mcp-google-multi 6.0.0-alpha.38 → 6.0.0-alpha.39

package/dist/accounts.d.ts

@@ -18,7 +18,10 @@ export interface AccountSet {
     defaultAccount?: string;
     defaultAccountSource?: 'env' | 'config';
 }
-export declare function resolveAccounts(env?: NodeJS.ProcessEnv, filePath?: string, onInvalid?: 'exit' | 'throw'): AccountSet;
+export declare function resolveAccounts(env?: NodeJS.ProcessEnv, filePath?: string, onInvalid?: 'exit' | 'throw', opts?: {
+    tokenDir?: string;
+}): AccountSet;
+export declare function fileStamp(filePath: string, version: number): string;
 /** Live accessor: dispatch-time readers use this, never a captured snapshot. */
 export declare function getAccountSet(): AccountSet;
 /** Re-resolve after a config.json mutation and swap the live set. */

package/dist/accounts.js

@@ -15,14 +15,14 @@ export function getTokenDir() {
 function parseCsv(value) {
     return (value ?? '').split(',').map((s) => s.trim()).filter(Boolean);
 }
-function accountPaths(alias) {
+function accountPaths(alias, dir = tokenDir) {
     return {
-        tokenPath: path.join(tokenDir, alias, 'token.json'),
-        encPath: path.join(tokenDir, `${alias}.enc`),
+        tokenPath: path.join(dir, alias, 'token.json'),
+        encPath: path.join(dir, `${alias}.enc`),
     };
 }
 /** v5 env parser, guards verbatim. Format: GOOGLE_ACCOUNTS="alias1:email1,alias2:email2". */
-function parseEnvAccounts(raw, adminAliases) {
+function parseEnvAccounts(raw, adminAliases, dir = tokenDir) {
     const configs = {};
     const aliases = [];
     for (const entry of raw.split(',')) {
@@ -49,7 +49,7 @@ function parseEnvAccounts(raw, adminAliases) {
         aliases.push(alias);
         configs[alias] = {
             email,
-            ...accountPaths(alias),
+            ...accountPaths(alias, dir),
             admin: adminAliases.includes(alias) || undefined,
             source: 'env',
         };
@@ -74,7 +74,8 @@ function noAccountsMessage() {
  * empty behaves as unset, mirroring GOOGLE_ACCOUNTS semantics.
  */
 let warnedLegacy = false;
-export function resolveAccounts(env = process.env, filePath = configFilePath(), onInvalid = 'exit') {
+export function resolveAccounts(env = process.env, filePath = configFilePath(), onInvalid = 'exit', opts = {}) {
+    const dir = opts.tokenDir ?? tokenDir;
     const adminEnv = parseCsv(env.GOOGLE_ADMIN_ACCOUNTS);
     const rawEnv = env.GOOGLE_ACCOUNTS;
     const fail = (slug, message) => {
@@ -102,7 +103,7 @@ export function resolveAccounts(env = process.env, filePath = configFilePath(),
         }
     }
     if (rawEnv && rawEnv.trim() !== '') {
-        const { aliases, configs } = parseEnvAccounts(rawEnv, adminEnv);
+        const { aliases, configs } = parseEnvAccounts(rawEnv, adminEnv, dir);
         materializeFirstRun(aliases, configs, filePath);
         const def = resolveDefaultAccount(env, null, aliases, fail);
         return {
@@ -167,7 +168,7 @@ export function resolveAccounts(env = process.env, filePath = configFilePath(),
         aliases.push(alias);
         configs[alias] = {
             email: entry.email,
-            ...accountPaths(alias),
+            ...accountPaths(alias, dir),
             scopeProfile: entry.scopeProfile,
             admin: adminEnv.length > 0 ? adminEnv.includes(alias) : entry.admin,
             source: 'config',
@@ -196,7 +197,7 @@ function resolveDefaultAccount(env, fromConfig, aliases, fail) {
     }
     return { defaultAccount: value, defaultAccountSource: fromEnv ? 'env' : 'config' };
 }
-function fileStamp(filePath, version) {
+export function fileStamp(filePath, version) {
     try {
         return `${version}:${fs.statSync(filePath).mtimeMs}`;
     }

package/dist/config-file.d.ts

@@ -1,6 +1,17 @@
 export declare const CONFIG_VERSION = 1;
 export declare function configDir(env?: NodeJS.ProcessEnv): string;
 export declare function configFilePath(env?: NodeJS.ProcessEnv): string;
+export declare function tenantsDir(env?: NodeJS.ProcessEnv): string;
+export declare function tenantConfigFilePath(tenantId: string, env?: NodeJS.ProcessEnv): string;
+export declare function tenantTokenDir(tenantId: string, env?: NodeJS.ProcessEnv): string;
+/** Create and permission-harden the tenant directory chain. mkdirSync's
+ * recursive mode only stamps the DEEPEST newly-created dir, so every level
+ * gets an explicit chmod: the shared tenants/ root (created by whichever
+ * tenant provisions first) must never stay group-readable. */
+export declare function ensureTenantDirs(tenantId: string, env?: NodeJS.ProcessEnv): {
+    configFile: string;
+    tokenDir: string;
+};
 export declare const ALIAS_RE: RegExp;
 export declare const RESERVED_ALIASES: string[];
 export declare function isReservedAlias(name: string): boolean;

package/dist/config-file.js

@@ -10,6 +10,38 @@ export function configDir(env = process.env) {
 export function configFilePath(env = process.env) {
     return path.join(configDir(env), 'config.json');
 }
+export function tenantsDir(env = process.env) {
+    return path.join(configDir(env), 'tenants');
+}
+// A tenant id becomes a filesystem path segment exactly like an account
+// alias, so it rides the same traversal guard.
+function assertTenantId(tenantId) {
+    if (!ALIAS_RE.test(tenantId) || isReservedAlias(tenantId)) {
+        throw new Error(`E_TENANT_ID_INVALID: invalid tenant id "${tenantId}".`);
+    }
+}
+export function tenantConfigFilePath(tenantId, env = process.env) {
+    assertTenantId(tenantId);
+    return path.join(tenantsDir(env), tenantId, 'config.json');
+}
+export function tenantTokenDir(tenantId, env = process.env) {
+    assertTenantId(tenantId);
+    return path.join(tenantsDir(env), tenantId, 'tokens');
+}
+/** Create and permission-harden the tenant directory chain. mkdirSync's
+ * recursive mode only stamps the DEEPEST newly-created dir, so every level
+ * gets an explicit chmod: the shared tenants/ root (created by whichever
+ * tenant provisions first) must never stay group-readable. */
+export function ensureTenantDirs(tenantId, env = process.env) {
+    const tokenDir = tenantTokenDir(tenantId, env);
+    const levels = [configDir(env), tenantsDir(env), path.join(tenantsDir(env), tenantId), tokenDir];
+    for (const dir of levels) {
+        fs.mkdirSync(dir, { recursive: true, mode: 0o700 });
+        if (process.platform !== 'win32')
+            fs.chmodSync(dir, 0o700);
+    }
+    return { configFile: tenantConfigFilePath(tenantId, env), tokenDir };
+}
 // Alias charset is load-bearing security, not cosmetics: the alias becomes a
 // tokenDir path segment (encPath), so this guard blocks path traversal.
 export const ALIAS_RE = /^[a-zA-Z0-9_-]+$/;

package/dist/fanout.d.ts

@@ -1,6 +1,6 @@
 import { z } from 'zod';
 export declare const CSV_RE: RegExp;
-export declare function fanoutAccountField(description: string): z.ZodType;
+export declare function fanoutAccountField(description: string, aliases: readonly string[]): z.ZodType;
 export type AccountSelector = {
     ok: true;
     fanout: boolean;

package/dist/fanout.js

@@ -1,19 +1,22 @@
 import { z } from 'zod';
-import { ACCOUNTS, getAccountSet, unknownAliasMessage } from './accounts.js';
+import { getAccountSet, unknownAliasMessage } from './accounts.js';
 export const CSV_RE = /^[a-zA-Z0-9_-]+(\s*,\s*[a-zA-Z0-9_-]+)+$/;
 const FANOUT_CONCURRENCY = 5;
-export function fanoutAccountField(description) {
-    const csvExample = ACCOUNTS.length > 1 ? `; or a CSV subset like "${ACCOUNTS.slice(0, 2).join(',')}"` : '';
+// `aliases` is required (no global default): the field is baked into a
+// registry's inputSchema, so it must be built from THAT registry's account
+// set or a '*' would advertise and accept another registry's aliases.
+export function fanoutAccountField(description, aliases) {
+    const csvExample = aliases.length > 1 ? `; or a CSV subset like "${aliases.slice(0, 2).join(',')}"` : '';
     // The union's OWN error only fires when every branch aborts at the type
     // check (a non-string). For a string, zod surfaces the single non-aborted
     // branch verbatim, which is the CSV regex, so a mistyped alias used to read
     // as "Invalid string: must match pattern /^[a-zA-Z0-9_-]+(,...)/" and never
     // named an alias. Hence the same message on BOTH.
-    const bad = () => unknownAliasMessage(ACCOUNTS, true);
+    const bad = () => unknownAliasMessage(aliases, true);
     return z
-        // '*' first so the tuple is statically non-empty even when ACCOUNTS is empty
+        // '*' first so the tuple is statically non-empty even when aliases is empty
         // (a fresh install): z.enum requires [string, ...string[]].
-        .union([z.enum(['*', ...ACCOUNTS]), z.string().regex(CSV_RE, { error: bad })], { error: bad })
+        .union([z.enum(['*', ...aliases]), z.string().regex(CSV_RE, { error: bad })], { error: bad })
         .optional()
         .describe(`${description}; "*" = all accounts${csvExample}; omit for the default account`);
 }

package/dist/identity.d.ts

@@ -6,9 +6,11 @@ import { type Policy, type Transport } from './write-control.js';
  * The one forward-compat seam (frozen public API): the free core builds
  * exactly one context with subject "owner"; EE later instantiates N contexts
  * from N registries. Nothing here may assume a global current-account.
+ * `subject` is a string (not the literal 'owner') so a context can carry a
+ * tenant id; the free core still always builds 'owner'.
  */
 export interface IdentityContext {
-    subject: 'owner';
+    subject: string;
     accounts: AccountSet;
     policy: Policy;
     getClient: typeof getClient;

package/dist/registry.d.ts

@@ -1,6 +1,7 @@
 import type { McpServer } from "@modelcontextprotocol/server";
 import { z } from 'zod';
 import { type Policy } from './write-control.js';
+import { type AccountSet } from './accounts.js';
 import type { ArgShape } from './arg-normalize.js';
 import type { Metrics } from './usage-metrics.js';
 export type Cud = 'read' | 'create' | 'update' | 'delete';
@@ -41,6 +42,7 @@ export declare function inferCud(name: string): Cud;
 export declare class ToolRegistry {
     private readonly server;
     private readonly metrics;
+    private readonly accounts;
     readonly tools: ToolEntry[];
     readonly policy: Policy;
     readonly registerTool: McpServer['registerTool'];
@@ -57,7 +59,7 @@ export declare class ToolRegistry {
     /** Agent-toggled runtime overlay (discover_all / discover_reset): lifts a
      * lazy surface to curated without touching the configured mode. */
     private expanded;
-    constructor(server: McpServer, policy: Policy, mode?: DiscoveryMode, metrics?: Metrics | null);
+    constructor(server: McpServer, policy: Policy, mode?: DiscoveryMode, metrics?: Metrics | null, accounts?: () => AccountSet);
     registerMeta: McpServer['registerTool'];
     services(): string[];
     /** Declared input-schema keys + scalar kinds for one tool (tools/call arg

package/dist/registry.js

@@ -91,6 +91,7 @@ export function inferCud(name) {
 export class ToolRegistry {
     server;
     metrics;
+    accounts;
     tools = [];
     policy;
     registerTool;
@@ -107,9 +108,14 @@ export class ToolRegistry {
     /** Agent-toggled runtime overlay (discover_all / discover_reset): lifts a
      * lazy surface to curated without touching the configured mode. */
     expanded = false;
-    constructor(server, policy, mode = resolveDiscoveryMode(), metrics = null) {
+    constructor(server, policy, mode = resolveDiscoveryMode(), metrics = null, 
+    // The registry's OWN account view: fan-out expansion, selector validation
+    // and default-account injection all read through it so a registry built
+    // over a subset never observes (or leaks) the global set.
+    accounts = getAccountSet) {
         this.server = server;
         this.metrics = metrics;
+        this.accounts = accounts;
         this.policy = policy;
         this.mode = mode;
         this.registerTool = ((name, config, handler) => {
@@ -142,12 +148,12 @@ export class ToolRegistry {
             const hasAccountField = 'account' in inputShape && !DEFAULT_ACCOUNT_EXCLUDE.has(name);
             if (cud === 'read' && !this.registeringMeta && !FANOUT_EXCLUDE.has(name) && isAccountEnum(inputShape.account)) {
                 const description = inputShape.account.description ?? 'Google account alias';
-                inputShape = { ...inputShape, account: fanoutAccountField(description) };
+                inputShape = { ...inputShape, account: fanoutAccountField(description, this.accounts().aliases) };
                 baseHandler = async (...args) => {
                     const first = args[0];
-                    const parsed = parseAccountSelector(typeof first?.account === 'string' ? first.account : '');
+                    const parsed = parseAccountSelector(typeof first?.account === 'string' ? first.account : '', this.accounts().aliases);
                     if (!parsed.ok)
-                        return invalidAccountsResult(parsed.invalid);
+                        return invalidAccountsResult(parsed.invalid, this.accounts().aliases);
                     if (!parsed.fanout)
                         return handler({ ...first, account: parsed.aliases[0] }, ...args.slice(1));
                     return runFanout(handler, args, parsed.aliases);
@@ -188,7 +194,7 @@ export class ToolRegistry {
                     // heals for a client that always omits account (this branch never
                     // reaches getClient's probe). One stat, only on omission.
                     refreshAccountSetIfStale();
-                    const def = getAccountSet().defaultAccount;
+                    const def = this.accounts().defaultAccount;
                     if (!def) {
                         return {
                             content: [
@@ -197,7 +203,7 @@ export class ToolRegistry {
                                     text: JSON.stringify({
                                         error: 'E_NO_DEFAULT_ACCOUNT',
                                         message: 'No "account" given and no default account is configured.',
-                                        hint: `Pass account explicitly (valid: ${getAccountSet().aliases.join(', ')}), or set GOOGLE_DEFAULT_ACCOUNT / "defaultAccount" in config.json.`,
+                                        hint: `Pass account explicitly (valid: ${this.accounts().aliases.join(', ')}), or set GOOGLE_DEFAULT_ACCOUNT / "defaultAccount" in config.json.`,
                                         retriable: false,
                                     }),
                                 },

package/dist/token-store.d.ts

@@ -1,7 +1,8 @@
 import type { TokenData } from './types.js';
 export declare function deriveKey(masterKey: string): Buffer;
-export declare function encryptToken(data: object, masterKey: string): string;
-export declare function decryptToken(fileContents: string, masterKey: string): TokenData;
+export declare function deriveTenantKey(masterKey: string, tenantId: string): Buffer;
+export declare function encryptToken(data: object, masterKey: string, tenantId?: string): string;
+export declare function decryptToken(fileContents: string, masterKey: string, tenantId?: string): TokenData;
 export declare function readToken(alias: string): TokenData | null;
 export declare function writeToken(alias: string, data: object): void;
 export declare function updateToken(alias: string, updates: object): void;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "mcp-google-multi",
-  "version": "6.0.0-alpha.38",
+  "version": "6.0.0-alpha.39",
   "mcpName": "io.github.bakissation/mcp-google-multi",
   "description": "Local MCP server for Google Workspace (Gmail, Drive, Calendar, Sheets, Docs, Contacts, Tasks, Meet, Search Console, +Forms/Chat/Admin) across multiple accounts — OAuth-only, encrypted token storage, deny-by-default writes.",
   "type": "module",