mcp-google-multi 6.0.0-beta.2 → 6.0.0-beta.4

package/dist/compose.js

@@ -0,0 +1,109 @@
+// Registry composition, extracted from index.ts so tests can build registries
+// without touching the CLI entrypoint. No import-time side effects of its own.
+import { McpServer } from "@modelcontextprotocol/server";
+import { GENERATED_SERVICES } from './tools/generated/index.js';
+import { GENERATED_GATES, SERVICES, servicesAwaitingRestart, unknownToolMessage } from './services.js';
+import { argNormalizationEnabled } from './arg-normalize.js';
+import { unknownArgMode } from './arg-strict.js';
+import { ToolRegistry } from './registry.js';
+import { registerDiscoverTools } from './discover.js';
+import { registerEscapeTools } from './tools/google-api.js';
+import { accountHealthDepsFor, registerAccountTools } from './tools/accounts-tool.js';
+import { registerDiagnoseTool } from './doctor.js';
+import { registerAccountWizardTools } from './tools/account-wizard.js';
+import { getToolsets, toolsetEnabled } from './toolsets.js';
+import { isOwnerContext } from './identity.js';
+import { resolveScopesForAccount } from './auth.js';
+/** The one place the MCP server is constructed, so an embedding host can pass
+ * per-session `instructions` without re-deriving the server identity. */
+export function createMcpServer(version, opts = {}) {
+    const instructions = opts.instructions?.trim() ? opts.instructions : undefined;
+    return new McpServer({ name: 'mcp-google-multi', version }, instructions ? { instructions } : undefined);
+}
+export function buildRegistry(server, ctx, mode, metrics = null) {
+    const policy = ctx.policy;
+    // The registry's account view IS the context's, not the process global.
+    const registry = new ToolRegistry(server, policy, mode, metrics, () => ctx.accounts);
+    // ctx.accounts is read per call, never snapshotted here, so a live getter stays live.
+    const owner = isOwnerContext(ctx);
+    const clientDeps = { getClientFn: ctx.getClient, localFiles: owner };
+    const execDeps = {
+        getClientFn: ctx.getClient,
+        scopeDeps: {
+            readTokenFn: ctx.tokenStore.readToken,
+            profileFn: (alias) => resolveScopesForAccount(alias, ctx.accounts),
+        },
+    };
+    const toolsets = getToolsets();
+    if (toolsets !== 'all') {
+        const known = new Set([...SERVICES.map((s) => s.name), ...GENERATED_SERVICES.map((s) => s.name)]);
+        for (const requested of toolsets) {
+            if (!known.has(requested)) {
+                process.stderr.write(`GOOGLE_TOOLSETS: unknown service "${requested}" ignored\n`);
+            }
+        }
+    }
+    for (const svc of SERVICES) {
+        if (!toolsetEnabled(toolsets, svc.name))
+            continue;
+        if (svc.enabled && !svc.enabled(ctx.accounts)) {
+            if (toolsets !== 'all') {
+                const hint = svc.name === 'admin' ? 'set admin on an account/profile (or GOOGLE_ADMIN_ACCOUNTS)' : `add "${svc.name}" to an account's scope profile (or legacy GOOGLE_OPTIONAL_SCOPES)`;
+                process.stderr.write(`GOOGLE_TOOLSETS: "${svc.name}" requested but not enabled — ${hint}\n`);
+            }
+            continue;
+        }
+        svc.register(registry, clientDeps);
+    }
+    for (const gen of GENERATED_SERVICES) {
+        if (!toolsetEnabled(toolsets, gen.name))
+            continue;
+        const curated = SERVICES.find((s) => s.name === gen.name);
+        const gate = curated?.enabled ?? GENERATED_GATES[gen.name]?.enabled;
+        if (gate && !gate(ctx.accounts)) {
+            if (!curated && toolsets !== 'all') {
+                process.stderr.write(`GOOGLE_TOOLSETS: "${gen.name}" requested but not enabled — ${GENERATED_GATES[gen.name].hint}\n`);
+            }
+            continue;
+        }
+        gen.register(registry, execDeps);
+    }
+    if (registry.services().length === 0) {
+        const known = [...new Set([...SERVICES.map((s) => s.name), ...GENERATED_SERVICES.map((s) => s.name)])].sort();
+        throw new Error(`GOOGLE_TOOLSETS="${process.env.GOOGLE_TOOLSETS ?? ''}" selected no enabled services. ` +
+            `Known services: ${known.join(', ')}. ` +
+            `Note: optional services need their bundle in an account's scope profile (or legacy GOOGLE_OPTIONAL_SCOPES); admin needs an admin account/profile.`);
+    }
+    registerDiscoverTools(registry, policy);
+    registerEscapeTools(registry, policy, execDeps);
+    registerAccountTools(registry, accountHealthDepsFor(ctx.tokenStore));
+    registerDiagnoseTool(registry, ctx);
+    // The wizard edits the owner's config.json and token store; any other
+    // context has neither.
+    if (owner)
+        registerAccountWizardTools(registry, server, () => servicesAwaitingRestart(registry));
+    return registry;
+}
+/** The per-request hooks bound to one registry: argument shapes, unknown-
+ * argument screening and the account a validation envelope names. Both
+ * transports and every resolved server target build them here, so a mistyped
+ * argument behaves the same wherever it arrives. */
+export function requestHooksFor(registry, ctx, metrics = null, env = process.env) {
+    const mode = unknownArgMode(env);
+    return {
+        argShapeFor: argNormalizationEnabled(env) ? (tool) => registry.argShape(tool) : undefined,
+        strictArgs: mode === 'off'
+            ? undefined
+            : {
+                mode,
+                declaredFor: (tool) => registry.declaredKeys(tool),
+                siblingsFor: (tool, keys) => registry.siblingSpellings(tool, keys),
+                unknownTool: (name) => unknownToolMessage(registry, name),
+                onDrop: metrics ? (tool, keys) => metrics.recordArgDrop(tool, keys) : undefined,
+            },
+        validationEnvelope: {
+            isKnownTool: (name) => registry.hasTool(name),
+            defaultAccount: () => ctx.accounts.defaultAccount,
+        },
+    };
+}

package/dist/config-file.d.ts

@@ -1,7 +1,20 @@
 export declare const CONFIG_VERSION = 1;
 export declare function configDir(env?: NodeJS.ProcessEnv): string;
 export declare function configFilePath(env?: NodeJS.ProcessEnv): string;
+export declare function tenantsDir(env?: NodeJS.ProcessEnv): string;
+export declare function tenantConfigFilePath(tenantId: string, env?: NodeJS.ProcessEnv): string;
+export declare function tenantTokenDir(tenantId: string, env?: NodeJS.ProcessEnv): string;
+/** Create and permission-harden the tenant directory chain. mkdirSync's
+ * recursive mode only stamps the DEEPEST newly-created dir, so every level
+ * gets an explicit chmod: the shared tenants/ root (created by whichever
+ * tenant provisions first) must never stay group-readable. */
+export declare function ensureTenantDirs(tenantId: string, env?: NodeJS.ProcessEnv): {
+    configFile: string;
+    tokenDir: string;
+};
 export declare const ALIAS_RE: RegExp;
+export declare const RESERVED_ALIASES: string[];
+export declare function isReservedAlias(name: string): boolean;
 export interface ConfigFile {
     version: number;
     accounts?: Record<string, {

package/dist/config-file.js

@@ -10,6 +10,38 @@ export function configDir(env = process.env) {
 export function configFilePath(env = process.env) {
     return path.join(configDir(env), 'config.json');
 }
+export function tenantsDir(env = process.env) {
+    return path.join(configDir(env), 'tenants');
+}
+// A tenant id becomes a filesystem path segment like an account alias (same
+// traversal guard); 'owner' is the single-owner subject, so no tenant may take it.
+function assertTenantId(tenantId) {
+    if (!ALIAS_RE.test(tenantId) || isReservedAlias(tenantId) || tenantId === 'owner') {
+        throw new Error(`E_TENANT_ID_INVALID: invalid tenant id "${tenantId}".`);
+    }
+}
+export function tenantConfigFilePath(tenantId, env = process.env) {
+    assertTenantId(tenantId);
+    return path.join(tenantsDir(env), tenantId, 'config.json');
+}
+export function tenantTokenDir(tenantId, env = process.env) {
+    assertTenantId(tenantId);
+    return path.join(tenantsDir(env), tenantId, 'tokens');
+}
+/** Create and permission-harden the tenant directory chain. mkdirSync's
+ * recursive mode only stamps the DEEPEST newly-created dir, so every level
+ * gets an explicit chmod: the shared tenants/ root (created by whichever
+ * tenant provisions first) must never stay group-readable. */
+export function ensureTenantDirs(tenantId, env = process.env) {
+    const tokenDir = tenantTokenDir(tenantId, env);
+    const levels = [configDir(env), tenantsDir(env), path.join(tenantsDir(env), tenantId), tokenDir];
+    for (const dir of levels) {
+        fs.mkdirSync(dir, { recursive: true, mode: 0o700 });
+        if (process.platform !== 'win32')
+            fs.chmodSync(dir, 0o700);
+    }
+    return { configFile: tenantConfigFilePath(tenantId, env), tokenDir };
+}
 // Alias charset is load-bearing security, not cosmetics: the alias becomes a
 // tokenDir path segment (encPath), so this guard blocks path traversal.
 export const ALIAS_RE = /^[a-zA-Z0-9_-]+$/;
@@ -19,10 +51,11 @@ const accountEntrySchema = z.strictObject({
     admin: z.boolean().optional(),
 });
 // .strict() everywhere: any unknown or secret-shaped key (clientSecret,
-// masterKey, jwtKey, clientId) fails validation, structurally enforcing
-// secrets-env-only. scopeProfiles/defaultAccount/discovery/toolsets are part
-// of the frozen envelope; their consumers land in later slices.
-const RESERVED_ALIASES = ['__proto__', 'constructor', 'prototype'];
+// masterKey, jwtKey, clientId) fails validation, structurally enforcing secrets-env-only.
+export const RESERVED_ALIASES = ['__proto__', 'constructor', 'prototype'];
+export function isReservedAlias(name) {
+    return RESERVED_ALIASES.includes(name);
+}
 const configSchema = z.strictObject({
     version: z.number().int(),
     accounts: z.record(z.string().regex(ALIAS_RE), accountEntrySchema).optional(),
@@ -36,9 +69,8 @@ const configSchema = z.strictObject({
     defaultAccount: z.string().optional(),
     discovery: z.enum(['lazy', 'curated', 'eager']).optional(),
     toolsets: z.string().optional(),
-    // Local usage metrics (metrics-feature-spec): absent = off. Downgrade rule:
-    // a pre-6.0 build reading a config carrying this key fails E_CONFIG_INVALID
-    // (strictObject); remove the key first.
+    // Absent = off. A pre-6.0 build reading a config carrying this key fails
+    // E_CONFIG_INVALID (strictObject); remove the key first to downgrade.
     usageMetrics: z.boolean().optional(),
 });
 export function failStartup(slug, message) {
@@ -89,9 +121,8 @@ export function loadConfigFile(filePath = configFilePath(), onInvalid = 'exit')
         const issue = result.error.issues[0];
         fail('E_CONFIG_INVALID', `${filePath}: ${issue.path.join('.') || '(root)'}: ${issue.message}. Secrets never belong in config.json.`);
     }
-    // Post-schema because zod's key regex passes these; a __proto__ record key
-    // is a prototype-pollution foothold, and Object.prototype member names break
-    // plain-object lookups downstream.
+    // Post-schema: zod's key regex passes these, but a __proto__ record key is
+    // a prototype-pollution foothold downstream.
     const data = result.data;
     for (const [section, keys] of [
         ['accounts', Object.keys(data.accounts ?? {})],

package/dist/discover.js

@@ -1,8 +1,8 @@
 import { z } from 'zod';
 import { describePolicy } from './write-control.js';
-// The description budget is the whole point of lazy mode: a full op list per
-// service put lazy tools/list at ~11.5k tokens (RQ2), so descriptions carry a
-// CAPPED vocabulary and the complete catalog stays in this tool's RESULT.
+import { hints } from './hint-provider.js';
+// The description budget is the whole point of lazy mode: descriptions carry
+// a CAPPED vocabulary, and the complete catalog stays in this tool's RESULT.
 const CURATED_OPS_CAP = 10;
 const GENERATED_GROUPS_CAP = 6;
 function opVocabulary(registry, service) {
@@ -14,8 +14,7 @@ function opVocabulary(registry, service) {
         parts.push(`${shown.join(', ')}${more > 0 ? ` +${more} more` : ''}`);
     }
     if (generated.length > 0) {
-        // The generated long tail compresses to its resource groups: denser and
-        // more selective than any truncated name list.
+        // Compresses to resource groups: denser than any truncated name list.
         const counts = new Map();
         for (const op of generated) {
             const group = op.split('_')[0];
@@ -30,10 +29,7 @@ function opVocabulary(registry, service) {
 }
 export function registerDiscoverTools(registry, policy) {
     const registerMeta = registry.registerMeta;
-    // Agent-controllable runtime expansion (D3 refinement): reveal the whole
-    // curated quality layer for heavy Google work, collapse to reclaim the
-    // name/schema context budget after. stdio-only semantics — over stateless
-    // HTTP the mode is forced curated and these are no-ops.
+    // stdio-only semantics: over stateless HTTP the mode is forced curated and these are no-ops.
     registerMeta('discover_all', {
         description: 'Reveal ALL curated Google tools at once (instead of per-service discovery). Use when ' +
             'starting substantial Google work; prefer these over google_api_call. Pair with discover_reset.',
@@ -91,6 +87,7 @@ export function registerDiscoverTools(registry, policy) {
         }, async ({ query }) => {
             const operations = registry.catalog(service, query);
             registry.reveal(service);
+            const rendered = hints()?.render({ kind: 'policy_summary', policy });
             return {
                 content: [
                     {
@@ -98,7 +95,7 @@ export function registerDiscoverTools(registry, policy) {
                         text: JSON.stringify({
                             service,
                             operations,
-                            writeControl: describePolicy(policy),
+                            writeControl: rendered?.hint ?? describePolicy(policy),
                             next: operations.length > 0
                                 ? 'Call the chosen tool by name; it is now listed and callable.'
                                 : `No ${service} operation matches "${query}". Call again without query for the full catalog.`,

package/dist/discovery-client.d.ts

@@ -49,5 +49,8 @@ export declare function loadMethodIndex(api: string, deps?: DiscoveryDeps): Prom
 export declare function clearDiscoveryMemoryCache(): void;
 export declare function cudFromMethod(method: Pick<DiscoveryMethod, 'httpMethod' | 'id'>): 'read' | 'create' | 'update' | 'delete';
 export declare function expandPath(template: string, pathParams: Record<string, string>): string;
+/** Search keywords are a few words; the caps keep a caller-sized query from
+ * driving index-size x token-count substring scans on the event loop. */
+export declare const MAX_SEARCH_QUERY = 500;
 export declare function searchMethods(index: DiscoveryMethod[], query: string, limit?: number): DiscoveryMethod[];
 export {};

package/dist/discovery-client.js

@@ -35,10 +35,8 @@ export const SUPPORTED_APIS = {
     vault: { id: 'vault', version: 'v1' },
     workspaceevents: { id: 'workspaceevents', version: 'v1' },
 };
-// Names agents actually type for an API, mapped to real SUPPORTED_APIS keys.
-// Motivated by observed escape-hatch misses ("analytics" is two Discovery
-// APIs, the Admin SDK is three); keep entries plural-target only when the
-// split is real.
+// Names agents actually type for an API, mapped to real SUPPORTED_APIS keys;
+// plural-target entries only where the split ("analytics" is two APIs) is real.
 export const API_ALIASES = {
     analytics: ['analyticsadmin', 'analyticsdata'],
     ga4: ['analyticsadmin', 'analyticsdata'],
@@ -74,6 +72,20 @@ export function discoveryCacheDir(env = process.env) {
     return (env.DISCOVERY_CACHE_PATH ??
         path.join(env.XDG_CONFIG_HOME || path.join(os.homedir(), '.config'), 'mcp-google-multi', 'discovery'));
 }
+// Default cache path only (an operator's DISCOVERY_CACHE_PATH may be shared
+// and keeps its mode), only when this process owns it; clears group/other bits.
+function tightenOwnDir(dir) {
+    if (process.platform === 'win32')
+        return;
+    try {
+        const st = fs.statSync(dir);
+        if (st.uid === process.getuid?.() && (st.mode & 0o077) !== 0)
+            fs.chmodSync(dir, st.mode & ~0o077 & 0o7777);
+    }
+    catch {
+        // the cache still works with the directory's own mode
+    }
+}
 // A poisoned cache file could repoint baseUrl off-Google; refuse to send the
 // user's Bearer token anywhere but a googleapis.com host.
 export function isGoogleApiUrl(url) {
@@ -95,9 +107,8 @@ export function buildMethodIndex(doc, api) {
             if (!method.id || !method.httpMethod || !method.path)
                 continue;
             const params = method.parameters ?? {};
-            // Google serves parameters{} with unstable key order between fetches;
-            // parameterOrder is the canonical sequence, so sort by it (alphabetical
-            // tie-break) to keep gen-tools output deterministic.
+            // parameters{} has unstable key order between fetches; sort by the
+            // canonical parameterOrder (alphabetical tie-break) for deterministic output.
             const order = method.parameterOrder ?? [];
             const pos = (n) => {
                 const i = order.indexOf(n);
@@ -135,6 +146,7 @@ export async function loadMethodIndex(api, deps = {}) {
         throw new Error(`Unknown api "${api}". Known: ${Object.keys(SUPPORTED_APIS).join(', ')}`);
     }
     const fetchFn = deps.fetchFn ?? ((url) => fetch(url, { signal: AbortSignal.timeout(FETCH_TIMEOUT_MS) }));
+    const defaultDir = deps.cacheDir === undefined && process.env.DISCOVERY_CACHE_PATH === undefined;
     const cacheDir = deps.cacheDir ?? discoveryCacheDir();
     const cacheFile = path.join(cacheDir, `${api}.json`);
     const readCache = () => {
@@ -158,9 +170,8 @@ export async function loadMethodIndex(api, deps = {}) {
     if (cacheFresh())
         doc = readCache();
     if (!doc) {
-        // Newer APIs (analyticsadmin/analyticsdata) are absent from the central
-        // discovery directory (404); each service's own $discovery endpoint is
-        // authoritative, so try both — same fallback as scripts/fetch-discovery.
+        // Newer APIs are absent from the central discovery directory (404); try
+        // each service's own $discovery endpoint too, as scripts/fetch-discovery does.
         const urls = [
             `https://www.googleapis.com/discovery/v1/apis/${spec.id}/${spec.version}/rest`,
             `https://${spec.id}.googleapis.com/$discovery/rest?version=${spec.version}`,
@@ -172,7 +183,9 @@ export async function loadMethodIndex(api, deps = {}) {
                 if (!res.ok)
                     throw new Error(`HTTP ${res.status}`);
                 doc = (await res.json());
-                fs.mkdirSync(cacheDir, { recursive: true });
+                fs.mkdirSync(cacheDir, { recursive: true, mode: 0o700 });
+                if (defaultDir)
+                    tightenOwnDir(cacheDir);
                 fs.writeFileSync(cacheFile, JSON.stringify(doc), { mode: 0o600 });
                 break;
             }
@@ -199,20 +212,11 @@ export function clearDiscoveryMemoryCache() {
 // GA4-style report execution (runReport, batchRunPivotReports, runAccessReport)
 // and check* predicates are POSTs purely for the request-body size — reads.
 const POST_READ_VERB = /^(get|list|search|query|lookup|count|batchGet|generateIds|export|download|inspect|check|suggest|(batch)?run\w*report)/i;
-// `cancelWipe` must be matched here, BEFORE `cancel` reaches the delete list:
-// it calls off a pending wipe, which is the opposite of one. Update is tested
-// before delete for exactly that reason.
-// State transitions on something that already exists: reversible, and none of
-// them creates anything, so `create` was both wrong and the most permissive
-// class available. `(batch)?` mirrors the delete list, without which every
-// `batchUpdate*` POST fell through to `create`.
+// Update, tested before delete, so cancelWipe (calling off a wipe) doesn't
+// reach the delete list via its "cancel" suffix. See docs/internals.md.
 const POST_UPDATE_VERB = /^(cancelWipe|(batch)?(untrash|undelete|restore|modify|move|set|sort|merge|unmerge|replace|resize|publish|resolve|update|patch|write|format|change|close|reopen|enable|disable|hide|unhide|accept|approve|decline|reassign|reactivate|renew|mark|turn|suspend|activate|make|return|reclaim|complete))/i;
-// archive sits with the deletes: in GA4 archiving a custom dimension/metric is
-// permanent, so the most restrictive write class is the safe classification.
-// So do the teardown verbs: `stop` and `cancel` tear down a push channel or a
-// long-running operation, `wipe`/`invalidate`/`signOut` destroy device data,
-// codes and sessions, `reset` discards a configuration, and `end` terminates a
-// live conference. Each removes something that existed.
+// archive/wipe/reset/stop/cancel/end etc. all remove or permanently discard
+// something that existed, so the most restrictive class is the safe one. See docs/internals.md.
 const POST_DELETE_VERB = /^(batch)?(delete|remove|trash|clear|empty|obliterate|purge|revoke|wipeout|archive|wipe|invalidate|signOut|stop|cancel|unregister|unreserve|reset|end)/i;
 export function cudFromMethod(method) {
     switch (method.httpMethod) {
@@ -244,13 +248,8 @@ export function expandPath(template, pathParams) {
         if (value === undefined) {
             throw new Error(`Missing required path parameter "${name}"`);
         }
-        // A blank segment collapses the path and Google routes the resulting
-        // trailing-slash URL to the COLLECTION: `sites.get` with siteUrl:"" came
-        // back as the whole site LIST, reported as success. Dot segments resolve
-        // at URL-parse time, so `../v1/contactGroups` retargets the call at a
-        // different endpoint and returns ITS response as success. Both are
-        // silent-wrong, so refuse locally rather than send a different request.
-        // `{+param}` keeps its slashes, so every segment has to be checked.
+        // Both a blank segment and a "." / ".." segment silently retarget the
+        // request to a different, successfully-answered endpoint. See docs/internals.md.
         const segments = plus ? String(value).split('/') : [String(value)];
         for (const segment of segments) {
             if (segment.trim() === '') {
@@ -263,8 +262,13 @@ export function expandPath(template, pathParams) {
         return segments.map(encodeURIComponent).join('/');
     });
 }
+/** Search keywords are a few words; the caps keep a caller-sized query from
+ * driving index-size x token-count substring scans on the event loop. */
+export const MAX_SEARCH_QUERY = 500;
+const MAX_SEARCH_TOKENS = 16;
 export function searchMethods(index, query, limit = 10) {
-    const tokens = query.toLowerCase().split(/\s+/).filter(Boolean);
+    const words = query.slice(0, MAX_SEARCH_QUERY).toLowerCase().split(/\s+/).filter(Boolean);
+    const tokens = [...new Set(words)].slice(0, MAX_SEARCH_TOKENS);
     if (tokens.length === 0)
         return index.slice(0, limit);
     const scored = index

package/dist/doctor.d.ts

@@ -1,6 +1,7 @@
 import type { ToolRegistry } from './registry.js';
 import { getAccountSet } from './accounts.js';
 import { type AccountHealth } from './tools/accounts-tool.js';
+import { type IdentityContext } from './identity.js';
 import { peekMasterKeyProvenance } from './master-key.js';
 import { type HttpConfig } from './http-config.js';
 export type Verdict = 'ok' | 'warn' | 'fail' | 'unknown';
@@ -51,21 +52,24 @@ export interface HttpProbeResult {
     unreachable?: boolean;
     problem?: string;
 }
-/** Console deep-link to enable one API (section-6 hint, error taxonomy B10). */
+/** Console deep-link to enable one API (section-6 hint). */
 export declare function apiEnableLink(api: string): string;
 /** One line, state AND source, so the people being measured can see both
- * here and in `diagnose` (metrics spec section 2). Read-only. */
+ * here and in `diagnose`. Read-only. */
 export declare function usageMetricsStatusLine(env: Record<string, string | undefined>): string;
 /** Roll section verdicts to an overall verdict. `unknown` never worsens it. */
 export declare function overallVerdict(sections: DiagnosticSection[]): Verdict;
-export declare function runDiagnostics(deps?: DiagnosticsDeps): Promise<DiagnosticsReport>;
+export declare function runDiagnostics(deps?: DiagnosticsDeps, opts?: {
+    scope?: 'operator' | 'tenant';
+}): Promise<DiagnosticsReport>;
 /** doctor CLI (brew-doctor style): glyph-coded human report. */
 export declare function renderDoctorText(report: DiagnosticsReport): string;
-/** Redacted, paste-ready bug report (BR8): verdicts + provenance labels + token
+/** Redacted, paste-ready bug report: verdicts + provenance labels + token
  * statuses + slugs; NO token values, secrets, keys, or full email addresses. */
 export declare function renderReport(report: DiagnosticsReport, version: string): string;
 /** Exit non-zero when any section FAILs; with strict, WARN counts too. */
 export declare function exitCodeFor(report: DiagnosticsReport, strict: boolean): number;
+export type DiagnoseContext = Pick<IdentityContext, 'subject' | 'accounts' | 'getClient' | 'tokenStore'>;
 /** Agent-callable structured health report (read-only). Mirrors `doctor`'s
  * engine. Registered as a META tool, like `account_list`: it introspects this
  * server rather than Google data, and as a normal tool it became a service of
@@ -73,7 +77,7 @@ export declare function exitCodeFor(report: DiagnosticsReport, strict: boolean):
  * from already-registered services, and this runs after that), so it was
  * advertised only once something else expanded the surface. The README sends
  * people here when they are stuck, so it has to be findable. */
-export declare function registerDiagnoseTool(registry: ToolRegistry): void;
+export declare function registerDiagnoseTool(registry: ToolRegistry, ctx?: DiagnoseContext): void;
 export interface ResetOptions {
     account?: string;
     regenerateKey: boolean;