mixdog 1.3.5 → 1.4.0

package/src/session-runtime/resource-mcp-api.mjs

@@ -2,69 +2,31 @@
 // the per-server intent (enabled flag) of servers registered plugins declare.
 // Plugin servers are derived live (mcp-glue/plugin-servers.mjs) and are never
 // written into `mcpServers`; ordinary edits refuse them.
+// The units it is assembled from: resource-mcp-store.mjs (the `mcpServers`
+// registry), resource-mcp-secrets.mjs (keychain side), resource-mcp-connector-
+// accounts.mjs (multi-account connector accounts), resource-mcp-oauth-api.mjs
+// (sign-in / sign-out) and resource-mcp-servers.mjs (pure map reads).
 import { clean } from '../runtime/agent/orchestrator/runtime-core/session-text.mjs';
-import {
-  mergeMcpServerConfig,
-  MCP_TIMEOUT_FIELD_GROUPS,
-} from '../runtime/agent/orchestrator/runtime-core/plugin-mcp.mjs';
-import { resolveMcpOAuthUrl } from '../runtime/agent/orchestrator/mcp/client-config.mjs';
-import { withAdoptedCopies, withPinnedCollisionNames, withPluginServerIntent } from './mcp-glue/plugin-servers.mjs';
+import { mergeMcpServerConfig } from '../runtime/agent/orchestrator/runtime-core/plugin-mcp.mjs';
+import { withAdoptedCopies, withPluginServerIntent } from './mcp-glue/plugin-servers.mjs';
 import { findRegisteredPlugin } from './resource-plugins-api.mjs';
-import { createMcpOAuthLogins } from './mcp-oauth-login.mjs';
-import { connectorById, gmailAppPasswordAccount, gmailAppPasswordValue } from '../runtime/shared/connector-catalog.mjs';
+import { migrateMergedConnectorServers } from './connector-merge-migration.mjs';
+import {
+  connectorAccountServers,
+  connectorAccountsOf,
+  connectorById,
+  connectorMultiAccount,
+  gmailAppPasswordAccount,
+  mergeConnectorAccountServers,
+} from '../runtime/shared/connector-catalog.mjs';
 import { saveMcpOAuthClientSecret } from '../runtime/agent/orchestrator/mcp/oauth-client.mjs';
 import { forgetGmailAppPassword, saveGmailAppPassword } from '../runtime/connectors/gmail-app-password.mjs';
-
-/** The URL a server's OAuth credentials are stored under, or null. */
-function oauthUrlOf(cfg) {
-  try {
-    return resolveMcpOAuthUrl(cfg);
-  } catch {
-    // No valid remote URL: such a server never logged in.
-    return null;
-  }
-}
-
-/** The `mcpServers` map of a config as a fresh object (never the live one). */
-function mcpServersOf(config) {
-  return config.mcpServers && typeof config.mcpServers === 'object' ? { ...config.mcpServers } : {};
-}
-
-function pluginOwnedError(name, owner) {
-  return new Error(
-    `MCP server "${name}" is provided by plugin "${owner.id}" (server "${owner.key}"); ` +
-      'enable or disable it with set_mcp_enabled, or manage the plugin instead'
-  );
-}
-
-const transportType = (type) => (type === 'streamable-http' ? 'http' : type);
-
-/** UI editors send complete transports; setup may send a partial patch. Merge
- *  the patch over the existing entry, keeping omitted fields (including
- *  credentials) unless the transport itself changed. */
-function mergedServerInput(input, existing, originalName) {
-  const transportChanged =
-    (input.type && transportType(input.type) !== transportType(existing.type || (existing.url ? 'http' : 'stdio'))) ||
-    (input.command && existing.url) ||
-    (input.url && !existing.url);
-  const maps = {};
-  if (!transportChanged) {
-    for (const key of ['env', 'headers', 'env_http_headers']) {
-      if (Object.hasOwn(input, key)) maps[key] = { ...(existing[key] || {}), ...input[key] };
-    }
-  }
-  // Existing timeouts are kept by mergeMcpServerConfig; the normalizer must only
-  // see (and validate) newly supplied ones, so a stored 0/'off' never blocks
-  // an unrelated save.
-  const { ...base } = transportChanged ? {} : existing;
-  for (const field of MCP_TIMEOUT_FIELD_GROUPS.flat()) delete base[field];
-  return {
-    ...base,
-    ...input,
-    ...maps,
-    name: clean(input.name) || originalName,
-  };
-}
+import { extensionScopesFromConfig, withExtensionScope } from '../runtime/shared/extension-scopes.mjs';
+import { accountTarget, mcpServersOf, mergedServerInput, nameTakenError } from './resource-mcp-servers.mjs';
+import { createMcpServerStore } from './resource-mcp-store.mjs';
+import { createMcpServerSecrets } from './resource-mcp-secrets.mjs';
+import { createConnectorAccountEdits, editsServerItself } from './resource-mcp-connector-accounts.mjs';
+import { createMcpOAuthApi } from './resource-mcp-oauth-api.mjs';
 
 export function createMcpResourceApi({ deps, sync, decorate }) {
   const {
@@ -92,121 +54,82 @@ export function createMcpResourceApi({ deps, sync, decorate }) {
     saveOAuthClientSecret = saveMcpOAuthClientSecret,
   } = deps;
 
-  const reconnectOne = async (name) => {
-    const status = await connectConfiguredMcp({ only: name, enabled: true });
-    const row = status?.servers?.find((server) => server.name === name);
-    return { connected: row?.connected === true, error: row?.error || null };
-  };
-  // Explicit OAuth sign-in: the one interactive MCP connect. On success the
-  // other runtimes reconnect the server non-interactively with the new tokens.
-  const oauthLogins = createMcpOAuthLogins({
-    async connect(name, openBrowser) {
-      const status = await connectConfiguredMcp({ only: name, enabled: true, login: { openBrowser } });
-      const row = status?.servers?.find((server) => server.name === name);
-      return { connected: row?.connected === true, error: row?.error || null };
-    },
-    cancel: (name) => cancelMcpLogin(name),
-    completeCallback: completeMcpLogin,
-    // 계정 바꾸기, transactionally: the working connection stays until the new
-    // sign-in succeeded and connects; a cancel or failure changes nothing, and
-    // a new sign-in that cannot connect is rolled back.
-    async switchAccount(name, launch, attempt) {
-      const cfg = resolveMcpCatalog().servers[name];
-      const switching = startMcpServerOAuthSwitch(cfg, launch, name);
-      attempt.abort = () => switching.cancel();
-      attempt.answer = (callbackUrl) => switching.answer(callbackUrl);
-      const signIn = await switching.done;
-      const rollback = await commitMcpServerOAuthSwitch(cfg, signIn);
-      const outcome = await reconnectOne(name);
-      if (outcome.connected) return outcome;
-      await rollback();
-      await reconnectOne(name);
-      return { connected: false, error: outcome.error || 'The new sign-in could not connect' };
-    },
-    onComplete: (name) => sync.announce('mcp', { detail: { mcpChanges: [{ name, enabled: true }] } }),
+  const oauthApi = createMcpOAuthApi({
+    sync,
+    mcpStatus,
+    connectConfiguredMcp,
+    clearMcpServerOAuth,
+    reloadFullConfig,
+    awaitKeychainPrewarm,
+    resolveMcpCatalog,
+    cancelMcpLogin,
+    completeMcpLogin,
+    getMcpServerOAuthState,
+    probeMcpServerAuth,
+    startMcpServerOAuthSwitch,
+    commitMcpServerOAuthSwitch,
+  });
+  const { adoptedConfig, saveServers, userServers, freeName, refusePluginServer } = createMcpServerStore({
+    getConfig,
+    saveConfigAndAdopt,
+    resolveMcpCatalog,
+    pluginMcpServer,
+  });
+  const { storeOAuthClientSecret, storeGmailAppPassword, releaseOAuth, forgetUnusedGmailAppPassword, releaseAccount } =
+    createMcpServerSecrets({
+      gmailAppPassword,
+      saveOAuthClientSecret,
+      clearMcpServerOAuth,
+      resolveConfiguredMcpCatalog,
+    });
+  const { addConnectorAccount, saveConnectorAccount, setConnectorAccountEnabled } = createConnectorAccountEdits({
+    normalizeMcpServerInput,
+    pluginMcpServer,
+    sync,
+    saveServers,
+    freeName,
+    storeOAuthClientSecret,
+    storeGmailAppPassword,
+    forgetUnusedGmailAppPassword,
+    releaseOAuth,
   });
-  /** The effective config of a server that signs in with MCP OAuth (HTTP/SSE
-   *  without configured authentication). */
-  const oauthServerConfig = async (name) => {
-    const serverName = clean(name);
-    if (!serverName) throw new Error('MCP server name is required');
-    await awaitKeychainPrewarm();
-    reloadFullConfig();
-    const cfg = resolveMcpCatalog().servers[serverName];
-    if (!cfg) throw new Error(`MCP server not configured: ${serverName}`);
-    if (!getMcpServerOAuthState(cfg)) throw new Error(`MCP server "${serverName}" does not use OAuth sign-in`);
-    return { serverName, cfg };
-  };
-
-  /** The config with any adoptable plugin server copies already adopted, so
-   *  every write also persists the adoption and never re-adds a copy. */
-  const adoptedConfig = () => withAdoptedCopies(getConfig(), resolveMcpCatalog().adoption);
-
-  /** Persist a new `mcpServers` map; project overrides never survive a global
-   *  edit. A plugin server pushed off its name by the edit keeps the collision
-   *  name it gets, so it does not flip again later. */
-  const saveServers = (servers) => {
-    const nextConfig = { ...adoptedConfig() };
-    delete nextConfig.mcpProjectOverrides;
-    saveConfigAndAdopt({ ...nextConfig, mcpServers: servers });
-    const saved = getConfig();
-    const pinned = withPinnedCollisionNames(saved, resolveMcpCatalog());
-    if (pinned !== saved) saveConfigAndAdopt(pinned);
-  };
-  const userServers = () => mcpServersOf(adoptedConfig());
-  const refusePluginServer = (name) => {
-    const owned = name ? pluginMcpServer(name) : null;
-    if (owned) throw pluginOwnedError(name, owned.owner);
-  };
-  // The user's OAuth client secret (custom connector → 고급 설정 → 비밀값)
-  // goes to the keychain only; clearing the client id forgets it.
-  const storeOAuthClientSecret = async (input, cfg, previous = {}) => {
-    if (!cfg?.url) return;
-    const secret = typeof input.oauthClientSecret === 'string' ? input.oauthClientSecret.trim() : '';
-    if (cfg.oauthClientId && secret) await saveOAuthClientSecret(cfg.url, secret);
-    else if (!cfg.oauthClientId && previous.oauthClientId) await saveOAuthClientSecret(previous.url || cfg.url, '');
-  };
-  // Gmail with an app password (connector-catalog.mjs GMAIL_APP_PASSWORD): the
-  // password is checked with Gmail before anything is saved and goes to the
-  // keychain only. A new connection needs one; an edit without one keeps it.
-  const storeGmailAppPassword = async (input, cfg, required) => {
-    const account = gmailAppPasswordAccount(cfg);
-    if (!account) return;
-    const password = gmailAppPasswordValue(input.appPassword);
-    if (password) await gmailAppPassword.save(account, password);
-    else if (required || input.appPassword !== undefined) {
-      throw new Error('GMAIL_APP_PASSWORD_FORMAT: An app password has 16 characters.');
-    }
-  };
-  // A server's OAuth tokens and client registration go with it, unless another
-  // configured server (plugin or disabled ones included, even with MCP
-  // disabled for this runtime) still uses them through the same exact URL.
-  // `signIn` tells the caller what happened to the sign-in: `removed` (local
-  // secrets deleted, `revoked` when the provider confirmed the revocation
-  // too), `shared` (another server still uses it), or none (null).
-  const releaseOAuth = async (cfg) => {
-    const url = oauthUrlOf(cfg);
-    if (!url) return null;
-    if (Object.values(resolveConfiguredMcpCatalog().servers).some((other) => oauthUrlOf(other) === url)) {
-      return { signIn: 'shared', revoked: false };
-    }
-    const { revoked = false } = (await clearMcpServerOAuth(cfg, { revoke: true })) || {};
-    return { signIn: 'removed', revoked };
-  };
-  // An app password is deleted once no configured server uses its account.
-  const forgetUnusedGmailAppPassword = async (account) => {
-    if (!account) return false;
-    const servers = Object.values(resolveConfiguredMcpCatalog().servers);
-    if (servers.some((cfg) => gmailAppPasswordAccount(cfg) === account)) return false;
-    await gmailAppPassword.forget(account);
-    return true;
-  };
   // Peers reload config from disk on receipt: land the write before publishing.
   const persisted = async () => {
     await flushSkillsSave?.();
   };
 
   return {
+    /** One-time, idempotent: merge the one-account servers of a multi-account
+     *  connector (`gmail`, `gmail-2`…) into one server holding the accounts
+     *  (connector-catalog.mjs mergeConnectorAccountServers). Every account
+     *  keeps its address, so its stored sign-in and app password stay as
+     *  they are. Settings keyed by a merged-away server name go with it:
+     *  scopes (`extensionScopes.mcp`) are dropped, and the accounts of a
+     *  server that was off stay off (`enabled: false` on the account);
+     *  per-agent / per-project connector settings and data-dir hooks move to
+     *  the surviving server first (connector-merge-migration.mjs); a store
+     *  that fails stays in a pending record that every start retries.
+     *  Returns what was merged. */
+    migrateConnectorAccounts() {
+      const config = getConfig();
+      const { servers, merged } = mergeConnectorAccountServers(mcpServersOf(config));
+      // Also retries, without a merge, what an earlier start could not migrate.
+      const settings = migrateMergedConnectorServers(
+        deps.cfgMod?.getPluginData?.() || deps.STANDALONE_DATA_DIR,
+        merged
+      );
+      if (!merged.length) return merged;
+      // Neither migrated nor recorded for a retry: merging again next start is the retry.
+      if (settings.unrecorded && settings.failed.length) return [];
+      let next = { ...config, mcpServers: servers };
+      const scoped = extensionScopesFromConfig(config).mcp;
+      for (const { name, from } of merged) {
+        for (const gone of from)
+          if (gone !== name && Object.hasOwn(scoped, gone)) next = withExtensionScope(next, 'mcp', gone, null);
+      }
+      saveConfigAndAdopt(next);
+      return merged;
+    },
     /** One-time, idempotent: move server copies an earlier plugin enable wrote
      *  into `mcpServers` to per-server plugin intent. Returns adopted names. */
     migratePluginMcpCopies() {
@@ -224,62 +147,14 @@ export function createMcpResourceApi({ deps, sync, decorate }) {
     async reconnectMcp(name) {
       await awaitKeychainPrewarm();
       reloadFullConfig();
-      const serverName = clean(name);
+      // An account reconnects with its server.
+      const serverName = accountTarget(resolveMcpCatalog().servers, clean(name))?.serverName || clean(name);
       if (!serverName) return sync.reconnectMcpAndAnnounce();
       const { enabled } = getMcpServerConfig(serverName);
       return sync.reconnectMcpAndAnnounce({ only: serverName, enabled });
     },
-    /** `{ flowId, state: 'pending', url }` once the browser login starts
-     *  (`options.openBrowser === false` leaves opening `url` to the caller), or
-     *  `{ flowId, state: 'complete' }` when stored credentials sufficed. */
-    async beginMcpOAuthLogin(name, options = {}) {
-      const { serverName, cfg } = await oauthServerConfig(name);
-      if (cfg.enabled === false) throw new Error(`MCP server is disabled: ${serverName}`);
-      // `mode`: `connect` (a normal authorization), `reauth` (repair the same
-      // connection; a refresh is tried first) or `switch` (계정 바꾸기).
-      if (options?.mode === 'switch' && !getMcpServerOAuthState(cfg)?.signedIn) {
-        throw new Error(`MCP server "${serverName}" is not signed in`);
-      }
-      return oauthLogins.begin(serverName, options);
-    },
-    /** `{ flowId, state: 'pending' | 'complete' | 'failed' | 'cancelled',
-     *  step?, error?, reason? }`; with `{ since, waitMs }` it resolves on the
-     *  flow's next change (mcp-oauth-login.mjs). */
-    getMcpOAuthLoginStatus(flowId, options) {
-      return oauthLogins.status(flowId, options);
-    },
-    cancelMcpOAuthLogin(flowId) {
-      return oauthLogins.cancel(flowId);
-    },
-    /** Remote / headless sign-in: complete the pending flow with the redirect
-     *  URL pasted from the browser. `{ flowId, state: 'complete' | 'failed',
-     *  error? }`; an invalid paste throws a fixed message and stays pending. */
-    completeMcpOAuthLogin(flowId, callbackUrl) {
-      return oauthLogins.complete(flowId, callbackUrl);
-    },
-    /** Forget the server's stored OAuth credentials (shared by every server
-     *  with the same exact URL) and reconnect without a login, here and on
-     *  peers, so it reports sign-in required. */
-    async signOutMcpServer(name) {
-      const { serverName, cfg } = await oauthServerConfig(name);
-      // A begin issued meanwhile waits until the credentials are gone.
-      return oauthLogins.cancelServer(serverName, async () => {
-        const { revoked = false } = (await clearMcpServerOAuth(cfg, { revoke: true })) || {};
-        const status = await sync.reconnectMcpAndAnnounce({ only: serverName, enabled: cfg.enabled !== false });
-        return { ...status, revoked };
-      });
-    },
-    /** `{ auth: 'oauth' | 'none' | 'configured' | 'unreachable', error? }` for an
-     *  HTTP/SSE config, without credentials or a browser. */
-    probeMcpServerAuth(cfg) {
-      if (!cfg || typeof cfg !== 'object' || Array.isArray(cfg)) throw new TypeError('MCP server config is required');
-      const probe = {};
-      for (const key of ['type', 'url', 'headers', 'bearer_token_env_var', 'env_http_headers']) {
-        if (cfg[key] !== undefined) probe[key] = cfg[key];
-      }
-      if (probe.type !== 'http' && probe.type !== 'sse') throw new TypeError("type must be 'http' or 'sse'");
-      return probeMcpServerAuth(probe);
-    },
+    // Sign-in / sign-out (resource-mcp-oauth-api.mjs), in this key position.
+    ...oauthApi,
     async addMcpServer(input = {}) {
       const { name, config: serverConfig } = normalizeMcpServerInput(input);
       // A catalog connector's server keeps its catalog id (connector-catalog.mjs).
@@ -289,7 +164,14 @@ export function createMcpResourceApi({ deps, sync, decorate }) {
         serverConfig.connector = connector;
       }
       const servers = userServers();
-      if (Object.hasOwn(servers, name)) throw new Error(`MCP server already exists: ${name}`);
+      // A multi-account connector's account (as its own server config) joins
+      // that connector's one server.
+      if (connector && connectorMultiAccount(connectorById(connector)) && !Array.isArray(input.accounts)) {
+        return addConnectorAccount(servers, connector, name, serverConfig, input);
+      }
+      if (Object.hasOwn(servers, name) || accountTarget(servers, name)) {
+        throw nameTakenError(servers, name);
+      }
       const owned = pluginMcpServer(name);
       if (owned) throw new Error(`MCP server already exists: ${name} (provided by plugin "${owned.owner.id}")`);
       await storeOAuthClientSecret(input, serverConfig);
@@ -300,6 +182,9 @@ export function createMcpResourceApi({ deps, sync, decorate }) {
     },
     async saveMcpServer(input = {}) {
       const servers = userServers();
+      // A name of a multi-account connector's account edits that account.
+      const accountOf = accountTarget(servers, clean(input.originalName) || clean(input.name));
+      if (accountOf && !editsServerItself(accountOf, input)) return saveConnectorAccount(servers, accountOf, input);
       // An explicit originalName must exist; a bare name edits a matching
       // server and otherwise creates a new one. Plugin servers are never
       // edited, renamed or shadowed here.
@@ -314,8 +199,11 @@ export function createMcpResourceApi({ deps, sync, decorate }) {
       const existing = originalName ? servers[originalName] : {};
       const normalizedInput = normalizeMcpServerInput(mergedServerInput(input, existing, originalName));
       const name = originalName && clean(input.name) === originalName ? originalName : normalizedInput.name;
-      if (name !== originalName && (Object.hasOwn(servers, name) || pluginMcpServer(name))) {
-        throw new Error(`MCP server already exists: ${name}`);
+      if (
+        name !== originalName &&
+        (Object.hasOwn(servers, name) || pluginMcpServer(name) || accountTarget(servers, name))
+      ) {
+        throw nameTakenError(servers, name);
       }
       if (originalName && originalName !== name) delete servers[originalName];
       servers[name] = mergeMcpServerConfig(existing, normalizedInput.config);
@@ -338,6 +226,20 @@ export function createMcpResourceApi({ deps, sync, decorate }) {
       const serverName = clean(name);
       if (!serverName) throw new Error('MCP server name is required');
       const servers = userServers();
+      // A name of a multi-account connector's account removes that account;
+      // the server goes with its last one.
+      const target = accountTarget(servers, serverName);
+      if (target) {
+        const rest = connectorAccountsOf(target.cfg).filter((entry) => entry.name !== serverName);
+        if (rest.length) servers[target.serverName] = { ...target.cfg, accounts: rest };
+        else delete servers[target.serverName];
+        saveServers(servers);
+        const status = rest.length
+          ? await sync.reconnectMcpAndAnnounce({ only: target.serverName, enabled: target.cfg.enabled !== false })
+          : await sync.reconnectMcpAndAnnounce({ drop: [target.serverName] });
+        const released = await releaseAccount(target.accountCfg);
+        return released ? { ...status, ...released } : status;
+      }
       if (!Object.hasOwn(servers, serverName)) {
         refusePluginServer(serverName);
         throw new Error(`MCP server not configured: ${serverName}`);
@@ -346,6 +248,17 @@ export function createMcpResourceApi({ deps, sync, decorate }) {
       delete servers[serverName];
       saveServers(servers);
       const status = await sync.reconnectMcpAndAnnounce({ drop: [serverName] });
+      // The server of a multi-account connector takes every account's sign-in with it.
+      const accountCfgs = connectorAccountServers(removed);
+      if (accountCfgs.length) {
+        const released = (await Promise.all(accountCfgs.map(releaseAccount))).filter(Boolean);
+        if (!released.length) return status;
+        return {
+          ...status,
+          signIn: released.every((one) => one.signIn === 'removed') ? 'removed' : 'shared',
+          revoked: released.every((one) => one.revoked === true),
+        };
+      }
       // A removed server keeps no sign-in another server does not share: an
       // app password leaves the keychain (it is revoked at Google only).
       const account = gmailAppPasswordAccount(removed);
@@ -357,7 +270,13 @@ export function createMcpResourceApi({ deps, sync, decorate }) {
       return released ? { ...status, ...released } : status;
     },
     async setMcpServerEnabled(name, enabled) {
-      const serverName = clean(name);
+      // A name a multi-account connector holds as an account switches that
+      // account (and, on, its server) rather than the whole server; the
+      // account sharing the server's name is switched off with the server.
+      const requested = clean(name);
+      const servers = userServers();
+      const held = accountTarget(servers, requested);
+      const serverName = held?.serverName || requested;
       if (!serverName) throw new Error('MCP server name is required');
       const want = enabled !== false;
       const owned = pluginMcpServer(serverName);
@@ -379,11 +298,11 @@ export function createMcpResourceApi({ deps, sync, decorate }) {
       }
       const shadowRow = mcpStatus().servers.find((s) => s.name === serverName);
       if (!shadowRow) throw new Error(`MCP server not configured: ${serverName}`);
-      const servers = userServers();
       const current = servers[serverName];
       if (!current || typeof current !== 'object' || Array.isArray(current)) {
         throw new Error(`MCP server not configured: ${serverName}`);
       }
+      if (held && (want || serverName !== requested)) return setConnectorAccountEnabled(servers, held, want);
       servers[serverName] = { ...current, enabled: want };
       saveServers(servers);
       const status = await sync.scheduleMcpToggle(serverName, want);

package/src/session-runtime/resource-mcp-connector-accounts.mjs

@@ -0,0 +1,163 @@
+// The accounts of a multi-account connector server as the MCP server API
+// edits them: adding one more account (into its server, or a new server
+// holding it) and editing one account's transport, app password or client.
+import { clean } from '../runtime/agent/orchestrator/runtime-core/session-text.mjs';
+import {
+  mergeMcpServerConfig,
+  MCP_TIMEOUT_FIELD_GROUPS,
+} from '../runtime/agent/orchestrator/runtime-core/plugin-mcp.mjs';
+import {
+  connectorAccountEnabled,
+  connectorAccountEntry,
+  connectorAccountServer,
+  connectorAccountServers,
+  connectorAccountsOf,
+  connectorAccountsUrl,
+  connectorById,
+  connectorOfServer,
+  gmailAppPasswordAccount,
+  withConnectorAccountEnabled,
+} from '../runtime/shared/connector-catalog.mjs';
+import { forgetConnectorAccountHealth } from '../runtime/connectors/connector-accounts-mcp.mjs';
+import { accountTarget, mergedServerInput, nameTakenError, oauthUrlOf } from './resource-mcp-servers.mjs';
+
+/** The server of multi-account connector `connector` in `servers`, or ''. */
+function connectorServerName(servers, connector) {
+  return (
+    Object.keys(servers).find(
+      (name) => connectorOfServer(servers[name]) === connector && connectorAccountsOf(servers[name]).length > 0
+    ) || ''
+  );
+}
+
+/** Whether `input` edits the server `target` belongs to rather than the
+ *  account: the account carries the server's name and the input the
+ *  server's own address (its config editor). */
+export const editsServerItself = (target, input) => {
+  if (target.serverName !== target.account.name || !clean(input.url)) return false;
+  try {
+    return oauthUrlOf({ type: input.type || 'http', url: input.url }) === oauthUrlOf(target.cfg);
+  } catch {
+    return false;
+  }
+};
+
+export function createConnectorAccountEdits({
+  normalizeMcpServerInput,
+  pluginMcpServer,
+  sync,
+  saveServers,
+  freeName,
+  storeOAuthClientSecret,
+  storeGmailAppPassword,
+  forgetUnusedGmailAppPassword,
+  releaseOAuth,
+}) {
+  /** One more account of multi-account connector `connector` (one-account
+   *  config `accountCfg` as normalized from `input`): into its server, or a
+   *  new server named `name` holding it. The same Gmail address again takes
+   *  the new app password. Resolves `{ name, account, status }`. */
+  async function addConnectorAccount(servers, connector, name, accountCfg, input) {
+    const serverName = connectorServerName(servers, connector);
+    const address = gmailAppPasswordAccount(accountCfg);
+    const cfg = serverName ? servers[serverName] : null;
+    const same =
+      cfg && address
+        ? connectorAccountsOf(cfg).find(
+            (account) => gmailAppPasswordAccount(connectorAccountServer(cfg, account)) === address
+          )
+        : null;
+    if (same) {
+      await storeGmailAppPassword(input, accountCfg, true);
+      const status = await sync.reconnectMcpAndAnnounce({ only: serverName, enabled: cfg.enabled !== false });
+      return { name: serverName, account: same.name, status };
+    }
+    if (!serverName && (Object.hasOwn(servers, name) || pluginMcpServer(name) || accountTarget(servers, name))) {
+      throw nameTakenError(servers, name);
+    }
+    const accountName = serverName ? freeName(servers, name) : name;
+    const account = connectorAccountEntry(accountName, accountCfg);
+    // Sign-in tokens are stored per exact URL: another account needs its own.
+    const backendUrl = connectorById(connector)?.backend?.url;
+    if (
+      !address &&
+      cfg &&
+      connectorAccountServers(cfg).some((other) => oauthUrlOf(other) === oauthUrlOf({ type: 'http', url: account.url }))
+    ) {
+      account.url = `${backendUrl}?account=${encodeURIComponent(accountName)}`;
+    }
+    const storedCfg = connectorAccountServer({ connector }, account);
+    await storeOAuthClientSecret(input, storedCfg);
+    await storeGmailAppPassword(input, storedCfg, true);
+    forgetConnectorAccountHealth(accountName);
+    let target = serverName;
+    if (cfg) {
+      servers[serverName] = { ...cfg, accounts: [...connectorAccountsOf(cfg), account] };
+    } else {
+      // The server's own settings (timeouts, enabled) ride on the input.
+      const { type: _type, url: _url, headers: _headers, oauthClientId: _client, ...rest } = accountCfg;
+      target = name;
+      servers[name] = { ...rest, type: 'http', url: connectorAccountsUrl(connector), connector, accounts: [account] };
+    }
+    saveServers(servers);
+    const status = await sync.reconnectMcpAndAnnounce({ only: target, enabled: servers[target].enabled !== false });
+    return { name: target, account: accountName, status };
+  }
+
+  /** An edit of one account (`target` from accountTarget): its transport,
+   *  app password or own client, as an edit of its one-account server was. */
+  async function saveConnectorAccount(servers, target, input) {
+    const { serverName, cfg, account, accountCfg } = target;
+    const { config } = normalizeMcpServerInput(
+      mergedServerInput({ ...input, name: account.name }, accountCfg, account.name)
+    );
+    const next = mergeMcpServerConfig(accountCfg, config);
+    next.connector = cfg.connector;
+    await storeOAuthClientSecret(input, next, accountCfg);
+    await storeGmailAppPassword(input, next, false);
+    // Settings that are not the account's transport (timeouts) are the server's.
+    const { type: _type, url: _url, headers: _headers, oauthClientId: _client, ...serverFields } = config;
+    const server = { ...cfg };
+    for (const group of MCP_TIMEOUT_FIELD_GROUPS) {
+      if (group.some((field) => Object.hasOwn(serverFields, field))) for (const field of group) delete server[field];
+    }
+    servers[serverName] = {
+      ...server,
+      ...serverFields,
+      accounts: connectorAccountsOf(cfg).map((entry) =>
+        entry.name === account.name
+          ? {
+              ...connectorAccountEntry(account.name, next),
+              ...(connectorAccountEnabled(entry) ? {} : { enabled: false }),
+            }
+          : entry
+      ),
+    };
+    saveServers(servers);
+    forgetConnectorAccountHealth(account.name);
+    const previousAddress = gmailAppPasswordAccount(accountCfg);
+    const address = gmailAppPasswordAccount(next);
+    if (previousAddress !== address) await forgetUnusedGmailAppPassword(previousAddress);
+    // An account switched from the Google sign-in to an app password keeps no sign-in.
+    if (address && !previousAddress) await releaseOAuth(accountCfg);
+    const status = await sync.reconnectMcpAndAnnounce({ only: serverName, enabled: cfg.enabled !== false });
+    return { name: serverName, account: account.name, source: 'config', status };
+  }
+
+  /** Switch one account (`target` from accountTarget) on or off by itself and
+   *  reconnect its server. Switching an account on switches its server on;
+   *  switching its last live account off switches the server off. */
+  async function setConnectorAccountEnabled(servers, target, enabled) {
+    const { serverName, cfg, account } = target;
+    const next = withConnectorAccountEnabled(cfg, account.name, enabled);
+    servers[serverName] = next;
+    saveServers(servers);
+    forgetConnectorAccountHealth(account.name);
+    const serverOn = next.enabled !== false;
+    const status = await sync.scheduleMcpToggle(serverName, serverOn);
+    await sync.publish('mcp', { mcpChanges: [{ name: serverName, enabled: serverOn }] });
+    return status;
+  }
+
+  return { addConnectorAccount, saveConnectorAccount, setConnectorAccountEnabled };
+}