toolception 0.5.2 → 0.5.4

package/dist/index.js

@@ -1,16 +1,18 @@
-var P = (r) => {
+var te = Object.defineProperty;
+var L = (r) => {
   throw TypeError(r);
 };
-var ee = (r, e, s) => e.has(r) || P("Cannot " + s);
-var w = (r, e, s) => e.has(r) ? P("Cannot add the same private member more than once") : e instanceof WeakSet ? e.add(r) : e.set(r, s);
-var f = (r, e, s) => (ee(r, e, "access private method"), s);
-import { z as p } from "zod";
-import N from "fastify";
-import j from "@fastify/cors";
-import { randomUUID as v } from "node:crypto";
-import { StreamableHTTPServerTransport as k } from "@modelcontextprotocol/sdk/server/streamableHttp.js";
-import { isInitializeRequest as D } from "@modelcontextprotocol/sdk/types.js";
-const L = {
+var se = (r, e, t) => e in r ? te(r, e, { enumerable: !0, configurable: !0, writable: !0, value: t }) : r[e] = t;
+var d = (r, e, t) => se(r, typeof e != "symbol" ? e + "" : e, t), oe = (r, e, t) => e.has(r) || L("Cannot " + t);
+var b = (r, e, t) => e.has(r) ? L("Cannot add the same private member more than once") : e instanceof WeakSet ? e.add(r) : e.set(r, t);
+var m = (r, e, t) => (oe(r, e, "access private method"), t);
+import { z as y } from "zod";
+import j from "fastify";
+import k from "@fastify/cors";
+import { randomUUID as T } from "node:crypto";
+import { StreamableHTTPServerTransport as D } from "@modelcontextprotocol/sdk/server/streamableHttp.js";
+import { isInitializeRequest as O } from "@modelcontextprotocol/sdk/types.js";
+const R = {
   dynamic: [
     "dynamic-tool-discovery",
     "dynamicToolDiscovery",
@@ -18,20 +20,21 @@ const L = {
   ],
   toolsets: ["tool-sets", "toolSets", "FMP_TOOL_SETS"]
 };
-class se {
+class re {
   constructor(e = {}) {
+    d(this, "keys");
     this.keys = {
-      dynamic: e.keys?.dynamic ?? L.dynamic,
-      toolsets: e.keys?.toolsets ?? L.toolsets
+      dynamic: e.keys?.dynamic ?? R.dynamic,
+      toolsets: e.keys?.toolsets ?? R.toolsets
     };
   }
-  resolveMode(e, s) {
-    return this.isDynamicEnabled(s) ? "DYNAMIC" : this.getToolsetsString(s) ? "STATIC" : this.isDynamicEnabled(e) ? "DYNAMIC" : this.getToolsetsString(e) ? "STATIC" : null;
+  resolveMode(e, t) {
+    return this.isDynamicEnabled(t) ? "DYNAMIC" : this.getToolsetsString(t) ? "STATIC" : this.isDynamicEnabled(e) ? "DYNAMIC" : this.getToolsetsString(e) ? "STATIC" : null;
   }
-  parseCommaSeparatedToolSets(e, s) {
+  parseCommaSeparatedToolSets(e, t) {
     if (!e || typeof e != "string") return [];
-    const t = e.split(",").map((n) => n.trim()).filter((n) => n.length > 0), o = new Set(Object.keys(s)), i = [];
-    for (const n of t)
+    const s = e.split(",").map((n) => n.trim()).filter((n) => n.length > 0), o = new Set(Object.keys(t)), i = [];
+    for (const n of s)
       o.has(n) ? i.push(n) : console.warn(
         `Invalid toolset '${n}' ignored. Available: ${Array.from(
           o
@@ -39,32 +42,32 @@ class se {
       );
     return i;
   }
-  getModulesForToolSets(e, s) {
-    const t = /* @__PURE__ */ new Set();
+  getModulesForToolSets(e, t) {
+    const s = /* @__PURE__ */ new Set();
     for (const o of e) {
-      const i = s[o];
-      i && (i.modules || []).forEach((n) => t.add(n));
+      const i = t[o];
+      i && (i.modules || []).forEach((n) => s.add(n));
     }
-    return Array.from(t);
+    return Array.from(s);
   }
-  validateToolsetName(e, s) {
+  validateToolsetName(e, t) {
     if (!e || typeof e != "string")
       return {
         isValid: !1,
         error: `Invalid toolset name provided. Must be a non-empty string. Available toolsets: ${Object.keys(
-          s
+          t
         ).join(", ")}`
       };
-    const t = e.trim();
-    return t.length === 0 ? {
+    const s = e.trim();
+    return s.length === 0 ? {
       isValid: !1,
       error: `Empty toolset name provided. Available toolsets: ${Object.keys(
-        s
+        t
       ).join(", ")}`
-    } : s[t] ? { isValid: !0, sanitized: t } : {
+    } : t[s] ? { isValid: !0, sanitized: s } : {
       isValid: !1,
-      error: `Toolset '${t}' not found. Available toolsets: ${Object.keys(
-        s
+      error: `Toolset '${s}' not found. Available toolsets: ${Object.keys(
+        t
       ).join(", ")}`
     };
   }
@@ -75,42 +78,44 @@ class se {
    * @param catalog - The toolset catalog to validate against
    * @returns Validation result with modules array if valid
    */
-  validateToolsetModules(e, s) {
+  validateToolsetModules(e, t) {
     try {
       for (const o of e)
-        if (!s[o])
+        if (!t[o])
           return {
             isValid: !1,
             error: `Toolset '${o}' not found in catalog`
           };
-      return { isValid: !0, modules: this.getModulesForToolSets(e, s) };
-    } catch (t) {
+      return { isValid: !0, modules: this.getModulesForToolSets(e, t) };
+    } catch (s) {
       return {
         isValid: !1,
-        error: `Error resolving modules for ${e.join(", ")}: ${t instanceof Error ? t.message : "Unknown error"}`
+        error: `Error resolving modules for ${e.join(", ")}: ${s instanceof Error ? s.message : "Unknown error"}`
       };
     }
   }
   isDynamicEnabled(e) {
     if (!e) return !1;
-    for (const s of this.keys.dynamic) {
-      const t = e[s];
-      if (t === !0 || typeof t == "string" && t.trim().toLowerCase() === "true")
+    for (const t of this.keys.dynamic) {
+      const s = e[t];
+      if (s === !0 || typeof s == "string" && s.trim().toLowerCase() === "true")
         return !0;
     }
     return !1;
   }
   getToolsetsString(e) {
     if (e)
-      for (const s of this.keys.toolsets) {
-        const t = e[s];
-        if (typeof t == "string" && t.trim().length > 0)
-          return t;
+      for (const t of this.keys.toolsets) {
+        const s = e[t];
+        if (typeof s == "string" && s.trim().length > 0)
+          return s;
       }
   }
 }
-class te {
+class ie {
   constructor(e) {
+    d(this, "catalog");
+    d(this, "moduleLoaders");
     this.catalog = e.catalog, this.moduleLoaders = e.moduleLoaders ?? {};
   }
   getAvailableToolsets() {
@@ -127,30 +132,30 @@ class te {
           ", "
         )}`
       };
-    const s = e.trim();
-    return s.length === 0 ? {
+    const t = e.trim();
+    return t.length === 0 ? {
       isValid: !1,
       error: `Empty toolset name provided. Available toolsets: ${this.getAvailableToolsets().join(
         ", "
       )}`
-    } : this.catalog[s] ? { isValid: !0, sanitized: s } : {
+    } : this.catalog[t] ? { isValid: !0, sanitized: t } : {
       isValid: !1,
-      error: `Toolset '${s}' not found. Available toolsets: ${this.getAvailableToolsets().join(
+      error: `Toolset '${t}' not found. Available toolsets: ${this.getAvailableToolsets().join(
         ", "
       )}`
     };
   }
-  async resolveToolsForToolsets(e, s) {
-    const t = [];
+  async resolveToolsForToolsets(e, t) {
+    const s = [];
     for (const o of e) {
       const i = this.catalog[o];
-      if (i && (Array.isArray(i.tools) && i.tools.length > 0 && t.push(...i.tools), Array.isArray(i.modules) && i.modules.length > 0))
+      if (i && (Array.isArray(i.tools) && i.tools.length > 0 && s.push(...i.tools), Array.isArray(i.modules) && i.modules.length > 0))
         for (const n of i.modules) {
           const l = this.moduleLoaders[n];
           if (l)
             try {
-              const a = await l(s);
-              Array.isArray(a) && a.length > 0 && t.push(...a);
+              const a = await l(t);
+              Array.isArray(a) && a.length > 0 && s.push(...a);
             } catch (a) {
               console.warn(
                 `Module loader '${n}' failed for toolset '${o}':`,
@@ -159,48 +164,54 @@ class te {
             }
         }
     }
-    return t;
+    return s;
   }
 }
-class R extends Error {
-  constructor(e, s, t, o) {
-    super(e), this.name = "ToolingError", this.code = s, this.details = t;
+class N extends Error {
+  constructor(t, s, o, i) {
+    super(t);
+    d(this, "code");
+    d(this, "details");
+    this.name = "ToolingError", this.code = s, this.details = o;
   }
 }
-class O {
+class z {
   constructor(e = {}) {
-    this.names = /* @__PURE__ */ new Set(), this.toolsetToNames = /* @__PURE__ */ new Map(), this.options = {
+    d(this, "options");
+    d(this, "names", /* @__PURE__ */ new Set());
+    d(this, "toolsetToNames", /* @__PURE__ */ new Map());
+    this.options = {
       namespaceWithToolset: e.namespaceWithToolset ?? !0
     };
   }
-  getSafeName(e, s) {
-    return !this.options.namespaceWithToolset || s.startsWith(`${e}.`) ? s : `${e}.${s}`;
+  getSafeName(e, t) {
+    return !this.options.namespaceWithToolset || t.startsWith(`${e}.`) ? t : `${e}.${t}`;
   }
   has(e) {
     return this.names.has(e);
   }
   add(e) {
     if (this.names.has(e))
-      throw new R(
+      throw new N(
         `Tool name collision: '${e}' already registered`,
         "E_TOOL_NAME_CONFLICT"
       );
     this.names.add(e);
   }
-  addForToolset(e, s) {
-    this.add(s);
-    const t = this.toolsetToNames.get(e) ?? /* @__PURE__ */ new Set();
-    t.add(s), this.toolsetToNames.set(e, t);
+  addForToolset(e, t) {
+    this.add(t);
+    const s = this.toolsetToNames.get(e) ?? /* @__PURE__ */ new Set();
+    s.add(t), this.toolsetToNames.set(e, s);
   }
-  mapAndValidate(e, s) {
-    return s.map((t) => {
-      const o = this.getSafeName(e, t.name);
+  mapAndValidate(e, t) {
+    return t.map((s) => {
+      const o = this.getSafeName(e, s.name);
       if (this.has(o))
-        throw new R(
+        throw new N(
           `Tool name collision for '${o}'`,
           "E_TOOL_NAME_CONFLICT"
         );
-      return { ...t, name: o };
+      return { ...s, name: o };
     });
   }
   list() {
@@ -208,14 +219,21 @@ class O {
   }
   listByToolset() {
     const e = {};
-    for (const [s, t] of this.toolsetToNames.entries())
-      e[s] = Array.from(t);
+    for (const [t, s] of this.toolsetToNames.entries())
+      e[t] = Array.from(s);
     return e;
   }
 }
-class oe {
+class ne {
   constructor(e) {
-    this.activeToolsets = /* @__PURE__ */ new Set(), this.server = e.server, this.resolver = e.resolver, this.context = e.context, this.onToolsListChanged = e.onToolsListChanged, this.exposurePolicy = e.exposurePolicy, this.toolRegistry = e.toolRegistry ?? new O({ namespaceWithToolset: !0 });
+    d(this, "server");
+    d(this, "resolver");
+    d(this, "context");
+    d(this, "onToolsListChanged");
+    d(this, "exposurePolicy");
+    d(this, "toolRegistry");
+    d(this, "activeToolsets", /* @__PURE__ */ new Set());
+    this.server = e.server, this.resolver = e.resolver, this.context = e.context, this.onToolsListChanged = e.onToolsListChanged, this.exposurePolicy = e.exposurePolicy, this.toolRegistry = e.toolRegistry ?? new z({ namespaceWithToolset: !0 });
   }
   /**
    * Sends a tool list change notification if configured.
@@ -250,14 +268,14 @@ class oe {
    * @param skipNotification - If true, skips the tool list change notification (for batch operations)
    * @returns Result object with success status and message
    */
-  async enableToolset(e, s = !1) {
-    const t = this.resolver.validateToolsetName(e);
-    if (!t.isValid || !t.sanitized)
+  async enableToolset(e, t = !1) {
+    const s = this.resolver.validateToolsetName(e);
+    if (!s.isValid || !s.sanitized)
       return {
         success: !1,
-        message: t.error || "Unknown validation error"
+        message: s.error || "Unknown validation error"
       };
-    const o = t.sanitized;
+    const o = s.sanitized;
     if (this.activeToolsets.has(o))
       return {
         success: !1,
@@ -280,7 +298,7 @@ class oe {
         for (const c of a)
           this.registerSingleTool(c, o), n.push(c.name);
       }
-      return this.activeToolsets.add(o), s || await this.notifyToolsChanged(), {
+      return this.activeToolsets.add(o), t || await this.notifyToolsChanged(), {
         success: !0,
         message: `Toolset '${o}' enabled successfully. Registered ${l?.length ?? 0} tools.`
       };
@@ -320,13 +338,13 @@ class oe {
    * @param toolsetKey - The toolset key for tracking
    * @private
    */
-  registerSingleTool(e, s) {
+  registerSingleTool(e, t) {
     this.server.tool(
       e.name,
       e.description,
       e.inputSchema,
-      async (t) => await e.handler(t)
-    ), this.toolRegistry.addForToolset(s, e.name);
+      async (s) => await e.handler(s)
+    ), this.toolRegistry.addForToolset(t, e.name);
   }
   /**
    * Disables a toolset by name.
@@ -335,21 +353,21 @@ class oe {
    * @returns Result object with success status and message
    */
   async disableToolset(e) {
-    const s = this.resolver.validateToolsetName(e);
-    if (!s.isValid || !s.sanitized) {
+    const t = this.resolver.validateToolsetName(e);
+    if (!t.isValid || !t.sanitized) {
       const o = Array.from(this.activeToolsets).join(", ") || "none";
       return {
         success: !1,
-        message: `${s.error || "Unknown validation error"} Active toolsets: ${o}`
+        message: `${t.error || "Unknown validation error"} Active toolsets: ${o}`
       };
     }
-    const t = s.sanitized;
-    return this.activeToolsets.has(t) ? (this.activeToolsets.delete(t), await this.notifyToolsChanged(), {
+    const s = t.sanitized;
+    return this.activeToolsets.has(s) ? (this.activeToolsets.delete(s), await this.notifyToolsChanged(), {
       success: !0,
-      message: `Toolset '${t}' disabled successfully. Individual tools remain registered due to MCP limitations.`
+      message: `Toolset '${s}' disabled successfully. Individual tools remain registered due to MCP limitations.`
     }) : {
       success: !1,
-      message: `Toolset '${t}' is not currently active. Active toolsets: ${Array.from(this.activeToolsets).join(", ") || "none"}`
+      message: `Toolset '${s}' is not currently active. Active toolsets: ${Array.from(this.activeToolsets).join(", ") || "none"}`
     };
   }
   getStatus() {
@@ -370,21 +388,21 @@ class oe {
    * @returns Result object with overall success status and individual results
    */
   async enableToolsets(e) {
-    const s = [];
+    const t = [];
     for (const n of e)
       try {
         const l = await this.enableToolset(n, !0);
-        s.push({ name: n, ...l });
+        t.push({ name: n, ...l });
       } catch (l) {
-        s.push({
+        t.push({
           name: n,
           success: !1,
           message: l instanceof Error ? l.message : "Unknown error",
           code: "E_INTERNAL"
         });
       }
-    const t = s.every((n) => n.success), o = s.some((n) => n.success), i = t ? "All toolsets enabled" : o ? "Some toolsets failed to enable" : "All toolsets failed to enable";
-    return o && await this.notifyToolsChanged(), { success: t, results: s, message: i };
+    const s = t.every((n) => n.success), o = t.some((n) => n.success), i = s ? "All toolsets enabled" : o ? "Some toolsets failed to enable" : "All toolsets failed to enable";
+    return o && await this.notifyToolsChanged(), { success: s, results: t, message: i };
   }
   /**
    * Enables all available toolsets in a batch operation.
@@ -395,11 +413,12 @@ class oe {
     return this.enableToolsets(e);
   }
 }
-function re(r, e, s) {
-  (s?.mode ?? "DYNAMIC") === "DYNAMIC" && (r.tool(
+function ae(r, e, t) {
+  (t?.mode ?? "DYNAMIC") === "DYNAMIC" && (r.tool(
     "enable_toolset",
     "Enable a toolset by name",
-    { name: p.string().describe("Toolset name") },
+    { name: y.string().describe("Toolset name") },
+    { destructiveHint: !0, idempotentHint: !0 },
     async (o) => {
       const i = await e.enableToolset(o.name);
       return {
@@ -409,7 +428,8 @@ function re(r, e, s) {
   ), r.tool(
     "disable_toolset",
     "Disable a toolset by name (state only)",
-    { name: p.string().describe("Toolset name") },
+    { name: y.string().describe("Toolset name") },
+    { destructiveHint: !0, idempotentHint: !0 },
     async (o) => {
       const i = await e.disableToolset(o.name);
       return {
@@ -420,6 +440,7 @@ function re(r, e, s) {
     "list_toolsets",
     "List available toolsets with active status and definitions",
     {},
+    { readOnlyHint: !0, idempotentHint: !0 },
     async () => {
       const o = e.getAvailableToolsets(), i = e.getStatus().toolsetToTools, n = o.map((l) => {
         const a = e.getToolsetDefinition(l);
@@ -444,7 +465,8 @@ function re(r, e, s) {
   ), r.tool(
     "describe_toolset",
     "Describe a toolset with definition, active status and tools",
-    { name: p.string().describe("Toolset name") },
+    { name: y.string().describe("Toolset name") },
+    { readOnlyHint: !0, idempotentHint: !0 },
     async (o) => {
       const i = e.getToolsetDefinition(o.name), n = e.getStatus().toolsetToTools;
       if (!i)
@@ -475,6 +497,7 @@ function re(r, e, s) {
     "list_tools",
     "List currently registered tool names (best effort)",
     {},
+    { readOnlyHint: !0, idempotentHint: !0 },
     async () => {
       const o = e.getStatus(), i = {
         tools: o.tools,
@@ -486,26 +509,32 @@ function re(r, e, s) {
     }
   );
 }
-class b {
+class A {
   constructor(e) {
-    this.initError = null, this.toolsetValidator = new se();
-    const s = e.startup ?? {}, t = this.resolveStartupConfig(s, e.catalog);
-    this.mode = t.mode, this.resolver = new te({
+    d(this, "mode");
+    d(this, "resolver");
+    d(this, "manager");
+    d(this, "toolsetValidator");
+    d(this, "initPromise");
+    d(this, "initError", null);
+    this.toolsetValidator = new re();
+    const t = e.startup ?? {}, s = this.resolveStartupConfig(t, e.catalog);
+    this.mode = s.mode, this.resolver = new ie({
       catalog: e.catalog,
       moduleLoaders: e.moduleLoaders
     });
-    const o = new O({
+    const o = new z({
       namespaceWithToolset: e.exposurePolicy?.namespaceToolsWithSetKey ?? !0
     });
-    this.manager = new oe({
+    this.manager = new ne({
       server: e.server,
       resolver: this.resolver,
       context: e.context,
       onToolsListChanged: e.notifyToolsListChanged,
       exposurePolicy: e.exposurePolicy,
       toolRegistry: o
-    }), e.registerMetaTools !== !1 && re(e.server, this.manager, { mode: this.mode });
-    const i = t.toolsets;
+    }), e.registerMetaTools !== !1 && ae(e.server, this.manager, { mode: this.mode });
+    const i = s.toolsets;
     this.initPromise = this.initializeToolsets(i);
   }
   /**
@@ -518,8 +547,8 @@ class b {
   async initializeToolsets(e) {
     try {
       e === "ALL" ? await this.manager.enableToolsets(this.resolver.getAvailableToolsets()) : Array.isArray(e) && e.length > 0 && await this.manager.enableToolsets(e);
-    } catch (s) {
-      this.initError = s instanceof Error ? s : new Error(String(s)), console.error("Failed to initialize toolsets:", this.initError);
+    } catch (t) {
+      this.initError = t instanceof Error ? t : new Error(String(t)), console.error("Failed to initialize toolsets:", this.initError);
     }
   }
   /**
@@ -539,19 +568,19 @@ class b {
   async isReady() {
     return await this.initPromise, this.initError === null;
   }
-  resolveStartupConfig(e, s) {
+  resolveStartupConfig(e, t) {
     if (e.mode) {
       if (e.mode === "DYNAMIC" && e.toolsets)
         return console.warn("startup.toolsets provided but ignored in DYNAMIC mode"), { mode: "DYNAMIC" };
       if (e.mode === "STATIC") {
         if (e.toolsets === "ALL")
           return { mode: "STATIC", toolsets: "ALL" };
-        const t = Array.isArray(e.toolsets) ? e.toolsets : [], o = [];
-        for (const i of t) {
-          const { isValid: n, sanitized: l, error: a } = this.toolsetValidator.validateToolsetName(i, s);
+        const s = Array.isArray(e.toolsets) ? e.toolsets : [], o = [];
+        for (const i of s) {
+          const { isValid: n, sanitized: l, error: a } = this.toolsetValidator.validateToolsetName(i, t);
           n && l ? o.push(l) : a && console.warn(a);
         }
-        if (t.length > 0 && o.length === 0)
+        if (s.length > 0 && o.length === 0)
           throw new Error(
             "STATIC mode requires valid toolsets or 'ALL'; none were valid"
           );
@@ -561,16 +590,16 @@ class b {
     }
     if (e.toolsets === "ALL") return { mode: "STATIC", toolsets: "ALL" };
     if (Array.isArray(e.toolsets) && e.toolsets.length > 0) {
-      const t = [];
+      const s = [];
       for (const o of e.toolsets) {
-        const { isValid: i, sanitized: n, error: l } = this.toolsetValidator.validateToolsetName(o, s);
-        i && n ? t.push(n) : l && console.warn(l);
+        const { isValid: i, sanitized: n, error: l } = this.toolsetValidator.validateToolsetName(o, t);
+        i && n ? s.push(n) : l && console.warn(l);
       }
-      if (t.length === 0)
+      if (s.length === 0)
         throw new Error(
           "STATIC mode requires valid toolsets or 'ALL'; none were valid"
         );
-      return { mode: "STATIC", toolsets: t };
+      return { mode: "STATIC", toolsets: s };
     }
     return { mode: "DYNAMIC" };
   }
@@ -581,13 +610,19 @@ class b {
     return this.manager;
   }
 }
-var T, S;
-class z {
+var w, E;
+class V {
   constructor(e = {}) {
-    w(this, T);
-    this.storage = /* @__PURE__ */ new Map(), this.maxSize = e.maxSize ?? 1e3, this.ttlMs = e.ttlMs ?? 1e3 * 60 * 60, this.onEvict = e.onEvict;
-    const s = e.pruneIntervalMs ?? 1e3 * 60 * 10;
-    this.pruneInterval = setInterval(() => this.pruneExpired(), s);
+    b(this, w);
+    d(this, "storage", /* @__PURE__ */ new Map());
+    d(this, "maxSize");
+    d(this, "ttlMs");
+    d(this, "onEvict");
+    // Use ReturnType<typeof setInterval> for cross-env typings without NodeJS namespace
+    d(this, "pruneInterval");
+    this.maxSize = e.maxSize ?? 1e3, this.ttlMs = e.ttlMs ?? 1e3 * 60 * 60, this.onEvict = e.onEvict;
+    const t = e.pruneIntervalMs ?? 1e3 * 60 * 10;
+    this.pruneInterval = setInterval(() => this.pruneExpired(), t);
   }
   getEntryCount() {
     return this.storage.size;
@@ -599,13 +634,13 @@ class z {
     return this.ttlMs;
   }
   get(e) {
-    const s = this.storage.get(e);
-    return s ? Date.now() - s.lastAccessed > this.ttlMs ? (this.delete(e), null) : (s.lastAccessed = Date.now(), this.storage.delete(e), this.storage.set(e, s), s.resource) : null;
+    const t = this.storage.get(e);
+    return t ? Date.now() - t.lastAccessed > this.ttlMs ? (this.delete(e), null) : (t.lastAccessed = Date.now(), this.storage.delete(e), this.storage.set(e, t), t.resource) : null;
   }
-  set(e, s) {
+  set(e, t) {
     this.storage.size >= this.maxSize && this.evictLeastRecentlyUsed();
-    const t = { resource: s, lastAccessed: Date.now() };
-    this.storage.set(e, t);
+    const s = { resource: t, lastAccessed: Date.now() };
+    this.storage.set(e, s);
   }
   /**
    * Removes an entry from the cache.
@@ -613,8 +648,8 @@ class z {
    * @param key - The key to remove
    */
   delete(e) {
-    const s = this.storage.get(e);
-    s && (this.storage.delete(e), f(this, T, S).call(this, e, s.resource));
+    const t = this.storage.get(e);
+    t && (this.storage.delete(e), m(this, w, E).call(this, e, t.resource));
   }
   /**
    * Stops the background pruning interval and optionally clears all entries.
@@ -630,8 +665,8 @@ class z {
   clear() {
     const e = Array.from(this.storage.entries());
     this.storage.clear();
-    for (const [s, t] of e)
-      f(this, T, S).call(this, s, t.resource);
+    for (const [t, s] of e)
+      m(this, w, E).call(this, t, s.resource);
   }
   /**
    * Evicts the least recently used entry from the cache.
@@ -646,33 +681,33 @@ class z {
    * @private
    */
   pruneExpired() {
-    const e = Date.now(), s = [];
-    for (const [t, o] of this.storage.entries())
-      e - o.lastAccessed > this.ttlMs && s.push(t);
-    for (const t of s)
-      this.delete(t);
+    const e = Date.now(), t = [];
+    for (const [s, o] of this.storage.entries())
+      e - o.lastAccessed > this.ttlMs && t.push(s);
+    for (const s of t)
+      this.delete(s);
   }
 }
-T = new WeakSet(), /**
+w = new WeakSet(), /**
  * Safely calls the evict callback, catching and logging any errors.
  * @param key - The key being evicted
  * @param resource - The resource being evicted
  * @private
  */
-S = function(e, s) {
+E = function(e, t) {
   if (this.onEvict)
     try {
-      const t = this.onEvict(e, s);
-      t instanceof Promise && t.catch((o) => {
+      const s = this.onEvict(e, t);
+      s instanceof Promise && s.catch((o) => {
         console.warn(`Error in cache eviction callback for key '${e}':`, o);
       });
-    } catch (t) {
-      console.warn(`Error in cache eviction callback for key '${e}':`, t);
+    } catch (s) {
+      console.warn(`Error in cache eviction callback for key '${e}':`, s);
     }
 };
-function V(r, e, s, t) {
+function F(r, e, t, s) {
   const o = ["/mcp", "/healthz", "/tools", "/.well-known/mcp-config"];
-  for (const i of s) {
+  for (const i of t) {
     const n = `${e}${i.path}`;
     if (o.some(
       (c) => n.startsWith(`${e}${c}`)
@@ -683,48 +718,48 @@ function V(r, e, s, t) {
       continue;
     }
     const a = i.method.toLowerCase();
-    r[a](n, async (c, d) => {
+    r[a](n, async (c, u) => {
       try {
-        const u = c.headers["mcp-client-id"]?.trim(), y = u && u.length > 0 ? u : `anon-${v()}`;
-        let C;
+        const f = c.headers["mcp-client-id"]?.trim(), v = f && f.length > 0 ? f : `anon-${T()}`;
+        let x;
         if (i.bodySchema) {
-          const m = i.bodySchema.safeParse(c.body);
-          if (!m.success)
-            return A(d, "body", m.error);
-          C = m.data;
+          const g = i.bodySchema.safeParse(c.body);
+          if (!g.success)
+            return S(u, "body", g.error);
+          x = g.data;
         }
         let I = {};
         if (i.querySchema) {
-          const m = i.querySchema.safeParse(c.query);
-          if (!m.success)
-            return A(d, "query", m.error);
-          I = m.data;
+          const g = i.querySchema.safeParse(c.query);
+          if (!g.success)
+            return S(u, "query", g.error);
+          I = g.data;
         }
-        let x = {};
+        let M = {};
         if (i.paramsSchema) {
-          const m = i.paramsSchema.safeParse(c.params);
-          if (!m.success)
-            return A(d, "params", m.error);
-          x = m.data;
+          const g = i.paramsSchema.safeParse(c.params);
+          if (!g.success)
+            return S(u, "params", g.error);
+          M = g.data;
         }
-        const M = {
-          body: C,
+        const P = {
+          body: x,
           query: I,
-          params: x,
+          params: M,
           headers: c.headers,
-          clientId: y
+          clientId: v
         };
-        if (t?.contextExtractor) {
-          const m = await t.contextExtractor(c);
-          Object.assign(M, m);
+        if (s?.contextExtractor) {
+          const g = await s.contextExtractor(c);
+          Object.assign(P, g);
         }
-        const $ = await i.handler(M);
+        const $ = await i.handler(P);
         if (i.responseSchema) {
-          const m = i.responseSchema.safeParse($);
-          return m.success ? m.data : (console.error(
+          const g = i.responseSchema.safeParse($);
+          return g.success ? g.data : (console.error(
             `Response validation failed for ${i.method} ${i.path}:`,
-            m.error
-          ), d.code(500), {
+            g.error
+          ), u.code(500), {
             error: {
               code: "RESPONSE_VALIDATION_ERROR",
               message: "Internal server error: invalid response format"
@@ -732,51 +767,58 @@ function V(r, e, s, t) {
           });
         }
         return $;
-      } catch (u) {
+      } catch (f) {
         return console.error(
           `Error in custom endpoint ${i.method} ${i.path}:`,
-          u
-        ), d.code(500), {
+          f
+        ), u.code(500), {
           error: {
             code: "INTERNAL_ERROR",
-            message: u instanceof Error ? u.message : "Internal server error"
+            message: f instanceof Error ? f.message : "Internal server error"
           }
         };
       }
     });
   }
 }
-function A(r, e, s) {
+function S(r, e, t) {
   return r.code(400), {
     error: {
       code: "VALIDATION_ERROR",
       message: `Validation failed for ${e}`,
-      details: s.errors
+      details: t.errors
     }
   };
 }
-class ie {
-  constructor(e, s, t = {}, o) {
-    this.app = null, this.clientCache = new z({
-      onEvict: (i, n) => {
-        this.cleanupBundle(n);
+class le {
+  constructor(e, t, s = {}, o) {
+    d(this, "options");
+    d(this, "defaultManager");
+    d(this, "createBundle");
+    d(this, "app", null);
+    d(this, "configSchema");
+    // Per-client server bundles and per-client session transports
+    d(this, "clientCache", new V({
+      onEvict: (e, t) => {
+        this.cleanupBundle(t);
       }
-    }), this.defaultManager = e, this.createBundle = s, this.options = {
-      host: t.host ?? "0.0.0.0",
-      port: t.port ?? 3e3,
-      basePath: t.basePath ?? "/",
-      cors: t.cors ?? !0,
-      logger: t.logger ?? !1,
-      app: t.app,
-      customEndpoints: t.customEndpoints
+    }));
+    this.defaultManager = e, this.createBundle = t, this.options = {
+      host: s.host ?? "0.0.0.0",
+      port: s.port ?? 3e3,
+      basePath: s.basePath ?? "/",
+      cors: s.cors ?? !0,
+      logger: s.logger ?? !1,
+      app: s.app,
+      customEndpoints: s.customEndpoints
     }, this.configSchema = o;
   }
   async start() {
     if (this.app) return;
-    const e = this.options.app ?? N({ logger: this.options.logger });
-    this.options.cors && await e.register(j, { origin: !0 });
-    const s = this.options.basePath.endsWith("/") ? this.options.basePath.slice(0, -1) : this.options.basePath;
-    e.get(`${s}/healthz`, async () => ({ ok: !0 })), e.get(`${s}/tools`, async () => this.defaultManager.getStatus()), e.get(`${s}/.well-known/mcp-config`, async (t, o) => (o.header("Content-Type", "application/schema+json; charset=utf-8"), this.configSchema ?? {
+    const e = this.options.app ?? j({ logger: this.options.logger });
+    this.options.cors && await e.register(k, { origin: !0 });
+    const t = this.options.basePath.endsWith("/") ? this.options.basePath.slice(0, -1) : this.options.basePath;
+    e.get(`${t}/healthz`, async () => ({ ok: !0 })), e.get(`${t}/tools`, async () => this.defaultManager.getStatus()), e.get(`${t}/.well-known/mcp-config`, async (s, o) => (o.header("Content-Type", "application/schema+json; charset=utf-8"), this.configSchema ?? {
       $schema: "https://json-schema.org/draft/2020-12/schema",
       title: "MCP Session Configuration",
       description: "Schema for the /mcp endpoint configuration",
@@ -786,32 +828,32 @@ class ie {
       "x-mcp-version": "1.0",
       "x-query-style": "dot+bracket"
     })), e.post(
-      `${s}/mcp`,
-      async (t, o) => {
-        const i = t.headers["mcp-client-id"]?.trim(), n = i && i.length > 0 ? i : `anon-${v()}`, l = !n.startsWith("anon-");
+      `${t}/mcp`,
+      async (s, o) => {
+        const i = s.headers["mcp-client-id"]?.trim(), n = i && i.length > 0 ? i : `anon-${T()}`, l = !n.startsWith("anon-");
         let a = l ? this.clientCache.get(n) : null;
         if (!a) {
-          const u = this.createBundle(), y = u.sessions;
+          const f = this.createBundle(), v = f.sessions;
           a = {
-            server: u.server,
-            orchestrator: u.orchestrator,
-            sessions: y instanceof Map ? y : /* @__PURE__ */ new Map()
+            server: f.server,
+            orchestrator: f.orchestrator,
+            sessions: v instanceof Map ? v : /* @__PURE__ */ new Map()
           }, l && this.clientCache.set(n, a);
         }
-        const c = t.headers["mcp-session-id"];
-        let d;
+        const c = s.headers["mcp-session-id"];
+        let u;
         if (c && a.sessions.get(c))
-          d = a.sessions.get(c);
-        else if (!c && D(t.body)) {
-          const u = v();
-          d = new k({
-            sessionIdGenerator: () => u,
-            onsessioninitialized: (y) => {
-              a.sessions.set(y, d);
+          u = a.sessions.get(c);
+        else if (!c && O(s.body)) {
+          const f = T();
+          u = new D({
+            sessionIdGenerator: () => f,
+            onsessioninitialized: (v) => {
+              a.sessions.set(v, u);
             }
           });
           try {
-            await a.server.connect(d);
+            await a.server.connect(u);
           } catch {
             return o.code(500), {
               jsonrpc: "2.0",
@@ -819,8 +861,8 @@ class ie {
               id: null
             };
           }
-          d.onclose = () => {
-            d?.sessionId && a.sessions.delete(d.sessionId);
+          u.onclose = () => {
+            u?.sessionId && a.sessions.delete(u.sessionId);
           };
         } else
           return o.code(400), {
@@ -828,28 +870,28 @@ class ie {
             error: { code: -32e3, message: "Session not found or expired" },
             id: null
           };
-        return await d.handleRequest(
-          t.raw,
+        return await u.handleRequest(
+          s.raw,
           o.raw,
-          t.body
+          s.body
         ), o;
       }
-    ), e.get(`${s}/mcp`, async (t, o) => {
-      const i = t.headers["mcp-client-id"]?.trim(), n = i && i.length > 0 ? i : "";
+    ), e.get(`${t}/mcp`, async (s, o) => {
+      const i = s.headers["mcp-client-id"]?.trim(), n = i && i.length > 0 ? i : "";
       if (!n)
         return o.code(400), "Missing mcp-client-id";
       const l = this.clientCache.get(n);
       if (!l)
         return o.code(400), "Invalid or expired client";
-      const a = t.headers["mcp-session-id"];
+      const a = s.headers["mcp-session-id"];
       if (!a)
         return o.code(400), "Missing mcp-session-id";
       const c = l.sessions.get(a);
-      return c ? (await c.handleRequest(t.raw, o.raw), o) : (o.code(400), "Invalid or expired session ID");
+      return c ? (await c.handleRequest(s.raw, o.raw), o) : (o.code(400), "Invalid or expired session ID");
     }), e.delete(
-      `${s}/mcp`,
-      async (t, o) => {
-        const i = t.headers["mcp-client-id"]?.trim(), n = i && i.length > 0 ? i : "", l = t.headers["mcp-session-id"];
+      `${t}/mcp`,
+      async (s, o) => {
+        const i = s.headers["mcp-client-id"]?.trim(), n = i && i.length > 0 ? i : "", l = s.headers["mcp-session-id"];
         if (!n || !l)
           return o.code(400), {
             jsonrpc: "2.0",
@@ -877,7 +919,7 @@ class ie {
         }
         return o.code(204).send(), o;
       }
-    ), this.options.customEndpoints && this.options.customEndpoints.length > 0 && V(e, s, this.options.customEndpoints), this.options.app || await e.listen({ host: this.options.host, port: this.options.port }), this.app = e;
+    ), this.options.customEndpoints && this.options.customEndpoints.length > 0 && F(e, t, this.options.customEndpoints), this.options.app || await e.listen({ host: this.options.host, port: this.options.port }), this.app = e;
   }
   /**
    * Stops the Fastify server and cleans up all resources.
@@ -893,27 +935,27 @@ class ie {
    * @private
    */
   cleanupBundle(e) {
-    for (const [s, t] of e.sessions.entries())
+    for (const [t, s] of e.sessions.entries())
       try {
-        typeof t.close == "function" && t.close().catch((o) => {
-          console.warn(`Error closing session ${s}:`, o);
+        typeof s.close == "function" && s.close().catch((o) => {
+          console.warn(`Error closing session ${t}:`, o);
         });
       } catch (o) {
-        console.warn(`Error closing session ${s}:`, o);
+        console.warn(`Error closing session ${t}:`, o);
       }
     e.sessions.clear();
   }
 }
-const ne = p.object({
-  mode: p.enum(["DYNAMIC", "STATIC"]).optional(),
-  toolsets: p.union([p.array(p.string()), p.literal("ALL")]).optional()
+const ce = y.object({
+  mode: y.enum(["DYNAMIC", "STATIC"]).optional(),
+  toolsets: y.union([y.array(y.string()), y.literal("ALL")]).optional()
 }).strict();
-async function Ee(r) {
+async function Ie(r) {
   if (r.startup)
     try {
-      ne.parse(r.startup);
+      ce.parse(r.startup);
     } catch (a) {
-      if (a instanceof p.ZodError) {
+      if (a instanceof y.ZodError) {
         const c = a.format();
         throw new Error(
           `Invalid startup configuration:
@@ -927,9 +969,9 @@ Hint: Common mistake - use "toolsets" not "initialToolsets"`
   const e = r.startup?.mode ?? "DYNAMIC";
   if (typeof r.createServer != "function")
     throw new Error("createMcpServer: `createServer` (factory) is required");
-  const s = r.createServer(), t = (a) => typeof a?.server?.notification == "function", o = (a) => typeof a?.notifyToolsListChanged == "function", i = async (a) => {
+  const t = r.createServer(), s = (a) => typeof a?.server?.notification == "function", o = (a) => typeof a?.notifyToolsListChanged == "function", i = async (a) => {
     try {
-      if (t(a)) {
+      if (s(a)) {
         await a.server.notification({
           method: "notifications/tools/list_changed"
         });
@@ -941,23 +983,23 @@ Hint: Common mistake - use "toolsets" not "initialToolsets"`
         return;
       console.warn("Failed to send tools list changed notification:", c);
     }
-  }, n = new b({
-    server: s,
+  }, n = new A({
+    server: t,
     catalog: r.catalog,
     moduleLoaders: r.moduleLoaders,
     exposurePolicy: r.exposurePolicy,
     context: r.context,
-    notifyToolsListChanged: async () => i(s),
+    notifyToolsListChanged: async () => i(t),
     startup: r.startup,
     registerMetaTools: r.registerMetaTools !== void 0 ? r.registerMetaTools : e === "DYNAMIC"
   });
   e === "STATIC" && await n.ensureReady();
-  const l = new ie(
+  const l = new le(
     n.getManager(),
     () => {
       if (e === "STATIC")
-        return { server: s, orchestrator: n };
-      const a = r.createServer(), c = new b({
+        return { server: t, orchestrator: n };
+      const a = r.createServer(), c = new A({
         server: a,
         catalog: r.catalog,
         moduleLoaders: r.moduleLoaders,
@@ -973,7 +1015,7 @@ Hint: Common mistake - use "toolsets" not "initialToolsets"`
     r.configSchema
   );
   return {
-    server: s,
+    server: t,
     start: async () => {
       await l.start();
     },
@@ -982,16 +1024,16 @@ Hint: Common mistake - use "toolsets" not "initialToolsets"`
     }
   };
 }
-function ae(r) {
-  le(r), ce(r), de(r), he(r);
+function de(r) {
+  ue(r), he(r), fe(r), me(r);
 }
-function le(r) {
+function ue(r) {
   if (!r || typeof r != "object")
     throw new Error(
       "Permission configuration is required for createPermissionBasedMcpServer"
     );
 }
-function ce(r) {
+function he(r) {
   if (!r.source)
     throw new Error('Permission source must be either "headers" or "config"');
   if (r.source !== "headers" && r.source !== "config")
@@ -999,19 +1041,19 @@ function ce(r) {
       `Invalid permission source: "${r.source}". Must be either "headers" or "config"`
     );
 }
-function de(r) {
+function fe(r) {
   if (r.source === "config" && !r.staticMap && !r.resolver)
     throw new Error(
       "Config-based permissions require at least one of: staticMap or resolver function"
     );
 }
-function he(r) {
+function me(r) {
   if (r.staticMap !== void 0) {
     if (typeof r.staticMap != "object" || r.staticMap === null)
       throw new Error(
         "staticMap must be an object mapping client IDs to toolset arrays"
       );
-    ue(r.staticMap);
+    ge(r.staticMap);
   }
   if (r.resolver !== void 0 && typeof r.resolver != "function")
     throw new Error(
@@ -1022,22 +1064,24 @@ function he(r) {
   if (r.headerName !== void 0 && (typeof r.headerName != "string" || r.headerName.length === 0))
     throw new Error("headerName must be a non-empty string");
 }
-function ue(r) {
-  for (const [e, s] of Object.entries(r))
-    if (!Array.isArray(s))
+function ge(r) {
+  for (const [e, t] of Object.entries(r))
+    if (!Array.isArray(t))
       throw new Error(
         `staticMap value for client "${e}" must be an array of toolset names`
       );
 }
-var g, F, _, B, H, Y;
-class fe {
+var p, _, H, B, Y, W;
+class pe {
   /**
    * Creates a new PermissionResolver instance.
    * @param config - The permission configuration defining how permissions are resolved
    */
   constructor(e) {
-    w(this, g);
-    this.config = e, this.cache = /* @__PURE__ */ new Map(), this.normalizedHeaderName = (e.headerName || "mcp-toolset-permissions").toLowerCase();
+    b(this, p);
+    d(this, "cache", /* @__PURE__ */ new Map());
+    d(this, "normalizedHeaderName");
+    this.config = e, this.normalizedHeaderName = (e.headerName || "mcp-toolset-permissions").toLowerCase();
   }
   /**
    * Resolves permissions for a client based on the configured source.
@@ -1052,23 +1096,23 @@ class fe {
    * @param headers - Optional request headers (required for header-based permissions)
    * @returns Array of toolset names the client is allowed to access
    */
-  resolvePermissions(e, s) {
+  resolvePermissions(e, t) {
     if (this.cache.has(e))
       return this.cache.get(e);
-    let t;
+    let s;
     try {
-      this.config.source === "headers" ? t = f(this, g, F).call(this, s) : t = f(this, g, B).call(this, e), Array.isArray(t) || (console.warn(
+      this.config.source === "headers" ? s = m(this, p, _).call(this, t) : s = m(this, p, B).call(this, e), Array.isArray(s) || (console.warn(
         `Permission resolution returned non-array for client ${e}, using empty permissions`
-      ), t = []), t = t.filter(
+      ), s = []), s = s.filter(
         (o) => typeof o == "string" && o.trim().length > 0
       );
     } catch (o) {
       console.error(
         `Unexpected error resolving permissions for client ${e}:`,
         o
-      ), t = [];
+      ), s = [];
     }
-    return this.cache.set(e, t), t;
+    return this.cache.set(e, s), s;
   }
   /**
    * Invalidates cached permissions for a specific client.
@@ -1086,7 +1130,7 @@ class fe {
     this.cache.clear();
   }
 }
-g = new WeakSet(), /**
+p = new WeakSet(), /**
  * Parses permissions from request headers.
  * Extracts comma-separated toolset names from the configured header.
  * Handles malformed headers gracefully by returning empty permissions.
@@ -1095,18 +1139,18 @@ g = new WeakSet(), /**
  * @returns Array of toolset names from headers, or empty array if header is missing/malformed
  * @private
  */
-F = function(e) {
+_ = function(e) {
   if (!e)
     return [];
-  const s = f(this, g, _).call(this, e, this.normalizedHeaderName);
-  if (!s)
+  const t = m(this, p, H).call(this, e, this.normalizedHeaderName);
+  if (!t)
     return [];
   try {
-    return s.split(",").map((t) => t.trim()).filter((t) => t.length > 0);
-  } catch (t) {
+    return t.split(",").map((s) => s.trim()).filter((s) => s.length > 0);
+  } catch (s) {
     return console.warn(
       `Failed to parse permission header '${this.normalizedHeaderName}':`,
-      t
+      s
     ), [];
   }
 }, /**
@@ -1117,11 +1161,11 @@ F = function(e) {
  * @returns The header value if found, undefined otherwise
  * @private
  */
-_ = function(e, s) {
-  if (e[s] !== void 0)
-    return e[s];
-  for (const [t, o] of Object.entries(e))
-    if (t.toLowerCase() === s)
+H = function(e, t) {
+  if (e[t] !== void 0)
+    return e[t];
+  for (const [s, o] of Object.entries(e))
+    if (s.toLowerCase() === t)
       return o;
 }, /**
  * Resolves permissions from server-side configuration.
@@ -1133,14 +1177,14 @@ _ = function(e, s) {
  */
 B = function(e) {
   if (this.config.resolver) {
-    const s = f(this, g, H).call(this, e);
-    if (s !== null)
-      return s;
+    const t = m(this, p, Y).call(this, e);
+    if (t !== null)
+      return t;
   }
   if (this.config.staticMap) {
-    const s = f(this, g, Y).call(this, e);
-    if (s !== null)
-      return s;
+    const t = m(this, p, W).call(this, e);
+    if (t !== null)
+      return t;
   }
   return this.config.defaultPermissions || [];
 }, /**
@@ -1150,16 +1194,16 @@ B = function(e) {
  * @returns Array of toolset names if successful, null if resolver fails or returns invalid data
  * @private
  */
-H = function(e) {
+Y = function(e) {
   try {
-    const s = this.config.resolver(e);
-    return Array.isArray(s) ? s : (console.warn(
+    const t = this.config.resolver(e);
+    return Array.isArray(t) ? t : (console.warn(
       `Permission resolver returned non-array for client ${e}, using fallback`
     ), null);
-  } catch (s) {
-    const t = s instanceof Error ? s.message : String(s);
+  } catch (t) {
+    const s = t instanceof Error ? t.message : String(t);
     return console.warn(
-      `Permission resolver declined client ${e} (${t}), trying fallback`
+      `Permission resolver declined client ${e} (${s}), trying fallback`
     ), null;
   }
 }, /**
@@ -1169,25 +1213,25 @@ H = function(e) {
  * @returns Array of toolset names if found, null if client not in map
  * @private
  */
-Y = function(e) {
-  const s = this.config.staticMap[e];
-  return s !== void 0 ? Array.isArray(s) ? s : [] : null;
+W = function(e) {
+  const t = this.config.staticMap[e];
+  return t !== void 0 ? Array.isArray(t) ? t : [] : null;
 };
-function me(r, e) {
-  return async (s) => {
-    const t = e.resolvePermissions(
-      s.clientId,
-      s.headers
-    ), o = r(t), i = o.orchestrator.getManager(), n = [], l = [];
-    if (t.length > 0) {
-      const a = await i.enableToolsets(t);
+function ye(r, e) {
+  return async (t) => {
+    const s = e.resolvePermissions(
+      t.clientId,
+      t.headers
+    ), o = r(s), i = o.orchestrator.getManager(), n = [], l = [];
+    if (s.length > 0) {
+      const a = await i.enableToolsets(s);
       for (const c of a.results)
         c.success ? n.push(c.name) : (l.push(c.name), console.warn(
-          `Failed to enable toolset '${c.name}' for client '${s.clientId}': ${c.message}`
+          `Failed to enable toolset '${c.name}' for client '${t.clientId}': ${c.message}`
         ));
       if (n.length === 0 && l.length > 0)
         throw new Error(
-          `All requested toolsets failed to enable for client '${s.clientId}'. Requested: [${t.join(", ")}]. Check that toolset names in permissions match the catalog.`
+          `All requested toolsets failed to enable for client '${t.clientId}'. Requested: [${s.join(", ")}]. Check that toolset names in permissions match the catalog.`
         );
     }
     return {
@@ -1198,8 +1242,8 @@ function me(r, e) {
     };
   };
 }
-var h, W, U, q, J, G, K, Z, Q, E, X;
-class ge {
+var h, U, q, J, G, K, Z, Q, X, C, ee;
+class ve {
   /**
    * Creates a new PermissionAwareFastifyTransport instance.
    * @param defaultManager - Default tool manager for status endpoints
@@ -1207,20 +1251,27 @@ class ge {
    * @param options - Transport configuration options
    * @param configSchema - Optional JSON schema for configuration discovery
    */
-  constructor(e, s, t = {}, o) {
-    w(this, h);
-    this.app = null, this.clientCache = new z({
-      onEvict: (i, n) => {
-        f(this, h, W).call(this, n);
+  constructor(e, t, s = {}, o) {
+    b(this, h);
+    d(this, "options");
+    d(this, "defaultManager");
+    d(this, "createPermissionAwareBundle");
+    d(this, "app", null);
+    d(this, "configSchema");
+    // Per-client server bundles and per-client session transports
+    d(this, "clientCache", new V({
+      onEvict: (e, t) => {
+        m(this, h, U).call(this, t);
       }
-    }), this.defaultManager = e, this.createPermissionAwareBundle = s, this.options = {
-      host: t.host ?? "0.0.0.0",
-      port: t.port ?? 3e3,
-      basePath: t.basePath ?? "/",
-      cors: t.cors ?? !0,
-      logger: t.logger ?? !1,
-      app: t.app,
-      customEndpoints: t.customEndpoints
+    }));
+    this.defaultManager = e, this.createPermissionAwareBundle = t, this.options = {
+      host: s.host ?? "0.0.0.0",
+      port: s.port ?? 3e3,
+      basePath: s.basePath ?? "/",
+      cors: s.cors ?? !0,
+      logger: s.logger ?? !1,
+      app: s.app,
+      customEndpoints: s.customEndpoints
     }, this.configSchema = o;
   }
   /**
@@ -1229,12 +1280,12 @@ class ge {
    */
   async start() {
     if (this.app) return;
-    const e = this.options.app ?? N({ logger: this.options.logger });
-    this.options.cors && await e.register(j, { origin: !0 });
-    const s = f(this, h, U).call(this, this.options.basePath);
-    f(this, h, q).call(this, e, s), f(this, h, J).call(this, e, s), f(this, h, G).call(this, e, s), f(this, h, K).call(this, e, s), f(this, h, Z).call(this, e, s), f(this, h, Q).call(this, e, s), this.options.customEndpoints && this.options.customEndpoints.length > 0 && V(e, s, this.options.customEndpoints, {
-      contextExtractor: async (t) => {
-        const o = f(this, h, E).call(this, t);
+    const e = this.options.app ?? j({ logger: this.options.logger });
+    this.options.cors && await e.register(k, { origin: !0 });
+    const t = m(this, h, q).call(this, this.options.basePath);
+    m(this, h, J).call(this, e, t), m(this, h, G).call(this, e, t), m(this, h, K).call(this, e, t), m(this, h, Z).call(this, e, t), m(this, h, Q).call(this, e, t), m(this, h, X).call(this, e, t), this.options.customEndpoints && this.options.customEndpoints.length > 0 && F(e, t, this.options.customEndpoints, {
+      contextExtractor: async (s) => {
+        const o = m(this, h, C).call(this, s);
         try {
           const i = await this.createPermissionAwareBundle(o);
           return {
@@ -1266,14 +1317,14 @@ h = new WeakSet(), /**
  * @param bundle - The client bundle to clean up
  * @private
  */
-W = function(e) {
-  for (const [s, t] of e.sessions.entries())
+U = function(e) {
+  for (const [t, s] of e.sessions.entries())
     try {
-      typeof t.close == "function" && t.close().catch((o) => {
-        console.warn(`Error closing session ${s}:`, o);
+      typeof s.close == "function" && s.close().catch((o) => {
+        console.warn(`Error closing session ${t}:`, o);
       });
     } catch (o) {
-      console.warn(`Error closing session ${s}:`, o);
+      console.warn(`Error closing session ${t}:`, o);
     }
   e.sessions.clear();
 }, /**
@@ -1282,7 +1333,7 @@ W = function(e) {
  * @returns Normalized base path without trailing slash
  * @private
  */
-U = function(e) {
+q = function(e) {
   return e.endsWith("/") ? e.slice(0, -1) : e;
 }, /**
  * Registers the health check endpoint.
@@ -1290,24 +1341,24 @@ U = function(e) {
  * @param base - Base path for routes
  * @private
  */
-q = function(e, s) {
-  e.get(`${s}/healthz`, async () => ({ ok: !0 }));
+J = function(e, t) {
+  e.get(`${t}/healthz`, async () => ({ ok: !0 }));
 }, /**
  * Registers the tools status endpoint.
  * @param app - Fastify instance
  * @param base - Base path for routes
  * @private
  */
-J = function(e, s) {
-  e.get(`${s}/tools`, async () => this.defaultManager.getStatus());
+G = function(e, t) {
+  e.get(`${t}/tools`, async () => this.defaultManager.getStatus());
 }, /**
  * Registers the MCP configuration discovery endpoint.
  * @param app - Fastify instance
  * @param base - Base path for routes
  * @private
  */
-G = function(e, s) {
-  e.get(`${s}/.well-known/mcp-config`, async (t, o) => (o.header("Content-Type", "application/schema+json; charset=utf-8"), this.configSchema ?? {
+K = function(e, t) {
+  e.get(`${t}/.well-known/mcp-config`, async (s, o) => (o.header("Content-Type", "application/schema+json; charset=utf-8"), this.configSchema ?? {
     $schema: "https://json-schema.org/draft/2020-12/schema",
     title: "MCP Session Configuration",
     description: "Schema for the /mcp endpoint configuration",
@@ -1324,42 +1375,42 @@ G = function(e, s) {
  * @param base - Base path for routes
  * @private
  */
-K = function(e, s) {
+Z = function(e, t) {
   e.post(
-    `${s}/mcp`,
-    async (t, o) => {
-      const i = f(this, h, E).call(this, t), n = !i.clientId.startsWith("anon-");
+    `${t}/mcp`,
+    async (s, o) => {
+      const i = m(this, h, C).call(this, s), n = !i.clientId.startsWith("anon-");
       let l = n ? this.clientCache.get(i.clientId) : null;
       if (!l)
         try {
-          const d = await this.createPermissionAwareBundle(i);
-          d.failedToolsets.length > 0 && console.warn(
-            `Client ${i.clientId} had ${d.failedToolsets.length} toolsets fail to enable: [${d.failedToolsets.join(", ")}]. Successfully enabled: [${d.allowedToolsets.join(", ")}]`
+          const u = await this.createPermissionAwareBundle(i);
+          u.failedToolsets.length > 0 && console.warn(
+            `Client ${i.clientId} had ${u.failedToolsets.length} toolsets fail to enable: [${u.failedToolsets.join(", ")}]. Successfully enabled: [${u.allowedToolsets.join(", ")}]`
           );
-          const u = d.sessions;
+          const f = u.sessions;
           l = {
-            server: d.server,
-            orchestrator: d.orchestrator,
-            allowedToolsets: d.allowedToolsets,
-            failedToolsets: d.failedToolsets,
-            sessions: u instanceof Map ? u : /* @__PURE__ */ new Map()
+            server: u.server,
+            orchestrator: u.orchestrator,
+            allowedToolsets: u.allowedToolsets,
+            failedToolsets: u.failedToolsets,
+            sessions: f instanceof Map ? f : /* @__PURE__ */ new Map()
           }, n && this.clientCache.set(i.clientId, l);
-        } catch (d) {
+        } catch (u) {
           return console.error(
             `Failed to create permission-aware bundle for client ${i.clientId}:`,
-            d
-          ), o.code(403), f(this, h, X).call(this, "Access denied");
+            u
+          ), o.code(403), m(this, h, ee).call(this, "Access denied");
         }
-      const a = t.headers["mcp-session-id"];
+      const a = s.headers["mcp-session-id"];
       let c;
       if (a && l.sessions.get(a))
         c = l.sessions.get(a);
-      else if (!a && D(t.body)) {
-        const d = v();
-        c = new k({
-          sessionIdGenerator: () => d,
-          onsessioninitialized: (u) => {
-            l.sessions.set(u, c);
+      else if (!a && O(s.body)) {
+        const u = T();
+        c = new D({
+          sessionIdGenerator: () => u,
+          onsessioninitialized: (f) => {
+            l.sessions.set(f, c);
           }
         });
         try {
@@ -1381,9 +1432,9 @@ K = function(e, s) {
           id: null
         };
       return await c.handleRequest(
-        t.raw,
+        s.raw,
         o.raw,
-        t.body
+        s.body
       ), o;
     }
   );
@@ -1393,19 +1444,19 @@ K = function(e, s) {
  * @param base - Base path for routes
  * @private
  */
-Z = function(e, s) {
-  e.get(`${s}/mcp`, async (t, o) => {
-    const i = t.headers["mcp-client-id"]?.trim(), n = i && i.length > 0 ? i : "";
+Q = function(e, t) {
+  e.get(`${t}/mcp`, async (s, o) => {
+    const i = s.headers["mcp-client-id"]?.trim(), n = i && i.length > 0 ? i : "";
     if (!n)
       return o.code(400), "Missing mcp-client-id";
     const l = this.clientCache.get(n);
     if (!l)
       return o.code(400), "Invalid or expired client";
-    const a = t.headers["mcp-session-id"];
+    const a = s.headers["mcp-session-id"];
     if (!a)
       return o.code(400), "Missing mcp-session-id";
     const c = l.sessions.get(a);
-    return c ? (await c.handleRequest(t.raw, o.raw), o) : (o.code(400), "Invalid or expired session ID");
+    return c ? (await c.handleRequest(s.raw, o.raw), o) : (o.code(400), "Invalid or expired session ID");
   });
 }, /**
  * Registers the DELETE /mcp endpoint for session termination.
@@ -1413,11 +1464,11 @@ Z = function(e, s) {
  * @param base - Base path for routes
  * @private
  */
-Q = function(e, s) {
+X = function(e, t) {
   e.delete(
-    `${s}/mcp`,
-    async (t, o) => {
-      const i = t.headers["mcp-client-id"]?.trim(), n = i && i.length > 0 ? i : "", l = t.headers["mcp-session-id"];
+    `${t}/mcp`,
+    async (s, o) => {
+      const i = s.headers["mcp-client-id"]?.trim(), n = i && i.length > 0 ? i : "", l = s.headers["mcp-session-id"];
       if (!n || !l)
         return o.code(400), {
           jsonrpc: "2.0",
@@ -1453,11 +1504,11 @@ Q = function(e, s) {
  * @returns Client request context with ID and headers
  * @private
  */
-E = function(e) {
-  const s = e.headers["mcp-client-id"]?.trim(), t = s && s.length > 0 ? s : `anon-${v()}`, o = {};
+C = function(e) {
+  const t = e.headers["mcp-client-id"]?.trim(), s = t && t.length > 0 ? t : `anon-${T()}`, o = {};
   for (const [i, n] of Object.entries(e.headers))
     typeof n == "string" && (o[i] = n);
-  return { clientId: t, headers: o };
+  return { clientId: s, headers: o };
 }, /**
  * Creates a safe error response that doesn't expose unauthorized toolset information.
  * Used for permission-related errors to prevent information leakage.
@@ -1466,17 +1517,17 @@ E = function(e) {
  * @returns JSON-RPC error response object
  * @private
  */
-X = function(e = "Access denied", s = -32e3) {
+ee = function(e = "Access denied", t = -32e3) {
   return {
     jsonrpc: "2.0",
     error: {
-      code: s,
+      code: t,
       message: e
     },
     id: null
   };
 };
-function pe(r) {
+function Te(r) {
   if (!r) return;
   const e = {
     namespaceToolsWithSetKey: r.namespaceToolsWithSetKey
@@ -1491,12 +1542,12 @@ function pe(r) {
     "Permission-based servers: exposurePolicy.onLimitExceeded is ignored. No toolset limits are enforced."
   ), e;
 }
-async function Ce(r) {
+async function Me(r) {
   if (!r.permissions)
     throw new Error(
       "Permission configuration is required for createPermissionBasedMcpServer. Please provide a 'permissions' field in the options."
     );
-  if (ae(r.permissions), r.startup)
+  if (de(r.permissions), r.startup)
     throw new Error(
       "Permission-based servers determine toolsets from client permissions. The 'startup' option is not allowed. Remove it from your configuration."
     );
@@ -1504,10 +1555,10 @@ async function Ce(r) {
     throw new Error(
       "createPermissionBasedMcpServer: `createServer` (factory) is required"
     );
-  const e = pe(
+  const e = Te(
     r.exposurePolicy
-  ), s = new fe(r.permissions), t = r.createServer(), o = new b({
-    server: t,
+  ), t = new pe(r.permissions), s = r.createServer(), o = new A({
+    server: s,
     catalog: r.catalog,
     moduleLoaders: r.moduleLoaders,
     exposurePolicy: e,
@@ -1516,9 +1567,9 @@ async function Ce(r) {
     // No notifications in STATIC mode
     startup: { mode: "STATIC", toolsets: [] },
     registerMetaTools: !1
-  }), i = me(
+  }), i = ye(
     (l) => {
-      const a = r.createServer(), c = new b({
+      const a = r.createServer(), c = new A({
         server: a,
         catalog: r.catalog,
         moduleLoaders: r.moduleLoaders,
@@ -1533,15 +1584,15 @@ async function Ce(r) {
       });
       return { server: a, orchestrator: c };
     },
-    s
-  ), n = new ge(
+    t
+  ), n = new ve(
     o.getManager(),
     i,
     r.http,
     r.configSchema
   );
   return {
-    server: t,
+    server: s,
     start: async () => {
       await n.start();
     },
@@ -1549,21 +1600,21 @@ async function Ce(r) {
       try {
         await n.stop();
       } finally {
-        s.clearCache();
+        t.clearCache();
       }
     }
   };
 }
-function Ie(r) {
+function Pe(r) {
   return r;
 }
-function xe(r) {
+function $e(r) {
   return r;
 }
 export {
-  Ee as createMcpServer,
-  Ce as createPermissionBasedMcpServer,
-  Ie as defineEndpoint,
-  xe as definePermissionAwareEndpoint
+  Ie as createMcpServer,
+  Me as createPermissionBasedMcpServer,
+  Pe as defineEndpoint,
+  $e as definePermissionAwareEndpoint
 };
 //# sourceMappingURL=index.js.map