@confluentinc/mcp-confluent 1.3.0 → 1.5.0

package/dist/preflight.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"preflight.d.ts","sourceRoot":"","sources":["../src/preflight.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AACH,eAAO,MAAM,oBAAoB,YAAY,CAAC;AAmC9C;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,gBAAgB,CAC9B,cAAc,EAAE,MAAM,EACtB,cAAc,EAAE,MAAM,GACrB,MAAM,GAAG,SAAS,CAWpB"}

package/dist/preflight.js

@@ -0,0 +1,68 @@
+/**
+ * Minimum full Node.js version (major.minor.patch) the server supports. Kept in
+ * lockstep with the `engines.node` field in package.json.
+ *
+ * A full version, not just a major, because the floor is dictated by a
+ * transitive dependency: undici (via cheerio) declares `engines.node
+ * >=22.19.0` and, at load time, destructures `markAsUncloneable` from
+ * `node:worker_threads` — an export that only exists from Node 22.10.0 onward.
+ * On an older 22.x (e.g. 22.0.0) undici crashes with a cryptic
+ * `webidl.util.markAsUncloneable is not a function` deep in its cache module,
+ * which is exactly the inscrutable-crash-instead-of-clear-message failure the
+ * preflight shim (src/index.ts) exists to prevent (issue #455). A major-only
+ * gate waved those runtimes straight into that crash, so the gate compares the
+ * full version. Bump this in step with undici's `engines.node` floor.
+ */
+export const MINIMUM_NODE_VERSION = "22.19.0";
+/**
+ * Parse a `major.minor.patch` triple from a Node version string, tolerating a
+ * leading "v" and an absent minor/patch (defaulted to 0). Returns `null` when
+ * no leading major integer is present, so callers can treat an unidentifiable
+ * runtime as unsupported.
+ */
+function parseVersion(version) {
+    const match = /^(\d+)(?:\.(\d+))?(?:\.(\d+))?/.exec(version.replace(/^v/, ""));
+    if (match === null) {
+        return null;
+    }
+    return [Number(match[1]), Number(match[2] || "0"), Number(match[3] || "0")];
+}
+/**
+ * Report whether version `a` is strictly older than version `b`, comparing
+ * major then minor then patch.
+ */
+function isOlder(a, b) {
+    if (a[0] !== b[0]) {
+        return a[0] < b[0];
+    }
+    if (a[1] !== b[1]) {
+        return a[1] < b[1];
+    }
+    return a[2] < b[2];
+}
+/**
+ * Return a human-readable error message when `currentVersion` is older than
+ * `minimumVersion`, otherwise `undefined`.
+ *
+ * Pure (no I/O) so the version gate is exhaustively unit-testable by passing
+ * `process.versions.node`-shaped strings directly. A leading "v" is tolerated.
+ * An unparseable version is treated as unsupported rather than waved through —
+ * we would rather show the upgrade message than hand control to a runtime we
+ * could not identify.
+ *
+ * Authored in syntax that parses on very old Node (no optional chaining, no
+ * import attributes): this module sits in the shim's static import graph, so a
+ * parse error here would reintroduce the very cryptic crash the shim exists to
+ * prevent.
+ */
+export function nodeVersionError(currentVersion, minimumVersion) {
+    const current = parseVersion(currentVersion);
+    const minimum = parseVersion(minimumVersion);
+    if (current === null || minimum === null || isOlder(current, minimum)) {
+        return (`mcp-confluent requires Node.js ${minimumVersion} or newer, ` +
+            `but the current runtime is Node.js ${currentVersion}.\n` +
+            `Please upgrade Node.js (https://nodejs.org/) and try again.`);
+    }
+    return undefined;
+}
+//# sourceMappingURL=preflight.js.map

package/dist/preflight.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"preflight.js","sourceRoot":"","sources":["../src/preflight.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AACH,MAAM,CAAC,MAAM,oBAAoB,GAAG,SAAS,CAAC;AAE9C;;;;;GAKG;AACH,SAAS,YAAY,CAAC,OAAe;IACnC,MAAM,KAAK,GAAG,gCAAgC,CAAC,IAAI,CACjD,OAAO,CAAC,OAAO,CAAC,IAAI,EAAE,EAAE,CAAC,CAC1B,CAAC;IACF,IAAI,KAAK,KAAK,IAAI,EAAE,CAAC;QACnB,OAAO,IAAI,CAAC;IACd,CAAC;IACD,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,GAAG,CAAC,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,GAAG,CAAC,CAAC,CAAC;AAC9E,CAAC;AAED;;;GAGG;AACH,SAAS,OAAO,CACd,CAA2B,EAC3B,CAA2B;IAE3B,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QAClB,OAAO,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;IACrB,CAAC;IACD,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QAClB,OAAO,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;IACrB,CAAC;IACD,OAAO,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;AACrB,CAAC;AAED;;;;;;;;;;;;;;GAcG;AACH,MAAM,UAAU,gBAAgB,CAC9B,cAAsB,EACtB,cAAsB;IAEtB,MAAM,OAAO,GAAG,YAAY,CAAC,cAAc,CAAC,CAAC;IAC7C,MAAM,OAAO,GAAG,YAAY,CAAC,cAAc,CAAC,CAAC;IAC7C,IAAI,OAAO,KAAK,IAAI,IAAI,OAAO,KAAK,IAAI,IAAI,OAAO,CAAC,OAAO,EAAE,OAAO,CAAC,EAAE,CAAC;QACtE,OAAO,CACL,kCAAkC,cAAc,aAAa;YAC7D,sCAAsC,cAAc,KAAK;YACzD,6DAA6D,CAC9D,CAAC;IACJ,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC"}

package/dist/server-main.d.ts

@@ -0,0 +1,98 @@
+#!/usr/bin/env node
+import { CLIOptions } from "./cli.js";
+import { MCPServerConfiguration } from "./config/index.js";
+import { TelemetryService } from "./confluent/telemetry.js";
+import { ToolHandler } from "./confluent/tools/base-tools.js";
+import { ToolName } from "./confluent/tools/tool-name.js";
+import { TransportManager } from "./mcp/transports/index.js";
+import { ServerRuntime } from "./server-runtime.js";
+/**
+ * Resolve the operator's tool allow/block-list into the set `ServerRuntime`
+ * gates on — or `undefined` when neither list was configured, preserving the
+ * "no filter configured" sentinel rather than materializing an all-tools set
+ * that would mean the same thing while muddying the runtime's contract.
+ */
+export declare function resolveAllowedToolNames(allowTools: string[], blockTools: string[]): ReadonlySet<ToolName> | undefined;
+/**
+ * Determine the subset of ToolHandlers to register: those left enabled by the
+ * runtime's operator allow/block-list (`runtime.isToolAllowed`) whose predicate
+ * is also satisfied (typically by at least one configured connection).
+ **/
+export declare function getToolHandlersToRegister(runtime: ServerRuntime): Map<ToolName, ToolHandler>;
+/**
+ * Resolve the Segment write key handed to `TelemetryService.initialize`.
+ *
+ * Precedence: an explicit YAML `server.analytics.write_key` wins; otherwise
+ * fall back to `buildConfig.TELEMETRY_WRITE_KEY` (the value `npm pack` injects
+ * at release time). On unpacked / dev builds the build-time value is empty,
+ * so an absent YAML field produces an empty-string fallback that
+ * `TelemetryService` treats as "no key supplied" — analytics stays off.
+ *
+ * Extracted from `main()` so the precedence is unit-testable without booting
+ * the full server.
+ */
+export declare function resolveTelemetryWriteKey(mcpConfig: MCPServerConfiguration): string | undefined;
+export declare function outputApiKey(): void;
+/**
+ * Bootstrap a starter `config.yaml` in the current working directory by
+ * copying one of the bundled example templates, then ensure the new file
+ * is listed in `<cwd>/.gitignore` so credentials filled in later don't
+ * slip into git.
+ *
+ * Resolved relative to `import.meta.url` (the compiled `dist/index.js`)
+ * so this keeps working when invoked via `npx`, where `process.cwd()`
+ * is the user's project but the example file lives next to the install.
+ *
+ * Refuses to overwrite an existing destination so an accidental rerun
+ * cannot wipe credentials the user already filled in. The write uses
+ * `wx` (exclusive create) so the existence check and the create happen
+ * as a single syscall — there is no TOCTOU window where another process
+ * could create the file between a precheck and the write.
+ *
+ * @param oauth When true, copy `config.oauth.example.yaml` (the minimal
+ *   OAuth template); when false, copy `config.example.yaml` (the
+ *   fully-annotated direct/api-key template). The CLI flag in the EEXIST
+ *   error message is selected to match.
+ */
+export declare function outputInitConfig(oauth?: boolean): void;
+export declare function outputToolList(filteredToolNames: ToolName[]): void;
+/**
+ * Result of {@link handleEarlyExits}. Returning a value instead of calling
+ * `process.exit` directly keeps the function pure enough that tests can
+ * assert dispatch behavior by inspecting the result + per-output spies,
+ * without having to stub `process.exit`.
+ */
+export type EarlyExitResult = {
+    handled: false;
+} | {
+    handled: true;
+    exitCode: 0;
+} | {
+    handled: true;
+    exitCode: 1;
+    stderr: string;
+};
+/**
+ * Dispatch the CLI's mutually-exclusive early-exit modes — generate-key,
+ * init-config, init-oauth-config, and list-tools — before the server
+ * bootstrap begins. Returns `{ handled: false }` when none apply, in
+ * which case the caller continues with normal startup.
+ *
+ * On init-config failure, the friendly error message is returned in
+ * `stderr` rather than written here, so the caller controls writing to
+ * stderr and exiting.
+ */
+export declare function handleEarlyExits(cliOptions: CLIOptions): EarlyExitResult;
+/**
+ * Tear the server down on a shutdown signal, then exit. Every step runs inside
+ * a try/finally so a rejection from any one — most plausibly a client manager
+ * failing to disconnect — is logged but never strands the process: the exit
+ * always fires. `exit` is injected (defaulting to `process.exit`) so this
+ * guarantee is unit-testable without stubbing the global.
+ */
+export declare function performCleanup(deps: {
+    telemetry: Pick<TelemetryService, "shutdown">;
+    transportManager: Pick<TransportManager, "stop">;
+    runtime: Pick<ServerRuntime, "oauthHolder" | "disconnectAll">;
+}, exit?: (code: number) => void): Promise<void>;
+//# sourceMappingURL=server-main.d.ts.map

package/dist/server-main.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"server-main.d.ts","sourceRoot":"","sources":["../src/server-main.ts"],"names":[],"mappings":";AAEA,OAAO,EACL,UAAU,EAMX,MAAM,aAAa,CAAC;AACrB,OAAO,EAGL,sBAAsB,EACvB,MAAM,sBAAsB,CAAC;AAG9B,OAAO,EAAkB,gBAAgB,EAAE,MAAM,6BAA6B,CAAC;AAC/E,OAAO,EAAgB,WAAW,EAAE,MAAM,oCAAoC,CAAC;AAE/E,OAAO,EAAE,QAAQ,EAAE,MAAM,mCAAmC,CAAC;AAK7D,OAAO,EAAkB,gBAAgB,EAAE,MAAM,8BAA8B,CAAC;AAChF,OAAO,EAAE,aAAa,EAAE,MAAM,wBAAwB,CAAC;AAEvD;;;;;GAKG;AACH,wBAAgB,uBAAuB,CACrC,UAAU,EAAE,MAAM,EAAE,EACpB,UAAU,EAAE,MAAM,EAAE,GACnB,WAAW,CAAC,QAAQ,CAAC,GAAG,SAAS,CAKnC;AAED;;;;IAII;AACJ,wBAAgB,yBAAyB,CACvC,OAAO,EAAE,aAAa,GACrB,GAAG,CAAC,QAAQ,EAAE,WAAW,CAAC,CAuD5B;AAED;;;;;;;;;;;GAWG;AACH,wBAAgB,wBAAwB,CACtC,SAAS,EAAE,sBAAsB,GAChC,MAAM,GAAG,SAAS,CAIpB;AAED,wBAAgB,YAAY,IAAI,IAAI,CAQnC;AAED;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,wBAAgB,gBAAgB,CAAC,KAAK,GAAE,OAAe,GAAG,IAAI,CAgC7D;AAkCD,wBAAgB,cAAc,CAAC,iBAAiB,EAAE,QAAQ,EAAE,GAAG,IAAI,CA+ClE;AAED;;;;;GAKG;AACH,MAAM,MAAM,eAAe,GACvB;IAAE,OAAO,EAAE,KAAK,CAAA;CAAE,GAClB;IAAE,OAAO,EAAE,IAAI,CAAC;IAAC,QAAQ,EAAE,CAAC,CAAA;CAAE,GAC9B;IAAE,OAAO,EAAE,IAAI,CAAC;IAAC,QAAQ,EAAE,CAAC,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,CAAC;AAEnD;;;;;;;;;GASG;AACH,wBAAgB,gBAAgB,CAAC,UAAU,EAAE,UAAU,GAAG,eAAe,CAqBxE;AAaD;;;;;;GAMG;AACH,wBAAsB,cAAc,CAClC,IAAI,EAAE;IACJ,SAAS,EAAE,IAAI,CAAC,gBAAgB,EAAE,UAAU,CAAC,CAAC;IAC9C,gBAAgB,EAAE,IAAI,CAAC,gBAAgB,EAAE,MAAM,CAAC,CAAC;IACjD,OAAO,EAAE,IAAI,CAAC,aAAa,EAAE,aAAa,GAAG,eAAe,CAAC,CAAC;CAC/D,EACD,IAAI,GAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAmC,GAC1D,OAAO,CAAC,IAAI,CAAC,CAaf"}

package/dist/server-main.js

@@ -0,0 +1,383 @@
+#!/usr/bin/env node
+import { DisplayedCommandLineUsageError, getFilteredToolNames, getPackageVersion, loadDotEnvFile, parseCliArgs, } from "./cli.js";
+import { buildConfigFromEnvAndCli, loadConfigFromYaml, MCPServerConfiguration, } from "./config/index.js";
+import { buildConfigTelemetry } from "./confluent/config-telemetry.js";
+import { buildConfig, fs, path } from "./confluent/node-deps.js";
+import { TelemetryEvent, TelemetryService } from "./confluent/telemetry.js";
+import { groupDisabledToolsByReason } from "./confluent/tools/tool-availability.js";
+import { ToolName } from "./confluent/tools/tool-name.js";
+import { ToolHandlerRegistry } from "./confluent/tools/tool-registry.js";
+import { initEnv } from "./env.js";
+import { logger, setLogLevel } from "./logger.js";
+import { generateApiKey, TransportManager } from "./mcp/transports/index.js";
+import { ServerRuntime } from "./server-runtime.js";
+/**
+ * Resolve the operator's tool allow/block-list into the set `ServerRuntime`
+ * gates on — or `undefined` when neither list was configured, preserving the
+ * "no filter configured" sentinel rather than materializing an all-tools set
+ * that would mean the same thing while muddying the runtime's contract.
+ */
+export function resolveAllowedToolNames(allowTools, blockTools) {
+    if (allowTools.length === 0 && blockTools.length === 0) {
+        return undefined;
+    }
+    return new Set(getFilteredToolNames(allowTools, blockTools));
+}
+/**
+ * Determine the subset of ToolHandlers to register: those left enabled by the
+ * runtime's operator allow/block-list (`runtime.isToolAllowed`) whose predicate
+ * is also satisfied (typically by at least one configured connection).
+ **/
+export function getToolHandlersToRegister(runtime) {
+    const toolHandlersToRegister = new Map();
+    const knownIds = new Set(Object.keys(runtime.config.connections));
+    // Pass 1: drop tools excluded by the allow/block list (logged per-tool —
+    // the reason is config-driven, not predicate-driven, so it doesn't fold
+    // into the grouped warning emitted later). The filter lives on the runtime
+    // so registration and the list-configured-connections tool read one source of truth.
+    const candidates = [];
+    for (const toolName of Object.values(ToolName)) {
+        if (!runtime.isToolAllowed(toolName)) {
+            logger.warn(`Tool ${toolName} disabled due to allow/block list rules`);
+            continue;
+        }
+        candidates.push([toolName, ToolHandlerRegistry.getToolHandler(toolName)]);
+    }
+    // Pass 2: register tools that are enabled on at least one connection, plus
+    // connection-independent tools (docs, diagnostics), which carry no per-connection
+    // verdict and so stay available even on a zero-connection config.
+    for (const [toolName, handler] of candidates) {
+        const enabledIds = handler.enabledConnectionIds(runtime);
+        // Unreachable: enabledConnectionIds() is derived by iterating
+        // runtime.config.connections, so every id it yields is already a known key.
+        // A non-empty unknownIds means that derivation has broken.
+        const unknownIds = enabledIds.filter((id) => !knownIds.has(id));
+        if (unknownIds.length > 0) {
+            throw new Error(`Wacky -- Tool ${toolName}: enabledConnectionIds() returned unknown connection ID(s): ${unknownIds.join(", ")}`);
+        }
+        if (enabledIds.length > 0 || handler.isConnectionIndependent) {
+            toolHandlersToRegister.set(toolName, handler);
+            logger.info(`Tool ${toolName} enabled`);
+        }
+    }
+    // Pass 3: emit one grouped warning per (connectionId, reason) for tools
+    // that are fully disabled — readers see the missing config piece and the
+    // list of all tools blocked by it in a single line, rather than one
+    // line per tool.
+    for (const group of groupDisabledToolsByReason(candidates, runtime)) {
+        logger.warn(`Tools disabled on connection '${group.connectionId}' — ${group.reason}: ${group.toolNames.join(", ")}`);
+    }
+    // Raise an error if no tools are enabled, as the server would be non-functional without any tools.
+    if (toolHandlersToRegister.size === 0) {
+        throw new Error("No tools enabled. Please check your configuration and environment variables.");
+    }
+    return toolHandlersToRegister;
+}
+/**
+ * Resolve the Segment write key handed to `TelemetryService.initialize`.
+ *
+ * Precedence: an explicit YAML `server.analytics.write_key` wins; otherwise
+ * fall back to `buildConfig.TELEMETRY_WRITE_KEY` (the value `npm pack` injects
+ * at release time). On unpacked / dev builds the build-time value is empty,
+ * so an absent YAML field produces an empty-string fallback that
+ * `TelemetryService` treats as "no key supplied" — analytics stays off.
+ *
+ * Extracted from `main()` so the precedence is unit-testable without booting
+ * the full server.
+ */
+export function resolveTelemetryWriteKey(mcpConfig) {
+    return (mcpConfig.server.analytics?.write_key ?? buildConfig.TELEMETRY_WRITE_KEY);
+}
+export function outputApiKey() {
+    const apiKey = generateApiKey();
+    console.log("\nGenerated MCP API Key:");
+    console.log("=".repeat(64));
+    console.log(apiKey);
+    console.log("=".repeat(64));
+    console.log("\nAdd this to your .env file:");
+    console.log(`MCP_API_KEY=${apiKey}\n`);
+}
+/**
+ * Bootstrap a starter `config.yaml` in the current working directory by
+ * copying one of the bundled example templates, then ensure the new file
+ * is listed in `<cwd>/.gitignore` so credentials filled in later don't
+ * slip into git.
+ *
+ * Resolved relative to `import.meta.url` (the compiled `dist/index.js`)
+ * so this keeps working when invoked via `npx`, where `process.cwd()`
+ * is the user's project but the example file lives next to the install.
+ *
+ * Refuses to overwrite an existing destination so an accidental rerun
+ * cannot wipe credentials the user already filled in. The write uses
+ * `wx` (exclusive create) so the existence check and the create happen
+ * as a single syscall — there is no TOCTOU window where another process
+ * could create the file between a precheck and the write.
+ *
+ * @param oauth When true, copy `config.oauth.example.yaml` (the minimal
+ *   OAuth template); when false, copy `config.example.yaml` (the
+ *   fully-annotated direct/api-key template). The CLI flag in the EEXIST
+ *   error message is selected to match.
+ */
+export function outputInitConfig(oauth = false) {
+    const sourceFileName = oauth
+        ? "config.oauth.example.yaml"
+        : "config.example.yaml";
+    const flagName = oauth ? "init-oauth-config" : "init-config";
+    const sourceUrl = new URL(`../${sourceFileName}`, import.meta.url);
+    const destPath = path.resolve("config.yaml");
+    const contents = fs.readFileSync(sourceUrl, "utf-8");
+    try {
+        fs.writeFileSync(destPath, contents, { flag: "wx" });
+    }
+    catch (err) {
+        if (err.code === "EEXIST") {
+            throw new Error(`config.yaml already exists at ${destPath}. ` +
+                `Remove or rename it before running --${flagName}.`);
+        }
+        throw err;
+    }
+    const gitignoreNote = ensureGitignoreEntry(destPath);
+    console.log(`wrote ./config.yaml (${gitignoreNote})`);
+    // OAuth has no credentials to edit; the bundled template is already
+    // runnable as-is. The api-key template, by contrast, ships placeholder
+    // values the user must fill in before the server can connect.
+    console.log(oauth
+        ? `Next: run with --config ./config.yaml`
+        : `Next: edit credentials in config.yaml and run with --config ./config.yaml`);
+}
+/**
+ * Ensure the basename of `filePath` is listed in `<dirname(filePath)>/.gitignore`.
+ * Creates the gitignore if missing; appends idempotently if present (matching
+ * trimmed lines verbatim — `*.yaml` globs or `/config.yaml` anchors are not
+ * recognized, so a user who already wrote either form will see a duplicate
+ * `config.yaml` entry, which is harmless).
+ *
+ * @returns A short note describing what happened, suitable for the success message.
+ */
+function ensureGitignoreEntry(filePath) {
+    const dir = path.dirname(filePath);
+    const fileName = path.basename(filePath);
+    const gitignorePath = path.join(dir, ".gitignore");
+    if (!fs.existsSync(gitignorePath)) {
+        fs.writeFileSync(gitignorePath, `${fileName}\n`);
+        return "added to .gitignore";
+    }
+    const existing = fs.readFileSync(gitignorePath, "utf-8");
+    const alreadyListed = existing
+        .split("\n")
+        .some((line) => line.trim() === fileName);
+    if (alreadyListed) {
+        return ".gitignore already excludes it";
+    }
+    const prefix = existing.length > 0 && !existing.endsWith("\n") ? "\n" : "";
+    fs.appendFileSync(gitignorePath, `${prefix}${fileName}\n`);
+    return "added to .gitignore";
+}
+export function outputToolList(filteredToolNames) {
+    const MAX_DESC_LENGTH = 120;
+    // Bucket by ToolCategory. Today's callers pass `filteredToolNames` in
+    // registry-declaration order, which already roughly groups same-category
+    // tools, but we re-bucket explicitly here so the rendered layout doesn't
+    // depend on that incidental ordering.
+    const byCategory = new Map();
+    // --list-tools runs before any config is loaded, so there is no real runtime.
+    // A zero-connection runtime makes getRegisteredToolConfig() return each tool's
+    // authored config verbatim (no connectionId augmentation), which is exactly
+    // the connection-independent catalog view this listing wants.
+    const runtime = new ServerRuntime(new MCPServerConfiguration({ connections: {} }), {});
+    for (const toolName of filteredToolNames) {
+        const handler = ToolHandlerRegistry.getToolHandler(toolName);
+        const config = handler.getRegisteredToolConfig(runtime);
+        let desc = config.description.replaceAll(/\s+/g, " ").trim();
+        if (desc.length > MAX_DESC_LENGTH) {
+            desc = desc.slice(0, MAX_DESC_LENGTH - 3) + "...";
+        }
+        let bucket = byCategory.get(handler.category);
+        bucket ??= [];
+        byCategory.set(handler.category, bucket);
+        bucket.push({ name: toolName, desc });
+    }
+    // Categories rendered lex-sorted (kebab-case enum values sort cleanly);
+    // within each category, tools preserve the order they appeared in
+    // `filteredToolNames` (today: registry-declaration order, as supplied
+    // by the caller).
+    const sortedCategories = Array.from(byCategory.keys()).sort((a, b) => a.localeCompare(b));
+    sortedCategories.forEach((category, idx) => {
+        console.log(`\x1b[1;36m${category}:\x1b[0m`);
+        for (const { name, desc } of byCategory.get(category)) {
+            console.log(`  \x1b[32m${name}\x1b[0m: ${desc}`);
+        }
+        // Blank line between sections, but not after the last category.
+        if (idx < sortedCategories.length - 1)
+            console.log("");
+    });
+}
+/**
+ * Dispatch the CLI's mutually-exclusive early-exit modes — generate-key,
+ * init-config, init-oauth-config, and list-tools — before the server
+ * bootstrap begins. Returns `{ handled: false }` when none apply, in
+ * which case the caller continues with normal startup.
+ *
+ * On init-config failure, the friendly error message is returned in
+ * `stderr` rather than written here, so the caller controls writing to
+ * stderr and exiting.
+ */
+export function handleEarlyExits(cliOptions) {
+    if (cliOptions.generateKey) {
+        outputApiKey();
+        return { handled: true, exitCode: 0 };
+    }
+    if (cliOptions.initConfig) {
+        return runOutputInitConfig(false);
+    }
+    if (cliOptions.initOauthConfig) {
+        return runOutputInitConfig(true);
+    }
+    if (cliOptions.listTools) {
+        outputToolList(getFilteredToolNames(cliOptions.allowTools ?? [], cliOptions.blockTools ?? []));
+        return { handled: true, exitCode: 0 };
+    }
+    return { handled: false };
+}
+function runOutputInitConfig(oauth) {
+    try {
+        outputInitConfig(oauth);
+        return { handled: true, exitCode: 0 };
+    }
+    catch (error) {
+        const msg = error instanceof Error ? error.message : String(error);
+        const flag = oauth ? "--init-oauth-config" : "--init-config";
+        return { handled: true, exitCode: 1, stderr: `${flag} failed: ${msg}` };
+    }
+}
+/**
+ * Tear the server down on a shutdown signal, then exit. Every step runs inside
+ * a try/finally so a rejection from any one — most plausibly a client manager
+ * failing to disconnect — is logged but never strands the process: the exit
+ * always fires. `exit` is injected (defaulting to `process.exit`) so this
+ * guarantee is unit-testable without stubbing the global.
+ */
+export async function performCleanup(deps, exit = (code) => process.exit(code)) {
+    logger.info("Shutting down...");
+    try {
+        await deps.telemetry.shutdown();
+        await deps.transportManager.stop();
+        // shutdown() is race-safe with an in-flight bootstrap.
+        deps.runtime.oauthHolder?.shutdown();
+        await deps.runtime.disconnectAll();
+    }
+    catch (error) {
+        logger.error({ err: error }, "Error during shutdown");
+    }
+    finally {
+        exit(0);
+    }
+}
+async function main() {
+    try {
+        // Parse command line arguments.(NO LONGER LOADS ENV VARS FROM -e file!)
+        const cliOptions = parseCliArgs(process.argv);
+        const earlyExit = handleEarlyExits(cliOptions);
+        if (earlyExit.handled) {
+            if (earlyExit.exitCode === 1) {
+                console.error(earlyExit.stderr);
+            }
+            process.exit(earlyExit.exitCode);
+        }
+        const allowedToolNames = resolveAllowedToolNames(cliOptions.allowTools ?? [], cliOptions.blockTools ?? []);
+        if (cliOptions.envFile) {
+            loadDotEnvFile(cliOptions.envFile);
+        }
+        // Convert our known env vars into a typed Environment obj.
+        const env = initEnv();
+        let mcpConfig;
+        // Load and validate configuration — from YAML file if --config provided, else from env vars + CLI overrides.
+        if (cliOptions.config) {
+            mcpConfig = loadConfigFromYaml(cliOptions.config, process.env);
+        }
+        else {
+            mcpConfig = buildConfigFromEnvAndCli(env, {
+                disableAuth: cliOptions.disableAuth,
+                allowedHosts: cliOptions.allowedHosts,
+                kafkaConfig: cliOptions.kafkaConfig,
+                oauth: cliOptions.oauth,
+                ccloudEnv: cliOptions.ccloudEnv,
+            });
+        }
+        setLogLevel(mcpConfig.server.log_level);
+        // Transport selection: YAML config is authoritative when --config is used;
+        // CLI flag (or its default) is used on the env-var path.
+        const transports = cliOptions.config
+            ? mcpConfig.server.transports
+            : cliOptions.transports;
+        // DO_NOT_TRACK is a cross-tool user preference (consoledonottrack.com);
+        // the env var acts as a floor so it is honored even when --config is used.
+        TelemetryService.initialize({
+            doNotTrack: mcpConfig.server.do_not_track || env.DO_NOT_TRACK,
+            writeKey: resolveTelemetryWriteKey(mcpConfig),
+        });
+        const telemetry = TelemetryService.getInstance();
+        logger.info(`${mcpConfig.getConnectionIds().length} connections loaded successfully`);
+        const runtime = ServerRuntime.fromConfig(mcpConfig, allowedToolNames);
+        const serverVersion = getPackageVersion();
+        telemetry.setCommonProperties({ serverVersion });
+        const toolHandlers = getToolHandlersToRegister(runtime);
+        logger.info({ enabledTools: [...toolHandlers.keys()] }, `${toolHandlers.size} tool(s) enabled`);
+        // Warn if auth is disabled
+        if (mcpConfig.server.auth.disabled) {
+            logger.warn("Authentication is DISABLED for HTTP/SSE transports. " +
+                "This should only be used in development environments.");
+        }
+        const transportManager = new TransportManager({
+            disableAuth: mcpConfig.server.auth.disabled,
+            allowedHosts: mcpConfig.server.auth.allowed_hosts,
+            apiKey: mcpConfig.server.auth.api_key,
+        });
+        const serverOptions = {
+            serverVersion,
+            toolHandlers,
+            runtime,
+            track: (props) => telemetry.track(TelemetryEvent.TOOL_CALL, {
+                ...props,
+            }),
+        };
+        // Start all transports with a single call
+        logger.info(`Starting transports: ${transports.join(", ")}`);
+        await transportManager.start({
+            serverOptions,
+            types: transports,
+            http: {
+                port: mcpConfig.server.http.port,
+                host: mcpConfig.server.http.host,
+                mcpEndpointPath: mcpConfig.server.http.mcp_endpoint,
+                sseEndpointPath: mcpConfig.server.http.sse_endpoint,
+                sseMessageEndpointPath: mcpConfig.server.http.sse_message_endpoint,
+            },
+        });
+        // Boot-time invariants (config source, active transports, connection
+        // types) ride this one-shot event rather than every TOOL_CALL — they
+        // don't change after startup, so duplicating them per tool call buys
+        // nothing. Warehouse queries join SERVER_START to TOOL_CALL on
+        // `serverSessionId` (a common property) when slicing is needed.
+        telemetry.track(TelemetryEvent.SERVER_START, {
+            ...buildConfigTelemetry(cliOptions, mcpConfig, transports),
+        });
+        // Set up cleanup handlers
+        const cleanup = () => performCleanup({ telemetry, transportManager, runtime });
+        process.on("SIGINT", cleanup);
+        process.on("SIGTERM", cleanup);
+        process.on("SIGQUIT", cleanup);
+        process.on("SIGUSR2", cleanup);
+    }
+    catch (error) {
+        if (error instanceof DisplayedCommandLineUsageError) {
+            process.exit(0);
+        }
+        logger.error({ err: error }, "Error starting server");
+        process.exit(1);
+    }
+}
+if (process.env.NODE_ENV !== "test") {
+    await main();
+}
+//# sourceMappingURL=server-main.js.map

package/dist/server-main.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"server-main.js","sourceRoot":"","sources":["../src/server-main.ts"],"names":[],"mappings":";AAEA,OAAO,EAEL,8BAA8B,EAC9B,oBAAoB,EACpB,iBAAiB,EACjB,cAAc,EACd,YAAY,GACb,MAAM,aAAa,CAAC;AACrB,OAAO,EACL,wBAAwB,EACxB,kBAAkB,EAClB,sBAAsB,GACvB,MAAM,sBAAsB,CAAC;AAC9B,OAAO,EAAE,oBAAoB,EAAE,MAAM,oCAAoC,CAAC;AAC1E,OAAO,EAAE,WAAW,EAAE,EAAE,EAAE,IAAI,EAAE,MAAM,6BAA6B,CAAC;AACpE,OAAO,EAAE,cAAc,EAAE,gBAAgB,EAAE,MAAM,6BAA6B,CAAC;AAE/E,OAAO,EAAE,0BAA0B,EAAE,MAAM,2CAA2C,CAAC;AACvF,OAAO,EAAE,QAAQ,EAAE,MAAM,mCAAmC,CAAC;AAC7D,OAAO,EAAE,mBAAmB,EAAE,MAAM,uCAAuC,CAAC;AAC5E,OAAO,EAAE,OAAO,EAAE,MAAM,aAAa,CAAC;AACtC,OAAO,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,gBAAgB,CAAC;AAErD,OAAO,EAAE,cAAc,EAAE,gBAAgB,EAAE,MAAM,8BAA8B,CAAC;AAChF,OAAO,EAAE,aAAa,EAAE,MAAM,wBAAwB,CAAC;AAEvD;;;;;GAKG;AACH,MAAM,UAAU,uBAAuB,CACrC,UAAoB,EACpB,UAAoB;IAEpB,IAAI,UAAU,CAAC,MAAM,KAAK,CAAC,IAAI,UAAU,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACvD,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,OAAO,IAAI,GAAG,CAAC,oBAAoB,CAAC,UAAU,EAAE,UAAU,CAAC,CAAC,CAAC;AAC/D,CAAC;AAED;;;;IAII;AACJ,MAAM,UAAU,yBAAyB,CACvC,OAAsB;IAEtB,MAAM,sBAAsB,GAAG,IAAI,GAAG,EAAyB,CAAC;IAChE,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC,CAAC;IAElE,yEAAyE;IACzE,wEAAwE;IACxE,2EAA2E;IAC3E,qFAAqF;IACrF,MAAM,UAAU,GAA4C,EAAE,CAAC;IAC/D,KAAK,MAAM,QAAQ,IAAI,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAC,EAAE,CAAC;QAC/C,IAAI,CAAC,OAAO,CAAC,aAAa,CAAC,QAAQ,CAAC,EAAE,CAAC;YACrC,MAAM,CAAC,IAAI,CAAC,QAAQ,QAAQ,yCAAyC,CAAC,CAAC;YACvE,SAAS;QACX,CAAC;QACD,UAAU,CAAC,IAAI,CAAC,CAAC,QAAQ,EAAE,mBAAmB,CAAC,cAAc,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC;IAC5E,CAAC;IAED,2EAA2E;IAC3E,kFAAkF;IAClF,kEAAkE;IAClE,KAAK,MAAM,CAAC,QAAQ,EAAE,OAAO,CAAC,IAAI,UAAU,EAAE,CAAC;QAC7C,MAAM,UAAU,GAAG,OAAO,CAAC,oBAAoB,CAAC,OAAO,CAAC,CAAC;QACzD,8DAA8D;QAC9D,4EAA4E;QAC5E,2DAA2D;QAC3D,MAAM,UAAU,GAAG,UAAU,CAAC,MAAM,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC;QAChE,IAAI,UAAU,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAC1B,MAAM,IAAI,KAAK,CACb,iBAAiB,QAAQ,+DAA+D,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAChH,CAAC;QACJ,CAAC;QACD,IAAI,UAAU,CAAC,MAAM,GAAG,CAAC,IAAI,OAAO,CAAC,uBAAuB,EAAE,CAAC;YAC7D,sBAAsB,CAAC,GAAG,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;YAC9C,MAAM,CAAC,IAAI,CAAC,QAAQ,QAAQ,UAAU,CAAC,CAAC;QAC1C,CAAC;IACH,CAAC;IAED,wEAAwE;IACxE,yEAAyE;IACzE,oEAAoE;IACpE,iBAAiB;IACjB,KAAK,MAAM,KAAK,IAAI,0BAA0B,CAAC,UAAU,EAAE,OAAO,CAAC,EAAE,CAAC;QACpE,MAAM,CAAC,IAAI,CACT,iCAAiC,KAAK,CAAC,YAAY,OAAO,KAAK,CAAC,MAAM,KAAK,KAAK,CAAC,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CACxG,CAAC;IACJ,CAAC;IAED,mGAAmG;IACnG,IAAI,sBAAsB,CAAC,IAAI,KAAK,CAAC,EAAE,CAAC;QACtC,MAAM,IAAI,KAAK,CACb,8EAA8E,CAC/E,CAAC;IACJ,CAAC;IAED,OAAO,sBAAsB,CAAC;AAChC,CAAC;AAED;;;;;;;;;;;GAWG;AACH,MAAM,UAAU,wBAAwB,CACtC,SAAiC;IAEjC,OAAO,CACL,SAAS,CAAC,MAAM,CAAC,SAAS,EAAE,SAAS,IAAI,WAAW,CAAC,mBAAmB,CACzE,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,YAAY;IAC1B,MAAM,MAAM,GAAG,cAAc,EAAE,CAAC;IAChC,OAAO,CAAC,GAAG,CAAC,0BAA0B,CAAC,CAAC;IACxC,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC;IAC5B,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;IACpB,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC;IAC5B,OAAO,CAAC,GAAG,CAAC,+BAA+B,CAAC,CAAC;IAC7C,OAAO,CAAC,GAAG,CAAC,eAAe,MAAM,IAAI,CAAC,CAAC;AACzC,CAAC;AAED;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,MAAM,UAAU,gBAAgB,CAAC,QAAiB,KAAK;IACrD,MAAM,cAAc,GAAG,KAAK;QAC1B,CAAC,CAAC,2BAA2B;QAC7B,CAAC,CAAC,qBAAqB,CAAC;IAC1B,MAAM,QAAQ,GAAG,KAAK,CAAC,CAAC,CAAC,mBAAmB,CAAC,CAAC,CAAC,aAAa,CAAC;IAC7D,MAAM,SAAS,GAAG,IAAI,GAAG,CAAC,MAAM,cAAc,EAAE,EAAE,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IACnE,MAAM,QAAQ,GAAG,IAAI,CAAC,OAAO,CAAC,aAAa,CAAC,CAAC;IAE7C,MAAM,QAAQ,GAAG,EAAE,CAAC,YAAY,CAAC,SAAS,EAAE,OAAO,CAAC,CAAC;IACrD,IAAI,CAAC;QACH,EAAE,CAAC,aAAa,CAAC,QAAQ,EAAE,QAAQ,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC;IACvD,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,IAAK,GAA6B,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;YACrD,MAAM,IAAI,KAAK,CACb,iCAAiC,QAAQ,IAAI;gBAC3C,wCAAwC,QAAQ,GAAG,CACtD,CAAC;QACJ,CAAC;QACD,MAAM,GAAG,CAAC;IACZ,CAAC;IAED,MAAM,aAAa,GAAG,oBAAoB,CAAC,QAAQ,CAAC,CAAC;IAErD,OAAO,CAAC,GAAG,CAAC,wBAAwB,aAAa,GAAG,CAAC,CAAC;IACtD,oEAAoE;IACpE,uEAAuE;IACvE,8DAA8D;IAC9D,OAAO,CAAC,GAAG,CACT,KAAK;QACH,CAAC,CAAC,uCAAuC;QACzC,CAAC,CAAC,2EAA2E,CAChF,CAAC;AACJ,CAAC;AAED;;;;;;;;GAQG;AACH,SAAS,oBAAoB,CAAC,QAAgB;IAC5C,MAAM,GAAG,GAAG,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;IACnC,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;IACzC,MAAM,aAAa,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,YAAY,CAAC,CAAC;IAEnD,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,aAAa,CAAC,EAAE,CAAC;QAClC,EAAE,CAAC,aAAa,CAAC,aAAa,EAAE,GAAG,QAAQ,IAAI,CAAC,CAAC;QACjD,OAAO,qBAAqB,CAAC;IAC/B,CAAC;IAED,MAAM,QAAQ,GAAG,EAAE,CAAC,YAAY,CAAC,aAAa,EAAE,OAAO,CAAC,CAAC;IACzD,MAAM,aAAa,GAAG,QAAQ;SAC3B,KAAK,CAAC,IAAI,CAAC;SACX,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,EAAE,KAAK,QAAQ,CAAC,CAAC;IAC5C,IAAI,aAAa,EAAE,CAAC;QAClB,OAAO,gCAAgC,CAAC;IAC1C,CAAC;IAED,MAAM,MAAM,GAAG,QAAQ,CAAC,MAAM,GAAG,CAAC,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC;IAC3E,EAAE,CAAC,cAAc,CAAC,aAAa,EAAE,GAAG,MAAM,GAAG,QAAQ,IAAI,CAAC,CAAC;IAC3D,OAAO,qBAAqB,CAAC;AAC/B,CAAC;AAED,MAAM,UAAU,cAAc,CAAC,iBAA6B;IAC1D,MAAM,eAAe,GAAG,GAAG,CAAC;IAE5B,sEAAsE;IACtE,yEAAyE;IACzE,yEAAyE;IACzE,sCAAsC;IACtC,MAAM,UAAU,GAAG,IAAI,GAAG,EAGvB,CAAC;IACJ,8EAA8E;IAC9E,+EAA+E;IAC/E,4EAA4E;IAC5E,8DAA8D;IAC9D,MAAM,OAAO,GAAG,IAAI,aAAa,CAC/B,IAAI,sBAAsB,CAAC,EAAE,WAAW,EAAE,EAAE,EAAE,CAAC,EAC/C,EAAE,CACH,CAAC;IACF,KAAK,MAAM,QAAQ,IAAI,iBAAiB,EAAE,CAAC;QACzC,MAAM,OAAO,GAAG,mBAAmB,CAAC,cAAc,CAAC,QAAQ,CAAC,CAAC;QAC7D,MAAM,MAAM,GAAG,OAAO,CAAC,uBAAuB,CAAC,OAAO,CAAC,CAAC;QACxD,IAAI,IAAI,GAAG,MAAM,CAAC,WAAW,CAAC,UAAU,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC;QAC7D,IAAI,IAAI,CAAC,MAAM,GAAG,eAAe,EAAE,CAAC;YAClC,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,eAAe,GAAG,CAAC,CAAC,GAAG,KAAK,CAAC;QACpD,CAAC;QACD,IAAI,MAAM,GAAG,UAAU,CAAC,GAAG,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;QAC9C,MAAM,KAAK,EAAE,CAAC;QACd,UAAU,CAAC,GAAG,CAAC,OAAO,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;QACzC,MAAM,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC;IACxC,CAAC;IAED,wEAAwE;IACxE,kEAAkE;IAClE,sEAAsE;IACtE,kBAAkB;IAClB,MAAM,gBAAgB,GAAG,KAAK,CAAC,IAAI,CAAC,UAAU,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CACnE,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,CACnB,CAAC;IACF,gBAAgB,CAAC,OAAO,CAAC,CAAC,QAAQ,EAAE,GAAG,EAAE,EAAE;QACzC,OAAO,CAAC,GAAG,CAAC,aAAa,QAAQ,UAAU,CAAC,CAAC;QAC7C,KAAK,MAAM,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,UAAU,CAAC,GAAG,CAAC,QAAQ,CAAE,EAAE,CAAC;YACvD,OAAO,CAAC,GAAG,CAAC,aAAa,IAAI,YAAY,IAAI,EAAE,CAAC,CAAC;QACnD,CAAC;QACD,gEAAgE;QAChE,IAAI,GAAG,GAAG,gBAAgB,CAAC,MAAM,GAAG,CAAC;YAAE,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IACzD,CAAC,CAAC,CAAC;AACL,CAAC;AAaD;;;;;;;;;GASG;AACH,MAAM,UAAU,gBAAgB,CAAC,UAAsB;IACrD,IAAI,UAAU,CAAC,WAAW,EAAE,CAAC;QAC3B,YAAY,EAAE,CAAC;QACf,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC,EAAE,CAAC;IACxC,CAAC;IACD,IAAI,UAAU,CAAC,UAAU,EAAE,CAAC;QAC1B,OAAO,mBAAmB,CAAC,KAAK,CAAC,CAAC;IACpC,CAAC;IACD,IAAI,UAAU,CAAC,eAAe,EAAE,CAAC;QAC/B,OAAO,mBAAmB,CAAC,IAAI,CAAC,CAAC;IACnC,CAAC;IACD,IAAI,UAAU,CAAC,SAAS,EAAE,CAAC;QACzB,cAAc,CACZ,oBAAoB,CAClB,UAAU,CAAC,UAAU,IAAI,EAAE,EAC3B,UAAU,CAAC,UAAU,IAAI,EAAE,CAC5B,CACF,CAAC;QACF,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC,EAAE,CAAC;IACxC,CAAC;IACD,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC;AAC5B,CAAC;AAED,SAAS,mBAAmB,CAAC,KAAc;IACzC,IAAI,CAAC;QACH,gBAAgB,CAAC,KAAK,CAAC,CAAC;QACxB,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC,EAAE,CAAC;IACxC,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,GAAG,GAAG,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QACnE,MAAM,IAAI,GAAG,KAAK,CAAC,CAAC,CAAC,qBAAqB,CAAC,CAAC,CAAC,eAAe,CAAC;QAC7D,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC,EAAE,MAAM,EAAE,GAAG,IAAI,YAAY,GAAG,EAAE,EAAE,CAAC;IAC1E,CAAC;AACH,CAAC;AAED;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,cAAc,CAClC,IAIC,EACD,OAA+B,CAAC,IAAI,EAAE,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC;IAE3D,MAAM,CAAC,IAAI,CAAC,kBAAkB,CAAC,CAAC;IAChC,IAAI,CAAC;QACH,MAAM,IAAI,CAAC,SAAS,CAAC,QAAQ,EAAE,CAAC;QAChC,MAAM,IAAI,CAAC,gBAAgB,CAAC,IAAI,EAAE,CAAC;QACnC,uDAAuD;QACvD,IAAI,CAAC,OAAO,CAAC,WAAW,EAAE,QAAQ,EAAE,CAAC;QACrC,MAAM,IAAI,CAAC,OAAO,CAAC,aAAa,EAAE,CAAC;IACrC,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,CAAC,KAAK,CAAC,EAAE,GAAG,EAAE,KAAK,EAAE,EAAE,uBAAuB,CAAC,CAAC;IACxD,CAAC;YAAS,CAAC;QACT,IAAI,CAAC,CAAC,CAAC,CAAC;IACV,CAAC;AACH,CAAC;AAED,KAAK,UAAU,IAAI;IACjB,IAAI,CAAC;QACH,wEAAwE;QACxE,MAAM,UAAU,GAAG,YAAY,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;QAE9C,MAAM,SAAS,GAAG,gBAAgB,CAAC,UAAU,CAAC,CAAC;QAC/C,IAAI,SAAS,CAAC,OAAO,EAAE,CAAC;YACtB,IAAI,SAAS,CAAC,QAAQ,KAAK,CAAC,EAAE,CAAC;gBAC7B,OAAO,CAAC,KAAK,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC;YAClC,CAAC;YACD,OAAO,CAAC,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAC;QACnC,CAAC;QAED,MAAM,gBAAgB,GAAG,uBAAuB,CAC9C,UAAU,CAAC,UAAU,IAAI,EAAE,EAC3B,UAAU,CAAC,UAAU,IAAI,EAAE,CAC5B,CAAC;QAEF,IAAI,UAAU,CAAC,OAAO,EAAE,CAAC;YACvB,cAAc,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC;QACrC,CAAC;QAED,2DAA2D;QAC3D,MAAM,GAAG,GAAG,OAAO,EAAE,CAAC;QAEtB,IAAI,SAAiC,CAAC;QACtC,6GAA6G;QAC7G,IAAI,UAAU,CAAC,MAAM,EAAE,CAAC;YACtB,SAAS,GAAG,kBAAkB,CAAC,UAAU,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,CAAC,CAAC;QACjE,CAAC;aAAM,CAAC;YACN,SAAS,GAAG,wBAAwB,CAAC,GAAG,EAAE;gBACxC,WAAW,EAAE,UAAU,CAAC,WAAW;gBACnC,YAAY,EAAE,UAAU,CAAC,YAAY;gBACrC,WAAW,EAAE,UAAU,CAAC,WAAW;gBACnC,KAAK,EAAE,UAAU,CAAC,KAAK;gBACvB,SAAS,EAAE,UAAU,CAAC,SAAS;aAChC,CAAC,CAAC;QACL,CAAC;QAED,WAAW,CAAC,SAAS,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;QAExC,2EAA2E;QAC3E,yDAAyD;QACzD,MAAM,UAAU,GAAG,UAAU,CAAC,MAAM;YAClC,CAAC,CAAC,SAAS,CAAC,MAAM,CAAC,UAAU;YAC7B,CAAC,CAAC,UAAU,CAAC,UAAU,CAAC;QAE1B,wEAAwE;QACxE,2EAA2E;QAC3E,gBAAgB,CAAC,UAAU,CAAC;YAC1B,UAAU,EAAE,SAAS,CAAC,MAAM,CAAC,YAAY,IAAI,GAAG,CAAC,YAAY;YAC7D,QAAQ,EAAE,wBAAwB,CAAC,SAAS,CAAC;SAC9C,CAAC,CAAC;QACH,MAAM,SAAS,GAAG,gBAAgB,CAAC,WAAW,EAAE,CAAC;QAEjD,MAAM,CAAC,IAAI,CACT,GAAG,SAAS,CAAC,gBAAgB,EAAE,CAAC,MAAM,kCAAkC,CACzE,CAAC;QAEF,MAAM,OAAO,GAAG,aAAa,CAAC,UAAU,CAAC,SAAS,EAAE,gBAAgB,CAAC,CAAC;QAEtE,MAAM,aAAa,GAAG,iBAAiB,EAAE,CAAC;QAE1C,SAAS,CAAC,mBAAmB,CAAC,EAAE,aAAa,EAAE,CAAC,CAAC;QAEjD,MAAM,YAAY,GAAG,yBAAyB,CAAC,OAAO,CAAC,CAAC;QAExD,MAAM,CAAC,IAAI,CACT,EAAE,YAAY,EAAE,CAAC,GAAG,YAAY,CAAC,IAAI,EAAE,CAAC,EAAE,EAC1C,GAAG,YAAY,CAAC,IAAI,kBAAkB,CACvC,CAAC;QAEF,2BAA2B;QAC3B,IAAI,SAAS,CAAC,MAAM,CAAC,IAAI,CAAC,QAAQ,EAAE,CAAC;YACnC,MAAM,CAAC,IAAI,CACT,sDAAsD;gBACpD,uDAAuD,CAC1D,CAAC;QACJ,CAAC;QAED,MAAM,gBAAgB,GAAG,IAAI,gBAAgB,CAAC;YAC5C,WAAW,EAAE,SAAS,CAAC,MAAM,CAAC,IAAI,CAAC,QAAQ;YAC3C,YAAY,EAAE,SAAS,CAAC,MAAM,CAAC,IAAI,CAAC,aAAa;YACjD,MAAM,EAAE,SAAS,CAAC,MAAM,CAAC,IAAI,CAAC,OAAO;SACtC,CAAC,CAAC;QAEH,MAAM,aAAa,GAA2B;YAC5C,aAAa;YACb,YAAY;YACZ,OAAO;YACP,KAAK,EAAE,CAAC,KAAK,EAAE,EAAE,CACf,SAAS,CAAC,KAAK,CAAC,cAAc,CAAC,SAAS,EAAE;gBACxC,GAAG,KAAK;aACT,CAAC;SACL,CAAC;QAEF,0CAA0C;QAC1C,MAAM,CAAC,IAAI,CAAC,wBAAwB,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QAC7D,MAAM,gBAAgB,CAAC,KAAK,CAAC;YAC3B,aAAa;YACb,KAAK,EAAE,UAAU;YACjB,IAAI,EAAE;gBACJ,IAAI,EAAE,SAAS,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI;gBAChC,IAAI,EAAE,SAAS,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI;gBAChC,eAAe,EAAE,SAAS,CAAC,MAAM,CAAC,IAAI,CAAC,YAAY;gBACnD,eAAe,EAAE,SAAS,CAAC,MAAM,CAAC,IAAI,CAAC,YAAY;gBACnD,sBAAsB,EAAE,SAAS,CAAC,MAAM,CAAC,IAAI,CAAC,oBAAoB;aACnE;SACF,CAAC,CAAC;QAEH,qEAAqE;QACrE,qEAAqE;QACrE,qEAAqE;QACrE,+DAA+D;QAC/D,gEAAgE;QAChE,SAAS,CAAC,KAAK,CAAC,cAAc,CAAC,YAAY,EAAE;YAC3C,GAAG,oBAAoB,CAAC,UAAU,EAAE,SAAS,EAAE,UAAU,CAAC;SAC3D,CAAC,CAAC;QAEH,0BAA0B;QAC1B,MAAM,OAAO,GAAG,GAAG,EAAE,CACnB,cAAc,CAAC,EAAE,SAAS,EAAE,gBAAgB,EAAE,OAAO,EAAE,CAAC,CAAC;QAE3D,OAAO,CAAC,EAAE,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;QAC9B,OAAO,CAAC,EAAE,CAAC,SAAS,EAAE,OAAO,CAAC,CAAC;QAC/B,OAAO,CAAC,EAAE,CAAC,SAAS,EAAE,OAAO,CAAC,CAAC;QAC/B,OAAO,CAAC,EAAE,CAAC,SAAS,EAAE,OAAO,CAAC,CAAC;IACjC,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAI,KAAK,YAAY,8BAA8B,EAAE,CAAC;YACpD,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAClB,CAAC;QACD,MAAM,CAAC,KAAK,CAAC,EAAE,GAAG,EAAE,KAAK,EAAE,EAAE,uBAAuB,CAAC,CAAC;QACtD,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;AACH,CAAC;AAED,IAAI,OAAO,CAAC,GAAG,CAAC,QAAQ,KAAK,MAAM,EAAE,CAAC;IACpC,MAAM,IAAI,EAAE,CAAC;AACf,CAAC"}

package/dist/server-runtime.d.ts

@@ -1,6 +1,7 @@
 import { MCPServerConfiguration } from "./config/index.js";
 import { BaseClientManager } from "./confluent/base-client-manager.js";
 import { OAuthHolder } from "./confluent/oauth/oauth-holder.js";
+import { ToolName } from "./confluent/tools/tool-name.js";
 /**
  * Aggregate of all runtime state threaded through the server.
  *
@@ -17,12 +18,26 @@ export declare class ServerRuntime {
      * before any handler that needs Confluent access.
      */
     readonly oauthHolder: OAuthHolder | undefined;
-    constructor(config: MCPServerConfiguration, clientManagers: Record<string, BaseClientManager>, oauthHolder?: OAuthHolder | undefined);
     /**
-     * Convenience accessor for the single-connection period.
-     * Remove (or make multi-connection-aware) when issue #151 lands.
+     * Tool names the operator's allow/block-list left enabled, or `undefined`
+     * when no list was configured (all tools allowed — cli.ts's default-on
+     * behavior). The `undefined`-means-unfiltered sentinel is this class's own
+     * business: callers ask {@link isToolAllowed} rather than branching on it.
      */
-    get clientManager(): BaseClientManager;
-    static fromConfig(config: MCPServerConfiguration): ServerRuntime;
+    private readonly allowedToolNames;
+    constructor(config: MCPServerConfiguration, clientManagers: Record<string, BaseClientManager>, oauthHolder?: OAuthHolder | undefined, allowedToolNames?: ReadonlySet<ToolName> | undefined);
+    /**
+     * Whether the operator's allow/block-list leaves `name` invokable. Always
+     * `true` when no list was configured. The single source of truth for the
+     * operator filter, shared by tool registration and the `list-configured-connections`
+     * tool so the advertised set and the reported set can never diverge.
+     */
+    isToolAllowed(name: ToolName): boolean;
+    /**
+     * Disconnect every per-connection client manager — the teardown counterpart
+     * to the per-connection construction in {@link fromConfig}.
+     */
+    disconnectAll(): Promise<void>;
+    static fromConfig(config: MCPServerConfiguration, allowedToolNames?: ReadonlySet<ToolName> | undefined): ServerRuntime;
 }
 //# sourceMappingURL=server-runtime.d.ts.map

package/dist/server-runtime.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"server-runtime.d.ts","sourceRoot":"","sources":["../src/server-runtime.ts"],"names":[],"mappings":"AAAA,OAAO,EAEL,sBAAsB,EACvB,MAAM,sBAAsB,CAAC;AAC9B,OAAO,EAAE,iBAAiB,EAAE,MAAM,uCAAuC,CAAC;AAG1E,OAAO,EAAE,WAAW,EAAE,MAAM,sCAAsC,CAAC;AAEnE;;;;GAIG;AACH,qBAAa,aAAa;IACxB,QAAQ,CAAC,MAAM,EAAE,sBAAsB,CAAC;IACxC,QAAQ,CAAC,cAAc,EAAE,MAAM,CAAC,MAAM,EAAE,iBAAiB,CAAC,CAAC;IAC3D;;;;;;OAMG;IACH,QAAQ,CAAC,WAAW,EAAE,WAAW,GAAG,SAAS,CAAC;gBAG5C,MAAM,EAAE,sBAAsB,EAC9B,cAAc,EAAE,MAAM,CAAC,MAAM,EAAE,iBAAiB,CAAC,EACjD,WAAW,GAAE,WAAW,GAAG,SAAqB;IAOlD;;;OAGG;IACH,IAAI,aAAa,IAAI,iBAAiB,CAarC;IAED,MAAM,CAAC,UAAU,CAAC,MAAM,EAAE,sBAAsB,GAAG,aAAa;CA4CjE"}
+{"version":3,"file":"server-runtime.d.ts","sourceRoot":"","sources":["../src/server-runtime.ts"],"names":[],"mappings":"AAAA,OAAO,EAEL,sBAAsB,EACvB,MAAM,sBAAsB,CAAC;AAC9B,OAAO,EAAE,iBAAiB,EAAE,MAAM,uCAAuC,CAAC;AAG1E,OAAO,EAAE,WAAW,EAAE,MAAM,sCAAsC,CAAC;AACnE,OAAO,EAAE,QAAQ,EAAE,MAAM,mCAAmC,CAAC;AAE7D;;;;GAIG;AACH,qBAAa,aAAa;IACxB,QAAQ,CAAC,MAAM,EAAE,sBAAsB,CAAC;IACxC,QAAQ,CAAC,cAAc,EAAE,MAAM,CAAC,MAAM,EAAE,iBAAiB,CAAC,CAAC;IAC3D;;;;;;OAMG;IACH,QAAQ,CAAC,WAAW,EAAE,WAAW,GAAG,SAAS,CAAC;IAE9C;;;;;OAKG;IACH,OAAO,CAAC,QAAQ,CAAC,gBAAgB,CAAoC;gBAGnE,MAAM,EAAE,sBAAsB,EAC9B,cAAc,EAAE,MAAM,CAAC,MAAM,EAAE,iBAAiB,CAAC,EACjD,WAAW,GAAE,WAAW,GAAG,SAAqB,EAChD,gBAAgB,GAAE,WAAW,CAAC,QAAQ,CAAC,GAAG,SAAqB;IAQjE;;;;;OAKG;IACH,aAAa,CAAC,IAAI,EAAE,QAAQ,GAAG,OAAO;IAMtC;;;OAGG;IACG,aAAa,IAAI,OAAO,CAAC,IAAI,CAAC;IAkBpC,MAAM,CAAC,UAAU,CACf,MAAM,EAAE,sBAAsB,EAC9B,gBAAgB,GAAE,WAAW,CAAC,QAAQ,CAAC,GAAG,SAAqB,GAC9D,aAAa;CAiDjB"}