toolception 0.6.0 → 0.6.1

package/dist/index.js

@@ -1,17 +1,17 @@
-var se = Object.defineProperty;
-var L = (o) => {
+var re = Object.defineProperty;
+var j = (o) => {
   throw TypeError(o);
 };
-var oe = (o, e, t) => e in o ? se(o, e, { enumerable: !0, configurable: !0, writable: !0, value: t }) : o[e] = t;
-var d = (o, e, t) => oe(o, typeof e != "symbol" ? e + "" : e, t), re = (o, e, t) => e.has(o) || L("Cannot " + t);
-var S = (o, e, t) => e.has(o) ? L("Cannot add the same private member more than once") : e instanceof WeakSet ? e.add(o) : e.set(o, t);
-var m = (o, e, t) => (re(o, e, "access private method"), t);
+var ie = (o, e, t) => e in o ? re(o, e, { enumerable: !0, configurable: !0, writable: !0, value: t }) : o[e] = t;
+var d = (o, e, t) => ie(o, typeof e != "symbol" ? e + "" : e, t), ne = (o, e, t) => e.has(o) || j("Cannot " + t);
+var A = (o, e, t) => e.has(o) ? j("Cannot add the same private member more than once") : e instanceof WeakSet ? e.add(o) : e.set(o, t);
+var m = (o, e, t) => (ne(o, e, "access private method"), t);
 import { z as v } from "zod";
 import N from "fastify";
-import k from "@fastify/cors";
-import { randomUUID as b, createHash as ie } from "node:crypto";
-import { StreamableHTTPServerTransport as O } from "@modelcontextprotocol/sdk/server/streamableHttp.js";
-import { isInitializeRequest as D } from "@modelcontextprotocol/sdk/types.js";
+import D from "@fastify/cors";
+import { randomUUID as S, createHash as ae } from "node:crypto";
+import { StreamableHTTPServerTransport as z } from "@modelcontextprotocol/sdk/server/streamableHttp.js";
+import { isInitializeRequest as _ } from "@modelcontextprotocol/sdk/types.js";
 const R = {
   dynamic: [
     "dynamic-tool-discovery",
@@ -20,7 +20,7 @@ const R = {
   ],
   toolsets: ["tool-sets", "toolSets", "FMP_TOOL_SETS"]
 };
-class ne {
+class le {
   constructor(e = {}) {
     d(this, "keys");
     this.keys = {
@@ -112,10 +112,16 @@ class ne {
       }
   }
 }
-class ae {
+const k = ["_meta"];
+class ce {
   constructor(e) {
     d(this, "catalog");
     d(this, "moduleLoaders");
+    for (const t of k)
+      if (t in e.catalog)
+        throw new Error(
+          `Toolset key '${t}' is reserved for internal use and cannot be used in the catalog`
+        );
     this.catalog = e.catalog, this.moduleLoaders = e.moduleLoaders ?? {};
   }
   getAvailableToolsets() {
@@ -138,6 +144,9 @@ class ae {
       error: `Empty toolset name provided. Available toolsets: ${this.getAvailableToolsets().join(
         ", "
       )}`
+    } : k.includes(t) ? {
+      isValid: !1,
+      error: `Toolset key '${t}' is reserved for internal use`
     } : this.catalog[t] ? { isValid: !0, sanitized: t } : {
       isValid: !1,
       error: `Toolset '${t}' not found. Available toolsets: ${this.getAvailableToolsets().join(
@@ -151,10 +160,10 @@ class ae {
       const i = this.catalog[r];
       if (i && (Array.isArray(i.tools) && i.tools.length > 0 && s.push(...i.tools), Array.isArray(i.modules) && i.modules.length > 0))
         for (const n of i.modules) {
-          const a = this.moduleLoaders[n];
-          if (a)
+          const l = this.moduleLoaders[n];
+          if (l)
             try {
-              const c = await a(t);
+              const c = await l(t);
               Array.isArray(c) && c.length > 0 && s.push(...c);
             } catch (c) {
               console.warn(
@@ -167,7 +176,7 @@ class ae {
     return s;
   }
 }
-class j extends Error {
+class O extends Error {
   constructor(t, s, r, i) {
     super(t);
     d(this, "code");
@@ -175,7 +184,7 @@ class j extends Error {
     this.name = "ToolingError", this.code = s, this.details = r;
   }
 }
-class z {
+class q {
   constructor(e = {}) {
     d(this, "options");
     d(this, "names", /* @__PURE__ */ new Set());
@@ -192,7 +201,7 @@ class z {
   }
   add(e) {
     if (this.names.has(e))
-      throw new j(
+      throw new O(
         `Tool name collision: '${e}' already registered`,
         "E_TOOL_NAME_CONFLICT"
       );
@@ -207,7 +216,7 @@ class z {
     return t.map((s) => {
       const r = this.getSafeName(e, s.name);
       if (this.has(r))
-        throw new j(
+        throw new O(
           `Tool name collision for '${r}'`,
           "E_TOOL_NAME_CONFLICT"
         );
@@ -224,7 +233,7 @@ class z {
     return e;
   }
 }
-class le {
+class de {
   constructor(e) {
     d(this, "server");
     d(this, "resolver");
@@ -233,7 +242,7 @@ class le {
     d(this, "exposurePolicy");
     d(this, "toolRegistry");
     d(this, "activeToolsets", /* @__PURE__ */ new Set());
-    this.server = e.server, this.resolver = e.resolver, this.context = e.context, this.onToolsListChanged = e.onToolsListChanged, this.exposurePolicy = e.exposurePolicy, this.toolRegistry = e.toolRegistry ?? new z({ namespaceWithToolset: !0 });
+    this.server = e.server, this.resolver = e.resolver, this.context = e.context, this.onToolsListChanged = e.onToolsListChanged, this.exposurePolicy = e.exposurePolicy, this.toolRegistry = e.toolRegistry ?? new q({ namespaceWithToolset: !0 });
   }
   /**
    * Sends a tool list change notification if configured.
@@ -286,28 +295,28 @@ class le {
       return { success: !1, message: i.message };
     const n = [];
     try {
-      const a = await this.resolver.resolveToolsForToolsets(
+      const l = await this.resolver.resolveToolsForToolsets(
         [r],
         this.context
       );
-      if (a && a.length > 0) {
+      if (l && l.length > 0) {
         const c = this.toolRegistry.mapAndValidate(
           r,
-          a
+          l
         );
-        for (const l of c)
-          this.registerSingleTool(l, r), n.push(l.name);
+        for (const a of c)
+          this.registerSingleTool(a, r), n.push(a.name);
       }
       return this.activeToolsets.add(r), t || await this.notifyToolsChanged(), {
         success: !0,
-        message: `Toolset '${r}' enabled successfully. Registered ${a?.length ?? 0} tools.`
+        message: `Toolset '${r}' enabled successfully. Registered ${l?.length ?? 0} tools.`
       };
-    } catch (a) {
+    } catch (l) {
       return n.length > 0 && console.warn(
         `Partial failure enabling toolset '${r}'. ${n.length} tools were registered but toolset activation failed. Tools remain registered due to MCP limitations: ${n.join(", ")}`
       ), {
         success: !1,
-        message: `Failed to enable toolset '${r}': ${a instanceof Error ? a.message : "Unknown error"}`
+        message: `Failed to enable toolset '${r}': ${l instanceof Error ? l.message : "Unknown error"}`
       };
     }
   }
@@ -397,13 +406,13 @@ class le {
     const t = [];
     for (const n of e)
       try {
-        const a = await this.enableToolset(n, !0);
-        t.push({ name: n, ...a });
-      } catch (a) {
+        const l = await this.enableToolset(n, !0);
+        t.push({ name: n, ...l });
+      } catch (l) {
         t.push({
           name: n,
           success: !1,
-          message: a instanceof Error ? a.message : "Unknown error",
+          message: l instanceof Error ? l.message : "Unknown error",
           code: "E_INTERNAL"
         });
       }
@@ -419,103 +428,104 @@ class le {
     return this.enableToolsets(e);
   }
 }
-function ce(o, e, t) {
-  (t?.mode ?? "DYNAMIC") === "DYNAMIC" && (o.tool(
+const b = "_meta";
+function ue(o, e, t, s) {
+  (s?.mode ?? "DYNAMIC") === "DYNAMIC" && (t.addForToolset(b, "enable_toolset"), o.tool(
     "enable_toolset",
     "Enable a toolset by name",
     { name: v.string().describe("Toolset name") },
     { destructiveHint: !0, idempotentHint: !0 },
-    async (r) => {
-      const i = await e.enableToolset(r.name);
+    async (i) => {
+      const n = await e.enableToolset(i.name);
       return {
-        content: [{ type: "text", text: JSON.stringify(i) }]
+        content: [{ type: "text", text: JSON.stringify(n) }]
       };
     }
-  ), o.tool(
+  ), t.addForToolset(b, "disable_toolset"), o.tool(
     "disable_toolset",
     "Disable a toolset by name (state only)",
     { name: v.string().describe("Toolset name") },
     { destructiveHint: !0, idempotentHint: !0 },
-    async (r) => {
-      const i = await e.disableToolset(r.name);
+    async (i) => {
+      const n = await e.disableToolset(i.name);
       return {
-        content: [{ type: "text", text: JSON.stringify(i) }]
+        content: [{ type: "text", text: JSON.stringify(n) }]
       };
     }
-  ), o.tool(
+  ), t.addForToolset(b, "list_toolsets"), o.tool(
     "list_toolsets",
     "List available toolsets with active status and definitions",
     {},
     { readOnlyHint: !0, idempotentHint: !0 },
     async () => {
-      const r = e.getAvailableToolsets(), i = e.getStatus().toolsetToTools, n = r.map((a) => {
-        const c = e.getToolsetDefinition(a);
+      const i = e.getAvailableToolsets(), n = e.getStatus().toolsetToTools, l = i.map((c) => {
+        const a = e.getToolsetDefinition(c);
         return {
-          key: a,
-          active: e.isActive(a),
-          definition: c ? {
-            name: c.name,
-            description: c.description,
-            modules: c.modules ?? [],
-            decisionCriteria: c.decisionCriteria ?? void 0
+          key: c,
+          active: e.isActive(c),
+          definition: a ? {
+            name: a.name,
+            description: a.description,
+            modules: a.modules ?? [],
+            decisionCriteria: a.decisionCriteria ?? void 0
           } : null,
-          tools: i[a] ?? []
+          tools: n[c] ?? []
         };
       });
       return {
         content: [
-          { type: "text", text: JSON.stringify({ toolsets: n }) }
+          { type: "text", text: JSON.stringify({ toolsets: l }) }
         ]
       };
     }
-  ), o.tool(
+  ), t.addForToolset(b, "describe_toolset"), o.tool(
     "describe_toolset",
     "Describe a toolset with definition, active status and tools",
     { name: v.string().describe("Toolset name") },
     { readOnlyHint: !0, idempotentHint: !0 },
-    async (r) => {
-      const i = e.getToolsetDefinition(r.name), n = e.getStatus().toolsetToTools;
-      if (!i)
+    async (i) => {
+      const n = e.getToolsetDefinition(i.name), l = e.getStatus().toolsetToTools;
+      if (!n)
         return {
           content: [
             {
               type: "text",
-              text: JSON.stringify({ error: `Unknown toolset '${r.name}'` })
+              text: JSON.stringify({ error: `Unknown toolset '${i.name}'` })
             }
           ]
         };
-      const a = {
-        key: r.name,
-        active: e.isActive(r.name),
+      const c = {
+        key: i.name,
+        active: e.isActive(i.name),
         definition: {
-          name: i.name,
-          description: i.description,
-          modules: i.modules ?? [],
-          decisionCriteria: i.decisionCriteria ?? void 0
+          name: n.name,
+          description: n.description,
+          modules: n.modules ?? [],
+          decisionCriteria: n.decisionCriteria ?? void 0
         },
-        tools: n[r.name] ?? []
+        tools: l[i.name] ?? []
       };
       return {
-        content: [{ type: "text", text: JSON.stringify(a) }]
+        content: [{ type: "text", text: JSON.stringify(c) }]
       };
     }
-  )), o.tool(
+  )), t.addForToolset(b, "list_tools"), o.tool(
     "list_tools",
     "List currently registered tool names (best effort)",
     {},
     { readOnlyHint: !0, idempotentHint: !0 },
     async () => {
-      const r = e.getStatus(), i = {
-        tools: r.tools,
-        toolsetToTools: r.toolsetToTools
+      const i = e.getStatus(), n = {
+        tools: i.tools,
+        toolsetToTools: i.toolsetToTools
       };
       return {
-        content: [{ type: "text", text: JSON.stringify(i) }]
+        content: [{ type: "text", text: JSON.stringify(n) }]
       };
     }
   );
 }
-class A {
+class C {
   constructor(e) {
     d(this, "mode");
     d(this, "resolver");
@@ -523,23 +533,23 @@ class A {
     d(this, "toolsetValidator");
     d(this, "initPromise");
     d(this, "initError", null);
-    this.toolsetValidator = new ne();
+    this.toolsetValidator = new le();
     const t = e.startup ?? {}, s = this.resolveStartupConfig(t, e.catalog);
-    this.mode = s.mode, this.resolver = new ae({
+    this.mode = s.mode, this.resolver = new ce({
       catalog: e.catalog,
       moduleLoaders: e.moduleLoaders
     });
-    const r = new z({
+    const r = new q({
       namespaceWithToolset: e.exposurePolicy?.namespaceToolsWithSetKey ?? !0
     });
-    this.manager = new le({
+    this.manager = new de({
       server: e.server,
       resolver: this.resolver,
       context: e.context,
       onToolsListChanged: e.notifyToolsListChanged,
       exposurePolicy: e.exposurePolicy,
       toolRegistry: r
-    }), e.registerMetaTools !== !1 && ce(e.server, this.manager, { mode: this.mode });
+    }), e.registerMetaTools !== !1 && ue(e.server, this.manager, r, { mode: this.mode });
     const i = s.toolsets;
     this.initPromise = this.initializeToolsets(i);
   }
@@ -583,8 +593,8 @@ class A {
           return { mode: "STATIC", toolsets: "ALL" };
         const s = Array.isArray(e.toolsets) ? e.toolsets : [], r = [];
         for (const i of s) {
-          const { isValid: n, sanitized: a, error: c } = this.toolsetValidator.validateToolsetName(i, t);
-          n && a ? r.push(a) : c && console.warn(c);
+          const { isValid: n, sanitized: l, error: c } = this.toolsetValidator.validateToolsetName(i, t);
+          n && l ? r.push(l) : c && console.warn(c);
         }
         if (s.length > 0 && r.length === 0)
           throw new Error(
@@ -598,8 +608,8 @@ class A {
     if (Array.isArray(e.toolsets) && e.toolsets.length > 0) {
       const s = [];
       for (const r of e.toolsets) {
-        const { isValid: i, sanitized: n, error: a } = this.toolsetValidator.validateToolsetName(r, t);
-        i && n ? s.push(n) : a && console.warn(a);
+        const { isValid: i, sanitized: n, error: l } = this.toolsetValidator.validateToolsetName(r, t);
+        i && n ? s.push(n) : l && console.warn(l);
       }
       if (s.length === 0)
         throw new Error(
@@ -616,10 +626,10 @@ class A {
     return this.manager;
   }
 }
-var x, E;
-class q {
+var x, P;
+class F {
   constructor(e = {}) {
-    S(this, x);
+    A(this, x);
     d(this, "storage", /* @__PURE__ */ new Map());
     d(this, "maxSize");
     d(this, "ttlMs");
@@ -655,7 +665,7 @@ class q {
    */
   delete(e) {
     const t = this.storage.get(e);
-    t && (this.storage.delete(e), m(this, x, E).call(this, e, t.resource));
+    t && (this.storage.delete(e), m(this, x, P).call(this, e, t.resource));
   }
   /**
    * Stops the background pruning interval and optionally clears all entries.
@@ -672,7 +682,7 @@ class q {
     const e = Array.from(this.storage.entries());
     this.storage.clear();
     for (const [t, s] of e)
-      m(this, x, E).call(this, t, s.resource);
+      m(this, x, P).call(this, t, s.resource);
   }
   /**
    * Evicts the least recently used entry from the cache.
@@ -700,7 +710,7 @@ x = new WeakSet(), /**
  * @param resource - The resource being evicted
  * @private
  */
-E = function(e, t) {
+P = function(e, t) {
   if (this.onEvict)
     try {
       const s = this.onEvict(e, t);
@@ -716,7 +726,7 @@ function V(o, e, t, s) {
   for (const i of t) {
     const n = `${e}${i.path}`;
     if (r.some(
-      (l) => n.startsWith(`${e}${l}`)
+      (a) => n.startsWith(`${e}${a}`)
     )) {
       console.warn(
         `Custom endpoint ${i.method} ${i.path} conflicts with built-in MCP endpoint. Skipping registration.`
@@ -724,44 +734,44 @@ function V(o, e, t, s) {
       continue;
     }
     const c = i.method.toLowerCase();
-    o[c](n, async (l, u) => {
+    o[c](n, async (a, u) => {
       try {
-        const h = l.headers["mcp-client-id"]?.trim(), g = h && h.length > 0 ? h : `anon-${b()}`;
+        const h = a.headers["mcp-client-id"]?.trim(), g = h && h.length > 0 ? h : `anon-${S()}`;
         let w;
         if (i.bodySchema) {
-          const y = i.bodySchema.safeParse(l.body);
+          const y = i.bodySchema.safeParse(a.body);
           if (!y.success)
-            return C(u, "body", y.error);
+            return E(u, "body", y.error);
           w = y.data;
         }
         let T = {};
         if (i.querySchema) {
-          const y = i.querySchema.safeParse(l.query);
+          const y = i.querySchema.safeParse(a.query);
           if (!y.success)
-            return C(u, "query", y.error);
+            return E(u, "query", y.error);
           T = y.data;
         }
-        let M = {};
+        let I = {};
         if (i.paramsSchema) {
-          const y = i.paramsSchema.safeParse(l.params);
+          const y = i.paramsSchema.safeParse(a.params);
           if (!y.success)
-            return C(u, "params", y.error);
-          M = y.data;
+            return E(u, "params", y.error);
+          I = y.data;
         }
-        const I = {
+        const $ = {
           body: w,
           query: T,
-          params: M,
-          headers: l.headers,
+          params: I,
+          headers: a.headers,
           clientId: g
         };
         if (s?.contextExtractor) {
-          const y = await s.contextExtractor(l);
-          Object.assign(I, y);
+          const y = await s.contextExtractor(a);
+          Object.assign($, y);
         }
-        const $ = await i.handler(I);
+        const L = await i.handler($);
         if (i.responseSchema) {
-          const y = i.responseSchema.safeParse($);
+          const y = i.responseSchema.safeParse(L);
           return y.success ? y.data : (console.error(
             `Response validation failed for ${i.method} ${i.path}:`,
             y.error
@@ -772,7 +782,7 @@ function V(o, e, t, s) {
             }
           });
         }
-        return $;
+        return L;
       } catch (h) {
         return console.error(
           `Error in custom endpoint ${i.method} ${i.path}:`,
@@ -787,7 +797,7 @@ function V(o, e, t, s) {
     });
   }
 }
-function C(o, e, t) {
+function E(o, e, t) {
   return o.code(400), {
     error: {
       code: "VALIDATION_ERROR",
@@ -796,7 +806,7 @@ function C(o, e, t) {
     }
   };
 }
-class de {
+class he {
   constructor(e, t, s = {}, r, i, n) {
     d(this, "options");
     d(this, "defaultManager");
@@ -806,7 +816,7 @@ class de {
     d(this, "app", null);
     d(this, "configSchema");
     // Per-client server bundles and per-client session transports
-    d(this, "clientCache", new q({
+    d(this, "clientCache", new F({
       onEvict: (e, t) => {
         this.cleanupBundle(t);
       }
@@ -824,7 +834,7 @@ class de {
   async start() {
     if (this.app) return;
     const e = this.options.app ?? N({ logger: this.options.logger });
-    this.options.cors && await e.register(k, { origin: !0 });
+    this.options.cors && await e.register(D, { origin: !0 });
     const t = this.options.basePath.endsWith("/") ? this.options.basePath.slice(0, -1) : this.options.basePath;
     e.get(`${t}/healthz`, async () => ({ ok: !0 })), e.get(`${t}/tools`, async () => this.defaultManager.getStatus()), e.get(`${t}/.well-known/mcp-config`, async (s, r) => (r.header("Content-Type", "application/schema+json; charset=utf-8"), this.configSchema ?? {
       $schema: "https://json-schema.org/draft/2020-12/schema",
@@ -838,26 +848,26 @@ class de {
     })), e.post(
       `${t}/mcp`,
       async (s, r) => {
-        const i = s.headers["mcp-client-id"]?.trim(), n = i && i.length > 0 ? i : `anon-${b()}`, a = !n.startsWith("anon-"), { cacheKey: c, mergedContext: l } = this.resolveSessionContext(
+        const i = s.headers["mcp-client-id"]?.trim(), n = i && i.length > 0 ? i : `anon-${S()}`, l = !n.startsWith("anon-"), { cacheKey: c, mergedContext: a } = this.resolveSessionContext(
           s,
           n
         );
-        let u = a ? this.clientCache.get(c) : null;
+        let u = l ? this.clientCache.get(c) : null;
         if (!u) {
-          const w = this.createBundle(l);
+          const w = this.createBundle(a);
           u = {
             server: w.server,
             orchestrator: w.orchestrator,
             sessions: /* @__PURE__ */ new Map()
-          }, a && this.clientCache.set(c, u);
+          }, l && this.clientCache.set(c, u);
         }
         const h = s.headers["mcp-session-id"];
         let g;
         if (h && u.sessions.get(h))
           g = u.sessions.get(h);
-        else if (!h && D(s.body)) {
-          const w = b();
-          g = new O({
+        else if (!h && _(s.body)) {
+          const w = S();
+          g = new z({
             sessionIdGenerator: () => w,
             onsessioninitialized: (T) => {
               u.sessions.set(T, g);
@@ -891,19 +901,19 @@ class de {
       const i = s.headers["mcp-client-id"]?.trim(), n = i && i.length > 0 ? i : "";
       if (!n)
         return r.code(400), "Missing mcp-client-id";
-      const a = this.clientCache.get(n);
-      if (!a)
+      const l = this.clientCache.get(n);
+      if (!l)
         return r.code(400), "Invalid or expired client";
       const c = s.headers["mcp-session-id"];
       if (!c)
         return r.code(400), "Missing mcp-session-id";
-      const l = a.sessions.get(c);
-      return l ? (await l.handleRequest(s.raw, r.raw), r) : (r.code(400), "Invalid or expired session ID");
+      const a = l.sessions.get(c);
+      return a ? (await a.handleRequest(s.raw, r.raw), r) : (r.code(400), "Invalid or expired session ID");
     }), e.delete(
       `${t}/mcp`,
       async (s, r) => {
-        const i = s.headers["mcp-client-id"]?.trim(), n = i && i.length > 0 ? i : "", a = s.headers["mcp-session-id"];
-        if (!n || !a)
+        const i = s.headers["mcp-client-id"]?.trim(), n = i && i.length > 0 ? i : "", l = s.headers["mcp-session-id"];
+        if (!n || !l)
           return r.code(400), {
             jsonrpc: "2.0",
             error: {
@@ -912,21 +922,21 @@ class de {
             },
             id: null
           };
-        const c = this.clientCache.get(n), l = c?.sessions.get(a);
-        if (!c || !l)
+        const c = this.clientCache.get(n), a = c?.sessions.get(l);
+        if (!c || !a)
           return r.code(404), {
             jsonrpc: "2.0",
             error: { code: -32e3, message: "Session not found or expired" },
             id: null
           };
         try {
-          if (typeof l.close == "function")
+          if (typeof a.close == "function")
             try {
-              await l.close();
+              await a.close();
             } catch {
             }
         } finally {
-          l?.sessionId ? c.sessions.delete(l.sessionId) : c.sessions.delete(a);
+          a?.sessionId ? c.sessions.delete(a.sessionId) : c.sessions.delete(l);
         }
         return r.code(204).send(), r;
       }
@@ -1014,7 +1024,7 @@ class de {
     return t;
   }
 }
-class ue {
+class fe {
   constructor(e) {
     d(this, "config");
     d(this, "queryParamName");
@@ -1147,25 +1157,25 @@ class ue {
     for (const i of t)
       s[i] = e[i];
     const r = JSON.stringify(s);
-    return ie("sha256").update(r).digest("hex").slice(0, 16);
+    return ae("sha256").update(r).digest("hex").slice(0, 16);
   }
 }
 function K(o) {
-  he(o), fe(o), me(o), ye(o), ge(o);
+  me(o), ye(o), ge(o), pe(o), ve(o);
 }
-function he(o) {
+function me(o) {
   if (!o || typeof o != "object")
     throw new Error(
       "Session context configuration must be an object"
     );
 }
-function fe(o) {
+function ye(o) {
   if (o.enabled !== void 0 && typeof o.enabled != "boolean")
     throw new Error(
       `enabled must be a boolean, got ${typeof o.enabled}`
     );
 }
-function me(o) {
+function ge(o) {
   if (o.queryParam !== void 0) {
     if (typeof o.queryParam != "object" || o.queryParam === null)
       throw new Error("queryParam must be an object");
@@ -1188,29 +1198,29 @@ function me(o) {
     }
   }
 }
-function ye(o) {
+function pe(o) {
   if (o.contextResolver !== void 0 && typeof o.contextResolver != "function")
     throw new Error(
       "contextResolver must be a function: (request, baseContext, parsedQueryConfig?) => unknown"
     );
 }
-function ge(o) {
+function ve(o) {
   if (o.merge !== void 0 && o.merge !== "shallow" && o.merge !== "deep")
     throw new Error(
       `Invalid merge strategy: "${o.merge}". Must be "shallow" or "deep"`
     );
 }
-const pe = v.object({
+const we = v.object({
   mode: v.enum(["DYNAMIC", "STATIC"]).optional(),
   toolsets: v.union([v.array(v.string()), v.literal("ALL")]).optional()
 }).strict();
-async function ke(o) {
+async function De(o) {
   if (o.startup)
     try {
-      pe.parse(o.startup);
-    } catch (l) {
-      if (l instanceof v.ZodError) {
-        const u = l.format();
+      we.parse(o.startup);
+    } catch (a) {
+      if (a instanceof v.ZodError) {
+        const u = a.format();
         throw new Error(
           `Invalid startup configuration:
 ${JSON.stringify(u, null, 2)}
@@ -1218,29 +1228,29 @@ ${JSON.stringify(u, null, 2)}
 Hint: Common mistake - use "toolsets" not "initialToolsets"`
         );
       }
-      throw l;
+      throw a;
     }
   const e = o.startup?.mode ?? "DYNAMIC";
   let t;
-  if (o.sessionContext && (K(o.sessionContext), t = new ue(o.sessionContext), e === "STATIC" && o.sessionContext.enabled !== !1 && console.warn(
+  if (o.sessionContext && (K(o.sessionContext), t = new fe(o.sessionContext), e === "STATIC" && o.sessionContext.enabled !== !1 && console.warn(
     "sessionContext has limited effect in STATIC mode: all clients share the same server instance with base context. Use DYNAMIC mode for per-session context isolation."
   )), typeof o.createServer != "function")
     throw new Error("createMcpServer: `createServer` (factory) is required");
-  const s = o.createServer(), r = (l) => typeof l?.server?.notification == "function", i = (l) => typeof l?.notifyToolsListChanged == "function", n = async (l) => {
+  const s = o.createServer(), r = (a) => typeof a?.server?.notification == "function", i = (a) => typeof a?.notifyToolsListChanged == "function", n = async (a) => {
     try {
-      if (r(l)) {
-        await l.server.notification({
+      if (r(a)) {
+        await a.server.notification({
           method: "notifications/tools/list_changed"
         });
         return;
       }
-      i(l) && await l.notifyToolsListChanged();
+      i(a) && await a.notifyToolsListChanged();
     } catch (u) {
       if ((u instanceof Error ? u.message : String(u)) === "Not connected")
         return;
       console.warn("Failed to send tools list changed notification:", u);
     }
-  }, a = new A({
+  }, l = new C({
     server: s,
     catalog: o.catalog,
     moduleLoaders: o.moduleLoaders,
@@ -1250,14 +1260,14 @@ Hint: Common mistake - use "toolsets" not "initialToolsets"`
     startup: o.startup,
     registerMetaTools: o.registerMetaTools !== void 0 ? o.registerMetaTools : e === "DYNAMIC"
   });
-  e === "STATIC" && await a.ensureReady();
-  const c = new de(
-    a.getManager(),
-    (l) => {
-      const u = l ?? o.context;
+  e === "STATIC" && await l.ensureReady();
+  const c = new he(
+    l.getManager(),
+    (a) => {
+      const u = a ?? o.context;
       if (e === "STATIC")
-        return { server: s, orchestrator: a };
-      const h = o.createServer(), g = new A({
+        return { server: s, orchestrator: l };
+      const h = o.createServer(), g = new C({
         server: h,
         catalog: o.catalog,
         moduleLoaders: o.moduleLoaders,
@@ -1284,16 +1294,16 @@ Hint: Common mistake - use "toolsets" not "initialToolsets"`
     }
   };
 }
-function ve(o) {
-  we(o), Te(o), be(o), xe(o);
+function Te(o) {
+  be(o), Se(o), xe(o), Ae(o);
 }
-function we(o) {
+function be(o) {
   if (!o || typeof o != "object")
     throw new Error(
       "Permission configuration is required for createPermissionBasedMcpServer"
     );
 }
-function Te(o) {
+function Se(o) {
   if (!o.source)
     throw new Error('Permission source must be either "headers" or "config"');
   if (o.source !== "headers" && o.source !== "config")
@@ -1301,19 +1311,19 @@ function Te(o) {
       `Invalid permission source: "${o.source}". Must be either "headers" or "config"`
     );
 }
-function be(o) {
+function xe(o) {
   if (o.source === "config" && !o.staticMap && !o.resolver)
     throw new Error(
       "Config-based permissions require at least one of: staticMap or resolver function"
     );
 }
-function xe(o) {
+function Ae(o) {
   if (o.staticMap !== void 0) {
     if (typeof o.staticMap != "object" || o.staticMap === null)
       throw new Error(
         "staticMap must be an object mapping client IDs to toolset arrays"
       );
-    Se(o.staticMap);
+    Ce(o.staticMap);
   }
   if (o.resolver !== void 0 && typeof o.resolver != "function")
     throw new Error(
@@ -1324,21 +1334,21 @@ function xe(o) {
   if (o.headerName !== void 0 && (typeof o.headerName != "string" || o.headerName.length === 0))
     throw new Error("headerName must be a non-empty string");
 }
-function Se(o) {
+function Ce(o) {
   for (const [e, t] of Object.entries(o))
     if (!Array.isArray(t))
       throw new Error(
         `staticMap value for client "${e}" must be an array of toolset names`
       );
 }
-var p, H, F, _, B, Y;
-class Ae {
+var p, H, B, Y, U, W;
+class Ee {
   /**
    * Creates a new PermissionResolver instance.
    * @param config - The permission configuration defining how permissions are resolved
    */
   constructor(e) {
-    S(this, p);
+    A(this, p);
     d(this, "cache", /* @__PURE__ */ new Map());
     d(this, "normalizedHeaderName");
     this.config = e, this.normalizedHeaderName = (e.headerName || "mcp-toolset-permissions").toLowerCase();
@@ -1361,7 +1371,7 @@ class Ae {
       return this.cache.get(e);
     let s;
     try {
-      this.config.source === "headers" ? s = m(this, p, H).call(this, t) : s = m(this, p, _).call(this, e), Array.isArray(s) || (console.warn(
+      this.config.source === "headers" ? s = m(this, p, H).call(this, t) : s = m(this, p, Y).call(this, e), Array.isArray(s) || (console.warn(
         `Permission resolution returned non-array for client ${e}, using empty permissions`
       ), s = []), s = s.filter(
         (r) => typeof r == "string" && r.trim().length > 0
@@ -1402,7 +1412,7 @@ p = new WeakSet(), /**
 H = function(e) {
   if (!e)
     return [];
-  const t = m(this, p, F).call(this, e, this.normalizedHeaderName);
+  const t = m(this, p, B).call(this, e, this.normalizedHeaderName);
   if (!t)
     return [];
   try {
@@ -1421,7 +1431,7 @@ H = function(e) {
  * @returns The header value if found, undefined otherwise
  * @private
  */
-F = function(e, t) {
+B = function(e, t) {
   if (e[t] !== void 0)
     return e[t];
   for (const [s, r] of Object.entries(e))
@@ -1435,14 +1445,14 @@ F = function(e, t) {
  * @returns Array of toolset names from configuration
  * @private
  */
-_ = function(e) {
+Y = function(e) {
   if (this.config.resolver) {
-    const t = m(this, p, B).call(this, e);
+    const t = m(this, p, U).call(this, e);
     if (t !== null)
       return t;
   }
   if (this.config.staticMap) {
-    const t = m(this, p, Y).call(this, e);
+    const t = m(this, p, W).call(this, e);
     if (t !== null)
       return t;
   }
@@ -1454,7 +1464,7 @@ _ = function(e) {
  * @returns Array of toolset names if successful, null if resolver fails or returns invalid data
  * @private
  */
-B = function(e) {
+U = function(e) {
   try {
     const t = this.config.resolver(e);
     return Array.isArray(t) ? t : (console.warn(
@@ -1473,23 +1483,23 @@ B = function(e) {
  * @returns Array of toolset names if found, null if client not in map
  * @private
  */
-Y = function(e) {
+W = function(e) {
   const t = this.config.staticMap[e];
   return t !== void 0 ? Array.isArray(t) ? t : [] : null;
 };
-function Ce(o, e) {
+function Pe(o, e) {
   return async (t) => {
     const s = e.resolvePermissions(
       t.clientId,
       t.headers
-    ), r = o(s), i = r.orchestrator.getManager(), n = [], a = [];
+    ), r = o(s), i = r.orchestrator.getManager(), n = [], l = [];
     if (s.length > 0) {
       const c = await i.enableToolsets(s);
-      for (const l of c.results)
-        l.success ? n.push(l.name) : (a.push(l.name), console.warn(
-          `Failed to enable toolset '${l.name}' for client '${t.clientId}': ${l.message}`
+      for (const a of c.results)
+        a.success ? n.push(a.name) : (l.push(a.name), console.warn(
+          `Failed to enable toolset '${a.name}' for client '${t.clientId}': ${a.message}`
         ));
-      if (n.length === 0 && a.length > 0)
+      if (n.length === 0 && l.length > 0)
         throw new Error(
           `All requested toolsets failed to enable for client '${t.clientId}'. Requested: [${s.join(", ")}]. Check that toolset names in permissions match the catalog.`
         );
@@ -1498,12 +1508,12 @@ function Ce(o, e) {
       server: r.server,
       orchestrator: r.orchestrator,
       allowedToolsets: n,
-      failedToolsets: a
+      failedToolsets: l
     };
   };
 }
-var f, U, W, J, Q, G, Z, X, ee, P, te;
-class Ee {
+var f, J, Q, G, Z, X, ee, te, se, M, oe;
+class Me {
   /**
    * Creates a new PermissionAwareFastifyTransport instance.
    * @param defaultManager - Default tool manager for status endpoints
@@ -1512,16 +1522,16 @@ class Ee {
    * @param configSchema - Optional JSON schema for configuration discovery
    */
   constructor(e, t, s = {}, r) {
-    S(this, f);
+    A(this, f);
     d(this, "options");
     d(this, "defaultManager");
     d(this, "createPermissionAwareBundle");
     d(this, "app", null);
     d(this, "configSchema");
     // Per-client server bundles and per-client session transports
-    d(this, "clientCache", new q({
+    d(this, "clientCache", new F({
       onEvict: (e, t) => {
-        m(this, f, U).call(this, t);
+        m(this, f, J).call(this, t);
       }
     }));
     this.defaultManager = e, this.createPermissionAwareBundle = t, this.options = {
@@ -1541,11 +1551,11 @@ class Ee {
   async start() {
     if (this.app) return;
     const e = this.options.app ?? N({ logger: this.options.logger });
-    this.options.cors && await e.register(k, { origin: !0 });
-    const t = m(this, f, W).call(this, this.options.basePath);
-    m(this, f, J).call(this, e, t), m(this, f, Q).call(this, e, t), m(this, f, G).call(this, e, t), m(this, f, Z).call(this, e, t), m(this, f, X).call(this, e, t), m(this, f, ee).call(this, e, t), this.options.customEndpoints && this.options.customEndpoints.length > 0 && V(e, t, this.options.customEndpoints, {
+    this.options.cors && await e.register(D, { origin: !0 });
+    const t = m(this, f, Q).call(this, this.options.basePath);
+    m(this, f, G).call(this, e, t), m(this, f, Z).call(this, e, t), m(this, f, X).call(this, e, t), m(this, f, ee).call(this, e, t), m(this, f, te).call(this, e, t), m(this, f, se).call(this, e, t), this.options.customEndpoints && this.options.customEndpoints.length > 0 && V(e, t, this.options.customEndpoints, {
       contextExtractor: async (s) => {
-        const r = m(this, f, P).call(this, s);
+        const r = m(this, f, M).call(this, s);
         try {
           const i = await this.createPermissionAwareBundle(r);
           return {
@@ -1577,7 +1587,7 @@ f = new WeakSet(), /**
  * @param bundle - The client bundle to clean up
  * @private
  */
-U = function(e) {
+J = function(e) {
   for (const [t, s] of e.sessions.entries())
     try {
       typeof s.close == "function" && s.close().catch((r) => {
@@ -1593,7 +1603,7 @@ U = function(e) {
  * @returns Normalized base path without trailing slash
  * @private
  */
-W = function(e) {
+Q = function(e) {
   return e.endsWith("/") ? e.slice(0, -1) : e;
 }, /**
  * Registers the health check endpoint.
@@ -1601,7 +1611,7 @@ W = function(e) {
  * @param base - Base path for routes
  * @private
  */
-J = function(e, t) {
+G = function(e, t) {
   e.get(`${t}/healthz`, async () => ({ ok: !0 }));
 }, /**
  * Registers the tools status endpoint.
@@ -1609,7 +1619,7 @@ J = function(e, t) {
  * @param base - Base path for routes
  * @private
  */
-Q = function(e, t) {
+Z = function(e, t) {
   e.get(`${t}/tools`, async () => this.defaultManager.getStatus());
 }, /**
  * Registers the MCP configuration discovery endpoint.
@@ -1617,7 +1627,7 @@ Q = function(e, t) {
  * @param base - Base path for routes
  * @private
  */
-G = function(e, t) {
+X = function(e, t) {
   e.get(`${t}/.well-known/mcp-config`, async (s, r) => (r.header("Content-Type", "application/schema+json; charset=utf-8"), this.configSchema ?? {
     $schema: "https://json-schema.org/draft/2020-12/schema",
     title: "MCP Session Configuration",
@@ -1635,46 +1645,46 @@ G = function(e, t) {
  * @param base - Base path for routes
  * @private
  */
-Z = function(e, t) {
+ee = function(e, t) {
   e.post(
     `${t}/mcp`,
     async (s, r) => {
-      const i = m(this, f, P).call(this, s), n = !i.clientId.startsWith("anon-");
-      let a = n ? this.clientCache.get(i.clientId) : null;
-      if (!a)
+      const i = m(this, f, M).call(this, s), n = !i.clientId.startsWith("anon-");
+      let l = n ? this.clientCache.get(i.clientId) : null;
+      if (!l)
         try {
           const u = await this.createPermissionAwareBundle(i);
           u.failedToolsets.length > 0 && console.warn(
             `Client ${i.clientId} had ${u.failedToolsets.length} toolsets fail to enable: [${u.failedToolsets.join(", ")}]. Successfully enabled: [${u.allowedToolsets.join(", ")}]`
           );
           const h = u.sessions;
-          a = {
+          l = {
             server: u.server,
             orchestrator: u.orchestrator,
             allowedToolsets: u.allowedToolsets,
             failedToolsets: u.failedToolsets,
             sessions: h instanceof Map ? h : /* @__PURE__ */ new Map()
-          }, n && this.clientCache.set(i.clientId, a);
+          }, n && this.clientCache.set(i.clientId, l);
         } catch (u) {
           return console.error(
             `Failed to create permission-aware bundle for client ${i.clientId}:`,
             u
-          ), r.code(403), m(this, f, te).call(this, "Access denied");
+          ), r.code(403), m(this, f, oe).call(this, "Access denied");
         }
       const c = s.headers["mcp-session-id"];
-      let l;
-      if (c && a.sessions.get(c))
-        l = a.sessions.get(c);
-      else if (!c && D(s.body)) {
-        const u = b();
-        l = new O({
+      let a;
+      if (c && l.sessions.get(c))
+        a = l.sessions.get(c);
+      else if (!c && _(s.body)) {
+        const u = S();
+        a = new z({
           sessionIdGenerator: () => u,
           onsessioninitialized: (h) => {
-            a.sessions.set(h, l);
+            l.sessions.set(h, a);
           }
         });
         try {
-          await a.server.connect(l);
+          await l.server.connect(a);
         } catch {
           return r.code(500), {
             jsonrpc: "2.0",
@@ -1682,8 +1692,8 @@ Z = function(e, t) {
             id: null
           };
         }
-        l.onclose = () => {
-          l?.sessionId && a.sessions.delete(l.sessionId);
+        a.onclose = () => {
+          a?.sessionId && l.sessions.delete(a.sessionId);
         };
       } else
         return r.code(400), {
@@ -1691,7 +1701,7 @@ Z = function(e, t) {
           error: { code: -32e3, message: "Session not found or expired" },
           id: null
         };
-      return await l.handleRequest(
+      return await a.handleRequest(
         s.raw,
         r.raw,
         s.body
@@ -1704,19 +1714,19 @@ Z = function(e, t) {
  * @param base - Base path for routes
  * @private
  */
-X = function(e, t) {
+te = function(e, t) {
   e.get(`${t}/mcp`, async (s, r) => {
     const i = s.headers["mcp-client-id"]?.trim(), n = i && i.length > 0 ? i : "";
     if (!n)
       return r.code(400), "Missing mcp-client-id";
-    const a = this.clientCache.get(n);
-    if (!a)
+    const l = this.clientCache.get(n);
+    if (!l)
       return r.code(400), "Invalid or expired client";
     const c = s.headers["mcp-session-id"];
     if (!c)
       return r.code(400), "Missing mcp-session-id";
-    const l = a.sessions.get(c);
-    return l ? (await l.handleRequest(s.raw, r.raw), r) : (r.code(400), "Invalid or expired session ID");
+    const a = l.sessions.get(c);
+    return a ? (await a.handleRequest(s.raw, r.raw), r) : (r.code(400), "Invalid or expired session ID");
   });
 }, /**
  * Registers the DELETE /mcp endpoint for session termination.
@@ -1724,12 +1734,12 @@ X = function(e, t) {
  * @param base - Base path for routes
  * @private
  */
-ee = function(e, t) {
+se = function(e, t) {
   e.delete(
     `${t}/mcp`,
     async (s, r) => {
-      const i = s.headers["mcp-client-id"]?.trim(), n = i && i.length > 0 ? i : "", a = s.headers["mcp-session-id"];
-      if (!n || !a)
+      const i = s.headers["mcp-client-id"]?.trim(), n = i && i.length > 0 ? i : "", l = s.headers["mcp-session-id"];
+      if (!n || !l)
         return r.code(400), {
           jsonrpc: "2.0",
           error: {
@@ -1738,21 +1748,21 @@ ee = function(e, t) {
           },
           id: null
         };
-      const c = this.clientCache.get(n), l = c?.sessions.get(a);
-      if (!c || !l)
+      const c = this.clientCache.get(n), a = c?.sessions.get(l);
+      if (!c || !a)
         return r.code(404), {
           jsonrpc: "2.0",
           error: { code: -32e3, message: "Session not found or expired" },
           id: null
         };
       try {
-        if (typeof l.close == "function")
+        if (typeof a.close == "function")
           try {
-            await l.close();
+            await a.close();
           } catch {
           }
       } finally {
-        l?.sessionId ? c.sessions.delete(l.sessionId) : c.sessions.delete(a);
+        a?.sessionId ? c.sessions.delete(a.sessionId) : c.sessions.delete(l);
       }
       return r.code(204).send(), r;
     }
@@ -1764,8 +1774,8 @@ ee = function(e, t) {
  * @returns Client request context with ID and headers
  * @private
  */
-P = function(e) {
-  const t = e.headers["mcp-client-id"]?.trim(), s = t && t.length > 0 ? t : `anon-${b()}`, r = {};
+M = function(e) {
+  const t = e.headers["mcp-client-id"]?.trim(), s = t && t.length > 0 ? t : `anon-${S()}`, r = {};
   for (const [i, n] of Object.entries(e.headers))
     typeof n == "string" && (r[i] = n);
   return { clientId: s, headers: r };
@@ -1777,7 +1787,7 @@ P = function(e) {
  * @returns JSON-RPC error response object
  * @private
  */
-te = function(e = "Access denied", t = -32e3) {
+oe = function(e = "Access denied", t = -32e3) {
   return {
     jsonrpc: "2.0",
     error: {
@@ -1787,7 +1797,7 @@ te = function(e = "Access denied", t = -32e3) {
     id: null
   };
 };
-function Pe(o) {
+function Ie(o) {
   if (!o) return;
   const e = {
     namespaceToolsWithSetKey: o.namespaceToolsWithSetKey
@@ -1802,12 +1812,12 @@ function Pe(o) {
     "Permission-based servers: exposurePolicy.onLimitExceeded is ignored. No toolset limits are enforced."
   ), e;
 }
-async function Oe(o) {
+async function ze(o) {
   if (!o.permissions)
     throw new Error(
       "Permission configuration is required for createPermissionBasedMcpServer. Please provide a 'permissions' field in the options."
     );
-  if (ve(o.permissions), o.sessionContext && (K(o.sessionContext), console.warn(
+  if (Te(o.permissions), o.sessionContext && (K(o.sessionContext), console.warn(
     "Session context support for permission-based servers is limited. The base context will be used for module loaders."
   )), o.startup)
     throw new Error(
@@ -1817,9 +1827,9 @@ async function Oe(o) {
     throw new Error(
       "createPermissionBasedMcpServer: `createServer` (factory) is required"
     );
-  const e = Pe(
+  const e = Ie(
     o.exposurePolicy
-  ), t = new Ae(o.permissions), s = o.createServer(), r = new A({
+  ), t = new Ee(o.permissions), s = o.createServer(), r = new C({
     server: s,
     catalog: o.catalog,
     moduleLoaders: o.moduleLoaders,
@@ -1829,9 +1839,9 @@ async function Oe(o) {
     // No notifications in STATIC mode
     startup: { mode: "STATIC", toolsets: [] },
     registerMetaTools: !1
-  }), i = Ce(
-    (a) => {
-      const c = o.createServer(), l = new A({
+  }), i = Pe(
+    (l) => {
+      const c = o.createServer(), a = new C({
         server: c,
         catalog: o.catalog,
         moduleLoaders: o.moduleLoaders,
@@ -1844,10 +1854,10 @@ async function Oe(o) {
         registerMetaTools: !1
         // No meta-tools - toolsets are fixed per client
       });
-      return { server: c, orchestrator: l };
+      return { server: c, orchestrator: a };
     },
     t
-  ), n = new Ee(
+  ), n = new Me(
     r.getManager(),
     i,
     o.http,
@@ -1867,17 +1877,17 @@ async function Oe(o) {
     }
   };
 }
-function De(o) {
+function _e(o) {
   return o;
 }
-function ze(o) {
+function qe(o) {
   return o;
 }
 export {
-  ue as SessionContextResolver,
-  ke as createMcpServer,
-  Oe as createPermissionBasedMcpServer,
-  De as defineEndpoint,
-  ze as definePermissionAwareEndpoint
+  fe as SessionContextResolver,
+  De as createMcpServer,
+  ze as createPermissionBasedMcpServer,
+  _e as defineEndpoint,
+  qe as definePermissionAwareEndpoint
 };
 //# sourceMappingURL=index.js.map