@confluentinc/mcp-confluent 1.4.0 → 1.6.0

package/dist/server-main.js

@@ -0,0 +1,410 @@
+#!/usr/bin/env node
+import { DisplayedCommandLineUsageError, getFilteredToolNames, getPackageVersion, loadDotEnvFile, parseCliArgs, } from "./cli.js";
+import { buildConfigFromEnvAndCli, loadConfigFromYaml, MCPServerConfiguration, } from "./config/index.js";
+import { buildConfigTelemetry } from "./confluent/config-telemetry.js";
+import { buildConfig, fs, path } from "./confluent/node-deps.js";
+import { captureException, closeSentry, initSentry, resolveSentryDsn, } from "./confluent/sentry.js";
+import { TelemetryEvent, TelemetryService } from "./confluent/telemetry.js";
+import { groupDisabledToolsByReason } from "./confluent/tools/tool-availability.js";
+import { ToolName } from "./confluent/tools/tool-name.js";
+import { ToolHandlerRegistry } from "./confluent/tools/tool-registry.js";
+import { initEnv } from "./env.js";
+import { logger, setLogLevel } from "./logger.js";
+import { generateApiKey, TransportManager } from "./mcp/transports/index.js";
+import { ServerRuntime } from "./server-runtime.js";
+/**
+ * Resolve the operator's tool allow/block-list into the set `ServerRuntime`
+ * gates on — or `undefined` when neither list was configured, preserving the
+ * "no filter configured" sentinel rather than materializing an all-tools set
+ * that would mean the same thing while muddying the runtime's contract.
+ */
+export function resolveAllowedToolNames(allowTools, blockTools) {
+    if (allowTools.length === 0 && blockTools.length === 0) {
+        return undefined;
+    }
+    return new Set(getFilteredToolNames(allowTools, blockTools));
+}
+/**
+ * Determine the subset of ToolHandlers to register: those left enabled by the
+ * runtime's operator allow/block-list (`runtime.isToolAllowed`) whose predicate
+ * is also satisfied (typically by at least one configured connection).
+ **/
+export function getToolHandlersToRegister(runtime) {
+    const toolHandlersToRegister = new Map();
+    const knownIds = new Set(Object.keys(runtime.config.connections));
+    // Pass 1: drop tools excluded by the allow/block list (logged per-tool —
+    // the reason is config-driven, not predicate-driven, so it doesn't fold
+    // into the grouped warning emitted later). The filter lives on the runtime
+    // so registration and the list-configured-connections tool read one source of truth.
+    const candidates = [];
+    for (const toolName of Object.values(ToolName)) {
+        if (!runtime.isToolAllowed(toolName)) {
+            logger.warn(`Tool ${toolName} disabled due to allow/block list rules`);
+            continue;
+        }
+        candidates.push([toolName, ToolHandlerRegistry.getToolHandler(toolName)]);
+    }
+    // Pass 2: register tools that are enabled on at least one connection, plus
+    // connection-independent tools (docs, diagnostics), which carry no per-connection
+    // verdict and so stay available even on a zero-connection config.
+    for (const [toolName, handler] of candidates) {
+        const enabledIds = handler.enabledConnectionIds(runtime);
+        // Unreachable: enabledConnectionIds() is derived by iterating
+        // runtime.config.connections, so every id it yields is already a known key.
+        // A non-empty unknownIds means that derivation has broken.
+        const unknownIds = enabledIds.filter((id) => !knownIds.has(id));
+        if (unknownIds.length > 0) {
+            throw new Error(`Wacky -- Tool ${toolName}: enabledConnectionIds() returned unknown connection ID(s): ${unknownIds.join(", ")}`);
+        }
+        if (enabledIds.length > 0 || handler.isConnectionIndependent) {
+            toolHandlersToRegister.set(toolName, handler);
+            logger.info(`Tool ${toolName} enabled`);
+        }
+    }
+    // Pass 3: emit one grouped warning per (connectionId, reason) for tools
+    // that are fully disabled — readers see the missing config piece and the
+    // list of all tools blocked by it in a single line, rather than one
+    // line per tool.
+    for (const group of groupDisabledToolsByReason(candidates, runtime)) {
+        logger.warn(`Tools disabled on connection '${group.connectionId}' — ${group.reason}: ${group.toolNames.join(", ")}`);
+    }
+    // Raise an error if no tools are enabled, as the server would be non-functional without any tools.
+    if (toolHandlersToRegister.size === 0) {
+        throw new Error("No tools enabled. Please check your configuration and environment variables.");
+    }
+    return toolHandlersToRegister;
+}
+/**
+ * Resolve the Segment write key handed to `TelemetryService.initialize`.
+ *
+ * Precedence: an explicit YAML `server.analytics.write_key` wins; otherwise
+ * fall back to `buildConfig.TELEMETRY_WRITE_KEY` (the value `npm pack` injects
+ * at release time). On unpacked / dev builds the build-time value is empty,
+ * so an absent YAML field produces an empty-string fallback that
+ * `TelemetryService` treats as "no key supplied" — analytics stays off.
+ *
+ * Extracted from `main()` so the precedence is unit-testable without booting
+ * the full server.
+ */
+export function resolveTelemetryWriteKey(mcpConfig) {
+    return (mcpConfig.server.analytics?.write_key ?? buildConfig.TELEMETRY_WRITE_KEY);
+}
+/**
+ * One opt-out for usage analytics and error reporting: either the
+ * `DO_NOT_TRACK` env var (consoledonottrack.com) or the YAML
+ * `server.do_not_track` field disables tracking.
+ */
+export function resolveDoNotTrack(serverDoNotTrack, envDoNotTrack) {
+    return serverDoNotTrack || envDoNotTrack;
+}
+export function outputApiKey() {
+    const apiKey = generateApiKey();
+    console.log("\nGenerated MCP API Key:");
+    console.log("=".repeat(64));
+    console.log(apiKey);
+    console.log("=".repeat(64));
+    console.log("\nAdd this to your .env file:");
+    console.log(`MCP_API_KEY=${apiKey}\n`);
+}
+/**
+ * Bootstrap a starter `config.yaml` in the current working directory by
+ * copying one of the bundled example templates, then ensure the new file
+ * is listed in `<cwd>/.gitignore` so credentials filled in later don't
+ * slip into git.
+ *
+ * Resolved relative to `import.meta.url` (the compiled `dist/index.js`)
+ * so this keeps working when invoked via `npx`, where `process.cwd()`
+ * is the user's project but the example file lives next to the install.
+ *
+ * Refuses to overwrite an existing destination so an accidental rerun
+ * cannot wipe credentials the user already filled in. The write uses
+ * `wx` (exclusive create) so the existence check and the create happen
+ * as a single syscall — there is no TOCTOU window where another process
+ * could create the file between a precheck and the write.
+ *
+ * @param oauth When true, copy `config.oauth.example.yaml` (the minimal
+ *   OAuth template); when false, copy `config.example.yaml` (the
+ *   fully-annotated direct/api-key template). The CLI flag in the EEXIST
+ *   error message is selected to match.
+ */
+export function outputInitConfig(oauth = false) {
+    const sourceFileName = oauth
+        ? "config.oauth.example.yaml"
+        : "config.example.yaml";
+    const flagName = oauth ? "init-oauth-config" : "init-config";
+    const sourceUrl = new URL(`../${sourceFileName}`, import.meta.url);
+    const destPath = path.resolve("config.yaml");
+    const contents = fs.readFileSync(sourceUrl, "utf-8");
+    try {
+        fs.writeFileSync(destPath, contents, { flag: "wx" });
+    }
+    catch (err) {
+        if (err.code === "EEXIST") {
+            throw new Error(`config.yaml already exists at ${destPath}. ` +
+                `Remove or rename it before running --${flagName}.`);
+        }
+        throw err;
+    }
+    const gitignoreNote = ensureGitignoreEntry(destPath);
+    console.log(`wrote ./config.yaml (${gitignoreNote})`);
+    // OAuth has no credentials to edit; the bundled template is already
+    // runnable as-is. The api-key template, by contrast, ships placeholder
+    // values the user must fill in before the server can connect.
+    console.log(oauth
+        ? `Next: run with --config ./config.yaml`
+        : `Next: edit credentials in config.yaml and run with --config ./config.yaml`);
+}
+/**
+ * Ensure the basename of `filePath` is listed in `<dirname(filePath)>/.gitignore`.
+ * Creates the gitignore if missing; appends idempotently if present (matching
+ * trimmed lines verbatim — `*.yaml` globs or `/config.yaml` anchors are not
+ * recognized, so a user who already wrote either form will see a duplicate
+ * `config.yaml` entry, which is harmless).
+ *
+ * @returns A short note describing what happened, suitable for the success message.
+ */
+function ensureGitignoreEntry(filePath) {
+    const dir = path.dirname(filePath);
+    const fileName = path.basename(filePath);
+    const gitignorePath = path.join(dir, ".gitignore");
+    if (!fs.existsSync(gitignorePath)) {
+        fs.writeFileSync(gitignorePath, `${fileName}\n`);
+        return "added to .gitignore";
+    }
+    const existing = fs.readFileSync(gitignorePath, "utf-8");
+    const alreadyListed = existing
+        .split("\n")
+        .some((line) => line.trim() === fileName);
+    if (alreadyListed) {
+        return ".gitignore already excludes it";
+    }
+    const prefix = existing.length > 0 && !existing.endsWith("\n") ? "\n" : "";
+    fs.appendFileSync(gitignorePath, `${prefix}${fileName}\n`);
+    return "added to .gitignore";
+}
+export function outputToolList(filteredToolNames) {
+    const MAX_DESC_LENGTH = 120;
+    // Bucket by ToolCategory. Today's callers pass `filteredToolNames` in
+    // registry-declaration order, which already roughly groups same-category
+    // tools, but we re-bucket explicitly here so the rendered layout doesn't
+    // depend on that incidental ordering.
+    const byCategory = new Map();
+    // --list-tools runs before any config is loaded, so there is no real runtime.
+    // A zero-connection runtime makes getRegisteredToolConfig() return each tool's
+    // authored config verbatim (no connectionId augmentation), which is exactly
+    // the connection-independent catalog view this listing wants.
+    const runtime = new ServerRuntime(new MCPServerConfiguration({ connections: {} }), {});
+    for (const toolName of filteredToolNames) {
+        const handler = ToolHandlerRegistry.getToolHandler(toolName);
+        const config = handler.getRegisteredToolConfig(runtime);
+        let desc = config.description.replaceAll(/\s+/g, " ").trim();
+        if (desc.length > MAX_DESC_LENGTH) {
+            desc = desc.slice(0, MAX_DESC_LENGTH - 3) + "...";
+        }
+        let bucket = byCategory.get(handler.category);
+        bucket ??= [];
+        byCategory.set(handler.category, bucket);
+        bucket.push({ name: toolName, desc });
+    }
+    // Categories rendered lex-sorted (kebab-case enum values sort cleanly);
+    // within each category, tools preserve the order they appeared in
+    // `filteredToolNames` (today: registry-declaration order, as supplied
+    // by the caller).
+    const sortedCategories = Array.from(byCategory.keys()).sort((a, b) => a.localeCompare(b));
+    sortedCategories.forEach((category, idx) => {
+        console.log(`\x1b[1;36m${category}:\x1b[0m`);
+        for (const { name, desc } of byCategory.get(category)) {
+            console.log(`  \x1b[32m${name}\x1b[0m: ${desc}`);
+        }
+        // Blank line between sections, but not after the last category.
+        if (idx < sortedCategories.length - 1)
+            console.log("");
+    });
+}
+/**
+ * Dispatch the CLI's mutually-exclusive early-exit modes — generate-key,
+ * init-config, init-oauth-config, and list-tools — before the server
+ * bootstrap begins. Returns `{ handled: false }` when none apply, in
+ * which case the caller continues with normal startup.
+ *
+ * On init-config failure, the friendly error message is returned in
+ * `stderr` rather than written here, so the caller controls writing to
+ * stderr and exiting.
+ */
+export function handleEarlyExits(cliOptions) {
+    if (cliOptions.generateKey) {
+        outputApiKey();
+        return { handled: true, exitCode: 0 };
+    }
+    if (cliOptions.initConfig) {
+        return runOutputInitConfig(false);
+    }
+    if (cliOptions.initOauthConfig) {
+        return runOutputInitConfig(true);
+    }
+    if (cliOptions.listTools) {
+        outputToolList(getFilteredToolNames(cliOptions.allowTools ?? [], cliOptions.blockTools ?? []));
+        return { handled: true, exitCode: 0 };
+    }
+    return { handled: false };
+}
+function runOutputInitConfig(oauth) {
+    try {
+        outputInitConfig(oauth);
+        return { handled: true, exitCode: 0 };
+    }
+    catch (error) {
+        const msg = error instanceof Error ? error.message : String(error);
+        const flag = oauth ? "--init-oauth-config" : "--init-config";
+        return { handled: true, exitCode: 1, stderr: `${flag} failed: ${msg}` };
+    }
+}
+/**
+ * Tear the server down on a shutdown signal, then exit. Every step runs inside
+ * a try/finally so a rejection from any one — most plausibly a client manager
+ * failing to disconnect — is logged but never strands the process: the exit
+ * always fires. `exit` is injected (defaulting to `process.exit`) so this
+ * guarantee is unit-testable without stubbing the global.
+ */
+export async function performCleanup(deps, exit = (code) => process.exit(code)) {
+    logger.info("Shutting down...");
+    try {
+        await deps.telemetry.shutdown();
+        await deps.transportManager.stop();
+        // shutdown() is race-safe with an in-flight bootstrap.
+        deps.runtime.oauthHolder?.shutdown();
+        await deps.runtime.disconnectAll();
+    }
+    catch (error) {
+        captureException(error);
+        logger.error({ err: error }, "Error during shutdown");
+    }
+    finally {
+        await closeSentry();
+        exit(0);
+    }
+}
+async function main() {
+    try {
+        // Parse command line arguments.(NO LONGER LOADS ENV VARS FROM -e file!)
+        const cliOptions = parseCliArgs(process.argv);
+        const earlyExit = handleEarlyExits(cliOptions);
+        if (earlyExit.handled) {
+            if (earlyExit.exitCode === 1) {
+                console.error(earlyExit.stderr);
+            }
+            process.exit(earlyExit.exitCode);
+        }
+        const allowedToolNames = resolveAllowedToolNames(cliOptions.allowTools ?? [], cliOptions.blockTools ?? []);
+        if (cliOptions.envFile) {
+            loadDotEnvFile(cliOptions.envFile);
+        }
+        // Convert our known env vars into a typed Environment obj.
+        const env = initEnv();
+        let mcpConfig;
+        // Load and validate configuration — from YAML file if --config provided, else from env vars + CLI overrides.
+        if (cliOptions.config) {
+            mcpConfig = loadConfigFromYaml(cliOptions.config, process.env);
+        }
+        else {
+            mcpConfig = buildConfigFromEnvAndCli(env, {
+                disableAuth: cliOptions.disableAuth,
+                allowedHosts: cliOptions.allowedHosts,
+                kafkaConfig: cliOptions.kafkaConfig,
+                oauth: cliOptions.oauth,
+                ccloudEnv: cliOptions.ccloudEnv,
+            });
+        }
+        setLogLevel(mcpConfig.server.log_level);
+        // Transport selection: YAML config is authoritative when --config is used;
+        // CLI flag (or its default) is used on the env-var path.
+        const transports = cliOptions.config
+            ? mcpConfig.server.transports
+            : cliOptions.transports;
+        // One consent switch gates usage analytics and error reporting alike.
+        const doNotTrack = resolveDoNotTrack(mcpConfig.server.do_not_track, env.DO_NOT_TRACK);
+        TelemetryService.initialize({
+            doNotTrack,
+            writeKey: resolveTelemetryWriteKey(mcpConfig),
+        });
+        // Distinct connection auth types (no ids/secrets) — helps triage which
+        // config path an error came from (e.g. oauth-only bugs).
+        const connectionTypes = [
+            ...new Set(Object.values(mcpConfig.connections).map((c) => c.type)),
+        ];
+        // Initialized here — once config + log level resolve so consent is known —
+        // to catch tool-handler, transport, and shutdown errors.
+        initSentry({
+            doNotTrack,
+            dsn: resolveSentryDsn(),
+            release: getPackageVersion(),
+            transports,
+            connectionTypes,
+        });
+        const telemetry = TelemetryService.getInstance();
+        logger.info(`${mcpConfig.getConnectionIds().length} connections loaded successfully`);
+        const runtime = ServerRuntime.fromConfig(mcpConfig, allowedToolNames);
+        const serverVersion = getPackageVersion();
+        telemetry.setCommonProperties({ serverVersion });
+        const toolHandlers = getToolHandlersToRegister(runtime);
+        logger.info({ enabledTools: [...toolHandlers.keys()] }, `${toolHandlers.size} tool(s) enabled`);
+        // Warn if auth is disabled
+        if (mcpConfig.server.auth.disabled) {
+            logger.warn("Authentication is DISABLED for HTTP/SSE transports. " +
+                "This should only be used in development environments.");
+        }
+        const transportManager = new TransportManager({
+            disableAuth: mcpConfig.server.auth.disabled,
+            allowedHosts: mcpConfig.server.auth.allowed_hosts,
+            apiKey: mcpConfig.server.auth.api_key,
+        });
+        const serverOptions = {
+            serverVersion,
+            toolHandlers,
+            runtime,
+            track: (props) => telemetry.track(TelemetryEvent.TOOL_CALL, {
+                ...props,
+            }),
+            captureError: (error, toolName) => captureException(error, { tags: { toolName } }),
+        };
+        // Start all transports with a single call
+        logger.info(`Starting transports: ${transports.join(", ")}`);
+        await transportManager.start({
+            serverOptions,
+            types: transports,
+            http: {
+                port: mcpConfig.server.http.port,
+                host: mcpConfig.server.http.host,
+                mcpEndpointPath: mcpConfig.server.http.mcp_endpoint,
+                sseEndpointPath: mcpConfig.server.http.sse_endpoint,
+                sseMessageEndpointPath: mcpConfig.server.http.sse_message_endpoint,
+            },
+        });
+        // Boot-time invariants (config source, active transports, connection
+        // types) ride this one-shot event rather than every TOOL_CALL — they
+        // don't change after startup, so duplicating them per tool call buys
+        // nothing. Warehouse queries join SERVER_START to TOOL_CALL on
+        // `serverSessionId` (a common property) when slicing is needed.
+        telemetry.track(TelemetryEvent.SERVER_START, {
+            ...buildConfigTelemetry(cliOptions, mcpConfig, transports),
+        });
+        // Set up cleanup handlers
+        const cleanup = () => performCleanup({ telemetry, transportManager, runtime });
+        process.on("SIGINT", cleanup);
+        process.on("SIGTERM", cleanup);
+        process.on("SIGQUIT", cleanup);
+        process.on("SIGUSR2", cleanup);
+    }
+    catch (error) {
+        if (error instanceof DisplayedCommandLineUsageError) {
+            process.exit(0);
+        }
+        captureException(error);
+        logger.error({ err: error }, "Error starting server");
+        process.exit(1);
+    }
+}
+if (process.env.NODE_ENV !== "test") {
+    await main();
+}
+//# sourceMappingURL=server-main.js.map

package/dist/server-main.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"server-main.js","sourceRoot":"","sources":["../src/server-main.ts"],"names":[],"mappings":";AAGA,OAAO,EACL,8BAA8B,EAC9B,oBAAoB,EACpB,iBAAiB,EACjB,cAAc,EACd,YAAY,GACb,MAAM,aAAa,CAAC;AACrB,OAAO,EACL,wBAAwB,EACxB,kBAAkB,EAClB,sBAAsB,GACvB,MAAM,sBAAsB,CAAC;AAC9B,OAAO,EAAE,oBAAoB,EAAE,MAAM,oCAAoC,CAAC;AAC1E,OAAO,EAAE,WAAW,EAAE,EAAE,EAAE,IAAI,EAAE,MAAM,6BAA6B,CAAC;AACpE,OAAO,EACL,gBAAgB,EAChB,WAAW,EACX,UAAU,EACV,gBAAgB,GACjB,MAAM,0BAA0B,CAAC;AAClC,OAAO,EAAE,cAAc,EAAE,gBAAgB,EAAE,MAAM,6BAA6B,CAAC;AAK/E,OAAO,EAAE,0BAA0B,EAAE,MAAM,2CAA2C,CAAC;AACvF,OAAO,EAAE,QAAQ,EAAE,MAAM,mCAAmC,CAAC;AAC7D,OAAO,EAAE,mBAAmB,EAAE,MAAM,uCAAuC,CAAC;AAC5E,OAAO,EAAE,OAAO,EAAE,MAAM,aAAa,CAAC;AACtC,OAAO,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,gBAAgB,CAAC;AAErD,OAAO,EAAE,cAAc,EAAE,gBAAgB,EAAE,MAAM,8BAA8B,CAAC;AAChF,OAAO,EAAE,aAAa,EAAE,MAAM,wBAAwB,CAAC;AAEvD;;;;;GAKG;AACH,MAAM,UAAU,uBAAuB,CACrC,UAAoB,EACpB,UAAoB;IAEpB,IAAI,UAAU,CAAC,MAAM,KAAK,CAAC,IAAI,UAAU,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACvD,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,OAAO,IAAI,GAAG,CAAC,oBAAoB,CAAC,UAAU,EAAE,UAAU,CAAC,CAAC,CAAC;AAC/D,CAAC;AAED;;;;IAII;AACJ,MAAM,UAAU,yBAAyB,CACvC,OAAsB;IAEtB,MAAM,sBAAsB,GAAG,IAAI,GAAG,EAAyB,CAAC;IAChE,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC,CAAC;IAElE,yEAAyE;IACzE,wEAAwE;IACxE,2EAA2E;IAC3E,qFAAqF;IACrF,MAAM,UAAU,GAA4C,EAAE,CAAC;IAC/D,KAAK,MAAM,QAAQ,IAAI,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAC,EAAE,CAAC;QAC/C,IAAI,CAAC,OAAO,CAAC,aAAa,CAAC,QAAQ,CAAC,EAAE,CAAC;YACrC,MAAM,CAAC,IAAI,CAAC,QAAQ,QAAQ,yCAAyC,CAAC,CAAC;YACvE,SAAS;QACX,CAAC;QACD,UAAU,CAAC,IAAI,CAAC,CAAC,QAAQ,EAAE,mBAAmB,CAAC,cAAc,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC;IAC5E,CAAC;IAED,2EAA2E;IAC3E,kFAAkF;IAClF,kEAAkE;IAClE,KAAK,MAAM,CAAC,QAAQ,EAAE,OAAO,CAAC,IAAI,UAAU,EAAE,CAAC;QAC7C,MAAM,UAAU,GAAG,OAAO,CAAC,oBAAoB,CAAC,OAAO,CAAC,CAAC;QACzD,8DAA8D;QAC9D,4EAA4E;QAC5E,2DAA2D;QAC3D,MAAM,UAAU,GAAG,UAAU,CAAC,MAAM,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC;QAChE,IAAI,UAAU,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAC1B,MAAM,IAAI,KAAK,CACb,iBAAiB,QAAQ,+DAA+D,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAChH,CAAC;QACJ,CAAC;QACD,IAAI,UAAU,CAAC,MAAM,GAAG,CAAC,IAAI,OAAO,CAAC,uBAAuB,EAAE,CAAC;YAC7D,sBAAsB,CAAC,GAAG,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;YAC9C,MAAM,CAAC,IAAI,CAAC,QAAQ,QAAQ,UAAU,CAAC,CAAC;QAC1C,CAAC;IACH,CAAC;IAED,wEAAwE;IACxE,yEAAyE;IACzE,oEAAoE;IACpE,iBAAiB;IACjB,KAAK,MAAM,KAAK,IAAI,0BAA0B,CAAC,UAAU,EAAE,OAAO,CAAC,EAAE,CAAC;QACpE,MAAM,CAAC,IAAI,CACT,iCAAiC,KAAK,CAAC,YAAY,OAAO,KAAK,CAAC,MAAM,KAAK,KAAK,CAAC,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CACxG,CAAC;IACJ,CAAC;IAED,mGAAmG;IACnG,IAAI,sBAAsB,CAAC,IAAI,KAAK,CAAC,EAAE,CAAC;QACtC,MAAM,IAAI,KAAK,CACb,8EAA8E,CAC/E,CAAC;IACJ,CAAC;IAED,OAAO,sBAAsB,CAAC;AAChC,CAAC;AAED;;;;;;;;;;;GAWG;AACH,MAAM,UAAU,wBAAwB,CACtC,SAAiC;IAEjC,OAAO,CACL,SAAS,CAAC,MAAM,CAAC,SAAS,EAAE,SAAS,IAAI,WAAW,CAAC,mBAAmB,CACzE,CAAC;AACJ,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,iBAAiB,CAC/B,gBAAyB,EACzB,aAAsB;IAEtB,OAAO,gBAAgB,IAAI,aAAa,CAAC;AAC3C,CAAC;AAED,MAAM,UAAU,YAAY;IAC1B,MAAM,MAAM,GAAG,cAAc,EAAE,CAAC;IAChC,OAAO,CAAC,GAAG,CAAC,0BAA0B,CAAC,CAAC;IACxC,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC;IAC5B,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;IACpB,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC;IAC5B,OAAO,CAAC,GAAG,CAAC,+BAA+B,CAAC,CAAC;IAC7C,OAAO,CAAC,GAAG,CAAC,eAAe,MAAM,IAAI,CAAC,CAAC;AACzC,CAAC;AAED;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,MAAM,UAAU,gBAAgB,CAAC,QAAiB,KAAK;IACrD,MAAM,cAAc,GAAG,KAAK;QAC1B,CAAC,CAAC,2BAA2B;QAC7B,CAAC,CAAC,qBAAqB,CAAC;IAC1B,MAAM,QAAQ,GAAG,KAAK,CAAC,CAAC,CAAC,mBAAmB,CAAC,CAAC,CAAC,aAAa,CAAC;IAC7D,MAAM,SAAS,GAAG,IAAI,GAAG,CAAC,MAAM,cAAc,EAAE,EAAE,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IACnE,MAAM,QAAQ,GAAG,IAAI,CAAC,OAAO,CAAC,aAAa,CAAC,CAAC;IAE7C,MAAM,QAAQ,GAAG,EAAE,CAAC,YAAY,CAAC,SAAS,EAAE,OAAO,CAAC,CAAC;IACrD,IAAI,CAAC;QACH,EAAE,CAAC,aAAa,CAAC,QAAQ,EAAE,QAAQ,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC;IACvD,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,IAAK,GAA6B,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;YACrD,MAAM,IAAI,KAAK,CACb,iCAAiC,QAAQ,IAAI;gBAC3C,wCAAwC,QAAQ,GAAG,CACtD,CAAC;QACJ,CAAC;QACD,MAAM,GAAG,CAAC;IACZ,CAAC;IAED,MAAM,aAAa,GAAG,oBAAoB,CAAC,QAAQ,CAAC,CAAC;IAErD,OAAO,CAAC,GAAG,CAAC,wBAAwB,aAAa,GAAG,CAAC,CAAC;IACtD,oEAAoE;IACpE,uEAAuE;IACvE,8DAA8D;IAC9D,OAAO,CAAC,GAAG,CACT,KAAK;QACH,CAAC,CAAC,uCAAuC;QACzC,CAAC,CAAC,2EAA2E,CAChF,CAAC;AACJ,CAAC;AAED;;;;;;;;GAQG;AACH,SAAS,oBAAoB,CAAC,QAAgB;IAC5C,MAAM,GAAG,GAAG,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;IACnC,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;IACzC,MAAM,aAAa,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,YAAY,CAAC,CAAC;IAEnD,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,aAAa,CAAC,EAAE,CAAC;QAClC,EAAE,CAAC,aAAa,CAAC,aAAa,EAAE,GAAG,QAAQ,IAAI,CAAC,CAAC;QACjD,OAAO,qBAAqB,CAAC;IAC/B,CAAC;IAED,MAAM,QAAQ,GAAG,EAAE,CAAC,YAAY,CAAC,aAAa,EAAE,OAAO,CAAC,CAAC;IACzD,MAAM,aAAa,GAAG,QAAQ;SAC3B,KAAK,CAAC,IAAI,CAAC;SACX,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,EAAE,KAAK,QAAQ,CAAC,CAAC;IAC5C,IAAI,aAAa,EAAE,CAAC;QAClB,OAAO,gCAAgC,CAAC;IAC1C,CAAC;IAED,MAAM,MAAM,GAAG,QAAQ,CAAC,MAAM,GAAG,CAAC,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC;IAC3E,EAAE,CAAC,cAAc,CAAC,aAAa,EAAE,GAAG,MAAM,GAAG,QAAQ,IAAI,CAAC,CAAC;IAC3D,OAAO,qBAAqB,CAAC;AAC/B,CAAC;AAED,MAAM,UAAU,cAAc,CAAC,iBAA6B;IAC1D,MAAM,eAAe,GAAG,GAAG,CAAC;IAE5B,sEAAsE;IACtE,yEAAyE;IACzE,yEAAyE;IACzE,sCAAsC;IACtC,MAAM,UAAU,GAAG,IAAI,GAAG,EAGvB,CAAC;IACJ,8EAA8E;IAC9E,+EAA+E;IAC/E,4EAA4E;IAC5E,8DAA8D;IAC9D,MAAM,OAAO,GAAG,IAAI,aAAa,CAC/B,IAAI,sBAAsB,CAAC,EAAE,WAAW,EAAE,EAAE,EAAE,CAAC,EAC/C,EAAE,CACH,CAAC;IACF,KAAK,MAAM,QAAQ,IAAI,iBAAiB,EAAE,CAAC;QACzC,MAAM,OAAO,GAAG,mBAAmB,CAAC,cAAc,CAAC,QAAQ,CAAC,CAAC;QAC7D,MAAM,MAAM,GAAG,OAAO,CAAC,uBAAuB,CAAC,OAAO,CAAC,CAAC;QACxD,IAAI,IAAI,GAAG,MAAM,CAAC,WAAW,CAAC,UAAU,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC;QAC7D,IAAI,IAAI,CAAC,MAAM,GAAG,eAAe,EAAE,CAAC;YAClC,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,eAAe,GAAG,CAAC,CAAC,GAAG,KAAK,CAAC;QACpD,CAAC;QACD,IAAI,MAAM,GAAG,UAAU,CAAC,GAAG,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;QAC9C,MAAM,KAAK,EAAE,CAAC;QACd,UAAU,CAAC,GAAG,CAAC,OAAO,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;QACzC,MAAM,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC;IACxC,CAAC;IAED,wEAAwE;IACxE,kEAAkE;IAClE,sEAAsE;IACtE,kBAAkB;IAClB,MAAM,gBAAgB,GAAG,KAAK,CAAC,IAAI,CAAC,UAAU,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CACnE,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,CACnB,CAAC;IACF,gBAAgB,CAAC,OAAO,CAAC,CAAC,QAAQ,EAAE,GAAG,EAAE,EAAE;QACzC,OAAO,CAAC,GAAG,CAAC,aAAa,QAAQ,UAAU,CAAC,CAAC;QAC7C,KAAK,MAAM,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,UAAU,CAAC,GAAG,CAAC,QAAQ,CAAE,EAAE,CAAC;YACvD,OAAO,CAAC,GAAG,CAAC,aAAa,IAAI,YAAY,IAAI,EAAE,CAAC,CAAC;QACnD,CAAC;QACD,gEAAgE;QAChE,IAAI,GAAG,GAAG,gBAAgB,CAAC,MAAM,GAAG,CAAC;YAAE,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IACzD,CAAC,CAAC,CAAC;AACL,CAAC;AAaD;;;;;;;;;GASG;AACH,MAAM,UAAU,gBAAgB,CAAC,UAAsB;IACrD,IAAI,UAAU,CAAC,WAAW,EAAE,CAAC;QAC3B,YAAY,EAAE,CAAC;QACf,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC,EAAE,CAAC;IACxC,CAAC;IACD,IAAI,UAAU,CAAC,UAAU,EAAE,CAAC;QAC1B,OAAO,mBAAmB,CAAC,KAAK,CAAC,CAAC;IACpC,CAAC;IACD,IAAI,UAAU,CAAC,eAAe,EAAE,CAAC;QAC/B,OAAO,mBAAmB,CAAC,IAAI,CAAC,CAAC;IACnC,CAAC;IACD,IAAI,UAAU,CAAC,SAAS,EAAE,CAAC;QACzB,cAAc,CACZ,oBAAoB,CAClB,UAAU,CAAC,UAAU,IAAI,EAAE,EAC3B,UAAU,CAAC,UAAU,IAAI,EAAE,CAC5B,CACF,CAAC;QACF,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC,EAAE,CAAC;IACxC,CAAC;IACD,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC;AAC5B,CAAC;AAED,SAAS,mBAAmB,CAAC,KAAc;IACzC,IAAI,CAAC;QACH,gBAAgB,CAAC,KAAK,CAAC,CAAC;QACxB,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC,EAAE,CAAC;IACxC,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,GAAG,GAAG,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QACnE,MAAM,IAAI,GAAG,KAAK,CAAC,CAAC,CAAC,qBAAqB,CAAC,CAAC,CAAC,eAAe,CAAC;QAC7D,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC,EAAE,MAAM,EAAE,GAAG,IAAI,YAAY,GAAG,EAAE,EAAE,CAAC;IAC1E,CAAC;AACH,CAAC;AAED;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,cAAc,CAClC,IAIC,EACD,OAA+B,CAAC,IAAI,EAAE,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC;IAE3D,MAAM,CAAC,IAAI,CAAC,kBAAkB,CAAC,CAAC;IAChC,IAAI,CAAC;QACH,MAAM,IAAI,CAAC,SAAS,CAAC,QAAQ,EAAE,CAAC;QAChC,MAAM,IAAI,CAAC,gBAAgB,CAAC,IAAI,EAAE,CAAC;QACnC,uDAAuD;QACvD,IAAI,CAAC,OAAO,CAAC,WAAW,EAAE,QAAQ,EAAE,CAAC;QACrC,MAAM,IAAI,CAAC,OAAO,CAAC,aAAa,EAAE,CAAC;IACrC,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,gBAAgB,CAAC,KAAK,CAAC,CAAC;QACxB,MAAM,CAAC,KAAK,CAAC,EAAE,GAAG,EAAE,KAAK,EAAE,EAAE,uBAAuB,CAAC,CAAC;IACxD,CAAC;YAAS,CAAC;QACT,MAAM,WAAW,EAAE,CAAC;QACpB,IAAI,CAAC,CAAC,CAAC,CAAC;IACV,CAAC;AACH,CAAC;AAED,KAAK,UAAU,IAAI;IACjB,IAAI,CAAC;QACH,wEAAwE;QACxE,MAAM,UAAU,GAAG,YAAY,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;QAE9C,MAAM,SAAS,GAAG,gBAAgB,CAAC,UAAU,CAAC,CAAC;QAC/C,IAAI,SAAS,CAAC,OAAO,EAAE,CAAC;YACtB,IAAI,SAAS,CAAC,QAAQ,KAAK,CAAC,EAAE,CAAC;gBAC7B,OAAO,CAAC,KAAK,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC;YAClC,CAAC;YACD,OAAO,CAAC,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAC;QACnC,CAAC;QAED,MAAM,gBAAgB,GAAG,uBAAuB,CAC9C,UAAU,CAAC,UAAU,IAAI,EAAE,EAC3B,UAAU,CAAC,UAAU,IAAI,EAAE,CAC5B,CAAC;QAEF,IAAI,UAAU,CAAC,OAAO,EAAE,CAAC;YACvB,cAAc,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC;QACrC,CAAC;QAED,2DAA2D;QAC3D,MAAM,GAAG,GAAG,OAAO,EAAE,CAAC;QAEtB,IAAI,SAAiC,CAAC;QACtC,6GAA6G;QAC7G,IAAI,UAAU,CAAC,MAAM,EAAE,CAAC;YACtB,SAAS,GAAG,kBAAkB,CAAC,UAAU,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,CAAC,CAAC;QACjE,CAAC;aAAM,CAAC;YACN,SAAS,GAAG,wBAAwB,CAAC,GAAG,EAAE;gBACxC,WAAW,EAAE,UAAU,CAAC,WAAW;gBACnC,YAAY,EAAE,UAAU,CAAC,YAAY;gBACrC,WAAW,EAAE,UAAU,CAAC,WAAW;gBACnC,KAAK,EAAE,UAAU,CAAC,KAAK;gBACvB,SAAS,EAAE,UAAU,CAAC,SAAS;aAChC,CAAC,CAAC;QACL,CAAC;QAED,WAAW,CAAC,SAAS,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;QAExC,2EAA2E;QAC3E,yDAAyD;QACzD,MAAM,UAAU,GAAG,UAAU,CAAC,MAAM;YAClC,CAAC,CAAC,SAAS,CAAC,MAAM,CAAC,UAAU;YAC7B,CAAC,CAAC,UAAU,CAAC,UAAU,CAAC;QAE1B,sEAAsE;QACtE,MAAM,UAAU,GAAG,iBAAiB,CAClC,SAAS,CAAC,MAAM,CAAC,YAAY,EAC7B,GAAG,CAAC,YAAY,CACjB,CAAC;QAEF,gBAAgB,CAAC,UAAU,CAAC;YAC1B,UAAU;YACV,QAAQ,EAAE,wBAAwB,CAAC,SAAS,CAAC;SAC9C,CAAC,CAAC;QAEH,uEAAuE;QACvE,yDAAyD;QACzD,MAAM,eAAe,GAAG;YACtB,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,SAAS,CAAC,WAAW,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;SACpE,CAAC;QAEF,2EAA2E;QAC3E,yDAAyD;QACzD,UAAU,CAAC;YACT,UAAU;YACV,GAAG,EAAE,gBAAgB,EAAE;YACvB,OAAO,EAAE,iBAAiB,EAAE;YAC5B,UAAU;YACV,eAAe;SAChB,CAAC,CAAC;QACH,MAAM,SAAS,GAAG,gBAAgB,CAAC,WAAW,EAAE,CAAC;QAEjD,MAAM,CAAC,IAAI,CACT,GAAG,SAAS,CAAC,gBAAgB,EAAE,CAAC,MAAM,kCAAkC,CACzE,CAAC;QAEF,MAAM,OAAO,GAAG,aAAa,CAAC,UAAU,CAAC,SAAS,EAAE,gBAAgB,CAAC,CAAC;QAEtE,MAAM,aAAa,GAAG,iBAAiB,EAAE,CAAC;QAE1C,SAAS,CAAC,mBAAmB,CAAC,EAAE,aAAa,EAAE,CAAC,CAAC;QAEjD,MAAM,YAAY,GAAG,yBAAyB,CAAC,OAAO,CAAC,CAAC;QAExD,MAAM,CAAC,IAAI,CACT,EAAE,YAAY,EAAE,CAAC,GAAG,YAAY,CAAC,IAAI,EAAE,CAAC,EAAE,EAC1C,GAAG,YAAY,CAAC,IAAI,kBAAkB,CACvC,CAAC;QAEF,2BAA2B;QAC3B,IAAI,SAAS,CAAC,MAAM,CAAC,IAAI,CAAC,QAAQ,EAAE,CAAC;YACnC,MAAM,CAAC,IAAI,CACT,sDAAsD;gBACpD,uDAAuD,CAC1D,CAAC;QACJ,CAAC;QAED,MAAM,gBAAgB,GAAG,IAAI,gBAAgB,CAAC;YAC5C,WAAW,EAAE,SAAS,CAAC,MAAM,CAAC,IAAI,CAAC,QAAQ;YAC3C,YAAY,EAAE,SAAS,CAAC,MAAM,CAAC,IAAI,CAAC,aAAa;YACjD,MAAM,EAAE,SAAS,CAAC,MAAM,CAAC,IAAI,CAAC,OAAO;SACtC,CAAC,CAAC;QAEH,MAAM,aAAa,GAA2B;YAC5C,aAAa;YACb,YAAY;YACZ,OAAO;YACP,KAAK,EAAE,CAAC,KAAK,EAAE,EAAE,CACf,SAAS,CAAC,KAAK,CAAC,cAAc,CAAC,SAAS,EAAE;gBACxC,GAAG,KAAK;aACT,CAAC;YACJ,YAAY,EAAE,CAAC,KAAK,EAAE,QAAQ,EAAE,EAAE,CAChC,gBAAgB,CAAC,KAAK,EAAE,EAAE,IAAI,EAAE,EAAE,QAAQ,EAAE,EAAE,CAAC;SAClD,CAAC;QAEF,0CAA0C;QAC1C,MAAM,CAAC,IAAI,CAAC,wBAAwB,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QAC7D,MAAM,gBAAgB,CAAC,KAAK,CAAC;YAC3B,aAAa;YACb,KAAK,EAAE,UAAU;YACjB,IAAI,EAAE;gBACJ,IAAI,EAAE,SAAS,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI;gBAChC,IAAI,EAAE,SAAS,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI;gBAChC,eAAe,EAAE,SAAS,CAAC,MAAM,CAAC,IAAI,CAAC,YAAY;gBACnD,eAAe,EAAE,SAAS,CAAC,MAAM,CAAC,IAAI,CAAC,YAAY;gBACnD,sBAAsB,EAAE,SAAS,CAAC,MAAM,CAAC,IAAI,CAAC,oBAAoB;aACnE;SACF,CAAC,CAAC;QAEH,qEAAqE;QACrE,qEAAqE;QACrE,qEAAqE;QACrE,+DAA+D;QAC/D,gEAAgE;QAChE,SAAS,CAAC,KAAK,CAAC,cAAc,CAAC,YAAY,EAAE;YAC3C,GAAG,oBAAoB,CAAC,UAAU,EAAE,SAAS,EAAE,UAAU,CAAC;SAC3D,CAAC,CAAC;QAEH,0BAA0B;QAC1B,MAAM,OAAO,GAAG,GAAG,EAAE,CACnB,cAAc,CAAC,EAAE,SAAS,EAAE,gBAAgB,EAAE,OAAO,EAAE,CAAC,CAAC;QAE3D,OAAO,CAAC,EAAE,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;QAC9B,OAAO,CAAC,EAAE,CAAC,SAAS,EAAE,OAAO,CAAC,CAAC;QAC/B,OAAO,CAAC,EAAE,CAAC,SAAS,EAAE,OAAO,CAAC,CAAC;QAC/B,OAAO,CAAC,EAAE,CAAC,SAAS,EAAE,OAAO,CAAC,CAAC;IACjC,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAI,KAAK,YAAY,8BAA8B,EAAE,CAAC;YACpD,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAClB,CAAC;QACD,gBAAgB,CAAC,KAAK,CAAC,CAAC;QACxB,MAAM,CAAC,KAAK,CAAC,EAAE,GAAG,EAAE,KAAK,EAAE,EAAE,uBAAuB,CAAC,CAAC;QACtD,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;AACH,CAAC;AAED,IAAI,OAAO,CAAC,GAAG,CAAC,QAAQ,KAAK,MAAM,EAAE,CAAC;IACpC,MAAM,IAAI,EAAE,CAAC;AACf,CAAC"}

package/dist/server-runtime.d.ts

@@ -1,6 +1,7 @@
-import { MCPServerConfiguration } from "./config/index.js";
-import { BaseClientManager } from "./confluent/base-client-manager.js";
+import type { MCPServerConfiguration } from "./config/index.js";
+import type { BaseClientManager } from "./confluent/base-client-manager.js";
 import { OAuthHolder } from "./confluent/oauth/oauth-holder.js";
+import type { ToolName } from "./confluent/tools/tool-name.js";
 /**
  * Aggregate of all runtime state threaded through the server.
  *
@@ -17,12 +18,26 @@ export declare class ServerRuntime {
      * before any handler that needs Confluent access.
      */
     readonly oauthHolder: OAuthHolder | undefined;
-    constructor(config: MCPServerConfiguration, clientManagers: Record<string, BaseClientManager>, oauthHolder?: OAuthHolder | undefined);
     /**
-     * Convenience accessor for the single-connection period.
-     * Remove (or make multi-connection-aware) when issue #151 lands.
+     * Tool names the operator's allow/block-list left enabled, or `undefined`
+     * when no list was configured (all tools allowed — cli.ts's default-on
+     * behavior). The `undefined`-means-unfiltered sentinel is this class's own
+     * business: callers ask {@link isToolAllowed} rather than branching on it.
      */
-    get clientManager(): BaseClientManager;
-    static fromConfig(config: MCPServerConfiguration): ServerRuntime;
+    private readonly allowedToolNames;
+    constructor(config: MCPServerConfiguration, clientManagers: Record<string, BaseClientManager>, oauthHolder?: OAuthHolder | undefined, allowedToolNames?: ReadonlySet<ToolName> | undefined);
+    /**
+     * Whether the operator's allow/block-list leaves `name` invokable. Always
+     * `true` when no list was configured. The single source of truth for the
+     * operator filter, shared by tool registration and the `list-configured-connections`
+     * tool so the advertised set and the reported set can never diverge.
+     */
+    isToolAllowed(name: ToolName): boolean;
+    /**
+     * Disconnect every per-connection client manager — the teardown counterpart
+     * to the per-connection construction in {@link fromConfig}.
+     */
+    disconnectAll(): Promise<void>;
+    static fromConfig(config: MCPServerConfiguration, allowedToolNames?: ReadonlySet<ToolName> | undefined): ServerRuntime;
 }
 //# sourceMappingURL=server-runtime.d.ts.map

package/dist/server-runtime.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"server-runtime.d.ts","sourceRoot":"","sources":["../src/server-runtime.ts"],"names":[],"mappings":"AAAA,OAAO,EAEL,sBAAsB,EACvB,MAAM,sBAAsB,CAAC;AAC9B,OAAO,EAAE,iBAAiB,EAAE,MAAM,uCAAuC,CAAC;AAG1E,OAAO,EAAE,WAAW,EAAE,MAAM,sCAAsC,CAAC;AAEnE;;;;GAIG;AACH,qBAAa,aAAa;IACxB,QAAQ,CAAC,MAAM,EAAE,sBAAsB,CAAC;IACxC,QAAQ,CAAC,cAAc,EAAE,MAAM,CAAC,MAAM,EAAE,iBAAiB,CAAC,CAAC;IAC3D;;;;;;OAMG;IACH,QAAQ,CAAC,WAAW,EAAE,WAAW,GAAG,SAAS,CAAC;gBAG5C,MAAM,EAAE,sBAAsB,EAC9B,cAAc,EAAE,MAAM,CAAC,MAAM,EAAE,iBAAiB,CAAC,EACjD,WAAW,GAAE,WAAW,GAAG,SAAqB;IAOlD;;;OAGG;IACH,IAAI,aAAa,IAAI,iBAAiB,CAarC;IAED,MAAM,CAAC,UAAU,CAAC,MAAM,EAAE,sBAAsB,GAAG,aAAa;CA4CjE"}
+{"version":3,"file":"server-runtime.d.ts","sourceRoot":"","sources":["../src/server-runtime.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EACV,sBAAsB,EAEvB,MAAM,sBAAsB,CAAC;AAC9B,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,uCAAuC,CAAC;AAG/E,OAAO,EAAE,WAAW,EAAE,MAAM,sCAAsC,CAAC;AACnE,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,mCAAmC,CAAC;AAElE;;;;GAIG;AACH,qBAAa,aAAa;IACxB,QAAQ,CAAC,MAAM,EAAE,sBAAsB,CAAC;IACxC,QAAQ,CAAC,cAAc,EAAE,MAAM,CAAC,MAAM,EAAE,iBAAiB,CAAC,CAAC;IAC3D;;;;;;OAMG;IACH,QAAQ,CAAC,WAAW,EAAE,WAAW,GAAG,SAAS,CAAC;IAE9C;;;;;OAKG;IACH,OAAO,CAAC,QAAQ,CAAC,gBAAgB,CAAoC;gBAGnE,MAAM,EAAE,sBAAsB,EAC9B,cAAc,EAAE,MAAM,CAAC,MAAM,EAAE,iBAAiB,CAAC,EACjD,WAAW,GAAE,WAAW,GAAG,SAAqB,EAChD,gBAAgB,GAAE,WAAW,CAAC,QAAQ,CAAC,GAAG,SAAqB;IAQjE;;;;;OAKG;IACH,aAAa,CAAC,IAAI,EAAE,QAAQ,GAAG,OAAO;IAMtC;;;OAGG;IACG,aAAa,IAAI,OAAO,CAAC,IAAI,CAAC;IAkBpC,MAAM,CAAC,UAAU,CACf,MAAM,EAAE,sBAAsB,EAC9B,gBAAgB,GAAE,WAAW,CAAC,QAAQ,CAAC,GAAG,SAAqB,GAC9D,aAAa;CAiDjB"}

package/dist/server-runtime.js

@@ -17,57 +17,74 @@ export class ServerRuntime {
      * before any handler that needs Confluent access.
      */
     oauthHolder;
-    constructor(config, clientManagers, oauthHolder = undefined) {
+    /**
+     * Tool names the operator's allow/block-list left enabled, or `undefined`
+     * when no list was configured (all tools allowed — cli.ts's default-on
+     * behavior). The `undefined`-means-unfiltered sentinel is this class's own
+     * business: callers ask {@link isToolAllowed} rather than branching on it.
+     */
+    allowedToolNames;
+    constructor(config, clientManagers, oauthHolder = undefined, allowedToolNames = undefined) {
         this.config = config;
         this.clientManagers = clientManagers;
         this.oauthHolder = oauthHolder;
+        this.allowedToolNames = allowedToolNames;
     }
     /**
-     * Convenience accessor for the single-connection period.
-     * Remove (or make multi-connection-aware) when issue #151 lands.
+     * Whether the operator's allow/block-list leaves `name` invokable. Always
+     * `true` when no list was configured. The single source of truth for the
+     * operator filter, shared by tool registration and the `list-configured-connections`
+     * tool so the advertised set and the reported set can never diverge.
      */
-    get clientManager() {
-        const managers = Object.values(this.clientManagers);
-        if (managers.length === 0) {
-            throw new Error("ServerRuntime has no client managers");
-        }
-        if (managers.length > 1) {
-            // enforceSingleConnectionOnly() in config/models.ts should prevent this at parse time;
-            // this guard is the runtime mirror of that constraint.
-            throw new Error("ServerRuntime has multiple client managers; use clientManagers[id] directly");
+    isToolAllowed(name) {
+        return (this.allowedToolNames === undefined || this.allowedToolNames.has(name));
+    }
+    /**
+     * Disconnect every per-connection client manager — the teardown counterpart
+     * to the per-connection construction in {@link fromConfig}.
+     */
+    async disconnectAll() {
+        // allSettled, not all: a single manager's disconnect() rejection must not
+        // abandon its siblings mid-shutdown. Wait for every disconnect, then raise
+        // an AggregateError carrying all failures so no error is silently dropped.
+        const results = await Promise.allSettled(Object.values(this.clientManagers).map((manager) => manager.disconnect()));
+        const failures = results
+            .filter((r) => r.status === "rejected")
+            .map((r) => r.reason);
+        if (failures.length > 0) {
+            throw new AggregateError(failures, `Failed to disconnect ${failures.length} of ${results.length} client manager(s)`);
         }
-        return managers[0];
     }
-    static fromConfig(config) {
+    static fromConfig(config, allowedToolNames = undefined) {
         const oauthConns = Object.values(config.connections).filter((c) => c.type === "oauth");
         if (oauthConns.length > 1) {
-            // `enforceSingleConnectionOnly()` already prevents this today; keep the
-            // defensive check so that when multi-connection support lands (#151),
-            // multi-OAuth is rejected explicitly rather than silently picking one.
+            // Only one OAuth connection is supported (the shared OAuthHolder owns a
+            // single CCloud identity). Reject multi-OAuth explicitly rather than
+            // silently picking one.
             throw new Error(`Multiple OAuth connections defined in configuration; only one is supported`);
         }
         const oauthConn = oauthConns[0];
         const oauthHolder = oauthConn
             ? new OAuthHolder(oauthConn.ccloud_env)
             : undefined;
-        // Construct a client manager for each connection in the config.
-        // (although currently there will only be one, see `enforceSingleConnectionOnly()`)
-        // When OAuth is in play, every connection's manager is bearer-auth-backed by
-        // the shared holder; otherwise, fall back to the per-connection direct factory.
+        // Construct a client manager per connection, keyed on the connection's own
+        // type — a direct connection always gets a DirectClientManager even when a
+        // sibling OAuth connection exists, so the epic's "OAuth Confluent Cloud +
+        // local Apache Kafka broker side by side" config wires each connection to a
+        // manager that can actually reach it.
         const clientManagers = Object.fromEntries(Object.entries(config.connections).map(([id, conn]) => {
-            if (oauthHolder && oauthConn) {
+            if (conn.type === "oauth") {
+                if (!oauthHolder) {
+                    throw new Error(`Wacky -- connection ${id} is oauth but no OAuthHolder was constructed`);
+                }
                 return [
                     id,
-                    new OAuthClientManager(oauthHolder, oauthConn.ccloud_env, oauthConn.kafka_debug),
+                    new OAuthClientManager(oauthHolder, conn.ccloud_env, conn.kafka_debug),
                 ];
             }
-            // No OAuth connection found, so every connection is direct.
-            if (conn.type !== "direct") {
-                throw new Error(`Internal error: connection ${id} is not direct but no OAuth holder was constructed`);
-            }
             return [id, constructDirectClientManager(conn)];
         }));
-        return new ServerRuntime(config, clientManagers, oauthHolder);
+        return new ServerRuntime(config, clientManagers, oauthHolder, allowedToolNames);
     }
 }
 //# sourceMappingURL=server-runtime.js.map

package/dist/server-runtime.js.map

@@ -1 +1 @@
-{"version":3,"file":"server-runtime.js","sourceRoot":"","sources":["../src/server-runtime.ts"],"names":[],"mappings":"AAKA,OAAO,EAAE,4BAA4B,EAAE,MAAM,yCAAyC,CAAC;AACvF,OAAO,EAAE,kBAAkB,EAAE,MAAM,wCAAwC,CAAC;AAC5E,OAAO,EAAE,WAAW,EAAE,MAAM,sCAAsC,CAAC;AAEnE;;;;GAIG;AACH,MAAM,OAAO,aAAa;IACf,MAAM,CAAyB;IAC/B,cAAc,CAAoC;IAC3D;;;;;;OAMG;IACM,WAAW,CAA0B;IAE9C,YACE,MAA8B,EAC9B,cAAiD,EACjD,cAAuC,SAAS;QAEhD,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC;QACrB,IAAI,CAAC,cAAc,GAAG,cAAc,CAAC;QACrC,IAAI,CAAC,WAAW,GAAG,WAAW,CAAC;IACjC,CAAC;IAED;;;OAGG;IACH,IAAI,aAAa;QACf,MAAM,QAAQ,GAAG,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC;QACpD,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAC1B,MAAM,IAAI,KAAK,CAAC,sCAAsC,CAAC,CAAC;QAC1D,CAAC;QACD,IAAI,QAAQ,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACxB,uFAAuF;YACvF,uDAAuD;YACvD,MAAM,IAAI,KAAK,CACb,6EAA6E,CAC9E,CAAC;QACJ,CAAC;QACD,OAAO,QAAQ,CAAC,CAAC,CAAE,CAAC;IACtB,CAAC;IAED,MAAM,CAAC,UAAU,CAAC,MAA8B;QAC9C,MAAM,UAAU,GAAG,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC,MAAM,CACzD,CAAC,CAAC,EAA8B,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,OAAO,CACtD,CAAC;QACF,IAAI,UAAU,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAC1B,wEAAwE;YACxE,sEAAsE;YACtE,uEAAuE;YACvE,MAAM,IAAI,KAAK,CACb,4EAA4E,CAC7E,CAAC;QACJ,CAAC;QACD,MAAM,SAAS,GAAG,UAAU,CAAC,CAAC,CAAC,CAAC;QAChC,MAAM,WAAW,GAAG,SAAS;YAC3B,CAAC,CAAC,IAAI,WAAW,CAAC,SAAS,CAAC,UAAU,CAAC;YACvC,CAAC,CAAC,SAAS,CAAC;QAEd,gEAAgE;QAChE,mFAAmF;QACnF,6EAA6E;QAC7E,gFAAgF;QAChF,MAAM,cAAc,GAAG,MAAM,CAAC,WAAW,CACvC,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,IAAI,CAAC,EAAE,EAAE;YACpD,IAAI,WAAW,IAAI,SAAS,EAAE,CAAC;gBAC7B,OAAO;oBACL,EAAE;oBACF,IAAI,kBAAkB,CACpB,WAAW,EACX,SAAS,CAAC,UAAU,EACpB,SAAS,CAAC,WAAW,CACtB;iBACO,CAAC;YACb,CAAC;YACD,4DAA4D;YAC5D,IAAI,IAAI,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;gBAC3B,MAAM,IAAI,KAAK,CACb,8BAA8B,EAAE,oDAAoD,CACrF,CAAC;YACJ,CAAC;YACD,OAAO,CAAC,EAAE,EAAE,4BAA4B,CAAC,IAAI,CAAC,CAAU,CAAC;QAC3D,CAAC,CAAC,CACH,CAAC;QACF,OAAO,IAAI,aAAa,CAAC,MAAM,EAAE,cAAc,EAAE,WAAW,CAAC,CAAC;IAChE,CAAC;CACF"}
+{"version":3,"file":"server-runtime.js","sourceRoot":"","sources":["../src/server-runtime.ts"],"names":[],"mappings":"AAKA,OAAO,EAAE,4BAA4B,EAAE,MAAM,yCAAyC,CAAC;AACvF,OAAO,EAAE,kBAAkB,EAAE,MAAM,wCAAwC,CAAC;AAC5E,OAAO,EAAE,WAAW,EAAE,MAAM,sCAAsC,CAAC;AAGnE;;;;GAIG;AACH,MAAM,OAAO,aAAa;IACf,MAAM,CAAyB;IAC/B,cAAc,CAAoC;IAC3D;;;;;;OAMG;IACM,WAAW,CAA0B;IAE9C;;;;;OAKG;IACc,gBAAgB,CAAoC;IAErE,YACE,MAA8B,EAC9B,cAAiD,EACjD,cAAuC,SAAS,EAChD,mBAAsD,SAAS;QAE/D,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC;QACrB,IAAI,CAAC,cAAc,GAAG,cAAc,CAAC;QACrC,IAAI,CAAC,WAAW,GAAG,WAAW,CAAC;QAC/B,IAAI,CAAC,gBAAgB,GAAG,gBAAgB,CAAC;IAC3C,CAAC;IAED;;;;;OAKG;IACH,aAAa,CAAC,IAAc;QAC1B,OAAO,CACL,IAAI,CAAC,gBAAgB,KAAK,SAAS,IAAI,IAAI,CAAC,gBAAgB,CAAC,GAAG,CAAC,IAAI,CAAC,CACvE,CAAC;IACJ,CAAC;IAED;;;OAGG;IACH,KAAK,CAAC,aAAa;QACjB,0EAA0E;QAC1E,2EAA2E;QAC3E,2EAA2E;QAC3E,MAAM,OAAO,GAAG,MAAM,OAAO,CAAC,UAAU,CACtC,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC,GAAG,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,UAAU,EAAE,CAAC,CAC1E,CAAC;QACF,MAAM,QAAQ,GAAG,OAAO;aACrB,MAAM,CAAC,CAAC,CAAC,EAA8B,EAAE,CAAC,CAAC,CAAC,MAAM,KAAK,UAAU,CAAC;aAClE,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC;QACxB,IAAI,QAAQ,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACxB,MAAM,IAAI,cAAc,CACtB,QAAQ,EACR,wBAAwB,QAAQ,CAAC,MAAM,OAAO,OAAO,CAAC,MAAM,oBAAoB,CACjF,CAAC;QACJ,CAAC;IACH,CAAC;IAED,MAAM,CAAC,UAAU,CACf,MAA8B,EAC9B,mBAAsD,SAAS;QAE/D,MAAM,UAAU,GAAG,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC,MAAM,CACzD,CAAC,CAAC,EAA8B,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,OAAO,CACtD,CAAC;QACF,IAAI,UAAU,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAC1B,wEAAwE;YACxE,qEAAqE;YACrE,wBAAwB;YACxB,MAAM,IAAI,KAAK,CACb,4EAA4E,CAC7E,CAAC;QACJ,CAAC;QACD,MAAM,SAAS,GAAG,UAAU,CAAC,CAAC,CAAC,CAAC;QAChC,MAAM,WAAW,GAAG,SAAS;YAC3B,CAAC,CAAC,IAAI,WAAW,CAAC,SAAS,CAAC,UAAU,CAAC;YACvC,CAAC,CAAC,SAAS,CAAC;QAEd,2EAA2E;QAC3E,2EAA2E;QAC3E,0EAA0E;QAC1E,4EAA4E;QAC5E,sCAAsC;QACtC,MAAM,cAAc,GAAG,MAAM,CAAC,WAAW,CACvC,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,IAAI,CAAC,EAAE,EAAE;YACpD,IAAI,IAAI,CAAC,IAAI,KAAK,OAAO,EAAE,CAAC;gBAC1B,IAAI,CAAC,WAAW,EAAE,CAAC;oBACjB,MAAM,IAAI,KAAK,CACb,uBAAuB,EAAE,8CAA8C,CACxE,CAAC;gBACJ,CAAC;gBACD,OAAO;oBACL,EAAE;oBACF,IAAI,kBAAkB,CACpB,WAAW,EACX,IAAI,CAAC,UAAU,EACf,IAAI,CAAC,WAAW,CACjB;iBACO,CAAC;YACb,CAAC;YACD,OAAO,CAAC,EAAE,EAAE,4BAA4B,CAAC,IAAI,CAAC,CAAU,CAAC;QAC3D,CAAC,CAAC,CACH,CAAC;QACF,OAAO,IAAI,aAAa,CACtB,MAAM,EACN,cAAc,EACd,WAAW,EACX,gBAAgB,CACjB,CAAC;IACJ,CAAC;CACF"}

package/dist/utils/quote-join-ids.d.ts

@@ -0,0 +1,9 @@
+/**
+ * Render a list of ids as a double-quoted, comma-separated string for prose
+ * (tool descriptions, error messages). The quoting keeps the list unambiguous
+ * when an id contains a comma; contained double quotes are backslash-escaped so
+ * the wrapping itself stays unambiguous. Returns "" for an empty list, so a
+ * caller wanting a placeholder can write `quoteJoinIds(ids) || "none"`.
+ */
+export declare function quoteJoinIds(ids: readonly string[]): string;
+//# sourceMappingURL=quote-join-ids.d.ts.map

package/dist/utils/quote-join-ids.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"quote-join-ids.d.ts","sourceRoot":"","sources":["../../src/utils/quote-join-ids.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AACH,wBAAgB,YAAY,CAAC,GAAG,EAAE,SAAS,MAAM,EAAE,GAAG,MAAM,CAE3D"}

package/dist/utils/quote-join-ids.js

@@ -0,0 +1,11 @@
+/**
+ * Render a list of ids as a double-quoted, comma-separated string for prose
+ * (tool descriptions, error messages). The quoting keeps the list unambiguous
+ * when an id contains a comma; contained double quotes are backslash-escaped so
+ * the wrapping itself stays unambiguous. Returns "" for an empty list, so a
+ * caller wanting a placeholder can write `quoteJoinIds(ids) || "none"`.
+ */
+export function quoteJoinIds(ids) {
+    return ids.map((id) => `"${id.replaceAll('"', '\\"')}"`).join(", ");
+}
+//# sourceMappingURL=quote-join-ids.js.map

package/dist/utils/quote-join-ids.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"quote-join-ids.js","sourceRoot":"","sources":["../../src/utils/quote-join-ids.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AACH,MAAM,UAAU,YAAY,CAAC,GAAsB;IACjD,OAAO,GAAG,CAAC,GAAG,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,IAAI,EAAE,CAAC,UAAU,CAAC,GAAG,EAAE,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AACtE,CAAC"}