runline 0.5.2 → 0.6.0

package/dist/plugins/_shared/googleAuth.js

@@ -0,0 +1,113 @@
+import { createSign } from "node:crypto";
+const TOKEN_ENDPOINT = "https://oauth2.googleapis.com/token";
+const REFRESH_SKEW_MS = 60_000;
+export async function googleAccessToken(ctx, pluginName, scopes) {
+    const cfg = ctx.connection.config;
+    if (cfg.accessToken &&
+        typeof cfg.accessTokenExpiresAt === "number" &&
+        Date.now() < cfg.accessTokenExpiresAt - REFRESH_SKEW_MS) {
+        return cfg.accessToken;
+    }
+    if (hasServiceAccountConfig(cfg)) {
+        return refreshServiceAccountAccessToken(ctx, pluginName, cfg, scopes);
+    }
+    return refreshOAuthAccessToken(ctx, pluginName, cfg);
+}
+function hasServiceAccountConfig(cfg) {
+    return !!cfg.serviceAccountJson || !!(cfg.serviceAccountEmail && cfg.serviceAccountPrivateKey);
+}
+async function refreshOAuthAccessToken(ctx, pluginName, cfg) {
+    const { clientId, clientSecret, refreshToken } = cfg;
+    if (!clientId || !clientSecret || !refreshToken) {
+        throw new Error(`${pluginName}: missing OAuth clientId/clientSecret/refreshToken or service account credentials. Run the OAuth helper or set serviceAccountJson.`);
+    }
+    const body = new URLSearchParams({
+        client_id: clientId,
+        client_secret: clientSecret,
+        refresh_token: refreshToken,
+        grant_type: "refresh_token",
+    });
+    const res = await fetch(TOKEN_ENDPOINT, {
+        method: "POST",
+        headers: { "Content-Type": "application/x-www-form-urlencoded" },
+        body: body.toString(),
+    });
+    if (!res.ok) {
+        throw new Error(`${pluginName}: token refresh failed (${res.status}): ${await res.text()}`);
+    }
+    const data = (await res.json());
+    const expiresAt = Date.now() + data.expires_in * 1000;
+    await ctx.updateConnection({
+        accessToken: data.access_token,
+        accessTokenExpiresAt: expiresAt,
+    });
+    return data.access_token;
+}
+async function refreshServiceAccountAccessToken(ctx, pluginName, cfg, scopes) {
+    const serviceAccount = parseServiceAccount(pluginName, cfg);
+    const now = Math.floor(Date.now() / 1000);
+    const assertion = signJwt({
+        alg: "RS256",
+        typ: "JWT",
+    }, {
+        iss: serviceAccount.client_email,
+        scope: scopes.join(" "),
+        aud: TOKEN_ENDPOINT,
+        iat: now,
+        exp: now + 3600,
+        ...(cfg.serviceAccountSubject ? { sub: cfg.serviceAccountSubject } : {}),
+    }, serviceAccount.private_key);
+    const body = new URLSearchParams({
+        grant_type: "urn:ietf:params:oauth:grant-type:jwt-bearer",
+        assertion,
+    });
+    const res = await fetch(TOKEN_ENDPOINT, {
+        method: "POST",
+        headers: { "Content-Type": "application/x-www-form-urlencoded" },
+        body: body.toString(),
+    });
+    if (!res.ok) {
+        throw new Error(`${pluginName}: service account token failed (${res.status}): ${await res.text()}`);
+    }
+    const data = (await res.json());
+    const expiresAt = Date.now() + data.expires_in * 1000;
+    await ctx.updateConnection({
+        accessToken: data.access_token,
+        accessTokenExpiresAt: expiresAt,
+    });
+    return data.access_token;
+}
+function parseServiceAccount(pluginName, cfg) {
+    if (cfg.serviceAccountJson) {
+        try {
+            const parsed = JSON.parse(cfg.serviceAccountJson);
+            if (parsed.client_email && parsed.private_key) {
+                return { client_email: parsed.client_email, private_key: parsed.private_key };
+            }
+        }
+        catch (err) {
+            throw new Error(`${pluginName}: invalid serviceAccountJson: ${err.message}`);
+        }
+    }
+    if (cfg.serviceAccountEmail && cfg.serviceAccountPrivateKey) {
+        return {
+            client_email: cfg.serviceAccountEmail,
+            private_key: cfg.serviceAccountPrivateKey.replace(/\\n/g, "\n"),
+        };
+    }
+    throw new Error(`${pluginName}: service account requires serviceAccountJson or serviceAccountEmail/serviceAccountPrivateKey`);
+}
+function signJwt(header, payload, privateKey) {
+    const encodedHeader = base64url(JSON.stringify(header));
+    const encodedPayload = base64url(JSON.stringify(payload));
+    const signingInput = `${encodedHeader}.${encodedPayload}`;
+    const signer = createSign("RSA-SHA256");
+    signer.update(signingInput);
+    signer.end();
+    const signature = signer.sign(privateKey.replace(/\\n/g, "\n"));
+    return `${signingInput}.${base64url(signature)}`;
+}
+function base64url(input) {
+    const buf = typeof input === "string" ? Buffer.from(input, "utf-8") : input;
+    return buf.toString("base64").replace(/\+/g, "-").replace(/\//g, "_").replace(/=+$/, "");
+}

package/dist/plugins/gmail/src/index.js

@@ -20,46 +20,10 @@
  * raw Gmail API response (including base64url `raw` for format=raw,
  * or parsed `payload` tree for format=full).
  */
-// ─── OAuth ───────────────────────────────────────────────────────
-const TOKEN_ENDPOINT = "https://oauth2.googleapis.com/token";
-const REFRESH_SKEW_MS = 60_000;
-async function refreshAccessToken(ctx) {
-    const cfg = ctx.connection.config;
-    const { clientId, clientSecret, refreshToken } = cfg;
-    if (!clientId || !clientSecret || !refreshToken) {
-        throw new Error("gmail: missing clientId/clientSecret/refreshToken. Run the Gmail OAuth helper to seed these.");
-    }
-    const body = new URLSearchParams({
-        client_id: clientId,
-        client_secret: clientSecret,
-        refresh_token: refreshToken,
-        grant_type: "refresh_token",
-    });
-    const res = await fetch(TOKEN_ENDPOINT, {
-        method: "POST",
-        headers: { "Content-Type": "application/x-www-form-urlencoded" },
-        body: body.toString(),
-    });
-    if (!res.ok) {
-        const text = await res.text();
-        throw new Error(`gmail: token refresh failed (${res.status}): ${text}`);
-    }
-    const data = (await res.json());
-    const expiresAt = Date.now() + data.expires_in * 1000;
-    await ctx.updateConnection({
-        accessToken: data.access_token,
-        accessTokenExpiresAt: expiresAt,
-    });
-    return data.access_token;
-}
+import { googleAccessToken } from "../../_shared/googleAuth.js";
+// ─── Auth ────────────────────────────────────────────────────────
 async function accessToken(ctx) {
-    const cfg = ctx.connection.config;
-    if (cfg.accessToken &&
-        typeof cfg.accessTokenExpiresAt === "number" &&
-        Date.now() < cfg.accessTokenExpiresAt - REFRESH_SKEW_MS) {
-        return cfg.accessToken;
-    }
-    return refreshAccessToken(ctx);
+    return googleAccessToken(ctx, "gmail", SCOPES);
 }
 // ─── Request ─────────────────────────────────────────────────────
 const API_BASE = "https://gmail.googleapis.com/gmail/v1/users/me";
@@ -527,22 +491,46 @@ export default function gmail(rl) {
     rl.setConnectionSchema({
         clientId: {
             type: "string",
-            required: true,
+            required: false,
             description: "Google OAuth2 client ID",
             env: "GMAIL_CLIENT_ID",
         },
         clientSecret: {
             type: "string",
-            required: true,
+            required: false,
             description: "Google OAuth2 client secret",
             env: "GMAIL_CLIENT_SECRET",
         },
         refreshToken: {
             type: "string",
-            required: true,
+            required: false,
             description: "OAuth2 refresh token (obtained via login flow)",
             env: "GMAIL_REFRESH_TOKEN",
         },
+        serviceAccountJson: {
+            type: "string",
+            required: false,
+            description: "Google service account JSON credential",
+            env: "GMAIL_SERVICE_ACCOUNT_JSON",
+        },
+        serviceAccountEmail: {
+            type: "string",
+            required: false,
+            description: "Google service account email",
+            env: "GMAIL_SERVICE_ACCOUNT_EMAIL",
+        },
+        serviceAccountPrivateKey: {
+            type: "string",
+            required: false,
+            description: "Google service account private key",
+            env: "GMAIL_SERVICE_ACCOUNT_PRIVATE_KEY",
+        },
+        serviceAccountSubject: {
+            type: "string",
+            required: false,
+            description: "User email to impersonate with domain-wide delegation",
+            env: "GMAIL_SERVICE_ACCOUNT_SUBJECT",
+        },
         accessToken: {
             type: "string",
             required: false,

package/dist/plugins/googleCalendar/src/index.js

@@ -28,48 +28,12 @@
  * call `event.listInstances`.
  */
 import rrulePkg from "rrule";
+import { googleAccessToken } from "../../_shared/googleAuth.js";
 // `rrule` ships as CJS; named imports fail under Node ESM.
 const { RRule } = rrulePkg;
-// ─── OAuth ───────────────────────────────────────────────────────
-const TOKEN_ENDPOINT = "https://oauth2.googleapis.com/token";
-const REFRESH_SKEW_MS = 60_000;
-async function refreshAccessToken(ctx) {
-    const cfg = ctx.connection.config;
-    const { clientId, clientSecret, refreshToken } = cfg;
-    if (!clientId || !clientSecret || !refreshToken) {
-        throw new Error("googleCalendar: missing clientId/clientSecret/refreshToken. Run the Google Calendar OAuth helper to seed these.");
-    }
-    const body = new URLSearchParams({
-        client_id: clientId,
-        client_secret: clientSecret,
-        refresh_token: refreshToken,
-        grant_type: "refresh_token",
-    });
-    const res = await fetch(TOKEN_ENDPOINT, {
-        method: "POST",
-        headers: { "Content-Type": "application/x-www-form-urlencoded" },
-        body: body.toString(),
-    });
-    if (!res.ok) {
-        const text = await res.text();
-        throw new Error(`googleCalendar: token refresh failed (${res.status}): ${text}`);
-    }
-    const data = (await res.json());
-    const expiresAt = Date.now() + data.expires_in * 1000;
-    await ctx.updateConnection({
-        accessToken: data.access_token,
-        accessTokenExpiresAt: expiresAt,
-    });
-    return data.access_token;
-}
+// ─── Auth ────────────────────────────────────────────────────────
 async function accessToken(ctx) {
-    const cfg = ctx.connection.config;
-    if (cfg.accessToken &&
-        typeof cfg.accessTokenExpiresAt === "number" &&
-        Date.now() < cfg.accessTokenExpiresAt - REFRESH_SKEW_MS) {
-        return cfg.accessToken;
-    }
-    return refreshAccessToken(ctx);
+    return googleAccessToken(ctx, "googleCalendar", SCOPES);
 }
 // ─── Request ─────────────────────────────────────────────────────
 const API_BASE = "https://www.googleapis.com/calendar/v3";
@@ -328,22 +292,46 @@ export default function googleCalendar(rl) {
     rl.setConnectionSchema({
         clientId: {
             type: "string",
-            required: true,
+            required: false,
             description: "Google OAuth2 client ID",
             env: "GOOGLE_CALENDAR_CLIENT_ID",
         },
         clientSecret: {
             type: "string",
-            required: true,
+            required: false,
             description: "Google OAuth2 client secret",
             env: "GOOGLE_CALENDAR_CLIENT_SECRET",
         },
         refreshToken: {
             type: "string",
-            required: true,
+            required: false,
             description: "OAuth2 refresh token (obtained via login flow)",
             env: "GOOGLE_CALENDAR_REFRESH_TOKEN",
         },
+        serviceAccountJson: {
+            type: "string",
+            required: false,
+            description: "Google service account JSON credential",
+            env: "GOOGLE_CALENDAR_SERVICE_ACCOUNT_JSON",
+        },
+        serviceAccountEmail: {
+            type: "string",
+            required: false,
+            description: "Google service account email",
+            env: "GOOGLE_CALENDAR_SERVICE_ACCOUNT_EMAIL",
+        },
+        serviceAccountPrivateKey: {
+            type: "string",
+            required: false,
+            description: "Google service account private key",
+            env: "GOOGLE_CALENDAR_SERVICE_ACCOUNT_PRIVATE_KEY",
+        },
+        serviceAccountSubject: {
+            type: "string",
+            required: false,
+            description: "User email to impersonate with domain-wide delegation",
+            env: "GOOGLE_CALENDAR_SERVICE_ACCOUNT_SUBJECT",
+        },
         accessToken: {
             type: "string",
             required: false,

package/dist/plugins/googleContacts/src/index.js

@@ -22,6 +22,7 @@
  * the bare ID and normalize. The response always includes a
  * convenience `contactId` field stripped from `resourceName`.
  */
+import { googleAccessToken } from "../../_shared/googleAuth.js";
 // ─── Fields ─────────────────────────────────────────────────────
 /**
  * Every `personFields` value supported by People API get/list calls.
@@ -78,45 +79,9 @@ const UPDATABLE_PERSON_FIELDS = new Set([
     "urls",
     "userDefined",
 ]);
-// ─── OAuth ───────────────────────────────────────────────────────
-const TOKEN_ENDPOINT = "https://oauth2.googleapis.com/token";
-const REFRESH_SKEW_MS = 60_000;
-async function refreshAccessToken(ctx) {
-    const cfg = ctx.connection.config;
-    const { clientId, clientSecret, refreshToken } = cfg;
-    if (!clientId || !clientSecret || !refreshToken) {
-        throw new Error("googleContacts: missing clientId/clientSecret/refreshToken. Run the Contacts OAuth helper to seed these.");
-    }
-    const body = new URLSearchParams({
-        client_id: clientId,
-        client_secret: clientSecret,
-        refresh_token: refreshToken,
-        grant_type: "refresh_token",
-    });
-    const res = await fetch(TOKEN_ENDPOINT, {
-        method: "POST",
-        headers: { "Content-Type": "application/x-www-form-urlencoded" },
-        body: body.toString(),
-    });
-    if (!res.ok) {
-        throw new Error(`googleContacts: token refresh failed (${res.status}): ${await res.text()}`);
-    }
-    const data = (await res.json());
-    const expiresAt = Date.now() + data.expires_in * 1000;
-    await ctx.updateConnection({
-        accessToken: data.access_token,
-        accessTokenExpiresAt: expiresAt,
-    });
-    return data.access_token;
-}
+// ─── Auth ────────────────────────────────────────────────────────
 async function accessToken(ctx) {
-    const cfg = ctx.connection.config;
-    if (cfg.accessToken &&
-        typeof cfg.accessTokenExpiresAt === "number" &&
-        Date.now() < cfg.accessTokenExpiresAt - REFRESH_SKEW_MS) {
-        return cfg.accessToken;
-    }
-    return refreshAccessToken(ctx);
+    return googleAccessToken(ctx, "googleContacts", SCOPES);
 }
 // ─── Request ─────────────────────────────────────────────────────
 const API_BASE = "https://people.googleapis.com/v1";
@@ -349,9 +314,13 @@ export default function googleContacts(rl) {
         ],
     });
     rl.setConnectionSchema({
-        clientId: { type: "string", required: true, env: "GOOGLE_CONTACTS_CLIENT_ID" },
-        clientSecret: { type: "string", required: true, env: "GOOGLE_CONTACTS_CLIENT_SECRET" },
-        refreshToken: { type: "string", required: true, env: "GOOGLE_CONTACTS_REFRESH_TOKEN" },
+        clientId: { type: "string", required: false, env: "GOOGLE_CONTACTS_CLIENT_ID" },
+        clientSecret: { type: "string", required: false, env: "GOOGLE_CONTACTS_CLIENT_SECRET" },
+        refreshToken: { type: "string", required: false, env: "GOOGLE_CONTACTS_REFRESH_TOKEN" },
+        serviceAccountJson: { type: "string", required: false, env: "GOOGLE_CONTACTS_SERVICE_ACCOUNT_JSON" },
+        serviceAccountEmail: { type: "string", required: false, env: "GOOGLE_CONTACTS_SERVICE_ACCOUNT_EMAIL" },
+        serviceAccountPrivateKey: { type: "string", required: false, env: "GOOGLE_CONTACTS_SERVICE_ACCOUNT_PRIVATE_KEY" },
+        serviceAccountSubject: { type: "string", required: false, env: "GOOGLE_CONTACTS_SERVICE_ACCOUNT_SUBJECT" },
         accessToken: { type: "string", required: false },
         accessTokenExpiresAt: { type: "number", required: false },
     });

package/dist/plugins/googleDocs/src/index.js

@@ -36,45 +36,10 @@
  * with a single request; callers who need to chain multiple edits
  * atomically can compose them via `document.batchUpdate`.
  */
-// ─── OAuth ───────────────────────────────────────────────────────
-const TOKEN_ENDPOINT = "https://oauth2.googleapis.com/token";
-const REFRESH_SKEW_MS = 60_000;
-async function refreshAccessToken(ctx) {
-    const cfg = ctx.connection.config;
-    const { clientId, clientSecret, refreshToken } = cfg;
-    if (!clientId || !clientSecret || !refreshToken) {
-        throw new Error("googleDocs: missing clientId/clientSecret/refreshToken. Run the Docs OAuth helper to seed these.");
-    }
-    const body = new URLSearchParams({
-        client_id: clientId,
-        client_secret: clientSecret,
-        refresh_token: refreshToken,
-        grant_type: "refresh_token",
-    });
-    const res = await fetch(TOKEN_ENDPOINT, {
-        method: "POST",
-        headers: { "Content-Type": "application/x-www-form-urlencoded" },
-        body: body.toString(),
-    });
-    if (!res.ok) {
-        throw new Error(`googleDocs: token refresh failed (${res.status}): ${await res.text()}`);
-    }
-    const data = (await res.json());
-    const expiresAt = Date.now() + data.expires_in * 1000;
-    await ctx.updateConnection({
-        accessToken: data.access_token,
-        accessTokenExpiresAt: expiresAt,
-    });
-    return data.access_token;
-}
+import { googleAccessToken } from "../../_shared/googleAuth.js";
+// ─── Auth ────────────────────────────────────────────────────────
 async function accessToken(ctx) {
-    const cfg = ctx.connection.config;
-    if (cfg.accessToken &&
-        typeof cfg.accessTokenExpiresAt === "number" &&
-        Date.now() < cfg.accessTokenExpiresAt - REFRESH_SKEW_MS) {
-        return cfg.accessToken;
-    }
-    return refreshAccessToken(ctx);
+    return googleAccessToken(ctx, "googleDocs", SCOPES);
 }
 // ─── Request ─────────────────────────────────────────────────────
 const DOCS_BASE = "https://docs.googleapis.com/v1";
@@ -206,9 +171,13 @@ export default function googleDocs(rl) {
         ],
     });
     rl.setConnectionSchema({
-        clientId: { type: "string", required: true, env: "GOOGLE_DOCS_CLIENT_ID" },
-        clientSecret: { type: "string", required: true, env: "GOOGLE_DOCS_CLIENT_SECRET" },
-        refreshToken: { type: "string", required: true, env: "GOOGLE_DOCS_REFRESH_TOKEN" },
+        clientId: { type: "string", required: false, env: "GOOGLE_DOCS_CLIENT_ID" },
+        clientSecret: { type: "string", required: false, env: "GOOGLE_DOCS_CLIENT_SECRET" },
+        refreshToken: { type: "string", required: false, env: "GOOGLE_DOCS_REFRESH_TOKEN" },
+        serviceAccountJson: { type: "string", required: false, env: "GOOGLE_DOCS_SERVICE_ACCOUNT_JSON" },
+        serviceAccountEmail: { type: "string", required: false, env: "GOOGLE_DOCS_SERVICE_ACCOUNT_EMAIL" },
+        serviceAccountPrivateKey: { type: "string", required: false, env: "GOOGLE_DOCS_SERVICE_ACCOUNT_PRIVATE_KEY" },
+        serviceAccountSubject: { type: "string", required: false, env: "GOOGLE_DOCS_SERVICE_ACCOUNT_SUBJECT" },
         accessToken: { type: "string", required: false },
         accessTokenExpiresAt: { type: "number", required: false },
     });

package/dist/plugins/googleDrive/src/index.js

@@ -36,6 +36,7 @@
  * (Buffer) vs a path (streamed).
  */
 import { createReadStream, readFileSync, statSync, writeFileSync } from "node:fs";
+import { googleAccessToken } from "../../_shared/googleAuth.js";
 // ─── MIME constants ──────────────────────────────────────────────
 const DRIVE = {
     FOLDER: "application/vnd.google-apps.folder",
@@ -55,46 +56,9 @@ const DRIVE = {
     FUSIONTABLE: "application/vnd.google-apps.fusiontable",
     UNKNOWN: "application/vnd.google-apps.unknown",
 };
-// ─── OAuth ───────────────────────────────────────────────────────
-const TOKEN_ENDPOINT = "https://oauth2.googleapis.com/token";
-const REFRESH_SKEW_MS = 60_000;
-async function refreshAccessToken(ctx) {
-    const cfg = ctx.connection.config;
-    const { clientId, clientSecret, refreshToken } = cfg;
-    if (!clientId || !clientSecret || !refreshToken) {
-        throw new Error("googleDrive: missing clientId/clientSecret/refreshToken. Run the Google Drive OAuth helper to seed these.");
-    }
-    const body = new URLSearchParams({
-        client_id: clientId,
-        client_secret: clientSecret,
-        refresh_token: refreshToken,
-        grant_type: "refresh_token",
-    });
-    const res = await fetch(TOKEN_ENDPOINT, {
-        method: "POST",
-        headers: { "Content-Type": "application/x-www-form-urlencoded" },
-        body: body.toString(),
-    });
-    if (!res.ok) {
-        const text = await res.text();
-        throw new Error(`googleDrive: token refresh failed (${res.status}): ${text}`);
-    }
-    const data = (await res.json());
-    const expiresAt = Date.now() + data.expires_in * 1000;
-    await ctx.updateConnection({
-        accessToken: data.access_token,
-        accessTokenExpiresAt: expiresAt,
-    });
-    return data.access_token;
-}
+// ─── Auth ────────────────────────────────────────────────────────
 async function accessToken(ctx) {
-    const cfg = ctx.connection.config;
-    if (cfg.accessToken &&
-        typeof cfg.accessTokenExpiresAt === "number" &&
-        Date.now() < cfg.accessTokenExpiresAt - REFRESH_SKEW_MS) {
-        return cfg.accessToken;
-    }
-    return refreshAccessToken(ctx);
+    return googleAccessToken(ctx, "googleDrive", SCOPES);
 }
 // ─── Request ─────────────────────────────────────────────────────
 const API_BASE = "https://www.googleapis.com";
@@ -408,22 +372,46 @@ export default function googleDrive(rl) {
     rl.setConnectionSchema({
         clientId: {
             type: "string",
-            required: true,
+            required: false,
             description: "Google OAuth2 client ID",
             env: "GOOGLE_DRIVE_CLIENT_ID",
         },
         clientSecret: {
             type: "string",
-            required: true,
+            required: false,
             description: "Google OAuth2 client secret",
             env: "GOOGLE_DRIVE_CLIENT_SECRET",
         },
         refreshToken: {
             type: "string",
-            required: true,
+            required: false,
             description: "OAuth2 refresh token",
             env: "GOOGLE_DRIVE_REFRESH_TOKEN",
         },
+        serviceAccountJson: {
+            type: "string",
+            required: false,
+            description: "Google service account JSON credential",
+            env: "GOOGLE_DRIVE_SERVICE_ACCOUNT_JSON",
+        },
+        serviceAccountEmail: {
+            type: "string",
+            required: false,
+            description: "Google service account email",
+            env: "GOOGLE_DRIVE_SERVICE_ACCOUNT_EMAIL",
+        },
+        serviceAccountPrivateKey: {
+            type: "string",
+            required: false,
+            description: "Google service account private key",
+            env: "GOOGLE_DRIVE_SERVICE_ACCOUNT_PRIVATE_KEY",
+        },
+        serviceAccountSubject: {
+            type: "string",
+            required: false,
+            description: "User email to impersonate with domain-wide delegation",
+            env: "GOOGLE_DRIVE_SERVICE_ACCOUNT_SUBJECT",
+        },
         accessToken: { type: "string", required: false },
         accessTokenExpiresAt: { type: "number", required: false },
     });

package/dist/plugins/googleSheets/src/index.js

@@ -28,46 +28,11 @@
  * Filtering is intentionally the caller's job — `read` returns
  * raw rows / objects and callers post-filter.
  */
+import { googleAccessToken } from "../../_shared/googleAuth.js";
 const ROW_NUMBER = "row_number";
-// ─── OAuth ───────────────────────────────────────────────────────
-const TOKEN_ENDPOINT = "https://oauth2.googleapis.com/token";
-const REFRESH_SKEW_MS = 60_000;
-async function refreshAccessToken(ctx) {
-    const cfg = ctx.connection.config;
-    const { clientId, clientSecret, refreshToken } = cfg;
-    if (!clientId || !clientSecret || !refreshToken) {
-        throw new Error("googleSheets: missing clientId/clientSecret/refreshToken. Run the Sheets OAuth helper to seed these.");
-    }
-    const body = new URLSearchParams({
-        client_id: clientId,
-        client_secret: clientSecret,
-        refresh_token: refreshToken,
-        grant_type: "refresh_token",
-    });
-    const res = await fetch(TOKEN_ENDPOINT, {
-        method: "POST",
-        headers: { "Content-Type": "application/x-www-form-urlencoded" },
-        body: body.toString(),
-    });
-    if (!res.ok) {
-        throw new Error(`googleSheets: token refresh failed (${res.status}): ${await res.text()}`);
-    }
-    const data = (await res.json());
-    const expiresAt = Date.now() + data.expires_in * 1000;
-    await ctx.updateConnection({
-        accessToken: data.access_token,
-        accessTokenExpiresAt: expiresAt,
-    });
-    return data.access_token;
-}
+// ─── Auth ────────────────────────────────────────────────────────
 async function accessToken(ctx) {
-    const cfg = ctx.connection.config;
-    if (cfg.accessToken &&
-        typeof cfg.accessTokenExpiresAt === "number" &&
-        Date.now() < cfg.accessTokenExpiresAt - REFRESH_SKEW_MS) {
-        return cfg.accessToken;
-    }
-    return refreshAccessToken(ctx);
+    return googleAccessToken(ctx, "googleSheets", SCOPES);
 }
 // ─── Request ─────────────────────────────────────────────────────
 const SHEETS_BASE = "https://sheets.googleapis.com";
@@ -387,22 +352,46 @@ export default function googleSheets(rl) {
     rl.setConnectionSchema({
         clientId: {
             type: "string",
-            required: true,
+            required: false,
             description: "Google OAuth2 client ID",
             env: "GOOGLE_SHEETS_CLIENT_ID",
         },
         clientSecret: {
             type: "string",
-            required: true,
+            required: false,
             description: "Google OAuth2 client secret",
             env: "GOOGLE_SHEETS_CLIENT_SECRET",
         },
         refreshToken: {
             type: "string",
-            required: true,
+            required: false,
             description: "OAuth2 refresh token",
             env: "GOOGLE_SHEETS_REFRESH_TOKEN",
         },
+        serviceAccountJson: {
+            type: "string",
+            required: false,
+            description: "Google service account JSON credential",
+            env: "GOOGLE_SHEETS_SERVICE_ACCOUNT_JSON",
+        },
+        serviceAccountEmail: {
+            type: "string",
+            required: false,
+            description: "Google service account email",
+            env: "GOOGLE_SHEETS_SERVICE_ACCOUNT_EMAIL",
+        },
+        serviceAccountPrivateKey: {
+            type: "string",
+            required: false,
+            description: "Google service account private key",
+            env: "GOOGLE_SHEETS_SERVICE_ACCOUNT_PRIVATE_KEY",
+        },
+        serviceAccountSubject: {
+            type: "string",
+            required: false,
+            description: "User email to impersonate with domain-wide delegation",
+            env: "GOOGLE_SHEETS_SERVICE_ACCOUNT_SUBJECT",
+        },
         accessToken: { type: "string", required: false },
         accessTokenExpiresAt: { type: "number", required: false },
     });