toolception 0.5.3 → 0.5.4

package/dist/index.js

@@ -1,17 +1,17 @@
-var se = Object.defineProperty;
+var te = Object.defineProperty;
 var L = (r) => {
   throw TypeError(r);
 };
-var te = (r, e, s) => e in r ? se(r, e, { enumerable: !0, configurable: !0, writable: !0, value: s }) : r[e] = s;
-var d = (r, e, s) => te(r, typeof e != "symbol" ? e + "" : e, s), oe = (r, e, s) => e.has(r) || L("Cannot " + s);
-var b = (r, e, s) => e.has(r) ? L("Cannot add the same private member more than once") : e instanceof WeakSet ? e.add(r) : e.set(r, s);
-var m = (r, e, s) => (oe(r, e, "access private method"), s);
+var se = (r, e, t) => e in r ? te(r, e, { enumerable: !0, configurable: !0, writable: !0, value: t }) : r[e] = t;
+var d = (r, e, t) => se(r, typeof e != "symbol" ? e + "" : e, t), oe = (r, e, t) => e.has(r) || L("Cannot " + t);
+var b = (r, e, t) => e.has(r) ? L("Cannot add the same private member more than once") : e instanceof WeakSet ? e.add(r) : e.set(r, t);
+var m = (r, e, t) => (oe(r, e, "access private method"), t);
 import { z as y } from "zod";
 import j from "fastify";
 import k from "@fastify/cors";
 import { randomUUID as T } from "node:crypto";
 import { StreamableHTTPServerTransport as D } from "@modelcontextprotocol/sdk/server/streamableHttp.js";
-import { isInitializeRequest as z } from "@modelcontextprotocol/sdk/types.js";
+import { isInitializeRequest as O } from "@modelcontextprotocol/sdk/types.js";
 const R = {
   dynamic: [
     "dynamic-tool-discovery",
@@ -28,13 +28,13 @@ class re {
       toolsets: e.keys?.toolsets ?? R.toolsets
     };
   }
-  resolveMode(e, s) {
-    return this.isDynamicEnabled(s) ? "DYNAMIC" : this.getToolsetsString(s) ? "STATIC" : this.isDynamicEnabled(e) ? "DYNAMIC" : this.getToolsetsString(e) ? "STATIC" : null;
+  resolveMode(e, t) {
+    return this.isDynamicEnabled(t) ? "DYNAMIC" : this.getToolsetsString(t) ? "STATIC" : this.isDynamicEnabled(e) ? "DYNAMIC" : this.getToolsetsString(e) ? "STATIC" : null;
   }
-  parseCommaSeparatedToolSets(e, s) {
+  parseCommaSeparatedToolSets(e, t) {
     if (!e || typeof e != "string") return [];
-    const t = e.split(",").map((n) => n.trim()).filter((n) => n.length > 0), o = new Set(Object.keys(s)), i = [];
-    for (const n of t)
+    const s = e.split(",").map((n) => n.trim()).filter((n) => n.length > 0), o = new Set(Object.keys(t)), i = [];
+    for (const n of s)
       o.has(n) ? i.push(n) : console.warn(
         `Invalid toolset '${n}' ignored. Available: ${Array.from(
           o
@@ -42,32 +42,32 @@ class re {
       );
     return i;
   }
-  getModulesForToolSets(e, s) {
-    const t = /* @__PURE__ */ new Set();
+  getModulesForToolSets(e, t) {
+    const s = /* @__PURE__ */ new Set();
     for (const o of e) {
-      const i = s[o];
-      i && (i.modules || []).forEach((n) => t.add(n));
+      const i = t[o];
+      i && (i.modules || []).forEach((n) => s.add(n));
     }
-    return Array.from(t);
+    return Array.from(s);
   }
-  validateToolsetName(e, s) {
+  validateToolsetName(e, t) {
     if (!e || typeof e != "string")
       return {
         isValid: !1,
         error: `Invalid toolset name provided. Must be a non-empty string. Available toolsets: ${Object.keys(
-          s
+          t
         ).join(", ")}`
       };
-    const t = e.trim();
-    return t.length === 0 ? {
+    const s = e.trim();
+    return s.length === 0 ? {
       isValid: !1,
       error: `Empty toolset name provided. Available toolsets: ${Object.keys(
-        s
+        t
       ).join(", ")}`
-    } : s[t] ? { isValid: !0, sanitized: t } : {
+    } : t[s] ? { isValid: !0, sanitized: s } : {
       isValid: !1,
-      error: `Toolset '${t}' not found. Available toolsets: ${Object.keys(
-        s
+      error: `Toolset '${s}' not found. Available toolsets: ${Object.keys(
+        t
       ).join(", ")}`
     };
   }
@@ -78,37 +78,37 @@ class re {
    * @param catalog - The toolset catalog to validate against
    * @returns Validation result with modules array if valid
    */
-  validateToolsetModules(e, s) {
+  validateToolsetModules(e, t) {
     try {
       for (const o of e)
-        if (!s[o])
+        if (!t[o])
           return {
             isValid: !1,
             error: `Toolset '${o}' not found in catalog`
           };
-      return { isValid: !0, modules: this.getModulesForToolSets(e, s) };
-    } catch (t) {
+      return { isValid: !0, modules: this.getModulesForToolSets(e, t) };
+    } catch (s) {
       return {
         isValid: !1,
-        error: `Error resolving modules for ${e.join(", ")}: ${t instanceof Error ? t.message : "Unknown error"}`
+        error: `Error resolving modules for ${e.join(", ")}: ${s instanceof Error ? s.message : "Unknown error"}`
       };
     }
   }
   isDynamicEnabled(e) {
     if (!e) return !1;
-    for (const s of this.keys.dynamic) {
-      const t = e[s];
-      if (t === !0 || typeof t == "string" && t.trim().toLowerCase() === "true")
+    for (const t of this.keys.dynamic) {
+      const s = e[t];
+      if (s === !0 || typeof s == "string" && s.trim().toLowerCase() === "true")
         return !0;
     }
     return !1;
   }
   getToolsetsString(e) {
     if (e)
-      for (const s of this.keys.toolsets) {
-        const t = e[s];
-        if (typeof t == "string" && t.trim().length > 0)
-          return t;
+      for (const t of this.keys.toolsets) {
+        const s = e[t];
+        if (typeof s == "string" && s.trim().length > 0)
+          return s;
       }
   }
 }
@@ -132,30 +132,30 @@ class ie {
           ", "
         )}`
       };
-    const s = e.trim();
-    return s.length === 0 ? {
+    const t = e.trim();
+    return t.length === 0 ? {
       isValid: !1,
       error: `Empty toolset name provided. Available toolsets: ${this.getAvailableToolsets().join(
         ", "
       )}`
-    } : this.catalog[s] ? { isValid: !0, sanitized: s } : {
+    } : this.catalog[t] ? { isValid: !0, sanitized: t } : {
       isValid: !1,
-      error: `Toolset '${s}' not found. Available toolsets: ${this.getAvailableToolsets().join(
+      error: `Toolset '${t}' not found. Available toolsets: ${this.getAvailableToolsets().join(
         ", "
       )}`
     };
   }
-  async resolveToolsForToolsets(e, s) {
-    const t = [];
+  async resolveToolsForToolsets(e, t) {
+    const s = [];
     for (const o of e) {
       const i = this.catalog[o];
-      if (i && (Array.isArray(i.tools) && i.tools.length > 0 && t.push(...i.tools), Array.isArray(i.modules) && i.modules.length > 0))
+      if (i && (Array.isArray(i.tools) && i.tools.length > 0 && s.push(...i.tools), Array.isArray(i.modules) && i.modules.length > 0))
         for (const n of i.modules) {
           const l = this.moduleLoaders[n];
           if (l)
             try {
-              const a = await l(s);
-              Array.isArray(a) && a.length > 0 && t.push(...a);
+              const a = await l(t);
+              Array.isArray(a) && a.length > 0 && s.push(...a);
             } catch (a) {
               console.warn(
                 `Module loader '${n}' failed for toolset '${o}':`,
@@ -164,18 +164,18 @@ class ie {
             }
         }
     }
-    return t;
+    return s;
   }
 }
 class N extends Error {
-  constructor(s, t, o, i) {
-    super(s);
+  constructor(t, s, o, i) {
+    super(t);
     d(this, "code");
     d(this, "details");
-    this.name = "ToolingError", this.code = t, this.details = o;
+    this.name = "ToolingError", this.code = s, this.details = o;
   }
 }
-class O {
+class z {
   constructor(e = {}) {
     d(this, "options");
     d(this, "names", /* @__PURE__ */ new Set());
@@ -184,8 +184,8 @@ class O {
       namespaceWithToolset: e.namespaceWithToolset ?? !0
     };
   }
-  getSafeName(e, s) {
-    return !this.options.namespaceWithToolset || s.startsWith(`${e}.`) ? s : `${e}.${s}`;
+  getSafeName(e, t) {
+    return !this.options.namespaceWithToolset || t.startsWith(`${e}.`) ? t : `${e}.${t}`;
   }
   has(e) {
     return this.names.has(e);
@@ -198,20 +198,20 @@ class O {
       );
     this.names.add(e);
   }
-  addForToolset(e, s) {
-    this.add(s);
-    const t = this.toolsetToNames.get(e) ?? /* @__PURE__ */ new Set();
-    t.add(s), this.toolsetToNames.set(e, t);
+  addForToolset(e, t) {
+    this.add(t);
+    const s = this.toolsetToNames.get(e) ?? /* @__PURE__ */ new Set();
+    s.add(t), this.toolsetToNames.set(e, s);
   }
-  mapAndValidate(e, s) {
-    return s.map((t) => {
-      const o = this.getSafeName(e, t.name);
+  mapAndValidate(e, t) {
+    return t.map((s) => {
+      const o = this.getSafeName(e, s.name);
       if (this.has(o))
         throw new N(
           `Tool name collision for '${o}'`,
           "E_TOOL_NAME_CONFLICT"
         );
-      return { ...t, name: o };
+      return { ...s, name: o };
     });
   }
   list() {
@@ -219,8 +219,8 @@ class O {
   }
   listByToolset() {
     const e = {};
-    for (const [s, t] of this.toolsetToNames.entries())
-      e[s] = Array.from(t);
+    for (const [t, s] of this.toolsetToNames.entries())
+      e[t] = Array.from(s);
     return e;
   }
 }
@@ -233,7 +233,7 @@ class ne {
     d(this, "exposurePolicy");
     d(this, "toolRegistry");
     d(this, "activeToolsets", /* @__PURE__ */ new Set());
-    this.server = e.server, this.resolver = e.resolver, this.context = e.context, this.onToolsListChanged = e.onToolsListChanged, this.exposurePolicy = e.exposurePolicy, this.toolRegistry = e.toolRegistry ?? new O({ namespaceWithToolset: !0 });
+    this.server = e.server, this.resolver = e.resolver, this.context = e.context, this.onToolsListChanged = e.onToolsListChanged, this.exposurePolicy = e.exposurePolicy, this.toolRegistry = e.toolRegistry ?? new z({ namespaceWithToolset: !0 });
   }
   /**
    * Sends a tool list change notification if configured.
@@ -268,14 +268,14 @@ class ne {
    * @param skipNotification - If true, skips the tool list change notification (for batch operations)
    * @returns Result object with success status and message
    */
-  async enableToolset(e, s = !1) {
-    const t = this.resolver.validateToolsetName(e);
-    if (!t.isValid || !t.sanitized)
+  async enableToolset(e, t = !1) {
+    const s = this.resolver.validateToolsetName(e);
+    if (!s.isValid || !s.sanitized)
       return {
         success: !1,
-        message: t.error || "Unknown validation error"
+        message: s.error || "Unknown validation error"
       };
-    const o = t.sanitized;
+    const o = s.sanitized;
     if (this.activeToolsets.has(o))
       return {
         success: !1,
@@ -298,7 +298,7 @@ class ne {
         for (const c of a)
           this.registerSingleTool(c, o), n.push(c.name);
       }
-      return this.activeToolsets.add(o), s || await this.notifyToolsChanged(), {
+      return this.activeToolsets.add(o), t || await this.notifyToolsChanged(), {
         success: !0,
         message: `Toolset '${o}' enabled successfully. Registered ${l?.length ?? 0} tools.`
       };
@@ -338,13 +338,13 @@ class ne {
    * @param toolsetKey - The toolset key for tracking
    * @private
    */
-  registerSingleTool(e, s) {
+  registerSingleTool(e, t) {
     this.server.tool(
       e.name,
       e.description,
       e.inputSchema,
-      async (t) => await e.handler(t)
-    ), this.toolRegistry.addForToolset(s, e.name);
+      async (s) => await e.handler(s)
+    ), this.toolRegistry.addForToolset(t, e.name);
   }
   /**
    * Disables a toolset by name.
@@ -353,21 +353,21 @@ class ne {
    * @returns Result object with success status and message
    */
   async disableToolset(e) {
-    const s = this.resolver.validateToolsetName(e);
-    if (!s.isValid || !s.sanitized) {
+    const t = this.resolver.validateToolsetName(e);
+    if (!t.isValid || !t.sanitized) {
       const o = Array.from(this.activeToolsets).join(", ") || "none";
       return {
         success: !1,
-        message: `${s.error || "Unknown validation error"} Active toolsets: ${o}`
+        message: `${t.error || "Unknown validation error"} Active toolsets: ${o}`
       };
     }
-    const t = s.sanitized;
-    return this.activeToolsets.has(t) ? (this.activeToolsets.delete(t), await this.notifyToolsChanged(), {
+    const s = t.sanitized;
+    return this.activeToolsets.has(s) ? (this.activeToolsets.delete(s), await this.notifyToolsChanged(), {
       success: !0,
-      message: `Toolset '${t}' disabled successfully. Individual tools remain registered due to MCP limitations.`
+      message: `Toolset '${s}' disabled successfully. Individual tools remain registered due to MCP limitations.`
     }) : {
       success: !1,
-      message: `Toolset '${t}' is not currently active. Active toolsets: ${Array.from(this.activeToolsets).join(", ") || "none"}`
+      message: `Toolset '${s}' is not currently active. Active toolsets: ${Array.from(this.activeToolsets).join(", ") || "none"}`
     };
   }
   getStatus() {
@@ -388,21 +388,21 @@ class ne {
    * @returns Result object with overall success status and individual results
    */
   async enableToolsets(e) {
-    const s = [];
+    const t = [];
     for (const n of e)
       try {
         const l = await this.enableToolset(n, !0);
-        s.push({ name: n, ...l });
+        t.push({ name: n, ...l });
       } catch (l) {
-        s.push({
+        t.push({
           name: n,
           success: !1,
           message: l instanceof Error ? l.message : "Unknown error",
           code: "E_INTERNAL"
         });
       }
-    const t = s.every((n) => n.success), o = s.some((n) => n.success), i = t ? "All toolsets enabled" : o ? "Some toolsets failed to enable" : "All toolsets failed to enable";
-    return o && await this.notifyToolsChanged(), { success: t, results: s, message: i };
+    const s = t.every((n) => n.success), o = t.some((n) => n.success), i = s ? "All toolsets enabled" : o ? "Some toolsets failed to enable" : "All toolsets failed to enable";
+    return o && await this.notifyToolsChanged(), { success: s, results: t, message: i };
   }
   /**
    * Enables all available toolsets in a batch operation.
@@ -413,11 +413,12 @@ class ne {
     return this.enableToolsets(e);
   }
 }
-function ae(r, e, s) {
-  (s?.mode ?? "DYNAMIC") === "DYNAMIC" && (r.tool(
+function ae(r, e, t) {
+  (t?.mode ?? "DYNAMIC") === "DYNAMIC" && (r.tool(
     "enable_toolset",
     "Enable a toolset by name",
     { name: y.string().describe("Toolset name") },
+    { destructiveHint: !0, idempotentHint: !0 },
     async (o) => {
       const i = await e.enableToolset(o.name);
       return {
@@ -428,6 +429,7 @@ function ae(r, e, s) {
     "disable_toolset",
     "Disable a toolset by name (state only)",
     { name: y.string().describe("Toolset name") },
+    { destructiveHint: !0, idempotentHint: !0 },
     async (o) => {
       const i = await e.disableToolset(o.name);
       return {
@@ -438,6 +440,7 @@ function ae(r, e, s) {
     "list_toolsets",
     "List available toolsets with active status and definitions",
     {},
+    { readOnlyHint: !0, idempotentHint: !0 },
     async () => {
       const o = e.getAvailableToolsets(), i = e.getStatus().toolsetToTools, n = o.map((l) => {
         const a = e.getToolsetDefinition(l);
@@ -463,6 +466,7 @@ function ae(r, e, s) {
     "describe_toolset",
     "Describe a toolset with definition, active status and tools",
     { name: y.string().describe("Toolset name") },
+    { readOnlyHint: !0, idempotentHint: !0 },
     async (o) => {
       const i = e.getToolsetDefinition(o.name), n = e.getStatus().toolsetToTools;
       if (!i)
@@ -493,6 +497,7 @@ function ae(r, e, s) {
     "list_tools",
     "List currently registered tool names (best effort)",
     {},
+    { readOnlyHint: !0, idempotentHint: !0 },
     async () => {
       const o = e.getStatus(), i = {
         tools: o.tools,
@@ -513,12 +518,12 @@ class A {
     d(this, "initPromise");
     d(this, "initError", null);
     this.toolsetValidator = new re();
-    const s = e.startup ?? {}, t = this.resolveStartupConfig(s, e.catalog);
-    this.mode = t.mode, this.resolver = new ie({
+    const t = e.startup ?? {}, s = this.resolveStartupConfig(t, e.catalog);
+    this.mode = s.mode, this.resolver = new ie({
       catalog: e.catalog,
       moduleLoaders: e.moduleLoaders
     });
-    const o = new O({
+    const o = new z({
       namespaceWithToolset: e.exposurePolicy?.namespaceToolsWithSetKey ?? !0
     });
     this.manager = new ne({
@@ -529,7 +534,7 @@ class A {
       exposurePolicy: e.exposurePolicy,
       toolRegistry: o
     }), e.registerMetaTools !== !1 && ae(e.server, this.manager, { mode: this.mode });
-    const i = t.toolsets;
+    const i = s.toolsets;
     this.initPromise = this.initializeToolsets(i);
   }
   /**
@@ -542,8 +547,8 @@ class A {
   async initializeToolsets(e) {
     try {
       e === "ALL" ? await this.manager.enableToolsets(this.resolver.getAvailableToolsets()) : Array.isArray(e) && e.length > 0 && await this.manager.enableToolsets(e);
-    } catch (s) {
-      this.initError = s instanceof Error ? s : new Error(String(s)), console.error("Failed to initialize toolsets:", this.initError);
+    } catch (t) {
+      this.initError = t instanceof Error ? t : new Error(String(t)), console.error("Failed to initialize toolsets:", this.initError);
     }
   }
   /**
@@ -563,19 +568,19 @@ class A {
   async isReady() {
     return await this.initPromise, this.initError === null;
   }
-  resolveStartupConfig(e, s) {
+  resolveStartupConfig(e, t) {
     if (e.mode) {
       if (e.mode === "DYNAMIC" && e.toolsets)
         return console.warn("startup.toolsets provided but ignored in DYNAMIC mode"), { mode: "DYNAMIC" };
       if (e.mode === "STATIC") {
         if (e.toolsets === "ALL")
           return { mode: "STATIC", toolsets: "ALL" };
-        const t = Array.isArray(e.toolsets) ? e.toolsets : [], o = [];
-        for (const i of t) {
-          const { isValid: n, sanitized: l, error: a } = this.toolsetValidator.validateToolsetName(i, s);
+        const s = Array.isArray(e.toolsets) ? e.toolsets : [], o = [];
+        for (const i of s) {
+          const { isValid: n, sanitized: l, error: a } = this.toolsetValidator.validateToolsetName(i, t);
           n && l ? o.push(l) : a && console.warn(a);
         }
-        if (t.length > 0 && o.length === 0)
+        if (s.length > 0 && o.length === 0)
           throw new Error(
             "STATIC mode requires valid toolsets or 'ALL'; none were valid"
           );
@@ -585,16 +590,16 @@ class A {
     }
     if (e.toolsets === "ALL") return { mode: "STATIC", toolsets: "ALL" };
     if (Array.isArray(e.toolsets) && e.toolsets.length > 0) {
-      const t = [];
+      const s = [];
       for (const o of e.toolsets) {
-        const { isValid: i, sanitized: n, error: l } = this.toolsetValidator.validateToolsetName(o, s);
-        i && n ? t.push(n) : l && console.warn(l);
+        const { isValid: i, sanitized: n, error: l } = this.toolsetValidator.validateToolsetName(o, t);
+        i && n ? s.push(n) : l && console.warn(l);
       }
-      if (t.length === 0)
+      if (s.length === 0)
         throw new Error(
           "STATIC mode requires valid toolsets or 'ALL'; none were valid"
         );
-      return { mode: "STATIC", toolsets: t };
+      return { mode: "STATIC", toolsets: s };
     }
     return { mode: "DYNAMIC" };
   }
@@ -616,8 +621,8 @@ class V {
     // Use ReturnType<typeof setInterval> for cross-env typings without NodeJS namespace
     d(this, "pruneInterval");
     this.maxSize = e.maxSize ?? 1e3, this.ttlMs = e.ttlMs ?? 1e3 * 60 * 60, this.onEvict = e.onEvict;
-    const s = e.pruneIntervalMs ?? 1e3 * 60 * 10;
-    this.pruneInterval = setInterval(() => this.pruneExpired(), s);
+    const t = e.pruneIntervalMs ?? 1e3 * 60 * 10;
+    this.pruneInterval = setInterval(() => this.pruneExpired(), t);
   }
   getEntryCount() {
     return this.storage.size;
@@ -629,13 +634,13 @@ class V {
     return this.ttlMs;
   }
   get(e) {
-    const s = this.storage.get(e);
-    return s ? Date.now() - s.lastAccessed > this.ttlMs ? (this.delete(e), null) : (s.lastAccessed = Date.now(), this.storage.delete(e), this.storage.set(e, s), s.resource) : null;
+    const t = this.storage.get(e);
+    return t ? Date.now() - t.lastAccessed > this.ttlMs ? (this.delete(e), null) : (t.lastAccessed = Date.now(), this.storage.delete(e), this.storage.set(e, t), t.resource) : null;
   }
-  set(e, s) {
+  set(e, t) {
     this.storage.size >= this.maxSize && this.evictLeastRecentlyUsed();
-    const t = { resource: s, lastAccessed: Date.now() };
-    this.storage.set(e, t);
+    const s = { resource: t, lastAccessed: Date.now() };
+    this.storage.set(e, s);
   }
   /**
    * Removes an entry from the cache.
@@ -643,8 +648,8 @@ class V {
    * @param key - The key to remove
    */
   delete(e) {
-    const s = this.storage.get(e);
-    s && (this.storage.delete(e), m(this, w, E).call(this, e, s.resource));
+    const t = this.storage.get(e);
+    t && (this.storage.delete(e), m(this, w, E).call(this, e, t.resource));
   }
   /**
    * Stops the background pruning interval and optionally clears all entries.
@@ -660,8 +665,8 @@ class V {
   clear() {
     const e = Array.from(this.storage.entries());
     this.storage.clear();
-    for (const [s, t] of e)
-      m(this, w, E).call(this, s, t.resource);
+    for (const [t, s] of e)
+      m(this, w, E).call(this, t, s.resource);
   }
   /**
    * Evicts the least recently used entry from the cache.
@@ -676,11 +681,11 @@ class V {
    * @private
    */
   pruneExpired() {
-    const e = Date.now(), s = [];
-    for (const [t, o] of this.storage.entries())
-      e - o.lastAccessed > this.ttlMs && s.push(t);
-    for (const t of s)
-      this.delete(t);
+    const e = Date.now(), t = [];
+    for (const [s, o] of this.storage.entries())
+      e - o.lastAccessed > this.ttlMs && t.push(s);
+    for (const s of t)
+      this.delete(s);
   }
 }
 w = new WeakSet(), /**
@@ -689,20 +694,20 @@ w = new WeakSet(), /**
  * @param resource - The resource being evicted
  * @private
  */
-E = function(e, s) {
+E = function(e, t) {
   if (this.onEvict)
     try {
-      const t = this.onEvict(e, s);
-      t instanceof Promise && t.catch((o) => {
+      const s = this.onEvict(e, t);
+      s instanceof Promise && s.catch((o) => {
         console.warn(`Error in cache eviction callback for key '${e}':`, o);
       });
-    } catch (t) {
-      console.warn(`Error in cache eviction callback for key '${e}':`, t);
+    } catch (s) {
+      console.warn(`Error in cache eviction callback for key '${e}':`, s);
     }
 };
-function F(r, e, s, t) {
+function F(r, e, t, s) {
   const o = ["/mcp", "/healthz", "/tools", "/.well-known/mcp-config"];
-  for (const i of s) {
+  for (const i of t) {
     const n = `${e}${i.path}`;
     if (o.some(
       (c) => n.startsWith(`${e}${c}`)
@@ -713,28 +718,28 @@ function F(r, e, s, t) {
       continue;
     }
     const a = i.method.toLowerCase();
-    r[a](n, async (c, h) => {
+    r[a](n, async (c, u) => {
       try {
         const f = c.headers["mcp-client-id"]?.trim(), v = f && f.length > 0 ? f : `anon-${T()}`;
         let x;
         if (i.bodySchema) {
           const g = i.bodySchema.safeParse(c.body);
           if (!g.success)
-            return S(h, "body", g.error);
+            return S(u, "body", g.error);
           x = g.data;
         }
         let I = {};
         if (i.querySchema) {
           const g = i.querySchema.safeParse(c.query);
           if (!g.success)
-            return S(h, "query", g.error);
+            return S(u, "query", g.error);
           I = g.data;
         }
         let M = {};
         if (i.paramsSchema) {
           const g = i.paramsSchema.safeParse(c.params);
           if (!g.success)
-            return S(h, "params", g.error);
+            return S(u, "params", g.error);
           M = g.data;
         }
         const P = {
@@ -744,8 +749,8 @@ function F(r, e, s, t) {
           headers: c.headers,
           clientId: v
         };
-        if (t?.contextExtractor) {
-          const g = await t.contextExtractor(c);
+        if (s?.contextExtractor) {
+          const g = await s.contextExtractor(c);
           Object.assign(P, g);
         }
         const $ = await i.handler(P);
@@ -754,7 +759,7 @@ function F(r, e, s, t) {
           return g.success ? g.data : (console.error(
             `Response validation failed for ${i.method} ${i.path}:`,
             g.error
-          ), h.code(500), {
+          ), u.code(500), {
             error: {
               code: "RESPONSE_VALIDATION_ERROR",
               message: "Internal server error: invalid response format"
@@ -766,7 +771,7 @@ function F(r, e, s, t) {
         return console.error(
           `Error in custom endpoint ${i.method} ${i.path}:`,
           f
-        ), h.code(500), {
+        ), u.code(500), {
           error: {
             code: "INTERNAL_ERROR",
             message: f instanceof Error ? f.message : "Internal server error"
@@ -776,17 +781,17 @@ function F(r, e, s, t) {
     });
   }
 }
-function S(r, e, s) {
+function S(r, e, t) {
   return r.code(400), {
     error: {
       code: "VALIDATION_ERROR",
       message: `Validation failed for ${e}`,
-      details: s.errors
+      details: t.errors
     }
   };
 }
 class le {
-  constructor(e, s, t = {}, o) {
+  constructor(e, t, s = {}, o) {
     d(this, "options");
     d(this, "defaultManager");
     d(this, "createBundle");
@@ -794,26 +799,26 @@ class le {
     d(this, "configSchema");
     // Per-client server bundles and per-client session transports
     d(this, "clientCache", new V({
-      onEvict: (e, s) => {
-        this.cleanupBundle(s);
+      onEvict: (e, t) => {
+        this.cleanupBundle(t);
       }
     }));
-    this.defaultManager = e, this.createBundle = s, this.options = {
-      host: t.host ?? "0.0.0.0",
-      port: t.port ?? 3e3,
-      basePath: t.basePath ?? "/",
-      cors: t.cors ?? !0,
-      logger: t.logger ?? !1,
-      app: t.app,
-      customEndpoints: t.customEndpoints
+    this.defaultManager = e, this.createBundle = t, this.options = {
+      host: s.host ?? "0.0.0.0",
+      port: s.port ?? 3e3,
+      basePath: s.basePath ?? "/",
+      cors: s.cors ?? !0,
+      logger: s.logger ?? !1,
+      app: s.app,
+      customEndpoints: s.customEndpoints
     }, this.configSchema = o;
   }
   async start() {
     if (this.app) return;
     const e = this.options.app ?? j({ logger: this.options.logger });
     this.options.cors && await e.register(k, { origin: !0 });
-    const s = this.options.basePath.endsWith("/") ? this.options.basePath.slice(0, -1) : this.options.basePath;
-    e.get(`${s}/healthz`, async () => ({ ok: !0 })), e.get(`${s}/tools`, async () => this.defaultManager.getStatus()), e.get(`${s}/.well-known/mcp-config`, async (t, o) => (o.header("Content-Type", "application/schema+json; charset=utf-8"), this.configSchema ?? {
+    const t = this.options.basePath.endsWith("/") ? this.options.basePath.slice(0, -1) : this.options.basePath;
+    e.get(`${t}/healthz`, async () => ({ ok: !0 })), e.get(`${t}/tools`, async () => this.defaultManager.getStatus()), e.get(`${t}/.well-known/mcp-config`, async (s, o) => (o.header("Content-Type", "application/schema+json; charset=utf-8"), this.configSchema ?? {
       $schema: "https://json-schema.org/draft/2020-12/schema",
       title: "MCP Session Configuration",
       description: "Schema for the /mcp endpoint configuration",
@@ -823,9 +828,9 @@ class le {
       "x-mcp-version": "1.0",
       "x-query-style": "dot+bracket"
     })), e.post(
-      `${s}/mcp`,
-      async (t, o) => {
-        const i = t.headers["mcp-client-id"]?.trim(), n = i && i.length > 0 ? i : `anon-${T()}`, l = !n.startsWith("anon-");
+      `${t}/mcp`,
+      async (s, o) => {
+        const i = s.headers["mcp-client-id"]?.trim(), n = i && i.length > 0 ? i : `anon-${T()}`, l = !n.startsWith("anon-");
         let a = l ? this.clientCache.get(n) : null;
         if (!a) {
           const f = this.createBundle(), v = f.sessions;
@@ -835,20 +840,20 @@ class le {
             sessions: v instanceof Map ? v : /* @__PURE__ */ new Map()
           }, l && this.clientCache.set(n, a);
         }
-        const c = t.headers["mcp-session-id"];
-        let h;
+        const c = s.headers["mcp-session-id"];
+        let u;
         if (c && a.sessions.get(c))
-          h = a.sessions.get(c);
-        else if (!c && z(t.body)) {
+          u = a.sessions.get(c);
+        else if (!c && O(s.body)) {
           const f = T();
-          h = new D({
+          u = new D({
             sessionIdGenerator: () => f,
             onsessioninitialized: (v) => {
-              a.sessions.set(v, h);
+              a.sessions.set(v, u);
             }
           });
           try {
-            await a.server.connect(h);
+            await a.server.connect(u);
           } catch {
             return o.code(500), {
               jsonrpc: "2.0",
@@ -856,8 +861,8 @@ class le {
               id: null
             };
           }
-          h.onclose = () => {
-            h?.sessionId && a.sessions.delete(h.sessionId);
+          u.onclose = () => {
+            u?.sessionId && a.sessions.delete(u.sessionId);
           };
         } else
           return o.code(400), {
@@ -865,28 +870,28 @@ class le {
             error: { code: -32e3, message: "Session not found or expired" },
             id: null
           };
-        return await h.handleRequest(
-          t.raw,
+        return await u.handleRequest(
+          s.raw,
           o.raw,
-          t.body
+          s.body
         ), o;
       }
-    ), e.get(`${s}/mcp`, async (t, o) => {
-      const i = t.headers["mcp-client-id"]?.trim(), n = i && i.length > 0 ? i : "";
+    ), e.get(`${t}/mcp`, async (s, o) => {
+      const i = s.headers["mcp-client-id"]?.trim(), n = i && i.length > 0 ? i : "";
       if (!n)
         return o.code(400), "Missing mcp-client-id";
       const l = this.clientCache.get(n);
       if (!l)
         return o.code(400), "Invalid or expired client";
-      const a = t.headers["mcp-session-id"];
+      const a = s.headers["mcp-session-id"];
       if (!a)
         return o.code(400), "Missing mcp-session-id";
       const c = l.sessions.get(a);
-      return c ? (await c.handleRequest(t.raw, o.raw), o) : (o.code(400), "Invalid or expired session ID");
+      return c ? (await c.handleRequest(s.raw, o.raw), o) : (o.code(400), "Invalid or expired session ID");
     }), e.delete(
-      `${s}/mcp`,
-      async (t, o) => {
-        const i = t.headers["mcp-client-id"]?.trim(), n = i && i.length > 0 ? i : "", l = t.headers["mcp-session-id"];
+      `${t}/mcp`,
+      async (s, o) => {
+        const i = s.headers["mcp-client-id"]?.trim(), n = i && i.length > 0 ? i : "", l = s.headers["mcp-session-id"];
         if (!n || !l)
           return o.code(400), {
             jsonrpc: "2.0",
@@ -914,7 +919,7 @@ class le {
         }
         return o.code(204).send(), o;
       }
-    ), this.options.customEndpoints && this.options.customEndpoints.length > 0 && F(e, s, this.options.customEndpoints), this.options.app || await e.listen({ host: this.options.host, port: this.options.port }), this.app = e;
+    ), this.options.customEndpoints && this.options.customEndpoints.length > 0 && F(e, t, this.options.customEndpoints), this.options.app || await e.listen({ host: this.options.host, port: this.options.port }), this.app = e;
   }
   /**
    * Stops the Fastify server and cleans up all resources.
@@ -930,13 +935,13 @@ class le {
    * @private
    */
   cleanupBundle(e) {
-    for (const [s, t] of e.sessions.entries())
+    for (const [t, s] of e.sessions.entries())
       try {
-        typeof t.close == "function" && t.close().catch((o) => {
-          console.warn(`Error closing session ${s}:`, o);
+        typeof s.close == "function" && s.close().catch((o) => {
+          console.warn(`Error closing session ${t}:`, o);
         });
       } catch (o) {
-        console.warn(`Error closing session ${s}:`, o);
+        console.warn(`Error closing session ${t}:`, o);
       }
     e.sessions.clear();
   }
@@ -964,9 +969,9 @@ Hint: Common mistake - use "toolsets" not "initialToolsets"`
   const e = r.startup?.mode ?? "DYNAMIC";
   if (typeof r.createServer != "function")
     throw new Error("createMcpServer: `createServer` (factory) is required");
-  const s = r.createServer(), t = (a) => typeof a?.server?.notification == "function", o = (a) => typeof a?.notifyToolsListChanged == "function", i = async (a) => {
+  const t = r.createServer(), s = (a) => typeof a?.server?.notification == "function", o = (a) => typeof a?.notifyToolsListChanged == "function", i = async (a) => {
     try {
-      if (t(a)) {
+      if (s(a)) {
         await a.server.notification({
           method: "notifications/tools/list_changed"
         });
@@ -979,12 +984,12 @@ Hint: Common mistake - use "toolsets" not "initialToolsets"`
       console.warn("Failed to send tools list changed notification:", c);
     }
   }, n = new A({
-    server: s,
+    server: t,
     catalog: r.catalog,
     moduleLoaders: r.moduleLoaders,
     exposurePolicy: r.exposurePolicy,
     context: r.context,
-    notifyToolsListChanged: async () => i(s),
+    notifyToolsListChanged: async () => i(t),
     startup: r.startup,
     registerMetaTools: r.registerMetaTools !== void 0 ? r.registerMetaTools : e === "DYNAMIC"
   });
@@ -993,7 +998,7 @@ Hint: Common mistake - use "toolsets" not "initialToolsets"`
     n.getManager(),
     () => {
       if (e === "STATIC")
-        return { server: s, orchestrator: n };
+        return { server: t, orchestrator: n };
       const a = r.createServer(), c = new A({
         server: a,
         catalog: r.catalog,
@@ -1010,7 +1015,7 @@ Hint: Common mistake - use "toolsets" not "initialToolsets"`
     r.configSchema
   );
   return {
-    server: s,
+    server: t,
     start: async () => {
       await l.start();
     },
@@ -1020,15 +1025,15 @@ Hint: Common mistake - use "toolsets" not "initialToolsets"`
   };
 }
 function de(r) {
-  he(r), ue(r), fe(r), me(r);
+  ue(r), he(r), fe(r), me(r);
 }
-function he(r) {
+function ue(r) {
   if (!r || typeof r != "object")
     throw new Error(
       "Permission configuration is required for createPermissionBasedMcpServer"
     );
 }
-function ue(r) {
+function he(r) {
   if (!r.source)
     throw new Error('Permission source must be either "headers" or "config"');
   if (r.source !== "headers" && r.source !== "config")
@@ -1060,13 +1065,13 @@ function me(r) {
     throw new Error("headerName must be a non-empty string");
 }
 function ge(r) {
-  for (const [e, s] of Object.entries(r))
-    if (!Array.isArray(s))
+  for (const [e, t] of Object.entries(r))
+    if (!Array.isArray(t))
       throw new Error(
         `staticMap value for client "${e}" must be an array of toolset names`
       );
 }
-var p, _, B, H, Y, W;
+var p, _, H, B, Y, W;
 class pe {
   /**
    * Creates a new PermissionResolver instance.
@@ -1091,23 +1096,23 @@ class pe {
    * @param headers - Optional request headers (required for header-based permissions)
    * @returns Array of toolset names the client is allowed to access
    */
-  resolvePermissions(e, s) {
+  resolvePermissions(e, t) {
     if (this.cache.has(e))
       return this.cache.get(e);
-    let t;
+    let s;
     try {
-      this.config.source === "headers" ? t = m(this, p, _).call(this, s) : t = m(this, p, H).call(this, e), Array.isArray(t) || (console.warn(
+      this.config.source === "headers" ? s = m(this, p, _).call(this, t) : s = m(this, p, B).call(this, e), Array.isArray(s) || (console.warn(
         `Permission resolution returned non-array for client ${e}, using empty permissions`
-      ), t = []), t = t.filter(
+      ), s = []), s = s.filter(
         (o) => typeof o == "string" && o.trim().length > 0
       );
     } catch (o) {
       console.error(
         `Unexpected error resolving permissions for client ${e}:`,
         o
-      ), t = [];
+      ), s = [];
     }
-    return this.cache.set(e, t), t;
+    return this.cache.set(e, s), s;
   }
   /**
    * Invalidates cached permissions for a specific client.
@@ -1137,15 +1142,15 @@ p = new WeakSet(), /**
 _ = function(e) {
   if (!e)
     return [];
-  const s = m(this, p, B).call(this, e, this.normalizedHeaderName);
-  if (!s)
+  const t = m(this, p, H).call(this, e, this.normalizedHeaderName);
+  if (!t)
     return [];
   try {
-    return s.split(",").map((t) => t.trim()).filter((t) => t.length > 0);
-  } catch (t) {
+    return t.split(",").map((s) => s.trim()).filter((s) => s.length > 0);
+  } catch (s) {
     return console.warn(
       `Failed to parse permission header '${this.normalizedHeaderName}':`,
-      t
+      s
     ), [];
   }
 }, /**
@@ -1156,11 +1161,11 @@ _ = function(e) {
  * @returns The header value if found, undefined otherwise
  * @private
  */
-B = function(e, s) {
-  if (e[s] !== void 0)
-    return e[s];
-  for (const [t, o] of Object.entries(e))
-    if (t.toLowerCase() === s)
+H = function(e, t) {
+  if (e[t] !== void 0)
+    return e[t];
+  for (const [s, o] of Object.entries(e))
+    if (s.toLowerCase() === t)
       return o;
 }, /**
  * Resolves permissions from server-side configuration.
@@ -1170,16 +1175,16 @@ B = function(e, s) {
  * @returns Array of toolset names from configuration
  * @private
  */
-H = function(e) {
+B = function(e) {
   if (this.config.resolver) {
-    const s = m(this, p, Y).call(this, e);
-    if (s !== null)
-      return s;
+    const t = m(this, p, Y).call(this, e);
+    if (t !== null)
+      return t;
   }
   if (this.config.staticMap) {
-    const s = m(this, p, W).call(this, e);
-    if (s !== null)
-      return s;
+    const t = m(this, p, W).call(this, e);
+    if (t !== null)
+      return t;
   }
   return this.config.defaultPermissions || [];
 }, /**
@@ -1191,14 +1196,14 @@ H = function(e) {
  */
 Y = function(e) {
   try {
-    const s = this.config.resolver(e);
-    return Array.isArray(s) ? s : (console.warn(
+    const t = this.config.resolver(e);
+    return Array.isArray(t) ? t : (console.warn(
       `Permission resolver returned non-array for client ${e}, using fallback`
     ), null);
-  } catch (s) {
-    const t = s instanceof Error ? s.message : String(s);
+  } catch (t) {
+    const s = t instanceof Error ? t.message : String(t);
     return console.warn(
-      `Permission resolver declined client ${e} (${t}), trying fallback`
+      `Permission resolver declined client ${e} (${s}), trying fallback`
     ), null;
   }
 }, /**
@@ -1209,24 +1214,24 @@ Y = function(e) {
  * @private
  */
 W = function(e) {
-  const s = this.config.staticMap[e];
-  return s !== void 0 ? Array.isArray(s) ? s : [] : null;
+  const t = this.config.staticMap[e];
+  return t !== void 0 ? Array.isArray(t) ? t : [] : null;
 };
 function ye(r, e) {
-  return async (s) => {
-    const t = e.resolvePermissions(
-      s.clientId,
-      s.headers
-    ), o = r(t), i = o.orchestrator.getManager(), n = [], l = [];
-    if (t.length > 0) {
-      const a = await i.enableToolsets(t);
+  return async (t) => {
+    const s = e.resolvePermissions(
+      t.clientId,
+      t.headers
+    ), o = r(s), i = o.orchestrator.getManager(), n = [], l = [];
+    if (s.length > 0) {
+      const a = await i.enableToolsets(s);
       for (const c of a.results)
         c.success ? n.push(c.name) : (l.push(c.name), console.warn(
-          `Failed to enable toolset '${c.name}' for client '${s.clientId}': ${c.message}`
+          `Failed to enable toolset '${c.name}' for client '${t.clientId}': ${c.message}`
         ));
       if (n.length === 0 && l.length > 0)
         throw new Error(
-          `All requested toolsets failed to enable for client '${s.clientId}'. Requested: [${t.join(", ")}]. Check that toolset names in permissions match the catalog.`
+          `All requested toolsets failed to enable for client '${t.clientId}'. Requested: [${s.join(", ")}]. Check that toolset names in permissions match the catalog.`
         );
     }
     return {
@@ -1237,7 +1242,7 @@ function ye(r, e) {
     };
   };
 }
-var u, U, q, J, G, K, Z, Q, X, C, ee;
+var h, U, q, J, G, K, Z, Q, X, C, ee;
 class ve {
   /**
    * Creates a new PermissionAwareFastifyTransport instance.
@@ -1246,8 +1251,8 @@ class ve {
    * @param options - Transport configuration options
    * @param configSchema - Optional JSON schema for configuration discovery
    */
-  constructor(e, s, t = {}, o) {
-    b(this, u);
+  constructor(e, t, s = {}, o) {
+    b(this, h);
     d(this, "options");
     d(this, "defaultManager");
     d(this, "createPermissionAwareBundle");
@@ -1255,18 +1260,18 @@ class ve {
     d(this, "configSchema");
     // Per-client server bundles and per-client session transports
     d(this, "clientCache", new V({
-      onEvict: (e, s) => {
-        m(this, u, U).call(this, s);
+      onEvict: (e, t) => {
+        m(this, h, U).call(this, t);
       }
     }));
-    this.defaultManager = e, this.createPermissionAwareBundle = s, this.options = {
-      host: t.host ?? "0.0.0.0",
-      port: t.port ?? 3e3,
-      basePath: t.basePath ?? "/",
-      cors: t.cors ?? !0,
-      logger: t.logger ?? !1,
-      app: t.app,
-      customEndpoints: t.customEndpoints
+    this.defaultManager = e, this.createPermissionAwareBundle = t, this.options = {
+      host: s.host ?? "0.0.0.0",
+      port: s.port ?? 3e3,
+      basePath: s.basePath ?? "/",
+      cors: s.cors ?? !0,
+      logger: s.logger ?? !1,
+      app: s.app,
+      customEndpoints: s.customEndpoints
     }, this.configSchema = o;
   }
   /**
@@ -1277,10 +1282,10 @@ class ve {
     if (this.app) return;
     const e = this.options.app ?? j({ logger: this.options.logger });
     this.options.cors && await e.register(k, { origin: !0 });
-    const s = m(this, u, q).call(this, this.options.basePath);
-    m(this, u, J).call(this, e, s), m(this, u, G).call(this, e, s), m(this, u, K).call(this, e, s), m(this, u, Z).call(this, e, s), m(this, u, Q).call(this, e, s), m(this, u, X).call(this, e, s), this.options.customEndpoints && this.options.customEndpoints.length > 0 && F(e, s, this.options.customEndpoints, {
-      contextExtractor: async (t) => {
-        const o = m(this, u, C).call(this, t);
+    const t = m(this, h, q).call(this, this.options.basePath);
+    m(this, h, J).call(this, e, t), m(this, h, G).call(this, e, t), m(this, h, K).call(this, e, t), m(this, h, Z).call(this, e, t), m(this, h, Q).call(this, e, t), m(this, h, X).call(this, e, t), this.options.customEndpoints && this.options.customEndpoints.length > 0 && F(e, t, this.options.customEndpoints, {
+      contextExtractor: async (s) => {
+        const o = m(this, h, C).call(this, s);
         try {
           const i = await this.createPermissionAwareBundle(o);
           return {
@@ -1306,20 +1311,20 @@ class ve {
     this.app && (this.clientCache.stop(!0), this.options.app || await this.app.close(), this.app = null);
   }
 }
-u = new WeakSet(), /**
+h = new WeakSet(), /**
  * Cleans up resources associated with a client bundle.
  * Closes all sessions within the bundle.
  * @param bundle - The client bundle to clean up
  * @private
  */
 U = function(e) {
-  for (const [s, t] of e.sessions.entries())
+  for (const [t, s] of e.sessions.entries())
     try {
-      typeof t.close == "function" && t.close().catch((o) => {
-        console.warn(`Error closing session ${s}:`, o);
+      typeof s.close == "function" && s.close().catch((o) => {
+        console.warn(`Error closing session ${t}:`, o);
       });
     } catch (o) {
-      console.warn(`Error closing session ${s}:`, o);
+      console.warn(`Error closing session ${t}:`, o);
     }
   e.sessions.clear();
 }, /**
@@ -1336,24 +1341,24 @@ q = function(e) {
  * @param base - Base path for routes
  * @private
  */
-J = function(e, s) {
-  e.get(`${s}/healthz`, async () => ({ ok: !0 }));
+J = function(e, t) {
+  e.get(`${t}/healthz`, async () => ({ ok: !0 }));
 }, /**
  * Registers the tools status endpoint.
  * @param app - Fastify instance
  * @param base - Base path for routes
  * @private
  */
-G = function(e, s) {
-  e.get(`${s}/tools`, async () => this.defaultManager.getStatus());
+G = function(e, t) {
+  e.get(`${t}/tools`, async () => this.defaultManager.getStatus());
 }, /**
  * Registers the MCP configuration discovery endpoint.
  * @param app - Fastify instance
  * @param base - Base path for routes
  * @private
  */
-K = function(e, s) {
-  e.get(`${s}/.well-known/mcp-config`, async (t, o) => (o.header("Content-Type", "application/schema+json; charset=utf-8"), this.configSchema ?? {
+K = function(e, t) {
+  e.get(`${t}/.well-known/mcp-config`, async (s, o) => (o.header("Content-Type", "application/schema+json; charset=utf-8"), this.configSchema ?? {
     $schema: "https://json-schema.org/draft/2020-12/schema",
     title: "MCP Session Configuration",
     description: "Schema for the /mcp endpoint configuration",
@@ -1370,40 +1375,40 @@ K = function(e, s) {
  * @param base - Base path for routes
  * @private
  */
-Z = function(e, s) {
+Z = function(e, t) {
   e.post(
-    `${s}/mcp`,
-    async (t, o) => {
-      const i = m(this, u, C).call(this, t), n = !i.clientId.startsWith("anon-");
+    `${t}/mcp`,
+    async (s, o) => {
+      const i = m(this, h, C).call(this, s), n = !i.clientId.startsWith("anon-");
       let l = n ? this.clientCache.get(i.clientId) : null;
       if (!l)
         try {
-          const h = await this.createPermissionAwareBundle(i);
-          h.failedToolsets.length > 0 && console.warn(
-            `Client ${i.clientId} had ${h.failedToolsets.length} toolsets fail to enable: [${h.failedToolsets.join(", ")}]. Successfully enabled: [${h.allowedToolsets.join(", ")}]`
+          const u = await this.createPermissionAwareBundle(i);
+          u.failedToolsets.length > 0 && console.warn(
+            `Client ${i.clientId} had ${u.failedToolsets.length} toolsets fail to enable: [${u.failedToolsets.join(", ")}]. Successfully enabled: [${u.allowedToolsets.join(", ")}]`
           );
-          const f = h.sessions;
+          const f = u.sessions;
           l = {
-            server: h.server,
-            orchestrator: h.orchestrator,
-            allowedToolsets: h.allowedToolsets,
-            failedToolsets: h.failedToolsets,
+            server: u.server,
+            orchestrator: u.orchestrator,
+            allowedToolsets: u.allowedToolsets,
+            failedToolsets: u.failedToolsets,
             sessions: f instanceof Map ? f : /* @__PURE__ */ new Map()
           }, n && this.clientCache.set(i.clientId, l);
-        } catch (h) {
+        } catch (u) {
           return console.error(
             `Failed to create permission-aware bundle for client ${i.clientId}:`,
-            h
-          ), o.code(403), m(this, u, ee).call(this, "Access denied");
+            u
+          ), o.code(403), m(this, h, ee).call(this, "Access denied");
         }
-      const a = t.headers["mcp-session-id"];
+      const a = s.headers["mcp-session-id"];
       let c;
       if (a && l.sessions.get(a))
         c = l.sessions.get(a);
-      else if (!a && z(t.body)) {
-        const h = T();
+      else if (!a && O(s.body)) {
+        const u = T();
         c = new D({
-          sessionIdGenerator: () => h,
+          sessionIdGenerator: () => u,
           onsessioninitialized: (f) => {
             l.sessions.set(f, c);
           }
@@ -1427,9 +1432,9 @@ Z = function(e, s) {
           id: null
         };
       return await c.handleRequest(
-        t.raw,
+        s.raw,
         o.raw,
-        t.body
+        s.body
       ), o;
     }
   );
@@ -1439,19 +1444,19 @@ Z = function(e, s) {
  * @param base - Base path for routes
  * @private
  */
-Q = function(e, s) {
-  e.get(`${s}/mcp`, async (t, o) => {
-    const i = t.headers["mcp-client-id"]?.trim(), n = i && i.length > 0 ? i : "";
+Q = function(e, t) {
+  e.get(`${t}/mcp`, async (s, o) => {
+    const i = s.headers["mcp-client-id"]?.trim(), n = i && i.length > 0 ? i : "";
     if (!n)
       return o.code(400), "Missing mcp-client-id";
     const l = this.clientCache.get(n);
     if (!l)
       return o.code(400), "Invalid or expired client";
-    const a = t.headers["mcp-session-id"];
+    const a = s.headers["mcp-session-id"];
     if (!a)
       return o.code(400), "Missing mcp-session-id";
     const c = l.sessions.get(a);
-    return c ? (await c.handleRequest(t.raw, o.raw), o) : (o.code(400), "Invalid or expired session ID");
+    return c ? (await c.handleRequest(s.raw, o.raw), o) : (o.code(400), "Invalid or expired session ID");
   });
 }, /**
  * Registers the DELETE /mcp endpoint for session termination.
@@ -1459,11 +1464,11 @@ Q = function(e, s) {
  * @param base - Base path for routes
  * @private
  */
-X = function(e, s) {
+X = function(e, t) {
   e.delete(
-    `${s}/mcp`,
-    async (t, o) => {
-      const i = t.headers["mcp-client-id"]?.trim(), n = i && i.length > 0 ? i : "", l = t.headers["mcp-session-id"];
+    `${t}/mcp`,
+    async (s, o) => {
+      const i = s.headers["mcp-client-id"]?.trim(), n = i && i.length > 0 ? i : "", l = s.headers["mcp-session-id"];
       if (!n || !l)
         return o.code(400), {
           jsonrpc: "2.0",
@@ -1500,10 +1505,10 @@ X = function(e, s) {
  * @private
  */
 C = function(e) {
-  const s = e.headers["mcp-client-id"]?.trim(), t = s && s.length > 0 ? s : `anon-${T()}`, o = {};
+  const t = e.headers["mcp-client-id"]?.trim(), s = t && t.length > 0 ? t : `anon-${T()}`, o = {};
   for (const [i, n] of Object.entries(e.headers))
     typeof n == "string" && (o[i] = n);
-  return { clientId: t, headers: o };
+  return { clientId: s, headers: o };
 }, /**
  * Creates a safe error response that doesn't expose unauthorized toolset information.
  * Used for permission-related errors to prevent information leakage.
@@ -1512,11 +1517,11 @@ C = function(e) {
  * @returns JSON-RPC error response object
  * @private
  */
-ee = function(e = "Access denied", s = -32e3) {
+ee = function(e = "Access denied", t = -32e3) {
   return {
     jsonrpc: "2.0",
     error: {
-      code: s,
+      code: t,
       message: e
     },
     id: null
@@ -1552,8 +1557,8 @@ async function Me(r) {
     );
   const e = Te(
     r.exposurePolicy
-  ), s = new pe(r.permissions), t = r.createServer(), o = new A({
-    server: t,
+  ), t = new pe(r.permissions), s = r.createServer(), o = new A({
+    server: s,
     catalog: r.catalog,
     moduleLoaders: r.moduleLoaders,
     exposurePolicy: e,
@@ -1579,7 +1584,7 @@ async function Me(r) {
       });
       return { server: a, orchestrator: c };
     },
-    s
+    t
   ), n = new ve(
     o.getManager(),
     i,
@@ -1587,7 +1592,7 @@ async function Me(r) {
     r.configSchema
   );
   return {
-    server: t,
+    server: s,
     start: async () => {
       await n.start();
     },
@@ -1595,7 +1600,7 @@ async function Me(r) {
       try {
         await n.stop();
       } finally {
-        s.clearCache();
+        t.clearCache();
       }
     }
   };