mcp-google-multi 6.0.0-alpha.71 → 6.0.0-alpha.72

package/dist/master-key.d.ts

@@ -15,7 +15,7 @@ export interface KeyDeps {
     hasAnyToken?: () => boolean;
 }
 export declare function __setKeychainFactoryForTest(fn: ((account: string) => KeychainEntry | null) | null): void;
-/** BR-1 single choke point: no other module may read the env vars directly.
+/** Single choke point: no other module may read the env vars directly.
  * Boot/CLI form: failures exit with a clean stderr slug ("fatal at startup"). */
 export declare function resolveMasterKey(deps?: KeyDeps): ResolvedKey;
 /** Dispatch form: identical resolution, but failures THROW (caught by the tool
@@ -28,14 +28,14 @@ export declare function peekMasterKeyProvenance(deps?: KeyDeps): KeyProvenance |
  * outstanding MCP tokens and clients re-auth silently. */
 export declare function resolveJwtKey(deps?: KeyDeps): ResolvedKey;
 /**
- * BR-5: after the FIRST successful token decrypt with an env-sourced key,
+ * After the FIRST successful token decrypt with an env-sourced key,
  * mirror it into the keychain (only when the keychain holds no entry) so the
  * key survives an env loss. Gating on a successful decrypt means a stale or
  * wrong env key is never mirrored. Best-effort: failures are doctor material,
  * never fatal.
  */
 export declare function noteSuccessfulDecrypt(): void;
-/** B6 reset: drop the generated MASTER_KEY material (0600 file + keychain
+/** Reset: drop the generated MASTER_KEY material (0600 file + keychain
  * entry) so the next run re-provisions. Never removes an env-provided key (the
  * deployer owns that; `env:true` flags it so reset can warn). The caller MUST
  * have wiped every .enc token first — regenerating with tokens present would

package/dist/master-key.js

@@ -32,7 +32,7 @@ function systemKeychain(account) {
     }
 }
 // Default keychain factory, replaceable ONLY for tests: unit tests must never
-// read or write the developer's real OS keyring (the BR-5 mirror once leaked a
+// read or write the developer's real OS keyring (the env->keychain mirror once leaked a
 // test fixture key into a real GNOME keyring — never again).
 let keychainFactory = systemKeychain;
 export function __setKeychainFactoryForTest(fn) {
@@ -98,7 +98,7 @@ function resolveKey(envName, fileName, hardGuard, deps, onFail = 'exit') {
     const fromFile = readKeyFile(filePath);
     if (fromFile)
         return { key: fromFile, provenance: 'file' };
-    // Generate-on-setup. The hard guard is cc-security Cgen: minting a fresh
+    // Generate-on-setup. The hard guard: minting a fresh
     // MASTER_KEY while <alias>.enc files exist would silently brick them all.
     if (hardGuard && hasAnyToken()) {
         fail('E_MASTER_KEY_MISSING_TOKENS_EXIST', `no ${envName} found in env, keychain or ${filePath}, but encrypted tokens exist under ${getTokenDir()}. ` +
@@ -151,7 +151,7 @@ function resolveKey(envName, fileName, hardGuard, deps, onFail = 'exit') {
 }
 let cachedMaster = null;
 let cachedJwt = null;
-/** BR-1 single choke point: no other module may read the env vars directly.
+/** Single choke point: no other module may read the env vars directly.
  * Boot/CLI form: failures exit with a clean stderr slug ("fatal at startup"). */
 export function resolveMasterKey(deps) {
     if (deps)
@@ -189,7 +189,7 @@ export function resolveJwtKey(deps) {
 }
 let mirrored = false;
 /**
- * BR-5: after the FIRST successful token decrypt with an env-sourced key,
+ * After the FIRST successful token decrypt with an env-sourced key,
  * mirror it into the keychain (only when the keychain holds no entry) so the
  * key survives an env loss. Gating on a successful decrypt means a stale or
  * wrong env key is never mirrored. Best-effort: failures are doctor material,
@@ -211,7 +211,7 @@ export function noteSuccessfulDecrypt() {
         // Keychain backend unavailable; env stays the working source.
     }
 }
-/** B6 reset: drop the generated MASTER_KEY material (0600 file + keychain
+/** Reset: drop the generated MASTER_KEY material (0600 file + keychain
  * entry) so the next run re-provisions. Never removes an env-provided key (the
  * deployer owns that; `env:true` flags it so reset can warn). The caller MUST
  * have wiped every .enc token first — regenerating with tokens present would

package/dist/mcp-token.d.ts

@@ -88,7 +88,7 @@ export declare class ReplayGuard {
     reserve(jti: string, ttlMs: number, nowMs: number): 'ok' | 'full';
     /** Record a jti as spent. A full guard refuses instead of evicting a live
      * jti: a flood of spends would otherwise make a spent artifact usable again,
-     * such as a callback the browser binding refused (H4 F1). `artifactExpMs`
+     * such as a callback the browser binding refused. `artifactExpMs`
      * keeps the record alive as long as the artifact itself, even when the clock
      * stepped back between its signing and this spend. */
     spend(jti: string, ttlMs: number, nowMs: number, artifactExpMs?: number): ReplaySpend;
@@ -138,10 +138,10 @@ export interface RefreshStoreOptions {
  * Persisted (encrypted under MASTER_KEY) refresh-token store. Rotates on every
  * use, and a token carries its family and generation under a MAC, so
  * presenting any generation the family has rotated past is REUSE: the family
- * is revoked for the rest of its life (#7 / C14, H4 F2). The store keeps one
+ * is revoked for the rest of its life. The store keeps one
  * record per family, whatever its rotation count. Every read-modify-write goes
  * through a file lock so concurrent stdio+HTTP processes can't lost-update or
- * double-spend (#12). See docs/internals.md.
+ * double-spend. See docs/internals.md.
  */
 export declare class RefreshStore {
     private readonly path;

package/dist/mcp-token.js

@@ -1,8 +1,8 @@
-// B13 token model (oauth-authorization-server.md §Data model): the MCP access
+// Token model: the MCP access
 // token (HS256 JWT, jose-only — AS==RS so no JWKS), the signed self-contained
 // `state` and authorization code, the in-memory single-use replay guard, and
-// the rotated refresh-token store. Keyed by the provisioned MCP_JWT_KEY
-// (B5), so tokens survive a restart as long as the key persists.
+// the rotated refresh-token store. Keyed by the provisioned MCP_JWT_KEY,
+// so tokens survive a restart as long as the key persists.
 import { createHash, createHmac, hkdfSync, randomBytes, scryptSync, timingSafeEqual } from 'node:crypto';
 import { existsSync, readFileSync } from 'node:fs';
 import { basename } from 'node:path';
@@ -126,7 +126,7 @@ export class ReplayGuard {
     }
     /** Record a jti as spent. A full guard refuses instead of evicting a live
      * jti: a flood of spends would otherwise make a spent artifact usable again,
-     * such as a callback the browser binding refused (H4 F1). `artifactExpMs`
+     * such as a callback the browser binding refused. `artifactExpMs`
      * keeps the record alive as long as the artifact itself, even when the clock
      * stepped back between its signing and this spend. */
     spend(jti, ttlMs, nowMs, artifactExpMs = 0) {
@@ -378,10 +378,10 @@ function lifetimeMs(name, v) {
  * Persisted (encrypted under MASTER_KEY) refresh-token store. Rotates on every
  * use, and a token carries its family and generation under a MAC, so
  * presenting any generation the family has rotated past is REUSE: the family
- * is revoked for the rest of its life (#7 / C14, H4 F2). The store keeps one
+ * is revoked for the rest of its life. The store keeps one
  * record per family, whatever its rotation count. Every read-modify-write goes
  * through a file lock so concurrent stdio+HTTP processes can't lost-update or
- * double-spend (#12). See docs/internals.md.
+ * double-spend. See docs/internals.md.
  */
 export class RefreshStore {
     path;

package/dist/migrate-config.js

@@ -35,7 +35,7 @@ export function runMigrateConfig(env = process.env) {
         }
         desired[alias] = { email };
     }
-    // Legacy global scopes (BC7) become an explicit named profile every account
+    // Legacy global scopes become an explicit named profile every account
     // points at, so removing the env var later changes nothing.
     const legacyNames = parseCsv(env.GOOGLE_OPTIONAL_SCOPES);
     let legacyProfile;

package/dist/oauth-as.d.ts

@@ -146,7 +146,7 @@ export interface AuthServer {
      * start a re-auth nor learn which aliases exist or what they hold. */
     reauthLink: (alias: string) => string;
 }
-/** C6: exact redirect_uri match, with RFC 8252 §7.3 port-agnostic loopback and
+/** Exact redirect_uri match, with RFC 8252 §7.3 port-agnostic loopback and
  *  the fixed claude.ai callback. */
 export declare function redirectAllowed(redirectUri: string, docRedirectUris: string[]): boolean;
 export declare function buildAuthServer(config: AuthServerConfig, deps?: AuthServerDeps): AuthServer;

package/dist/oauth-as.js

@@ -1,8 +1,8 @@
-// B13: the minimal OAuth 2.1 Authorization Server + Resource Server
-// (oauth-authorization-server.md). Federate-and-hold: the server mints its own
+// The minimal OAuth 2.1 Authorization Server + Resource Server.
+// Federate-and-hold: the server mints its own
 // audience-bound HS256 token for the MCP client (leg A), gates on an owner
 // Google login (leg B, tokens discarded), and separately holds per-alias Google
-// tokens (leg C, unchanged). Mounts into B12's HttpTransportHost as `routes` +
+// tokens (leg C, unchanged). Mounts into the HttpTransportHost as `routes` +
 // an `authenticate` for POST /mcp. All Google/CIMD I/O is injectable so the
 // whole surface is exercised by an offline harness.
 import { createHash, randomBytes, timingSafeEqual } from 'node:crypto';
@@ -25,7 +25,7 @@ const HOSTED_DOMAIN = /^[a-z0-9-]+(\.[a-z0-9-]+)+$/i;
 // RFC 6749's error_description charset: %x20-21 / %x23-5B / %x5D-7E (printable
 // ASCII minus the backslash and double-quote that would need escaping in the
 // query string). A resolveSubject denial outside this set is dropped rather
-// than forwarded unvalidated (H3 PR1).
+// than forwarded unvalidated.
 const ERROR_DESCRIPTION_RE = /^[\x20-\x21\x23-\x5b\x5d-\x7e]{1,200}$/;
 /** Only trust the id_token identity when Google marks the email verified (#8).
  * The token comes straight from Google's token endpoint, so its claims are
@@ -90,7 +90,7 @@ function isLoopbackHostname(h) {
     // prefix (which would let "127.evil.com" masquerade as loopback).
     return isIPv4(host) && host.split('.')[0] === '127';
 }
-/** C6: exact redirect_uri match, with RFC 8252 §7.3 port-agnostic loopback and
+/** Exact redirect_uri match, with RFC 8252 §7.3 port-agnostic loopback and
  *  the fixed claude.ai callback. */
 export function redirectAllowed(redirectUri, docRedirectUris) {
     if (redirectUri === CLAUDE_AI_FIXED_CALLBACK)
@@ -256,7 +256,7 @@ export function buildAuthServer(config, deps = {}) {
         const reg = registered.get(clientId);
         if (reg)
             return { redirect_uris: reg.redirect_uris, dcr: true };
-        // C7/#5: validate the issuer host + scheme BEFORE any outbound fetch, so we
+        // Validate the issuer host + scheme BEFORE any outbound fetch, so we
         // only ever fetch an allowlisted issuer (no arbitrary-URL SSRF surface).
         let issuerHost;
         let scheme;
@@ -281,7 +281,7 @@ export function buildAuthServer(config, deps = {}) {
         if ('error' in got)
             return { error: got.error, message: 'invalid client' };
         const uris = got.doc.redirect_uris;
-        // C6 #14: warn on a localhost-only redirect set (loopback impersonation),
+        // Warn on a localhost-only redirect set (loopback impersonation),
         // once per fetch rather than on every sign-in the cache serves.
         if (got.fresh && uris.every((u) => { try {
             return isLoopbackHostname(new URL(u).hostname);
@@ -299,7 +299,7 @@ export function buildAuthServer(config, deps = {}) {
     /** `incoming`: the artifact spent to get here. If no slot is left for the
      * new state it is unspent, so retrying it works once a slot frees. */
     async function toGoogle(res, sp, incoming) {
-        // H4 F1: without this, a Google URL minted here and forwarded to someone
+        // Without this, a Google URL minted here and forwarded to someone
         // else signs THEM in and hands their subject to the starting client.
         const headers = {};
         if (sp.flow === 'owner_gate') {
@@ -388,7 +388,7 @@ export function buildAuthServer(config, deps = {}) {
             void _spent;
             return toGoogle(res, sp, minted.jti);
         }
-        // In-call re-auth (BV-1): a user-clicked `flow=alias_reauth` link has NO
+        // In-call re-auth: a user-clicked `flow=alias_reauth` link has NO
         // client leg — no code is delivered to any client, the refreshed token is
         // written server-side for the alias — so it skips the client_id/redirect/
         // PKCE requirements. The link must be one this server signed (reauthLink),
@@ -529,7 +529,7 @@ export function buildAuthServer(config, deps = {}) {
         if (st.flow === 'alias_reauth') {
             if (!st.alias)
                 return errorPage(res, 400, 'invalid_request', 'alias_reauth without an alias');
-            // C13 / identity binding (#2/#6): only overwrite the alias's tokens if the
+            // Identity binding: only overwrite the alias's tokens if the
             // completing Google identity IS that alias's configured account — else an
             // attacker who crafts an alias_reauth link and logs in with their OWN
             // account could inject their tokens (account swap). The alias emails (leg
@@ -677,7 +677,7 @@ export function buildAuthServer(config, deps = {}) {
         }
         return json(res, 400, { error: 'unsupported_grant_type', message: 'authorization_code or refresh_token only' });
     };
-    // POST /register (minimal DCR, D2). Parse the raw JSON body directly (the
+    // POST /register (minimal DCR). Parse the raw JSON body directly (the
     // redirect_uris array must survive intact).
     const register = async (req, res) => {
         let parsed;

package/dist/oauth-consent.js

@@ -1,9 +1,9 @@
 import { OAuth2Client } from 'googleapis-common';
 import http from 'node:http';
 import { URL } from 'node:url';
-// Shared loopback OAuth consent (leg C of cc-auth), used by the account wizard
-// (B7) and the `auth --account` CLI. Live-server-safe: typed errors instead of
-// process.exit, and a timeout so a never-completed consent can't wedge a tool
+// Shared loopback OAuth consent (leg C: per-alias Google tokens), used by the
+// account wizard and the `auth --account` CLI. Live-server-safe: typed errors
+// instead of process.exit, and a timeout so a never-completed consent can't wedge a tool
 // call forever. The listener binds an EPHEMERAL loopback port (RFC 8252 §7.3;
 // Google Desktop clients accept any http://localhost:<port> redirect), so a
 // second local process on a fixed port can never break auth.

package/dist/outbound-allowlist.js

@@ -1,7 +1,7 @@
 // Opt-in outbound recipient allowlist for unattended deployments: a
 // prompt-injection blast-radius control (a hijacked agent cannot mail, invite
-// or share outside the operator's list), a safety feature first and an
-// enterprise checkbox second. FREE-core forever (ee-definition-v0 handoff).
+// or share outside the operator's list), a safety feature,
+// available in every install.
 // Off by default: an unset/empty GOOGLE_OUTBOUND_ALLOWLIST gates nothing.
 import { hints } from './hint-provider.js';
 /** Parse GOOGLE_OUTBOUND_ALLOWLIST: comma-separated addresses and @domain

package/dist/reauth-hint.js

@@ -1,6 +1,6 @@
-// B13 in-call re-auth (BV-1): a dead/missing per-account Google token is a
-// leg-C failure. Over stdio the fix is the `auth --account` CLI; over HTTP the
-// user cannot run a CLI, so the hint becomes a clickable, server-signed link
+// In-call re-auth: a dead/missing per-account Google token is a leg-C
+// (per-alias Google token) failure. Over stdio the fix is the `auth --account`
+// CLI; over HTTP the user cannot run a CLI, so the hint becomes a clickable, server-signed link
 // into the AS's clientless alias_reauth flow (AuthServer.reauthLink). The HTTP
 // bootstrap installs the linker when the AS starts; stdio never does.
 import { hints } from './hint-provider.js';

package/dist/registry-transfer.d.ts

@@ -1,4 +1,4 @@
-/** D11 (refuse-only for v1): export/import operate on the FLAT single-owner
+/** Refuse-only for v1: export/import operate on the FLAT single-owner
  * store. A tenant-namespaced layout means the bundle would either miss every
  * tenant's tokens or exfiltrate all of them in one file — refuse instead.
  * Returns the offending dir, or null when the store is flat. */

package/dist/registry-transfer.js

@@ -1,4 +1,4 @@
-// B19: encrypted registry export / import (account-registry.md). Moves a whole
+// Encrypted registry export / import. Moves a whole
 // setup to another machine. The bundle is encrypted under a user PASSPHRASE
 // (portable across machines with different MASTER_KEYs) via the token-store AES
 // primitives; the bundled <alias>.enc token files stay encrypted under the
@@ -11,7 +11,7 @@ import { createCipheriv, createDecipheriv, randomBytes, scryptSync } from 'node:
 import { atomicWriteFileSync, atomicWriteWithLock } from './fs-atomic.js';
 import { ALIAS_RE, configFilePath, CONFIG_VERSION, tenantsDir } from './config-file.js';
 import { getTokenDir } from './accounts.js';
-/** D11 (refuse-only for v1): export/import operate on the FLAT single-owner
+/** Refuse-only for v1: export/import operate on the FLAT single-owner
  * store. A tenant-namespaced layout means the bundle would either miss every
  * tenant's tokens or exfiltrate all of them in one file — refuse instead.
  * Returns the offending dir, or null when the store is flat. */

package/dist/registry.d.ts

@@ -106,7 +106,7 @@ export declare class ToolRegistry {
     /** discover_all: advertise the full curated set at once. Idempotent. */
     expand(): boolean;
     /** discover_reset: back to the lean meta-only surface. Clears reveals too.
-     * BV-8: if a client mishandles a SHRINKING tools/list, this degrades to a
+     * If a client mishandles a SHRINKING tools/list, this degrades to a
      * no-op for that session — tools stay callable regardless (graceful
      * dispatch), zero correctness impact. */
     collapse(): boolean;

package/dist/registry.js

@@ -81,7 +81,7 @@ function isAccountSelector(field) {
     const def = field?._zod?.def;
     if (!def)
         return false;
-    // A2 made account enums .optional(); unwrap it or fan-out silently dies.
+    // Account enums are .optional(); unwrap it or fan-out silently dies.
     if (def.type === 'optional')
         return def.innerType?._zod?.def?.type === 'enum';
     return def.type === 'enum';
@@ -145,7 +145,7 @@ export class ToolRegistry {
                 idempotentHint: cud !== 'create',
                 ...config.annotations,
             };
-            // A12: forced per-call human approval on the irreversible set, even in
+            // Forced per-call human approval on the irreversible set, even in
             // bypass mode. Client-enforced via the wire _meta (Claude Code reads
             // anthropic/* ONLY there); the server verdict stays separate.
             // Every tool also advertises a result-size budget: fat readers declare
@@ -196,7 +196,7 @@ export class ToolRegistry {
                     : writeDisabledResult({ name, service, cud, scopes: config.requiredScopes }, policy, 
                     // Concrete by here: default-account injection wraps this.
                     args[0]?.account);
-            // A2: the ONE default-account injection site — outside the CUD gate and
+            // The ONE default-account injection site — outside the CUD gate and
             // the fan-out parse so both observe a concrete alias; NOT meta-skipped
             // (that is what covers google_api_call with zero bespoke code). Explicit
             // aliases, "*" and CSV pass through untouched.
@@ -392,7 +392,7 @@ export class ToolRegistry {
         return true;
     }
     /** discover_reset: back to the lean meta-only surface. Clears reveals too.
-     * BV-8: if a client mishandles a SHRINKING tools/list, this degrades to a
+     * If a client mishandles a SHRINKING tools/list, this degrades to a
      * no-op for that session — tools stay callable regardless (graceful
      * dispatch), zero correctness impact. */
     collapse() {

package/dist/scope-catalog.d.ts

@@ -8,6 +8,7 @@ export interface BundleCatalogEntry {
     description: string;
     risk: 'low' | 'medium' | 'high';
     workspaceOnly?: boolean;
+    personalRefused?: boolean;
 }
 export declare const ADMIN_SCOPES: string[];
 export declare const BUNDLE_CATALOG: Record<string, BundleCatalogEntry>;
@@ -17,6 +18,10 @@ export declare const BUNDLE_ALIASES: Record<string, string>;
 /** Bundle names are user input: an Object.prototype member ("constructor",
  * "toString") passes a plain `in` or index lookup, so membership is own-key only. */
 export declare function isKnownBundle(name: string): boolean;
+/** A gmail.com or googlemail.com address, which is always a personal Google account. */
+export declare function isPersonalGoogleAddress(email: string): boolean;
+/** The bundles in `bundles` that Google refuses on the consent screen of the account at `email`. */
+export declare function refusedBundlesFor(email: string, bundles: readonly string[]): string[];
 export declare function resolveBundleAliases(bundles: string[]): string[];
 /** Closest catalog key for E_UNKNOWN_BUNDLE remediation (edit distance <= 2). */
 export declare function closestBundle(name: string): string | undefined;

package/dist/scope-catalog.js

@@ -63,6 +63,7 @@ export const BUNDLE_CATALOG = {
         ],
         description: 'Manage Cloud Identity groups and devices across the directory.',
         risk: 'high',
+        personalRefused: true,
     },
     cloudsearch: {
         scopes: ['https://www.googleapis.com/auth/cloud_search'],
@@ -79,6 +80,7 @@ export const BUNDLE_CATALOG = {
         scopes: ['https://www.googleapis.com/auth/keep'],
         description: 'Read and edit Google Keep notes.',
         risk: 'low',
+        personalRefused: true,
     },
     driveactivity: {
         scopes: ['https://www.googleapis.com/auth/drive.activity.readonly'],
@@ -165,6 +167,17 @@ const warnedAliases = new Set();
 export function isKnownBundle(name) {
     return Object.hasOwn(BUNDLE_CATALOG, name);
 }
+const PERSONAL_ADDRESS_RE = /@(?:gmail|googlemail)\.com$/i;
+/** A gmail.com or googlemail.com address, which is always a personal Google account. */
+export function isPersonalGoogleAddress(email) {
+    return PERSONAL_ADDRESS_RE.test(email.trim());
+}
+/** The bundles in `bundles` that Google refuses on the consent screen of the account at `email`. */
+export function refusedBundlesFor(email, bundles) {
+    if (!isPersonalGoogleAddress(email))
+        return [];
+    return bundles.filter((b) => isKnownBundle(b) && BUNDLE_CATALOG[b].personalRefused === true);
+}
 export function resolveBundleAliases(bundles) {
     return bundles.map((name) => {
         const target = Object.hasOwn(BUNDLE_ALIASES, name) ? BUNDLE_ALIASES[name] : undefined;

package/dist/scope-observability.d.ts

@@ -65,7 +65,7 @@ export interface ScopesReport {
             bundle: string;
         }[];
         /** Runtime-signal bucket: static classification cannot prove account
-         * type; doctor (B9) fills it from observed persistent admin 403s. */
+         * type; doctor fills it from observed persistent admin 403s. */
         accountType: string[];
         unknown: string[];
     };

package/dist/scope-observability.js

@@ -79,7 +79,7 @@ export function scopeHint(scope, c, alias) {
                 hint: rendered?.hint ??
                     (`Scope ${scope} is in ${alias}'s profile but not granted (you unchecked it at consent). ` +
                         reauthHint(alias)),
-                // The ONE kind whose retriable the host may flip (Decision 3): the
+                // The ONE kind whose retriable the host may flip: the
                 // owner keeps true, a multi-tenant host may report false because the
                 // fix needs the user in a browser.
                 retriable: rendered?.retriable ?? true,

package/dist/ssrf-guard.js

@@ -1,7 +1,6 @@
-// B13 / C11: SSRF guard for every server-side fetch (the CIMD client_id doc).
-// D4 decision (dependencies-and-bv §2.2): a small AUDITED private-range check,
-// no dependency — HTTPS-only, resolve-then-check ALL addresses (anti-rebind),
-// no redirects followed, and capped size and time. Blocks 10/8, 172.16/12,
+// SSRF guard for every server-side fetch (the CIMD client_id doc).
+// A small AUDITED private-range check, no dependency — HTTPS-only,
+// resolve-then-check ALL addresses (anti-rebind), no redirects followed, and capped size and time. Blocks 10/8, 172.16/12,
 // 192.168/16, 127/8, 169.254/16, 0/8, multicast, ::1, fc00::/7, fe80::/10, and
 // v4-mapped forms.
 import { lookup } from 'node:dns/promises';

package/dist/tenant-purge.js

@@ -1,4 +1,4 @@
-// S1.21: tenant offboarding primitives. Core owns the reusable token-purge
+// Tenant offboarding primitives. Core owns the reusable token-purge
 // legs (generically useful, tenant-id-agnostic); the tenant_delete
 // ORCHESTRATION (what to purge, in what order, from which admin surface)
 // lives with the tenancy module that calls these.

package/dist/tools/_errors.js

@@ -134,7 +134,7 @@ function netCodeOf(error) {
     }
     return undefined;
 }
-/** Console deep-link to enable one API (noob-proofing hint, B10). */
+/** Console deep-link to enable one API (noob-proofing hint). */
 function apiEnableLink(api) {
     return `https://console.cloud.google.com/apis/library/${api}.googleapis.com`;
 }
@@ -397,9 +397,9 @@ export function mapGoogleError(error, account, serviceHints, scopeContext) {
                 hint: rendered?.hint ??
                     (`Network failure (${netCode}) before reaching Google - not an auth or API problem. Usually transient: retry. ` +
                         'If it persists on a high-latency or broken-IPv6 link, raise the happy-eyeballs budget: NODE_OPTIONS=--network-family-autoselection-attempt-timeout=4000 (server default 2000ms), and check connectivity with curl.'),
-                // Not an override site (C5 is the only kind whose retriable the host
-                // may flip): a multi-tenant host keeps core's retriable codes for
-                // network_error.
+                // Not an override site (scope_not_granted is the only kind whose
+                // retriable the host may flip): a multi-tenant host keeps core's
+                // retriable codes for network_error.
                 retriable: RETRIABLE_NET_CODES.has(netCode),
                 account,
             };

package/dist/tools/account-wizard.d.ts

@@ -9,8 +9,9 @@ export interface AddForm {
     otherBundles: string;
     admin: boolean;
 }
-/** Every optional bundle (admin is granted via its own checkbox, not here). */
-export declare function allOptionalBundles(): string[];
+/** Every optional bundle (admin is granted via its own checkbox, not here),
+ * less those Google refuses for the account at `email` when one is given. */
+export declare function allOptionalBundles(email?: string): string[];
 /** elicitation/create form schema (flat primitives only, per the MCP spec). */
 export declare function addFormSchema(): Record<string, unknown>;
 export type AddValidation = {
@@ -53,7 +54,7 @@ export declare function argsToAddForm(a: {
 /** Scopes requested by the profile but NOT granted at consent (granular
  * consent / unchecked bundles). Pure. */
 export declare function scopeGrantDiff(requested: string[], grantedScope: string | undefined): string[];
-/** HTTP-transport consent context (S1.20): set by the HTTP bootstrap. When
+/** HTTP-transport consent context: set by the HTTP bootstrap. When
  * present, runConsent NEVER binds a server-side loopback listener — the
  * user's browser cannot reach the daemon's loopback — and instead hands out
  * a clientless AS consent URL. The injector decides the flow (single-owner =

package/dist/tools/account-wizard.js

@@ -3,7 +3,7 @@ import { getAccountSet, invalidateAccountSet, refreshAccountSetIfStale } from '.
 import { ALIAS_RE, mutateConfigFile } from '../config-file.js';
 import { writeToken } from '../token-store.js';
 import { resolveScopesForAccount } from '../auth.js';
-import { BUNDLE_CATALOG, closestBundle, isKnownBundle, resolveBundleAliases } from '../scope-catalog.js';
+import { BUNDLE_CATALOG, closestBundle, isKnownBundle, refusedBundlesFor, resolveBundleAliases } from '../scope-catalog.js';
 import { openUrl } from '../open-url.js';
 import { coerceBoolean } from './_coerce.js';
 import { safeMessage, stringifyEnvelope } from './_errors.js';
@@ -13,9 +13,14 @@ import { detectClients, buildServerEntry, renderInstruction, applyFileEntry, res
 // multi-select, so a boolean per bundle IS the checklist); the long tail stays
 // a comma-separated field for power users, and `allBundles` grants every one.
 const CHECKBOX_BUNDLES = ['forms', 'chat'];
-/** Every optional bundle (admin is granted via its own checkbox, not here). */
-export function allOptionalBundles() {
-    return Object.keys(BUNDLE_CATALOG).filter((n) => n !== 'admin');
+/** Every optional bundle (admin is granted via its own checkbox, not here),
+ * less those Google refuses for the account at `email` when one is given. */
+export function allOptionalBundles(email) {
+    const all = Object.keys(BUNDLE_CATALOG).filter((n) => n !== 'admin');
+    if (email === undefined)
+        return all;
+    const refused = new Set(refusedBundlesFor(email, all));
+    return all.filter((n) => !refused.has(n));
 }
 /** elicitation/create form schema (flat primitives only, per the MCP spec). */
 export function addFormSchema() {
@@ -49,7 +54,7 @@ export function validateAddForm(input, existingAliases) {
     }
     if (input.allBundles === true) {
         // "All optional scopes" supersedes the individual picks.
-        return { ok: true, alias, email, bundles: allOptionalBundles(), admin: input.admin === true };
+        return { ok: true, alias, email, bundles: allOptionalBundles(email), admin: input.admin === true };
     }
     const picked = CHECKBOX_BUNDLES.filter((b) => input[b] === true);
     const rawOther = (input.otherBundles ?? '').split(',').map((s) => s.trim()).filter(Boolean);
@@ -70,6 +75,16 @@ export function validateAddForm(input, existingAliases) {
             };
         }
     }
+    const refused = refusedBundlesFor(email, bundles);
+    if (refused.length > 0) {
+        return {
+            ok: false,
+            slug: 'E_VALIDATION',
+            message: `Google does not let a personal account grant ${refused.map((b) => `"${b}"`).join(', ')}.`,
+            hint: 'Leave it out, or link a Google Workspace account for it.',
+            alias,
+        };
+    }
     return { ok: true, alias, email, bundles, admin: input.admin === true };
 }
 /** URL-mode elicitation params. `elicitationId` is REQUIRED by the spec
@@ -103,7 +118,7 @@ export function scopeGrantDiff(requested, grantedScope) {
     return requested.filter((s) => !granted.has(s));
 }
 /** Persist a new account row (+ a per-account scope profile when bundles/admin
- * were chosen) through the atomic registry mutation path (BR2). */
+ * were chosen) through the atomic registry mutation path. */
 function writeAccountRow(alias, email, bundles, admin) {
     mutateConfigFile((current) => {
         const next = { ...current, accounts: { ...(current.accounts ?? {}) } };
@@ -157,7 +172,7 @@ function pendingText(alias, url, pending) {
 }
 /** Run Google consent for `alias` and persist the token. Opens the browser via
  * URL-mode elicitation when the client supports it, else server-side + prints
- * the URL. Returns the granted-scope diff for the S4 report. */
+ * the URL. Returns the granted-scope diff for the validation report. */
 async function runConsent(server, alias) {
     const { randomBytes } = await import('node:crypto');
     const cfg = getAccountSet().configs[alias];
@@ -274,14 +289,14 @@ export function registerAccountWizardTools(registry, server, awaitingRestart = (
         try {
             // Env-sourced registry: GOOGLE_ACCOUNTS is the exclusive source and
             // config.json accounts are ignored, so a wizard add would be a phantom
-            // write. Refuse up front (BR-10) rather than write a row nothing reads.
+            // write. Refuse up front rather than write a row nothing reads.
             if (process.env.GOOGLE_ACCOUNTS?.trim()) {
                 return errorResult('E_ENV_ACCOUNTS_MODE', 'Accounts are defined by the GOOGLE_ACCOUNTS environment variable, so a new account cannot be added interactively: config.json is ignored while it is set, and the row would be written where nothing reads it.', 'Either add the alias to GOOGLE_ACCOUNTS and run account_reauth, or run `mcp-google-multi migrate-config` to move accounts into config.json and unset GOOGLE_ACCOUNTS.');
             }
             if (!hasClientCredentials()) {
                 return errorResult('invalid_client', 'GOOGLE_CLIENT_ID and GOOGLE_CLIENT_SECRET are not set, so there is no OAuth client to run consent against.', 'Run the `setup` prompt (/mcp__google-multi__setup) to create an OAuth client, then set them. See docs/google-cloud-setup.md.');
             }
-            // S1: collect the registry row. Arguments win over the form so the
+            // Collect the registry row. Arguments win over the form so the
             // wizard still works in clients without form elicitation (where the
             // interactive path used to dead-end).
             const a = (args ?? {});
@@ -304,7 +319,7 @@ export function registerAccountWizardTools(registry, server, awaitingRestart = (
             const validated = validateAddForm(input, getAccountSet().aliases);
             if (!validated.ok)
                 return errorResult(validated.slug, validated.message, validated.hint, validated.alias);
-            // S2: atomic write + make the alias callable without a restart (BR3).
+            // Atomic write + make the alias callable without a restart.
             writeAccountRow(validated.alias, validated.email, validated.bundles, validated.admin);
             invalidateAccountSet();
             // Live account args validate against the refreshed registry already;
@@ -316,13 +331,13 @@ export function registerAccountWizardTools(registry, server, awaitingRestart = (
             catch {
                 // a client that cannot receive notifications loses nothing but the nudge
             }
-            // S3 + S4: consent + validate.
+            // Consent + validate.
             const consent = await runConsent(server, validated.alias);
             if (consent.ok === 'pending')
                 return textResult(pendingText(validated.alias, consent.url, awaitingRestart()));
             if (!consent.ok)
                 return errorResult(consent.slug, consent.message, consent.hint, validated.alias);
-            // B15: offer to register the server with another MCP client.
+            // Offer to register the server with another MCP client.
             return textResult(`${s4Text(validated.alias, consent.missing, awaitingRestart())}\nTip: run account_write_config to register this server with another MCP client (Claude Desktop / Cursor / Claude Code).`);
         }
         catch (e) {

package/dist/tools/accounts-tool.d.ts

@@ -12,7 +12,7 @@ export interface AccountHealthDeps {
     fileExists: (p: string) => boolean;
     now: () => number;
     /** Scopes required by registered tools — feeds doctor's tool-grained
-     * "registered but not requestable" view (B9). account_list stays compact:
+     * "registered but not requestable" view. account_list stays compact:
      * its report universe is profile ∪ granted only. */
     registeredScopes?: () => string[];
     /** Account view health is derived against; absent = the global registry. */

package/dist/tools/accounts-tool.js

@@ -22,7 +22,7 @@ export function deriveAccountHealth(alias, deps = DEFAULT_DEPS) {
     const config = set.configs[alias];
     const admin = getAdminAccounts(set).includes(alias);
     const configured = resolveScopesForAccount(alias, set);
-    // BR-10: env-sourced accounts are not persisted in config.json, so the
+    // Env-sourced accounts are not persisted in config.json, so the
     // account wizard cannot edit them — the deployer edits env instead.
     const base = {
         alias,

package/dist/tools/admin.js

@@ -6,7 +6,7 @@ import { getClient } from '../client.js';
 import { handleGoogleApiError, invalidParams } from './_errors.js';
 // Admin SDK requires Workspace super-admin (or delegated admin) on the account — personal @gmail.com accounts 403 on every endpoint.
 export function registerAdminTools(server, deps = {}) {
-    // Per-registry, LIVE account enum + injectable client (S1.10): the
+    // Per-registry, LIVE account enum + injectable client: the
     // schema follows the registry's account view at parse time, and the
     // custody path is the context's, not the process global.
     const accountEnum = accountArgLive(() => server.accountAliases()).optional();