@contentgrowth/llm-service 1.4.0 → 1.4.1

package/dist/index.d.cts

@@ -2,6 +2,7 @@ import OpenAI from 'openai';
 import Anthropic from '@anthropic-ai/sdk';
 import { GoogleGenAI } from '@google/genai';
 export { Modality } from '@google/genai';
+import { GoogleTokenManager } from './utils/google-auth.cjs';
 
 declare namespace FINISH_REASONS {
     let COMPLETED: string;
@@ -807,98 +808,6 @@ declare function handleApiError(error: Error, operation?: string, context?: stri
  */
 declare function sanitizeError(error: Error, context?: string): Error;
 
-/**
- * Google OAuth2 Token Manager
- *
- * Handles token generation, caching, and automatic refresh for
- * Google Cloud service accounts. Tokens are cached and automatically
- * refreshed when they expire (with a 5-minute safety buffer).
- *
- * @example
- * const sa = parseGoogleCredentials(credentials);
- * const tokenManager = new GoogleTokenManager(sa);
- *
- * // Get token (cached or fresh)
- * const token = await tokenManager.getToken();
- *
- * // Force refresh
- * tokenManager.invalidate();
- * const newToken = await tokenManager.getToken();
- */
-declare class GoogleTokenManager {
-    /**
-     * @param {object} serviceAccount - Parsed service account with client_email and private_key
-     * @param {object} options - Optional configuration
-     * @param {string} options.scope - OAuth2 scope (default: cloud-platform)
-     * @param {number} options.tokenLifetime - Token lifetime in seconds (default: 3600)
-     */
-    constructor(serviceAccount: object, options?: {
-        scope: string;
-        tokenLifetime: number;
-    });
-    clientEmail: any;
-    privateKey: any;
-    projectId: any;
-    scope: string;
-    tokenLifetime: number;
-    _tokenCache: string;
-    _expiresAt: number;
-    /**
-     * Get a valid access token (cached or fresh)
-     *
-     * @returns {Promise<string>} OAuth2 access token
-     */
-    getToken(): Promise<string>;
-    /**
-     * Clear cached token (force refresh on next getToken call)
-     */
-    invalidate(): void;
-    /**
-     * Check if cached token is still valid
-     *
-     * @returns {boolean} True if token is valid
-     */
-    isValid(): boolean;
-    /**
-     * Get time until token expires (in seconds)
-     *
-     * @returns {number} Seconds until expiration (0 if no token or expired)
-     */
-    getTimeToExpiry(): number;
-    /**
-     * Generate OAuth2 token via JWT flow
-     *
-     * @private
-     * @returns {Promise<string>} Access token
-     */
-    private _generateToken;
-    /**
-     * Sign JWT using service account private key
-     *
-     * @private
-     * @param {object} header - JWT header
-     * @param {object} payload - JWT payload
-     * @returns {Promise<string>} Signed JWT
-     */
-    private _signJWT;
-    /**
-     * Import PEM private key for signing
-     *
-     * @private
-     * @param {string} pemKey - PEM formatted private key
-     * @returns {Promise<CryptoKey>} Imported key
-     */
-    private _importPrivateKey;
-    /**
-     * Base64 URL encode (without padding)
-     *
-     * @private
-     * @param {string|ArrayBuffer} input - Data to encode
-     * @returns {string} Base64 URL encoded string
-     */
-    private _base64UrlEncode;
-}
-
 /**
  * Transcription Service - Separate from LLM Service
  * Handles audio-to-text transcription using various providers.

package/dist/index.d.ts

@@ -2,6 +2,7 @@ import OpenAI from 'openai';
 import Anthropic from '@anthropic-ai/sdk';
 import { GoogleGenAI } from '@google/genai';
 export { Modality } from '@google/genai';
+import { GoogleTokenManager } from './utils/google-auth.js';
 
 declare namespace FINISH_REASONS {
     let COMPLETED: string;
@@ -807,98 +808,6 @@ declare function handleApiError(error: Error, operation?: string, context?: stri
  */
 declare function sanitizeError(error: Error, context?: string): Error;
 
-/**
- * Google OAuth2 Token Manager
- *
- * Handles token generation, caching, and automatic refresh for
- * Google Cloud service accounts. Tokens are cached and automatically
- * refreshed when they expire (with a 5-minute safety buffer).
- *
- * @example
- * const sa = parseGoogleCredentials(credentials);
- * const tokenManager = new GoogleTokenManager(sa);
- *
- * // Get token (cached or fresh)
- * const token = await tokenManager.getToken();
- *
- * // Force refresh
- * tokenManager.invalidate();
- * const newToken = await tokenManager.getToken();
- */
-declare class GoogleTokenManager {
-    /**
-     * @param {object} serviceAccount - Parsed service account with client_email and private_key
-     * @param {object} options - Optional configuration
-     * @param {string} options.scope - OAuth2 scope (default: cloud-platform)
-     * @param {number} options.tokenLifetime - Token lifetime in seconds (default: 3600)
-     */
-    constructor(serviceAccount: object, options?: {
-        scope: string;
-        tokenLifetime: number;
-    });
-    clientEmail: any;
-    privateKey: any;
-    projectId: any;
-    scope: string;
-    tokenLifetime: number;
-    _tokenCache: string;
-    _expiresAt: number;
-    /**
-     * Get a valid access token (cached or fresh)
-     *
-     * @returns {Promise<string>} OAuth2 access token
-     */
-    getToken(): Promise<string>;
-    /**
-     * Clear cached token (force refresh on next getToken call)
-     */
-    invalidate(): void;
-    /**
-     * Check if cached token is still valid
-     *
-     * @returns {boolean} True if token is valid
-     */
-    isValid(): boolean;
-    /**
-     * Get time until token expires (in seconds)
-     *
-     * @returns {number} Seconds until expiration (0 if no token or expired)
-     */
-    getTimeToExpiry(): number;
-    /**
-     * Generate OAuth2 token via JWT flow
-     *
-     * @private
-     * @returns {Promise<string>} Access token
-     */
-    private _generateToken;
-    /**
-     * Sign JWT using service account private key
-     *
-     * @private
-     * @param {object} header - JWT header
-     * @param {object} payload - JWT payload
-     * @returns {Promise<string>} Signed JWT
-     */
-    private _signJWT;
-    /**
-     * Import PEM private key for signing
-     *
-     * @private
-     * @param {string} pemKey - PEM formatted private key
-     * @returns {Promise<CryptoKey>} Imported key
-     */
-    private _importPrivateKey;
-    /**
-     * Base64 URL encode (without padding)
-     *
-     * @private
-     * @param {string|ArrayBuffer} input - Data to encode
-     * @returns {string} Base64 URL encoded string
-     */
-    private _base64UrlEncode;
-}
-
 /**
  * Transcription Service - Separate from LLM Service
  * Handles audio-to-text transcription using various providers.

package/dist/utils/google-auth.cjs

@@ -0,0 +1,257 @@
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, { get: all[name], enumerable: true });
+};
+var __copyProps = (to, from, except, desc) => {
+  if (from && typeof from === "object" || typeof from === "function") {
+    for (let key of __getOwnPropNames(from))
+      if (!__hasOwnProp.call(to, key) && key !== except)
+        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
+  }
+  return to;
+};
+var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
+
+// src/utils/google-auth.js
+var google_auth_exports = {};
+__export(google_auth_exports, {
+  GoogleTokenManager: () => GoogleTokenManager,
+  getGoogleOAuth2Token: () => getGoogleOAuth2Token,
+  parseGoogleCredentials: () => parseGoogleCredentials,
+  validateServiceAccount: () => validateServiceAccount
+});
+module.exports = __toCommonJS(google_auth_exports);
+var import_node_buffer = require("buffer");
+function parseGoogleCredentials(input) {
+  if (!input) {
+    throw new Error("Google Cloud credentials not provided");
+  }
+  if (typeof input === "object") {
+    const { client_email, private_key } = input;
+    if (!client_email || !private_key) {
+      throw new Error("Google Cloud Service Account object missing client_email or private_key");
+    }
+    return input;
+  }
+  if (typeof input === "string") {
+    const trimmed = input.trim();
+    if (trimmed.startsWith("ya29.")) {
+      return trimmed;
+    }
+    if (trimmed.startsWith("AIzaSy")) {
+      throw new Error(
+        "Google Cloud Service APIs (Text-to-Speech, Speech-to-Text) do not support API keys (AIzaSy...). Please provide a Service Account JSON key from GCP Console > IAM & Admin > Service Accounts."
+      );
+    }
+    let jsonString = trimmed;
+    if (!jsonString.startsWith("{")) {
+      try {
+        jsonString = import_node_buffer.Buffer.from(jsonString, "base64").toString("utf-8");
+      } catch (err) {
+        throw new Error(`Failed to decode base64 service account: ${err.message}`);
+      }
+    }
+    try {
+      const parsed = JSON.parse(jsonString);
+      if (!parsed.client_email || !parsed.private_key) {
+        throw new Error("Service account missing required fields: client_email, private_key");
+      }
+      return parsed;
+    } catch (err) {
+      if (err.message.includes("missing required fields")) {
+        throw err;
+      }
+      throw new Error(`Failed to parse service account JSON: ${err.message}`);
+    }
+  }
+  throw new Error(
+    "Invalid Google Cloud credentials. Expected a Service Account JSON (with client_email & private_key) or OAuth2 Bearer token."
+  );
+}
+function validateServiceAccount(sa) {
+  if (!sa || typeof sa !== "object") {
+    throw new Error("Service account must be an object");
+  }
+  if (!sa.client_email) {
+    throw new Error("Service account missing client_email");
+  }
+  if (!sa.private_key) {
+    throw new Error("Service account missing private_key");
+  }
+  if (!sa.project_id) {
+    console.warn("[GoogleAuth] Service account missing project_id - may need to specify project explicitly");
+  }
+  return true;
+}
+var GoogleTokenManager = class {
+  /**
+   * @param {object} serviceAccount - Parsed service account with client_email and private_key
+   * @param {object} options - Optional configuration
+   * @param {string} options.scope - OAuth2 scope (default: cloud-platform)
+   * @param {number} options.tokenLifetime - Token lifetime in seconds (default: 3600)
+   */
+  constructor(serviceAccount, options = {}) {
+    validateServiceAccount(serviceAccount);
+    this.clientEmail = serviceAccount.client_email;
+    this.privateKey = serviceAccount.private_key;
+    this.projectId = serviceAccount.project_id;
+    this.scope = options.scope || "https://www.googleapis.com/auth/cloud-platform";
+    this.tokenLifetime = options.tokenLifetime || 3600;
+    this._tokenCache = null;
+    this._expiresAt = 0;
+  }
+  /**
+   * Get a valid access token (cached or fresh)
+   * 
+   * @returns {Promise<string>} OAuth2 access token
+   */
+  async getToken() {
+    const now = Math.floor(Date.now() / 1e3);
+    if (this._tokenCache && now < this._expiresAt - 300) {
+      return this._tokenCache;
+    }
+    this._tokenCache = await this._generateToken();
+    this._expiresAt = now + this.tokenLifetime;
+    return this._tokenCache;
+  }
+  /**
+   * Clear cached token (force refresh on next getToken call)
+   */
+  invalidate() {
+    this._tokenCache = null;
+    this._expiresAt = 0;
+  }
+  /**
+   * Check if cached token is still valid
+   * 
+   * @returns {boolean} True if token is valid
+   */
+  isValid() {
+    const now = Math.floor(Date.now() / 1e3);
+    return this._tokenCache && now < this._expiresAt - 300;
+  }
+  /**
+   * Get time until token expires (in seconds)
+   * 
+   * @returns {number} Seconds until expiration (0 if no token or expired)
+   */
+  getTimeToExpiry() {
+    if (!this._tokenCache) return 0;
+    const now = Math.floor(Date.now() / 1e3);
+    return Math.max(0, this._expiresAt - now);
+  }
+  /**
+   * Generate OAuth2 token via JWT flow
+   * 
+   * @private
+   * @returns {Promise<string>} Access token
+   */
+  async _generateToken() {
+    const now = Math.floor(Date.now() / 1e3);
+    const header = {
+      alg: "RS256",
+      typ: "JWT"
+    };
+    const payload = {
+      iss: this.clientEmail,
+      scope: this.scope,
+      aud: "https://oauth2.googleapis.com/token",
+      exp: now + this.tokenLifetime,
+      iat: now
+    };
+    const jwt = await this._signJWT(header, payload);
+    const response = await fetch("https://oauth2.googleapis.com/token", {
+      method: "POST",
+      headers: {
+        "Content-Type": "application/x-www-form-urlencoded"
+      },
+      body: new URLSearchParams({
+        grant_type: "urn:ietf:params:oauth:grant-type:jwt-bearer",
+        assertion: jwt
+      })
+    });
+    if (!response.ok) {
+      const error = await response.text();
+      throw new Error(`Failed to get OAuth2 token: ${response.status} - ${error}`);
+    }
+    const data = await response.json();
+    if (!data.access_token) {
+      throw new Error("No access_token in OAuth2 response");
+    }
+    return data.access_token;
+  }
+  /**
+   * Sign JWT using service account private key
+   * 
+   * @private
+   * @param {object} header - JWT header
+   * @param {object} payload - JWT payload
+   * @returns {Promise<string>} Signed JWT
+   */
+  async _signJWT(header, payload) {
+    const encoder = new TextEncoder();
+    const headerB64 = this._base64UrlEncode(JSON.stringify(header));
+    const payloadB64 = this._base64UrlEncode(JSON.stringify(payload));
+    const unsignedToken = `${headerB64}.${payloadB64}`;
+    const privateKey = await this._importPrivateKey(this.privateKey);
+    const signature = await crypto.subtle.sign(
+      { name: "RSASSA-PKCS1-v1_5" },
+      privateKey,
+      encoder.encode(unsignedToken)
+    );
+    const signatureB64 = this._base64UrlEncode(signature);
+    return `${unsignedToken}.${signatureB64}`;
+  }
+  /**
+   * Import PEM private key for signing
+   * 
+   * @private
+   * @param {string} pemKey - PEM formatted private key
+   * @returns {Promise<CryptoKey>} Imported key
+   */
+  async _importPrivateKey(pemKey) {
+    const pemContents = pemKey.replace(/-----BEGIN PRIVATE KEY-----/, "").replace(/-----END PRIVATE KEY-----/, "").replace(/\\n/g, "").replace(/\n/g, "").trim();
+    const binaryKey = import_node_buffer.Buffer.from(pemContents, "base64");
+    return crypto.subtle.importKey(
+      "pkcs8",
+      binaryKey,
+      {
+        name: "RSASSA-PKCS1-v1_5",
+        hash: "SHA-256"
+      },
+      false,
+      ["sign"]
+    );
+  }
+  /**
+   * Base64 URL encode (without padding)
+   * 
+   * @private
+   * @param {string|ArrayBuffer} input - Data to encode
+   * @returns {string} Base64 URL encoded string
+   */
+  _base64UrlEncode(input) {
+    const buffer = typeof input === "string" ? import_node_buffer.Buffer.from(input, "utf-8") : import_node_buffer.Buffer.from(input);
+    return buffer.toString("base64").replace(/\+/g, "-").replace(/\//g, "_").replace(/=/g, "");
+  }
+};
+async function getGoogleOAuth2Token(credentialInput, options = {}) {
+  const parsed = parseGoogleCredentials(credentialInput);
+  if (typeof parsed === "string") {
+    return parsed;
+  }
+  const manager = new GoogleTokenManager(parsed, options);
+  return manager.getToken();
+}
+// Annotate the CommonJS export names for ESM import in node:
+0 && (module.exports = {
+  GoogleTokenManager,
+  getGoogleOAuth2Token,
+  parseGoogleCredentials,
+  validateServiceAccount
+});
+//# sourceMappingURL=google-auth.cjs.map

package/dist/utils/google-auth.cjs.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../src/utils/google-auth.js"],"sourcesContent":["/**\n * Google Cloud Authentication Utilities\n * \n * Provides service account parsing, OAuth2 token generation,\n * and token lifecycle management for Google Cloud services.\n * \n * These utilities are designed for edge runtime environments\n * (Cloudflare Workers, Vercel Edge, etc.) where traditional\n * ADC (Application Default Credentials) is not available.\n */\n\nimport { Buffer } from 'node:buffer';\n\n/**\n * Parses and normalizes Google Service Account credentials.\n * Accepts:\n *   - Service account JSON string\n *   - Base64-encoded service account JSON string\n *   - JavaScript object { client_email, private_key }\n *   - Direct OAuth2 token string (starts with ya29.)\n * \n * @param {string|object} input - Service account as JSON string, base64, object, or OAuth2 token\n * @returns {string|object} OAuth2 token string (if input is token) or service account object\n * @throws {Error} If input is invalid or missing required fields\n * \n * @example\n * // From JSON string\n * const sa = parseGoogleCredentials('{\"client_email\":\"...\",\"private_key\":\"...\"}');\n * // Returns: { client_email, private_key, ... }\n * \n * // From base64\n * const sa = parseGoogleCredentials('eyJjbGllbnRfZW1haWwiOi4uLn0=');\n * // Returns: { client_email, private_key, ... }\n * \n * // From object\n * const sa = parseGoogleCredentials({ client_email: '...', private_key: '...' });\n * // Returns: { client_email, private_key, ... }\n * \n * // From OAuth2 token (pass-through)\n * const token = parseGoogleCredentials('ya29.a0...');\n * // Returns: 'ya29.a0...'\n */\nexport function parseGoogleCredentials(input) {\n  if (!input) {\n    throw new Error('Google Cloud credentials not provided');\n  }\n  \n  // Already an object with client_email and private_key\n  if (typeof input === 'object') {\n    const { client_email, private_key } = input;\n    if (!client_email || !private_key) {\n      throw new Error('Google Cloud Service Account object missing client_email or private_key');\n    }\n    return input;\n  }\n  \n  if (typeof input === 'string') {\n    const trimmed = input.trim();\n    \n    // Already a Google OAuth2 access token (starts with ya29.)\n    if (trimmed.startsWith('ya29.')) {\n      return trimmed;\n    }\n    \n    // Detect API key and provide clear error message\n    if (trimmed.startsWith('AIzaSy')) {\n      throw new Error(\n        'Google Cloud Service APIs (Text-to-Speech, Speech-to-Text) do not support API keys (AIzaSy...). ' +\n        'Please provide a Service Account JSON key from GCP Console > IAM & Admin > Service Accounts.'\n      );\n    }\n    \n    let jsonString = trimmed;\n    \n    // Try base64 decode if doesn't look like JSON\n    if (!jsonString.startsWith('{')) {\n      try {\n        jsonString = Buffer.from(jsonString, 'base64').toString('utf-8');\n      } catch (err) {\n        throw new Error(`Failed to decode base64 service account: ${err.message}`);\n      }\n    }\n    \n    // Parse JSON\n    try {\n      const parsed = JSON.parse(jsonString);\n      \n      if (!parsed.client_email || !parsed.private_key) {\n        throw new Error('Service account missing required fields: client_email, private_key');\n      }\n      \n      return parsed;\n    } catch (err) {\n      if (err.message.includes('missing required fields')) {\n        throw err;\n      }\n      throw new Error(`Failed to parse service account JSON: ${err.message}`);\n    }\n  }\n  \n  throw new Error(\n    'Invalid Google Cloud credentials. Expected a Service Account JSON (with client_email & private_key) or OAuth2 Bearer token.'\n  );\n}\n\n/**\n * Validate service account has required fields\n * \n * @param {object} sa - Service account object\n * @returns {boolean} True if valid\n * @throws {Error} If invalid\n */\nexport function validateServiceAccount(sa) {\n  if (!sa || typeof sa !== 'object') {\n    throw new Error('Service account must be an object');\n  }\n  \n  if (!sa.client_email) {\n    throw new Error('Service account missing client_email');\n  }\n  \n  if (!sa.private_key) {\n    throw new Error('Service account missing private_key');\n  }\n  \n  if (!sa.project_id) {\n    console.warn('[GoogleAuth] Service account missing project_id - may need to specify project explicitly');\n  }\n  \n  return true;\n}\n\n/**\n * Google OAuth2 Token Manager\n * \n * Handles token generation, caching, and automatic refresh for\n * Google Cloud service accounts. Tokens are cached and automatically\n * refreshed when they expire (with a 5-minute safety buffer).\n * \n * @example\n * const sa = parseGoogleCredentials(credentials);\n * const tokenManager = new GoogleTokenManager(sa);\n * \n * // Get token (cached or fresh)\n * const token = await tokenManager.getToken();\n * \n * // Force refresh\n * tokenManager.invalidate();\n * const newToken = await tokenManager.getToken();\n */\nexport class GoogleTokenManager {\n  /**\n   * @param {object} serviceAccount - Parsed service account with client_email and private_key\n   * @param {object} options - Optional configuration\n   * @param {string} options.scope - OAuth2 scope (default: cloud-platform)\n   * @param {number} options.tokenLifetime - Token lifetime in seconds (default: 3600)\n   */\n  constructor(serviceAccount, options = {}) {\n    validateServiceAccount(serviceAccount);\n    \n    this.clientEmail = serviceAccount.client_email;\n    this.privateKey = serviceAccount.private_key;\n    this.projectId = serviceAccount.project_id;\n    \n    this.scope = options.scope || 'https://www.googleapis.com/auth/cloud-platform';\n    this.tokenLifetime = options.tokenLifetime || 3600;\n    \n    this._tokenCache = null;\n    this._expiresAt = 0;\n  }\n  \n  /**\n   * Get a valid access token (cached or fresh)\n   * \n   * @returns {Promise<string>} OAuth2 access token\n   */\n  async getToken() {\n    const now = Math.floor(Date.now() / 1000);\n    \n    // Return cached token if still valid (with 5 min buffer)\n    if (this._tokenCache && now < this._expiresAt - 300) {\n      return this._tokenCache;\n    }\n    \n    // Generate new token\n    this._tokenCache = await this._generateToken();\n    this._expiresAt = now + this.tokenLifetime;\n    \n    return this._tokenCache;\n  }\n  \n  /**\n   * Clear cached token (force refresh on next getToken call)\n   */\n  invalidate() {\n    this._tokenCache = null;\n    this._expiresAt = 0;\n  }\n  \n  /**\n   * Check if cached token is still valid\n   * \n   * @returns {boolean} True if token is valid\n   */\n  isValid() {\n    const now = Math.floor(Date.now() / 1000);\n    return this._tokenCache && now < this._expiresAt - 300;\n  }\n  \n  /**\n   * Get time until token expires (in seconds)\n   * \n   * @returns {number} Seconds until expiration (0 if no token or expired)\n   */\n  getTimeToExpiry() {\n    if (!this._tokenCache) return 0;\n    const now = Math.floor(Date.now() / 1000);\n    return Math.max(0, this._expiresAt - now);\n  }\n  \n  /**\n   * Generate OAuth2 token via JWT flow\n   * \n   * @private\n   * @returns {Promise<string>} Access token\n   */\n  async _generateToken() {\n    const now = Math.floor(Date.now() / 1000);\n    \n    // Create JWT header\n    const header = {\n      alg: 'RS256',\n      typ: 'JWT'\n    };\n    \n    // Create JWT payload\n    const payload = {\n      iss: this.clientEmail,\n      scope: this.scope,\n      aud: 'https://oauth2.googleapis.com/token',\n      exp: now + this.tokenLifetime,\n      iat: now\n    };\n    \n    // Sign JWT\n    const jwt = await this._signJWT(header, payload);\n    \n    // Exchange JWT for access token\n    const response = await fetch('https://oauth2.googleapis.com/token', {\n      method: 'POST',\n      headers: {\n        'Content-Type': 'application/x-www-form-urlencoded'\n      },\n      body: new URLSearchParams({\n        grant_type: 'urn:ietf:params:oauth:grant-type:jwt-bearer',\n        assertion: jwt\n      })\n    });\n    \n    if (!response.ok) {\n      const error = await response.text();\n      throw new Error(`Failed to get OAuth2 token: ${response.status} - ${error}`);\n    }\n    \n    const data = await response.json();\n    \n    if (!data.access_token) {\n      throw new Error('No access_token in OAuth2 response');\n    }\n    \n    return data.access_token;\n  }\n  \n  /**\n   * Sign JWT using service account private key\n   * \n   * @private\n   * @param {object} header - JWT header\n   * @param {object} payload - JWT payload\n   * @returns {Promise<string>} Signed JWT\n   */\n  async _signJWT(header, payload) {\n    const encoder = new TextEncoder();\n    \n    // Encode header and payload\n    const headerB64 = this._base64UrlEncode(JSON.stringify(header));\n    const payloadB64 = this._base64UrlEncode(JSON.stringify(payload));\n    const unsignedToken = `${headerB64}.${payloadB64}`;\n    \n    // Import private key\n    const privateKey = await this._importPrivateKey(this.privateKey);\n    \n    // Sign\n    const signature = await crypto.subtle.sign(\n      { name: 'RSASSA-PKCS1-v1_5' },\n      privateKey,\n      encoder.encode(unsignedToken)\n    );\n    \n    // Encode signature\n    const signatureB64 = this._base64UrlEncode(signature);\n    \n    return `${unsignedToken}.${signatureB64}`;\n  }\n  \n  /**\n   * Import PEM private key for signing\n   * \n   * @private\n   * @param {string} pemKey - PEM formatted private key\n   * @returns {Promise<CryptoKey>} Imported key\n   */\n  async _importPrivateKey(pemKey) {\n    // Remove PEM headers and newlines\n    const pemContents = pemKey\n      .replace(/-----BEGIN PRIVATE KEY-----/, '')\n      .replace(/-----END PRIVATE KEY-----/, '')\n      .replace(/\\\\n/g, '')\n      .replace(/\\n/g, '')\n      .trim();\n    \n    // Decode base64\n    const binaryKey = Buffer.from(pemContents, 'base64');\n    \n    // Import key\n    return crypto.subtle.importKey(\n      'pkcs8',\n      binaryKey,\n      {\n        name: 'RSASSA-PKCS1-v1_5',\n        hash: 'SHA-256'\n      },\n      false,\n      ['sign']\n    );\n  }\n  \n  /**\n   * Base64 URL encode (without padding)\n   * \n   * @private\n   * @param {string|ArrayBuffer} input - Data to encode\n   * @returns {string} Base64 URL encoded string\n   */\n  _base64UrlEncode(input) {\n    const buffer = typeof input === 'string' \n      ? Buffer.from(input, 'utf-8')\n      : Buffer.from(input);\n    \n    return buffer\n      .toString('base64')\n      .replace(/\\+/g, '-')\n      .replace(/\\//g, '_')\n      .replace(/=/g, '');\n  }\n}\n\n/**\n * Convenience function to get a token directly (no caching)\n * Handles both service accounts and pre-existing OAuth2 tokens\n * \n * @param {string|object} credentialInput - Service account or OAuth2 token\n * @param {object} options - Optional configuration\n * @param {string} options.scope - OAuth2 scope (default: cloud-platform)\n * @returns {Promise<string>} Access token\n * \n * @example\n * // From service account\n * const sa = { client_email: '...', private_key: '...' };\n * const token = await getGoogleOAuth2Token(sa);\n * \n * // From OAuth2 token (pass-through)\n * const token = await getGoogleOAuth2Token('ya29.a0...');\n */\nexport async function getGoogleOAuth2Token(credentialInput, options = {}) {\n  const parsed = parseGoogleCredentials(credentialInput);\n  \n  // If already a token (string), return it\n  if (typeof parsed === 'string') {\n    return parsed;\n  }\n  \n  // Generate token from service account\n  const manager = new GoogleTokenManager(parsed, options);\n  return manager.getToken();\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAWA,yBAAuB;AA+BhB,SAAS,uBAAuB,OAAO;AAC5C,MAAI,CAAC,OAAO;AACV,UAAM,IAAI,MAAM,uCAAuC;AAAA,EACzD;AAGA,MAAI,OAAO,UAAU,UAAU;AAC7B,UAAM,EAAE,cAAc,YAAY,IAAI;AACtC,QAAI,CAAC,gBAAgB,CAAC,aAAa;AACjC,YAAM,IAAI,MAAM,yEAAyE;AAAA,IAC3F;AACA,WAAO;AAAA,EACT;AAEA,MAAI,OAAO,UAAU,UAAU;AAC7B,UAAM,UAAU,MAAM,KAAK;AAG3B,QAAI,QAAQ,WAAW,OAAO,GAAG;AAC/B,aAAO;AAAA,IACT;AAGA,QAAI,QAAQ,WAAW,QAAQ,GAAG;AAChC,YAAM,IAAI;AAAA,QACR;AAAA,MAEF;AAAA,IACF;AAEA,QAAI,aAAa;AAGjB,QAAI,CAAC,WAAW,WAAW,GAAG,GAAG;AAC/B,UAAI;AACF,qBAAa,0BAAO,KAAK,YAAY,QAAQ,EAAE,SAAS,OAAO;AAAA,MACjE,SAAS,KAAK;AACZ,cAAM,IAAI,MAAM,4CAA4C,IAAI,OAAO,EAAE;AAAA,MAC3E;AAAA,IACF;AAGA,QAAI;AACF,YAAM,SAAS,KAAK,MAAM,UAAU;AAEpC,UAAI,CAAC,OAAO,gBAAgB,CAAC,OAAO,aAAa;AAC/C,cAAM,IAAI,MAAM,oEAAoE;AAAA,MACtF;AAEA,aAAO;AAAA,IACT,SAAS,KAAK;AACZ,UAAI,IAAI,QAAQ,SAAS,yBAAyB,GAAG;AACnD,cAAM;AAAA,MACR;AACA,YAAM,IAAI,MAAM,yCAAyC,IAAI,OAAO,EAAE;AAAA,IACxE;AAAA,EACF;AAEA,QAAM,IAAI;AAAA,IACR;AAAA,EACF;AACF;AASO,SAAS,uBAAuB,IAAI;AACzC,MAAI,CAAC,MAAM,OAAO,OAAO,UAAU;AACjC,UAAM,IAAI,MAAM,mCAAmC;AAAA,EACrD;AAEA,MAAI,CAAC,GAAG,cAAc;AACpB,UAAM,IAAI,MAAM,sCAAsC;AAAA,EACxD;AAEA,MAAI,CAAC,GAAG,aAAa;AACnB,UAAM,IAAI,MAAM,qCAAqC;AAAA,EACvD;AAEA,MAAI,CAAC,GAAG,YAAY;AAClB,YAAQ,KAAK,0FAA0F;AAAA,EACzG;AAEA,SAAO;AACT;AAoBO,IAAM,qBAAN,MAAyB;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAO9B,YAAY,gBAAgB,UAAU,CAAC,GAAG;AACxC,2BAAuB,cAAc;AAErC,SAAK,cAAc,eAAe;AAClC,SAAK,aAAa,eAAe;AACjC,SAAK,YAAY,eAAe;AAEhC,SAAK,QAAQ,QAAQ,SAAS;AAC9B,SAAK,gBAAgB,QAAQ,iBAAiB;AAE9C,SAAK,cAAc;AACnB,SAAK,aAAa;AAAA,EACpB;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAOA,MAAM,WAAW;AACf,UAAM,MAAM,KAAK,MAAM,KAAK,IAAI,IAAI,GAAI;AAGxC,QAAI,KAAK,eAAe,MAAM,KAAK,aAAa,KAAK;AACnD,aAAO,KAAK;AAAA,IACd;AAGA,SAAK,cAAc,MAAM,KAAK,eAAe;AAC7C,SAAK,aAAa,MAAM,KAAK;AAE7B,WAAO,KAAK;AAAA,EACd;AAAA;AAAA;AAAA;AAAA,EAKA,aAAa;AACX,SAAK,cAAc;AACnB,SAAK,aAAa;AAAA,EACpB;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAOA,UAAU;AACR,UAAM,MAAM,KAAK,MAAM,KAAK,IAAI,IAAI,GAAI;AACxC,WAAO,KAAK,eAAe,MAAM,KAAK,aAAa;AAAA,EACrD;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAOA,kBAAkB;AAChB,QAAI,CAAC,KAAK,YAAa,QAAO;AAC9B,UAAM,MAAM,KAAK,MAAM,KAAK,IAAI,IAAI,GAAI;AACxC,WAAO,KAAK,IAAI,GAAG,KAAK,aAAa,GAAG;AAAA,EAC1C;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAQA,MAAM,iBAAiB;AACrB,UAAM,MAAM,KAAK,MAAM,KAAK,IAAI,IAAI,GAAI;AAGxC,UAAM,SAAS;AAAA,MACb,KAAK;AAAA,MACL,KAAK;AAAA,IACP;AAGA,UAAM,UAAU;AAAA,MACd,KAAK,KAAK;AAAA,MACV,OAAO,KAAK;AAAA,MACZ,KAAK;AAAA,MACL,KAAK,MAAM,KAAK;AAAA,MAChB,KAAK;AAAA,IACP;AAGA,UAAM,MAAM,MAAM,KAAK,SAAS,QAAQ,OAAO;AAG/C,UAAM,WAAW,MAAM,MAAM,uCAAuC;AAAA,MAClE,QAAQ;AAAA,MACR,SAAS;AAAA,QACP,gBAAgB;AAAA,MAClB;AAAA,MACA,MAAM,IAAI,gBAAgB;AAAA,QACxB,YAAY;AAAA,QACZ,WAAW;AAAA,MACb,CAAC;AAAA,IACH,CAAC;AAED,QAAI,CAAC,SAAS,IAAI;AAChB,YAAM,QAAQ,MAAM,SAAS,KAAK;AAClC,YAAM,IAAI,MAAM,+BAA+B,SAAS,MAAM,MAAM,KAAK,EAAE;AAAA,IAC7E;AAEA,UAAM,OAAO,MAAM,SAAS,KAAK;AAEjC,QAAI,CAAC,KAAK,cAAc;AACtB,YAAM,IAAI,MAAM,oCAAoC;AAAA,IACtD;AAEA,WAAO,KAAK;AAAA,EACd;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAUA,MAAM,SAAS,QAAQ,SAAS;AAC9B,UAAM,UAAU,IAAI,YAAY;AAGhC,UAAM,YAAY,KAAK,iBAAiB,KAAK,UAAU,MAAM,CAAC;AAC9D,UAAM,aAAa,KAAK,iBAAiB,KAAK,UAAU,OAAO,CAAC;AAChE,UAAM,gBAAgB,GAAG,SAAS,IAAI,UAAU;AAGhD,UAAM,aAAa,MAAM,KAAK,kBAAkB,KAAK,UAAU;AAG/D,UAAM,YAAY,MAAM,OAAO,OAAO;AAAA,MACpC,EAAE,MAAM,oBAAoB;AAAA,MAC5B;AAAA,MACA,QAAQ,OAAO,aAAa;AAAA,IAC9B;AAGA,UAAM,eAAe,KAAK,iBAAiB,SAAS;AAEpD,WAAO,GAAG,aAAa,IAAI,YAAY;AAAA,EACzC;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EASA,MAAM,kBAAkB,QAAQ;AAE9B,UAAM,cAAc,OACjB,QAAQ,+BAA+B,EAAE,EACzC,QAAQ,6BAA6B,EAAE,EACvC,QAAQ,QAAQ,EAAE,EAClB,QAAQ,OAAO,EAAE,EACjB,KAAK;AAGR,UAAM,YAAY,0BAAO,KAAK,aAAa,QAAQ;AAGnD,WAAO,OAAO,OAAO;AAAA,MACnB;AAAA,MACA;AAAA,MACA;AAAA,QACE,MAAM;AAAA,QACN,MAAM;AAAA,MACR;AAAA,MACA;AAAA,MACA,CAAC,MAAM;AAAA,IACT;AAAA,EACF;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EASA,iBAAiB,OAAO;AACtB,UAAM,SAAS,OAAO,UAAU,WAC5B,0BAAO,KAAK,OAAO,OAAO,IAC1B,0BAAO,KAAK,KAAK;AAErB,WAAO,OACJ,SAAS,QAAQ,EACjB,QAAQ,OAAO,GAAG,EAClB,QAAQ,OAAO,GAAG,EAClB,QAAQ,MAAM,EAAE;AAAA,EACrB;AACF;AAmBA,eAAsB,qBAAqB,iBAAiB,UAAU,CAAC,GAAG;AACxE,QAAM,SAAS,uBAAuB,eAAe;AAGrD,MAAI,OAAO,WAAW,UAAU;AAC9B,WAAO;AAAA,EACT;AAGA,QAAM,UAAU,IAAI,mBAAmB,QAAQ,OAAO;AACtD,SAAO,QAAQ,SAAS;AAC1B;","names":[]}

package/dist/utils/google-auth.d.cts

@@ -0,0 +1,151 @@
+/**
+ * Parses and normalizes Google Service Account credentials.
+ * Accepts:
+ *   - Service account JSON string
+ *   - Base64-encoded service account JSON string
+ *   - JavaScript object { client_email, private_key }
+ *   - Direct OAuth2 token string (starts with ya29.)
+ *
+ * @param {string|object} input - Service account as JSON string, base64, object, or OAuth2 token
+ * @returns {string|object} OAuth2 token string (if input is token) or service account object
+ * @throws {Error} If input is invalid or missing required fields
+ *
+ * @example
+ * // From JSON string
+ * const sa = parseGoogleCredentials('{"client_email":"...","private_key":"..."}');
+ * // Returns: { client_email, private_key, ... }
+ *
+ * // From base64
+ * const sa = parseGoogleCredentials('eyJjbGllbnRfZW1haWwiOi4uLn0=');
+ * // Returns: { client_email, private_key, ... }
+ *
+ * // From object
+ * const sa = parseGoogleCredentials({ client_email: '...', private_key: '...' });
+ * // Returns: { client_email, private_key, ... }
+ *
+ * // From OAuth2 token (pass-through)
+ * const token = parseGoogleCredentials('ya29.a0...');
+ * // Returns: 'ya29.a0...'
+ */
+declare function parseGoogleCredentials(input: string | object): string | object;
+/**
+ * Validate service account has required fields
+ *
+ * @param {object} sa - Service account object
+ * @returns {boolean} True if valid
+ * @throws {Error} If invalid
+ */
+declare function validateServiceAccount(sa: object): boolean;
+/**
+ * Convenience function to get a token directly (no caching)
+ * Handles both service accounts and pre-existing OAuth2 tokens
+ *
+ * @param {string|object} credentialInput - Service account or OAuth2 token
+ * @param {object} options - Optional configuration
+ * @param {string} options.scope - OAuth2 scope (default: cloud-platform)
+ * @returns {Promise<string>} Access token
+ *
+ * @example
+ * // From service account
+ * const sa = { client_email: '...', private_key: '...' };
+ * const token = await getGoogleOAuth2Token(sa);
+ *
+ * // From OAuth2 token (pass-through)
+ * const token = await getGoogleOAuth2Token('ya29.a0...');
+ */
+declare function getGoogleOAuth2Token(credentialInput: string | object, options?: {
+    scope: string;
+}): Promise<string>;
+/**
+ * Google OAuth2 Token Manager
+ *
+ * Handles token generation, caching, and automatic refresh for
+ * Google Cloud service accounts. Tokens are cached and automatically
+ * refreshed when they expire (with a 5-minute safety buffer).
+ *
+ * @example
+ * const sa = parseGoogleCredentials(credentials);
+ * const tokenManager = new GoogleTokenManager(sa);
+ *
+ * // Get token (cached or fresh)
+ * const token = await tokenManager.getToken();
+ *
+ * // Force refresh
+ * tokenManager.invalidate();
+ * const newToken = await tokenManager.getToken();
+ */
+declare class GoogleTokenManager {
+    /**
+     * @param {object} serviceAccount - Parsed service account with client_email and private_key
+     * @param {object} options - Optional configuration
+     * @param {string} options.scope - OAuth2 scope (default: cloud-platform)
+     * @param {number} options.tokenLifetime - Token lifetime in seconds (default: 3600)
+     */
+    constructor(serviceAccount: object, options?: {
+        scope: string;
+        tokenLifetime: number;
+    });
+    clientEmail: any;
+    privateKey: any;
+    projectId: any;
+    scope: string;
+    tokenLifetime: number;
+    _tokenCache: string;
+    _expiresAt: number;
+    /**
+     * Get a valid access token (cached or fresh)
+     *
+     * @returns {Promise<string>} OAuth2 access token
+     */
+    getToken(): Promise<string>;
+    /**
+     * Clear cached token (force refresh on next getToken call)
+     */
+    invalidate(): void;
+    /**
+     * Check if cached token is still valid
+     *
+     * @returns {boolean} True if token is valid
+     */
+    isValid(): boolean;
+    /**
+     * Get time until token expires (in seconds)
+     *
+     * @returns {number} Seconds until expiration (0 if no token or expired)
+     */
+    getTimeToExpiry(): number;
+    /**
+     * Generate OAuth2 token via JWT flow
+     *
+     * @private
+     * @returns {Promise<string>} Access token
+     */
+    private _generateToken;
+    /**
+     * Sign JWT using service account private key
+     *
+     * @private
+     * @param {object} header - JWT header
+     * @param {object} payload - JWT payload
+     * @returns {Promise<string>} Signed JWT
+     */
+    private _signJWT;
+    /**
+     * Import PEM private key for signing
+     *
+     * @private
+     * @param {string} pemKey - PEM formatted private key
+     * @returns {Promise<CryptoKey>} Imported key
+     */
+    private _importPrivateKey;
+    /**
+     * Base64 URL encode (without padding)
+     *
+     * @private
+     * @param {string|ArrayBuffer} input - Data to encode
+     * @returns {string} Base64 URL encoded string
+     */
+    private _base64UrlEncode;
+}
+
+export { GoogleTokenManager, getGoogleOAuth2Token, parseGoogleCredentials, validateServiceAccount };