mcp-google-multi 6.0.0-alpha.42 → 6.0.0-alpha.44

package/dist/auth.d.ts

@@ -1,14 +1,15 @@
+import type { AccountSet } from './accounts.js';
 import { ADMIN_SCOPES } from './scope-catalog.js';
 export declare const BASE_SCOPES: string[];
 export declare const OPTIONAL_SCOPE_BUNDLES: Record<string, string[]>;
 export { ADMIN_SCOPES };
 /** Union of every account's resolved bundles: a service registers if ANY
  * account can authorize it; per-account authz happens at call time (BR2). */
-export declare function getOptionalBundles(): string[];
+export declare function getOptionalBundles(set?: AccountSet): string[];
 /** Aliases granted ADMIN_SCOPES: per-account admin flag (env
  * GOOGLE_ADMIN_ACCOUNTS overrides config.json at resolve) OR the account's
  * scope profile carrying admin (boolean or "admin" bundle) — equivalent forms. */
-export declare function getAdminAccounts(): string[];
+export declare function getAdminAccounts(set?: AccountSet): string[];
 /** Scopes are fixed at consent time: changing an account's profile (or the
  * legacy env) changes its consent set and requires re-running auth. Evaluated
  * per account: `work` can carry admin + gmail_settings while `personal` is

package/dist/auth.js

@@ -55,11 +55,10 @@ function legacyGlobalProfile() {
     }
     return { bundles };
 }
-function profileForAccount(alias) {
+function profileForAccount(alias, set = getAccountSet()) {
     const legacy = legacyGlobalProfile();
     if (legacy)
         return legacy;
-    const set = getAccountSet();
     const name = set.configs[alias]?.scopeProfile ?? 'base';
     // hasOwn: a profile named like an Object.prototype member must never
     // resolve to the inherited function.
@@ -67,14 +66,13 @@ function profileForAccount(alias) {
 }
 /** Union of every account's resolved bundles: a service registers if ANY
  * account can authorize it; per-account authz happens at call time (BR2). */
-export function getOptionalBundles() {
+export function getOptionalBundles(set = getAccountSet()) {
     const legacy = legacyGlobalProfile();
     if (legacy)
         return legacy.bundles.filter(b => b !== 'admin');
     const union = new Set();
-    const set = getAccountSet();
     for (const alias of set.aliases) {
-        for (const b of profileForAccount(alias).bundles) {
+        for (const b of profileForAccount(alias, set).bundles) {
             if (b !== 'admin')
                 union.add(b);
         }
@@ -84,12 +82,12 @@ export function getOptionalBundles() {
 /** Aliases granted ADMIN_SCOPES: per-account admin flag (env
  * GOOGLE_ADMIN_ACCOUNTS overrides config.json at resolve) OR the account's
  * scope profile carrying admin (boolean or "admin" bundle) — equivalent forms. */
-export function getAdminAccounts() {
-    const { aliases, configs } = getAccountSet();
+export function getAdminAccounts(set = getAccountSet()) {
+    const { aliases, configs } = set;
     return aliases.filter((a) => {
         if (configs[a].admin === true)
             return true;
-        const p = profileForAccount(a);
+        const p = profileForAccount(a, set);
         return p.admin === true || p.bundles.includes('admin');
     });
 }

package/dist/doctor.d.ts

@@ -58,7 +58,9 @@ export declare function apiEnableLink(api: string): string;
 export declare function usageMetricsStatusLine(env: Record<string, string | undefined>): string;
 /** Roll section verdicts to an overall verdict. `unknown` never worsens it. */
 export declare function overallVerdict(sections: DiagnosticSection[]): Verdict;
-export declare function runDiagnostics(deps?: DiagnosticsDeps): Promise<DiagnosticsReport>;
+export declare function runDiagnostics(deps?: DiagnosticsDeps, opts?: {
+    scope?: 'operator' | 'tenant';
+}): Promise<DiagnosticsReport>;
 /** doctor CLI (brew-doctor style): glyph-coded human report. */
 export declare function renderDoctorText(report: DiagnosticsReport): string;
 /** Redacted, paste-ready bug report (BR8): verdicts + provenance labels + token
@@ -73,7 +75,9 @@ export declare function exitCodeFor(report: DiagnosticsReport, strict: boolean):
  * from already-registered services, and this runs after that), so it was
  * advertised only once something else expanded the surface. The README sends
  * people here when they are stuck, so it has to be findable. */
-export declare function registerDiagnoseTool(registry: ToolRegistry): void;
+export declare function registerDiagnoseTool(registry: ToolRegistry, ctx?: {
+    subject: string;
+}): void;
 export interface ResetOptions {
     account?: string;
     regenerateKey: boolean;

package/dist/doctor.js

@@ -300,21 +300,28 @@ export function overallVerdict(sections) {
     }
     return worst;
 }
-export async function runDiagnostics(deps = DEFAULT_DEPS) {
+export async function runDiagnostics(deps = DEFAULT_DEPS, opts = {}) {
+    // Tenant scope omits the OPERATOR sections: §3 (key provenance = box
+    // infrastructure) and §7 (its owner-gate lines print MCP_OWNER_EMAILS
+    // values — other people's addresses from a tenant's seat).
+    const tenantScope = opts.scope === 'tenant';
     const sections = [];
     sections.push(sectionRuntime(deps));
     const set = deps.accountSet();
     sections.push(sectionConfig(deps, set));
     const aliases = set?.aliases ?? [];
-    sections.push(sectionKeys(deps, aliases));
+    if (!tenantScope)
+        sections.push(sectionKeys(deps, aliases));
     if (aliases.length > 0) {
         const [tokens, scopes] = sectionsTokensAndScopes(deps, aliases);
         sections.push(tokens, scopes);
         sections.push(await sectionApiEnablement(deps, aliases));
     }
-    const http = await sectionHttp(deps, aliases);
-    if (http)
-        sections.push(http);
+    if (!tenantScope) {
+        const http = await sectionHttp(deps, aliases);
+        if (http)
+            sections.push(http);
+    }
     return { verdict: overallVerdict(sections), sections };
 }
 // --- skins -----------------------------------------------------------------
@@ -364,14 +371,17 @@ export function exitCodeFor(report, strict) {
  * from already-registered services, and this runs after that), so it was
  * advertised only once something else expanded the surface. The README sends
  * people here when they are stuck, so it has to be findable. */
-export function registerDiagnoseTool(registry) {
+export function registerDiagnoseTool(registry, ctx) {
+    // A non-owner context gets the tenant-scoped report; the free core's single
+    // 'owner' context keeps today's full operator report.
+    const scope = ctx && ctx.subject !== 'owner' ? 'tenant' : 'operator';
     registry.registerMeta('diagnose', {
         annotations: { readOnlyHint: true, openWorldHint: true },
         description: 'Health report for this server: runtime, config, keys, per-account token status, scope grants, and API enablement. Read-only; returns copy-pasteable fixes for anything wrong. Call this to diagnose auth/config failures.',
         inputSchema: {},
     }, async () => {
         try {
-            const result = await runDiagnostics();
+            const result = await runDiagnostics(undefined, { scope });
             return { content: [{ type: 'text', text: JSON.stringify(result, null, 2) }] };
         }
         catch (e) {

package/dist/index.js

@@ -58,7 +58,7 @@ function buildRegistry(server, ctx, mode, metrics = null) {
     for (const svc of SERVICES) {
         if (!toolsetEnabled(toolsets, svc.name))
             continue;
-        if (svc.enabled && !svc.enabled()) {
+        if (svc.enabled && !svc.enabled(ctx.accounts)) {
             if (toolsets !== 'all') {
                 const hint = svc.name === 'admin' ? 'set admin on an account/profile (or GOOGLE_ADMIN_ACCOUNTS)' : `add "${svc.name}" to an account's scope profile (or legacy GOOGLE_OPTIONAL_SCOPES)`;
                 process.stderr.write(`GOOGLE_TOOLSETS: "${svc.name}" requested but not enabled — ${hint}\n`);
@@ -72,7 +72,7 @@ function buildRegistry(server, ctx, mode, metrics = null) {
             continue;
         const curated = SERVICES.find((s) => s.name === gen.name);
         const gate = curated?.enabled ?? GENERATED_GATES[gen.name]?.enabled;
-        if (gate && !gate()) {
+        if (gate && !gate(ctx.accounts)) {
             if (!curated && toolsets !== 'all') {
                 process.stderr.write(`GOOGLE_TOOLSETS: "${gen.name}" requested but not enabled — ${GENERATED_GATES[gen.name].hint}\n`);
             }
@@ -89,7 +89,7 @@ function buildRegistry(server, ctx, mode, metrics = null) {
     registerDiscoverTools(registry, policy);
     registerEscapeTools(registry, policy);
     registerAccountTools(registry);
-    registerDiagnoseTool(registry);
+    registerDiagnoseTool(registry, ctx);
     registerAccountWizardTools(registry, server);
     return registry;
 }

package/dist/mcp-token.d.ts

@@ -89,4 +89,9 @@ export declare class RefreshStore {
         token: string;
         sub: string;
     } | null;
+    /** Drop every ACTIVE record minted under `sub` (linear scan under the store
+     * lock). Spent entries carry no sub and stay: with their families gone, a
+     * reuse finds nothing to revoke — inert by construction. Returns the number
+     * of active tokens dropped. */
+    purgeTenant(sub: string): number;
 }

package/dist/mcp-token.js

@@ -175,4 +175,23 @@ export class RefreshStore {
             return { token: next, sub: rec.sub };
         });
     }
+    /** Drop every ACTIVE record minted under `sub` (linear scan under the store
+     * lock). Spent entries carry no sub and stay: with their families gone, a
+     * reuse finds nothing to revoke — inert by construction. Returns the number
+     * of active tokens dropped. */
+    purgeTenant(sub) {
+        return withFileLock(this.path, () => {
+            const data = this.load();
+            let dropped = 0;
+            for (const [t, r] of Object.entries(data.active)) {
+                if (r.sub === sub) {
+                    delete data.active[t];
+                    dropped += 1;
+                }
+            }
+            if (dropped > 0)
+                this.save(data);
+            return dropped;
+        });
+    }
 }

package/dist/registry-transfer.d.ts

@@ -1,3 +1,8 @@
+/** D11 (refuse-only for v1): export/import operate on the FLAT single-owner
+ * store. A tenant-namespaced layout means the bundle would either miss every
+ * tenant's tokens or exfiltrate all of them in one file — refuse instead.
+ * Returns the offending dir, or null when the store is flat. */
+export declare function refuseIfMultiTenant(dir?: string): string | null;
 export interface TransferBundle {
     manifest: {
         v: 1;

package/dist/registry-transfer.js

@@ -9,8 +9,22 @@ import * as readline from 'node:readline';
 import path from 'node:path';
 import { encryptToken, decryptToken } from './token-store.js';
 import { atomicWriteFileSync, atomicWriteWithLock } from './fs-atomic.js';
-import { ALIAS_RE, configFilePath, CONFIG_VERSION } from './config-file.js';
+import { ALIAS_RE, configFilePath, CONFIG_VERSION, tenantsDir } from './config-file.js';
 import { getTokenDir } from './accounts.js';
+/** D11 (refuse-only for v1): export/import operate on the FLAT single-owner
+ * store. A tenant-namespaced layout means the bundle would either miss every
+ * tenant's tokens or exfiltrate all of them in one file — refuse instead.
+ * Returns the offending dir, or null when the store is flat. */
+export function refuseIfMultiTenant(dir = tenantsDir()) {
+    try {
+        if (readdirSync(dir).length > 0)
+            return dir;
+    }
+    catch {
+        // absent or unreadable tenants/ = flat store
+    }
+    return null;
+}
 function resolveDeps(deps) {
     return {
         configPath: deps.configPath ?? configFilePath(),
@@ -152,6 +166,11 @@ async function resolvePassphrase(prompt) {
     }
 }
 export async function runExportCli(argv) {
+    const mtDir = refuseIfMultiTenant();
+    if (mtDir) {
+        console.error(`E_MULTI_TENANT_EXPORT_REFUSED: tenant-namespaced token stores exist under ${mtDir}; account export only operates on a flat single-owner store.`);
+        return 2;
+    }
     const out = argFlag(argv, '--out');
     if (!out) {
         console.error('Usage: mcp-google-multi account export --out <bundle.enc>');
@@ -169,6 +188,11 @@ export async function runExportCli(argv) {
     return 0;
 }
 export async function runImportCli(argv) {
+    const mtDir = refuseIfMultiTenant();
+    if (mtDir) {
+        console.error(`E_MULTI_TENANT_EXPORT_REFUSED: tenant-namespaced token stores exist under ${mtDir}; account import only operates on a flat single-owner store.`);
+        return 2;
+    }
     const file = argv[argv.indexOf('import') + 1];
     if (!file || file.startsWith('--')) {
         console.error('Usage: mcp-google-multi account import <bundle.enc> [--replace]');

package/dist/services.d.ts

@@ -1,12 +1,16 @@
+import type { AccountSet } from './accounts.js';
 import type { ToolRegistry } from './registry.js';
 export interface ServiceEntry {
     name: string;
     register: (registry: ToolRegistry) => void;
-    enabled?: () => boolean;
+    /** Absent = always on. Gates evaluate against the PASSED account set (the
+     * calling tenant's view); omitted set = the global registry, today's
+     * behavior. */
+    enabled?: (set?: AccountSet) => boolean;
 }
 export declare const SERVICES: ServiceEntry[];
 export declare const GENERATED_GATES: Record<string, {
-    enabled: () => boolean;
+    enabled: (set?: AccountSet) => boolean;
     hint: string;
 }>;
 /**

package/dist/services.js

@@ -25,16 +25,16 @@ export const SERVICES = [
     { name: 'searchconsole', register: registerSearchConsoleTools },
     { name: 'tasks', register: registerTasksTools },
     { name: 'meet', register: registerMeetTools },
-    { name: 'slides', register: registerSlidesTools, enabled: () => new Set(getOptionalBundles()).has('slides') },
-    { name: 'forms', register: registerFormsTools, enabled: () => new Set(getOptionalBundles()).has('forms') },
-    { name: 'chat', register: registerChatTools, enabled: () => new Set(getOptionalBundles()).has('chat') },
-    { name: 'analytics', register: registerAnalyticsTools, enabled: () => { const b = new Set(getOptionalBundles()); return b.has('analytics') || b.has('analytics_write'); } },
-    { name: 'admin', register: registerAdminTools, enabled: () => getAdminAccounts().length > 0 },
+    { name: 'slides', register: registerSlidesTools, enabled: (set) => new Set(getOptionalBundles(set)).has('slides') },
+    { name: 'forms', register: registerFormsTools, enabled: (set) => new Set(getOptionalBundles(set)).has('forms') },
+    { name: 'chat', register: registerChatTools, enabled: (set) => new Set(getOptionalBundles(set)).has('chat') },
+    { name: 'analytics', register: registerAnalyticsTools, enabled: (set) => { const b = new Set(getOptionalBundles(set)); return b.has('analytics') || b.has('analytics_write'); } },
+    { name: 'admin', register: registerAdminTools, enabled: (set) => getAdminAccounts(set).length > 0 },
 ];
 // Generated-only services with opt-in scopes; admin/forms/chat/analytics reuse their curated gate in buildRegistry,
 // and workspaceevents is deliberately absent — no dedicated scope (subscriptions use resource scopes).
 const bundleGate = (name) => ({
-    enabled: () => new Set(getOptionalBundles()).has(name),
+    enabled: (set) => new Set(getOptionalBundles(set)).has(name),
     hint: `add "${name}" to an account's scope profile (or legacy GOOGLE_OPTIONAL_SCOPES)`,
 });
 export const GENERATED_GATES = {

package/dist/tenant-purge.d.ts

@@ -0,0 +1,26 @@
+import type { TokenData } from './types.js';
+/** Best-effort Google-side revocation (RFC 7009 endpoint). Returns whether
+ * Google acknowledged; NEVER throws — a network failure must not block the
+ * local purge (the local copy is the thing we control). */
+export declare function revokeGoogleToken(tokenData: {
+    refresh_token?: string;
+    access_token?: string;
+}, fetchFn?: typeof fetch): Promise<boolean>;
+export interface TenantTokenPurge {
+    /** Aliases whose .enc files were removed. */
+    removed: string[];
+    /** How many tokens Google acknowledged revoking (best-effort). */
+    revoked: number;
+}
+/** Remove every `.enc` under the tenant's token dir, optionally revoking each
+ * at Google first. Decrypt failures still purge the file — an unreadable
+ * token is exactly the thing to delete. Only THIS tenant's dir is touched. */
+export declare function purgeTenantTokens(tenantId: string, opts?: {
+    env?: NodeJS.ProcessEnv;
+    revoke?: (t: TokenData) => Promise<boolean>;
+    resolveKey?: () => string;
+}): Promise<TenantTokenPurge>;
+/** Remove the whole tenants/<id> directory (config + tokens). The id is
+ * validated by the path helper, so a traversal-shaped id throws before any
+ * filesystem access. */
+export declare function removeTenantDir(tenantId: string, env?: NodeJS.ProcessEnv): void;

package/dist/tenant-purge.js

@@ -0,0 +1,67 @@
+// S1.21: tenant offboarding primitives. Core owns the reusable token-purge
+// legs (generically useful, tenant-id-agnostic); the tenant_delete
+// ORCHESTRATION (what to purge, in what order, from which admin surface)
+// lives with the tenancy module that calls these.
+import fs from 'node:fs';
+import path from 'node:path';
+import { tenantConfigFilePath, tenantTokenDir } from './config-file.js';
+import { createTokenStore } from './token-store.js';
+/** Best-effort Google-side revocation (RFC 7009 endpoint). Returns whether
+ * Google acknowledged; NEVER throws — a network failure must not block the
+ * local purge (the local copy is the thing we control). */
+export async function revokeGoogleToken(tokenData, fetchFn = fetch) {
+    const token = tokenData.refresh_token ?? tokenData.access_token;
+    if (!token)
+        return false;
+    try {
+        const res = await fetchFn('https://oauth2.googleapis.com/revoke', {
+            method: 'POST',
+            headers: { 'Content-Type': 'application/x-www-form-urlencoded' },
+            body: new URLSearchParams({ token }).toString(),
+        });
+        return res.ok;
+    }
+    catch {
+        return false;
+    }
+}
+/** Remove every `.enc` under the tenant's token dir, optionally revoking each
+ * at Google first. Decrypt failures still purge the file — an unreadable
+ * token is exactly the thing to delete. Only THIS tenant's dir is touched. */
+export async function purgeTenantTokens(tenantId, opts = {}) {
+    const dir = tenantTokenDir(tenantId, opts.env);
+    const store = createTokenStore(dir, { tenantId, resolveKey: opts.resolveKey });
+    const removed = [];
+    let revoked = 0;
+    let names;
+    try {
+        names = fs.readdirSync(dir);
+    }
+    catch {
+        return { removed, revoked }; // no token dir = nothing to purge
+    }
+    for (const name of names) {
+        if (!name.endsWith('.enc'))
+            continue;
+        const alias = name.slice(0, -'.enc'.length);
+        if (opts.revoke) {
+            try {
+                const token = store.readToken(alias);
+                if (token && (await opts.revoke(token)))
+                    revoked += 1;
+            }
+            catch {
+                // undecryptable or invalid-alias filename: still remove the file
+            }
+        }
+        fs.rmSync(path.join(dir, name), { force: true });
+        removed.push(alias);
+    }
+    return { removed, revoked };
+}
+/** Remove the whole tenants/<id> directory (config + tokens). The id is
+ * validated by the path helper, so a traversal-shaped id throws before any
+ * filesystem access. */
+export function removeTenantDir(tenantId, env) {
+    fs.rmSync(path.dirname(tenantConfigFilePath(tenantId, env)), { recursive: true, force: true });
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "mcp-google-multi",
-  "version": "6.0.0-alpha.42",
+  "version": "6.0.0-alpha.44",
   "mcpName": "io.github.bakissation/mcp-google-multi",
   "description": "Local MCP server for Google Workspace (Gmail, Drive, Calendar, Sheets, Docs, Contacts, Tasks, Meet, Search Console, +Forms/Chat/Admin) across multiple accounts — OAuth-only, encrypted token storage, deny-by-default writes.",
   "type": "module",