mcp-google-multi 6.0.0-alpha.54 → 6.0.0-alpha.56

package/dist/accounts.d.ts

@@ -20,6 +20,7 @@ export interface AccountSet {
 }
 export declare function resolveAccounts(env?: NodeJS.ProcessEnv, filePath?: string, onInvalid?: 'exit' | 'throw', opts?: {
     tokenDir?: string;
+    emptyOk?: boolean;
 }): AccountSet;
 export declare function fileStamp(filePath: string, version: number): string;
 /** Live accessor: dispatch-time readers use this, never a captured snapshot. */

package/dist/accounts.js

@@ -3,7 +3,7 @@ import fs from 'node:fs';
 import { z } from 'zod';
 import { loadEnvFiles } from './env-load.js';
 import { ALIAS_RE, CONFIG_VERSION, configDir, configFilePath, failStartup, isReservedAlias, loadConfigFile, mutateConfigFile } from './config-file.js';
-import { BUNDLE_CATALOG, closestBundle, resolveBundleAliases } from './scope-catalog.js';
+import { closestBundle, isKnownBundle, resolveBundleAliases } from './scope-catalog.js';
 const envLoad = loadEnvFiles();
 const defaultTokenDir = path.join(configDir(), 'tokens');
 const tokenDir = process.env.TOKEN_STORE_PATH
@@ -74,7 +74,10 @@ function noAccountsMessage() {
  * empty behaves as unset, mirroring GOOGLE_ACCOUNTS semantics.
  */
 let warnedLegacy = false;
-export function resolveAccounts(env = process.env, filePath = configFilePath(), onInvalid = 'exit', opts = {}) {
+export function resolveAccounts(env = process.env, filePath = configFilePath(), onInvalid = 'exit', 
+// emptyOk: zero accounts is a valid set, not an error, even with 'throw'
+// (a context that has linked nothing yet). An invalid file still fails.
+opts = {}) {
     const dir = opts.tokenDir ?? tokenDir;
     const adminEnv = parseCsv(env.GOOGLE_ADMIN_ACCOUNTS);
     const rawEnv = env.GOOGLE_ACCOUNTS;
@@ -92,7 +95,7 @@ export function resolveAccounts(env = process.env, filePath = configFilePath(),
             if (bundle === 'admin') {
                 fail('E_UNKNOWN_BUNDLE', '"admin" is not a global bundle: grant it per account via GOOGLE_ADMIN_ACCOUNTS or an "admin: true" scope profile.');
             }
-            if (!(bundle in BUNDLE_CATALOG)) {
+            if (!isKnownBundle(bundle)) {
                 const hint = closestBundle(bundle);
                 fail('E_UNKNOWN_BUNDLE', `unknown bundle "${bundle}" in GOOGLE_OPTIONAL_SCOPES${hint ? ` — did you mean "${hint}"?` : ''}`);
             }
@@ -130,7 +133,7 @@ export function resolveAccounts(env = process.env, filePath = configFilePath(),
         // empty (BR-4), enforced by assertServerAccountsConfigured() in index.ts.
         // The dispatch-path reload ('throw') still throws so a mid-session emptied
         // config.json keeps the last-good registry (BR-7) instead of dropping tools.
-        if (onInvalid === 'throw') {
+        if (onInvalid === 'throw' && !opts.emptyOk) {
             throw new Error(`E_NO_ACCOUNTS_CONFIGURED: ${noAccountsMessage()}`);
         }
         return {
@@ -149,7 +152,7 @@ export function resolveAccounts(env = process.env, filePath = configFilePath(),
     for (const [name, profile] of Object.entries(config?.scopeProfiles ?? {})) {
         const bundles = resolveBundleAliases(profile.bundles);
         for (const bundle of bundles) {
-            if (!(bundle in BUNDLE_CATALOG)) {
+            if (!isKnownBundle(bundle)) {
                 const hint = closestBundle(bundle);
                 fail('E_UNKNOWN_BUNDLE', `unknown bundle "${bundle}" in scope profile "${name}"${hint ? ` — did you mean "${hint}"?` : ''}`);
             }

package/dist/auth.js

@@ -1,7 +1,7 @@
 import { randomBytes } from 'node:crypto';
 import { openUrl } from './open-url.js';
 import { ACCOUNTS, getAccountSet } from './accounts.js';
-import { ADMIN_SCOPES, BUNDLE_CATALOG, closestBundle, resolveBundleAliases } from './scope-catalog.js';
+import { ADMIN_SCOPES, BUNDLE_CATALOG, closestBundle, isKnownBundle, resolveBundleAliases } from './scope-catalog.js';
 import { resolveMasterKey } from './master-key.js';
 import { writeToken } from './token-store.js';
 import { buildConsentClient, openLoopbackConsent, TESTING_MODE_WARNING } from './oauth-consent.js';
@@ -48,7 +48,7 @@ function legacyGlobalProfile() {
         if (bundle === 'admin') {
             throw new Error('E_UNKNOWN_BUNDLE: "admin" is not a global bundle: grant it per account via GOOGLE_ADMIN_ACCOUNTS or an "admin: true" scope profile.');
         }
-        if (!(bundle in BUNDLE_CATALOG)) {
+        if (!isKnownBundle(bundle)) {
             const hint = closestBundle(bundle);
             throw new Error(`E_UNKNOWN_BUNDLE: unknown bundle "${bundle}" in GOOGLE_OPTIONAL_SCOPES${hint ? ` — did you mean "${hint}"?` : ''}`);
         }

package/dist/compose.d.ts

@@ -1,5 +1,11 @@
 import type { McpServer } from "@modelcontextprotocol/server";
+import type { ServerTarget } from './http-transport.js';
 import { ToolRegistry, type DiscoveryMode } from './registry.js';
 import { type IdentityContext } from './identity.js';
 import type { Metrics } from './usage-metrics.js';
 export declare function buildRegistry(server: McpServer, ctx: IdentityContext, mode?: DiscoveryMode, metrics?: Metrics | null): ToolRegistry;
+/** The per-request hooks bound to one registry: argument shapes, unknown-
+ * argument screening and the account a validation envelope names. Both
+ * transports and every resolved server target build them here, so a mistyped
+ * argument behaves the same wherever it arrives. */
+export declare function requestHooksFor(registry: ToolRegistry, ctx: Pick<IdentityContext, 'accounts'>, metrics?: Metrics | null, env?: NodeJS.ProcessEnv): Omit<ServerTarget, 'server'>;

package/dist/compose.js

@@ -4,7 +4,9 @@
 // parsing, no process.exit, no prints (accounts.js module-load resolution is
 // the one inherited, pre-existing exception on the import chain).
 import { GENERATED_SERVICES } from './tools/generated/index.js';
-import { GENERATED_GATES, SERVICES } from './services.js';
+import { GENERATED_GATES, SERVICES, unknownToolMessage } from './services.js';
+import { argNormalizationEnabled } from './arg-normalize.js';
+import { unknownArgMode } from './arg-strict.js';
 import { ToolRegistry } from './registry.js';
 import { registerDiscoverTools } from './discover.js';
 import { registerEscapeTools } from './tools/google-api.js';
@@ -82,3 +84,26 @@ export function buildRegistry(server, ctx, mode, metrics = null) {
         registerAccountWizardTools(registry, server);
     return registry;
 }
+/** The per-request hooks bound to one registry: argument shapes, unknown-
+ * argument screening and the account a validation envelope names. Both
+ * transports and every resolved server target build them here, so a mistyped
+ * argument behaves the same wherever it arrives. */
+export function requestHooksFor(registry, ctx, metrics = null, env = process.env) {
+    const mode = unknownArgMode(env);
+    return {
+        argShapeFor: argNormalizationEnabled(env) ? (tool) => registry.argShape(tool) : undefined,
+        strictArgs: mode === 'off'
+            ? undefined
+            : {
+                mode,
+                declaredFor: (tool) => registry.declaredKeys(tool),
+                siblingsFor: (tool, keys) => registry.siblingSpellings(tool, keys),
+                unknownTool: (name) => unknownToolMessage(registry, name),
+                onDrop: metrics ? (tool, keys) => metrics.recordArgDrop(tool, keys) : undefined,
+            },
+        validationEnvelope: {
+            isKnownTool: (name) => registry.hasTool(name),
+            defaultAccount: () => ctx.accounts.defaultAccount,
+        },
+    };
+}

package/dist/http-transport.d.ts

@@ -15,6 +15,16 @@ export type AuthOutcome = {
 export type Authenticator = (req: IncomingMessage) => AuthOutcome | Promise<AuthOutcome>;
 /** A mounted extra route (the AS endpoints, B13). Return true if it wrote a response. */
 export type RouteHandler = (req: IncomingMessage, res: ServerResponse, url: URL) => boolean | Promise<boolean>;
+/** What a verified subject resolves to: ITS server plus the per-request hooks
+ * bound to that server's registry (tool shapes, declared keys, the default
+ * account a validation envelope names). The metrics observers (metricsTap,
+ * onArgRename) stay host-wide and must not be bound to any one registry. */
+export interface ServerTarget {
+    server: McpServer;
+    argShapeFor?: (tool: string) => ArgShape | undefined;
+    strictArgs?: StrictArgOptions;
+    validationEnvelope?: ValidationEnvelopeOptions;
+}
 export interface HttpHostOptions {
     /** The ONE McpServer + registry built at boot (P1 / BV gap #4: never per request). */
     server: McpServer;
@@ -25,14 +35,13 @@ export interface HttpHostOptions {
     /** Tenant-resolution seam: map the verified subject to ITS server. Absent
      * (free core) = every request dispatches to the one boot `server`. Return
      * null for an unknown subject -> 403 tenant_not_found. Each distinct
-     * resolved server gets its own serialize key. */
+     * resolved server gets its own dispatch lane. With a resolver, the
+     * per-request hooks come from the resolved target ONLY: the host-level
+     * argShapeFor / strictArgs / validationEnvelope describe the boot server's
+     * registry, never another subject's. */
     resolveServer?: (claims: {
         sub: string;
-    }) => Promise<{
-        server: McpServer;
-    } | null> | {
-        server: McpServer;
-    } | null;
+    }) => Promise<ServerTarget | null> | ServerTarget | null;
     /** Extra routes keyed by exact pathname (AS endpoints mount here in B13). */
     routes?: Record<string, RouteHandler>;
     log?: (line: string) => void;

package/dist/http-transport.js

@@ -43,12 +43,12 @@ export function jsonRpcMethod(body) {
 export class HttpTransportHost {
     opts;
     httpServer;
-    // Serialize the connect→dispatch critical section PER KEY: a McpServer
+    // Serialize the connect→dispatch critical section PER SERVER: a McpServer
     // captures its transport per request (protocol.js), but the gap between
     // connect() and the dispatch capturing it would still race under true
     // concurrency, so all traffic to ONE server runs under one mutex. The free
-    // core uses a single key (one boot server); with resolveServer each subject
-    // gets its own server and therefore its own independent lock lane.
+    // core has one lane (the boot server); with resolveServer each resolved
+    // server gets its own, however subjects map onto servers.
     locks = new Map();
     constructor(opts) {
         this.opts = opts;
@@ -56,7 +56,15 @@ export class HttpTransportHost {
     serializeFor(key, fn) {
         const prev = this.locks.get(key) ?? Promise.resolve();
         const run = prev.then(fn, fn);
-        this.locks.set(key, run.then(() => undefined, () => undefined));
+        const tail = run.then(() => undefined, () => undefined);
+        this.locks.set(key, tail);
+        // An idle lane drops out, so the map holds only in-flight subjects rather
+        // than every subject ever seen. A request that chained on this tail has
+        // already replaced it, so the identity check never frees a live lane.
+        void tail.then(() => {
+            if (this.locks.get(key) === tail)
+                this.locks.delete(key);
+        });
         return run;
     }
     log(line) {
@@ -154,7 +162,12 @@ export class HttpTransportHost {
         const sub = auth.sub ?? 'owner';
         // Tenant resolution (the seam EE fills): map the verified subject to ITS
         // server. Absent resolver = the one boot server for every subject.
-        let target = { server: this.opts.server };
+        let target = {
+            server: this.opts.server,
+            argShapeFor: this.opts.argShapeFor,
+            strictArgs: this.opts.strictArgs,
+            validationEnvelope: this.opts.validationEnvelope,
+        };
         if (this.opts.resolveServer) {
             try {
                 target = await this.opts.resolveServer({ sub });
@@ -204,12 +217,11 @@ export class HttpTransportHost {
         // releases. (A shared initialized-state persists across stateless requests;
         // benign for the single-owner design.)
         const deadlineMs = this.opts.dispatchTimeoutMs ?? DISPATCH_TIMEOUT_DEFAULT;
-        // The lock lane must match the SERVER identity, not the subject: without a
-        // resolver every subject shares the one boot server, so keying on sub
-        // would let two subjects race one server through the connect gap.
-        const serializeKey = this.opts.resolveServer ? sub : '__single__';
-        const mcpServer = target.server;
-        await this.serializeFor(serializeKey, async () => {
+        // The lock lane is the SERVER identity, never the subject: two subjects
+        // reaching one server (the boot server, or a resolver mapping several
+        // subjects to one) would otherwise race it through the connect gap.
+        const { server: mcpServer, argShapeFor, strictArgs, validationEnvelope } = target;
+        await this.serializeFor(mcpServer, async () => {
             const disconnected = new Promise((resolve) => res.once('close', () => resolve('closed')));
             let timer;
             const timedOut = new Promise((resolve) => {
@@ -218,10 +230,10 @@ export class HttpTransportHost {
             });
             // Same composition as the stdio leg: the envelope rewrite is innermost,
             // so the tap above it still classifies the original validation prose.
-            const enveloped = withValidationEnvelope(transport, this.opts.validationEnvelope ?? {});
+            const enveloped = withValidationEnvelope(transport, validationEnvelope ?? {});
             const tapped = this.opts.metricsTap ? this.opts.metricsTap(enveloped) : enveloped;
-            await mcpServer.connect(this.opts.argShapeFor || this.opts.strictArgs
-                ? withArgNormalization(tapped, this.opts.argShapeFor ?? (() => undefined), this.opts.log, this.opts.onArgRename, this.opts.strictArgs)
+            await mcpServer.connect(argShapeFor || strictArgs
+                ? withArgNormalization(tapped, argShapeFor ?? (() => undefined), this.opts.log, this.opts.onArgRename, strictArgs)
                 : tapped);
             // Reflect the dispatch into a non-rejecting arm: if the deadline wins the
             // race, an orphaned handler settling later must not surface as an unhandled

package/dist/index.js

@@ -1,42 +1,26 @@
 #!/usr/bin/env node
 // First import: triggers accounts.js module load (env files + registry) before
 // anything else. Named to also pull the server-only empty-registry guard (BR-4).
-import { assertServerAccountsConfigured, getAccountSet } from './accounts.js';
+import { assertServerAccountsConfigured } from './accounts.js';
 import { accountsAssertRequired, assertNoEnvAccountsMode, assertNoEnvOptionalScopesMode, isMultiTenantBoot, mtBootGates } from './boot-gates.js';
 import { readFileSync } from 'node:fs';
 import { fileURLToPath } from 'node:url';
 import path from 'node:path';
 import { StdioServerTransport } from "@modelcontextprotocol/server/stdio";
 import { McpServer } from "@modelcontextprotocol/server";
-import { unknownToolMessage } from './services.js';
 import { resolveDiscoveryMode } from './registry.js';
 import { isAllowed, describePolicy } from './write-control.js';
 import { buildIdentityContext } from './identity.js';
-import { buildRegistry } from './compose.js';
+import { buildRegistry, requestHooksFor } from './compose.js';
 import { registerSetupPrompt } from './setup-prompt.js';
 import { applyNetTuning } from './net-tuning.js';
-import { argNormalizationEnabled, withArgNormalization, withValidationEnvelope } from './arg-normalize.js';
-import { unknownArgMode } from './arg-strict.js';
+import { withArgNormalization, withValidationEnvelope } from './arg-normalize.js';
 import { envValueSource } from './env-load.js';
 import { loadConfigFile } from './config-file.js';
 import { initUsageMetrics, resolveUsageMetrics, sourceLabel } from './usage-metrics.js';
 applyNetTuning();
 const __dirname = path.dirname(fileURLToPath(import.meta.url));
 const pkg = JSON.parse(readFileSync(path.resolve(__dirname, '..', 'package.json'), 'utf-8'));
-/** Unknown-argument screening options, or undefined when the feature is off.
- * Shared by both transports so a mistyped argument behaves identically. */
-function strictArgOptions(registry, metrics) {
-    const mode = unknownArgMode();
-    if (mode === 'off')
-        return undefined;
-    return {
-        mode,
-        declaredFor: (tool) => registry.declaredKeys(tool),
-        siblingsFor: (tool, keys) => registry.siblingSpellings(tool, keys),
-        unknownTool: (name) => unknownToolMessage(registry, name),
-        onDrop: metrics ? (tool, keys) => metrics.recordArgDrop(tool, keys) : undefined,
-    };
-}
 async function main() {
     if (process.argv.includes('auth')) {
         const { runAuthFlow } = await import('./auth.js');
@@ -208,30 +192,28 @@ async function main() {
     if (wantStdio) {
         const server = new McpServer({ name: 'mcp-google-multi', version: pkg.version });
         const stdioMetrics = initMetricsFor('stdio', resolveDiscoveryMode());
-        const registry = buildRegistry(server, buildIdentityContext(process.env, { transport: 'stdio' }), undefined, stdioMetrics);
+        const stdioCtx = buildIdentityContext(process.env, { transport: 'stdio' });
+        const registry = buildRegistry(server, stdioCtx, undefined, stdioMetrics);
         registry.installListHandler();
         registerSetupPrompt(server);
+        const stdioHooks = requestHooksFor(registry, stdioCtx, stdioMetrics);
         // Outbound runs outermost-first, so the composition is deliberate: the
         // envelope rewrite is INNERMOST (last to touch the frame), the tap sits
         // above it (classifying the ORIGINAL validation prose), arg normalization
         // outermost. The tap only counts outbound JSON-RPC error frames (no
         // handler ran) plus id->tool names.
-        let transport = withValidationEnvelope(new StdioServerTransport(), {
-            isKnownTool: (n) => registry.hasTool(n),
-            defaultAccount: () => getAccountSet().defaultAccount,
-        });
+        let transport = withValidationEnvelope(new StdioServerTransport(), stdioHooks.validationEnvelope);
         if (stdioMetrics) {
             const { tapUsageMetrics } = await import('./metrics-tap.js');
             transport = tapUsageMetrics(transport, stdioMetrics, (n) => registry.hasTool(n));
         }
-        const strictStdio = strictArgOptions(registry, stdioMetrics);
-        await server.connect(argNormalizationEnabled() || strictStdio
+        await server.connect(stdioHooks.argShapeFor || stdioHooks.strictArgs
             ? withArgNormalization(transport, 
             // Gated exactly as the HTTP leg gates `argShapeFor`. Passing the
             // shape unconditionally made stdio rename keys while
             // GOOGLE_ARG_NORMALIZE=off, so the same call succeeded on stdio
             // and failed on HTTP once screening rejects.
-            argNormalizationEnabled() ? (n) => registry.argShape(n) : () => undefined, undefined, stdioMetrics ? (tool, n) => stdioMetrics.recordArgFix(tool, n) : undefined, strictStdio)
+            stdioHooks.argShapeFor ?? (() => undefined), undefined, stdioMetrics ? (tool, n) => stdioMetrics.recordArgFix(tool, n) : undefined, stdioHooks.strictArgs)
             : transport);
     }
     if (wantHttp) {
@@ -259,11 +241,12 @@ async function main() {
         }
         const httpServer = new McpServer({ name: 'mcp-google-multi', version: pkg.version });
         const httpMetrics = initMetricsFor('http', 'curated');
-        const registry = buildRegistry(httpServer, buildIdentityContext(process.env, { transport: 'http' }), 'curated', httpMetrics);
+        const httpCtx = buildIdentityContext(process.env, { transport: 'http' });
+        const registry = buildRegistry(httpServer, httpCtx, 'curated', httpMetrics);
         registry.installListHandler();
         registerSetupPrompt(httpServer);
         // B13: mount the OAuth 2.1 AS (legs A + B) + the Bearer authenticator.
-        const { buildAuthServer } = await import('./oauth-as.js');
+        const { buildAuthServer, verifiedEmailFromIdToken } = await import('./oauth-as.js');
         const { jwtSecretFrom } = await import('./mcp-token.js');
         const { resolveJwtKey, resolveMasterKeyForDispatch } = await import('./master-key.js');
         const { OAuth2Client } = await import('googleapis-common');
@@ -272,20 +255,6 @@ async function main() {
         const { configDir } = await import('./config-file.js');
         const { getAccountSet } = await import('./accounts.js');
         const googleClient = () => new OAuth2Client(process.env.GOOGLE_CLIENT_ID, process.env.GOOGLE_CLIENT_SECRET, `${httpCfg.publicUrl}/callback`);
-        // Only trust the id_token email when Google marks it verified (#8).
-        const verifiedEmailFromIdToken = (idToken) => {
-            if (!idToken)
-                return undefined;
-            try {
-                const [, payload] = idToken.split('.');
-                const claims = JSON.parse(Buffer.from(payload, 'base64url').toString('utf-8'));
-                const verified = claims.email_verified === true || claims.email_verified === 'true';
-                return verified ? claims.email : undefined;
-            }
-            catch {
-                return undefined;
-            }
-        };
         const authServer = buildAuthServer({
             base: httpCfg.publicUrl,
             resourceUri: httpCfg.resourceUri,
@@ -326,8 +295,7 @@ async function main() {
         const { setHttpReauthBase } = await import('./reauth-hint.js');
         setHttpReauthBase(httpCfg.publicUrl);
         // Wizard consent over HTTP: hand out the clientless AS link instead of
-        // binding a loopback listener (single-owner flow; a tenancy host installs
-        // its own signed-mint context here).
+        // binding a loopback listener.
         const { setWizardHttpConsent } = await import('./tools/account-wizard.js');
         setWizardHttpConsent({
             mintConsentUrl: (alias) => `${httpCfg.publicUrl}/authorize?flow=alias_reauth&alias=${encodeURIComponent(alias)}`,
@@ -345,14 +313,9 @@ async function main() {
             authenticate: authServer.authenticate,
             routes: authServer.routes,
             log: (l) => process.stderr.write(`[http] ${l}\n`),
-            argShapeFor: argNormalizationEnabled() ? (n) => registry.argShape(n) : undefined,
+            ...requestHooksFor(registry, httpCtx, httpMetrics),
             metricsTap: httpTap,
-            validationEnvelope: {
-                isKnownTool: (n) => registry.hasTool(n),
-                defaultAccount: () => getAccountSet().defaultAccount,
-            },
             onArgRename: httpMetrics ? (tool, n) => httpMetrics.recordArgFix(tool, n) : undefined,
-            strictArgs: strictArgOptions(registry, httpMetrics),
         });
         await host.start();
         process.stderr.write(`HTTP transport listening on http://${httpCfg.host}:${httpCfg.port} (public ${httpCfg.publicUrl})\n`);

package/dist/mcp-token.d.ts

@@ -32,6 +32,9 @@ export interface StatePayload {
     tenantId?: string;
     /** alias_add only: scope bundles chosen when the link was minted. */
     bundles?: string[];
+    /** alias_add only: an opaque value the minting caller chose, signed like
+     * tenantId and handed back to its binder (e.g. a server-side link record). */
+    nonce?: string;
 }
 export interface CodePayload {
     redirect_uri: string;

package/dist/migrate-config.js

@@ -1,5 +1,5 @@
 import { CONFIG_VERSION, configFilePath, loadConfigFile, mutateConfigFile } from './config-file.js';
-import { BUNDLE_CATALOG, closestBundle, resolveBundleAliases } from './scope-catalog.js';
+import { closestBundle, isKnownBundle, resolveBundleAliases } from './scope-catalog.js';
 function parseCsv(value) {
     return (value ?? '').split(',').map((s) => s.trim()).filter(Boolean);
 }
@@ -47,7 +47,7 @@ export function runMigrateConfig(env = process.env) {
                 process.exitCode = 1;
                 return;
             }
-            if (!(bundle in BUNDLE_CATALOG)) {
+            if (!isKnownBundle(bundle)) {
                 const hint = closestBundle(bundle);
                 console.error(`E_UNKNOWN_BUNDLE: unknown bundle "${bundle}" in GOOGLE_OPTIONAL_SCOPES${hint ? ` — did you mean "${hint}"?` : ''}. Nothing written.`);
                 process.exitCode = 1;

package/dist/oauth-as.d.ts

@@ -22,6 +22,27 @@ export interface AuthServerConfig {
      * cross-tenant re-auth vector. Server-minted signed flows are unaffected. */
     legacyAliasReauth?: boolean;
 }
+/** What /callback hands the alias_add binder once Google returned a verified
+ * identity for a server-minted link. */
+export interface TenantAliasBind {
+    tenantId: string;
+    alias: string;
+    email: string;
+    bundles?: string[];
+    nonce?: string;
+    tokens: Record<string, unknown>;
+}
+/** A binder's deliberate refusal (policy, not failure): /callback answers 403
+ * with this slug and message. The message reaches an unauthenticated browser. */
+export interface AliasBindRefusal {
+    refused: {
+        slug: string;
+        message: string;
+    };
+}
+/** Only trust the id_token email when Google marks it verified (#8). The token
+ * comes straight from Google's token endpoint, so its claims are read unsigned. */
+export declare function verifiedEmailFromIdToken(idToken?: string | null): string | undefined;
 export interface AuthServerDeps {
     fetchCimd?: (clientId: string) => Promise<Record<string, unknown>>;
     /** Exchange a Google auth code at `${base}/callback` for tokens (+ owner email). */
@@ -34,6 +55,7 @@ export interface AuthServerDeps {
         flow: StatePayload['flow'];
         alias?: string;
         state: string;
+        bundles?: string[];
     }) => string;
     writeToken?: (alias: string, tokens: Record<string, unknown>) => void;
     registeredClients?: Map<string, {
@@ -52,16 +74,11 @@ export interface AuthServerDeps {
     resolveSubject?: (email: string) => {
         sub: string;
     } | null;
-    /** alias_add completion: persist the config row AND the tokens for the new
-     * alias under its tenant in ONE call, atomically — /callback invokes it only
-     * after a successful Google exchange, so no pre-write orphan can exist. */
-    bindTenantAlias?: (bind: {
-        tenantId: string;
-        alias: string;
-        email: string;
-        bundles?: string[];
-        tokens: Record<string, unknown>;
-    }) => void;
+    /** alias_add completion: persist the new alias's config row and tokens under
+     * its tenant. /callback awaits it only after a successful Google exchange.
+     * A returned refusal answers 403 with its slug; a throw or rejection answers
+     * 500 E_ALIAS_ADD_FAILED. */
+    bindTenantAlias?: (bind: TenantAliasBind) => void | AliasBindRefusal | Promise<void | AliasBindRefusal>;
 }
 export interface AuthServer {
     routes: Record<string, RouteHandler>;
@@ -69,12 +86,13 @@ export interface AuthServer {
     /** Mint a signed, single-use, TTL-bound clientless flow URL
      * (`${base}/authorize?flow=...&state=<signed>`). The tenantId/bundles ride
      * INSIDE the signed state, so nothing at /authorize or /callback trusts a
-     * caller-supplied identity. Inert unless something calls it (EE wizard). */
+     * caller-supplied identity. Inert unless something calls it. */
     mintFlowState: (opts: {
         flow: 'alias_add' | 'alias_reauth';
         alias: string;
         tenantId?: string;
         bundles?: string[];
+        nonce?: string;
     }) => Promise<string>;
 }
 /** C6: exact redirect_uri match, with RFC 8252 §7.3 port-agnostic loopback and

package/dist/oauth-as.js

@@ -17,6 +17,21 @@ const CLAUDE_AI_FIXED_CALLBACK = 'https://claude.ai/api/mcp/auth_callback';
 export const DCR_MAX_CLIENTS = 1000;
 export const DCR_MAX_REDIRECT_URIS = 10;
 const DCR_MAX_URI_LEN = 2048;
+/** Only trust the id_token email when Google marks it verified (#8). The token
+ * comes straight from Google's token endpoint, so its claims are read unsigned. */
+export function verifiedEmailFromIdToken(idToken) {
+    if (!idToken)
+        return undefined;
+    try {
+        const [, payload] = idToken.split('.');
+        const claims = JSON.parse(Buffer.from(payload, 'base64url').toString('utf-8'));
+        const verified = claims.email_verified === true || claims.email_verified === 'true';
+        return verified ? claims.email : undefined;
+    }
+    catch {
+        return undefined;
+    }
+}
 // --- helpers ----------------------------------------------------------------
 function json(res, status, body, extraHeaders = {}) {
     res.writeHead(status, { 'Content-Type': 'application/json', ...extraHeaders });
@@ -203,7 +218,7 @@ export function buildAuthServer(config, deps = {}) {
     async function toGoogle(res, sp) {
         const state = await signState(sp, base, secret, nowSec());
         const authUrl = deps.buildGoogleAuthUrl
-            ? deps.buildGoogleAuthUrl({ flow: sp.flow, alias: sp.alias, state })
+            ? deps.buildGoogleAuthUrl({ flow: sp.flow, alias: sp.alias, state, bundles: sp.bundles })
             : `https://accounts.google.com/o/oauth2/v2/auth?state=${encodeURIComponent(state)}`;
         return redirect(res, authUrl);
     }
@@ -356,16 +371,26 @@ export function buildAuthServer(config, deps = {}) {
             const boundEmail = (exchanged.email ?? '').toLowerCase();
             if (!boundEmail)
                 return errorPage(res, 403, 'access_denied', 'Google did not return an email for the signed-in account');
+            let refusal;
             try {
-                deps.bindTenantAlias({ tenantId: st.tenantId, alias: st.alias, email: boundEmail, bundles: st.bundles, tokens: exchanged.tokens });
+                const out = await deps.bindTenantAlias({ tenantId: st.tenantId, alias: st.alias, email: boundEmail, bundles: st.bundles, nonce: st.nonce, tokens: exchanged.tokens });
+                refusal = out?.refused;
             }
             catch (e) {
-                log(`alias_add bind failed for "${st.alias}": ${e.message}`);
+                // Any rejection reason, even none, must still reach this answer.
+                log(`alias_add bind failed for "${st.alias}": ${e instanceof Error ? e.message : typeof e === 'string' ? e : 'non-Error rejection'}`);
                 return errorPage(res, 500, 'E_ALIAS_ADD_FAILED', 'the account could not be saved; try the link again or ask for a fresh one');
             }
+            if (refusal) {
+                // The slug lands in a text/plain body; keep it a bare identifier.
+                const slug = typeof refusal.slug === 'string' && /^[A-Za-z0-9_]+$/.test(refusal.slug) ? refusal.slug : 'access_denied';
+                const message = typeof refusal.message === 'string' && refusal.message ? refusal.message : 'the account could not be linked';
+                log(`alias_add refused for "${st.alias}": ${slug}`);
+                return errorPage(res, 403, slug, message);
+            }
             log(`callback ok flow=alias_add alias=${st.alias}`);
             res.writeHead(200, { 'Content-Type': 'text/html' });
-            res.end(`<!doctype html><meta charset=utf-8><p>Connected "${st.alias}". You can close this window and retry your request.</p>`);
+            res.end(`<!doctype html><meta charset=utf-8><p>Connected "${escapeHtml(st.alias)}". You can close this window and retry your request.</p>`);
             return true;
         }
         if (st.flow === 'alias_reauth') {
@@ -385,7 +410,7 @@ export function buildAuthServer(config, deps = {}) {
             deps.writeToken?.(st.alias, exchanged.tokens);
             log(`callback ok flow=alias_reauth alias=${st.alias}`);
             res.writeHead(200, { 'Content-Type': 'text/html' });
-            res.end(`<!doctype html><meta charset=utf-8><p>Re-authenticated "${st.alias}". You can close this window.</p>`);
+            res.end(`<!doctype html><meta charset=utf-8><p>Re-authenticated "${escapeHtml(st.alias)}". You can close this window.</p>`);
             return true;
         }
         // owner_gate: resolve the verified email to its subject (default = the
@@ -503,8 +528,8 @@ export function buildAuthServer(config, deps = {}) {
             return { ok: false, status: 401, headers: { 'WWW-Authenticate': wwwAuth }, body: JSON.stringify({ error: 'E_MCP_TOKEN_INVALID', message: 'invalid or expired token' }) };
         }
     };
-    const mintFlowState = async ({ flow, alias, tenantId, bundles }) => {
-        const state = await signState({ flow, client_id: '', redirect_uri: '', code_challenge: '', resource, alias, tenantId, bundles }, base, secret, nowSec());
+    const mintFlowState = async ({ flow, alias, tenantId, bundles, nonce }) => {
+        const state = await signState({ flow, client_id: '', redirect_uri: '', code_challenge: '', resource, alias, tenantId, bundles, nonce }, base, secret, nowSec());
         return `${base}/authorize?flow=${flow}&state=${encodeURIComponent(state)}`;
     };
     return { routes, authenticate, mintFlowState };

package/dist/scope-catalog.d.ts

@@ -14,6 +14,9 @@ export declare const BUNDLE_CATALOG: Record<string, BundleCatalogEntry>;
 /** One-way soft-rename map (UD5): empty at 6.0.0; the mechanism ships now so a
  * future rename is a deprecation warning, never a breaking config change. */
 export declare const BUNDLE_ALIASES: Record<string, string>;
+/** Bundle names are user input: an Object.prototype member ("constructor",
+ * "toString") passes a plain `in` or index lookup, so membership is own-key only. */
+export declare function isKnownBundle(name: string): boolean;
 export declare function resolveBundleAliases(bundles: string[]): string[];
 /** Closest catalog key for E_UNKNOWN_BUNDLE remediation (edit distance <= 2). */
 export declare function closestBundle(name: string): string | undefined;

package/dist/scope-catalog.js

@@ -160,9 +160,14 @@ export const BUNDLE_CATALOG = {
  * future rename is a deprecation warning, never a breaking config change. */
 export const BUNDLE_ALIASES = {};
 const warnedAliases = new Set();
+/** Bundle names are user input: an Object.prototype member ("constructor",
+ * "toString") passes a plain `in` or index lookup, so membership is own-key only. */
+export function isKnownBundle(name) {
+    return Object.hasOwn(BUNDLE_CATALOG, name);
+}
 export function resolveBundleAliases(bundles) {
     return bundles.map((name) => {
-        const target = BUNDLE_ALIASES[name];
+        const target = Object.hasOwn(BUNDLE_ALIASES, name) ? BUNDLE_ALIASES[name] : undefined;
         if (!target)
             return name;
         if (!warnedAliases.has(name)) {

package/dist/tools/account-wizard.d.ts

@@ -57,7 +57,7 @@ export declare function scopeGrantDiff(requested: string[], grantedScope: string
  * present, runConsent NEVER binds a server-side loopback listener — the
  * user's browser cannot reach the daemon's loopback — and instead hands out
  * a clientless AS consent URL. The injector decides the flow (single-owner =
- * the legacy alias_reauth link; a tenancy host mints a signed alias_add URL). */
+ * the legacy alias_reauth link). */
 export interface WizardHttpConsent {
     mintConsentUrl: (alias: string) => Promise<string> | string;
 }

package/dist/tools/account-wizard.js

@@ -3,7 +3,7 @@ import { getAccountSet, invalidateAccountSet } from '../accounts.js';
 import { ALIAS_RE, mutateConfigFile } from '../config-file.js';
 import { writeToken } from '../token-store.js';
 import { resolveScopesForAccount } from '../auth.js';
-import { BUNDLE_CATALOG, closestBundle, resolveBundleAliases } from '../scope-catalog.js';
+import { BUNDLE_CATALOG, closestBundle, isKnownBundle, resolveBundleAliases } from '../scope-catalog.js';
 import { openUrl } from '../open-url.js';
 import { coerceBoolean } from './_coerce.js';
 import { safeMessage, stringifyEnvelope } from './_errors.js';
@@ -58,7 +58,7 @@ export function validateAddForm(input, existingAliases) {
         if (b === 'admin') {
             return { ok: false, slug: 'E_UNKNOWN_BUNDLE', message: '"admin" is not a scope bundle.', hint: 'Use the admin checkbox instead, or pass "admin": true.', alias };
         }
-        if (!(b in BUNDLE_CATALOG)) {
+        if (!isKnownBundle(b)) {
             const closest = closestBundle(b);
             const known = Object.keys(BUNDLE_CATALOG).filter((n) => n !== 'admin').join(', ');
             return {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "mcp-google-multi",
-  "version": "6.0.0-alpha.54",
+  "version": "6.0.0-alpha.56",
   "mcpName": "io.github.bakissation/mcp-google-multi",
   "description": "Local MCP server for Google Workspace (Gmail, Drive, Calendar, Sheets, Docs, Contacts, Tasks, Meet, Search Console, +Forms/Chat/Admin) across multiple accounts — OAuth-only, encrypted token storage, deny-by-default writes.",
   "type": "module",
@@ -28,6 +28,8 @@
     "./tenant-purge": "./dist/tenant-purge.js",
     "./doctor": "./dist/doctor.js",
     "./write-control": "./dist/write-control.js",
+    "./scope-catalog": "./dist/scope-catalog.js",
+    "./auth": "./dist/auth.js",
     "./package.json": "./package.json"
   },
   "files": [