@zackbart/connecta 0.36.1 → 0.36.2

package/CHANGELOG.md

@@ -2,6 +2,19 @@
 
 All notable changes to this package are documented here.
 
+## 0.36.2 — 2026-10-27
+
+Connecta 0.36.2 makes Google's hosted MCP servers, such as BigQuery, usable through generic `remoteMcp()` connections. The new `@zackbart/connecta/google` entry mints Google service-account tokens for request-local auth, so agent pools can share a service-account connection without a browser consent. The service account acts as itself, or as a Workspace user when a delegation subject is given. A rejected token is dropped and re-minted for the next request; dispatched writes are never replayed.
+
+Remote MCP OAuth connections can now add browser-only authorization parameters with `auth.authorizationParams`. Personal Google connections set `access_type: "offline"` and `prompt: "consent"` to receive refresh tokens. Protocol and security fields are reserved, and changing the parameters requires reconnecting. API OAuth keeps its existing `authorizationParams` validation.
+
+Both additions are opt-in. Deployments that do not use them need no configuration change. The root bundle cap rises to 403,500 B gzip to fit the new validation. Live Google sign-in and BigQuery calls have not been exercised with deployment credentials.
+
+### Added
+
+- Mint Google service-account tokens for generic remote MCP request auth through `@zackbart/connecta/google`, with optional Workspace delegation and rejected-token cache invalidation.
+- Let remote MCP OAuth connections configure browser-only authorization parameters, including Google's offline-access and consent settings. Protocol and security fields, including `response_mode`, are reserved in every case variant; changing remote MCP authorization parameters requires reconnecting. API OAuth keeps its existing `authorizationParams` validation.
+
 ## 0.36.1 — 2026-10-27
 
 Connecta 0.36.1 adds read-only Granola workspace API access and lets Eve agents select a pool before each model call. Pool changes keep guidance caches separate and prevent replay of parked calls against a different pool. Existing static-pool configuration and public provider tools keep their behavior.

package/bin/version.mjs

@@ -1,3 +1,3 @@
 // Generated from package.json by scripts/generate-version.mjs.
 // Workers-safe: no runtime filesystem read or deployment override.
-export const CONNECTA_VERSION = "0.36.1";
+export const CONNECTA_VERSION = "0.36.2";

package/dist/auth/downstream-oauth.js

@@ -1972,6 +1972,9 @@ export class KvOAuthProvider {
                     return;
                 if (!this.allowAuthorization)
                     throw this.authorizationRefused();
+                for (const [name, value] of this.clientOptions?.authorizationParams ?? []) {
+                    authorizationUrl.searchParams.set(name, value);
+                }
                 this.assertCredentialFree(authorizationUrl.toString(), (yield authInvoke(this, "boundGrant", [])).body, true);
                 const state = this.consent.state ?? authorizationUrl.searchParams.get("state");
                 if (!state)

package/dist/auth/oauth-authorization-params.js

@@ -0,0 +1,52 @@
+import { ConfigError } from "../config-schema.js";
+/**
+ * Protocol and security fields cannot be supplied through remote MCP extensions.
+ * `response_mode` stays reserved: callbacks arrive only as GET query parameters.
+ */
+const RESERVED = new Set([
+    "response_type",
+    "response_mode",
+    "client_id",
+    "client_secret",
+    "redirect_uri",
+    "state",
+    "code_challenge",
+    "code_challenge_method",
+    "scope",
+    "resource",
+    "request",
+    "request_uri",
+]);
+/** Validate and snapshot non-secret browser-only parameters at construction. */
+export function authorizationParamsFor(value, path) {
+    if (value === undefined)
+        return [];
+    const invalid = (detail) => {
+        throw new ConfigError(`${path} ${detail}`);
+    };
+    if (value === null || typeof value !== "object" || Array.isArray(value))
+        invalid("must be a plain string map.");
+    const entries = Object.entries(value);
+    if (entries.length > 32)
+        invalid("must contain at most 32 parameters.");
+    const names = new Set();
+    return entries
+        .map(([name, entry]) => {
+        if (!/^[A-Za-z0-9_.-]{1,128}$/.test(name))
+            invalid("names must be 1–128 ASCII letters, digits, dots, underscores or hyphens.");
+        const lower = name.toLowerCase();
+        if (RESERVED.has(lower))
+            invalid(`may not set "${name}"; the authorization request owns it.`);
+        if (names.has(lower))
+            invalid("must not contain case-variant duplicate names.");
+        names.add(lower);
+        if (typeof entry !== "string" ||
+            !entry.trim() ||
+            entry.length > 2048 ||
+            Array.from(entry).some((char) => char.charCodeAt(0) < 32 || char.charCodeAt(0) === 127)) {
+            invalid("values must be non-empty strings of at most 2048 code units without control characters.");
+        }
+        return [name, entry];
+    })
+        .sort(([a], [b]) => (a < b ? -1 : a > b ? 1 : 0));
+}

package/dist/auth/static-oauth.js

@@ -222,7 +222,7 @@ class StaticOAuthProvider extends KvOAuthProvider {
         super(connectorId, ctx.storage, `${ctx.baseUrl}/oauth/callback/${connectorId}`, coordinator, ctx.allowAuthorization === true, oauthSealerFor(ctx), viewSignal(ctx, requestOwned), 
         // No client binding: the client is configuration, so there is no
         // registration for a restart to carry forward or discard.
-        undefined, (reset) => trackOAuthStartReset(ctx.requestScope ?? ctx, reset), undefined, settings.scope, undefined, { secrets: sentSecretsFor(ctx) });
+        undefined, (reset) => trackOAuthStartReset(ctx.requestScope ?? ctx, reset), undefined, settings.scope, undefined, { secrets: sentSecretsFor(ctx), authorizationParams: settings.authorizationParams });
         this.settings = settings;
     }
     /**
@@ -341,9 +341,6 @@ class StaticOAuthProvider extends KvOAuthProvider {
         }, StaticOAuthProvider.prototype.validateResourceURL);
         registerAuthMethod(StaticOAuthProvider.prototype, "redirectToAuthorization", function (authorizationUrl) {
             return authFlow(function* () {
-                for (const [name, value] of this.settings.authorizationParams) {
-                    authorizationUrl.searchParams.set(name, value);
-                }
                 if (!this.settings.pkce) {
                     authorizationUrl.searchParams.delete("code_challenge");
                     authorizationUrl.searchParams.delete("code_challenge_method");

package/dist/connectors/option-shapes.js

@@ -22,6 +22,7 @@ export const REMOTE_MCP_AUTH = variants("type", {
     }).shape,
     oauth: optionsOf()({
         ...keys("type", "clientMetadataUrl", "scope"),
+        authorizationParams: strings(),
         client: optionsOf()(keys("issuer", "clientId", "clientSecret", "tokenEndpointAuthMethod")),
     }).shape,
 });

package/dist/connectors/remote-mcp.d.ts

@@ -1,6 +1,7 @@
 import { type RemoteOAuthClient } from "../auth/downstream-client-metadata.js";
 import type { FetchLike, Transport } from "@modelcontextprotocol/client";
 import { ConnectorCallError } from "../errors.js";
+import type { RequestToken } from "../request-token.js";
 import type { Connector, ConnectorCallAdmissionPolicy, ConnectorContext, ConnectorCredentialConfig, ConnectorUsageGuide, Logger } from "../types.js";
 /**
  * A static downstream credential supplied through the connection in the
@@ -37,7 +38,7 @@ interface RemoteMcpCredentialAuth {
 export type RemoteMcpAuth = {
     type: "request";
     /** Resolve a Bearer token inside this request. Never persisted or described. */
-    token: (ctx: ConnectorContext) => Promise<string>;
+    token: RequestToken;
     /** Static protocol/catalog headers, never Authorization. */
     headers?: Record<string, string>;
 } | {
@@ -51,6 +52,8 @@ export type RemoteMcpAuth = {
     client?: RemoteOAuthClient;
     /** Space-separated default scopes when the resource server does not advertise them. */
     scope?: string;
+    /** Non-secret browser authorization parameters; protocol fields are reserved. Changes require reconnect. */
+    authorizationParams?: Record<string, string>;
 };
 export type RemoteMcpRedirectPolicy = "none" | "same-origin";
 export interface RemoteMcpOptions {

package/dist/connectors/remote-mcp.js

@@ -1,3 +1,4 @@
+import { authorizationParamsFor } from "../auth/oauth-authorization-params.js";
 import { authView } from "../auth/native-call.js";
 import { authFlow, authCall, authInvoke, authValue, authMethod, authCatch } from "../auth/native.js";
 import { isOAuthCredentialRequest } from "../auth/oauth-token-response.js";
@@ -1101,6 +1102,7 @@ export function remoteMcp(id, opts) {
     const clientMetadataUrl = opts.auth?.type === "oauth" ? opts.auth.clientMetadataUrl : undefined;
     const oauthScope = opts.auth?.type === "oauth" ? opts.auth.scope : undefined;
     assertOAuthScope(id, oauthScope);
+    const authorizationParams = authorizationParamsFor(opts.auth?.type === "oauth" ? opts.auth.authorizationParams : undefined, `remoteMcp(${JSON.stringify(id)}).auth.authorizationParams`);
     const staticClient = opts.auth?.type === "oauth" && opts.auth.client ? { ...opts.auth.client } : undefined;
     assertRemoteOAuthClient(id, staticClient);
     if (staticClient && clientMetadataUrl !== undefined)
@@ -1722,6 +1724,7 @@ export function remoteMcp(id, opts) {
             url: new URL(opts.url).href,
             redirectUri,
             clientMetadata: downstreamClientMetadata(redirectUri, oauthScope, ctx.oauthClientName, staticClient ? remoteClientAuthMethod(staticClient) : "none"),
+            ...(authorizationParams.length ? { authorizationParams } : {}),
             authScope: opts.authScope ?? "shared",
             versionNegotiation: opts.versionNegotiation ?? "auto",
             redirects: opts.redirects ?? "none",
@@ -1735,7 +1738,7 @@ export function remoteMcp(id, opts) {
                     },
                 }
                 : {}),
-        }), (reset) => trackOAuthStartReset(ctx.requestScope ?? ctx, reset), metadataUrl, oauthScope, undefined, { name: ctx.oauthClientName, client: staticClient, secrets: sentSecretsFor(ctx) });
+        }), (reset) => trackOAuthStartReset(ctx.requestScope ?? ctx, reset), metadataUrl, oauthScope, undefined, { name: ctx.oauthClientName, client: staticClient, secrets: sentSecretsFor(ctx), authorizationParams });
         if (state)
             state.provider = provider;
         return provider;
@@ -1856,6 +1859,11 @@ export function remoteMcp(id, opts) {
                     return response;
                 });
             }));
+            if (response.status === 401 && requestAuth?.token.invalidate && credentialValue !== null) {
+                // Invalidate the exact bytes this transport sent, never a newer token.
+                // Preserve the original 401 even if an operator hook fails. No replay.
+                (yield authCatch(authInvoke(requestAuth.token, "invalidate", [credentialValue, ctx]), () => { }));
+            }
             if (credentialPost && !isOAuthCredentialRequest(init) && REDIRECT_STATUSES.has(response.status)) {
                 (yield authCatch(authValue(() => response.body?.cancel()), () => { }));
                 throw new ConnectorCallError("connector_call_failed", "OAuth registration endpoint redirected; the request was not repeated.", { retryable: false });
@@ -2408,6 +2416,9 @@ export function remoteMcp(id, opts) {
                 : isOauth
                     ? {
                         mode: "oauth",
+                        ...(authorizationParams.length
+                            ? { authorizationParamNames: authorizationParams.map(([name]) => name) }
+                            : {}),
                         ...(oauthScope !== undefined ? { scope: oauthScope } : {}),
                         ...(describedClientMetadataUrl !== undefined ? { clientMetadataUrl: describedClientMetadataUrl } : {}),
                     }

package/dist/google.d.ts

@@ -0,0 +1,13 @@
+import type { RequestToken } from "./request-token.js";
+import { type GoogleServiceAccount } from "./providers/_shared/google/service-account.js";
+export type { GoogleServiceAccount } from "./providers/_shared/google/service-account.js";
+export interface GoogleServiceAccountTokenOptions {
+    /** The downloaded JSON key text, or its camelCase fields. Kept in deployment memory only. */
+    serviceAccount: GoogleServiceAccount | string;
+    /** Non-empty HTTPS OAuth scope URLs for the target API. */
+    scopes: readonly string[];
+    /** Optional Workspace user for domain-wide delegation; omitted means the account itself. */
+    subject?: string;
+}
+/** Mint Google OAuth access tokens for remoteMcp's shared request auth on Node or Workers. */
+export declare function googleServiceAccountToken(options: GoogleServiceAccountTokenOptions): RequestToken;

package/dist/google.js

@@ -0,0 +1,42 @@
+import { assertKnownOptions, ConfigError, keys, optionsOf } from "./config-schema.js";
+import { delegatedToken, forgetDelegatedToken, parseServiceAccount, } from "./providers/_shared/google/service-account.js";
+const OPTIONS = optionsOf()(keys("serviceAccount", "scopes", "subject"));
+const ACCOUNT = optionsOf()(keys("clientEmail", "privateKey", "clientId"));
+/** Mint Google OAuth access tokens for remoteMcp's shared request auth on Node or Workers. */
+export function googleServiceAccountToken(options) {
+    const opts = assertKnownOptions(options, "googleServiceAccountToken", OPTIONS);
+    let input = opts.serviceAccount;
+    if (typeof input === "object" && input !== null) {
+        input = assertKnownOptions(input, "googleServiceAccountToken.serviceAccount", ACCOUNT);
+    }
+    let account;
+    try {
+        account = parseServiceAccount("googleServiceAccountToken", input);
+    }
+    catch {
+        // The legacy Workspace parser may quote a JSON credential's type. Never
+        // reflect arbitrary credential-file fields through this public helper.
+        throw new ConfigError("googleServiceAccountToken.serviceAccount requires a valid Google service-account JSON key or { clientEmail, privateKey, clientId? } with a PKCS#8 RSA key of at least 2048 bits.");
+    }
+    if (!Array.isArray(opts.scopes) || opts.scopes.length === 0 || !Array.from(opts.scopes).every(validScope)) {
+        throw new ConfigError("googleServiceAccountToken.scopes must be a non-empty array of HTTPS OAuth scope URLs.");
+    }
+    if (opts.subject !== undefined && (typeof opts.subject !== "string" || !/^[^\s@]+@[^\s@]+$/.test(opts.subject))) {
+        throw new ConfigError("googleServiceAccountToken.subject must be a Workspace email address when provided.");
+    }
+    const request = { account, subject: opts.subject, scopes: [...new Set(opts.scopes)] };
+    const token = async (ctx) => await delegatedToken(request, ctx);
+    token.invalidate = async (rejected) => await forgetDelegatedToken(request, rejected);
+    return token;
+}
+function validScope(value) {
+    if (typeof value !== "string" || /\s/.test(value))
+        return false;
+    try {
+        const url = new URL(value);
+        return url.protocol === "https:" && !url.username && !url.password && !url.hash;
+    }
+    catch {
+        return false;
+    }
+}

package/dist/providers/_shared/google/service-account.d.ts

@@ -35,7 +35,7 @@ export declare function parseServiceAccount(owner: string, input: unknown): Serv
 /** One delegated token request: whose account, acting as whom, for what. */
 export interface DelegatedTokenRequest {
     account: ServiceAccountKey;
-    subject: string;
+    subject?: string | undefined;
     scopes: readonly string[];
 }
 /**

package/dist/providers/_shared/google/service-account.js

@@ -1,8 +1,7 @@
 /**
- * A Google service account acting for Workspace users through domain-wide
- * delegation: the key, the signed JWT-bearer assertion, and the short-lived
- * access tokens it buys. Shared by every Workspace product provider; never its
- * own export.
+ * A Google service account acting as itself or for Workspace users through
+ * domain-wide delegation: the key, signed JWT-bearer assertions and short-lived
+ * access tokens. Shared by Workspace providers and the optional /google helper.
  *
  * Why not the vault. One key serves every Workspace connector a deployment
  * declares — Gmail, Drive, Docs — and it is a deployment secret in the same
@@ -300,9 +299,17 @@ function tokenAnswer(status, code) {
  * Map a refused token request to what fixes it. The codes are RFC 6749's and
  * Google documents what each means for a delegated assertion.
  */
-function tokenFailure(account, scopes, status, headers, payload) {
+function tokenFailure(account, scopes, status, headers, payload, subject) {
     const code = asRecord(payload)["error"];
     const said = tokenAnswer(status, code);
+    if (subject === undefined) {
+        if (code === "unauthorized_client" || code === "access_denied" || code === "invalid_scope" || status === 403) {
+            return new ConnectorCallError("provider_permission_denied", `Google refused a service-account token.${said} Check the requested OAuth scopes and the service account's IAM permissions for the target API and resources.`);
+        }
+        if (code === "invalid_grant") {
+            return resendAdvice(new ConnectorCallError("auth_required", `Google refused the service-account assertion.${said} The key may be deleted or disabled, or this host's clock may be minutes off. Check the key and clock.`), " before retrying");
+        }
+    }
     const client = account.clientId
         ? `client ID ${account.clientId} (${account.clientEmail})`
         : `the client ID of ${account.clientEmail}`;
@@ -325,7 +332,7 @@ function tokenFailure(account, scopes, status, headers, payload) {
     if (status === 403) {
         return new ConnectorCallError("provider_permission_denied", `Google refused domain-wide delegation.${said} Ask a Workspace super admin to review ${client} in the Admin console's Manage Domain Wide Delegation entry and grant exactly these scopes: ${scopes.join(",")}.`);
     }
-    return new ConnectorCallError("connector_call_failed", `Google's token endpoint refused the delegated assertion with HTTP ${status}.${said}`, { retryable: false });
+    return new ConnectorCallError("connector_call_failed", `Google's token endpoint refused the ${subject === undefined ? "service-account" : "delegated"} assertion with HTTP ${status}.${said}`, { retryable: false });
 }
 async function mint(account, subject, scopes, ctx) {
     const issuedAt = Date.now();
@@ -339,7 +346,7 @@ async function mint(account, subject, scopes, ctx) {
         const parsed = await response.jsonResult();
         const payload = "value" in parsed ? parsed.value : undefined;
         if (!response.ok) {
-            throw verdict(tokenFailure(account, scopes, response.status, response.headers, payload));
+            throw verdict(tokenFailure(account, scopes, response.status, response.headers, payload, subject));
         }
         const body = asRecord(payload);
         const accessToken = body["access_token"];
@@ -383,7 +390,12 @@ function keyIdentity(account) {
 }
 async function cacheKey({ account, subject, scopes }) {
     // Workspace addresses are case-insensitive; scope order is not a new grant.
-    return [account.clientEmail, await keyIdentity(account), subject.toLowerCase(), [...scopes].sort().join(" ")].join("\n");
+    return JSON.stringify([
+        account.clientEmail,
+        await keyIdentity(account),
+        subject?.toLowerCase() ?? null,
+        [...new Set(scopes)].sort(),
+    ]);
 }
 function remember(key, minted) {
     tokens.delete(key);

package/dist/providers/planning-center/lib/constants.d.ts

@@ -55,4 +55,4 @@ export declare const PLANNING_CENTER_MAX_RESPONSE_BYTES: number;
  */
 export declare const PLANNING_CENTER_ADMISSION: ConnectorCallAdmissionPolicy;
 /** Planning Center refuses a request without a descriptive one (HTTP 403). */
-export declare const DEFAULT_USER_AGENT = "connecta/0.36.1 (+https://github.com/zackbart/connecta)";
+export declare const DEFAULT_USER_AGENT = "connecta/0.36.2 (+https://github.com/zackbart/connecta)";

package/dist/request-token.d.ts

@@ -0,0 +1,7 @@
+import type { ConnectorContext } from "./types.js";
+/** A request-local Bearer resolver with optional cache invalidation on HTTP 401. */
+export interface RequestToken {
+    (ctx: ConnectorContext): Promise<string>;
+    /** Drop only the rejected token. This hook never authorizes replay. */
+    invalidate?: (rejected: string, ctx: ConnectorContext) => Promise<void>;
+}

package/dist/request-token.js

@@ -0,0 +1 @@
+export {};

package/dist/version.d.ts

@@ -1 +1 @@
-export declare const CONNECTA_VERSION = "0.36.1";
+export declare const CONNECTA_VERSION = "0.36.2";

package/dist/version.js

@@ -1,3 +1,3 @@
 // Generated from package.json by scripts/generate-version.mjs.
 // Workers-safe: no runtime filesystem read or deployment override.
-export const CONNECTA_VERSION = "0.36.1";
+export const CONNECTA_VERSION = "0.36.2";

package/documentation/README.md

@@ -8,18 +8,19 @@ For a new deployment, start with [Deploying Connecta](./deploying.md).
 
 ## Operator tasks
 
-| Task                                     | Self-contained procedure                                                                                                            |
-| ---------------------------------------- | ----------------------------------------------------------------------------------------------------------------------------------- |
-| Add or remove a connector                | [Change the connector roster](./integrating.md#add-or-remove-a-connector)                                                           |
-| Set up a maintained provider             | [Maintained provider setup](./providers.md)                                                                                         |
-| Inspect maintained API sources and tools | [API sources and tool inventory](./providers.md#api-sources-and-tool-inventory)                                                     |
-| Organize an agent's pools and tiers      | [Organizing an agent's pools](./auth.md#organizing-an-agents-pools)                                                                 |
-| Add a person (maintainer or pool member) | [Add a person](./auth.md#add-a-person), [member page](./operator-ui.md#use-the-member-page)                                         |
-| Connect a shared credential              | [Connect a shared credential](./auth.md#connect-a-shared-credential)                                                                |
-| Issue, rotate, or revoke an agent token  | [Manage an agent token](./auth.md#issue-rotate-or-revoke-an-agent-token)                                                            |
-| Upgrade between versions                 | [Upgrade an existing deployment](./deploying.md#upgrade-an-existing-deployment), including [migration to 0.33](./migration-0.33.md) |
-| Diagnose with `connecta doctor`          | [Verify and diagnose](./deploying.md#verify-and-diagnose)                                                                           |
-| Connect a client with tool search        | [Native tool surface](./meta-tools.md#native-tool-surface), [Eve agents](./meta-tools.md#eve-agents)                                |
+| Task                                             | Self-contained procedure                                                                                                            |
+| ------------------------------------------------ | ----------------------------------------------------------------------------------------------------------------------------------- |
+| Add or remove a connector                        | [Change the connector roster](./integrating.md#add-or-remove-a-connector)                                                           |
+| Set up a maintained provider                     | [Maintained provider setup](./providers.md)                                                                                         |
+| Inspect maintained API sources and tools         | [API sources and tool inventory](./providers.md#api-sources-and-tool-inventory)                                                     |
+| Organize an agent's pools and tiers              | [Organizing an agent's pools](./auth.md#organizing-an-agents-pools)                                                                 |
+| Add a person (maintainer or pool member)         | [Add a person](./auth.md#add-a-person), [member page](./operator-ui.md#use-the-member-page)                                         |
+| Connect Google hosted MCP with a service account | [Google tokens and shared-agent/personal-people setup](./auth.md#google-service-account-tokens-and-hosted-mcp)                      |
+| Connect a shared credential                      | [Connect a shared credential](./auth.md#connect-a-shared-credential)                                                                |
+| Issue, rotate, or revoke an agent token          | [Manage an agent token](./auth.md#issue-rotate-or-revoke-an-agent-token)                                                            |
+| Upgrade between versions                         | [Upgrade an existing deployment](./deploying.md#upgrade-an-existing-deployment), including [migration to 0.33](./migration-0.33.md) |
+| Diagnose with `connecta doctor`                  | [Verify and diagnose](./deploying.md#verify-and-diagnose)                                                                           |
+| Connect a client with tool search                | [Native tool surface](./meta-tools.md#native-tool-surface), [Eve agents](./meta-tools.md#eve-agents)                                |
 
 For removed hosted presets and the former hosted modes of Stripe, Vercel,
 Cloudflare, and GitHub, use [Migrate hosted MCP presets](./hosted-mcp-migration.md).

package/documentation/architecture.md

@@ -1199,6 +1199,15 @@ meaning. These facts do not change agent error fields or write outcomes.
 
 ## Configuration
 
+Downstream OAuth browser extensions use `auth.authorizationParams` on
+`remoteMcp()` and `oauth.authorizationParams` on `api()`. Both snapshot and
+validate the string map at construction, reserve protocol/security parameters
+case-insensitively, and add entries only when publishing the consent URL.
+Remote MCP includes canonical sorted entries in its existing client configuration
+binding (omitted and empty maps remain equivalent); static API OAuth retains
+its existing token-endpoint binding. The [auth contract](./auth.md#browser-authorization-parameters)
+owns limits, reserved names, and reconnect requirements.
+
 `ConnectaConfig` is one schema (`src/config.ts`, combinators in
 `src/config-schema.ts`). The same value produces the TypeScript type a
 deployment writes, the unknown-key walk createConnecta runs before reading any
@@ -1210,8 +1219,8 @@ is resolved in place of the caller's object, so no getter or Proxy trap runs;
 an accessor on a config object or array is refused by path, as is an object
 that cannot be inspected. A closed object or record slot takes a plain object
 only: an array or a class instance there is refused by path, unread. String
-maps (static `headers`, `api()`'s `authorizationParams` and
-`tokenRequestHeaders`) are copied the same way and each value must be a
+maps (static `headers`, remote MCP and `api()` OAuth `authorizationParams`,
+and `api()` OAuth `tokenRequestHeaders`) are copied the same way and each value must be a
 string. A discriminated union (`remoteMcp()`'s `auth.type`,
 a provider's `auth.type`) with a missing or unrecognized discriminant throws
 with the valid values. Only plain data is copied. Connectors, modules,
@@ -1770,6 +1779,19 @@ fetch, streams, Web Crypto, lifetime and request-byte behavior, as listed in
 
 ## Optional deployment modules
 
+`/google` (`src/google.ts`) exports the Promise-based
+`googleServiceAccountToken` request-token resolver outside the root graph.
+It reuses `src/providers/_shared/google/service-account.ts` for Web Crypto,
+in-memory token caching and exact-token invalidation, with an absent subject
+for service accounts acting as themselves. Workspace providers keep supplying
+subjects and retain their delegated error guidance. `src/request-token.ts`
+owns the callable resolver contract and optional HTTP-401 invalidation hook;
+`remoteMcp()` invokes it without replaying the failed operation.
+`test/google-service-account-token.test.ts` exercises signing/cache behavior on
+Node and workerd; `test/google-service-account-remote.node.test.ts` checks
+real-socket token/MCP requests, invalidation and one physical attempt per write.
+Operator setup lives in [Google hosted MCP](./auth.md#google-service-account-tokens-and-hosted-mcp).
+
 `createConnecta` takes closed typed `ui`, `vault`, and `activity`
 slots, with factories at `/ui`, `/credentials`, and `/activity`
 and agent tokens at `/auth/access-tokens`. Root exports the contracts, never the implementations, and there

package/documentation/auth.md

@@ -14,7 +14,7 @@ credential contracts; use [deployment setup](./deploying.md) for runnable steps.
 | Set up human sign-in                                                | [Access on Workers](#cloudflare-access-on-workers), [Clerk tokens and sessions](#clerk-oauth-tokens-and-operator-sessions), [Clerk Organizations](#one-clerk-instance-one-organization-per-deployment), [management](#human-authentication-management) |
 | Enable credential or connection controls                            | [Management permissions](#management-permissions), [start/restart/disconnect](#starting-restarting-and-disconnecting)                                                                                                                                  |
 | Diagnose consent or token refresh                                   | [State at rest](#downstream-oauth-state-at-rest), [callbacks](#consents-and-callbacks), [refresh failures](#refresh-failures), [safe errors](#what-a-servers-errors-may-say)                                                                           |
-| Configure a downstream OAuth client or HTTP handler                 | [Client registration](#downstream-oauth-client-registration), [api() OAuth](#downstream-oauth-on-api), [request-local bearer tokens](#request-local-downstream-bearer-tokens)                                                                          |
+| Configure a downstream OAuth client or HTTP handler                 | [Client registration](#downstream-oauth-client-registration), [api() OAuth](#downstream-oauth-on-api), [request-local bearer tokens](#request-local-downstream-bearer-tokens), [Google hosted MCP](#google-service-account-tokens-and-hosted-mcp)      |
 | Review browser or downstream URL boundaries                         | [Origins](#origins), [advertised URLs](#urls-a-downstream-advertises), [one server per grant](#one-server-per-grant)                                                                                                                                   |
 
 [Credential recognition and admission](#credential-recognition-and-admission)
@@ -2498,6 +2498,48 @@ stored static-client state and reselects the configured identity.
 Configured `scope` is a fallback; a downstream challenge or protected-resource
 declaration takes precedence, and the SDK adds `offline_access` when advertised.
 
+### Browser authorization parameters
+
+Set `auth.authorizationParams` on an OAuth `remoteMcp()` connector to add
+non-secret provider parameters to the browser consent URL. This works with
+pre-registered clients, CIMD, and DCR. For example:
+
+```ts
+remoteMcp("crm", {
+  url: "https://mcp.example/mcp",
+  auth: {
+    type: "oauth",
+    scope: "records.read",
+    authorizationParams: { access_type: "offline", prompt: "consent" },
+  },
+});
+```
+
+Each configured parameter occurs once, replacing any same-name value already
+on the authorization endpoint URL. These parameters are never added to token
+exchange, refresh, registration, revocation, metadata, or MCP requests.
+Descriptions expose parameter names only. Values are public configuration,
+visible in the consent URL and stored with it; never put secrets here.
+
+The map must be a plain string record with at most 32 entries. Names contain
+1–128 ASCII letters, digits, dots, underscores, or hyphens. Values must be
+nonempty (not whitespace-only), at most 2048 UTF-16 code units, and contain no
+ASCII control characters. Case-variant duplicate names are refused. The
+following names, including every case variant, fail construction with
+`ConfigError`: `response_type`, `response_mode`, `client_id`, `client_secret`,
+`redirect_uri`, `state`, `code_challenge`, `code_challenge_method`, `scope`,
+`resource`, `request`, and `request_uri`. Configure scopes through `auth.scope`.
+`response_mode` is reserved because Connecta accepts callbacks only as GET query
+parameters.
+
+For remote MCP, the map joins the stored client configuration binding, like
+scope and client identity. Adding, removing, or changing a parameter requires
+Restart or Disconnect and reconnect to obtain a grant with the new consent
+settings. The map does not rewrite existing grants or pending consent URLs;
+as with scope, reconfiguring it alone does not obtain a new grant. A DCR
+registration created under different parameters cannot be carried through
+Restart. Key order is irrelevant; an empty map and omission are equivalent.
+
 ## Downstream OAuth on `api()`
 
 `api()` takes a static authorization-code configuration for APIs without MCP
@@ -2532,7 +2574,7 @@ No discovery or registration occurs; all URLs are configuration, so the
 | ---------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ |
 | Endpoints                    | Checked at construction: HTTPS, HTTP only on loopback, no credentials or fragment.                                                                                                                                                                                                                                                                                                                                             |
 | `pkce`                       | S256 by default; `false` omits challenge and verifier.                                                                                                                                                                                                                                                                                                                                                                         |
-| `authorizationParams`        | Adds provider parameters; cannot restate the grant's own.                                                                                                                                                                                                                                                                                                                                                                      |
+| `authorizationParams`        | Browser-only string parameters. Exact names `response_type`, `client_id`, `redirect_uri`, `state`, `scope`, `code_challenge`, `code_challenge_method` and `resource` are refused; other names and string values are accepted as before. Remote MCP's [stricter rules](#browser-authorization-parameters) do not apply here.                                                                                                    |
 | `expectedCallbackParameters` | Optional `Readonly<Record<string, string>>` of fixed provider response values. Each configured parameter must occur exactly once with its exact decoded value, after pending-state verification and before issuer validation, flow claims, code exchange, or grant persistence. Missing, duplicate, or mismatched values refuse without exchanging a code or returning parameter values. Omission preserves existing behavior. |
 | `revocationEndpoint`         | Optional trusted HTTPS revocation URL (loopback HTTP allowed), without credentials, query or fragment. Disconnect removes the local grant before one bounded attempt using the configured client. Failure reports `oauth_revocation_failed`; a repeated Disconnect never retries.                                                                                                                                              |
 | `revocationRequestFormat`    | `"form"` by default; `"json"` sends JSON without `token_type_hint`. Requires `revocationEndpoint` when set.                                                                                                                                                                                                                                                                                                                    |
@@ -2585,6 +2627,15 @@ owner's access token as `Authorization: Bearer` with these rules:
 - The answer's `.text()` and `.json()`, clones' too, decode its bytes as UTF-8, so
   workerd never quotes a downstream's Content-Type in its own log.
 
+`api()` already supports `oauth.authorizationParams` through the same OAuth
+provider and browser-only injection. It keeps its existing, more permissive
+validation (see the `api()` option table), so existing configurations still
+construct. Use only GET query response modes with it. Its existing binding remains
+unchanged: the token endpoint identifies the grant; scope, client identity,
+and authorization parameters do not add a stored client configuration binding.
+Changing authorization parameters affects new consents; reconnect to obtain a
+grant with different consent settings.
+
 The grant record and consents, epoch fencing, vault sealing, shared/personal ownership,
 callback state/principal checks, `authorize_connector`, Connect, Restart, and
 Disconnect match `remoteMcp()`. Status calls report a stored grant for the
@@ -2603,6 +2654,14 @@ transport, are not stored or described, and a changed token replaces the client.
 This mode refuses cleartext non-loopback origins. Optional `auth.headers` carry
 static protocol/catalog controls and cannot set Authorization.
 
+A resolver may expose `token.invalidate(rejectedToken, ctx): Promise<void>` to
+remove a cached token after a downstream HTTP 401. The hook receives the exact
+token sent by that transport, so it must leave a newer cached token intact.
+Hook failures are withheld and preserve the original 401. Request auth never
+automatically repeats the operation or renews the grant inside the failed
+scope: authorization failure stays latched for that scope. A new request resolves
+the callback again. In particular, no dispatched write is replayed.
+
 The GitHub provider validates each tool's owner/repo and scope access before
 resolving an installation token. It creates one token-bound MCP client for that
 operation and closes it before returning. Completed installation/token caches
@@ -2613,6 +2672,134 @@ is retained across requests, and rejected writes are never replayed. An omitted
 `describe()` includes neither the key nor the minted tokens. The maintained
 provider skill explains App permissions and installation prerequisites.
 
+### Google service-account tokens and hosted MCP
+
+Import `googleServiceAccountToken` from `@zackbart/connecta/google` to connect a
+Google hosted MCP server using a service-account JSON key on Node or Workers.
+This optional subpath is outside the root import graph. Supply deployment secrets
+through the environment or platform secret store:
+
+```ts
+import { remoteMcp } from "@zackbart/connecta";
+import { googleServiceAccountToken } from "@zackbart/connecta/google";
+
+const warehouse = remoteMcp("warehouse", {
+  url: "https://bigquery.googleapis.com/mcp",
+  authScope: "shared",
+  auth: {
+    type: "request",
+    token: googleServiceAccountToken({
+      serviceAccount: env.GOOGLE_SERVICE_ACCOUNT_JSON,
+      scopes: ["https://www.googleapis.com/auth/bigquery"],
+    }),
+  },
+});
+
+const warehousePersonal = remoteMcp("warehouse_personal", {
+  url: "https://bigquery.googleapis.com/mcp",
+  authScope: "personal",
+  auth: {
+    type: "oauth",
+    scope: "https://www.googleapis.com/auth/bigquery",
+    authorizationParams: { access_type: "offline", prompt: "consent" },
+    client: {
+      issuer: "https://accounts.google.com",
+      clientId: env.GOOGLE_CLIENT_ID,
+      clientSecret: env.GOOGLE_CLIENT_SECRET,
+      tokenEndpointAuthMethod: "client_secret_post",
+    },
+  },
+});
+```
+
+`serviceAccount` accepts downloaded JSON text or
+`{ clientEmail, privateKey, clientId? }`; `privateKey` is a PKCS#8 RSA PEM of at
+least 2048 bits. `scopes` must be a non-empty array of HTTPS URLs without
+credentials, whitespace, or fragments. Unknown options fail construction with
+`ConfigError`. An optional fixed `subject: "alice@example.com"` requests
+Workspace domain-wide delegation and requires its admin grant. Omit `subject`
+for BigQuery: the signed assertion then has no `sub` and acts as the service
+account itself. See [Google's service-account grant documentation](https://developers.google.com/identity/protocols/oauth2/service-account).
+
+The helper signs RS256 JWT-bearer assertions and exchanges them at Google's fixed
+token endpoint. It keeps only bounded in-memory token entries, partitioned by
+account, key fingerprint, absent-or-present subject and scope set. Concurrent
+mints share a flight; tokens refresh with a one-minute margin. Keys, assertions
+and tokens are never logged, persisted or described. Bearer tokens use request
+auth's existing secret redaction. A 401 evicts only the rejected token; the next
+request mints again. The failed operation is never automatically repeated.
+
+#### Separate agent and people connections
+
+Grant the shared connection to agent pools (including pools used by Eve agents)
+and the personal connection to pools used by people. Add these entries to the
+existing deployment configuration, keeping its inbound auth, executor, vault and
+storage configuration:
+
+```ts
+connectors: [warehouse, warehousePersonal],
+agents: ["assistant"],
+pools: {
+  warehouse_agents: { tools: ["warehouse"], members: ["agent:assistant"] },
+  warehouse_people: { tools: ["warehouse_personal"], members: ["user_alice"] },
+},
+```
+
+Replace `user_alice` with Alice's admitted principal ID. Agents have no principal;
+`authScope: "personal"` connectors never appear for them, even if included in a
+pool's tools. The shared connection uses its fixed service account for every
+member; the personal connection uses each person's own encrypted OAuth grant.
+People connect through `authorize_connector` or their member page. Follow
+[Add a person](#add-a-person), [agent tokens](#agent-tokens-and-upgrading-from-earlier-tokens)
+and [shared credential ownership](#connect-a-shared-credential) for admission and
+pool membership. The request-token connection gets its key from deployment
+configuration and does not need a credential-vault slot.
+
+#### Google-side setup
+
+1. Enable the BigQuery API in the Google Cloud project and confirm that the
+   BigQuery MCP service is available under the project's organization policies.
+   Google's current setup uses `https://bigquery.googleapis.com/mcp` and API
+   enablement; follow its current server setup if enablement requirements change.
+   Grant the service account MCP Tool User (`roles/mcp.toolUser`) and BigQuery
+   Job User (`roles/bigquery.jobUser`) on the project where queries run.
+   [BigQuery MCP setup and required roles](https://docs.cloud.google.com/bigquery/docs/use-bigquery-mcp).
+2. Grant BigQuery Data Viewer (`roles/bigquery.dataViewer`) on the datasets the
+   service account may query. Dataset grants restrict data access separately
+   from project-level job execution. Grant further permissions only for the
+   operations you intend to expose; OAuth scopes do not replace IAM.
+   [BigQuery IAM roles and grant levels](https://docs.cloud.google.com/bigquery/docs/access-control).
+   Create a service-account JSON key and store it as
+   `GOOGLE_SERVICE_ACCOUNT_JSON` in the deployment secret store; the helper
+   does not use ADC, metadata-server credentials, or workload identity federation.
+   [Service-account key creation](https://docs.cloud.google.com/iam/docs/keys-create-delete).
+3. For the personal connection, configure Google Auth Platform branding,
+   audience and data access. Choose **Internal** for an application restricted to
+   people in your Workspace organization, using a project belonging to that
+   organization. Internal consent does not grant dataset access; each person
+   still needs the applicable IAM permissions.
+   [Configure consent and audience](https://developers.google.com/workspace/guides/configure-oauth-consent).
+4. Create a **Web application** OAuth client under Google Auth Platform → Clients.
+   Register the exact Connecta callback, for example
+   `https://connecta.example/oauth/callback/warehouse_personal`, using the
+   deployment's configured public origin. Store its client ID and secret as
+   deployment secrets. Google's hosted MCP servers do not support DCR or client
+   metadata documents, so configure the static `auth.client` shown above.
+   [Web OAuth client setup](https://docs.cloud.google.com/mcp/set-up-authentication-mcp-servers#web),
+   [Google MCP registration limitations](https://docs.cloud.google.com/mcp/authenticate-mcp#limitations).
+
+The pre-registered client path supports Google's exact issuer and
+`client_secret_post`; Google's [discovery document](https://accounts.google.com/.well-known/openid-configuration)
+advertises that method, PKCE S256, and `https://oauth2.googleapis.com/token`.
+The personal example requests `access_type=offline` to obtain a refresh token
+and `prompt=consent` to show consent again when reconnecting. See
+[Google's offline-access requirements](https://developers.google.com/identity/protocols/oauth2/web-server#offline).
+Connecta retains the stored refresh token when a successful refresh response
+omits `refresh_token`, allowing later refreshes with that same token. After
+adding these parameters to an existing connector, Disconnect and reconnect.
+Live Google consent and project-specific permissions still need verification
+against the operator's project.
+
 ## Contributor reference
 
 ### INV-5 output redaction limits

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@zackbart/connecta",
-  "version": "0.36.1",
+  "version": "0.36.2",
   "type": "module",
   "sideEffects": false,
   "description": "One MCP to rule them all — a single MCP endpoint aggregating many downstream connectors behind a code-first surface of six meta-tools.",
@@ -162,6 +162,10 @@
     "./worker": {
       "types": "./dist/worker.d.ts",
       "import": "./dist/worker.js"
+    },
+    "./google": {
+      "types": "./dist/google.d.ts",
+      "import": "./dist/google.js"
     }
   },
   "scripts": {

package/templates/node/package.json

@@ -18,7 +18,7 @@
   },
   "dependencies": {
     "@clerk/backend": "^3.12.0",
-    "@zackbart/connecta": "0.36.1",
+    "@zackbart/connecta": "0.36.2",
     "quickjs-emscripten": "0.32.0",
     "undici": "6.29.1"
   },