mcp-google-multi 6.0.0-alpha.41 → 6.0.0-alpha.42

package/dist/client.d.ts

@@ -1,3 +1,24 @@
 import { OAuth2Client } from 'googleapis-common';
-import type { Account } from './accounts.js';
-export declare function getClient(account: Account): Promise<OAuth2Client>;
+import type { Account, AccountSet } from './accounts.js';
+import type { TokenData } from './types.js';
+export interface GetClientDeps {
+    /** Live account view — read at call time, never a captured snapshot. */
+    accounts: () => AccountSet;
+    readToken: (alias: string) => TokenData | null;
+    updateToken: (alias: string, updates: object) => void;
+    /** Cross-process staleness probe (single-owner global registry only). */
+    refreshIfStale?: () => void;
+}
+/** Test-only visibility into the dedupe map. */
+export declare function __inflightSizeForTest(): number;
+/**
+ * Per-context client factory: `contextKey` namespaces the single-flight map
+ * (one lane per tenant), `deps` carry that context's account view and token
+ * custody. The free core builds exactly one, bound to the global registry.
+ */
+export declare function makeGetClient(contextKey: string, deps: GetClientDeps): (account: Account) => Promise<OAuth2Client>;
+/** The single-owner client, bound to the global registry + token store. The
+ * operator surfaces that never carry a tenant (api-probe, executor and
+ * escape-hatch `deps.getClientFn ?? getClient` defaults, stdio dispatch)
+ * resolve through this. */
+export declare const getClient: (account: Account) => Promise<OAuth2Client>;

package/dist/identity.js

@@ -1,8 +1,12 @@
-import { getAccountSet } from './accounts.js';
-import { getClient } from './client.js';
-import { hasToken, readToken, updateToken, writeToken } from './token-store.js';
+import { getAccountSet, getTokenDir, refreshAccountSetIfStale } from './accounts.js';
+import { makeGetClient } from './client.js';
+import { createTokenStore } from './token-store.js';
 import { resolvePolicy } from './write-control.js';
 export function buildIdentityContext(env = process.env, opts = {}) {
+    // Real closures over the single-owner state (the SAME factories EE
+    // instantiates per tenant), bound here to the global registry + token dir —
+    // behavior-identical to the module-level functions for the free core.
+    const tokenStore = createTokenStore(getTokenDir());
     return {
         subject: 'owner',
         // Live getter: the seam must always see the current registry, never a
@@ -13,7 +17,12 @@ export function buildIdentityContext(env = process.env, opts = {}) {
         // The dispatch transport rides into the resolved policy as a reserved seam
         // (cc-write-control B14); it does not change any write-control verdict.
         policy: resolvePolicy(env, { transport: opts.transport }),
-        getClient,
-        tokenStore: { readToken, writeToken, updateToken, hasToken },
+        getClient: makeGetClient('owner', {
+            accounts: getAccountSet,
+            readToken: tokenStore.readToken,
+            updateToken: tokenStore.updateToken,
+            refreshIfStale: refreshAccountSetIfStale,
+        }),
+        tokenStore,
     };
 }

package/dist/token-store.d.ts

@@ -7,3 +7,20 @@ export declare function readToken(alias: string): TokenData | null;
 export declare function writeToken(alias: string, data: object): void;
 export declare function updateToken(alias: string, updates: object): void;
 export declare function hasToken(alias: string): boolean;
+export interface TokenStore {
+    readToken(alias: string): TokenData | null;
+    writeToken(alias: string, data: object): void;
+    updateToken(alias: string, updates: object): void;
+    hasToken(alias: string): boolean;
+}
+/**
+ * Context-scoped token store: `.enc` files live under `dir`, ciphertext keyed
+ * by `tenantId` when present (HKDF v2 envelope; omitted = the single-owner v1
+ * envelope). Same lock + atomic-write + error contract as the module-level
+ * functions: readToken returns null ONLY when the file is missing and throws
+ * on a decrypt failure.
+ */
+export declare function createTokenStore(dir: string, opts?: {
+    tenantId?: string;
+    resolveKey?: () => string;
+}): TokenStore;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "mcp-google-multi",
-  "version": "6.0.0-alpha.41",
+  "version": "6.0.0-alpha.42",
   "mcpName": "io.github.bakissation/mcp-google-multi",
   "description": "Local MCP server for Google Workspace (Gmail, Drive, Calendar, Sheets, Docs, Contacts, Tasks, Meet, Search Console, +Forms/Chat/Admin) across multiple accounts — OAuth-only, encrypted token storage, deny-by-default writes.",
   "type": "module",