google-services-mcp 0.1.0-beta.100

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 Nabheet S. Sandhu
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/README.md

@@ -0,0 +1,303 @@
+# google-services-mcp
+
+MCP (Model Context Protocol) server that gives AI agents direct access to your
+Google services — **Gmail, Calendar, Google Meet, Drive, Contacts, Tasks,
+Sheets, Docs, Slides, YouTube, and Forms** — with multi-account OAuth support.
+
+Add one account, wire the server into any MCP-compatible AI client, and your
+agent can read and send email, manage your calendar, find files in Drive,
+create documents and spreadsheets, and more — using your real Google data.
+
+## Features
+
+- **Gmail** — send, list, read, modify, and reply to messages
+- **Calendar** — list calendars, create/read/update/delete events, create Google Meet links
+- **Drive** — list, read, upload, update, delete, and share files
+- **Contacts** — list, search, and create contacts
+- **Tasks** — list task lists, create/complete/delete tasks
+- **Sheets** — create spreadsheets, read/write/append cell ranges, batch update
+- **Docs** — create documents, read text, insert/replace text, batch update
+- **Slides** — create presentations, add/delete slides, find-and-replace text
+- **YouTube** — search videos, manage uploads/playlists/subscriptions
+- **Forms** — create forms, add questions, read responses
+- **Multi-account** — connect several Google accounts, set a default, or pass
+  an `account` argument to any tool
+- **OAuth 2.0** — one-time browser authorization; tokens are stored locally and refreshed automatically
+
+> **60 tools** across 11 services, all prefixed `google_`. Full reference:
+> [docs/TOOLS.md](docs/TOOLS.md).
+
+## Requirements
+
+- Node.js **24+** (CI runs Node 24; local dev on 26)
+- A Google Cloud project with the required APIs enabled and an OAuth 2.0
+  **Desktop app** client (one-time setup, ~10 minutes — see below)
+
+## Install
+
+No install needed — run straight from npm via `npx`:
+
+```bash
+npx -y google-services-mcp --version
+```
+
+`npx` downloads the package on first run and caches it. Every command in
+this README (`add`, `list`, `status`, ...) works the same way:
+
+```bash
+npx -y google-services-mcp add personal
+```
+
+> **Pin a version for reproducibility** — check the current release with
+> `npm view google-services-mcp version`, then run an exact version:
+>
+> ```bash
+> npx -y google-services-mcp@<version> add personal
+> ```
+>
+> MCP clients auto-launch this server, so pinning avoids surprise breakage
+> when a new release ships.
+
+### Alternative: global install
+
+Prefer a persistent `google-services-mcp` command (and faster MCP client
+startup)?
+
+```bash
+npm install -g google-services-mcp
+```
+
+Then replace `npx -y google-services-mcp` with `google-services-mcp`
+everywhere below.
+
+### Release channels
+
+- `latest` — stable releases, published automatically on every merge to `main`
+- `beta` — staging builds, published manually from `main`
+  (e.g. `0.x.x-beta.0`)
+
+Try the staging channel without touching your stable install:
+
+```bash
+npx -y google-services-mcp@beta --version
+```
+
+All publishes are signed with npm **provenance** (trusted publishing via
+GitHub Actions OIDC) — no npm token is stored in CI.
+
+## Quick start
+
+1. **Add a Google account** — opens your browser for one-time authorization:
+
+   ```bash
+   npx -y google-services-mcp add personal
+   ```
+
+2. **Register the server** with your MCP client (see
+   [MCP client configuration](#mcp-client-configuration) for Claude Desktop,
+   opencode, and generic configs).
+
+3. **Start using it** — ask your agent to "check my email" or "add an event to
+   my calendar". Or add more accounts any time: `npx -y google-services-mcp add work`.
+
+## MCP client configuration
+
+The server speaks MCP over stdio. Point your client at the
+`google-services-mcp` package via `npx` and pass your OAuth credentials via
+environment variables. (If you installed globally, use `google-services-mcp`
+as the command instead.)
+
+### opencode
+
+In `opencode.json` (or your global config):
+
+```json
+{
+  "mcp": {
+    "google-services-mcp": {
+      "type": "local",
+      "command": ["npx", "-y", "google-services-mcp"],
+      "enabled": true,
+      "environment": {
+        "GOOGLE_MCP_CLIENT_ID": "your-client-id",
+        "GOOGLE_MCP_CLIENT_SECRET": "your-client-secret"
+      }
+    }
+  }
+}
+```
+
+### Claude Desktop / Cursor / other MCP clients
+
+In the client's MCP settings file (e.g. `claude_desktop_config.json`):
+
+```json
+{
+  "mcpServers": {
+    "google-services-mcp": {
+      "command": "npx",
+      "args": ["-y", "google-services-mcp"],
+      "env": {
+        "GOOGLE_MCP_CLIENT_ID": "your-client-id",
+        "GOOGLE_MCP_CLIENT_SECRET": "your-client-secret"
+      }
+    }
+  }
+}
+```
+
+## Google Cloud setup (one-time)
+
+Each installation uses its own OAuth client — credentials are per-user and
+never shared.
+
+### 1. Create a project
+
+Open the [Google Cloud Console](https://console.cloud.google.com/), choose
+**Select a project → New Project**, and name it (e.g. `google-services-mcp`).
+
+### 2. Configure the OAuth consent screen
+
+**APIs & Services → OAuth consent screen**:
+
+1. User type: **External** (required for regular Google accounts).
+2. App name: anything you like (e.g. `Google Service MCP`); support email = yours.
+3. Under **Audience → Test users**, click **Add users** and enter **every Google
+   account that will use this server**. While the app is in Testing mode,
+   accounts not on this list get `access blocked` on the consent screen.
+
+### 3. Enable the required APIs
+
+**APIs & Services → Library**, search and **Enable** each:
+
+`Gmail API` · `Google Calendar API` · `Google Drive API` · `People API` ·
+`Google Tasks API` · `Google Sheets API` · `Google Docs API` ·
+`Google Slides API` · `YouTube Data API v3` · `Google Forms API`
+
+> **Automated:** with the `gcloud` CLI installed and authenticated
+> (`gcloud auth login`), enable all 10 APIs at once — idempotent, safe to
+> re-run:
+>
+> ```bash
+> bash scripts/enable-apis.sh --project your-project-id
+> ```
+
+### 4. Create OAuth client credentials
+
+**APIs & Services → Credentials → Create Credentials → OAuth client ID**:
+
+1. Application type: **Desktop app**.
+2. Authorized redirect URIs: `http://localhost:8787`.
+3. Copy the **Client ID** and **Client Secret**.
+
+### 5. Provide the credentials
+
+Set these environment variables (or put them in your MCP client config as
+above):
+
+```text
+GOOGLE_MCP_CLIENT_ID=<your-oauth-client-id>
+GOOGLE_MCP_CLIENT_SECRET=<your-oauth-client-secret>
+```
+
+Optional:
+
+```text
+GOOGLE_MCP_DIR=~/.google-services-mcp   # where config and tokens live (default ~/.google-services-mcp)
+GOOGLE_MCP_REDIRECT_PORT=8787          # local loopback port for OAuth (default 8787)
+# Full redirect URI override. Takes precedence over REDIRECT_PORT and must
+# exactly match a URI registered for this OAuth client in the Cloud Console.
+# GOOGLE_MCP_REDIRECT_URI=http://127.0.0.1:8787/oauth2callback
+```
+
+### 6. Connect your first account
+
+```bash
+npx -y google-services-mcp add personal
+```
+
+A browser opens to the Google consent screen. After you approve, the account is
+stored in `~/.google-services-mcp/accounts/` and ready to use. Repeat with a
+different name (e.g. `work`) to connect more accounts.
+
+## CLI reference
+
+```bash
+npx -y google-services-mcp                     # run the MCP server over stdio
+npx -y google-services-mcp add <name>          # add a Google account (opens browser)
+npx -y google-services-mcp list                # list connected accounts
+npx -y google-services-mcp remove <name>       # remove an account
+npx -y google-services-mcp set-default <name>  # set the default account
+npx -y google-services-mcp status              # show config and token health
+npx -y google-services-mcp --help              # show help
+```
+
+## For AI agents
+
+- All tools are prefixed `google_`, e.g. `google_gmail_list`,
+  `google_calendar_list_events`, `google_drive_list_files`.
+- The `account` argument selects which connected account a tool uses;
+  omit it to use the default account.
+- Agents can connect new accounts themselves via the **`account_add`** tool —
+  it opens the browser consent flow without needing the CLI.
+- See [docs/TOOLS.md](docs/TOOLS.md) for the full tool reference.
+
+## Security
+
+- OAuth tokens are stored in `~/.google-services-mcp/accounts/<account-name>.json`
+  with restrictive file permissions. Keep them private — never commit them.
+- The server never logs tokens or credentials.
+- Scopes requested: Gmail modify, Calendar, Drive, Contacts, Tasks, Sheets,
+  Docs, Slides, YouTube, Forms, plus `userinfo.email` for account display.
+- If a client secret is ever exposed, rotate it in the Google Cloud Console
+  (Credentials → your OAuth client → rotate secret).
+
+## Troubleshooting
+
+| Symptom | Cause / fix |
+| --- | --- |
+| `access blocked` on consent | Account not in **Test users** (setup step 2.3) — add it and retry |
+| `redirect_uri_mismatch` | Exactly `http://localhost:8787` (no trailing slash), per OAuth client |
+| Tokens stop after ~7 days | App in **Testing** mode — re-run `add` or **Publish app** |
+| `npx` not found | GUI clients may lack PATH — use `/usr/local/bin/npx` or global install |
+| `Google hasn't verified this app` | Normal — click **Advanced → Continue** for personal use |
+
+## Local development
+
+```bash
+git clone https://github.com/nabheet/google-services-mcp.git
+cd google-services-mcp
+npm install
+npm run build        # compile to dist/
+npm test             # vitest, TDD suites (incl. hermetic E2E in test/e2e/)
+npm run typecheck    # tsc --noEmit
+npm run dev          # run from source with tsx
+```
+
+See [AGENTS.md](AGENTS.md) for architecture and conventions.
+
+## Releases (maintainers)
+
+All publishing happens from GitHub Actions — no local npm login needed:
+
+1. **Stable** — every merge to `main` auto-publishes the next patch version
+   to `latest` with provenance, then creates a `vX.Y.Z` tag and GitHub
+   release. No manual steps. The next version is derived from the last
+   published `latest` on npm, so repeated merges never collide; an
+   intentional minor/major bump in `package.json` is honored.
+2. **Staging** — manual beta builds from `main`: **Actions → CI
+   → Run workflow**. Publishes a `beta` build (`0.1.1-beta.X`) under the
+   `beta` dist-tag with provenance.
+
+Prerelease tags `v*-beta*` publish to `beta` with a prerelease GitHub release
+(patch/minor builds for milestone testing). Publishing uses npm **trusted
+publishing** (OIDC): configure it once per package at
+`npmjs.com/package/google-services-mcp/access` with the GitHub repository
+`nabheet/google-services-mcp` and workflow name `ci.yml`.
+npm allows **one trusted publisher per package** and validates the calling
+workflow's filename — all channels run from the same `ci.yml` file.
+No `NPM_TOKEN` secret is required.
+
+## License
+
+MIT

package/dist/auth/config.d.ts

@@ -0,0 +1,43 @@
+/**
+ * Configuration for the OAuth client and server defaults.
+ *
+ * Credentials come from (in order of precedence):
+ *   1. Environment variables GOOGLE_MCP_CLIENT_ID / GOOGLE_MCP_CLIENT_SECRET
+ *   2. The config file at <dir>/config.json
+ *
+ * The data directory defaults to ~/.google-services-mcp and can be overridden with
+ * GOOGLE_MCP_DIR.
+ */
+export declare const DEFAULT_REDIRECT_PORT = 8787;
+/** Scopes requested when adding an account. Covers all services this server exposes. */
+export declare const DEFAULT_SCOPES: string[];
+export interface Config {
+    clientId: string;
+    clientSecret: string;
+    /** Loopback port used during the OAuth redirect. Default 8787. Ignored when redirectUri is set. */
+    redirectPort?: number;
+    /**
+     * Full redirect URI registered with Google, e.g. "http://127.0.0.1:8787/oauth2callback".
+     * Takes precedence over redirectPort and must exactly match what is registered for
+     * this OAuth client in the Google Cloud Console.
+     */
+    redirectUri?: string;
+    /** Account used when tools are called without an explicit `account`. */
+    defaultAccount?: string;
+    /** Override the scope list requested at authorization time. */
+    scopes?: string[];
+}
+export declare function getDataDir(): string;
+export declare function getConfigPath(): string;
+export declare function getAccountsDir(): string;
+export declare function getAccountPath(name: string): string;
+export declare function sanitizeName(name: string): string;
+export declare function isValidName(name: string): boolean;
+export declare function ensureDirs(): Promise<void>;
+export declare function loadConfig(): Promise<Config>;
+export declare function saveConfig(config: Config): Promise<void>;
+export declare function saveClientCredentials(clientId: string, clientSecret: string): Promise<void>;
+export declare function hasCredentials(config: Config): boolean;
+/** Location of this package's root (for README links etc.). */
+export declare function getPackageRoot(): string;
+//# sourceMappingURL=config.d.ts.map

package/dist/auth/config.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"config.d.ts","sourceRoot":"","sources":["../../src/auth/config.ts"],"names":[],"mappings":"AAKA;;;;;;;;;GASG;AAEH,eAAO,MAAM,qBAAqB,OAAO,CAAC;AAE1C,wFAAwF;AACxF,eAAO,MAAM,cAAc,EAAE,MAAM,EAuBlC,CAAC;AAEF,MAAM,WAAW,MAAM;IACrB,QAAQ,EAAE,MAAM,CAAC;IACjB,YAAY,EAAE,MAAM,CAAC;IACrB,mGAAmG;IACnG,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB;;;;OAIG;IACH,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,wEAAwE;IACxE,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,+DAA+D;IAC/D,MAAM,CAAC,EAAE,MAAM,EAAE,CAAC;CACnB;AAED,wBAAgB,UAAU,IAAI,MAAM,CAEnC;AAED,wBAAgB,aAAa,IAAI,MAAM,CAEtC;AAED,wBAAgB,cAAc,IAAI,MAAM,CAEvC;AAED,wBAAgB,cAAc,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAEnD;AAED,wBAAgB,YAAY,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAMjD;AAED,wBAAgB,WAAW,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAEjD;AAED,wBAAsB,UAAU,IAAI,OAAO,CAAC,IAAI,CAAC,CAKhD;AAED,wBAAsB,UAAU,IAAI,OAAO,CAAC,MAAM,CAAC,CAwBlD;AAED,wBAAsB,UAAU,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAa9D;AAED,wBAAsB,qBAAqB,CAAC,QAAQ,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAKjG;AAED,wBAAgB,cAAc,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAEtD;AAED,+DAA+D;AAC/D,wBAAgB,cAAc,IAAI,MAAM,CAEvC"}

package/dist/auth/config.js

@@ -0,0 +1,112 @@
+import fs from "node:fs/promises";
+import os from "node:os";
+import path from "node:path";
+import { fileURLToPath } from "node:url";
+/**
+ * Configuration for the OAuth client and server defaults.
+ *
+ * Credentials come from (in order of precedence):
+ *   1. Environment variables GOOGLE_MCP_CLIENT_ID / GOOGLE_MCP_CLIENT_SECRET
+ *   2. The config file at <dir>/config.json
+ *
+ * The data directory defaults to ~/.google-services-mcp and can be overridden with
+ * GOOGLE_MCP_DIR.
+ */
+export const DEFAULT_REDIRECT_PORT = 8787;
+/** Scopes requested when adding an account. Covers all services this server exposes. */
+export const DEFAULT_SCOPES = [
+    // Gmail: read, send, and modify (labels/trash) — not permanent delete
+    "https://www.googleapis.com/auth/gmail.modify",
+    // Calendar + Google Meet (conferenceData on events)
+    "https://www.googleapis.com/auth/calendar",
+    // Drive: full access to the user's Drive
+    "https://www.googleapis.com/auth/drive",
+    // Contacts (read/write)
+    "https://www.googleapis.com/auth/contacts",
+    // Tasks
+    "https://www.googleapis.com/auth/tasks",
+    // Sheets: read/write spreadsheets
+    "https://www.googleapis.com/auth/spreadsheets",
+    // Docs: read/write documents
+    "https://www.googleapis.com/auth/documents",
+    // Slides: read/write presentations
+    "https://www.googleapis.com/auth/presentations",
+    // YouTube: read/write the user's channel data and playlists
+    "https://www.googleapis.com/auth/youtube",
+    // Forms: read/write forms and responses
+    "https://www.googleapis.com/auth/forms",
+    // Identity: lets fetchUserInfo return the signed-in email for account display
+    "https://www.googleapis.com/auth/userinfo.email",
+];
+export function getDataDir() {
+    return process.env.GOOGLE_MCP_DIR || path.join(os.homedir(), ".google-services-mcp");
+}
+export function getConfigPath() {
+    return path.join(getDataDir(), "config.json");
+}
+export function getAccountsDir() {
+    return path.join(getDataDir(), "accounts");
+}
+export function getAccountPath(name) {
+    return path.join(getAccountsDir(), `${sanitizeName(name)}.json`);
+}
+export function sanitizeName(name) {
+    const cleaned = name.replace(/[^a-zA-Z0-9_-]/g, "_").toLowerCase();
+    if (!/[a-zA-Z0-9]/.test(cleaned)) {
+        throw new Error("Account name must contain at least one alphanumeric character.");
+    }
+    return cleaned;
+}
+export function isValidName(name) {
+    return /^[a-zA-Z0-9_-]+$/.test(name);
+}
+export async function ensureDirs() {
+    await fs.mkdir(getAccountsDir(), { recursive: true, mode: 0o700 });
+    // mkdir's mode only applies to newly-created dirs; harden pre-existing ones.
+    await fs.chmod(getAccountsDir(), 0o700).catch(() => { });
+    await fs.chmod(getDataDir(), 0o700).catch(() => { });
+}
+export async function loadConfig() {
+    await ensureDirs();
+    let file = {};
+    try {
+        const raw = await fs.readFile(getConfigPath(), "utf8");
+        file = JSON.parse(raw);
+    }
+    catch {
+        // No config file yet — env vars may still provide credentials.
+    }
+    const envId = process.env.GOOGLE_MCP_CLIENT_ID;
+    const envSecret = process.env.GOOGLE_MCP_CLIENT_SECRET;
+    const envPort = process.env.GOOGLE_MCP_REDIRECT_PORT;
+    const envUri = process.env.GOOGLE_MCP_REDIRECT_URI;
+    const config = {
+        clientId: envId || file.clientId || "",
+        clientSecret: envSecret || file.clientSecret || "",
+        redirectPort: envPort ? Number(envPort) : file.redirectPort || DEFAULT_REDIRECT_PORT,
+        redirectUri: envUri || file.redirectUri || undefined,
+        defaultAccount: file.defaultAccount,
+        scopes: file.scopes || DEFAULT_SCOPES,
+    };
+    return config;
+}
+export async function saveConfig(config) {
+    await ensureDirs();
+    const { clientId, clientSecret, redirectPort, redirectUri, defaultAccount, scopes } = config;
+    await fs.writeFile(getConfigPath(), JSON.stringify({ clientId, clientSecret, redirectPort, redirectUri, defaultAccount, scopes }, null, 2), { encoding: "utf8", mode: 0o600 });
+    await fs.chmod(getConfigPath(), 0o600).catch(() => { });
+}
+export async function saveClientCredentials(clientId, clientSecret) {
+    const config = await loadConfig();
+    config.clientId = clientId || config.clientId;
+    config.clientSecret = clientSecret || config.clientSecret;
+    await saveConfig(config);
+}
+export function hasCredentials(config) {
+    return Boolean(config.clientId && config.clientSecret);
+}
+/** Location of this package's root (for README links etc.). */
+export function getPackageRoot() {
+    return path.dirname(path.dirname(fileURLToPath(import.meta.url)));
+}
+//# sourceMappingURL=config.js.map

package/dist/auth/config.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"config.js","sourceRoot":"","sources":["../../src/auth/config.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,kBAAkB,CAAC;AAClC,OAAO,EAAE,MAAM,SAAS,CAAC;AACzB,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AAEzC;;;;;;;;;GASG;AAEH,MAAM,CAAC,MAAM,qBAAqB,GAAG,IAAI,CAAC;AAE1C,wFAAwF;AACxF,MAAM,CAAC,MAAM,cAAc,GAAa;IACtC,sEAAsE;IACtE,8CAA8C;IAC9C,oDAAoD;IACpD,0CAA0C;IAC1C,yCAAyC;IACzC,uCAAuC;IACvC,wBAAwB;IACxB,0CAA0C;IAC1C,QAAQ;IACR,uCAAuC;IACvC,kCAAkC;IAClC,8CAA8C;IAC9C,6BAA6B;IAC7B,2CAA2C;IAC3C,mCAAmC;IACnC,+CAA+C;IAC/C,4DAA4D;IAC5D,yCAAyC;IACzC,wCAAwC;IACxC,uCAAuC;IACvC,8EAA8E;IAC9E,gDAAgD;CACjD,CAAC;AAmBF,MAAM,UAAU,UAAU;IACxB,OAAO,OAAO,CAAC,GAAG,CAAC,cAAc,IAAI,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,OAAO,EAAE,EAAE,sBAAsB,CAAC,CAAC;AACvF,CAAC;AAED,MAAM,UAAU,aAAa;IAC3B,OAAO,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,EAAE,aAAa,CAAC,CAAC;AAChD,CAAC;AAED,MAAM,UAAU,cAAc;IAC5B,OAAO,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,EAAE,UAAU,CAAC,CAAC;AAC7C,CAAC;AAED,MAAM,UAAU,cAAc,CAAC,IAAY;IACzC,OAAO,IAAI,CAAC,IAAI,CAAC,cAAc,EAAE,EAAE,GAAG,YAAY,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;AACnE,CAAC;AAED,MAAM,UAAU,YAAY,CAAC,IAAY;IACvC,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,CAAC,iBAAiB,EAAE,GAAG,CAAC,CAAC,WAAW,EAAE,CAAC;IACnE,IAAI,CAAC,aAAa,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;QACjC,MAAM,IAAI,KAAK,CAAC,gEAAgE,CAAC,CAAC;IACpF,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,MAAM,UAAU,WAAW,CAAC,IAAY;IACtC,OAAO,kBAAkB,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AACvC,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,UAAU;IAC9B,MAAM,EAAE,CAAC,KAAK,CAAC,cAAc,EAAE,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IACnE,6EAA6E;IAC7E,MAAM,EAAE,CAAC,KAAK,CAAC,cAAc,EAAE,EAAE,KAAK,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;IACxD,MAAM,EAAE,CAAC,KAAK,CAAC,UAAU,EAAE,EAAE,KAAK,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;AACtD,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,UAAU;IAC9B,MAAM,UAAU,EAAE,CAAC;IACnB,IAAI,IAAI,GAAoB,EAAE,CAAC;IAC/B,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,MAAM,EAAE,CAAC,QAAQ,CAAC,aAAa,EAAE,EAAE,MAAM,CAAC,CAAC;QACvD,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IACzB,CAAC;IAAC,MAAM,CAAC;QACP,+DAA+D;IACjE,CAAC;IAED,MAAM,KAAK,GAAG,OAAO,CAAC,GAAG,CAAC,oBAAoB,CAAC;IAC/C,MAAM,SAAS,GAAG,OAAO,CAAC,GAAG,CAAC,wBAAwB,CAAC;IACvD,MAAM,OAAO,GAAG,OAAO,CAAC,GAAG,CAAC,wBAAwB,CAAC;IACrD,MAAM,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC,uBAAuB,CAAC;IAEnD,MAAM,MAAM,GAAW;QACrB,QAAQ,EAAE,KAAK,IAAI,IAAI,CAAC,QAAQ,IAAI,EAAE;QACtC,YAAY,EAAE,SAAS,IAAI,IAAI,CAAC,YAAY,IAAI,EAAE;QAClD,YAAY,EAAE,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,YAAY,IAAI,qBAAqB;QACpF,WAAW,EAAE,MAAM,IAAI,IAAI,CAAC,WAAW,IAAI,SAAS;QACpD,cAAc,EAAE,IAAI,CAAC,cAAc;QACnC,MAAM,EAAE,IAAI,CAAC,MAAM,IAAI,cAAc;KACtC,CAAC;IACF,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,UAAU,CAAC,MAAc;IAC7C,MAAM,UAAU,EAAE,CAAC;IACnB,MAAM,EAAE,QAAQ,EAAE,YAAY,EAAE,YAAY,EAAE,WAAW,EAAE,cAAc,EAAE,MAAM,EAAE,GAAG,MAAM,CAAC;IAC7F,MAAM,EAAE,CAAC,SAAS,CAChB,aAAa,EAAE,EACf,IAAI,CAAC,SAAS,CACZ,EAAE,QAAQ,EAAE,YAAY,EAAE,YAAY,EAAE,WAAW,EAAE,cAAc,EAAE,MAAM,EAAE,EAC7E,IAAI,EACJ,CAAC,CACF,EACD,EAAE,QAAQ,EAAE,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,CAClC,CAAC;IACF,MAAM,EAAE,CAAC,KAAK,CAAC,aAAa,EAAE,EAAE,KAAK,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;AACzD,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,qBAAqB,CAAC,QAAgB,EAAE,YAAoB;IAChF,MAAM,MAAM,GAAG,MAAM,UAAU,EAAE,CAAC;IAClC,MAAM,CAAC,QAAQ,GAAG,QAAQ,IAAI,MAAM,CAAC,QAAQ,CAAC;IAC9C,MAAM,CAAC,YAAY,GAAG,YAAY,IAAI,MAAM,CAAC,YAAY,CAAC;IAC1D,MAAM,UAAU,CAAC,MAAM,CAAC,CAAC;AAC3B,CAAC;AAED,MAAM,UAAU,cAAc,CAAC,MAAc;IAC3C,OAAO,OAAO,CAAC,MAAM,CAAC,QAAQ,IAAI,MAAM,CAAC,YAAY,CAAC,CAAC;AACzD,CAAC;AAED,+DAA+D;AAC/D,MAAM,UAAU,cAAc;IAC5B,OAAO,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,aAAa,CAAC,OAAO,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;AACpE,CAAC"}

package/dist/auth/manager.d.ts

@@ -0,0 +1,50 @@
+import { type Auth } from "googleapis";
+import { type Config } from "./config.js";
+import { type StoredAccount } from "./store.js";
+export interface AddAccountOptions {
+    /** Set to false to skip opening the browser (headless). */
+    openBrowser?: boolean;
+    /** Milliseconds to wait for the OAuth callback before failing. Default 5 minutes. */
+    timeoutMs?: number;
+}
+export interface AccountStatus {
+    name: string;
+    email?: string;
+    expiresAt?: number;
+    tokenHealthy: boolean;
+    scopes: string[];
+}
+export interface ServerStatus {
+    credentialsConfigured: boolean;
+    dataDir: string;
+    defaultAccount?: string;
+    accounts: AccountStatus[];
+}
+/**
+ * Coordinates credentials, per-account token storage, the interactive OAuth
+ * flow, and refresh. All service modules resolve auth through here.
+ */
+declare class AuthManager {
+    getConfig(): Promise<Config>;
+    listAccounts(): Promise<StoredAccount[]>;
+    /**
+     * Resolve an account to use for a tool call.
+     * Priority: explicit name -> configured default -> sole account.
+     */
+    resolveAccount(name?: string): Promise<StoredAccount>;
+    /** Get an authenticated googleapis OAuth2 client, refreshing first if needed. */
+    getClient(name?: string): Promise<Auth.OAuth2Client>;
+    /**
+     * Run the interactive OAuth flow to add a new account: opens the consent
+     * screen, waits for the loopback callback, exchanges the code, and persists
+     * the account alongside the signed-in email.
+     */
+    addAccount(name: string, options?: AddAccountOptions): Promise<StoredAccount>;
+    removeAccount(name: string): Promise<boolean>;
+    setDefaultAccount(name: string): Promise<void>;
+    saveCredentials(clientId: string, clientSecret: string): Promise<void>;
+    getStatus(): Promise<ServerStatus>;
+}
+export declare const authManager: AuthManager;
+export {};
+//# sourceMappingURL=manager.d.ts.map

package/dist/auth/manager.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"manager.d.ts","sourceRoot":"","sources":["../../src/auth/manager.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,IAAI,EAAU,MAAM,YAAY,CAAC;AAC/C,OAAO,EACL,KAAK,MAAM,EAMZ,MAAM,aAAa,CAAC;AAYrB,OAAO,EAIL,KAAK,aAAa,EAEnB,MAAM,YAAY,CAAC;AAEpB,MAAM,WAAW,iBAAiB;IAChC,2DAA2D;IAC3D,WAAW,CAAC,EAAE,OAAO,CAAC;IACtB,qFAAqF;IACrF,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAED,MAAM,WAAW,aAAa;IAC5B,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,YAAY,EAAE,OAAO,CAAC;IACtB,MAAM,EAAE,MAAM,EAAE,CAAC;CAClB;AAED,MAAM,WAAW,YAAY;IAC3B,qBAAqB,EAAE,OAAO,CAAC;IAC/B,OAAO,EAAE,MAAM,CAAC;IAChB,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,QAAQ,EAAE,aAAa,EAAE,CAAC;CAC3B;AAED;;;GAGG;AACH,cAAM,WAAW;IACT,SAAS,IAAI,OAAO,CAAC,MAAM,CAAC,CAEjC;IAEK,YAAY,IAAI,OAAO,CAAC,aAAa,EAAE,CAAC,CAE7C;IAED;;;OAGG;IACG,cAAc,CAAC,IAAI,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,aAAa,CAAC,CAwB1D;IAED,iFAAiF;IAC3E,SAAS,CAAC,IAAI,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,YAAY,CAAC,CAsBzD;IAED;;;;OAIG;IACG,UAAU,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,GAAE,iBAAsB,GAAG,OAAO,CAAC,aAAa,CAAC,CA4CtF;IAEK,aAAa,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAElD;IAEK,iBAAiB,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAQnD;IAEK,eAAe,CAAC,QAAQ,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAE3E;IAEK,SAAS,IAAI,OAAO,CAAC,YAAY,CAAC,CAevC;CACF;AAED,eAAO,MAAM,WAAW,aAAoB,CAAC"}