR",
@@ -755,13 +785,20 @@ function A(r, e, s) {
     }
   };
 }
-class ie {
+class le {
   constructor(e, s, t = {}, o) {
-    this.app = null, this.clientCache = new O({
-      onEvict: (i, n) => {
-        this.cleanupBundle(n);
+    d(this, "options");
+    d(this, "defaultManager");
+    d(this, "createBundle");
+    d(this, "app", null);
+    d(this, "configSchema");
+    // Per-client server bundles and per-client session transports
+    d(this, "clientCache", new V({
+      onEvict: (e, s) => {
+        this.cleanupBundle(s);
       }
-    }), this.defaultManager = e, this.createBundle = s, this.options = {
+    }));
+    this.defaultManager = e, this.createBundle = s, this.options = {
       host: t.host ?? "0.0.0.0",
       port: t.port ?? 3e3,
       basePath: t.basePath ?? "/",
@@ -773,8 +810,8 @@ class ie {
   }
   async start() {
     if (this.app) return;
-    const e = this.options.app ?? N({ logger: this.options.logger });
-    this.options.cors && await e.register(j, { origin: !0 });
+    const e = this.options.app ?? j({ logger: this.options.logger });
+    this.options.cors && await e.register(k, { origin: !0 });
     const s = this.options.basePath.endsWith("/") ? this.options.basePath.slice(0, -1) : this.options.basePath;
     e.get(`${s}/healthz`, async () => ({ ok: !0 })), e.get(`${s}/tools`, async () => this.defaultManager.getStatus()), e.get(`${s}/.well-known/mcp-config`, async (t, o) => (o.header("Content-Type", "application/schema+json; charset=utf-8"), this.configSchema ?? {
       $schema: "https://json-schema.org/draft/2020-12/schema",
@@ -788,30 +825,30 @@ class ie {
     })), e.post(
       `${s}/mcp`,
       async (t, o) => {
-        const i = t.headers["mcp-client-id"]?.trim(), n = i && i.length > 0 ? i : `anon-${y()}`, l = !n.startsWith("anon-");
+        const i = t.headers["mcp-client-id"]?.trim(), n = i && i.length > 0 ? i : `anon-${T()}`, l = !n.startsWith("anon-");
         let a = l ? this.clientCache.get(n) : null;
         if (!a) {
-          const u = this.createBundle(), p = u.sessions;
+          const f = this.createBundle(), v = f.sessions;
           a = {
-            server: u.server,
-            orchestrator: u.orchestrator,
-            sessions: p instanceof Map ? p : /* @__PURE__ */ new Map()
+            server: f.server,
+            orchestrator: f.orchestrator,
+            sessions: v instanceof Map ? v : /* @__PURE__ */ new Map()
           }, l && this.clientCache.set(n, a);
         }
         const c = t.headers["mcp-session-id"];
-        let d;
+        let h;
         if (c && a.sessions.get(c))
-          d = a.sessions.get(c);
-        else if (!c && D(t.body)) {
-          const u = y();
-          d = new k({
-            sessionIdGenerator: () => u,
-            onsessioninitialized: (p) => {
-              a.sessions.set(p, d);
+          h = a.sessions.get(c);
+        else if (!c && z(t.body)) {
+          const f = T();
+          h = new D({
+            sessionIdGenerator: () => f,
+            onsessioninitialized: (v) => {
+              a.sessions.set(v, h);
             }
           });
           try {
-            await a.server.connect(d);
+            await a.server.connect(h);
           } catch {
             return o.code(500), {
               jsonrpc: "2.0",
@@ -819,8 +856,8 @@ class ie {
               id: null
             };
           }
-          d.onclose = () => {
-            d?.sessionId && a.sessions.delete(d.sessionId);
+          h.onclose = () => {
+            h?.sessionId && a.sessions.delete(h.sessionId);
           };
         } else
           return o.code(400), {
@@ -828,7 +865,7 @@ class ie {
             error: { code: -32e3, message: "Session not found or expired" },
             id: null
           };
-        return await d.handleRequest(
+        return await h.handleRequest(
           t.raw,
           o.raw,
           t.body
@@ -877,7 +914,7 @@ class ie {
         }
         return o.code(204).send(), o;
       }
-    ), this.options.customEndpoints && this.options.customEndpoints.length > 0 && V(e, s, this.options.customEndpoints), this.options.app || await e.listen({ host: this.options.host, port: this.options.port }), this.app = e;
+    ), this.options.customEndpoints && this.options.customEndpoints.length > 0 && F(e, s, this.options.customEndpoints), this.options.app || await e.listen({ host: this.options.host, port: this.options.port }), this.app = e;
   }
   /**
    * Stops the Fastify server and cleans up all resources.
@@ -904,7 +941,26 @@ class ie {
     e.sessions.clear();
   }
 }
-async function Se(r) {
+const ce = y.object({
+  mode: y.enum(["DYNAMIC", "STATIC"]).optional(),
+  toolsets: y.union([y.array(y.string()), y.literal("ALL")]).optional()
+}).strict();
+async function Ie(r) {
+  if (r.startup)
+    try {
+      ce.parse(r.startup);
+    } catch (a) {
+      if (a instanceof y.ZodError) {
+        const c = a.format();
+        throw new Error(
+          `Invalid startup configuration:
+${JSON.stringify(c, null, 2)}
+
+Hint: Common mistake - use "toolsets" not "initialToolsets"`
+        );
+      }
+      throw a;
+    }
   const e = r.startup?.mode ?? "DYNAMIC";
   if (typeof r.createServer != "function")
     throw new Error("createMcpServer: `createServer` (factory) is required");
@@ -922,7 +978,7 @@ async function Se(r) {
         return;
       console.warn("Failed to send tools list changed notification:", c);
     }
-  }, n = new w({
+  }, n = new A({
     server: s,
     catalog: r.catalog,
     moduleLoaders: r.moduleLoaders,
@@ -933,12 +989,12 @@ async function Se(r) {
     registerMetaTools: r.registerMetaTools !== void 0 ? r.registerMetaTools : e === "DYNAMIC"
   });
   e === "STATIC" && await n.ensureReady();
-  const l = new ie(
+  const l = new le(
     n.getManager(),
     () => {
       if (e === "STATIC")
         return { server: s, orchestrator: n };
-      const a = r.createServer(), c = new w({
+      const a = r.createServer(), c = new A({
         server: a,
         catalog: r.catalog,
         moduleLoaders: r.moduleLoaders,
@@ -963,16 +1019,16 @@ async function Se(r) {
     }
   };
 }
-function ne(r) {
-  ae(r), le(r), ce(r), de(r);
+function de(r) {
+  he(r), ue(r), fe(r), me(r);
 }
-function ae(r) {
+function he(r) {
   if (!r || typeof r != "object")
     throw new Error(
       "Permission configuration is required for createPermissionBasedMcpServer"
     );
 }
-function le(r) {
+function ue(r) {
   if (!r.source)
     throw new Error('Permission source must be either "headers" or "config"');
   if (r.source !== "headers" && r.source !== "config")
@@ -980,19 +1036,19 @@ function le(r) {
       `Invalid permission source: "${r.source}". Must be either "headers" or "config"`
     );
 }
-function ce(r) {
+function fe(r) {
   if (r.source === "config" && !r.staticMap && !r.resolver)
     throw new Error(
       "Config-based permissions require at least one of: staticMap or resolver function"
     );
 }
-function de(r) {
+function me(r) {
   if (r.staticMap !== void 0) {
     if (typeof r.staticMap != "object" || r.staticMap === null)
       throw new Error(
         "staticMap must be an object mapping client IDs to toolset arrays"
       );
-    he(r.staticMap);
+    ge(r.staticMap);
   }
   if (r.resolver !== void 0 && typeof r.resolver != "function")
     throw new Error(
@@ -1003,22 +1059,24 @@ function de(r) {
   if (r.headerName !== void 0 && (typeof r.headerName != "string" || r.headerName.length === 0))
     throw new Error("headerName must be a non-empty string");
 }
-function he(r) {
+function ge(r) {
   for (const [e, s] of Object.entries(r))
     if (!Array.isArray(s))
       throw new Error(
         `staticMap value for client "${e}" must be an array of toolset names`
       );
 }
-var g, F, _, B, H, W;
-class ue {
+var p, _, B, H, Y, W;
+class pe {
   /**
    * Creates a new PermissionResolver instance.
    * @param config - The permission configuration defining how permissions are resolved
    */
   constructor(e) {
-    T(this, g);
-    this.config = e, this.cache = /* @__PURE__ */ new Map(), this.normalizedHeaderName = (e.headerName || "mcp-toolset-permissions").toLowerCase();
+    b(this, p);
+    d(this, "cache", /* @__PURE__ */ new Map());
+    d(this, "normalizedHeaderName");
+    this.config = e, this.normalizedHeaderName = (e.headerName || "mcp-toolset-permissions").toLowerCase();
   }
   /**
    * Resolves permissions for a client based on the configured source.
@@ -1038,7 +1096,7 @@ class ue {
       return this.cache.get(e);
     let t;
     try {
-      this.config.source === "headers" ? t = f(this, g, F).call(this, s) : t = f(this, g, B).call(this, e), Array.isArray(t) || (console.warn(
+      this.config.source === "headers" ? t = m(this, p, _).call(this, s) : t = m(this, p, H).call(this, e), Array.isArray(t) || (console.warn(
         `Permission resolution returned non-array for client ${e}, using empty permissions`
       ), t = []), t = t.filter(
         (o) => typeof o == "string" && o.trim().length > 0
@@ -1067,7 +1125,7 @@ class ue {
     this.cache.clear();
   }
 }
-g = new WeakSet(), /**
+p = new WeakSet(), /**
  * Parses permissions from request headers.
  * Extracts comma-separated toolset names from the configured header.
  * Handles malformed headers gracefully by returning empty permissions.
@@ -1076,10 +1134,10 @@ g = new WeakSet(), /**
  * @returns Array of toolset names from headers, or empty array if header is missing/malformed
  * @private
  */
-F = function(e) {
+_ = function(e) {
   if (!e)
     return [];
-  const s = f(this, g, _).call(this, e, this.normalizedHeaderName);
+  const s = m(this, p, B).call(this, e, this.normalizedHeaderName);
   if (!s)
     return [];
   try {
@@ -1098,7 +1156,7 @@ F = function(e) {
  * @returns The header value if found, undefined otherwise
  * @private
  */
-_ = function(e, s) {
+B = function(e, s) {
   if (e[s] !== void 0)
     return e[s];
   for (const [t, o] of Object.entries(e))
@@ -1112,14 +1170,14 @@ _ = function(e, s) {
  * @returns Array of toolset names from configuration
  * @private
  */
-B = function(e) {
+H = function(e) {
   if (this.config.resolver) {
-    const s = f(this, g, H).call(this, e);
+    const s = m(this, p, Y).call(this, e);
     if (s !== null)
       return s;
   }
   if (this.config.staticMap) {
-    const s = f(this, g, W).call(this, e);
+    const s = m(this, p, W).call(this, e);
     if (s !== null)
       return s;
   }
@@ -1131,7 +1189,7 @@ B = function(e) {
  * @returns Array of toolset names if successful, null if resolver fails or returns invalid data
  * @private
  */
-H = function(e) {
+Y = function(e) {
   try {
     const s = this.config.resolver(e);
     return Array.isArray(s) ? s : (console.warn(
@@ -1154,7 +1212,7 @@ W = function(e) {
   const s = this.config.staticMap[e];
   return s !== void 0 ? Array.isArray(s) ? s : [] : null;
 };
-function fe(r, e) {
+function ye(r, e) {
   return async (s) => {
     const t = e.resolvePermissions(
       s.clientId,
@@ -1179,8 +1237,8 @@ function fe(r, e) {
     };
   };
 }
-var h, Y, U, q, J, G, K, Q, X, E, Z;
-class me {
+var u, U, q, J, G, K, Z, Q, X, C, ee;
+class ve {
   /**
    * Creates a new PermissionAwareFastifyTransport instance.
    * @param defaultManager - Default tool manager for status endpoints
@@ -1189,12 +1247,19 @@ class me {
    * @param configSchema - Optional JSON schema for configuration discovery
    */
   constructor(e, s, t = {}, o) {
-    T(this, h);
-    this.app = null, this.clientCache = new O({
-      onEvict: (i, n) => {
-        f(this, h, Y).call(this, n);
+    b(this, u);
+    d(this, "options");
+    d(this, "defaultManager");
+    d(this, "createPermissionAwareBundle");
+    d(this, "app", null);
+    d(this, "configSchema");
+    // Per-client server bundles and per-client session transports
+    d(this, "clientCache", new V({
+      onEvict: (e, s) => {
+        m(this, u, U).call(this, s);
       }
-    }), this.defaultManager = e, this.createPermissionAwareBundle = s, this.options = {
+    }));
+    this.defaultManager = e, this.createPermissionAwareBundle = s, this.options = {
       host: t.host ?? "0.0.0.0",
       port: t.port ?? 3e3,
       basePath: t.basePath ?? "/",
@@ -1210,12 +1275,12 @@ class me {
    */
   async start() {
     if (this.app) return;
-    const e = this.options.app ?? N({ logger: this.options.logger });
-    this.options.cors && await e.register(j, { origin: !0 });
-    const s = f(this, h, U).call(this, this.options.basePath);
-    f(this, h, q).call(this, e, s), f(this, h, J).call(this, e, s), f(this, h, G).call(this, e, s), f(this, h, K).call(this, e, s), f(this, h, Q).call(this, e, s), f(this, h, X).call(this, e, s), this.options.customEndpoints && this.options.customEndpoints.length > 0 && V(e, s, this.options.customEndpoints, {
+    const e = this.options.app ?? j({ logger: this.options.logger });
+    this.options.cors && await e.register(k, { origin: !0 });
+    const s = m(this, u, q).call(this, this.options.basePath);
+    m(this, u, J).call(this, e, s), m(this, u, G).call(this, e, s), m(this, u, K).call(this, e, s), m(this, u, Z).call(this, e, s), m(this, u, Q).call(this, e, s), m(this, u, X).call(this, e, s), this.options.customEndpoints && this.options.customEndpoints.length > 0 && F(e, s, this.options.customEndpoints, {
       contextExtractor: async (t) => {
-        const o = f(this, h, E).call(this, t);
+        const o = m(this, u, C).call(this, t);
         try {
           const i = await this.createPermissionAwareBundle(o);
           return {
@@ -1241,13 +1306,13 @@ class me {
     this.app && (this.clientCache.stop(!0), this.options.app || await this.app.close(), this.app = null);
   }
 }
-h = new WeakSet(), /**
+u = new WeakSet(), /**
  * Cleans up resources associated with a client bundle.
  * Closes all sessions within the bundle.
  * @param bundle - The client bundle to clean up
  * @private
  */
-Y = function(e) {
+U = function(e) {
   for (const [s, t] of e.sessions.entries())
     try {
       typeof t.close == "function" && t.close().catch((o) => {
@@ -1263,7 +1328,7 @@ Y = function(e) {
  * @returns Normalized base path without trailing slash
  * @private
  */
-U = function(e) {
+q = function(e) {
   return e.endsWith("/") ? e.slice(0, -1) : e;
 }, /**
  * Registers the health check endpoint.
@@ -1271,7 +1336,7 @@ U = function(e) {
  * @param base - Base path for routes
  * @private
  */
-q = function(e, s) {
+J = function(e, s) {
   e.get(`${s}/healthz`, async () => ({ ok: !0 }));
 }, /**
  * Registers the tools status endpoint.
@@ -1279,7 +1344,7 @@ q = function(e, s) {
  * @param base - Base path for routes
  * @private
  */
-J = function(e, s) {
+G = function(e, s) {
   e.get(`${s}/tools`, async () => this.defaultManager.getStatus());
 }, /**
  * Registers the MCP configuration discovery endpoint.
@@ -1287,7 +1352,7 @@ J = function(e, s) {
  * @param base - Base path for routes
  * @private
  */
-G = function(e, s) {
+K = function(e, s) {
   e.get(`${s}/.well-known/mcp-config`, async (t, o) => (o.header("Content-Type", "application/schema+json; charset=utf-8"), this.configSchema ?? {
     $schema: "https://json-schema.org/draft/2020-12/schema",
     title: "MCP Session Configuration",
@@ -1305,42 +1370,42 @@ G = function(e, s) {
  * @param base - Base path for routes
  * @private
  */
-K = function(e, s) {
+Z = function(e, s) {
   e.post(
     `${s}/mcp`,
     async (t, o) => {
-      const i = f(this, h, E).call(this, t), n = !i.clientId.startsWith("anon-");
+      const i = m(this, u, C).call(this, t), n = !i.clientId.startsWith("anon-");
       let l = n ? this.clientCache.get(i.clientId) : null;
       if (!l)
         try {
-          const d = await this.createPermissionAwareBundle(i);
-          d.failedToolsets.length > 0 && console.warn(
-            `Client ${i.clientId} had ${d.failedToolsets.length} toolsets fail to enable: [${d.failedToolsets.join(", ")}]. Successfully enabled: [${d.allowedToolsets.join(", ")}]`
+          const h = await this.createPermissionAwareBundle(i);
+          h.failedToolsets.length > 0 && console.warn(
+            `Client ${i.clientId} had ${h.failedToolsets.length} toolsets fail to enable: [${h.failedToolsets.join(", ")}]. Successfully enabled: [${h.allowedToolsets.join(", ")}]`
           );
-          const u = d.sessions;
+          const f = h.sessions;
           l = {
-            server: d.server,
-            orchestrator: d.orchestrator,
-            allowedToolsets: d.allowedToolsets,
-            failedToolsets: d.failedToolsets,
-            sessions: u instanceof Map ? u : /* @__PURE__ */ new Map()
+            server: h.server,
+            orchestrator: h.orchestrator,
+            allowedToolsets: h.allowedToolsets,
+            failedToolsets: h.failedToolsets,
+            sessions: f instanceof Map ? f : /* @__PURE__ */ new Map()
           }, n && this.clientCache.set(i.clientId, l);
-        } catch (d) {
+        } catch (h) {
           return console.error(
             `Failed to create permission-aware bundle for client ${i.clientId}:`,
-            d
-          ), o.code(403), f(this, h, Z).call(this, "Access denied");
+            h
+          ), o.code(403), m(this, u, ee).call(this, "Access denied");
         }
       const a = t.headers["mcp-session-id"];
       let c;
       if (a && l.sessions.get(a))
         c = l.sessions.get(a);
-      else if (!a && D(t.body)) {
-        const d = y();
-        c = new k({
-          sessionIdGenerator: () => d,
-          onsessioninitialized: (u) => {
-            l.sessions.set(u, c);
+      else if (!a && z(t.body)) {
+        const h = T();
+        c = new D({
+          sessionIdGenerator: () => h,
+          onsessioninitialized: (f) => {
+            l.sessions.set(f, c);
           }
         });
         try {
@@ -1434,8 +1499,8 @@ X = function(e, s) {
  * @returns Client request context with ID and headers
  * @private
  */
-E = function(e) {
-  const s = e.headers["mcp-client-id"]?.trim(), t = s && s.length > 0 ? s : `anon-${y()}`, o = {};
+C = function(e) {
+  const s = e.headers["mcp-client-id"]?.trim(), t = s && s.length > 0 ? s : `anon-${T()}`, o = {};
   for (const [i, n] of Object.entries(e.headers))
     typeof n == "string" && (o[i] = n);
   return { clientId: t, headers: o };
@@ -1447,7 +1512,7 @@ E = function(e) {
  * @returns JSON-RPC error response object
  * @private
  */
-Z = function(e = "Access denied", s = -32e3) {
+ee = function(e = "Access denied", s = -32e3) {
   return {
     jsonrpc: "2.0",
     error: {
@@ -1457,7 +1522,7 @@ Z = function(e = "Access denied", s = -32e3) {
     id: null
   };
 };
-function ge(r) {
+function Te(r) {
   if (!r) return;
   const e = {
     namespaceToolsWithSetKey: r.namespaceToolsWithSetKey
@@ -1472,12 +1537,12 @@ function ge(r) {
     "Permission-based servers: exposurePolicy.onLimitExceeded is ignored. No toolset limits are enforced."
   ), e;
 }
-async function Ee(r) {
+async function Me(r) {
   if (!r.permissions)
     throw new Error(
       "Permission configuration is required for createPermissionBasedMcpServer. Please provide a 'permissions' field in the options."
     );
-  if (ne(r.permissions), r.startup)
+  if (de(r.permissions), r.startup)
     throw new Error(
       "Permission-based servers determine toolsets from client permissions. The 'startup' option is not allowed. Remove it from your configuration."
     );
@@ -1485,9 +1550,9 @@ async function Ee(r) {
     throw new Error(
       "createPermissionBasedMcpServer: `createServer` (factory) is required"
     );
-  const e = ge(
+  const e = Te(
     r.exposurePolicy
-  ), s = new ue(r.permissions), t = r.createServer(), o = new w({
+  ), s = new pe(r.permissions), t = r.createServer(), o = new A({
     server: t,
     catalog: r.catalog,
     moduleLoaders: r.moduleLoaders,
@@ -1497,9 +1562,9 @@ async function Ee(r) {
     // No notifications in STATIC mode
     startup: { mode: "STATIC", toolsets: [] },
     registerMetaTools: !1
-  }), i = fe(
+  }), i = ye(
     (l) => {
-      const a = r.createServer(), c = new w({
+      const a = r.createServer(), c = new A({
         server: a,
         catalog: r.catalog,
         moduleLoaders: r.moduleLoaders,
@@ -1515,7 +1580,7 @@ async function Ee(r) {
       return { server: a, orchestrator: c };
     },
     s
-  ), n = new me(
+  ), n = new ve(
     o.getManager(),
     i,
     r.http,
@@ -1535,16 +1600,16 @@ async function Ee(r) {
     }
   };
 }
-function Ce(r) {
+function Pe(r) {
   return r;
 }
-function xe(r) {
+function $e(r) {
   return r;
 }
 export {
-  Se as createMcpServer,
-  Ee as createPermissionBasedMcpServer,
-  Ce as defineEndpoint,
-  xe as definePermissionAwareEndpoint
+  Ie as createMcpServer,
+  Me as createPermissionBasedMcpServer,
+  Pe as defineEndpoint,
+  $e as definePermissionAwareEndpoint
 };
 //# sourceMappingURL=index.js.map