@steve31415/baselib 3.4.0 → 3.4.1

package/dist/ops/gcp-auth.d.ts

@@ -1,4 +1,4 @@
-import { GoogleAuth, OAuth2Client } from 'google-auth-library';
+import { type AuthClient } from 'google-auth-library';
 import type { Runner } from '../deploy/types.js';
 export type GcpCredential = {
     kind: 'adc';
@@ -22,4 +22,16 @@ export interface CredentialDeps {
 export declare function resolveGcpCredential(deps?: CredentialDeps): Promise<GcpCredential>;
 /** Short human description for the tool's progress line. */
 export declare function describeCredential(cred: GcpCredential): string;
-export declare function authClientFor(cred: GcpCredential): GoogleAuth | OAuth2Client;
+/** The client the connector will mint the IAM login token from. Always a
+ *  concrete AuthClient (JWT for a service-account key, UserRefreshClient for
+ *  an authorized-user ADC file, OAuth2Client around a ready token), never a
+ *  GoogleAuth: the connector tells the two apart with `instanceof GoogleAuth`
+ *  against ITS copy of google-auth-library, and when a consumer's install
+ *  hoists a different copy than baselib's (coder2, 2026-09-04 — connector
+ *  1.12 wants ^11, baselib ^10) a GoogleAuth of ours fails that check, gets
+ *  wrapped as if it were an AuthClient, and the wrapper's getAccessToken()
+ *  reads `.token` off the bare string GoogleAuth returns: "Failed to get
+ *  access token for automatic IAM authentication". An AuthClient crosses the
+ *  package boundary by duck typing alone, so the client carries both Cloud
+ *  SQL scopes itself rather than relying on the wrapper's. */
+export declare function authClientFor(cred: GcpCredential): Promise<AuthClient>;

package/dist/ops/gcp-auth.js

@@ -54,11 +54,23 @@ export function describeCredential(cred) {
             return `gcloud access token for ${cred.account}`;
     }
 }
-export function authClientFor(cred) {
+/** The client the connector will mint the IAM login token from. Always a
+ *  concrete AuthClient (JWT for a service-account key, UserRefreshClient for
+ *  an authorized-user ADC file, OAuth2Client around a ready token), never a
+ *  GoogleAuth: the connector tells the two apart with `instanceof GoogleAuth`
+ *  against ITS copy of google-auth-library, and when a consumer's install
+ *  hoists a different copy than baselib's (coder2, 2026-09-04 — connector
+ *  1.12 wants ^11, baselib ^10) a GoogleAuth of ours fails that check, gets
+ *  wrapped as if it were an AuthClient, and the wrapper's getAccessToken()
+ *  reads `.token` off the bare string GoogleAuth returns: "Failed to get
+ *  access token for automatic IAM authentication". An AuthClient crosses the
+ *  package boundary by duck typing alone, so the client carries both Cloud
+ *  SQL scopes itself rather than relying on the wrapper's. */
+export async function authClientFor(cred) {
     if (cred.kind === 'access-token') {
         const client = new OAuth2Client();
         client.setCredentials({ access_token: cred.token });
         return client;
     }
-    return new GoogleAuth({ keyFilename: cred.path, scopes: CLOUD_SQL_SCOPES });
+    return new GoogleAuth({ keyFilename: cred.path, scopes: CLOUD_SQL_SCOPES }).getClient();
 }

package/dist/ops/sql.js

@@ -104,7 +104,7 @@ function outputTypes() {
 export async function connectCloudSql(target, log, runner) {
     const cred = await resolveGcpCredential({ runner });
     log(`connecting to ${target.instance} db=${target.database} as ${target.user} via ${describeCredential(cred)}`);
-    const { options: connection, connector } = await cloudSqlClientOptions(target.instance, authClientFor(cred));
+    const { options: connection, connector } = await cloudSqlClientOptions(target.instance, await authClientFor(cred));
     const client = new pg.Client({
         ...connection,
         user: target.user,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@steve31415/baselib",
-  "version": "3.4.0",
+  "version": "3.4.1",
   "description": "Plasticine new-world shared platform library: logging, auth, service-to-service auth, db, HTTP, sync, app updates",
   "type": "module",
   "license": "MIT",