@questpie/mcp 3.16.0 → 3.17.0

package/dist/create-server-CEWFf041.mjs

@@ -0,0 +1,2394 @@
+import { createAdapterContext, createContextFactory, defaultOperationScope, evaluateRouteAccess, executeJsonRoute, extractAppServices, introspectCollection, introspectGlobal, introspectRoutes, isJsonRoute, umbrellaScopeFor } from "questpie";
+import { randomUUID } from "node:crypto";
+import { types } from "node:util";
+import { snapshotBoundedBrokerValue } from "questpie/executor";
+import { z } from "zod";
+import { McpServer, ResourceTemplate } from "@modelcontextprotocol/sdk/server/mcp.js";
+import { ListToolsRequestSchema, ToolSchema } from "@modelcontextprotocol/sdk/types.js";
+
+//#region src/server/mcp-tool.ts
+var McpToolBuilder = class {
+	constructor(name, config) {
+		this.name = name;
+		this.config = config;
+	}
+	handler(handler) {
+		return Object.freeze({
+			__brand: "mcpTool",
+			name: this.name,
+			config: this.config,
+			handler
+		});
+	}
+};
+/**
+* Define a custom MCP tool, contributed by a module the same way collections and
+* routes are (via `ModuleDefinition.mcpTools`). `mcpTool(name, config).handler(fn)`
+* returns a frozen, branded {@link McpToolDefinition}; the CRUD/route tools the
+* framework auto-generates are the same shape.
+*
+* `config` mirrors the MCP tool contract: `inputSchema`/`outputSchema` (Zod),
+* `title`/`description`/`annotations` for discovery, plus the two QUESTPIE
+* authorization hooks that compose exactly like the built-in tools:
+* - `access` — required explicit opt-in and an {@link McpAccessRule} run against the caller's transport /
+*   accessMode / session (and, for an OAuth caller, its scopes). Same RBAC-style
+*   gate the CRUD tools use.
+* - `scopes` — the OAuth scopes an `oauth` caller must hold ({@link McpToolConfig.scopes}).
+*   Custom tools have no default scope mapping (unlike CRUD, there is no
+*   resource/operation to derive one from), so it is required; use `false` for
+*   an explicit no-OAuth-scope policy. The shipped scope gate ({@link scopeGateAllows}) enforces this at both
+*   `tools/list` (hidden) and `tools/call` (denied); `system`/`user` callers
+*   carry no scopes and skip it, so the effective bound is always `scopes ∩ RBAC`.
+*
+* @example
+* ```ts
+* export const ping = mcpTool("ops.ping", {
+*   access: ({ session }) => !!session,
+*   description: "Health probe",
+*   inputSchema: z.object({}),
+*   scopes: "routes:ops/ping:invoke", // only OAuth callers holding this scope
+* }).handler(async () => ({ content: [{ type: "text", text: "pong" }] }));
+* ```
+*/
+function mcpTool(name, config) {
+	return new McpToolBuilder(name, config);
+}
+function isMcpTool(value) {
+	return !!value && typeof value === "object" && value["__brand"] === "mcpTool" && typeof value.handler === "function";
+}
+
+//#endregion
+//#region src/server/principal.ts
+const hasOwnData = (descriptors, key) => {
+	const descriptor = descriptors[key];
+	return !!descriptor && "value" in descriptor;
+};
+const isObject = (value) => typeof value === "object" && value !== null && !Array.isArray(value);
+const nonEmptyString = (value) => typeof value === "string" && value.length > 0;
+const isString = (value) => typeof value === "string";
+function hasOwnString(value, key) {
+	try {
+		const descriptor = Object.getOwnPropertyDescriptor(value, key);
+		return !!descriptor && "value" in descriptor && nonEmptyString(descriptor.value);
+	} catch {
+		return false;
+	}
+}
+/**
+* Validate the complete MCP-facing principal discriminant without invoking
+* getters or reading inherited properties.
+*/
+function validateMcpPrincipal(value) {
+	if (!isObject(value)) return null;
+	try {
+		const descriptors = Object.getOwnPropertyDescriptors(value);
+		if (!hasOwnData(descriptors, "kind")) return null;
+		if (descriptors.kind.value === "system") return Object.keys(descriptors).length === 1 ? { kind: "system" } : null;
+		if (descriptors.kind.value === "user") {
+			if (Object.keys(descriptors).some((key) => ![
+				"kind",
+				"user",
+				"session"
+			].includes(key)) || !hasOwnData(descriptors, "user") || !isObject(descriptors.user.value) || !hasOwnString(descriptors.user.value, "id") || !hasOwnData(descriptors, "session") || !isObject(descriptors.session.value) || !hasOwnString(descriptors.session.value, "id")) return null;
+			return { kind: "user" };
+		}
+		if (descriptors.kind.value === "oauth") {
+			if (Object.keys(descriptors).some((key) => ![
+				"kind",
+				"user",
+				"clientId",
+				"scopes",
+				"tokenId"
+			].includes(key)) || !hasOwnData(descriptors, "user") || !isObject(descriptors.user.value) || !hasOwnString(descriptors.user.value, "id") || !hasOwnData(descriptors, "clientId") || !nonEmptyString(descriptors.clientId.value) || !hasOwnData(descriptors, "tokenId") || !isString(descriptors.tokenId.value) || !hasOwnData(descriptors, "scopes") || !Array.isArray(descriptors.scopes.value) || !descriptors.scopes.value.every(nonEmptyString)) return null;
+			return {
+				kind: "oauth",
+				scopes: [...descriptors.scopes.value]
+			};
+		}
+		return null;
+	} catch {
+		return null;
+	}
+}
+
+//#endregion
+//#region src/server/policy.ts
+const DEFAULT_MCP_CONFIG = {
+	crud: {
+		maxLimit: 100,
+		collections: {},
+		globals: {}
+	},
+	routes: { routes: {} },
+	resources: {},
+	http: {
+		accessMode: "user",
+		enableJsonResponse: true
+	},
+	stdio: { trustedMaintenance: false },
+	execution: {}
+};
+function isPlainObject(value) {
+	return !!value && typeof value === "object" && !Array.isArray(value);
+}
+const UNSAFE_CONFIG_KEYS = new Set([
+	"__proto__",
+	"prototype",
+	"constructor"
+]);
+function ownDataEntries(value) {
+	if (!isPlainObject(value)) return [];
+	try {
+		return Object.entries(Object.getOwnPropertyDescriptors(value)).filter(([key, descriptor]) => !UNSAFE_CONFIG_KEYS.has(key) && "value" in descriptor).map(([key, descriptor]) => [key, descriptor.value]);
+	} catch {
+		return [];
+	}
+}
+function safeCloneConfigValue(value) {
+	if (Array.isArray(value)) return value.map((entry) => safeCloneConfigValue(entry));
+	if (!isPlainObject(value)) return value;
+	const clone = Object.create(null);
+	for (const [key, entry] of ownDataEntries(value)) clone[key] = safeCloneConfigValue(entry);
+	return clone;
+}
+function mergeDeep(base, override) {
+	const out = safeCloneConfigValue(base);
+	for (const [key, value] of ownDataEntries(override)) if (isPlainObject(value) && isPlainObject(out[key])) out[key] = mergeDeep(out[key], value);
+	else if (value !== void 0) out[key] = safeCloneConfigValue(value);
+	return out;
+}
+function ownValue(record, key) {
+	if (!record || !Object.prototype.hasOwnProperty.call(record, key)) return;
+	return record[key];
+}
+function replaceOwnEntries(base, override) {
+	const next = safeCloneConfigValue(base ?? {});
+	for (const [key, value] of ownDataEntries(override)) next[key] = safeCloneConfigValue(value);
+	return next;
+}
+function resolveMcpConfig(app, override) {
+	const appConfig = app.state?.config?.mcp ?? {};
+	const safeOverride = safeCloneConfigValue(override);
+	const resolved = mergeDeep(mergeDeep(DEFAULT_MCP_CONFIG, appConfig), safeOverride);
+	if (safeOverride?.crud?.collections) resolved.crud = {
+		...resolved.crud,
+		collections: replaceOwnEntries(resolved.crud?.collections, safeOverride.crud.collections)
+	};
+	if (safeOverride?.crud?.globals) resolved.crud = {
+		...resolved.crud,
+		globals: replaceOwnEntries(resolved.crud?.globals, safeOverride.crud.globals)
+	};
+	if (safeOverride?.routes?.routes) resolved.routes = {
+		...resolved.routes,
+		routes: replaceOwnEntries(resolved.routes?.routes, safeOverride.routes.routes)
+	};
+	return resolved;
+}
+/**
+* Resolve workload authority maps atomically. A caller-provided map replaces
+* the corresponding app map instead of inheriting entries or nested authority.
+*/
+function resolveWorkloadMcpConfig(app, override) {
+	const resolved = resolveMcpConfig(app, override);
+	if (!override) return resolved;
+	const safeOverride = safeCloneConfigValue(override);
+	if (Object.prototype.hasOwnProperty.call(safeOverride.crud ?? {}, "collections")) resolved.crud = {
+		...resolved.crud,
+		collections: safeCloneConfigValue(safeOverride.crud?.collections ?? {})
+	};
+	if (Object.prototype.hasOwnProperty.call(safeOverride.crud ?? {}, "globals")) resolved.crud = {
+		...resolved.crud,
+		globals: safeCloneConfigValue(safeOverride.crud?.globals ?? {})
+	};
+	if (Object.prototype.hasOwnProperty.call(safeOverride.routes ?? {}, "routes")) resolved.routes = {
+		...resolved.routes,
+		routes: safeCloneConfigValue(safeOverride.routes?.routes ?? {})
+	};
+	for (const kind of [
+		"collections",
+		"globals",
+		"routes"
+	]) if (Object.prototype.hasOwnProperty.call(safeOverride.resources ?? {}, kind)) resolved.resources = {
+		...resolved.resources,
+		[kind]: safeCloneConfigValue(safeOverride.resources?.[kind] ?? {})
+	};
+	return resolved;
+}
+function resolveEntityPolicy(config, kind, name, _transport = "http") {
+	const crud = ownValue(config, "crud");
+	const routes = ownValue(config, "routes");
+	if (kind === "route") return normalizePolicy({ expose: false }, ownValue(ownValue(routes, "routes"), name));
+	if (kind === "global") return normalizePolicy({ expose: false }, ownValue(ownValue(crud, "globals"), name));
+	return normalizePolicy({ expose: false }, ownValue(ownValue(crud, "collections"), name));
+}
+function normalizePolicy(defaults, override) {
+	override = safeCloneConfigValue(override);
+	if (override === false) return {
+		expose: false,
+		operations: {},
+		operationScopes: {},
+		operationWorkloads: {}
+	};
+	const base = {
+		expose: defaults.expose ?? true,
+		operations: { ...defaults.operations ?? {} },
+		requiredScopes: defaults.requiredScopes,
+		operationScopes: { ...defaults.operationScopes ?? {} },
+		workload: defaults.workload,
+		operationWorkloads: { ...defaults.operationWorkloads ?? {} },
+		fields: defaults.fields,
+		description: defaults.description
+	};
+	if (override === void 0) return base;
+	if (override === true) return {
+		...base,
+		expose: true
+	};
+	return {
+		...base,
+		...override,
+		expose: override.expose ?? true,
+		operations: {
+			...base.operations,
+			...override.operations ?? {}
+		},
+		requiredScopes: override.requiredScopes ?? base.requiredScopes,
+		operationScopes: {
+			...base.operationScopes,
+			...override.operationScopes ?? {}
+		},
+		workload: override.workload ?? base.workload,
+		operationWorkloads: {
+			...base.operationWorkloads,
+			...override.operationWorkloads ?? {}
+		}
+	};
+}
+function workloadRequirementForOperation(policy, operation) {
+	return policy.operationWorkloads[operation] ?? policy.workload;
+}
+function operationRule(policy, operation) {
+	return policy.operations[operation];
+}
+/** Normalize an {@link McpRequiredScopes} declaration to a scope list. */
+function normalizeRequiredScopes(required) {
+	if (required === void 0 || required === false) return [];
+	return typeof required === "string" ? [required] : [...required];
+}
+/**
+* Resolve the scopes an OAuth caller must hold for a given entity operation.
+*
+* Precedence (most specific wins), each level is declarative data:
+* 1. `policy.operationScopes[operationName]` — per-operation override.
+* 2. `policy.requiredScopes` — entity-level requirement (all operations).
+* 3. the default `<resource>:<name>:<verb>` mapping derived from the kind.
+*
+* A level set to `false` explicitly requires no scope (stops the fallback).
+* Returns a (possibly empty) scope list; empty means "no scope required". This
+* resolves the requirement; the deny/register decision that consumes it is
+* {@link scopeGateAllows}.
+*/
+function requiredScopesForOperation(policy, kind, name, operationName, operationKind) {
+	const perOperation = policy.operationScopes[operationName];
+	if (perOperation !== void 0) return normalizeRequiredScopes(perOperation);
+	if (policy.requiredScopes !== void 0) return normalizeRequiredScopes(policy.requiredScopes);
+	return [defaultOperationScope(kind, name, operationKind)];
+}
+/**
+* The consented scopes carried by the request, or `undefined` when the caller
+* is not OAuth-authenticated. Reads `ctx.principal` (populated by MO6): only the
+* `oauth` principal carries `scopes`; `user` and `system` do not.
+*/
+function scopesFromContext(ctx) {
+	const principal = ctx.principal;
+	if (principal === void 0 || principal === null) return void 0;
+	const validated = validateMcpPrincipal(principal);
+	if (!validated) return null;
+	return validated.kind === "oauth" ? validated.scopes : void 0;
+}
+/**
+* The OAuth scope gate (MO8, extended by the umbrella model — LOCKED #2).
+*
+* Given the scopes the caller holds (from {@link scopesFromContext}) and the
+* scopes an operation requires (from {@link requiredScopesForOperation} or a
+* custom tool's `config.scopes`), decide whether the scope gate passes.
+*
+* Semantics:
+* - `heldScopes === undefined` → the caller is not OAuth-authenticated (`user`,
+*   `system`, or unauthenticated). The scope gate does not apply and PASSES;
+*   authorization is left entirely to RBAC / MCP rules. This is what keeps the
+*   first-party admin (`user`) and stdio (`system`) paths unchanged.
+* - Otherwise the caller is an `oauth` principal: the gate PASSES iff EVERY
+*   required scope is satisfied — a required scope is satisfied when the caller
+*   holds it directly OR holds its applicable coarse umbrella
+*   ({@link umbrellaScopeFor}). An empty `required` needs nothing, so it passes
+*   for everyone.
+*
+* The umbrella widening is deliberately narrow — it can only satisfy a
+* granular `<resource>:<name>:read|write` with the matching `<resource>:read`
+* or `<resource>:write` umbrella. `read` and `write` are independent (holding
+* `collections:write` never satisfies a `<name>:read` requirement, and vice
+* versa), and there is NO umbrella for `:delete` or `routes:…:invoke`. So the
+* umbrella grants convenience without ever over-granting across verb, resource
+* kind, or into delete/invoke.
+*
+* This gate is **additive** — it can only ever REMOVE access from an `oauth`
+* caller. It never grants access on its own: callers still run the MCP rule and
+* the collection/global `.access()` RBAC independently, and all must pass. The
+* effective `oauth` permission is therefore `scopes ∩ RBAC`.
+*/
+function scopeGateAllows(heldScopes, required) {
+	if (heldScopes === null) return false;
+	if (heldScopes === void 0) return true;
+	if (required.length === 0) return true;
+	const held = new Set(heldScopes);
+	return required.every((scope) => {
+		if (held.has(scope)) return true;
+		const umbrella = umbrellaScopeFor(scope);
+		return umbrella !== void 0 && held.has(umbrella);
+	});
+}
+async function evaluateMcpRule(rule, options) {
+	const scopes = scopesFromContext(options.ctx);
+	if (scopes === null) return false;
+	if (rule === void 0) return true;
+	if (typeof rule === "boolean") return rule;
+	return rule({
+		transport: options.transport,
+		accessMode: options.accessMode,
+		session: options.ctx.session,
+		scopes,
+		ctx: options.ctx
+	});
+}
+
+//#endregion
+//#region src/server/catalog.ts
+const COLLECTION_OPERATION_KINDS = {
+	list: "read",
+	count: "read",
+	get: "read",
+	create: "write",
+	update: "write",
+	delete: "delete"
+};
+const GLOBAL_OPERATION_KINDS = {
+	get: "read",
+	update: "write"
+};
+const sanitizeRouteKey = (key) => key.replace(/[:/[\].]+/g, ".").replace(/\.+/g, ".").replace(/^\./, "").replace(/\.$/, "");
+const operationIsExplicitlyEnabled = (policy, operation) => {
+	const rule = operationRule(policy, operation);
+	return rule !== void 0 && rule !== false;
+};
+const addRequiredScopes = (target, required) => {
+	if (required === void 0 || required === false) return;
+	const scopes = typeof required === "string" ? [required] : required;
+	for (const scope of scopes) if (!target.includes(scope)) target.push(scope);
+};
+const hasOwn$1 = (record, key) => !!record && Object.prototype.hasOwnProperty.call(record, key);
+function ownSection(record, key) {
+	return hasOwn$1(record, key) ? record[key] : void 0;
+}
+function snapshotWorkload(requirement) {
+	if (!requirement) return void 0;
+	return Object.freeze({
+		capabilities: Object.freeze([...requirement.capabilities]),
+		...requirement.handoff ? { handoff: requirement.handoff } : {}
+	});
+}
+function snapshotPolicy(policy) {
+	const operations = Object.create(null);
+	for (const [name, rule] of Object.entries(policy.operations)) operations[name] = rule;
+	const operationScopes = Object.create(null);
+	for (const [name, scopes] of Object.entries(policy.operationScopes)) operationScopes[name] = Array.isArray(scopes) ? Object.freeze([...scopes]) : scopes;
+	const operationWorkloads = Object.create(null);
+	for (const [name, workload] of Object.entries(policy.operationWorkloads)) {
+		const snapshot = snapshotWorkload(workload);
+		if (snapshot) operationWorkloads[name] = snapshot;
+	}
+	return Object.freeze({
+		...policy,
+		operations: Object.freeze(operations),
+		requiredScopes: Array.isArray(policy.requiredScopes) ? Object.freeze([...policy.requiredScopes]) : policy.requiredScopes,
+		operationScopes: Object.freeze(operationScopes),
+		workload: snapshotWorkload(policy.workload),
+		operationWorkloads: Object.freeze(operationWorkloads),
+		fields: policy.fields ? Object.freeze({
+			include: policy.fields.include ? Object.freeze([...policy.fields.include]) : void 0,
+			exclude: policy.fields.exclude ? Object.freeze([...policy.fields.exclude]) : void 0
+		}) : void 0
+	});
+}
+function snapshotTool(candidate) {
+	const config = Object.freeze({
+		...candidate.config,
+		scopes: Array.isArray(candidate.config.scopes) ? Object.freeze([...candidate.config.scopes]) : candidate.config.scopes,
+		workload: snapshotWorkload(candidate.config.workload),
+		annotations: candidate.config.annotations ? Object.freeze({ ...candidate.config.annotations }) : void 0,
+		_meta: candidate.config["_meta"] ? Object.freeze({ ...candidate.config["_meta"] }) : void 0
+	});
+	return Object.freeze({
+		__brand: "mcpTool",
+		name: candidate.name,
+		config,
+		handler: candidate.handler
+	});
+}
+function readonlyMap(source) {
+	return Object.freeze({
+		get size() {
+			return source.size;
+		},
+		get: (key) => source.get(key),
+		has: (key) => source.has(key),
+		entries: () => source.entries(),
+		keys: () => source.keys(),
+		values: () => source.values(),
+		forEach: (callback, thisArg) => {
+			const view = readonlyMap(source);
+			source.forEach((value, key) => callback.call(thisArg, value, key, view));
+		},
+		[Symbol.iterator]: () => source[Symbol.iterator](),
+		[Symbol.toStringTag]: "Map"
+	});
+}
+function readonlySet(source) {
+	return Object.freeze({
+		get size() {
+			return source.size;
+		},
+		has: (value) => source.has(value),
+		entries: () => source.entries(),
+		keys: () => source.keys(),
+		values: () => source.values(),
+		forEach: (callback, thisArg) => {
+			const view = readonlySet(source);
+			source.forEach((value) => callback.call(thisArg, value, value, view));
+		},
+		[Symbol.iterator]: () => source[Symbol.iterator](),
+		[Symbol.toStringTag]: "Set"
+	});
+}
+function resolveMcpCatalog(app, config) {
+	const collections = /* @__PURE__ */ new Map();
+	const globals = /* @__PURE__ */ new Map();
+	const routes = /* @__PURE__ */ new Map();
+	const customTools = /* @__PURE__ */ new Map();
+	const oauthScopes = [];
+	const umbrellaScopes = [];
+	const releasedToolNames = /* @__PURE__ */ new Set();
+	const claimToolName = (name) => {
+		if (releasedToolNames.has(name)) throw new Error(`Duplicate MCP tool name: ${name}`);
+		releasedToolNames.add(name);
+	};
+	for (const name of Object.keys(app.getCollections())) {
+		const policy = snapshotPolicy(resolveEntityPolicy(config, "collection", name));
+		if (!policy.expose) continue;
+		const operations = Object.entries(COLLECTION_OPERATION_KINDS).filter(([operation]) => operationIsExplicitlyEnabled(policy, operation)).map(([operation, operationKind]) => {
+			const required = requiredScopesForOperation(policy, "collection", name, operation, operationKind);
+			addRequiredScopes(oauthScopes, required);
+			for (const scope of required) {
+				const umbrella = umbrellaScopeFor(scope);
+				if (umbrella && !umbrellaScopes.includes(umbrella)) umbrellaScopes.push(umbrella);
+			}
+			return operation;
+		});
+		if (operations.length > 0) {
+			for (const operation of operations) claimToolName(`collections.${name}.${operation}`);
+			collections.set(name, Object.freeze({
+				policy,
+				operations: Object.freeze([...operations])
+			}));
+		}
+	}
+	for (const name of Object.keys(app.getGlobals())) {
+		const policy = snapshotPolicy(resolveEntityPolicy(config, "global", name));
+		if (!policy.expose) continue;
+		const operations = Object.entries(GLOBAL_OPERATION_KINDS).filter(([operation]) => operationIsExplicitlyEnabled(policy, operation)).map(([operation, operationKind]) => {
+			const required = requiredScopesForOperation(policy, "global", name, operation, operationKind);
+			addRequiredScopes(oauthScopes, required);
+			for (const scope of required) {
+				const umbrella = umbrellaScopeFor(scope);
+				if (umbrella && !umbrellaScopes.includes(umbrella)) umbrellaScopes.push(umbrella);
+			}
+			return operation;
+		});
+		if (operations.length > 0) {
+			for (const operation of operations) claimToolName(`globals.${name}.${operation}`);
+			globals.set(name, Object.freeze({
+				policy,
+				operations: Object.freeze([...operations])
+			}));
+		}
+	}
+	for (const route$1 of introspectRoutes(app)) {
+		if (!isJsonRoute(route$1.definition) || route$1.meta?.mcp?.expose !== true) continue;
+		const policy = snapshotPolicy(resolveEntityPolicy(config, "route", route$1.key));
+		if (!policy.expose || !operationIsExplicitlyEnabled(policy, "execute")) continue;
+		addRequiredScopes(oauthScopes, requiredScopesForOperation(policy, "route", route$1.key, "execute", "invoke"));
+		const toolName = route$1.meta.mcp.name ?? `routes.${sanitizeRouteKey(route$1.key)}`;
+		claimToolName(toolName);
+		routes.set(route$1.key, Object.freeze({
+			policy,
+			operations: Object.freeze(["execute"]),
+			route: route$1,
+			toolName
+		}));
+	}
+	const configuredTools = app.state?.mcpTools ?? {};
+	for (const [key, candidate] of Object.entries(configuredTools)) {
+		if (!isMcpTool(candidate) || candidate.config.access === void 0 || candidate.config.scopes === void 0) continue;
+		if (candidate.config.access === false) continue;
+		const tool = snapshotTool(candidate);
+		const name = tool.name || key;
+		claimToolName(name);
+		customTools.set(name, Object.freeze({ tool }));
+		addRequiredScopes(oauthScopes, tool.config.scopes);
+	}
+	const resourceConfig = ownSection(config, "resources");
+	const configuredResourceCollections = ownSection(resourceConfig, "collections");
+	const configuredResourceGlobals = ownSection(resourceConfig, "globals");
+	const configuredResourceRoutes = ownSection(resourceConfig, "routes");
+	const resourceCollections = new Set([...collections.entries()].filter(([name, entry]) => hasOwn$1(configuredResourceCollections, name) && configuredResourceCollections?.[name] === true && entry.operations.some((operation) => [
+		"list",
+		"count",
+		"get"
+	].includes(operation))).map(([name]) => name));
+	const resourceGlobals = new Set([...globals.entries()].filter(([name, entry]) => hasOwn$1(configuredResourceGlobals, name) && configuredResourceGlobals?.[name] === true && entry.operations.includes("get")).map(([name]) => name));
+	const resourceRoutes = new Set([...routes.keys()].filter((name) => hasOwn$1(configuredResourceRoutes, name) && configuredResourceRoutes?.[name] === true));
+	return Object.freeze({
+		collections: readonlyMap(collections),
+		globals: readonlyMap(globals),
+		routes: readonlyMap(routes),
+		customTools: readonlyMap(customTools),
+		resources: Object.freeze({
+			collections: readonlySet(resourceCollections),
+			globals: readonlySet(resourceGlobals),
+			routes: readonlySet(resourceRoutes)
+		}),
+		oauth: Object.freeze({
+			scopes: Object.freeze([...oauthScopes, ...umbrellaScopes]),
+			scopesSupported: Object.freeze([...umbrellaScopes])
+		})
+	});
+}
+
+//#endregion
+//#region src/server/execution-boundary.ts
+const DEFAULT_MCP_EXECUTION_LIMITS = Object.freeze({
+	maxInputBytes: 64 * 1024,
+	maxInputDepth: 16,
+	maxOutputDepth: 64,
+	maxValueNodes: 1e4,
+	maxOutputBytes: 1024 * 1024,
+	timeoutMs: 3e4,
+	maxConcurrency: 64,
+	maxConcurrencyPerPrincipal: 8,
+	maxTools: 512,
+	maxResources: 512
+});
+const ABSOLUTE_MCP_EXECUTION_LIMITS = Object.freeze({
+	maxInputBytes: 1024 * 1024,
+	maxInputDepth: 64,
+	maxOutputDepth: 64,
+	maxValueNodes: 1e5,
+	maxOutputBytes: 4 * 1024 * 1024,
+	timeoutMs: 5 * 6e4,
+	maxConcurrency: 1024,
+	maxConcurrencyPerPrincipal: 1024,
+	maxTools: 2048,
+	maxResources: 2048
+});
+const PUBLIC_ERROR_META_KEY = "questpie/error";
+const PUBLIC_ERROR_CODES = new Set([
+	"access_denied",
+	"invalid_input",
+	"input_too_large",
+	"output_too_large",
+	"timeout",
+	"cancelled",
+	"busy",
+	"internal"
+]);
+var McpPublicError = class extends Error {
+	code;
+	correlationId;
+	constructor(code, correlationId = randomUUID()) {
+		super(`${publicMessage(code)} (${code}; correlationId=${correlationId})`);
+		this.name = "McpPublicError";
+		this.code = code;
+		this.correlationId = correlationId;
+	}
+};
+var McpAccessDeniedError = class extends Error {
+	constructor() {
+		super("MCP access denied");
+		this.name = "McpAccessDeniedError";
+	}
+};
+/** Read a public boundary code without touching an error message or accessor. */
+function mcpPublicErrorCode(error) {
+	if (!error || typeof error !== "object" || types.isProxy(error)) return;
+	try {
+		const descriptor = Object.getOwnPropertyDescriptor(error, "code");
+		return descriptor && "value" in descriptor && typeof descriptor.value === "string" && PUBLIC_ERROR_CODES.has(descriptor.value) ? descriptor.value : void 0;
+	} catch {
+		return;
+	}
+}
+function positiveInteger(value, fallback, maximum, name) {
+	if (value === void 0) return fallback;
+	if (!Number.isSafeInteger(value) || value <= 0 || value > maximum) throw new Error(`Invalid MCP execution limit: ${name}`);
+	return value;
+}
+function resolveMcpExecutionLimits(config) {
+	const limits = {
+		maxInputBytes: positiveInteger(config?.maxInputBytes, DEFAULT_MCP_EXECUTION_LIMITS.maxInputBytes, ABSOLUTE_MCP_EXECUTION_LIMITS.maxInputBytes, "maxInputBytes"),
+		maxInputDepth: positiveInteger(config?.maxInputDepth, DEFAULT_MCP_EXECUTION_LIMITS.maxInputDepth, ABSOLUTE_MCP_EXECUTION_LIMITS.maxInputDepth, "maxInputDepth"),
+		maxOutputDepth: positiveInteger(config?.maxOutputDepth, DEFAULT_MCP_EXECUTION_LIMITS.maxOutputDepth, ABSOLUTE_MCP_EXECUTION_LIMITS.maxOutputDepth, "maxOutputDepth"),
+		maxValueNodes: positiveInteger(config?.maxValueNodes, DEFAULT_MCP_EXECUTION_LIMITS.maxValueNodes, ABSOLUTE_MCP_EXECUTION_LIMITS.maxValueNodes, "maxValueNodes"),
+		maxOutputBytes: positiveInteger(config?.maxOutputBytes, DEFAULT_MCP_EXECUTION_LIMITS.maxOutputBytes, ABSOLUTE_MCP_EXECUTION_LIMITS.maxOutputBytes, "maxOutputBytes"),
+		timeoutMs: positiveInteger(config?.timeoutMs, DEFAULT_MCP_EXECUTION_LIMITS.timeoutMs, ABSOLUTE_MCP_EXECUTION_LIMITS.timeoutMs, "timeoutMs"),
+		maxConcurrency: positiveInteger(config?.maxConcurrency, DEFAULT_MCP_EXECUTION_LIMITS.maxConcurrency, ABSOLUTE_MCP_EXECUTION_LIMITS.maxConcurrency, "maxConcurrency"),
+		maxConcurrencyPerPrincipal: positiveInteger(config?.maxConcurrencyPerPrincipal, DEFAULT_MCP_EXECUTION_LIMITS.maxConcurrencyPerPrincipal, ABSOLUTE_MCP_EXECUTION_LIMITS.maxConcurrencyPerPrincipal, "maxConcurrencyPerPrincipal"),
+		maxTools: positiveInteger(config?.maxTools, DEFAULT_MCP_EXECUTION_LIMITS.maxTools, ABSOLUTE_MCP_EXECUTION_LIMITS.maxTools, "maxTools"),
+		maxResources: positiveInteger(config?.maxResources, DEFAULT_MCP_EXECUTION_LIMITS.maxResources, ABSOLUTE_MCP_EXECUTION_LIMITS.maxResources, "maxResources")
+	};
+	if (limits.maxConcurrencyPerPrincipal > limits.maxConcurrency) throw new Error("Invalid MCP execution limit: maxConcurrencyPerPrincipal");
+	return Object.freeze(limits);
+}
+function jsonStringBytes(value, maximum) {
+	if (maximum < 0) return 1;
+	if (maximum < 2 || value.length + 2 > maximum) return maximum + 1;
+	let bytes = 2;
+	for (let index = 0; index < value.length; index += 1) {
+		const code = value.charCodeAt(index);
+		if (code === 34 || code === 92) bytes += 2;
+		else if (code <= 31) bytes += code === 8 || code === 9 || code === 10 || code === 12 || code === 13 ? 2 : 6;
+		else if (code <= 127) bytes += 1;
+		else if (code <= 2047) bytes += 2;
+		else if (code >= 55296 && code <= 56319 && index + 1 < value.length && value.charCodeAt(index + 1) >= 56320 && value.charCodeAt(index + 1) <= 57343) {
+			bytes += 4;
+			index += 1;
+		} else if (code >= 55296 && code <= 57343) bytes += 6;
+		else bytes += 3;
+		if (bytes > maximum) return maximum + 1;
+	}
+	return bytes;
+}
+function isJsonContainer(value) {
+	if (!value || typeof value !== "object" || types.isProxy(value)) return false;
+	try {
+		const prototype = Object.getPrototypeOf(value);
+		return Array.isArray(value) ? prototype === Array.prototype : prototype === Object.prototype || prototype === null;
+	} catch {
+		return false;
+	}
+}
+function isJsonDate(value) {
+	if (!(value instanceof Date) || types.isProxy(value)) return false;
+	try {
+		return Object.getPrototypeOf(value) === Date.prototype && Number.isFinite(Date.prototype.getTime.call(value));
+	} catch {
+		return false;
+	}
+}
+function isArrayIndex(key, length) {
+	const index = Number(key);
+	return Number.isSafeInteger(index) && index >= 0 && index < length && String(index) === key;
+}
+function assertBoundedMcpValue(value, limits, code, correlationId = randomUUID()) {
+	const pending = [{
+		value,
+		depth: 0
+	}];
+	let nodes = 0;
+	let bytes = 0;
+	while (pending.length > 0) {
+		const next = pending.pop();
+		nodes += 1;
+		if (nodes > limits.maxValueNodes || next.depth > limits.maxValueDepth) throw new McpPublicError(code, correlationId);
+		const current = next.value;
+		if (current === null || typeof current === "boolean") bytes += 5;
+		else if (typeof current === "number") {
+			if (typeof current === "number" && !Number.isFinite(current)) throw new McpPublicError(code, correlationId);
+			bytes += 32;
+		} else if (typeof current === "string") bytes += jsonStringBytes(current, limits.maxBytes - bytes);
+		else if (typeof current === "bigint") bytes += jsonStringBytes(current.toString(), limits.maxBytes - bytes);
+		else if (isJsonDate(current)) bytes += 32;
+		else if (isJsonContainer(current)) {
+			let descriptors;
+			try {
+				descriptors = Object.getOwnPropertyDescriptors(current);
+			} catch {
+				throw new McpPublicError(code, correlationId);
+			}
+			const arrayLength = Array.isArray(current) ? current.length : void 0;
+			let arrayIndexes = 0;
+			bytes += 2;
+			for (const [key, descriptor] of Object.entries(descriptors)) {
+				if (key === "toJSON") throw new McpPublicError(code, correlationId);
+				if (arrayLength !== void 0 && isArrayIndex(key, arrayLength)) {
+					arrayIndexes += 1;
+					if (!("value" in descriptor)) throw new McpPublicError(code, correlationId);
+					pending.push({
+						value: descriptor.value,
+						depth: next.depth + 1
+					});
+					continue;
+				}
+				if (!descriptor.enumerable) continue;
+				if (!("value" in descriptor)) throw new McpPublicError(code, correlationId);
+				bytes += jsonStringBytes(key, limits.maxBytes - bytes) + 4;
+				pending.push({
+					value: descriptor.value,
+					depth: next.depth + 1
+				});
+			}
+			if (arrayLength !== void 0) {
+				if (arrayLength > limits.maxValueNodes) throw new McpPublicError(code, correlationId);
+				const holes = arrayLength - arrayIndexes;
+				nodes += holes;
+				bytes += Math.max(0, arrayLength - 1) + holes * 4;
+			}
+		} else if (current !== void 0) throw new McpPublicError(code, correlationId);
+		if (nodes > limits.maxValueNodes || bytes > limits.maxBytes) throw new McpPublicError(code, correlationId);
+	}
+}
+function snapshotBoundedMcpValue(value, limits, code, correlationId = randomUUID()) {
+	const snapshot = snapshotBoundedBrokerValue(value === void 0 ? null : value, limits.maxBytes, limits.maxValueDepth, limits.maxValueNodes);
+	if (!snapshot.ok) throw new McpPublicError(code, correlationId);
+	return snapshot.value;
+}
+function publicMessage(code) {
+	return code === "access_denied" ? "MCP access denied" : "MCP operation failed";
+}
+function classifyError(error, correlationId) {
+	if (!!error && (typeof error === "object" || typeof error === "function") && types.isProxy(error)) return new McpPublicError("internal", correlationId);
+	if (error instanceof McpPublicError) return error;
+	if (error instanceof McpAccessDeniedError || isLegacyAccessDenied(error)) return new McpPublicError("access_denied", correlationId);
+	if (error instanceof z.ZodError) return new McpPublicError("invalid_input", correlationId);
+	return new McpPublicError("internal", correlationId);
+}
+function isLegacyAccessDenied(error) {
+	if (!error || typeof error !== "object") return false;
+	try {
+		const descriptor = Object.getOwnPropertyDescriptor(error, "message");
+		return !!descriptor && "value" in descriptor && descriptor.value === "MCP access denied";
+	} catch {
+		return false;
+	}
+}
+function diagnosticError(error) {
+	try {
+		return Object.freeze({ kind: error instanceof Error ? "Error" : "Unknown" });
+	} catch {
+		return Object.freeze({ kind: "Unknown" });
+	}
+}
+function dataProperty(value, key) {
+	if (!value || typeof value !== "object" || types.isProxy(value)) return;
+	try {
+		const descriptor = Object.getOwnPropertyDescriptor(value, key);
+		return descriptor && "value" in descriptor ? descriptor.value : void 0;
+	} catch {
+		return;
+	}
+}
+function principalKey(ctx, transport, accessMode, workloadConcurrencyKey) {
+	if (accessMode === "system") return `${transport}:system`;
+	if (transport === "workload" && typeof workloadConcurrencyKey === "string" && workloadConcurrencyKey.length > 0) return `workload:${workloadConcurrencyKey.slice(0, 256)}`;
+	const principal = dataProperty(ctx, "principal");
+	const kind = dataProperty(principal, "kind");
+	if (kind === "oauth") {
+		const tokenId = dataProperty(principal, "tokenId");
+		if (typeof tokenId === "string" && tokenId.length > 0) return `oauth:${tokenId.slice(0, 256)}`;
+		const clientId = dataProperty(principal, "clientId");
+		const userId = dataProperty(dataProperty(principal, "user"), "id");
+		return `oauth:${String(clientId).slice(0, 128)}:${String(userId).slice(0, 128)}`;
+	}
+	if (kind === "user") {
+		const sessionId = dataProperty(dataProperty(principal, "session"), "id");
+		if (typeof sessionId === "string" && sessionId.length > 0) return `user:${sessionId.slice(0, 256)}`;
+	}
+	return `${transport}:anonymous`;
+}
+function safeRequestId(value) {
+	if (typeof value === "number") return Number.isSafeInteger(value) ? value : void 0;
+	return /^[\w.:-]{1,128}$/.test(value) ? value : void 0;
+}
+function toMcpToolError(error) {
+	const resolved = error instanceof McpPublicError ? error : classifyError(error, randomUUID());
+	return {
+		isError: true,
+		content: [{
+			type: "text",
+			text: publicMessage(resolved.code)
+		}],
+		_meta: { [PUBLIC_ERROR_META_KEY]: {
+			code: resolved.code,
+			correlationId: resolved.correlationId
+		} }
+	};
+}
+var McpExecutionGate = class {
+	active = 0;
+	activeByPrincipal = /* @__PURE__ */ new Map();
+	diagnosticActive = false;
+};
+var McpExecutionBoundary = class {
+	limits;
+	constructor(config = {}, gate = new McpExecutionGate()) {
+		this.config = config;
+		this.gate = gate;
+		this.limits = resolveMcpExecutionLimits(config);
+	}
+	emitDiagnostic(event) {
+		if (!this.config.onDiagnostic || this.gate.diagnosticActive) return;
+		this.gate.diagnosticActive = true;
+		Promise.resolve().then(() => this.config.onDiagnostic(Object.freeze(event))).catch(() => void 0).finally(() => {
+			this.gate.diagnosticActive = false;
+		});
+	}
+	acquireGlobal(correlationId) {
+		if (this.gate.active >= this.limits.maxConcurrency) throw new McpPublicError("busy", correlationId);
+		this.gate.active += 1;
+		return () => {
+			this.gate.active -= 1;
+		};
+	}
+	acquirePrincipal(key, correlationId) {
+		const active = this.gate.activeByPrincipal.get(key) ?? 0;
+		if (active >= this.limits.maxConcurrencyPerPrincipal) throw new McpPublicError("busy", correlationId);
+		this.gate.activeByPrincipal.set(key, active + 1);
+		return () => {
+			const next = (this.gate.activeByPrincipal.get(key) ?? 1) - 1;
+			if (next === 0) this.gate.activeByPrincipal.delete(key);
+			else this.gate.activeByPrincipal.set(key, next);
+		};
+	}
+	async execute(options) {
+		const startedAt = Date.now();
+		const correlationId = randomUUID();
+		const requestId = safeRequestId(options.extra.requestId);
+		let rawError;
+		try {
+			assertBoundedMcpValue(options.input, {
+				maxBytes: this.limits.maxInputBytes,
+				maxValueDepth: this.limits.maxInputDepth,
+				maxValueNodes: this.limits.maxValueNodes
+			}, "input_too_large", correlationId);
+			if (options.extra.signal.aborted) throw new McpPublicError("cancelled", correlationId);
+			const releaseGlobal = this.acquireGlobal(correlationId);
+			const controller = new AbortController();
+			let timedOut = false;
+			const cancel = () => controller.abort(options.extra.signal.reason);
+			options.extra.signal.addEventListener("abort", cancel, { once: true });
+			const timer = setTimeout(() => {
+				timedOut = true;
+				controller.abort(/* @__PURE__ */ new Error("MCP execution deadline exceeded"));
+			}, this.limits.timeoutMs);
+			let releasePrincipal;
+			const settled = Promise.resolve().then(async () => {
+				const ctx = await options.authorize({
+					signal: controller.signal,
+					requestId: options.extra.requestId,
+					correlationId
+				});
+				if (controller.signal.aborted) throw new McpPublicError(timedOut ? "timeout" : "cancelled", correlationId);
+				releasePrincipal = this.acquirePrincipal(principalKey(ctx, options.transport, options.accessMode, options.concurrencyKey?.()), correlationId);
+				return snapshotBoundedMcpValue(await options.invoke({
+					ctx,
+					signal: controller.signal,
+					requestId: options.extra.requestId,
+					correlationId
+				}), {
+					maxBytes: this.limits.maxOutputBytes,
+					maxValueDepth: this.limits.maxOutputDepth,
+					maxValueNodes: this.limits.maxValueNodes
+				}, "output_too_large", correlationId);
+			}).finally(() => {
+				releasePrincipal?.();
+				releaseGlobal();
+			});
+			settled.catch(() => void 0);
+			const aborted = new Promise((_resolve, reject) => {
+				const onAbort = () => reject(new McpPublicError(timedOut ? "timeout" : "cancelled", correlationId));
+				if (controller.signal.aborted) onAbort();
+				else controller.signal.addEventListener("abort", onAbort, { once: true });
+			});
+			try {
+				const result = await Promise.race([settled, aborted]);
+				this.emitDiagnostic({
+					correlationId,
+					...requestId !== void 0 ? { requestId } : {},
+					transport: options.transport,
+					operation: options.operation.slice(0, 256),
+					durationMs: Date.now() - startedAt,
+					outcome: "completed"
+				});
+				return result;
+			} finally {
+				clearTimeout(timer);
+				options.extra.signal.removeEventListener("abort", cancel);
+			}
+		} catch (error) {
+			rawError = error;
+			const publicError = classifyError(error, correlationId);
+			this.emitDiagnostic({
+				correlationId: publicError.correlationId,
+				...requestId !== void 0 ? { requestId } : {},
+				transport: options.transport,
+				operation: options.operation.slice(0, 256),
+				durationMs: Date.now() - startedAt,
+				outcome: "rejected",
+				code: publicError.code,
+				...publicError.code === "internal" ? { internalError: diagnosticError(rawError) } : {}
+			});
+			throw publicError;
+		}
+	}
+};
+
+//#endregion
+//#region src/server/release.ts
+const releases = /* @__PURE__ */ new WeakMap();
+const executionGates = /* @__PURE__ */ new WeakMap();
+function executionGate(app) {
+	const key = app;
+	const existing = executionGates.get(key);
+	if (existing) return existing;
+	const created = new McpExecutionGate();
+	executionGates.set(key, created);
+	return created;
+}
+function freezeConfig(value, seen = /* @__PURE__ */ new WeakSet()) {
+	if (!value || typeof value !== "object" || seen.has(value)) return value;
+	seen.add(value);
+	for (const entry of Object.values(value)) freezeConfig(entry, seen);
+	return Object.freeze(value);
+}
+function createRelease(app, config, options) {
+	const frozenConfig = freezeConfig(options?.resources === false ? {
+		...config,
+		resources: {
+			collections: Object.create(null),
+			globals: Object.create(null),
+			routes: Object.create(null)
+		}
+	} : config);
+	const catalog = resolveMcpCatalog(app, frozenConfig);
+	const execution = new McpExecutionBoundary(frozenConfig.execution, executionGate(app));
+	const toolCount = [...catalog.collections.values()].reduce((total, entry) => total + entry.operations.length, 0) + [...catalog.globals.values()].reduce((total, entry) => total + entry.operations.length, 0) + catalog.routes.size + catalog.customTools.size;
+	const resourceCount = catalog.resources.collections.size + catalog.resources.globals.size + catalog.resources.routes.size;
+	if (toolCount > execution.limits.maxTools) throw new Error("MCP released tool count exceeds configured limit");
+	if (resourceCount > execution.limits.maxResources) throw new Error("MCP released resource count exceeds configured limit");
+	return Object.freeze({
+		config: frozenConfig,
+		catalog,
+		execution
+	});
+}
+/** App-owned release snapshot shared by OAuth advertisement and default servers. */
+function getAppMcpRelease(app) {
+	const key = app;
+	const existing = releases.get(key);
+	if (existing) return existing;
+	const created = createRelease(app, resolveMcpConfig(app));
+	releases.set(key, created);
+	return created;
+}
+/** Explicit programmatic overrides are isolated snapshots, never OAuth state. */
+function createIsolatedMcpRelease(app, override) {
+	return createRelease(app, resolveMcpConfig(app, override));
+}
+/** Workload authority is isolated and resources remain unavailable. */
+function createWorkloadMcpRelease(app, override) {
+	return createRelease(app, resolveWorkloadMcpConfig(app, override), { resources: false });
+}
+
+//#endregion
+//#region src/server/zod-json-schema.ts
+function jsonSchemaCompatibleSchema(schema) {
+	if (!schema) return void 0;
+	if (canConvertToJsonSchema(schema)) return schema;
+	const def = schema._def;
+	switch (def?.type) {
+		case "date": return z.string().describe("ISO date or date-time string");
+		case "optional": return jsonSchemaCompatibleSchema(def.innerType)?.optional() ?? z.unknown();
+		case "nullable": return jsonSchemaCompatibleSchema(def.innerType)?.nullable() ?? z.unknown();
+		case "default":
+		case "prefault":
+		case "catch": return jsonSchemaCompatibleSchema(def.innerType)?.optional() ?? z.unknown();
+		case "array": return z.array(jsonSchemaCompatibleSchema(def.element) ?? z.unknown());
+		case "record": {
+			const keySchema = jsonSchemaCompatibleSchema(def.keyType);
+			return z.record(keySchema instanceof z.ZodString ? keySchema : z.string(), jsonSchemaCompatibleSchema(def.valueType) ?? z.unknown());
+		}
+		case "union": {
+			const options = Array.isArray(def.options) ? def.options.map((option) => jsonSchemaCompatibleSchema(option) ?? z.unknown()) : [];
+			if (options.length === 0) return z.unknown();
+			if (options.length === 1) return options[0];
+			return z.union(options);
+		}
+		case "object": {
+			const shape = schema.shape;
+			const nextShape = {};
+			for (const [key, value] of Object.entries(shape)) nextShape[key] = jsonSchemaCompatibleSchema(value) ?? z.unknown();
+			const objectSchema = z.object(nextShape);
+			if (def.catchall && def.catchall._def?.type !== "never") return objectSchema.catchall(jsonSchemaCompatibleSchema(def.catchall) ?? z.unknown());
+			return objectSchema;
+		}
+		default: return z.unknown();
+	}
+}
+function toJsonSchema(schema) {
+	const compatible = jsonSchemaCompatibleSchema(schema);
+	if (!compatible) return void 0;
+	try {
+		return z.toJSONSchema(compatible, { reused: "ref" });
+	} catch {
+		return;
+	}
+}
+function toToolInputJsonSchema(schema) {
+	const parsed = ToolSchema.shape.inputSchema.safeParse(toJsonSchema(schema));
+	return parsed.success ? parsed.data : {
+		type: "object",
+		properties: {}
+	};
+}
+function toToolOutputJsonSchema(schema) {
+	const parsed = ToolSchema.shape.outputSchema.safeParse(toJsonSchema(schema));
+	return parsed.success ? parsed.data : void 0;
+}
+function canConvertToJsonSchema(schema) {
+	try {
+		z.toJSONSchema(schema);
+		return true;
+	} catch {
+		return false;
+	}
+}
+
+//#endregion
+//#region src/server/field-policy.ts
+const SYSTEM_FIELD_NAMES = [
+	"id",
+	"createdAt",
+	"updatedAt",
+	"deletedAt",
+	"_status"
+];
+const hasOwn = (value, key) => Object.prototype.hasOwnProperty.call(value, key);
+const isRecord = (value) => typeof value === "object" && value !== null && !Array.isArray(value);
+const hasFieldPolicy = (policy) => (policy.fields?.include?.length ?? 0) > 0 || (policy.fields?.exclude?.length ?? 0) > 0;
+const allowedKeysFor = (keys, policy) => {
+	const initial = policy.fields?.include?.length ? policy.fields.include : Array.from(keys);
+	const allowed = new Set(initial);
+	for (const key of policy.fields?.exclude ?? []) allowed.delete(key);
+	return allowed;
+};
+function filterRecordFields(value, policy) {
+	if (!hasFieldPolicy(policy) || !isRecord(value)) return value;
+	const allowed = allowedKeysFor(Object.keys(value), policy);
+	const next = {};
+	for (const key of allowed) if (hasOwn(value, key)) next[key] = value[key];
+	return next;
+}
+function filterCrudResultFields(value, policy) {
+	if (!hasFieldPolicy(policy)) return value;
+	if (Array.isArray(value)) return value.map((item) => filterCrudResultFields(item, policy));
+	if (!isRecord(value)) return value;
+	if (Array.isArray(value.docs)) return {
+		...value,
+		docs: value.docs.map((doc) => filterRecordFields(doc, policy))
+	};
+	if (isRecord(value.data)) return {
+		...value,
+		data: filterRecordFields(value.data, policy)
+	};
+	return filterRecordFields(value, policy);
+}
+function filterEntitySchemaFields(schema, policy) {
+	if (!hasFieldPolicy(policy) || !isRecord(schema.fields)) return schema;
+	const allowed = allowedKeysFor(Object.keys(schema.fields), policy);
+	const fields = {};
+	for (const key of allowed) if (hasOwn(schema.fields, key)) fields[key] = schema.fields[key];
+	const next = {
+		...schema,
+		fields
+	};
+	if (isRecord(schema.validation)) {
+		const validation = schema.validation;
+		next.validation = filterValidationSchemas(validation, allowed);
+	}
+	return next;
+}
+function filterValidationSchemas(validation, allowed) {
+	const next = { ...validation };
+	for (const [key, schema] of Object.entries(validation)) next[key] = filterJsonSchemaProperties(schema, allowed);
+	return next;
+}
+function filterJsonSchemaProperties(schema, allowed) {
+	if (!isRecord(schema) || !isRecord(schema.properties)) return schema;
+	const jsonSchema = schema;
+	const properties = {};
+	for (const key of allowed) if (hasOwn(jsonSchema.properties, key)) properties[key] = jsonSchema.properties[key];
+	return {
+		...jsonSchema,
+		properties,
+		required: Array.isArray(jsonSchema.required) ? jsonSchema.required.filter((key) => allowed.has(key)) : jsonSchema.required
+	};
+}
+function createCollectionDataSchema(collection, operation, policy) {
+	const validation = collection.state?.validation;
+	return filterZodObjectSchema(operation === "create" ? validation?.insertSchema : validation?.updateSchema, policy, entityFieldNames(collection), entityFieldDefinitions(collection));
+}
+function createGlobalDataSchema(global, policy) {
+	const validation = global.state?.validation;
+	return filterZodObjectSchema(validation?.updateSchema, policy, entityFieldNames(global), entityFieldDefinitions(global));
+}
+function filterZodObjectSchema(schema, policy, knownFields, fieldDefinitions) {
+	if (!schema || !(schema instanceof z.ZodObject)) {
+		const allowed$1 = allowedKeysFor(knownFields ?? [], policy);
+		return z.object(Object.fromEntries([...allowed$1].map((key) => [key, z.unknown().optional()]))).strict();
+	}
+	const shape = schema.shape;
+	if (!(hasFieldPolicy(policy) || !!knownFields?.length)) return schema;
+	const allowed = allowedKeysFor(knownFields ?? Object.keys(shape), policy);
+	const nextShape = {};
+	for (const key of allowed) if (hasOwn(shape, key)) nextShape[key] = jsonCompatibleFieldSchema(fieldDefinitions?.[key], shape[key]) ?? z.unknown();
+	return z.object(nextShape).strict();
+}
+function jsonCompatibleFieldSchema(fieldDefinition, schema) {
+	if (!isRecord(fieldDefinition) || !isRecord(fieldDefinition._state)) return jsonSchemaCompatibleSchema(schema);
+	const state = fieldDefinition._state;
+	const type = state.type;
+	let external;
+	if (type === "datetime" || type === "date") {
+		const item = type === "datetime" ? z.iso.datetime({ offset: true }) : z.iso.date();
+		if (state.isArray === true) {
+			let arraySchema = z.array(item);
+			if (typeof state.minItems === "number") arraySchema = arraySchema.min(state.minItems);
+			if (typeof state.maxItems === "number") arraySchema = arraySchema.max(state.maxItems);
+			external = arraySchema;
+		} else external = item;
+	} else if (type === "object" && isRecord(state.nestedFields)) {
+		const nestedShape = {};
+		for (const [key, nestedDefinition] of Object.entries(state.nestedFields)) {
+			if (!isRecord(nestedDefinition) || typeof nestedDefinition.toZodSchema !== "function") continue;
+			nestedShape[key] = jsonCompatibleFieldSchema(nestedDefinition, nestedDefinition.toZodSchema()) ?? z.unknown();
+		}
+		external = z.object(nestedShape);
+	} else return jsonSchemaCompatibleSchema(schema);
+	if (!external) return void 0;
+	if (schema.isNullable()) external = external.nullable();
+	if (schema.isOptional()) external = external.optional();
+	return external;
+}
+function entityFieldNames(entity) {
+	const fields = entity.state?.fields;
+	if (!isRecord(fields)) return void 0;
+	return Object.keys(fields);
+}
+function entityFieldDefinitions(entity) {
+	const fieldDefinitions = entity.state?.fieldDefinitions;
+	return isRecord(fieldDefinitions) ? fieldDefinitions : void 0;
+}
+function allowedEntityFieldNames(entity, policy) {
+	const entityFields = entityFieldNames(entity) ?? [];
+	return [...allowedKeysFor(policy.fields?.include?.length ? entityFields : [...new Set([...entityFields, ...SYSTEM_FIELD_NAMES])], policy)];
+}
+function allowedEntityRelationNames(entity, policy) {
+	const fields = entity.state?.fields;
+	if (!isRecord(fields)) return [];
+	const allowed = new Set(allowedEntityFieldNames(entity, policy));
+	return Object.entries(fields).filter(([name, field]) => {
+		if (!allowed.has(name) || !isRecord(field)) return false;
+		const fieldState = field["_state"];
+		const state = isRecord(fieldState) ? fieldState : void 0;
+		return state?.type === "relation" || state?.type === "upload";
+	}).map(([name]) => name);
+}
+
+//#endregion
+//#region src/server/runtime.ts
+function createRuntimeScope(app, options, execution, workload) {
+	const transport = options.transport ?? "http";
+	const accessMode = options.accessMode ?? "user";
+	const createContext = createContextFactory(app);
+	let requestContextPromise;
+	return {
+		app,
+		transport,
+		accessMode,
+		request: options.request,
+		workload,
+		execution,
+		async getContext() {
+			if (options.ctx) return options.ctx;
+			if (options.request) {
+				requestContextPromise ??= createAdapterContext(app, options.request, { accessMode }).then((adapterContext) => ({
+					...adapterContext.appContext,
+					request: options.request
+				}));
+				return requestContextPromise;
+			}
+			return createContext({ accessMode });
+		}
+	};
+}
+function toRequestContext(ctx, accessMode) {
+	return {
+		session: ctx.session,
+		principal: ctx.principal,
+		locale: ctx.locale,
+		defaultLocale: ctx.defaultLocale,
+		localeFallback: ctx.localeFallback,
+		accessMode: ctx.accessMode ?? accessMode,
+		stage: ctx.stage,
+		requestId: ctx.requestId,
+		traceId: ctx.traceId,
+		db: ctx.db,
+		"~contextExtensions": ctx["~contextExtensions"]
+	};
+}
+const MAX_MCP_RUNTIME_JSON_BYTES = 4 * 1024 * 1024;
+const UTF8_ENCODER = new TextEncoder();
+function runtimeSnapshot(value) {
+	return snapshotBoundedMcpValue(value, {
+		maxBytes: MAX_MCP_RUNTIME_JSON_BYTES,
+		maxValueDepth: 64,
+		maxValueNodes: 1e5
+	}, "output_too_large");
+}
+function stringifyRuntimeSnapshot(value) {
+	const serialized = JSON.stringify(value, null, 2);
+	if (UTF8_ENCODER.encode(serialized).byteLength > MAX_MCP_RUNTIME_JSON_BYTES) throw new McpPublicError("output_too_large");
+	return serialized;
+}
+function safeJsonStringify(value) {
+	return stringifyRuntimeSnapshot(runtimeSnapshot(value));
+}
+function toToolResult(value) {
+	const snapshot = runtimeSnapshot(value);
+	return {
+		structuredContent: snapshot && typeof snapshot === "object" && !Array.isArray(snapshot) ? snapshot : { value: snapshot },
+		content: [{
+			type: "text",
+			text: stringifyRuntimeSnapshot(snapshot)
+		}]
+	};
+}
+function toToolError(error) {
+	return toMcpToolError(error);
+}
+function jsonResource(uri, value) {
+	return { contents: [{
+		uri,
+		mimeType: "application/json",
+		text: safeJsonStringify(value)
+	}] };
+}
+
+//#endregion
+//#region src/server/workload-boundary.ts
+const PUBLIC_ACCESS_DENIED = "MCP access denied";
+function isProxy(value) {
+	return !!value && (typeof value === "object" || typeof value === "function") && types.isProxy(value);
+}
+function readMethod(owner, name) {
+	if (!owner || typeof owner !== "object" && typeof owner !== "function") return null;
+	if (isProxy(owner)) return null;
+	try {
+		let candidate = owner;
+		while (candidate) {
+			if (isProxy(candidate)) return null;
+			const descriptor = Object.getOwnPropertyDescriptor(candidate, name);
+			if (descriptor) {
+				if (!("value" in descriptor) || typeof descriptor.value !== "function") return null;
+				return descriptor.value.bind(owner);
+			}
+			candidate = Object.getPrototypeOf(candidate);
+		}
+		return null;
+	} catch {
+		return null;
+	}
+}
+function createWorkloadMcpBoundary(options) {
+	try {
+		if (!options || typeof options !== "object" || isProxy(options) || !("envelope" in options) || options.envelope === void 0) throw new Error(PUBLIC_ACCESS_DENIED);
+		const concurrencyKey = options.concurrencyKey === void 0 ? `boundary:${randomUUID()}` : typeof options.concurrencyKey === "string" && /^[\w.:-]{1,256}$/.test(options.concurrencyKey) ? `consumer:${options.concurrencyKey}` : null;
+		if (!concurrencyKey) throw new Error(PUBLIC_ACCESS_DENIED);
+		const authorize = readMethod(options.authorizer, "authorize");
+		const bindContext = readMethod(options.contextBinder, "bind");
+		if (!authorize || !bindContext) throw new Error(PUBLIC_ACCESS_DENIED);
+		let executeHandoff;
+		if (options.handoff) {
+			const method = readMethod(options.handoff, "execute");
+			if (!method) throw new Error(PUBLIC_ACCESS_DENIED);
+			executeHandoff = method;
+		}
+		return {
+			envelope: options.envelope,
+			concurrencyKey,
+			authorize,
+			bindContext,
+			audit: options.audit,
+			executeHandoff,
+			discoveryTools: []
+		};
+	} catch {
+		throw new Error(PUBLIC_ACCESS_DENIED);
+	}
+}
+function snapshotAuthorization(value) {
+	try {
+		if (!value || typeof value !== "object" || Array.isArray(value) || isProxy(value)) return null;
+		const descriptors = Object.getOwnPropertyDescriptors(value);
+		const context = descriptors.context;
+		const attribution = descriptors.attribution;
+		if (!context || !("value" in context)) return null;
+		if (attribution && !("value" in attribution)) return null;
+		if (isProxy(context.value) || attribution && isProxy(attribution.value)) return null;
+		return Object.freeze({
+			context: context.value,
+			...attribution ? { attribution: attribution.value } : {}
+		});
+	} catch {
+		return null;
+	}
+}
+function isBoundContext(value) {
+	try {
+		if (!value || typeof value !== "object" || Array.isArray(value) || isProxy(value)) return false;
+		const descriptors = Object.getOwnPropertyDescriptors(value);
+		const accessMode = descriptors.accessMode;
+		const db = descriptors.db;
+		const principal = descriptors.principal;
+		return !!accessMode && "value" in accessMode && accessMode.value === "user" && !!db && "value" in db && !!db.value && (!principal || "value" in principal && principal.value?.kind !== "system");
+	} catch {
+		return false;
+	}
+}
+function normalizeRequirement(requirement) {
+	try {
+		if (!requirement || typeof requirement !== "object" || isProxy(requirement) || !Array.isArray(requirement.capabilities) || requirement.capabilities.length === 0 || requirement.capabilities.length > 64 || requirement.capabilities.some((capability) => isProxy(capability)) || !requirement.capabilities.every((capability) => typeof capability === "string" && capability.length > 0 && capability.length <= 256) || requirement.handoff !== void 0 && (typeof requirement.handoff !== "string" || requirement.handoff.length === 0 || requirement.handoff.length > 256)) return null;
+		return Object.freeze({
+			capabilities: Object.freeze([...requirement.capabilities]),
+			...requirement.handoff ? { handoff: requirement.handoff } : {}
+		});
+	} catch {
+		return null;
+	}
+}
+function normalizeTool(identity, requirement) {
+	return Object.freeze({
+		kind: identity.kind,
+		name: identity.name,
+		operation: identity.operation,
+		intent: identity.intent,
+		transport: "workload",
+		capabilities: Object.freeze([...requirement.capabilities]),
+		...requirement.handoff ? { handoff: requirement.handoff } : {}
+	});
+}
+async function auditDecision(boundary, event) {
+	try {
+		await boundary.audit?.(event);
+	} catch {
+		throw new Error(PUBLIC_ACCESS_DENIED);
+	}
+}
+async function authorizeWorkload(boundary, phase, identity, requirement, control) {
+	const cancelled = () => control?.signal.aborted === true;
+	if (cancelled()) return null;
+	const normalized = normalizeRequirement(requirement);
+	if (!normalized || normalized.handoff && !boundary.executeHandoff) {
+		await auditDecision(boundary, {
+			phase,
+			decision: "denied",
+			reason: "authorization_denied"
+		});
+		return null;
+	}
+	const tool = normalizeTool(identity, normalized);
+	let result;
+	try {
+		result = await boundary.authorize({
+			phase,
+			envelope: boundary.envelope,
+			tool
+		}, control);
+	} catch {
+		result = null;
+	}
+	if (cancelled()) return null;
+	const authorization = snapshotAuthorization(result);
+	if (!authorization) {
+		await auditDecision(boundary, {
+			phase,
+			decision: "denied",
+			reason: "authorization_invalid"
+		});
+		return null;
+	}
+	if (cancelled()) return null;
+	let context;
+	try {
+		context = await boundary.bindContext({
+			authorizationContext: authorization.context,
+			attribution: authorization.attribution,
+			tool
+		}, control);
+	} catch {
+		context = null;
+	}
+	if (cancelled()) return null;
+	if (!isBoundContext(context)) {
+		await auditDecision(boundary, {
+			phase,
+			decision: "denied",
+			reason: "context_invalid"
+		});
+		return null;
+	}
+	if (cancelled()) return null;
+	await auditDecision(boundary, {
+		phase,
+		decision: "allowed",
+		toolName: tool.name,
+		attribution: authorization.attribution
+	});
+	if (cancelled()) return null;
+	return Object.freeze({
+		authorization,
+		concurrencyKey: boundary.concurrencyKey,
+		context,
+		tool
+	});
+}
+function registerWorkloadDiscoveryTool(boundary, tool, identity, requirement, allows) {
+	const normalized = normalizeRequirement(requirement);
+	if (!normalized) return;
+	boundary.discoveryTools.push({
+		tool: Object.freeze({ ...tool }),
+		identity: Object.freeze({ ...identity }),
+		requirement: normalized,
+		allows
+	});
+}
+async function listWorkloadTools(boundary, execution, extra) {
+	const tools = [];
+	const controller = new AbortController();
+	let timedOut = false;
+	const cancel = () => controller.abort(extra.signal.reason);
+	if (extra.signal.aborted) cancel();
+	else extra.signal.addEventListener("abort", cancel, { once: true });
+	const timer = setTimeout(() => {
+		timedOut = true;
+		controller.abort(/* @__PURE__ */ new Error("MCP discovery deadline exceeded"));
+	}, execution.limits.timeoutMs);
+	const boundedExtra = {
+		...extra,
+		signal: controller.signal
+	};
+	try {
+		for (const candidate of boundary.discoveryTools) try {
+			let workloadAuthorization;
+			const tool = await execution.execute({
+				operation: "tools/list",
+				transport: "workload",
+				accessMode: "user",
+				input: { name: candidate.tool.name },
+				extra: boundedExtra,
+				authorize: async (control) => {
+					workloadAuthorization = await authorizeWorkload(boundary, "discovery", candidate.identity, candidate.requirement, control);
+					if (!workloadAuthorization || !await candidate.allows(workloadAuthorization.context)) throw new McpAccessDeniedError();
+					return workloadAuthorization.context;
+				},
+				concurrencyKey: () => workloadAuthorization?.concurrencyKey,
+				invoke: async () => candidate.tool
+			});
+			tools.push(tool);
+		} catch (error) {
+			const code = mcpPublicErrorCode(error);
+			if (code === "access_denied" || code === "internal") continue;
+			if (timedOut && code === "cancelled") throw new McpPublicError("timeout");
+			throw error;
+		}
+		assertBoundedMcpValue({ tools }, {
+			maxBytes: execution.limits.maxOutputBytes,
+			maxValueDepth: execution.limits.maxOutputDepth,
+			maxValueNodes: execution.limits.maxValueNodes
+		}, "output_too_large");
+		return { tools };
+	} finally {
+		clearTimeout(timer);
+		extra.signal.removeEventListener("abort", cancel);
+	}
+}
+async function executeWorkloadTool(boundary, authorized, metadata, execution, invoke) {
+	if (!authorized.tool.handoff) return invoke();
+	if (!boundary.executeHandoff) throw new Error(PUBLIC_ACCESS_DENIED);
+	try {
+		return await boundary.executeHandoff({
+			authorizationContext: authorized.authorization.context,
+			attribution: authorized.authorization.attribution,
+			toolName: authorized.tool.name,
+			capability: authorized.tool.handoff,
+			tool: authorized.tool,
+			metadata,
+			signal: execution.signal,
+			requestId: execution.requestId,
+			correlationId: execution.correlationId,
+			invoke
+		});
+	} catch {
+		throw new Error(PUBLIC_ACCESS_DENIED);
+	}
+}
+
+//#endregion
+//#region src/server/crud-tools.ts
+const idSchema = z.union([z.string(), z.number()]);
+const deleteSchema = z.object({ id: idSchema }).strict();
+const MAX_QUERY_FIELDS = 64;
+const MAX_WHERE_DEPTH = 3;
+const MAX_LOGICAL_CLAUSES = 16;
+const MAX_OPERATOR_VALUES = 100;
+const MAX_OFFSET = 1e4;
+const scalarQueryValue = z.union([
+	z.string().max(4096),
+	z.number().finite(),
+	z.boolean(),
+	z.null()
+]);
+const queryValue = z.union([scalarQueryValue, z.array(scalarQueryValue).max(MAX_OPERATOR_VALUES)]);
+const operatorSchema = z.object(Object.fromEntries([
+	"eq",
+	"ne",
+	"not",
+	"gt",
+	"gte",
+	"lt",
+	"lte",
+	"in",
+	"notIn",
+	"like",
+	"ilike",
+	"notLike",
+	"notIlike",
+	"contains",
+	"startsWith",
+	"endsWith",
+	"isNull",
+	"isNotNull",
+	"arrayOverlaps",
+	"arrayContained",
+	"arrayContains"
+].map((operator) => [operator, queryValue.optional()]))).strict();
+const fieldCondition = z.union([queryValue, operatorSchema]).meta({ id: "QuestpieMcpFieldCondition" });
+function boundedFields(fields) {
+	return fields.slice(0, MAX_QUERY_FIELDS);
+}
+function whereSchema(fields, depth = 0) {
+	const shape = Object.fromEntries(boundedFields(fields).map((field) => [field, fieldCondition.optional()]));
+	if (depth < MAX_WHERE_DEPTH) {
+		const nested = whereSchema(fields, depth + 1);
+		shape.AND = z.array(nested).max(MAX_LOGICAL_CLAUSES).optional();
+		shape.OR = z.array(nested).max(MAX_LOGICAL_CLAUSES).optional();
+		shape.NOT = nested.optional();
+	}
+	return z.object(shape).strict();
+}
+function columnsSchema(fields) {
+	return z.object(Object.fromEntries(boundedFields(fields).map((field) => [field, z.boolean().optional()]))).strict();
+}
+function sortSchema(fields) {
+	return z.object(Object.fromEntries(boundedFields(fields).map((field) => [field, z.enum(["asc", "desc"]).optional()]))).strict();
+}
+function relationLoadSchema(relations) {
+	return z.object(Object.fromEntries(boundedFields(relations).map((field) => [field, z.literal(true).optional()]))).strict();
+}
+function collectionReadSchemas(collection, policy) {
+	const fields = allowedEntityFieldNames(collection, policy);
+	const common = {
+		with: relationLoadSchema(allowedEntityRelationNames(collection, policy)).optional(),
+		columns: columnsSchema(fields).optional(),
+		locale: z.string().max(64).optional(),
+		includeDeleted: z.boolean().optional(),
+		stage: z.string().max(64).optional()
+	};
+	return {
+		list: z.object({
+			where: whereSchema(fields).optional(),
+			sort: sortSchema(fields).optional(),
+			limit: z.number().int().positive().max(1e4).optional(),
+			page: z.number().int().positive().max(1e3).optional(),
+			offset: z.number().int().nonnegative().max(MAX_OFFSET).optional(),
+			...common
+		}).strict(),
+		count: z.object({
+			where: whereSchema(fields).optional(),
+			includeDeleted: z.boolean().optional()
+		}).strict(),
+		get: z.object({
+			id: idSchema,
+			...common
+		}).strict()
+	};
+}
+function globalOperationBaseSchema(global, policy) {
+	const fields = allowedEntityFieldNames(global, policy);
+	return {
+		with: relationLoadSchema(allowedEntityRelationNames(global, policy)).optional(),
+		columns: columnsSchema(fields).optional(),
+		locale: z.string().max(64).optional(),
+		stage: z.string().max(64).optional()
+	};
+}
+const COLLECTION_OPERATIONS = [
+	{
+		name: "list",
+		kind: "read",
+		description: (name) => `List ${name} records.`,
+		execute: (crud, input, ctx, maxLimit) => crud.find({
+			...input,
+			limit: Math.min(input.limit ?? maxLimit, maxLimit)
+		}, ctx)
+	},
+	{
+		name: "count",
+		kind: "read",
+		description: (name) => `Count ${name} records.`,
+		execute: (crud, input, ctx) => crud.count(input, ctx)
+	},
+	{
+		name: "get",
+		kind: "read",
+		description: (name) => `Get one ${name} record by id.`,
+		execute: (crud, input, ctx) => {
+			const { id, ...options } = input;
+			return crud.findOne({
+				...options,
+				where: { id }
+			}, ctx);
+		}
+	},
+	{
+		name: "create",
+		kind: "write",
+		description: (name) => `Create a ${name} record.`,
+		execute: (crud, input, ctx) => crud.create(input.data, ctx)
+	},
+	{
+		name: "update",
+		kind: "write",
+		description: (name) => `Update a ${name} record by id.`,
+		execute: (crud, input, ctx) => crud.updateById({
+			id: input.id,
+			data: input.data
+		}, ctx)
+	},
+	{
+		name: "delete",
+		kind: "delete",
+		description: (name) => `Delete a ${name} record by id.`,
+		execute: (crud, input, ctx) => crud.deleteById({ id: input.id }, ctx)
+	}
+];
+const GLOBAL_OPERATIONS = [{
+	name: "get",
+	kind: "read",
+	description: (name) => `Get the ${name} global.`,
+	execute: (crud, input, ctx) => crud.get(input, ctx)
+}, {
+	name: "update",
+	kind: "write",
+	description: (name) => `Update the ${name} global.`,
+	execute: (crud, input, ctx) => {
+		const { data, ...options } = input;
+		return crud.update(data, ctx, options);
+	}
+}];
+function collectionOperationSchema(operationName, collection, policy) {
+	if (operationName === "create") return z.object({ data: createCollectionDataSchema(collection, "create", policy) }).strict();
+	if (operationName === "update") return z.object({
+		id: idSchema,
+		data: createCollectionDataSchema(collection, "update", policy)
+	}).strict();
+	return collectionReadSchemas(collection, policy)[operationName] ?? deleteSchema;
+}
+function globalOperationSchema(operationName, global, policy) {
+	if (operationName === "update") return z.object({
+		data: createGlobalDataSchema(global, policy),
+		...globalOperationBaseSchema(global, policy)
+	}).strict();
+	return z.object(globalOperationBaseSchema(global, policy)).strict();
+}
+async function questpieAllows(scope, ctx, kind, name, operationName) {
+	if (scope.accessMode === "system") return true;
+	const crudContext = {
+		db: ctx.db ?? scope.app.db,
+		session: ctx.session,
+		locale: ctx.locale,
+		accessMode: scope.accessMode,
+		stage: ctx.stage
+	};
+	if (kind === "collection") {
+		const collection = scope.app.getCollections()[name];
+		const schema$1 = await introspectCollection(collection, crudContext, scope.app);
+		if (!schema$1.access.visible) return false;
+		const mappedOperation$1 = operationName === "create" || operationName === "update" || operationName === "delete" ? operationName : "read";
+		const result$1 = schema$1.access.operations[mappedOperation$1];
+		return !!result$1 && result$1.allowed !== false;
+	}
+	const global = scope.app.getGlobals()[name];
+	const schema = await introspectGlobal(global, crudContext, scope.app);
+	if (!schema.access.visible) return false;
+	const mappedOperation = operationName === "update" ? "update" : "read";
+	const result = schema.access.operations[mappedOperation];
+	return !!result && result.allowed !== false;
+}
+async function allowsOperation(scope, ctx, policy, kind, entityName, operationName, operationKind) {
+	if (!await evaluateMcpRule(operationRule(policy, operationName), {
+		transport: scope.transport,
+		accessMode: scope.accessMode,
+		ctx
+	})) return false;
+	if (!scopeGateAllows(scopesFromContext(ctx), requiredScopesForOperation(policy, kind, entityName, operationName, operationKind))) return false;
+	return questpieAllows(scope, ctx, kind, entityName, operationName);
+}
+async function shouldRegister(scope, policy, kind, entityName, operationName, operationKind) {
+	if (!policy.expose) return false;
+	if (scope.workload && !workloadRequirementForOperation(policy, operationName)) return false;
+	if (scope.workload) return true;
+	return allowsOperation(scope, await scope.getContext(), policy, kind, entityName, operationName, operationKind);
+}
+async function registerCrudTools(server, scope, config, catalog) {
+	const maxLimit = config.crud?.maxLimit ?? 100;
+	const collections = scope.app.getCollections();
+	const globals = scope.app.getGlobals();
+	for (const [name, catalogEntry] of catalog.collections) {
+		const collection = collections[name];
+		const policy = catalogEntry.policy;
+		const crud = scope.app.collections[name];
+		for (const operation of COLLECTION_OPERATIONS) {
+			if (!catalogEntry.operations.includes(operation.name)) continue;
+			const toolName = `collections.${name}.${operation.name}`;
+			const inputSchema = collectionOperationSchema(operation.name, collection, policy);
+			const annotations = {
+				readOnlyHint: operation.kind === "read",
+				destructiveHint: operation.kind === "delete",
+				idempotentHint: operation.name === "update" || operation.name === "delete"
+			};
+			const workloadRequirement = workloadRequirementForOperation(policy, operation.name);
+			const workloadIdentity = {
+				kind: "collection",
+				name: toolName,
+				operation: operation.name,
+				intent: operation.kind === "read" && !workloadRequirement?.handoff ? "read" : "effect"
+			};
+			const allows = (ctx) => allowsOperation(scope, ctx, policy, "collection", name, operation.name, operation.kind);
+			if (!await shouldRegister(scope, policy, "collection", name, operation.name, operation.kind)) continue;
+			server.registerTool(toolName, {
+				description: policy.description ?? operation.description(name),
+				inputSchema,
+				annotations
+			}, async (input, extra) => {
+				try {
+					let workloadAuthorization;
+					return await scope.execution.execute({
+						operation: toolName,
+						transport: scope.transport,
+						accessMode: scope.accessMode,
+						input,
+						extra,
+						authorize: async (control) => {
+							workloadAuthorization = scope.workload ? await authorizeWorkload(scope.workload, "call", workloadIdentity, workloadRequirement, control) : void 0;
+							if (scope.workload && !workloadAuthorization) throw new McpAccessDeniedError();
+							const ctx = workloadAuthorization?.context ?? await scope.getContext();
+							if (!await allows(ctx)) throw new McpAccessDeniedError();
+							return ctx;
+						},
+						concurrencyKey: () => workloadAuthorization?.concurrencyKey,
+						invoke: async ({ ctx, signal, requestId, correlationId }) => {
+							const invoke = async () => {
+								return toToolResult(filterCrudResultFields(await operation.execute(crud, input, ctx, maxLimit), policy));
+							};
+							if (scope.workload && workloadAuthorization && workloadRequirement) return executeWorkloadTool(scope.workload, workloadAuthorization, void 0, {
+								signal,
+								requestId,
+								correlationId
+							}, invoke);
+							return invoke();
+						}
+					});
+				} catch (error) {
+					return toToolError(error);
+				}
+			});
+			if (scope.workload) registerWorkloadDiscoveryTool(scope.workload, {
+				name: toolName,
+				description: policy.description ?? operation.description(name),
+				inputSchema: toToolInputJsonSchema(inputSchema),
+				annotations
+			}, workloadIdentity, workloadRequirement, allows);
+		}
+	}
+	for (const [name, catalogEntry] of catalog.globals) {
+		const global = globals[name];
+		const policy = catalogEntry.policy;
+		const crud = scope.app.globals[name];
+		for (const operation of GLOBAL_OPERATIONS) {
+			if (!catalogEntry.operations.includes(operation.name)) continue;
+			const toolName = `globals.${name}.${operation.name}`;
+			const inputSchema = globalOperationSchema(operation.name, global, policy);
+			const annotations = {
+				readOnlyHint: operation.kind === "read",
+				idempotentHint: operation.name === "update"
+			};
+			const workloadRequirement = workloadRequirementForOperation(policy, operation.name);
+			const workloadIdentity = {
+				kind: "global",
+				name: toolName,
+				operation: operation.name,
+				intent: operation.kind === "read" && !workloadRequirement?.handoff ? "read" : "effect"
+			};
+			const allows = (ctx) => allowsOperation(scope, ctx, policy, "global", name, operation.name, operation.kind);
+			if (!await shouldRegister(scope, policy, "global", name, operation.name, operation.kind)) continue;
+			server.registerTool(toolName, {
+				description: policy.description ?? operation.description(name),
+				inputSchema,
+				annotations
+			}, async (input, extra) => {
+				try {
+					let workloadAuthorization;
+					return await scope.execution.execute({
+						operation: toolName,
+						transport: scope.transport,
+						accessMode: scope.accessMode,
+						input,
+						extra,
+						authorize: async (control) => {
+							workloadAuthorization = scope.workload ? await authorizeWorkload(scope.workload, "call", workloadIdentity, workloadRequirement, control) : void 0;
+							if (scope.workload && !workloadAuthorization) throw new McpAccessDeniedError();
+							const ctx = workloadAuthorization?.context ?? await scope.getContext();
+							if (!await allows(ctx)) throw new McpAccessDeniedError();
+							return ctx;
+						},
+						concurrencyKey: () => workloadAuthorization?.concurrencyKey,
+						invoke: async ({ ctx, signal, requestId, correlationId }) => {
+							const invoke = async () => {
+								return toToolResult(filterCrudResultFields(await operation.execute(crud, input, ctx), policy));
+							};
+							if (scope.workload && workloadAuthorization && workloadRequirement) return executeWorkloadTool(scope.workload, workloadAuthorization, void 0, {
+								signal,
+								requestId,
+								correlationId
+							}, invoke);
+							return invoke();
+						}
+					});
+				} catch (error) {
+					return toToolError(error);
+				}
+			});
+			if (scope.workload) registerWorkloadDiscoveryTool(scope.workload, {
+				name: toolName,
+				description: policy.description ?? operation.description(name),
+				inputSchema: toToolInputJsonSchema(inputSchema),
+				annotations
+			}, workloadIdentity, workloadRequirement, allows);
+		}
+	}
+}
+
+//#endregion
+//#region src/server/custom-tools.ts
+function customToolWorkloadIdentity(toolName, tool) {
+	return {
+		kind: "custom",
+		name: toolName,
+		operation: "execute",
+		intent: tool.config.workload?.handoff || tool.config.annotations?.readOnlyHint !== true ? "effect" : "read"
+	};
+}
+function customToolDescriptor(toolName, tool) {
+	const inputSchema = customToolInputSchema(tool);
+	const discoveryOutputSchema = toToolOutputJsonSchema(jsonSchemaCompatibleSchema(tool.config.outputSchema));
+	return {
+		name: toolName,
+		title: tool.config.title,
+		description: tool.config.description,
+		inputSchema: toToolInputJsonSchema(inputSchema),
+		...discoveryOutputSchema ? { outputSchema: discoveryOutputSchema } : {},
+		annotations: tool.config.annotations,
+		_meta: tool.config["_meta"]
+	};
+}
+function customToolInputSchema(tool) {
+	return jsonSchemaCompatibleSchema(tool.config.inputSchema) ?? z.object({}).strict();
+}
+function customToolAllows(scope, tool, ctx) {
+	const requiredScopes = normalizeRequiredScopes(tool.config.scopes);
+	return Promise.resolve(evaluateMcpRule(tool.config.access, {
+		transport: scope.transport,
+		accessMode: scope.accessMode,
+		ctx
+	})).then((allowed) => allowed && scopeGateAllows(scopesFromContext(ctx), requiredScopes));
+}
+async function validateCustomToolOutput(tool, result) {
+	if (!tool.config.outputSchema || result.isError) return result;
+	const parsed = await tool.config.outputSchema.safeParseAsync(result.structuredContent);
+	if (!parsed.success) throw new Error("MCP custom tool output failed validation");
+	return {
+		...result,
+		structuredContent: parsed.data
+	};
+}
+async function executeCustomToolCall(scope, toolName, tool, input, extra) {
+	const workloadIdentity = customToolWorkloadIdentity(toolName, tool);
+	let workloadAuthorization;
+	return scope.execution.execute({
+		operation: toolName,
+		transport: scope.transport,
+		accessMode: scope.accessMode,
+		input,
+		extra,
+		authorize: async (control) => {
+			workloadAuthorization = scope.workload ? await authorizeWorkload(scope.workload, "call", workloadIdentity, tool.config.workload, control) : void 0;
+			if (scope.workload && !workloadAuthorization) throw new McpAccessDeniedError();
+			const callCtx = workloadAuthorization?.context ?? await scope.getContext();
+			if (!await customToolAllows(scope, tool, callCtx)) throw new McpAccessDeniedError();
+			return callCtx;
+		},
+		concurrencyKey: () => workloadAuthorization?.concurrencyKey,
+		invoke: async ({ ctx, signal, requestId, correlationId }) => {
+			const parsedInput = tool.config.inputSchema ? await tool.config.inputSchema.parseAsync(input) : await z.object({}).strict().parseAsync(input);
+			const invoke = () => tool.handler({
+				input: parsedInput,
+				ctx,
+				transport: scope.transport,
+				accessMode: scope.accessMode,
+				request: scope.request,
+				signal,
+				requestId,
+				correlationId
+			});
+			if (scope.workload && workloadAuthorization && tool.config.workload) return validateCustomToolOutput(tool, await executeWorkloadTool(scope.workload, workloadAuthorization, void 0, {
+				signal,
+				requestId,
+				correlationId
+			}, invoke));
+			return validateCustomToolOutput(tool, await invoke());
+		}
+	});
+}
+async function registerCustomTools(server, scope, catalog) {
+	for (const [toolName, { tool }] of catalog.customTools) {
+		const workloadIdentity = customToolWorkloadIdentity(toolName, tool);
+		if (scope.workload && !tool.config.workload) continue;
+		const allows = (ctx) => customToolAllows(scope, tool, ctx);
+		if (!scope.workload) {
+			if (!await allows(await scope.getContext())) continue;
+		}
+		const inputSchema = customToolInputSchema(tool);
+		const outputSchema = jsonSchemaCompatibleSchema(tool.config.outputSchema);
+		server.registerTool(toolName, {
+			title: tool.config.title,
+			description: tool.config.description,
+			inputSchema,
+			outputSchema,
+			annotations: tool.config.annotations,
+			_meta: tool.config["_meta"]
+		}, async (input, extra) => {
+			try {
+				return await executeCustomToolCall(scope, toolName, tool, input, extra);
+			} catch (error) {
+				return toToolError(error);
+			}
+		});
+		if (scope.workload) registerWorkloadDiscoveryTool(scope.workload, customToolDescriptor(toolName, tool), workloadIdentity, tool.config.workload, allows);
+	}
+}
+
+//#endregion
+//#region src/server/resources.ts
+function fallbackExtra(requestId) {
+	return {
+		signal: new AbortController().signal,
+		requestId
+	};
+}
+function executeResource(scope, operation, input, extra, invoke) {
+	return scope.execution.execute({
+		operation,
+		transport: scope.transport,
+		accessMode: scope.accessMode,
+		input,
+		extra,
+		authorize: scope.getContext,
+		invoke
+	});
+}
+async function collectionSchema(scope, name) {
+	const ctx = await scope.getContext();
+	const collection = scope.app.getCollections()[name];
+	return introspectCollection(collection, {
+		db: ctx.db ?? scope.app.db,
+		session: ctx.session,
+		locale: ctx.locale,
+		accessMode: scope.accessMode,
+		stage: ctx.stage
+	}, scope.app);
+}
+async function globalSchema(scope, name) {
+	const ctx = await scope.getContext();
+	const global = scope.app.getGlobals()[name];
+	return introspectGlobal(global, {
+		db: ctx.db ?? scope.app.db,
+		session: ctx.session,
+		locale: ctx.locale,
+		accessMode: scope.accessMode,
+		stage: ctx.stage
+	}, scope.app);
+}
+async function visibleCollections(scope, catalog) {
+	const entries = [];
+	for (const name of catalog.resources.collections) {
+		const catalogEntry = catalog.collections.get(name);
+		if (!catalogEntry) continue;
+		const policy = catalogEntry.policy;
+		const operation = catalogEntry.operations.find((candidate) => [
+			"list",
+			"count",
+			"get"
+		].includes(candidate)) ?? "list";
+		const ctx = await scope.getContext();
+		if (!await evaluateMcpRule(operationRule(policy, operation), {
+			transport: scope.transport,
+			accessMode: scope.accessMode,
+			ctx
+		}) || !scopeGateAllows(scopesFromContext(ctx), requiredScopesForOperation(policy, "collection", name, operation, "read"))) continue;
+		const schema = await collectionSchema(scope, name);
+		if (scope.accessMode === "system" || schema.access.visible && schema.access.operations.read.allowed !== false) entries.push(filterEntitySchemaFields(schema, policy));
+	}
+	return entries;
+}
+async function visibleGlobals(scope, catalog) {
+	const entries = [];
+	for (const name of catalog.resources.globals) {
+		const catalogEntry = catalog.globals.get(name);
+		if (!catalogEntry) continue;
+		const policy = catalogEntry.policy;
+		const ctx = await scope.getContext();
+		if (!await evaluateMcpRule(operationRule(policy, "get"), {
+			transport: scope.transport,
+			accessMode: scope.accessMode,
+			ctx
+		}) || !scopeGateAllows(scopesFromContext(ctx), requiredScopesForOperation(policy, "global", name, "get", "read"))) continue;
+		const schema = await globalSchema(scope, name);
+		if (scope.accessMode === "system" || schema.access.visible && schema.access.operations.read.allowed !== false) entries.push(filterEntitySchemaFields(schema, policy));
+	}
+	return entries;
+}
+function routeToolInputSchema(route$1) {
+	if (!isJsonRoute(route$1.definition)) return void 0;
+	const params = route$1.params ?? [];
+	if (params.length === 0) return route$1.definition.schema;
+	const shape = {};
+	for (const param of params) shape[param] = z.string();
+	return z.object({
+		params: z.object(shape),
+		input: route$1.definition.schema
+	});
+}
+async function routeCatalog(scope, catalog) {
+	const ctx = await scope.getContext();
+	const services = extractAppServices(scope.app, {
+		db: ctx.db ?? scope.app.db,
+		session: ctx.session,
+		locale: ctx.locale,
+		accessMode: ctx.accessMode,
+		principal: ctx.principal
+	});
+	const routes = [];
+	for (const routeKey of catalog.resources.routes) {
+		const catalogEntry = catalog.routes.get(routeKey);
+		if (!catalogEntry) continue;
+		const route$1 = catalogEntry.route;
+		if (!isJsonRoute(route$1.definition)) continue;
+		const policy = catalogEntry.policy;
+		if (!await evaluateMcpRule(operationRule(policy, "execute"), {
+			transport: scope.transport,
+			accessMode: scope.accessMode,
+			ctx
+		}) || !scopeGateAllows(scopesFromContext(ctx), requiredScopesForOperation(policy, "route", routeKey, "execute", "invoke"))) continue;
+		const params = Object.fromEntries((route$1.params ?? []).map((param) => [param, ""]));
+		if (!await evaluateRouteAccess(route$1.definition.access, {
+			...services,
+			...ctx["~contextExtensions"] ?? {},
+			locale: ctx.locale,
+			request: scope.request,
+			params
+		})) continue;
+		routes.push({
+			key: route$1.key,
+			path: route$1.path,
+			methods: route$1.methods,
+			mode: route$1.mode,
+			params: route$1.params,
+			meta: route$1.meta,
+			hasInputSchema: isJsonRoute(route$1.definition),
+			hasOutputSchema: isJsonRoute(route$1.definition) && !!route$1.definition.outputSchema,
+			inputSchema: toJsonSchema(route$1.definition.schema),
+			outputSchema: toJsonSchema(route$1.definition.outputSchema),
+			toolInputSchema: toJsonSchema(routeToolInputSchema(route$1))
+		});
+	}
+	return routes;
+}
+function resourceEntry(uri, name, description) {
+	return {
+		uri,
+		name,
+		mimeType: "application/json",
+		description
+	};
+}
+function registerSchemaResources(server, scope, catalog) {
+	if (catalog.resources.collections.size > 0) server.registerResource("questpie-schema-collections", "questpie://schema/collections", {
+		title: "QUESTPIE collections schema",
+		mimeType: "application/json"
+	}, async (uri, extra) => executeResource(scope, "resources.collections.read", { uri: uri.toString() }, extra, async () => jsonResource(uri.toString(), await visibleCollections(scope, catalog))));
+	if (catalog.resources.collections.size > 0) server.registerResource("questpie-schema-collection", new ResourceTemplate("questpie://schema/collections/{name}", {
+		list: async (extra) => executeResource(scope, "resources.collections.list", {}, extra, async () => ({ resources: (await visibleCollections(scope, catalog)).map((schema) => resourceEntry(`questpie://schema/collections/${schema.name}`, `Collection ${schema.name}`, schema.description ? String(schema.description) : void 0)) })),
+		complete: { name: async (value) => executeResource(scope, "resources.collections.complete", { value }, fallbackExtra("resources.collections.complete"), async () => (await visibleCollections(scope, catalog)).map((schema) => schema.name).filter((name) => name.startsWith(value))) }
+	}), {
+		title: "QUESTPIE collection schema",
+		mimeType: "application/json"
+	}, async (uri, variables, extra) => executeResource(scope, "resources.collection.read", {
+		uri: uri.toString(),
+		variables
+	}, extra, async () => {
+		const name = String(variables.name);
+		const schema = (await visibleCollections(scope, catalog)).find((item) => item.name === name);
+		if (!schema) throw new Error("MCP resource is not exposed");
+		return jsonResource(uri.toString(), schema);
+	}));
+	if (catalog.resources.globals.size > 0) server.registerResource("questpie-schema-globals", "questpie://schema/globals", {
+		title: "QUESTPIE globals schema",
+		mimeType: "application/json"
+	}, async (uri, extra) => executeResource(scope, "resources.globals.read", { uri: uri.toString() }, extra, async () => jsonResource(uri.toString(), await visibleGlobals(scope, catalog))));
+	if (catalog.resources.globals.size > 0) server.registerResource("questpie-schema-global", new ResourceTemplate("questpie://schema/globals/{name}", {
+		list: async (extra) => executeResource(scope, "resources.globals.list", {}, extra, async () => ({ resources: (await visibleGlobals(scope, catalog)).map((schema) => resourceEntry(`questpie://schema/globals/${schema.name}`, `Global ${schema.name}`, schema.description ? String(schema.description) : void 0)) })),
+		complete: { name: async (value) => executeResource(scope, "resources.globals.complete", { value }, fallbackExtra("resources.globals.complete"), async () => (await visibleGlobals(scope, catalog)).map((schema) => schema.name).filter((name) => name.startsWith(value))) }
+	}), {
+		title: "QUESTPIE global schema",
+		mimeType: "application/json"
+	}, async (uri, variables, extra) => executeResource(scope, "resources.global.read", {
+		uri: uri.toString(),
+		variables
+	}, extra, async () => {
+		const name = String(variables.name);
+		const schema = (await visibleGlobals(scope, catalog)).find((item) => item.name === name);
+		if (!schema) throw new Error("MCP resource is not exposed");
+		return jsonResource(uri.toString(), schema);
+	}));
+	if (catalog.resources.routes.size > 0) server.registerResource("questpie-schema-routes", "questpie://schema/routes", {
+		title: "QUESTPIE route schema",
+		mimeType: "application/json"
+	}, async (uri, extra) => executeResource(scope, "resources.routes.read", { uri: uri.toString() }, extra, async () => jsonResource(uri.toString(), await routeCatalog(scope, catalog))));
+	if (catalog.resources.routes.size > 0) server.registerResource("questpie-schema-route", new ResourceTemplate("questpie://schema/routes/{key}", {
+		list: async (extra) => executeResource(scope, "resources.routes.list", {}, extra, async () => ({ resources: (await routeCatalog(scope, catalog)).map((route$1) => resourceEntry(`questpie://schema/routes/${encodeURIComponent(route$1.key)}`, `Route ${route$1.key}`, route$1.meta?.description)) })),
+		complete: { key: async (value) => executeResource(scope, "resources.routes.complete", { value }, fallbackExtra("resources.routes.complete"), async () => (await routeCatalog(scope, catalog)).map((route$1) => route$1.key).filter((key) => key.startsWith(value))) }
+	}), {
+		title: "QUESTPIE route schema",
+		mimeType: "application/json"
+	}, async (uri, variables, extra) => executeResource(scope, "resources.route.read", {
+		uri: uri.toString(),
+		variables
+	}, extra, async () => {
+		const key = decodeURIComponent(String(variables.key));
+		const route$1 = (await routeCatalog(scope, catalog)).find((item) => item.key === key);
+		if (!route$1) throw new Error("MCP resource is not exposed");
+		return jsonResource(uri.toString(), route$1);
+	}));
+}
+
+//#endregion
+//#region src/server/route-tools.ts
+function routeInputSchema(route$1) {
+	if (!isJsonRoute(route$1.definition)) return z.object({});
+	if (route$1.params.length === 0) return jsonSchemaCompatibleSchema(route$1.definition.schema) ?? z.object({});
+	const paramsShape = {};
+	for (const param of route$1.params) paramsShape[param] = z.string();
+	return z.object({
+		params: z.object(paramsShape).strict(),
+		input: jsonSchemaCompatibleSchema(route$1.definition.schema) ?? z.object({})
+	}).strict();
+}
+async function registerRouteTools(server, scope, catalog) {
+	for (const [routeKey, catalogEntry] of catalog.routes) {
+		const route$1 = catalogEntry.route;
+		const definition = route$1.definition;
+		if (!isJsonRoute(definition)) continue;
+		const mcpMeta = route$1.meta?.mcp;
+		if (!mcpMeta) continue;
+		const policy = catalogEntry.policy;
+		const name = catalogEntry.toolName;
+		const workloadRequirement = workloadRequirementForOperation(policy, "execute");
+		if (scope.workload && !workloadRequirement) continue;
+		const inputSchema = routeInputSchema(route$1);
+		const outputSchema = jsonSchemaCompatibleSchema(definition.outputSchema);
+		const annotations = mcpMeta.annotations;
+		const workloadIdentity = {
+			kind: "route",
+			name,
+			operation: "execute",
+			intent: workloadRequirement?.handoff || annotations?.readOnlyHint !== true ? "effect" : "read"
+		};
+		const allows = async (ctx) => {
+			if (!(await evaluateMcpRule(operationRule(policy, "execute"), {
+				transport: scope.transport,
+				accessMode: scope.accessMode,
+				ctx
+			}) && scopeGateAllows(scopesFromContext(ctx), requiredScopesForOperation(policy, "route", routeKey, "execute", "invoke")))) return false;
+			const services = extractAppServices(scope.app, {
+				db: ctx.db ?? scope.app.db,
+				session: ctx.session,
+				locale: ctx.locale,
+				accessMode: ctx.accessMode,
+				principal: ctx.principal
+			});
+			const params = Object.fromEntries(route$1.params.map((param) => [param, ""]));
+			return evaluateRouteAccess(definition.access, {
+				...services,
+				...ctx["~contextExtensions"] ?? {},
+				locale: ctx.locale,
+				request: scope.request,
+				params
+			});
+		};
+		if (!scope.workload) {
+			if (!await allows(await scope.getContext())) continue;
+		}
+		server.registerTool(name, {
+			title: mcpMeta.title ?? route$1.meta?.title,
+			description: mcpMeta.description ?? route$1.meta?.description,
+			inputSchema,
+			outputSchema,
+			annotations
+		}, async (input, extra) => {
+			try {
+				let workloadAuthorization;
+				return await scope.execution.execute({
+					operation: name,
+					transport: scope.transport,
+					accessMode: scope.accessMode,
+					input,
+					extra,
+					authorize: async (control) => {
+						workloadAuthorization = scope.workload ? await authorizeWorkload(scope.workload, "call", workloadIdentity, workloadRequirement, control) : void 0;
+						if (scope.workload && !workloadAuthorization) throw new McpAccessDeniedError();
+						const routeCtx = workloadAuthorization?.context ?? await scope.getContext();
+						if (!await allows(routeCtx)) throw new McpAccessDeniedError();
+						return routeCtx;
+					},
+					concurrencyKey: () => workloadAuthorization?.concurrencyKey,
+					invoke: async ({ ctx, signal, requestId, correlationId }) => {
+						const invocation = route$1.params.length > 0 ? z.object({
+							input: z.unknown(),
+							params: z.record(z.string(), z.string())
+						}).parse(input) : {
+							input,
+							params: {}
+						};
+						const requestContext = toRequestContext(ctx, scope.accessMode);
+						const executionRequest = new Request(scope.request?.url ?? "http://questpie.local/mcp", {
+							method: scope.request?.method ?? "POST",
+							headers: scope.request?.headers,
+							signal
+						});
+						const invoke = async () => toToolResult(await executeJsonRoute(scope.app, definition, invocation.input, requestContext, executionRequest, invocation.params));
+						if (scope.workload && workloadAuthorization && workloadRequirement) return executeWorkloadTool(scope.workload, workloadAuthorization, void 0, {
+							signal,
+							requestId,
+							correlationId
+						}, invoke);
+						return invoke();
+					}
+				});
+			} catch (error) {
+				return toToolError(error);
+			}
+		});
+		if (scope.workload) {
+			const discoveryOutputSchema = toToolOutputJsonSchema(outputSchema);
+			registerWorkloadDiscoveryTool(scope.workload, {
+				name,
+				title: mcpMeta.title ?? route$1.meta?.title,
+				description: mcpMeta.description ?? route$1.meta?.description,
+				inputSchema: toToolInputJsonSchema(inputSchema),
+				...discoveryOutputSchema ? { outputSchema: discoveryOutputSchema } : {},
+				annotations
+			}, workloadIdentity, workloadRequirement, allows);
+		}
+	}
+}
+
+//#endregion
+//#region src/server/create-server.ts
+async function createServer(app, options, workload) {
+	const release = workload ? createWorkloadMcpRelease(app, options.config) : options.config ? createIsolatedMcpRelease(app, options.config) : getAppMcpRelease(app);
+	const { config, catalog } = release;
+	const transport = options.transport ?? "http";
+	const accessMode = transport === "stdio" ? resolveStdioAccessMode(options, config.stdio?.trustedMaintenance) : "user";
+	const scope = createRuntimeScope(app, {
+		...options,
+		transport,
+		accessMode,
+		config
+	}, release.execution, workload);
+	const server = new McpServer({
+		name: config.name ?? "questpie",
+		version: config.version ?? "0.0.0"
+	}, { capabilities: {
+		tools: {},
+		...catalog.resources.collections.size > 0 || catalog.resources.globals.size > 0 || catalog.resources.routes.size > 0 ? { resources: {} } : {}
+	} });
+	await registerCrudTools(server, scope, config, catalog);
+	await registerRouteTools(server, scope, catalog);
+	registerSchemaResources(server, scope, catalog);
+	await registerCustomTools(server, scope, catalog);
+	if (workload) server.server.setRequestHandler(ListToolsRequestSchema, (_request, extra) => listWorkloadTools(workload, release.execution, extra));
+	else if ([...catalog.collections.values()].every((entry) => entry.operations.length === 0) && [...catalog.globals.values()].every((entry) => entry.operations.length === 0) && catalog.routes.size === 0 && catalog.customTools.size === 0) server.server.setRequestHandler(ListToolsRequestSchema, () => ({ tools: [] }));
+	return server;
+}
+function resolveStdioAccessMode(options, trustedMaintenance) {
+	if (trustedMaintenance === true) {
+		if (options.ctx !== void 0 || options.request !== void 0 || options.accessMode === "user") throw new Error("Trusted-maintenance stdio cannot be combined with request authority");
+		return "system";
+	}
+	if (options.ctx?.accessMode === "user" && options.accessMode !== "system") return "user";
+	throw new Error("Stdio MCP requires explicit authority: provide a user-mode ctx or configure stdio.trustedMaintenance");
+}
+async function createMcpServer(app, options = {}) {
+	return createServer(app, options);
+}
+async function createWorkloadMcpServer(app, options) {
+	const boundary = createWorkloadMcpBoundary(options);
+	return createServer(app, {
+		transport: "workload",
+		accessMode: "user",
+		config: options.config
+	}, boundary);
+}
+
+//#endregion
+export { validateMcpPrincipal as C, scopesFromContext as S, resolveMcpCatalog as _, customToolWorkloadIdentity as a, requiredScopesForOperation as b, createWorkloadMcpBoundary as c, getAppMcpRelease as d, McpAccessDeniedError as f, toMcpToolError as g, mcpPublicErrorCode as h, customToolDescriptor as i, createRuntimeScope as l, assertBoundedMcpValue as m, createWorkloadMcpServer as n, executeCustomToolCall as o, McpPublicError as p, customToolAllows as r, authorizeWorkload as s, createMcpServer as t, createWorkloadMcpRelease as u, defaultOperationScope as v, mcpTool as w, scopeGateAllows as x, normalizeRequiredScopes as y };