@chkp/policy-insights-mcp 0.4.3 → 0.4.4

package/dist/index.js

@@ -1270,600 +1270,451 @@ var toolDefinitionMap = [
 // ../infra/dist/api-client.js
 import axios from "axios";
 import https from "https";
-var TokenType;
-(function(TokenType2) {
-  TokenType2["API_KEY"] = "API_KEY";
-  TokenType2["CI_TOKEN"] = "CI_TOKEN";
-})(TokenType || (TokenType = {}));
-function getMainPackageUserAgent() {
-  if (process.env.CP_MCP_MAIN_PKG) {
-    if (process.env.CP_MCP_MAIN_PKG.includes("quantum-management-mcp")) {
-      return "mgmt-mcp";
-    }
+
+// ../mcp-utils/dist/cli-options.js
+function booleanOptionDefault(envValue, optionDefault) {
+  return envValue === "true" || optionDefault === "true";
+}
+function resolveTransportType(transportOption, env = process.env) {
+  return (transportOption || env.MCP_TRANSPORT_TYPE || "stdio").toLowerCase() === "http" ? "http" : "stdio";
+}
+function optionKey(flag) {
+  const long = flag.split(/[,\s]+/).find((part) => part.startsWith("--"));
+  if (!long)
+    return void 0;
+  const negated = long.startsWith("--no-");
+  return {
+    key: long.replace(/^--(no-)?/, "").replace(/-([a-z])/g, (_match, char) => char.toUpperCase()),
+    negated
+  };
+}
+function operatorValues(options, parsed, env = process.env) {
+  const values = { ...env };
+  for (const option of options) {
+    const derived = option.env ? optionKey(option.flag) : void 0;
+    if (!derived || derived.negated)
+      continue;
+    const value = parsed[derived.key];
+    if (value !== void 0)
+      values[option.env] = value;
   }
-  return "Check Point MCP API Client";
+  return values;
 }
-var ClientResponse = class {
-  constructor(status, response) {
-    this.status = status;
-    this.response = response;
+
+// ../mcp-utils/dist/debug-view.js
+import { createHash } from "node:crypto";
+var BUILTIN_LOGGABLE_KEYS = [
+  "accept",
+  "accept-encoding",
+  "accept-language",
+  "connection",
+  "content-length",
+  "content-type",
+  "host",
+  "mcp-protocol-version",
+  "traceparent",
+  "user-agent",
+  "x-correlation-id",
+  "x-gw-auth-method",
+  "x-request-id",
+  // Launcher options
+  "debug",
+  "telemetry",
+  "telemetry-url",
+  "transport",
+  "transport-port"
+];
+function normalizeDebugKey(key) {
+  const split = /[-_]/.test(key) ? key : key.replace(/([a-z][0-9]*)([A-Z])/g, "$1-$2");
+  return split.replace(/_/g, "-").toLowerCase();
+}
+function debugLoggableKeys(extra = []) {
+  return new Set([...BUILTIN_LOGGABLE_KEYS, ...extra].map(normalizeDebugKey));
+}
+function describe(key, value, loggable) {
+  if (value === void 0 || value === null || value === "")
+    return "(unset)";
+  if (loggable.has(normalizeDebugKey(key))) {
+    return typeof value === "string" ? value : JSON.stringify(value);
+  }
+  const text = typeof value === "string" ? value : Array.isArray(value) ? value.join(", ") : void 0;
+  return text === void 0 ? "(hidden)" : `(hidden, ${text.length} chars)`;
+}
+function debugView(record, loggable = debugLoggableKeys()) {
+  return Object.fromEntries(Object.entries(record ?? {}).map(([key, value]) => [key, describe(key, value, loggable)]));
+}
+function sessionLogLabel(sessionId) {
+  if (!sessionId || sessionId === "default")
+    return "default";
+  return `session#${createHash("sha256").update(sessionId).digest("hex").slice(0, 8)}`;
+}
+
+// ../mcp-utils/dist/launcher.js
+import { Command } from "commander";
+import { StdioServerTransport } from "@modelcontextprotocol/sdk/server/stdio.js";
+import { StreamableHTTPServerTransport } from "@modelcontextprotocol/sdk/server/streamableHttp.js";
+import fs from "fs";
+import http from "http";
+import { randomUUID } from "crypto";
+
+// ../mcp-utils/dist/connection-source.js
+function hasValue(value) {
+  return value !== void 0 && value !== null && value !== "" && !(Array.isArray(value) && value.length === 0);
+}
+function headersRead(fromHeaders, headers) {
+  const read = /* @__PURE__ */ new Set();
+  const recording = new Proxy(headers, {
+    get(target, prop, receiver) {
+      const value = Reflect.get(target, prop, receiver);
+      if (typeof prop === "string" && hasValue(value))
+        read.add(prop);
+      return value;
+    }
+  });
+  try {
+    fromHeaders(recording);
+  } catch {
   }
-};
-var APIClientBase = class {
-  constructor(authToken = "", tokenType = TokenType.API_KEY, cloudConnected = false) {
-    this.authToken = authToken;
-    this.tokenType = tokenType;
-    this.cloudConnected = cloudConnected;
-    this.sid = null;
-    this.sessionTimeout = null;
-    this.sessionStart = null;
-    this.isMDS = false;
-    this._externalSid = false;
+  return read;
+}
+function keySet(keys = []) {
+  return new Set(keys.map(normalizeDebugKey));
+}
+function chooseConnectionSource(read, basicKeys) {
+  for (const key of read) {
+    if (!basicKeys.has(normalizeDebugKey(key)))
+      return "caller";
   }
-  /**
-  * Create an API client instance - generic method for creating clients
-  */
-  static create(...args) {
-    return new this(...args);
+  return "operator";
+}
+function basicOnly(headers, basicKeys) {
+  return Object.fromEntries(Object.entries(headers).filter(([key]) => basicKeys.has(normalizeDebugKey(key))));
+}
+function mergeHeaders(base, overrides) {
+  const merged = {};
+  const index = /* @__PURE__ */ new Map();
+  for (const [key, value] of [...Object.entries(base), ...Object.entries(overrides)]) {
+    const id = normalizeDebugKey(key);
+    const previous = index.get(id);
+    if (previous !== void 0)
+      delete merged[previous];
+    index.set(id, key);
+    merged[key] = value;
+  }
+  return merged;
+}
+function operatorHeaders(values) {
+  const headers = {};
+  for (const [name, value] of Object.entries(values)) {
+    if (!hasValue(value))
+      continue;
+    headers[name.replace(/_/g, "-")] = Array.isArray(value) ? value.map(String) : String(value);
   }
-  /**
-   * Get headers for the API requests
-   */
-  getHeaders() {
-    const headers = {
-      "Content-Type": "application/json",
-      "User-Agent": getMainPackageUserAgent()
-    };
-    if (this.sid) {
-      headers["X-chkp-sid"] = this.sid;
-    }
-    if (this.cloudConnected && this.tokenType === TokenType.CI_TOKEN) {
-      headers["Authorization"] = `Bearer ${this.authToken}`;
-      headers["CLOUD-INFRA-TOKEN"] = this.authToken;
-    }
+  return headers;
+}
+function canonicalizeAliases(headers, aliases) {
+  if (aliases.size === 0)
     return headers;
+  const canonical = new Set([...aliases.values()].map(normalizeDebugKey));
+  const present = new Set(Object.keys(headers).map(normalizeDebugKey).filter((key) => canonical.has(key)));
+  const result = {};
+  for (const [key, value] of Object.entries(headers)) {
+    const target = aliases.get(normalizeDebugKey(key));
+    if (target === void 0) {
+      result[key] = value;
+    } else if (!present.has(normalizeDebugKey(target))) {
+      result[target] = value;
+      present.add(normalizeDebugKey(target));
+    }
+  }
+  return result;
+}
+function aliasMap(aliases = {}) {
+  return new Map(Object.entries(aliases).map(([alias, target]) => [normalizeDebugKey(alias), target]));
+}
+function sessionHeaders(source, callerHeaders, operator, basicKeys, operatorSettingsOverHttp) {
+  if (source === "caller") {
+    return mergeHeaders(basicOnly(operator, basicKeys), callerHeaders);
   }
+  const base = operatorSettingsOverHttp ? operator : basicOnly(operator, basicKeys);
+  return mergeHeaders(base, basicOnly(callerHeaders, basicKeys));
+}
+
+// ../mcp-utils/dist/settings-manager.js
+var SettingsManager = class _SettingsManager {
   /**
-   * Get debug mode
+   * Creates a new SettingsManager
+   * @param settingsClass The Settings class to use for creating settings instances
    */
-  get debug() {
-    return !!this._debug;
+  constructor(settingsClass) {
+    this.settingsMap = /* @__PURE__ */ new Map();
+    this.defaultSessionId = "default";
+    this.operatorValues = {};
+    this.sessionSources = /* @__PURE__ */ new Map();
+    this.settingsClass = settingsClass;
+    this.loggableKeys = debugLoggableKeys(settingsClass?.debugLoggableKeys ?? []);
+    this.basicKeys = keySet(settingsClass?.basicKeys ?? []);
+    this.headerAliases = aliasMap(settingsClass?.headerAliases);
+    this.operatorSettingsOverHttp = settingsClass?.operatorSettingsOverHttp !== false;
   }
   /**
-   * Set debug mode
+   * Get settings for a specific session
+   * @param sessionId The session ID (defaults to 'default' for stdio mode)
+   * @returns Settings instance for the session
    */
-  set debug(value) {
-    this._debug = value;
+  getSettings(sessionId) {
+    const sid = sessionId || this.defaultSessionId;
+    if (!this.settingsMap.has(sid)) {
+      this.settingsMap.set(sid, new this.settingsClass());
+    }
+    return this.settingsMap.get(sid);
   }
   /**
-    * Set a pre-authenticated session ID provided externally (e.g. via X-chkp-sid header).
-    * When set, the client will skip login and use this SID directly for all requests.
-    */
-  setExternalSid(sid) {
-    this.sid = sid;
-    this._externalSid = true;
-    this.sessionStart = Date.now();
-    this.sessionTimeout = Number.MAX_SAFE_INTEGER / 1e3;
+   * Set settings for a specific session
+   * @param settings The settings object to set
+   * @param sessionId The session ID (defaults to 'default' for stdio mode)
+   */
+  setSettings(settings, sessionId) {
+    const sid = sessionId || this.defaultSessionId;
+    this.settingsMap.set(sid, settings);
   }
   /**
-   * Check if this client needs to perform login before making API calls
+   * Injects debug settings from source into settings object
+   * @param settings The settings object to update
+   * @param source Source object containing debug information
+   * @param scope 'process' when the operator set debug (CLI/env), which also
+   *   updates the process-wide state; 'session' when a caller set it through a
+   *   header, which affects only that session's settings
+   * @private
    */
-  needsLogin() {
-    if (this._externalSid) {
-      return false;
+  injectDebug(settings, source, scope) {
+    const debug = source?.debug ?? _SettingsManager.globalDebugState ?? process.env.DEBUG;
+    if (typeof debug !== "undefined") {
+      if (scope === "process" && source?.debug !== void 0) {
+        _SettingsManager.globalDebugState = source.debug;
+      }
+      if (typeof settings.set === "function") {
+        settings.set("debug", debug);
+      } else {
+        settings.debug = debug;
+      }
+      if (debug) {
+        console.error("Debug enabled. Source:");
+        this.printDebugView(source);
+      }
     }
-    return true;
   }
   /**
-   * Check if this client is in an MDS environment
+   * Print settings object for debugging by dynamically discovering its properties
+   * @param settings The settings object to print
+   * @private
    */
-  async isMDSEnvironment() {
-    if (!this.hasValidSession()) {
-      await this.login();
+  printSettingsDebug(settings) {
+    if (typeof settings.get === "function") {
+      console.error("Settings (using get method):");
+      if (settings.data && typeof settings.data === "object") {
+        this.printDebugView(settings.data);
+      } else {
+        console.error("  Unable to enumerate settings properties - no accessible data structure");
+      }
+    } else {
+      console.error("Settings (plain object):");
+      this.printDebugView(settings);
     }
-    return this.isMDS;
   }
-  /**
-   * Check if the client has a valid session
-   */
-  hasValidSession() {
-    return !!this.sid && !this.isSessionExpired();
+  /** Print allowlisted values; everything else as "(hidden, N chars)". */
+  printDebugView(record) {
+    Object.entries(debugView(record, this.loggableKeys)).forEach(([key, value]) => {
+      console.error(`  ${key}: ${value}`);
+    });
   }
   /**
-   * Get the current session ID (for debugging/logging purposes)
+   * Create settings from command-line arguments
+   * @param args Command line arguments
+   * @param sessionId Optional session ID
+   * @returns Settings instance
    */
-  getSessionId() {
-    return this.sid;
+  createFromArgs(args, sessionId) {
+    const settings = this.settingsClass.fromArgs(args);
+    this.injectDebug(settings, args, "process");
+    this.setSettings(settings, sessionId);
+    return settings;
   }
   /**
-   * Create a new API client instance with a specific session ID
-   * Used for domain-specific clients in MDS environments
+   * Record the operator's values (environment variables and parsed CLI
+   * options, keyed by environment-variable name). HTTP sessions take basic
+   * keys from them when the caller doesn't send its own, and their whole
+   * connection set when the caller sends none of it.
    */
-  static createWithSid(originalClient, sid) {
-    const newClient = Object.create(Object.getPrototypeOf(originalClient));
-    Object.assign(newClient, originalClient);
-    newClient.sid = sid;
-    newClient.sessionStart = Date.now();
-    return newClient;
+  setOperatorValues(values) {
+    this.operatorValues = canonicalizeAliases(operatorHeaders(values), this.headerAliases);
   }
   /**
-   * Call an API endpoint
+   * Create settings from HTTP headers
+   * @param headers HTTP headers
+   * @param sessionId Optional session ID
+   * @returns Settings instance
    */
-  async callApi(method, uri, data, params) {
-    if (this.needsLogin() && (!this.sid || this.isSessionExpired())) {
-      try {
-        await this.login();
-      } catch (error) {
-        if (error instanceof ClientResponse) {
-          console.error(`Login failed with status ${error.status}:`, error.response);
-          return error;
-        }
-        console.error("Login failed with unexpected error:", error);
-        return new ClientResponse(500, { error: "Authentication failed", message: error.message });
-      }
+  createFromHeaders(headers, sessionId) {
+    const verbose = _SettingsManager.globalDebugState;
+    if (verbose) {
+      console.error("[SettingsManager.createFromHeaders] Verbose: Starting with session:", sessionLogLabel(sessionId));
+      console.error("[SettingsManager.createFromHeaders] Verbose: Incoming headers count:", Object.keys(headers).length);
     }
-    let httpsAgent;
-    if (this instanceof OnPremAPIClient) {
-      httpsAgent = new https.Agent({ rejectUnauthorized: false });
+    if (_SettingsManager.globalDebugState) {
+      console.error("=== createFromHeaders Debug Info ===");
+      console.error("Incoming headers:");
+      this.printDebugView(headers);
     }
-    try {
-      return await this.makeRequest(this.getHost(), method, uri, data, this.getHeaders(), params, httpsAgent);
-    } catch (error) {
-      if ((error.message?.includes("401") || error.response?.status === 401) && error.message?.toLowerCase().includes("session")) {
-        if (this._externalSid) {
-          throw new Error("Pre-authenticated session (X-chkp-sid) has expired. Provide a new session ID.");
-        }
-        console.error("Session expired (401), resetting session and retrying...");
-        this.sid = null;
-        this.sessionStart = null;
-        try {
-          await this.login();
-        } catch (loginError) {
-          if (loginError instanceof ClientResponse) {
-            console.error(`Login retry failed with status ${loginError.status}:`, loginError.response);
-            return loginError;
-          }
-          console.error("Login retry failed with unexpected error:", loginError);
-          throw loginError;
-        }
-        return await this.makeRequest(this.getHost(), method, uri, data, this.getHeaders(), params, httpsAgent);
+    if (verbose && (!headers || Object.keys(headers).length === 0)) {
+      console.error("[SettingsManager.createFromHeaders] Verbose: WARNING - Headers object is empty or undefined");
+    }
+    const normalizedHeaders = {};
+    for (const [key, value] of Object.entries(headers)) {
+      const normalizedKey = key.includes("_") ? key.replace(/_/g, "-") : key;
+      normalizedHeaders[normalizedKey] = value;
+      if (verbose) {
+        console.error(`[SettingsManager.createFromHeaders] Verbose: Header normalized: "${key}" -> "${normalizedKey}"`);
       }
-      throw error;
     }
-  }
-  /**
-   * Check if the session is expired based on sessionTimeout and sessionStart
-   */
-  isSessionExpired() {
-    if (!this.sid || !this.sessionTimeout || !this.sessionStart)
-      return true;
-    const now = Date.now();
-    return now > this.sessionStart + (this.sessionTimeout - 5) * 1e3;
-  }
-  getHeadersForLogin() {
-    return { "Content-Type": "application/json" };
-  }
-  /**
-   * Login to the API using the API key
-   */
-  async login() {
-    if (this._externalSid) {
-      if (!this.sid)
-        throw new Error("External SID has expired");
-      return this.sid;
+    if (verbose) {
+      console.error("[SettingsManager.createFromHeaders] Verbose: Normalized headers count:", Object.keys(normalizedHeaders).length);
     }
-    const apiTokenHeader = this.tokenType === TokenType.API_KEY ? "api-key" : "ci-token";
-    const loginResp = await this.makeRequest(this.getHost(), "POST", "login", { [apiTokenHeader]: this.authToken }, this.getHeadersForLogin());
-    if (loginResp.status !== 200 || !loginResp.response || !loginResp.response.sid) {
-      throw loginResp;
+    if (_SettingsManager.globalDebugState) {
+      console.error("Normalized header names:", Object.keys(normalizedHeaders));
     }
-    this.sid = loginResp.response.sid;
-    this.sessionTimeout = loginResp.response["session-timeout"] || null;
-    this.sessionStart = Date.now();
-    if (loginResp.response.uid) {
-      await this.detectMDS(loginResp.response.uid);
+    const debugHeader = normalizedHeaders["debug"] || normalizedHeaders["Debug"] || normalizedHeaders["DEBUG"];
+    const requestedDebug = Array.isArray(debugHeader) ? debugHeader[0] : debugHeader;
+    const debugSource = {
+      debug: requestedDebug !== void 0 ? requestedDebug.toLowerCase() === "true" : _SettingsManager.globalDebugState
+    };
+    const callerHeaders = canonicalizeAliases(normalizedHeaders, this.headerAliases);
+    const source = this.connectionSource(callerHeaders, sessionId);
+    const inputHeaders = sessionHeaders(source, callerHeaders, this.operatorValues, this.basicKeys, this.operatorSettingsOverHttp);
+    if (verbose) {
+      console.error("[SettingsManager.createFromHeaders] Verbose: Connection settings source:", source);
+      console.error("[SettingsManager.createFromHeaders] Verbose: Calling settingsClass.fromHeaders");
     }
-    return loginResp.response.sid;
+    const settings = this.settingsClass.fromHeaders(inputHeaders);
+    if (verbose) {
+      console.error("[SettingsManager.createFromHeaders] Verbose: Settings object created");
+    }
+    this.injectDebug(settings, debugSource, "session");
+    if (_SettingsManager.globalDebugState) {
+      console.error("Final settings object for session:", sessionLogLabel(sessionId));
+      this.printSettingsDebug(settings);
+      console.error("=== End createFromHeaders Debug Info ===");
+    }
+    if (verbose) {
+      console.error("[SettingsManager.createFromHeaders] Verbose: Storing settings for session:", sessionLogLabel(sessionId));
+    }
+    this.setSettings(settings, sessionId);
+    return settings;
   }
   /**
-   * Detect if this is an MDS environment by checking the session details
+   * Clear settings for a session
+   * @param sessionId The session ID to clear
    */
-  async detectMDS(sessionUid, handleSelfSigned = false) {
-    try {
-      let httpsAgent;
-      if (handleSelfSigned) {
-        httpsAgent = new https.Agent({ rejectUnauthorized: false });
-      }
-      const sessionResp = await this.makeRequest(this.getHost(), "POST", "show-session", { uid: sessionUid }, this.getHeaders(), null, httpsAgent);
-      if (sessionResp.status === 200 && sessionResp.response?.domain?.["domain-type"] === "mds") {
-        this.isMDS = true;
-      }
-    } catch (error) {
-      console.warn("Could not determine MDS status:", error);
-      this.isMDS = false;
+  clearSession(sessionId) {
+    if (sessionId !== this.defaultSessionId) {
+      this.settingsMap.delete(sessionId);
+      this.sessionSources.delete(sessionId);
     }
   }
   /**
-   * Make a request to a Check Point API
+   * The session's connection source: decided by the request that creates the
+   * session and kept for its lifetime, so a later request cannot switch it.
    */
-  async makeRequest(host, method, uri, data, headers = {}, params = null, httpsAgent) {
-    uri = uri.replace(/^\//, "");
-    const url = `${host}/${uri}`;
-    const config = {
-      method: method.toUpperCase(),
-      url,
-      headers,
-      params: params || void 0
-    };
-    if (httpsAgent) {
-      config.httpsAgent = httpsAgent;
-    }
-    if (method.toUpperCase() !== "GET" && data !== void 0) {
-      config.data = data;
-    }
-    console.error(`API Request: ${method} ${url}`);
-    try {
-      const response = await axios(config);
-      return new ClientResponse(response.status, response.data);
-    } catch (error) {
-      if (error.response) {
-        console.error(`\u274C API Error (${error.response.status}):`);
-        console.error("Headers:", error.response.headers);
-        console.error("Data:", error.response.data);
-        if (this.debug) {
-          console.error("Debug mode: Printing request details:");
-          console.error("Request Method:", method);
-          console.error("Request URL:", url);
-          console.error("Request Headers:", config.headers);
-          console.error("Request Data:", config.data);
-          console.error("Request Params:", config.params);
-        }
-      }
-      if (error.response) {
-        throw new Error(`API request failed: ${error.response.status} - ${JSON.stringify(error.response.data)}`);
-      }
-      throw error;
-    }
+  connectionSource(headers, sessionId) {
+    const known = sessionId ? this.sessionSources.get(sessionId) : void 0;
+    if (known)
+      return known;
+    const source = chooseConnectionSource(headersRead((h) => this.settingsClass.fromHeaders(h), headers), this.basicKeys);
+    if (sessionId)
+      this.sessionSources.set(sessionId, source);
+    return source;
   }
 };
-var SmartOneCloudAPIClient = class extends APIClientBase {
-  constructor(authToken, tokenType, s1cUrl, cloudConnected = false) {
-    super(authToken, tokenType, cloudConnected);
-    this.s1cUrl = s1cUrl;
-  }
-  getHost() {
-    return this.s1cUrl;
-  }
-  getHeadersForLogin() {
-    const headers = { "Content-Type": "application/json" };
-    if (this.cloudConnected && this.tokenType === TokenType.CI_TOKEN) {
-      headers["Authorization"] = `Bearer ${this.authToken}`;
+SettingsManager.globalDebugState = void 0;
+
+// ../mcp-utils/dist/telemetry.js
+import machineIdPkg from "node-machine-id";
+import { createHash as createHash2 } from "crypto";
+var { machineIdSync } = machineIdPkg;
+var machineId = null;
+var hashedMachineId = null;
+var transportType = "stdio";
+function setTransportType(type) {
+  transportType = type;
+}
+function isTelemetryDisabled() {
+  return process.env.TELEMETRY_DISABLED === "true" || process.env.TELEMETRY_DISABLED === "1";
+}
+function getTelemetryUrl() {
+  return process.env.TELEMETRY_URL || "https://metrics.security.ai.checkpoint.com/api/v1/metrics/collect";
+}
+function hashString(input) {
+  return createHash2("sha256").update(input).digest("hex");
+}
+function getMachineId() {
+  if (!machineId) {
+    try {
+      machineId = machineIdSync();
+    } catch (error) {
+      console.warn("Failed to get machine ID for telemetry:", error);
+      machineId = "unknown";
     }
-    return headers;
   }
-};
-var OnPremAPIClient = class extends APIClientBase {
-  constructor(apiKey, managementHost, managementPort = "443", username, password, domain) {
-    super(apiKey || "");
-    this.managementHost = managementHost;
-    this.managementPort = managementPort;
-    this.domain = domain;
-    this.username = username;
-    this.password = password;
+  return machineId;
+}
+function getHashedMachineId() {
+  if (!hashedMachineId) {
+    hashedMachineId = hashString(getMachineId());
   }
-  getHost() {
-    const managementHost = this.managementHost;
-    const port = this.managementPort;
-    return `https://${managementHost}:${port}/web_api`;
+  return hashedMachineId;
+}
+function calculateChecksum(mcpName, toolName, machineId2, clientVersion) {
+  const data = mcpName + machineId2.slice(0, 16) + toolName + clientVersion;
+  return hashString(data);
+}
+async function trackToolCall(mcpName, toolName, clientVersion, extra) {
+  if (isTelemetryDisabled()) {
+    return;
   }
-  /**
-  * Override login() to support both api-key and username/password authentication
-  * and allow self-signed certificates
-  */
-  async login() {
-    if (this._externalSid) {
-      if (!this.sid)
-        throw new Error("External SID has expired");
-      return this.sid;
-    }
-    const isUsingApiKey = !!this.authToken;
-    const isUsingCredentials = !!(this.username && this.password);
-    if (!isUsingApiKey && !isUsingCredentials) {
-      throw new ClientResponse(401, { message: "Authentication failed: No API key or username/password provided" });
-    }
-    const httpsAgent = new https.Agent({ rejectUnauthorized: false });
-    const loginPayload = isUsingApiKey ? { "api-key": this.authToken } : { "user": this.username, "password": this.password };
-    if (this.domain) {
-      loginPayload["domain"] = this.domain;
-    }
-    const loginResp = await this.makeRequest(this.getHost(), "POST", "login", loginPayload, { "Content-Type": "application/json" }, null, httpsAgent);
-    if (loginResp.status !== 200 || !loginResp.response || !loginResp.response.sid) {
-      throw loginResp;
-    }
-    this.sid = loginResp.response.sid;
-    this.sessionTimeout = loginResp.response["session-timeout"] || null;
-    this.sessionStart = Date.now();
-    if (loginResp.response.uid) {
-      await this.detectMDS(loginResp.response.uid, true);
-    }
-    return loginResp.response.sid;
+  try {
+    const machineId2 = getHashedMachineId();
+    const checksum = calculateChecksum(mcpName, toolName, machineId2, clientVersion);
+    fetch(getTelemetryUrl(), {
+      method: "POST",
+      headers: { "Content-Type": "application/json" },
+      body: JSON.stringify({
+        mcp_name: mcpName,
+        tool_name: toolName,
+        machine_id: machineId2,
+        client_version: clientVersion,
+        transport_type: transportType,
+        checksum
+      })
+    }).catch(() => {
+    });
+  } catch (error) {
   }
-};
-
-// ../infra/dist/string-utils.js
-function nullOrEmpty(val) {
-  return val === void 0 || val === null || typeof val === "string" && (val.trim() === "" || val === "undefined" || val === "null");
 }
-function sanitizeData(kwargs) {
-  const data = {};
-  for (const [key, value] of Object.entries(kwargs)) {
-    if (value === null || value === void 0 || value === "" || Array.isArray(value) && value.length === 0) {
+
+// ../mcp-utils/dist/launcher.js
+function mirrorBooleanFlagsToEnv(config, options) {
+  for (const option of config.options) {
+    if (option.type !== "boolean" || !option.env)
       continue;
+    const derived = optionKey(option.flag);
+    if (!derived)
+      continue;
+    if (derived.negated) {
+      throw new Error(`Option '${option.flag}' in the configuration for '${config.name}' is a negatable flag paired with env var '${option.env}', which cannot be mirrored automatically: commander keys it as '${derived.key}' and inverts its meaning, so whether the flag being present should set '${option.env}' to 'true' or 'false' depends on how that variable is named. Mirror it explicitly in launchMCPServer instead, the way --no-telemetry does for TELEMETRY_DISABLED.`);
+    }
+    if (options[derived.key] === true) {
+      process.env[option.env] = "true";
     }
-    const safeKey = key.replace(/_/g, "-");
-    data[safeKey] = value;
-  }
-  return data;
-}
-
-// ../mcp-utils/dist/cli-options.js
-function booleanOptionDefault(envValue, optionDefault) {
-  return envValue === "true" || optionDefault === "true";
-}
-
-// ../mcp-utils/dist/launcher.js
-import { Command } from "commander";
-import { StdioServerTransport } from "@modelcontextprotocol/sdk/server/stdio.js";
-import { StreamableHTTPServerTransport } from "@modelcontextprotocol/sdk/server/streamableHttp.js";
-import fs from "fs";
-import http from "http";
-import { randomUUID } from "crypto";
-
-// ../mcp-utils/dist/settings-manager.js
-var SettingsManager = class _SettingsManager {
-  /**
-   * Creates a new SettingsManager
-   * @param settingsClass The Settings class to use for creating settings instances
-   */
-  constructor(settingsClass) {
-    this.settingsMap = /* @__PURE__ */ new Map();
-    this.defaultSessionId = "default";
-    this.settingsClass = settingsClass;
-  }
-  /**
-   * Get settings for a specific session
-   * @param sessionId The session ID (defaults to 'default' for stdio mode)
-   * @returns Settings instance for the session
-   */
-  getSettings(sessionId) {
-    const sid = sessionId || this.defaultSessionId;
-    if (!this.settingsMap.has(sid)) {
-      this.settingsMap.set(sid, new this.settingsClass());
-    }
-    return this.settingsMap.get(sid);
-  }
-  /**
-   * Set settings for a specific session
-   * @param settings The settings object to set
-   * @param sessionId The session ID (defaults to 'default' for stdio mode)
-   */
-  setSettings(settings, sessionId) {
-    const sid = sessionId || this.defaultSessionId;
-    this.settingsMap.set(sid, settings);
-  }
-  /**
-   * Injects debug settings from source into settings object
-   * @param settings The settings object to update
-   * @param source Source object containing debug information
-   * @private
-   */
-  injectDebug(settings, source) {
-    const debug = source?.debug ?? _SettingsManager.globalDebugState ?? process.env.DEBUG;
-    if (typeof debug !== "undefined") {
-      if (source?.debug !== void 0) {
-        _SettingsManager.globalDebugState = source.debug;
-      }
-      if (typeof settings.set === "function") {
-        settings.set("debug", debug);
-      } else {
-        settings.debug = debug;
-      }
-      if (debug) {
-        console.error("Debug enabled. Source object contents:");
-        console.error(JSON.stringify(source, null, 2));
-      }
-    }
-  }
-  /**
-   * Print settings object for debugging by dynamically discovering its properties
-   * @param settings The settings object to print
-   * @private
-   */
-  printSettingsDebug(settings) {
-    if (typeof settings.get === "function") {
-      console.error("Settings (using get method):");
-      if (settings.data && typeof settings.data === "object") {
-        Object.entries(settings.data).forEach(([key, value]) => {
-          console.error(`  ${key}: ${JSON.stringify(value)}`);
-        });
-      } else {
-        console.error("  Unable to enumerate settings properties - no accessible data structure");
-      }
-    } else {
-      console.error("Settings (plain object):");
-      Object.entries(settings).forEach(([key, value]) => {
-        console.error(`  ${key}: ${JSON.stringify(value)}`);
-      });
-    }
-  }
-  /**
-   * Create settings from command-line arguments
-   * @param args Command line arguments
-   * @param sessionId Optional session ID
-   * @returns Settings instance
-   */
-  createFromArgs(args, sessionId) {
-    const settings = this.settingsClass.fromArgs(args);
-    this.injectDebug(settings, args);
-    this.setSettings(settings, sessionId);
-    return settings;
-  }
-  /**
-   * Create settings from HTTP headers
-   * @param headers HTTP headers
-   * @param sessionId Optional session ID
-   * @returns Settings instance
-   */
-  createFromHeaders(headers, sessionId) {
-    const verbose = _SettingsManager.globalDebugState;
-    if (verbose) {
-      console.error("[SettingsManager.createFromHeaders] Verbose: Starting with sessionId:", sessionId || "(default)");
-      console.error("[SettingsManager.createFromHeaders] Verbose: Incoming headers count:", Object.keys(headers).length);
-    }
-    if (_SettingsManager.globalDebugState) {
-      console.error("=== createFromHeaders Debug Info ===");
-      console.error("Incoming headers:");
-      console.error(JSON.stringify(headers, null, 2));
-    }
-    if (verbose && (!headers || Object.keys(headers).length === 0)) {
-      console.error("[SettingsManager.createFromHeaders] Verbose: WARNING - Headers object is empty or undefined");
-    }
-    const normalizedHeaders = {};
-    for (const [key, value] of Object.entries(headers)) {
-      const normalizedKey = key.includes("_") ? key.replace(/_/g, "-") : key;
-      normalizedHeaders[normalizedKey] = value;
-      if (verbose) {
-        console.error(`[SettingsManager.createFromHeaders] Verbose: Header normalized: "${key}" -> "${normalizedKey}"`);
-      }
-    }
-    if (verbose) {
-      console.error("[SettingsManager.createFromHeaders] Verbose: Normalized headers count:", Object.keys(normalizedHeaders).length);
-    }
-    if (_SettingsManager.globalDebugState) {
-      console.error("Normalized headers:");
-      console.error(JSON.stringify(normalizedHeaders, null, 2));
-    }
-    const debugHeader = normalizedHeaders["debug"] || normalizedHeaders["Debug"] || normalizedHeaders["DEBUG"];
-    const debugSource = { debug: debugHeader !== void 0 ? debugHeader : _SettingsManager.globalDebugState };
-    if (verbose) {
-      console.error("[SettingsManager.createFromHeaders] Verbose: Calling settingsClass.fromHeaders");
-    }
-    const settings = this.settingsClass.fromHeaders(normalizedHeaders);
-    if (verbose) {
-      console.error("[SettingsManager.createFromHeaders] Verbose: Settings object created");
-    }
-    this.injectDebug(settings, debugSource);
-    if (_SettingsManager.globalDebugState) {
-      console.error("Final settings object for session:", sessionId || "(default)");
-      this.printSettingsDebug(settings);
-      console.error("=== End createFromHeaders Debug Info ===");
-    }
-    if (verbose) {
-      console.error("[SettingsManager.createFromHeaders] Verbose: Storing settings for session:", sessionId || "(default)");
-    }
-    this.setSettings(settings, sessionId);
-    return settings;
-  }
-  /**
-   * Clear settings for a session
-   * @param sessionId The session ID to clear
-   */
-  clearSession(sessionId) {
-    if (sessionId !== this.defaultSessionId) {
-      this.settingsMap.delete(sessionId);
-    }
-  }
-};
-SettingsManager.globalDebugState = void 0;
-
-// ../mcp-utils/dist/telemetry.js
-import machineIdPkg from "node-machine-id";
-import { createHash } from "crypto";
-var { machineIdSync } = machineIdPkg;
-var machineId = null;
-var hashedMachineId = null;
-var transportType = "stdio";
-function setTransportType(type) {
-  transportType = type;
-}
-function isTelemetryDisabled() {
-  return process.env.TELEMETRY_DISABLED === "true" || process.env.TELEMETRY_DISABLED === "1";
-}
-function getTelemetryUrl() {
-  return process.env.TELEMETRY_URL || "https://metrics.security.ai.checkpoint.com/api/v1/metrics/collect";
-}
-function hashString(input) {
-  return createHash("sha256").update(input).digest("hex");
-}
-function getMachineId() {
-  if (!machineId) {
-    try {
-      machineId = machineIdSync();
-    } catch (error) {
-      console.warn("Failed to get machine ID for telemetry:", error);
-      machineId = "unknown";
-    }
-  }
-  return machineId;
-}
-function getHashedMachineId() {
-  if (!hashedMachineId) {
-    hashedMachineId = hashString(getMachineId());
-  }
-  return hashedMachineId;
-}
-function calculateChecksum(mcpName, toolName, machineId2, clientVersion) {
-  const data = mcpName + machineId2.slice(0, 16) + toolName + clientVersion;
-  return hashString(data);
-}
-async function trackToolCall(mcpName, toolName, clientVersion, extra) {
-  if (isTelemetryDisabled()) {
-    return;
-  }
-  try {
-    const machineId2 = getHashedMachineId();
-    const checksum = calculateChecksum(mcpName, toolName, machineId2, clientVersion);
-    fetch(getTelemetryUrl(), {
-      method: "POST",
-      headers: { "Content-Type": "application/json" },
-      body: JSON.stringify({
-        mcp_name: mcpName,
-        tool_name: toolName,
-        machine_id: machineId2,
-        client_version: clientVersion,
-        transport_type: transportType,
-        checksum
-      })
-    }).catch(() => {
-    });
-  } catch (error) {
-  }
-}
-
-// ../mcp-utils/dist/launcher.js
-function optionKey(flag) {
-  const long = flag.split(/[,\s]+/).find((part) => part.startsWith("--"));
-  if (!long)
-    return void 0;
-  const negated = long.startsWith("--no-");
-  return {
-    key: long.replace(/^--(no-)?/, "").replace(/-([a-z])/g, (_match, char) => char.toUpperCase()),
-    negated
-  };
-}
-function mirrorBooleanFlagsToEnv(config, options) {
-  for (const option of config.options) {
-    if (option.type !== "boolean" || !option.env)
-      continue;
-    const derived = optionKey(option.flag);
-    if (!derived)
-      continue;
-    if (derived.negated) {
-      throw new Error(`Option '${option.flag}' in the configuration for '${config.name}' is a negatable flag paired with env var '${option.env}', which cannot be mirrored automatically: commander keys it as '${derived.key}' and inverts its meaning, so whether the flag being present should set '${option.env}' to 'true' or 'false' depends on how that variable is named. Mirror it explicitly in launchMCPServer instead, the way --no-telemetry does for TELEMETRY_DISABLED.`);
-    }
-    if (options[derived.key] === true) {
-      process.env[option.env] = "true";
-    }
   }
 }
 async function launchMCPServer(configPath, serverModule2) {
@@ -1901,17 +1752,23 @@ async function launchMCPServer(configPath, serverModule2) {
     process.env.TELEMETRY_URL = options.telemetryUrl;
   }
   mirrorBooleanFlagsToEnv(config, options);
+  const transportType2 = resolveTransportType(options.transport);
+  process.env.MCP_TRANSPORT_TYPE = transportType2;
   if (!serverModule2.settingsManager) {
     throw new Error("ServerModule must have a settingsManager. Create it with createServerModule.");
   }
   const settings = serverModule2.settingsManager.createFromArgs(options);
+  serverModule2.settingsManager.setOperatorValues?.(operatorValues(config.options, options));
   if (typeof serverModule2.server.applyToolPolicy === "function") {
     console.error("[launchMCPServer] Applying tool policy before connecting");
     serverModule2.server.applyToolPolicy();
   }
-  const transportType2 = (options.transport || process.env.MCP_TRANSPORT_TYPE || "stdio").toLowerCase() === "http" ? "http" : "stdio";
   const transportPort = options.transportPort ? parseInt(options.transportPort, 10) : process.env.MCP_TRANSPORT_PORT ? parseInt(process.env.MCP_TRANSPORT_PORT, 10) : 3e3;
   if (transportType2 === "http") {
+    const refusal = serverModule2.httpStartupCheck?.();
+    if (refusal) {
+      throw new Error(refusal);
+    }
     setTransportType("http");
     await launchHTTPServer(config, serverModule2, transportPort);
   } else {
@@ -1960,7 +1817,7 @@ async function launchHTTPServer(config, serverModule2, port) {
           if (sessionId && transports[sessionId]) {
             const verbose = SettingsManager.globalDebugState;
             if (verbose) {
-              console.error("[launchHTTPServer] Verbose: Reusing existing transport for session:", sessionId);
+              console.error("[launchHTTPServer] Verbose: Reusing existing transport for session:", sessionLogLabel(sessionId));
             }
             transport = transports[sessionId];
             if (!serverModule2.settingsManager) {
@@ -1980,7 +1837,7 @@ async function launchHTTPServer(config, serverModule2, port) {
               onsessioninitialized: (sid) => {
                 const verbose = SettingsManager.globalDebugState;
                 if (verbose) {
-                  console.error("[launchHTTPServer] Verbose: New session initialized:", sid);
+                  console.error("[launchHTTPServer] Verbose: New session initialized:", sessionLogLabel(sid));
                 }
                 transports[sid] = transport;
                 if (verbose) {
@@ -2183,7 +2040,6 @@ function headersToEnvVars(headers, config) {
   }
   if (verbose) {
     console.error("[headersToEnvVars] Verbose: Final result keys:", Object.keys(result));
-    console.error("[headersToEnvVars] Verbose: Final result (sanitized):", Object.fromEntries(Object.entries(result).map(([k, v]) => [k, k.toLowerCase().includes("key") || k.toLowerCase().includes("token") || k.toLowerCase().includes("password") ? "***" : v])));
   }
   return result;
 }
@@ -2210,7 +2066,7 @@ var APIManagerFactory = class {
     const verbose = SettingsManager.globalDebugState;
     const sid = sessionId || this.defaultSessionId;
     if (verbose) {
-      console.error("[APIManagerFactory.getAPIManager] Verbose: Getting API manager for session:", sid);
+      console.error("[APIManagerFactory.getAPIManager] Verbose: Getting API manager for session:", sessionLogLabel(sid));
     }
     if (!this.apiManagerMap.has(sid)) {
       if (verbose) {
@@ -2308,16 +2164,15 @@ var SessionContext = class {
   /**
    * Get the current session ID from the MCP extra context
    * @param extra Extra context passed to MCP tool callbacks
-   * @returns The session ID or DEFAULT_SESSION_ID if not available
+   * @returns The session ID, or DEFAULT_SESSION_ID under stdio
+   * @throws Under HTTP transport when the context carries no session ID
    */
   static getSessionId(extra) {
-    if (!extra)
-      return this.DEFAULT_SESSION_ID;
-    if (extra.transport && extra.transport.sessionId) {
-      return extra.transport.sessionId;
-    }
-    if (extra.sessionId) {
-      return extra.sessionId;
+    const sessionId = extra?.transport?.sessionId || extra?.sessionId;
+    if (sessionId)
+      return sessionId;
+    if (process.env.MCP_TRANSPORT_TYPE === "http") {
+      throw new Error("No MCP session in this request context; HTTP transport requires one");
     }
     return this.DEFAULT_SESSION_ID;
   }
@@ -2434,10 +2289,10 @@ var SessionContext = class {
           }
         }
       }
-      console.error(`Using cached user data for session: ${sessionId}, key: ${options.cacheKey}`);
+      console.error(`Using cached user data for ${sessionLogLabel(sessionId)}, key: ${options.cacheKey}`);
       return { cancelled: false, data: dataToReturn2 };
     }
-    console.error(`Prompting user for data for session: ${sessionId}, key: ${options.cacheKey}`);
+    console.error(`Prompting user for data for ${sessionLogLabel(sessionId)}, key: ${options.cacheKey}`);
     let result;
     if (options.showLoginDialog) {
       const { showLoginDialog: showLoginDialog2 } = await Promise.resolve().then(() => (init_ui_dialog(), ui_dialog_exports));
@@ -2478,338 +2333,691 @@ var SessionContext = class {
         }
       }
     }
-    return { cancelled: false, data: dataToReturn };
+    return { cancelled: false, data: dataToReturn };
+  }
+  /**
+   * Clear cached user data for a specific key
+   * @param cacheKey The cache key to clear
+   * @param extra Extra context with session information
+   */
+  static clearUserData(cacheKey, extra) {
+    const sessionId = this.getSessionId(extra);
+    if (this.sessionData.has(sessionId)) {
+      const sessionInfo = this.sessionData.get(sessionId);
+      sessionInfo.data.delete(cacheKey);
+      sessionInfo.lastAccessed = Date.now();
+    }
+  }
+  /**
+   * Check if user data exists and is not expired
+   * @param cacheKey The cache key to check
+   * @param extra Extra context with session information
+   * @returns true if valid cached data exists, false otherwise
+   */
+  static hasValidUserData(cacheKey, extra) {
+    const cachedData = this.getData(cacheKey, extra);
+    if (!cachedData || !cachedData.expiresAt) {
+      return false;
+    }
+    return Date.now() < cachedData.expiresAt;
+  }
+};
+_a = SessionContext;
+SessionContext.DEFAULT_SESSION_ID = "default";
+SessionContext.sessionData = /* @__PURE__ */ new Map();
+SessionContext.SESSION_TIMEOUT_MS = 24 * 60 * 60 * 1e3;
+SessionContext.CLEANUP_INTERVAL_MS = 60 * 60 * 1e3;
+SessionContext.MAX_SESSIONS = 1e3;
+SessionContext.cleanupTimer = null;
+(() => {
+  _a.startCleanupTimer();
+})();
+
+// ../mcp-utils/dist/session-manager.js
+var DEFAULT_SESSION_TIMEOUT_MS = 15 * 60 * 1e3;
+var SessionManager = class {
+  constructor() {
+    this.sessions = /* @__PURE__ */ new Map();
+  }
+  /**
+   * Create a new session
+   * @param sessionId The session ID
+   * @param metadata Optional metadata to store with the session
+   * @returns Session info
+   */
+  createSession(sessionId, metadata = {}) {
+    const now = /* @__PURE__ */ new Date();
+    const sessionInfo = {
+      sessionId,
+      createdAt: now,
+      lastActive: now,
+      ...metadata
+    };
+    this.sessions.set(sessionId, sessionInfo);
+    return sessionInfo;
+  }
+  /**
+   * Get info for a session
+   * @param sessionId The session ID
+   * @returns Session info or undefined if not found
+   */
+  getSession(sessionId) {
+    if (this.sessions.has(sessionId)) {
+      this.touchSession(sessionId);
+    }
+    return this.sessions.get(sessionId);
+  }
+  /**
+   * Update session activity timestamp
+   * @param sessionId The session ID
+   */
+  touchSession(sessionId) {
+    const session = this.sessions.get(sessionId);
+    if (session) {
+      session.lastActive = /* @__PURE__ */ new Date();
+    }
+  }
+  /**
+   * Remove a session
+   * @param sessionId The session ID
+   */
+  removeSession(sessionId) {
+    this.sessions.delete(sessionId);
+    SessionContext.clearSessionData(sessionId);
+  }
+  /**
+   * Get all active sessions
+   * @returns Array of session info objects
+   */
+  getAllSessions() {
+    return Array.from(this.sessions.values());
+  }
+  /**
+   * Get count of active sessions
+   * @returns Number of active sessions
+   */
+  getSessionCount() {
+    return this.sessions.size;
+  }
+  /**
+   * Clean up inactive sessions older than the specified timeout
+   * @param timeoutMs Timeout in milliseconds (default: 30 minutes)
+   * @returns Number of sessions removed
+   */
+  cleanupInactiveSessions(timeoutMs = DEFAULT_SESSION_TIMEOUT_MS) {
+    const now = /* @__PURE__ */ new Date();
+    let removedCount = 0;
+    for (const [sessionId, session] of this.sessions.entries()) {
+      const inactiveTime = now.getTime() - session.lastActive.getTime();
+      if (inactiveTime > timeoutMs) {
+        this.removeSession(sessionId);
+        removedCount++;
+      }
+    }
+    return removedCount;
+  }
+};
+
+// ../mcp-utils/dist/server-utils.js
+function getHeaderValue(headers, key) {
+  const normalizedKey = key.replace(/_/g, "-");
+  const value = headers[normalizedKey] || headers[normalizedKey.toUpperCase()] || headers[normalizedKey.toLowerCase()];
+  return typeof value === "string" ? value : Array.isArray(value) ? value[0] : void 0;
+}
+function createApiRunner(serverModule2) {
+  return async (method, uri, data, extra, domain) => {
+    const apiManager = SessionContext.getAPIManager(serverModule2, extra);
+    return await apiManager.callApi(method, uri, data, domain);
+  };
+}
+function wrapServerWithTracking(server2, createServerFn) {
+  const registrations = [];
+  const originalTool = server2.tool?.bind(server2);
+  const originalPrompt = server2.prompt?.bind(server2);
+  const originalResource = server2.resource?.bind(server2);
+  if (originalTool) {
+    server2.tool = function(...args) {
+      registrations.push({ type: "tool", method: "tool", args: [...args] });
+      return originalTool(...args);
+    };
+  }
+  if (originalPrompt) {
+    server2.prompt = function(...args) {
+      registrations.push({ type: "prompt", method: "prompt", args: [...args] });
+      return originalPrompt(...args);
+    };
+  }
+  if (originalResource) {
+    server2.resource = function(...args) {
+      registrations.push({ type: "resource", method: "resource", args: [...args] });
+      return originalResource(...args);
+    };
+  }
+  const createInstance = () => {
+    const newServer = createServerFn();
+    for (const reg of registrations) {
+      if (newServer[reg.method]) {
+        newServer[reg.method](...reg.args);
+      }
+    }
+    const toolPolicy = typeof server2.getToolPolicy === "function" ? server2.getToolPolicy() : void 0;
+    if (toolPolicy && typeof newServer.setToolPolicy === "function") {
+      newServer.setToolPolicy(toolPolicy);
+      if (typeof newServer.applyToolPolicy === "function") {
+        newServer.applyToolPolicy();
+      }
+    }
+    return newServer;
+  };
+  return { wrappedServer: server2, createInstance };
+}
+function createServerModule(server2, Settings2, pkg2, apiManagerClass, toolPolicyCallback, createServerFn) {
+  const settingsManager = new SettingsManager(Settings2);
+  const apiManagerFactory = new APIManagerFactory(apiManagerClass, settingsManager);
+  const sessionManager = new SessionManager();
+  if (toolPolicyCallback && typeof server2.setToolPolicy === "function") {
+    console.error("[createServerModule] Setting tool policy callback on server");
+    server2.setToolPolicy(toolPolicyCallback);
+  }
+  const serverFactory = createServerFn || server2._createServerFn;
+  let createServerInstance;
+  if (serverFactory) {
+    const { wrappedServer, createInstance } = wrapServerWithTracking(server2, serverFactory);
+    createServerInstance = createInstance;
+    console.error("[createServerModule] Server factory enabled - HTTP multi-user support active");
+  } else {
+    console.error("[createServerModule] Warning: No server factory provided - HTTP multi-user may have issues");
+  }
+  return {
+    server: server2,
+    Settings: Settings2,
+    settingsManager,
+    apiManagerFactory,
+    sessionManager,
+    pkg: pkg2,
+    toolPolicyCallback,
+    createServerInstance
+  };
+}
+
+// ../mcp-utils/dist/index.js
+init_ui_dialog();
+
+// ../mcp-utils/dist/mcp-server.js
+import { McpServer } from "@modelcontextprotocol/sdk/server/mcp.js";
+var CPMcpServer = class extends McpServer {
+  constructor(serverInfo, options) {
+    super(serverInfo, options);
+    this.mcpName = serverInfo.name;
+    this.mcpVersion = serverInfo.version || "0.0.0";
+  }
+  /**
+   * Set a tool policy callback to filter which tools are available
+   * This should be called after all tools are registered but before connecting
+   * @param callback Function that returns true if a tool should be enabled
+   */
+  setToolPolicy(callback) {
+    console.error("[CPMcpServer] Setting tool policy callback");
+    this.toolPolicyCallback = callback;
+  }
+  /**
+   * Get the tool policy callback, if one was set.
+   *
+   * Needed so the policy can be carried onto the per-session server instances
+   * created for HTTP transport. A typed accessor keeps that transfer honest:
+   * callers do not have to reach into the private field, where a misspelling
+   * would go unnoticed by the compiler.
+   */
+  getToolPolicy() {
+    return this.toolPolicyCallback;
+  }
+  /**
+   * Apply the tool policy by checking all registered tools
+   * This should be called after all tools are registered but before connecting
+   *
+   * Per-tool tracing is behind the debug flag. This used to run once per process
+   * on the template server, where a line per tool was a cheap startup banner.
+   * It now also runs per session under HTTP transport, so unconditional tracing
+   * would scale stderr with sessions x tools and bury the summary. The summary
+   * line always prints — it is the fact worth having for every session.
+   */
+  applyToolPolicy() {
+    const verbose = SettingsManager.globalDebugState === true || SettingsManager.globalDebugState === "true";
+    if (!this.toolPolicyCallback) {
+      if (verbose) {
+        console.error("[CPMcpServer] No tool policy callback set, allowing all tools");
+      }
+      return;
+    }
+    const registeredTools = this._registeredTools;
+    if (!registeredTools || typeof registeredTools !== "object") {
+      console.error("[CPMcpServer] No tools registered yet");
+      return;
+    }
+    const toolNames = Object.keys(registeredTools);
+    if (verbose) {
+      console.error(`[CPMcpServer] Applying tool policy`);
+      console.error(`[CPMcpServer] Found ${toolNames.length} registered tools:`, toolNames);
+    }
+    let enabledCount = 0;
+    let disabledCount = 0;
+    for (const [toolName, tool] of Object.entries(registeredTools)) {
+      const isAllowed = this.toolPolicyCallback(toolName);
+      if (!isAllowed) {
+        if (verbose) {
+          console.error(`[CPMcpServer] Tool '${toolName}' is NOT allowed by policy - disabling`);
+        }
+        if (typeof tool.disable === "function") {
+          tool.disable();
+          disabledCount++;
+        }
+      } else {
+        if (verbose) {
+          console.error(`[CPMcpServer] Tool '${toolName}' is allowed by policy`);
+        }
+        enabledCount++;
+      }
+    }
+    console.error(`[CPMcpServer] Policy applied: ${enabledCount}/${toolNames.length} tools enabled, ${disabledCount} disabled`);
+  }
+  // Override the tool method to wrap callbacks with telemetry
+  tool(...args) {
+    const callback = args[args.length - 1];
+    if (typeof callback === "function") {
+      const toolName = args[0];
+      const wrappedCallback = async (...callbackArgs) => {
+        let extra = callbackArgs[1];
+        if (!extra && callbackArgs[0]?.sessionId) {
+          extra = callbackArgs[0];
+        }
+        trackToolCall(this.mcpName, toolName, this.mcpVersion, extra).catch(() => {
+        });
+        if (callbackArgs.length === 1 && callbackArgs[0]?.sessionId) {
+          return callback({}, callbackArgs[0]);
+        }
+        return callback(...callbackArgs);
+      };
+      args[args.length - 1] = wrappedCallback;
+    }
+    return super.tool(...args);
+  }
+};
+
+// ../mcp-utils/dist/package-utils.js
+import { readFileSync } from "fs";
+import { join as join2, dirname } from "path";
+import { fileURLToPath } from "url";
+function readPackageJson(importMetaUrl) {
+  const pkg2 = JSON.parse(readFileSync(join2(dirname(fileURLToPath(importMetaUrl)), "../package.json"), "utf-8"));
+  process.env.CP_MCP_MAIN_PKG = `${pkg2.name} v${pkg2.version}`;
+  return pkg2;
+}
+function createMcpServer(importMetaUrl, serverInfo, options) {
+  const pkg2 = readPackageJson(importMetaUrl);
+  const fullServerInfo = {
+    ...serverInfo,
+    name: serverInfo.name || pkg2.name,
+    version: serverInfo.version || pkg2.version
+  };
+  const createServerFn = () => {
+    return new CPMcpServer(fullServerInfo, options);
+  };
+  const server2 = new CPMcpServer(fullServerInfo, options);
+  server2._createServerFn = createServerFn;
+  return { server: server2, pkg: pkg2 };
+}
+
+// ../infra/dist/api-client.js
+var DEBUG_LOGGABLE_REQUEST_KEYS = debugLoggableKeys([
+  "details-level",
+  "domain",
+  "filter",
+  "layer",
+  "limit",
+  "name",
+  "offset",
+  "order",
+  "package",
+  "show-membership",
+  "targets",
+  "task-id",
+  "type",
+  "uid",
+  "use-object-dictionary"
+]);
+var TokenType;
+(function(TokenType2) {
+  TokenType2["API_KEY"] = "API_KEY";
+  TokenType2["CI_TOKEN"] = "CI_TOKEN";
+})(TokenType || (TokenType = {}));
+function getMainPackageUserAgent() {
+  if (process.env.CP_MCP_MAIN_PKG) {
+    if (process.env.CP_MCP_MAIN_PKG.includes("quantum-management-mcp")) {
+      return "mgmt-mcp";
+    }
+  }
+  return "Check Point MCP API Client";
+}
+var ClientResponse = class {
+  constructor(status, response) {
+    this.status = status;
+    this.response = response;
+  }
+};
+var APIClientBase = class {
+  constructor(authToken = "", tokenType = TokenType.API_KEY, cloudConnected = false) {
+    this.authToken = authToken;
+    this.tokenType = tokenType;
+    this.cloudConnected = cloudConnected;
+    this.sid = null;
+    this.sessionTimeout = null;
+    this.sessionStart = null;
+    this.isMDS = false;
+    this._externalSid = false;
+  }
+  /**
+  * Create an API client instance - generic method for creating clients
+  */
+  static create(...args) {
+    return new this(...args);
+  }
+  /**
+   * Get headers for the API requests
+   */
+  getHeaders() {
+    const headers = {
+      "Content-Type": "application/json",
+      "User-Agent": getMainPackageUserAgent()
+    };
+    if (this.sid) {
+      headers["X-chkp-sid"] = this.sid;
+    }
+    if (this.cloudConnected && this.tokenType === TokenType.CI_TOKEN) {
+      headers["Authorization"] = `Bearer ${this.authToken}`;
+      headers["CLOUD-INFRA-TOKEN"] = this.authToken;
+    }
+    return headers;
   }
   /**
-   * Clear cached user data for a specific key
-   * @param cacheKey The cache key to clear
-   * @param extra Extra context with session information
+   * Get debug mode
    */
-  static clearUserData(cacheKey, extra) {
-    const sessionId = this.getSessionId(extra);
-    if (this.sessionData.has(sessionId)) {
-      const sessionInfo = this.sessionData.get(sessionId);
-      sessionInfo.data.delete(cacheKey);
-      sessionInfo.lastAccessed = Date.now();
-    }
+  get debug() {
+    return !!this._debug;
   }
   /**
-   * Check if user data exists and is not expired
-   * @param cacheKey The cache key to check
-   * @param extra Extra context with session information
-   * @returns true if valid cached data exists, false otherwise
+   * Set debug mode
    */
-  static hasValidUserData(cacheKey, extra) {
-    const cachedData = this.getData(cacheKey, extra);
-    if (!cachedData || !cachedData.expiresAt) {
-      return false;
-    }
-    return Date.now() < cachedData.expiresAt;
-  }
-};
-_a = SessionContext;
-SessionContext.DEFAULT_SESSION_ID = "default";
-SessionContext.sessionData = /* @__PURE__ */ new Map();
-SessionContext.SESSION_TIMEOUT_MS = 24 * 60 * 60 * 1e3;
-SessionContext.CLEANUP_INTERVAL_MS = 60 * 60 * 1e3;
-SessionContext.MAX_SESSIONS = 1e3;
-SessionContext.cleanupTimer = null;
-(() => {
-  _a.startCleanupTimer();
-})();
-
-// ../mcp-utils/dist/session-manager.js
-var DEFAULT_SESSION_TIMEOUT_MS = 15 * 60 * 1e3;
-var SessionManager = class {
-  constructor() {
-    this.sessions = /* @__PURE__ */ new Map();
+  set debug(value) {
+    this._debug = value;
   }
   /**
-   * Create a new session
-   * @param sessionId The session ID
-   * @param metadata Optional metadata to store with the session
-   * @returns Session info
-   */
-  createSession(sessionId, metadata = {}) {
-    const now = /* @__PURE__ */ new Date();
-    const sessionInfo = {
-      sessionId,
-      createdAt: now,
-      lastActive: now,
-      ...metadata
-    };
-    this.sessions.set(sessionId, sessionInfo);
-    return sessionInfo;
+    * Set a pre-authenticated session ID provided externally (e.g. via X-chkp-sid header).
+    * When set, the client will skip login and use this SID directly for all requests.
+    */
+  setExternalSid(sid) {
+    this.sid = sid;
+    this._externalSid = true;
+    this.sessionStart = Date.now();
+    this.sessionTimeout = Number.MAX_SAFE_INTEGER / 1e3;
   }
   /**
-   * Get info for a session
-   * @param sessionId The session ID
-   * @returns Session info or undefined if not found
+   * Check if this client needs to perform login before making API calls
    */
-  getSession(sessionId) {
-    if (this.sessions.has(sessionId)) {
-      this.touchSession(sessionId);
+  needsLogin() {
+    if (this._externalSid) {
+      return false;
     }
-    return this.sessions.get(sessionId);
+    return true;
   }
   /**
-   * Update session activity timestamp
-   * @param sessionId The session ID
+   * Check if this client is in an MDS environment
    */
-  touchSession(sessionId) {
-    const session = this.sessions.get(sessionId);
-    if (session) {
-      session.lastActive = /* @__PURE__ */ new Date();
+  async isMDSEnvironment() {
+    if (!this.hasValidSession()) {
+      await this.login();
     }
+    return this.isMDS;
   }
   /**
-   * Remove a session
-   * @param sessionId The session ID
+   * Check if the client has a valid session
    */
-  removeSession(sessionId) {
-    this.sessions.delete(sessionId);
-    SessionContext.clearSessionData(sessionId);
+  hasValidSession() {
+    return !!this.sid && !this.isSessionExpired();
   }
   /**
-   * Get all active sessions
-   * @returns Array of session info objects
+   * Get the current session ID (for debugging/logging purposes)
    */
-  getAllSessions() {
-    return Array.from(this.sessions.values());
+  getSessionId() {
+    return this.sid;
   }
   /**
-   * Get count of active sessions
-   * @returns Number of active sessions
+   * Create a new API client instance with a specific session ID
+   * Used for domain-specific clients in MDS environments
    */
-  getSessionCount() {
-    return this.sessions.size;
+  static createWithSid(originalClient, sid) {
+    const newClient = Object.create(Object.getPrototypeOf(originalClient));
+    Object.assign(newClient, originalClient);
+    newClient.sid = sid;
+    newClient.sessionStart = Date.now();
+    return newClient;
   }
   /**
-   * Clean up inactive sessions older than the specified timeout
-   * @param timeoutMs Timeout in milliseconds (default: 30 minutes)
-   * @returns Number of sessions removed
+   * Call an API endpoint
    */
-  cleanupInactiveSessions(timeoutMs = DEFAULT_SESSION_TIMEOUT_MS) {
-    const now = /* @__PURE__ */ new Date();
-    let removedCount = 0;
-    for (const [sessionId, session] of this.sessions.entries()) {
-      const inactiveTime = now.getTime() - session.lastActive.getTime();
-      if (inactiveTime > timeoutMs) {
-        this.removeSession(sessionId);
-        removedCount++;
-      }
-    }
-    return removedCount;
-  }
-};
-
-// ../mcp-utils/dist/server-utils.js
-function getHeaderValue(headers, key) {
-  const normalizedKey = key.replace(/_/g, "-");
-  const value = headers[normalizedKey] || headers[normalizedKey.toUpperCase()] || headers[normalizedKey.toLowerCase()];
-  return typeof value === "string" ? value : Array.isArray(value) ? value[0] : void 0;
-}
-function createApiRunner(serverModule2) {
-  return async (method, uri, data, extra, domain) => {
-    const apiManager = SessionContext.getAPIManager(serverModule2, extra);
-    return await apiManager.callApi(method, uri, data, domain);
-  };
-}
-function wrapServerWithTracking(server2, createServerFn) {
-  const registrations = [];
-  const originalTool = server2.tool?.bind(server2);
-  const originalPrompt = server2.prompt?.bind(server2);
-  const originalResource = server2.resource?.bind(server2);
-  if (originalTool) {
-    server2.tool = function(...args) {
-      registrations.push({ type: "tool", method: "tool", args: [...args] });
-      return originalTool(...args);
-    };
-  }
-  if (originalPrompt) {
-    server2.prompt = function(...args) {
-      registrations.push({ type: "prompt", method: "prompt", args: [...args] });
-      return originalPrompt(...args);
-    };
-  }
-  if (originalResource) {
-    server2.resource = function(...args) {
-      registrations.push({ type: "resource", method: "resource", args: [...args] });
-      return originalResource(...args);
-    };
-  }
-  const createInstance = () => {
-    const newServer = createServerFn();
-    for (const reg of registrations) {
-      if (newServer[reg.method]) {
-        newServer[reg.method](...reg.args);
+  async callApi(method, uri, data, params) {
+    if (this.needsLogin() && (!this.sid || this.isSessionExpired())) {
+      try {
+        await this.login();
+      } catch (error) {
+        if (error instanceof ClientResponse) {
+          console.error(`Login failed with status ${error.status}:`, error.response);
+          return error;
+        }
+        console.error("Login failed with unexpected error:", error);
+        return new ClientResponse(500, { error: "Authentication failed", message: error.message });
       }
     }
-    const toolPolicy = typeof server2.getToolPolicy === "function" ? server2.getToolPolicy() : void 0;
-    if (toolPolicy && typeof newServer.setToolPolicy === "function") {
-      newServer.setToolPolicy(toolPolicy);
-      if (typeof newServer.applyToolPolicy === "function") {
-        newServer.applyToolPolicy();
-      }
+    let httpsAgent;
+    if (this instanceof OnPremAPIClient) {
+      httpsAgent = new https.Agent({ rejectUnauthorized: false });
+    }
+    try {
+      return await this.makeRequest(this.getHost(), method, uri, data, this.getHeaders(), params, httpsAgent);
+    } catch (error) {
+      if ((error.message?.includes("401") || error.response?.status === 401) && error.message?.toLowerCase().includes("session")) {
+        if (this._externalSid) {
+          throw new Error("Pre-authenticated session (X-chkp-sid) has expired. Provide a new session ID.");
+        }
+        console.error("Session expired (401), resetting session and retrying...");
+        this.sid = null;
+        this.sessionStart = null;
+        try {
+          await this.login();
+        } catch (loginError) {
+          if (loginError instanceof ClientResponse) {
+            console.error(`Login retry failed with status ${loginError.status}:`, loginError.response);
+            return loginError;
+          }
+          console.error("Login retry failed with unexpected error:", loginError);
+          throw loginError;
+        }
+        return await this.makeRequest(this.getHost(), method, uri, data, this.getHeaders(), params, httpsAgent);
+      }
+      throw error;
     }
-    return newServer;
-  };
-  return { wrappedServer: server2, createInstance };
-}
-function createServerModule(server2, Settings2, pkg2, apiManagerClass, toolPolicyCallback, createServerFn) {
-  const settingsManager = new SettingsManager(Settings2);
-  const apiManagerFactory = new APIManagerFactory(apiManagerClass, settingsManager);
-  const sessionManager = new SessionManager();
-  if (toolPolicyCallback && typeof server2.setToolPolicy === "function") {
-    console.error("[createServerModule] Setting tool policy callback on server");
-    server2.setToolPolicy(toolPolicyCallback);
-  }
-  const serverFactory = createServerFn || server2._createServerFn;
-  let createServerInstance;
-  if (serverFactory) {
-    const { wrappedServer, createInstance } = wrapServerWithTracking(server2, serverFactory);
-    createServerInstance = createInstance;
-    console.error("[createServerModule] Server factory enabled - HTTP multi-user support active");
-  } else {
-    console.error("[createServerModule] Warning: No server factory provided - HTTP multi-user may have issues");
-  }
-  return {
-    server: server2,
-    Settings: Settings2,
-    settingsManager,
-    apiManagerFactory,
-    sessionManager,
-    pkg: pkg2,
-    toolPolicyCallback,
-    createServerInstance
-  };
-}
-
-// ../mcp-utils/dist/index.js
-init_ui_dialog();
-
-// ../mcp-utils/dist/mcp-server.js
-import { McpServer } from "@modelcontextprotocol/sdk/server/mcp.js";
-var CPMcpServer = class extends McpServer {
-  constructor(serverInfo, options) {
-    super(serverInfo, options);
-    this.mcpName = serverInfo.name;
-    this.mcpVersion = serverInfo.version || "0.0.0";
   }
   /**
-   * Set a tool policy callback to filter which tools are available
-   * This should be called after all tools are registered but before connecting
-   * @param callback Function that returns true if a tool should be enabled
+   * Check if the session is expired based on sessionTimeout and sessionStart
    */
-  setToolPolicy(callback) {
-    console.error("[CPMcpServer] Setting tool policy callback");
-    this.toolPolicyCallback = callback;
+  isSessionExpired() {
+    if (!this.sid || !this.sessionTimeout || !this.sessionStart)
+      return true;
+    const now = Date.now();
+    return now > this.sessionStart + (this.sessionTimeout - 5) * 1e3;
+  }
+  getHeadersForLogin() {
+    return { "Content-Type": "application/json" };
   }
   /**
-   * Get the tool policy callback, if one was set.
-   *
-   * Needed so the policy can be carried onto the per-session server instances
-   * created for HTTP transport. A typed accessor keeps that transfer honest:
-   * callers do not have to reach into the private field, where a misspelling
-   * would go unnoticed by the compiler.
+   * Login to the API using the API key
    */
-  getToolPolicy() {
-    return this.toolPolicyCallback;
+  async login() {
+    if (this._externalSid) {
+      if (!this.sid)
+        throw new Error("External SID has expired");
+      return this.sid;
+    }
+    const apiTokenHeader = this.tokenType === TokenType.API_KEY ? "api-key" : "ci-token";
+    const loginResp = await this.makeRequest(this.getHost(), "POST", "login", { [apiTokenHeader]: this.authToken }, this.getHeadersForLogin());
+    if (loginResp.status !== 200 || !loginResp.response || !loginResp.response.sid) {
+      throw loginResp;
+    }
+    this.sid = loginResp.response.sid;
+    this.sessionTimeout = loginResp.response["session-timeout"] || null;
+    this.sessionStart = Date.now();
+    if (loginResp.response.uid) {
+      await this.detectMDS(loginResp.response.uid);
+    }
+    return loginResp.response.sid;
   }
   /**
-   * Apply the tool policy by checking all registered tools
-   * This should be called after all tools are registered but before connecting
-   *
-   * Per-tool tracing is behind the debug flag. This used to run once per process
-   * on the template server, where a line per tool was a cheap startup banner.
-   * It now also runs per session under HTTP transport, so unconditional tracing
-   * would scale stderr with sessions x tools and bury the summary. The summary
-   * line always prints — it is the fact worth having for every session.
+   * Detect if this is an MDS environment by checking the session details
    */
-  applyToolPolicy() {
-    const verbose = SettingsManager.globalDebugState === true || SettingsManager.globalDebugState === "true";
-    if (!this.toolPolicyCallback) {
-      if (verbose) {
-        console.error("[CPMcpServer] No tool policy callback set, allowing all tools");
+  async detectMDS(sessionUid, handleSelfSigned = false) {
+    try {
+      let httpsAgent;
+      if (handleSelfSigned) {
+        httpsAgent = new https.Agent({ rejectUnauthorized: false });
       }
-      return;
+      const sessionResp = await this.makeRequest(this.getHost(), "POST", "show-session", { uid: sessionUid }, this.getHeaders(), null, httpsAgent);
+      if (sessionResp.status === 200 && sessionResp.response?.domain?.["domain-type"] === "mds") {
+        this.isMDS = true;
+      }
+    } catch (error) {
+      console.warn("Could not determine MDS status:", error);
+      this.isMDS = false;
     }
-    const registeredTools = this._registeredTools;
-    if (!registeredTools || typeof registeredTools !== "object") {
-      console.error("[CPMcpServer] No tools registered yet");
-      return;
+  }
+  /**
+   * Make a request to a Check Point API
+   */
+  async makeRequest(host, method, uri, data, headers = {}, params = null, httpsAgent) {
+    uri = uri.replace(/^\//, "");
+    const url = `${host}/${uri}`;
+    const config = {
+      method: method.toUpperCase(),
+      url,
+      headers,
+      params: params || void 0
+    };
+    if (httpsAgent) {
+      config.httpsAgent = httpsAgent;
     }
-    const toolNames = Object.keys(registeredTools);
-    if (verbose) {
-      console.error(`[CPMcpServer] Applying tool policy`);
-      console.error(`[CPMcpServer] Found ${toolNames.length} registered tools:`, toolNames);
+    if (method.toUpperCase() !== "GET" && data !== void 0) {
+      config.data = data;
     }
-    let enabledCount = 0;
-    let disabledCount = 0;
-    for (const [toolName, tool] of Object.entries(registeredTools)) {
-      const isAllowed = this.toolPolicyCallback(toolName);
-      if (!isAllowed) {
-        if (verbose) {
-          console.error(`[CPMcpServer] Tool '${toolName}' is NOT allowed by policy - disabling`);
-        }
-        if (typeof tool.disable === "function") {
-          tool.disable();
-          disabledCount++;
-        }
-      } else {
-        if (verbose) {
-          console.error(`[CPMcpServer] Tool '${toolName}' is allowed by policy`);
+    console.error(`API Request: ${method} ${url}`);
+    try {
+      const response = await axios(config);
+      return new ClientResponse(response.status, response.data);
+    } catch (error) {
+      if (error.response) {
+        console.error(`\u274C API Error (${error.response.status}):`);
+        console.error("Headers:", error.response.headers);
+        console.error("Data:", error.response.data);
+        if (this.debug) {
+          console.error("Debug mode: Printing request details:");
+          console.error("Request Method:", method);
+          console.error("Request URL:", url);
+          console.error("Request Headers:", debugView(config.headers));
+          console.error("Request Data:", debugView(config.data && typeof config.data === "object" ? config.data : { body: config.data }, DEBUG_LOGGABLE_REQUEST_KEYS));
         }
-        enabledCount++;
       }
+      if (error.response) {
+        throw new Error(`API request failed: ${error.response.status} - ${JSON.stringify(error.response.data)}`);
+      }
+      throw error;
     }
-    console.error(`[CPMcpServer] Policy applied: ${enabledCount}/${toolNames.length} tools enabled, ${disabledCount} disabled`);
   }
-  // Override the tool method to wrap callbacks with telemetry
-  tool(...args) {
-    const callback = args[args.length - 1];
-    if (typeof callback === "function") {
-      const toolName = args[0];
-      const wrappedCallback = async (...callbackArgs) => {
-        let extra = callbackArgs[1];
-        if (!extra && callbackArgs[0]?.sessionId) {
-          extra = callbackArgs[0];
-        }
-        trackToolCall(this.mcpName, toolName, this.mcpVersion, extra).catch(() => {
-        });
-        if (callbackArgs.length === 1 && callbackArgs[0]?.sessionId) {
-          return callback({}, callbackArgs[0]);
-        }
-        return callback(...callbackArgs);
-      };
-      args[args.length - 1] = wrappedCallback;
+};
+var SmartOneCloudAPIClient = class extends APIClientBase {
+  constructor(authToken, tokenType, s1cUrl, cloudConnected = false) {
+    super(authToken, tokenType, cloudConnected);
+    this.s1cUrl = s1cUrl;
+  }
+  getHost() {
+    return this.s1cUrl;
+  }
+  getHeadersForLogin() {
+    const headers = { "Content-Type": "application/json" };
+    if (this.cloudConnected && this.tokenType === TokenType.CI_TOKEN) {
+      headers["Authorization"] = `Bearer ${this.authToken}`;
     }
-    return super.tool(...args);
+    return headers;
+  }
+};
+var OnPremAPIClient = class extends APIClientBase {
+  constructor(apiKey, managementHost, managementPort = "443", username, password, domain) {
+    super(apiKey || "");
+    this.managementHost = managementHost;
+    this.managementPort = managementPort;
+    this.domain = domain;
+    this.username = username;
+    this.password = password;
+  }
+  getHost() {
+    const managementHost = this.managementHost;
+    const port = this.managementPort;
+    return `https://${managementHost}:${port}/web_api`;
+  }
+  /**
+  * Override login() to support both api-key and username/password authentication
+  * and allow self-signed certificates
+  */
+  async login() {
+    if (this._externalSid) {
+      if (!this.sid)
+        throw new Error("External SID has expired");
+      return this.sid;
+    }
+    const isUsingApiKey = !!this.authToken;
+    const isUsingCredentials = !!(this.username && this.password);
+    if (!isUsingApiKey && !isUsingCredentials) {
+      throw new ClientResponse(401, { message: "Authentication failed: No API key or username/password provided" });
+    }
+    const httpsAgent = new https.Agent({ rejectUnauthorized: false });
+    const loginPayload = isUsingApiKey ? { "api-key": this.authToken } : { "user": this.username, "password": this.password };
+    if (this.domain) {
+      loginPayload["domain"] = this.domain;
+    }
+    const loginResp = await this.makeRequest(this.getHost(), "POST", "login", loginPayload, { "Content-Type": "application/json" }, null, httpsAgent);
+    if (loginResp.status !== 200 || !loginResp.response || !loginResp.response.sid) {
+      throw loginResp;
+    }
+    this.sid = loginResp.response.sid;
+    this.sessionTimeout = loginResp.response["session-timeout"] || null;
+    this.sessionStart = Date.now();
+    if (loginResp.response.uid) {
+      await this.detectMDS(loginResp.response.uid, true);
+    }
+    return loginResp.response.sid;
   }
 };
 
-// ../mcp-utils/dist/package-utils.js
-import { readFileSync } from "fs";
-import { join as join2, dirname } from "path";
-import { fileURLToPath } from "url";
-function readPackageJson(importMetaUrl) {
-  const pkg2 = JSON.parse(readFileSync(join2(dirname(fileURLToPath(importMetaUrl)), "../package.json"), "utf-8"));
-  process.env.CP_MCP_MAIN_PKG = `${pkg2.name} v${pkg2.version}`;
-  return pkg2;
+// ../infra/dist/string-utils.js
+function nullOrEmpty(val) {
+  return val === void 0 || val === null || typeof val === "string" && (val.trim() === "" || val === "undefined" || val === "null");
 }
-function createMcpServer(importMetaUrl, serverInfo, options) {
-  const pkg2 = readPackageJson(importMetaUrl);
-  const fullServerInfo = {
-    ...serverInfo,
-    name: serverInfo.name || pkg2.name,
-    version: serverInfo.version || pkg2.version
-  };
-  const createServerFn = () => {
-    return new CPMcpServer(fullServerInfo, options);
-  };
-  const server2 = new CPMcpServer(fullServerInfo, options);
-  server2._createServerFn = createServerFn;
-  return { server: server2, pkg: pkg2 };
+function sanitizeData(kwargs) {
+  const data = {};
+  for (const [key, value] of Object.entries(kwargs)) {
+    if (value === null || value === void 0 || value === "" || Array.isArray(value) && value.length === 0) {
+      continue;
+    }
+    const safeKey = key.replace(/_/g, "-");
+    data[safeKey] = value;
+  }
+  return data;
 }
 
 // ../infra/dist/api-manager.js
@@ -3321,7 +3529,9 @@ var Settings = class _Settings {
       return "STG";
     return void 0;
   }
-  constructor({ apiKey = process.env.API_KEY, username = process.env.USERNAME, password = process.env.PASSWORD, s1cUrl = process.env.S1C_URL, managementHost = process.env.MANAGEMENT_HOST, managementPort = process.env.MANAGEMENT_PORT || "443", cloudInfraToken = process.env.CLOUD_INFRA_TOKEN, cloudConnected = process.env.CLOUD_CONNECTED === "true", sid, clientId = process.env.CLIENT_ID, secretKey = process.env.SECRET_KEY, region = process.env.REGION || "EU", devPort = process.env.DEV_PORT || "8006", gatewayUrl } = {}) {
+  // Takes only what it is given: the environment is read by fromArgs, so
+  // settings built from request headers never pick up the process's values.
+  constructor({ apiKey, username, password, s1cUrl, managementHost, managementPort = "443", cloudInfraToken, cloudConnected = false, sid, clientId, secretKey, region = "EU", devPort = "8006", gatewayUrl } = {}) {
     this.region = "EU";
     this.devPort = "8006";
     this.gatewayUrl = "";
@@ -3501,19 +3711,20 @@ var Settings = class _Settings {
         console.error("[Settings.fromArgs] Verbose: WARNING - Args object appears empty, no authentication values found");
       }
     }
+    const env = process.env;
     return new _Settings({
-      apiKey: args.apiKey,
-      username: args.username,
-      password: args.password,
-      s1cUrl: args.s1cUrl,
-      managementHost: args.managementHost,
-      managementPort: args.managementPort,
-      cloudInfraToken: args.cloudInfraToken,
-      cloudConnected: args.cloudConnected,
-      clientId: args.clientId,
-      secretKey: args.secretKey,
-      region: typeof args.region === "string" ? args.region.trim().toUpperCase() : void 0,
-      devPort: args.devPort,
+      apiKey: args.apiKey ?? env.API_KEY,
+      username: args.username ?? env.USERNAME,
+      password: args.password ?? env.PASSWORD,
+      s1cUrl: args.s1cUrl ?? env.S1C_URL,
+      managementHost: args.managementHost ?? env.MANAGEMENT_HOST,
+      managementPort: args.managementPort ?? (env.MANAGEMENT_PORT || void 0),
+      cloudInfraToken: args.cloudInfraToken ?? env.CLOUD_INFRA_TOKEN,
+      cloudConnected: args.cloudConnected ?? env.CLOUD_CONNECTED === "true",
+      clientId: args.clientId ?? env.CLIENT_ID,
+      secretKey: args.secretKey ?? env.SECRET_KEY,
+      region: typeof args.region === "string" ? args.region.trim().toUpperCase() : env.REGION || void 0,
+      devPort: args.devPort ?? (env.DEV_PORT || void 0),
       gatewayUrl: args.gatewayUrl
     });
   }
@@ -3558,7 +3769,6 @@ var Settings = class _Settings {
       const hasAnyValue = extractedValues.apiKey || extractedValues.username || extractedValues.password || extractedValues.s1cUrl || extractedValues.managementHost || extractedValues.cloudInfraToken;
       if (!hasAnyValue) {
         console.error("[Settings.fromHeaders] Verbose: WARNING - No authentication values found in headers");
-        console.error("[Settings.fromHeaders] Verbose: Full headers object (sanitized):", Object.fromEntries(Object.entries(headers).map(([k, v]) => [k, k.toLowerCase().includes("key") || k.toLowerCase().includes("token") || k.toLowerCase().includes("password") ? "***" : v])));
       }
     }
     return new _Settings({
@@ -3579,6 +3789,17 @@ var Settings = class _Settings {
     });
   }
 };
+Settings.debugLoggableKeys = [
+  "management-host",
+  "management-port",
+  "s1c-url",
+  "gateway-url",
+  "region",
+  "dev-port",
+  "cloud-connected",
+  "write-mode"
+];
+Settings.basicKeys = ["REGION"];
 
 // ../infra/dist/external-user-token-manager.js
 import axios2 from "axios";