mcp-google-multi 6.0.0-beta.1 → 6.0.0-beta.2

package/dist/tools/account-wizard.js

@@ -5,14 +5,16 @@ import { writeToken } from '../token-store.js';
 import { resolveScopesForAccount } from '../auth.js';
 import { BUNDLE_CATALOG, closestBundle, resolveBundleAliases } from '../scope-catalog.js';
 import { openUrl } from '../open-url.js';
-import { buildConsentClient, awaitLoopbackConsent, hasClientCredentials, } from '../oauth-consent.js';
+import { coerceBoolean } from './_coerce.js';
+import { safeMessage, stringifyEnvelope } from './_errors.js';
+import { buildConsentClient, openLoopbackConsent, hasClientCredentials, TESTING_MODE_WARNING, } from '../oauth-consent.js';
 import { detectClients, buildServerEntry, renderInstruction, applyFileEntry, resolveMode, DEFAULT_SERVER_NAME, } from '../client-config.js';
 // B7: the elicitation-driven account_add / account_reauth wizard. It rebuilds
 // interactive account management on the mutable config.json registry so a
 // running server can add an account without the deployer editing env + running
 // a CLI. Google consent reuses the loopback flow (leg C); the HTTP-transport
 // consent path (${BASE}/authorize) is owned by the OAuth AS and lands with that
-// cluster — account_add over http is gated behind it.
+// cluster. account_add over http is gated behind it.
 const ALIAS_RE = /^[a-zA-Z0-9_-]+$/;
 // The common optional bundles get their own checkbox (MCP elicitation has no
 // multi-select, so a boolean per bundle IS the checklist); the long tail stays
@@ -44,13 +46,13 @@ export function validateAddForm(input, existingAliases) {
     const alias = (input.alias ?? '').trim();
     const email = (input.email ?? '').trim();
     if (!ALIAS_RE.test(alias)) {
-        return { ok: false, slug: 'E_VALIDATION', message: `Invalid alias "${alias}". Use letters, digits, "_" or "-".` };
+        return { ok: false, slug: 'E_VALIDATION', message: `Invalid alias "${alias}".`, hint: 'Use letters, digits, "_" or "-".', alias };
     }
     if (existingAliases.includes(alias)) {
-        return { ok: false, slug: 'E_ALIAS_EXISTS', message: `Alias "${alias}" already exists; use account_reauth to re-authenticate it, or pick another name.` };
+        return { ok: false, slug: 'E_ALIAS_EXISTS', message: `Alias "${alias}" already exists.`, hint: 'Use account_reauth to re-authenticate it, or pick another name.', alias };
     }
     if (email === '') {
-        return { ok: false, slug: 'E_VALIDATION', message: 'Email is required (used as the Google login hint).' };
+        return { ok: false, slug: 'E_VALIDATION', message: 'Email is required.', hint: "It is used as the Google login hint, so it must be the account's real Google address.", alias };
     }
     if (input.allBundles === true) {
         // "All optional scopes" supersedes the individual picks.
@@ -61,15 +63,46 @@ export function validateAddForm(input, existingAliases) {
     const bundles = [...new Set(resolveBundleAliases([...picked, ...rawOther]))];
     for (const b of bundles) {
         if (b === 'admin') {
-            return { ok: false, slug: 'E_UNKNOWN_BUNDLE', message: '"admin" is not a bundle — use the admin checkbox instead.' };
+            return { ok: false, slug: 'E_UNKNOWN_BUNDLE', message: '"admin" is not a scope bundle.', hint: 'Use the admin checkbox instead, or pass "admin": true.', alias };
         }
         if (!(b in BUNDLE_CATALOG)) {
-            const hint = closestBundle(b);
-            return { ok: false, slug: 'E_UNKNOWN_BUNDLE', message: `Unknown bundle "${b}"${hint ? ` — did you mean "${hint}"?` : ''}. Known: ${Object.keys(BUNDLE_CATALOG).filter((n) => n !== 'admin').join(', ')}.` };
+            const closest = closestBundle(b);
+            const known = Object.keys(BUNDLE_CATALOG).filter((n) => n !== 'admin').join(', ');
+            return {
+                ok: false,
+                slug: 'E_UNKNOWN_BUNDLE',
+                message: `Unknown bundle "${b}".`,
+                hint: `${closest ? `Did you mean "${closest}"? ` : ''}Known bundles: ${known}.`,
+                alias,
+            };
         }
     }
     return { ok: true, alias, email, bundles, admin: input.admin === true };
 }
+/** URL-mode elicitation params. `elicitationId` is REQUIRED by the spec
+ * schema; omitting it made every url-mode request fail client-side
+ * validation, so the branch silently never worked. Pure, so the shape is
+ * testable against the SDK's own schema without a live client. */
+export function urlElicitationParams(alias, url, elicitationId) {
+    return {
+        mode: 'url',
+        elicitationId,
+        message: `Authorize the "${alias}" Google account in your browser.`,
+        url,
+    };
+}
+/** Map direct tool arguments onto the elicitation form shape: the argument-
+ * mode fallback for clients without form elicitation. All bundle picks travel
+ * through otherBundles, which validateAddForm resolves and validates. Pure. */
+export function argsToAddForm(a) {
+    return {
+        alias: a.alias ?? a.account ?? '',
+        email: a.email ?? '',
+        allBundles: a.allBundles === true,
+        otherBundles: a.bundles ?? '',
+        admin: a.admin === true,
+    };
+}
 /** Scopes requested by the profile but NOT granted at consent (granular
  * consent / unchecked bundles). Pure. */
 export function scopeGrantDiff(requested, grantedScope) {
@@ -92,8 +125,23 @@ function writeAccountRow(alias, email, bundles, admin) {
         return next;
     });
 }
-function textResult(text, isError = false) {
-    return { content: [{ type: 'text', text }], ...(isError ? { isError: true } : {}) };
+function textResult(text) {
+    return { content: [{ type: 'text', text }] };
+}
+/** Wizard failures carry the same envelope as every other tool's, so a client
+ * can branch on the slug and metrics can classify them. Success stays prose:
+ * it is a human-readable onboarding report, not data. */
+function errorResult(slug, message, hint, account) {
+    return {
+        content: [{ type: 'text', text: stringifyEnvelope({
+                    error: slug,
+                    message,
+                    ...(hint ? { hint } : {}),
+                    retriable: false,
+                    ...(account ? { account } : {}),
+                }) }],
+        isError: true,
+    };
 }
 /** Run Google consent for `alias` and persist the token. Opens the browser via
  * URL-mode elicitation when the client supports it, else server-side + prints
@@ -101,22 +149,41 @@ function textResult(text, isError = false) {
 async function runConsent(server, alias) {
     const { randomBytes } = await import('node:crypto');
     const cfg = getAccountSet().configs[alias];
-    if (!cfg)
-        return { ok: false, text: `E_VALIDATION: account "${alias}" is not in the live registry (env-sourced accounts are not editable here).` };
-    const client = buildConsentClient();
+    if (!cfg) {
+        return {
+            ok: false,
+            slug: 'E_VALIDATION',
+            message: `Account "${alias}" is not in the live registry.`,
+            hint: 'Accounts sourced from GOOGLE_ACCOUNTS are not editable here. Run `mcp-google-multi migrate-config` to move them into config.json.',
+        };
+    }
+    // Bind the ephemeral loopback listener BEFORE building the auth URL: the
+    // redirect URI needs the assigned port, and listening first means the
+    // callback can't race the browser.
+    const loop = await openLoopbackConsent();
+    const client = buildConsentClient(loop.redirect);
     const expectedState = randomBytes(32).toString('hex');
     const scopes = resolveScopesForAccount(alias);
     const url = client.generateAuthUrl({ access_type: 'offline', prompt: 'consent', scope: scopes, login_hint: cfg.email, state: expectedState });
-    // Start the loopback listener BEFORE opening the browser so it can't miss the
-    // redirect. Any startup error (e.g. port in use) surfaces synchronously.
-    const consent = awaitLoopbackConsent(client, expectedState);
+    const consent = loop.finish(client, expectedState);
+    // Capability probe: the spec advertises each elicitation mode as a PRESENT
+    // object, not a boolean, so test presence rather than truthiness.
     const caps = server.server.getClientCapabilities?.();
     let opened = false;
-    if (caps?.elicitation?.url) {
+    if (caps?.elicitation?.url !== undefined) {
         try {
-            const r = await server.server.elicitInput({ mode: 'url', message: `Authorize the "${alias}" Google account in your browser.`, url });
+            // elicitationId is REQUIRED by the spec schema; omitting it made every
+            // url-mode request fail client-side validation, so this branch always
+            // fell through to the server-side browser open.
+            const r = await server.server.elicitInput(urlElicitationParams(alias, url, randomBytes(16).toString('hex')));
             if (r.action !== 'accept') {
-                return { ok: false, text: 'confirmation_declined: consent was cancelled; the account row was kept but no token was stored (doctor will show it as "missing").' };
+                loop.close();
+                return {
+                    ok: false,
+                    slug: 'confirmation_declined',
+                    message: 'Consent was cancelled, so no token was stored.',
+                    hint: 'The account row was kept and diagnose reports its token as "missing". Run account_reauth to finish authorizing it.',
+                };
             }
             opened = true;
         }
@@ -132,15 +199,23 @@ async function runConsent(server, alias) {
         tokens = await consent;
     }
     catch (e) {
-        return { ok: false, text: `${e.message}${opened ? '' : `\nOpen this URL to authorize:\n${url}`}` };
+        // Always surface the URL: the browser hand-off can succeed and consent
+        // still fail (declined, timed out), and the URL is the only recovery.
+        return {
+            ok: false,
+            slug: 'auth_required',
+            message: safeMessage(e),
+            hint: `The browser hand-off can succeed and consent still fail, so this URL is the only recovery. Open it to authorize: ${url}`,
+        };
     }
     writeToken(alias, tokens);
     return { ok: true, missing: scopeGrantDiff(scopes, typeof tokens.scope === 'string' ? tokens.scope : undefined) };
 }
 function s4Text(alias, missing) {
-    if (missing.length === 0)
-        return `✔ "${alias}" authenticated; all requested scopes granted. It is now usable without a restart.`;
-    return `⚠ "${alias}" authenticated, but ${missing.length} requested scope(s) were NOT granted (E_SCOPE_NOT_GRANTED) — you may have unchecked some on the consent screen. Re-run account_reauth to grant them. The account is usable for the granted scopes.`;
+    const outcome = missing.length === 0
+        ? `✔ "${alias}" authenticated; all requested scopes granted. It is now usable without a restart.`
+        : `⚠ "${alias}" authenticated, but ${missing.length} requested scope(s) were NOT granted (E_SCOPE_NOT_GRANTED). You may have unchecked some on the consent screen. Re-run account_reauth to grant them. The account is usable for the granted scopes.`;
+    return `${outcome}\n${TESTING_MODE_WARNING}`;
 }
 const REQUIRES_INTERACTION = { 'anthropic/requiresUserInteraction': true };
 export function registerAccountWizardTools(registry, server) {
@@ -151,43 +226,63 @@ export function registerAccountWizardTools(registry, server) {
     registerMeta('account_add', {
         _meta: REQUIRES_INTERACTION,
         annotations: { openWorldHint: true },
-        description: 'Add a new Google account interactively: collects alias/email/scope bundles via a form, writes the registry, and runs Google consent in the browser — no file editing or restart needed. Requires GOOGLE_CLIENT_ID/SECRET (run the `setup` prompt first if missing).',
-        inputSchema: {},
-    }, async () => {
+        description: 'Add a new Google account: pass alias + email directly (plus optional bundles/allBundles/admin), or pass nothing for an interactive form where the client supports elicitation. Writes the registry and runs Google consent in the browser. No file editing or restart needed. Requires GOOGLE_CLIENT_ID/SECRET (run the `setup` prompt first if missing).',
+        inputSchema: {
+            alias: z.string().optional().describe('Account alias (letters, digits, _ or -). Pass with email to add directly, skipping the form.'),
+            account: z.string().optional().describe('Alias for the new account (same as `alias`; every other tool spells it `account`)'),
+            email: z.string().optional().describe("The account's Google address (used as the login hint)"),
+            bundles: z.string().optional().describe('Optional scope bundles, comma-separated (e.g. "forms,chat"); blank = base scopes only'),
+            allBundles: coerceBoolean.optional().describe('Grant every optional bundle (biggest consent screen); overrides bundles'),
+            admin: coerceBoolean.optional().describe('Grant Workspace admin scopes (super-admin accounts only)'),
+        },
+    }, async (args) => {
         try {
             // Env-sourced registry: GOOGLE_ACCOUNTS is the exclusive source and
             // config.json accounts are ignored, so a wizard add would be a phantom
             // write. Refuse up front (BR-10) rather than write a row nothing reads.
             if (process.env.GOOGLE_ACCOUNTS?.trim()) {
-                return textResult('E_ENV_ACCOUNTS_MODE: accounts are defined by the GOOGLE_ACCOUNTS environment variable, so new accounts cannot be added interactively (config.json is ignored while it is set). Either add the alias to GOOGLE_ACCOUNTS and run account_reauth, or run `mcp-google-multi migrate-config` to move accounts into config.json and unset GOOGLE_ACCOUNTS.', true);
+                return errorResult('E_ENV_ACCOUNTS_MODE', 'Accounts are defined by the GOOGLE_ACCOUNTS environment variable, so a new account cannot be added interactively: config.json is ignored while it is set, and the row would be written where nothing reads it.', 'Either add the alias to GOOGLE_ACCOUNTS and run account_reauth, or run `mcp-google-multi migrate-config` to move accounts into config.json and unset GOOGLE_ACCOUNTS.');
             }
             if (!hasClientCredentials()) {
-                return textResult('E_CLIENT_CREDENTIALS_MISSING: GOOGLE_CLIENT_ID/GOOGLE_CLIENT_SECRET are not set. Run the `setup` prompt (/mcp__google-multi__setup) to create an OAuth client, then set them.', true);
+                return errorResult('invalid_client', 'GOOGLE_CLIENT_ID and GOOGLE_CLIENT_SECRET are not set, so there is no OAuth client to run consent against.', 'Run the `setup` prompt (/mcp__google-multi__setup) to create an OAuth client, then set them. See docs/google-cloud-setup.md.');
             }
-            const caps = server.server.getClientCapabilities?.();
-            if (!caps?.elicitation?.form) {
-                return textResult('This client does not support form elicitation. Add the account from the CLI instead: `npx mcp-google-multi account add --alias <alias> --email <email> [--profile a,b] [--admin]`.', true);
+            // S1: collect the registry row. Arguments win over the form so the
+            // wizard still works in clients without form elicitation (where the
+            // interactive path used to dead-end).
+            const a = (args ?? {});
+            let input;
+            if (a.alias?.trim() || a.account?.trim() || a.email?.trim()) {
+                input = argsToAddForm(a);
             }
-            // S1: collect the registry row.
-            const form = await server.server.elicitInput({ message: 'Add a Google account', requestedSchema: addFormSchema() });
-            if (form.action !== 'accept') {
-                return textResult('confirmation_declined: no account was added.');
+            else {
+                // Modes are advertised as PRESENT objects, not booleans.
+                const caps = server.server.getClientCapabilities?.();
+                if (caps?.elicitation?.form === undefined) {
+                    return errorResult('elicitation_unsupported', 'This client does not support the interactive form, and no arguments were supplied, so there is nothing to add.', 'Call account_add again with arguments instead, e.g. {"alias": "work", "email": "you@example.com"} (optional: "bundles" as a comma-separated list, "allBundles": true, "admin": true).');
+                }
+                const form = await server.server.elicitInput({ message: 'Add a Google account', requestedSchema: addFormSchema() });
+                if (form.action !== 'accept') {
+                    return textResult('confirmation_declined: no account was added.');
+                }
+                input = (form.content ?? {});
             }
-            const validated = validateAddForm(form.content ?? {}, getAccountSet().aliases);
+            const validated = validateAddForm(input, getAccountSet().aliases);
             if (!validated.ok)
-                return textResult(`${validated.slug}: ${validated.message}`, true);
+                return errorResult(validated.slug, validated.message, validated.hint, validated.alias);
             // S2: atomic write + make the alias callable without a restart (BR3).
             writeAccountRow(validated.alias, validated.email, validated.bundles, validated.admin);
             invalidateAccountSet();
             // S3 + S4: consent + validate.
             const consent = await runConsent(server, validated.alias);
             if (!consent.ok)
-                return textResult(consent.text, true);
+                return errorResult(consent.slug, consent.message, consent.hint, validated.alias);
             // B15: offer to register the server with another MCP client.
             return textResult(`${s4Text(validated.alias, consent.missing)}\nTip: run account_write_config to register this server with another MCP client (Claude Desktop / Cursor / Claude Code).`);
         }
         catch (e) {
-            return textResult(`account_add failed: ${e.message}`, true);
+            // safeMessage, not error.message: an arbitrary throw here can carry a
+            // token or a whole response body.
+            return errorResult('internal', `account_add failed: ${safeMessage(e)}`);
         }
     });
     registerMeta('account_reauth', {
@@ -197,24 +292,30 @@ export function registerAccountWizardTools(registry, server) {
         inputSchema: {
             // Plain string (NOT the account enum) so this never joins the
             // multi-account fan-out path; validated against the registry below.
-            alias: z.string().describe('Existing account alias to re-authenticate'),
+            alias: z.string().min(1).optional().describe('Existing account alias to re-authenticate'),
+            // Every other tool in the server spells this `account`, so that is
+            // what a caller reaches for. Accepting both removes a dead end that
+            // no did-you-mean can rescue: `account` is 5 edits from `alias`, so
+            // the matcher cannot bridge them.
+            account: z.string().min(1).optional().describe('Alias of the account to re-authenticate (same as `alias`)'),
         },
     }, async (args) => {
         try {
-            const alias = args.alias ?? '';
+            const a = args;
+            const alias = a.alias ?? a.account ?? '';
             if (!hasClientCredentials()) {
-                return textResult('E_CLIENT_CREDENTIALS_MISSING: GOOGLE_CLIENT_ID/GOOGLE_CLIENT_SECRET are not set.', true);
+                return errorResult('invalid_client', 'GOOGLE_CLIENT_ID and GOOGLE_CLIENT_SECRET are not set, so there is no OAuth client to run consent against.', 'Run the `setup` prompt (/mcp__google-multi__setup) to create an OAuth client, then set them. See docs/google-cloud-setup.md.');
             }
             if (!getAccountSet().aliases.includes(alias)) {
-                return textResult(`E_VALIDATION: unknown account "${alias}". Known: ${getAccountSet().aliases.join(', ')}. Use account_add for a new one.`, true);
+                return errorResult('validation_error', `Unknown account "${alias}".`, `Pass one of the configured aliases: ${getAccountSet().aliases.join(', ')}. Use account_add to create a new one.`, alias);
             }
             const consent = await runConsent(server, alias);
             if (!consent.ok)
-                return textResult(consent.text, true);
+                return errorResult(consent.slug, consent.message, consent.hint, alias);
             return textResult(s4Text(alias, consent.missing));
         }
         catch (e) {
-            return textResult(`account_reauth failed: ${e.message}`, true);
+            return errorResult('internal', `account_reauth failed: ${safeMessage(e)}`);
         }
     });
     registerMeta('account_write_config', {
@@ -246,7 +347,7 @@ export function registerAccountWizardTools(registry, server) {
                 entry = buildServerEntry({ name, mode, resourceUri });
             }
             catch (e) {
-                return textResult(e.message, true);
+                return errorResult('internal', safeMessage(e));
             }
             let clients = detectClients();
             if (a.client)
@@ -257,16 +358,16 @@ export function registerAccountWizardTools(registry, server) {
             for (const client of targets) {
                 const instr = renderInstruction(client, name, entry);
                 if (client.managed === 'cli') {
-                    blocks.push(`${client.label} — run:\n  ${instr.text}`);
+                    blocks.push(`${client.label}: run\n  ${instr.text}`);
                 }
                 else if (a.write) {
                     const res = applyFileEntry(client, name, entry);
                     blocks.push(res.ok
-                        ? `${client.label} — ${res.action} "${name}" in ${res.path}${res.backup ? ` (backup ${res.backup})` : ''}`
-                        : `${client.label} — ${res.message}\n${res.snippet ?? ''}`);
+                        ? `${client.label}: ${res.action} "${name}" in ${res.path}${res.backup ? ` (backup ${res.backup})` : ''}`
+                        : `${client.label}: ${res.message}\n${res.snippet ?? ''}`);
                 }
                 else {
-                    blocks.push(`${client.label} — add to ${instr.path}:\n${instr.text}`);
+                    blocks.push(`${client.label}: add to ${instr.path}\n${instr.text}`);
                 }
             }
             if (targets.length === 0) {
@@ -278,7 +379,7 @@ export function registerAccountWizardTools(registry, server) {
             return textResult(`${blocks.join('\n\n')}\n\n${note}`);
         }
         catch (e) {
-            return textResult(`account_write_config failed: ${e.message}`, true);
+            return errorResult('internal', `account_write_config failed: ${safeMessage(e)}`);
         }
     });
 }

package/dist/tools/admin.js

@@ -3,7 +3,7 @@ import { coerceBoolean } from './_coerce.js';
 import { admin as adminClient } from '@googleapis/admin';
 import { accountAliasSchema } from '../accounts.js';
 import { getClient } from '../client.js';
-import { handleGoogleApiError } from './_errors.js';
+import { handleGoogleApiError, invalidParams } from './_errors.js';
 const accountEnum = accountAliasSchema.optional();
 // Admin SDK requires Workspace super-admin (or delegated admin) on the account — personal @gmail.com accounts 403 on every endpoint.
 export function registerAdminTools(server) {
@@ -98,7 +98,7 @@ export function registerAdminTools(server) {
         description: 'Get a single Workspace user by email or user ID',
         inputSchema: {
             account: accountEnum.describe('Google account alias (must be a Workspace admin)'),
-            userKey: z.string().describe('User email or ID'),
+            userKey: z.string().min(1).describe('User email or ID'),
             projection: z.enum(['basic', 'custom', 'full']).optional(),
         },
     }, async ({ account, userKey, projection }) => {
@@ -121,7 +121,7 @@ export function registerAdminTools(server) {
         description: 'Update a Workspace user (PATCH semantics). Gated by write-control (a CUD tool).',
         inputSchema: {
             account: accountEnum.describe('Google account alias (must be a Workspace admin)'),
-            userKey: z.string().describe('User email or ID'),
+            userKey: z.string().min(1).describe('User email or ID'),
             givenName: z.string().optional(),
             familyName: z.string().optional(),
             suspended: coerceBoolean.optional(),
@@ -150,7 +150,7 @@ export function registerAdminTools(server) {
             if (orgUnitPath !== undefined)
                 requestBody.orgUnitPath = orgUnitPath;
             if (Object.keys(requestBody).length === 0) {
-                return { content: [{ type: 'text', text: JSON.stringify({ error: 'No fields to update' }) }], isError: true };
+                return invalidParams(account, 'No fields to update: every optional field was omitted, so the request would have been a no-op.', 'Pass at least one of: givenName, familyName, suspended, password, changePasswordAtNextLogin, orgUnitPath.');
             }
             const res = await directory.users.patch({ userKey, requestBody });
             return {
@@ -197,7 +197,7 @@ export function registerAdminTools(server) {
         description: 'List members of a Workspace group',
         inputSchema: {
             account: accountEnum.describe('Google account alias (must be a Workspace admin)'),
-            groupKey: z.string().describe('Group email or ID'),
+            groupKey: z.string().min(1).describe('Group email or ID'),
             roles: z.string().optional().describe('Comma-separated roles to include (OWNER, MANAGER, MEMBER)'),
             includeDerivedMembership: coerceBoolean.optional(),
             maxResults: z.number().min(1).max(200).optional(),
@@ -224,5 +224,6 @@ export function registerAdminTools(server) {
     });
 }
 function handleAdminError(error, account) {
-    return handleGoogleApiError(error, account, "Admin tools require Workspace super-admin privileges AND the account must be listed in GOOGLE_ADMIN_ACCOUNTS (then re-authenticated). Personal Gmail accounts cannot use these endpoints.");
+    const admin = 'Admin tools require Workspace super-admin privileges AND the account must be listed as an admin account (then re-authenticated). Personal Gmail accounts cannot use these endpoints.';
+    return handleGoogleApiError(error, account, { scope: admin, resource: admin });
 }

package/dist/tools/analytics.d.ts

@@ -0,0 +1,18 @@
+import type { ToolRegistry } from '../registry.js';
+/** Accepts "213025502" or "properties/213025502"; rejects the identifiers
+ * people paste by mistake (G-… measurement IDs, UA-… properties) with a
+ * pointer to the right one. */
+export declare function normalizeProperty(input: string): {
+    name: string;
+} | {
+    hint: string;
+};
+/** GA4 report rows ({dimensionValues:[{value}], metricValues:[{value}]}) are
+ * verbose; merge each row into one {name: value} object (dimension and metric
+ * API names never collide). Shared by runReport and runRealtimeReport. */
+export declare function shapeReport(data: any): Record<string, unknown>;
+export declare function shapeAccountSummaries(data: any): Record<string, unknown>;
+/** Full metadata descriptions run to paragraphs; the first ~160 chars carry
+ * the disambiguation the model needs without bloating a ~300-entry list. */
+export declare function shapeMetadata(data: any): Record<string, unknown>;
+export declare function registerAnalyticsTools(server: ToolRegistry): void;