mcp-google-multi 6.0.0-alpha.65 → 6.0.0-alpha.66

package/dist/cimd-cache.js

@@ -100,7 +100,7 @@ export class CimdClientCache {
     // Over-cap requests arrive at whatever rate the caller likes.
     noteBusy() {
         const now = this.deps.now();
-        if (now - this.busyLoggedAt < BUSY_LOG_EVERY_MS) {
+        if (now >= this.busyLoggedAt && now - this.busyLoggedAt < BUSY_LOG_EVERY_MS) {
             this.busySuppressed++;
             return;
         }

package/dist/mcp-token.d.ts

@@ -1,7 +1,7 @@
 export declare const ACCESS_TTL_DEFAULT = 600;
 export declare const STATE_TTL_DEFAULT = 600;
 export declare const CODE_TTL_DEFAULT = 60;
-export declare const REPLAY_CAP_DEFAULT = 10000;
+export declare const REPLAY_CAP_DEFAULT = 100000;
 /** Derive the HS256 secret (32 bytes) from the provisioned MCP_JWT_KEY string. */
 export declare function jwtSecretFrom(jwtKey: string): Uint8Array;
 export interface AccessTokenParams {
@@ -46,8 +46,9 @@ export interface CodePayload {
     sub: string;
 }
 export declare function signState(payload: StatePayload, base: string, secret: Uint8Array, iat: number, ttlSec?: number): Promise<string>;
-export declare function verifyState(token: string, base: string, secret: Uint8Array): Promise<StatePayload & {
+export declare function verifyState(token: string, base: string, secret: Uint8Array, nowSec?: number): Promise<StatePayload & {
     jti: string;
+    exp: number;
 }>;
 /** A re-auth link is handed out in a tool error, so it has to survive until
  * the user clicks it; an hour, not the 10-minute state TTL. */
@@ -64,21 +65,41 @@ export declare function verifyReauthLink(base: string, secret: Uint8Array, param
 /** A pending-authorization artifact for the DCR consent interstitial (same
  * shape as `state`, distinct purpose so the two can't be confused). */
 export declare function signPending(payload: StatePayload, base: string, secret: Uint8Array, iat: number, ttlSec?: number): Promise<string>;
-export declare function verifyPending(token: string, base: string, secret: Uint8Array): Promise<StatePayload & {
+export declare function verifyPending(token: string, base: string, secret: Uint8Array, nowSec?: number): Promise<StatePayload & {
     jti: string;
+    exp: number;
 }>;
 export declare function signAuthzCode(payload: CodePayload, base: string, secret: Uint8Array, iat: number, ttlSec?: number): Promise<string>;
-export declare function verifyAuthzCode(token: string, base: string, secret: Uint8Array): Promise<CodePayload & {
+export declare function verifyAuthzCode(token: string, base: string, secret: Uint8Array, nowSec?: number): Promise<CodePayload & {
     jti: string;
+    exp: number;
 }>;
+/** `full`: there is no room without forgetting a jti that is still live. */
+export type ReplaySpend = 'ok' | 'replay' | 'full';
 export declare class ReplayGuard {
     private readonly cap;
     private readonly seen;
+    private earliest;
+    private sweptAt;
     constructor(cap?: number);
-    /** Record a jti as spent. Returns false if it was already spent (replay). */
+    /** Hold a slot for an artifact about to be handed out, so its spend can
+     * never meet a full guard. The flood then lands where the artifact is
+     * minted, and refusing there loses nothing. */
+    reserve(jti: string, ttlMs: number, nowMs: number): 'ok' | 'full';
+    /** Record a jti as spent. A full guard refuses instead of evicting a live
+     * jti: a flood of spends would otherwise make a spent artifact usable again,
+     * such as a callback the browser binding refused (H4 F1). `artifactExpMs`
+     * keeps the record alive as long as the artifact itself, even when the clock
+     * stepped back between its signing and this spend. */
+    spend(jti: string, ttlMs: number, nowMs: number, artifactExpMs?: number): ReplaySpend;
+    /** Undo a spend whose next step could not go ahead. The slot stays held, so
+     * nothing is forgotten, and the artifact can be spent once more. */
+    unspend(jti: string): void;
+    /** `spend` as a boolean: false for a replay and for a full guard alike. */
     consume(jti: string, ttlMs: number, nowMs: number): boolean;
     get size(): number;
-    private evictExpired;
+    private record;
+    private room;
 }
 /** An earlier release's record, keyed by its live token. */
 export interface RefreshRecord {

package/dist/mcp-token.js

@@ -12,7 +12,7 @@ import { atomicWriteFileSync, withFileLock } from './fs-atomic.js';
 export const ACCESS_TTL_DEFAULT = 600; // seconds
 export const STATE_TTL_DEFAULT = 600;
 export const CODE_TTL_DEFAULT = 60;
-export const REPLAY_CAP_DEFAULT = 10_000;
+export const REPLAY_CAP_DEFAULT = 100_000;
 /** Derive the HS256 secret (32 bytes) from the provisioned MCP_JWT_KEY string. */
 export function jwtSecretFrom(jwtKey) {
     return new Uint8Array(deriveKey(jwtKey));
@@ -52,17 +52,19 @@ async function signArtifact(claims, purpose, base, secret, iat, ttlSec) {
         .setJti(newJti())
         .sign(secret);
 }
-async function verifyArtifact(token, purpose, base, secret) {
-    const { payload } = await jwtVerify(token, secret, { issuer: base });
+// `nowSec`: the caller's clock, so expiry is judged by the same clock as the
+// replay guard that records the artifact's spend.
+async function verifyArtifact(token, purpose, base, secret, nowSec) {
+    const { payload } = await jwtVerify(token, secret, { issuer: base, ...(nowSec !== undefined ? { currentDate: new Date(nowSec * 1000) } : {}) });
     if (payload.purpose !== purpose)
         throw new Error(`wrong artifact purpose (${String(payload.purpose)})`);
-    return { ...payload, jti: String(payload.jti ?? '') };
+    return { ...payload, jti: String(payload.jti ?? ''), exp: Number(payload.exp ?? 0) };
 }
 export function signState(payload, base, secret, iat, ttlSec = STATE_TTL_DEFAULT) {
     return signArtifact(payload, 'mcp_state', base, secret, iat, ttlSec);
 }
-export async function verifyState(token, base, secret) {
-    return (await verifyArtifact(token, 'mcp_state', base, secret));
+export async function verifyState(token, base, secret, nowSec) {
+    return (await verifyArtifact(token, 'mcp_state', base, secret, nowSec));
 }
 // --- alias_reauth link -------------------------------------------------------
 /** A re-auth link is handed out in a tool error, so it has to survive until
@@ -93,44 +95,97 @@ export function verifyReauthLink(base, secret, params, nowSec) {
 export function signPending(payload, base, secret, iat, ttlSec = STATE_TTL_DEFAULT) {
     return signArtifact(payload, 'mcp_pending', base, secret, iat, ttlSec);
 }
-export async function verifyPending(token, base, secret) {
-    return (await verifyArtifact(token, 'mcp_pending', base, secret));
+export async function verifyPending(token, base, secret, nowSec) {
+    return (await verifyArtifact(token, 'mcp_pending', base, secret, nowSec));
 }
 export function signAuthzCode(payload, base, secret, iat, ttlSec = CODE_TTL_DEFAULT) {
     return signArtifact(payload, 'mcp_code', base, secret, iat, ttlSec);
 }
-export async function verifyAuthzCode(token, base, secret) {
-    return (await verifyArtifact(token, 'mcp_code', base, secret));
+export async function verifyAuthzCode(token, base, secret, nowSec) {
+    return (await verifyArtifact(token, 'mcp_code', base, secret, nowSec));
 }
-// --- Replay guard (C10/C17: single-use, capped, TTL-evicted) ----------------
+/** A full guard refuses rather than sweeping again sooner than this. */
+const FULL_SWEEP_EVERY_MS = 1000;
 export class ReplayGuard {
     cap;
-    seen = new Map(); // jti -> expiry (ms)
+    seen = new Map();
+    // A lower bound on every entry's expiry: below it nothing can have expired.
+    earliest = Infinity;
+    sweptAt = -Infinity;
     constructor(cap = REPLAY_CAP_DEFAULT) {
         this.cap = cap;
     }
-    /** Record a jti as spent. Returns false if it was already spent (replay). */
-    consume(jti, ttlMs, nowMs) {
-        this.evictExpired(nowMs);
-        if (this.seen.has(jti))
-            return false;
-        if (this.seen.size >= this.cap) {
-            // drop the oldest-inserted entry to bound memory (C17)
-            const oldest = this.seen.keys().next().value;
-            if (oldest !== undefined)
-                this.seen.delete(oldest);
+    /** Hold a slot for an artifact about to be handed out, so its spend can
+     * never meet a full guard. The flood then lands where the artifact is
+     * minted, and refusing there loses nothing. */
+    reserve(jti, ttlMs, nowMs) {
+        if (!this.room(nowMs))
+            return 'full';
+        this.record(jti, nowMs + ttlMs, false);
+        return 'ok';
+    }
+    /** Record a jti as spent. A full guard refuses instead of evicting a live
+     * jti: a flood of spends would otherwise make a spent artifact usable again,
+     * such as a callback the browser binding refused (H4 F1). `artifactExpMs`
+     * keeps the record alive as long as the artifact itself, even when the clock
+     * stepped back between its signing and this spend. */
+    spend(jti, ttlMs, nowMs, artifactExpMs = 0) {
+        const exp = Math.max(nowMs + ttlMs, artifactExpMs);
+        const held = this.seen.get(jti);
+        if (held && held.exp > nowMs) {
+            if (held.spent)
+                return 'replay';
+            held.spent = true;
+            held.exp = Math.max(held.exp, exp);
+            return 'ok';
         }
-        this.seen.set(jti, nowMs + ttlMs);
-        return true;
+        if (held)
+            this.seen.delete(jti);
+        if (!this.room(nowMs))
+            return 'full';
+        this.record(jti, exp, true);
+        return 'ok';
+    }
+    /** Undo a spend whose next step could not go ahead. The slot stays held, so
+     * nothing is forgotten, and the artifact can be spent once more. */
+    unspend(jti) {
+        const held = this.seen.get(jti);
+        if (held)
+            held.spent = false;
+    }
+    /** `spend` as a boolean: false for a replay and for a full guard alike. */
+    consume(jti, ttlMs, nowMs) {
+        return this.spend(jti, ttlMs, nowMs) === 'ok';
     }
     get size() {
         return this.seen.size;
     }
-    evictExpired(nowMs) {
-        for (const [jti, exp] of this.seen) {
-            if (exp <= nowMs)
+    record(jti, exp, spent) {
+        this.seen.set(jti, { exp, spent });
+        if (exp < this.earliest)
+            this.earliest = exp;
+    }
+    // Expired entries are dropped only here, when the map is at the cap: a refusal
+    // costs O(1), and a sweep runs only once something can have expired, at most
+    // once a second. Walking the map from its head on every call is not cheap: a
+    // Map iterator steps over every deleted slot until the table is rebuilt.
+    room(nowMs) {
+        if (this.seen.size < this.cap)
+            return true;
+        if (nowMs < this.earliest)
+            return false;
+        if (nowMs >= this.sweptAt && nowMs - this.sweptAt < FULL_SWEEP_EVERY_MS)
+            return false;
+        this.sweptAt = nowMs;
+        let earliest = Infinity;
+        for (const [jti, e] of this.seen) {
+            if (e.exp <= nowMs)
                 this.seen.delete(jti);
+            else if (e.exp < earliest)
+                earliest = e.exp;
         }
+        this.earliest = earliest;
+        return this.seen.size < this.cap;
     }
 }
 /** Store files this release writes; an absent `format` is an earlier release's. */

package/dist/oauth-as.d.ts

@@ -122,7 +122,9 @@ export interface AuthServer {
     /** Mint a signed, single-use, TTL-bound clientless flow URL
      * (`${base}/authorize?flow=...&state=<signed>`). The tenantId/bundles ride
      * INSIDE the signed state, so nothing at /authorize or /callback trusts a
-     * caller-supplied identity. Inert unless something calls it. */
+     * caller-supplied identity. The URL works only on this AuthServer, and only
+     * until its process restarts: sign-in artifacts are signed with a key each
+     * buildAuthServer call generates. Inert unless something calls it. */
     mintFlowState: (opts: {
         flow: 'alias_add';
         alias: string;

package/dist/oauth-as.js

@@ -7,6 +7,7 @@
 // whole surface is exercised by an offline harness.
 import { createHash, randomBytes, timingSafeEqual } from 'node:crypto';
 import { isIPv4 } from 'node:net';
+import { decodeJwt } from 'jose';
 import { signAccessToken, verifyAccessToken, signState, verifyState, signAuthzCode, verifyAuthzCode, signReauthLink, verifyReauthLink, signPending, verifyPending, ReplayGuard, RefreshStore, STATE_TTL_DEFAULT, CODE_TTL_DEFAULT, ACCESS_TTL_DEFAULT, } from './mcp-token.js';
 import { fetchCimdDocument } from './ssrf-guard.js';
 import { CimdClientCache } from './cimd-cache.js';
@@ -53,8 +54,8 @@ function json(res, status, body, extraHeaders = {}) {
     res.end(JSON.stringify(body));
     return true;
 }
-function errorPage(res, status, slug, message) {
-    res.writeHead(status, { 'Content-Type': 'text/plain' });
+function errorPage(res, status, slug, message, extraHeaders = {}) {
+    res.writeHead(status, { 'Content-Type': 'text/plain', ...extraHeaders });
     res.end(`${slug}: ${message}`);
     return true;
 }
@@ -67,6 +68,10 @@ function subjectUnavailable(res) {
 function clientUnavailable(res) {
     return json(res, 503, { error: 'temporarily_unavailable', message: 'the client could not be checked right now; retry shortly' }, { 'Retry-After': '5' });
 }
+// The replay guard is full: every slot holds a jti that is still live.
+function signInBusy(res) {
+    return errorPage(res, 503, 'E_SIGNIN_BUSY', 'sign-in is busy right now; retry in a minute', { 'Retry-After': '60' });
+}
 function redirect(res, location, extraHeaders = {}) {
     res.writeHead(302, { Location: location, ...extraHeaders });
     res.end();
@@ -183,6 +188,11 @@ export function buildAuthServer(config, deps = {}) {
     const base = config.base;
     const resource = config.resourceUri;
     const secret = config.secret;
+    // States, approvals and codes live minutes, and their single use rests on an
+    // in-memory replay guard that a restart empties. So they are signed with a
+    // key only this AuthServer holds: a restart invalidates every one in flight,
+    // instead of letting a spent or unreserved one pass the new, empty guard.
+    const flowSecret = new Uint8Array(randomBytes(32));
     const accessTtl = config.accessTtlSec ?? ACCESS_TTL_DEFAULT;
     const cimd = deps.fetchCimd ?? ((clientId) => fetchCimdDocument(clientId));
     const replay = deps.replayGuard ?? new ReplayGuard();
@@ -195,6 +205,26 @@ export function buildAuthServer(config, deps = {}) {
     }
     const refresh = deps.refreshStore ?? new RefreshStore(config.refreshStorePath, config.masterKey, { maxAgeSec: config.refreshMaxAgeSec, idleSec: config.refreshIdleSec, log });
     const nowSec = () => Math.floor(now() / 1000);
+    // A full guard is refused at whatever rate the caller likes, so its line is
+    // written at most once a minute (or at once after the clock stepped back).
+    let fullLoggedAt = -Infinity;
+    let fullSuppressed = 0;
+    const noteFull = (at) => {
+        if (at >= fullLoggedAt && at - fullLoggedAt < 60_000) {
+            fullSuppressed++;
+            return;
+        }
+        log(`replay guard full: sign-in refused${fullSuppressed > 0 ? ` (n=${fullSuppressed} suppressed)` : ''}`);
+        fullLoggedAt = at;
+        fullSuppressed = 0;
+    };
+    const spend = (artifact, ttlSec) => {
+        const at = now();
+        const r = replay.spend(artifact.jti, ttlSec * 1000, at, artifact.exp * 1000);
+        if (r === 'full')
+            noteFull(at);
+        return r;
+    };
     const resolveSubject = deps.resolveSubject ?? ((email) => (config.ownerEmails.includes(email) ? { sub: 'owner' } : null));
     const issHeader = { 'Cache-Control': 'no-store' };
     const prm = {
@@ -261,7 +291,9 @@ export function buildAuthServer(config, deps = {}) {
     function escapeHtml(s) {
         return s.replace(/[&<>"']/g, (c) => ({ '&': '&amp;', '<': '&lt;', '>': '&gt;', '"': '&quot;', "'": '&#39;' })[c]);
     }
-    async function toGoogle(res, sp) {
+    /** `incoming`: the artifact spent to get here. If no slot is left for the
+     * new state it is unspent, so retrying it works once a slot frees. */
+    async function toGoogle(res, sp, incoming) {
         // H4 F1: without this, a Google URL minted here and forwarded to someone
         // else signs THEM in and hands their subject to the starting client.
         const headers = {};
@@ -271,7 +303,16 @@ export function buildAuthServer(config, deps = {}) {
             sp = { ...sp, bind };
             headers['Set-Cookie'] = `${bindCookieName(base, bind)}=${value}; ${bindCookieAttrs(base, STATE_TTL_DEFAULT)}`;
         }
-        const state = await signState(sp, base, secret, nowSec());
+        const state = await signState(sp, base, flowSecret, nowSec());
+        // Its /callback must find a slot even while a flood fills the guard, or a
+        // refusal there (the browser binding) could not be recorded.
+        const at = now();
+        if (replay.reserve(String(decodeJwt(state).jti), STATE_TTL_DEFAULT * 1000, at) === 'full') {
+            if (incoming)
+                replay.unspend(incoming);
+            noteFull(at);
+            return signInBusy(res);
+        }
         const authUrl = deps.buildGoogleAuthUrl
             ? deps.buildGoogleAuthUrl({ flow: sp.flow, alias: sp.alias, state, bundles: sp.bundles })
             : `https://accounts.google.com/o/oauth2/v2/auth?state=${encodeURIComponent(state)}`;
@@ -290,22 +331,25 @@ export function buildAuthServer(config, deps = {}) {
             }
             let pending;
             try {
-                pending = await verifyPending(form.pending ?? '', base, secret);
+                pending = await verifyPending(form.pending ?? '', base, flowSecret, nowSec());
             }
             catch {
                 return errorPage(res, 400, 'E_STATE_INVALID', 'the approval is invalid or expired');
             }
-            // Only the client leg signs pendings, and it is always the owner sign-in;
-            // a pending signed before that rule (flow=alias_reauth) is refused here.
+            // Only the client leg signs pendings, and it is always the owner sign-in.
+            // Defence in depth: a pending from an earlier release, which could carry
+            // flow=alias_reauth, was signed with MCP_JWT_KEY and no longer verifies.
             if (pending.flow !== 'owner_gate') {
                 return errorPage(res, 400, 'E_STATE_INVALID', 'the approval is invalid or expired');
             }
-            if (!replay.consume(pending.jti, STATE_TTL_DEFAULT * 1000, now())) {
+            const spent = spend(pending, STATE_TTL_DEFAULT);
+            if (spent === 'full')
+                return signInBusy(res);
+            if (spent === 'replay')
                 return errorPage(res, 400, 'E_STATE_INVALID', 'this approval was already used');
-            }
             const { jti: _drop, ...sp } = pending;
             void _drop;
-            return toGoogle(res, sp);
+            return toGoogle(res, sp, pending.jti);
         }
         const q = url.searchParams;
         const clientId = q.get('client_id') ?? '';
@@ -322,7 +366,7 @@ export function buildAuthServer(config, deps = {}) {
         if (q.get('flow') === 'alias_add' && !clientId) {
             let minted;
             try {
-                minted = await verifyState(q.get('state') ?? '', base, secret);
+                minted = await verifyState(q.get('state') ?? '', base, flowSecret, nowSec());
             }
             catch {
                 return errorPage(res, 400, 'E_STATE_INVALID', 'the add-account link is invalid, expired, or tampered');
@@ -330,12 +374,14 @@ export function buildAuthServer(config, deps = {}) {
             if (minted.flow !== 'alias_add' || !minted.alias || !minted.tenantId) {
                 return errorPage(res, 400, 'E_STATE_INVALID', 'the add-account link is malformed');
             }
-            if (!replay.consume(minted.jti, STATE_TTL_DEFAULT * 1000, now())) {
+            const spent = spend(minted, STATE_TTL_DEFAULT);
+            if (spent === 'full')
+                return signInBusy(res);
+            if (spent === 'replay')
                 return errorPage(res, 400, 'E_STATE_INVALID', 'this add-account link was already used');
-            }
             const { jti: _spent, ...sp } = minted;
             void _spent;
-            return toGoogle(res, sp);
+            return toGoogle(res, sp, minted.jti);
         }
         // In-call re-auth (BV-1): a user-clicked `flow=alias_reauth` link has NO
         // client leg — no code is delivered to any client, the refreshed token is
@@ -393,7 +439,7 @@ export function buildAuthServer(config, deps = {}) {
         // it — their redirect_uris come from an issuer-allowlisted document a rogue
         // cannot forge, so there is nothing to spoof.
         if (client.dcr) {
-            const pendingToken = await signPending(statePayload, base, secret, nowSec());
+            const pendingToken = await signPending(statePayload, base, flowSecret, nowSec());
             res.writeHead(200, { 'Content-Type': 'text/html; charset=utf-8', 'Cache-Control': 'no-store', 'Content-Security-Policy': "frame-ancestors 'none'", 'X-Frame-Options': 'DENY' });
             res.end(`<!doctype html><meta charset=utf-8><title>Authorize access</title>` +
                 `<body style="font-family:system-ui,sans-serif;max-width:36em;margin:3em auto;line-height:1.5">` +
@@ -413,14 +459,16 @@ export function buildAuthServer(config, deps = {}) {
         const stateToken = url.searchParams.get('state') ?? '';
         let st;
         try {
-            st = await verifyState(stateToken, base, secret);
+            st = await verifyState(stateToken, base, flowSecret, nowSec());
         }
         catch {
             return errorPage(res, 400, 'E_STATE_INVALID', 'state is invalid, expired, or tampered');
         }
-        if (!replay.consume(st.jti, STATE_TTL_DEFAULT * 1000, now())) {
+        const spent = spend(st, STATE_TTL_DEFAULT);
+        if (spent === 'full')
+            return signInBusy(res);
+        if (spent === 'replay')
             return errorPage(res, 400, 'E_STATE_INVALID', 'state has already been used (replay)');
-        }
         // After the spend, so a refused callback URL cannot be replayed from the
         // browser that holds the cookie; before the exchange and resolveSubject.
         if (st.flow === 'owner_gate') {
@@ -528,7 +576,7 @@ export function buildAuthServer(config, deps = {}) {
             const s = st.client_state ? `&state=${encodeURIComponent(st.client_state)}` : '';
             return redirect(res, `${st.redirect_uri}${sep}error=access_denied${s}&iss=${iss}`);
         }
-        const authzCode = await signAuthzCode({ redirect_uri: st.redirect_uri, code_challenge: st.code_challenge, resource: st.resource, sub: subject.sub }, base, secret, nowSec());
+        const authzCode = await signAuthzCode({ redirect_uri: st.redirect_uri, code_challenge: st.code_challenge, resource: st.resource, sub: subject.sub }, base, flowSecret, nowSec());
         log('callback ok flow=owner_gate');
         const sep = st.redirect_uri.includes('?') ? '&' : '?';
         const s = st.client_state ? `&state=${encodeURIComponent(st.client_state)}` : '';
@@ -547,14 +595,16 @@ export function buildAuthServer(config, deps = {}) {
         if (grant === 'authorization_code') {
             let code;
             try {
-                code = await verifyAuthzCode(form.code ?? '', base, secret);
+                code = await verifyAuthzCode(form.code ?? '', base, flowSecret, nowSec());
             }
             catch {
                 return json(res, 400, { error: 'invalid_grant', message: 'authorization code invalid or expired' });
             }
-            if (!replay.consume(code.jti, CODE_TTL_DEFAULT * 1000, now())) {
+            const spent = spend(code, CODE_TTL_DEFAULT);
+            if (spent === 'full')
+                return subjectUnavailable(res);
+            if (spent === 'replay')
                 return json(res, 400, { error: 'invalid_grant', message: 'authorization code already redeemed' });
-            }
             if (form.redirect_uri !== code.redirect_uri) {
                 return json(res, 400, { error: 'invalid_grant', message: 'redirect_uri mismatch' });
             }
@@ -572,6 +622,8 @@ export function buildAuthServer(config, deps = {}) {
                 }
                 catch (e) {
                     log(`token deferred grant=authorization_code: subject check failed: ${e instanceof Error ? logSafe(e.message, 200) : 'non-Error throw'}`);
+                    // Nothing was issued and PKCE passed, so the retry the 503 asks for may redeem it.
+                    replay.unspend(code.jti);
                     return subjectUnavailable(res);
                 }
                 if (!active) {
@@ -684,7 +736,7 @@ export function buildAuthServer(config, deps = {}) {
         // here would be a state no route verifies the way its flow needs.
         if (flow !== 'alias_add')
             throw new Error(`mintFlowState supports alias_add only, not ${String(flow)}`);
-        const state = await signState({ flow, client_id: '', redirect_uri: '', code_challenge: '', resource, alias, tenantId, bundles, nonce }, base, secret, nowSec());
+        const state = await signState({ flow, client_id: '', redirect_uri: '', code_challenge: '', resource, alias, tenantId, bundles, nonce }, base, flowSecret, nowSec());
         return `${base}/authorize?flow=${flow}&state=${encodeURIComponent(state)}`;
     };
     const reauthLink = (alias) => `${base}/authorize?flow=alias_reauth&${signReauthLink(base, secret, alias, nowSec())}`;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "mcp-google-multi",
-  "version": "6.0.0-alpha.65",
+  "version": "6.0.0-alpha.66",
   "mcpName": "io.github.bakissation/mcp-google-multi",
   "description": "Local MCP server for Google Workspace (Gmail, Drive, Calendar, Sheets, Docs, Contacts, Tasks, Meet, Search Console, +Forms/Chat/Admin) across multiple accounts — OAuth-only, encrypted token storage, deny-by-default writes.",
   "type": "module",