mcp-google-multi 6.0.0-beta.2 → 6.0.0-beta.3

package/dist/accounts.d.ts

@@ -18,7 +18,11 @@ export interface AccountSet {
     defaultAccount?: string;
     defaultAccountSource?: 'env' | 'config';
 }
-export declare function resolveAccounts(env?: NodeJS.ProcessEnv, filePath?: string, onInvalid?: 'exit' | 'throw'): AccountSet;
+export declare function resolveAccounts(env?: NodeJS.ProcessEnv, filePath?: string, onInvalid?: 'exit' | 'throw', opts?: {
+    tokenDir?: string;
+    emptyOk?: boolean;
+}): AccountSet;
+export declare function fileStamp(filePath: string, version: number): string;
 /** Live accessor: dispatch-time readers use this, never a captured snapshot. */
 export declare function getAccountSet(): AccountSet;
 /** Re-resolve after a config.json mutation and swap the live set. */
@@ -45,6 +49,18 @@ export declare function unknownAliasMessage(aliases: readonly string[], selector
 export declare function accountAliasSchemaFor(aliases: readonly string[]): z.ZodType<string>;
 /** Shared, load-time snapshot used by every tool's `account` field. */
 export declare const accountAliasSchema: z.ZodType<string>;
+/** Live account argument: validates at PARSE time against the accessor's
+ * CURRENT aliases, so an alias added mid-session (account_add, or a tenant
+ * alias link) is immediately valid on already-registered tools — a baked
+ * z.enum freezes the boot-time set until restart. An empty set stays
+ * permissive (same empty-safe rule as above); dispatch still resolves the
+ * alias against the live registry. */
+export declare function accountArgLive(aliases: () => readonly string[]): z.ZodType<string>;
+/** The live membership check behind accountArgLive and the fan-out field;
+ * `selectors` also admits "*". An empty set stays permissive. */
+export declare function liveAccountCheck(aliases: () => readonly string[], selectors: boolean): z.core.$ZodCheck<string>;
+/** True for a field built on liveAccountCheck, optional or not. */
+export declare function isLiveAccountField(field: unknown): boolean;
 /**
  * BR-4: the stdio/http SERVER never boots with an empty registry — a fresh user
  * bootstraps via env / `migrate-config` / `account import` / `auth` first. The

package/dist/accounts.js

@@ -2,8 +2,8 @@ import path from 'node:path';
 import fs from 'node:fs';
 import { z } from 'zod';
 import { loadEnvFiles } from './env-load.js';
-import { CONFIG_VERSION, configDir, configFilePath, failStartup, loadConfigFile, mutateConfigFile } from './config-file.js';
-import { BUNDLE_CATALOG, closestBundle, resolveBundleAliases } from './scope-catalog.js';
+import { ALIAS_RE, CONFIG_VERSION, configDir, configFilePath, failStartup, isReservedAlias, loadConfigFile, mutateConfigFile } from './config-file.js';
+import { closestBundle, isKnownBundle, resolveBundleAliases } from './scope-catalog.js';
 const envLoad = loadEnvFiles();
 const defaultTokenDir = path.join(configDir(), 'tokens');
 const tokenDir = process.env.TOKEN_STORE_PATH
@@ -15,14 +15,14 @@ export function getTokenDir() {
 function parseCsv(value) {
     return (value ?? '').split(',').map((s) => s.trim()).filter(Boolean);
 }
-function accountPaths(alias) {
+function accountPaths(alias, dir = tokenDir) {
     return {
-        tokenPath: path.join(tokenDir, alias, 'token.json'),
-        encPath: path.join(tokenDir, `${alias}.enc`),
+        tokenPath: path.join(dir, alias, 'token.json'),
+        encPath: path.join(dir, `${alias}.enc`),
     };
 }
 /** v5 env parser, guards verbatim. Format: GOOGLE_ACCOUNTS="alias1:email1,alias2:email2". */
-function parseEnvAccounts(raw, adminAliases) {
+function parseEnvAccounts(raw, adminAliases, dir = tokenDir) {
     const configs = {};
     const aliases = [];
     for (const entry of raw.split(',')) {
@@ -40,7 +40,7 @@ function parseEnvAccounts(raw, adminAliases) {
         }
         // Restrict alias to a safe charset so it can't escape `tokenDir` via path traversal
         // (e.g. "../../etc/passwd:foo@bar.com" in .env).
-        if (!/^[a-zA-Z0-9_-]+$/.test(alias) || ['__proto__', 'constructor', 'prototype'].includes(alias)) {
+        if (!ALIAS_RE.test(alias) || isReservedAlias(alias)) {
             throw new Error(`Invalid alias "${alias}". Allowed characters: letters, digits, underscore, hyphen.`);
         }
         if (aliases.includes(alias)) {
@@ -49,7 +49,7 @@ function parseEnvAccounts(raw, adminAliases) {
         aliases.push(alias);
         configs[alias] = {
             email,
-            ...accountPaths(alias),
+            ...accountPaths(alias, dir),
             admin: adminAliases.includes(alias) || undefined,
             source: 'env',
         };
@@ -74,7 +74,11 @@ function noAccountsMessage() {
  * empty behaves as unset, mirroring GOOGLE_ACCOUNTS semantics.
  */
 let warnedLegacy = false;
-export function resolveAccounts(env = process.env, filePath = configFilePath(), onInvalid = 'exit') {
+export function resolveAccounts(env = process.env, filePath = configFilePath(), onInvalid = 'exit', 
+// emptyOk: zero accounts is a valid set, not an error, even with 'throw'
+// (a context that has linked nothing yet). An invalid file still fails.
+opts = {}) {
+    const dir = opts.tokenDir ?? tokenDir;
     const adminEnv = parseCsv(env.GOOGLE_ADMIN_ACCOUNTS);
     const rawEnv = env.GOOGLE_ACCOUNTS;
     const fail = (slug, message) => {
@@ -91,7 +95,7 @@ export function resolveAccounts(env = process.env, filePath = configFilePath(),
             if (bundle === 'admin') {
                 fail('E_UNKNOWN_BUNDLE', '"admin" is not a global bundle: grant it per account via GOOGLE_ADMIN_ACCOUNTS or an "admin: true" scope profile.');
             }
-            if (!(bundle in BUNDLE_CATALOG)) {
+            if (!isKnownBundle(bundle)) {
                 const hint = closestBundle(bundle);
                 fail('E_UNKNOWN_BUNDLE', `unknown bundle "${bundle}" in GOOGLE_OPTIONAL_SCOPES${hint ? ` — did you mean "${hint}"?` : ''}`);
             }
@@ -102,7 +106,7 @@ export function resolveAccounts(env = process.env, filePath = configFilePath(),
         }
     }
     if (rawEnv && rawEnv.trim() !== '') {
-        const { aliases, configs } = parseEnvAccounts(rawEnv, adminEnv);
+        const { aliases, configs } = parseEnvAccounts(rawEnv, adminEnv, dir);
         materializeFirstRun(aliases, configs, filePath);
         const def = resolveDefaultAccount(env, null, aliases, fail);
         return {
@@ -129,7 +133,7 @@ export function resolveAccounts(env = process.env, filePath = configFilePath(),
         // empty (BR-4), enforced by assertServerAccountsConfigured() in index.ts.
         // The dispatch-path reload ('throw') still throws so a mid-session emptied
         // config.json keeps the last-good registry (BR-7) instead of dropping tools.
-        if (onInvalid === 'throw') {
+        if (onInvalid === 'throw' && !opts.emptyOk) {
             throw new Error(`E_NO_ACCOUNTS_CONFIGURED: ${noAccountsMessage()}`);
         }
         return {
@@ -148,7 +152,7 @@ export function resolveAccounts(env = process.env, filePath = configFilePath(),
     for (const [name, profile] of Object.entries(config?.scopeProfiles ?? {})) {
         const bundles = resolveBundleAliases(profile.bundles);
         for (const bundle of bundles) {
-            if (!(bundle in BUNDLE_CATALOG)) {
+            if (!isKnownBundle(bundle)) {
                 const hint = closestBundle(bundle);
                 fail('E_UNKNOWN_BUNDLE', `unknown bundle "${bundle}" in scope profile "${name}"${hint ? ` — did you mean "${hint}"?` : ''}`);
             }
@@ -167,7 +171,7 @@ export function resolveAccounts(env = process.env, filePath = configFilePath(),
         aliases.push(alias);
         configs[alias] = {
             email: entry.email,
-            ...accountPaths(alias),
+            ...accountPaths(alias, dir),
             scopeProfile: entry.scopeProfile,
             admin: adminEnv.length > 0 ? adminEnv.includes(alias) : entry.admin,
             source: 'config',
@@ -196,7 +200,7 @@ function resolveDefaultAccount(env, fromConfig, aliases, fail) {
     }
     return { defaultAccount: value, defaultAccountSource: fromEnv ? 'env' : 'config' };
 }
-function fileStamp(filePath, version) {
+export function fileStamp(filePath, version) {
     try {
         return `${version}:${fs.statSync(filePath).mtimeMs}`;
     }
@@ -283,6 +287,8 @@ export const ACCOUNTS = current.aliases;
  * enum actually accepts, and naming a runtime-added alias as valid while
  * rejecting it would be a lie. */
 export function unknownAliasMessage(aliases, selectors = false) {
+    if (aliases.length === 0)
+        return 'No Google account is configured yet. Add one with account_add.';
     const all = selectors ? '; "*" for all accounts' : '';
     const csv = selectors && aliases.length > 1 ? `; or a CSV subset like "${aliases.slice(0, 2).join(',')}"` : '';
     return `Unknown account alias. Valid: ${aliases.join(', ')}${all}${csv}. Run account_list if accounts changed since this server started.`;
@@ -301,6 +307,37 @@ export function accountAliasSchemaFor(aliases) {
 }
 /** Shared, load-time snapshot used by every tool's `account` field. */
 export const accountAliasSchema = accountAliasSchemaFor(ACCOUNTS);
+/** Live account argument: validates at PARSE time against the accessor's
+ * CURRENT aliases, so an alias added mid-session (account_add, or a tenant
+ * alias link) is immediately valid on already-registered tools — a baked
+ * z.enum freezes the boot-time set until restart. An empty set stays
+ * permissive (same empty-safe rule as above); dispatch still resolves the
+ * alias against the live registry. */
+export function accountArgLive(aliases) {
+    return z.string().check(liveAccountCheck(aliases, false));
+}
+// The check instance survives the clones .describe() and .optional() make,
+// so it is what marks a field as an account selector for the registry.
+const LIVE_ACCOUNT_CHECKS = new WeakSet();
+/** The live membership check behind accountArgLive and the fan-out field;
+ * `selectors` also admits "*". An empty set stays permissive. */
+export function liveAccountCheck(aliases, selectors) {
+    const check = z.superRefine((value, ctx) => {
+        const current = aliases();
+        if (current.length === 0 || current.includes(value) || (selectors && value === '*'))
+            return;
+        ctx.addIssue({ code: 'custom', message: unknownAliasMessage(current, selectors) });
+    });
+    LIVE_ACCOUNT_CHECKS.add(check);
+    return check;
+}
+/** True for a field built on liveAccountCheck, optional or not. */
+export function isLiveAccountField(field) {
+    let def = field?._zod?.def;
+    if (def?.type === 'optional')
+        def = def.innerType?._zod?.def;
+    return def?.checks?.some((c) => LIVE_ACCOUNT_CHECKS.has(c)) ?? false;
+}
 /**
  * BR-4: the stdio/http SERVER never boots with an empty registry — a fresh user
  * bootstraps via env / `migrate-config` / `account import` / `auth` first. The

package/dist/api-probe.d.ts

@@ -1,3 +1,5 @@
+import { getClient } from './client.js';
+import { readToken } from './token-store.js';
 import type { ApiProbeResult } from './doctor.js';
 export interface ApiProbeSpec {
     service: string;
@@ -15,4 +17,7 @@ export interface ApiProbeDeps {
     grantedScopes: (alias: string) => string[];
     request: (alias: string, url: string) => Promise<void>;
 }
+/** Probe deps over one context's token reads and client; the module-level
+ * pair is the single owner's. */
+export declare function apiProbeDepsFor(readTokenFn: typeof readToken, getClientFn: typeof getClient): ApiProbeDeps;
 export declare function probeApiEnablement(alias: string, deps?: ApiProbeDeps): Promise<ApiProbeResult[]>;

package/dist/api-probe.js

@@ -24,21 +24,26 @@ export const API_PROBES = [
 export function planProbes(granted, probes = API_PROBES) {
     return probes.filter((p) => granted.some((s) => p.scopePrefixes.some((prefix) => s.startsWith(prefix))));
 }
-const DEFAULT_DEPS = {
-    grantedScopes: (alias) => {
-        try {
-            const scope = readToken(alias)?.scope;
-            return typeof scope === 'string' ? scope.split(' ').filter(Boolean) : [];
-        }
-        catch {
-            return [];
-        }
-    },
-    request: async (alias, url) => {
-        const auth = await getClient(alias);
-        await auth.request({ url, timeout: 10_000 });
-    },
-};
+/** Probe deps over one context's token reads and client; the module-level
+ * pair is the single owner's. */
+export function apiProbeDepsFor(readTokenFn, getClientFn) {
+    return {
+        grantedScopes: (alias) => {
+            try {
+                const scope = readTokenFn(alias)?.scope;
+                return typeof scope === 'string' ? scope.split(' ').filter(Boolean) : [];
+            }
+            catch {
+                return [];
+            }
+        },
+        request: async (alias, url) => {
+            const auth = await getClientFn(alias);
+            await auth.request({ url, timeout: 10_000 });
+        },
+    };
+}
+const DEFAULT_DEPS = apiProbeDepsFor(readToken, getClient);
 export async function probeApiEnablement(alias, deps = DEFAULT_DEPS) {
     const results = [];
     for (const spec of planProbes(deps.grantedScopes(alias))) {

package/dist/arg-normalize.js

@@ -1,5 +1,5 @@
-import { screenArguments, unknownArgEnvelope, } from './arg-strict.js';
-import { sliceClean } from './trim.js';
+import { echoName, echoNames, screenArguments, unknownArgEnvelope, } from './arg-strict.js';
+import { logSafe, sliceClean } from './trim.js';
 // The SDK synthesizes input-validation failures as isError RESULTS, skipping
 // the handler entirely: no handler of ours runs, so no envelope exists and the
 // client gets free text. The text is prose in both SDK eras (v1 prefixed it
@@ -115,8 +115,9 @@ export function screenMessage(msg, opts, log = (l) => process.stderr.write(`${l}
     if (screened.unknown.length === 0 && screened.redundant.length === 0)
         return { action: 'forward', msg };
     const all = [...screened.unknown.map((u) => u.sent), ...screened.redundant];
-    // Key names only; argument VALUES never reach the log.
-    log(`[args] ${tool}: undeclared ${all.join(', ')}${opts.mode === 'warn' ? ' (dropped)' : ' (rejected)'}`);
+    // Key names only; argument VALUES never reach the log. The names are the
+    // caller's, so they are escaped here and only here: the envelope is JSON.
+    log(`[args] ${tool}: undeclared ${logSafe(echoNames(all), 600)}${opts.mode === 'warn' ? ' (dropped)' : ' (rejected)'}`);
     try {
         // Only ever a DECLARED key or the literal placeholder, so the metrics
         // closed-vocabulary rule holds: the caller's key is never persisted.
@@ -132,7 +133,7 @@ export function screenMessage(msg, opts, log = (l) => process.stderr.write(`${l}
     const siblings = screened.unknown.some((u) => u.suggestions.length > 0)
         ? []
         : (opts.siblingsFor?.(tool, screened.unknown.map((u) => u.sent)) ?? []);
-    const envelope = unknownArgEnvelope(tool, screened.unknown, declared, typeof account === 'string' ? account : undefined, siblings);
+    const envelope = unknownArgEnvelope(tool, screened.unknown, declared, typeof account === 'string' ? echoName(account) : undefined, siblings);
     return {
         action: 'reject',
         response: {

package/dist/arg-strict.d.ts

@@ -14,6 +14,13 @@ export declare const STRICT_EXEMPT_TOOLS: ReadonlySet<string>;
  * tools: no declared key starts with `_` or contains `/`, so neither rule can
  * shadow a real parameter. */
 export declare function isExemptKey(key: string): boolean;
+/** A call can carry thousands of unknown keys, or one of megabytes: only the
+ * first few earn a did-you-mean, and the log line and the envelope echo a
+ * bounded prefix of each name. The reject decision itself is never capped. */
+export declare const MAX_SUGGESTED_KEYS = 8;
+export declare function echoName(name: string): string;
+/** The first MAX_SUGGESTED_KEYS names, each capped, then "and N more". */
+export declare function echoNames(names: readonly string[], quote?: boolean): string;
 /**
  * Rank declared keys for an unknown key. Tiers, best non-empty tier wins:
  *   0 same key modulo case and separators

package/dist/arg-strict.js

@@ -9,7 +9,8 @@
 // and never touches a VALUE: it only decides that a key is undeclared, and
 // suggests what the caller probably meant. Rewriting would risk sending a real
 // value to Google on a guess, which is strictly worse than refusing.
-import { editDistance } from './scope-catalog.js';
+import { editDistance, SUGGEST_MAX_INPUT } from './scope-catalog.js';
+import { sliceClean } from './trim.js';
 /**
  * `GOOGLE_ARG_UNKNOWN`: reject | warn | off. A typo in the VALUE still falls
  * back to `warn`, not to the default: an operator who misspells the setting
@@ -59,6 +60,20 @@ export function isExemptKey(key) {
  * alone; they match far too much to be useful. */
 const GENERIC = new Set(['id', 'name', 'title', 'body', 'parent', 'text', 'content', 'type', 'value', 'key', 'data']);
 const flatten = (s) => s.toLowerCase().replace(/[^a-z0-9]/g, '');
+/** A call can carry thousands of unknown keys, or one of megabytes: only the
+ * first few earn a did-you-mean, and the log line and the envelope echo a
+ * bounded prefix of each name. The reject decision itself is never capped. */
+export const MAX_SUGGESTED_KEYS = 8;
+const MAX_ECHO_CHARS = 64;
+export function echoName(name) {
+    return name.length > MAX_ECHO_CHARS ? `${sliceClean(name, MAX_ECHO_CHARS)}...` : name;
+}
+/** The first MAX_SUGGESTED_KEYS names, each capped, then "and N more". */
+export function echoNames(names, quote = false) {
+    const shown = names.slice(0, MAX_SUGGESTED_KEYS).map((n) => (quote ? `"${echoName(n)}"` : echoName(n)));
+    const rest = names.length - shown.length;
+    return rest > 0 ? `${shown.join(', ')} and ${rest} more` : shown.join(', ');
+}
 function tokens(s) {
     return s
         .replace(/([a-z0-9])([A-Z])/g, '$1 $2')
@@ -76,6 +91,8 @@ function tokens(s) {
  * distance 6, well past any sane threshold, which is why tier 1 exists.
  */
 export function suggestKeys(unknown, declared, limit = 2) {
+    if (unknown.length > SUGGEST_MAX_INPUT)
+        return [];
     const uFlat = flatten(unknown);
     const uTok = tokens(unknown);
     const tiers = [[], [], [], []];
@@ -94,8 +111,12 @@ export function suggestKeys(unknown, declared, limit = 2) {
             tiers[2].push({ key, rank: Math.abs(kFlat.length - uFlat.length) });
             continue;
         }
+        const maxDist = Math.max(1, Math.floor(uFlat.length / 4));
+        // The distance is at least the length gap: skip the DP when that alone fails.
+        if (Math.abs(uFlat.length - kFlat.length) > maxDist)
+            continue;
         const d = editDistance(uFlat, kFlat);
-        if (d <= Math.max(1, Math.floor(uFlat.length / 4)))
+        if (d <= maxDist)
             tiers[3].push({ key, rank: d });
     }
     const tier = tiers.find((t) => t.length > 0);
@@ -117,10 +138,19 @@ export function screenArguments(tool, args, declared) {
     if (STRICT_EXEMPT_TOOLS.has(tool) || declared.length === 0)
         return out;
     const declaredSet = new Set(declared);
+    // Tier 0 (same key modulo case and separators) is a map lookup, so every key
+    // gets it and a redundant twin is recognised past the ranking budget too.
+    // A near-miss duplicate (a typo sent next to its declared key) is recognised
+    // only within the budget: a call needs 9 of them before one is refused.
+    const byFlat = new Map();
+    for (const k of declared)
+        byFlat.set(flatten(k), [...(byFlat.get(flatten(k)) ?? []), k]);
+    let ranked = 0;
     for (const key of Object.keys(args)) {
         if (declaredSet.has(key) || isExemptKey(key))
             continue;
-        const suggestions = suggestKeys(key, declared);
+        const twins = key.length <= SUGGEST_MAX_INPUT ? byFlat.get(flatten(key)) : undefined;
+        const suggestions = twins ? twins.slice(0, 2) : ranked++ < MAX_SUGGESTED_KEYS ? suggestKeys(key, declared) : [];
         // The caller sent both spellings, so the declared one already won and the
         // outcome is what it has always been. Never fail a call that works today.
         if (suggestions.some((s) => s in args)) {
@@ -133,7 +163,7 @@ export function screenArguments(tool, args, declared) {
 }
 /** The agent-facing envelope. Values are never included, only key names. */
 export function unknownArgEnvelope(tool, unknown, declared, account, siblings = []) {
-    const names = unknown.map((u) => `"${u.sent}"`).join(', ');
+    const names = echoNames(unknown.map((u) => u.sent), true);
     const accepts = `This tool accepts: ${declared.join(', ')}.`;
     const suggested = unknown.flatMap((u) => u.suggestions);
     let hint;

package/dist/auth.d.ts

@@ -1,17 +1,18 @@
+import type { AccountSet } from './accounts.js';
 import { ADMIN_SCOPES } from './scope-catalog.js';
 export declare const BASE_SCOPES: string[];
 export declare const OPTIONAL_SCOPE_BUNDLES: Record<string, string[]>;
 export { ADMIN_SCOPES };
 /** Union of every account's resolved bundles: a service registers if ANY
  * account can authorize it; per-account authz happens at call time (BR2). */
-export declare function getOptionalBundles(): string[];
+export declare function getOptionalBundles(set?: AccountSet): string[];
 /** Aliases granted ADMIN_SCOPES: per-account admin flag (env
  * GOOGLE_ADMIN_ACCOUNTS overrides config.json at resolve) OR the account's
  * scope profile carrying admin (boolean or "admin" bundle) — equivalent forms. */
-export declare function getAdminAccounts(): string[];
+export declare function getAdminAccounts(set?: AccountSet): string[];
 /** Scopes are fixed at consent time: changing an account's profile (or the
  * legacy env) changes its consent set and requires re-running auth. Evaluated
  * per account: `work` can carry admin + gmail_settings while `personal` is
  * never asked for them. */
-export declare function resolveScopesForAccount(alias: string): string[];
+export declare function resolveScopesForAccount(alias: string, set?: AccountSet): string[];
 export declare function runAuthFlow(args: string[]): Promise<void>;

package/dist/auth.js

@@ -1,7 +1,7 @@
 import { randomBytes } from 'node:crypto';
 import { openUrl } from './open-url.js';
 import { ACCOUNTS, getAccountSet } from './accounts.js';
-import { ADMIN_SCOPES, BUNDLE_CATALOG, closestBundle, resolveBundleAliases } from './scope-catalog.js';
+import { ADMIN_SCOPES, BUNDLE_CATALOG, closestBundle, isKnownBundle, resolveBundleAliases } from './scope-catalog.js';
 import { resolveMasterKey } from './master-key.js';
 import { writeToken } from './token-store.js';
 import { buildConsentClient, openLoopbackConsent, TESTING_MODE_WARNING } from './oauth-consent.js';
@@ -48,18 +48,17 @@ function legacyGlobalProfile() {
         if (bundle === 'admin') {
             throw new Error('E_UNKNOWN_BUNDLE: "admin" is not a global bundle: grant it per account via GOOGLE_ADMIN_ACCOUNTS or an "admin: true" scope profile.');
         }
-        if (!(bundle in BUNDLE_CATALOG)) {
+        if (!isKnownBundle(bundle)) {
             const hint = closestBundle(bundle);
             throw new Error(`E_UNKNOWN_BUNDLE: unknown bundle "${bundle}" in GOOGLE_OPTIONAL_SCOPES${hint ? ` — did you mean "${hint}"?` : ''}`);
         }
     }
     return { bundles };
 }
-function profileForAccount(alias) {
+function profileForAccount(alias, set = getAccountSet()) {
     const legacy = legacyGlobalProfile();
     if (legacy)
         return legacy;
-    const set = getAccountSet();
     const name = set.configs[alias]?.scopeProfile ?? 'base';
     // hasOwn: a profile named like an Object.prototype member must never
     // resolve to the inherited function.
@@ -67,14 +66,13 @@ function profileForAccount(alias) {
 }
 /** Union of every account's resolved bundles: a service registers if ANY
  * account can authorize it; per-account authz happens at call time (BR2). */
-export function getOptionalBundles() {
+export function getOptionalBundles(set = getAccountSet()) {
     const legacy = legacyGlobalProfile();
     if (legacy)
         return legacy.bundles.filter(b => b !== 'admin');
     const union = new Set();
-    const set = getAccountSet();
     for (const alias of set.aliases) {
-        for (const b of profileForAccount(alias).bundles) {
+        for (const b of profileForAccount(alias, set).bundles) {
             if (b !== 'admin')
                 union.add(b);
         }
@@ -84,12 +82,12 @@ export function getOptionalBundles() {
 /** Aliases granted ADMIN_SCOPES: per-account admin flag (env
  * GOOGLE_ADMIN_ACCOUNTS overrides config.json at resolve) OR the account's
  * scope profile carrying admin (boolean or "admin" bundle) — equivalent forms. */
-export function getAdminAccounts() {
-    const { aliases, configs } = getAccountSet();
+export function getAdminAccounts(set = getAccountSet()) {
+    const { aliases, configs } = set;
     return aliases.filter((a) => {
         if (configs[a].admin === true)
             return true;
-        const p = profileForAccount(a);
+        const p = profileForAccount(a, set);
         return p.admin === true || p.bundles.includes('admin');
     });
 }
@@ -97,15 +95,15 @@ export function getAdminAccounts() {
  * legacy env) changes its consent set and requires re-running auth. Evaluated
  * per account: `work` can carry admin + gmail_settings while `personal` is
  * never asked for them. */
-export function resolveScopesForAccount(alias) {
-    const profile = profileForAccount(alias);
+export function resolveScopesForAccount(alias, set = getAccountSet()) {
+    const profile = profileForAccount(alias, set);
     const scopes = profile.includesBase === false ? [] : [...BASE_SCOPES];
     for (const bundle of profile.bundles) {
         if (bundle === 'admin')
             continue;
         scopes.push(...BUNDLE_CATALOG[bundle].scopes);
     }
-    if (getAdminAccounts().includes(alias)) {
+    if (getAdminAccounts(set).includes(alias)) {
         scopes.push(...ADMIN_SCOPES);
     }
     return Array.from(new Set(scopes));

package/dist/boot-gates.d.ts

@@ -0,0 +1,26 @@
+export interface MtBootGates {
+    /** True = multi-tenant deployment: the server boots with zero accounts
+     * (tenants provision in-band) and the provisioning gate below replaces the
+     * flat owner-allowlist requirement. */
+    multiTenant: boolean;
+    /** Fail-fast replacement for the E_OWNER_EMAILS_REQUIRED check. MUST refuse
+     * (exit/throw) when no valid provisioning mechanism is configured — an
+     * ungated HTTP endpoint must never boot, whatever the condition checked. */
+    assertProvisioningGate: () => void;
+}
+export declare function setMtBootGates(g: MtBootGates | null): void;
+export declare function mtBootGates(): MtBootGates | null;
+export declare function isMultiTenantBoot(): boolean;
+/** BR-4 applies to stdio always, and to HTTP only when single-owner: a
+ * multi-tenant HTTP deploy starts empty by design. */
+export declare function accountsAssertRequired(wantStdio: boolean, multiTenant: boolean): boolean;
+/** A set GOOGLE_ACCOUNTS on a multi-tenant boot is refused at DEPLOY time:
+ * the env registry is process-wide, so it would graft one operator's accounts
+ * onto every tenant and turn every tenant's first wizard call into a dead
+ * end (the per-call E_ENV_ACCOUNTS_MODE guard), N confusing failures instead
+ * of one clear one. */
+export declare function assertNoEnvAccountsMode(env?: NodeJS.ProcessEnv): void;
+/** Same class, second vector: GOOGLE_OPTIONAL_SCOPES is a process-wide legacy
+ * global scope profile, so on a multi-tenant box one operator's scope choice
+ * would silently apply to every tenant's consent. */
+export declare function assertNoEnvOptionalScopesMode(env?: NodeJS.ProcessEnv): void;

package/dist/boot-gates.js

@@ -0,0 +1,38 @@
+// S1.16: multi-tenant boot gates. The free core never sets these — every
+// helper reduces to today's single-owner behavior when no gates are
+// installed. Deliberately a side-effect-free module (accounts.ts/auth.ts
+// resolve env at import time) so the tenancy module can import it cheaply.
+import { failStartup } from './config-file.js';
+let gates = null;
+export function setMtBootGates(g) {
+    gates = g;
+}
+export function mtBootGates() {
+    return gates;
+}
+export function isMultiTenantBoot() {
+    return gates?.multiTenant === true;
+}
+/** BR-4 applies to stdio always, and to HTTP only when single-owner: a
+ * multi-tenant HTTP deploy starts empty by design. */
+export function accountsAssertRequired(wantStdio, multiTenant) {
+    return wantStdio || !multiTenant;
+}
+/** A set GOOGLE_ACCOUNTS on a multi-tenant boot is refused at DEPLOY time:
+ * the env registry is process-wide, so it would graft one operator's accounts
+ * onto every tenant and turn every tenant's first wizard call into a dead
+ * end (the per-call E_ENV_ACCOUNTS_MODE guard), N confusing failures instead
+ * of one clear one. */
+export function assertNoEnvAccountsMode(env = process.env) {
+    if (env.GOOGLE_ACCOUNTS?.trim()) {
+        failStartup('E_ENV_ACCOUNTS_MODE_MT', 'GOOGLE_ACCOUNTS must not be set on a multi-tenant deployment; accounts are linked in-band per tenant. Unset it and restart.');
+    }
+}
+/** Same class, second vector: GOOGLE_OPTIONAL_SCOPES is a process-wide legacy
+ * global scope profile, so on a multi-tenant box one operator's scope choice
+ * would silently apply to every tenant's consent. */
+export function assertNoEnvOptionalScopesMode(env = process.env) {
+    if (env.GOOGLE_OPTIONAL_SCOPES?.trim()) {
+        failStartup('E_ENV_OPTIONAL_SCOPES_MT', 'GOOGLE_OPTIONAL_SCOPES must not be set on a multi-tenant deployment; scopes are chosen per tenant at consent. Unset it and restart.');
+    }
+}

package/dist/cimd-cache.d.ts

@@ -0,0 +1,38 @@
+export declare const CIMD_TTL_MS: number;
+/** The oldest validated document still served while the cap is full or the issuer cannot answer. */
+export declare const CIMD_MAX_STALE_MS: number;
+/** Fetches at once. A lookup can outlive the fetch that gave up on it, so ssrf-guard caps its own lookups apart. */
+export declare const CIMD_MAX_IN_FLIGHT = 4;
+export declare const CIMD_CACHE_MAX = 256;
+export type CimdDocument = Record<string, unknown>;
+type CimdError = {
+    error: 'E_CIMD_SSRF_BLOCKED' | 'E_CIMD_INVALID';
+};
+/** `fresh` is true only for the request whose fetch produced the document. */
+export type CimdResolution = {
+    doc: CimdDocument;
+    fresh: boolean;
+} | {
+    busy: true;
+} | CimdError;
+export interface CimdCacheDeps {
+    fetch: (clientId: string) => Promise<CimdDocument>;
+    now: () => number;
+    log: (line: string) => void;
+}
+export declare class CimdClientCache {
+    private readonly deps;
+    private readonly entries;
+    private readonly inFlight;
+    private busyLoggedAt;
+    private busySuppressed;
+    constructor(deps: CimdCacheDeps);
+    get size(): number;
+    /** `validate` runs once per fetch, in the request that started it, and every
+     * request waiting on that fetch gets the same answer. */
+    resolve(clientId: string, validate: (doc: CimdDocument) => boolean): Promise<CimdResolution>;
+    private fetchFor;
+    private store;
+    private noteBusy;
+}
+export {};