mcp-google-multi 6.0.0-alpha.55 → 6.0.0-alpha.57

package/dist/accounts.d.ts

@@ -56,6 +56,11 @@ export declare const accountAliasSchema: z.ZodType<string>;
  * permissive (same empty-safe rule as above); dispatch still resolves the
  * alias against the live registry. */
 export declare function accountArgLive(aliases: () => readonly string[]): z.ZodType<string>;
+/** The live membership check behind accountArgLive and the fan-out field;
+ * `selectors` also admits "*". An empty set stays permissive. */
+export declare function liveAccountCheck(aliases: () => readonly string[], selectors: boolean): z.core.$ZodCheck<string>;
+/** True for a field built on liveAccountCheck, optional or not. */
+export declare function isLiveAccountField(field: unknown): boolean;
 /**
  * BR-4: the stdio/http SERVER never boots with an empty registry — a fresh user
  * bootstraps via env / `migrate-config` / `account import` / `auth` first. The

package/dist/accounts.js

@@ -3,7 +3,7 @@ import fs from 'node:fs';
 import { z } from 'zod';
 import { loadEnvFiles } from './env-load.js';
 import { ALIAS_RE, CONFIG_VERSION, configDir, configFilePath, failStartup, isReservedAlias, loadConfigFile, mutateConfigFile } from './config-file.js';
-import { BUNDLE_CATALOG, closestBundle, resolveBundleAliases } from './scope-catalog.js';
+import { closestBundle, isKnownBundle, resolveBundleAliases } from './scope-catalog.js';
 const envLoad = loadEnvFiles();
 const defaultTokenDir = path.join(configDir(), 'tokens');
 const tokenDir = process.env.TOKEN_STORE_PATH
@@ -95,7 +95,7 @@ opts = {}) {
             if (bundle === 'admin') {
                 fail('E_UNKNOWN_BUNDLE', '"admin" is not a global bundle: grant it per account via GOOGLE_ADMIN_ACCOUNTS or an "admin: true" scope profile.');
             }
-            if (!(bundle in BUNDLE_CATALOG)) {
+            if (!isKnownBundle(bundle)) {
                 const hint = closestBundle(bundle);
                 fail('E_UNKNOWN_BUNDLE', `unknown bundle "${bundle}" in GOOGLE_OPTIONAL_SCOPES${hint ? ` — did you mean "${hint}"?` : ''}`);
             }
@@ -152,7 +152,7 @@ opts = {}) {
     for (const [name, profile] of Object.entries(config?.scopeProfiles ?? {})) {
         const bundles = resolveBundleAliases(profile.bundles);
         for (const bundle of bundles) {
-            if (!(bundle in BUNDLE_CATALOG)) {
+            if (!isKnownBundle(bundle)) {
                 const hint = closestBundle(bundle);
                 fail('E_UNKNOWN_BUNDLE', `unknown bundle "${bundle}" in scope profile "${name}"${hint ? ` — did you mean "${hint}"?` : ''}`);
             }
@@ -287,6 +287,8 @@ export const ACCOUNTS = current.aliases;
  * enum actually accepts, and naming a runtime-added alias as valid while
  * rejecting it would be a lie. */
 export function unknownAliasMessage(aliases, selectors = false) {
+    if (aliases.length === 0)
+        return 'No Google account is configured yet. Add one with account_add.';
     const all = selectors ? '; "*" for all accounts' : '';
     const csv = selectors && aliases.length > 1 ? `; or a CSV subset like "${aliases.slice(0, 2).join(',')}"` : '';
     return `Unknown account alias. Valid: ${aliases.join(', ')}${all}${csv}. Run account_list if accounts changed since this server started.`;
@@ -312,12 +314,29 @@ export const accountAliasSchema = accountAliasSchemaFor(ACCOUNTS);
  * permissive (same empty-safe rule as above); dispatch still resolves the
  * alias against the live registry. */
 export function accountArgLive(aliases) {
-    return z.string().superRefine((value, ctx) => {
+    return z.string().check(liveAccountCheck(aliases, false));
+}
+// The check instance survives the clones .describe() and .optional() make,
+// so it is what marks a field as an account selector for the registry.
+const LIVE_ACCOUNT_CHECKS = new WeakSet();
+/** The live membership check behind accountArgLive and the fan-out field;
+ * `selectors` also admits "*". An empty set stays permissive. */
+export function liveAccountCheck(aliases, selectors) {
+    const check = z.superRefine((value, ctx) => {
         const current = aliases();
-        if (current.length > 0 && !current.includes(value)) {
-            ctx.addIssue({ code: 'custom', message: unknownAliasMessage(current) });
-        }
+        if (current.length === 0 || current.includes(value) || (selectors && value === '*'))
+            return;
+        ctx.addIssue({ code: 'custom', message: unknownAliasMessage(current, selectors) });
     });
+    LIVE_ACCOUNT_CHECKS.add(check);
+    return check;
+}
+/** True for a field built on liveAccountCheck, optional or not. */
+export function isLiveAccountField(field) {
+    let def = field?._zod?.def;
+    if (def?.type === 'optional')
+        def = def.innerType?._zod?.def;
+    return def?.checks?.some((c) => LIVE_ACCOUNT_CHECKS.has(c)) ?? false;
 }
 /**
  * BR-4: the stdio/http SERVER never boots with an empty registry — a fresh user

package/dist/arg-normalize.js

@@ -1,4 +1,4 @@
-import { screenArguments, unknownArgEnvelope, } from './arg-strict.js';
+import { echoName, echoNames, screenArguments, unknownArgEnvelope, } from './arg-strict.js';
 import { sliceClean } from './trim.js';
 // The SDK synthesizes input-validation failures as isError RESULTS, skipping
 // the handler entirely: no handler of ours runs, so no envelope exists and the
@@ -116,7 +116,7 @@ export function screenMessage(msg, opts, log = (l) => process.stderr.write(`${l}
         return { action: 'forward', msg };
     const all = [...screened.unknown.map((u) => u.sent), ...screened.redundant];
     // Key names only; argument VALUES never reach the log.
-    log(`[args] ${tool}: undeclared ${all.join(', ')}${opts.mode === 'warn' ? ' (dropped)' : ' (rejected)'}`);
+    log(`[args] ${tool}: undeclared ${echoNames(all)}${opts.mode === 'warn' ? ' (dropped)' : ' (rejected)'}`);
     try {
         // Only ever a DECLARED key or the literal placeholder, so the metrics
         // closed-vocabulary rule holds: the caller's key is never persisted.
@@ -132,7 +132,7 @@ export function screenMessage(msg, opts, log = (l) => process.stderr.write(`${l}
     const siblings = screened.unknown.some((u) => u.suggestions.length > 0)
         ? []
         : (opts.siblingsFor?.(tool, screened.unknown.map((u) => u.sent)) ?? []);
-    const envelope = unknownArgEnvelope(tool, screened.unknown, declared, typeof account === 'string' ? account : undefined, siblings);
+    const envelope = unknownArgEnvelope(tool, screened.unknown, declared, typeof account === 'string' ? echoName(account) : undefined, siblings);
     return {
         action: 'reject',
         response: {

package/dist/arg-strict.d.ts

@@ -14,6 +14,13 @@ export declare const STRICT_EXEMPT_TOOLS: ReadonlySet<string>;
  * tools: no declared key starts with `_` or contains `/`, so neither rule can
  * shadow a real parameter. */
 export declare function isExemptKey(key: string): boolean;
+/** A call can carry thousands of unknown keys, or one of megabytes: only the
+ * first few earn a did-you-mean, and the log line and the envelope echo a
+ * bounded prefix of each name. The reject decision itself is never capped. */
+export declare const MAX_SUGGESTED_KEYS = 8;
+export declare function echoName(name: string): string;
+/** The first MAX_SUGGESTED_KEYS names, each capped, then "and N more". */
+export declare function echoNames(names: readonly string[], quote?: boolean): string;
 /**
  * Rank declared keys for an unknown key. Tiers, best non-empty tier wins:
  *   0 same key modulo case and separators

package/dist/arg-strict.js

@@ -9,7 +9,8 @@
 // and never touches a VALUE: it only decides that a key is undeclared, and
 // suggests what the caller probably meant. Rewriting would risk sending a real
 // value to Google on a guess, which is strictly worse than refusing.
-import { editDistance } from './scope-catalog.js';
+import { editDistance, SUGGEST_MAX_INPUT } from './scope-catalog.js';
+import { sliceClean } from './trim.js';
 /**
  * `GOOGLE_ARG_UNKNOWN`: reject | warn | off. A typo in the VALUE still falls
  * back to `warn`, not to the default: an operator who misspells the setting
@@ -59,6 +60,20 @@ export function isExemptKey(key) {
  * alone; they match far too much to be useful. */
 const GENERIC = new Set(['id', 'name', 'title', 'body', 'parent', 'text', 'content', 'type', 'value', 'key', 'data']);
 const flatten = (s) => s.toLowerCase().replace(/[^a-z0-9]/g, '');
+/** A call can carry thousands of unknown keys, or one of megabytes: only the
+ * first few earn a did-you-mean, and the log line and the envelope echo a
+ * bounded prefix of each name. The reject decision itself is never capped. */
+export const MAX_SUGGESTED_KEYS = 8;
+const MAX_ECHO_CHARS = 64;
+export function echoName(name) {
+    return name.length > MAX_ECHO_CHARS ? `${sliceClean(name, MAX_ECHO_CHARS)}...` : name;
+}
+/** The first MAX_SUGGESTED_KEYS names, each capped, then "and N more". */
+export function echoNames(names, quote = false) {
+    const shown = names.slice(0, MAX_SUGGESTED_KEYS).map((n) => (quote ? `"${echoName(n)}"` : echoName(n)));
+    const rest = names.length - shown.length;
+    return rest > 0 ? `${shown.join(', ')} and ${rest} more` : shown.join(', ');
+}
 function tokens(s) {
     return s
         .replace(/([a-z0-9])([A-Z])/g, '$1 $2')
@@ -76,6 +91,8 @@ function tokens(s) {
  * distance 6, well past any sane threshold, which is why tier 1 exists.
  */
 export function suggestKeys(unknown, declared, limit = 2) {
+    if (unknown.length > SUGGEST_MAX_INPUT)
+        return [];
     const uFlat = flatten(unknown);
     const uTok = tokens(unknown);
     const tiers = [[], [], [], []];
@@ -94,8 +111,12 @@ export function suggestKeys(unknown, declared, limit = 2) {
             tiers[2].push({ key, rank: Math.abs(kFlat.length - uFlat.length) });
             continue;
         }
+        const maxDist = Math.max(1, Math.floor(uFlat.length / 4));
+        // The distance is at least the length gap: skip the DP when that alone fails.
+        if (Math.abs(uFlat.length - kFlat.length) > maxDist)
+            continue;
         const d = editDistance(uFlat, kFlat);
-        if (d <= Math.max(1, Math.floor(uFlat.length / 4)))
+        if (d <= maxDist)
             tiers[3].push({ key, rank: d });
     }
     const tier = tiers.find((t) => t.length > 0);
@@ -117,10 +138,19 @@ export function screenArguments(tool, args, declared) {
     if (STRICT_EXEMPT_TOOLS.has(tool) || declared.length === 0)
         return out;
     const declaredSet = new Set(declared);
+    // Tier 0 (same key modulo case and separators) is a map lookup, so every key
+    // gets it and a redundant twin is recognised past the ranking budget too.
+    // A near-miss duplicate (a typo sent next to its declared key) is recognised
+    // only within the budget: a call needs 9 of them before one is refused.
+    const byFlat = new Map();
+    for (const k of declared)
+        byFlat.set(flatten(k), [...(byFlat.get(flatten(k)) ?? []), k]);
+    let ranked = 0;
     for (const key of Object.keys(args)) {
         if (declaredSet.has(key) || isExemptKey(key))
             continue;
-        const suggestions = suggestKeys(key, declared);
+        const twins = key.length <= SUGGEST_MAX_INPUT ? byFlat.get(flatten(key)) : undefined;
+        const suggestions = twins ? twins.slice(0, 2) : ranked++ < MAX_SUGGESTED_KEYS ? suggestKeys(key, declared) : [];
         // The caller sent both spellings, so the declared one already won and the
         // outcome is what it has always been. Never fail a call that works today.
         if (suggestions.some((s) => s in args)) {
@@ -133,7 +163,7 @@ export function screenArguments(tool, args, declared) {
 }
 /** The agent-facing envelope. Values are never included, only key names. */
 export function unknownArgEnvelope(tool, unknown, declared, account, siblings = []) {
-    const names = unknown.map((u) => `"${u.sent}"`).join(', ');
+    const names = echoNames(unknown.map((u) => u.sent), true);
     const accepts = `This tool accepts: ${declared.join(', ')}.`;
     const suggested = unknown.flatMap((u) => u.suggestions);
     let hint;

package/dist/auth.js

@@ -1,7 +1,7 @@
 import { randomBytes } from 'node:crypto';
 import { openUrl } from './open-url.js';
 import { ACCOUNTS, getAccountSet } from './accounts.js';
-import { ADMIN_SCOPES, BUNDLE_CATALOG, closestBundle, resolveBundleAliases } from './scope-catalog.js';
+import { ADMIN_SCOPES, BUNDLE_CATALOG, closestBundle, isKnownBundle, resolveBundleAliases } from './scope-catalog.js';
 import { resolveMasterKey } from './master-key.js';
 import { writeToken } from './token-store.js';
 import { buildConsentClient, openLoopbackConsent, TESTING_MODE_WARNING } from './oauth-consent.js';
@@ -48,7 +48,7 @@ function legacyGlobalProfile() {
         if (bundle === 'admin') {
             throw new Error('E_UNKNOWN_BUNDLE: "admin" is not a global bundle: grant it per account via GOOGLE_ADMIN_ACCOUNTS or an "admin: true" scope profile.');
         }
-        if (!(bundle in BUNDLE_CATALOG)) {
+        if (!isKnownBundle(bundle)) {
             const hint = closestBundle(bundle);
             throw new Error(`E_UNKNOWN_BUNDLE: unknown bundle "${bundle}" in GOOGLE_OPTIONAL_SCOPES${hint ? ` — did you mean "${hint}"?` : ''}`);
         }

package/dist/compose.js

@@ -4,7 +4,7 @@
 // parsing, no process.exit, no prints (accounts.js module-load resolution is
 // the one inherited, pre-existing exception on the import chain).
 import { GENERATED_SERVICES } from './tools/generated/index.js';
-import { GENERATED_GATES, SERVICES, unknownToolMessage } from './services.js';
+import { GENERATED_GATES, SERVICES, servicesAwaitingRestart, unknownToolMessage } from './services.js';
 import { argNormalizationEnabled } from './arg-normalize.js';
 import { unknownArgMode } from './arg-strict.js';
 import { ToolRegistry } from './registry.js';
@@ -81,7 +81,7 @@ export function buildRegistry(server, ctx, mode, metrics = null) {
     // The wizard edits the owner's config.json and token store; any other
     // context has neither.
     if (owner)
-        registerAccountWizardTools(registry, server);
+        registerAccountWizardTools(registry, server, () => servicesAwaitingRestart(registry));
     return registry;
 }
 /** The per-request hooks bound to one registry: argument shapes, unknown-

package/dist/discovery-client.d.ts

@@ -49,5 +49,8 @@ export declare function loadMethodIndex(api: string, deps?: DiscoveryDeps): Prom
 export declare function clearDiscoveryMemoryCache(): void;
 export declare function cudFromMethod(method: Pick<DiscoveryMethod, 'httpMethod' | 'id'>): 'read' | 'create' | 'update' | 'delete';
 export declare function expandPath(template: string, pathParams: Record<string, string>): string;
+/** Search keywords are a few words; the caps keep a caller-sized query from
+ * driving index-size x token-count substring scans on the event loop. */
+export declare const MAX_SEARCH_QUERY = 500;
 export declare function searchMethods(index: DiscoveryMethod[], query: string, limit?: number): DiscoveryMethod[];
 export {};

package/dist/discovery-client.js

@@ -263,8 +263,13 @@ export function expandPath(template, pathParams) {
         return segments.map(encodeURIComponent).join('/');
     });
 }
+/** Search keywords are a few words; the caps keep a caller-sized query from
+ * driving index-size x token-count substring scans on the event loop. */
+export const MAX_SEARCH_QUERY = 500;
+const MAX_SEARCH_TOKENS = 16;
 export function searchMethods(index, query, limit = 10) {
-    const tokens = query.toLowerCase().split(/\s+/).filter(Boolean);
+    const words = query.slice(0, MAX_SEARCH_QUERY).toLowerCase().split(/\s+/).filter(Boolean);
+    const tokens = [...new Set(words)].slice(0, MAX_SEARCH_TOKENS);
     if (tokens.length === 0)
         return index.slice(0, limit);
     const scored = index

package/dist/fanout.d.ts

@@ -1,6 +1,14 @@
 import { z } from 'zod';
 export declare const CSV_RE: RegExp;
-export declare function fanoutAccountField(description: string, aliases: readonly string[]): z.ZodType;
+export declare function fanoutAccountField(description: string, aliases: () => readonly string[]): z.ZodType;
+/** '*' over an empty account set would fan out to nothing and report success. */
+export declare function noAccountsResult(): {
+    content: {
+        type: "text";
+        text: string;
+    }[];
+    isError: true;
+};
 export type AccountSelector = {
     ok: true;
     fanout: boolean;

package/dist/fanout.js

@@ -1,25 +1,47 @@
 import { z } from 'zod';
-import { getAccountSet, unknownAliasMessage } from './accounts.js';
+import { getAccountSet, liveAccountCheck, unknownAliasMessage } from './accounts.js';
+import { echoName, echoNames, MAX_SUGGESTED_KEYS } from './arg-strict.js';
 export const CSV_RE = /^[a-zA-Z0-9_-]+(\s*,\s*[a-zA-Z0-9_-]+)+$/;
 const FANOUT_CONCURRENCY = 5;
 // `aliases` is required (no global default): the field is baked into a
-// registry's inputSchema, so it must be built from THAT registry's account
-// set or a '*' would advertise and accept another registry's aliases.
+// registry's inputSchema, so it must read THAT registry's account set or a
+// '*' would advertise and accept another registry's aliases. It is a getter:
+// the set is read at parse time, so an alias added mid-session (account_add,
+// a tenant link) is valid on tools registered before it existed.
 export function fanoutAccountField(description, aliases) {
-    const csvExample = aliases.length > 1 ? `; or a CSV subset like "${aliases.slice(0, 2).join(',')}"` : '';
+    const boot = aliases();
+    const csvExample = boot.length > 1 ? `; or a CSV subset like "${boot.slice(0, 2).join(',')}"` : '';
     // The union's OWN error only fires when every branch aborts at the type
     // check (a non-string). For a string, zod surfaces the single non-aborted
     // branch verbatim, which is the CSV regex, so a mistyped alias used to read
     // as "Invalid string: must match pattern /^[a-zA-Z0-9_-]+(,...)/" and never
     // named an alias. Hence the same message on BOTH.
-    const bad = () => unknownAliasMessage(aliases, true);
+    const bad = () => unknownAliasMessage(aliases(), true);
     return z
-        // '*' first so the tuple is statically non-empty even when aliases is empty
-        // (a fresh install): z.enum requires [string, ...string[]].
-        .union([z.enum(['*', ...aliases]), z.string().regex(CSV_RE, { error: bad })], { error: bad })
+        // The selector branch stays first: tools/list injects the live
+        // '*' + alias enum into it (registry withLiveAccountEnum).
+        .union([z.string().check(liveAccountCheck(aliases, true)), z.string().regex(CSV_RE, { error: bad })], { error: bad })
         .optional()
         .describe(`${description}; "*" = all accounts${csvExample}; omit for the default account`);
 }
+/** '*' over an empty account set would fan out to nothing and report success. */
+export function noAccountsResult() {
+    return {
+        content: [
+            {
+                type: 'text',
+                text: JSON.stringify({
+                    error: 'validation_error',
+                    message: 'No Google account is configured, so "*" selects nothing.',
+                    hint: unknownAliasMessage([]),
+                    retriable: false,
+                    account: '*',
+                }),
+            },
+        ],
+        isError: true,
+    };
+}
 export function parseAccountSelector(value, accounts = getAccountSet().aliases) {
     if (value === '*')
         return { ok: true, fanout: true, aliases: [...accounts] };
@@ -56,10 +78,11 @@ export function invalidAccountsResult(invalid, accounts = getAccountSet().aliase
                 type: 'text',
                 text: JSON.stringify({
                     error: 'validation_error',
-                    message: `Unknown account alias(es): ${invalid.join(', ')}.`,
+                    // The caller's CSV can hold any number of tokens: echo a prefix.
+                    message: `Unknown account alias(es): ${echoNames(invalid)}.`,
                     hint: unknownAliasMessage(accounts, true),
                     retriable: false,
-                    account: invalid.join(','),
+                    account: invalid.slice(0, MAX_SUGGESTED_KEYS).map(echoName).join(','),
                 }),
             },
         ],

package/dist/http-transport.js

@@ -9,6 +9,10 @@ import { withArgNormalization, withValidationEnvelope } from './arg-normalize.js
 // serialize() lock forever. Generous by default so slow-but-valid calls (large
 // Drive exports, fan-out) still finish; the point is only to guarantee release.
 const DISPATCH_TIMEOUT_DEFAULT = 120_000;
+/** MCP 2025-06-18 dropped JSON-RPC batching, and the SDK screens every frame
+ * of a batch synchronously in one tick: without a cap one body multiplies the
+ * per-call work by however many frames fit in it. */
+const MAX_BATCH_FRAMES = 16;
 export function parseOwnerEmails(env = process.env) {
     return (env.MCP_OWNER_EMAILS ?? '')
         .split(',')
@@ -198,6 +202,9 @@ export class HttpTransportHost {
         catch (e) {
             return this.fail(res, 400, 'invalid_body', e.message);
         }
+        if (Array.isArray(body) && body.length > MAX_BATCH_FRAMES) {
+            return this.fail(res, 400, 'batch_too_large', `a JSON-RPC batch may hold at most ${MAX_BATCH_FRAMES} messages`);
+        }
         // Host/Origin are enforced by the front guard above (uniformly for /mcp and
         // the mounted AS routes), so the SDK's own DNS-rebind guard is disabled: its
         // exact-Host match is stricter than the front guard and would 403 valid

package/dist/index.js

@@ -246,29 +246,16 @@ async function main() {
         registry.installListHandler();
         registerSetupPrompt(httpServer);
         // B13: mount the OAuth 2.1 AS (legs A + B) + the Bearer authenticator.
-        const { buildAuthServer } = await import('./oauth-as.js');
+        const { buildAuthServer, verifiedEmailFromIdToken } = await import('./oauth-as.js');
         const { jwtSecretFrom } = await import('./mcp-token.js');
         const { resolveJwtKey, resolveMasterKeyForDispatch } = await import('./master-key.js');
         const { OAuth2Client } = await import('googleapis-common');
         const { writeToken } = await import('./token-store.js');
         const { resolveScopesForAccount } = await import('./auth.js');
+        const { ownerAuthUrlOptions } = await import('./oauth-consent.js');
         const { configDir } = await import('./config-file.js');
         const { getAccountSet } = await import('./accounts.js');
         const googleClient = () => new OAuth2Client(process.env.GOOGLE_CLIENT_ID, process.env.GOOGLE_CLIENT_SECRET, `${httpCfg.publicUrl}/callback`);
-        // Only trust the id_token email when Google marks it verified (#8).
-        const verifiedEmailFromIdToken = (idToken) => {
-            if (!idToken)
-                return undefined;
-            try {
-                const [, payload] = idToken.split('.');
-                const claims = JSON.parse(Buffer.from(payload, 'base64url').toString('utf-8'));
-                const verified = claims.email_verified === true || claims.email_verified === 'true';
-                return verified ? claims.email : undefined;
-            }
-            catch {
-                return undefined;
-            }
-        };
         const authServer = buildAuthServer({
             base: httpCfg.publicUrl,
             resourceUri: httpCfg.resourceUri,
@@ -279,20 +266,7 @@ async function main() {
             masterKey: resolveMasterKeyForDispatch().key,
             refreshStorePath: path.join(configDir(), 'mcp-tokens.enc'),
         }, {
-            buildGoogleAuthUrl: ({ flow, alias, state }) => {
-                if (flow === 'alias_reauth' && alias) {
-                    const cfg = getAccountSet().configs[alias];
-                    // openid+email so /callback can bind the returned identity to the alias.
-                    return googleClient().generateAuthUrl({
-                        access_type: 'offline',
-                        prompt: 'consent',
-                        scope: [...new Set([...resolveScopesForAccount(alias), 'openid', 'email'])],
-                        login_hint: cfg?.email,
-                        state,
-                    });
-                }
-                return googleClient().generateAuthUrl({ scope: ['openid', 'email'], prompt: 'select_account', state });
-            },
+            buildGoogleAuthUrl: ({ flow, alias, state }) => googleClient().generateAuthUrl(ownerAuthUrlOptions({ flow, alias, state }, (a) => resolveScopesForAccount(a))),
             exchangeCode: async (code, flow) => {
                 const { tokens } = await googleClient().getToken(code);
                 const email = verifiedEmailFromIdToken(tokens.id_token ?? undefined);
@@ -309,8 +283,7 @@ async function main() {
         const { setHttpReauthBase } = await import('./reauth-hint.js');
         setHttpReauthBase(httpCfg.publicUrl);
         // Wizard consent over HTTP: hand out the clientless AS link instead of
-        // binding a loopback listener (single-owner flow; a tenancy host installs
-        // its own signed-mint context here).
+        // binding a loopback listener.
         const { setWizardHttpConsent } = await import('./tools/account-wizard.js');
         setWizardHttpConsent({
             mintConsentUrl: (alias) => `${httpCfg.publicUrl}/authorize?flow=alias_reauth&alias=${encodeURIComponent(alias)}`,

package/dist/mcp-token.d.ts

@@ -32,6 +32,9 @@ export interface StatePayload {
     tenantId?: string;
     /** alias_add only: scope bundles chosen when the link was minted. */
     bundles?: string[];
+    /** alias_add only: an opaque value the minting caller chose, signed like
+     * tenantId and handed back to its binder (e.g. a server-side link record). */
+    nonce?: string;
 }
 export interface CodePayload {
     redirect_uri: string;

package/dist/migrate-config.js

@@ -1,5 +1,5 @@
 import { CONFIG_VERSION, configFilePath, loadConfigFile, mutateConfigFile } from './config-file.js';
-import { BUNDLE_CATALOG, closestBundle, resolveBundleAliases } from './scope-catalog.js';
+import { closestBundle, isKnownBundle, resolveBundleAliases } from './scope-catalog.js';
 function parseCsv(value) {
     return (value ?? '').split(',').map((s) => s.trim()).filter(Boolean);
 }
@@ -47,7 +47,7 @@ export function runMigrateConfig(env = process.env) {
                 process.exitCode = 1;
                 return;
             }
-            if (!(bundle in BUNDLE_CATALOG)) {
+            if (!isKnownBundle(bundle)) {
                 const hint = closestBundle(bundle);
                 console.error(`E_UNKNOWN_BUNDLE: unknown bundle "${bundle}" in GOOGLE_OPTIONAL_SCOPES${hint ? ` — did you mean "${hint}"?` : ''}. Nothing written.`);
                 process.exitCode = 1;

package/dist/oauth-as.d.ts

@@ -22,18 +22,40 @@ export interface AuthServerConfig {
      * cross-tenant re-auth vector. Server-minted signed flows are unaffected. */
     legacyAliasReauth?: boolean;
 }
+/** What /callback hands the alias_add binder once Google returned a verified
+ * identity for a server-minted link. */
+export interface TenantAliasBind {
+    tenantId: string;
+    alias: string;
+    email: string;
+    bundles?: string[];
+    nonce?: string;
+    tokens: Record<string, unknown>;
+}
+/** A binder's deliberate refusal (policy, not failure): /callback answers 403
+ * with this slug and message. The message reaches an unauthenticated browser. */
+export interface AliasBindRefusal {
+    refused: {
+        slug: string;
+        message: string;
+    };
+}
+/** Only trust the id_token email when Google marks it verified (#8). The token
+ * comes straight from Google's token endpoint, so its claims are read unsigned. */
+export declare function verifiedEmailFromIdToken(idToken?: string | null): string | undefined;
 export interface AuthServerDeps {
     fetchCimd?: (clientId: string) => Promise<Record<string, unknown>>;
     /** Exchange a Google auth code at `${base}/callback` for tokens (+ owner email). */
     exchangeCode?: (code: string, flow: StatePayload['flow']) => Promise<GoogleExchangeResult>;
     /** Build the Google authorization URL (redirect back to `${base}/callback`).
-     *  The impl chooses scope/prompt/login_hint from the flow: owner_gate =
-     *  `openid email` + select_account; alias_reauth = the alias's resource scopes
-     *  + consent. */
+     *  The impl chooses scope/prompt from the flow: owner_gate = `openid email`
+     *  + select_account; alias_reauth = the alias's resource scopes + select_account
+     *  consent, and no login_hint (the link needs no authentication). */
     buildGoogleAuthUrl?: (opts: {
         flow: StatePayload['flow'];
         alias?: string;
         state: string;
+        bundles?: string[];
     }) => string;
     writeToken?: (alias: string, tokens: Record<string, unknown>) => void;
     registeredClients?: Map<string, {
@@ -52,16 +74,11 @@ export interface AuthServerDeps {
     resolveSubject?: (email: string) => {
         sub: string;
     } | null;
-    /** alias_add completion: persist the config row AND the tokens for the new
-     * alias under its tenant in ONE call, atomically — /callback invokes it only
-     * after a successful Google exchange, so no pre-write orphan can exist. */
-    bindTenantAlias?: (bind: {
-        tenantId: string;
-        alias: string;
-        email: string;
-        bundles?: string[];
-        tokens: Record<string, unknown>;
-    }) => void;
+    /** alias_add completion: persist the new alias's config row and tokens under
+     * its tenant. /callback awaits it only after a successful Google exchange.
+     * A returned refusal answers 403 with its slug; a throw or rejection answers
+     * 500 E_ALIAS_ADD_FAILED. */
+    bindTenantAlias?: (bind: TenantAliasBind) => void | AliasBindRefusal | Promise<void | AliasBindRefusal>;
 }
 export interface AuthServer {
     routes: Record<string, RouteHandler>;
@@ -69,12 +86,13 @@ export interface AuthServer {
     /** Mint a signed, single-use, TTL-bound clientless flow URL
      * (`${base}/authorize?flow=...&state=<signed>`). The tenantId/bundles ride
      * INSIDE the signed state, so nothing at /authorize or /callback trusts a
-     * caller-supplied identity. Inert unless something calls it (EE wizard). */
+     * caller-supplied identity. Inert unless something calls it. */
     mintFlowState: (opts: {
         flow: 'alias_add' | 'alias_reauth';
         alias: string;
         tenantId?: string;
         bundles?: string[];
+        nonce?: string;
     }) => Promise<string>;
 }
 /** C6: exact redirect_uri match, with RFC 8252 §7.3 port-agnostic loopback and