@browserstack/mcp-server 1.5.0-beta.21 → 1.5.0-beta.23

package/dist/tools/automate.js

@@ -1,7 +1,5 @@
 import { z } from "zod";
 import { fetchAutomationScreenshots } from "./automate-utils/fetch-screenshots.js";
-import { DEFAULT_SESSION_LIST_LIMIT, listSessionIds, UnknownBuildError, } from "./automate-utils/list-session-ids.js";
-import { isObservabilityBuildUuid, resolveHashedBuildId, } from "./automate-utils/resolve-hashed-build-id.js";
 import { SessionType } from "../lib/constants.js";
 import { trackMCP } from "../lib/instrumentation.js";
 import logger from "../logger.js";
@@ -50,63 +48,10 @@ export async function fetchAutomationScreenshotsTool(args, config) {
         };
     }
 }
-export async function listSessionIdsTool(args, config) {
-    try {
-        // Accept the observability build id too. Observability ids are usually
-        // UUIDs but can also be 40-char hex like Automate hashed ids, so shape
-        // alone is not enough: try the REST list first and resolve on a miss.
-        const inputId = args.buildId.trim();
-        let buildId = inputId;
-        let resolvedNote;
-        const resolve = async () => {
-            const resolved = await resolveHashedBuildId(inputId, config, args.sessionType);
-            buildId = resolved.hashedBuildId;
-            resolvedNote = `Resolved observability build ${inputId} to hashed build id ${buildId}.`;
-        };
-        let sessions;
-        if (isObservabilityBuildUuid(inputId)) {
-            await resolve();
-            sessions = await listSessionIds({ ...args, buildId }, config);
-        }
-        else {
-            try {
-                sessions = await listSessionIds({ ...args, buildId }, config);
-            }
-            catch (error) {
-                if (!(error instanceof UnknownBuildError))
-                    throw error;
-                try {
-                    await resolve();
-                }
-                catch (resolveError) {
-                    logger.debug("listSessions: id is neither a known hashed build nor a resolvable observability build", resolveError);
-                    throw error;
-                }
-                sessions = await listSessionIds({ ...args, buildId }, config);
-            }
-        }
-        const content = [
-            {
-                type: "text",
-                text: sessions.length === 0
-                    ? "No sessions found for this hashed build ID."
-                    : JSON.stringify(sessions, null, 2),
-            },
-        ];
-        if (resolvedNote) {
-            content.push({ type: "text", text: resolvedNote });
-        }
-        return { content };
-    }
-    catch (error) {
-        logger.error("Error listing session IDs", error);
-        throw error;
-    }
-}
 //Registers the fetchAutomationScreenshots tool with the MCP server
 export default function addAutomationTools(server, config) {
     const tools = {};
-    tools.fetchAutomationScreenshots = server.tool("fetchAutomationScreenshots", "Fetch screenshots captured during an Automate/App Automate session.", {
+    tools.fetchAutomationScreenshots = server.tool("fetchAutomationScreenshots", "Fetch and process screenshots from a BrowserStack Automate session", {
         sessionId: z
             .string()
             .describe("The BrowserStack session ID to fetch screenshots from"),
@@ -138,53 +83,5 @@ export default function addAutomationTools(server, config) {
             };
         }
     });
-    tools.listSessions = server.tool("listSessions", "List sessions for a hashed Automate/App Automate build: session IDs, status, OS, browser/device, dashboard URL.", {
-        sessionType: z
-            .enum([SessionType.Automate, SessionType.AppAutomate])
-            .describe("Type of BrowserStack session"),
-        buildId: z
-            .string()
-            .describe("Hashed build id from the dashboard, or the observability build id from getBuildId."),
-        limit: z
-            .number()
-            .int()
-            .positive()
-            .optional()
-            .describe(`Max sessions to return. Defaults to ${DEFAULT_SESSION_LIST_LIMIT}.`),
-        offset: z
-            .number()
-            .int()
-            .min(0)
-            .optional()
-            .describe("Pagination offset for the REST session list."),
-        status: z
-            .string()
-            .optional()
-            .describe("Optional session status filter (e.g. done, running, error). Applied client-side."),
-    }, {
-        title: "List Sessions",
-        readOnlyHint: true,
-        openWorldHint: false,
-        destructiveHint: false,
-        idempotentHint: true,
-    }, async (args) => {
-        try {
-            trackMCP("listSessions", server.server.getClientVersion(), undefined, config);
-            return await listSessionIdsTool(args, config);
-        }
-        catch (error) {
-            trackMCP("listSessions", server.server.getClientVersion(), error, config);
-            const errorMessage = error instanceof Error ? error.message : "Unknown error";
-            return {
-                content: [
-                    {
-                        type: "text",
-                        text: `Error listing session IDs: ${errorMessage}`,
-                    },
-                ],
-                isError: true,
-            };
-        }
-    });
     return tools;
 }

package/dist/tools/bstack-sdk.js

@@ -13,11 +13,11 @@ export function registerRunBrowserStackTestsTool(server, config) {
         idempotentHint: true,
     }, async (args) => {
         try {
-            trackMCP("setupBrowserStackAutomateTests", server.server.getClientVersion(), undefined, config);
+            trackMCP("runTestsOnBrowserStack", server.server.getClientVersion(), config);
             return await runTestsOnBrowserStackHandler(args, config);
         }
         catch (error) {
-            return handleMCPError("setupBrowserStackAutomateTests", server, config, error);
+            return handleMCPError("runTestsOnBrowserStack", server, config, error);
         }
     });
     return tools;

package/dist/tools/build-insights.js

@@ -2,7 +2,6 @@ import { z } from "zod";
 import logger from "../logger.js";
 import { fetchFromBrowserStackAPI, handleMCPError } from "../lib/utils.js";
 import { trackMCP } from "../lib/instrumentation.js";
-import { resolveHashedBuildId } from "./automate-utils/resolve-hashed-build-id.js";
 // Tool function that fetches build insights from two APIs
 export async function fetchBuildInsightsTool(args, config) {
     try {
@@ -16,7 +15,6 @@ export async function fetchBuildInsightsTool(args, config) {
                 return null;
             }),
         ]);
-        const { hashed_id, session_type } = await resolveInsightsHashedId(args.buildId, buildData, config);
         // Select useful fields for users
         const insights = {
             name: buildData.name,
@@ -35,8 +33,6 @@ export async function fetchBuildInsightsTool(args, config) {
             commit_sha: buildData.vcs_info?.sha,
             vcs_name: buildData.vcs_info?.name,
             quality_gate_result: qualityData?.quality_gate_result,
-            ...(hashed_id ? { hashed_id } : {}),
-            ...(session_type ? { session_type } : {}),
         };
         const qualityProfiles = qualityData?.quality_profiles?.map((profile) => ({
             name: profile.name,
@@ -60,45 +56,10 @@ export async function fetchBuildInsightsTool(args, config) {
         throw error;
     }
 }
-/**
- * The observability build payload does not carry the Automate hashed build id
- * today. Prefer it if the API ever adds one; otherwise resolve it through any
- * session of the build (two deterministic REST calls). Never blocks insights.
- */
-async function resolveInsightsHashedId(observabilityBuildId, buildData, config) {
-    const direct = extractHashedBuildId(buildData);
-    if (direct) {
-        return { hashed_id: direct };
-    }
-    try {
-        const resolved = await resolveHashedBuildId(observabilityBuildId, config);
-        return {
-            hashed_id: resolved.hashedBuildId,
-            session_type: resolved.sessionType,
-        };
-    }
-    catch (error) {
-        logger.warn("Could not resolve hashed build id for build insights", error);
-        return {};
-    }
-}
-function extractHashedBuildId(buildData) {
-    const candidates = [
-        buildData?.hashed_id,
-        buildData?.automate_hashed_id,
-        buildData?.hashedId,
-    ];
-    for (const candidate of candidates) {
-        if (typeof candidate === "string" &&
-            /^[a-z0-9]{40}$/i.test(candidate.trim()))
-            return candidate.trim();
-    }
-    return undefined;
-}
 // Registers the fetchBuildInsights tool with the MCP server
 export default function addBuildInsightsTools(server, config) {
     const tools = {};
-    tools.fetchBuildInsights = server.tool("fetchBuildInsights", "Fetch build details and quality gate results. Includes hashed_id and session_type for listSessions.", {
+    tools.fetchBuildInsights = server.tool("fetchBuildInsights", "Fetches insights about a BrowserStack build by combining build details and quality gate results.", {
         buildId: z.string().describe("The build UUID of the BrowserStack build"),
     }, {
         title: "Fetch Build Insights",
@@ -108,7 +69,7 @@ export default function addBuildInsightsTools(server, config) {
         idempotentHint: true,
     }, async (args) => {
         try {
-            trackMCP("fetchBuildInsights", server.server.getClientVersion(), undefined, config);
+            trackMCP("fetchBuildInsights", server.server.getClientVersion(), config);
             return await fetchBuildInsightsTool(args, config);
         }
         catch (error) {

package/dist/tools/capability-registry/bind.d.ts

@@ -0,0 +1,29 @@
+/**
+ * Turn grouped caller arguments into a path, a query and a body.
+ *
+ * Arguments arrive GROUPED — {path_params, query, body} — because spec parameter names
+ * collide across locations: four tm operations declare one name in two places (`bulk-move`
+ * has `folder_id` as both a path parameter and a body field). A flat map cannot say which
+ * one is meant, which is exactly why the Python side used to rename body fields `body_*`.
+ * Grouping removes the collision AND the rename, so a caller sends the spec's own names.
+ */
+import { Capability, WireParam } from "./types.js";
+export interface GroupedArguments {
+    path_params?: Record<string, unknown>;
+    query?: Record<string, unknown>;
+    body?: Record<string, unknown>;
+}
+export interface BoundRequest {
+    path: string;
+    query: Record<string, unknown>;
+    body?: Record<string, unknown>;
+}
+/**
+ * Check one argument against its declared schema, raising a caller-safe error.
+ *
+ * Type checking is also the injection defence for path parameters: most of tm's 278 path
+ * parameters are `type: integer`, so a traversal attempt like `../../admin-v2` fails here
+ * rather than being encoded into a URL.
+ */
+export declare function coerce(value: unknown, param: WireParam): unknown;
+export declare function bind(capability: Capability, args: GroupedArguments): BoundRequest;

package/dist/tools/capability-registry/bind.js

@@ -0,0 +1,329 @@
+/**
+ * Turn grouped caller arguments into a path, a query and a body.
+ *
+ * Arguments arrive GROUPED — {path_params, query, body} — because spec parameter names
+ * collide across locations: four tm operations declare one name in two places (`bulk-move`
+ * has `folder_id` as both a path parameter and a body field). A flat map cannot say which
+ * one is meant, which is exactly why the Python side used to rename body fields `body_*`.
+ * Grouping removes the collision AND the rename, so a caller sends the spec's own names.
+ */
+import { InvocationError } from "./index-loader.js";
+/**
+ * String formats worth ENFORCING, as opposed to merely publishing.
+ *
+ * A validator that rejects a correct value is worse than no validator: the caller cannot
+ * route around it, and the request that would have worked never leaves. So this covers only
+ * the formats where "wrong" is unambiguous and a legitimate value cannot trip it.
+ *
+ * tm declares eight formats. `date`, `date-time` and `uuid` are here. `email` and `uri` are
+ * deliberately NOT — every compact regex for either rejects addresses and URLs that servers
+ * accept, and being wrong in that direction blocks real work. `int64`, `float` and `binary`
+ * say what a number or blob is, which `type` already covers.
+ */
+const FORMATS = {
+    date: {
+        // A real calendar date, so 2026-02-31 fails rather than being reformatted.
+        test: (v) => /^\d{4}-\d{2}-\d{2}$/.test(v) &&
+            !Number.isNaN(Date.parse(`${v}T00:00:00Z`)) &&
+            new Date(`${v}T00:00:00Z`).toISOString().startsWith(v),
+        want: "a date (YYYY-MM-DD)",
+    },
+    "date-time": {
+        // Permissive on purpose: offset or Z, optional fractional seconds. Tightening this
+        // buys nothing and starts rejecting timestamps the product would have taken.
+        test: (v) => /^\d{4}-\d{2}-\d{2}[Tt ]\d{2}:\d{2}:\d{2}(\.\d+)?([Zz]|[+-]\d{2}:?\d{2})?$/.test(v) && !Number.isNaN(Date.parse(v)),
+        want: "a date-time (e.g. 2026-01-31T09:30:00Z)",
+    },
+    uuid: {
+        test: (v) => /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i.test(v),
+        want: "a UUID",
+    },
+};
+/**
+ * A declared `pattern`, compiled once, or undefined if it will not compile here.
+ *
+ * `u` because tm's patterns use `\p{L}`/`\p{N}`, which are a syntax error without it. A
+ * pattern this engine cannot compile is SKIPPED rather than thrown: the index is generated
+ * from someone else's spec, and refusing to invoke a working endpoint because its regex
+ * dialect differs would be our bug landing on the caller.
+ */
+const patternCache = new Map();
+function compiled(pattern) {
+    if (!patternCache.has(pattern)) {
+        let regex;
+        try {
+            regex = new RegExp(pattern, "u");
+        }
+        catch {
+            try {
+                regex = new RegExp(pattern);
+            }
+            catch {
+                regex = undefined;
+            }
+        }
+        patternCache.set(pattern, regex);
+    }
+    return patternCache.get(pattern);
+}
+/**
+ * Every constraint the parameter declares, checked against the COERCED value.
+ *
+ * Runs inside `bind`, which register.ts calls dry before the write-consent gate — so a
+ * value that breaks a constraint is refused before the user is asked to approve anything,
+ * and nothing reaches egress.
+ *
+ * `label` carries the parent name for a nested field, so the message names `test_case.name`
+ * rather than a bare `name` the caller would have to go looking for.
+ */
+function checkConstraints(value, param, label = param.name) {
+    const fail = (what) => {
+        throw new InvocationError(`'${label}' ${what}`);
+    };
+    if (typeof value === "number") {
+        if (param.minimum !== undefined && value < param.minimum)
+            fail(`must be at least ${param.minimum}`);
+        if (param.maximum !== undefined && value > param.maximum)
+            fail(`must be at most ${param.maximum}`);
+        if (param.multipleOf !== undefined && param.multipleOf > 0) {
+            // Scale BOTH to integers before the modulo: 0.3 % 0.1 is 0.09999… in binary floating
+            // point and would reject a value the product accepts. The scale has to cover the
+            // value's decimals as well as the step's — scaling by the step alone rounds 0.25 to
+            // 3 against a step of 1, which then divides evenly and lets a bad value through.
+            const scale = 10 ** Math.max(decimals(param.multipleOf), decimals(value));
+            if (Math.round(value * scale) % Math.round(param.multipleOf * scale) !==
+                0)
+                fail(`must be a multiple of ${param.multipleOf}`);
+        }
+    }
+    if (typeof value === "string") {
+        if (param.minLength !== undefined && value.length < param.minLength)
+            fail(`must be at least ${param.minLength} character(s)`);
+        if (param.maxLength !== undefined && value.length > param.maxLength)
+            fail(`must be at most ${param.maxLength} character(s)`);
+        if (param.pattern) {
+            const regex = compiled(param.pattern);
+            if (regex && !regex.test(value))
+                fail(`must match ${param.pattern}`);
+        }
+        const format = param.format ? FORMATS[param.format] : undefined;
+        if (format && !format.test(value))
+            fail(`must be ${format.want}`);
+    }
+    if (Array.isArray(value)) {
+        if (param.minItems !== undefined && value.length < param.minItems)
+            fail(`must have at least ${param.minItems} item(s)`);
+        if (param.maxItems !== undefined && value.length > param.maxItems)
+            fail(`must have at most ${param.maxItems} item(s)`);
+        if (param.uniqueItems) {
+            const seen = new Set(value.map((item) => JSON.stringify(item)));
+            if (seen.size !== value.length)
+                fail("must not contain duplicate items");
+        }
+    }
+}
+/** Decimal places, for scaling `multipleOf` out of floating point. */
+function decimals(n) {
+    const text = String(n);
+    const dot = text.indexOf(".");
+    return dot < 0 ? 0 : text.length - dot - 1;
+}
+/**
+ * The declared fields one level inside an object, or inside each item of an array.
+ *
+ * Only what `fields` names is checked, and an undeclared key is left alone — `fields` is a
+ * projection of the shape, not a closed contract, so rejecting the rest would refuse valid
+ * bodies. That is the opposite of the top level, where the full parameter list IS known and
+ * an unknown name is an error.
+ */
+function checkFields(value, param) {
+    if (!param.fields?.length)
+        return;
+    const items = Array.isArray(value) ? value : [value];
+    for (const item of items) {
+        if (typeof item !== "object" || item === null || Array.isArray(item))
+            continue;
+        const record = item;
+        for (const field of param.fields) {
+            if (!(field.name in record)) {
+                if (field.required)
+                    throw new InvocationError(`missing required parameter(s): ${param.name}.${field.name}`);
+                continue;
+            }
+            const label = `${param.name}.${field.name}`;
+            const coerced = coerceType(record[field.name], field, label);
+            checkConstraints(coerced, field, label);
+        }
+    }
+}
+/**
+ * Check one argument against its declared schema, raising a caller-safe error.
+ *
+ * Type checking is also the injection defence for path parameters: most of tm's 278 path
+ * parameters are `type: integer`, so a traversal attempt like `../../admin-v2` fails here
+ * rather than being encoded into a URL.
+ */
+export function coerce(value, param) {
+    const coerced = coerceType(value, param);
+    checkConstraints(coerced, param);
+    checkFields(coerced, param);
+    return coerced;
+}
+function coerceType(value, param, label = param.name) {
+    const expected = param.type;
+    if (expected === "object" || expected === "array") {
+        // An opaque body object is passed through as given: the spec does not describe its
+        // fields, so validating or reshaping it would mean inventing a contract.
+        if (expected === "object" &&
+            (typeof value !== "object" || value === null || Array.isArray(value))) {
+            throw new InvocationError(`'${label}' must be an object`);
+        }
+        if (expected === "array" && !Array.isArray(value)) {
+            throw new InvocationError(`'${label}' must be a list`);
+        }
+        return value;
+    }
+    if (expected === "integer" || expected === "number") {
+        const parsed = Number(String(value).trim());
+        if (!Number.isFinite(parsed)) {
+            throw new InvocationError(`'${label}' must be a number`);
+        }
+        return expected === "integer" ? Math.trunc(parsed) : parsed;
+    }
+    if (expected === "boolean") {
+        if (typeof value === "boolean")
+            return value;
+        const text = String(value).trim().toLowerCase();
+        if (["true", "1", "yes"].includes(text))
+            return true;
+        if (["false", "0", "no"].includes(text))
+            return false;
+        throw new InvocationError(`'${label}' must be true or false`);
+    }
+    // NO DECLARED TYPE: pass the value through as given.
+    //
+    // The fallthrough below is String(value), which is right for a declared string and
+    // silently destructive for anything the spec left untyped. create_report_v2 declares
+    // `mail_to` and `report_filters` with no type and the API wants objects for both, so a
+    // correct payload was serialised to the literal "[object Object]" and refused:
+    //
+    //   The property '#/mail_to' of type string did not match the following type: object
+    //
+    // The caller sent the right thing, this layer broke it, and the server's message blames
+    // the caller for a string it never wrote. An untyped parameter means the spec declines to
+    // say what shape it is — which is a reason to leave it alone, not to guess "string".
+    const untyped = !expected;
+    if (untyped && (typeof value === "object" || typeof value === "boolean")) {
+        return value;
+    }
+    const text = String(value);
+    if (param.values && param.values.length > 0) {
+        const allowed = param.values.map((v) => String(v));
+        if (!allowed.includes(text)) {
+            throw new InvocationError(`'${label}' must be one of: ${allowed.join(", ")}`);
+        }
+    }
+    return text;
+}
+/** Place a value at a JSON-pointer-ish path, creating the objects on the way. */
+function place(root, pointer, value) {
+    const segments = pointer.split("/").filter((segment) => segment !== "");
+    let cursor = root;
+    for (const segment of segments.slice(0, -1)) {
+        const next = cursor[segment];
+        if (typeof next !== "object" || next === null || Array.isArray(next)) {
+            cursor[segment] = {};
+        }
+        cursor = cursor[segment];
+    }
+    cursor[segments[segments.length - 1]] = value;
+}
+const GROUPS = [
+    { group: "path_params", declared: "path_params" },
+    { group: "query", declared: "query" },
+    { group: "body", declared: "body" },
+];
+export function bind(capability, args) {
+    let path = capability.path;
+    const query = {};
+    const body = {};
+    for (const { group, declared } of GROUPS) {
+        const supplied = args[group] || {};
+        if (typeof supplied !== "object" ||
+            supplied === null ||
+            Array.isArray(supplied)) {
+            throw new InvocationError(`${group} must be an object of name -> value`);
+        }
+        const params = capability[declared] || [];
+        const byName = new Map(params.map((param) => [param.name, param]));
+        // Unknown arguments are an error rather than being dropped: silently ignoring a
+        // misspelled filter would return a larger result set that looks like a correct answer.
+        const unknown = Object.keys(supplied).filter((name) => !byName.has(name));
+        if (unknown.length > 0) {
+            // A CALLER WHO SENT THE WRAPPER WE BUILD DESERVES TO BE TOLD SO.
+            //
+            // Most of these endpoints want a nested body — Rails `params.require(:test_case)` —
+            // and the fields declare that as `json_path: /test_case/name`, so this layer
+            // assembles the wrapper itself and the caller sends the fields flat. A caller who
+            // wraps it by hand therefore sends a key that is never a declared param, and the
+            // bare message reads as "that field does not exist" when the truth is the opposite:
+            // it exists, and building it is our job.
+            //
+            // Worth special-casing because the guidance itself has been telling callers to wrap:
+            // 25 tm capabilities carried a line describing the WIRE format to a caller who never
+            // writes the wire. Those lines are being corrected, but an agent working from an
+            // older artifact, or reasoning from the Rails convention, lands here either way.
+            const wrappers = new Set(params
+                .map((param) => param.json_path)
+                .filter((path) => Boolean(path))
+                .map((path) => path.replace(/^\//, "").split("/")[0])
+                .filter((segment) => segment && !byName.has(segment)));
+            const sentAWrapper = unknown.filter((name) => wrappers.has(name));
+            throw new InvocationError(`unknown ${group}: ${unknown.sort().join(", ")}. accepted: ` +
+                `${[...byName.keys()].sort().join(", ") || "none"}` +
+                (sentAWrapper.length > 0
+                    ? `. ${sentAWrapper.sort().join(" and ")} ` +
+                        `${sentAWrapper.length > 1 ? "are wrappers" : "is a wrapper"} this ` +
+                        `surface builds for you from each field's json_path — send the fields ` +
+                        `directly instead of nesting them`
+                    : ""));
+        }
+        for (const [name, raw] of Object.entries(supplied)) {
+            const param = byName.get(name);
+            const value = coerce(raw, param);
+            if (group === "path_params") {
+                // Encode with nothing exempt: a `/` inside a path value would otherwise rewrite the
+                // route. Schema checking already stops this for integer ids; this covers strings.
+                path = path.replaceAll(`{${name}}`, encodeURIComponent(String(value)));
+            }
+            else if (group === "body") {
+                place(body, param.json_path || `/${name}`, value);
+            }
+            else {
+                query[name] = value;
+            }
+        }
+    }
+    // `required` is enforced for BODY as well as path. It was path-only on the Python side at
+    // first, so a missing required body field passed silently and the product answered with a
+    // 4xx that read like the caller's fault.
+    const missing = [];
+    for (const { group, declared } of GROUPS) {
+        if (group === "query")
+            continue;
+        const supplied = args[group] || {};
+        for (const param of capability[declared] ||
+            []) {
+            if (param.required && !(param.name in supplied))
+                missing.push(param.name);
+        }
+    }
+    if (missing.length > 0) {
+        throw new InvocationError(`missing required parameter(s): ${missing.sort().join(", ")}`);
+    }
+    const leftover = path.match(/\{[a-z_]+\}/gi);
+    if (leftover) {
+        throw new InvocationError(`path placeholder(s) not supplied: ${leftover.join(", ")}`);
+    }
+    return { path, query, body: Object.keys(body).length > 0 ? body : undefined };
+}

package/dist/tools/capability-registry/config.d.ts

@@ -0,0 +1,62 @@
+/**
+ * Where the index comes from, and where each product lives.
+ *
+ * A product may DECLARE its host in its own index file (`<product>.base_url`, authored in
+ * the harness's product.yaml and carried through by the export). That is the default, not
+ * the last word: config overrides it, and for a region-sharded product account discovery
+ * outranks it — see `resolveBaseUrl`. The same artifact therefore still ships to every
+ * environment, because anything environment- or account-specific is resolved here.
+ */
+import { BrowserStackConfig } from "../../lib/types.js";
+import { HostSource } from "./discovery.js";
+import { Transport } from "./egress.js";
+/**
+ * The environment this DEPLOYMENT points at, e.g. "preprod".
+ *
+ * Process-level on purpose, and the distinction from region matters: an environment is a
+ * property of the deployment (this instance talks to preprod), whereas a REGION is a
+ * property of the account (this user's data lives in EU). That is why region discovery is
+ * per request and never cached under REMOTE_MCP, while the environment is read once here.
+ */
+export declare function selectedEnvironment(): string;
+/** True when this product's host is account-specific and must be discovered per call. */
+export declare function isRegionSharded(product: string, source?: HostSource): boolean;
+/**
+ * Resolve a product's host.
+ *
+ * Atlas resolves: an explicit per-session override, then the host for the session's
+ * environment (`harness.extra_environments[env][product]`), then the profile's own
+ * `base_url`. The same rungs, in the same order, with one addition:
+ *
+ *   1. CAPABILITY_REGISTRY_BASE_URL_<PRODUCT>            explicit, environment-agnostic
+ *   2. CAPABILITY_REGISTRY_BASE_URL_<PRODUCT>_<ENV>      this environment's host
+ *   3. CAPABILITY_REGISTRY_BASE_URLS {product:{env:url}} the same, as one map
+ *   4. account discovery — the index's `base_urls`, probed
+ *   5. the single host declared in the index, `base_url`
+ *   6. refuse, by name
+ *
+ * DISCOVERY OUTRANKS THE DECLARED HOST, which is where this departs from Atlas. A declared
+ * host is one fixed origin, so for a region-sharded product it would send every account
+ * outside the default region to the wrong host — a failure that only shows up on those
+ * accounts, and so passes any test run from inside the default one. Discovery answers with
+ * the region the account is actually on; `base_url` is the fallback for when the probe
+ * cannot answer at all.
+ *
+ * Refusing rather than guessing is deliberate: a guessed host fails as a DNS error or a 404
+ * that reads like the caller's problem, when it is our missing configuration.
+ */
+export declare function resolveBaseUrl(product: string, config: BrowserStackConfig, source?: HostSource, transport?: Transport): Promise<string>;
+/**
+ * Locate the artifact(s).
+ *
+ * ONE FILE PER PRODUCT, so this returns a list. Explicit env wins; otherwise look for a
+ * `capability/` directory beside the compiled module and at the package root, then fall
+ * back to a single `capability-index.json` for the pre-release layout. The package-root
+ * candidates exist because `tsc` compiles TS and does not copy JSON into `dist`.
+ *
+ * Returns an empty list when nothing is found — the caller logs that and registers no
+ * tools, rather than throwing.
+ */
+export declare function indexPaths(): string[];
+/** Off by default is wrong for a shipped feature, but a kill switch is not. */
+export declare function isEnabled(): boolean;