mcp-google-multi 6.0.0-alpha.37 → 6.0.0-alpha.39

package/dist/accounts.d.ts

@@ -18,7 +18,10 @@ export interface AccountSet {
     defaultAccount?: string;
     defaultAccountSource?: 'env' | 'config';
 }
-export declare function resolveAccounts(env?: NodeJS.ProcessEnv, filePath?: string, onInvalid?: 'exit' | 'throw'): AccountSet;
+export declare function resolveAccounts(env?: NodeJS.ProcessEnv, filePath?: string, onInvalid?: 'exit' | 'throw', opts?: {
+    tokenDir?: string;
+}): AccountSet;
+export declare function fileStamp(filePath: string, version: number): string;
 /** Live accessor: dispatch-time readers use this, never a captured snapshot. */
 export declare function getAccountSet(): AccountSet;
 /** Re-resolve after a config.json mutation and swap the live set. */

package/dist/accounts.js

@@ -15,14 +15,14 @@ export function getTokenDir() {
 function parseCsv(value) {
     return (value ?? '').split(',').map((s) => s.trim()).filter(Boolean);
 }
-function accountPaths(alias) {
+function accountPaths(alias, dir = tokenDir) {
     return {
-        tokenPath: path.join(tokenDir, alias, 'token.json'),
-        encPath: path.join(tokenDir, `${alias}.enc`),
+        tokenPath: path.join(dir, alias, 'token.json'),
+        encPath: path.join(dir, `${alias}.enc`),
     };
 }
 /** v5 env parser, guards verbatim. Format: GOOGLE_ACCOUNTS="alias1:email1,alias2:email2". */
-function parseEnvAccounts(raw, adminAliases) {
+function parseEnvAccounts(raw, adminAliases, dir = tokenDir) {
     const configs = {};
     const aliases = [];
     for (const entry of raw.split(',')) {
@@ -49,7 +49,7 @@ function parseEnvAccounts(raw, adminAliases) {
         aliases.push(alias);
         configs[alias] = {
             email,
-            ...accountPaths(alias),
+            ...accountPaths(alias, dir),
             admin: adminAliases.includes(alias) || undefined,
             source: 'env',
         };
@@ -74,7 +74,8 @@ function noAccountsMessage() {
  * empty behaves as unset, mirroring GOOGLE_ACCOUNTS semantics.
  */
 let warnedLegacy = false;
-export function resolveAccounts(env = process.env, filePath = configFilePath(), onInvalid = 'exit') {
+export function resolveAccounts(env = process.env, filePath = configFilePath(), onInvalid = 'exit', opts = {}) {
+    const dir = opts.tokenDir ?? tokenDir;
     const adminEnv = parseCsv(env.GOOGLE_ADMIN_ACCOUNTS);
     const rawEnv = env.GOOGLE_ACCOUNTS;
     const fail = (slug, message) => {
@@ -102,7 +103,7 @@ export function resolveAccounts(env = process.env, filePath = configFilePath(),
         }
     }
     if (rawEnv && rawEnv.trim() !== '') {
-        const { aliases, configs } = parseEnvAccounts(rawEnv, adminEnv);
+        const { aliases, configs } = parseEnvAccounts(rawEnv, adminEnv, dir);
         materializeFirstRun(aliases, configs, filePath);
         const def = resolveDefaultAccount(env, null, aliases, fail);
         return {
@@ -167,7 +168,7 @@ export function resolveAccounts(env = process.env, filePath = configFilePath(),
         aliases.push(alias);
         configs[alias] = {
             email: entry.email,
-            ...accountPaths(alias),
+            ...accountPaths(alias, dir),
             scopeProfile: entry.scopeProfile,
             admin: adminEnv.length > 0 ? adminEnv.includes(alias) : entry.admin,
             source: 'config',
@@ -196,7 +197,7 @@ function resolveDefaultAccount(env, fromConfig, aliases, fail) {
     }
     return { defaultAccount: value, defaultAccountSource: fromEnv ? 'env' : 'config' };
 }
-function fileStamp(filePath, version) {
+export function fileStamp(filePath, version) {
     try {
         return `${version}:${fs.statSync(filePath).mtimeMs}`;
     }

package/dist/config-file.d.ts

@@ -1,6 +1,17 @@
 export declare const CONFIG_VERSION = 1;
 export declare function configDir(env?: NodeJS.ProcessEnv): string;
 export declare function configFilePath(env?: NodeJS.ProcessEnv): string;
+export declare function tenantsDir(env?: NodeJS.ProcessEnv): string;
+export declare function tenantConfigFilePath(tenantId: string, env?: NodeJS.ProcessEnv): string;
+export declare function tenantTokenDir(tenantId: string, env?: NodeJS.ProcessEnv): string;
+/** Create and permission-harden the tenant directory chain. mkdirSync's
+ * recursive mode only stamps the DEEPEST newly-created dir, so every level
+ * gets an explicit chmod: the shared tenants/ root (created by whichever
+ * tenant provisions first) must never stay group-readable. */
+export declare function ensureTenantDirs(tenantId: string, env?: NodeJS.ProcessEnv): {
+    configFile: string;
+    tokenDir: string;
+};
 export declare const ALIAS_RE: RegExp;
 export declare const RESERVED_ALIASES: string[];
 export declare function isReservedAlias(name: string): boolean;

package/dist/config-file.js

@@ -10,6 +10,38 @@ export function configDir(env = process.env) {
 export function configFilePath(env = process.env) {
     return path.join(configDir(env), 'config.json');
 }
+export function tenantsDir(env = process.env) {
+    return path.join(configDir(env), 'tenants');
+}
+// A tenant id becomes a filesystem path segment exactly like an account
+// alias, so it rides the same traversal guard.
+function assertTenantId(tenantId) {
+    if (!ALIAS_RE.test(tenantId) || isReservedAlias(tenantId)) {
+        throw new Error(`E_TENANT_ID_INVALID: invalid tenant id "${tenantId}".`);
+    }
+}
+export function tenantConfigFilePath(tenantId, env = process.env) {
+    assertTenantId(tenantId);
+    return path.join(tenantsDir(env), tenantId, 'config.json');
+}
+export function tenantTokenDir(tenantId, env = process.env) {
+    assertTenantId(tenantId);
+    return path.join(tenantsDir(env), tenantId, 'tokens');
+}
+/** Create and permission-harden the tenant directory chain. mkdirSync's
+ * recursive mode only stamps the DEEPEST newly-created dir, so every level
+ * gets an explicit chmod: the shared tenants/ root (created by whichever
+ * tenant provisions first) must never stay group-readable. */
+export function ensureTenantDirs(tenantId, env = process.env) {
+    const tokenDir = tenantTokenDir(tenantId, env);
+    const levels = [configDir(env), tenantsDir(env), path.join(tenantsDir(env), tenantId), tokenDir];
+    for (const dir of levels) {
+        fs.mkdirSync(dir, { recursive: true, mode: 0o700 });
+        if (process.platform !== 'win32')
+            fs.chmodSync(dir, 0o700);
+    }
+    return { configFile: tenantConfigFilePath(tenantId, env), tokenDir };
+}
 // Alias charset is load-bearing security, not cosmetics: the alias becomes a
 // tokenDir path segment (encPath), so this guard blocks path traversal.
 export const ALIAS_RE = /^[a-zA-Z0-9_-]+$/;

package/dist/doctor.js

@@ -7,6 +7,7 @@ import { peekMasterKeyProvenance, deleteMasterKeyMaterial } from './master-key.j
 import { hasToken } from './token-store.js';
 import { configDir, loadConfigFile } from './config-file.js';
 import { envValueSource } from './env-load.js';
+import { reauthHint } from './reauth-hint.js';
 import { describeMetricsDir, resolveUsageMetrics, sourceLabel } from './usage-metrics.js';
 import { probeApiEnablement } from './api-probe.js';
 import { safeMessage, stringifyEnvelope } from './tools/_errors.js';
@@ -181,7 +182,7 @@ function sectionsTokensAndScopes(deps, aliases) {
             if (scopeVerdict === 'ok')
                 scopeVerdict = 'warn';
             scopeLines.push(`${alias}: ${r.callable.length} callable, ${r.requestable.length} requested-not-granted`);
-            scopeHint = `Re-auth to grant missing scopes: \`npx mcp-google-multi auth --account ${alias}\`.`;
+            scopeHint = `Re-auth to grant missing scopes. ${reauthHint(alias)}`;
         }
         else {
             scopeLines.push(`${alias}: ${r.callable.length} callable, all profile scopes granted`);

package/dist/fanout.d.ts

@@ -1,6 +1,6 @@
 import { z } from 'zod';
 export declare const CSV_RE: RegExp;
-export declare function fanoutAccountField(description: string): z.ZodType;
+export declare function fanoutAccountField(description: string, aliases: readonly string[]): z.ZodType;
 export type AccountSelector = {
     ok: true;
     fanout: boolean;

package/dist/fanout.js

@@ -1,19 +1,22 @@
 import { z } from 'zod';
-import { ACCOUNTS, getAccountSet, unknownAliasMessage } from './accounts.js';
+import { getAccountSet, unknownAliasMessage } from './accounts.js';
 export const CSV_RE = /^[a-zA-Z0-9_-]+(\s*,\s*[a-zA-Z0-9_-]+)+$/;
 const FANOUT_CONCURRENCY = 5;
-export function fanoutAccountField(description) {
-    const csvExample = ACCOUNTS.length > 1 ? `; or a CSV subset like "${ACCOUNTS.slice(0, 2).join(',')}"` : '';
+// `aliases` is required (no global default): the field is baked into a
+// registry's inputSchema, so it must be built from THAT registry's account
+// set or a '*' would advertise and accept another registry's aliases.
+export function fanoutAccountField(description, aliases) {
+    const csvExample = aliases.length > 1 ? `; or a CSV subset like "${aliases.slice(0, 2).join(',')}"` : '';
     // The union's OWN error only fires when every branch aborts at the type
     // check (a non-string). For a string, zod surfaces the single non-aborted
     // branch verbatim, which is the CSV regex, so a mistyped alias used to read
     // as "Invalid string: must match pattern /^[a-zA-Z0-9_-]+(,...)/" and never
     // named an alias. Hence the same message on BOTH.
-    const bad = () => unknownAliasMessage(ACCOUNTS, true);
+    const bad = () => unknownAliasMessage(aliases, true);
     return z
-        // '*' first so the tuple is statically non-empty even when ACCOUNTS is empty
+        // '*' first so the tuple is statically non-empty even when aliases is empty
         // (a fresh install): z.enum requires [string, ...string[]].
-        .union([z.enum(['*', ...ACCOUNTS]), z.string().regex(CSV_RE, { error: bad })], { error: bad })
+        .union([z.enum(['*', ...aliases]), z.string().regex(CSV_RE, { error: bad })], { error: bad })
         .optional()
         .describe(`${description}; "*" = all accounts${csvExample}; omit for the default account`);
 }

package/dist/http-transport.d.ts

@@ -4,6 +4,7 @@ import type { HttpConfig } from './http-config.js';
 import { type ArgShape, type StrictArgOptions, type ValidationEnvelopeOptions } from './arg-normalize.js';
 export type AuthOutcome = {
     ok: true;
+    sub?: string;
 } | {
     ok: false;
     status: number;

package/dist/http-transport.js

@@ -149,6 +149,15 @@ export class HttpTransportHost {
             this.log(`${auth.status} auth_failed path=/mcp`);
             return;
         }
+        // Thread the verified subject to tool handlers: the Node transport forwards
+        // req.auth verbatim as ctx.http.authInfo. Token/clientId stay empty — the
+        // bearer value must not re-enter the dispatch path via handler context.
+        req.auth = {
+            token: '',
+            clientId: '',
+            scopes: ['mcp:use'],
+            extra: { sub: auth.sub ?? 'owner' },
+        };
         let body;
         try {
             body = await this.readJson(req);

package/dist/identity.d.ts

@@ -6,9 +6,11 @@ import { type Policy, type Transport } from './write-control.js';
  * The one forward-compat seam (frozen public API): the free core builds
  * exactly one context with subject "owner"; EE later instantiates N contexts
  * from N registries. Nothing here may assume a global current-account.
+ * `subject` is a string (not the literal 'owner') so a context can carry a
+ * tenant id; the free core still always builds 'owner'.
  */
 export interface IdentityContext {
-    subject: 'owner';
+    subject: string;
     accounts: AccountSet;
     policy: Policy;
     getClient: typeof getClient;

package/dist/oauth-as.js

@@ -385,8 +385,8 @@ export function buildAuthServer(config, deps = {}) {
             if (!form.code_verifier || pkceS256(form.code_verifier) !== code.code_challenge) {
                 return json(res, 400, { error: 'invalid_grant', message: 'PKCE verification failed' });
             }
-            const access = await signAccessToken({ base, secret, iat: nowSec(), ttlSec: accessTtl, sub: 'owner' });
-            const refreshToken = refresh.issue(now(), 'owner');
+            const access = await signAccessToken({ base, secret, iat: nowSec(), ttlSec: accessTtl, sub: code.sub });
+            const refreshToken = refresh.issue(now(), code.sub);
             log('token issued grant=authorization_code');
             return json(res, 200, { access_token: access, token_type: 'Bearer', expires_in: accessTtl, refresh_token: refreshToken, scope: 'mcp:use' });
         }
@@ -394,7 +394,7 @@ export function buildAuthServer(config, deps = {}) {
             const next = refresh.rotate(form.refresh_token ?? '', now());
             if (!next)
                 return json(res, 400, { error: 'invalid_grant', message: 'unknown or rotated refresh token' });
-            const access = await signAccessToken({ base, secret, iat: nowSec(), ttlSec: accessTtl, sub: 'owner' });
+            const access = await signAccessToken({ base, secret, iat: nowSec(), ttlSec: accessTtl, sub: next.sub });
             log('token issued grant=refresh_token');
             return json(res, 200, { access_token: access, token_type: 'Bearer', expires_in: accessTtl, refresh_token: next.token, scope: 'mcp:use' });
         }
@@ -446,8 +446,8 @@ export function buildAuthServer(config, deps = {}) {
             return { ok: false, status: 401, headers: { 'WWW-Authenticate': wwwAuth }, body: JSON.stringify({ error: 'E_MCP_TOKEN_INVALID', message: 'missing bearer token' }) };
         }
         try {
-            await verifyAccessToken(header.slice(7), base, secret);
-            return { ok: true };
+            const claims = await verifyAccessToken(header.slice(7), base, secret);
+            return { ok: true, sub: claims.sub };
         }
         catch {
             return { ok: false, status: 401, headers: { 'WWW-Authenticate': wwwAuth }, body: JSON.stringify({ error: 'E_MCP_TOKEN_INVALID', message: 'invalid or expired token' }) };

package/dist/registry.d.ts

@@ -1,6 +1,7 @@
 import type { McpServer } from "@modelcontextprotocol/server";
 import { z } from 'zod';
 import { type Policy } from './write-control.js';
+import { type AccountSet } from './accounts.js';
 import type { ArgShape } from './arg-normalize.js';
 import type { Metrics } from './usage-metrics.js';
 export type Cud = 'read' | 'create' | 'update' | 'delete';
@@ -41,6 +42,7 @@ export declare function inferCud(name: string): Cud;
 export declare class ToolRegistry {
     private readonly server;
     private readonly metrics;
+    private readonly accounts;
     readonly tools: ToolEntry[];
     readonly policy: Policy;
     readonly registerTool: McpServer['registerTool'];
@@ -57,7 +59,7 @@ export declare class ToolRegistry {
     /** Agent-toggled runtime overlay (discover_all / discover_reset): lifts a
      * lazy surface to curated without touching the configured mode. */
     private expanded;
-    constructor(server: McpServer, policy: Policy, mode?: DiscoveryMode, metrics?: Metrics | null);
+    constructor(server: McpServer, policy: Policy, mode?: DiscoveryMode, metrics?: Metrics | null, accounts?: () => AccountSet);
     registerMeta: McpServer['registerTool'];
     services(): string[];
     /** Declared input-schema keys + scalar kinds for one tool (tools/call arg

package/dist/registry.js

@@ -91,6 +91,7 @@ export function inferCud(name) {
 export class ToolRegistry {
     server;
     metrics;
+    accounts;
     tools = [];
     policy;
     registerTool;
@@ -107,9 +108,14 @@ export class ToolRegistry {
     /** Agent-toggled runtime overlay (discover_all / discover_reset): lifts a
      * lazy surface to curated without touching the configured mode. */
     expanded = false;
-    constructor(server, policy, mode = resolveDiscoveryMode(), metrics = null) {
+    constructor(server, policy, mode = resolveDiscoveryMode(), metrics = null, 
+    // The registry's OWN account view: fan-out expansion, selector validation
+    // and default-account injection all read through it so a registry built
+    // over a subset never observes (or leaks) the global set.
+    accounts = getAccountSet) {
         this.server = server;
         this.metrics = metrics;
+        this.accounts = accounts;
         this.policy = policy;
         this.mode = mode;
         this.registerTool = ((name, config, handler) => {
@@ -142,12 +148,12 @@ export class ToolRegistry {
             const hasAccountField = 'account' in inputShape && !DEFAULT_ACCOUNT_EXCLUDE.has(name);
             if (cud === 'read' && !this.registeringMeta && !FANOUT_EXCLUDE.has(name) && isAccountEnum(inputShape.account)) {
                 const description = inputShape.account.description ?? 'Google account alias';
-                inputShape = { ...inputShape, account: fanoutAccountField(description) };
+                inputShape = { ...inputShape, account: fanoutAccountField(description, this.accounts().aliases) };
                 baseHandler = async (...args) => {
                     const first = args[0];
-                    const parsed = parseAccountSelector(typeof first?.account === 'string' ? first.account : '');
+                    const parsed = parseAccountSelector(typeof first?.account === 'string' ? first.account : '', this.accounts().aliases);
                     if (!parsed.ok)
-                        return invalidAccountsResult(parsed.invalid);
+                        return invalidAccountsResult(parsed.invalid, this.accounts().aliases);
                     if (!parsed.fanout)
                         return handler({ ...first, account: parsed.aliases[0] }, ...args.slice(1));
                     return runFanout(handler, args, parsed.aliases);
@@ -188,7 +194,7 @@ export class ToolRegistry {
                     // heals for a client that always omits account (this branch never
                     // reaches getClient's probe). One stat, only on omission.
                     refreshAccountSetIfStale();
-                    const def = getAccountSet().defaultAccount;
+                    const def = this.accounts().defaultAccount;
                     if (!def) {
                         return {
                             content: [
@@ -197,7 +203,7 @@ export class ToolRegistry {
                                     text: JSON.stringify({
                                         error: 'E_NO_DEFAULT_ACCOUNT',
                                         message: 'No "account" given and no default account is configured.',
-                                        hint: `Pass account explicitly (valid: ${getAccountSet().aliases.join(', ')}), or set GOOGLE_DEFAULT_ACCOUNT / "defaultAccount" in config.json.`,
+                                        hint: `Pass account explicitly (valid: ${this.accounts().aliases.join(', ')}), or set GOOGLE_DEFAULT_ACCOUNT / "defaultAccount" in config.json.`,
                                         retriable: false,
                                     }),
                                 },

package/dist/scope-observability.js

@@ -1,6 +1,7 @@
 import { ADMIN_SCOPES, BUNDLE_CATALOG } from './scope-catalog.js';
 import { BASE_SCOPES, resolveScopesForAccount } from './auth.js';
 import { readToken } from './token-store.js';
+import { reauthHint } from './reauth-hint.js';
 // Reverse index scope -> bundles offering it, narrowest bundle first (fewest
 // scopes) so the remediation names the smallest grant. BASE_SCOPES map to the
 // pseudo-bundle "base" (outside a profile only via includesBase:false).
@@ -74,7 +75,7 @@ export function scopeHint(scope, c, alias) {
         case 'requestable_not_granted':
             return {
                 hint: `Scope ${scope} is in ${alias}'s profile but not granted (you unchecked it at consent). ` +
-                    `Re-grant: npx mcp-google-multi auth --account ${alias}`,
+                    reauthHint(alias),
                 retriable: true,
             };
         case 'not_requestable':

package/dist/token-store.d.ts

@@ -1,7 +1,8 @@
 import type { TokenData } from './types.js';
 export declare function deriveKey(masterKey: string): Buffer;
-export declare function encryptToken(data: object, masterKey: string): string;
-export declare function decryptToken(fileContents: string, masterKey: string): TokenData;
+export declare function deriveTenantKey(masterKey: string, tenantId: string): Buffer;
+export declare function encryptToken(data: object, masterKey: string, tenantId?: string): string;
+export declare function decryptToken(fileContents: string, masterKey: string, tenantId?: string): TokenData;
 export declare function readToken(alias: string): TokenData | null;
 export declare function writeToken(alias: string, data: object): void;
 export declare function updateToken(alias: string, updates: object): void;

package/dist/tools/accounts-tool.js

@@ -1,3 +1,4 @@
+import { reauthHint } from '../reauth-hint.js';
 import * as fs from 'node:fs';
 import { getAccountSet, refreshAccountSetIfStale } from '../accounts.js';
 import { buildScopesReport } from '../scope-observability.js';
@@ -35,7 +36,7 @@ export function deriveAccountHealth(alias, deps = DEFAULT_DEPS) {
                 status: 'missing',
                 hint: legacy
                     ? 'Plaintext token.json found — run: npx mcp-google-multi migrate-tokens'
-                    : `Run: npx mcp-google-multi auth --account ${alias}`,
+                    : reauthHint(alias),
             },
             scopes: noScopes,
         };
@@ -69,7 +70,7 @@ export function deriveAccountHealth(alias, deps = DEFAULT_DEPS) {
             status,
             expiryDate: expiry !== undefined ? new Date(expiry).toISOString() : undefined,
             hint: status === 'needs_reauth'
-                ? `Run: npx mcp-google-multi auth --account ${alias}`
+                ? reauthHint(alias)
                 : missing.length > 0
                     ? 'Re-auth to grant the missing scopes'
                     : undefined,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "mcp-google-multi",
-  "version": "6.0.0-alpha.37",
+  "version": "6.0.0-alpha.39",
   "mcpName": "io.github.bakissation/mcp-google-multi",
   "description": "Local MCP server for Google Workspace (Gmail, Drive, Calendar, Sheets, Docs, Contacts, Tasks, Meet, Search Console, +Forms/Chat/Admin) across multiple accounts — OAuth-only, encrypted token storage, deny-by-default writes.",
   "type": "module",