mcp-google-multi 6.0.0-beta.2 → 6.0.0-beta.4

package/dist/metrics-cli.d.ts

@@ -15,7 +15,7 @@ interface PromotionRow {
     calls: number;
     kind: 'curation-candidate' | 'visibility-failure' | 'generation-gap';
 }
-/** The promotion-queue view: ranked evidence, a human decides (spec section 5). */
+/** The promotion-queue view: ranked evidence, a human decides. */
 export declare function classifyPromotion(merged: DayAgg, data: PromotionData): PromotionRow[];
 export declare function runMetricsCli(argv: string[], deps: MetricsCliDeps): number;
 export {};

package/dist/metrics-cli.js

@@ -87,7 +87,7 @@ function renderReport(merged, days, out) {
     }
 }
 const tail = (id) => id.split('.').slice(1).join('.');
-/** The promotion-queue view: ranked evidence, a human decides (spec section 5). */
+/** The promotion-queue view: ranked evidence, a human decides. */
 export function classifyPromotion(merged, data) {
     const curated = new Set();
     for (const id of data.curatedIds) {

package/dist/metrics-tap.js

@@ -1,10 +1,7 @@
 import { isSchemaValidationText } from './arg-normalize.js';
 const PENDING_CAP = 1_000;
-// The detector lives next to the rewriter that consumes the same frames, so
-// the two can never drift apart. This tap sees the ORIGINAL prose:
-// withValidationEnvelope sits BELOW it and converts that same frame into an
-// envelope for the client, so classification here and the contract on the wire
-// stay independent.
+// This tap sees the ORIGINAL prose; withValidationEnvelope sits BELOW it and
+// converts the same frame for the client, so the two stay independent.
 export { isSchemaValidationText };
 /**
  * @param isKnownTool membership test against the REGISTERED tool set. The

package/dist/migrate-config.d.ts

@@ -1,7 +1,6 @@
 /**
  * Synthesize config.json accounts{} from the v5 env (GOOGLE_ACCOUNTS +
  * GOOGLE_ADMIN_ACCOUNTS). Never deletes or edits env; idempotent (a re-run
- * that changes nothing says so). Scope-profile and preference fields are
- * migrated by their own slices' commands.
+ * that changes nothing says so).
  */
 export declare function runMigrateConfig(env?: NodeJS.ProcessEnv): void;

package/dist/migrate-config.js

@@ -1,13 +1,12 @@
 import { CONFIG_VERSION, configFilePath, loadConfigFile, mutateConfigFile } from './config-file.js';
-import { BUNDLE_CATALOG, closestBundle, resolveBundleAliases } from './scope-catalog.js';
+import { closestBundle, isKnownBundle, resolveBundleAliases } from './scope-catalog.js';
 function parseCsv(value) {
     return (value ?? '').split(',').map((s) => s.trim()).filter(Boolean);
 }
 /**
  * Synthesize config.json accounts{} from the v5 env (GOOGLE_ACCOUNTS +
  * GOOGLE_ADMIN_ACCOUNTS). Never deletes or edits env; idempotent (a re-run
- * that changes nothing says so). Scope-profile and preference fields are
- * migrated by their own slices' commands.
+ * that changes nothing says so).
  */
 export function runMigrateConfig(env = process.env) {
     const raw = env.GOOGLE_ACCOUNTS;
@@ -35,7 +34,7 @@ export function runMigrateConfig(env = process.env) {
         }
         desired[alias] = { email };
     }
-    // Legacy global scopes (BC7) become an explicit named profile every account
+    // Legacy global scopes become an explicit named profile every account
     // points at, so removing the env var later changes nothing.
     const legacyNames = parseCsv(env.GOOGLE_OPTIONAL_SCOPES);
     let legacyProfile;
@@ -47,7 +46,7 @@ export function runMigrateConfig(env = process.env) {
                 process.exitCode = 1;
                 return;
             }
-            if (!(bundle in BUNDLE_CATALOG)) {
+            if (!isKnownBundle(bundle)) {
                 const hint = closestBundle(bundle);
                 console.error(`E_UNKNOWN_BUNDLE: unknown bundle "${bundle}" in GOOGLE_OPTIONAL_SCOPES${hint ? ` — did you mean "${hint}"?` : ''}. Nothing written.`);
                 process.exitCode = 1;
@@ -59,8 +58,7 @@ export function runMigrateConfig(env = process.env) {
     const filePath = configFilePath(env);
     const before = loadConfigFile(filePath);
     // Merge per-alias: env owns the alias set and emails, but file-only fields
-    // (scopeProfile, admin) survive for retained aliases — mirroring runtime
-    // precedence, where unset GOOGLE_ADMIN_ACCOUNTS preserves file admin flags.
+    // (scopeProfile, admin) survive for retained aliases.
     const existing = before?.accounts ?? {};
     const dropped = Object.keys(existing).filter((a) => !(a in desired));
     for (const [alias, entry] of Object.entries(desired)) {

package/dist/net-tuning.js

@@ -1,8 +1,6 @@
 import net from 'node:net';
-// Node's happy-eyeballs gives each address family 250ms per connect attempt on
-// every LTS line (raised to 500ms only in v25.2+); on high-latency or
-// broken-IPv6 links that aborts EVERY Google call while curl works. Raise the
-// process default unless the user tuned it themselves. Why: docs/internals.md.
+// Node's happy-eyeballs 250ms-per-attempt default aborts EVERY Google call on
+// a high-latency or broken-IPv6 link while curl works. See docs/internals.md.
 export const CONNECT_ATTEMPT_TIMEOUT_MS = 2000;
 const USER_FLAGS = ['--network-family-autoselection-attempt-timeout', '--no-network-family-autoselection'];
 /** Pure decision: the timeout to apply, or null to leave Node's setting alone. */

package/dist/oauth-as.d.ts

@@ -6,6 +6,10 @@ export declare const DCR_MAX_REDIRECT_URIS = 10;
 export interface GoogleExchangeResult {
     tokens: Record<string, unknown>;
     email?: string;
+    /** Google's stable account id; unlike the address it is never reassigned. */
+    sub?: string;
+    /** Google Workspace hosted domain; absent for a consumer account. */
+    hd?: string;
 }
 export interface AuthServerConfig {
     base: string;
@@ -16,21 +20,72 @@ export interface AuthServerConfig {
     accessTtlSec?: number;
     masterKey: string;
     refreshStorePath: string;
+    /** `maxAgeSec` of the refresh store buildAuthServer creates: sessions end
+     * this long after their sign-in. Unset: unlimited. */
+    refreshMaxAgeSec?: number;
+    /** `idleSec` of that store: sessions end this long after their last
+     * refresh. Unset: unlimited. */
+    refreshIdleSec?: number;
+    /** `maxFamiliesPerSub` of that store: bounds how many live refresh-token
+     * families one subject may hold, dropping its least-recently-used one to
+     * make room. Unset: unlimited. */
+    refreshMaxFamiliesPerSub?: number;
+    /** Default true. The clientless `flow=alias_reauth` link names an alias with
+     * no tenant binding, so a multi-tenant deployment sets false: with several
+     * tenants an alias name alone is ambiguous and the branch becomes a
+     * cross-tenant re-auth vector. Server-minted alias_add flows are unaffected. */
+    legacyAliasReauth?: boolean;
 }
+/** What /callback hands the alias_add binder once Google returned a verified
+ * identity for a server-minted link. */
+export interface TenantAliasBind {
+    tenantId: string;
+    alias: string;
+    email: string;
+    bundles?: string[];
+    nonce?: string;
+    tokens: Record<string, unknown>;
+    sub?: string;
+}
+/** A binder's deliberate refusal (policy, not failure): /callback answers 403
+ * with this slug and message. The message reaches an unauthenticated browser. */
+export interface AliasBindRefusal {
+    refused: {
+        slug: string;
+        message: string;
+    };
+}
+export interface GoogleIdentity {
+    email?: string;
+    sub?: string;
+    hd?: string;
+}
+/** Only trust the id_token identity when Google marks the email verified.
+ * The token comes straight from Google's token endpoint, so its claims are
+ * read unsigned. A malformed sub or hd is dropped, never passed on. */
+export declare function verifiedIdentityFromIdToken(idToken?: string | null): GoogleIdentity | undefined;
+export declare function verifiedEmailFromIdToken(idToken?: string | null): string | undefined;
 export interface AuthServerDeps {
     fetchCimd?: (clientId: string) => Promise<Record<string, unknown>>;
     /** Exchange a Google auth code at `${base}/callback` for tokens (+ owner email). */
     exchangeCode?: (code: string, flow: StatePayload['flow']) => Promise<GoogleExchangeResult>;
     /** Build the Google authorization URL (redirect back to `${base}/callback`).
-     *  The impl chooses scope/prompt/login_hint from the flow: owner_gate =
-     *  `openid email` + select_account; alias_reauth = the alias's resource scopes
-     *  + consent. */
+     *  The impl chooses scope/prompt from the flow: owner_gate = `openid email`
+     *  + select_account; alias_reauth = the alias's resource scopes + select_account
+     *  consent, and no login_hint (the link needs no authentication). */
     buildGoogleAuthUrl?: (opts: {
         flow: StatePayload['flow'];
         alias?: string;
         state: string;
+        bundles?: string[];
     }) => string;
     writeToken?: (alias: string, tokens: Record<string, unknown>) => void;
+    /** Scopes the alias asked for that `grantedScope` lacks, so the alias_reauth
+     * completion page can say what Google's granular consent left out. */
+    missingScopes?: (alias: string, grantedScope: string | undefined) => string[];
+    /** Whether a readable token is stored for the alias; a narrower re-auth
+     * grant keeps it rather than replace it. */
+    hasToken?: (alias: string) => boolean;
     registeredClients?: Map<string, {
         redirect_uris: string[];
     }>;
@@ -41,12 +96,57 @@ export interface AuthServerDeps {
     log?: (line: string) => void;
     /** The alias's configured Google email, for the alias_reauth identity binding. */
     aliasEmail?: (alias: string) => string | undefined;
+    /** Map a verified sign-in email to the subject its tokens are minted under.
+     * Default = the MCP_OWNER_EMAILS allowlist -> {sub:'owner'}; null = denied.
+     * The tenant resolver (invite claim / email->tenant lookup) plugs in here.
+     * `identity` carries Google's `sub` and `hd` when the exchange returned
+     * them, so a resolver can key on the stable account id rather than an
+     * address that can be reassigned. */
+    resolveSubject?: (email: string, identity?: {
+        sub?: string;
+        hd?: string;
+    }) => {
+        sub: string;
+    } | null | {
+        denied: {
+            description: string;
+        };
+    };
+    /** alias_add completion: persist the new alias's config row and tokens under
+     * its tenant. /callback awaits it only after a successful Google exchange.
+     * A returned refusal answers 403 with its slug; a throw or rejection answers
+     * 500 E_ALIAS_ADD_FAILED. */
+    bindTenantAlias?: (bind: TenantAliasBind) => void | AliasBindRefusal | Promise<void | AliasBindRefusal>;
+    /** False for a subject this host no longer serves (a multi-tenant host that
+     * removed or suspended it): /token then issues and rotates nothing for it
+     * (400 invalid_grant; a rotated sub's refresh tokens are dropped). A throw
+     * means the answer is unknown right now: 503 temporarily_unavailable, and
+     * the presented refresh token is not spent. Absent: every subject is active. */
+    subjectActive?: (sub: string) => boolean;
 }
 export interface AuthServer {
     routes: Record<string, RouteHandler>;
     authenticate: (req: IncomingMessage) => Promise<AuthOutcome>;
+    /** Mint a signed, single-use, TTL-bound clientless flow URL
+     * (`${base}/authorize?flow=...&state=<signed>`). The tenantId/bundles ride
+     * INSIDE the signed state, so nothing at /authorize or /callback trusts a
+     * caller-supplied identity. The URL works only on this AuthServer, and only
+     * until its process restarts: sign-in artifacts are signed with a key each
+     * buildAuthServer call generates. Inert unless something calls it. */
+    mintFlowState: (opts: {
+        flow: 'alias_add';
+        alias: string;
+        tenantId?: string;
+        bundles?: string[];
+        nonce?: string;
+    }) => Promise<string>;
+    /** The owner's re-auth link for `alias`: HMAC-signed, expiring, not single
+     * use (a chat client may prefetch it). /authorize refuses any alias_reauth
+     * request without a valid one, so an unauthenticated caller can neither
+     * start a re-auth nor learn which aliases exist or what they hold. */
+    reauthLink: (alias: string) => string;
 }
-/** C6: exact redirect_uri match, with RFC 8252 §7.3 port-agnostic loopback and
+/** Exact redirect_uri match, with RFC 8252 §7.3 port-agnostic loopback and
  *  the fixed claude.ai callback. */
 export declare function redirectAllowed(redirectUri: string, docRedirectUris: string[]): boolean;
 export declare function buildAuthServer(config: AuthServerConfig, deps?: AuthServerDeps): AuthServer;