Add opt-in strict Google OAuth resource authorization

[ctate]

Summary

Adds opt-in strict authorization for Google resource APIs while preserving the existing permissive fallback by default.

• Persist OAuth access-token records with issuing identity, client, granted scopes, one-hour expiry, and revocation state, including refreshed tokens and store snapshots.
• Protect userinfo, Gmail, Calendar, Drive, and upload aliases when google.strict_scopes: true. Require active emulator-issued access tokens, enforce endpoint-specific scope alternatives, and return Google-compatible 401 UNAUTHENTICATED or 403 PERMISSION_DENIED responses.
• Synchronize the option and behavior across the example config, CLI help, README, web documentation, package documentation, and service skills.

This gives integrations production-like credential and permission behavior when needed without breaking existing local workflows that use arbitrary bearer tokens.

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated
emulate	Ready	Preview, v0	Sep 3, 2026 8:06am UTC