@kadoa/mcp 0.5.10 → 0.5.11

package/dist/index.js

@@ -51861,13 +51861,23 @@ This is the main page content.`
 });
 
 // src/client.ts
+function resolveServiceAccountApiKey(credentialRef) {
+  const configuredRef = process.env.MCP_SERVICE_ACCOUNT_CREDENTIAL_REF?.trim();
+  if (!configuredRef || credentialRef !== configuredRef) {
+    throw new Error("Unknown service-account credential reference");
+  }
+  const apiKey = process.env.MCP_SERVICE_ACCOUNT_KADOA_API_KEY?.trim();
+  if (!apiKey) {
+    throw new Error("Service-account API key is not configured");
+  }
+  return apiKey;
+}
 function createKadoaClient(auth) {
-  const client = new KadoaClient({ bearerToken: auth.jwt });
+  const { principal } = auth;
+  const client = principal.type === "user" ? new KadoaClient({ bearerToken: principal.supabaseJwt }) : new KadoaClient({ apiKey: auth.apiKey ?? resolveServiceAccountApiKey(principal.credentialRef) });
   client.axiosInstance.interceptors.request.use((config2) => {
     config2.headers["x-kadoa-source"] = "mcp";
-    if (auth.teamId) {
-      config2.headers["x-team-id"] = auth.teamId;
-    }
+    config2.headers["x-team-id"] = principal.teamId;
     return config2;
   });
   return client;
@@ -51882,6 +51892,7 @@ var init_client = __esm(() => {
 // src/client.ts
 var exports_client = {};
 __export(exports_client, {
+  resolveServiceAccountApiKey: () => resolveServiceAccountApiKey2,
   refreshSupabaseJwtRaw: () => refreshSupabaseJwtRaw,
   refreshSupabaseJwt: () => refreshSupabaseJwt,
   isJwtExpired: () => isJwtExpired,
@@ -51892,13 +51903,23 @@ __export(exports_client, {
   KadoaSdkException: () => KadoaSdkException,
   KadoaClient: () => KadoaClient
 });
+function resolveServiceAccountApiKey2(credentialRef) {
+  const configuredRef = process.env.MCP_SERVICE_ACCOUNT_CREDENTIAL_REF?.trim();
+  if (!configuredRef || credentialRef !== configuredRef) {
+    throw new Error("Unknown service-account credential reference");
+  }
+  const apiKey = process.env.MCP_SERVICE_ACCOUNT_KADOA_API_KEY?.trim();
+  if (!apiKey) {
+    throw new Error("Service-account API key is not configured");
+  }
+  return apiKey;
+}
 function createKadoaClient2(auth) {
-  const client = new KadoaClient({ bearerToken: auth.jwt });
+  const { principal } = auth;
+  const client = principal.type === "user" ? new KadoaClient({ bearerToken: principal.supabaseJwt }) : new KadoaClient({ apiKey: auth.apiKey ?? resolveServiceAccountApiKey2(principal.credentialRef) });
   client.axiosInstance.interceptors.request.use((config2) => {
     config2.headers["x-kadoa-source"] = "mcp";
-    if (auth.teamId) {
-      config2.headers["x-team-id"] = auth.teamId;
-    }
+    config2.headers["x-team-id"] = principal.teamId;
     return config2;
   });
   return client;
@@ -51955,7 +51976,7 @@ async function _doRefreshRaw(supabaseRefreshToken) {
     return { jwt: data.access_token, refreshToken: data.refresh_token };
   }
   const body = await res.text().catch(() => "");
-  console.error(`[JWT_REFRESH] FAIL: Supabase returned ${res.status} (refreshToken=${supabaseRefreshToken.slice(0, 12)}...): ${body}`);
+  console.error(`[JWT_REFRESH] FAIL: Supabase returned ${res.status}: ${body}`);
   if (body.includes("session_expired") || body.includes("refresh_token_not_found") || body.includes("refresh_token_already_used")) {
     throw new SessionExpiredError("Your Kadoa session has expired due to inactivity. Please reconnect to re-authenticate.");
   }
@@ -51968,7 +51989,7 @@ async function refreshSupabaseJwt(ctx) {
   }
   try {
     const refreshToken = ctx.supabaseRefreshToken;
-    console.error(`[JWT_REFRESH] Refreshing Supabase JWT (refreshToken=${refreshToken.slice(0, 12)}..., team=${ctx.teamId ?? "unknown"})`);
+    console.error(`[JWT_REFRESH] Refreshing Supabase JWT (team=${ctx.teamId ?? "unknown"})`);
     const result = await refreshSupabaseJwtRaw(refreshToken);
     if (!result)
       return;
@@ -51984,7 +52005,7 @@ async function refreshSupabaseJwt(ctx) {
     } catch (e) {
       console.error("[JWT_REFRESH] WARN: persist failed, tokens updated in-memory only:", e);
     }
-    console.error(`[JWT_REFRESH] OK: token refreshed (team=${ctx.teamId ?? "unknown"}, newRefreshToken=${result.refreshToken.slice(0, 12)}...)`);
+    console.error(`[JWT_REFRESH] OK: token refreshed (team=${ctx.teamId ?? "unknown"})`);
     return result.jwt;
   } catch (error48) {
     if (error48 instanceof SessionExpiredError)
@@ -52307,6 +52328,12 @@ function registerTools(server, ctx, capabilities) {
     inputSchema: {},
     annotations: { readOnlyHint: true, destructiveHint: false, idempotentHint: true }
   }, withErrorHandling("whoami", async () => {
+    if (ctx.principal.type === "serviceAccount") {
+      return jsonResult({
+        authMethod: "Shared organization service account",
+        teamId: ctx.principal.teamId
+      });
+    }
     const jwt2 = await getValidJwt(ctx);
     const user = await ctx.client.user.getCurrentUser();
     const teams = await ctx.client.listTeams(jwt2 ? { bearerToken: jwt2 } : undefined);
@@ -53181,6 +53208,12 @@ function registerTools(server, ctx, capabilities) {
     inputSchema: {},
     annotations: { readOnlyHint: true, destructiveHint: false, idempotentHint: true }
   }, withErrorHandling("team_list", async () => {
+    if (ctx.principal.type === "serviceAccount") {
+      return jsonResult({
+        teams: [{ id: ctx.principal.teamId, active: true, sharedServiceAccount: true }],
+        activeTeamId: ctx.principal.teamId
+      });
+    }
     const jwt2 = await getValidJwt(ctx);
     const teams = await ctx.client.listTeams(jwt2 ? { bearerToken: jwt2 } : undefined);
     const activeTeamId = ctx.teamId ?? teams[0]?.id;
@@ -53202,6 +53235,9 @@ function registerTools(server, ctx, capabilities) {
     },
     annotations: { readOnlyHint: false, destructiveHint: false, idempotentHint: true }
   }, withErrorHandling("team_switch", async (args) => {
+    if (ctx.principal.type === "serviceAccount") {
+      return errorResult("This shared organization connector is fixed to one team and cannot switch teams.");
+    }
     const jwt2 = await getValidJwt(ctx);
     const teams = await ctx.client.listTeams({ bearerToken: jwt2 });
     const identifier = args.teamIdentifier;
@@ -53619,7 +53655,7 @@ var package_default;
 var init_package = __esm(() => {
   package_default = {
     name: "@kadoa/mcp",
-    version: "0.5.10",
+    version: "0.5.11",
     description: "Kadoa MCP Server — manage workflows from Claude Desktop, Cursor, and other MCP clients",
     type: "module",
     main: "dist/index.js",
@@ -57651,11 +57687,87 @@ var init_bearerAuth = __esm(() => {
   init_errors4();
 });
 
+// src/service-account-config.ts
+function getServiceAccountOAuthConfig() {
+  const values = Object.fromEntries(Object.entries(ENV_KEYS).map(([field, envKey]) => [field, process.env[envKey]?.trim()]));
+  if (Object.values(values).every((value) => !value))
+    return;
+  const missing = Object.entries(values).filter(([, value]) => !value).map(([field]) => ENV_KEYS[field]);
+  if (missing.length > 0) {
+    throw new Error(`Incomplete service-account OAuth configuration; missing ${missing.join(", ")}`);
+  }
+  const redirectUri = new URL(values.redirectUri);
+  if (redirectUri.protocol !== "https:" && redirectUri.hostname !== "localhost") {
+    throw new Error("MCP_SERVICE_ACCOUNT_OAUTH_REDIRECT_URI must use HTTPS");
+  }
+  return {
+    clientId: values.clientId,
+    clientSecret: values.clientSecret,
+    redirectUri: redirectUri.toString(),
+    credentialRef: values.credentialRef,
+    teamId: values.teamId,
+    label: values.label
+  };
+}
+function getConfiguredServiceAccountClient(clientId) {
+  const configuredClientId = process.env.MCP_SERVICE_ACCOUNT_OAUTH_CLIENT_ID?.trim();
+  if (!configuredClientId || configuredClientId !== clientId)
+    return;
+  const config2 = getServiceAccountOAuthConfig();
+  if (!config2)
+    return;
+  return {
+    client_id: config2.clientId,
+    client_secret: config2.clientSecret,
+    client_id_issued_at: 0,
+    client_name: config2.label,
+    redirect_uris: [config2.redirectUri],
+    token_endpoint_auth_method: "client_secret_post",
+    grant_types: ["authorization_code", "refresh_token"],
+    response_types: ["code"]
+  };
+}
+var ENV_KEYS;
+var init_service_account_config = __esm(() => {
+  ENV_KEYS = {
+    clientId: "MCP_SERVICE_ACCOUNT_OAUTH_CLIENT_ID",
+    clientSecret: "MCP_SERVICE_ACCOUNT_OAUTH_CLIENT_SECRET",
+    redirectUri: "MCP_SERVICE_ACCOUNT_OAUTH_REDIRECT_URI",
+    credentialRef: "MCP_SERVICE_ACCOUNT_CREDENTIAL_REF",
+    teamId: "MCP_SERVICE_ACCOUNT_TEAM_ID",
+    label: "MCP_SERVICE_ACCOUNT_LABEL"
+  };
+});
+
 // src/auth.ts
 import { randomBytes, createHash as createHash2 } from "node:crypto";
 function randomToken(bytes = 32) {
   return randomBytes(bytes).toString("hex");
 }
+function readPrincipal(entry) {
+  if (entry.principal)
+    return entry.principal;
+  if (entry.supabaseJwt && entry.supabaseRefreshToken) {
+    return {
+      type: "user",
+      supabaseJwt: entry.supabaseJwt,
+      supabaseRefreshToken: entry.supabaseRefreshToken,
+      teamId: entry.teamId
+    };
+  }
+  throw new InvalidTokenError("Stored token has no valid principal");
+}
+function persistPrincipal(principal) {
+  if (principal.type === "serviceAccount") {
+    return { principal, teamId: principal.teamId };
+  }
+  return {
+    principal,
+    supabaseJwt: principal.supabaseJwt,
+    supabaseRefreshToken: principal.supabaseRefreshToken,
+    teamId: principal.teamId
+  };
+}
 function generatePKCE() {
   const verifier = randomBytes(32).toString("base64url").replace(/[^a-zA-Z0-9\-._~]/g, "").slice(0, 128);
   const challenge = createHash2("sha256").update(verifier).digest("base64url");
@@ -57753,7 +57865,7 @@ class KadoaOAuthProvider {
     const store = this.store;
     return {
       async getClient(clientId) {
-        return store.get("clients", clientId);
+        return getConfiguredServiceAccountClient(clientId) ?? store.get("clients", clientId);
       },
       async registerClient(client) {
         const clientId = randomToken(16);
@@ -57768,10 +57880,9 @@ class KadoaOAuthProvider {
     };
   }
   async authorize(client, params, res) {
-    const supabaseUrl = process.env.SUPABASE_URL;
     const serverUrl = process.env.MCP_SERVER_URL;
-    if (!supabaseUrl || !serverUrl) {
-      throw new Error("SUPABASE_URL and MCP_SERVER_URL must be configured");
+    if (!serverUrl) {
+      throw new Error("MCP_SERVER_URL must be configured");
     }
     const state = randomToken();
     const { verifier, challenge } = generatePKCE();
@@ -57780,6 +57891,14 @@ class KadoaOAuthProvider {
       params,
       supabaseCodeVerifier: verifier
     }, 600);
+    const configuredServiceClientId = process.env.MCP_SERVICE_ACCOUNT_OAUTH_CLIENT_ID?.trim();
+    if (configuredServiceClientId === client.client_id) {
+      const serviceConfig = getServiceAccountOAuthConfig();
+      if (!serviceConfig)
+        throw new Error("Service-account OAuth configuration is unavailable");
+      res.type("html").send(renderServiceAccountConsentPage(state, serviceConfig.label));
+      return;
+    }
     res.type("html").send(renderLoginPage(state));
   }
   async handleGoogleLogin(req, res) {
@@ -57897,8 +58016,9 @@ class KadoaOAuthProvider {
     if (teams.length === 1) {
       const refreshed = await setActiveTeamAndRefresh(supabaseJwt, supabaseRefreshToken, teams[0].id);
       await this.completeAuthFlow(pending, res, {
-        jwt: refreshed.jwt,
-        refreshToken: refreshed.refreshToken,
+        type: "user",
+        supabaseJwt: refreshed.jwt,
+        supabaseRefreshToken: refreshed.refreshToken,
         teamId: teams[0].id
       });
       return;
@@ -57927,29 +58047,28 @@ class KadoaOAuthProvider {
       await this.store.del("auth_codes", authorizationCode);
       throw new Error("Authorization code expired");
     }
+    if (entry.clientId !== _client.client_id) {
+      throw new Error("OAuth client mismatch for authorization code");
+    }
     if (redirectUri && redirectUri !== entry.redirectUri) {
       throw new Error("redirect_uri mismatch");
     }
     const accessToken = randomToken();
     const refreshToken = randomToken();
     const expiresAt = Date.now() + ACCESS_TOKEN_TTL * 1000;
+    const principal = readPrincipal(entry);
     await this.store.set("access_tokens", accessToken, {
-      supabaseJwt: entry.supabaseJwt,
-      supabaseRefreshToken: entry.supabaseRefreshToken,
-      teamId: entry.teamId,
+      ...persistPrincipal(principal),
       clientId: entry.clientId,
       expiresAt
     }, ACCESS_TOKEN_TTL);
     await this.store.set("refresh_tokens", refreshToken, {
-      supabaseJwt: entry.supabaseJwt,
-      supabaseRefreshToken: entry.supabaseRefreshToken,
-      teamId: entry.teamId,
+      ...persistPrincipal(principal),
       clientId: entry.clientId
     }, 2592000);
     await this.store.del("auth_codes", authorizationCode);
-    const claims = jwtClaims(entry.supabaseJwt);
     const sessionCount = await this.store.size("access_tokens");
-    console.log(`[AUTH] LOGIN: tokens issued (email=${claims.email}, team=${entry.teamId}, token=${accessToken.slice(0, 12)}..., ttl=${ACCESS_TOKEN_TTL}s, active_sessions=${sessionCount})`);
+    console.log(`[AUTH] LOGIN: tokens issued (mode=${principal.type}, team=${principal.teamId}, ttl=${ACCESS_TOKEN_TTL}s, active_sessions=${sessionCount})`);
     return {
       access_token: accessToken,
       token_type: "bearer",
@@ -57961,12 +58080,36 @@ class KadoaOAuthProvider {
     const entry = await this.store.get("refresh_tokens", refreshToken);
     if (!entry) {
       const sessionCount = await this.store.size("refresh_tokens");
-      console.error(`[AUTH] REFRESH_FAIL: unknown refresh token (token=${refreshToken.slice(0, 12)}..., active_sessions=${sessionCount})`);
+      console.error(`[AUTH] REFRESH_FAIL: unknown refresh token (active_sessions=${sessionCount})`);
       throw new InvalidTokenError("Unknown or expired refresh token");
     }
+    if (entry.clientId !== _client.client_id) {
+      throw new Error("OAuth client mismatch for refresh token");
+    }
     await this.store.del("refresh_tokens", refreshToken);
-    let { supabaseJwt, supabaseRefreshToken } = entry;
-    const claims = jwtClaims(entry.supabaseJwt);
+    const storedPrincipal = readPrincipal(entry);
+    if (storedPrincipal.type === "serviceAccount") {
+      const newAccessToken2 = randomToken();
+      const newRefreshToken2 = randomToken();
+      const expiresAt2 = Date.now() + ACCESS_TOKEN_TTL * 1000;
+      await this.store.set("access_tokens", newAccessToken2, {
+        ...persistPrincipal(storedPrincipal),
+        clientId: entry.clientId,
+        expiresAt: expiresAt2
+      }, ACCESS_TOKEN_TTL);
+      await this.store.set("refresh_tokens", newRefreshToken2, {
+        ...persistPrincipal(storedPrincipal),
+        clientId: entry.clientId
+      }, 2592000);
+      return {
+        access_token: newAccessToken2,
+        token_type: "bearer",
+        expires_in: ACCESS_TOKEN_TTL,
+        refresh_token: newRefreshToken2
+      };
+    }
+    let { supabaseJwt, supabaseRefreshToken } = storedPrincipal;
+    const claims = jwtClaims(storedPrincipal.supabaseJwt);
     const context = `email=${claims.email}, team=${entry.teamId}`;
     try {
       const { refreshSupabaseJwtRaw: refreshSupabaseJwtRaw2, SessionExpiredError: SessionExpiredError2 } = await Promise.resolve().then(() => (init_client2(), exports_client));
@@ -57990,17 +58133,19 @@ class KadoaOAuthProvider {
     const newAccessToken = randomToken();
     const newRefreshToken = randomToken();
     const expiresAt = Date.now() + ACCESS_TOKEN_TTL * 1000;
-    await this.store.set("access_tokens", newAccessToken, {
+    const refreshedPrincipal = {
+      type: "user",
       supabaseJwt,
       supabaseRefreshToken,
-      teamId,
+      teamId
+    };
+    await this.store.set("access_tokens", newAccessToken, {
+      ...persistPrincipal(refreshedPrincipal),
       clientId: entry.clientId,
       expiresAt
     }, ACCESS_TOKEN_TTL);
     await this.store.set("refresh_tokens", newRefreshToken, {
-      supabaseJwt,
-      supabaseRefreshToken,
-      teamId,
+      ...persistPrincipal(refreshedPrincipal),
       clientId: entry.clientId
     }, 2592000);
     return {
@@ -58014,25 +58159,28 @@ class KadoaOAuthProvider {
     const entry = await this.store.get("access_tokens", token);
     if (!entry) {
       const sessionCount = await this.store.size("access_tokens");
-      console.error(`[AUTH] VERIFY_FAIL: unknown token (token=${token.slice(0, 12)}..., active_sessions=${sessionCount})`);
+      console.error(`[AUTH] VERIFY_FAIL: unknown token (active_sessions=${sessionCount})`);
       throw new InvalidTokenError("Unknown or expired access token");
     }
     if (entry.expiresAt < Date.now()) {
       const expiredAgo = Math.round((Date.now() - entry.expiresAt) / 1000);
-      const claims = jwtClaims(entry.supabaseJwt);
-      console.error(`[AUTH] VERIFY_FAIL: token expired ${expiredAgo}s ago (email=${claims.email}, team=${entry.teamId}, token=${token.slice(0, 12)}...)`);
+      console.error(`[AUTH] VERIFY_FAIL: token expired ${expiredAgo}s ago (team=${entry.teamId})`);
       await this.store.del("access_tokens", token);
       throw new InvalidTokenError("Access token expired");
     }
+    const principal = readPrincipal(entry);
     return {
       token,
       clientId: entry.clientId,
       scopes: [],
       expiresAt: Math.floor(entry.expiresAt / 1000),
       extra: {
-        supabaseJwt: entry.supabaseJwt,
-        supabaseRefreshToken: entry.supabaseRefreshToken,
-        teamId: entry.teamId
+        principal,
+        ...principal.type === "user" ? {
+          supabaseJwt: principal.supabaseJwt,
+          supabaseRefreshToken: principal.supabaseRefreshToken
+        } : {},
+        teamId: principal.teamId
       }
     };
   }
@@ -58062,6 +58210,29 @@ class KadoaOAuthProvider {
       res.redirect(redirectUrl.toString());
     }
   }
+  async handleServiceAccountConsent(req, res) {
+    const { state } = req.body;
+    if (!state) {
+      res.status(400).send("Missing state parameter");
+      return;
+    }
+    const pending = await this.store.get("pending_auths", state);
+    if (!pending) {
+      res.status(400).send("Unknown or expired state parameter");
+      return;
+    }
+    const config2 = getServiceAccountOAuthConfig();
+    if (!config2 || pending.client.client_id !== config2.clientId) {
+      res.status(403).send("Service-account authorization is not available for this client");
+      return;
+    }
+    await this.store.del("pending_auths", state);
+    await this.completeAuthFlow(pending, res, {
+      type: "serviceAccount",
+      credentialRef: config2.credentialRef,
+      teamId: config2.teamId
+    });
+  }
   async handleTeamSelection(req, res) {
     const { token, teamId } = req.body;
     if (!token || !teamId) {
@@ -58086,8 +58257,9 @@ class KadoaOAuthProvider {
     try {
       const refreshed = await setActiveTeamAndRefresh(entry.supabaseJwt, entry.supabaseRefreshToken, teamId);
       await this.completeAuthFlow(entry.pending, res, {
-        jwt: refreshed.jwt,
-        refreshToken: refreshed.refreshToken,
+        type: "user",
+        supabaseJwt: refreshed.jwt,
+        supabaseRefreshToken: refreshed.refreshToken,
         teamId
       });
     } catch (error48) {
@@ -58101,12 +58273,10 @@ class KadoaOAuthProvider {
       res.redirect(redirectUrl.toString());
     }
   }
-  async completeAuthFlow(pending, res, credentials) {
+  async completeAuthFlow(pending, res, principal) {
     const mcpCode = randomToken();
     await this.store.set("auth_codes", mcpCode, {
-      supabaseJwt: credentials.jwt,
-      supabaseRefreshToken: credentials.refreshToken,
-      teamId: credentials.teamId,
+      ...persistPrincipal(principal),
       codeChallenge: pending.params.codeChallenge,
       clientId: pending.client.client_id,
       redirectUri: pending.params.redirectUri,
@@ -58120,6 +58290,33 @@ class KadoaOAuthProvider {
     res.redirect(redirectUrl.toString());
   }
 }
+function renderServiceAccountConsentPage(state, label) {
+  return `<!DOCTYPE html>
+<html lang="en">
+<head>
+  <meta charset="utf-8" />
+  <meta name="viewport" content="width=device-width, initial-scale=1" />
+  <title>Connect shared Kadoa workspace</title>
+  <style>
+    body { font-family: ui-sans-serif, system-ui, sans-serif; background: #fafafa; color: #18181b; min-height: 100vh; display: grid; place-items: center; margin: 0; }
+    main { width: min(420px, calc(100% - 2rem)); background: white; border: 1px solid #e4e4e7; border-radius: 8px; padding: 2rem; box-sizing: border-box; }
+    h1 { font-size: 1.25rem; margin: 0 0 0.75rem; }
+    p { color: #52525b; line-height: 1.5; }
+    button { width: 100%; border: 1px solid #9a3412; border-radius: 4px; padding: 0.7rem 1rem; color: white; background: #c2410c; font: inherit; font-weight: 600; cursor: pointer; }
+  </style>
+</head>
+<body>
+  <main>
+    <h1>Connect ${escapeHtml(label)}</h1>
+    <p>Claude will use the shared Kadoa service account for this organization. Activity will not be attributed to your individual Kadoa identity.</p>
+    <form method="POST" action="/auth/service-account">
+      <input type="hidden" name="state" value="${escapeHtml(state)}" />
+      <button type="submit">Continue with shared workspace</button>
+    </form>
+  </main>
+</body>
+</html>`;
+}
 function renderTeamSelectionPage(teams, selectionToken) {
   const teamButtons = teams.map((t) => `
       <button type="submit" name="teamId" value="${t.id}" class="team-btn">
@@ -58542,6 +58739,7 @@ function escapeHtml(str) {
 var TEAM_SELECTION_TTL, ACCESS_TOKEN_TTL;
 var init_auth2 = __esm(() => {
   init_errors4();
+  init_service_account_config();
   TEAM_SELECTION_TTL = 10 * 60 * 1000;
   ACCESS_TOKEN_TTL = 7 * 24 * 3600;
 });
@@ -58657,14 +58855,21 @@ function jwtClaims2(jwt2) {
 }
 function resolveAuth(req) {
   const extra = req.auth?.extra;
-  if (!extra) {
-    console.error("[AUTH_RESOLVE] FAIL: req.auth.extra is missing");
+  if (!extra || !extra.principal || typeof extra.principal !== "object") {
+    console.error("[AUTH_RESOLVE] FAIL: req.auth.extra.principal is missing");
     return;
   }
-  if (typeof extra.supabaseJwt === "string") {
-    const claims = jwtClaims2(extra.supabaseJwt);
-    const userId = claims.sub;
-    if (!userId) {
+  const principal = extra.principal;
+  if (principal.type === "serviceAccount") {
+    if (!principal.credentialRef || !principal.teamId) {
+      console.error("[AUTH_RESOLVE] FAIL: service-account principal is incomplete");
+      return;
+    }
+    return { principal, mcpToken: req.auth.token };
+  }
+  if (principal.type === "user") {
+    const claims = jwtClaims2(principal.supabaseJwt);
+    if (!claims.sub) {
       console.error(`[AUTH_RESOLVE] FAIL: JWT missing sub claim (email=${claims.email ?? "unknown"})`);
       return;
     }
@@ -58672,20 +58877,14 @@ function resolveAuth(req) {
     if (exp) {
       const remainingSec = exp - Math.floor(Date.now() / 1000);
       if (remainingSec <= 0) {
-        console.error(`[AUTH_RESOLVE] WARN: JWT already expired ${-remainingSec}s ago (email=${claims.email}, team=${extra.teamId})`);
+        console.error(`[AUTH_RESOLVE] WARN: JWT already expired ${-remainingSec}s ago (team=${principal.teamId})`);
       } else if (remainingSec < 300) {
-        console.error(`[AUTH_RESOLVE] WARN: JWT expires in ${remainingSec}s (email=${claims.email}, team=${extra.teamId})`);
+        console.error(`[AUTH_RESOLVE] WARN: JWT expires in ${remainingSec}s (team=${principal.teamId})`);
       }
     }
-    return {
-      jwt: extra.supabaseJwt,
-      refreshToken: extra.supabaseRefreshToken ?? "",
-      teamId: extra.teamId ?? "",
-      userId,
-      mcpToken: req.auth.token
-    };
+    return { principal, mcpToken: req.auth.token };
   }
-  console.error(`[AUTH_RESOLVE] FAIL: no supabaseJwt in extra (keys: ${Object.keys(extra).join(", ")})`);
+  console.error("[AUTH_RESOLVE] FAIL: unknown principal type");
   return;
 }
 async function startHttpServer(options) {
@@ -58710,6 +58909,9 @@ async function startHttpServer(options) {
   app.post("/auth/login", express8.urlencoded({ extended: false }), (req, res) => {
     provider.handleEmailPasswordLogin(req, res);
   });
+  app.post("/auth/service-account", express8.urlencoded({ extended: false }), (req, res) => {
+    provider.handleServiceAccountConsent(req, res);
+  });
   app.post("/auth/sso", express8.urlencoded({ extended: false }), (req, res) => {
     provider.handleSSOLogin(req, res);
   });
@@ -58735,19 +58937,24 @@ async function startHttpServer(options) {
       });
       return;
     }
-    const identity2 = `jwt:${auth.userId.slice(0, 8)}...:team=${auth.teamId.slice(0, 8)}...`;
-    if (isJwtExpired(auth.jwt)) {
+    let principal = auth.principal;
+    const identity2 = `mode=${principal.type}:team=${principal.teamId.slice(0, 8)}...`;
+    if (principal.type === "user" && isJwtExpired(principal.supabaseJwt)) {
       try {
-        const refreshed = await refreshSupabaseJwtRaw(auth.refreshToken);
+        const refreshed = await refreshSupabaseJwtRaw(principal.supabaseRefreshToken);
         if (refreshed) {
-          auth.jwt = refreshed.jwt;
-          auth.refreshToken = refreshed.refreshToken;
+          principal = {
+            ...principal,
+            supabaseJwt: refreshed.jwt,
+            supabaseRefreshToken: refreshed.refreshToken
+          };
           const entry = await store.get("access_tokens", auth.mcpToken);
           if (entry) {
             const remainingMs = entry.expiresAt - Date.now();
             if (remainingMs > 0) {
               await store.set("access_tokens", auth.mcpToken, {
                 ...entry,
+                principal,
                 supabaseJwt: refreshed.jwt,
                 supabaseRefreshToken: refreshed.refreshToken
               }, Math.ceil(remainingMs / 1000));
@@ -58774,31 +58981,32 @@ async function startHttpServer(options) {
       const transport = new StreamableHTTPServerTransport({
         sessionIdGenerator: undefined
       });
-      const server = await createServer({
-        jwt: auth.jwt,
-        refreshToken: auth.refreshToken,
-        teamId: auth.teamId,
-        persist: async (state) => {
-          const entry = await store.get("access_tokens", auth.mcpToken);
-          if (!entry) {
-            console.error(`[PERSIST] WARN: access token gone from store (token=${auth.mcpToken.slice(0, 12)}...)`);
-            return;
-          }
-          const remainingMs = entry.expiresAt - Date.now();
-          if (remainingMs <= 0) {
-            console.error(`[PERSIST] WARN: access token already expired, skipping persist`);
-            return;
-          }
-          const ttlSeconds = Math.ceil(remainingMs / 1000);
-          await store.set("access_tokens", auth.mcpToken, {
-            ...entry,
-            supabaseJwt: state.supabaseJwt ?? entry.supabaseJwt,
-            supabaseRefreshToken: state.supabaseRefreshToken ?? entry.supabaseRefreshToken,
-            teamId: state.teamId ?? entry.teamId
-          }, ttlSeconds);
-          console.error(`[PERSIST] OK: updated access token in store (token=${auth.mcpToken.slice(0, 12)}..., team=${state.teamId ?? "unchanged"}, ttl=${ttlSeconds}s)`);
+      const persist = principal.type === "user" ? async (state) => {
+        const entry = await store.get("access_tokens", auth.mcpToken);
+        if (!entry) {
+          console.error("[PERSIST] WARN: access token gone from store");
+          return;
         }
-      });
+        const remainingMs = entry.expiresAt - Date.now();
+        if (remainingMs <= 0) {
+          console.error("[PERSIST] WARN: access token already expired, skipping persist");
+          return;
+        }
+        const updatedPrincipal = {
+          type: "user",
+          supabaseJwt: state.supabaseJwt ?? principal.supabaseJwt,
+          supabaseRefreshToken: state.supabaseRefreshToken ?? principal.supabaseRefreshToken,
+          teamId: state.teamId ?? principal.teamId
+        };
+        await store.set("access_tokens", auth.mcpToken, {
+          ...entry,
+          principal: updatedPrincipal,
+          supabaseJwt: updatedPrincipal.supabaseJwt,
+          supabaseRefreshToken: updatedPrincipal.supabaseRefreshToken,
+          teamId: updatedPrincipal.teamId
+        }, Math.ceil(remainingMs / 1000));
+      } : undefined;
+      const server = await createServer({ principal, persist });
       await server.connect(transport);
       await transport.handleRequest(req, res, req.body);
     } catch (error48) {
@@ -58852,11 +59060,18 @@ var init_http2 = __esm(async () => {
 
 // src/index.ts
 async function createServer(auth, options) {
-  const ctx = {
-    client: createKadoaClient({ jwt: auth.jwt, teamId: auth.teamId }),
+  const principal = "principal" in auth ? auth.principal : {
+    type: "user",
     supabaseJwt: auth.jwt,
     supabaseRefreshToken: auth.refreshToken,
-    teamId: auth.teamId,
+    teamId: auth.teamId
+  };
+  const ctx = {
+    client: createKadoaClient({ principal }),
+    principal,
+    supabaseJwt: principal.type === "user" ? principal.supabaseJwt : undefined,
+    supabaseRefreshToken: principal.type === "user" ? principal.supabaseRefreshToken : undefined,
+    teamId: principal.teamId,
     persist: auth.persist
   };
   const server = new McpServer({ name: "kadoa", version: package_default.version }, {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@kadoa/mcp",
-  "version": "0.5.10",
+  "version": "0.5.11",
   "description": "Kadoa MCP Server — manage workflows from Claude Desktop, Cursor, and other MCP clients",
   "type": "module",
   "main": "dist/index.js",