[tnunamak]

A grant package is one access token that covers several child grants. Today a hosted MCP call with a package token picks its child implicitly: with one child it falls back to that child, and otherwise it reads every child and merges the results (deduplicating hits, applying one global limit, summing counts). The MCP profile (§3) forbids both: with a package token the child is always named, and no result is computed across children.

For package tokens, each of the six data tools (schema, query_records, aggregate, search, fetch, read_record_field) now declares a required grant_id and sends the call to exactly that child's resource-server client. The server checks grant_id before any resource-server call and returns a tool result with isError: true when it is missing, not a string, malformed or not a child of the token; the error text tells the model how to recover. A valid grant_id is any non-empty string of [A-Za-z0-9._~-] (access extension §5.3). Ordinary client tokens keep their tool list and routing unchanged, and reject grant_id. Package resource templates are removed so no read can bypass the selector.

The cross-child merge layer is deleted from server/package-rs-client.ts (about 1,300 lines, plus the 39 unit tests that pinned it); vendor/mcp-server/src/package-profile.ts is new and holds the selection logic, ported from prototype PR #358 with its experiment flag and its grt_-only ID pattern removed. The server instructions and tool descriptions now tell a package-token model to choose a child by grant_id.

Consequence for users: a package-token client that relied on a merged cross-child search or schema now has to call once per child. Child discovery (list_package_children, named in the error text) and the package_child_inactive result ship in the next PR; until then a client learns its child ids from the authorization result.

Tests: package-profile.test.ts and hosted-mcp-oauth.test.ts cover missing, malformed and unknown selectors and a valid read of child A and child B for every tool (30 cases that fail on the base), a sibling record that stays unreadable after an own-child read succeeds, a revoked child, a downstream 403 grant_invalid that touches no sibling, both children surviving a token refresh, and re-consent. 508 tests and the type check pass; tools/list is 22,580 bytes for client tokens and 23,961 for package tokens, under the 24,576-byte budget. An independent review by a different model ran 90 hostile selectors (prototype keys, whitespace, Unicode, traversal, long strings); none reached a resource-server client.

Landing order: do not merge this PR without the child-discovery PR (list_package_children and package_child_inactive, the next in the stack). Alone, it would leave a package-token client that has to send grant_id with no way to learn a valid value. Merge them together, or discovery first.

What an existing client sees after this merge: a session on an ordinary client token sees no change (same tools, schemas and results). A session on a package token sees grant_id as a required argument on the six data tools in tools/list, so a model that reads the schema supplies it; once the discovery PR is in, the tool list also offers list_package_children to find the value. A client that sends no grant_id gets a tool error naming how to recover instead of a merged result.

This PR is stacked on #381 (the 401 invalid_token change) because both edit the hosted test file; retarget it after #381 merges. Not verified: the unchanged tool-footprint test still fails on the base because it reads an operator document missing from this repository.

Assisted-by: AI