mcp-google-multi 6.0.0-beta.1 → 6.0.0-beta.3

package/dist/arg-normalize.js

@@ -1,6 +1,24 @@
+import { echoName, echoNames, screenArguments, unknownArgEnvelope, } from './arg-strict.js';
+import { logSafe, sliceClean } from './trim.js';
+// The SDK synthesizes input-validation failures as isError RESULTS, skipping
+// the handler entirely: no handler of ours runs, so no envelope exists and the
+// client gets free text. The text is prose in both SDK eras (v1 prefixed it
+// with "MCP error -32602: ", v2 dropped that prefix), while handler envelopes
+// are always JSON starting with "{".
+const SCHEMA_VALIDATION_TEXT = /^(MCP error -32602: )?Input validation error:/;
+export function isSchemaValidationText(text) {
+    return SCHEMA_VALIDATION_TEXT.test(text);
+}
+/** Capture form of the v2 text. The tool-name class excludes ':' and ' ', so
+ * the first ": " after the name is unambiguously the delimiter. */
+const VALIDATION_PROSE = /^(?:MCP error -32602: )?Input validation error: Invalid arguments for tool ([A-Za-z0-9_.-]+): ([\s\S]+)$/;
+/** The SDK's OTHER synthesized prose on the same catch. Both prefixes are
+ * SDK-authored; a HANDLER's free text is not, and must survive untouched
+ * (the account wizard answers in prose today). */
+const SDK_OUTPUT_PROSE = /^(?:MCP error -32602: )?Output validation error: /;
 // Wire-level tools/call argument normalization. Clients (LLMs) recurringly
 // snake_case a camelCase parameter (thread_id for threadId) and burn a retry
-// on the -32602. A schema-level fix is off the table: SDK 1.x advertises an
+// on the -32602. A schema-level fix is off the table: the SDK advertises an
 // EMPTY input schema for any non-object wrapper (pipe/preprocess), so the
 // only seam that keeps tools/list intact is the JSON-RPC message itself —
 // which is versioned MCP spec, stabler than any SDK internal. The rename is
@@ -36,7 +54,7 @@ export function normalizeCallArguments(shape, args) {
     }
     return { args: out ?? args, renamed };
 }
-export function normalizeMessage(msg, shapeFor, log = (l) => process.stderr.write(`${l}\n`)) {
+export function normalizeMessage(msg, shapeFor, log = (l) => process.stderr.write(`${l}\n`), onRename) {
     const m = msg;
     if (m.method !== 'tools/call' || typeof m.params?.name !== 'string')
         return msg;
@@ -51,16 +69,85 @@ export function normalizeMessage(msg, shapeFor, log = (l) => process.stderr.writ
         return msg;
     // Key names only — argument VALUES never reach the log.
     log(`[args] ${m.params.name}: ${renamed.map(([f, t]) => `${f} -> ${t}`).join(', ')}`);
+    try {
+        onRename?.(m.params.name, renamed.length);
+    }
+    catch { /* observers never break dispatch */ }
     return {
         ...msg,
         params: { ...m.params, arguments: normalized },
     };
 }
+/**
+ * Screen a normalized tools/call for undeclared keys. `warn` forwards exactly
+ * as before and only reports; `reject` answers with the taxonomy envelope and
+ * never reaches the handler, so nothing is sent to Google on a guess.
+ */
+export function screenMessage(msg, opts, log = (l) => process.stderr.write(`${l}\n`)) {
+    if (opts.mode === 'off')
+        return { action: 'forward', msg };
+    const m = msg;
+    if (m.method !== 'tools/call' || typeof m.params?.name !== 'string')
+        return { action: 'forward', msg };
+    const args = m.params.arguments;
+    if (!args || typeof args !== 'object' || Array.isArray(args))
+        return { action: 'forward', msg };
+    const tool = m.params.name;
+    const declared = opts.declaredFor(tool);
+    // Unregistered tool. The spec keeps this a PROTOCOL error (unknown tool is
+    // not something the model can fix by adjusting arguments), so the channel
+    // stays a JSON-RPC error; only the message gets the did-you-mean and the
+    // gated-service next step. Without `unknownTool`, or on a notification,
+    // the SDK's own "not found" still answers.
+    if (!declared) {
+        if (!opts.unknownTool || m.id === undefined)
+            return { action: 'forward', msg };
+        return {
+            action: 'reject',
+            response: {
+                jsonrpc: '2.0',
+                id: m.id,
+                error: { code: -32602, message: opts.unknownTool(tool) },
+            },
+        };
+    }
+    const screened = screenArguments(tool, args, declared);
+    if (screened.unknown.length === 0 && screened.redundant.length === 0)
+        return { action: 'forward', msg };
+    const all = [...screened.unknown.map((u) => u.sent), ...screened.redundant];
+    // Key names only; argument VALUES never reach the log. The names are the
+    // caller's, so they are escaped here and only here: the envelope is JSON.
+    log(`[args] ${tool}: undeclared ${logSafe(echoNames(all), 600)}${opts.mode === 'warn' ? ' (dropped)' : ' (rejected)'}`);
+    try {
+        // Only ever a DECLARED key or the literal placeholder, so the metrics
+        // closed-vocabulary rule holds: the caller's key is never persisted.
+        opts.onDrop?.(tool, screened.unknown.map((u) => u.suggestions[0] ?? '_unmatched'));
+    }
+    catch { /* observers never break dispatch */ }
+    if (opts.mode === 'warn' || screened.unknown.length === 0)
+        return { action: 'forward', msg };
+    // Nothing to answer (a malformed notification): dispatch as before.
+    if (m.id === undefined)
+        return { action: 'forward', msg };
+    const account = args.account;
+    const siblings = screened.unknown.some((u) => u.suggestions.length > 0)
+        ? []
+        : (opts.siblingsFor?.(tool, screened.unknown.map((u) => u.sent)) ?? []);
+    const envelope = unknownArgEnvelope(tool, screened.unknown, declared, typeof account === 'string' ? echoName(account) : undefined, siblings);
+    return {
+        action: 'reject',
+        response: {
+            jsonrpc: '2.0',
+            id: m.id,
+            result: { content: [{ type: 'text', text: JSON.stringify(envelope) }], isError: true },
+        },
+    };
+}
 /** Wrap a server-side transport so tools/call argument keys are normalized
  * before the SDK validates them. The Protocol assigns `onmessage` during
  * connect(); the interceptor lives in that setter, so the wrapper works
  * identically for stdio and (per-request, stateless) HTTP transports. */
-export function withArgNormalization(transport, shapeFor, log) {
+export function withArgNormalization(transport, shapeFor, log, onRename, strict) {
     const wrapper = {
         start: () => transport.start(),
         send: (message, options) => transport.send(message, options),
@@ -70,7 +157,145 @@ export function withArgNormalization(transport, shapeFor, log) {
         get: () => transport.onmessage,
         set: (handler) => {
             transport.onmessage = handler
-                ? (message, extra) => handler(normalizeMessage(message, shapeFor, log), extra)
+                ? (message, extra) => {
+                    // Rename FIRST: a snake_case twin of a declared key is a fix, not
+                    // an unknown argument, so it must never reach the screen.
+                    const normalized = normalizeMessage(message, shapeFor, log, onRename);
+                    if (!strict)
+                        return handler(normalized, extra);
+                    const outcome = screenMessage(normalized, strict, log);
+                    if (outcome.action === 'forward')
+                        return handler(outcome.msg, extra);
+                    // Last-resort fallback: dispatch as before rather than hang the
+                    // caller. The stderr line and the counter already fired above.
+                    // `send` is async, so a rejected promise needs catching too: a
+                    // bare `void` left the client waiting for a frame that never came.
+                    const fallback = () => handler(normalized, extra);
+                    try {
+                        // Answer on the INNER transport so the metrics tap still sees the
+                        // frame and clears its pending id.
+                        void Promise.resolve(transport.send(outcome.response)).catch(fallback);
+                    }
+                    catch {
+                        fallback();
+                    }
+                }
+                : undefined;
+        },
+    });
+    for (const prop of ['onclose', 'onerror']) {
+        Object.defineProperty(wrapper, prop, {
+            get: () => transport[prop],
+            set: (v) => {
+                transport[prop] = v;
+            },
+        });
+    }
+    Object.defineProperty(wrapper, 'sessionId', { get: () => transport.sessionId });
+    if (transport.setProtocolVersion) {
+        wrapper.setProtocolVersion = (v) => transport.setProtocolVersion(v);
+    }
+    // v2-only, called by Protocol.connect() before start(). A no-op today (both
+    // sides default to the same exported constant), but a proxy that silently
+    // eats a member the SDK calls is a bug waiting for the first caller that
+    // passes supportedProtocolVersions explicitly.
+    if (transport.setSupportedProtocolVersions) {
+        wrapper.setSupportedProtocolVersions = (v) => transport.setSupportedProtocolVersions(v);
+    }
+    return wrapper;
+}
+const MAX_ACCOUNT_CHARS = 64;
+const MAX_ISSUE_CHARS = 800;
+const MAX_PROSE_CHARS = 500;
+const ENVELOPE_PENDING_CAP = 1_000;
+export function validationEnvelope(tool, issues, account) {
+    return {
+        error: 'validation_error',
+        message: `${tool} arguments failed validation: ${sliceClean(issues, MAX_ISSUE_CHARS)}`,
+        hint: `Fix the argument named in the message and call again. This tool's inputSchema in tools/list lists every accepted argument, its type and its allowed values. Nothing was sent to Google.`,
+        retriable: false,
+        account: account ?? '',
+    };
+}
+/** Floor for the OTHER bare prose the same SDK catch produces: an output-schema
+ * failure. Nothing is known about the cause, so it says exactly that. */
+export function outputFailureEnvelope(tool, text, account) {
+    return {
+        error: 'internal',
+        message: `${tool} returned a result the protocol rejected: ${sliceClean(text, MAX_PROSE_CHARS)}`,
+        hint: 'A server-side failure, not a rejected argument. Retry once; if it repeats, the message above is the signal to report.',
+        retriable: false,
+        account: account ?? '',
+    };
+}
+export function rewriteValidationFrame(message, pending, opts) {
+    const m = message;
+    // Responses only. A server-initiated REQUEST (elicitation, sampling) also
+    // carries an id, from a different id space, and evicting on it would drop a
+    // real pending call.
+    if (m.id === undefined || m.method !== undefined)
+        return message;
+    const call = pending.get(m.id);
+    pending.delete(m.id);
+    if (m.result?.isError !== true)
+        return message;
+    const content = m.result.content;
+    if (!content || content.length !== 1 || content[0]?.type !== 'text')
+        return message;
+    const text = content[0].text;
+    if (typeof text !== 'string' || text.startsWith('{'))
+        return message;
+    const parsed = isSchemaValidationText(text) ? VALIDATION_PROSE.exec(text) : null;
+    // Anything the SDK did not author is a handler's own answer. Leave it alone.
+    if (!parsed && !SDK_OUTPUT_PROSE.test(text))
+        return message;
+    const tool = parsed?.[1] ?? call?.tool;
+    if (!tool || (opts.isKnownTool && !opts.isKnownTool(tool)))
+        return message;
+    const account = call?.account ?? opts.defaultAccount?.();
+    const envelope = parsed
+        ? validationEnvelope(tool, parsed[2], account)
+        : outputFailureEnvelope(tool, text, account);
+    return {
+        ...message,
+        result: { ...m.result, content: [{ type: 'text', text: JSON.stringify(envelope) }] },
+    };
+}
+export function withValidationEnvelope(transport, opts = {}) {
+    const pending = new Map();
+    const wrapper = {
+        start: () => transport.start(),
+        send: (message, options) => {
+            let out = message;
+            try {
+                out = rewriteValidationFrame(message, pending, opts);
+            }
+            catch { /* the seam may never break the wire */ }
+            return transport.send(out, options);
+        },
+        close: () => transport.close(),
+    };
+    Object.defineProperty(wrapper, 'onmessage', {
+        get: () => transport.onmessage,
+        set: (handler) => {
+            transport.onmessage = handler
+                ? (message, extra) => {
+                    try {
+                        const m = message;
+                        if (m.method === 'tools/call' && m.id !== undefined && typeof m.params?.name === 'string') {
+                            if (pending.size >= ENVELOPE_PENDING_CAP)
+                                pending.clear();
+                            const args = m.params.arguments;
+                            const raw = args && typeof args === 'object' ? args.account : undefined;
+                            pending.set(m.id, {
+                                tool: m.params.name,
+                                account: typeof raw === 'string' ? sliceClean(raw, MAX_ACCOUNT_CHARS) : undefined,
+                            });
+                        }
+                    }
+                    catch { /* never break dispatch */ }
+                    handler(message, extra);
+                }
                 : undefined;
         },
     });

package/dist/arg-strict.d.ts

@@ -0,0 +1,61 @@
+export type UnknownArgMode = 'reject' | 'warn' | 'off';
+/**
+ * `GOOGLE_ARG_UNKNOWN`: reject | warn | off. A typo in the VALUE still falls
+ * back to `warn`, not to the default: an operator who misspells the setting
+ * has said nothing about which behavior they want, and guessing the strict
+ * one would turn a config typo into failing tool calls.
+ */
+export declare function unknownArgMode(env?: NodeJS.ProcessEnv): UnknownArgMode;
+/** Tools that legitimately accept open-ended top-level keys. Empty at 6.0.0:
+ * the escape hatch is NOT one, because its open-endedness lives in the VALUES
+ * of queryParams/body, never in its six fixed top-level keys. */
+export declare const STRICT_EXEMPT_TOOLS: ReadonlySet<string>;
+/** Metadata a client may legitimately attach. Measured against all registered
+ * tools: no declared key starts with `_` or contains `/`, so neither rule can
+ * shadow a real parameter. */
+export declare function isExemptKey(key: string): boolean;
+/** A call can carry thousands of unknown keys, or one of megabytes: only the
+ * first few earn a did-you-mean, and the log line and the envelope echo a
+ * bounded prefix of each name. The reject decision itself is never capped. */
+export declare const MAX_SUGGESTED_KEYS = 8;
+export declare function echoName(name: string): string;
+/** The first MAX_SUGGESTED_KEYS names, each capped, then "and N more". */
+export declare function echoNames(names: readonly string[], quote?: boolean): string;
+/**
+ * Rank declared keys for an unknown key. Tiers, best non-empty tier wins:
+ *   0 same key modulo case and separators
+ *   1 every token of the unknown key appears in the declared key
+ *   2 substring containment of the flattened forms
+ *   3 a genuine typo by edit distance
+ * Plain edit distance alone cannot carry this: parentid -> parentfolderid is
+ * distance 6, well past any sane threshold, which is why tier 1 exists.
+ */
+export declare function suggestKeys(unknown: string, declared: readonly string[], limit?: number): string[];
+export interface ScreenedKey {
+    /** the key the caller sent; for stderr and the agent-facing hint only */
+    sent: string;
+    /** best suggestions, always declared keys of the tool being called */
+    suggestions: string[];
+}
+export interface ScreenResult {
+    unknown: ScreenedKey[];
+    /** dropped exactly as before: the caller also sent the declared key */
+    redundant: string[];
+}
+/**
+ * Split a call's post-rename keys into declared, redundant-duplicate and
+ * genuinely unknown. `declared` is the tool's full declared key list.
+ */
+export declare function screenArguments(tool: string, args: Record<string, unknown>, declared: readonly string[]): ScreenResult;
+export interface SiblingSpelling {
+    key: string;
+    tools: string[];
+}
+/** The agent-facing envelope. Values are never included, only key names. */
+export declare function unknownArgEnvelope(tool: string, unknown: ScreenedKey[], declared: readonly string[], account: string | undefined, siblings?: SiblingSpelling[]): {
+    error: string;
+    message: string;
+    hint: string;
+    retriable: boolean;
+    account?: string;
+};

package/dist/arg-strict.js

@@ -0,0 +1,193 @@
+// Unknown-argument screening (backlog item 14). zod strips undeclared keys
+// before a handler runs, so a misremembered argument name used to produce a
+// SUCCESS response with wrong behavior: `parentId` on drive_create_folder was
+// dropped and the folder landed in My Drive root. Field-reported, then
+// reproduced: the typo, the correct name and a wholly invented key all
+// returned byte-identical responses.
+//
+// This module is pure and holds no registry reference. It never rewrites a key
+// and never touches a VALUE: it only decides that a key is undeclared, and
+// suggests what the caller probably meant. Rewriting would risk sending a real
+// value to Google on a guess, which is strictly worse than refusing.
+import { editDistance, SUGGEST_MAX_INPUT } from './scope-catalog.js';
+import { sliceClean } from './trim.js';
+/**
+ * `GOOGLE_ARG_UNKNOWN`: reject | warn | off. A typo in the VALUE still falls
+ * back to `warn`, not to the default: an operator who misspells the setting
+ * has said nothing about which behavior they want, and guessing the strict
+ * one would turn a config typo into failing tool calls.
+ */
+export function unknownArgMode(env = process.env) {
+    const raw = (env.GOOGLE_ARG_UNKNOWN ?? '').trim().toLowerCase();
+    if (raw === '')
+        return DEFAULT_MODE;
+    if (raw === 'reject' || raw === 'warn' || raw === 'off')
+        return raw;
+    process.stderr.write(`GOOGLE_ARG_UNKNOWN="${raw}" is not valid (reject | warn | off); using warn\n`);
+    return 'warn';
+}
+// The staged rollout is over: `warn` shipped first as pure observability, and
+// this is the flip it was staging for. An undeclared argument is dropped by
+// zod before the handler runs, so `warn` means the CLIENT sees a confident
+// success for a call the server did not perform: drive_list with a misspelled
+// folder key returned the My Drive root, byte-identical to no argument at all.
+// A wrong answer that reads as right is the failure mode agents recover from
+// worst, so the default refuses the call and says what it probably meant.
+const DEFAULT_MODE = 'reject';
+/** Tools that legitimately accept open-ended top-level keys. Empty at 6.0.0:
+ * the escape hatch is NOT one, because its open-endedness lives in the VALUES
+ * of queryParams/body, never in its six fixed top-level keys. */
+export const STRICT_EXEMPT_TOOLS = new Set();
+/** Keys a CLIENT adds on its own, not keys the model chose. `random_string`
+ * is the long-standing probe some clients send to a tool they read as taking
+ * no arguments; the others are call-plumbing that bridges and proxies have
+ * been observed to fold into `arguments` instead of `params._meta`, where the
+ * spec puts them. Rejecting these would fail a call the model got right.
+ * Measured against the full 978-tool surface: none is a declared key. */
+const CLIENT_ARTIFACT_KEYS = new Set([
+    'random_string',
+    'toolCallId',
+    'tool_call_id',
+    'tool_call_description',
+]);
+/** Metadata a client may legitimately attach. Measured against all registered
+ * tools: no declared key starts with `_` or contains `/`, so neither rule can
+ * shadow a real parameter. */
+export function isExemptKey(key) {
+    return key.startsWith('_') || key.includes('/') || CLIENT_ARTIFACT_KEYS.has(key);
+}
+/** Generic words that must never be offered as a suggestion on containment
+ * alone; they match far too much to be useful. */
+const GENERIC = new Set(['id', 'name', 'title', 'body', 'parent', 'text', 'content', 'type', 'value', 'key', 'data']);
+const flatten = (s) => s.toLowerCase().replace(/[^a-z0-9]/g, '');
+/** A call can carry thousands of unknown keys, or one of megabytes: only the
+ * first few earn a did-you-mean, and the log line and the envelope echo a
+ * bounded prefix of each name. The reject decision itself is never capped. */
+export const MAX_SUGGESTED_KEYS = 8;
+const MAX_ECHO_CHARS = 64;
+export function echoName(name) {
+    return name.length > MAX_ECHO_CHARS ? `${sliceClean(name, MAX_ECHO_CHARS)}...` : name;
+}
+/** The first MAX_SUGGESTED_KEYS names, each capped, then "and N more". */
+export function echoNames(names, quote = false) {
+    const shown = names.slice(0, MAX_SUGGESTED_KEYS).map((n) => (quote ? `"${echoName(n)}"` : echoName(n)));
+    const rest = names.length - shown.length;
+    return rest > 0 ? `${shown.join(', ')} and ${rest} more` : shown.join(', ');
+}
+function tokens(s) {
+    return s
+        .replace(/([a-z0-9])([A-Z])/g, '$1 $2')
+        .split(/[\s_\-.]+/)
+        .map((t) => t.toLowerCase())
+        .filter(Boolean);
+}
+/**
+ * Rank declared keys for an unknown key. Tiers, best non-empty tier wins:
+ *   0 same key modulo case and separators
+ *   1 every token of the unknown key appears in the declared key
+ *   2 substring containment of the flattened forms
+ *   3 a genuine typo by edit distance
+ * Plain edit distance alone cannot carry this: parentid -> parentfolderid is
+ * distance 6, well past any sane threshold, which is why tier 1 exists.
+ */
+export function suggestKeys(unknown, declared, limit = 2) {
+    if (unknown.length > SUGGEST_MAX_INPUT)
+        return [];
+    const uFlat = flatten(unknown);
+    const uTok = tokens(unknown);
+    const tiers = [[], [], [], []];
+    for (const key of declared) {
+        const kFlat = flatten(key);
+        const kTok = tokens(key);
+        if (kFlat === uFlat) {
+            tiers[0].push({ key, rank: 0 });
+            continue;
+        }
+        if (uTok.length >= 2 && uTok.every((t) => kTok.includes(t))) {
+            tiers[1].push({ key, rank: Math.abs(kTok.length - uTok.length) });
+            continue;
+        }
+        if (uFlat.length >= 4 && !GENERIC.has(kFlat) && (kFlat.includes(uFlat) || uFlat.includes(kFlat))) {
+            tiers[2].push({ key, rank: Math.abs(kFlat.length - uFlat.length) });
+            continue;
+        }
+        const maxDist = Math.max(1, Math.floor(uFlat.length / 4));
+        // The distance is at least the length gap: skip the DP when that alone fails.
+        if (Math.abs(uFlat.length - kFlat.length) > maxDist)
+            continue;
+        const d = editDistance(uFlat, kFlat);
+        if (d <= maxDist)
+            tiers[3].push({ key, rank: d });
+    }
+    const tier = tiers.find((t) => t.length > 0);
+    if (!tier)
+        return [];
+    // Stable: declaration order breaks rank ties.
+    return tier
+        .map((e, i) => ({ ...e, i }))
+        .sort((a, b) => a.rank - b.rank || a.i - b.i)
+        .slice(0, limit)
+        .map((e) => e.key);
+}
+/**
+ * Split a call's post-rename keys into declared, redundant-duplicate and
+ * genuinely unknown. `declared` is the tool's full declared key list.
+ */
+export function screenArguments(tool, args, declared) {
+    const out = { unknown: [], redundant: [] };
+    if (STRICT_EXEMPT_TOOLS.has(tool) || declared.length === 0)
+        return out;
+    const declaredSet = new Set(declared);
+    // Tier 0 (same key modulo case and separators) is a map lookup, so every key
+    // gets it and a redundant twin is recognised past the ranking budget too.
+    // A near-miss duplicate (a typo sent next to its declared key) is recognised
+    // only within the budget: a call needs 9 of them before one is refused.
+    const byFlat = new Map();
+    for (const k of declared)
+        byFlat.set(flatten(k), [...(byFlat.get(flatten(k)) ?? []), k]);
+    let ranked = 0;
+    for (const key of Object.keys(args)) {
+        if (declaredSet.has(key) || isExemptKey(key))
+            continue;
+        const twins = key.length <= SUGGEST_MAX_INPUT ? byFlat.get(flatten(key)) : undefined;
+        const suggestions = twins ? twins.slice(0, 2) : ranked++ < MAX_SUGGESTED_KEYS ? suggestKeys(key, declared) : [];
+        // The caller sent both spellings, so the declared one already won and the
+        // outcome is what it has always been. Never fail a call that works today.
+        if (suggestions.some((s) => s in args)) {
+            out.redundant.push(key);
+            continue;
+        }
+        out.unknown.push({ sent: key, suggestions });
+    }
+    return out;
+}
+/** The agent-facing envelope. Values are never included, only key names. */
+export function unknownArgEnvelope(tool, unknown, declared, account, siblings = []) {
+    const names = echoNames(unknown.map((u) => u.sent), true);
+    const accepts = `This tool accepts: ${declared.join(', ')}.`;
+    const suggested = unknown.flatMap((u) => u.suggestions);
+    let hint;
+    if (suggested.length > 0) {
+        const did = unknown
+            .filter((u) => u.suggestions.length > 0)
+            .map((u) => u.suggestions.map((s) => `"${s}"`).join(' or '))
+            .join(', ');
+        hint = `Did you mean ${did}? ${accepts}`;
+    }
+    else if (siblings.length > 0) {
+        const spelled = siblings
+            .map((s) => `"${s.key}" (${s.tools.slice(0, 3).join(', ')})`)
+            .join(' and ');
+        hint = `${accepts} Other tools in this service spell a similar argument ${spelled}.`;
+    }
+    else {
+        hint = accepts;
+    }
+    return {
+        error: 'unknown_argument',
+        message: `${tool} does not accept ${names}. Nothing was sent to Google.`,
+        hint,
+        retriable: false,
+        ...(account !== undefined ? { account } : {}),
+    };
+}

package/dist/auth.d.ts

@@ -1,17 +1,18 @@
+import type { AccountSet } from './accounts.js';
 import { ADMIN_SCOPES } from './scope-catalog.js';
 export declare const BASE_SCOPES: string[];
 export declare const OPTIONAL_SCOPE_BUNDLES: Record<string, string[]>;
 export { ADMIN_SCOPES };
 /** Union of every account's resolved bundles: a service registers if ANY
  * account can authorize it; per-account authz happens at call time (BR2). */
-export declare function getOptionalBundles(): string[];
+export declare function getOptionalBundles(set?: AccountSet): string[];
 /** Aliases granted ADMIN_SCOPES: per-account admin flag (env
  * GOOGLE_ADMIN_ACCOUNTS overrides config.json at resolve) OR the account's
  * scope profile carrying admin (boolean or "admin" bundle) — equivalent forms. */
-export declare function getAdminAccounts(): string[];
+export declare function getAdminAccounts(set?: AccountSet): string[];
 /** Scopes are fixed at consent time: changing an account's profile (or the
  * legacy env) changes its consent set and requires re-running auth. Evaluated
  * per account: `work` can carry admin + gmail_settings while `personal` is
  * never asked for them. */
-export declare function resolveScopesForAccount(alias: string): string[];
+export declare function resolveScopesForAccount(alias: string, set?: AccountSet): string[];
 export declare function runAuthFlow(args: string[]): Promise<void>;