mcp-google-multi 6.0.0-alpha.40 → 6.0.0-alpha.42

package/dist/boot-gates.d.ts

@@ -0,0 +1,26 @@
+export interface MtBootGates {
+    /** True = multi-tenant deployment: the server boots with zero accounts
+     * (tenants provision in-band) and the provisioning gate below replaces the
+     * flat owner-allowlist requirement. */
+    multiTenant: boolean;
+    /** Fail-fast replacement for the E_OWNER_EMAILS_REQUIRED check. MUST refuse
+     * (exit/throw) when no valid provisioning mechanism is configured — an
+     * ungated HTTP endpoint must never boot, whatever the condition checked. */
+    assertProvisioningGate: () => void;
+}
+export declare function setMtBootGates(g: MtBootGates | null): void;
+export declare function mtBootGates(): MtBootGates | null;
+export declare function isMultiTenantBoot(): boolean;
+/** BR-4 applies to stdio always, and to HTTP only when single-owner: a
+ * multi-tenant HTTP deploy starts empty by design. */
+export declare function accountsAssertRequired(wantStdio: boolean, multiTenant: boolean): boolean;
+/** A set GOOGLE_ACCOUNTS on a multi-tenant boot is refused at DEPLOY time:
+ * the env registry is process-wide, so it would graft one operator's accounts
+ * onto every tenant and turn every tenant's first wizard call into a dead
+ * end (the per-call E_ENV_ACCOUNTS_MODE guard), N confusing failures instead
+ * of one clear one. */
+export declare function assertNoEnvAccountsMode(env?: NodeJS.ProcessEnv): void;
+/** Same class, second vector: GOOGLE_OPTIONAL_SCOPES is a process-wide legacy
+ * global scope profile, so on a multi-tenant box one operator's scope choice
+ * would silently apply to every tenant's consent. */
+export declare function assertNoEnvOptionalScopesMode(env?: NodeJS.ProcessEnv): void;

package/dist/boot-gates.js

@@ -0,0 +1,38 @@
+// S1.16: multi-tenant boot gates. The free core never sets these — every
+// helper reduces to today's single-owner behavior when no gates are
+// installed. Deliberately a side-effect-free module (accounts.ts/auth.ts
+// resolve env at import time) so the tenancy module can import it cheaply.
+import { failStartup } from './config-file.js';
+let gates = null;
+export function setMtBootGates(g) {
+    gates = g;
+}
+export function mtBootGates() {
+    return gates;
+}
+export function isMultiTenantBoot() {
+    return gates?.multiTenant === true;
+}
+/** BR-4 applies to stdio always, and to HTTP only when single-owner: a
+ * multi-tenant HTTP deploy starts empty by design. */
+export function accountsAssertRequired(wantStdio, multiTenant) {
+    return wantStdio || !multiTenant;
+}
+/** A set GOOGLE_ACCOUNTS on a multi-tenant boot is refused at DEPLOY time:
+ * the env registry is process-wide, so it would graft one operator's accounts
+ * onto every tenant and turn every tenant's first wizard call into a dead
+ * end (the per-call E_ENV_ACCOUNTS_MODE guard), N confusing failures instead
+ * of one clear one. */
+export function assertNoEnvAccountsMode(env = process.env) {
+    if (env.GOOGLE_ACCOUNTS?.trim()) {
+        failStartup('E_ENV_ACCOUNTS_MODE_MT', 'GOOGLE_ACCOUNTS must not be set on a multi-tenant deployment; accounts are linked in-band per tenant. Unset it and restart.');
+    }
+}
+/** Same class, second vector: GOOGLE_OPTIONAL_SCOPES is a process-wide legacy
+ * global scope profile, so on a multi-tenant box one operator's scope choice
+ * would silently apply to every tenant's consent. */
+export function assertNoEnvOptionalScopesMode(env = process.env) {
+    if (env.GOOGLE_OPTIONAL_SCOPES?.trim()) {
+        failStartup('E_ENV_OPTIONAL_SCOPES_MT', 'GOOGLE_OPTIONAL_SCOPES must not be set on a multi-tenant deployment; scopes are chosen per tenant at consent. Unset it and restart.');
+    }
+}

package/dist/client.d.ts

@@ -1,3 +1,24 @@
 import { OAuth2Client } from 'googleapis-common';
-import type { Account } from './accounts.js';
-export declare function getClient(account: Account): Promise<OAuth2Client>;
+import type { Account, AccountSet } from './accounts.js';
+import type { TokenData } from './types.js';
+export interface GetClientDeps {
+    /** Live account view — read at call time, never a captured snapshot. */
+    accounts: () => AccountSet;
+    readToken: (alias: string) => TokenData | null;
+    updateToken: (alias: string, updates: object) => void;
+    /** Cross-process staleness probe (single-owner global registry only). */
+    refreshIfStale?: () => void;
+}
+/** Test-only visibility into the dedupe map. */
+export declare function __inflightSizeForTest(): number;
+/**
+ * Per-context client factory: `contextKey` namespaces the single-flight map
+ * (one lane per tenant), `deps` carry that context's account view and token
+ * custody. The free core builds exactly one, bound to the global registry.
+ */
+export declare function makeGetClient(contextKey: string, deps: GetClientDeps): (account: Account) => Promise<OAuth2Client>;
+/** The single-owner client, bound to the global registry + token store. The
+ * operator surfaces that never carry a tenant (api-probe, executor and
+ * escape-hatch `deps.getClientFn ?? getClient` defaults, stdio dispatch)
+ * resolve through this. */
+export declare const getClient: (account: Account) => Promise<OAuth2Client>;

package/dist/http-transport.d.ts

@@ -22,6 +22,17 @@ export interface HttpHostOptions {
     version: string;
     ownerConfigured: boolean;
     authenticate: Authenticator;
+    /** Tenant-resolution seam: map the verified subject to ITS server. Absent
+     * (free core) = every request dispatches to the one boot `server`. Return
+     * null for an unknown subject -> 403 tenant_not_found. Each distinct
+     * resolved server gets its own serialize key. */
+    resolveServer?: (claims: {
+        sub: string;
+    }) => Promise<{
+        server: McpServer;
+    } | null> | {
+        server: McpServer;
+    } | null;
     /** Extra routes keyed by exact pathname (AS endpoints mount here in B13). */
     routes?: Record<string, RouteHandler>;
     log?: (line: string) => void;
@@ -53,9 +64,9 @@ export declare function jsonRpcMethod(body: unknown): string;
 export declare class HttpTransportHost {
     private readonly opts;
     private httpServer?;
-    private lock;
+    private readonly locks;
     constructor(opts: HttpHostOptions);
-    private serialize;
+    private serializeFor;
     private log;
     start(): Promise<void>;
     close(): Promise<void>;

package/dist/http-transport.js

@@ -43,18 +43,20 @@ export function jsonRpcMethod(body) {
 export class HttpTransportHost {
     opts;
     httpServer;
-    // Serialize the connect→dispatch critical section: the shared McpServer
+    // Serialize the connect→dispatch critical section PER KEY: a McpServer
     // captures its transport per request (protocol.js), but the gap between
     // connect() and the dispatch capturing it would still race under true
-    // concurrency. Single-owner HTTP traffic is effectively serial, so a mutex
-    // keeps correctness at negligible cost (and never rebuilds the registry).
-    lock = Promise.resolve();
+    // concurrency, so all traffic to ONE server runs under one mutex. The free
+    // core uses a single key (one boot server); with resolveServer each subject
+    // gets its own server and therefore its own independent lock lane.
+    locks = new Map();
     constructor(opts) {
         this.opts = opts;
     }
-    serialize(fn) {
-        const run = this.lock.then(fn, fn);
-        this.lock = run.then(() => undefined, () => undefined);
+    serializeFor(key, fn) {
+        const prev = this.locks.get(key) ?? Promise.resolve();
+        const run = prev.then(fn, fn);
+        this.locks.set(key, run.then(() => undefined, () => undefined));
         return run;
     }
     log(line) {
@@ -149,6 +151,24 @@ export class HttpTransportHost {
             this.log(`${auth.status} auth_failed path=/mcp`);
             return;
         }
+        const sub = auth.sub ?? 'owner';
+        // Tenant resolution (the seam EE fills): map the verified subject to ITS
+        // server. Absent resolver = the one boot server for every subject.
+        let target = { server: this.opts.server };
+        if (this.opts.resolveServer) {
+            try {
+                target = await this.opts.resolveServer({ sub });
+            }
+            catch {
+                target = null;
+            }
+            if (!target) {
+                res.writeHead(403, { 'Content-Type': 'application/json' });
+                res.end(JSON.stringify({ error: 'tenant_not_found', message: 'no tenant is provisioned for this subject' }));
+                this.log('403 tenant_not_found path=/mcp');
+                return;
+            }
+        }
         // Thread the verified subject to tool handlers: the Node transport forwards
         // req.auth verbatim as ctx.http.authInfo. Token/clientId stay empty — the
         // bearer value must not re-enter the dispatch path via handler context.
@@ -156,7 +176,7 @@ export class HttpTransportHost {
             token: '',
             clientId: '',
             scopes: ['mcp:use'],
-            extra: { sub: auth.sub ?? 'owner' },
+            extra: { sub },
         };
         let body;
         try {
@@ -184,7 +204,12 @@ export class HttpTransportHost {
         // releases. (A shared initialized-state persists across stateless requests;
         // benign for the single-owner design.)
         const deadlineMs = this.opts.dispatchTimeoutMs ?? DISPATCH_TIMEOUT_DEFAULT;
-        await this.serialize(async () => {
+        // The lock lane must match the SERVER identity, not the subject: without a
+        // resolver every subject shares the one boot server, so keying on sub
+        // would let two subjects race one server through the connect gap.
+        const serializeKey = this.opts.resolveServer ? sub : '__single__';
+        const mcpServer = target.server;
+        await this.serializeFor(serializeKey, async () => {
             const disconnected = new Promise((resolve) => res.once('close', () => resolve('closed')));
             let timer;
             const timedOut = new Promise((resolve) => {
@@ -195,7 +220,7 @@ export class HttpTransportHost {
             // so the tap above it still classifies the original validation prose.
             const enveloped = withValidationEnvelope(transport, this.opts.validationEnvelope ?? {});
             const tapped = this.opts.metricsTap ? this.opts.metricsTap(enveloped) : enveloped;
-            await this.opts.server.connect(this.opts.argShapeFor || this.opts.strictArgs
+            await mcpServer.connect(this.opts.argShapeFor || this.opts.strictArgs
                 ? withArgNormalization(tapped, this.opts.argShapeFor ?? (() => undefined), this.opts.log, this.opts.onArgRename, this.opts.strictArgs)
                 : tapped);
             // Reflect the dispatch into a non-rejecting arm: if the deadline wins the

package/dist/identity.js

@@ -1,8 +1,12 @@
-import { getAccountSet } from './accounts.js';
-import { getClient } from './client.js';
-import { hasToken, readToken, updateToken, writeToken } from './token-store.js';
+import { getAccountSet, getTokenDir, refreshAccountSetIfStale } from './accounts.js';
+import { makeGetClient } from './client.js';
+import { createTokenStore } from './token-store.js';
 import { resolvePolicy } from './write-control.js';
 export function buildIdentityContext(env = process.env, opts = {}) {
+    // Real closures over the single-owner state (the SAME factories EE
+    // instantiates per tenant), bound here to the global registry + token dir —
+    // behavior-identical to the module-level functions for the free core.
+    const tokenStore = createTokenStore(getTokenDir());
     return {
         subject: 'owner',
         // Live getter: the seam must always see the current registry, never a
@@ -13,7 +17,12 @@ export function buildIdentityContext(env = process.env, opts = {}) {
         // The dispatch transport rides into the resolved policy as a reserved seam
         // (cc-write-control B14); it does not change any write-control verdict.
         policy: resolvePolicy(env, { transport: opts.transport }),
-        getClient,
-        tokenStore: { readToken, writeToken, updateToken, hasToken },
+        getClient: makeGetClient('owner', {
+            accounts: getAccountSet,
+            readToken: tokenStore.readToken,
+            updateToken: tokenStore.updateToken,
+            refreshIfStale: refreshAccountSetIfStale,
+        }),
+        tokenStore,
     };
 }

package/dist/index.js

@@ -2,6 +2,7 @@
 // First import: triggers accounts.js module load (env files + registry) before
 // anything else. Named to also pull the server-only empty-registry guard (BR-4).
 import { assertServerAccountsConfigured, getAccountSet } from './accounts.js';
+import { accountsAssertRequired, assertNoEnvAccountsMode, assertNoEnvOptionalScopesMode, isMultiTenantBoot, mtBootGates } from './boot-gates.js';
 import { readFileSync } from 'node:fs';
 import { fileURLToPath } from 'node:url';
 import path from 'node:path';
@@ -198,14 +199,8 @@ async function main() {
         }
         return;
     }
-    // BR-4: the SERVER never boots with an empty registry. The bootstrap and
-    // diagnostic CLIs above already returned; a fresh user configures accounts
-    // (env / migrate-config / account import / auth) before the server runs.
-    assertServerAccountsConfigured();
-    // Resolve (or provision) the master key BEFORE serving: the hard guard is
-    // specced "fatal at startup", never mid-dispatch.
-    const { resolveMasterKey } = await import('./master-key.js');
-    resolveMasterKey();
+    // Transport derivation FIRST: the accounts gate below is transport-aware
+    // (a multi-tenant HTTP deploy legitimately boots with zero accounts).
     const { resolveHttpConfig, transportIncludesHttp } = await import('./http-config.js');
     let httpCfg;
     try {
@@ -217,6 +212,21 @@ async function main() {
     }
     const wantStdio = httpCfg.transport === 'stdio' || httpCfg.transport === 'both';
     const wantHttp = transportIncludesHttp(httpCfg.transport);
+    // BR-4: the SERVER never boots with an empty registry — stdio always, HTTP
+    // when single-owner. The bootstrap and diagnostic CLIs above already
+    // returned. A multi-tenant boot instead refuses the two process-wide env
+    // vectors that would leak one operator's accounts/scopes into every tenant.
+    const mt = isMultiTenantBoot();
+    if (accountsAssertRequired(wantStdio, mt))
+        assertServerAccountsConfigured();
+    if (mt) {
+        assertNoEnvAccountsMode();
+        assertNoEnvOptionalScopesMode();
+    }
+    // Resolve (or provision) the master key BEFORE serving: the hard guard is
+    // specced "fatal at startup", never mid-dispatch.
+    const { resolveMasterKey } = await import('./master-key.js');
+    resolveMasterKey();
     // Local usage metrics: fail-closed resolve, self-announcing source, null
     // when off (no wrapper, no dir, nothing initializes). One instance per
     // transport so `boots` keys stay honest under `both`.
@@ -282,12 +292,21 @@ async function main() {
     }
     if (wantHttp) {
         const { HttpTransportHost, parseOwnerEmails } = await import('./http-transport.js');
-        // BR3 / C13: the owner allowlist is the entire multi-tenant collapse; refuse
-        // to open an ungated HTTP endpoint.
         const owners = parseOwnerEmails(process.env);
-        if (owners.length === 0) {
-            process.stderr.write('E_OWNER_EMAILS_REQUIRED: MCP_TRANSPORT includes http but MCP_OWNER_EMAILS is empty. Set MCP_OWNER_EMAILS to the Google email(s) allowed to authenticate.\n');
-            process.exit(1);
+        const gates = mtBootGates();
+        if (gates?.multiTenant) {
+            // Same fail-fast SHAPE, different condition: an ungated HTTP endpoint
+            // must never boot; under tenancy the gate is "a valid provisioning
+            // mechanism exists", not a flat owner allowlist.
+            gates.assertProvisioningGate();
+        }
+        else {
+            // BR3 / C13: the owner allowlist is the entire multi-tenant collapse;
+            // refuse to open an ungated HTTP endpoint.
+            if (owners.length === 0) {
+                process.stderr.write('E_OWNER_EMAILS_REQUIRED: MCP_TRANSPORT includes http but MCP_OWNER_EMAILS is empty. Set MCP_OWNER_EMAILS to the Google email(s) allowed to authenticate.\n');
+                process.exit(1);
+            }
         }
         // BR7: stateless HTTP cannot push tools/list_changed, so it forces curated.
         const configuredMode = (process.env.GOOGLE_DISCOVERY ?? '').trim().toLowerCase();

package/dist/token-store.d.ts

@@ -7,3 +7,20 @@ export declare function readToken(alias: string): TokenData | null;
 export declare function writeToken(alias: string, data: object): void;
 export declare function updateToken(alias: string, updates: object): void;
 export declare function hasToken(alias: string): boolean;
+export interface TokenStore {
+    readToken(alias: string): TokenData | null;
+    writeToken(alias: string, data: object): void;
+    updateToken(alias: string, updates: object): void;
+    hasToken(alias: string): boolean;
+}
+/**
+ * Context-scoped token store: `.enc` files live under `dir`, ciphertext keyed
+ * by `tenantId` when present (HKDF v2 envelope; omitted = the single-owner v1
+ * envelope). Same lock + atomic-write + error contract as the module-level
+ * functions: readToken returns null ONLY when the file is missing and throws
+ * on a decrypt failure.
+ */
+export declare function createTokenStore(dir: string, opts?: {
+    tenantId?: string;
+    resolveKey?: () => string;
+}): TokenStore;

package/dist/usage-metrics.js

@@ -44,7 +44,7 @@ export const KNOWN_ERROR_SLUGS = new Set([
     'insufficient_scope', 'internal', 'invalid_client', 'invalid_client_metadata',
     'invalid_grant', 'invalid_params', 'invalid_query', 'invalid_request',
     'invalid_scope', 'network_error', 'not_found', 'rate_limited',
-    'reauth_required', 'recipient_not_allowed', 'too_large', 'toolset_disabled', 'unknown_api',
+    'reauth_required', 'recipient_not_allowed', 'tenant_not_found', 'too_large', 'toolset_disabled', 'unknown_api',
     'unknown_argument', 'unknown_method', 'unsupported_grant_type', 'unsupported_type',
     'untrusted_host', 'upstream_error', 'validation_error', 'write_disabled',
 ]);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "mcp-google-multi",
-  "version": "6.0.0-alpha.40",
+  "version": "6.0.0-alpha.42",
   "mcpName": "io.github.bakissation/mcp-google-multi",
   "description": "Local MCP server for Google Workspace (Gmail, Drive, Calendar, Sheets, Docs, Contacts, Tasks, Meet, Search Console, +Forms/Chat/Admin) across multiple accounts — OAuth-only, encrypted token storage, deny-by-default writes.",
   "type": "module",