@centrali-io/centrali-mcp 5.2.0 → 5.4.0

package/dist/tools/service-accounts.js

@@ -15,6 +15,7 @@ Object.defineProperty(exports, "__esModule", { value: true });
 exports.registerServiceAccountTools = registerServiceAccountTools;
 const axios_1 = __importDefault(require("axios"));
 const zod_1 = require("zod");
+const _register_js_1 = require("./_register.js");
 /**
  * Ensures the SDK has a valid token by making a lightweight SDK call if needed.
  */
@@ -69,29 +70,13 @@ function createIamClient(sdk, centraliUrl, workspaceId, baseSuffix) {
     }));
     return client;
 }
-function formatError(error, context) {
-    var _a, _b, _c, _d, _e, _f, _g, _h;
-    if (error && typeof error === "object") {
-        const e = error;
-        if ((_a = e.response) === null || _a === void 0 ? void 0 : _a.data) {
-            const d = e.response.data;
-            const code = (_e = (_d = (_b = d.code) !== null && _b !== void 0 ? _b : (_c = d.error) === null || _c === void 0 ? void 0 : _c.code) !== null && _d !== void 0 ? _d : e.response.status) !== null && _e !== void 0 ? _e : "ERROR";
-            const message = (_h = (_f = d.message) !== null && _f !== void 0 ? _f : (_g = d.error) === null || _g === void 0 ? void 0 : _g.message) !== null && _h !== void 0 ? _h : JSON.stringify(d);
-            return `Error ${context}: [${code}] ${message}`;
-        }
-        if ("message" in e) {
-            return `Error ${context}: ${e.message}`;
-        }
-    }
-    return `Error ${context}: ${error instanceof Error ? error.message : String(error)}`;
-}
 function registerServiceAccountTools(server, sdk, centraliUrl, workspaceId, currentIdentity) {
     const getSaClient = () => createIamClient(sdk, centraliUrl, workspaceId, "service-accounts");
     const getUsersClient = () => createIamClient(sdk, centraliUrl, workspaceId, "users");
     const getRolesClient = () => createIamClient(sdk, centraliUrl, workspaceId, "roles");
     const getGroupsClient = () => createIamClient(sdk, centraliUrl, workspaceId, "groups");
     // ── Identity ─────────────────────────────────────────────────────
-    server.tool("get_current_identity", "Get the current authenticated MCP identity. In stdio/service-account mode, returns the MCP service account. In hosted OAuth mode, fetches the authenticated user's profile, roles, and groups from IAM.", {}, () => __awaiter(this, void 0, void 0, function* () {
+    (0, _register_js_1.registerTool)(server, "get_current_identity", "Get the current authenticated MCP identity. In stdio/service-account mode, returns the MCP service account. In hosted OAuth mode, fetches the authenticated user's profile, roles, and groups from IAM.", {}, () => __awaiter(this, void 0, void 0, function* () {
         var _a, _b, _c, _d, _e, _f, _g, _h, _j, _k, _l, _m, _o, _p;
         try {
             if ((currentIdentity === null || currentIdentity === void 0 ? void 0 : currentIdentity.userId) && !currentIdentity.isServiceAccount) {
@@ -155,13 +140,13 @@ function registerServiceAccountTools(server, sdk, centraliUrl, workspaceId, curr
         }
         catch (error) {
             return {
-                content: [{ type: "text", text: formatError(error, "getting current identity") }],
+                content: [{ type: "text", text: (0, _register_js_1.formatError)(error, "getting current identity") }],
                 isError: true,
             };
         }
     }));
     // ── Service Account CRUD ─────────────────────────────────────────
-    server.tool("list_service_accounts", "List all service accounts in the workspace. Service accounts are machine identities used for backend-to-backend API access (client_credentials flow).", {
+    (0, _register_js_1.registerTool)(server, "list_service_accounts", "List all service accounts in the workspace. Service accounts are machine identities used for backend-to-backend API access (client_credentials flow).", {
         page: zod_1.z.number().optional().describe("Page number (default: 1)"),
         pageSize: zod_1.z.number().optional().describe("Results per page (default: 20)"),
     }, (_a) => __awaiter(this, [_a], void 0, function* ({ page, pageSize }) {
@@ -178,12 +163,12 @@ function registerServiceAccountTools(server, sdk, centraliUrl, workspaceId, curr
         }
         catch (error) {
             return {
-                content: [{ type: "text", text: formatError(error, "listing service accounts") }],
+                content: [{ type: "text", text: (0, _register_js_1.formatError)(error, "listing service accounts") }],
                 isError: true,
             };
         }
     }));
-    server.tool("get_service_account", "Get details of a specific service account by its numeric ID. Returns name, clientId, description, and revocation status. Does NOT return the clientSecret (it's only shown once at creation time).", {
+    (0, _register_js_1.registerTool)(server, "get_service_account", "Get details of a specific service account by its numeric ID. Returns name, clientId, description, and revocation status. Does NOT return the clientSecret (it's only shown once at creation time).", {
         serviceAccountId: zod_1.z.number().describe("The service account numeric ID"),
     }, (_a) => __awaiter(this, [_a], void 0, function* ({ serviceAccountId }) {
         try {
@@ -194,12 +179,12 @@ function registerServiceAccountTools(server, sdk, centraliUrl, workspaceId, curr
         }
         catch (error) {
             return {
-                content: [{ type: "text", text: formatError(error, `getting service account '${serviceAccountId}'`) }],
+                content: [{ type: "text", text: (0, _register_js_1.formatError)(error, `getting service account '${serviceAccountId}'`) }],
                 isError: true,
             };
         }
     }));
-    server.tool("create_service_account", "Create a new service account (machine identity). Returns the clientId and clientSecret — the secret is ONLY shown once, so store it securely. Use the credentials with OAuth2 client_credentials flow to get access tokens.", {
+    (0, _register_js_1.registerTool)(server, "create_service_account", "Create a new service account (machine identity). Returns the clientId and clientSecret — the secret is ONLY shown once, so store it securely. Use the credentials with OAuth2 client_credentials flow to get access tokens.", {
         name: zod_1.z.string().describe("Display name for the service account (e.g., 'CI/CD Pipeline', 'Analytics Worker')"),
         description: zod_1.z.string().optional().describe("Optional description of what this service account is used for"),
     }, (_a) => __awaiter(this, [_a], void 0, function* ({ name, description }) {
@@ -217,12 +202,12 @@ function registerServiceAccountTools(server, sdk, centraliUrl, workspaceId, curr
         }
         catch (error) {
             return {
-                content: [{ type: "text", text: formatError(error, `creating service account '${name}'`) }],
+                content: [{ type: "text", text: (0, _register_js_1.formatError)(error, `creating service account '${name}'`) }],
                 isError: true,
             };
         }
     }));
-    server.tool("update_service_account_name", "Update the display name of a service account.", {
+    (0, _register_js_1.registerTool)(server, "update_service_account_name", "Update the display name of a service account.", {
         serviceAccountId: zod_1.z.number().describe("The service account numeric ID"),
         name: zod_1.z.string().describe("New display name"),
     }, (_a) => __awaiter(this, [_a], void 0, function* ({ serviceAccountId, name }) {
@@ -234,12 +219,12 @@ function registerServiceAccountTools(server, sdk, centraliUrl, workspaceId, curr
         }
         catch (error) {
             return {
-                content: [{ type: "text", text: formatError(error, `updating service account '${serviceAccountId}' name`) }],
+                content: [{ type: "text", text: (0, _register_js_1.formatError)(error, `updating service account '${serviceAccountId}' name`) }],
                 isError: true,
             };
         }
     }));
-    server.tool("update_service_account_description", "Update the description of a service account.", {
+    (0, _register_js_1.registerTool)(server, "update_service_account_description", "Update the description of a service account.", {
         serviceAccountId: zod_1.z.number().describe("The service account numeric ID"),
         description: zod_1.z.string().nullable().describe("New description (or null to clear)"),
     }, (_a) => __awaiter(this, [_a], void 0, function* ({ serviceAccountId, description }) {
@@ -251,12 +236,12 @@ function registerServiceAccountTools(server, sdk, centraliUrl, workspaceId, curr
         }
         catch (error) {
             return {
-                content: [{ type: "text", text: formatError(error, `updating service account '${serviceAccountId}' description`) }],
+                content: [{ type: "text", text: (0, _register_js_1.formatError)(error, `updating service account '${serviceAccountId}' description`) }],
                 isError: true,
             };
         }
     }));
-    server.tool("delete_service_account", "Permanently delete a service account. This is irreversible — all tokens are invalidated immediately. Note: the service account must not be revoked (revoke prevents deletion).", {
+    (0, _register_js_1.registerTool)(server, "delete_service_account", "Permanently delete a service account. This is irreversible — all tokens are invalidated immediately. Note: the service account must not be revoked (revoke prevents deletion).", {
         clientId: zod_1.z.string().describe("The service account's clientId string (e.g., 'ci_abc123') — NOT the numeric ID"),
     }, (_a) => __awaiter(this, [_a], void 0, function* ({ clientId }) {
         try {
@@ -267,13 +252,13 @@ function registerServiceAccountTools(server, sdk, centraliUrl, workspaceId, curr
         }
         catch (error) {
             return {
-                content: [{ type: "text", text: formatError(error, `deleting service account '${clientId}'`) }],
+                content: [{ type: "text", text: (0, _register_js_1.formatError)(error, `deleting service account '${clientId}'`) }],
                 isError: true,
             };
         }
     }));
     // ── Secret Rotation & Revocation ─────────────────────────────────
-    server.tool("rotate_service_account_secret", "Rotate the client secret of a service account. The old secret is immediately invalidated. Returns the new clientSecret — store it securely, it's only shown once.", {
+    (0, _register_js_1.registerTool)(server, "rotate_service_account_secret", "Rotate the client secret of a service account. The old secret is immediately invalidated. Returns the new clientSecret — store it securely, it's only shown once.", {
         serviceAccountId: zod_1.z.number().describe("The service account numeric ID"),
     }, (_a) => __awaiter(this, [_a], void 0, function* ({ serviceAccountId }) {
         try {
@@ -287,12 +272,12 @@ function registerServiceAccountTools(server, sdk, centraliUrl, workspaceId, curr
         }
         catch (error) {
             return {
-                content: [{ type: "text", text: formatError(error, `rotating secret for service account '${serviceAccountId}'`) }],
+                content: [{ type: "text", text: (0, _register_js_1.formatError)(error, `rotating secret for service account '${serviceAccountId}'`) }],
                 isError: true,
             };
         }
     }));
-    server.tool("revoke_service_account", "Revoke a service account. All existing tokens are invalidated and no new tokens can be issued. This cannot be undone.", {
+    (0, _register_js_1.registerTool)(server, "revoke_service_account", "Revoke a service account. All existing tokens are invalidated and no new tokens can be issued. This cannot be undone.", {
         serviceAccountId: zod_1.z.number().describe("The service account numeric ID to revoke"),
     }, (_a) => __awaiter(this, [_a], void 0, function* ({ serviceAccountId }) {
         try {
@@ -303,13 +288,13 @@ function registerServiceAccountTools(server, sdk, centraliUrl, workspaceId, curr
         }
         catch (error) {
             return {
-                content: [{ type: "text", text: formatError(error, `revoking service account '${serviceAccountId}'`) }],
+                content: [{ type: "text", text: (0, _register_js_1.formatError)(error, `revoking service account '${serviceAccountId}'`) }],
                 isError: true,
             };
         }
     }));
     // ── Dev Token Generation ─────────────────────────────────────────
-    server.tool("generate_dev_token", "Generate a short-lived development token for a service account. Useful for testing and local development without the full OAuth2 client_credentials flow. The token has limited TTL.", {
+    (0, _register_js_1.registerTool)(server, "generate_dev_token", "Generate a short-lived development token for a service account. Useful for testing and local development without the full OAuth2 client_credentials flow. The token has limited TTL.", {
         serviceAccountId: zod_1.z.number().describe("The service account numeric ID"),
         ttlSeconds: zod_1.z.number().describe("Token time-to-live in seconds (valid options depend on server config, typically 3600, 86400, 604800)"),
     }, (_a) => __awaiter(this, [_a], void 0, function* ({ serviceAccountId, ttlSeconds }) {
@@ -324,13 +309,13 @@ function registerServiceAccountTools(server, sdk, centraliUrl, workspaceId, curr
         }
         catch (error) {
             return {
-                content: [{ type: "text", text: formatError(error, `generating dev token for service account '${serviceAccountId}'`) }],
+                content: [{ type: "text", text: (0, _register_js_1.formatError)(error, `generating dev token for service account '${serviceAccountId}'`) }],
                 isError: true,
             };
         }
     }));
     // ── Permission Introspection ─────────────────────────────────────
-    server.tool("scan_service_account_permissions", "Scan all permissions for a service account. Returns a full access matrix showing every resource and action with Allow/Deny decisions and reasons. Use this to audit what a service account can and cannot do.", {
+    (0, _register_js_1.registerTool)(server, "scan_service_account_permissions", "Scan all permissions for a service account. Returns a full access matrix showing every resource and action with Allow/Deny decisions and reasons. Use this to audit what a service account can and cannot do.", {
         serviceAccountId: zod_1.z.number().describe("The service account numeric ID"),
         filter: zod_1.z.enum(["all", "allowed", "denied"]).optional().describe("Filter results: 'all' (default), 'allowed' (only granted), 'denied' (only missing)"),
         resourceCategory: zod_1.z.string().optional().describe("Filter by resource category (e.g., 'workspace')"),
@@ -348,12 +333,12 @@ function registerServiceAccountTools(server, sdk, centraliUrl, workspaceId, curr
         }
         catch (error) {
             return {
-                content: [{ type: "text", text: formatError(error, `scanning permissions for service account '${serviceAccountId}'`) }],
+                content: [{ type: "text", text: (0, _register_js_1.formatError)(error, `scanning permissions for service account '${serviceAccountId}'`) }],
                 isError: true,
             };
         }
     }));
-    server.tool("simulate_service_account_permission", "Simulate an authorization check for a service account against a specific resource and action. Returns the decision (Allow/Deny), evaluation trace, and suggestions for granting access if denied.", {
+    (0, _register_js_1.registerTool)(server, "simulate_service_account_permission", "Simulate an authorization check for a service account against a specific resource and action. Returns the decision (Allow/Deny), evaluation trace, and suggestions for granting access if denied.", {
         serviceAccountId: zod_1.z.number().describe("The service account numeric ID"),
         resource: zod_1.z.string().describe("Resource identifier (e.g., 'workspace::records', 'workspace::compute-functions')"),
         resourceCategory: zod_1.z.string().describe("Resource category (e.g., 'workspace')"),
@@ -371,7 +356,7 @@ function registerServiceAccountTools(server, sdk, centraliUrl, workspaceId, curr
         }
         catch (error) {
             return {
-                content: [{ type: "text", text: formatError(error, `simulating permission for service account '${serviceAccountId}'`) }],
+                content: [{ type: "text", text: (0, _register_js_1.formatError)(error, `simulating permission for service account '${serviceAccountId}'`) }],
                 isError: true,
             };
         }
@@ -396,7 +381,7 @@ function registerServiceAccountTools(server, sdk, centraliUrl, workspaceId, curr
             details: zod_1.z.record(zod_1.z.string(), zod_1.z.unknown()).optional(),
         })),
     }).describe("The remediation option object from generate_remediation — pass the full option object exactly as returned");
-    server.tool("generate_remediation", "Generate remediation options for granting a service account access to a specific resource and actions. Returns multiple options: assign an existing role, join a group, or create a minimal new policy. Use after scan_service_account_permissions or simulate_service_account_permission shows Deny.", {
+    (0, _register_js_1.registerTool)(server, "generate_remediation", "Generate remediation options for granting a service account access to a specific resource and actions. Returns multiple options: assign an existing role, join a group, or create a minimal new policy. Use after scan_service_account_permissions or simulate_service_account_permission shows Deny.", {
         serviceAccountId: zod_1.z.number().describe("The service account numeric ID"),
         resource: zod_1.z.string().describe("Resource identifier (e.g., 'workspace::records', 'workspace::compute-functions')"),
         resourceCategory: zod_1.z.string().describe("Resource category (e.g., 'workspace')"),
@@ -416,12 +401,12 @@ function registerServiceAccountTools(server, sdk, centraliUrl, workspaceId, curr
         }
         catch (error) {
             return {
-                content: [{ type: "text", text: formatError(error, `generating remediation for service account '${serviceAccountId}'`) }],
+                content: [{ type: "text", text: (0, _register_js_1.formatError)(error, `generating remediation for service account '${serviceAccountId}'`) }],
                 isError: true,
             };
         }
     }));
-    server.tool("preview_remediation", "Preview what changes would be made by applying a specific remediation option. Shows what would be created or modified without actually making changes. Call generate_remediation first to get the options.", {
+    (0, _register_js_1.registerTool)(server, "preview_remediation", "Preview what changes would be made by applying a specific remediation option. Shows what would be created or modified without actually making changes. Call generate_remediation first to get the options.", {
         serviceAccountId: zod_1.z.number().describe("The service account numeric ID"),
         resource: zod_1.z.string().describe("Resource identifier (same as used in generate_remediation)"),
         resourceCategory: zod_1.z.string().describe("Resource category (same as used in generate_remediation)"),
@@ -444,12 +429,12 @@ function registerServiceAccountTools(server, sdk, centraliUrl, workspaceId, curr
         }
         catch (error) {
             return {
-                content: [{ type: "text", text: formatError(error, `previewing remediation for service account '${serviceAccountId}'`) }],
+                content: [{ type: "text", text: (0, _register_js_1.formatError)(error, `previewing remediation for service account '${serviceAccountId}'`) }],
                 isError: true,
             };
         }
     }));
-    server.tool("apply_remediation", "Apply a remediation option to actually grant access. Creates roles, policies, or group assignments as needed. After applying, the service account will have the requested permissions. The response includes a verification check confirming the access was granted.", {
+    (0, _register_js_1.registerTool)(server, "apply_remediation", "Apply a remediation option to actually grant access. Creates roles, policies, or group assignments as needed. After applying, the service account will have the requested permissions. The response includes a verification check confirming the access was granted.", {
         serviceAccountId: zod_1.z.number().describe("The service account numeric ID"),
         resource: zod_1.z.string().describe("Resource identifier (same as used in generate_remediation)"),
         resourceCategory: zod_1.z.string().describe("Resource category (same as used in generate_remediation)"),
@@ -473,13 +458,13 @@ function registerServiceAccountTools(server, sdk, centraliUrl, workspaceId, curr
         }
         catch (error) {
             return {
-                content: [{ type: "text", text: formatError(error, `applying remediation for service account '${serviceAccountId}'`) }],
+                content: [{ type: "text", text: (0, _register_js_1.formatError)(error, `applying remediation for service account '${serviceAccountId}'`) }],
                 isError: true,
             };
         }
     }));
     // ── Service Account ↔ Roles ──────────────────────────────────────
-    server.tool("list_service_account_roles", "List all roles assigned to a service account.", {
+    (0, _register_js_1.registerTool)(server, "list_service_account_roles", "List all roles assigned to a service account.", {
         serviceAccountId: zod_1.z.number().describe("The service account numeric ID"),
     }, (_a) => __awaiter(this, [_a], void 0, function* ({ serviceAccountId }) {
         try {
@@ -490,12 +475,12 @@ function registerServiceAccountTools(server, sdk, centraliUrl, workspaceId, curr
         }
         catch (error) {
             return {
-                content: [{ type: "text", text: formatError(error, `listing roles for service account '${serviceAccountId}'`) }],
+                content: [{ type: "text", text: (0, _register_js_1.formatError)(error, `listing roles for service account '${serviceAccountId}'`) }],
                 isError: true,
             };
         }
     }));
-    server.tool("assign_role_to_service_account", "Assign a role to a service account. The service account inherits all permissions defined in the role.", {
+    (0, _register_js_1.registerTool)(server, "assign_role_to_service_account", "Assign a role to a service account. The service account inherits all permissions defined in the role.", {
         serviceAccountId: zod_1.z.number().describe("The service account numeric ID"),
         roleId: zod_1.z.string().describe("The role ID (UUID) to assign"),
     }, (_a) => __awaiter(this, [_a], void 0, function* ({ serviceAccountId, roleId }) {
@@ -507,12 +492,12 @@ function registerServiceAccountTools(server, sdk, centraliUrl, workspaceId, curr
         }
         catch (error) {
             return {
-                content: [{ type: "text", text: formatError(error, `assigning role '${roleId}' to service account '${serviceAccountId}'`) }],
+                content: [{ type: "text", text: (0, _register_js_1.formatError)(error, `assigning role '${roleId}' to service account '${serviceAccountId}'`) }],
                 isError: true,
             };
         }
     }));
-    server.tool("remove_role_from_service_account", "Remove a role from a service account. The service account loses all permissions from this role.", {
+    (0, _register_js_1.registerTool)(server, "remove_role_from_service_account", "Remove a role from a service account. The service account loses all permissions from this role.", {
         serviceAccountId: zod_1.z.number().describe("The service account numeric ID"),
         roleId: zod_1.z.string().describe("The role ID (UUID) to remove"),
     }, (_a) => __awaiter(this, [_a], void 0, function* ({ serviceAccountId, roleId }) {
@@ -524,13 +509,13 @@ function registerServiceAccountTools(server, sdk, centraliUrl, workspaceId, curr
         }
         catch (error) {
             return {
-                content: [{ type: "text", text: formatError(error, `removing role '${roleId}' from service account '${serviceAccountId}'`) }],
+                content: [{ type: "text", text: (0, _register_js_1.formatError)(error, `removing role '${roleId}' from service account '${serviceAccountId}'`) }],
                 isError: true,
             };
         }
     }));
     // ── Service Account ↔ Groups ─────────────────────────────────────
-    server.tool("list_service_account_groups", "List all groups a service account belongs to.", {
+    (0, _register_js_1.registerTool)(server, "list_service_account_groups", "List all groups a service account belongs to.", {
         serviceAccountId: zod_1.z.number().describe("The service account numeric ID"),
     }, (_a) => __awaiter(this, [_a], void 0, function* ({ serviceAccountId }) {
         try {
@@ -541,12 +526,12 @@ function registerServiceAccountTools(server, sdk, centraliUrl, workspaceId, curr
         }
         catch (error) {
             return {
-                content: [{ type: "text", text: formatError(error, `listing groups for service account '${serviceAccountId}'`) }],
+                content: [{ type: "text", text: (0, _register_js_1.formatError)(error, `listing groups for service account '${serviceAccountId}'`) }],
                 isError: true,
             };
         }
     }));
-    server.tool("add_service_account_to_group", "Add a service account to a group. The service account inherits all roles assigned to the group.", {
+    (0, _register_js_1.registerTool)(server, "add_service_account_to_group", "Add a service account to a group. The service account inherits all roles assigned to the group.", {
         serviceAccountId: zod_1.z.number().describe("The service account numeric ID"),
         groupId: zod_1.z.string().describe("The group ID (UUID) to add the service account to"),
     }, (_a) => __awaiter(this, [_a], void 0, function* ({ serviceAccountId, groupId }) {
@@ -558,12 +543,12 @@ function registerServiceAccountTools(server, sdk, centraliUrl, workspaceId, curr
         }
         catch (error) {
             return {
-                content: [{ type: "text", text: formatError(error, `adding service account '${serviceAccountId}' to group '${groupId}'`) }],
+                content: [{ type: "text", text: (0, _register_js_1.formatError)(error, `adding service account '${serviceAccountId}' to group '${groupId}'`) }],
                 isError: true,
             };
         }
     }));
-    server.tool("remove_service_account_from_group", "Remove a service account from a group. The service account loses all permissions inherited through this group.", {
+    (0, _register_js_1.registerTool)(server, "remove_service_account_from_group", "Remove a service account from a group. The service account loses all permissions inherited through this group.", {
         serviceAccountId: zod_1.z.number().describe("The service account numeric ID"),
         groupId: zod_1.z.string().describe("The group ID (UUID) to remove the service account from"),
     }, (_a) => __awaiter(this, [_a], void 0, function* ({ serviceAccountId, groupId }) {
@@ -575,13 +560,13 @@ function registerServiceAccountTools(server, sdk, centraliUrl, workspaceId, curr
         }
         catch (error) {
             return {
-                content: [{ type: "text", text: formatError(error, `removing service account '${serviceAccountId}' from group '${groupId}'`) }],
+                content: [{ type: "text", text: (0, _register_js_1.formatError)(error, `removing service account '${serviceAccountId}' from group '${groupId}'`) }],
                 isError: true,
             };
         }
     }));
     // ── Role CRUD ────────────────────────────────────────────────────
-    server.tool("list_roles", "List all roles in the workspace. Roles are named labels assigned to users and service accounts.", {
+    (0, _register_js_1.registerTool)(server, "list_roles", "List all roles in the workspace. Roles are named labels assigned to users and service accounts.", {
         page: zod_1.z.number().optional().describe("Page number (default: 1)"),
         pageSize: zod_1.z.number().optional().describe("Results per page (default: 20)"),
     }, (_a) => __awaiter(this, [_a], void 0, function* ({ page, pageSize }) {
@@ -598,12 +583,12 @@ function registerServiceAccountTools(server, sdk, centraliUrl, workspaceId, curr
         }
         catch (error) {
             return {
-                content: [{ type: "text", text: formatError(error, "listing roles") }],
+                content: [{ type: "text", text: (0, _register_js_1.formatError)(error, "listing roles") }],
                 isError: true,
             };
         }
     }));
-    server.tool("get_role", "Get details of a role including its permissions.", {
+    (0, _register_js_1.registerTool)(server, "get_role", "Get details of a role including its permissions.", {
         roleId: zod_1.z.string().describe("The role ID (UUID)"),
     }, (_a) => __awaiter(this, [_a], void 0, function* ({ roleId }) {
         try {
@@ -614,12 +599,12 @@ function registerServiceAccountTools(server, sdk, centraliUrl, workspaceId, curr
         }
         catch (error) {
             return {
-                content: [{ type: "text", text: formatError(error, `getting role '${roleId}'`) }],
+                content: [{ type: "text", text: (0, _register_js_1.formatError)(error, `getting role '${roleId}'`) }],
                 isError: true,
             };
         }
     }));
-    server.tool("create_role", "Create a new role. Roles are named labels assigned to users and service accounts. They do NOT contain permissions directly — to grant access, create a policy that targets the role as a principal. Role names are immutable after creation.", {
+    (0, _register_js_1.registerTool)(server, "create_role", "Create a new role. Roles are named labels assigned to users and service accounts. They do NOT contain permissions directly — to grant access, create a policy that targets the role as a principal. Role names are immutable after creation.", {
         name: zod_1.z.string().describe("Role name (e.g., 'Data Reader', 'Compute Admin'). Cannot be changed after creation."),
         description: zod_1.z.string().optional().describe("Optional description of the role's purpose"),
     }, (_a) => __awaiter(this, [_a], void 0, function* ({ name, description }) {
@@ -634,12 +619,12 @@ function registerServiceAccountTools(server, sdk, centraliUrl, workspaceId, curr
         }
         catch (error) {
             return {
-                content: [{ type: "text", text: formatError(error, `creating role '${name}'`) }],
+                content: [{ type: "text", text: (0, _register_js_1.formatError)(error, `creating role '${name}'`) }],
                 isError: true,
             };
         }
     }));
-    server.tool("update_role", "Update a role's description. Role names are immutable. Roles are named labels assigned to users/service accounts — they do NOT contain permissions directly. To grant access, create a policy that references the role.", {
+    (0, _register_js_1.registerTool)(server, "update_role", "Update a role's description. Role names are immutable. Roles are named labels assigned to users/service accounts — they do NOT contain permissions directly. To grant access, create a policy that references the role.", {
         roleId: zod_1.z.string().describe("The role ID (UUID) to update"),
         description: zod_1.z.string().optional().describe("Updated description"),
     }, (_a) => __awaiter(this, [_a], void 0, function* ({ roleId, description }) {
@@ -654,12 +639,12 @@ function registerServiceAccountTools(server, sdk, centraliUrl, workspaceId, curr
         }
         catch (error) {
             return {
-                content: [{ type: "text", text: formatError(error, `updating role '${roleId}'`) }],
+                content: [{ type: "text", text: (0, _register_js_1.formatError)(error, `updating role '${roleId}'`) }],
                 isError: true,
             };
         }
     }));
-    server.tool("delete_role", "Delete a role. Service accounts assigned to this role will lose the label.", {
+    (0, _register_js_1.registerTool)(server, "delete_role", "Delete a role. Service accounts assigned to this role will lose the label.", {
         roleId: zod_1.z.string().describe("The role ID (UUID) to delete"),
     }, (_a) => __awaiter(this, [_a], void 0, function* ({ roleId }) {
         try {
@@ -670,13 +655,13 @@ function registerServiceAccountTools(server, sdk, centraliUrl, workspaceId, curr
         }
         catch (error) {
             return {
-                content: [{ type: "text", text: formatError(error, `deleting role '${roleId}'`) }],
+                content: [{ type: "text", text: (0, _register_js_1.formatError)(error, `deleting role '${roleId}'`) }],
                 isError: true,
             };
         }
     }));
     // ── Group CRUD ───────────────────────────────────────────────────
-    server.tool("list_groups", "List all groups in the workspace. Groups bundle service accounts together and can have roles assigned to them.", {
+    (0, _register_js_1.registerTool)(server, "list_groups", "List all groups in the workspace. Groups bundle service accounts together and can have roles assigned to them.", {
         page: zod_1.z.number().optional().describe("Page number (default: 1)"),
         pageSize: zod_1.z.number().optional().describe("Results per page (default: 20)"),
     }, (_a) => __awaiter(this, [_a], void 0, function* ({ page, pageSize }) {
@@ -693,12 +678,12 @@ function registerServiceAccountTools(server, sdk, centraliUrl, workspaceId, curr
         }
         catch (error) {
             return {
-                content: [{ type: "text", text: formatError(error, "listing groups") }],
+                content: [{ type: "text", text: (0, _register_js_1.formatError)(error, "listing groups") }],
                 isError: true,
             };
         }
     }));
-    server.tool("get_group", "Get details of a group.", {
+    (0, _register_js_1.registerTool)(server, "get_group", "Get details of a group.", {
         groupId: zod_1.z.string().describe("The group ID (UUID)"),
     }, (_a) => __awaiter(this, [_a], void 0, function* ({ groupId }) {
         try {
@@ -709,12 +694,12 @@ function registerServiceAccountTools(server, sdk, centraliUrl, workspaceId, curr
         }
         catch (error) {
             return {
-                content: [{ type: "text", text: formatError(error, `getting group '${groupId}'`) }],
+                content: [{ type: "text", text: (0, _register_js_1.formatError)(error, `getting group '${groupId}'`) }],
                 isError: true,
             };
         }
     }));
-    server.tool("create_group", "Create a new group. Groups let you assign roles to multiple service accounts at once.", {
+    (0, _register_js_1.registerTool)(server, "create_group", "Create a new group. Groups let you assign roles to multiple service accounts at once.", {
         name: zod_1.z.string().describe("Group name (e.g., 'Backend Services', 'Analytics Pipeline')"),
         description: zod_1.z.string().optional().describe("Optional description"),
     }, (_a) => __awaiter(this, [_a], void 0, function* ({ name, description }) {
@@ -729,12 +714,12 @@ function registerServiceAccountTools(server, sdk, centraliUrl, workspaceId, curr
         }
         catch (error) {
             return {
-                content: [{ type: "text", text: formatError(error, `creating group '${name}'`) }],
+                content: [{ type: "text", text: (0, _register_js_1.formatError)(error, `creating group '${name}'`) }],
                 isError: true,
             };
         }
     }));
-    server.tool("update_group", "Update a group's description. Group names are immutable and cannot be changed after creation.", {
+    (0, _register_js_1.registerTool)(server, "update_group", "Update a group's description. Group names are immutable and cannot be changed after creation.", {
         groupId: zod_1.z.string().describe("The group ID (UUID) to update"),
         description: zod_1.z.string().optional().describe("Updated description"),
     }, (_a) => __awaiter(this, [_a], void 0, function* ({ groupId, description }) {
@@ -749,12 +734,12 @@ function registerServiceAccountTools(server, sdk, centraliUrl, workspaceId, curr
         }
         catch (error) {
             return {
-                content: [{ type: "text", text: formatError(error, `updating group '${groupId}'`) }],
+                content: [{ type: "text", text: (0, _register_js_1.formatError)(error, `updating group '${groupId}'`) }],
                 isError: true,
             };
         }
     }));
-    server.tool("delete_group", "Delete a group. Service accounts in this group lose permissions inherited through it.", {
+    (0, _register_js_1.registerTool)(server, "delete_group", "Delete a group. Service accounts in this group lose permissions inherited through it.", {
         groupId: zod_1.z.string().describe("The group ID (UUID) to delete"),
     }, (_a) => __awaiter(this, [_a], void 0, function* ({ groupId }) {
         try {
@@ -765,14 +750,14 @@ function registerServiceAccountTools(server, sdk, centraliUrl, workspaceId, curr
         }
         catch (error) {
             return {
-                content: [{ type: "text", text: formatError(error, `deleting group '${groupId}'`) }],
+                content: [{ type: "text", text: (0, _register_js_1.formatError)(error, `deleting group '${groupId}'`) }],
                 isError: true,
             };
         }
     }));
     // ── Publishable Keys ─────────────────────────────────────────────
     const getPkClient = () => createIamClient(sdk, centraliUrl, workspaceId, "publishable-keys");
-    server.tool("list_publishable_keys", "List all publishable keys in the workspace. Publishable keys are frontend-safe API keys for browser/client-side apps — they grant scoped, read-mostly access to specific collections, records, triggers, and files.", {
+    (0, _register_js_1.registerTool)(server, "list_publishable_keys", "List all publishable keys in the workspace. Publishable keys are frontend-safe API keys for browser/client-side apps — they grant scoped, read-mostly access to specific collections, records, triggers, and files.", {
         page: zod_1.z.number().optional().describe("Page number (default: 1)"),
         pageSize: zod_1.z.number().optional().describe("Results per page (default: 20)"),
     }, (_a) => __awaiter(this, [_a], void 0, function* ({ page, pageSize }) {
@@ -789,12 +774,12 @@ function registerServiceAccountTools(server, sdk, centraliUrl, workspaceId, curr
         }
         catch (error) {
             return {
-                content: [{ type: "text", text: formatError(error, "listing publishable keys") }],
+                content: [{ type: "text", text: (0, _register_js_1.formatError)(error, "listing publishable keys") }],
                 isError: true,
             };
         }
     }));
-    server.tool("get_publishable_key", "Get details of a publishable key including its scopes and usage stats.", {
+    (0, _register_js_1.registerTool)(server, "get_publishable_key", "Get details of a publishable key including its scopes and usage stats.", {
         keyId: zod_1.z.string().describe("The publishable key ID (UUID)"),
     }, (_a) => __awaiter(this, [_a], void 0, function* ({ keyId }) {
         try {
@@ -805,12 +790,12 @@ function registerServiceAccountTools(server, sdk, centraliUrl, workspaceId, curr
         }
         catch (error) {
             return {
-                content: [{ type: "text", text: formatError(error, `getting publishable key '${keyId}'`) }],
+                content: [{ type: "text", text: (0, _register_js_1.formatError)(error, `getting publishable key '${keyId}'`) }],
                 isError: true,
             };
         }
     }));
-    server.tool("create_publishable_key", "Create a publishable key for frontend/client-side use. Returns the full key value (pk_live_...) — it's safe to embed in client code but only shown in full once. Scopes control what the key can access. Always use least-privilege: only grant the specific collections, actions, and triggers the frontend needs.", {
+    (0, _register_js_1.registerTool)(server, "create_publishable_key", "Create a publishable key for frontend/client-side use. Returns the full key value (pk_live_...) — it's safe to embed in client code but only shown in full once. Scopes control what the key can access. Always use least-privilege: only grant the specific collections, actions, and triggers the frontend needs.", {
         label: zod_1.z.string().describe("Display label (e.g., 'React Dashboard', 'Marketing Site')"),
         scopes: zod_1.z.array(zod_1.z.string()).describe("Scopes defining what this key can access. Format: 'resource:action:target'. Examples: 'records:list:products' (list products), 'records:retrieve:*' (read any collection), 'records:create:orders' (create orders), 'triggers:execute:send-email' (invoke a trigger), 'files:retrieve' (read files), 'collections:list' (list collection schemas). Write actions (create, execute) require explicit targets — no wildcards."),
     }, (_a) => __awaiter(this, [_a], void 0, function* ({ label, scopes }) {
@@ -825,12 +810,12 @@ function registerServiceAccountTools(server, sdk, centraliUrl, workspaceId, curr
         }
         catch (error) {
             return {
-                content: [{ type: "text", text: formatError(error, `creating publishable key '${label}'`) }],
+                content: [{ type: "text", text: (0, _register_js_1.formatError)(error, `creating publishable key '${label}'`) }],
                 isError: true,
             };
         }
     }));
-    server.tool("update_publishable_key", "Update a publishable key's label or scopes. When updating scopes, the new scopes replace all existing ones.", {
+    (0, _register_js_1.registerTool)(server, "update_publishable_key", "Update a publishable key's label or scopes. When updating scopes, the new scopes replace all existing ones.", {
         keyId: zod_1.z.string().describe("The publishable key ID (UUID) to update"),
         label: zod_1.z.string().optional().describe("Updated label"),
         scopes: zod_1.z.array(zod_1.z.string()).optional().describe("Updated scopes (replaces all existing). Same format as create_publishable_key."),
@@ -848,12 +833,12 @@ function registerServiceAccountTools(server, sdk, centraliUrl, workspaceId, curr
         }
         catch (error) {
             return {
-                content: [{ type: "text", text: formatError(error, `updating publishable key '${keyId}'`) }],
+                content: [{ type: "text", text: (0, _register_js_1.formatError)(error, `updating publishable key '${keyId}'`) }],
                 isError: true,
             };
         }
     }));
-    server.tool("revoke_publishable_key", "Revoke a publishable key. The key immediately stops working. This cannot be undone — create a new key if needed.", {
+    (0, _register_js_1.registerTool)(server, "revoke_publishable_key", "Revoke a publishable key. The key immediately stops working. This cannot be undone — create a new key if needed.", {
         keyId: zod_1.z.string().describe("The publishable key ID (UUID) to revoke"),
     }, (_a) => __awaiter(this, [_a], void 0, function* ({ keyId }) {
         try {
@@ -864,7 +849,7 @@ function registerServiceAccountTools(server, sdk, centraliUrl, workspaceId, curr
         }
         catch (error) {
             return {
-                content: [{ type: "text", text: formatError(error, `revoking publishable key '${keyId}'`) }],
+                content: [{ type: "text", text: (0, _register_js_1.formatError)(error, `revoking publishable key '${keyId}'`) }],
                 isError: true,
             };
         }
@@ -875,7 +860,7 @@ function registerServiceAccountTools(server, sdk, centraliUrl, workspaceId, curr
     const getPoliciesClient = () => createIamClient(sdk, centraliUrl, workspaceId, "access/policies");
     const getPermissionsClient = () => createIamClient(sdk, centraliUrl, workspaceId, "access/permissions");
     const getResourcesClient = () => createIamClient(sdk, centraliUrl, workspaceId, "access/resources");
-    server.tool("list_policies", "List all access control policies in the workspace. Policies define who can do what — they bind roles/groups/principals to permissions with optional conditions.", {
+    (0, _register_js_1.registerTool)(server, "list_policies", "List all access control policies in the workspace. Policies define who can do what — they bind roles/groups/principals to permissions with optional conditions.", {
         page: zod_1.z.number().optional().describe("Page number (default: 1)"),
         pageSize: zod_1.z.number().optional().describe("Results per page (default: 20)"),
     }, (_a) => __awaiter(this, [_a], void 0, function* ({ page, pageSize }) {
@@ -889,10 +874,10 @@ function registerServiceAccountTools(server, sdk, centraliUrl, workspaceId, curr
             return { content: [{ type: "text", text: JSON.stringify(result.data, null, 2) }] };
         }
         catch (error) {
-            return { content: [{ type: "text", text: formatError(error, "listing policies") }], isError: true };
+            return { content: [{ type: "text", text: (0, _register_js_1.formatError)(error, "listing policies") }], isError: true };
         }
     }));
-    server.tool("get_policy", "Get the full definition of an access control policy by ID.", {
+    (0, _register_js_1.registerTool)(server, "get_policy", "Get the full definition of an access control policy by ID.", {
         policyId: zod_1.z.string().describe("The policy ID"),
     }, (_a) => __awaiter(this, [_a], void 0, function* ({ policyId }) {
         try {
@@ -900,10 +885,10 @@ function registerServiceAccountTools(server, sdk, centraliUrl, workspaceId, curr
             return { content: [{ type: "text", text: JSON.stringify(result.data, null, 2) }] };
         }
         catch (error) {
-            return { content: [{ type: "text", text: formatError(error, `getting policy '${policyId}'`) }], isError: true };
+            return { content: [{ type: "text", text: (0, _register_js_1.formatError)(error, `getting policy '${policyId}'`) }], isError: true };
         }
     }));
-    server.tool("create_policy", "Create an access control policy. Policies grant or deny actions on resources to principals (users, service accounts, groups, roles).", {
+    (0, _register_js_1.registerTool)(server, "create_policy", "Create an access control policy. Policies grant or deny actions on resources to principals (users, service accounts, groups, roles).", {
         policy: zod_1.z.record(zod_1.z.string(), zod_1.z.any()).describe("The policy definition object. Must include: name, effect ('allow'|'deny'), principals, resources, actions. May include conditions."),
     }, (_a) => __awaiter(this, [_a], void 0, function* ({ policy }) {
         try {
@@ -911,10 +896,10 @@ function registerServiceAccountTools(server, sdk, centraliUrl, workspaceId, curr
             return { content: [{ type: "text", text: JSON.stringify(result.data, null, 2) }] };
         }
         catch (error) {
-            return { content: [{ type: "text", text: formatError(error, "creating policy") }], isError: true };
+            return { content: [{ type: "text", text: (0, _register_js_1.formatError)(error, "creating policy") }], isError: true };
         }
     }));
-    server.tool("update_policy", "Update an existing access control policy by ID.", {
+    (0, _register_js_1.registerTool)(server, "update_policy", "Update an existing access control policy by ID.", {
         policyId: zod_1.z.string().describe("The policy ID to update"),
         policy: zod_1.z.record(zod_1.z.string(), zod_1.z.any()).describe("The updated policy definition"),
     }, (_a) => __awaiter(this, [_a], void 0, function* ({ policyId, policy }) {
@@ -923,10 +908,10 @@ function registerServiceAccountTools(server, sdk, centraliUrl, workspaceId, curr
             return { content: [{ type: "text", text: JSON.stringify(result.data, null, 2) }] };
         }
         catch (error) {
-            return { content: [{ type: "text", text: formatError(error, `updating policy '${policyId}'`) }], isError: true };
+            return { content: [{ type: "text", text: (0, _register_js_1.formatError)(error, `updating policy '${policyId}'`) }], isError: true };
         }
     }));
-    server.tool("delete_policy", "Delete an access control policy by ID. This immediately revokes the access it granted. Use this to undo apply_remediation.", {
+    (0, _register_js_1.registerTool)(server, "delete_policy", "Delete an access control policy by ID. This immediately revokes the access it granted. Use this to undo apply_remediation.", {
         policyId: zod_1.z.string().describe("The policy ID to delete"),
     }, (_a) => __awaiter(this, [_a], void 0, function* ({ policyId }) {
         try {
@@ -934,11 +919,11 @@ function registerServiceAccountTools(server, sdk, centraliUrl, workspaceId, curr
             return { content: [{ type: "text", text: `Policy '${policyId}' deleted.` }] };
         }
         catch (error) {
-            return { content: [{ type: "text", text: formatError(error, `deleting policy '${policyId}'`) }], isError: true };
+            return { content: [{ type: "text", text: (0, _register_js_1.formatError)(error, `deleting policy '${policyId}'`) }], isError: true };
         }
     }));
     // ── Permissions CRUD ───────────────────────────────────────────────
-    server.tool("list_permissions", "List all permission definitions in the workspace. Permissions are resource + action pairs (e.g., 'workspace::records' + 'create').", {
+    (0, _register_js_1.registerTool)(server, "list_permissions", "List all permission definitions in the workspace. Permissions are resource + action pairs (e.g., 'workspace::records' + 'create').", {
         page: zod_1.z.number().optional().describe("Page number (default: 1)"),
         pageSize: zod_1.z.number().optional().describe("Results per page (default: 20)"),
     }, (_a) => __awaiter(this, [_a], void 0, function* ({ page, pageSize }) {
@@ -952,10 +937,10 @@ function registerServiceAccountTools(server, sdk, centraliUrl, workspaceId, curr
             return { content: [{ type: "text", text: JSON.stringify(result.data, null, 2) }] };
         }
         catch (error) {
-            return { content: [{ type: "text", text: formatError(error, "listing permissions") }], isError: true };
+            return { content: [{ type: "text", text: (0, _register_js_1.formatError)(error, "listing permissions") }], isError: true };
         }
     }));
-    server.tool("create_permission", "Create a new permission definition. Permissions bind actions to a resource within a policy. Required fields: name, resourceId (UUID from list_resources), actions (string array), policyId (UUID from list_policies or create_policy).", {
+    (0, _register_js_1.registerTool)(server, "create_permission", "Create a new permission definition. Permissions bind actions to a resource within a policy. Required fields: name, resourceId (UUID from list_resources), actions (string array), policyId (UUID from list_policies or create_policy).", {
         permission: zod_1.z.record(zod_1.z.string(), zod_1.z.any()).describe("Required: { name: string, resourceId: UUID, actions: string[], policyId: UUID }. Optional: description, priority (number)."),
     }, (_a) => __awaiter(this, [_a], void 0, function* ({ permission }) {
         try {
@@ -963,10 +948,10 @@ function registerServiceAccountTools(server, sdk, centraliUrl, workspaceId, curr
             return { content: [{ type: "text", text: JSON.stringify(result.data, null, 2) }] };
         }
         catch (error) {
-            return { content: [{ type: "text", text: formatError(error, "creating permission") }], isError: true };
+            return { content: [{ type: "text", text: (0, _register_js_1.formatError)(error, "creating permission") }], isError: true };
         }
     }));
-    server.tool("delete_permission", "Delete a permission definition by ID.", {
+    (0, _register_js_1.registerTool)(server, "delete_permission", "Delete a permission definition by ID.", {
         permissionId: zod_1.z.string().describe("The permission ID to delete"),
     }, (_a) => __awaiter(this, [_a], void 0, function* ({ permissionId }) {
         try {
@@ -974,11 +959,11 @@ function registerServiceAccountTools(server, sdk, centraliUrl, workspaceId, curr
             return { content: [{ type: "text", text: `Permission '${permissionId}' deleted.` }] };
         }
         catch (error) {
-            return { content: [{ type: "text", text: formatError(error, `deleting permission '${permissionId}'`) }], isError: true };
+            return { content: [{ type: "text", text: (0, _register_js_1.formatError)(error, `deleting permission '${permissionId}'`) }], isError: true };
         }
     }));
     // ── Resources ──────────────────────────────────────────────────────
-    server.tool("list_resources", "List all protected resource definitions in the workspace. Resources are the things permissions act on (e.g., 'workspace::records', 'workspace::functions').", {
+    (0, _register_js_1.registerTool)(server, "list_resources", "List all protected resource definitions in the workspace. Resources are the things permissions act on (e.g., 'workspace::records', 'workspace::functions').", {
         page: zod_1.z.number().optional().describe("Page number (default: 1)"),
         pageSize: zod_1.z.number().optional().describe("Results per page (default: 20)"),
     }, (_a) => __awaiter(this, [_a], void 0, function* ({ page, pageSize }) {
@@ -992,10 +977,10 @@ function registerServiceAccountTools(server, sdk, centraliUrl, workspaceId, curr
             return { content: [{ type: "text", text: JSON.stringify(result.data, null, 2) }] };
         }
         catch (error) {
-            return { content: [{ type: "text", text: formatError(error, "listing resources") }], isError: true };
+            return { content: [{ type: "text", text: (0, _register_js_1.formatError)(error, "listing resources") }], isError: true };
         }
     }));
-    server.tool("get_resource", "Get details of a protected resource definition by ID.", {
+    (0, _register_js_1.registerTool)(server, "get_resource", "Get details of a protected resource definition by ID.", {
         resourceId: zod_1.z.string().describe("The resource ID"),
     }, (_a) => __awaiter(this, [_a], void 0, function* ({ resourceId }) {
         try {
@@ -1003,7 +988,7 @@ function registerServiceAccountTools(server, sdk, centraliUrl, workspaceId, curr
             return { content: [{ type: "text", text: JSON.stringify(result.data, null, 2) }] };
         }
         catch (error) {
-            return { content: [{ type: "text", text: formatError(error, `getting resource '${resourceId}'`) }], isError: true };
+            return { content: [{ type: "text", text: (0, _register_js_1.formatError)(error, `getting resource '${resourceId}'`) }], isError: true };
         }
     }));
 }