toolception 0.5.5 → 0.6.1

package/dist/index.js

@@ -1,17 +1,17 @@
-var se = Object.defineProperty;
-var L = (r) => {
-  throw TypeError(r);
+var re = Object.defineProperty;
+var j = (o) => {
+  throw TypeError(o);
 };
-var te = (r, e, s) => e in r ? se(r, e, { enumerable: !0, configurable: !0, writable: !0, value: s }) : r[e] = s;
-var d = (r, e, s) => te(r, typeof e != "symbol" ? e + "" : e, s), oe = (r, e, s) => e.has(r) || L("Cannot " + s);
-var b = (r, e, s) => e.has(r) ? L("Cannot add the same private member more than once") : e instanceof WeakSet ? e.add(r) : e.set(r, s);
-var m = (r, e, s) => (oe(r, e, "access private method"), s);
-import { z as y } from "zod";
-import j from "fastify";
-import k from "@fastify/cors";
-import { randomUUID as T } from "node:crypto";
-import { StreamableHTTPServerTransport as O } from "@modelcontextprotocol/sdk/server/streamableHttp.js";
-import { isInitializeRequest as D } from "@modelcontextprotocol/sdk/types.js";
+var ie = (o, e, t) => e in o ? re(o, e, { enumerable: !0, configurable: !0, writable: !0, value: t }) : o[e] = t;
+var d = (o, e, t) => ie(o, typeof e != "symbol" ? e + "" : e, t), ne = (o, e, t) => e.has(o) || j("Cannot " + t);
+var A = (o, e, t) => e.has(o) ? j("Cannot add the same private member more than once") : e instanceof WeakSet ? e.add(o) : e.set(o, t);
+var m = (o, e, t) => (ne(o, e, "access private method"), t);
+import { z as v } from "zod";
+import N from "fastify";
+import D from "@fastify/cors";
+import { randomUUID as S, createHash as ae } from "node:crypto";
+import { StreamableHTTPServerTransport as z } from "@modelcontextprotocol/sdk/server/streamableHttp.js";
+import { isInitializeRequest as _ } from "@modelcontextprotocol/sdk/types.js";
 const R = {
   dynamic: [
     "dynamic-tool-discovery",
@@ -20,7 +20,7 @@ const R = {
   ],
   toolsets: ["tool-sets", "toolSets", "FMP_TOOL_SETS"]
 };
-class re {
+class le {
   constructor(e = {}) {
     d(this, "keys");
     this.keys = {
@@ -28,46 +28,46 @@ class re {
       toolsets: e.keys?.toolsets ?? R.toolsets
     };
   }
-  resolveMode(e, s) {
-    return this.isDynamicEnabled(s) ? "DYNAMIC" : this.getToolsetsString(s) ? "STATIC" : this.isDynamicEnabled(e) ? "DYNAMIC" : this.getToolsetsString(e) ? "STATIC" : null;
+  resolveMode(e, t) {
+    return this.isDynamicEnabled(t) ? "DYNAMIC" : this.getToolsetsString(t) ? "STATIC" : this.isDynamicEnabled(e) ? "DYNAMIC" : this.getToolsetsString(e) ? "STATIC" : null;
   }
-  parseCommaSeparatedToolSets(e, s) {
+  parseCommaSeparatedToolSets(e, t) {
     if (!e || typeof e != "string") return [];
-    const t = e.split(",").map((n) => n.trim()).filter((n) => n.length > 0), o = new Set(Object.keys(s)), i = [];
-    for (const n of t)
-      o.has(n) ? i.push(n) : console.warn(
+    const s = e.split(",").map((n) => n.trim()).filter((n) => n.length > 0), r = new Set(Object.keys(t)), i = [];
+    for (const n of s)
+      r.has(n) ? i.push(n) : console.warn(
         `Invalid toolset '${n}' ignored. Available: ${Array.from(
-          o
+          r
         ).join(", ")}`
       );
     return i;
   }
-  getModulesForToolSets(e, s) {
-    const t = /* @__PURE__ */ new Set();
-    for (const o of e) {
-      const i = s[o];
-      i && (i.modules || []).forEach((n) => t.add(n));
+  getModulesForToolSets(e, t) {
+    const s = /* @__PURE__ */ new Set();
+    for (const r of e) {
+      const i = t[r];
+      i && (i.modules || []).forEach((n) => s.add(n));
     }
-    return Array.from(t);
+    return Array.from(s);
   }
-  validateToolsetName(e, s) {
+  validateToolsetName(e, t) {
     if (!e || typeof e != "string")
       return {
         isValid: !1,
         error: `Invalid toolset name provided. Must be a non-empty string. Available toolsets: ${Object.keys(
-          s
+          t
         ).join(", ")}`
       };
-    const t = e.trim();
-    return t.length === 0 ? {
+    const s = e.trim();
+    return s.length === 0 ? {
       isValid: !1,
       error: `Empty toolset name provided. Available toolsets: ${Object.keys(
-        s
+        t
       ).join(", ")}`
-    } : s[t] ? { isValid: !0, sanitized: t } : {
+    } : t[s] ? { isValid: !0, sanitized: s } : {
       isValid: !1,
-      error: `Toolset '${t}' not found. Available toolsets: ${Object.keys(
-        s
+      error: `Toolset '${s}' not found. Available toolsets: ${Object.keys(
+        t
       ).join(", ")}`
     };
   }
@@ -78,44 +78,50 @@ class re {
    * @param catalog - The toolset catalog to validate against
    * @returns Validation result with modules array if valid
    */
-  validateToolsetModules(e, s) {
+  validateToolsetModules(e, t) {
     try {
-      for (const o of e)
-        if (!s[o])
+      for (const r of e)
+        if (!t[r])
           return {
             isValid: !1,
-            error: `Toolset '${o}' not found in catalog`
+            error: `Toolset '${r}' not found in catalog`
           };
-      return { isValid: !0, modules: this.getModulesForToolSets(e, s) };
-    } catch (t) {
+      return { isValid: !0, modules: this.getModulesForToolSets(e, t) };
+    } catch (s) {
       return {
         isValid: !1,
-        error: `Error resolving modules for ${e.join(", ")}: ${t instanceof Error ? t.message : "Unknown error"}`
+        error: `Error resolving modules for ${e.join(", ")}: ${s instanceof Error ? s.message : "Unknown error"}`
       };
     }
   }
   isDynamicEnabled(e) {
     if (!e) return !1;
-    for (const s of this.keys.dynamic) {
-      const t = e[s];
-      if (t === !0 || typeof t == "string" && t.trim().toLowerCase() === "true")
+    for (const t of this.keys.dynamic) {
+      const s = e[t];
+      if (s === !0 || typeof s == "string" && s.trim().toLowerCase() === "true")
         return !0;
     }
     return !1;
   }
   getToolsetsString(e) {
     if (e)
-      for (const s of this.keys.toolsets) {
-        const t = e[s];
-        if (typeof t == "string" && t.trim().length > 0)
-          return t;
+      for (const t of this.keys.toolsets) {
+        const s = e[t];
+        if (typeof s == "string" && s.trim().length > 0)
+          return s;
       }
   }
 }
-class ie {
+const k = ["_meta"];
+class ce {
   constructor(e) {
     d(this, "catalog");
     d(this, "moduleLoaders");
+    for (const t of k)
+      if (t in e.catalog)
+        throw new Error(
+          `Toolset key '${t}' is reserved for internal use and cannot be used in the catalog`
+        );
     this.catalog = e.catalog, this.moduleLoaders = e.moduleLoaders ?? {};
   }
   getAvailableToolsets() {
@@ -132,50 +138,53 @@ class ie {
           ", "
         )}`
       };
-    const s = e.trim();
-    return s.length === 0 ? {
+    const t = e.trim();
+    return t.length === 0 ? {
       isValid: !1,
       error: `Empty toolset name provided. Available toolsets: ${this.getAvailableToolsets().join(
         ", "
       )}`
-    } : this.catalog[s] ? { isValid: !0, sanitized: s } : {
+    } : k.includes(t) ? {
+      isValid: !1,
+      error: `Toolset key '${t}' is reserved for internal use`
+    } : this.catalog[t] ? { isValid: !0, sanitized: t } : {
       isValid: !1,
-      error: `Toolset '${s}' not found. Available toolsets: ${this.getAvailableToolsets().join(
+      error: `Toolset '${t}' not found. Available toolsets: ${this.getAvailableToolsets().join(
         ", "
       )}`
     };
   }
-  async resolveToolsForToolsets(e, s) {
-    const t = [];
-    for (const o of e) {
-      const i = this.catalog[o];
-      if (i && (Array.isArray(i.tools) && i.tools.length > 0 && t.push(...i.tools), Array.isArray(i.modules) && i.modules.length > 0))
+  async resolveToolsForToolsets(e, t) {
+    const s = [];
+    for (const r of e) {
+      const i = this.catalog[r];
+      if (i && (Array.isArray(i.tools) && i.tools.length > 0 && s.push(...i.tools), Array.isArray(i.modules) && i.modules.length > 0))
         for (const n of i.modules) {
           const l = this.moduleLoaders[n];
           if (l)
             try {
-              const a = await l(s);
-              Array.isArray(a) && a.length > 0 && t.push(...a);
-            } catch (a) {
+              const c = await l(t);
+              Array.isArray(c) && c.length > 0 && s.push(...c);
+            } catch (c) {
               console.warn(
-                `Module loader '${n}' failed for toolset '${o}':`,
-                a
+                `Module loader '${n}' failed for toolset '${r}':`,
+                c
               );
             }
         }
     }
-    return t;
+    return s;
   }
 }
-class N extends Error {
-  constructor(s, t, o, i) {
-    super(s);
+class O extends Error {
+  constructor(t, s, r, i) {
+    super(t);
     d(this, "code");
     d(this, "details");
-    this.name = "ToolingError", this.code = t, this.details = o;
+    this.name = "ToolingError", this.code = s, this.details = r;
   }
 }
-class z {
+class q {
   constructor(e = {}) {
     d(this, "options");
     d(this, "names", /* @__PURE__ */ new Set());
@@ -184,34 +193,34 @@ class z {
       namespaceWithToolset: e.namespaceWithToolset ?? !0
     };
   }
-  getSafeName(e, s) {
-    return !this.options.namespaceWithToolset || s.startsWith(`${e}.`) ? s : `${e}.${s}`;
+  getSafeName(e, t) {
+    return !this.options.namespaceWithToolset || t.startsWith(`${e}.`) ? t : `${e}.${t}`;
   }
   has(e) {
     return this.names.has(e);
   }
   add(e) {
     if (this.names.has(e))
-      throw new N(
+      throw new O(
         `Tool name collision: '${e}' already registered`,
         "E_TOOL_NAME_CONFLICT"
       );
     this.names.add(e);
   }
-  addForToolset(e, s) {
-    this.add(s);
-    const t = this.toolsetToNames.get(e) ?? /* @__PURE__ */ new Set();
-    t.add(s), this.toolsetToNames.set(e, t);
-  }
-  mapAndValidate(e, s) {
-    return s.map((t) => {
-      const o = this.getSafeName(e, t.name);
-      if (this.has(o))
-        throw new N(
-          `Tool name collision for '${o}'`,
+  addForToolset(e, t) {
+    this.add(t);
+    const s = this.toolsetToNames.get(e) ?? /* @__PURE__ */ new Set();
+    s.add(t), this.toolsetToNames.set(e, s);
+  }
+  mapAndValidate(e, t) {
+    return t.map((s) => {
+      const r = this.getSafeName(e, s.name);
+      if (this.has(r))
+        throw new O(
+          `Tool name collision for '${r}'`,
           "E_TOOL_NAME_CONFLICT"
         );
-      return { ...t, name: o };
+      return { ...s, name: r };
     });
   }
   list() {
@@ -219,12 +228,12 @@ class z {
   }
   listByToolset() {
     const e = {};
-    for (const [s, t] of this.toolsetToNames.entries())
-      e[s] = Array.from(t);
+    for (const [t, s] of this.toolsetToNames.entries())
+      e[t] = Array.from(s);
     return e;
   }
 }
-class ne {
+class de {
   constructor(e) {
     d(this, "server");
     d(this, "resolver");
@@ -233,7 +242,7 @@ class ne {
     d(this, "exposurePolicy");
     d(this, "toolRegistry");
     d(this, "activeToolsets", /* @__PURE__ */ new Set());
-    this.server = e.server, this.resolver = e.resolver, this.context = e.context, this.onToolsListChanged = e.onToolsListChanged, this.exposurePolicy = e.exposurePolicy, this.toolRegistry = e.toolRegistry ?? new z({ namespaceWithToolset: !0 });
+    this.server = e.server, this.resolver = e.resolver, this.context = e.context, this.onToolsListChanged = e.onToolsListChanged, this.exposurePolicy = e.exposurePolicy, this.toolRegistry = e.toolRegistry ?? new q({ namespaceWithToolset: !0 });
   }
   /**
    * Sends a tool list change notification if configured.
@@ -268,46 +277,46 @@ class ne {
    * @param skipNotification - If true, skips the tool list change notification (for batch operations)
    * @returns Result object with success status and message
    */
-  async enableToolset(e, s = !1) {
-    const t = this.resolver.validateToolsetName(e);
-    if (!t.isValid || !t.sanitized)
+  async enableToolset(e, t = !1) {
+    const s = this.resolver.validateToolsetName(e);
+    if (!s.isValid || !s.sanitized)
       return {
         success: !1,
-        message: t.error || "Unknown validation error"
+        message: s.error || "Unknown validation error"
       };
-    const o = t.sanitized;
-    if (this.activeToolsets.has(o))
+    const r = s.sanitized;
+    if (this.activeToolsets.has(r))
       return {
         success: !1,
-        message: `Toolset '${o}' is already enabled.`
+        message: `Toolset '${r}' is already enabled.`
       };
-    const i = this.checkExposurePolicy(o);
+    const i = this.checkExposurePolicy(r);
     if (!i.allowed)
       return { success: !1, message: i.message };
     const n = [];
     try {
       const l = await this.resolver.resolveToolsForToolsets(
-        [o],
+        [r],
         this.context
       );
       if (l && l.length > 0) {
-        const a = this.toolRegistry.mapAndValidate(
-          o,
+        const c = this.toolRegistry.mapAndValidate(
+          r,
           l
         );
-        for (const c of a)
-          this.registerSingleTool(c, o), n.push(c.name);
+        for (const a of c)
+          this.registerSingleTool(a, r), n.push(a.name);
       }
-      return this.activeToolsets.add(o), s || await this.notifyToolsChanged(), {
+      return this.activeToolsets.add(r), t || await this.notifyToolsChanged(), {
         success: !0,
-        message: `Toolset '${o}' enabled successfully. Registered ${l?.length ?? 0} tools.`
+        message: `Toolset '${r}' enabled successfully. Registered ${l?.length ?? 0} tools.`
       };
     } catch (l) {
       return n.length > 0 && console.warn(
-        `Partial failure enabling toolset '${o}'. ${n.length} tools were registered but toolset activation failed. Tools remain registered due to MCP limitations: ${n.join(", ")}`
+        `Partial failure enabling toolset '${r}'. ${n.length} tools were registered but toolset activation failed. Tools remain registered due to MCP limitations: ${n.join(", ")}`
       ), {
         success: !1,
-        message: `Failed to enable toolset '${o}': ${l instanceof Error ? l.message : "Unknown error"}`
+        message: `Failed to enable toolset '${r}': ${l instanceof Error ? l.message : "Unknown error"}`
       };
     }
   }
@@ -338,19 +347,19 @@ class ne {
    * @param toolsetKey - The toolset key for tracking
    * @private
    */
-  registerSingleTool(e, s) {
+  registerSingleTool(e, t) {
     e.annotations && Object.keys(e.annotations).length > 0 && e.annotations ? this.server.tool(
       e.name,
       e.description,
       e.inputSchema,
       e.annotations,
-      async (o) => await e.handler(o)
+      async (r) => await e.handler(r)
     ) : this.server.tool(
       e.name,
       e.description,
       e.inputSchema,
-      async (o) => await e.handler(o)
-    ), this.toolRegistry.addForToolset(s, e.name);
+      async (r) => await e.handler(r)
+    ), this.toolRegistry.addForToolset(t, e.name);
   }
   /**
    * Disables a toolset by name.
@@ -359,21 +368,21 @@ class ne {
    * @returns Result object with success status and message
    */
   async disableToolset(e) {
-    const s = this.resolver.validateToolsetName(e);
-    if (!s.isValid || !s.sanitized) {
-      const o = Array.from(this.activeToolsets).join(", ") || "none";
+    const t = this.resolver.validateToolsetName(e);
+    if (!t.isValid || !t.sanitized) {
+      const r = Array.from(this.activeToolsets).join(", ") || "none";
       return {
         success: !1,
-        message: `${s.error || "Unknown validation error"} Active toolsets: ${o}`
+        message: `${t.error || "Unknown validation error"} Active toolsets: ${r}`
       };
     }
-    const t = s.sanitized;
-    return this.activeToolsets.has(t) ? (this.activeToolsets.delete(t), await this.notifyToolsChanged(), {
+    const s = t.sanitized;
+    return this.activeToolsets.has(s) ? (this.activeToolsets.delete(s), await this.notifyToolsChanged(), {
       success: !0,
-      message: `Toolset '${t}' disabled successfully. Individual tools remain registered due to MCP limitations.`
+      message: `Toolset '${s}' disabled successfully. Individual tools remain registered due to MCP limitations.`
     }) : {
       success: !1,
-      message: `Toolset '${t}' is not currently active. Active toolsets: ${Array.from(this.activeToolsets).join(", ") || "none"}`
+      message: `Toolset '${s}' is not currently active. Active toolsets: ${Array.from(this.activeToolsets).join(", ") || "none"}`
     };
   }
   getStatus() {
@@ -394,21 +403,21 @@ class ne {
    * @returns Result object with overall success status and individual results
    */
   async enableToolsets(e) {
-    const s = [];
+    const t = [];
     for (const n of e)
       try {
         const l = await this.enableToolset(n, !0);
-        s.push({ name: n, ...l });
+        t.push({ name: n, ...l });
       } catch (l) {
-        s.push({
+        t.push({
           name: n,
           success: !1,
           message: l instanceof Error ? l.message : "Unknown error",
           code: "E_INTERNAL"
         });
       }
-    const t = s.every((n) => n.success), o = s.some((n) => n.success), i = t ? "All toolsets enabled" : o ? "Some toolsets failed to enable" : "All toolsets failed to enable";
-    return o && await this.notifyToolsChanged(), { success: t, results: s, message: i };
+    const s = t.every((n) => n.success), r = t.some((n) => n.success), i = s ? "All toolsets enabled" : r ? "Some toolsets failed to enable" : "All toolsets failed to enable";
+    return r && await this.notifyToolsChanged(), { success: s, results: t, message: i };
   }
   /**
    * Enables all available toolsets in a batch operation.
@@ -419,103 +428,104 @@ class ne {
     return this.enableToolsets(e);
   }
 }
-function ae(r, e, s) {
-  (s?.mode ?? "DYNAMIC") === "DYNAMIC" && (r.tool(
+const b = "_meta";
+function ue(o, e, t, s) {
+  (s?.mode ?? "DYNAMIC") === "DYNAMIC" && (t.addForToolset(b, "enable_toolset"), o.tool(
     "enable_toolset",
     "Enable a toolset by name",
-    { name: y.string().describe("Toolset name") },
+    { name: v.string().describe("Toolset name") },
     { destructiveHint: !0, idempotentHint: !0 },
-    async (o) => {
-      const i = await e.enableToolset(o.name);
+    async (i) => {
+      const n = await e.enableToolset(i.name);
       return {
-        content: [{ type: "text", text: JSON.stringify(i) }]
+        content: [{ type: "text", text: JSON.stringify(n) }]
       };
     }
-  ), r.tool(
+  ), t.addForToolset(b, "disable_toolset"), o.tool(
     "disable_toolset",
     "Disable a toolset by name (state only)",
-    { name: y.string().describe("Toolset name") },
+    { name: v.string().describe("Toolset name") },
     { destructiveHint: !0, idempotentHint: !0 },
-    async (o) => {
-      const i = await e.disableToolset(o.name);
+    async (i) => {
+      const n = await e.disableToolset(i.name);
       return {
-        content: [{ type: "text", text: JSON.stringify(i) }]
+        content: [{ type: "text", text: JSON.stringify(n) }]
       };
     }
-  ), r.tool(
+  ), t.addForToolset(b, "list_toolsets"), o.tool(
     "list_toolsets",
     "List available toolsets with active status and definitions",
     {},
     { readOnlyHint: !0, idempotentHint: !0 },
     async () => {
-      const o = e.getAvailableToolsets(), i = e.getStatus().toolsetToTools, n = o.map((l) => {
-        const a = e.getToolsetDefinition(l);
+      const i = e.getAvailableToolsets(), n = e.getStatus().toolsetToTools, l = i.map((c) => {
+        const a = e.getToolsetDefinition(c);
         return {
-          key: l,
-          active: e.isActive(l),
+          key: c,
+          active: e.isActive(c),
           definition: a ? {
             name: a.name,
             description: a.description,
             modules: a.modules ?? [],
             decisionCriteria: a.decisionCriteria ?? void 0
           } : null,
-          tools: i[l] ?? []
+          tools: n[c] ?? []
         };
       });
       return {
         content: [
-          { type: "text", text: JSON.stringify({ toolsets: n }) }
+          { type: "text", text: JSON.stringify({ toolsets: l }) }
         ]
       };
     }
-  ), r.tool(
+  ), t.addForToolset(b, "describe_toolset"), o.tool(
     "describe_toolset",
     "Describe a toolset with definition, active status and tools",
-    { name: y.string().describe("Toolset name") },
+    { name: v.string().describe("Toolset name") },
     { readOnlyHint: !0, idempotentHint: !0 },
-    async (o) => {
-      const i = e.getToolsetDefinition(o.name), n = e.getStatus().toolsetToTools;
-      if (!i)
+    async (i) => {
+      const n = e.getToolsetDefinition(i.name), l = e.getStatus().toolsetToTools;
+      if (!n)
         return {
           content: [
             {
               type: "text",
-              text: JSON.stringify({ error: `Unknown toolset '${o.name}'` })
+              text: JSON.stringify({ error: `Unknown toolset '${i.name}'` })
             }
           ]
         };
-      const l = {
-        key: o.name,
-        active: e.isActive(o.name),
+      const c = {
+        key: i.name,
+        active: e.isActive(i.name),
         definition: {
-          name: i.name,
-          description: i.description,
-          modules: i.modules ?? [],
-          decisionCriteria: i.decisionCriteria ?? void 0
+          name: n.name,
+          description: n.description,
+          modules: n.modules ?? [],
+          decisionCriteria: n.decisionCriteria ?? void 0
         },
-        tools: n[o.name] ?? []
+        tools: l[i.name] ?? []
       };
       return {
-        content: [{ type: "text", text: JSON.stringify(l) }]
+        content: [{ type: "text", text: JSON.stringify(c) }]
       };
     }
-  )), r.tool(
+  )), t.addForToolset(b, "list_tools"), o.tool(
     "list_tools",
     "List currently registered tool names (best effort)",
     {},
     { readOnlyHint: !0, idempotentHint: !0 },
     async () => {
-      const o = e.getStatus(), i = {
-        tools: o.tools,
-        toolsetToTools: o.toolsetToTools
+      const i = e.getStatus(), n = {
+        tools: i.tools,
+        toolsetToTools: i.toolsetToTools
       };
       return {
-        content: [{ type: "text", text: JSON.stringify(i) }]
+        content: [{ type: "text", text: JSON.stringify(n) }]
       };
     }
   );
 }
-class A {
+class C {
   constructor(e) {
     d(this, "mode");
     d(this, "resolver");
@@ -523,24 +533,24 @@ class A {
     d(this, "toolsetValidator");
     d(this, "initPromise");
     d(this, "initError", null);
-    this.toolsetValidator = new re();
-    const s = e.startup ?? {}, t = this.resolveStartupConfig(s, e.catalog);
-    this.mode = t.mode, this.resolver = new ie({
+    this.toolsetValidator = new le();
+    const t = e.startup ?? {}, s = this.resolveStartupConfig(t, e.catalog);
+    this.mode = s.mode, this.resolver = new ce({
       catalog: e.catalog,
       moduleLoaders: e.moduleLoaders
     });
-    const o = new z({
+    const r = new q({
       namespaceWithToolset: e.exposurePolicy?.namespaceToolsWithSetKey ?? !0
     });
-    this.manager = new ne({
+    this.manager = new de({
       server: e.server,
       resolver: this.resolver,
       context: e.context,
       onToolsListChanged: e.notifyToolsListChanged,
       exposurePolicy: e.exposurePolicy,
-      toolRegistry: o
-    }), e.registerMetaTools !== !1 && ae(e.server, this.manager, { mode: this.mode });
-    const i = t.toolsets;
+      toolRegistry: r
+    }), e.registerMetaTools !== !1 && ue(e.server, this.manager, r, { mode: this.mode });
+    const i = s.toolsets;
     this.initPromise = this.initializeToolsets(i);
   }
   /**
@@ -553,8 +563,8 @@ class A {
   async initializeToolsets(e) {
     try {
       e === "ALL" ? await this.manager.enableToolsets(this.resolver.getAvailableToolsets()) : Array.isArray(e) && e.length > 0 && await this.manager.enableToolsets(e);
-    } catch (s) {
-      this.initError = s instanceof Error ? s : new Error(String(s)), console.error("Failed to initialize toolsets:", this.initError);
+    } catch (t) {
+      this.initError = t instanceof Error ? t : new Error(String(t)), console.error("Failed to initialize toolsets:", this.initError);
     }
   }
   /**
@@ -574,38 +584,38 @@ class A {
   async isReady() {
     return await this.initPromise, this.initError === null;
   }
-  resolveStartupConfig(e, s) {
+  resolveStartupConfig(e, t) {
     if (e.mode) {
       if (e.mode === "DYNAMIC" && e.toolsets)
         return console.warn("startup.toolsets provided but ignored in DYNAMIC mode"), { mode: "DYNAMIC" };
       if (e.mode === "STATIC") {
         if (e.toolsets === "ALL")
           return { mode: "STATIC", toolsets: "ALL" };
-        const t = Array.isArray(e.toolsets) ? e.toolsets : [], o = [];
-        for (const i of t) {
-          const { isValid: n, sanitized: l, error: a } = this.toolsetValidator.validateToolsetName(i, s);
-          n && l ? o.push(l) : a && console.warn(a);
+        const s = Array.isArray(e.toolsets) ? e.toolsets : [], r = [];
+        for (const i of s) {
+          const { isValid: n, sanitized: l, error: c } = this.toolsetValidator.validateToolsetName(i, t);
+          n && l ? r.push(l) : c && console.warn(c);
         }
-        if (t.length > 0 && o.length === 0)
+        if (s.length > 0 && r.length === 0)
           throw new Error(
             "STATIC mode requires valid toolsets or 'ALL'; none were valid"
           );
-        return { mode: "STATIC", toolsets: o };
+        return { mode: "STATIC", toolsets: r };
       }
       return { mode: e.mode };
     }
     if (e.toolsets === "ALL") return { mode: "STATIC", toolsets: "ALL" };
     if (Array.isArray(e.toolsets) && e.toolsets.length > 0) {
-      const t = [];
-      for (const o of e.toolsets) {
-        const { isValid: i, sanitized: n, error: l } = this.toolsetValidator.validateToolsetName(o, s);
-        i && n ? t.push(n) : l && console.warn(l);
+      const s = [];
+      for (const r of e.toolsets) {
+        const { isValid: i, sanitized: n, error: l } = this.toolsetValidator.validateToolsetName(r, t);
+        i && n ? s.push(n) : l && console.warn(l);
       }
-      if (t.length === 0)
+      if (s.length === 0)
         throw new Error(
           "STATIC mode requires valid toolsets or 'ALL'; none were valid"
         );
-      return { mode: "STATIC", toolsets: t };
+      return { mode: "STATIC", toolsets: s };
     }
     return { mode: "DYNAMIC" };
   }
@@ -616,10 +626,10 @@ class A {
     return this.manager;
   }
 }
-var w, E;
-class V {
+var x, P;
+class F {
   constructor(e = {}) {
-    b(this, w);
+    A(this, x);
     d(this, "storage", /* @__PURE__ */ new Map());
     d(this, "maxSize");
     d(this, "ttlMs");
@@ -627,8 +637,8 @@ class V {
     // Use ReturnType<typeof setInterval> for cross-env typings without NodeJS namespace
     d(this, "pruneInterval");
     this.maxSize = e.maxSize ?? 1e3, this.ttlMs = e.ttlMs ?? 1e3 * 60 * 60, this.onEvict = e.onEvict;
-    const s = e.pruneIntervalMs ?? 1e3 * 60 * 10;
-    this.pruneInterval = setInterval(() => this.pruneExpired(), s);
+    const t = e.pruneIntervalMs ?? 1e3 * 60 * 10;
+    this.pruneInterval = setInterval(() => this.pruneExpired(), t);
   }
   getEntryCount() {
     return this.storage.size;
@@ -640,13 +650,13 @@ class V {
     return this.ttlMs;
   }
   get(e) {
-    const s = this.storage.get(e);
-    return s ? Date.now() - s.lastAccessed > this.ttlMs ? (this.delete(e), null) : (s.lastAccessed = Date.now(), this.storage.delete(e), this.storage.set(e, s), s.resource) : null;
+    const t = this.storage.get(e);
+    return t ? Date.now() - t.lastAccessed > this.ttlMs ? (this.delete(e), null) : (t.lastAccessed = Date.now(), this.storage.delete(e), this.storage.set(e, t), t.resource) : null;
   }
-  set(e, s) {
+  set(e, t) {
     this.storage.size >= this.maxSize && this.evictLeastRecentlyUsed();
-    const t = { resource: s, lastAccessed: Date.now() };
-    this.storage.set(e, t);
+    const s = { resource: t, lastAccessed: Date.now() };
+    this.storage.set(e, s);
   }
   /**
    * Removes an entry from the cache.
@@ -654,8 +664,8 @@ class V {
    * @param key - The key to remove
    */
   delete(e) {
-    const s = this.storage.get(e);
-    s && (this.storage.delete(e), m(this, w, E).call(this, e, s.resource));
+    const t = this.storage.get(e);
+    t && (this.storage.delete(e), m(this, x, P).call(this, e, t.resource));
   }
   /**
    * Stops the background pruning interval and optionally clears all entries.
@@ -671,8 +681,8 @@ class V {
   clear() {
     const e = Array.from(this.storage.entries());
     this.storage.clear();
-    for (const [s, t] of e)
-      m(this, w, E).call(this, s, t.resource);
+    for (const [t, s] of e)
+      m(this, x, P).call(this, t, s.resource);
   }
   /**
    * Evicts the least recently used entry from the cache.
@@ -687,84 +697,84 @@ class V {
    * @private
    */
   pruneExpired() {
-    const e = Date.now(), s = [];
-    for (const [t, o] of this.storage.entries())
-      e - o.lastAccessed > this.ttlMs && s.push(t);
-    for (const t of s)
-      this.delete(t);
+    const e = Date.now(), t = [];
+    for (const [s, r] of this.storage.entries())
+      e - r.lastAccessed > this.ttlMs && t.push(s);
+    for (const s of t)
+      this.delete(s);
   }
 }
-w = new WeakSet(), /**
+x = new WeakSet(), /**
  * Safely calls the evict callback, catching and logging any errors.
  * @param key - The key being evicted
  * @param resource - The resource being evicted
  * @private
  */
-E = function(e, s) {
+P = function(e, t) {
   if (this.onEvict)
     try {
-      const t = this.onEvict(e, s);
-      t instanceof Promise && t.catch((o) => {
-        console.warn(`Error in cache eviction callback for key '${e}':`, o);
+      const s = this.onEvict(e, t);
+      s instanceof Promise && s.catch((r) => {
+        console.warn(`Error in cache eviction callback for key '${e}':`, r);
       });
-    } catch (t) {
-      console.warn(`Error in cache eviction callback for key '${e}':`, t);
+    } catch (s) {
+      console.warn(`Error in cache eviction callback for key '${e}':`, s);
     }
 };
-function F(r, e, s, t) {
-  const o = ["/mcp", "/healthz", "/tools", "/.well-known/mcp-config"];
-  for (const i of s) {
+function V(o, e, t, s) {
+  const r = ["/mcp", "/healthz", "/tools", "/.well-known/mcp-config"];
+  for (const i of t) {
     const n = `${e}${i.path}`;
-    if (o.some(
-      (c) => n.startsWith(`${e}${c}`)
+    if (r.some(
+      (a) => n.startsWith(`${e}${a}`)
     )) {
       console.warn(
         `Custom endpoint ${i.method} ${i.path} conflicts with built-in MCP endpoint. Skipping registration.`
       );
       continue;
     }
-    const a = i.method.toLowerCase();
-    r[a](n, async (c, u) => {
+    const c = i.method.toLowerCase();
+    o[c](n, async (a, u) => {
       try {
-        const f = c.headers["mcp-client-id"]?.trim(), v = f && f.length > 0 ? f : `anon-${T()}`;
-        let x;
+        const h = a.headers["mcp-client-id"]?.trim(), g = h && h.length > 0 ? h : `anon-${S()}`;
+        let w;
         if (i.bodySchema) {
-          const g = i.bodySchema.safeParse(c.body);
-          if (!g.success)
-            return S(u, "body", g.error);
-          x = g.data;
+          const y = i.bodySchema.safeParse(a.body);
+          if (!y.success)
+            return E(u, "body", y.error);
+          w = y.data;
         }
-        let I = {};
+        let T = {};
         if (i.querySchema) {
-          const g = i.querySchema.safeParse(c.query);
-          if (!g.success)
-            return S(u, "query", g.error);
-          I = g.data;
+          const y = i.querySchema.safeParse(a.query);
+          if (!y.success)
+            return E(u, "query", y.error);
+          T = y.data;
         }
-        let M = {};
+        let I = {};
         if (i.paramsSchema) {
-          const g = i.paramsSchema.safeParse(c.params);
-          if (!g.success)
-            return S(u, "params", g.error);
-          M = g.data;
+          const y = i.paramsSchema.safeParse(a.params);
+          if (!y.success)
+            return E(u, "params", y.error);
+          I = y.data;
         }
-        const P = {
-          body: x,
-          query: I,
-          params: M,
-          headers: c.headers,
-          clientId: v
+        const $ = {
+          body: w,
+          query: T,
+          params: I,
+          headers: a.headers,
+          clientId: g
         };
-        if (t?.contextExtractor) {
-          const g = await t.contextExtractor(c);
-          Object.assign(P, g);
+        if (s?.contextExtractor) {
+          const y = await s.contextExtractor(a);
+          Object.assign($, y);
         }
-        const $ = await i.handler(P);
+        const L = await i.handler($);
         if (i.responseSchema) {
-          const g = i.responseSchema.safeParse($);
-          return g.success ? g.data : (console.error(
+          const y = i.responseSchema.safeParse(L);
+          return y.success ? y.data : (console.error(
             `Response validation failed for ${i.method} ${i.path}:`,
-            g.error
+            y.error
           ), u.code(500), {
             error: {
               code: "RESPONSE_VALIDATION_ERROR",
@@ -772,59 +782,61 @@ function F(r, e, s, t) {
             }
           });
         }
-        return $;
-      } catch (f) {
+        return L;
+      } catch (h) {
         return console.error(
           `Error in custom endpoint ${i.method} ${i.path}:`,
-          f
+          h
         ), u.code(500), {
           error: {
             code: "INTERNAL_ERROR",
-            message: f instanceof Error ? f.message : "Internal server error"
+            message: h instanceof Error ? h.message : "Internal server error"
           }
         };
       }
     });
   }
 }
-function S(r, e, s) {
-  return r.code(400), {
+function E(o, e, t) {
+  return o.code(400), {
     error: {
       code: "VALIDATION_ERROR",
       message: `Validation failed for ${e}`,
-      details: s.errors
+      details: t.errors
     }
   };
 }
-class le {
-  constructor(e, s, t = {}, o) {
+class he {
+  constructor(e, t, s = {}, r, i, n) {
     d(this, "options");
     d(this, "defaultManager");
     d(this, "createBundle");
+    d(this, "sessionContextResolver");
+    d(this, "baseContext");
     d(this, "app", null);
     d(this, "configSchema");
     // Per-client server bundles and per-client session transports
-    d(this, "clientCache", new V({
-      onEvict: (e, s) => {
-        this.cleanupBundle(s);
+    d(this, "clientCache", new F({
+      onEvict: (e, t) => {
+        this.cleanupBundle(t);
       }
     }));
-    this.defaultManager = e, this.createBundle = s, this.options = {
-      host: t.host ?? "0.0.0.0",
-      port: t.port ?? 3e3,
-      basePath: t.basePath ?? "/",
-      cors: t.cors ?? !0,
-      logger: t.logger ?? !1,
-      app: t.app,
-      customEndpoints: t.customEndpoints
-    }, this.configSchema = o;
+    this.defaultManager = e, this.createBundle = t, this.sessionContextResolver = i, this.baseContext = n, this.options = {
+      host: s.host ?? "0.0.0.0",
+      port: s.port ?? 3e3,
+      basePath: s.basePath ?? "/",
+      cors: s.cors ?? !0,
+      logger: s.logger ?? !1,
+      app: s.app,
+      customEndpoints: s.customEndpoints
+    }, this.configSchema = r;
   }
   async start() {
     if (this.app) return;
-    const e = this.options.app ?? j({ logger: this.options.logger });
-    this.options.cors && await e.register(k, { origin: !0 });
-    const s = this.options.basePath.endsWith("/") ? this.options.basePath.slice(0, -1) : this.options.basePath;
-    e.get(`${s}/healthz`, async () => ({ ok: !0 })), e.get(`${s}/tools`, async () => this.defaultManager.getStatus()), e.get(`${s}/.well-known/mcp-config`, async (t, o) => (o.header("Content-Type", "application/schema+json; charset=utf-8"), this.configSchema ?? {
+    const e = this.options.app ?? N({ logger: this.options.logger });
+    this.options.cors && await e.register(D, { origin: !0 });
+    const t = this.options.basePath.endsWith("/") ? this.options.basePath.slice(0, -1) : this.options.basePath;
+    e.get(`${t}/healthz`, async () => ({ ok: !0 })), e.get(`${t}/tools`, async () => this.defaultManager.getStatus()), e.get(`${t}/.well-known/mcp-config`, async (s, r) => (r.header("Content-Type", "application/schema+json; charset=utf-8"), this.configSchema ?? {
       $schema: "https://json-schema.org/draft/2020-12/schema",
       title: "MCP Session Configuration",
       description: "Schema for the /mcp endpoint configuration",
@@ -834,72 +846,75 @@ class le {
       "x-mcp-version": "1.0",
       "x-query-style": "dot+bracket"
     })), e.post(
-      `${s}/mcp`,
-      async (t, o) => {
-        const i = t.headers["mcp-client-id"]?.trim(), n = i && i.length > 0 ? i : `anon-${T()}`, l = !n.startsWith("anon-");
-        let a = l ? this.clientCache.get(n) : null;
-        if (!a) {
-          const f = this.createBundle(), v = f.sessions;
-          a = {
-            server: f.server,
-            orchestrator: f.orchestrator,
-            sessions: v instanceof Map ? v : /* @__PURE__ */ new Map()
-          }, l && this.clientCache.set(n, a);
+      `${t}/mcp`,
+      async (s, r) => {
+        const i = s.headers["mcp-client-id"]?.trim(), n = i && i.length > 0 ? i : `anon-${S()}`, l = !n.startsWith("anon-"), { cacheKey: c, mergedContext: a } = this.resolveSessionContext(
+          s,
+          n
+        );
+        let u = l ? this.clientCache.get(c) : null;
+        if (!u) {
+          const w = this.createBundle(a);
+          u = {
+            server: w.server,
+            orchestrator: w.orchestrator,
+            sessions: /* @__PURE__ */ new Map()
+          }, l && this.clientCache.set(c, u);
         }
-        const c = t.headers["mcp-session-id"];
-        let u;
-        if (c && a.sessions.get(c))
-          u = a.sessions.get(c);
-        else if (!c && D(t.body)) {
-          const f = T();
-          u = new O({
-            sessionIdGenerator: () => f,
-            onsessioninitialized: (v) => {
-              a.sessions.set(v, u);
+        const h = s.headers["mcp-session-id"];
+        let g;
+        if (h && u.sessions.get(h))
+          g = u.sessions.get(h);
+        else if (!h && _(s.body)) {
+          const w = S();
+          g = new z({
+            sessionIdGenerator: () => w,
+            onsessioninitialized: (T) => {
+              u.sessions.set(T, g);
             }
           });
           try {
-            await a.server.connect(u);
+            await u.server.connect(g);
           } catch {
-            return o.code(500), {
+            return r.code(500), {
               jsonrpc: "2.0",
               error: { code: -32603, message: "Error initializing server." },
               id: null
             };
           }
-          u.onclose = () => {
-            u?.sessionId && a.sessions.delete(u.sessionId);
+          g.onclose = () => {
+            g?.sessionId && u.sessions.delete(g.sessionId);
           };
         } else
-          return o.code(400), {
+          return r.code(400), {
             jsonrpc: "2.0",
             error: { code: -32e3, message: "Session not found or expired" },
             id: null
           };
-        return await u.handleRequest(
-          t.raw,
-          o.raw,
-          t.body
-        ), o;
+        return await g.handleRequest(
+          s.raw,
+          r.raw,
+          s.body
+        ), r;
       }
-    ), e.get(`${s}/mcp`, async (t, o) => {
-      const i = t.headers["mcp-client-id"]?.trim(), n = i && i.length > 0 ? i : "";
+    ), e.get(`${t}/mcp`, async (s, r) => {
+      const i = s.headers["mcp-client-id"]?.trim(), n = i && i.length > 0 ? i : "";
       if (!n)
-        return o.code(400), "Missing mcp-client-id";
+        return r.code(400), "Missing mcp-client-id";
       const l = this.clientCache.get(n);
       if (!l)
-        return o.code(400), "Invalid or expired client";
-      const a = t.headers["mcp-session-id"];
-      if (!a)
-        return o.code(400), "Missing mcp-session-id";
-      const c = l.sessions.get(a);
-      return c ? (await c.handleRequest(t.raw, o.raw), o) : (o.code(400), "Invalid or expired session ID");
+        return r.code(400), "Invalid or expired client";
+      const c = s.headers["mcp-session-id"];
+      if (!c)
+        return r.code(400), "Missing mcp-session-id";
+      const a = l.sessions.get(c);
+      return a ? (await a.handleRequest(s.raw, r.raw), r) : (r.code(400), "Invalid or expired session ID");
     }), e.delete(
-      `${s}/mcp`,
-      async (t, o) => {
-        const i = t.headers["mcp-client-id"]?.trim(), n = i && i.length > 0 ? i : "", l = t.headers["mcp-session-id"];
+      `${t}/mcp`,
+      async (s, r) => {
+        const i = s.headers["mcp-client-id"]?.trim(), n = i && i.length > 0 ? i : "", l = s.headers["mcp-session-id"];
         if (!n || !l)
-          return o.code(400), {
+          return r.code(400), {
             jsonrpc: "2.0",
             error: {
               code: -32600,
@@ -907,25 +922,25 @@ class le {
             },
             id: null
           };
-        const a = this.clientCache.get(n), c = a?.sessions.get(l);
-        if (!a || !c)
-          return o.code(404), {
+        const c = this.clientCache.get(n), a = c?.sessions.get(l);
+        if (!c || !a)
+          return r.code(404), {
             jsonrpc: "2.0",
             error: { code: -32e3, message: "Session not found or expired" },
             id: null
           };
         try {
-          if (typeof c.close == "function")
+          if (typeof a.close == "function")
             try {
-              await c.close();
+              await a.close();
             } catch {
             }
         } finally {
-          c?.sessionId ? a.sessions.delete(c.sessionId) : a.sessions.delete(l);
+          a?.sessionId ? c.sessions.delete(a.sessionId) : c.sessions.delete(l);
         }
-        return o.code(204).send(), o;
+        return r.code(204).send(), r;
       }
-    ), this.options.customEndpoints && this.options.customEndpoints.length > 0 && F(e, s, this.options.customEndpoints), this.options.app || await e.listen({ host: this.options.host, port: this.options.port }), this.app = e;
+    ), this.options.customEndpoints && this.options.customEndpoints.length > 0 && V(e, t, this.options.customEndpoints), this.options.app || await e.listen({ host: this.options.host, port: this.options.port }), this.app = e;
   }
   /**
    * Stops the Fastify server and cleans up all resources.
@@ -941,150 +956,399 @@ class le {
    * @private
    */
   cleanupBundle(e) {
-    for (const [s, t] of e.sessions.entries())
+    for (const [t, s] of e.sessions.entries())
       try {
-        typeof t.close == "function" && t.close().catch((o) => {
-          console.warn(`Error closing session ${s}:`, o);
+        typeof s.close == "function" && s.close().catch((r) => {
+          console.warn(`Error closing session ${t}:`, r);
         });
-      } catch (o) {
-        console.warn(`Error closing session ${s}:`, o);
+      } catch (r) {
+        console.warn(`Error closing session ${t}:`, r);
       }
     e.sessions.clear();
   }
+  /**
+   * Resolves the session context and generates a cache key for the request.
+   * If a session context resolver is configured, it extracts query parameters
+   * and merges session-specific context with the base context.
+   *
+   * @param req - The Fastify request
+   * @param clientId - The client identifier
+   * @returns Object with cache key and merged context
+   * @private
+   */
+  resolveSessionContext(e, t) {
+    if (!this.sessionContextResolver)
+      return {
+        cacheKey: t,
+        mergedContext: this.baseContext
+      };
+    const s = {
+      clientId: t,
+      headers: this.extractHeaders(e),
+      query: this.extractQuery(e)
+    }, r = this.sessionContextResolver.resolve(
+      s,
+      this.baseContext
+    );
+    return {
+      cacheKey: r.cacheKeySuffix === "default" ? t : `${t}:${r.cacheKeySuffix}`,
+      mergedContext: r.context
+    };
+  }
+  /**
+   * Extracts headers from a Fastify request as a Record.
+   * Normalizes header names to lowercase.
+   *
+   * @param req - The Fastify request
+   * @returns Headers as a string record
+   * @private
+   */
+  extractHeaders(e) {
+    const t = {};
+    for (const [s, r] of Object.entries(e.headers))
+      typeof r == "string" ? t[s.toLowerCase()] = r : Array.isArray(r) && r.length > 0 && (t[s.toLowerCase()] = r[0]);
+    return t;
+  }
+  /**
+   * Extracts query parameters from a Fastify request as a Record.
+   *
+   * @param req - The Fastify request
+   * @returns Query parameters as a string record
+   * @private
+   */
+  extractQuery(e) {
+    const t = {}, s = e.query;
+    if (s && typeof s == "object")
+      for (const [r, i] of Object.entries(s))
+        typeof i == "string" && (t[r] = i);
+    return t;
+  }
 }
-const ce = y.object({
-  mode: y.enum(["DYNAMIC", "STATIC"]).optional(),
-  toolsets: y.union([y.array(y.string()), y.literal("ALL")]).optional()
+class fe {
+  constructor(e) {
+    d(this, "config");
+    d(this, "queryParamName");
+    d(this, "encoding");
+    d(this, "allowedKeys");
+    d(this, "mergeStrategy");
+    this.config = e, this.queryParamName = e.queryParam?.name ?? "config", this.encoding = e.queryParam?.encoding ?? "base64", this.allowedKeys = e.queryParam?.allowedKeys ? new Set(e.queryParam.allowedKeys) : null, this.mergeStrategy = e.merge ?? "shallow";
+  }
+  /**
+   * Resolves the session context for a request.
+   *
+   * @param request - The request context (clientId, headers, query)
+   * @param baseContext - The base context from server configuration
+   * @returns The resolved context and cache key suffix
+   */
+  resolve(e, t) {
+    if (this.config.enabled === !1)
+      return {
+        context: t,
+        cacheKeySuffix: "default"
+      };
+    const s = this.parseQueryConfig(e.query);
+    if (this.config.contextResolver)
+      try {
+        return {
+          context: this.config.contextResolver(
+            e,
+            t,
+            s
+          ),
+          cacheKeySuffix: this.generateCacheKeySuffix(s)
+        };
+      } catch {
+        return {
+          context: t,
+          cacheKeySuffix: "default"
+        };
+      }
+    return {
+      context: this.mergeContexts(t, s),
+      cacheKeySuffix: this.generateCacheKeySuffix(s)
+    };
+  }
+  /**
+   * Parses the session config from query parameters.
+   * Returns empty object on parse failure (fail secure).
+   *
+   * @param query - Query parameters from the request
+   * @returns Parsed and filtered config object
+   * @private
+   */
+  parseQueryConfig(e) {
+    const t = e[this.queryParamName];
+    if (!t)
+      return {};
+    try {
+      let s;
+      this.encoding === "base64" ? s = Buffer.from(t, "base64").toString("utf-8") : s = t;
+      const r = JSON.parse(s);
+      return typeof r != "object" || r === null || Array.isArray(r) ? {} : this.filterAllowedKeys(r);
+    } catch {
+      return {};
+    }
+  }
+  /**
+   * Filters the parsed config to only include allowed keys.
+   * If no allowedKeys whitelist is configured, returns the full object.
+   *
+   * @param parsed - The parsed config object
+   * @returns Filtered config with only allowed keys
+   * @private
+   */
+  filterAllowedKeys(e) {
+    if (!this.allowedKeys)
+      return e;
+    const t = {};
+    for (const s of this.allowedKeys)
+      s in e && (t[s] = e[s]);
+    return t;
+  }
+  /**
+   * Merges the base context with the session config.
+   *
+   * @param baseContext - The base context from server configuration
+   * @param sessionConfig - The parsed session config
+   * @returns Merged context
+   * @private
+   */
+  mergeContexts(e, t) {
+    return Object.keys(t).length === 0 ? e : typeof e != "object" || e === null || Array.isArray(e) ? t : this.mergeStrategy === "deep" ? this.deepMerge(
+      e,
+      t
+    ) : {
+      ...e,
+      ...t
+    };
+  }
+  /**
+   * Performs a deep merge of two objects.
+   * Session config values override base context values.
+   *
+   * @param base - The base object
+   * @param override - The override object
+   * @returns Deep merged object
+   * @private
+   */
+  deepMerge(e, t) {
+    const s = { ...e };
+    for (const [r, i] of Object.entries(t)) {
+      const n = s[r];
+      typeof i == "object" && i !== null && !Array.isArray(i) && typeof n == "object" && n !== null && !Array.isArray(n) ? s[r] = this.deepMerge(
+        n,
+        i
+      ) : s[r] = i;
+    }
+    return s;
+  }
+  /**
+   * Generates a deterministic cache key suffix based on the session config.
+   * Returns 'default' when no session config is present.
+   *
+   * @param sessionConfig - The parsed session config
+   * @returns Hash string or 'default'
+   * @private
+   */
+  generateCacheKeySuffix(e) {
+    if (Object.keys(e).length === 0)
+      return "default";
+    const t = Object.keys(e).sort(), s = {};
+    for (const i of t)
+      s[i] = e[i];
+    const r = JSON.stringify(s);
+    return ae("sha256").update(r).digest("hex").slice(0, 16);
+  }
+}
+function K(o) {
+  me(o), ye(o), ge(o), pe(o), ve(o);
+}
+function me(o) {
+  if (!o || typeof o != "object")
+    throw new Error(
+      "Session context configuration must be an object"
+    );
+}
+function ye(o) {
+  if (o.enabled !== void 0 && typeof o.enabled != "boolean")
+    throw new Error(
+      `enabled must be a boolean, got ${typeof o.enabled}`
+    );
+}
+function ge(o) {
+  if (o.queryParam !== void 0) {
+    if (typeof o.queryParam != "object" || o.queryParam === null)
+      throw new Error("queryParam must be an object");
+    if (o.queryParam.name !== void 0 && (typeof o.queryParam.name != "string" || o.queryParam.name.length === 0))
+      throw new Error("queryParam.name must be a non-empty string");
+    if (o.queryParam.encoding !== void 0 && o.queryParam.encoding !== "base64" && o.queryParam.encoding !== "json")
+      throw new Error(
+        `Invalid queryParam.encoding: "${o.queryParam.encoding}". Must be "base64" or "json"`
+      );
+    if (o.queryParam.allowedKeys !== void 0) {
+      if (!Array.isArray(o.queryParam.allowedKeys))
+        throw new Error("queryParam.allowedKeys must be an array of strings");
+      for (let e = 0; e < o.queryParam.allowedKeys.length; e++) {
+        const t = o.queryParam.allowedKeys[e];
+        if (typeof t != "string" || t.length === 0)
+          throw new Error(
+            `queryParam.allowedKeys[${e}] must be a non-empty string`
+          );
+      }
+    }
+  }
+}
+function pe(o) {
+  if (o.contextResolver !== void 0 && typeof o.contextResolver != "function")
+    throw new Error(
+      "contextResolver must be a function: (request, baseContext, parsedQueryConfig?) => unknown"
+    );
+}
+function ve(o) {
+  if (o.merge !== void 0 && o.merge !== "shallow" && o.merge !== "deep")
+    throw new Error(
+      `Invalid merge strategy: "${o.merge}". Must be "shallow" or "deep"`
+    );
+}
+const we = v.object({
+  mode: v.enum(["DYNAMIC", "STATIC"]).optional(),
+  toolsets: v.union([v.array(v.string()), v.literal("ALL")]).optional()
 }).strict();
-async function Ie(r) {
-  if (r.startup)
+async function De(o) {
+  if (o.startup)
     try {
-      ce.parse(r.startup);
+      we.parse(o.startup);
     } catch (a) {
-      if (a instanceof y.ZodError) {
-        const c = a.format();
+      if (a instanceof v.ZodError) {
+        const u = a.format();
         throw new Error(
           `Invalid startup configuration:
-${JSON.stringify(c, null, 2)}
+${JSON.stringify(u, null, 2)}
 
 Hint: Common mistake - use "toolsets" not "initialToolsets"`
         );
       }
       throw a;
     }
-  const e = r.startup?.mode ?? "DYNAMIC";
-  if (typeof r.createServer != "function")
+  const e = o.startup?.mode ?? "DYNAMIC";
+  let t;
+  if (o.sessionContext && (K(o.sessionContext), t = new fe(o.sessionContext), e === "STATIC" && o.sessionContext.enabled !== !1 && console.warn(
+    "sessionContext has limited effect in STATIC mode: all clients share the same server instance with base context. Use DYNAMIC mode for per-session context isolation."
+  )), typeof o.createServer != "function")
     throw new Error("createMcpServer: `createServer` (factory) is required");
-  const s = r.createServer(), t = (a) => typeof a?.server?.notification == "function", o = (a) => typeof a?.notifyToolsListChanged == "function", i = async (a) => {
+  const s = o.createServer(), r = (a) => typeof a?.server?.notification == "function", i = (a) => typeof a?.notifyToolsListChanged == "function", n = async (a) => {
     try {
-      if (t(a)) {
+      if (r(a)) {
         await a.server.notification({
           method: "notifications/tools/list_changed"
         });
         return;
       }
-      o(a) && await a.notifyToolsListChanged();
-    } catch (c) {
-      if ((c instanceof Error ? c.message : String(c)) === "Not connected")
+      i(a) && await a.notifyToolsListChanged();
+    } catch (u) {
+      if ((u instanceof Error ? u.message : String(u)) === "Not connected")
         return;
-      console.warn("Failed to send tools list changed notification:", c);
+      console.warn("Failed to send tools list changed notification:", u);
     }
-  }, n = new A({
+  }, l = new C({
     server: s,
-    catalog: r.catalog,
-    moduleLoaders: r.moduleLoaders,
-    exposurePolicy: r.exposurePolicy,
-    context: r.context,
-    notifyToolsListChanged: async () => i(s),
-    startup: r.startup,
-    registerMetaTools: r.registerMetaTools !== void 0 ? r.registerMetaTools : e === "DYNAMIC"
+    catalog: o.catalog,
+    moduleLoaders: o.moduleLoaders,
+    exposurePolicy: o.exposurePolicy,
+    context: o.context,
+    notifyToolsListChanged: async () => n(s),
+    startup: o.startup,
+    registerMetaTools: o.registerMetaTools !== void 0 ? o.registerMetaTools : e === "DYNAMIC"
   });
-  e === "STATIC" && await n.ensureReady();
-  const l = new le(
-    n.getManager(),
-    () => {
+  e === "STATIC" && await l.ensureReady();
+  const c = new he(
+    l.getManager(),
+    (a) => {
+      const u = a ?? o.context;
       if (e === "STATIC")
-        return { server: s, orchestrator: n };
-      const a = r.createServer(), c = new A({
-        server: a,
-        catalog: r.catalog,
-        moduleLoaders: r.moduleLoaders,
-        exposurePolicy: r.exposurePolicy,
-        context: r.context,
-        notifyToolsListChanged: async () => i(a),
-        startup: r.startup,
-        registerMetaTools: r.registerMetaTools !== void 0 ? r.registerMetaTools : e === "DYNAMIC"
+        return { server: s, orchestrator: l };
+      const h = o.createServer(), g = new C({
+        server: h,
+        catalog: o.catalog,
+        moduleLoaders: o.moduleLoaders,
+        exposurePolicy: o.exposurePolicy,
+        context: u,
+        notifyToolsListChanged: async () => n(h),
+        startup: o.startup,
+        registerMetaTools: o.registerMetaTools !== void 0 ? o.registerMetaTools : e === "DYNAMIC"
       });
-      return { server: a, orchestrator: c };
+      return { server: h, orchestrator: g };
     },
-    r.http,
-    r.configSchema
+    o.http,
+    o.configSchema,
+    t,
+    o.context
   );
   return {
     server: s,
     start: async () => {
-      await l.start();
+      await c.start();
     },
     close: async () => {
-      await l.stop();
+      await c.stop();
     }
   };
 }
-function de(r) {
-  ue(r), he(r), fe(r), me(r);
+function Te(o) {
+  be(o), Se(o), xe(o), Ae(o);
 }
-function ue(r) {
-  if (!r || typeof r != "object")
+function be(o) {
+  if (!o || typeof o != "object")
     throw new Error(
       "Permission configuration is required for createPermissionBasedMcpServer"
     );
 }
-function he(r) {
-  if (!r.source)
+function Se(o) {
+  if (!o.source)
     throw new Error('Permission source must be either "headers" or "config"');
-  if (r.source !== "headers" && r.source !== "config")
+  if (o.source !== "headers" && o.source !== "config")
     throw new Error(
-      `Invalid permission source: "${r.source}". Must be either "headers" or "config"`
+      `Invalid permission source: "${o.source}". Must be either "headers" or "config"`
     );
 }
-function fe(r) {
-  if (r.source === "config" && !r.staticMap && !r.resolver)
+function xe(o) {
+  if (o.source === "config" && !o.staticMap && !o.resolver)
     throw new Error(
       "Config-based permissions require at least one of: staticMap or resolver function"
     );
 }
-function me(r) {
-  if (r.staticMap !== void 0) {
-    if (typeof r.staticMap != "object" || r.staticMap === null)
+function Ae(o) {
+  if (o.staticMap !== void 0) {
+    if (typeof o.staticMap != "object" || o.staticMap === null)
       throw new Error(
         "staticMap must be an object mapping client IDs to toolset arrays"
       );
-    ge(r.staticMap);
+    Ce(o.staticMap);
   }
-  if (r.resolver !== void 0 && typeof r.resolver != "function")
+  if (o.resolver !== void 0 && typeof o.resolver != "function")
     throw new Error(
       "resolver must be a synchronous function: (clientId: string) => string[]"
     );
-  if (r.defaultPermissions !== void 0 && !Array.isArray(r.defaultPermissions))
+  if (o.defaultPermissions !== void 0 && !Array.isArray(o.defaultPermissions))
     throw new Error("defaultPermissions must be an array of toolset names");
-  if (r.headerName !== void 0 && (typeof r.headerName != "string" || r.headerName.length === 0))
+  if (o.headerName !== void 0 && (typeof o.headerName != "string" || o.headerName.length === 0))
     throw new Error("headerName must be a non-empty string");
 }
-function ge(r) {
-  for (const [e, s] of Object.entries(r))
-    if (!Array.isArray(s))
+function Ce(o) {
+  for (const [e, t] of Object.entries(o))
+    if (!Array.isArray(t))
       throw new Error(
         `staticMap value for client "${e}" must be an array of toolset names`
       );
 }
-var p, _, H, B, Y, W;
-class pe {
+var p, H, B, Y, U, W;
+class Ee {
   /**
    * Creates a new PermissionResolver instance.
    * @param config - The permission configuration defining how permissions are resolved
    */
   constructor(e) {
-    b(this, p);
+    A(this, p);
     d(this, "cache", /* @__PURE__ */ new Map());
     d(this, "normalizedHeaderName");
     this.config = e, this.normalizedHeaderName = (e.headerName || "mcp-toolset-permissions").toLowerCase();
@@ -1102,23 +1366,23 @@ class pe {
    * @param headers - Optional request headers (required for header-based permissions)
    * @returns Array of toolset names the client is allowed to access
    */
-  resolvePermissions(e, s) {
+  resolvePermissions(e, t) {
     if (this.cache.has(e))
       return this.cache.get(e);
-    let t;
+    let s;
     try {
-      this.config.source === "headers" ? t = m(this, p, _).call(this, s) : t = m(this, p, B).call(this, e), Array.isArray(t) || (console.warn(
+      this.config.source === "headers" ? s = m(this, p, H).call(this, t) : s = m(this, p, Y).call(this, e), Array.isArray(s) || (console.warn(
         `Permission resolution returned non-array for client ${e}, using empty permissions`
-      ), t = []), t = t.filter(
-        (o) => typeof o == "string" && o.trim().length > 0
+      ), s = []), s = s.filter(
+        (r) => typeof r == "string" && r.trim().length > 0
       );
-    } catch (o) {
+    } catch (r) {
       console.error(
         `Unexpected error resolving permissions for client ${e}:`,
-        o
-      ), t = [];
+        r
+      ), s = [];
     }
-    return this.cache.set(e, t), t;
+    return this.cache.set(e, s), s;
   }
   /**
    * Invalidates cached permissions for a specific client.
@@ -1145,18 +1409,18 @@ p = new WeakSet(), /**
  * @returns Array of toolset names from headers, or empty array if header is missing/malformed
  * @private
  */
-_ = function(e) {
+H = function(e) {
   if (!e)
     return [];
-  const s = m(this, p, H).call(this, e, this.normalizedHeaderName);
-  if (!s)
+  const t = m(this, p, B).call(this, e, this.normalizedHeaderName);
+  if (!t)
     return [];
   try {
-    return s.split(",").map((t) => t.trim()).filter((t) => t.length > 0);
-  } catch (t) {
+    return t.split(",").map((s) => s.trim()).filter((s) => s.length > 0);
+  } catch (s) {
     return console.warn(
       `Failed to parse permission header '${this.normalizedHeaderName}':`,
-      t
+      s
     ), [];
   }
 }, /**
@@ -1167,12 +1431,12 @@ _ = function(e) {
  * @returns The header value if found, undefined otherwise
  * @private
  */
-H = function(e, s) {
-  if (e[s] !== void 0)
-    return e[s];
-  for (const [t, o] of Object.entries(e))
-    if (t.toLowerCase() === s)
-      return o;
+B = function(e, t) {
+  if (e[t] !== void 0)
+    return e[t];
+  for (const [s, r] of Object.entries(e))
+    if (s.toLowerCase() === t)
+      return r;
 }, /**
  * Resolves permissions from server-side configuration.
  * Tries resolver function first (if provided), then falls back to static map,
@@ -1181,16 +1445,16 @@ H = function(e, s) {
  * @returns Array of toolset names from configuration
  * @private
  */
-B = function(e) {
+Y = function(e) {
   if (this.config.resolver) {
-    const s = m(this, p, Y).call(this, e);
-    if (s !== null)
-      return s;
+    const t = m(this, p, U).call(this, e);
+    if (t !== null)
+      return t;
   }
   if (this.config.staticMap) {
-    const s = m(this, p, W).call(this, e);
-    if (s !== null)
-      return s;
+    const t = m(this, p, W).call(this, e);
+    if (t !== null)
+      return t;
   }
   return this.config.defaultPermissions || [];
 }, /**
@@ -1200,16 +1464,16 @@ B = function(e) {
  * @returns Array of toolset names if successful, null if resolver fails or returns invalid data
  * @private
  */
-Y = function(e) {
+U = function(e) {
   try {
-    const s = this.config.resolver(e);
-    return Array.isArray(s) ? s : (console.warn(
+    const t = this.config.resolver(e);
+    return Array.isArray(t) ? t : (console.warn(
       `Permission resolver returned non-array for client ${e}, using fallback`
     ), null);
-  } catch (s) {
-    const t = s instanceof Error ? s.message : String(s);
+  } catch (t) {
+    const s = t instanceof Error ? t.message : String(t);
     return console.warn(
-      `Permission resolver declined client ${e} (${t}), trying fallback`
+      `Permission resolver declined client ${e} (${s}), trying fallback`
     ), null;
   }
 }, /**
@@ -1220,36 +1484,36 @@ Y = function(e) {
  * @private
  */
 W = function(e) {
-  const s = this.config.staticMap[e];
-  return s !== void 0 ? Array.isArray(s) ? s : [] : null;
+  const t = this.config.staticMap[e];
+  return t !== void 0 ? Array.isArray(t) ? t : [] : null;
 };
-function ye(r, e) {
-  return async (s) => {
-    const t = e.resolvePermissions(
-      s.clientId,
-      s.headers
-    ), o = r(t), i = o.orchestrator.getManager(), n = [], l = [];
-    if (t.length > 0) {
-      const a = await i.enableToolsets(t);
-      for (const c of a.results)
-        c.success ? n.push(c.name) : (l.push(c.name), console.warn(
-          `Failed to enable toolset '${c.name}' for client '${s.clientId}': ${c.message}`
+function Pe(o, e) {
+  return async (t) => {
+    const s = e.resolvePermissions(
+      t.clientId,
+      t.headers
+    ), r = o(s), i = r.orchestrator.getManager(), n = [], l = [];
+    if (s.length > 0) {
+      const c = await i.enableToolsets(s);
+      for (const a of c.results)
+        a.success ? n.push(a.name) : (l.push(a.name), console.warn(
+          `Failed to enable toolset '${a.name}' for client '${t.clientId}': ${a.message}`
         ));
       if (n.length === 0 && l.length > 0)
         throw new Error(
-          `All requested toolsets failed to enable for client '${s.clientId}'. Requested: [${t.join(", ")}]. Check that toolset names in permissions match the catalog.`
+          `All requested toolsets failed to enable for client '${t.clientId}'. Requested: [${s.join(", ")}]. Check that toolset names in permissions match the catalog.`
         );
     }
     return {
-      server: o.server,
-      orchestrator: o.orchestrator,
+      server: r.server,
+      orchestrator: r.orchestrator,
       allowedToolsets: n,
       failedToolsets: l
     };
   };
 }
-var h, U, q, J, G, K, Z, Q, X, C, ee;
-class ve {
+var f, J, Q, G, Z, X, ee, te, se, M, oe;
+class Me {
   /**
    * Creates a new PermissionAwareFastifyTransport instance.
    * @param defaultManager - Default tool manager for status endpoints
@@ -1257,28 +1521,28 @@ class ve {
    * @param options - Transport configuration options
    * @param configSchema - Optional JSON schema for configuration discovery
    */
-  constructor(e, s, t = {}, o) {
-    b(this, h);
+  constructor(e, t, s = {}, r) {
+    A(this, f);
     d(this, "options");
     d(this, "defaultManager");
     d(this, "createPermissionAwareBundle");
     d(this, "app", null);
     d(this, "configSchema");
     // Per-client server bundles and per-client session transports
-    d(this, "clientCache", new V({
-      onEvict: (e, s) => {
-        m(this, h, U).call(this, s);
+    d(this, "clientCache", new F({
+      onEvict: (e, t) => {
+        m(this, f, J).call(this, t);
       }
     }));
-    this.defaultManager = e, this.createPermissionAwareBundle = s, this.options = {
-      host: t.host ?? "0.0.0.0",
-      port: t.port ?? 3e3,
-      basePath: t.basePath ?? "/",
-      cors: t.cors ?? !0,
-      logger: t.logger ?? !1,
-      app: t.app,
-      customEndpoints: t.customEndpoints
-    }, this.configSchema = o;
+    this.defaultManager = e, this.createPermissionAwareBundle = t, this.options = {
+      host: s.host ?? "0.0.0.0",
+      port: s.port ?? 3e3,
+      basePath: s.basePath ?? "/",
+      cors: s.cors ?? !0,
+      logger: s.logger ?? !1,
+      app: s.app,
+      customEndpoints: s.customEndpoints
+    }, this.configSchema = r;
   }
   /**
    * Starts the Fastify server and registers all MCP endpoints.
@@ -1286,14 +1550,14 @@ class ve {
    */
   async start() {
     if (this.app) return;
-    const e = this.options.app ?? j({ logger: this.options.logger });
-    this.options.cors && await e.register(k, { origin: !0 });
-    const s = m(this, h, q).call(this, this.options.basePath);
-    m(this, h, J).call(this, e, s), m(this, h, G).call(this, e, s), m(this, h, K).call(this, e, s), m(this, h, Z).call(this, e, s), m(this, h, Q).call(this, e, s), m(this, h, X).call(this, e, s), this.options.customEndpoints && this.options.customEndpoints.length > 0 && F(e, s, this.options.customEndpoints, {
-      contextExtractor: async (t) => {
-        const o = m(this, h, C).call(this, t);
+    const e = this.options.app ?? N({ logger: this.options.logger });
+    this.options.cors && await e.register(D, { origin: !0 });
+    const t = m(this, f, Q).call(this, this.options.basePath);
+    m(this, f, G).call(this, e, t), m(this, f, Z).call(this, e, t), m(this, f, X).call(this, e, t), m(this, f, ee).call(this, e, t), m(this, f, te).call(this, e, t), m(this, f, se).call(this, e, t), this.options.customEndpoints && this.options.customEndpoints.length > 0 && V(e, t, this.options.customEndpoints, {
+      contextExtractor: async (s) => {
+        const r = m(this, f, M).call(this, s);
         try {
-          const i = await this.createPermissionAwareBundle(o);
+          const i = await this.createPermissionAwareBundle(r);
           return {
             allowedToolsets: i.allowedToolsets,
             failedToolsets: i.failedToolsets
@@ -1317,20 +1581,20 @@ class ve {
     this.app && (this.clientCache.stop(!0), this.options.app || await this.app.close(), this.app = null);
   }
 }
-h = new WeakSet(), /**
+f = new WeakSet(), /**
  * Cleans up resources associated with a client bundle.
  * Closes all sessions within the bundle.
  * @param bundle - The client bundle to clean up
  * @private
  */
-U = function(e) {
-  for (const [s, t] of e.sessions.entries())
+J = function(e) {
+  for (const [t, s] of e.sessions.entries())
     try {
-      typeof t.close == "function" && t.close().catch((o) => {
-        console.warn(`Error closing session ${s}:`, o);
+      typeof s.close == "function" && s.close().catch((r) => {
+        console.warn(`Error closing session ${t}:`, r);
       });
-    } catch (o) {
-      console.warn(`Error closing session ${s}:`, o);
+    } catch (r) {
+      console.warn(`Error closing session ${t}:`, r);
     }
   e.sessions.clear();
 }, /**
@@ -1339,7 +1603,7 @@ U = function(e) {
  * @returns Normalized base path without trailing slash
  * @private
  */
-q = function(e) {
+Q = function(e) {
   return e.endsWith("/") ? e.slice(0, -1) : e;
 }, /**
  * Registers the health check endpoint.
@@ -1347,24 +1611,24 @@ q = function(e) {
  * @param base - Base path for routes
  * @private
  */
-J = function(e, s) {
-  e.get(`${s}/healthz`, async () => ({ ok: !0 }));
+G = function(e, t) {
+  e.get(`${t}/healthz`, async () => ({ ok: !0 }));
 }, /**
  * Registers the tools status endpoint.
  * @param app - Fastify instance
  * @param base - Base path for routes
  * @private
  */
-G = function(e, s) {
-  e.get(`${s}/tools`, async () => this.defaultManager.getStatus());
+Z = function(e, t) {
+  e.get(`${t}/tools`, async () => this.defaultManager.getStatus());
 }, /**
  * Registers the MCP configuration discovery endpoint.
  * @param app - Fastify instance
  * @param base - Base path for routes
  * @private
  */
-K = function(e, s) {
-  e.get(`${s}/.well-known/mcp-config`, async (t, o) => (o.header("Content-Type", "application/schema+json; charset=utf-8"), this.configSchema ?? {
+X = function(e, t) {
+  e.get(`${t}/.well-known/mcp-config`, async (s, r) => (r.header("Content-Type", "application/schema+json; charset=utf-8"), this.configSchema ?? {
     $schema: "https://json-schema.org/draft/2020-12/schema",
     title: "MCP Session Configuration",
     description: "Schema for the /mcp endpoint configuration",
@@ -1381,11 +1645,11 @@ K = function(e, s) {
  * @param base - Base path for routes
  * @private
  */
-Z = function(e, s) {
+ee = function(e, t) {
   e.post(
-    `${s}/mcp`,
-    async (t, o) => {
-      const i = m(this, h, C).call(this, t), n = !i.clientId.startsWith("anon-");
+    `${t}/mcp`,
+    async (s, r) => {
+      const i = m(this, f, M).call(this, s), n = !i.clientId.startsWith("anon-");
       let l = n ? this.clientCache.get(i.clientId) : null;
       if (!l)
         try {
@@ -1393,55 +1657,55 @@ Z = function(e, s) {
           u.failedToolsets.length > 0 && console.warn(
             `Client ${i.clientId} had ${u.failedToolsets.length} toolsets fail to enable: [${u.failedToolsets.join(", ")}]. Successfully enabled: [${u.allowedToolsets.join(", ")}]`
           );
-          const f = u.sessions;
+          const h = u.sessions;
           l = {
             server: u.server,
             orchestrator: u.orchestrator,
             allowedToolsets: u.allowedToolsets,
             failedToolsets: u.failedToolsets,
-            sessions: f instanceof Map ? f : /* @__PURE__ */ new Map()
+            sessions: h instanceof Map ? h : /* @__PURE__ */ new Map()
           }, n && this.clientCache.set(i.clientId, l);
         } catch (u) {
           return console.error(
             `Failed to create permission-aware bundle for client ${i.clientId}:`,
             u
-          ), o.code(403), m(this, h, ee).call(this, "Access denied");
+          ), r.code(403), m(this, f, oe).call(this, "Access denied");
         }
-      const a = t.headers["mcp-session-id"];
-      let c;
-      if (a && l.sessions.get(a))
-        c = l.sessions.get(a);
-      else if (!a && D(t.body)) {
-        const u = T();
-        c = new O({
+      const c = s.headers["mcp-session-id"];
+      let a;
+      if (c && l.sessions.get(c))
+        a = l.sessions.get(c);
+      else if (!c && _(s.body)) {
+        const u = S();
+        a = new z({
           sessionIdGenerator: () => u,
-          onsessioninitialized: (f) => {
-            l.sessions.set(f, c);
+          onsessioninitialized: (h) => {
+            l.sessions.set(h, a);
           }
         });
         try {
-          await l.server.connect(c);
+          await l.server.connect(a);
         } catch {
-          return o.code(500), {
+          return r.code(500), {
             jsonrpc: "2.0",
             error: { code: -32603, message: "Error initializing server." },
             id: null
           };
         }
-        c.onclose = () => {
-          c?.sessionId && l.sessions.delete(c.sessionId);
+        a.onclose = () => {
+          a?.sessionId && l.sessions.delete(a.sessionId);
         };
       } else
-        return o.code(400), {
+        return r.code(400), {
           jsonrpc: "2.0",
           error: { code: -32e3, message: "Session not found or expired" },
           id: null
         };
-      return await c.handleRequest(
-        t.raw,
-        o.raw,
-        t.body
-      ), o;
+      return await a.handleRequest(
+        s.raw,
+        r.raw,
+        s.body
+      ), r;
     }
   );
 }, /**
@@ -1450,19 +1714,19 @@ Z = function(e, s) {
  * @param base - Base path for routes
  * @private
  */
-Q = function(e, s) {
-  e.get(`${s}/mcp`, async (t, o) => {
-    const i = t.headers["mcp-client-id"]?.trim(), n = i && i.length > 0 ? i : "";
+te = function(e, t) {
+  e.get(`${t}/mcp`, async (s, r) => {
+    const i = s.headers["mcp-client-id"]?.trim(), n = i && i.length > 0 ? i : "";
     if (!n)
-      return o.code(400), "Missing mcp-client-id";
+      return r.code(400), "Missing mcp-client-id";
     const l = this.clientCache.get(n);
     if (!l)
-      return o.code(400), "Invalid or expired client";
-    const a = t.headers["mcp-session-id"];
-    if (!a)
-      return o.code(400), "Missing mcp-session-id";
-    const c = l.sessions.get(a);
-    return c ? (await c.handleRequest(t.raw, o.raw), o) : (o.code(400), "Invalid or expired session ID");
+      return r.code(400), "Invalid or expired client";
+    const c = s.headers["mcp-session-id"];
+    if (!c)
+      return r.code(400), "Missing mcp-session-id";
+    const a = l.sessions.get(c);
+    return a ? (await a.handleRequest(s.raw, r.raw), r) : (r.code(400), "Invalid or expired session ID");
   });
 }, /**
  * Registers the DELETE /mcp endpoint for session termination.
@@ -1470,13 +1734,13 @@ Q = function(e, s) {
  * @param base - Base path for routes
  * @private
  */
-X = function(e, s) {
+se = function(e, t) {
   e.delete(
-    `${s}/mcp`,
-    async (t, o) => {
-      const i = t.headers["mcp-client-id"]?.trim(), n = i && i.length > 0 ? i : "", l = t.headers["mcp-session-id"];
+    `${t}/mcp`,
+    async (s, r) => {
+      const i = s.headers["mcp-client-id"]?.trim(), n = i && i.length > 0 ? i : "", l = s.headers["mcp-session-id"];
       if (!n || !l)
-        return o.code(400), {
+        return r.code(400), {
           jsonrpc: "2.0",
           error: {
             code: -32600,
@@ -1484,23 +1748,23 @@ X = function(e, s) {
           },
           id: null
         };
-      const a = this.clientCache.get(n), c = a?.sessions.get(l);
-      if (!a || !c)
-        return o.code(404), {
+      const c = this.clientCache.get(n), a = c?.sessions.get(l);
+      if (!c || !a)
+        return r.code(404), {
           jsonrpc: "2.0",
           error: { code: -32e3, message: "Session not found or expired" },
           id: null
         };
       try {
-        if (typeof c.close == "function")
+        if (typeof a.close == "function")
           try {
-            await c.close();
+            await a.close();
           } catch {
           }
       } finally {
-        c?.sessionId ? a.sessions.delete(c.sessionId) : a.sessions.delete(l);
+        a?.sessionId ? c.sessions.delete(a.sessionId) : c.sessions.delete(l);
       }
-      return o.code(204).send(), o;
+      return r.code(204).send(), r;
     }
   );
 }, /**
@@ -1510,11 +1774,11 @@ X = function(e, s) {
  * @returns Client request context with ID and headers
  * @private
  */
-C = function(e) {
-  const s = e.headers["mcp-client-id"]?.trim(), t = s && s.length > 0 ? s : `anon-${T()}`, o = {};
+M = function(e) {
+  const t = e.headers["mcp-client-id"]?.trim(), s = t && t.length > 0 ? t : `anon-${S()}`, r = {};
   for (const [i, n] of Object.entries(e.headers))
-    typeof n == "string" && (o[i] = n);
-  return { clientId: t, headers: o };
+    typeof n == "string" && (r[i] = n);
+  return { clientId: s, headers: r };
 }, /**
  * Creates a safe error response that doesn't expose unauthorized toolset information.
  * Used for permission-related errors to prevent information leakage.
@@ -1523,64 +1787,66 @@ C = function(e) {
  * @returns JSON-RPC error response object
  * @private
  */
-ee = function(e = "Access denied", s = -32e3) {
+oe = function(e = "Access denied", t = -32e3) {
   return {
     jsonrpc: "2.0",
     error: {
-      code: s,
+      code: t,
       message: e
     },
     id: null
   };
 };
-function Te(r) {
-  if (!r) return;
+function Ie(o) {
+  if (!o) return;
   const e = {
-    namespaceToolsWithSetKey: r.namespaceToolsWithSetKey
+    namespaceToolsWithSetKey: o.namespaceToolsWithSetKey
   };
-  return r.allowlist !== void 0 && console.warn(
+  return o.allowlist !== void 0 && console.warn(
     "Permission-based servers: exposurePolicy.allowlist is ignored. Allowed toolsets are determined by client permissions."
-  ), r.denylist !== void 0 && console.warn(
+  ), o.denylist !== void 0 && console.warn(
     "Permission-based servers: exposurePolicy.denylist is ignored. Use permission configuration to control toolset access."
-  ), r.maxActiveToolsets !== void 0 && console.warn(
+  ), o.maxActiveToolsets !== void 0 && console.warn(
     "Permission-based servers: exposurePolicy.maxActiveToolsets is ignored. Toolset count is determined by client permissions."
-  ), r.onLimitExceeded !== void 0 && console.warn(
+  ), o.onLimitExceeded !== void 0 && console.warn(
     "Permission-based servers: exposurePolicy.onLimitExceeded is ignored. No toolset limits are enforced."
   ), e;
 }
-async function Me(r) {
-  if (!r.permissions)
+async function ze(o) {
+  if (!o.permissions)
     throw new Error(
       "Permission configuration is required for createPermissionBasedMcpServer. Please provide a 'permissions' field in the options."
     );
-  if (de(r.permissions), r.startup)
+  if (Te(o.permissions), o.sessionContext && (K(o.sessionContext), console.warn(
+    "Session context support for permission-based servers is limited. The base context will be used for module loaders."
+  )), o.startup)
     throw new Error(
       "Permission-based servers determine toolsets from client permissions. The 'startup' option is not allowed. Remove it from your configuration."
     );
-  if (typeof r.createServer != "function")
+  if (typeof o.createServer != "function")
     throw new Error(
       "createPermissionBasedMcpServer: `createServer` (factory) is required"
     );
-  const e = Te(
-    r.exposurePolicy
-  ), s = new pe(r.permissions), t = r.createServer(), o = new A({
-    server: t,
-    catalog: r.catalog,
-    moduleLoaders: r.moduleLoaders,
+  const e = Ie(
+    o.exposurePolicy
+  ), t = new Ee(o.permissions), s = o.createServer(), r = new C({
+    server: s,
+    catalog: o.catalog,
+    moduleLoaders: o.moduleLoaders,
     exposurePolicy: e,
-    context: r.context,
+    context: o.context,
     notifyToolsListChanged: void 0,
     // No notifications in STATIC mode
     startup: { mode: "STATIC", toolsets: [] },
     registerMetaTools: !1
-  }), i = ye(
+  }), i = Pe(
     (l) => {
-      const a = r.createServer(), c = new A({
-        server: a,
-        catalog: r.catalog,
-        moduleLoaders: r.moduleLoaders,
+      const c = o.createServer(), a = new C({
+        server: c,
+        catalog: o.catalog,
+        moduleLoaders: o.moduleLoaders,
         exposurePolicy: e,
-        context: r.context,
+        context: o.context,
         notifyToolsListChanged: void 0,
         // No notifications in STATIC mode
         startup: { mode: "STATIC", toolsets: [] },
@@ -1588,17 +1854,17 @@ async function Me(r) {
         registerMetaTools: !1
         // No meta-tools - toolsets are fixed per client
       });
-      return { server: a, orchestrator: c };
+      return { server: c, orchestrator: a };
     },
-    s
-  ), n = new ve(
-    o.getManager(),
+    t
+  ), n = new Me(
+    r.getManager(),
     i,
-    r.http,
-    r.configSchema
+    o.http,
+    o.configSchema
   );
   return {
-    server: t,
+    server: s,
     start: async () => {
       await n.start();
     },
@@ -1606,21 +1872,22 @@ async function Me(r) {
       try {
         await n.stop();
       } finally {
-        s.clearCache();
+        t.clearCache();
       }
     }
   };
 }
-function Pe(r) {
-  return r;
+function _e(o) {
+  return o;
 }
-function $e(r) {
-  return r;
+function qe(o) {
+  return o;
 }
 export {
-  Ie as createMcpServer,
-  Me as createPermissionBasedMcpServer,
-  Pe as defineEndpoint,
-  $e as definePermissionAwareEndpoint
+  fe as SessionContextResolver,
+  De as createMcpServer,
+  ze as createPermissionBasedMcpServer,
+  _e as defineEndpoint,
+  qe as definePermissionAwareEndpoint
 };
 //# sourceMappingURL=index.js.map