@transcend-io/mcp-server-consent 0.8.4 → 0.9.0

package/dist/scopes-UQvBqSH8.mjs

@@ -1,1287 +0,0 @@
-import { EmptySchema, OffsetPaginationSchema, createListResult, createToolResult, defineTool, z } from "@transcend-io/mcp-server-base";
-import { AirgapBundleAnalyticsBinInterval, AirgapBundleAnalyticsDimension, AirgapBundleAnalyticsMetric, ConsentManagerAnalyticsDataSource, ConsentManagerMetricBin, ConsentTrackerStatus, ConsentTrackerType, CookieOrderField, DataFlowOrderField, DataFlowScope, OrderDirection, ScopeName, TriageAction } from "@transcend-io/privacy-types";
-import { AIRGAP_BUNDLE_AGGREGATE_ANALYTICS, AIRGAP_BUNDLE_TIMESERIES_ANALYTICS, CONSENT_MANAGER_ANALYTICS_DATA, COOKIES, COOKIE_STATS, DATA_FLOWS, EXPERIENCES, FETCH_CONSENT_MANAGER, FETCH_CONSENT_MANAGER_ID, PURPOSES, UPDATE_DATA_FLOWS, UPDATE_OR_CREATE_COOKIES } from "@transcend-io/sdk";
-//#region src/resolveAirgapBundleId.ts
-const bundleIdCache = /* @__PURE__ */ new WeakMap();
-/**
-* Lazily resolve the airgap bundle ID from the API key.
-* Caches the result per GraphQL client instance so subsequent
-* calls return instantly without an extra network request.
-*/
-async function resolveAirgapBundleId(graphql) {
-	const cached = bundleIdCache.get(graphql);
-	if (cached) return cached;
-	const id = (await graphql.makeRequest(FETCH_CONSENT_MANAGER_ID, {})).consentManager.consentManager.id;
-	bundleIdCache.set(graphql, id);
-	return id;
-}
-//#endregion
-//#region src/tools/consent_bulk_triage.ts
-const BulkTriageItemSchema = z.object({
-	type: z.nativeEnum(ConsentTrackerType).describe("Item type"),
-	id: z.string().describe("Item ID (for data flows) or cookie name (for cookies)"),
-	action: z.nativeEnum(TriageAction).describe("Action to take: APPROVE or JUNK"),
-	trackingPurposes: z.array(z.string()).optional().describe("Tracking purposes to assign (required when approving)"),
-	service: z.string().optional().describe("Service name to assign")
-});
-const BulkTriageSchema = z.object({ items: z.array(BulkTriageItemSchema).min(1).describe("Items to triage") });
-function createConsentBulkTriageTool(clients) {
-	return defineTool({
-		name: "consent_bulk_triage",
-		description: "Bulk triage action: approve or junk multiple cookies and data flows in a single call. For cookies, APPROVE sets status=LIVE; JUNK sets isJunk=true. For data flows, same behavior. Optionally assign tracking purposes and service when approving.",
-		category: "Consent Management",
-		readOnly: false,
-		annotations: {
-			readOnlyHint: false,
-			destructiveHint: true,
-			idempotentHint: false
-		},
-		zodSchema: BulkTriageSchema,
-		handler: async ({ items }) => {
-			const airgapBundleId = await resolveAirgapBundleId(clients.graphql);
-			const cookieItems = items.filter((i) => i.type === "cookie");
-			const dfItems = items.filter((i) => i.type === "data_flow");
-			const results = {
-				cookies: [],
-				dataFlows: []
-			};
-			if (cookieItems.length > 0) {
-				const cookieInputs = cookieItems.map((item) => ({
-					name: item.id,
-					...item.action === "APPROVE" ? {
-						status: ConsentTrackerStatus.Live,
-						isJunk: false
-					} : {
-						status: ConsentTrackerStatus.Live,
-						isJunk: true
-					},
-					...item.trackingPurposes ? { trackingPurposes: item.trackingPurposes } : {},
-					...item.service ? { service: item.service } : {}
-				}));
-				await clients.graphql.makeRequest(UPDATE_OR_CREATE_COOKIES, {
-					airgapBundleId,
-					cookies: cookieInputs
-				});
-				results.cookies = cookieInputs.map((c) => ({
-					name: c.name,
-					action: c.isJunk ? "JUNKED" : "APPROVED",
-					status: c.status || "LIVE"
-				}));
-			}
-			if (dfItems.length > 0) {
-				const dfInputs = dfItems.map((item) => ({
-					id: item.id,
-					...item.action === "APPROVE" ? {
-						status: ConsentTrackerStatus.Live,
-						isJunk: false
-					} : {
-						status: ConsentTrackerStatus.Live,
-						isJunk: true
-					},
-					...item.trackingPurposes ? { purposeIds: item.trackingPurposes } : {},
-					...item.service ? { service: item.service } : {}
-				}));
-				results.dataFlows = (await clients.graphql.makeRequest(UPDATE_DATA_FLOWS, {
-					airgapBundleId,
-					dataFlows: dfInputs
-				})).updateDataFlows.dataFlows.map((df) => ({
-					id: df.id,
-					action: df.isJunk ? "JUNKED" : "APPROVED",
-					status: df.status
-				}));
-			}
-			return createToolResult(true, {
-				totalProcessed: cookieItems.length + dfItems.length,
-				...results
-			});
-		}
-	});
-}
-//#endregion
-//#region src/analyticsDateRange.ts
-/**
-* Resolve a date range from explicit ISO timestamps or a lookback window.
-*/
-function resolveAnalyticsDateRange(args) {
-	const endDate = args.end ? new Date(args.end) : /* @__PURE__ */ new Date();
-	const lookbackDays = args.days ?? 7;
-	const startDate = args.start ? new Date(args.start) : /* @__PURE__ */ new Date(endDate.getTime() - lookbackDays * 24 * 60 * 60 * 1e3);
-	if (Number.isNaN(startDate.getTime()) || Number.isNaN(endDate.getTime())) throw new Error("Invalid start or end date");
-	if (startDate > endDate) throw new Error("Start date must be before end date");
-	return {
-		startEpoch: Math.floor(startDate.getTime() / 1e3),
-		endEpoch: Math.floor(endDate.getTime() / 1e3),
-		startIso: startDate.toISOString(),
-		endIso: endDate.toISOString()
-	};
-}
-//#endregion
-//#region src/normalizeAnalyticsMetric.ts
-const VALID_METRICS = new Set(Object.values(AirgapBundleAnalyticsMetric));
-/** Common agent/API guesses mapped to GraphQL AnalyticsEvent values */
-const ANALYTICS_METRIC_ALIASES = {
-	PAGE_VIEW: AirgapBundleAnalyticsMetric.PageViews,
-	CONSENT_SESSION: AirgapBundleAnalyticsMetric.SiteSessions,
-	CONSENT_SESSIONS: AirgapBundleAnalyticsMetric.SiteSessions
-};
-/**
-* Normalize metric input, accepting common aliases (e.g. PAGE_VIEW → PAGE_VIEWS).
-*/
-function normalizeAnalyticsMetric(metric) {
-	const upper = metric.toUpperCase();
-	if (VALID_METRICS.has(upper)) return upper;
-	return ANALYTICS_METRIC_ALIASES[upper] ?? upper;
-}
-const airgapBundleAnalyticsMetricSchema = z.preprocess((value) => typeof value === "string" ? normalizeAnalyticsMetric(value) : value, z.nativeEnum(AirgapBundleAnalyticsMetric));
-//#endregion
-//#region src/tools/consent_get_aggregate_analytics.ts
-const GetAggregateAnalyticsSchema = z.object({
-	metric: airgapBundleAnalyticsMetricSchema.describe("Analytics metric to query. CONSENT_CHANGED for opt-in/out counts; SITE_SESSIONS or PAGE_VIEWS for traffic totals."),
-	start: z.string().optional().describe("Start datetime (ISO 8601). Defaults to `days` lookback from end."),
-	end: z.string().optional().describe("End datetime (ISO 8601). Defaults to now."),
-	days: z.coerce.number().min(1).max(365).optional().describe("Lookback window in days when start is omitted (default: 7)."),
-	include_dimensions: z.array(z.nativeEnum(AirgapBundleAnalyticsDimension)).optional().describe("Dimension breakdowns (e.g. NEW_VALUE, REGIME, PURPOSE). Recommended for CONSENT_CHANGED.")
-});
-function createConsentGetAggregateAnalyticsTool(clients) {
-	return defineTool({
-		name: "consent_get_aggregate_analytics",
-		description: "Query aggregate consent analytics via airgapBundleAggregateAnalytics. Use CONSENT_CHANGED with NEW_VALUE/REGIME/PURPOSE for opt-in/out counts; SITE_SESSIONS or PAGE_VIEWS for total traffic. Requires ViewConsentManager API key scope.",
-		category: "Consent Management",
-		readOnly: true,
-		annotations: {
-			readOnlyHint: true,
-			destructiveHint: false,
-			idempotentHint: true
-		},
-		zodSchema: GetAggregateAnalyticsSchema,
-		handler: async ({ metric, start, end, days, include_dimensions }) => {
-			const airgapBundleId = await resolveAirgapBundleId(clients.graphql);
-			const range = resolveAnalyticsDateRange({
-				start,
-				end,
-				days
-			});
-			const items = (await clients.graphql.makeRequest(AIRGAP_BUNDLE_AGGREGATE_ANALYTICS, {
-				id: airgapBundleId,
-				input: {
-					metric,
-					start: range.startEpoch,
-					end: range.endEpoch,
-					...include_dimensions?.length ? { includeDimensions: include_dimensions } : {}
-				}
-			})).airgapBundleAggregateAnalytics.items;
-			return createToolResult(true, {
-				airgapBundleId,
-				metric,
-				period: {
-					start: range.startIso,
-					end: range.endIso,
-					startEpoch: range.startEpoch,
-					endEpoch: range.endEpoch
-				},
-				items,
-				totalRows: items.length
-			});
-		}
-	});
-}
-//#endregion
-//#region src/tools/consent_get_analytics_data.ts
-const GetAnalyticsDataSchema = z.object({
-	data_source: z.nativeEnum(ConsentManagerAnalyticsDataSource).describe("analyticsData source: PRIVACY_SIGNAL_TIMESERIES (DNT/GPC), CONSENT_CHANGES_TIMESERIES (opt-in/out), or CONSENT_SESSIONS_BY_REGIME."),
-	start: z.string().optional().describe("Start datetime (ISO 8601). Defaults to `days` lookback from end."),
-	end: z.string().optional().describe("End datetime (ISO 8601). Defaults to now."),
-	days: z.coerce.number().min(1).max(365).optional().describe("Lookback window in days when start is omitted (default: 7)."),
-	bin: z.nativeEnum(ConsentManagerMetricBin).optional().default(ConsentManagerMetricBin.Daily).describe("Time bin size for analyticsData (1h or 1d, default: 1d).")
-});
-function createConsentGetAnalyticsDataTool(clients) {
-	return defineTool({
-		name: "consent_get_analytics_data",
-		description: "Query consent metrics via the analyticsData GraphQL query. Returns timeseries for privacy signals (DNT/GPC), consent changes (opt-in/out), or sessions by regime. Requires ViewConsentManager API key scope.",
-		category: "Consent Management",
-		readOnly: true,
-		annotations: {
-			readOnlyHint: true,
-			destructiveHint: false,
-			idempotentHint: true
-		},
-		zodSchema: GetAnalyticsDataSchema,
-		handler: async ({ data_source, start, end, days, bin }) => {
-			const airgapBundleId = await resolveAirgapBundleId(clients.graphql);
-			const range = resolveAnalyticsDateRange({
-				start,
-				end,
-				days
-			});
-			const series = (await clients.graphql.makeRequest(CONSENT_MANAGER_ANALYTICS_DATA, { input: {
-				dataSource: data_source,
-				startDate: range.startIso,
-				endDate: range.endIso,
-				forceRefetch: true,
-				airgapBundleId,
-				binInterval: bin,
-				smoothTimeseries: false
-			} })).analyticsData.series;
-			return createToolResult(true, {
-				airgapBundleId,
-				dataSource: data_source,
-				binInterval: bin,
-				period: {
-					start: range.startIso,
-					end: range.endIso
-				},
-				series
-			});
-		}
-	});
-}
-//#endregion
-//#region src/getDataFlowCount.ts
-/**
-* Fetch `dataFlows.totalCount` without paging nodes.
-*
-* Uses `first: 1` so the payload stays small. The list API hides CSP rows
-* (same as the Consent Manager table), so these counts match what users see.
-*/
-async function getDataFlowCount(graphql, airgapBundleId, filterBy) {
-	return (await graphql.makeRequest(DATA_FLOWS, {
-		input: { airgapBundleId },
-		first: 1,
-		offset: 0,
-		filterBy
-	})).dataFlows.totalCount;
-}
-//#endregion
-//#region src/tools/consent_get_inventory_stats.ts
-const GetInventoryStatsSchema = z.object({});
-function createConsentGetInventoryStatsTool(clients) {
-	return defineTool({
-		name: "consent_get_inventory_stats",
-		description: "Get cookie and data-flow inventory triage counts: live (approved), needs review, and junk. Counts match the Consent Manager tables and the default consent_list_cookies / consent_list_data_flows filters (CSP data flows are omitted, same as the UI). This is inventory status, not consent analytics — use consent_get_aggregate_analytics or consent_get_timeseries_analytics for opt-in/out and signal metrics.",
-		category: "Consent Management",
-		readOnly: true,
-		annotations: {
-			readOnlyHint: true,
-			destructiveHint: false,
-			idempotentHint: true
-		},
-		zodSchema: GetInventoryStatsSchema,
-		handler: async () => {
-			const airgapBundleId = await resolveAirgapBundleId(clients.graphql);
-			const [cookieData, needReviewCount, liveCount, junkCount] = await Promise.all([
-				clients.graphql.makeRequest(COOKIE_STATS, { input: { airgapBundleId } }),
-				getDataFlowCount(clients.graphql, airgapBundleId, { status: ConsentTrackerStatus.NeedsReview }),
-				getDataFlowCount(clients.graphql, airgapBundleId, {
-					status: ConsentTrackerStatus.Live,
-					isJunk: false
-				}),
-				getDataFlowCount(clients.graphql, airgapBundleId, {
-					status: ConsentTrackerStatus.Live,
-					isJunk: true
-				})
-			]);
-			return createToolResult(true, {
-				cookies: cookieData.cookieStats,
-				dataFlows: {
-					liveCount,
-					needReviewCount,
-					junkCount
-				}
-			});
-		}
-	});
-}
-//#endregion
-//#region src/tools/consent_get_preferences.ts
-const GetPreferencesSchema = z.object({
-	identifier: z.string().describe("User identifier (e.g., email, user ID)"),
-	partition: z.string().optional().describe("Partition/organization context (optional)")
-});
-function createConsentGetPreferencesTool(clients) {
-	const { rest } = clients;
-	return defineTool({
-		name: "consent_get_preferences",
-		description: "Get consent preferences for a specific user/identifier",
-		category: "Consent Management",
-		readOnly: true,
-		annotations: {
-			readOnlyHint: true,
-			destructiveHint: false,
-			idempotentHint: true
-		},
-		requireSombra: true,
-		zodSchema: GetPreferencesSchema,
-		handler: async ({ identifier, partition }) => {
-			const result = await rest.getConsentPreferences(identifier, partition);
-			if (!result) return createToolResult(true, {
-				found: false,
-				message: "No consent preferences found for this identifier"
-			});
-			return createToolResult(true, {
-				found: true,
-				preferences: result
-			});
-		}
-	});
-}
-//#endregion
-//#region src/tools/consent_get_timeseries_analytics.ts
-const GetTimeseriesAnalyticsSchema = z.object({
-	metric: airgapBundleAnalyticsMetricSchema.describe("Analytics metric to query. PAGE_VIEWS for daily page-view volume; SITE_SESSIONS for sessions; SIGNAL_DETECTED for GPC/DNT signal counts over time."),
-	start: z.string().optional().describe("Start datetime (ISO 8601). Defaults to `days` lookback from end."),
-	end: z.string().optional().describe("End datetime (ISO 8601). Defaults to now."),
-	days: z.coerce.number().min(1).max(365).optional().describe("Lookback window in days when start is omitted (default: 7)."),
-	bin_interval: z.nativeEnum(AirgapBundleAnalyticsBinInterval).optional().default(AirgapBundleAnalyticsBinInterval.Hourly).describe("Time bin size: 1m, 1h, or 1d (default: 1h).")
-});
-function createConsentGetTimeseriesAnalyticsTool(clients) {
-	return defineTool({
-		name: "consent_get_timeseries_analytics",
-		description: "Query timeseries consent analytics via airgapBundleTimeseriesAnalytics. Use PAGE_VIEWS or SITE_SESSIONS for traffic volume; SIGNAL_DETECTED for privacy signal counts. Requires ViewConsentManager API key scope.",
-		category: "Consent Management",
-		readOnly: true,
-		annotations: {
-			readOnlyHint: true,
-			destructiveHint: false,
-			idempotentHint: true
-		},
-		zodSchema: GetTimeseriesAnalyticsSchema,
-		handler: async ({ metric, start, end, days, bin_interval }) => {
-			const airgapBundleId = await resolveAirgapBundleId(clients.graphql);
-			const range = resolveAnalyticsDateRange({
-				start,
-				end,
-				days
-			});
-			const items = (await clients.graphql.makeRequest(AIRGAP_BUNDLE_TIMESERIES_ANALYTICS, {
-				id: airgapBundleId,
-				input: {
-					metric,
-					start: range.startEpoch,
-					end: range.endEpoch,
-					binInterval: bin_interval
-				}
-			})).airgapBundleTimeseriesAnalytics.items;
-			return createToolResult(true, {
-				airgapBundleId,
-				metric,
-				binInterval: bin_interval,
-				period: {
-					start: range.startIso,
-					end: range.endIso,
-					startEpoch: range.startEpoch,
-					endEpoch: range.endEpoch
-				},
-				items,
-				totalRows: items.length
-			});
-		}
-	});
-}
-//#endregion
-//#region src/tools/consent_list_airgap_bundles.ts
-const ListAirgapBundlesSchema = EmptySchema;
-function createConsentListAirgapBundlesTool(clients) {
-	return defineTool({
-		name: "consent_list_airgap_bundles",
-		description: "Get the consent manager (airgap bundle) configured for your organization. Returns the bundle ID, URLs, configuration, and domains.",
-		category: "Consent Management",
-		readOnly: true,
-		annotations: {
-			readOnlyHint: true,
-			destructiveHint: false,
-			idempotentHint: true
-		},
-		zodSchema: ListAirgapBundlesSchema,
-		handler: async (_args) => {
-			return createToolResult(true, (await clients.graphql.makeRequest(FETCH_CONSENT_MANAGER, {})).consentManager.consentManager);
-		}
-	});
-}
-//#endregion
-//#region src/tools/consent_list_cookies.ts
-const ListCookiesSchema = OffsetPaginationSchema.extend({
-	status: z.nativeEnum(ConsentTrackerStatus).describe("Filter by status: NEEDS_REVIEW (triage) or LIVE (approved)"),
-	isJunk: z.boolean().optional().describe("Filter by junk status"),
-	showZeroActivity: z.boolean().optional().describe("Include items with zero activity. Omit (default) so the NEEDS_REVIEW total matches consent_get_inventory_stats cookies.needReviewCount; set true for the full triage backlog including never-active cookies."),
-	text: z.string().optional().describe("Search text filter"),
-	service: z.string().optional().describe("Filter by service name"),
-	minOccurrences: z.number().min(0).optional().describe("Only return cookies with at least this many occurrences (traffic)"),
-	orderField: z.nativeEnum(CookieOrderField).optional().describe("Field to sort by (e.g. occurrences to rank by traffic)"),
-	orderDirection: z.nativeEnum(OrderDirection).optional().describe("Sort direction: ASC or DESC")
-});
-function createConsentListCookiesTool(clients) {
-	return defineTool({
-		name: "consent_list_cookies",
-		description: "List cookies in your consent manager. Requires a status filter: NEEDS_REVIEW for triage backlog, LIVE for approved cookies. Returns name, service, tracking purposes, activity (occurrences), junk status, and more. Sort by occurrences (orderField=occurrences, orderDirection=DESC) to surface top-traffic cookies, and use minOccurrences to filter low-traffic noise.",
-		category: "Consent Management",
-		readOnly: true,
-		annotations: {
-			readOnlyHint: true,
-			destructiveHint: false,
-			idempotentHint: true
-		},
-		zodSchema: ListCookiesSchema,
-		handler: async ({ first, offset, status, isJunk, showZeroActivity, text, service, minOccurrences, orderField, orderDirection }) => {
-			const airgapBundleId = await resolveAirgapBundleId(clients.graphql);
-			const { nodes, totalCount } = (await clients.graphql.makeRequest(COOKIES, {
-				input: { airgapBundleId },
-				first,
-				offset,
-				filterBy: {
-					status,
-					...isJunk !== void 0 ? { isJunk } : {},
-					...showZeroActivity !== void 0 ? { showZeroActivity } : {},
-					...text ? { text } : {},
-					...service ? { service } : {},
-					...minOccurrences !== void 0 ? { minOccurrences } : {}
-				},
-				...orderField && orderDirection ? { orderBy: [{
-					field: orderField,
-					direction: orderDirection
-				}] } : {}
-			})).cookies;
-			return createListResult(nodes, {
-				totalCount,
-				hasNextPage: offset + nodes.length < totalCount
-			});
-		}
-	});
-}
-//#endregion
-//#region src/tools/consent_list_data_flows.ts
-const ListDataFlowsSchema = OffsetPaginationSchema.extend({
-	status: z.nativeEnum(ConsentTrackerStatus).describe("Filter by status: NEEDS_REVIEW (triage) or LIVE (approved)"),
-	isJunk: z.boolean().optional().describe("Filter by junk status"),
-	showZeroActivity: z.boolean().optional().describe("Include items with zero activity. Omit (default) so the NEEDS_REVIEW total matches consent_get_inventory_stats dataFlows.needReviewCount (the Consent Manager table). Set true for the full triage backlog including never-active flows."),
-	text: z.string().optional().describe("Search text filter"),
-	service: z.string().optional().describe("Filter by service name"),
-	unmappedOnly: z.boolean().optional().describe("Return only unmapped/orphaned flows with no associated service (catalog integration). Useful with status=LIVE to find approved flows that are not mapped to a service."),
-	type: z.nativeEnum(DataFlowScope).optional().describe("Filter by data flow scope type (e.g. HOST, PATH, REGEX, CSP)"),
-	minOccurrences: z.number().min(0).optional().describe("Only return flows with at least this many occurrences (traffic)"),
-	orderField: z.nativeEnum(DataFlowOrderField).optional().describe("Field to sort by"),
-	orderDirection: z.nativeEnum(OrderDirection).optional().describe("Sort direction: ASC or DESC")
-});
-function createConsentListDataFlowsTool(clients) {
-	return defineTool({
-		name: "consent_list_data_flows",
-		description: "List data flows (network requests) in your consent manager. Requires a status filter: NEEDS_REVIEW for triage backlog, LIVE for approved flows. Returns value (URL/host), service, tracking purposes, activity (occurrences), and more. Use unmappedOnly to find approved flows with no service, type to filter by scope (e.g. CSP), and minOccurrences to focus on high-traffic flows.",
-		category: "Consent Management",
-		readOnly: true,
-		annotations: {
-			readOnlyHint: true,
-			destructiveHint: false,
-			idempotentHint: true
-		},
-		zodSchema: ListDataFlowsSchema,
-		handler: async ({ first, offset, status, isJunk, showZeroActivity, text, service, unmappedOnly, type, minOccurrences, orderField, orderDirection }) => {
-			const airgapBundleId = await resolveAirgapBundleId(clients.graphql);
-			const { nodes, totalCount } = (await clients.graphql.makeRequest(DATA_FLOWS, {
-				input: { airgapBundleId },
-				first,
-				offset,
-				filterBy: {
-					status,
-					...isJunk !== void 0 ? { isJunk } : {},
-					...showZeroActivity !== void 0 ? { showZeroActivity } : {},
-					...text ? { text } : {},
-					...unmappedOnly ? { service: "" } : service ? { service } : {},
-					...type ? { type } : {},
-					...minOccurrences !== void 0 ? { minOccurrences } : {}
-				},
-				...orderField && orderDirection ? { orderBy: [{
-					field: orderField,
-					direction: orderDirection
-				}] } : {}
-			})).dataFlows;
-			return createListResult(nodes, {
-				totalCount,
-				hasNextPage: offset + nodes.length < totalCount
-			});
-		}
-	});
-}
-//#endregion
-//#region src/tools/consent_list_purposes.ts
-const ListPurposesSchema = z.object({ limit: z.coerce.number().min(1).max(100).optional().default(50).describe("Maximum number of purposes to return (1-100, default 50).") });
-function createConsentListPurposesTool(clients) {
-	return defineTool({
-		name: "consent_list_purposes",
-		description: "List all tracking purposes configured for consent management (max ~100 results).",
-		category: "Consent Management",
-		readOnly: true,
-		annotations: {
-			readOnlyHint: true,
-			destructiveHint: false,
-			idempotentHint: true
-		},
-		zodSchema: ListPurposesSchema,
-		handler: async ({ limit }) => {
-			const { nodes, totalCount } = (await clients.graphql.makeRequest(PURPOSES, { first: Math.min(limit, 100) })).purposes;
-			return createListResult(nodes, {
-				totalCount,
-				hasNextPage: nodes.length < totalCount
-			});
-		}
-	});
-}
-//#endregion
-//#region src/tools/consent_list_regimes.ts
-const ListRegimesSchema = z.object({
-	limit: z.coerce.number().min(1).max(100).optional().default(50).describe("Maximum number of regimes to return per page (1-100, default 50)."),
-	offset: z.coerce.number().min(0).optional().default(0).describe("Number of results to skip for pagination (default 0).")
-});
-function createConsentListRegimesTool(clients) {
-	return defineTool({
-		name: "consent_list_regimes",
-		description: "List all consent experiences (regional regimes) configured for your organization. Returns experience name, regions, purposes, opted-out purposes, and view state.",
-		category: "Consent Management",
-		readOnly: true,
-		annotations: {
-			readOnlyHint: true,
-			destructiveHint: false,
-			idempotentHint: true
-		},
-		zodSchema: ListRegimesSchema,
-		handler: async ({ limit, offset }) => {
-			const { totalCount, nodes } = (await clients.graphql.makeRequest(EXPERIENCES, {
-				first: limit,
-				offset
-			})).experiences;
-			return createListResult(nodes, {
-				totalCount,
-				hasNextPage: offset + nodes.length < totalCount
-			});
-		}
-	});
-}
-//#endregion
-//#region src/tools/consent_set_preferences.ts
-const PurposeConsentSchema = z.object({
-	purpose: z.string().describe("Purpose slug"),
-	enabled: z.boolean().describe("Whether consent is granted")
-});
-const SetPreferencesSchema = z.object({
-	identifier: z.string().optional().describe("User identifier"),
-	partition: z.string().describe("Partition/organization context"),
-	purposes: z.array(PurposeConsentSchema).describe("Array of purpose consent settings"),
-	confirmed: z.boolean().optional().describe("Whether consent was explicitly confirmed")
-});
-function createConsentSetPreferencesTool(clients) {
-	const { rest } = clients;
-	return defineTool({
-		name: "consent_set_preferences",
-		description: "Set consent preferences for a user (client-side sync)",
-		category: "Consent Management",
-		readOnly: false,
-		annotations: {
-			readOnlyHint: false,
-			destructiveHint: false,
-			idempotentHint: true
-		},
-		requireSombra: true,
-		zodSchema: SetPreferencesSchema,
-		handler: async ({ partition, identifier, purposes, confirmed }) => {
-			return createToolResult(true, {
-				...await rest.syncConsent({
-					partition,
-					identifier,
-					purposes: purposes.map((p) => ({
-						purpose: p.purpose,
-						enabled: p.enabled
-					})),
-					confirmed
-				}),
-				message: "Consent preferences synced successfully"
-			});
-		}
-	});
-}
-//#endregion
-//#region src/tools/consent_update_cookies.ts
-const UpdateCookieItemSchema = z.object({
-	name: z.string().describe("Cookie name (used as the identifier for upsert)"),
-	trackingPurposes: z.array(z.string()).optional().describe("Tracking purpose slugs (e.g., \"Advertising\", \"Analytics\")"),
-	description: z.string().optional().describe("Cookie description"),
-	service: z.string().optional().describe("Service/integration name"),
-	isJunk: z.boolean().optional().describe("Mark as junk"),
-	status: z.nativeEnum(ConsentTrackerStatus).optional().describe("Set status to LIVE (approve) or NEEDS_REVIEW")
-});
-const UpdateCookiesSchema = z.object({ cookies: z.array(UpdateCookieItemSchema).min(1).describe("Cookies to update") });
-function createConsentUpdateCookiesTool(clients) {
-	return defineTool({
-		name: "consent_update_cookies",
-		description: "Update one or more cookies. Use to approve (status=LIVE), junk (isJunk=true), assign tracking purposes, or set a service. The cookie \"name\" field is the identifier for upsert — existing cookies with matching names will be updated.",
-		category: "Consent Management",
-		readOnly: false,
-		annotations: {
-			readOnlyHint: false,
-			destructiveHint: true,
-			idempotentHint: true
-		},
-		zodSchema: UpdateCookiesSchema,
-		handler: async ({ cookies }) => {
-			const airgapBundleId = await resolveAirgapBundleId(clients.graphql);
-			const cookieInputs = cookies.map((c) => ({
-				name: c.name,
-				...c.trackingPurposes ? { trackingPurposes: c.trackingPurposes } : {},
-				...c.description !== void 0 ? { description: c.description } : {},
-				...c.service !== void 0 ? { service: c.service } : {},
-				...c.isJunk !== void 0 ? { isJunk: c.isJunk } : {},
-				...c.status !== void 0 ? { status: c.status } : {}
-			}));
-			await clients.graphql.makeRequest(UPDATE_OR_CREATE_COOKIES, {
-				airgapBundleId,
-				cookies: cookieInputs
-			});
-			return createToolResult(true, {
-				updated: cookieInputs.length,
-				cookies: cookieInputs.map((c) => ({
-					name: c.name,
-					status: c.status,
-					isJunk: c.isJunk,
-					trackingPurposes: c.trackingPurposes,
-					service: c.service
-				}))
-			});
-		}
-	});
-}
-//#endregion
-//#region src/tools/consent_update_data_flows.ts
-const UpdateDataFlowItemSchema = z.object({
-	id: z.string().describe("Data flow ID"),
-	trackingPurposes: z.array(z.string()).optional().describe("Tracking purpose slugs"),
-	description: z.string().optional().describe("Data flow description"),
-	service: z.string().optional().describe("Service/integration name"),
-	isJunk: z.boolean().optional().describe("Mark as junk"),
-	status: z.nativeEnum(ConsentTrackerStatus).optional().describe("Set status to LIVE (approve) or NEEDS_REVIEW")
-});
-const UpdateDataFlowsSchema = z.object({ dataFlows: z.array(UpdateDataFlowItemSchema).min(1).describe("Data flows to update") });
-function createConsentUpdateDataFlowsTool(clients) {
-	return defineTool({
-		name: "consent_update_data_flows",
-		description: "Update one or more data flows. Use to approve (status=LIVE), junk (isJunk=true), assign tracking purposes, or set a service.",
-		category: "Consent Management",
-		readOnly: false,
-		annotations: {
-			readOnlyHint: false,
-			destructiveHint: true,
-			idempotentHint: true
-		},
-		zodSchema: UpdateDataFlowsSchema,
-		handler: async ({ dataFlows }) => {
-			const airgapBundleId = await resolveAirgapBundleId(clients.graphql);
-			const dfInputs = dataFlows.map((df) => ({
-				id: df.id,
-				...df.trackingPurposes ? { purposeIds: df.trackingPurposes } : {},
-				...df.description !== void 0 ? { description: df.description } : {},
-				...df.service !== void 0 ? { service: df.service } : {},
-				...df.isJunk !== void 0 ? { isJunk: df.isJunk } : {},
-				...df.status !== void 0 ? { status: df.status } : {}
-			}));
-			const data = await clients.graphql.makeRequest(UPDATE_DATA_FLOWS, {
-				airgapBundleId,
-				dataFlows: dfInputs
-			});
-			return createToolResult(true, {
-				updated: data.updateDataFlows.dataFlows.length,
-				dataFlows: data.updateDataFlows.dataFlows.map((df) => ({
-					id: df.id,
-					value: df.value,
-					status: df.status,
-					isJunk: df.isJunk,
-					purposes: df.purposes.map((p) => p.name),
-					service: df.service?.title
-				}))
-			});
-		}
-	});
-}
-//#endregion
-//#region src/tools/index.ts
-function getConsentTools(clients) {
-	return [
-		createConsentGetPreferencesTool(clients),
-		createConsentSetPreferencesTool(clients),
-		createConsentListPurposesTool(clients),
-		createConsentListDataFlowsTool(clients),
-		createConsentListCookiesTool(clients),
-		createConsentListAirgapBundlesTool(clients),
-		createConsentListRegimesTool(clients),
-		createConsentGetInventoryStatsTool(clients),
-		createConsentGetAggregateAnalyticsTool(clients),
-		createConsentGetTimeseriesAnalyticsTool(clients),
-		createConsentGetAnalyticsDataTool(clients),
-		createConsentUpdateCookiesTool(clients),
-		createConsentUpdateDataFlowsTool(clients),
-		createConsentBulkTriageTool(clients)
-	];
-}
-//#endregion
-//#region src/prompts/consent_inspect_site.ts
-const consentInspectSitePrompt = {
-	name: "consent-inspect-site",
-	description: "Live site investigation methodology for consent triage using browser DevTools. Covers regime overrides, consent verification, performance entries, HTML search, ad infrastructure checks, and airgap classification queries.",
-	arguments: [
-		{
-			name: "site_url",
-			description: "The site to investigate (e.g. \"https://example.com\")",
-			required: true
-		},
-		{
-			name: "tracker_domains",
-			description: "Comma-separated tracker domains to look for (e.g. \"doubleclick.net,google-analytics.com\")",
-			required: true
-		},
-		{
-			name: "regime",
-			description: "The most permissive regime name for URL override (e.g. \"us\"). Choose the regime with fewest opted-out purposes so trackers fire.",
-			required: false
-		}
-	],
-	handler: (args) => {
-		const siteUrl = args.site_url || "(not specified)";
-		const trackerDomains = args.tracker_domains || "(not specified)";
-		const regime = args.regime || "us";
-		const domainList = trackerDomains.split(",").map((d) => d.trim()).filter(Boolean);
-		const domainArrayLiteral = JSON.stringify(domainList);
-		return [{
-			role: "user",
-			content: {
-				type: "text",
-				text: `Investigate how these trackers load on ${siteUrl}: ${trackerDomains}. Use regime "${regime}" for debug overrides.`
-			}
-		}, {
-			role: "assistant",
-			content: {
-				type: "text",
-				text: `## Live Site Investigation
-
-### Important: Platform vs Client Sites
-
-The bundle name (e.g. "acme-platform") may be a platform provider, not the actual
-site with trackers. If the main domain is a corporate page without ad trackers, find a
-real client site from links on the homepage and use that instead.
-
-### Step 1: Navigate with Debug Overrides
-
-Load the page with hash parameters to control consent behavior:
-
-\`\`\`
-${siteUrl}/#tcm-regime=${regime}&tcm-prompt=Hidden&log=*
-\`\`\`
-
-| Parameter | Purpose |
-|-----------|---------|
-| \`tcm-regime=${regime}\` | Force the most permissive privacy regime |
-| \`tcm-prompt=Hidden\` | Suppress the consent banner |
-| \`log=*\` | Enable verbose airgap debug logging |
-
-When \`docs_list\` / \`docs_fetch\` are available, fetch the debugging article for full detail; otherwise open:
-https://docs.transcend.io/docs/articles/consent-management/reference/debugging-and-testing
-
-### Step 2: Verify Consent State
-
-\`\`\`javascript
-(() => {
-  if (!window.airgap) return 'airgap not loaded';
-  return JSON.stringify({
-    regimes: airgap.getRegimes(),
-    purposes: airgap.getConsent().purposes,
-    regimePurposes: airgap.getRegimePurposes(),
-  }, null, 2);
-})()
-\`\`\`
-
-All purposes should be \`true\` or \`"Auto"\`. If not, opt in manually:
-
-\`\`\`javascript
-(() => {
-  airgap.optIn(Object.fromEntries(
-    airgap.getRegimePurposes().map(p => [p, true])
-  ));
-  return JSON.stringify(airgap.getConsent().purposes);
-})()
-\`\`\`
-
-### Step 3: Check Performance Entries for Tracker Domains
-
-\`\`\`javascript
-(() => {
-  const domains = ${domainArrayLiteral};
-  const entries = performance.getEntriesByType('resource');
-  const results = {};
-  for (const d of domains) {
-    results[d] = entries.filter(e => e.name.includes(d)).map(e => ({
-      url: e.name,
-      initiator: e.initiatorType,
-      duration: Math.round(e.duration),
-      size: e.transferSize,
-    }));
-  }
-  return JSON.stringify(results, null, 2);
-})()
-\`\`\`
-
-### Step 4: Search Page HTML
-
-\`\`\`javascript
-(() => {
-  const terms = ${domainArrayLiteral};
-  const html = document.documentElement.outerHTML;
-  const results = {};
-  for (const term of terms) {
-    const matches = [];
-    let i = 0;
-    while ((i = html.indexOf(term, i)) !== -1) {
-      matches.push(html.substring(Math.max(0, i - 100), Math.min(html.length, i + 100)));
-      i += term.length;
-      if (matches.length > 3) break;
-    }
-    results[term] = { count: matches.length, samples: matches };
-  }
-  return JSON.stringify(results, null, 2);
-})()
-\`\`\`
-
-### Step 5: Identify Ad Infrastructure
-
-\`\`\`javascript
-(() => {
-  const scripts = Array.from(document.querySelectorAll('script[src]')).map(s => s.src);
-  // Non-exhaustive list of common ad tech scripts; look for any third-party ad scripts beyond these
-  const adScripts = scripts.filter(s =>
-    s.includes('prebid') || s.includes('gpt.js') || s.includes('googletag') ||
-    s.includes('taboola') || s.includes('criteo') || s.includes('amazon-adsystem') ||
-    s.includes('adsbygoogle') || s.includes('doubleclick')
-  );
-  const adDivs = Array.from(document.querySelectorAll(
-    '[data-prebid], [data-ad], [data-ad-slot], [data-ad-unit], [id*="ad-slot"], [id*="ad-unit"], [class*="ad-container"]'
-  ));
-  const adSlots = adDivs.map(d => ({
-    tag: d.tagName, id: d.id, class: d.className?.substring(0, 60),
-    dataSizes: d.getAttribute('data-sizes'),
-    dataPrebid: d.getAttribute('data-prebid'),
-    dataTargeting: d.getAttribute('data-targeting'),
-  }));
-  const iframes = Array.from(document.querySelectorAll('iframe'));
-  const adIframes = iframes.filter(f => f.title?.includes('ad') || f.id?.includes('ad'));
-  return JSON.stringify({
-    adScripts,
-    adSlotCount: adSlots.length,
-    adSlotSamples: adSlots.slice(0, 5),
-    adIframes: adIframes.map(f => ({
-      id: f.id, src: f.src?.substring(0, 150), title: f.title,
-    })),
-  }, null, 2);
-})()
-\`\`\`
-
-### Step 6: Check Inline Initialization Scripts
-
-\`\`\`javascript
-(() => {
-  const scripts = Array.from(document.querySelectorAll('script:not([src])'));
-  const adInline = scripts.filter(s =>
-    s.textContent.includes('prebid') || s.textContent.includes('googletag') ||
-    s.textContent.includes('adsbygoogle') || s.textContent.includes('criteo') ||
-    s.textContent.includes('taboola')
-  );
-  return JSON.stringify(adInline.map(s => ({
-    parent: s.parentElement?.tagName,
-    preview: s.textContent.substring(0, 500),
-  })), null, 2);
-})()
-\`\`\`
-
-### Step 7: Check Window Globals and Ad Config
-
-\`\`\`javascript
-(() => {
-  const knownAdGlobals = ['pbjs', 'googletag', '__tcfapi', '__gpp', '__cmp',
-    'adsbygoogle', '_taboola', 'criteo_q', 'apstag'];
-  const adGlobals = Object.keys(window).filter(k =>
-    knownAdGlobals.some(g => k.toLowerCase().includes(g.toLowerCase()))
-  );
-  const configs = {};
-  for (const g of adGlobals) {
-    try {
-      const val = window[g];
-      if (val && typeof val === 'object') {
-        configs[g] = JSON.stringify(val).substring(0, 500);
-      }
-    } catch {}
-  }
-  return JSON.stringify({ adGlobals, configs }, null, 2);
-})()
-\`\`\`
-
-### Step 8: Check Airgap Classification Per Tracker
-
-\`\`\`javascript
-(async () => {
-  if (!window.airgap) return 'airgap not loaded';
-  const domains = ${domainArrayLiteral};
-  const results = {};
-  for (const d of domains) {
-    try {
-      const purposes = await airgap.getPurposes('https://' + d + '/');
-      const allowed = await airgap.isAllowed('https://' + d + '/');
-      results[d] = { purposes, allowed };
-    } catch (e) { results[d] = { error: e.message }; }
-  }
-  return JSON.stringify(results, null, 2);
-})()
-\`\`\`
-
-### Step 9: Read Console Logs
-
-Read the browser console output. The \`log=*\` override makes airgap emit detailed
-allow/block decisions for every request, including purpose lookups. Search these logs
-for each tracker domain to see how airgap classifies and handles it.
-
-## Useful Console Commands Reference
-
-| Command | Purpose |
-|---------|---------|
-| \`airgap.getConsent().purposes\` | Current consent state per purpose |
-| \`airgap.getRegimes()\` | Active regime(s) for this session |
-| \`airgap.getRegimePurposes()\` | Purposes regulated under current regime |
-| \`await airgap.getPurposes('{url}')\` | What purposes a URL is classified under |
-| \`await airgap.isAllowed('{url}')\` | Whether a URL is currently allowed |
-| \`await airgap.isCookieAllowed({name:'{name}'})\` | Whether a cookie is allowed |
-| \`await airgap.getCookiePurposes({name:'{name}'})\` | Cookie's assigned purposes |
-| \`airgap.export().requests\` | Quarantined requests |
-| \`airgap.export().cookies\` | Quarantined cookies |
-| \`airgap.version\` | Current airgap version |
-
-## Output Format
-
-For each tracker return:
-
-\`\`\`json
-{
-  "domain": "<domain>",
-  "found_on_page": true,
-  "loading_method": "direct_script|tag_manager|iframe|dynamic|not_found",
-  "loaded_by": "<what script or mechanism loads it>",
-  "in_main_document": true,
-  "airgap_purposes": ["Advertising"],
-  "airgap_allowed": true,
-  "ad_infrastructure": "<detected ad chain, e.g. Prebid -> GPT>",
-  "related_config": "<relevant config values>",
-  "notes": "<additional observations>"
-}
-\`\`\`
-
-Also return a site summary:
-
-\`\`\`json
-{
-  "site_investigated": "<actual URL used>",
-  "ad_stack": "<detected stack, e.g. Prebid -> Google Publisher Tags>",
-  "consent_manager": "Transcend CMP",
-  "total_ad_slots": "<count>",
-  "total_scripts": "<count>",
-  "total_iframes": "<count>"
-}
-\`\`\``
-			}
-		}];
-	}
-};
-//#endregion
-//#region src/prompts/consent_research_tracker.ts
-const consentResearchTrackerPrompt = {
-	name: "consent-research-tracker",
-	description: "Research methodology for classifying cookies and data flows. Covers company identification, privacy policy lookup, CMP database checks, and structured evidence gathering for consent purpose assignment.",
-	arguments: [
-		{
-			name: "domain",
-			description: "The tracker domain or cookie name to research (e.g. \"doubleclick.net\", \"_ga\")",
-			required: true
-		},
-		{
-			name: "type",
-			description: "Whether this is a \"cookie\" or \"data_flow\" (default: \"data_flow\")",
-			required: false
-		},
-		{
-			name: "available_purposes",
-			description: "Comma-separated list of the customer's configured purposes (e.g. \"Essential,Functional,Analytics,Advertising,SaleOfInfo\"). Only recommend purposes from this list.",
-			required: false
-		}
-	],
-	handler: (args) => {
-		const domain = args.domain || "(not specified)";
-		return [{
-			role: "user",
-			content: {
-				type: "text",
-				text: `Research the ${args.type || "data_flow"} "${domain}" to determine its consent classification. Available purposes: ${args.available_purposes || "(fetch from consent_list_purposes)"}`
-			}
-		}, {
-			role: "assistant",
-			content: {
-				type: "text",
-				text: `## Research Methodology
-
-For each tracker or cookie, follow these steps in order:
-
-### Step 1: Company Identification
-
-Search the root domain (strip subdomains for broader matches) to find the operating company.
-Check for recent acquisitions or rebrands — ad tech companies frequently change ownership.
-
-### Step 2: First-Party Privacy Docs
-
-Find and read the company's privacy policy and/or cookie policy. Look for:
-- How they classify their own tracking
-- What data they collect
-- Stated purposes for data processing
-- Data retention periods
-
-### Step 3: Service Description
-
-Understand the business model:
-- Ad tech (DSP, SSP, ad exchange, header bidding)?
-- Analytics (pageview counters, session recording, A/B testing)?
-- CMP (consent management platform)?
-- CDN / performance (content delivery, image optimization)?
-- Functional (chat, support, preferences, authentication)?
-- Data broker (selling/sharing data with third parties)?
-
-### Step 4: CMP Database Lookups
-
-Search these databases for existing classifications:
-
-| Database | URL | Use For |
-|----------|-----|---------|
-| CookieDatabase.org | https://cookiedatabase.org/ | Cookie name lookup |
-| better.fyi trackers | https://better.fyi/trackers/ | Domain-to-company lookup |
-| Ghostery TrackerDB | https://www.ghostery.com/trackerdb | Tracker classification |
-| Cookiepedia | https://cookiepedia.co.uk/ | Cookie purpose database |
-| BuiltWith | https://builtwith.com/ | Site technology stack |
-| urlscan.io | https://urlscan.io/ | Domain/infrastructure analysis |
-
-### Step 5: Third-Party Cookie Policies
-
-Find other companies' published cookie policies that classify this same tracker/service.
-Multiple independent classifications strengthen confidence.
-
-### Step 6: Essential vs Non-Essential Determination
-
-Based on all evidence:
-- Would the site break without this tracker? (Essential)
-- Is it required for core functionality like auth, security, or the CMP itself? (Essential)
-- Does it enhance features without being required? (Functional)
-- Does it measure usage or behavior? (Analytics)
-- Does it serve, target, or retarget ads? (Advertising)
-- Is data sold or shared with third parties for their own use? (SaleOfInfo)
-
-Items can have multiple purposes (e.g. ["Advertising", "Analytics"] for an ad platform
-that also tracks impressions).
-
-IMPORTANT: Only recommend purposes from the customer's configured list. If research
-suggests a purpose that doesn't exist for this customer, flag it and suggest the closest
-available match.
-
-## Junk Indicators
-
-Mark as JUNK (not a real tracker to classify) if:
-- From a browser extension (Grammarly, LastPass, ad blockers injecting scripts)
-- Malware or unwanted injection not placed by the site operator
-- A development/testing artifact (localhost, staging URLs)
-- A subdomain variant of an already-approved regex rule
-
-## Confidence Levels
-
-- **High**: First-party docs confirm, OR multiple CMPs agree, OR well-known tracker
-- **Medium**: Some evidence but no definitive first-party documentation
-- **Low**: No docs found, best-guess only — flag for manual review
-
-## Output Format
-
-Return a structured finding for each item:
-
-\`\`\`json
-{
-  "domain": "<domain or cookie name>",
-  "company_name": "<identified company>",
-  "company_description": "<what the company does, 1-2 sentences>",
-  "service_url": "<company homepage>",
-  "specific_product": "<what product/feature this domain serves>",
-  "recommended_purposes": ["Advertising"],
-  "confidence": "High",
-  "is_junk": false,
-  "evidence_summary": "<2-3 sentence summary with key facts>",
-  "sources": ["<url1>", "<url2>"],
-  "suggested_description": "<one-line description to save as Transcend note>",
-  "first_party_privacy_url": "<URL of their privacy/cookie policy if found>",
-  "other_cmps_classify_as": "<what other CMPs say>"
-}
-\`\`\``
-			}
-		}];
-	}
-};
-//#endregion
-//#region src/prompts/consent_triage.ts
-const consentTriagePrompt = {
-	name: "consent-triage",
-	description: "Systematically triage cookies and data flows discovered by Transcend consent telemetry. Walks through setup, batch fetching, research, review, and classification push.",
-	arguments: [{
-		name: "triage_type",
-		description: "What to triage: \"cookies\", \"data_flows\", or \"both\" (default: \"both\")",
-		required: false
-	}, {
-		name: "batch_size",
-		description: "Number of items per batch (default: 10)",
-		required: false
-	}],
-	handler: (args) => {
-		const triageType = args.triage_type || "both";
-		const batchSize = args.batch_size || "10";
-		return [{
-			role: "user",
-			content: {
-				type: "text",
-				text: `Triage ${triageType === "both" ? "cookies and data flows" : triageType} in batches of ${batchSize}, sorted by highest traffic first.`
-			}
-		}, {
-			role: "assistant",
-			content: {
-				type: "text",
-				text: `I'll walk through the consent triage workflow. Here's how it works:
-
-## Phase 1: Setup
-
-Gather the customer's consent configuration by calling these tools in parallel:
-
-1. \`consent_list_airgap_bundles\` — get the consent manager info (bundle ID is auto-resolved)
-2. \`consent_get_inventory_stats\` — backlog overview
-3. \`consent_list_purposes\` — the customer's configured tracking purposes
-4. \`consent_list_regimes\` — consent experiences with regions, purposes, and opt-out defaults
-
-CRITICAL: Each customer configures their own purposes. Do NOT assume defaults exist. Only use purposes returned by \`consent_list_purposes\` for classification.
-
-From the regimes data, determine:
-- Which purposes can be opted out of per experience
-- Which purposes default to opted-out
-- The most permissive regime (fewest opted-out purposes) — needed for live site investigation
-
-Present the customer's setup:
-
-| Purpose | Slug | Used in Regimes |
-|---------|------|-----------------|
-| (from API) | (from API) | (cross-ref with regimes) |
-
-Present triage stats from \`consent_get_inventory_stats\` (cookie and data-flow counts match the Consent Manager tables; CSP data flows are omitted like the UI):
-
-| Metric | Cookies | Data Flows |
-|--------|---------|------------|
-| Needs Review | cookies.needReviewCount | dataFlows.needReviewCount |
-| Live (Approved) | cookies.liveCount | dataFlows.liveCount |
-| Junk | cookies.junkCount | dataFlows.junkCount |
-
-## Phase 2: Fetch Batch
-
-Fetch the next batch of items needing review, sorted by highest traffic:
-
-${[triageType === "cookies" || triageType === "both" ? "- `consent_list_cookies { status: \"NEEDS_REVIEW\", first: " + batchSize + ", order_field: \"occurrences\", order_direction: \"DESC\" }`" : "", triageType === "data_flows" || triageType === "both" ? "- `consent_list_data_flows { status: \"NEEDS_REVIEW\", first: " + batchSize + ", order_field: \"occurrences\", order_direction: \"DESC\" }`" : ""].filter(Boolean).join("\n")}
-
-Present in this table format:
-
-| # | Name/Domain | Type | Service | Auto-Purposes | Occurrences | Sites | First Seen |
-|---|-------------|------|---------|---------------|-------------|-------|------------|
-
-## Phase 3: Research
-
-For each item in the batch, research its purpose using web search and CMP databases.
-Use the \`consent-research-tracker\` prompt for detailed research methodology.
-If browser/DevTools access is available, use the \`consent-inspect-site\` prompt for live site investigation.
-
-Split items into parallel research groups of 3–5 items each for efficiency.
-
-## Phase 4: Present Findings
-
-For each researched item, present:
-
-### {name/domain}
-| Field | Value |
-|-------|-------|
-| Type | Cookie / Data Flow (HOST/REGEX) |
-| Domain | \`example.com\` |
-| Service | Service Name (or "Unknown") |
-| Current Purposes | What Transcend auto-classified (if any) |
-| Recommended Purpose | Research-based recommendation |
-| Confidence | High / Medium / Low |
-| How Loaded | Direct script / Tag manager / iframe / Dynamic |
-| Occurrences | N |
-| Evidence | Brief summary + source URLs |
-| Recommended Action | APPROVE with purposes / JUNK / NEEDS MANUAL REVIEW |
-| Suggested Note | Description to save to Transcend |
-
-Then show a summary action table:
-
-| # | Name/Domain | Action | Purposes | Service | Note |
-|---|-------------|--------|----------|---------|------|
-
-Ask the user to confirm, modify, or reject each recommendation before proceeding.
-
-## Phase 5: Push Classifications
-
-For confirmed items, update Transcend:
-
-- Individual updates with notes: \`consent_update_data_flows\` / \`consent_update_cookies\` with id, tracking_purposes, description, service, status: "LIVE"
-- Bulk approve/junk: \`consent_bulk_triage\` with items array containing type, id, action, tracking_purposes
-- Mark junk items with action "JUNK" (no purposes needed)
-
-After pushing, report what was updated and show the remaining triage count.
-
-## Phase 6: Loop
-
-Ask the user if they want to continue with the next batch. Repeat from Phase 2.
-
-## Key References
-
-When \`docs_list\` / \`docs_fetch\` are available (e.g. the unified \`@transcend-io/mcp\` server), prefer those for full markdown. Otherwise open the docs URLs directly:
-
-- Triage guide: https://docs.transcend.io/docs/articles/consent-management/configuration/triage-cookies-and-dataflows-guide
-- Data flows & cookies: https://docs.transcend.io/docs/articles/consent-management/concepts/data-flows-and-cookies
-- Tracking purposes: https://docs.transcend.io/docs/articles/consent-management/concepts/tracking-purposes
-- Regional experiences: https://docs.transcend.io/docs/articles/consent-management/configuration/regional-experiences
-- Telemetry overview: https://docs.transcend.io/docs/articles/consent-management/configuration/telemetry-overview`
-			}
-		}];
-	}
-};
-//#endregion
-//#region src/prompts/index.ts
-/**
-* Returns consent workflow prompt templates for MCP prompts/list and prompts/get.
-*
-* @param _clients - Unused; accepted so createMCPServer can pass the same factory shape as getTools
-*/
-function getConsentPrompts(_clients) {
-	return [
-		consentTriagePrompt,
-		consentResearchTrackerPrompt,
-		consentInspectSitePrompt
-	];
-}
-//#endregion
-//#region src/scopes.ts
-/** OAuth scopes required for Consent MCP tools (offline_access added by base). */
-const CONSENT_OAUTH_SCOPES = [
-	ScopeName.ViewConsentManager,
-	ScopeName.ViewAssignedConsentManager,
-	ScopeName.ManageConsentManager,
-	ScopeName.ManageAssignedConsentManager,
-	ScopeName.ViewDataFlow,
-	ScopeName.ManageDataFlow
-];
-//#endregion
-export { resolveAirgapBundleId as C, BulkTriageSchema as S, GetInventoryStatsSchema as _, UpdateDataFlowsSchema as a, resolveAnalyticsDateRange as b, PurposeConsentSchema as c, ListPurposesSchema as d, ListDataFlowsSchema as f, GetPreferencesSchema as g, GetTimeseriesAnalyticsSchema as h, UpdateDataFlowItemSchema as i, SetPreferencesSchema as l, ListAirgapBundlesSchema as m, getConsentPrompts as n, UpdateCookieItemSchema as o, ListCookiesSchema as p, getConsentTools as r, UpdateCookiesSchema as s, CONSENT_OAUTH_SCOPES as t, ListRegimesSchema as u, GetAnalyticsDataSchema as v, BulkTriageItemSchema as x, GetAggregateAnalyticsSchema as y };
-
-//# sourceMappingURL=scopes-UQvBqSH8.mjs.map