rhombus-node-mcp 0.1.55 → 0.1.57

package/dist/api/lpr-tool-api.js

@@ -1,4 +1,4 @@
-import { postApi } from "../network/network.js";
+import { postApi, throwIfApiError } from "../network/network.js";
 import { formatTimestamp } from "../util.js";
 export async function getVehicleEvents(args, timeZone, requestModifiers, sessionId) {
     const requestArgs = {
@@ -15,9 +15,7 @@ export async function getVehicleEvents(args, timeZone, requestModifiers, session
         modifiers: requestModifiers,
         sessionId,
     });
-    if (res.error) {
-        throw new Error(JSON.stringify(res));
-    }
+    throwIfApiError(res);
     return (res.events?.map(event => ({
         uuid: event.uuid ?? "",
         deviceUuid: event.deviceUuid ?? undefined,
@@ -35,9 +33,7 @@ export async function getSavedVehicles(timeZone, requestModifiers, sessionId) {
         modifiers: requestModifiers,
         sessionId,
     });
-    if (res.error) {
-        throw new Error(JSON.stringify(res));
-    }
+    throwIfApiError(res);
     return (res.vehicles?.map(vehicle => ({
         createdTimestamp: formatTimestamp(vehicle.createdAtMillis ?? Date.now(), timeZone),
         name: vehicle.name ?? "No Name",
@@ -53,9 +49,7 @@ export async function getVehicleLabels(requestModifiers, sessionId) {
         modifiers: requestModifiers,
         sessionId,
     });
-    if (res.error) {
-        throw new Error(JSON.stringify(res));
-    }
+    throwIfApiError(res);
     const processedVehicleLabels = {};
     for (const [licensePlate, labels] of Object.entries(res.vehicleLabels ?? {})) {
         const filteredLabels = labels?.filter(label => label !== null) ?? [];
@@ -73,22 +67,83 @@ export async function searchLicensePlates(query, timeZone, requestModifiers, ses
         modifiers: requestModifiers,
         sessionId,
     });
-    if (res.error)
-        throw new Error(JSON.stringify(res));
+    throwIfApiError(res);
     return (res.licensePlateEvents || []).map((event) => ({
         licensePlate: event.vehicleLicensePlate ?? undefined,
         deviceUuid: event.deviceUuid ?? undefined,
         timestampMs: event.eventTimestamp ?? undefined,
     }));
 }
+/**
+ * Save (or overwrite) a vehicle. The plate is the key, so calling this for a
+ * plate that already exists replaces its name and description.
+ *
+ * NOTE the field-name asymmetry, which this used to get wrong: the REQUEST
+ * field is `vehicleLicensePlate` (`Vehicle_SaveVehicleWSRequest`) while the
+ * READ field is `licensePlate` (`VehicleV2Type`). Sending `licensePlate` here
+ * silently saved a vehicle with no plate attached.
+ */
 export async function saveVehicle(name, licensePlate, description, requestModifiers, sessionId) {
     const res = await postApi({
         route: "/vehicle/saveVehicle",
-        body: { name, licensePlate, description: description || "" },
+        body: {
+            name,
+            vehicleLicensePlate: licensePlate,
+            description: description || "",
+        },
+        modifiers: requestModifiers,
+        sessionId,
+    });
+    throwIfApiError(res);
+    return { success: true, licensePlate, warningMsg: res.warningMsg ?? undefined };
+}
+export async function deleteVehicle(licensePlate, requestModifiers, sessionId) {
+    const res = await postApi({
+        route: "/vehicle/deleteVehicle",
+        body: {
+            vehicleLicensePlate: licensePlate,
+        },
+        modifiers: requestModifiers,
+        sessionId,
+    });
+    throwIfApiError(res);
+    return { success: true, licensePlate, warningMsg: res.warningMsg ?? undefined };
+}
+export async function addVehicleLabel(licensePlate, label, requestModifiers, sessionId) {
+    const res = await postApi({
+        route: "/vehicle/addVehicleLabel",
+        body: {
+            vehicleLicensePlate: licensePlate,
+            label,
+        },
+        modifiers: requestModifiers,
+        sessionId,
+    });
+    throwIfApiError(res);
+    return { success: true, licensePlate, label, warningMsg: res.warningMsg ?? undefined };
+}
+export async function removeVehicleLabel(licensePlate, label, requestModifiers, sessionId) {
+    const res = await postApi({
+        route: "/vehicle/removeVehicleLabel",
+        body: {
+            vehicleLicensePlate: licensePlate,
+            label,
+        },
+        modifiers: requestModifiers,
+        sessionId,
+    });
+    throwIfApiError(res);
+    return { success: true, licensePlate, label, warningMsg: res.warningMsg ?? undefined };
+}
+/** The raw saved vehicle, for the exists-checks the write paths need. */
+export async function findSavedVehicle(licensePlate, requestModifiers, sessionId) {
+    const res = await postApi({
+        route: "/vehicle/getVehicles",
+        body: {},
         modifiers: requestModifiers,
         sessionId,
     });
-    if (res.error)
-        throw new Error(JSON.stringify(res));
-    return { success: true };
+    throwIfApiError(res);
+    const normalized = licensePlate.trim().toUpperCase();
+    return res.vehicles?.find(vehicle => vehicle?.licensePlate?.trim().toUpperCase() === normalized);
 }

package/dist/api/policy-alerts-tool-api.js

@@ -9,12 +9,14 @@ export async function getPolicyAlerts(args, requestModifiers, sessionId) {
     }).then(response => {
         return {
             ...response,
-            policyAlerts: (response.policyAlerts || []).map((alert) => ({
+            policyAlerts: (response.policyAlerts || [])
+                .filter((alert) => alert != null)
+                .map((alert) => ({
                 ...alert,
                 labels: [
                     ...(alert.alertingEventFaces || []),
                     ...(alert.alertingEventVehicles || []),
-                ].flatMap(alert => alert.labels),
+                ].flatMap(event => event?.labels ?? []),
                 createdOnString: alert.timestampMs
                     ? formatTimestamp(alert.timestampMs, args.timeZone)
                     : undefined,
@@ -31,7 +33,9 @@ export async function getExpiringPolicyAlerts(args, requestModifiers, sessionId)
     }).then(response => {
         return {
             ...response,
-            policyAlerts: (response.policyAlerts || []).map((alert) => ({
+            policyAlerts: (response.policyAlerts || [])
+                .filter((alert) => alert != null)
+                .map((alert) => ({
                 ...alert,
                 createdOnString: alert.timestampMs
                     ? formatTimestamp(alert.timestampMs)

package/dist/api/report-tool-api.js

@@ -423,7 +423,10 @@ export async function getCustomLLMReport(promptUuid, promptType, startTimeMs, en
     return result;
 }
 export async function getAuditFeed(startTimeMs, endTimeMs, requestModifiers, sessionId) {
-    const body = { startTimeMs, endTimeMs };
+    const body = {
+        timestampMsAfter: startTimeMs,
+        timestampMsBefore: endTimeMs,
+    };
     const response = await postApi({
         route: "/report/getAuditFeed",
         body,

package/dist/api/rules-tool-api.js

@@ -1,4 +1,4 @@
-import { postApi } from "../network/network.js";
+import { postApi, throwIfApiError } from "../network/network.js";
 export async function listRules(requestModifiers, sessionId) {
     const res = await postApi({
         route: "/rules/getRulesForOrg",
@@ -6,9 +6,7 @@ export async function listRules(requestModifiers, sessionId) {
         modifiers: requestModifiers,
         sessionId,
     });
-    if (res.error) {
-        throw new Error(JSON.stringify(res));
-    }
+    throwIfApiError(res);
     return (res.rules?.map((rule) => ({
         uuid: rule.uuid ?? undefined,
         name: rule.name ?? undefined,
@@ -26,9 +24,7 @@ export async function createRule(ruleConfig, requestModifiers, sessionId) {
         modifiers: requestModifiers,
         sessionId,
     });
-    if (res.error) {
-        throw new Error(JSON.stringify(res));
-    }
+    throwIfApiError(res);
     return {
         uuid: res.ruleUuid ?? undefined,
         success: true,
@@ -41,9 +37,7 @@ export async function updateRule(ruleConfig, requestModifiers, sessionId) {
         modifiers: requestModifiers,
         sessionId,
     });
-    if (res.error) {
-        throw new Error(JSON.stringify(res));
-    }
+    throwIfApiError(res);
     return { success: true };
 }
 export async function deleteRule(ruleUuid, requestModifiers, sessionId) {
@@ -53,9 +47,7 @@ export async function deleteRule(ruleUuid, requestModifiers, sessionId) {
         modifiers: requestModifiers,
         sessionId,
     });
-    if (res.error) {
-        throw new Error(JSON.stringify(res));
-    }
+    throwIfApiError(res);
     return { uuid: ruleUuid, success: true };
 }
 export async function getRuleRecords(ruleUuid, requestModifiers, sessionId) {
@@ -65,9 +57,7 @@ export async function getRuleRecords(ruleUuid, requestModifiers, sessionId) {
         modifiers: requestModifiers,
         sessionId,
     });
-    if (res.error) {
-        throw new Error(JSON.stringify(res));
-    }
+    throwIfApiError(res);
     return (res.rulesEventRecords?.map((record) => ({
         uuid: record.uuid ?? undefined,
         ruleUuid: record.ruleUuid ?? undefined,

package/dist/api/schedule-tool-api.js

@@ -0,0 +1,107 @@
+import { postApi, throwIfApiError } from "../network/network.js";
+import { describeWeeklyInterval } from "../util.js";
+/**
+ * api2 models a weekly schedule as `{name, strategy, intervalList}` where every
+ * interval is a pair of "minute of week" integers. We return the raw integers
+ * *and* a rendered `window` string — see `describeWeeklyInterval`.
+ */
+function mapSchedule(raw) {
+    return {
+        uuid: raw.uuid ?? undefined,
+        name: raw.name ?? undefined,
+        strategy: raw.strategy ?? undefined,
+        mutable: raw.mutable ?? undefined,
+        oneTimeUse: raw.oneTimeUse ?? undefined,
+        intervals: raw.intervalList?.map(interval => ({
+            minuteOfWeekStart: interval.minuteOfWeekStart ?? undefined,
+            minuteOfWeekStop: interval.minuteOfWeekStop ?? undefined,
+            window: describeWeeklyInterval(interval.minuteOfWeekStart, interval.minuteOfWeekStop),
+        })) ?? [],
+    };
+}
+export async function findSchedules(requestModifiers, sessionId) {
+    const res = await postApi({
+        route: "/policy/findSchedules",
+        body: {},
+        modifiers: requestModifiers,
+        sessionId,
+    });
+    throwIfApiError(res);
+    return {
+        schedules: res.schedules?.flatMap(raw => (raw ? [mapSchedule(raw)] : [])) ?? [],
+        warningMsg: res.warningMsg ?? undefined,
+    };
+}
+export async function createSchedule(scheduleInput, requestModifiers, sessionId) {
+    const res = await postApi({
+        route: "/policy/createSchedule",
+        body: {
+            schedule: scheduleInput,
+        },
+        modifiers: requestModifiers,
+        sessionId,
+    });
+    throwIfApiError(res);
+    return {
+        scheduleUuid: res.scheduleUuid ?? undefined,
+        warningMsg: res.warningMsg ?? undefined,
+    };
+}
+export async function updateSchedule(scheduleInput, requestModifiers, sessionId) {
+    const res = await postApi({
+        route: "/policy/updateSchedule",
+        body: {
+            schedule: scheduleInput,
+        },
+        modifiers: requestModifiers,
+        sessionId,
+    });
+    throwIfApiError(res);
+    return {
+        updated: { success: true, scheduleUuid: scheduleInput.uuid },
+        warningMsg: res.warningMsg ?? undefined,
+    };
+}
+export async function deleteSchedule(scheduleUuid, requestModifiers, sessionId) {
+    const res = await postApi({
+        route: "/policy/deleteSchedule",
+        body: { scheduleUuid },
+        modifiers: requestModifiers,
+        sessionId,
+    });
+    throwIfApiError(res);
+    return {
+        deleted: { success: true, scheduleUuid },
+        warningMsg: res.warningMsg ?? undefined,
+    };
+}
+/**
+ * Which policies reference a schedule. Deleting a schedule that is still in use
+ * silently changes the behaviour of every policy attached to it, so the delete
+ * path calls this first and refuses when the list is non-empty.
+ */
+export async function getPoliciesUsingSchedule(scheduleUuid, requestModifiers, sessionId) {
+    const res = await postApi({
+        route: "/policy/getPoliciesUsingSchedule",
+        body: {
+            scheduleUuid,
+        },
+        modifiers: requestModifiers,
+        sessionId,
+    });
+    throwIfApiError(res);
+    const collect = (list, policyType) => list?.flatMap(entry => entry ? [{ uuid: entry.uuid ?? undefined, name: entry.name ?? undefined, policyType }] : []) ?? [];
+    return {
+        usedBy: [
+            ...collect(res.cameraPolicyList, "camera"),
+            ...collect(res.doorPolicyList, "door"),
+            ...collect(res.accessControlledDoorPolicyList, "access-controlled-door"),
+            ...collect(res.audioPolicyList, "audio"),
+            ...collect(res.climatePolicyList, "climate"),
+            ...collect(res.occupancyPolicyList, "occupancy"),
+            ...collect(res.proximityPolicyList, "proximity"),
+            ...collect(res.videoIntercomPolicyList, "video-intercom"),
+        ],
+        warningMsg: res.warningMsg ?? undefined,
+    };
+}

package/dist/api/search-tool-api.js

@@ -1,4 +1,4 @@
-import { postApi } from "../network/network.js";
+import { postApi, throwIfApiError } from "../network/network.js";
 export async function searchLicensePlates(query, startTimeMs, endTimeMs, deviceUuids, locationUuids, requestModifiers, sessionId) {
     const body = {
         licensePlate: query,
@@ -13,9 +13,7 @@ export async function searchLicensePlates(query, startTimeMs, endTimeMs, deviceU
         modifiers: requestModifiers,
         sessionId,
     });
-    if (res.error) {
-        throw new Error(JSON.stringify(res));
-    }
+    throwIfApiError(res);
     return (res.vehicleEvents?.map((event) => ({
         licensePlate: event.vehicleLicensePlate ?? undefined,
         deviceUuid: event.deviceUuid ?? undefined,
@@ -36,9 +34,7 @@ export async function searchObjectsByColor(color, cameraUuid, startTimeMs, endTi
         modifiers: requestModifiers,
         sessionId,
     });
-    if (res.error) {
-        throw new Error(JSON.stringify(res));
-    }
+    throwIfApiError(res);
     return (res.objects?.map((result) => ({
         deviceUuid: result.deviceUuid ?? undefined,
         timestampMs: result.timestampMs ?? undefined,
@@ -62,9 +58,7 @@ export async function searchObjectsByText(textQuery, startTimeMs, endTimeMs, dev
         modifiers: requestModifiers,
         sessionId,
     });
-    if (res.error) {
-        throw new Error(JSON.stringify(res));
-    }
+    throwIfApiError(res);
     return (res.similarEmbeddings?.map((match) => ({
         deviceUuid: match.embedding?.deviceUuid ?? undefined,
         timestampMs: match.embedding?.timestamp ?? undefined,
@@ -84,9 +78,7 @@ export async function searchMotionGrid(cameraUuid, startTimeMs, endTimeMs, reque
         modifiers: requestModifiers,
         sessionId,
     });
-    if (res.error) {
-        throw new Error(JSON.stringify(res));
-    }
+    throwIfApiError(res);
     return (res.timeUtcSecsList?.map((ts) => ({
         timestampSecs: ts,
     })) ?? []);

package/dist/api/update-tool-api.js

@@ -1,4 +1,4 @@
-import { postApi } from "../network/network.js";
+import { apiFailureMessage, postApi } from "../network/network.js";
 /**
  * Updates camera configuration using the faceted config API
  */
@@ -350,3 +350,98 @@ export function formatCameraSettings(settings) {
     }
     return sections.join("\n\n");
 }
+/**
+ * Apply settings to a DOORBELL camera.
+ *
+ * Doorbell cameras take the same setting NAMES as cameras but a different
+ * envelope: `/doorbellcamera/updateConfig` wants one FLAT `configUpdate` object,
+ * where `/camera/updateFacetedConfig` wants `videoFacetSettings` /
+ * `audioFacetSettings` / `deviceSettings` keyed by facet. Sending the faceted
+ * shape here is accepted and silently changes nothing, so the flattening has to
+ * happen on this side.
+ */
+export async function updateDoorbellCameraConfig(deviceUuid, settings, requestModifiers, sessionId) {
+    try {
+        const configUpdate = { deviceUuid, ...settings };
+        const result = await postApi({
+            route: "/doorbellcamera/updateConfig",
+            body: { configUpdate },
+            modifiers: requestModifiers,
+            sessionId,
+        });
+        if (result.error) {
+            return {
+                success: false,
+                error: result.errorMsg || "Failed to update doorbell camera configuration",
+            };
+        }
+        return { success: true, updatedSettings: configUpdate };
+    }
+    catch (error) {
+        return {
+            success: false,
+            error: error instanceof Error ? error.message : "Unknown error occurred",
+        };
+    }
+}
+/**
+ * Read a doorbell camera's current config. The response `config` is the same
+ * FLAT object `/doorbellcamera/updateConfig` writes, so a write can be verified
+ * by reading the changed keys back — which matters here because the update
+ * response only echoes the caller's own input (`updatedSettings`) and cannot
+ * distinguish a real write from a silent no-op.
+ */
+export async function getDoorbellCameraConfig(deviceUuid, requestModifiers, sessionId) {
+    try {
+        const result = await postApi({
+            route: "/doorbellcamera/getConfig",
+            body: { deviceUuid },
+            modifiers: requestModifiers,
+            sessionId,
+        });
+        if (result.error) {
+            return {
+                success: false,
+                error: apiFailureMessage(result) ?? "Failed to read the doorbell camera's configuration",
+            };
+        }
+        return { success: true, config: (result.config ?? {}) };
+    }
+    catch (error) {
+        return {
+            success: false,
+            error: error instanceof Error ? error.message : "Unknown error occurred",
+        };
+    }
+}
+/** Confirm a doorbell camera exists before writing to it. */
+export async function getDoorbellCameraDetails(deviceUuid, requestModifiers, sessionId) {
+    try {
+        const result = await postApi({
+            route: "/doorbellcamera/getMinimalStateList",
+            body: {},
+            modifiers: requestModifiers,
+            sessionId,
+        });
+        if (result.error) {
+            return {
+                success: false,
+                error: result.errorMsg || "Failed to list doorbell cameras",
+            };
+        }
+        const match = result.minimalStates?.find(state => state?.uuid === deviceUuid);
+        if (!match) {
+            return {
+                success: false,
+                error: `No doorbell camera in this organization has the uuid "${deviceUuid}". Use get-entity-tool with entityType doorbell-camera to list them — do not guess a uuid.`,
+            };
+        }
+        return { success: true, name: match.name ?? undefined };
+    }
+    catch (error) {
+        return {
+            success: false,
+            error: error instanceof Error ? error.message : "Unknown error occurred",
+        };
+    }
+}

package/dist/api/user-tool-api.js

@@ -1,4 +1,4 @@
-import { postApi } from "../network/network.js";
+import { apiWarning, postApi, throwIfApiError } from "../network/network.js";
 export async function listUsers(requestModifiers, sessionId) {
     const res = await postApi({
         route: "/user/getUsersInOrg",
@@ -6,9 +6,7 @@ export async function listUsers(requestModifiers, sessionId) {
         modifiers: requestModifiers,
         sessionId,
     });
-    if (res.error) {
-        throw new Error(JSON.stringify(res));
-    }
+    throwIfApiError(res);
     return (res.users?.map(user => ({
         uuid: user.uuid ?? undefined,
         email: user.email ?? undefined,
@@ -23,9 +21,7 @@ export async function findUserByEmail(email, requestModifiers, sessionId) {
         modifiers: requestModifiers,
         sessionId,
     });
-    if (res.error) {
-        throw new Error(JSON.stringify(res));
-    }
+    throwIfApiError(res);
     const user = res.user;
     if (!user)
         return undefined;
@@ -48,9 +44,7 @@ export async function getPermissionsForCurrentUser(requestModifiers, sessionId)
         modifiers: requestModifiers,
         sessionId,
     });
-    if (res.error) {
-        throw new Error(JSON.stringify(res));
-    }
+    throwIfApiError(res);
     return {
         role: res.role ?? undefined,
         functionalityAccessMap: res.functionalityAccessMap
@@ -98,9 +92,7 @@ export async function getPermissionGroups(requestModifiers, sessionId) {
         modifiers: requestModifiers,
         sessionId,
     });
-    if (res.error) {
-        throw new Error(JSON.stringify(res));
-    }
+    throwIfApiError(res);
     return (res.permissionGroups?.map(group => ({
         uuid: group.uuid ?? undefined,
         name: group.name ?? undefined,
@@ -124,3 +116,56 @@ export async function getPermissionGroups(requestModifiers, sessionId) {
         locationGranularAccessMap: toNestedStringMap(group.locationGranularAccessMap),
     })) ?? []);
 }
+// ---------------------------------------------------------------------------
+// User write paths
+// ---------------------------------------------------------------------------
+export async function createUser(input, requestModifiers, sessionId) {
+    const res = await postApi({
+        route: "/user/createUser",
+        body: {
+            name: input.name,
+            email: input.email,
+            permissionGroupUuid: input.permissionGroupUuid,
+            // Creating a user normally emails them an invitation. That is an
+            // outward-facing side effect, so the caller has to opt into suppressing it
+            // rather than us silently picking either behaviour.
+            suppressWelcomeEmail: input.suppressWelcomeEmail ?? false,
+        },
+        modifiers: requestModifiers,
+        sessionId,
+    });
+    throwIfApiError(res);
+    return {
+        success: true,
+        uuid: res.userUuid ?? undefined,
+        warningMsg: res.warningMsg ?? undefined,
+    };
+}
+/**
+ * Selective user update — omitted fields are left alone, so a rename cannot
+ * blank someone's notification settings or MFA flag.
+ */
+export async function updateUser(userUuid, changes, requestModifiers, sessionId) {
+    const res = await postApi({
+        route: "/user/updateUserSelective",
+        body: {
+            userUuid,
+            name: changes.name,
+            permissionGroupUuid: changes.permissionGroupUuid,
+        },
+        modifiers: requestModifiers,
+        sessionId,
+    });
+    throwIfApiError(res);
+    return { success: true, uuid: userUuid, warningMsg: apiWarning(res) };
+}
+export async function deleteUser(userUuid, requestModifiers, sessionId) {
+    const res = await postApi({
+        route: "/user/deleteUser",
+        body: { userUuid },
+        modifiers: requestModifiers,
+        sessionId,
+    });
+    throwIfApiError(res);
+    return { success: true, uuid: userUuid, warningMsg: apiWarning(res) };
+}

package/dist/createServer.js

@@ -1,7 +1,7 @@
 import { McpServer } from "@modelcontextprotocol/sdk/server/mcp.js";
 import path from "path";
 import { createTracingProxy } from "./telemetry/tracingProxy.js";
-import { resolveAccessibleApps } from "./api/get-accessible-apps.js";
+import { resolveAccessibleApps, resolveSessionIdentity, } from "./api/get-accessible-apps.js";
 import { logger } from "./logger.js";
 import { createFilteringProxy } from "./util.js";
 import getResources from "./resources/getResources.js";
@@ -42,6 +42,11 @@ export async function serverInit() {
  *
  * Otherwise (unresolved session, empty apps, or only other enums like
  * RHOMBUS_KEY), fall back to the permissive union of console + partner sets.
+ *
+ * Support-authority sessions (getCurrentUser with no `user`, or
+ * `sessionType === "SUPPORT"`) are resolved to exactly `[CONSOLE]` upstream in
+ * `resolveAccessibleApps`, so they take the console branch here and never the
+ * permissive union.
  */
 function pickToolsForSession(apps) {
     if (apps !== null && apps.length > 0 && apps.includes(RhombusAppEnum.PARTNER)) {
@@ -59,7 +64,11 @@ function isNodeDevEnvironment() {
  * Human-readable caller + tool-set summary for dev logs (must stay aligned with
  * {@link pickToolsForSession}).
  */
-function describeCallerForDevLogs(apps) {
+function describeCallerForDevLogs(apps, identity) {
+    if (identity?.sessionType === "SUPPORT") {
+        const who = [identity.name, identity.email].filter(Boolean).join(" ");
+        return `caller=support session (${who || "no name"}, id=${identity.userId ?? "?"}); tool sets=shared + console`;
+    }
     if (apps === null) {
         return "caller=unknown (no session or unresolved apps); tool sets=shared + console + partner (permissive)";
     }
@@ -77,11 +86,11 @@ function describeCallerForDevLogs(apps) {
     }
     return `caller=other (accessibleRhombusApps=[${apps.join(", ")}]); tool sets=shared + console + partner (permissive)`;
 }
-function logDevToolRegistration(sessionId, apps, toolsToRegister) {
+function logDevToolRegistration(sessionId, apps, identity, toolsToRegister) {
     if (!isNodeDevEnvironment())
         return;
     const names = toolsToRegister.map((t) => path.basename(t.name, ".js")).sort();
-    logger.info(`[dev MCP tools] session=${sessionId ?? "(none)"} — ${describeCallerForDevLogs(apps)} — registering ${names.length} tools`);
+    logger.info(`[dev MCP tools] session=${sessionId ?? "(none)"} — ${describeCallerForDevLogs(apps, identity)} — registering ${names.length} tools`);
     logger.info(`[dev MCP tools] tool names: ${names.join(", ")}`);
 }
 export default async function createServer({ sessionId } = {}) {
@@ -103,9 +112,12 @@ export default async function createServer({ sessionId } = {}) {
     }
     logger.info(`📚 Registered ${resources.length} resources`);
     const apps = await resolveAccessibleApps(sessionId);
+    // Same cached getCurrentUser payload — no second API call.
+    const identity = await resolveSessionIdentity(sessionId);
     const toolsToRegister = pickToolsForSession(apps);
-    logDevToolRegistration(sessionId, apps, toolsToRegister);
-    logger.info(`🔒 Session ${sessionId ?? "(none)"}: apps=[${apps?.join(", ") ?? "unknown"}] — registering ${toolsToRegister.length} tools`);
+    logDevToolRegistration(sessionId, apps, identity, toolsToRegister);
+    const sessionKind = identity?.sessionType === "SUPPORT" ? " sessionType=SUPPORT" : "";
+    logger.info(`🔒 Session ${sessionId ?? "(none)"}:${sessionKind} apps=[${apps?.join(", ") ?? "unknown"}] — registering ${toolsToRegister.length} tools`);
     // Tracing wraps every tool handler; filtering wraps on top so handlers are
     // timed after includeFields/filterBy are stripped (keeping them out of
     // mcp.tool.arg_keys). Spans are no-ops unless a host registers an OTel SDK.