mcp-google-multi 6.0.0-alpha.56 → 6.0.0-alpha.58

package/dist/accounts.d.ts

@@ -56,6 +56,11 @@ export declare const accountAliasSchema: z.ZodType<string>;
  * permissive (same empty-safe rule as above); dispatch still resolves the
  * alias against the live registry. */
 export declare function accountArgLive(aliases: () => readonly string[]): z.ZodType<string>;
+/** The live membership check behind accountArgLive and the fan-out field;
+ * `selectors` also admits "*". An empty set stays permissive. */
+export declare function liveAccountCheck(aliases: () => readonly string[], selectors: boolean): z.core.$ZodCheck<string>;
+/** True for a field built on liveAccountCheck, optional or not. */
+export declare function isLiveAccountField(field: unknown): boolean;
 /**
  * BR-4: the stdio/http SERVER never boots with an empty registry — a fresh user
  * bootstraps via env / `migrate-config` / `account import` / `auth` first. The

package/dist/accounts.js

@@ -287,6 +287,8 @@ export const ACCOUNTS = current.aliases;
  * enum actually accepts, and naming a runtime-added alias as valid while
  * rejecting it would be a lie. */
 export function unknownAliasMessage(aliases, selectors = false) {
+    if (aliases.length === 0)
+        return 'No Google account is configured yet. Add one with account_add.';
     const all = selectors ? '; "*" for all accounts' : '';
     const csv = selectors && aliases.length > 1 ? `; or a CSV subset like "${aliases.slice(0, 2).join(',')}"` : '';
     return `Unknown account alias. Valid: ${aliases.join(', ')}${all}${csv}. Run account_list if accounts changed since this server started.`;
@@ -312,12 +314,29 @@ export const accountAliasSchema = accountAliasSchemaFor(ACCOUNTS);
  * permissive (same empty-safe rule as above); dispatch still resolves the
  * alias against the live registry. */
 export function accountArgLive(aliases) {
-    return z.string().superRefine((value, ctx) => {
+    return z.string().check(liveAccountCheck(aliases, false));
+}
+// The check instance survives the clones .describe() and .optional() make,
+// so it is what marks a field as an account selector for the registry.
+const LIVE_ACCOUNT_CHECKS = new WeakSet();
+/** The live membership check behind accountArgLive and the fan-out field;
+ * `selectors` also admits "*". An empty set stays permissive. */
+export function liveAccountCheck(aliases, selectors) {
+    const check = z.superRefine((value, ctx) => {
         const current = aliases();
-        if (current.length > 0 && !current.includes(value)) {
-            ctx.addIssue({ code: 'custom', message: unknownAliasMessage(current) });
-        }
+        if (current.length === 0 || current.includes(value) || (selectors && value === '*'))
+            return;
+        ctx.addIssue({ code: 'custom', message: unknownAliasMessage(current, selectors) });
     });
+    LIVE_ACCOUNT_CHECKS.add(check);
+    return check;
+}
+/** True for a field built on liveAccountCheck, optional or not. */
+export function isLiveAccountField(field) {
+    let def = field?._zod?.def;
+    if (def?.type === 'optional')
+        def = def.innerType?._zod?.def;
+    return def?.checks?.some((c) => LIVE_ACCOUNT_CHECKS.has(c)) ?? false;
 }
 /**
  * BR-4: the stdio/http SERVER never boots with an empty registry — a fresh user

package/dist/arg-normalize.js

@@ -1,4 +1,4 @@
-import { screenArguments, unknownArgEnvelope, } from './arg-strict.js';
+import { echoName, echoNames, screenArguments, unknownArgEnvelope, } from './arg-strict.js';
 import { sliceClean } from './trim.js';
 // The SDK synthesizes input-validation failures as isError RESULTS, skipping
 // the handler entirely: no handler of ours runs, so no envelope exists and the
@@ -116,7 +116,7 @@ export function screenMessage(msg, opts, log = (l) => process.stderr.write(`${l}
         return { action: 'forward', msg };
     const all = [...screened.unknown.map((u) => u.sent), ...screened.redundant];
     // Key names only; argument VALUES never reach the log.
-    log(`[args] ${tool}: undeclared ${all.join(', ')}${opts.mode === 'warn' ? ' (dropped)' : ' (rejected)'}`);
+    log(`[args] ${tool}: undeclared ${echoNames(all)}${opts.mode === 'warn' ? ' (dropped)' : ' (rejected)'}`);
     try {
         // Only ever a DECLARED key or the literal placeholder, so the metrics
         // closed-vocabulary rule holds: the caller's key is never persisted.
@@ -132,7 +132,7 @@ export function screenMessage(msg, opts, log = (l) => process.stderr.write(`${l}
     const siblings = screened.unknown.some((u) => u.suggestions.length > 0)
         ? []
         : (opts.siblingsFor?.(tool, screened.unknown.map((u) => u.sent)) ?? []);
-    const envelope = unknownArgEnvelope(tool, screened.unknown, declared, typeof account === 'string' ? account : undefined, siblings);
+    const envelope = unknownArgEnvelope(tool, screened.unknown, declared, typeof account === 'string' ? echoName(account) : undefined, siblings);
     return {
         action: 'reject',
         response: {

package/dist/arg-strict.d.ts

@@ -14,6 +14,13 @@ export declare const STRICT_EXEMPT_TOOLS: ReadonlySet<string>;
  * tools: no declared key starts with `_` or contains `/`, so neither rule can
  * shadow a real parameter. */
 export declare function isExemptKey(key: string): boolean;
+/** A call can carry thousands of unknown keys, or one of megabytes: only the
+ * first few earn a did-you-mean, and the log line and the envelope echo a
+ * bounded prefix of each name. The reject decision itself is never capped. */
+export declare const MAX_SUGGESTED_KEYS = 8;
+export declare function echoName(name: string): string;
+/** The first MAX_SUGGESTED_KEYS names, each capped, then "and N more". */
+export declare function echoNames(names: readonly string[], quote?: boolean): string;
 /**
  * Rank declared keys for an unknown key. Tiers, best non-empty tier wins:
  *   0 same key modulo case and separators

package/dist/arg-strict.js

@@ -9,7 +9,8 @@
 // and never touches a VALUE: it only decides that a key is undeclared, and
 // suggests what the caller probably meant. Rewriting would risk sending a real
 // value to Google on a guess, which is strictly worse than refusing.
-import { editDistance } from './scope-catalog.js';
+import { editDistance, SUGGEST_MAX_INPUT } from './scope-catalog.js';
+import { sliceClean } from './trim.js';
 /**
  * `GOOGLE_ARG_UNKNOWN`: reject | warn | off. A typo in the VALUE still falls
  * back to `warn`, not to the default: an operator who misspells the setting
@@ -59,6 +60,20 @@ export function isExemptKey(key) {
  * alone; they match far too much to be useful. */
 const GENERIC = new Set(['id', 'name', 'title', 'body', 'parent', 'text', 'content', 'type', 'value', 'key', 'data']);
 const flatten = (s) => s.toLowerCase().replace(/[^a-z0-9]/g, '');
+/** A call can carry thousands of unknown keys, or one of megabytes: only the
+ * first few earn a did-you-mean, and the log line and the envelope echo a
+ * bounded prefix of each name. The reject decision itself is never capped. */
+export const MAX_SUGGESTED_KEYS = 8;
+const MAX_ECHO_CHARS = 64;
+export function echoName(name) {
+    return name.length > MAX_ECHO_CHARS ? `${sliceClean(name, MAX_ECHO_CHARS)}...` : name;
+}
+/** The first MAX_SUGGESTED_KEYS names, each capped, then "and N more". */
+export function echoNames(names, quote = false) {
+    const shown = names.slice(0, MAX_SUGGESTED_KEYS).map((n) => (quote ? `"${echoName(n)}"` : echoName(n)));
+    const rest = names.length - shown.length;
+    return rest > 0 ? `${shown.join(', ')} and ${rest} more` : shown.join(', ');
+}
 function tokens(s) {
     return s
         .replace(/([a-z0-9])([A-Z])/g, '$1 $2')
@@ -76,6 +91,8 @@ function tokens(s) {
  * distance 6, well past any sane threshold, which is why tier 1 exists.
  */
 export function suggestKeys(unknown, declared, limit = 2) {
+    if (unknown.length > SUGGEST_MAX_INPUT)
+        return [];
     const uFlat = flatten(unknown);
     const uTok = tokens(unknown);
     const tiers = [[], [], [], []];
@@ -94,8 +111,12 @@ export function suggestKeys(unknown, declared, limit = 2) {
             tiers[2].push({ key, rank: Math.abs(kFlat.length - uFlat.length) });
             continue;
         }
+        const maxDist = Math.max(1, Math.floor(uFlat.length / 4));
+        // The distance is at least the length gap: skip the DP when that alone fails.
+        if (Math.abs(uFlat.length - kFlat.length) > maxDist)
+            continue;
         const d = editDistance(uFlat, kFlat);
-        if (d <= Math.max(1, Math.floor(uFlat.length / 4)))
+        if (d <= maxDist)
             tiers[3].push({ key, rank: d });
     }
     const tier = tiers.find((t) => t.length > 0);
@@ -117,10 +138,19 @@ export function screenArguments(tool, args, declared) {
     if (STRICT_EXEMPT_TOOLS.has(tool) || declared.length === 0)
         return out;
     const declaredSet = new Set(declared);
+    // Tier 0 (same key modulo case and separators) is a map lookup, so every key
+    // gets it and a redundant twin is recognised past the ranking budget too.
+    // A near-miss duplicate (a typo sent next to its declared key) is recognised
+    // only within the budget: a call needs 9 of them before one is refused.
+    const byFlat = new Map();
+    for (const k of declared)
+        byFlat.set(flatten(k), [...(byFlat.get(flatten(k)) ?? []), k]);
+    let ranked = 0;
     for (const key of Object.keys(args)) {
         if (declaredSet.has(key) || isExemptKey(key))
             continue;
-        const suggestions = suggestKeys(key, declared);
+        const twins = key.length <= SUGGEST_MAX_INPUT ? byFlat.get(flatten(key)) : undefined;
+        const suggestions = twins ? twins.slice(0, 2) : ranked++ < MAX_SUGGESTED_KEYS ? suggestKeys(key, declared) : [];
         // The caller sent both spellings, so the declared one already won and the
         // outcome is what it has always been. Never fail a call that works today.
         if (suggestions.some((s) => s in args)) {
@@ -133,7 +163,7 @@ export function screenArguments(tool, args, declared) {
 }
 /** The agent-facing envelope. Values are never included, only key names. */
 export function unknownArgEnvelope(tool, unknown, declared, account, siblings = []) {
-    const names = unknown.map((u) => `"${u.sent}"`).join(', ');
+    const names = echoNames(unknown.map((u) => u.sent), true);
     const accepts = `This tool accepts: ${declared.join(', ')}.`;
     const suggested = unknown.flatMap((u) => u.suggestions);
     let hint;

package/dist/compose.js

@@ -4,7 +4,7 @@
 // parsing, no process.exit, no prints (accounts.js module-load resolution is
 // the one inherited, pre-existing exception on the import chain).
 import { GENERATED_SERVICES } from './tools/generated/index.js';
-import { GENERATED_GATES, SERVICES, unknownToolMessage } from './services.js';
+import { GENERATED_GATES, SERVICES, servicesAwaitingRestart, unknownToolMessage } from './services.js';
 import { argNormalizationEnabled } from './arg-normalize.js';
 import { unknownArgMode } from './arg-strict.js';
 import { ToolRegistry } from './registry.js';
@@ -81,7 +81,7 @@ export function buildRegistry(server, ctx, mode, metrics = null) {
     // The wizard edits the owner's config.json and token store; any other
     // context has neither.
     if (owner)
-        registerAccountWizardTools(registry, server);
+        registerAccountWizardTools(registry, server, () => servicesAwaitingRestart(registry));
     return registry;
 }
 /** The per-request hooks bound to one registry: argument shapes, unknown-

package/dist/discovery-client.d.ts

@@ -49,5 +49,8 @@ export declare function loadMethodIndex(api: string, deps?: DiscoveryDeps): Prom
 export declare function clearDiscoveryMemoryCache(): void;
 export declare function cudFromMethod(method: Pick<DiscoveryMethod, 'httpMethod' | 'id'>): 'read' | 'create' | 'update' | 'delete';
 export declare function expandPath(template: string, pathParams: Record<string, string>): string;
+/** Search keywords are a few words; the caps keep a caller-sized query from
+ * driving index-size x token-count substring scans on the event loop. */
+export declare const MAX_SEARCH_QUERY = 500;
 export declare function searchMethods(index: DiscoveryMethod[], query: string, limit?: number): DiscoveryMethod[];
 export {};

package/dist/discovery-client.js

@@ -263,8 +263,13 @@ export function expandPath(template, pathParams) {
         return segments.map(encodeURIComponent).join('/');
     });
 }
+/** Search keywords are a few words; the caps keep a caller-sized query from
+ * driving index-size x token-count substring scans on the event loop. */
+export const MAX_SEARCH_QUERY = 500;
+const MAX_SEARCH_TOKENS = 16;
 export function searchMethods(index, query, limit = 10) {
-    const tokens = query.toLowerCase().split(/\s+/).filter(Boolean);
+    const words = query.slice(0, MAX_SEARCH_QUERY).toLowerCase().split(/\s+/).filter(Boolean);
+    const tokens = [...new Set(words)].slice(0, MAX_SEARCH_TOKENS);
     if (tokens.length === 0)
         return index.slice(0, limit);
     const scored = index

package/dist/fanout.d.ts

@@ -1,6 +1,14 @@
 import { z } from 'zod';
 export declare const CSV_RE: RegExp;
-export declare function fanoutAccountField(description: string, aliases: readonly string[]): z.ZodType;
+export declare function fanoutAccountField(description: string, aliases: () => readonly string[]): z.ZodType;
+/** '*' over an empty account set would fan out to nothing and report success. */
+export declare function noAccountsResult(): {
+    content: {
+        type: "text";
+        text: string;
+    }[];
+    isError: true;
+};
 export type AccountSelector = {
     ok: true;
     fanout: boolean;

package/dist/fanout.js

@@ -1,25 +1,47 @@
 import { z } from 'zod';
-import { getAccountSet, unknownAliasMessage } from './accounts.js';
+import { getAccountSet, liveAccountCheck, unknownAliasMessage } from './accounts.js';
+import { echoName, echoNames, MAX_SUGGESTED_KEYS } from './arg-strict.js';
 export const CSV_RE = /^[a-zA-Z0-9_-]+(\s*,\s*[a-zA-Z0-9_-]+)+$/;
 const FANOUT_CONCURRENCY = 5;
 // `aliases` is required (no global default): the field is baked into a
-// registry's inputSchema, so it must be built from THAT registry's account
-// set or a '*' would advertise and accept another registry's aliases.
+// registry's inputSchema, so it must read THAT registry's account set or a
+// '*' would advertise and accept another registry's aliases. It is a getter:
+// the set is read at parse time, so an alias added mid-session (account_add,
+// a tenant link) is valid on tools registered before it existed.
 export function fanoutAccountField(description, aliases) {
-    const csvExample = aliases.length > 1 ? `; or a CSV subset like "${aliases.slice(0, 2).join(',')}"` : '';
+    const boot = aliases();
+    const csvExample = boot.length > 1 ? `; or a CSV subset like "${boot.slice(0, 2).join(',')}"` : '';
     // The union's OWN error only fires when every branch aborts at the type
     // check (a non-string). For a string, zod surfaces the single non-aborted
     // branch verbatim, which is the CSV regex, so a mistyped alias used to read
     // as "Invalid string: must match pattern /^[a-zA-Z0-9_-]+(,...)/" and never
     // named an alias. Hence the same message on BOTH.
-    const bad = () => unknownAliasMessage(aliases, true);
+    const bad = () => unknownAliasMessage(aliases(), true);
     return z
-        // '*' first so the tuple is statically non-empty even when aliases is empty
-        // (a fresh install): z.enum requires [string, ...string[]].
-        .union([z.enum(['*', ...aliases]), z.string().regex(CSV_RE, { error: bad })], { error: bad })
+        // The selector branch stays first: tools/list injects the live
+        // '*' + alias enum into it (registry withLiveAccountEnum).
+        .union([z.string().check(liveAccountCheck(aliases, true)), z.string().regex(CSV_RE, { error: bad })], { error: bad })
         .optional()
         .describe(`${description}; "*" = all accounts${csvExample}; omit for the default account`);
 }
+/** '*' over an empty account set would fan out to nothing and report success. */
+export function noAccountsResult() {
+    return {
+        content: [
+            {
+                type: 'text',
+                text: JSON.stringify({
+                    error: 'validation_error',
+                    message: 'No Google account is configured, so "*" selects nothing.',
+                    hint: unknownAliasMessage([]),
+                    retriable: false,
+                    account: '*',
+                }),
+            },
+        ],
+        isError: true,
+    };
+}
 export function parseAccountSelector(value, accounts = getAccountSet().aliases) {
     if (value === '*')
         return { ok: true, fanout: true, aliases: [...accounts] };
@@ -56,10 +78,11 @@ export function invalidAccountsResult(invalid, accounts = getAccountSet().aliase
                 type: 'text',
                 text: JSON.stringify({
                     error: 'validation_error',
-                    message: `Unknown account alias(es): ${invalid.join(', ')}.`,
+                    // The caller's CSV can hold any number of tokens: echo a prefix.
+                    message: `Unknown account alias(es): ${echoNames(invalid)}.`,
                     hint: unknownAliasMessage(accounts, true),
                     retriable: false,
-                    account: invalid.join(','),
+                    account: invalid.slice(0, MAX_SUGGESTED_KEYS).map(echoName).join(','),
                 }),
             },
         ],

package/dist/http-transport.js

@@ -9,6 +9,10 @@ import { withArgNormalization, withValidationEnvelope } from './arg-normalize.js
 // serialize() lock forever. Generous by default so slow-but-valid calls (large
 // Drive exports, fan-out) still finish; the point is only to guarantee release.
 const DISPATCH_TIMEOUT_DEFAULT = 120_000;
+/** MCP 2025-06-18 dropped JSON-RPC batching, and the SDK screens every frame
+ * of a batch synchronously in one tick: without a cap one body multiplies the
+ * per-call work by however many frames fit in it. */
+const MAX_BATCH_FRAMES = 16;
 export function parseOwnerEmails(env = process.env) {
     return (env.MCP_OWNER_EMAILS ?? '')
         .split(',')
@@ -198,6 +202,9 @@ export class HttpTransportHost {
         catch (e) {
             return this.fail(res, 400, 'invalid_body', e.message);
         }
+        if (Array.isArray(body) && body.length > MAX_BATCH_FRAMES) {
+            return this.fail(res, 400, 'batch_too_large', `a JSON-RPC batch may hold at most ${MAX_BATCH_FRAMES} messages`);
+        }
         // Host/Origin are enforced by the front guard above (uniformly for /mcp and
         // the mounted AS routes), so the SDK's own DNS-rebind guard is disabled: its
         // exact-Host match is stricter than the front guard and would 403 valid

package/dist/index.js

@@ -250,8 +250,10 @@ async function main() {
         const { jwtSecretFrom } = await import('./mcp-token.js');
         const { resolveJwtKey, resolveMasterKeyForDispatch } = await import('./master-key.js');
         const { OAuth2Client } = await import('googleapis-common');
-        const { writeToken } = await import('./token-store.js');
+        const { readToken, writeToken } = await import('./token-store.js');
         const { resolveScopesForAccount } = await import('./auth.js');
+        const { ownerAuthUrlOptions } = await import('./oauth-consent.js');
+        const { scopeGrantDiff, setWizardHttpConsent } = await import('./tools/account-wizard.js');
         const { configDir } = await import('./config-file.js');
         const { getAccountSet } = await import('./accounts.js');
         const googleClient = () => new OAuth2Client(process.env.GOOGLE_CLIENT_ID, process.env.GOOGLE_CLIENT_SECRET, `${httpCfg.publicUrl}/callback`);
@@ -265,20 +267,7 @@ async function main() {
             masterKey: resolveMasterKeyForDispatch().key,
             refreshStorePath: path.join(configDir(), 'mcp-tokens.enc'),
         }, {
-            buildGoogleAuthUrl: ({ flow, alias, state }) => {
-                if (flow === 'alias_reauth' && alias) {
-                    const cfg = getAccountSet().configs[alias];
-                    // openid+email so /callback can bind the returned identity to the alias.
-                    return googleClient().generateAuthUrl({
-                        access_type: 'offline',
-                        prompt: 'consent',
-                        scope: [...new Set([...resolveScopesForAccount(alias), 'openid', 'email'])],
-                        login_hint: cfg?.email,
-                        state,
-                    });
-                }
-                return googleClient().generateAuthUrl({ scope: ['openid', 'email'], prompt: 'select_account', state });
-            },
+            buildGoogleAuthUrl: ({ flow, alias, state }) => googleClient().generateAuthUrl(ownerAuthUrlOptions({ flow, alias, state }, (a) => resolveScopesForAccount(a))),
             exchangeCode: async (code, flow) => {
                 const { tokens } = await googleClient().getToken(code);
                 const email = verifiedEmailFromIdToken(tokens.id_token ?? undefined);
@@ -287,19 +276,25 @@ async function main() {
                 return { tokens: flow === 'owner_gate' ? {} : tokens, email };
             },
             writeToken: (alias, tokens) => writeToken(alias, tokens),
+            missingScopes: (alias, granted) => scopeGrantDiff(resolveScopesForAccount(alias), granted),
+            hasToken: (alias) => {
+                try {
+                    return readToken(alias) != null;
+                }
+                catch {
+                    return false; // undecryptable: nothing usable to keep
+                }
+            },
             aliasEmail: (alias) => getAccountSet().configs[alias]?.email,
             log: (l) => process.stderr.write(`[as] ${l}\n`),
         });
-        // BV-1: over HTTP, a dead/missing per-account token surfaces a clickable
-        // re-auth link into the AS's alias_reauth flow instead of a stdio CLI hint.
-        const { setHttpReauthBase } = await import('./reauth-hint.js');
-        setHttpReauthBase(httpCfg.publicUrl);
-        // Wizard consent over HTTP: hand out the clientless AS link instead of
+        // BV-1: over HTTP, a dead/missing per-account token surfaces a clickable,
+        // signed re-auth link into the AS's alias_reauth flow instead of a CLI hint.
+        const { setHttpReauthLink } = await import('./reauth-hint.js');
+        setHttpReauthLink((alias) => authServer.reauthLink(alias));
+        // Wizard consent over HTTP: hand out the same signed link instead of
         // binding a loopback listener.
-        const { setWizardHttpConsent } = await import('./tools/account-wizard.js');
-        setWizardHttpConsent({
-            mintConsentUrl: (alias) => `${httpCfg.publicUrl}/authorize?flow=alias_reauth&alias=${encodeURIComponent(alias)}`,
-        });
+        setWizardHttpConsent({ mintConsentUrl: (alias) => authServer.reauthLink(alias) });
         let httpTap;
         if (httpMetrics) {
             const { tapUsageMetrics } = await import('./metrics-tap.js');

package/dist/mcp-token.d.ts

@@ -46,6 +46,18 @@ export declare function signState(payload: StatePayload, base: string, secret: U
 export declare function verifyState(token: string, base: string, secret: Uint8Array): Promise<StatePayload & {
     jti: string;
 }>;
+/** A re-auth link is handed out in a tool error, so it has to survive until
+ * the user clicks it; an hour, not the 10-minute state TTL. */
+export declare const REAUTH_LINK_TTL_SEC = 3600;
+/** Query string of a server-issued alias_reauth link: the alias, an expiry and
+ * an HMAC over both. Synchronous, so the error hints that carry it stay so. */
+export declare function signReauthLink(base: string, secret: Uint8Array, alias: string, nowSec: number): string;
+/** The alias a link was issued for, or null when it is missing, forged or expired. */
+export declare function verifyReauthLink(base: string, secret: Uint8Array, params: {
+    alias: string;
+    exp: string;
+    sig: string;
+}, nowSec: number): string | null;
 /** A pending-authorization artifact for the DCR consent interstitial (same
  * shape as `state`, distinct purpose so the two can't be confused). */
 export declare function signPending(payload: StatePayload, base: string, secret: Uint8Array, iat: number, ttlSec?: number): Promise<string>;

package/dist/mcp-token.js

@@ -3,7 +3,7 @@
 // `state` and authorization code, the in-memory single-use replay guard, and
 // the opaque rotated refresh-token store. Keyed by the provisioned MCP_JWT_KEY
 // (B5), so tokens survive a restart as long as the key persists.
-import { randomBytes } from 'node:crypto';
+import { createHmac, randomBytes, timingSafeEqual } from 'node:crypto';
 import { existsSync, readFileSync } from 'node:fs';
 import { SignJWT, jwtVerify } from 'jose';
 import { deriveKey, encryptToken, decryptToken } from './token-store.js';
@@ -59,6 +59,30 @@ export function signState(payload, base, secret, iat, ttlSec = STATE_TTL_DEFAULT
 export async function verifyState(token, base, secret) {
     return (await verifyArtifact(token, 'mcp_state', base, secret));
 }
+// --- alias_reauth link -------------------------------------------------------
+/** A re-auth link is handed out in a tool error, so it has to survive until
+ * the user clicks it; an hour, not the 10-minute state TTL. */
+export const REAUTH_LINK_TTL_SEC = 3600;
+function reauthMac(base, secret, alias, exp) {
+    // The newline-separated input can never be a JWT signing input (two
+    // base64url segments and one dot), so the shared key stays unambiguous.
+    return createHmac('sha256', secret).update(`alias_reauth\n${base}\n${alias}\n${exp}`).digest();
+}
+/** Query string of a server-issued alias_reauth link: the alias, an expiry and
+ * an HMAC over both. Synchronous, so the error hints that carry it stay so. */
+export function signReauthLink(base, secret, alias, nowSec) {
+    const exp = nowSec + REAUTH_LINK_TTL_SEC;
+    return `alias=${encodeURIComponent(alias)}&exp=${exp}&sig=${reauthMac(base, secret, alias, exp).toString('base64url')}`;
+}
+/** The alias a link was issued for, or null when it is missing, forged or expired. */
+export function verifyReauthLink(base, secret, params, nowSec) {
+    const exp = Number(params.exp);
+    if (!params.alias || !/^\d+$/.test(params.exp) || exp < nowSec)
+        return null;
+    const want = reauthMac(base, secret, params.alias, exp);
+    const got = Buffer.from(params.sig, 'base64url');
+    return got.length === want.length && timingSafeEqual(got, want) ? params.alias : null;
+}
 /** A pending-authorization artifact for the DCR consent interstitial (same
  * shape as `state`, distinct purpose so the two can't be confused). */
 export function signPending(payload, base, secret, iat, ttlSec = STATE_TTL_DEFAULT) {

package/dist/oauth-as.d.ts

@@ -16,10 +16,10 @@ export interface AuthServerConfig {
     accessTtlSec?: number;
     masterKey: string;
     refreshStorePath: string;
-    /** Default true. The clientless alias-only `flow=alias_reauth` link carries
+    /** Default true. The clientless `flow=alias_reauth` link names an alias with
      * no tenant binding, so a multi-tenant deployment sets false: with several
      * tenants an alias name alone is ambiguous and the branch becomes a
-     * cross-tenant re-auth vector. Server-minted signed flows are unaffected. */
+     * cross-tenant re-auth vector. Server-minted alias_add flows are unaffected. */
     legacyAliasReauth?: boolean;
 }
 /** What /callback hands the alias_add binder once Google returned a verified
@@ -48,9 +48,9 @@ export interface AuthServerDeps {
     /** Exchange a Google auth code at `${base}/callback` for tokens (+ owner email). */
     exchangeCode?: (code: string, flow: StatePayload['flow']) => Promise<GoogleExchangeResult>;
     /** Build the Google authorization URL (redirect back to `${base}/callback`).
-     *  The impl chooses scope/prompt/login_hint from the flow: owner_gate =
-     *  `openid email` + select_account; alias_reauth = the alias's resource scopes
-     *  + consent. */
+     *  The impl chooses scope/prompt from the flow: owner_gate = `openid email`
+     *  + select_account; alias_reauth = the alias's resource scopes + select_account
+     *  consent, and no login_hint (the link needs no authentication). */
     buildGoogleAuthUrl?: (opts: {
         flow: StatePayload['flow'];
         alias?: string;
@@ -58,6 +58,12 @@ export interface AuthServerDeps {
         bundles?: string[];
     }) => string;
     writeToken?: (alias: string, tokens: Record<string, unknown>) => void;
+    /** Scopes the alias asked for that `grantedScope` lacks, so the alias_reauth
+     * completion page can say what Google's granular consent left out. */
+    missingScopes?: (alias: string, grantedScope: string | undefined) => string[];
+    /** Whether a readable token is stored for the alias; a narrower re-auth
+     * grant keeps it rather than replace it. */
+    hasToken?: (alias: string) => boolean;
     registeredClients?: Map<string, {
         redirect_uris: string[];
     }>;
@@ -88,12 +94,17 @@ export interface AuthServer {
      * INSIDE the signed state, so nothing at /authorize or /callback trusts a
      * caller-supplied identity. Inert unless something calls it. */
     mintFlowState: (opts: {
-        flow: 'alias_add' | 'alias_reauth';
+        flow: 'alias_add';
         alias: string;
         tenantId?: string;
         bundles?: string[];
         nonce?: string;
     }) => Promise<string>;
+    /** The owner's re-auth link for `alias`: HMAC-signed, expiring, not single
+     * use (a chat client may prefetch it). /authorize refuses any alias_reauth
+     * request without a valid one, so an unauthenticated caller can neither
+     * start a re-auth nor learn which aliases exist or what they hold. */
+    reauthLink: (alias: string) => string;
 }
 /** C6: exact redirect_uri match, with RFC 8252 §7.3 port-agnostic loopback and
  *  the fixed claude.ai callback. */