@mcp-z/oauth-google 1.0.0

package/dist/cjs/providers/service-account.js

@@ -0,0 +1,800 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", {
+    value: true
+});
+Object.defineProperty(exports, "ServiceAccountProvider", {
+    enumerable: true,
+    get: function() {
+        return ServiceAccountProvider;
+    }
+});
+var _fs = require("fs");
+var _googleauthlibrary = require("google-auth-library");
+var _jose = require("jose");
+function _array_like_to_array(arr, len) {
+    if (len == null || len > arr.length) len = arr.length;
+    for(var i = 0, arr2 = new Array(len); i < len; i++)arr2[i] = arr[i];
+    return arr2;
+}
+function _array_without_holes(arr) {
+    if (Array.isArray(arr)) return _array_like_to_array(arr);
+}
+function asyncGeneratorStep(gen, resolve, reject, _next, _throw, key, arg) {
+    try {
+        var info = gen[key](arg);
+        var value = info.value;
+    } catch (error) {
+        reject(error);
+        return;
+    }
+    if (info.done) {
+        resolve(value);
+    } else {
+        Promise.resolve(value).then(_next, _throw);
+    }
+}
+function _async_to_generator(fn) {
+    return function() {
+        var self = this, args = arguments;
+        return new Promise(function(resolve, reject) {
+            var gen = fn.apply(self, args);
+            function _next(value) {
+                asyncGeneratorStep(gen, resolve, reject, _next, _throw, "next", value);
+            }
+            function _throw(err) {
+                asyncGeneratorStep(gen, resolve, reject, _next, _throw, "throw", err);
+            }
+            _next(undefined);
+        });
+    };
+}
+function _class_call_check(instance, Constructor) {
+    if (!(instance instanceof Constructor)) {
+        throw new TypeError("Cannot call a class as a function");
+    }
+}
+function _define_property(obj, key, value) {
+    if (key in obj) {
+        Object.defineProperty(obj, key, {
+            value: value,
+            enumerable: true,
+            configurable: true,
+            writable: true
+        });
+    } else {
+        obj[key] = value;
+    }
+    return obj;
+}
+function _instanceof(left, right) {
+    if (right != null && typeof Symbol !== "undefined" && right[Symbol.hasInstance]) {
+        return !!right[Symbol.hasInstance](left);
+    } else {
+        return left instanceof right;
+    }
+}
+function _iterable_to_array(iter) {
+    if (typeof Symbol !== "undefined" && iter[Symbol.iterator] != null || iter["@@iterator"] != null) return Array.from(iter);
+}
+function _non_iterable_spread() {
+    throw new TypeError("Invalid attempt to spread non-iterable instance.\\nIn order to be iterable, non-array objects must have a [Symbol.iterator]() method.");
+}
+function _object_spread(target) {
+    for(var i = 1; i < arguments.length; i++){
+        var source = arguments[i] != null ? arguments[i] : {};
+        var ownKeys = Object.keys(source);
+        if (typeof Object.getOwnPropertySymbols === "function") {
+            ownKeys = ownKeys.concat(Object.getOwnPropertySymbols(source).filter(function(sym) {
+                return Object.getOwnPropertyDescriptor(source, sym).enumerable;
+            }));
+        }
+        ownKeys.forEach(function(key) {
+            _define_property(target, key, source[key]);
+        });
+    }
+    return target;
+}
+function ownKeys(object, enumerableOnly) {
+    var keys = Object.keys(object);
+    if (Object.getOwnPropertySymbols) {
+        var symbols = Object.getOwnPropertySymbols(object);
+        if (enumerableOnly) {
+            symbols = symbols.filter(function(sym) {
+                return Object.getOwnPropertyDescriptor(object, sym).enumerable;
+            });
+        }
+        keys.push.apply(keys, symbols);
+    }
+    return keys;
+}
+function _object_spread_props(target, source) {
+    source = source != null ? source : {};
+    if (Object.getOwnPropertyDescriptors) {
+        Object.defineProperties(target, Object.getOwnPropertyDescriptors(source));
+    } else {
+        ownKeys(Object(source)).forEach(function(key) {
+            Object.defineProperty(target, key, Object.getOwnPropertyDescriptor(source, key));
+        });
+    }
+    return target;
+}
+function _to_consumable_array(arr) {
+    return _array_without_holes(arr) || _iterable_to_array(arr) || _unsupported_iterable_to_array(arr) || _non_iterable_spread();
+}
+function _type_of(obj) {
+    "@swc/helpers - typeof";
+    return obj && typeof Symbol !== "undefined" && obj.constructor === Symbol ? "symbol" : typeof obj;
+}
+function _unsupported_iterable_to_array(o, minLen) {
+    if (!o) return;
+    if (typeof o === "string") return _array_like_to_array(o, minLen);
+    var n = Object.prototype.toString.call(o).slice(8, -1);
+    if (n === "Object" && o.constructor) n = o.constructor.name;
+    if (n === "Map" || n === "Set") return Array.from(n);
+    if (n === "Arguments" || /^(?:Ui|I)nt(?:8|16|32)(?:Clamped)?Array$/.test(n)) return _array_like_to_array(o, minLen);
+}
+function _ts_generator(thisArg, body) {
+    var f, y, t, _ = {
+        label: 0,
+        sent: function() {
+            if (t[0] & 1) throw t[1];
+            return t[1];
+        },
+        trys: [],
+        ops: []
+    }, g = Object.create((typeof Iterator === "function" ? Iterator : Object).prototype), d = Object.defineProperty;
+    return d(g, "next", {
+        value: verb(0)
+    }), d(g, "throw", {
+        value: verb(1)
+    }), d(g, "return", {
+        value: verb(2)
+    }), typeof Symbol === "function" && d(g, Symbol.iterator, {
+        value: function() {
+            return this;
+        }
+    }), g;
+    function verb(n) {
+        return function(v) {
+            return step([
+                n,
+                v
+            ]);
+        };
+    }
+    function step(op) {
+        if (f) throw new TypeError("Generator is already executing.");
+        while(g && (g = 0, op[0] && (_ = 0)), _)try {
+            if (f = 1, y && (t = op[0] & 2 ? y["return"] : op[0] ? y["throw"] || ((t = y["return"]) && t.call(y), 0) : y.next) && !(t = t.call(y, op[1])).done) return t;
+            if (y = 0, t) op = [
+                op[0] & 2,
+                t.value
+            ];
+            switch(op[0]){
+                case 0:
+                case 1:
+                    t = op;
+                    break;
+                case 4:
+                    _.label++;
+                    return {
+                        value: op[1],
+                        done: false
+                    };
+                case 5:
+                    _.label++;
+                    y = op[1];
+                    op = [
+                        0
+                    ];
+                    continue;
+                case 7:
+                    op = _.ops.pop();
+                    _.trys.pop();
+                    continue;
+                default:
+                    if (!(t = _.trys, t = t.length > 0 && t[t.length - 1]) && (op[0] === 6 || op[0] === 2)) {
+                        _ = 0;
+                        continue;
+                    }
+                    if (op[0] === 3 && (!t || op[1] > t[0] && op[1] < t[3])) {
+                        _.label = op[1];
+                        break;
+                    }
+                    if (op[0] === 6 && _.label < t[1]) {
+                        _.label = t[1];
+                        t = op;
+                        break;
+                    }
+                    if (t && _.label < t[2]) {
+                        _.label = t[2];
+                        _.ops.push(op);
+                        break;
+                    }
+                    if (t[2]) _.ops.pop();
+                    _.trys.pop();
+                    continue;
+            }
+            op = body.call(thisArg, _);
+        } catch (e) {
+            op = [
+                6,
+                e
+            ];
+            y = 0;
+        } finally{
+            f = t = 0;
+        }
+        if (op[0] & 5) throw op[1];
+        return {
+            value: op[0] ? op[1] : void 0,
+            done: true
+        };
+    }
+}
+var ServiceAccountProvider = /*#__PURE__*/ function() {
+    "use strict";
+    function ServiceAccountProvider(config) {
+        _class_call_check(this, ServiceAccountProvider);
+        this.config = config;
+        this.keyFilePath = config.keyFilePath;
+        this.scopes = config.scopes;
+    }
+    var _proto = ServiceAccountProvider.prototype;
+    /**
+   * Load and parse service account key file from disk
+   * Validates structure and caches for subsequent calls
+   */ _proto.loadKeyFile = function loadKeyFile() {
+        return _async_to_generator(function() {
+            var fileContent, keyData, error;
+            return _ts_generator(this, function(_state) {
+                switch(_state.label){
+                    case 0:
+                        // Return cached key data if already loaded
+                        if (this.keyData) {
+                            return [
+                                2,
+                                this.keyData
+                            ];
+                        }
+                        _state.label = 1;
+                    case 1:
+                        _state.trys.push([
+                            1,
+                            3,
+                            ,
+                            4
+                        ]);
+                        return [
+                            4,
+                            _fs.promises.readFile(this.keyFilePath, 'utf-8')
+                        ];
+                    case 2:
+                        fileContent = _state.sent();
+                        try {
+                            keyData = JSON.parse(fileContent);
+                        } catch (parseError) {
+                            throw new Error("Failed to parse service account key file as JSON: ".concat(this.keyFilePath, "\n") + "Error: ".concat(_instanceof(parseError, Error) ? parseError.message : String(parseError)));
+                        }
+                        // Validate structure
+                        this.keyData = this.validateKeyFile(keyData);
+                        return [
+                            2,
+                            this.keyData
+                        ];
+                    case 3:
+                        error = _state.sent();
+                        // Handle file not found
+                        if (error.code === 'ENOENT') {
+                            throw new Error("Service account key file not found: ".concat(this.keyFilePath, "\nMake sure GOOGLE_SERVICE_ACCOUNT_KEY_FILE points to a valid file path."));
+                        }
+                        // Handle permission errors
+                        if (error.code === 'EACCES') {
+                            throw new Error("Permission denied reading service account key file: ".concat(this.keyFilePath, "\nCheck file permissions (should be readable by current user)."));
+                        }
+                        // Re-throw other errors
+                        throw error;
+                    case 4:
+                        return [
+                            2
+                        ];
+                }
+            });
+        }).call(this);
+    };
+    /**
+   * Validate service account key file structure
+   * Ensures all required fields are present and correctly typed
+   */ _proto.validateKeyFile = function validateKeyFile(data) {
+        if (!data || (typeof data === "undefined" ? "undefined" : _type_of(data)) !== 'object') {
+            throw new Error('Service account key file must contain a JSON object');
+        }
+        var obj = data;
+        // Validate type field
+        if (obj.type !== 'service_account') {
+            throw new Error('Invalid service account key file: Expected type "service_account", got "'.concat(obj.type, '"\nMake sure you downloaded a service account key, not an OAuth client credential.'));
+        }
+        // Validate required string fields
+        var requiredFields = [
+            'project_id',
+            'private_key_id',
+            'private_key',
+            'client_email',
+            'client_id',
+            'auth_uri',
+            'token_uri'
+        ];
+        var missingFields = requiredFields.filter(function(field) {
+            return typeof obj[field] !== 'string' || !obj[field];
+        });
+        if (missingFields.length > 0) {
+            throw new Error("Service account key file is missing required fields: ".concat(missingFields.join(', '), "\nMake sure you downloaded a complete service account key file from Google Cloud Console."));
+        }
+        // Validate private key format
+        var privateKey = obj.private_key;
+        if (!privateKey.includes('BEGIN PRIVATE KEY') || !privateKey.includes('END PRIVATE KEY')) {
+            throw new Error('Service account private_key field does not contain a valid PEM-formatted key.\n' + 'Expected format: -----BEGIN PRIVATE KEY-----...-----END PRIVATE KEY-----');
+        }
+        return obj;
+    };
+    /**
+   * Generate signed JWT (JSON Web Token) for service account authentication
+   * Uses RS256 algorithm with private key from key file
+   */ _proto.generateJWT = function generateJWT() {
+        return _async_to_generator(function() {
+            var keyData, privateKey, now, jwt;
+            return _ts_generator(this, function(_state) {
+                switch(_state.label){
+                    case 0:
+                        return [
+                            4,
+                            this.loadKeyFile()
+                        ];
+                    case 1:
+                        keyData = _state.sent();
+                        return [
+                            4,
+                            (0, _jose.importPKCS8)(keyData.private_key, 'RS256')
+                        ];
+                    case 2:
+                        privateKey = _state.sent();
+                        // Current time
+                        now = Math.floor(Date.now() / 1000);
+                        return [
+                            4,
+                            new _jose.SignJWT({
+                                iss: keyData.client_email,
+                                scope: this.scopes.join(' '),
+                                aud: 'https://oauth2.googleapis.com/token',
+                                exp: now + 3600,
+                                iat: now
+                            }).setProtectedHeader({
+                                alg: 'RS256',
+                                typ: 'JWT'
+                            }).sign(privateKey)
+                        ];
+                    case 3:
+                        jwt = _state.sent();
+                        return [
+                            2,
+                            jwt
+                        ];
+                }
+            });
+        }).call(this);
+    };
+    /**
+   * Exchange signed JWT for access token at Google OAuth endpoint
+   * POST to https://oauth2.googleapis.com/token with grant_type=jwt-bearer
+   */ _proto.exchangeJWT = function exchangeJWT(jwt) {
+        return _async_to_generator(function() {
+            var tokenEndpoint, response, errorText, errorMessage, errorJson, tokenData, expiry, error;
+            return _ts_generator(this, function(_state) {
+                switch(_state.label){
+                    case 0:
+                        tokenEndpoint = 'https://oauth2.googleapis.com/token';
+                        _state.label = 1;
+                    case 1:
+                        _state.trys.push([
+                            1,
+                            6,
+                            ,
+                            7
+                        ]);
+                        return [
+                            4,
+                            fetch(tokenEndpoint, {
+                                method: 'POST',
+                                headers: {
+                                    'Content-Type': 'application/x-www-form-urlencoded'
+                                },
+                                body: new URLSearchParams({
+                                    grant_type: 'urn:ietf:params:oauth:grant-type:jwt-bearer',
+                                    assertion: jwt
+                                })
+                            })
+                        ];
+                    case 2:
+                        response = _state.sent();
+                        if (!!response.ok) return [
+                            3,
+                            4
+                        ];
+                        return [
+                            4,
+                            response.text()
+                        ];
+                    case 3:
+                        errorText = _state.sent();
+                        try {
+                            errorJson = JSON.parse(errorText);
+                            errorMessage = errorJson.error_description || errorJson.error || errorText;
+                        } catch (unused) {
+                            errorMessage = errorText;
+                        }
+                        // 400: Invalid JWT (malformed claims, expired, etc.)
+                        if (response.status === 400) {
+                            throw new Error("Invalid service account JWT: ".concat(errorMessage, "\nThis usually means the JWT claims are malformed or the key file is invalid."));
+                        }
+                        // 401: Unauthorized (revoked service account, wrong scopes, etc.)
+                        if (response.status === 401) {
+                            throw new Error("Service account authentication failed: ".concat(errorMessage, "\nThe service account may have been disabled or deleted. Check Google Cloud Console."));
+                        }
+                        // Other errors
+                        throw new Error("Token exchange failed (HTTP ".concat(response.status, "): ").concat(errorMessage));
+                    case 4:
+                        return [
+                            4,
+                            response.json()
+                        ];
+                    case 5:
+                        tokenData = _state.sent();
+                        // Calculate expiry timestamp (token expires in ~1 hour)
+                        expiry = Date.now() + (tokenData.expires_in - 60) * 1000; // Subtract 60s for safety margin
+                        return [
+                            2,
+                            {
+                                token: tokenData.access_token,
+                                expiry: expiry
+                            }
+                        ];
+                    case 6:
+                        error = _state.sent();
+                        // Network errors
+                        if (_instanceof(error, TypeError) && error.message.includes('fetch')) {
+                            throw new Error('Network error connecting to Google OAuth endpoint. Check internet connection.');
+                        }
+                        // Re-throw other errors
+                        throw error;
+                    case 7:
+                        return [
+                            2
+                        ];
+                }
+            });
+        })();
+    };
+    /**
+   * Get access token for Google APIs
+   * Generates fresh JWT and exchanges for access token on each call
+   *
+   * Note: accountId parameter is ignored for service accounts (service account is single static identity)
+   */ _proto.getAccessToken = function getAccessToken(_accountId) {
+        return _async_to_generator(function() {
+            var jwt, _ref, token, expiry, error;
+            return _ts_generator(this, function(_state) {
+                switch(_state.label){
+                    case 0:
+                        // Check if we have a valid cached token (optional optimization)
+                        if (this.cachedToken && this.cachedToken.expiry > Date.now()) {
+                            return [
+                                2,
+                                this.cachedToken.token
+                            ];
+                        }
+                        _state.label = 1;
+                    case 1:
+                        _state.trys.push([
+                            1,
+                            4,
+                            ,
+                            5
+                        ]);
+                        return [
+                            4,
+                            this.generateJWT()
+                        ];
+                    case 2:
+                        jwt = _state.sent();
+                        return [
+                            4,
+                            this.exchangeJWT(jwt)
+                        ];
+                    case 3:
+                        _ref = _state.sent(), token = _ref.token, expiry = _ref.expiry;
+                        // Cache token for subsequent calls (optional optimization)
+                        this.cachedToken = {
+                            token: token,
+                            expiry: expiry
+                        };
+                        return [
+                            2,
+                            token
+                        ];
+                    case 4:
+                        error = _state.sent();
+                        // Add context to errors
+                        throw new Error("Failed to get service account access token: ".concat(_instanceof(error, Error) ? error.message : String(error)));
+                    case 5:
+                        return [
+                            2
+                        ];
+                }
+            });
+        }).call(this);
+    };
+    /**
+   * Get OAuth2Client with service account credentials for googleapis
+   * This is the CRITICAL method that servers use to get authenticated API clients
+   *
+   * Service account ONLY works with accountId='service-account' (single static identity)
+   *
+    @param accountId - Account identifier (must be 'service-account' or undefined)
+   * @returns OAuth2Client instance with access token credentials set
+   */ _proto.toAuth = function toAuth(accountId) {
+        var _this = this;
+        var _this_config_logger;
+        // Service account ONLY works with 'service-account' account ID
+        if (accountId !== undefined && accountId !== 'service-account') {
+            throw new Error("ServiceAccountProvider only supports accountId='service-account', got '".concat(accountId, "'. Service account uses a single static identity pattern."));
+        }
+        // Create OAuth2Client instance (no client ID/secret needed for service accounts)
+        var client = new _googleauthlibrary.OAuth2Client();
+        // Override getRequestMetadataAsync to provide authentication headers for each request
+        // This is the method googleapis calls to get auth headers - can be async and fetch tokens on-demand
+        client.getRequestMetadataAsync = function(_url) {
+            return _async_to_generator(function() {
+                var token, headers, error, _this_config_logger;
+                return _ts_generator(this, function(_state) {
+                    switch(_state.label){
+                        case 0:
+                            _state.trys.push([
+                                0,
+                                2,
+                                ,
+                                3
+                            ]);
+                            return [
+                                4,
+                                this.getAccessToken()
+                            ];
+                        case 1:
+                            token = _state.sent();
+                            // Update client credentials for consistency (other googleapis methods might check these)
+                            client.credentials = {
+                                access_token: token,
+                                token_type: 'Bearer'
+                            };
+                            // Return headers as Headers instance for proper TypeScript types
+                            headers = new Headers();
+                            headers.set('authorization', "Bearer ".concat(token));
+                            return [
+                                2,
+                                {
+                                    headers: headers
+                                }
+                            ];
+                        case 2:
+                            error = _state.sent();
+                            (_this_config_logger = this.config.logger) === null || _this_config_logger === void 0 ? void 0 : _this_config_logger.error('Failed to get service account access token for API request', {
+                                error: error
+                            });
+                            throw error;
+                        case 3:
+                            return [
+                                2
+                            ];
+                    }
+                });
+            }).call(_this);
+        };
+        // Override getAccessToken to support googleapis client API and direct token access
+        client.getAccessToken = function() {
+            return _async_to_generator(function() {
+                var token, error, _this_config_logger;
+                return _ts_generator(this, function(_state) {
+                    switch(_state.label){
+                        case 0:
+                            _state.trys.push([
+                                0,
+                                2,
+                                ,
+                                3
+                            ]);
+                            return [
+                                4,
+                                this.getAccessToken()
+                            ];
+                        case 1:
+                            token = _state.sent();
+                            return [
+                                2,
+                                {
+                                    token: token
+                                }
+                            ];
+                        case 2:
+                            error = _state.sent();
+                            (_this_config_logger = this.config.logger) === null || _this_config_logger === void 0 ? void 0 : _this_config_logger.error('Failed to get service account access token', {
+                                error: error
+                            });
+                            throw error;
+                        case 3:
+                            return [
+                                2
+                            ];
+                    }
+                });
+            }).call(_this);
+        };
+        (_this_config_logger = this.config.logger) === null || _this_config_logger === void 0 ? void 0 : _this_config_logger.debug("ServiceAccountProvider: OAuth2Client created for ".concat(accountId));
+        return client;
+    };
+    /**
+   * Get service account email address
+   * Used for account registration and display
+   *
+   * Note: accountId parameter is ignored for service accounts
+   * @returns Service account email from key file (e.g., "service-account@project.iam.gserviceaccount.com")
+   */ _proto.getUserEmail = function getUserEmail(_accountId) {
+        return _async_to_generator(function() {
+            var keyData;
+            return _ts_generator(this, function(_state) {
+                switch(_state.label){
+                    case 0:
+                        return [
+                            4,
+                            this.loadKeyFile()
+                        ];
+                    case 1:
+                        keyData = _state.sent();
+                        return [
+                            2,
+                            keyData.client_email
+                        ];
+                }
+            });
+        }).call(this);
+    };
+    /**
+   * Create middleware wrapper for single-user authentication
+   * This is the CRITICAL method that integrates service account auth into MCP servers
+   *
+   * Middleware wraps tool, resource, and prompt handlers and injects authContext into extra parameter.
+   * Handlers receive OAuth2Client via extra.authContext.auth for API calls.
+   *
+   * @returns Object with withToolAuth, withResourceAuth, withPromptAuth methods
+   *
+   * @example
+   * ```typescript
+   * // Server registration
+   * const authMiddleware = provider.authMiddleware();
+   * const tools = toolFactories.map(f => f()).map(authMiddleware.withToolAuth);
+   * const resources = resourceFactories.map(f => f()).map(authMiddleware.withResourceAuth);
+   * const prompts = promptFactories.map(f => f()).map(authMiddleware.withPromptAuth);
+   *
+   * // Tool handler receives auth
+   * async function handler({ id }: In, extra: EnrichedExtra) {
+   *   // extra.authContext.auth is OAuth2Client (from middleware)
+   *   const gmail = google.gmail({ version: 'v1', auth: extra.authContext.auth });
+   * }
+   * ```
+   */ _proto.authMiddleware = function authMiddleware() {
+        var _this = this;
+        // Shared wrapper logic - extracts extra parameter from specified position
+        // Generic T captures the actual module type; handler is cast from unknown to callable
+        var wrapAtPosition = function(module, extraPosition) {
+            var _this1 = _this;
+            var originalHandler = module.handler;
+            var wrappedHandler = function() {
+                for(var _len = arguments.length, allArgs = new Array(_len), _key = 0; _key < _len; _key++){
+                    allArgs[_key] = arguments[_key];
+                }
+                return _async_to_generator(function() {
+                    var extra, accountId, serviceEmail, auth, error, message;
+                    return _ts_generator(this, function(_state) {
+                        switch(_state.label){
+                            case 0:
+                                // Extract extra from the correct position
+                                extra = allArgs[extraPosition];
+                                _state.label = 1;
+                            case 1:
+                                _state.trys.push([
+                                    1,
+                                    5,
+                                    ,
+                                    6
+                                ]);
+                                // Use fixed accountId for storage isolation (like device-code pattern)
+                                accountId = 'service-account';
+                                return [
+                                    4,
+                                    this.getUserEmail()
+                                ];
+                            case 2:
+                                serviceEmail = _state.sent();
+                                // Get access token (generates JWT and exchanges if needed)
+                                return [
+                                    4,
+                                    this.getAccessToken()
+                                ];
+                            case 3:
+                                _state.sent();
+                                // Create OAuth2Client with service account credentials
+                                auth = this.toAuth(accountId);
+                                // Inject authContext and logger into extra parameter
+                                extra.authContext = {
+                                    auth: auth,
+                                    accountId: accountId,
+                                    metadata: {
+                                        serviceEmail: serviceEmail
+                                    }
+                                };
+                                extra.logger = this.config.logger;
+                                return [
+                                    4,
+                                    originalHandler.apply(void 0, _to_consumable_array(allArgs))
+                                ];
+                            case 4:
+                                // Call original handler with all args
+                                return [
+                                    2,
+                                    _state.sent()
+                                ];
+                            case 5:
+                                error = _state.sent();
+                                message = _instanceof(error, Error) ? error.message : String(error);
+                                // Provide specific, actionable error messages based on error type
+                                if (message.includes('key file not found')) {
+                                    throw new Error("Service account setup error: Key file '".concat(this.keyFilePath, "' not found.\n• Set GOOGLE_SERVICE_ACCOUNT_KEY_FILE environment variable\n• Or ensure the file path exists and is accessible"));
+                                }
+                                if (message.includes('Forbidden') || message.includes('access_denied')) {
+                                    throw new Error('Service account permission error: The service account does not have required permissions.\n' + '• Ensure the service account has been granted the necessary roles\n' + '• Check that required API scopes are enabled in Google Cloud Console\n' + '• Verify the service account is active (not disabled)');
+                                }
+                                if (message.includes('invalid_grant') || message.includes('JWT')) {
+                                    throw new Error('Service account authentication error: Invalid credentials or expired tokens.\n' + '• Verify your service account key file is valid and not expired\n' + '• Check that the service account email and project match your GCP setup\n' + '• Try regenerating the key file in Google Cloud Console');
+                                }
+                                if (message.includes('Network error') || message.includes('fetch')) {
+                                    throw new Error('Service account connection error: Unable to reach Google authentication services.\n' + '• Check your internet connection\n' + '• Verify firewall/proxy settings allow HTTPS to oauth2.googleapis.com\n' + '• Try again in a few moments (may be temporary service issue)');
+                                }
+                                // Generic fallback with original error
+                                throw new Error("Service account authentication failed: ".concat(message));
+                            case 6:
+                                return [
+                                    2
+                                ];
+                        }
+                    });
+                }).call(_this1);
+            };
+            return _object_spread_props(_object_spread({}, module), {
+                handler: wrappedHandler
+            });
+        };
+        return {
+            // Use structural constraints to avoid contravariance check on handler type.
+            // wrapAtPosition is now generic and returns T directly.
+            withToolAuth: function(module) {
+                return wrapAtPosition(module, 1);
+            },
+            withResourceAuth: function(module) {
+                return wrapAtPosition(module, 2);
+            },
+            withPromptAuth: function(module) {
+                return wrapAtPosition(module, 0);
+            }
+        };
+    };
+    return ServiceAccountProvider;
+}();
+/* CJS INTEROP */ if (exports.__esModule && exports.default) { try { Object.defineProperty(exports.default, '__esModule', { value: true }); for (var key in exports) { exports.default[key] = exports[key]; } } catch (_) {}; module.exports = exports.default; }