@visulima/storage 1.0.0-alpha.26 → 1.0.0-alpha.27

package/dist/storage/gcs/index.d.ts

@@ -1,3951 +1,15 @@
-import { F as File$1, m as MetaStorageOptions, L as LocalMetaStorageOptions, k as BaseStorageOptions, M as MetaStorage, H as HttpError, b as FileInit, d as FilePart, e as FileQuery, a as FileReturn, B as BaseStorage } from "../../packem_shared/storage.d-BOMUJD96.js";
+import { F as File, t as MetaStorageOptions, L as LocalMetaStorageOptions, l as BaseStorageOptions, M as MetaStorage, H as HttpError, e as FileInit, f as FilePart, g as FileQuery, a as FileReturn, B as BaseStorage } from "../../packem_shared/storage.d-Cr6f2lac.js";
 import 'node:stream';
-import * as _$undici_types0 from 'undici-types';
-import { Agent } from 'http';
-import * as stream from 'stream';
-import { Readable } from 'stream';
-import * as querystring from 'querystring';
-import * as _$google_logging_utils0 from 'google-logging-utils';
-import { EventEmitter } from 'events';
-import * as gcpMetadata from 'gcp-metadata';
+import { RetryConfig } from 'gaxios';
+import { GoogleAuthOptions, GoogleAuth } from 'google-auth-library';
 import 'node:crypto';
 import 'node:http';
 import 'lru-cache';
 declare const GCSConfig: Record<string, string | string[]>;
-declare class GCSFile extends File$1 {
+declare class GCSFile extends File {
   GCSUploadURI?: string;
   uri?: string;
 }
-/**
- * TypeScript does not have this type available globally - however `@types/node` includes `undici-types`, which has it:
- * - https://www.npmjs.com/package/@types/node/v/18.19.59?activeTab=dependencies
- *
- * Additionally, this is the TypeScript pattern for type sniffing and `import("undici-types")` is pretty common:
- * - https://github.com/DefinitelyTyped/DefinitelyTyped/blob/master/types/node/globals.d.ts
- */
-type _BodyInit = typeof globalThis extends {
-  BodyInit: infer T;
-} ? T : _$undici_types0.BodyInit;
-/**
- * An AIP-193 conforming error interface.
- *
- * @see {@link https://google.aip.dev/193#http11json-representation AIP-193}
- *
- * @param res the response object
- * @returns the extracted error information
- */
-
-/**
- * Support `instanceof` operator for `GaxiosError`s in different versions of this library.
- *
- * @see {@link GaxiosError[Symbol.hasInstance]}
- */
-declare const GAXIOS_ERROR_SYMBOL: unique symbol;
-declare class GaxiosError<T = ReturnType<JSON['parse']>> extends Error {
-  config: GaxiosOptionsPrepared;
-  response?: GaxiosResponse<T> | undefined;
-  /**
-   * An error code.
-   * Can be a system error code, DOMException error name, or any error's 'code' property where it is a `string`.
-   *
-   * It is only a `number` when the cause is sourced from an API-level error (AIP-193).
-   *
-   * @see {@link https://nodejs.org/api/errors.html#errorcode error.code}
-   * @see {@link https://developer.mozilla.org/en-US/docs/Web/API/DOMException#error_names DOMException#error_names}
-   * @see {@link https://google.aip.dev/193#http11json-representation AIP-193}
-   *
-   * @example
-   * 'ECONNRESET'
-   *
-   * @example
-   * 'TimeoutError'
-   *
-   * @example
-   * 500
-   */
-  code?: string | number;
-  /**
-   * An HTTP Status code.
-   * @see {@link https://developer.mozilla.org/en-US/docs/Web/API/Response/status Response#status}
-   *
-   * @example
-   * 500
-   */
-  status?: number;
-  /**
-   * @deprecated use {@link GaxiosError.cause} instead.
-   *
-   * @see {@link https://developer.mozilla.org/en-US/docs/Web/JavaScript/Reference/Global_Objects/Error/cause Error#cause}
-   *
-   * @privateRemarks
-   *
-   * We will want to remove this property later as the modern `cause` property is better suited
-   * for displaying and relaying nested errors. Keeping this here makes the resulting
-   * error log larger than it needs to be.
-   *
-   */
-  error?: Error | NodeJS.ErrnoException;
-  /**
-   * Support `instanceof` operator for `GaxiosError` across builds/duplicated files.
-   *
-   * @see {@link GAXIOS_ERROR_SYMBOL}
-   * @see {@link GaxiosError[Symbol.hasInstance]}
-   * @see {@link https://github.com/microsoft/TypeScript/issues/13965#issuecomment-278570200}
-   * @see {@link https://stackoverflow.com/questions/46618852/require-and-instanceof}
-   * @see {@link https://developer.mozilla.org/en-US/docs/Web/JavaScript/Reference/Global_Objects/Function/@@hasInstance#reverting_to_default_instanceof_behavior}
-   */
-  [GAXIOS_ERROR_SYMBOL]: string;
-  /**
-   * Support `instanceof` operator for `GaxiosError` across builds/duplicated files.
-   *
-   * @see {@link GAXIOS_ERROR_SYMBOL}
-   * @see {@link GaxiosError[GAXIOS_ERROR_SYMBOL]}
-   */
-  static [Symbol.hasInstance](instance: unknown): boolean;
-  constructor(message: string, config: GaxiosOptionsPrepared, response?: GaxiosResponse<T> | undefined, cause?: unknown);
-}
-type GaxiosResponseData = ReturnType<JSON['parse']> | GaxiosOptionsPrepared['data'];
-type GaxiosPromise<T = GaxiosResponseData> = Promise<GaxiosResponse<T>>;
-interface GaxiosResponse<T = GaxiosResponseData> extends Response {
-  config: GaxiosOptionsPrepared;
-  data: T;
-}
-interface GaxiosMultipartOptions {
-  headers: Headers;
-  content: string | Readable;
-}
-/**
- * Request options that are used to form the request.
- */
-interface GaxiosOptions extends RequestInit {
-  /**
-   * Optional method to override making the actual HTTP request. Useful
-   * for writing tests.
-   */
-  adapter?: <T = GaxiosResponseData>(options: GaxiosOptionsPrepared, defaultAdapter: (options: GaxiosOptionsPrepared) => GaxiosPromise<T>) => GaxiosPromise<T>;
-  url?: string | URL;
-  baseURL?: string | URL;
-  /**
-   * The data to send in the {@link RequestInit.body} of the request. Objects will be
-   * serialized as JSON, except for:
-   * - `ArrayBuffer`
-   * - `Blob`
-   * - `Buffer` (Node.js)
-   * - `DataView`
-   * - `File`
-   * - `FormData`
-   * - `ReadableStream`
-   * - `stream.Readable` (Node.js)
-   * - strings
-   * - `TypedArray` (e.g. `Uint8Array`, `BigInt64Array`)
-   * - `URLSearchParams`
-   * - all other objects where:
-   *   - headers['Content-Type'] === 'application/x-www-form-urlencoded' (serialized as `URLSearchParams`)
-   *
-   * In all other cases, if you would like to prevent `application/json` as the
-   * default `Content-Type` header you must provide a string or readable stream
-   * rather than an object, e.g.:
-   *
-   * ```ts
-   * {data: JSON.stringify({some: 'data'})}
-   * {data: fs.readFile('./some-data.jpeg')}
-   * ```
-   */
-  data?: _BodyInit | ArrayBuffer | Blob | Buffer | DataView | File | FormData | ReadableStream | Readable | string | ArrayBufferView | URLSearchParams | {};
-  /**
-   * The maximum size of the http response `Content-Length` in bytes allowed.
-   */
-  maxContentLength?: number;
-  /**
-   * The maximum number of redirects to follow. Defaults to 20.
-   *
-   * @deprecated non-spec. Should use `20` if enabled per-spec: https://fetch.spec.whatwg.org/#http-redirect-fetch
-   */
-  maxRedirects?: number;
-  /**
-   * @deprecated non-spec. Should use `20` if enabled per-spec: https://fetch.spec.whatwg.org/#http-redirect-fetch
-   */
-  follow?: number;
-  /**
-   * A collection of parts to send as a `Content-Type: multipart/related` request.
-   *
-   * This is passed to {@link RequestInit.body}.
-   */
-  multipart?: GaxiosMultipartOptions[];
-  params?: GaxiosResponseData;
-  /**
-   * @deprecated Use {@link URLSearchParams} instead and pass this directly to {@link GaxiosOptions.data `data`}.
-   */
-  paramsSerializer?: (params: {
-    [index: string]: string | number;
-  }) => string;
-  /**
-   * A timeout for the request, in milliseconds. No timeout by default.
-   */
-  timeout?: number;
-  /**
-   * @deprecated ignored
-   */
-  onUploadProgress?: (progressEvent: GaxiosResponseData) => void;
-  /**
-   * If the `fetchImplementation` is native `fetch`, the
-   * stream is a `ReadableStream`, otherwise `readable.Stream`
-   */
-  responseType?: 'arraybuffer' | 'blob' | 'json' | 'text' | 'stream' | 'unknown';
-  agent?: Agent | ((parsedUrl: URL) => Agent);
-  validateStatus?: (status: number) => boolean;
-  retryConfig?: RetryConfig;
-  retry?: boolean;
-  /**
-   * @deprecated non-spec. https://github.com/node-fetch/node-fetch/issues/1438
-   */
-  size?: number;
-  /**
-   * Implementation of `fetch` to use when making the API call. Will use `fetch` by default.
-   *
-   * @example
-   *
-   * let customFetchCalled = false;
-   * const myFetch = (...args: Parameters<typeof fetch>) => {
-   *  customFetchCalled = true;
-   *  return fetch(...args);
-   * };
-   *
-   * {fetchImplementation: myFetch};
-   */
-  fetchImplementation?: typeof fetch;
-  cert?: string;
-  key?: string;
-  /**
-   * An optional proxy to use for requests.
-   * Available via `process.env.HTTP_PROXY` and `process.env.HTTPS_PROXY` as well - with a preference for the this config option when multiple are available.
-   * The {@link GaxiosOptions.agent `agent`} option overrides this.
-   *
-   * @see {@link GaxiosOptions.noProxy}
-   * @see {@link GaxiosOptions.agent}
-   */
-  proxy?: string | URL;
-  /**
-   * A list for excluding traffic for proxies.
-   * Available via `process.env.NO_PROXY` as well as a common-separated list of strings - merged with any local `noProxy` rules.
-   *
-   * - When provided a string, it is matched by
-   *   - Wildcard `*.` and `.` matching are available. (e.g. `.example.com` or `*.example.com`)
-   * - When provided a URL, it is matched by the `.origin` property.
-   *   - For example, requesting `https://example.com` with the following `noProxy`s would result in a no proxy use:
-   *     - new URL('https://example.com')
-   *     - new URL('https://example.com:443')
-   *   - The following would be used with a proxy:
-   *     - new URL('http://example.com:80')
-   *     - new URL('https://example.com:8443')
-   * - When provided a regular expression it is used to match the stringified URL
-   *
-   * @see {@link GaxiosOptions.proxy}
-   */
-  noProxy?: (string | URL | RegExp)[];
-  /**
-   * An experimental error redactor.
-   *
-   * @remarks
-   *
-   * This does not replace the requirement for an active Data Loss Prevention (DLP) provider. For DLP suggestions, see:
-   * - https://cloud.google.com/sensitive-data-protection/docs/redacting-sensitive-data#dlp_deidentify_replace_infotype-nodejs
-   * - https://cloud.google.com/sensitive-data-protection/docs/infotypes-reference#credentials_and_secrets
-   *
-   * @experimental
-   */
-  errorRedactor?: typeof defaultErrorRedactor | false;
-}
-interface GaxiosOptionsPrepared extends GaxiosOptions {
-  headers: Headers;
-  url: URL;
-}
-/**
- * Gaxios retry configuration.
- */
-interface RetryConfig {
-  /**
-   * The number of times to retry the request.  Defaults to 3.
-   */
-  retry?: number;
-  /**
-   * The number of retries already attempted.
-   */
-  currentRetryAttempt?: number;
-  /**
-   * The amount of time to initially delay the retry, in ms.  Defaults to 100ms.
-   */
-  retryDelay?: number;
-  /**
-   * The HTTP Methods that will be automatically retried.
-   * Defaults to ['GET','PUT','HEAD','OPTIONS','DELETE']
-   */
-  httpMethodsToRetry?: string[];
-  /**
-   * The HTTP response status codes that will automatically be retried.
-   * Defaults to: [[100, 199], [408, 408], [429, 429], [500, 599]]
-   */
-  statusCodesToRetry?: number[][];
-  /**
-   * Function to invoke when a retry attempt is made.
-   */
-  onRetryAttempt?: (err: GaxiosError) => Promise<void> | void;
-  /**
-   * Function to invoke which determines if you should retry
-   */
-  shouldRetry?: (err: GaxiosError) => Promise<boolean> | boolean;
-  /**
-   * When there is no response, the number of retries to attempt. Defaults to 2.
-   */
-  noResponseRetries?: number;
-  /**
-   * Function to invoke which returns a promise. After the promise resolves,
-   * the retry will be triggered. If provided, this will be used in-place of
-   * the `retryDelay`
-   */
-  retryBackoff?: (err: GaxiosError, defaultBackoffMs: number) => Promise<void>;
-  /**
-   * Time that the initial request was made. Users should not set this directly.
-   */
-  timeOfFirstRequest?: number;
-  /**
-   * The length of time to keep retrying in ms. The last sleep period will
-   * be shortened as necessary, so that the last retry runs at deadline (and not
-   * considerably beyond it).  The total time starting from when the initial
-   * request is sent, after which an error will be returned, regardless of the
-   * retrying attempts made meanwhile. Defaults to Number.MAX_SAFE_INTEGER indicating to effectively
-   * ignore totalTimeout.
-   */
-  totalTimeout?: number;
-  maxRetryDelay?: number;
-  retryDelayMultiplier?: number;
-}
-/**
- * An experimental error redactor.
- *
- * @param config Config to potentially redact properties of
- * @param response Config to potentially redact properties of
- *
- * @experimental
- */
-declare function defaultErrorRedactor<O extends GaxiosOptionsPrepared, R extends GaxiosResponse<GaxiosResponseData>>(data: {
-  config?: O;
-  response?: R;
-}): {
-  config?: O;
-  response?: R;
-};
-/**
- * Interceptors that can be run for requests or responses. These interceptors run asynchronously.
- */
-interface GaxiosInterceptor<T extends GaxiosOptionsPrepared | GaxiosResponse> {
-  /**
-   * Function to be run when applying an interceptor.
-   *
-   * @param {T} configOrResponse The current configuration or response.
-   * @returns {Promise<T>} Promise that resolves to the modified set of options or response.
-   */
-  resolved?: (configOrResponse: T) => Promise<T>;
-  /**
-   * Function to be run if the previous call to resolved throws / rejects or the request results in an invalid status
-   * as determined by the call to validateStatus.
-   *
-   * @param {GaxiosError} err The error thrown from the previously called resolved function.
-   */
-  rejected?: (err: GaxiosError) => void;
-}
-/**
- * Class to manage collections of GaxiosInterceptors for both requests and responses.
- */
-declare class GaxiosInterceptorManager<T extends GaxiosOptionsPrepared | GaxiosResponse> extends Set<GaxiosInterceptor<T> | null> {}
-/**
- * An interface for enforcing `fetch`-type compliance.
- *
- * @remarks
- *
- * This provides type guarantees during build-time, ensuring the `fetch` method is 1:1
- * compatible with the `fetch` API.
- */
-interface FetchCompliance {
-  fetch: typeof fetch;
-}
-declare class Gaxios implements FetchCompliance {
-  #private;
-  protected agentCache: Map<string | URL, Agent | ((parsedUrl: URL) => Agent)>;
-  /**
-   * Default HTTP options that will be used for every HTTP request.
-   */
-  defaults: GaxiosOptions;
-  /**
-   * Interceptors
-   */
-  interceptors: {
-    request: GaxiosInterceptorManager<GaxiosOptionsPrepared>;
-    response: GaxiosInterceptorManager<GaxiosResponse>;
-  };
-  /**
-   * The Gaxios class is responsible for making HTTP requests.
-   * @param defaults The default set of options to be used for this instance.
-   */
-  constructor(defaults?: GaxiosOptions);
-  /**
-   * A {@link fetch `fetch`} compliant API for {@link Gaxios}.
-   *
-   * @remarks
-   *
-   * This is useful as a drop-in replacement for `fetch` API usage.
-   *
-   * @example
-   *
-   * ```ts
-   * const gaxios = new Gaxios();
-   * const myFetch: typeof fetch = (...args) => gaxios.fetch(...args);
-   * await myFetch('https://example.com');
-   * ```
-   *
-   * @param args `fetch` API or `Gaxios#request` parameters
-   * @returns the {@link Response} with Gaxios-added properties
-   */
-  fetch<T = unknown>(...args: Parameters<typeof fetch> | Parameters<Gaxios['request']>): GaxiosPromise<T>;
-  /**
-   * Perform an HTTP request with the given options.
-   * @param opts Set of HTTP options that will be used for this HTTP request.
-   */
-  request<T = ReturnType<JSON['parse']>>(opts?: GaxiosOptions): GaxiosPromise<T>;
-  private _defaultAdapter;
-  /**
-   * Internal, retryable version of the `request` method.
-   * @param opts Set of HTTP options that will be used for this HTTP request.
-   */
-  protected _request<T = ReturnType<JSON['parse']>>(opts: GaxiosOptionsPrepared): GaxiosPromise<T>;
-  private getResponseData;
-  /**
-   * By default, throw for any non-2xx status code
-   * @param status status code from the HTTP response
-   */
-  private validateStatus;
-  /**
-   * Attempts to parse a response by looking at the Content-Type header.
-   * @param {Response} response the HTTP response.
-   * @returns a promise that resolves to the response data.
-   */
-  private getResponseDataFromContentType;
-  /**
-   * Creates an async generator that yields the pieces of a multipart/related request body.
-   * This implementation follows the spec: https://www.ietf.org/rfc/rfc2387.txt. However, recursive
-   * multipart/related requests are not currently supported.
-   *
-   * @param {GaxiosMultipartOptions[]} multipartOptions the pieces to turn into a multipart/related body.
-   * @param {string} boundary the boundary string to be placed between each part.
-   */
-  private getMultipartRequest;
-  /**
-   * Merges headers.
-   * If the base headers do not exist a new `Headers` object will be returned.
-   *
-   * @remarks
-   *
-   * Using this utility can be helpful when the headers are not known to exist:
-   * - if they exist as `Headers`, that instance will be used
-   *   - it improves performance and allows users to use their existing references to their `Headers`
-   * - if they exist in another form (`HeadersInit`), they will be used to create a new `Headers` object
-   * - if the base headers do not exist a new `Headers` object will be created
-   *
-   * @param base headers to append/overwrite to
-   * @param append headers to append/overwrite with
-   * @returns the base headers instance with merged `Headers`
-   */
-  static mergeHeaders(base?: HeadersInit$1, ...append: HeadersInit$1[]): Headers;
-}
-type HeadersInit$1 = ConstructorParameters<typeof Headers>[0];
-/**
- * The default instance used when the `request` method is directly
- * invoked.
- */
-declare const instance: Gaxios;
-/**
- * Make an HTTP request using the given options.
- * @param opts Options for the request
- */
-declare function request<T>(opts: GaxiosOptions): Promise<GaxiosResponse<T>>;
-interface Credentials {
-  /**
-   * This field is only present if the access_type parameter was set to offline in the authentication request. For details, see Refresh tokens.
-   */
-  refresh_token?: string | null;
-  /**
-   * The time in ms at which this token is thought to expire.
-   */
-  expiry_date?: number | null;
-  /**
-   * A token that can be sent to a Google API.
-   */
-  access_token?: string | null;
-  /**
-   * Identifies the type of token returned. At this time, this field always has the value Bearer.
-   */
-  token_type?: string | null;
-  /**
-   * A JWT that contains identity information about the user that is digitally signed by Google.
-   */
-  id_token?: string | null;
-  /**
-   * The scopes of access granted by the access_token expressed as a list of space-delimited, case-sensitive strings.
-   */
-  scope?: string;
-}
-interface CredentialRequest {
-  /**
-   * This field is only present if the access_type parameter was set to offline in the authentication request. For details, see Refresh tokens.
-   */
-  refresh_token?: string;
-  /**
-   * A token that can be sent to a Google API.
-   */
-  access_token?: string;
-  /**
-   * Identifies the type of token returned. At this time, this field always has the value Bearer.
-   */
-  token_type?: string;
-  /**
-   * The remaining lifetime of the access token in seconds.
-   */
-  expires_in?: number;
-  /**
-   * A JWT that contains identity information about the user that is digitally signed by Google.
-   */
-  id_token?: string;
-  /**
-   * The scopes of access granted by the access_token expressed as a list of space-delimited, case-sensitive strings.
-   */
-  scope?: string;
-}
-interface JWTInput {
-  type?: string;
-  client_email?: string;
-  private_key?: string;
-  private_key_id?: string;
-  project_id?: string;
-  client_id?: string;
-  client_secret?: string;
-  refresh_token?: string;
-  quota_project_id?: string;
-  universe_domain?: string;
-}
-interface ImpersonatedJWTInput {
-  type?: string;
-  source_credentials?: JWTInput;
-  service_account_impersonation_url?: string;
-  delegates?: string[];
-  scopes?: string[];
-}
-interface CredentialBody {
-  client_email?: string;
-  private_key?: string;
-  universe_domain?: string;
-}
-interface JwkCertificate {
-  kty: string;
-  alg: string;
-  use?: string;
-  kid: string;
-  n: string;
-  e: string;
-}
-/**
- * A utility for converting snake_case to camelCase.
- *
- * For, for example `my_snake_string` becomes `mySnakeString`.
- */
-type SnakeToCamel<S> = S extends `${infer FirstWord}_${infer Remainder}` ? `${FirstWord}${Capitalize<SnakeToCamel<Remainder>>}` : S;
-/**
- * A utility for converting an type's keys from snake_case
- * to camelCase, if the keys are strings.
- *
- * For example:
- *
- * ```ts
- * {
- *   my_snake_string: boolean;
- *   myCamelString: string;
- *   my_snake_obj: {
- *     my_snake_obj_string: string;
- *   };
- * }
- * ```
- *
- * becomes:
- *
- * ```ts
- * {
- *   mySnakeString: boolean;
- *   myCamelString: string;
- *   mySnakeObj: {
- *     mySnakeObjString: string;
- *   }
- * }
- * ```
- *
- * @remarks
- *
- * The generated documentation for the camelCase'd properties won't be available
- * until {@link https://github.com/microsoft/TypeScript/issues/50715} has been
- * resolved.
- */
-type SnakeToCamelObject<T> = { [K in keyof T as SnakeToCamel<K>]: T[K] extends {} ? SnakeToCamelObject<T[K]> : T[K] };
-/**
- * A utility for adding camelCase versions of a type's snake_case keys, if the
- * keys are strings, preserving any existing keys.
- *
- * For example:
- *
- * ```ts
- * {
- *   my_snake_boolean: boolean;
- *   myCamelString: string;
- *   my_snake_obj: {
- *     my_snake_obj_string: string;
- *   };
- * }
- * ```
- *
- * becomes:
- *
- * ```ts
- * {
- *   my_snake_boolean: boolean;
- *   mySnakeBoolean: boolean;
- *   myCamelString: string;
- *   my_snake_obj: {
- *     my_snake_obj_string: string;
- *   };
- *   mySnakeObj: {
- *     mySnakeObjString: string;
- *   }
- * }
- * ```
- * @remarks
- *
- * The generated documentation for the camelCase'd properties won't be available
- * until {@link https://github.com/microsoft/TypeScript/issues/50715} has been
- * resolved.
- *
- * Tracking: {@link https://github.com/googleapis/google-auth-library-nodejs/issues/1686}
- */
-type OriginalAndCamel<T> = { [K in keyof T as K | SnakeToCamel<K>]: T[K] extends {} ? OriginalAndCamel<T[K]> : T[K] };
-/**
- * An interface for enforcing `fetch`-type compliance.
- *
- * @remarks
- *
- * This provides type guarantees during build-time, ensuring the `fetch` method is 1:1
- * compatible with the `Gaxios#fetch` API.
- */
-interface GaxiosFetchCompliance {
-  fetch: typeof fetch | Gaxios['fetch'];
-}
-/**
- * Easy access to symbol-indexed strings on config objects.
- */
-
-/**
- * Base auth configurations (e.g. from JWT or `.json` files) with conventional
- * camelCased options.
- *
- * @privateRemarks
- *
- * This interface is purposely not exported so that it can be removed once
- * {@link https://github.com/microsoft/TypeScript/issues/50715} has been
- * resolved. Then, we can use {@link OriginalAndCamel} to shrink this interface.
- *
- * Tracking: {@link https://github.com/googleapis/google-auth-library-nodejs/issues/1686}
- */
-interface AuthJSONOptions {
-  /**
-   * The project ID corresponding to the current credentials if available.
-   */
-  project_id: string | null;
-  /**
-   * An alias for {@link AuthJSONOptions.project_id `project_id`}.
-   */
-  projectId: AuthJSONOptions['project_id'];
-  /**
-   * The quota project ID. The quota project can be used by client libraries for the billing purpose.
-   * See {@link https://cloud.google.com/docs/quota Working with quotas}
-   */
-  quota_project_id: string;
-  /**
-   * An alias for {@link AuthJSONOptions.quota_project_id `quota_project_id`}.
-   */
-  quotaProjectId: AuthJSONOptions['quota_project_id'];
-  /**
-   * The default service domain for a given Cloud universe.
-   *
-   * @example
-   * 'googleapis.com'
-   */
-  universe_domain: string;
-  /**
-   * An alias for {@link AuthJSONOptions.universe_domain `universe_domain`}.
-   */
-  universeDomain: AuthJSONOptions['universe_domain'];
-}
-/**
- * Base `AuthClient` configuration.
- *
- * The camelCased options are aliases of the snake_cased options, supporting both
- * JSON API and JS conventions.
- */
-interface AuthClientOptions extends Partial<OriginalAndCamel<AuthJSONOptions>> {
-  /**
-   * An API key to use, optional.
-   */
-  apiKey?: string;
-  credentials?: Credentials;
-  /**
-   * The {@link Gaxios `Gaxios`} instance used for making requests.
-   *
-   * @see {@link AuthClientOptions.useAuthRequestParameters}
-   */
-  transporter?: Gaxios;
-  /**
-   * Provides default options to the transporter, such as {@link GaxiosOptions.agent `agent`} or
-   *  {@link GaxiosOptions.retryConfig `retryConfig`}.
-   *
-   * This option is ignored if {@link AuthClientOptions.transporter `gaxios`} has been provided
-   */
-  transporterOptions?: GaxiosOptions;
-  /**
-   * The expiration threshold in milliseconds before forcing token refresh of
-   * unexpired tokens.
-   */
-  eagerRefreshThresholdMillis?: number;
-  /**
-   * Whether to attempt to refresh tokens on status 401/403 responses
-   * even if an attempt is made to refresh the token preemptively based
-   * on the expiry_date.
-   */
-  forceRefreshOnFailure?: boolean;
-  /**
-   * Enables/disables the adding of the AuthClient's default interceptor.
-   *
-   * @see {@link AuthClientOptions.transporter}
-   *
-   * @remarks
-   *
-   * Disabling is useful for debugging and experimentation.
-   *
-   * @default true
-   */
-  useAuthRequestParameters?: boolean;
-}
-/**
- * The default cloud universe
- *
- * @see {@link AuthJSONOptions.universe_domain}
- */
-declare const DEFAULT_UNIVERSE = "googleapis.com";
-/**
- * Defines the root interface for all clients that generate credentials
- * for calling Google APIs. All clients should implement this interface.
- */
-interface CredentialsClient {
-  projectId?: AuthClientOptions['projectId'];
-  eagerRefreshThresholdMillis: NonNullable<AuthClientOptions['eagerRefreshThresholdMillis']>;
-  forceRefreshOnFailure: NonNullable<AuthClientOptions['forceRefreshOnFailure']>;
-  /**
-   * @return A promise that resolves with the current GCP access token
-   *   response. If the current credential is expired, a new one is retrieved.
-   */
-  getAccessToken(): Promise<GetAccessTokenResponse>;
-  /**
-   * The main authentication interface. It takes an optional url which when
-   * present is the endpoint being accessed, and returns a Promise which
-   * resolves with authorization header fields.
-   *
-   * The result has the form:
-   * { authorization: 'Bearer <access_token_value>' }
-   * @param url The URI being authorized.
-   */
-  getRequestHeaders(url?: string | URL): Promise<Headers>;
-  /**
-   * Provides an alternative Gaxios request implementation with auth credentials
-   */
-  request<T>(opts: GaxiosOptions): GaxiosPromise<T>;
-  /**
-   * Sets the auth credentials.
-   */
-  setCredentials(credentials: Credentials): void;
-  /**
-   * Subscribes a listener to the tokens event triggered when a token is
-   * generated.
-   *
-   * @param event The tokens event to subscribe to.
-   * @param listener The listener that triggers on event trigger.
-   * @return The current client instance.
-   */
-  on(event: 'tokens', listener: (tokens: Credentials) => void): this;
-}
-declare interface AuthClient {
-  on(event: 'tokens', listener: (tokens: Credentials) => void): this;
-}
-/**
- * The base of all Auth Clients.
- */
-declare abstract class AuthClient extends EventEmitter implements CredentialsClient, GaxiosFetchCompliance {
-  apiKey?: string;
-  projectId?: string | null;
-  /**
-   * The quota project ID. The quota project can be used by client libraries for the billing purpose.
-   * See {@link https://cloud.google.com/docs/quota Working with quotas}
-   */
-  quotaProjectId?: string;
-  /**
-   * The {@link Gaxios `Gaxios`} instance used for making requests.
-   */
-  transporter: Gaxios;
-  credentials: Credentials;
-  eagerRefreshThresholdMillis: number;
-  forceRefreshOnFailure: boolean;
-  universeDomain: string;
-  /**
-   * Symbols that can be added to GaxiosOptions to specify the method name that is
-   * making an RPC call, for logging purposes, as well as a string ID that can be
-   * used to correlate calls and responses.
-   */
-  static readonly RequestMethodNameSymbol: unique symbol;
-  static readonly RequestLogIdSymbol: unique symbol;
-  constructor(opts?: AuthClientOptions);
-  /**
-   * A {@link fetch `fetch`} compliant API for {@link AuthClient}.
-   *
-   * @see {@link AuthClient.request} for the classic method.
-   *
-   * @remarks
-   *
-   * This is useful as a drop-in replacement for `fetch` API usage.
-   *
-   * @example
-   *
-   * ```ts
-   * const authClient = new AuthClient();
-   * const fetchWithAuthClient: typeof fetch = (...args) => authClient.fetch(...args);
-   * await fetchWithAuthClient('https://example.com');
-   * ```
-   *
-   * @param args `fetch` API or {@link Gaxios.fetch `Gaxios#fetch`} parameters
-   * @returns the {@link GaxiosResponse} with Gaxios-added properties
-   */
-  fetch<T>(...args: Parameters<Gaxios['fetch']>): GaxiosPromise<T>;
-  /**
-   * The public request API in which credentials may be added to the request.
-   *
-   * @see {@link AuthClient.fetch} for the modern method.
-   *
-   * @param options options for `gaxios`
-   */
-  abstract request<T>(options: GaxiosOptions): GaxiosPromise<T>;
-  /**
-   * The main authentication interface. It takes an optional url which when
-   * present is the endpoint being accessed, and returns a Promise which
-   * resolves with authorization header fields.
-   *
-   * The result has the form:
-   * ```ts
-   * new Headers({'authorization': 'Bearer <access_token_value>'});
-   * ```
-   *
-   * @param url The URI being authorized.
-   */
-  abstract getRequestHeaders(url?: string | URL): Promise<Headers>;
-  /**
-   * @return A promise that resolves with the current GCP access token
-   *   response. If the current credential is expired, a new one is retrieved.
-   */
-  abstract getAccessToken(): Promise<{
-    token?: string | null;
-    res?: GaxiosResponse | null;
-  }>;
-  /**
-   * Sets the auth credentials.
-   */
-  setCredentials(credentials: Credentials): void;
-  /**
-   * Append additional headers, e.g., x-goog-user-project, shared across the
-   * classes inheriting AuthClient. This method should be used by any method
-   * that overrides getRequestMetadataAsync(), which is a shared helper for
-   * setting request information in both gRPC and HTTP API calls.
-   *
-   * @param headers object to append additional headers to.
-   */
-  protected addSharedMetadataHeaders(headers: Headers): Headers;
-  /**
-   * Adds the `x-goog-user-project` and `authorization` headers to the target Headers
-   * object, if they exist on the source.
-   *
-   * @param target the headers to target
-   * @param source the headers to source from
-   * @returns the target headers
-   */
-  protected addUserProjectAndAuthHeaders<T extends Headers>(target: T, source: Headers): T;
-  static log: _$google_logging_utils0.AdhocDebugLogFunction;
-  static readonly DEFAULT_REQUEST_INTERCEPTOR: Parameters<Gaxios['interceptors']['request']['add']>[0];
-  static readonly DEFAULT_RESPONSE_INTERCEPTOR: Parameters<Gaxios['interceptors']['response']['add']>[0];
-  /**
-   * Sets the method name that is making a Gaxios request, so that logging may tag
-   * log lines with the operation.
-   * @param config A Gaxios request config
-   * @param methodName The method name making the call
-   */
-  static setMethodName(config: GaxiosOptions, methodName: string): void;
-  /**
-   * Retry config for Auth-related requests.
-   *
-   * @remarks
-   *
-   * This is not a part of the default {@link AuthClient.transporter transporter/gaxios}
-   * config as some downstream APIs would prefer if customers explicitly enable retries,
-   * such as GCS.
-   */
-  protected static get RETRY_CONFIG(): GaxiosOptions;
-}
-type HeadersInit = ConstructorParameters<typeof Headers>[0];
-interface GetAccessTokenResponse {
-  token?: string | null;
-  res?: GaxiosResponse | null;
-}
-/**
- * @deprecated - use the Promise API instead
- */
-interface BodyResponseCallback<T> {
-  (err: Error | null, res?: GaxiosResponse<T> | null): void;
-}
-declare class LoginTicket {
-  private envelope?;
-  private payload?;
-  /**
-   * Create a simple class to extract user ID from an ID Token
-   *
-   * @param {string} env Envelope of the jwt
-   * @param {TokenPayload} pay Payload of the jwt
-   * @constructor
-   */
-  constructor(env?: string, pay?: TokenPayload);
-  getEnvelope(): string | undefined;
-  getPayload(): TokenPayload | undefined;
-  /**
-   * Create a simple class to extract user ID from an ID Token
-   *
-   * @return The user ID
-   */
-  getUserId(): string | null;
-  /**
-   * Returns attributes from the login ticket.  This can contain
-   * various information about the user session.
-   *
-   * @return The envelope and payload
-   */
-  getAttributes(): {
-    envelope: string | undefined;
-    payload: TokenPayload | undefined;
-  };
-}
-interface TokenPayload {
-  /**
-   * The Issuer Identifier for the Issuer of the response. Always
-   * https://accounts.google.com or accounts.google.com for Google ID tokens.
-   */
-  iss: string;
-  /**
-   * Access token hash. Provides validation that the access token is tied to the
-   * identity token. If the ID token is issued with an access token in the
-   * server flow, this is always included. This can be used as an alternate
-   * mechanism to protect against cross-site request forgery attacks, but if you
-   * follow Step 1 and Step 3 it is not necessary to verify the access token.
-   */
-  at_hash?: string;
-  /**
-   * True if the user's e-mail address has been verified; otherwise false.
-   */
-  email_verified?: boolean;
-  /**
-   * An identifier for the user, unique among all Google accounts and never
-   * reused. A Google account can have multiple emails at different points in
-   * time, but the sub value is never changed. Use sub within your application
-   * as the unique-identifier key for the user.
-   */
-  sub: string;
-  /**
-   * The client_id of the authorized presenter. This claim is only needed when
-   * the party requesting the ID token is not the same as the audience of the ID
-   * token. This may be the case at Google for hybrid apps where a web
-   * application and Android app have a different client_id but share the same
-   * project.
-   */
-  azp?: string;
-  /**
-   * The user's email address. This may not be unique and is not suitable for
-   * use as a primary key. Provided only if your scope included the string
-   * "email".
-   */
-  email?: string;
-  /**
-   * The URL of the user's profile page. Might be provided when:
-   * - The request scope included the string "profile"
-   * - The ID token is returned from a token refresh
-   * - When profile claims are present, you can use them to update your app's
-   * user records. Note that this claim is never guaranteed to be present.
-   */
-  profile?: string;
-  /**
-   * The URL of the user's profile picture. Might be provided when:
-   * - The request scope included the string "profile"
-   * - The ID token is returned from a token refresh
-   * - When picture claims are present, you can use them to update your app's
-   * user records. Note that this claim is never guaranteed to be present.
-   */
-  picture?: string;
-  /**
-   * The user's full name, in a displayable form. Might be provided when:
-   * - The request scope included the string "profile"
-   * - The ID token is returned from a token refresh
-   * - When name claims are present, you can use them to update your app's user
-   * records. Note that this claim is never guaranteed to be present.
-   */
-  name?: string;
-  /**
-   * The user's given name, in a displayable form. Might be provided when:
-   * - The request scope included the string "profile"
-   * - The ID token is returned from a token refresh
-   * - When name claims are present, you can use them to update your app's user
-   * records. Note that this claim is never guaranteed to be present.
-   */
-  given_name?: string;
-  /**
-   * The user's family name, in a displayable form. Might be provided when:
-   * - The request scope included the string "profile"
-   * - The ID token is returned from a token refresh
-   * - When name claims are present, you can use them to update your app's user
-   * records. Note that this claim is never guaranteed to be present.
-   */
-  family_name?: string;
-  /**
-   * Identifies the audience that this ID token is intended for. It must be one
-   * of the OAuth 2.0 client IDs of your application.
-   */
-  aud: string;
-  /**
-   * The time the ID token was issued, represented in Unix time (integer
-   * seconds).
-   */
-  iat: number;
-  /**
-   * The time the ID token expires, represented in Unix time (integer seconds).
-   */
-  exp: number;
-  /**
-   * The value of the nonce supplied by your app in the authentication request.
-   * You should enforce protection against replay attacks by ensuring it is
-   * presented only once.
-   */
-  nonce?: string;
-  /**
-   * The hosted G Suite domain of the user. Provided only if the user belongs to
-   * a hosted domain.
-   */
-  hd?: string;
-  /**
-   * The user's locale, represented by a BCP 47 language tag.
-   * Might be provided when a name claim is present.
-   */
-  locale?: string;
-}
-/**
- * The results from the `generateCodeVerifierAsync` method.  To learn more,
- * See the sample:
- * https://github.com/googleapis/google-auth-library-nodejs/blob/main/samples/oauth2-codeVerifier.js
- */
-interface CodeVerifierResults {
-  /**
-   * The code verifier that will be used when calling `getToken` to obtain a new
-   * access token.
-   */
-  codeVerifier: string;
-  /**
-   * The code_challenge that should be sent with the `generateAuthUrl` call
-   * to obtain a verifiable authentication url.
-   */
-  codeChallenge?: string;
-}
-interface Certificates {
-  [index: string]: string | JwkCertificate;
-}
-interface PublicKeys {
-  [index: string]: string;
-}
-declare enum CodeChallengeMethod {
-  Plain = "plain",
-  S256 = "S256",
-}
-declare enum CertificateFormat {
-  PEM = "PEM",
-  JWK = "JWK",
-}
-/**
- * The client authentication type. Supported values are basic, post, and none.
- * https://datatracker.ietf.org/doc/html/rfc7591#section-2
- */
-declare enum ClientAuthentication$1 {
-  ClientSecretPost = "ClientSecretPost",
-  ClientSecretBasic = "ClientSecretBasic",
-  None = "None",
-}
-interface GetTokenOptions$1 {
-  code: string;
-  codeVerifier?: string;
-  /**
-   * The client ID for your application. The value passed into the constructor
-   * will be used if not provided. Must match any client_id option passed to
-   * a corresponding call to generateAuthUrl.
-   */
-  client_id?: string;
-  /**
-   * Determines where the API server redirects the user after the user
-   * completes the authorization flow. The value passed into the constructor
-   * will be used if not provided. Must match any redirect_uri option passed to
-   * a corresponding call to generateAuthUrl.
-   */
-  redirect_uri?: string;
-}
-interface TokenInfo {
-  /**
-   * The application that is the intended user of the access token.
-   */
-  aud: string;
-  /**
-   * This value lets you correlate profile information from multiple Google
-   * APIs. It is only present in the response if you included the profile scope
-   * in your request in step 1. The field value is an immutable identifier for
-   * the logged-in user that can be used to create and manage user sessions in
-   * your application. The identifier is the same regardless of which client ID
-   * is used to retrieve it. This enables multiple applications in the same
-   * organization to correlate profile information.
-   */
-  user_id?: string;
-  /**
-   * An array of scopes that the user granted access to.
-   */
-  scopes: string[];
-  /**
-   * The datetime when the token becomes invalid.
-   */
-  expiry_date: number;
-  /**
-   * An identifier for the user, unique among all Google accounts and never
-   * reused. A Google account can have multiple emails at different points in
-   * time, but the sub value is never changed. Use sub within your application
-   * as the unique-identifier key for the user.
-   */
-  sub?: string;
-  /**
-   * The client_id of the authorized presenter. This claim is only needed when
-   * the party requesting the ID token is not the same as the audience of the ID
-   * token. This may be the case at Google for hybrid apps where a web
-   * application and Android app have a different client_id but share the same
-   * project.
-   */
-  azp?: string;
-  /**
-   * Indicates whether your application can refresh access tokens
-   * when the user is not present at the browser. Valid parameter values are
-   * 'online', which is the default value, and 'offline'. Set the value to
-   * 'offline' if your application needs to refresh access tokens when the user
-   * is not present at the browser. This value instructs the Google
-   * authorization server to return a refresh token and an access token the
-   * first time that your application exchanges an authorization code for
-   * tokens.
-   */
-  access_type?: string;
-  /**
-   * The user's email address. This value may not be unique to this user and
-   * is not suitable for use as a primary key. Provided only if your scope
-   * included the email scope value.
-   */
-  email?: string;
-  /**
-   * True if the user's e-mail address has been verified; otherwise false.
-   */
-  email_verified?: boolean;
-}
-interface GenerateAuthUrlOpts {
-  /**
-   * Recommended. Indicates whether your application can refresh access tokens
-   * when the user is not present at the browser. Valid parameter values are
-   * 'online', which is the default value, and 'offline'. Set the value to
-   * 'offline' if your application needs to refresh access tokens when the user
-   * is not present at the browser. This value instructs the Google
-   * authorization server to return a refresh token and an access token the
-   * first time that your application exchanges an authorization code for
-   * tokens.
-   */
-  access_type?: string;
-  /**
-   * The hd (hosted domain) parameter streamlines the login process for G Suite
-   * hosted accounts. By including the domain of the G Suite user (for example,
-   * mycollege.edu), you can indicate that the account selection UI should be
-   * optimized for accounts at that domain. To optimize for G Suite accounts
-   * generally instead of just one domain, use an asterisk: hd=*.
-   * Don't rely on this UI optimization to control who can access your app,
-   * as client-side requests can be modified. Be sure to validate that the
-   * returned ID token has an hd claim value that matches what you expect
-   * (e.g. mycolledge.edu). Unlike the request parameter, the ID token claim is
-   * contained within a security token from Google, so the value can be trusted.
-   */
-  hd?: string;
-  /**
-   * The 'response_type' will always be set to 'CODE'.
-   */
-  response_type?: string;
-  /**
-   * The client ID for your application. The value passed into the constructor
-   * will be used if not provided. You can find this value in the API Console.
-   */
-  client_id?: string;
-  /**
-   * Determines where the API server redirects the user after the user
-   * completes the authorization flow. The value must exactly match one of the
-   * 'redirect_uri' values listed for your project in the API Console. Note that
-   * the http or https scheme, case, and trailing slash ('/') must all match.
-   * The value passed into the constructor will be used if not provided.
-   */
-  redirect_uri?: string;
-  /**
-   * Required. A space-delimited list of scopes that identify the resources that
-   * your application could access on the user's behalf. These values inform the
-   * consent screen that Google displays to the user. Scopes enable your
-   * application to only request access to the resources that it needs while
-   * also enabling users to control the amount of access that they grant to your
-   * application. Thus, there is an inverse relationship between the number of
-   * scopes requested and the likelihood of obtaining user consent. The
-   * OAuth 2.0 API Scopes document provides a full list of scopes that you might
-   * use to access Google APIs. We recommend that your application request
-   * access to authorization scopes in context whenever possible. By requesting
-   * access to user data in context, via incremental authorization, you help
-   * users to more easily understand why your application needs the access it is
-   * requesting.
-   */
-  scope?: string[] | string;
-  /**
-   * Recommended. Specifies any string value that your application uses to
-   * maintain state between your authorization request and the authorization
-   * server's response. The server returns the exact value that you send as a
-   * name=value pair in the hash (#) fragment of the 'redirect_uri' after the
-   * user consents to or denies your application's access request. You can use
-   * this parameter for several purposes, such as directing the user to the
-   * correct resource in your application, sending nonces, and mitigating
-   * cross-site request forgery. Since your redirect_uri can be guessed, using a
-   * state value can increase your assurance that an incoming connection is the
-   * result of an authentication request. If you generate a random string or
-   * encode the hash of a cookie or another value that captures the client's
-   * state, you can validate the response to additionally ensure that the
-   * request and response originated in the same browser, providing protection
-   * against attacks such as cross-site request forgery. See the OpenID Connect
-   * documentation for an example of how to create and confirm a state token.
-   */
-  state?: string;
-  /**
-   * Optional. Enables applications to use incremental authorization to request
-   * access to additional scopes in context. If you set this parameter's value
-   * to true and the authorization request is granted, then the new access token
-   * will also cover any scopes to which the user previously granted the
-   * application access. See the incremental authorization section for examples.
-   */
-  include_granted_scopes?: boolean;
-  /**
-   * Optional. If your application knows which user is trying to authenticate,
-   * it can use this parameter to provide a hint to the Google Authentication
-   * Server. The server uses the hint to simplify the login flow either by
-   * prefilling the email field in the sign-in form or by selecting the
-   * appropriate multi-login session. Set the parameter value to an email
-   * address or sub identifier, which is equivalent to the user's Google ID.
-   */
-  login_hint?: string;
-  /**
-   * Optional. A space-delimited, case-sensitive list of prompts to present the
-   * user. If you don't specify this parameter, the user will be prompted only
-   * the first time your app requests access.  Possible values are:
-   *
-   * 'none' - Donot display any authentication or consent screens. Must not be
-   *        specified with other values.
-   * 'consent' - 	Prompt the user for consent.
-   * 'select_account' - Prompt the user to select an account.
-   */
-  prompt?: string;
-  /**
-   * Recommended. Specifies what method was used to encode a 'code_verifier'
-   * that will be used during authorization code exchange. This parameter must
-   * be used with the 'code_challenge' parameter. The value of the
-   * 'code_challenge_method' defaults to "plain" if not present in the request
-   * that includes a 'code_challenge'. The only supported values for this
-   * parameter are "S256" or "plain".
-   */
-  code_challenge_method?: CodeChallengeMethod;
-  /**
-   * Recommended. Specifies an encoded 'code_verifier' that will be used as a
-   * server-side challenge during authorization code exchange. This parameter
-   * must be used with the 'code_challenge' parameter described above.
-   */
-  code_challenge?: string;
-  /**
-   * A way for developers and/or the auth team to provide a set of key value
-   * pairs to be added as query parameters to the authorization url.
-   */
-  [key: string]: querystring.ParsedUrlQueryInput[keyof querystring.ParsedUrlQueryInput];
-}
-interface AccessTokenResponse {
-  access_token: string;
-  expiry_date: number;
-}
-interface GetRefreshHandlerCallback {
-  (): Promise<AccessTokenResponse>;
-}
-interface GetTokenCallback$1 {
-  (err: GaxiosError | null, token?: Credentials | null, res?: GaxiosResponse | null): void;
-}
-interface GetTokenResponse {
-  tokens: Credentials;
-  res: GaxiosResponse | null;
-}
-interface GetAccessTokenCallback {
-  (err: GaxiosError | null, token?: string | null, res?: GaxiosResponse | null): void;
-}
-interface RefreshAccessTokenCallback {
-  (err: GaxiosError | null, credentials?: Credentials | null, res?: GaxiosResponse | null): void;
-}
-interface RefreshAccessTokenResponse {
-  credentials: Credentials;
-  res: GaxiosResponse | null;
-}
-interface RequestMetadataResponse {
-  headers: Headers;
-  res?: GaxiosResponse<void> | null;
-}
-interface GetFederatedSignonCertsCallback {
-  (err: GaxiosError | null, certs?: Certificates, response?: GaxiosResponse<void> | null): void;
-}
-interface FederatedSignonCertsResponse {
-  certs: Certificates;
-  format: CertificateFormat;
-  res?: GaxiosResponse<void> | null;
-}
-interface GetIapPublicKeysCallback {
-  (err: GaxiosError | null, pubkeys?: PublicKeys, response?: GaxiosResponse<void> | null): void;
-}
-interface IapPublicKeysResponse {
-  pubkeys: PublicKeys;
-  res?: GaxiosResponse<void> | null;
-}
-interface RevokeCredentialsResult {
-  success: boolean;
-}
-interface VerifyIdTokenOptions {
-  idToken: string;
-  audience?: string | string[];
-  maxExpiry?: number;
-}
-interface OAuth2ClientEndpoints {
-  /**
-   * The endpoint for viewing access token information
-   *
-   * @example
-   * 'https://oauth2.googleapis.com/tokeninfo'
-   */
-  tokenInfoUrl: string | URL;
-  /**
-   * The base URL for auth endpoints.
-   *
-   * @example
-   * 'https://accounts.google.com/o/oauth2/v2/auth'
-   */
-  oauth2AuthBaseUrl: string | URL;
-  /**
-   * The base endpoint for token retrieval
-   * .
-   * @example
-   * 'https://oauth2.googleapis.com/token'
-   */
-  oauth2TokenUrl: string | URL;
-  /**
-   * The base endpoint to revoke tokens.
-   *
-   * @example
-   * 'https://oauth2.googleapis.com/revoke'
-   */
-  oauth2RevokeUrl: string | URL;
-  /**
-   * Sign on certificates in PEM format.
-   *
-   * @example
-   * 'https://www.googleapis.com/oauth2/v1/certs'
-   */
-  oauth2FederatedSignonPemCertsUrl: string | URL;
-  /**
-   * Sign on certificates in JWK format.
-   *
-   * @example
-   * 'https://www.googleapis.com/oauth2/v3/certs'
-   */
-  oauth2FederatedSignonJwkCertsUrl: string | URL;
-  /**
-   * IAP Public Key URL.
-   * This URL contains a JSON dictionary that maps the `kid` claims to the public key values.
-   *
-   * @example
-   * 'https://www.gstatic.com/iap/verify/public_key'
-   */
-  oauth2IapPublicKeyUrl: string | URL;
-}
-/**
- * A convenient interface for those looking to pass the OAuth2 Client config via a parsed
- * JSON file.
- */
-interface OAuth2JSONOptions {
-  /**
-   * The authentication client ID.
-   *
-   * @alias {@link OAuth2ClientOptions.clientId}
-   */
-  client_id?: string;
-  /**
-   * The authentication client secret.
-   *
-   * @alias {@link OAuth2ClientOptions.clientSecret}
-   */
-  client_secret?: string;
-  /**
-   * The URIs to redirect to after completing the auth request.
-   *
-   * @alias {@link OAuth2ClientOptions.redirectUri}
-   */
-  redirect_uris?: string[];
-}
-interface OAuth2ClientOptions extends AuthClientOptions, OAuth2JSONOptions {
-  /**
-   * The authentication client ID.
-   *
-   * @alias {@link OAuth2JSONOptions.client_id}
-   */
-  clientId?: string;
-  /**
-   * The authentication client secret.
-   *
-   * @alias {@link OAuth2JSONOptions.client_secret}
-   */
-  clientSecret?: string;
-  /**
-   * The URI to redirect to after completing the auth request.
-   *
-   * @alias {@link OAuth2JSONOptions.redirect_uris}
-   */
-  redirectUri?: string;
-  /**
-   * Customizable endpoints.
-   */
-  endpoints?: Partial<OAuth2ClientEndpoints>;
-  /**
-   * The allowed OAuth2 token issuers.
-   */
-  issuers?: string[];
-  /**
-   * The client authentication type. Supported values are basic, post, and none.
-   * Defaults to post if not provided.
-   * https://datatracker.ietf.org/doc/html/rfc7591#section-2
-   */
-  clientAuthentication?: ClientAuthentication$1;
-}
-type RefreshOptions = Pick<AuthClientOptions, 'eagerRefreshThresholdMillis' | 'forceRefreshOnFailure'>;
-declare class OAuth2Client extends AuthClient {
-  private redirectUri?;
-  private certificateCache;
-  private certificateExpiry;
-  private certificateCacheFormat;
-  protected refreshTokenPromises: Map<string, Promise<GetTokenResponse>>;
-  readonly endpoints: Readonly<OAuth2ClientEndpoints>;
-  readonly issuers: string[];
-  readonly clientAuthentication: ClientAuthentication$1;
-  _clientId?: string;
-  _clientSecret?: string;
-  refreshHandler?: GetRefreshHandlerCallback;
-  /**
-   * An OAuth2 Client for Google APIs.
-   *
-   * @param options The OAuth2 Client Options. Passing an `clientId` directly is **@DEPRECATED**.
-   * @param clientSecret **@DEPRECATED**. Provide a {@link OAuth2ClientOptions `OAuth2ClientOptions`} object in the first parameter instead.
-   * @param redirectUri **@DEPRECATED**. Provide a {@link OAuth2ClientOptions `OAuth2ClientOptions`} object in the first parameter instead.
-   */
-  constructor(options?: OAuth2ClientOptions | OAuth2ClientOptions['clientId'],
-  /**
-   * @deprecated - provide a {@link OAuth2ClientOptions `OAuth2ClientOptions`} object in the first parameter instead
-   */
-  clientSecret?: OAuth2ClientOptions['clientSecret'],
-  /**
-   * @deprecated - provide a {@link OAuth2ClientOptions `OAuth2ClientOptions`} object in the first parameter instead
-   */
-  redirectUri?: OAuth2ClientOptions['redirectUri']);
-  /**
-   * @deprecated use instance's {@link OAuth2Client.endpoints}
-   */
-  protected static readonly GOOGLE_TOKEN_INFO_URL = "https://oauth2.googleapis.com/tokeninfo";
-  /**
-   * Clock skew - five minutes in seconds
-   */
-  private static readonly CLOCK_SKEW_SECS_;
-  /**
-   * The default max Token Lifetime is one day in seconds
-   */
-  private static readonly DEFAULT_MAX_TOKEN_LIFETIME_SECS_;
-  /**
-   * Generates URL for consent page landing.
-   * @param opts Options.
-   * @return URL to consent page.
-   */
-  generateAuthUrl(opts?: GenerateAuthUrlOpts): string;
-  generateCodeVerifier(): void;
-  /**
-   * Convenience method to automatically generate a code_verifier, and its
-   * resulting SHA256. If used, this must be paired with a S256
-   * code_challenge_method.
-   *
-   * For a full example see:
-   * https://github.com/googleapis/google-auth-library-nodejs/blob/main/samples/oauth2-codeVerifier.js
-   */
-  generateCodeVerifierAsync(): Promise<CodeVerifierResults>;
-  /**
-   * Gets the access token for the given code.
-   * @param code The authorization code.
-   * @param callback Optional callback fn.
-   */
-  getToken(code: string): Promise<GetTokenResponse>;
-  getToken(options: GetTokenOptions$1): Promise<GetTokenResponse>;
-  getToken(code: string, callback: GetTokenCallback$1): void;
-  getToken(options: GetTokenOptions$1, callback: GetTokenCallback$1): void;
-  private getTokenAsync;
-  /**
-   * Refreshes the access token.
-   * @param refresh_token Existing refresh token.
-   * @private
-   */
-  protected refreshToken(refreshToken?: string | null): Promise<GetTokenResponse>;
-  protected refreshTokenNoCache(refreshToken?: string | null): Promise<GetTokenResponse>;
-  /**
-   * Retrieves the access token using refresh token
-   *
-   * @param callback callback
-   */
-  refreshAccessToken(): Promise<RefreshAccessTokenResponse>;
-  refreshAccessToken(callback: RefreshAccessTokenCallback): void;
-  private refreshAccessTokenAsync;
-  /**
-   * Get a non-expired access token, after refreshing if necessary
-   *
-   * @param callback Callback to call with the access token
-   */
-  getAccessToken(): Promise<GetAccessTokenResponse>;
-  getAccessToken(callback: GetAccessTokenCallback): void;
-  private getAccessTokenAsync;
-  /**
-   * The main authentication interface.  It takes an optional url which when
-   * present is the endpoint being accessed, and returns a Promise which
-   * resolves with authorization header fields.
-   *
-   * In OAuth2Client, the result has the form:
-   * { authorization: 'Bearer <access_token_value>' }
-   */
-  getRequestHeaders(url?: string | URL): Promise<Headers>;
-  protected getRequestMetadataAsync(url?: string | URL | null): Promise<RequestMetadataResponse>;
-  /**
-   * Generates an URL to revoke the given token.
-   * @param token The existing token to be revoked.
-   *
-   * @deprecated use instance method {@link OAuth2Client.getRevokeTokenURL}
-   */
-  static getRevokeTokenUrl(token: string): string;
-  /**
-   * Generates a URL to revoke the given token.
-   *
-   * @param token The existing token to be revoked.
-   */
-  getRevokeTokenURL(token: string): URL;
-  /**
-   * Revokes the access given to token.
-   * @param token The existing token to be revoked.
-   * @param callback Optional callback fn.
-   */
-  revokeToken(token: string): GaxiosPromise<RevokeCredentialsResult>;
-  revokeToken(token: string, callback: BodyResponseCallback<RevokeCredentialsResult>): void;
-  /**
-   * Revokes access token and clears the credentials object
-   * @param callback callback
-   */
-  revokeCredentials(): GaxiosPromise<RevokeCredentialsResult>;
-  revokeCredentials(callback: BodyResponseCallback<RevokeCredentialsResult>): void;
-  private revokeCredentialsAsync;
-  /**
-   * Provides a request implementation with OAuth 2.0 flow. If credentials have
-   * a refresh_token, in cases of HTTP 401 and 403 responses, it automatically
-   * asks for a new access token and replays the unsuccessful request.
-   * @param opts Request options.
-   * @param callback callback.
-   * @return Request object
-   */
-  request<T>(opts: GaxiosOptions): GaxiosPromise<T>;
-  request<T>(opts: GaxiosOptions, callback: BodyResponseCallback<T>): void;
-  protected requestAsync<T>(opts: GaxiosOptions, reAuthRetried?: boolean): Promise<GaxiosResponse<T>>;
-  /**
-   * Verify id token is token by checking the certs and audience
-   * @param options that contains all options.
-   * @param callback Callback supplying GoogleLogin if successful
-   */
-  verifyIdToken(options: VerifyIdTokenOptions): Promise<LoginTicket>;
-  verifyIdToken(options: VerifyIdTokenOptions, callback: (err: Error | null, login?: LoginTicket) => void): void;
-  private verifyIdTokenAsync;
-  /**
-   * Obtains information about the provisioned access token.  Especially useful
-   * if you want to check the scopes that were provisioned to a given token.
-   *
-   * @param accessToken Required.  The Access Token for which you want to get
-   * user info.
-   */
-  getTokenInfo(accessToken: string): Promise<TokenInfo>;
-  /**
-   * Gets federated sign-on certificates to use for verifying identity tokens.
-   * Returns certs as array structure, where keys are key ids, and values
-   * are certificates in either PEM or JWK format.
-   * @param callback Callback supplying the certificates
-   */
-  getFederatedSignonCerts(): Promise<FederatedSignonCertsResponse>;
-  getFederatedSignonCerts(callback: GetFederatedSignonCertsCallback): void;
-  getFederatedSignonCertsAsync(): Promise<FederatedSignonCertsResponse>;
-  /**
-   * Gets federated sign-on certificates to use for verifying identity tokens.
-   * Returns certs as array structure, where keys are key ids, and values
-   * are certificates in either PEM or JWK format.
-   * @param callback Callback supplying the certificates
-   */
-  getIapPublicKeys(): Promise<IapPublicKeysResponse>;
-  getIapPublicKeys(callback: GetIapPublicKeysCallback): void;
-  getIapPublicKeysAsync(): Promise<IapPublicKeysResponse>;
-  verifySignedJwtWithCerts(): void;
-  /**
-   * Verify the id token is signed with the correct certificate
-   * and is from the correct audience.
-   * @param jwt The jwt to verify (The ID Token in this case).
-   * @param certs The array of certs to test the jwt against.
-   * @param requiredAudience The audience to test the jwt against.
-   * @param issuers The allowed issuers of the jwt (Optional).
-   * @param maxExpiry The max expiry the certificate can be (Optional).
-   * @return Returns a promise resolving to LoginTicket on verification.
-   */
-  verifySignedJwtWithCertsAsync(jwt: string, certs: Certificates | PublicKeys, requiredAudience?: string | string[], issuers?: string[], maxExpiry?: number): Promise<LoginTicket>;
-  /**
-   * Returns a promise that resolves with AccessTokenResponse type if
-   * refreshHandler is defined.
-   * If not, nothing is returned.
-   */
-  private processAndValidateRefreshHandler;
-  /**
-   * Returns true if a token is expired or will expire within
-   * eagerRefreshThresholdMillismilliseconds.
-   * If there is no expiry time, assumes the token is not expired or expiring.
-   */
-  protected isTokenExpiring(): boolean;
-}
-interface IdTokenOptions extends OAuth2ClientOptions {
-  /**
-   * The client to make the request to fetch an ID token.
-   */
-  idTokenProvider: IdTokenProvider;
-  /**
-   * The audience to use when requesting an ID token.
-   */
-  targetAudience: string;
-}
-interface IdTokenProvider {
-  fetchIdToken: (targetAudience: string) => Promise<string>;
-}
-declare class IdTokenClient extends OAuth2Client {
-  targetAudience: string;
-  idTokenProvider: IdTokenProvider;
-  /**
-   * Google ID Token client
-   *
-   * Retrieve ID token from the metadata server.
-   * See: https://cloud.google.com/docs/authentication/get-id-token#metadata-server
-   */
-  constructor(options: IdTokenOptions);
-  protected getRequestMetadataAsync(): Promise<RequestMetadataResponse>;
-  private getIdTokenExpiryDate;
-}
-declare enum GCPEnv {
-  APP_ENGINE = "APP_ENGINE",
-  KUBERNETES_ENGINE = "KUBERNETES_ENGINE",
-  CLOUD_FUNCTIONS = "CLOUD_FUNCTIONS",
-  COMPUTE_ENGINE = "COMPUTE_ENGINE",
-  CLOUD_RUN = "CLOUD_RUN",
-  CLOUD_RUN_JOBS = "CLOUD_RUN_JOBS",
-  NONE = "NONE",
-}
-interface Transporter {
-  request<T>(opts: GaxiosOptions): GaxiosPromise<T>;
-}
-interface TokenOptions {
-  /**
-   * Path to a .json, .pem, or .p12 key file.
-   */
-  keyFile?: string;
-  /**
-   * The raw private key value.
-   */
-  key?: string;
-  /**
-   * The service account email address.
-   */
-  email?: string;
-  /**
-   * The issuer claim for the JWT.
-   */
-  iss?: string;
-  /**
-   * The subject claim for the JWT. This is used for impersonation.
-   */
-  sub?: string;
-  /**
-   * The space-delimited list of scopes for the requested token.
-   */
-  scope?: string | string[];
-  /**
-   * Additional claims to include in the JWT payload.
-   */
-  additionalClaims?: {
-    [key: string]: any;
-  };
-  /**
-   * Eagerly refresh unexpired tokens when they are within this many
-   * milliseconds from expiring.
-   * Defaults to 0.
-   */
-  eagerRefreshThresholdMillis?: number;
-  transporter?: Transporter;
-}
-/**
- * Interface for the data returned from the token endpoint.
- */
-interface TokenData {
-  /** An optional refresh token. */
-  refresh_token?: string;
-  /** The duration of the token in seconds. */
-  expires_in?: number;
-  /** The access token. */
-  access_token?: string;
-  /** The type of token, e.g., "Bearer". */
-  token_type?: string;
-  /** An optional ID token. */
-  id_token?: string;
-}
-/**
- * Fetches an access token.
- * @param tokenOptions The options for the token.
- * @returns A promise that resolves with the token data.
- */
-/**
- * Options for fetching an access token.
- */
-interface GetTokenOptions {
-  /**
-   * If true, a new token will be fetched, ignoring any cached token.
-   */
-  forceRefresh?: boolean;
-}
-/**
- * Callback type for the `getToken` method.
- */
-type GetTokenCallback = (err: Error | null, token?: TokenData) => void;
-/**
- * The GoogleToken class is used to manage authentication with Google's OAuth 2.0 authorization server.
- * It handles fetching, caching, and refreshing of access tokens.
- */
-declare class GoogleToken {
-  /** The configuration options for this token instance. */
-  private tokenOptions;
-  /** The handler for token fetching and caching logic. */
-  private tokenHandler;
-  /**
-   * Create a GoogleToken.
-   *
-   * @param options  Configuration object.
-   */
-  constructor(options?: TokenOptions);
-  get expiresAt(): number | undefined;
-  /**
-   * The most recent access token obtained by this client.
-   */
-  get accessToken(): string | undefined;
-  /**
-   * The most recent ID token obtained by this client.
-   */
-  get idToken(): string | undefined;
-  /**
-   * The token type of the most recent access token.
-   */
-  get tokenType(): string | undefined;
-  /**
-   * The refresh token for the current credentials.
-   */
-  get refreshToken(): string | undefined;
-  /**
-   * A boolean indicating if the current token has expired.
-   */
-  hasExpired(): boolean;
-  /**
-   * A boolean indicating if the current token is expiring soon,
-   * based on the `eagerRefreshThresholdMillis` option.
-   */
-  isTokenExpiring(): boolean;
-  /**
-   * Fetches a new access token and returns it.
-   * @param opts Options for fetching the token.
-   */
-  getToken(opts?: GetTokenOptions): Promise<TokenData>;
-  getToken(callback: GetTokenCallback, opts?: GetTokenOptions): void;
-  /**
-   * Revokes the current access token and resets the token handler.
-   */
-  revokeToken(): Promise<void>;
-  revokeToken(callback: (err?: Error) => void): void;
-  /**
-   * Returns the configuration options for this token instance.
-   */
-  get googleTokenOptions(): TokenOptions;
-}
-interface JWTOptions extends OAuth2ClientOptions {
-  /**
-   * The service account email address.
-   */
-  email?: string;
-  /**
-   * The path to private key file. Not necessary if {@link JWTOptions.key} has been provided.
-   */
-  keyFile?: string;
-  /**
-   * The value of key. Not necessary if {@link JWTOptions.keyFile} has been provided.
-   */
-  key?: string;
-  /**
-   * The list of requested scopes or a single scope.
-   */
-  keyId?: string;
-  /**
-   * The impersonated account's email address.
-   */
-  scopes?: string | string[];
-  /**
-   * The ID of the key.
-   */
-  subject?: string;
-  /**
-   * Additional claims, such as target audience.
-   *
-   * @example
-   * ```
-   * {target_audience: 'targetAudience'}
-   * ```
-   */
-  additionalClaims?: {};
-}
-declare class JWT extends OAuth2Client implements IdTokenProvider {
-  email?: string;
-  keyFile?: string;
-  key?: string;
-  keyId?: string;
-  defaultScopes?: string | string[];
-  scopes?: string | string[];
-  scope?: string;
-  subject?: string;
-  gtoken?: GoogleToken;
-  additionalClaims?: {};
-  useJWTAccessWithScope?: boolean;
-  defaultServicePath?: string;
-  private access?;
-  /**
-   * JWT service account credentials.
-   *
-   * Retrieve access token using gtoken.
-   *
-   * @param options the
-   */
-  constructor(options?: JWTOptions);
-  /**
-   * Creates a copy of the credential with the specified scopes.
-   * @param scopes List of requested scopes or a single scope.
-   * @return The cloned instance.
-   */
-  createScoped(scopes?: string | string[]): JWT;
-  /**
-   * Obtains the metadata to be sent with the request.
-   *
-   * @param url the URI being authorized.
-   */
-  protected getRequestMetadataAsync(url?: string | null): Promise<RequestMetadataResponse>;
-  /**
-   * Fetches an ID token.
-   * @param targetAudience the audience for the fetched ID token.
-   */
-  fetchIdToken(targetAudience: string): Promise<string>;
-  /**
-   * Determine if there are currently scopes available.
-   */
-  private hasUserScopes;
-  /**
-   * Are there any default or user scopes defined.
-   */
-  private hasAnyScopes;
-  /**
-   * Get the initial access token using gToken.
-   * @param callback Optional callback.
-   * @returns Promise that resolves with credentials
-   */
-  authorize(): Promise<Credentials>;
-  authorize(callback: (err: Error | null, result?: Credentials) => void): void;
-  private authorizeAsync;
-  /**
-   * Refreshes the access token.
-   * @param refreshToken ignored
-   * @private
-   */
-  protected refreshTokenNoCache(): Promise<GetTokenResponse>;
-  /**
-   * Create a gToken if it doesn't already exist.
-   */
-  private createGToken;
-  /**
-   * Create a JWT credentials instance using the given input options.
-   * @param json The input object.
-   *
-   * @remarks
-   *
-   * **Important**: If you accept a credential configuration (credential JSON/File/Stream) from an external source for authentication to Google Cloud, you must validate it before providing it to any Google API or library. Providing an unvalidated credential configuration to Google APIs can compromise the security of your systems and data. For more information, refer to {@link https://cloud.google.com/docs/authentication/external/externally-sourced-credentials Validate credential configurations from external sources}.
-   */
-  fromJSON(json: JWTInput): void;
-  /**
-   * Create a JWT credentials instance using the given input stream.
-   * @param inputStream The input stream.
-   * @param callback Optional callback.
-   *
-   * @remarks
-   *
-   * **Important**: If you accept a credential configuration (credential JSON/File/Stream) from an external source for authentication to Google Cloud, you must validate it before providing it to any Google API or library. Providing an unvalidated credential configuration to Google APIs can compromise the security of your systems and data. For more information, refer to {@link https://cloud.google.com/docs/authentication/external/externally-sourced-credentials Validate credential configurations from external sources}.
-   */
-  fromStream(inputStream: stream.Readable): Promise<void>;
-  fromStream(inputStream: stream.Readable, callback: (err?: Error | null) => void): void;
-  private fromStreamAsync;
-  /**
-   * Creates a JWT credentials instance using an API Key for authentication.
-   * @param apiKey The API Key in string form.
-   */
-  fromAPIKey(apiKey: string): void;
-  /**
-   * Using the key or keyFile on the JWT client, obtain an object that contains
-   * the key and the client email.
-   */
-  getCredentials(): Promise<CredentialBody>;
-}
-interface UserRefreshClientOptions extends OAuth2ClientOptions {
-  /**
-   * The authentication client ID.
-   */
-  clientId?: string;
-  /**
-   * The authentication client secret.
-   */
-  clientSecret?: string;
-  /**
-   * The authentication refresh token.
-   */
-  refreshToken?: string;
-}
-declare class UserRefreshClient extends OAuth2Client {
-  _refreshToken?: string | null;
-  /**
-   * The User Refresh Token client.
-   *
-   * @param optionsOrClientId The User Refresh Token client options. Passing an `clientId` directly is **@DEPRECATED**.
-   * @param clientSecret **@DEPRECATED**. Provide a {@link UserRefreshClientOptions `UserRefreshClientOptions`} object in the first parameter instead.
-   * @param refreshToken **@DEPRECATED**. Provide a {@link UserRefreshClientOptions `UserRefreshClientOptions`} object in the first parameter instead.
-   * @param eagerRefreshThresholdMillis **@DEPRECATED**. Provide a {@link UserRefreshClientOptions `UserRefreshClientOptions`} object in the first parameter instead.
-   * @param forceRefreshOnFailure **@DEPRECATED**. Provide a {@link UserRefreshClientOptions `UserRefreshClientOptions`} object in the first parameter instead.
-   */
-  constructor(optionsOrClientId?: string | UserRefreshClientOptions,
-  /**
-   * @deprecated - provide a {@link UserRefreshClientOptions `UserRefreshClientOptions`} object in the first parameter instead
-   */
-
-  clientSecret?: UserRefreshClientOptions['clientSecret'],
-  /**
-   * @deprecated - provide a {@link UserRefreshClientOptions `UserRefreshClientOptions`} object in the first parameter instead
-   */
-
-  refreshToken?: UserRefreshClientOptions['refreshToken'],
-  /**
-   * @deprecated - provide a {@link UserRefreshClientOptions `UserRefreshClientOptions`} object in the first parameter instead
-   */
-
-  eagerRefreshThresholdMillis?: UserRefreshClientOptions['eagerRefreshThresholdMillis'],
-  /**
-   * @deprecated - provide a {@link UserRefreshClientOptions `UserRefreshClientOptions`} object in the first parameter instead
-   */
-
-  forceRefreshOnFailure?: UserRefreshClientOptions['forceRefreshOnFailure']);
-  /**
-   * Refreshes the access token.
-   * @param refreshToken An ignored refreshToken..
-   * @param callback Optional callback.
-   */
-  protected refreshTokenNoCache(): Promise<GetTokenResponse>;
-  fetchIdToken(targetAudience: string): Promise<string>;
-  /**
-   * Create a UserRefreshClient credentials instance using the given input
-   * options.
-   * @param json The input object.
-   */
-  fromJSON(json: JWTInput): void;
-  /**
-   * Create a UserRefreshClient credentials instance using the given input
-   * stream.
-   * @param inputStream The input stream.
-   * @param callback Optional callback.
-   */
-  fromStream(inputStream: stream.Readable): Promise<void>;
-  fromStream(inputStream: stream.Readable, callback: (err?: Error) => void): void;
-  private fromStreamAsync;
-  /**
-   * Create a UserRefreshClient credentials instance using the given input
-   * options.
-   * @param json The input object.
-   */
-  static fromJSON(json: JWTInput): UserRefreshClient;
-}
-interface ImpersonatedOptions extends OAuth2ClientOptions {
-  /**
-   * Client used to perform exchange for impersonated client.
-   */
-  sourceClient?: AuthClient;
-  /**
-   * The service account to impersonate.
-   */
-  targetPrincipal?: string;
-  /**
-   * Scopes to request during the authorization grant.
-   */
-  targetScopes?: string[];
-  /**
-   * The chained list of delegates required to grant the final access_token.
-   */
-  delegates?: string[];
-  /**
-   * Number of seconds the delegated credential should be valid.
-   */
-  lifetime?: number | 3600;
-  /**
-   * API endpoint to fetch token from.
-   */
-  endpoint?: string;
-}
-interface FetchIdTokenOptions {
-  /**
-   * Include the service account email in the token.
-   * If set to `true`, the token will contain `email` and `email_verified` claims.
-   */
-  includeEmail: boolean;
-}
-declare class Impersonated extends OAuth2Client implements IdTokenProvider {
-  private sourceClient;
-  private targetPrincipal;
-  private targetScopes;
-  private delegates;
-  private lifetime;
-  private endpoint;
-  /**
-   * Impersonated service account credentials.
-   *
-   * Create a new access token by impersonating another service account.
-   *
-   * Impersonated Credentials allowing credentials issued to a user or
-   * service account to impersonate another. The source project using
-   * Impersonated Credentials must enable the "IAMCredentials" API.
-   * Also, the target service account must grant the orginating principal
-   * the "Service Account Token Creator" IAM role.
-   *
-   * **IMPORTANT**: This method does not validate the credential configuration.
-   * A security risk occurs when a credential configuration configured with
-   * malicious URLs is used. When the credential configuration is accepted from
-   * an untrusted source, you should validate it before using it with this
-   * method. For more details, see
-   * https://cloud.google.com/docs/authentication/external/externally-sourced-credentials.
-   *
-   * @param {object} options - The configuration object.
-   * @param {object} [options.sourceClient] the source credential used as to
-   * acquire the impersonated credentials.
-   * @param {string} [options.targetPrincipal] the service account to
-   * impersonate.
-   * @param {string[]} [options.delegates] the chained list of delegates
-   * required to grant the final access_token. If set, the sequence of
-   * identities must have "Service Account Token Creator" capability granted to
-   * the preceding identity. For example, if set to [serviceAccountB,
-   * serviceAccountC], the sourceCredential must have the Token Creator role on
-   * serviceAccountB. serviceAccountB must have the Token Creator on
-   * serviceAccountC. Finally, C must have Token Creator on target_principal.
-   * If left unset, sourceCredential must have that role on targetPrincipal.
-   * @param {string[]} [options.targetScopes] scopes to request during the
-   * authorization grant.
-   * @param {number} [options.lifetime] number of seconds the delegated
-   * credential should be valid for up to 3600 seconds by default, or 43,200
-   * seconds by extending the token's lifetime, see:
-   * https://cloud.google.com/iam/docs/creating-short-lived-service-account-credentials#sa-credentials-oauth
-   * @param {string} [options.endpoint] api endpoint override.
-   */
-  constructor(options?: ImpersonatedOptions);
-  /**
-   * Signs some bytes.
-   *
-   * {@link https://cloud.google.com/iam/docs/reference/credentials/rest/v1/projects.serviceAccounts/signBlob Reference Documentation}
-   * @param blobToSign String to sign.
-   *
-   * @returns A {@link SignBlobResponse} denoting the keyID and signedBlob in base64 string
-   */
-  sign(blobToSign: string): Promise<SignBlobResponse>;
-  /** The service account email to be impersonated. */
-  getTargetPrincipal(): string;
-  /**
-   * Refreshes the access token.
-   */
-  protected refreshToken(): Promise<GetTokenResponse>;
-  /**
-   * Generates an OpenID Connect ID token for a service account.
-   *
-   * {@link https://cloud.google.com/iam/docs/reference/credentials/rest/v1/projects.serviceAccounts/generateIdToken Reference Documentation}
-   *
-   * @param targetAudience the audience for the fetched ID token.
-   * @param options the for the request
-   * @return an OpenID Connect ID token
-   */
-  fetchIdToken(targetAudience: string, options?: FetchIdTokenOptions): Promise<string>;
-}
-/**
- * OAuth client authentication types.
- * https://tools.ietf.org/html/rfc6749#section-2.3
- */
-type ConfidentialClientType = 'basic' | 'request-body';
-/**
- * Defines the client authentication credentials for basic and request-body
- * credentials.
- * https://tools.ietf.org/html/rfc6749#section-2.3.1
- */
-interface ClientAuthentication {
-  confidentialClientType: ConfidentialClientType;
-  clientId: string;
-  clientSecret?: string;
-}
-interface OAuthClientAuthHandlerOptions {
-  /**
-   * Defines the client authentication credentials for basic and request-body
-   * credentials.
-   */
-  clientAuthentication?: ClientAuthentication;
-  /**
-   * An optional transporter to use.
-   */
-  transporter?: Gaxios;
-}
-/**
- * Abstract class for handling client authentication in OAuth-based
- * operations.
- * When request-body client authentication is used, only application/json and
- * application/x-www-form-urlencoded content types for HTTP methods that support
- * request bodies are supported.
- */
-declare abstract class OAuthClientAuthHandler {
-  #private;
-  protected transporter: Gaxios;
-  /**
-   * Instantiates an OAuth client authentication handler.
-   * @param options The OAuth Client Auth Handler instance options. Passing an `ClientAuthentication` directly is **@DEPRECATED**.
-   */
-  constructor(options?: ClientAuthentication | OAuthClientAuthHandlerOptions);
-  /**
-   * Applies client authentication on the OAuth request's headers or POST
-   * body but does not process the request.
-   * @param opts The GaxiosOptions whose headers or data are to be modified
-   *   depending on the client authentication mechanism to be used.
-   * @param bearerToken The optional bearer token to use for authentication.
-   *   When this is used, no client authentication credentials are needed.
-   */
-  protected applyClientAuthenticationOptions(opts: GaxiosOptions, bearerToken?: string): void;
-  /**
-   * Applies client authentication on the request's header if either
-   * basic authentication or bearer token authentication is selected.
-   *
-   * @param opts The GaxiosOptions whose headers or data are to be modified
-   *   depending on the client authentication mechanism to be used.
-   * @param bearerToken The optional bearer token to use for authentication.
-   *   When this is used, no client authentication credentials are needed.
-   */
-  private injectAuthenticatedHeaders;
-  /**
-   * Applies client authentication on the request's body if request-body
-   * client authentication is selected.
-   *
-   * @param opts The GaxiosOptions whose headers or data are to be modified
-   *   depending on the client authentication mechanism to be used.
-   */
-  private injectAuthenticatedRequestBody;
-  /**
-   * Retry config for Auth-related requests.
-   *
-   * @remarks
-   *
-   * This is not a part of the default {@link AuthClient.transporter transporter/gaxios}
-   * config as some downstream APIs would prefer if customers explicitly enable retries,
-   * such as GCS.
-   */
-  protected static get RETRY_CONFIG(): GaxiosOptions;
-}
-/**
- * Defines the interface needed to initialize an StsCredentials instance.
- * The interface does not directly map to the spec and instead is converted
- * to be compliant with the JavaScript style guide. This is because this is
- * instantiated internally.
- * StsCredentials implement the OAuth 2.0 token exchange based on
- * https://tools.ietf.org/html/rfc8693.
- * Request options are defined in
- * https://tools.ietf.org/html/rfc8693#section-2.1
- */
-interface StsCredentialsOptions {
-  /**
-   * REQUIRED. The value "urn:ietf:params:oauth:grant-type:token-exchange"
-   * indicates that a token exchange is being performed.
-   */
-  grantType: string;
-  /**
-   * OPTIONAL. A URI that indicates the target service or resource where the
-   * client intends to use the requested security token.
-   */
-  resource?: string;
-  /**
-   * OPTIONAL. The logical name of the target service where the client
-   * intends to use the requested security token.  This serves a purpose
-   * similar to the "resource" parameter but with the client providing a
-   * logical name for the target service.
-   */
-  audience?: string;
-  /**
-   * OPTIONAL. A list of space-delimited, case-sensitive strings, as defined
-   * in Section 3.3 of [RFC6749], that allow the client to specify the desired
-   * scope of the requested security token in the context of the service or
-   * resource where the token will be used.
-   */
-  scope?: string[];
-  /**
-   * OPTIONAL. An identifier, as described in Section 3 of [RFC8693], eg.
-   * "urn:ietf:params:oauth:token-type:access_token" for the type of the
-   * requested security token.
-   */
-  requestedTokenType?: string;
-  /**
-   * REQUIRED. A security token that represents the identity of the party on
-   * behalf of whom the request is being made.
-   */
-  subjectToken: string;
-  /**
-   * REQUIRED. An identifier, as described in Section 3 of [RFC8693], that
-   * indicates the type of the security token in the "subject_token" parameter.
-   */
-  subjectTokenType: string;
-  actingParty?: {
-    /**
-     * OPTIONAL. A security token that represents the identity of the acting
-     * party.  Typically, this will be the party that is authorized to use the
-     * requested security token and act on behalf of the subject.
-     */
-    actorToken: string;
-    /**
-     * An identifier, as described in Section 3, that indicates the type of the
-     * security token in the "actor_token" parameter. This is REQUIRED when the
-     * "actor_token" parameter is present in the request but MUST NOT be
-     * included otherwise.
-     */
-    actorTokenType: string;
-  };
-}
-/**
- * Defines the OAuth 2.0 token exchange successful response based on
- * https://tools.ietf.org/html/rfc8693#section-2.2.1
- */
-interface StsSuccessfulResponse {
-  access_token: string;
-  issued_token_type: string;
-  token_type: string;
-  expires_in?: number;
-  refresh_token?: string;
-  scope?: string;
-  res?: GaxiosResponse | null;
-}
-interface StsCredentialsConstructionOptions extends OAuthClientAuthHandlerOptions {
-  /**
-   * The client authentication credentials if available.
-   */
-  clientAuthentication?: ClientAuthentication;
-  /**
-   * The token exchange endpoint.
-   */
-  tokenExchangeEndpoint: string | URL;
-}
-/**
- * Implements the OAuth 2.0 token exchange based on
- * https://tools.ietf.org/html/rfc8693
- */
-declare class StsCredentials extends OAuthClientAuthHandler {
-  #private;
-  /**
-   * Initializes an STS credentials instance.
-   *
-   * @param options The STS credentials instance options. Passing an `tokenExchangeEndpoint` directly is **@DEPRECATED**.
-   * @param clientAuthentication **@DEPRECATED**. Provide a {@link StsCredentialsConstructionOptions `StsCredentialsConstructionOptions`} object in the first parameter instead.
-   */
-  constructor(options?: StsCredentialsConstructionOptions | string | URL,
-  /**
-   * @deprecated - provide a {@link StsCredentialsConstructionOptions `StsCredentialsConstructionOptions`} object in the first parameter instead
-   */
-
-  clientAuthentication?: ClientAuthentication);
-  /**
-   * Exchanges the provided token for another type of token based on the
-   * rfc8693 spec.
-   * @param stsCredentialsOptions The token exchange options used to populate
-   *   the token exchange request.
-   * @param additionalHeaders Optional additional headers to pass along the
-   *   request.
-   * @param options Optional additional GCP-specific non-spec defined options
-   *   to send with the request.
-   *   Example: `&options=${encodeUriComponent(JSON.stringified(options))}`
-   * @return A promise that resolves with the token exchange response containing
-   *   the requested token and its expiration time.
-   */
-  exchangeToken(stsCredentialsOptions: StsCredentialsOptions, headers?: HeadersInit, options?: Parameters<JSON['stringify']>[0]): Promise<StsSuccessfulResponse>;
-}
-/**
- * Shared options used to build {@link ExternalAccountClient} and
- * {@link ExternalAccountAuthorizedUserClient}.
- */
-interface SharedExternalAccountClientOptions extends AuthClientOptions {
-  /**
-   *  The Security Token Service audience, which is usually the fully specified
-   *  resource name of the workload or workforce pool provider.
-   */
-  audience: string;
-  /**
-   * The Security Token Service token URL used to exchange the third party token
-   * for a GCP access token. If not provided, will default to
-   * 'https://sts.googleapis.com/v1/token'
-   */
-  token_url?: string;
-}
-/**
- * Interface containing context about the requested external identity. This is
- * passed on all requests from external account clients to external identity suppliers.
- */
-interface ExternalAccountSupplierContext {
-  /**
-   * The requested external account audience. For example:
-   * * "//iam.googleapis.com/locations/global/workforcePools/$WORKFORCE_POOL_ID/providers/$PROVIDER_ID"
-   * * "//iam.googleapis.com/projects/PROJECT_NUMBER/locations/global/workloadIdentityPools/POOL_ID/providers/PROVIDER_ID"
-   */
-  audience: string;
-  /**
-   * The requested subject token type. Expected values include:
-   * * "urn:ietf:params:oauth:token-type:jwt"
-   * * "urn:ietf:params:aws:token-type:aws4_request"
-   * * "urn:ietf:params:oauth:token-type:saml2"
-   * * "urn:ietf:params:oauth:token-type:id_token"
-   */
-  subjectTokenType: string;
-  /**
-   * The {@link Gaxios} instance for calling external account
-   * to use for requests.
-   */
-  transporter: Gaxios;
-}
-/**
- * Base external account credentials json interface.
- */
-interface BaseExternalAccountClientOptions extends SharedExternalAccountClientOptions {
-  /**
-   * Credential type, should always be 'external_account'.
-   */
-  type?: string;
-  /**
-   * The Security Token Service subject token type based on the OAuth 2.0
-   * token exchange spec. Expected values include:
-   * * 'urn:ietf:params:oauth:token-type:jwt'
-   * * 'urn:ietf:params:aws:token-type:aws4_request'
-   * * 'urn:ietf:params:oauth:token-type:saml2'
-   * * 'urn:ietf:params:oauth:token-type:id_token'
-   */
-  subject_token_type: string;
-  /**
-   * The URL for the service account impersonation request. This URL is required
-   * for some APIs. If this URL is not available, the access token from the
-   * Security Token Service is used directly.
-   */
-  service_account_impersonation_url?: string;
-  /**
-   * Object containing additional options for service account impersonation.
-   */
-  service_account_impersonation?: {
-    /**
-     * The desired lifetime of the impersonated service account access token.
-     * If not provided, the default lifetime will be 3600 seconds.
-     */
-    token_lifetime_seconds?: number;
-  };
-  /**
-   * The endpoint used to retrieve account related information.
-   */
-  token_info_url?: string;
-  /**
-   * Client ID of the service account from the console.
-   */
-  client_id?: string;
-  /**
-   * Client secret of the service account from the console.
-   */
-  client_secret?: string;
-  /**
-   * The workforce pool user project. Required when using a workforce identity
-   * pool.
-   */
-  workforce_pool_user_project?: string;
-  /**
-   * The scopes to request during the authorization grant.
-   */
-  scopes?: string[];
-  /**
-   * @example
-   * https://cloudresourcemanager.googleapis.com/v1/projects/
-   **/
-  cloud_resource_manager_url?: string | URL;
-}
-/**
- * Interface defining the successful response for iamcredentials
- * generateAccessToken API.
- * https://cloud.google.com/iam/docs/reference/credentials/rest/v1/projects.serviceAccounts/generateAccessToken
- */
-interface IamGenerateAccessTokenResponse {
-  accessToken: string;
-  /**
-   * ISO format used for expiration time.
-   *
-   * @example
-   * '2014-10-02T15:01:23.045123456Z'
-   */
-  expireTime: string;
-}
-/**
- * Internal interface for tracking the access token expiration time.
- */
-interface CredentialsWithResponse$2 extends Credentials {
-  res?: GaxiosResponse | null;
-}
-/**
- * Base external account client. This is used to instantiate AuthClients for
- * exchanging external account credentials for GCP access token and authorizing
- * requests to GCP APIs.
- * The base class implements common logic for exchanging various type of
- * external credentials for GCP access token. The logic of determining and
- * retrieving the external credential based on the environment and
- * credential_source will be left for the subclasses.
- */
-declare abstract class BaseExternalAccountClient extends AuthClient {
-  #private;
-  /**
-   * OAuth scopes for the GCP access token to use. When not provided,
-   * the default https://www.googleapis.com/auth/cloud-platform is
-   * used.
-   */
-  scopes?: string | string[];
-  projectNumber: string | null;
-  protected readonly audience: string;
-  protected readonly subjectTokenType: string;
-  protected stsCredential: StsCredentials;
-  protected readonly clientAuth?: ClientAuthentication;
-  protected credentialSourceType?: string;
-  private cachedAccessToken;
-  private readonly serviceAccountImpersonationUrl?;
-  private readonly serviceAccountImpersonationLifetime?;
-  private readonly workforcePoolUserProject?;
-  private readonly configLifetimeRequested;
-  private readonly tokenUrl;
-  /**
-   * @example
-   * ```ts
-   * new URL('https://cloudresourcemanager.googleapis.com/v1/projects/');
-   * ```
-   */
-  protected cloudResourceManagerURL: URL | string;
-  protected supplierContext: ExternalAccountSupplierContext;
-  /**
-   * Instantiate a BaseExternalAccountClient instance using the provided JSON
-   * object loaded from an external account credentials file.
-   * @param options The external account options object typically loaded
-   *   from the external account JSON credential file. The camelCased options
-   *   are aliases for the snake_cased options.
-   */
-  constructor(options: BaseExternalAccountClientOptions | SnakeToCamelObject<BaseExternalAccountClientOptions>);
-  /** The service account email to be impersonated, if available. */
-  getServiceAccountEmail(): string | null;
-  /**
-   * Provides a mechanism to inject GCP access tokens directly.
-   * When the provided credential expires, a new credential, using the
-   * external account options, is retrieved.
-   * @param credentials The Credentials object to set on the current client.
-   */
-  setCredentials(credentials: Credentials): void;
-  /**
-   * Triggered when a external subject token is needed to be exchanged for a GCP
-   * access token via GCP STS endpoint.
-   * This abstract method needs to be implemented by subclasses depending on
-   * the type of external credential used.
-   * @return A promise that resolves with the external subject token.
-   */
-  abstract retrieveSubjectToken(): Promise<string>;
-  /**
-   * @return A promise that resolves with the current GCP access token
-   *   response. If the current credential is expired, a new one is retrieved.
-   */
-  getAccessToken(): Promise<GetAccessTokenResponse>;
-  /**
-   * The main authentication interface. It takes an optional url which when
-   * present is the endpoint being accessed, and returns a Promise which
-   * resolves with authorization header fields.
-   *
-   * The result has the form:
-   * { authorization: 'Bearer <access_token_value>' }
-   */
-  getRequestHeaders(): Promise<Headers>;
-  /**
-   * Provides a request implementation with OAuth 2.0 flow. In cases of
-   * HTTP 401 and 403 responses, it automatically asks for a new access token
-   * and replays the unsuccessful request.
-   * @param opts Request options.
-   * @param callback callback.
-   * @return A promise that resolves with the HTTP response when no callback is
-   *   provided.
-   */
-  request<T>(opts: GaxiosOptions): GaxiosPromise<T>;
-  request<T>(opts: GaxiosOptions, callback: BodyResponseCallback<T>): void;
-  /**
-   * @return A promise that resolves with the project ID corresponding to the
-   *   current workload identity pool or current workforce pool if
-   *   determinable. For workforce pool credential, it returns the project ID
-   *   corresponding to the workforcePoolUserProject.
-   *   This is introduced to match the current pattern of using the Auth
-   *   library:
-   *   const projectId = await auth.getProjectId();
-   *   const url = `https://dns.googleapis.com/dns/v1/projects/${projectId}`;
-   *   const res = await client.request({ url });
-   *   The resource may not have permission
-   *   (resourcemanager.projects.get) to call this API or the required
-   *   scopes may not be selected:
-   *   https://cloud.google.com/resource-manager/reference/rest/v1/projects/get#authorization-scopes
-   */
-  getProjectId(): Promise<string | null>;
-  /**
-   * Authenticates the provided HTTP request, processes it and resolves with the
-   * returned response.
-   * @param opts The HTTP request options.
-   * @param reAuthRetried Whether the current attempt is a retry after a failed attempt due to an auth failure.
-   * @return A promise that resolves with the successful response.
-   */
-  protected requestAsync<T>(opts: GaxiosOptions, reAuthRetried?: boolean): Promise<GaxiosResponse<T>>;
-  /**
-   * Forces token refresh, even if unexpired tokens are currently cached.
-   * External credentials are exchanged for GCP access tokens via the token
-   * exchange endpoint and other settings provided in the client options
-   * object.
-   * If the service_account_impersonation_url is provided, an additional
-   * step to exchange the external account GCP access token for a service
-   * account impersonated token is performed.
-   * @return A promise that resolves with the fresh GCP access tokens.
-   */
-  protected refreshAccessTokenAsync(): Promise<CredentialsWithResponse$2>;
-  /**
-   * Returns the workload identity pool project number if it is determinable
-   * from the audience resource name.
-   * @param audience The STS audience used to determine the project number.
-   * @return The project number associated with the workload identity pool, if
-   *   this can be determined from the STS audience field. Otherwise, null is
-   *   returned.
-   */
-  private getProjectNumber;
-  /**
-   * Exchanges an external account GCP access token for a service
-   * account impersonated access token using iamcredentials
-   * GenerateAccessToken API.
-   * @param token The access token to exchange for a service account access
-   *   token.
-   * @return A promise that resolves with the service account impersonated
-   *   credentials response.
-   */
-  private getImpersonatedAccessToken;
-  /**
-   * Returns whether the provided credentials are expired or not.
-   * If there is no expiry time, assumes the token is not expired or expiring.
-   * @param accessToken The credentials to check for expiration.
-   * @return Whether the credentials are expired or not.
-   */
-  private isExpired;
-  /**
-   * @return The list of scopes for the requested GCP access token.
-   */
-  private getScopesArray;
-  private getMetricsHeaderValue;
-  protected getTokenUrl(): string;
-}
-type SubjectTokenFormatType = 'json' | 'text';
-/**
- * Supplier interface for subject tokens. This can be implemented to
- * return a subject token which can then be exchanged for a GCP token by an
- * {@link IdentityPoolClient}.
- */
-interface SubjectTokenSupplier {
-  /**
-   * Gets a valid subject token for the requested external account identity.
-   * Note that these are not cached by the calling {@link IdentityPoolClient},
-   * so caching should be including in the implementation.
-   * @param context {@link ExternalAccountSupplierContext} from the calling
-   *   {@link IdentityPoolClient}, contains the requested audience and subject token type
-   *   for the external account identity as well as the transport from the
-   *   calling client to use for requests.
-   * @return A promise that resolves with the requested subject token string.
-   */
-  getSubjectToken: (context: ExternalAccountSupplierContext) => Promise<string>;
-}
-/**
- * Url-sourced/file-sourced credentials json interface.
- * This is used for K8s and Azure workloads.
- */
-interface IdentityPoolClientOptions extends BaseExternalAccountClientOptions {
-  /**
-   * Object containing options to retrieve identity pool credentials. A valid credential
-   * source or a subject token supplier must be specified.
-   */
-  credential_source?: {
-    /**
-     * The file location to read the subject token from. Either this, a URL
-     * or a certificate location should be specified.
-     */
-    file?: string;
-    /**
-     * The URL to call to retrieve the subject token. Either this, a file
-     * location or a certificate location should be specified.
-     */
-    url?: string;
-    /**
-     * Optional headers to send on the request to the specified URL.
-     */
-    headers?: {
-      [key: string]: string;
-    };
-    /**
-     * The format that the subject token is in the file or the URL response.
-     * If not provided, will default to reading the text string directly.
-     */
-    format?: {
-      /**
-       * The format type. Can either be 'text' or 'json'.
-       */
-      type: SubjectTokenFormatType;
-      /**
-       * The field name containing the subject token value if the type is 'json'.
-       */
-      subject_token_field_name?: string;
-    };
-    /**
-     * The certificate location to call to retrieve the subject token. Either this, a file
-     * location, or an url should be specified.
-     * @example
-     * File Format:
-     * ```json
-     * {
-     * "cert_configs": {
-     *    "workload": {
-     *      "key_path": "$PATH_TO_LEAF_KEY",
-     *      "cert_path": "$PATH_TO_LEAF_CERT"
-     *    }
-     *  }
-     * }
-     * ```
-     */
-    certificate?: {
-      /**
-       * Specify whether the certificate config should be used from the default location.
-       * Either this or the certificate_config_location must be provided.
-       * The certificate config file must be in the following JSON format:
-       */
-      use_default_certificate_config?: boolean;
-      /**
-       * Location to fetch certificate config from in case default config is not to be used.
-       * Either this or use_default_certificate_config=true should be provided.
-       */
-      certificate_config_location?: string;
-      /**
-       * TrustChainPath specifies the path to a PEM-formatted file containing the X.509 certificate trust chain.
-       * The file should contain any intermediate certificates needed to connect
-       * the mTLS leaf certificate to a root certificate in the trust store.
-       */
-      trust_chain_path?: string;
-    };
-  };
-  /**
-   * The subject token supplier to call to retrieve the subject token to exchange
-   * for a GCP access token. Either this or a valid credential source should
-   * be specified.
-   */
-  subject_token_supplier?: SubjectTokenSupplier;
-}
-/**
- * Defines the Url-sourced and file-sourced external account clients mainly
- * used for K8s and Azure workloads.
- */
-declare class IdentityPoolClient extends BaseExternalAccountClient {
-  private readonly subjectTokenSupplier;
-  /**
-   * Instantiate an IdentityPoolClient instance using the provided JSON
-   * object loaded from an external account credentials file.
-   * An error is thrown if the credential is not a valid file-sourced or
-   * url-sourced credential or a workforce pool user project is provided
-   * with a non workforce audience.
-   * @param options The external account options object typically loaded
-   *   from the external account JSON credential file. The camelCased options
-   *   are aliases for the snake_cased options.
-   */
-  constructor(options: IdentityPoolClientOptions | SnakeToCamelObject<IdentityPoolClientOptions>);
-  /**
-   * Triggered when a external subject token is needed to be exchanged for a GCP
-   * access token via GCP STS endpoint. Gets a subject token by calling
-   * the configured {@link SubjectTokenSupplier}
-   * @return A promise that resolves with the external subject token.
-   */
-  retrieveSubjectToken(): Promise<string>;
-}
-/**
- * Interface defining AWS security credentials.
- * These are either determined from AWS security_credentials endpoint or
- * AWS environment variables.
- */
-interface AwsSecurityCredentials {
-  accessKeyId: string;
-  secretAccessKey: string;
-  token?: string;
-}
-/**
- * Implements an AWS API request signer based on the AWS Signature Version 4
- * signing process.
- * https://docs.aws.amazon.com/general/latest/gr/signature-version-4.html
- */
-declare class AwsRequestSigner {
-  private readonly getCredentials;
-  private readonly region;
-  private readonly crypto;
-  /**
-   * Instantiates an AWS API request signer used to send authenticated signed
-   * requests to AWS APIs based on the AWS Signature Version 4 signing process.
-   * This also provides a mechanism to generate the signed request without
-   * sending it.
-   * @param getCredentials A mechanism to retrieve AWS security credentials
-   *   when needed.
-   * @param region The AWS region to use.
-   */
-  constructor(getCredentials: () => Promise<AwsSecurityCredentials>, region: string);
-  /**
-   * Generates the signed request for the provided HTTP request for calling
-   * an AWS API. This follows the steps described at:
-   * https://docs.aws.amazon.com/general/latest/gr/sigv4_signing.html
-   * @param amzOptions The AWS request options that need to be signed.
-   * @return A promise that resolves with the GaxiosOptions containing the
-   *   signed HTTP request parameters.
-   */
-  getRequestOptions(amzOptions: GaxiosOptions): Promise<GaxiosOptions>;
-}
-/**
- * AWS credentials JSON interface. This is used for AWS workloads.
- */
-interface AwsClientOptions extends BaseExternalAccountClientOptions {
-  /**
-   * Object containing options to retrieve AWS security credentials. A valid credential
-   * source or a aws security credentials supplier should be specified.
-   */
-  credential_source?: {
-    /**
-     * AWS environment ID. Currently only 'AWS1' is supported.
-     */
-    environment_id: string;
-    /**
-     * The EC2 metadata URL to retrieve the current AWS region from. If this is
-     * not provided, the region should be present in the AWS_REGION or AWS_DEFAULT_REGION
-     * environment variables.
-     */
-    region_url?: string;
-    /**
-     * The EC2 metadata URL to retrieve AWS security credentials. If this is not provided,
-     * the credentials should be present in the AWS_ACCESS_KEY_ID, AWS_SECRET_ACCESS_KEY,
-     * and AWS_SESSION_TOKEN environment variables.
-     */
-    url?: string;
-    /**
-     * The regional GetCallerIdentity action URL, used to determine the account
-     * ID and its roles.
-     */
-    regional_cred_verification_url: string;
-    /**
-     *  The imdsv2 session token url is used to fetch session token from AWS
-     *  which is later sent through headers for metadata requests. If the
-     *  field is missing, then session token won't be fetched and sent with
-     *  the metadata requests.
-     *  The session token is required for IMDSv2 but optional for IMDSv1
-     */
-    imdsv2_session_token_url?: string;
-  };
-  /**
-   * The AWS security credentials supplier to call to retrieve the AWS region
-   * and AWS security credentials. Either this or a valid credential source
-   * must be specified.
-   */
-  aws_security_credentials_supplier?: AwsSecurityCredentialsSupplier;
-}
-/**
- * Supplier interface for AWS security credentials. This can be implemented to
- * return an AWS region and AWS security credentials. These credentials can
- * then be exchanged for a GCP token by an {@link AwsClient}.
- */
-interface AwsSecurityCredentialsSupplier {
-  /**
-   * Gets the active AWS region.
-   * @param context {@link ExternalAccountSupplierContext} from the calling
-   *   {@link AwsClient}, contains the requested audience and subject token type
-   *   for the external account identity as well as the transport from the
-   *   calling client to use for requests.
-   * @return A promise that resolves with the AWS region string.
-   */
-  getAwsRegion: (context: ExternalAccountSupplierContext) => Promise<string>;
-  /**
-   * Gets valid AWS security credentials for the requested external account
-   * identity. Note that these are not cached by the calling {@link AwsClient},
-   * so caching should be including in the implementation.
-   * @param context {@link ExternalAccountSupplierContext} from the calling
-   *   {@link AwsClient}, contains the requested audience and subject token type
-   *   for the external account identity as well as the transport from the
-   *   calling client to use for requests.
-   * @return A promise that resolves with the requested {@link AwsSecurityCredentials}.
-   */
-  getAwsSecurityCredentials: (context: ExternalAccountSupplierContext) => Promise<AwsSecurityCredentials>;
-}
-/**
- * AWS external account client. This is used for AWS workloads, where
- * AWS STS GetCallerIdentity serialized signed requests are exchanged for
- * GCP access token.
- */
-declare class AwsClient extends BaseExternalAccountClient {
-  #private;
-  private readonly environmentId?;
-  private readonly awsSecurityCredentialsSupplier;
-  private readonly regionalCredVerificationUrl;
-  private awsRequestSigner;
-  private region;
-  /**
-   * @deprecated AWS client no validates the EC2 metadata address.
-   **/
-  static AWS_EC2_METADATA_IPV4_ADDRESS: string;
-  /**
-   * @deprecated AWS client no validates the EC2 metadata address.
-   **/
-  static AWS_EC2_METADATA_IPV6_ADDRESS: string;
-  /**
-   * Instantiates an AwsClient instance using the provided JSON
-   * object loaded from an external account credentials file.
-   * An error is thrown if the credential is not a valid AWS credential.
-   * @param options The external account options object typically loaded
-   *   from the external account JSON credential file.
-   */
-  constructor(options: AwsClientOptions | SnakeToCamelObject<AwsClientOptions>);
-  private validateEnvironmentId;
-  /**
-   * Triggered when an external subject token is needed to be exchanged for a
-   * GCP access token via GCP STS endpoint. This will call the
-   * {@link AwsSecurityCredentialsSupplier} to retrieve an AWS region and AWS
-   * Security Credentials, then use them to create a signed AWS STS request that
-   * can be exchanged for a GCP access token.
-   * @return A promise that resolves with the external subject token.
-   */
-  retrieveSubjectToken(): Promise<string>;
-}
-/**
- * Error thrown from the executable run by PluggableAuthClient.
- */
-declare class ExecutableError extends Error {
-  /**
-   * The exit code returned by the executable.
-   */
-  readonly code: string;
-  constructor(message: string, code: string);
-}
-/**
- * Defines the credential source portion of the configuration for PluggableAuthClient.
- *
- * <p>Command is the only required field. If timeout_millis is not specified, the library will
- * default to a 30-second timeout.
- *
- * <pre>
- * Sample credential source for Pluggable Auth Client:
- * {
- *   ...
- *   "credential_source": {
- *     "executable": {
- *       "command": "/path/to/get/credentials.sh --arg1=value1 --arg2=value2",
- *       "timeout_millis": 5000,
- *       "output_file": "/path/to/generated/cached/credentials"
- *     }
- *   }
- * }
- * </pre>
- */
-interface PluggableAuthClientOptions extends BaseExternalAccountClientOptions {
-  credential_source: {
-    executable: {
-      /**
-       * The command used to retrieve the 3rd party token.
-       */
-      command: string;
-      /**
-       * The timeout for executable to run in milliseconds. If none is provided it
-       * will be set to the default timeout of 30 seconds.
-       */
-      timeout_millis?: number;
-      /**
-       * An optional output file location that will be checked for a cached response
-       * from a previous run of the executable.
-       */
-      output_file?: string;
-    };
-  };
-}
-/**
- * PluggableAuthClient enables the exchange of workload identity pool external credentials for
- * Google access tokens by retrieving 3rd party tokens through a user supplied executable. These
- * scripts/executables are completely independent of the Google Cloud Auth libraries. These
- * credentials plug into ADC and will call the specified executable to retrieve the 3rd party token
- * to be exchanged for a Google access token.
- *
- * <p>To use these credentials, the GOOGLE_EXTERNAL_ACCOUNT_ALLOW_EXECUTABLES environment variable
- * must be set to '1'. This is for security reasons.
- *
- * <p>Both OIDC and SAML are supported. The executable must adhere to a specific response format
- * defined below.
- *
- * <p>The executable must print out the 3rd party token to STDOUT in JSON format. When an
- * output_file is specified in the credential configuration, the executable must also handle writing the
- * JSON response to this file.
- *
- * <pre>
- * OIDC response sample:
- * {
- *   "version": 1,
- *   "success": true,
- *   "token_type": "urn:ietf:params:oauth:token-type:id_token",
- *   "id_token": "HEADER.PAYLOAD.SIGNATURE",
- *   "expiration_time": 1620433341
- * }
- *
- * SAML2 response sample:
- * {
- *   "version": 1,
- *   "success": true,
- *   "token_type": "urn:ietf:params:oauth:token-type:saml2",
- *   "saml_response": "...",
- *   "expiration_time": 1620433341
- * }
- *
- * Error response sample:
- * {
- *   "version": 1,
- *   "success": false,
- *   "code": "401",
- *   "message": "Error message."
- * }
- * </pre>
- *
- * <p>The "expiration_time" field in the JSON response is only required for successful
- * responses when an output file was specified in the credential configuration
- *
- * <p>The auth libraries will populate certain environment variables that will be accessible by the
- * executable, such as: GOOGLE_EXTERNAL_ACCOUNT_AUDIENCE, GOOGLE_EXTERNAL_ACCOUNT_TOKEN_TYPE,
- * GOOGLE_EXTERNAL_ACCOUNT_INTERACTIVE, GOOGLE_EXTERNAL_ACCOUNT_IMPERSONATED_EMAIL, and
- * GOOGLE_EXTERNAL_ACCOUNT_OUTPUT_FILE.
- *
- * <p>Please see this repositories README for a complete executable request/response specification.
- */
-declare class PluggableAuthClient extends BaseExternalAccountClient {
-  /**
-   * The command used to retrieve the third party token.
-   */
-  private readonly command;
-  /**
-   * The timeout in milliseconds for running executable,
-   * set to default if none provided.
-   */
-  private readonly timeoutMillis;
-  /**
-   * The path to file to check for cached executable response.
-   */
-  private readonly outputFile?;
-  /**
-   * Executable and output file handler.
-   */
-  private readonly handler;
-  /**
-   * Instantiates a PluggableAuthClient instance using the provided JSON
-   * object loaded from an external account credentials file.
-   * An error is thrown if the credential is not a valid pluggable auth credential.
-   * @param options The external account options object typically loaded from
-   *   the external account JSON credential file.
-   */
-  constructor(options: PluggableAuthClientOptions);
-  /**
-   * Triggered when an external subject token is needed to be exchanged for a
-   * GCP access token via GCP STS endpoint.
-   * This uses the `options.credential_source` object to figure out how
-   * to retrieve the token using the current environment. In this case,
-   * this calls a user provided executable which returns the subject token.
-   * The logic is summarized as:
-   * 1. Validated that the executable is allowed to run. The
-   *    GOOGLE_EXTERNAL_ACCOUNT_ALLOW_EXECUTABLES environment must be set to
-   *    1 for security reasons.
-   * 2. If an output file is specified by the user, check the file location
-   *    for a response. If the file exists and contains a valid response,
-   *    return the subject token from the file.
-   * 3. Call the provided executable and return response.
-   * @return A promise that resolves with the external subject token.
-   */
-  retrieveSubjectToken(): Promise<string>;
-}
-type ExternalAccountClientOptions = IdentityPoolClientOptions | AwsClientOptions | PluggableAuthClientOptions;
-/**
- * Dummy class with no constructor. Developers are expected to use fromJSON.
- */
-declare class ExternalAccountClient {
-  constructor();
-  /**
-   * This static method will instantiate the
-   * corresponding type of external account credential depending on the
-   * underlying credential source.
-   *
-   * **IMPORTANT**: This method does not validate the credential configuration.
-   * A security risk occurs when a credential configuration configured with
-   * malicious URLs is used. When the credential configuration is accepted from
-   * an untrusted source, you should validate it before using it with this
-   * method. For more details, see
-   * https://cloud.google.com/docs/authentication/external/externally-sourced-credentials.
-   *
-   * @param options The external account options object typically loaded
-   *   from the external account JSON credential file.
-   * @return A BaseExternalAccountClient instance or null if the options
-   *   provided do not correspond to an external account credential.
-   */
-  static fromJSON(options: ExternalAccountClientOptions): BaseExternalAccountClient | null;
-}
-/**
- * The credentials JSON file type for external account authorized user clients.
- */
-declare const EXTERNAL_ACCOUNT_AUTHORIZED_USER_TYPE = "external_account_authorized_user";
-/**
- * External Account Authorized User Credentials JSON interface.
- */
-interface ExternalAccountAuthorizedUserClientOptions extends SharedExternalAccountClientOptions {
-  type: typeof EXTERNAL_ACCOUNT_AUTHORIZED_USER_TYPE;
-  client_id: string;
-  client_secret: string;
-  refresh_token: string;
-  token_info_url: string;
-  revoke_url?: string;
-}
-/**
- * Internal interface for tracking the access token expiration time.
- */
-interface CredentialsWithResponse$1 extends Credentials {
-  res?: GaxiosResponse | null;
-}
-/**
- * External Account Authorized User Client. This is used for OAuth2 credentials
- * sourced using external identities through Workforce Identity Federation.
- * Obtaining the initial access and refresh token can be done through the
- * Google Cloud CLI.
- */
-declare class ExternalAccountAuthorizedUserClient extends AuthClient {
-  private cachedAccessToken;
-  private readonly externalAccountAuthorizedUserHandler;
-  private refreshToken;
-  /**
-   * Instantiates an ExternalAccountAuthorizedUserClient instances using the
-   * provided JSON object loaded from a credentials files.
-   * An error is throws if the credential is not valid.
-   * @param options The external account authorized user option object typically
-   *   from the external accoutn authorized user JSON credential file.
-   */
-  constructor(options: ExternalAccountAuthorizedUserClientOptions);
-  getAccessToken(): Promise<{
-    token?: string | null;
-    res?: GaxiosResponse | null;
-  }>;
-  getRequestHeaders(): Promise<Headers>;
-  request<T>(opts: GaxiosOptions): GaxiosPromise<T>;
-  request<T>(opts: GaxiosOptions, callback: BodyResponseCallback<T>): void;
-  /**
-   * Authenticates the provided HTTP request, processes it and resolves with the
-   * returned response.
-   * @param opts The HTTP request options.
-   * @param reAuthRetried Whether the current attempt is a retry after a failed attempt due to an auth failure.
-   * @return A promise that resolves with the successful response.
-   */
-  protected requestAsync<T>(opts: GaxiosOptions, reAuthRetried?: boolean): Promise<GaxiosResponse<T>>;
-  /**
-   * Forces token refresh, even if unexpired tokens are currently cached.
-   * @return A promise that resolves with the refreshed credential.
-   */
-  protected refreshAccessTokenAsync(): Promise<CredentialsWithResponse$1>;
-  /**
-   * Returns whether the provided credentials are expired or not.
-   * If there is no expiry time, assumes the token is not expired or expiring.
-   * @param credentials The credentials to check for expiration.
-   * @return Whether the credentials are expired or not.
-   */
-  private isExpired;
-}
-/**
- * Defines all types of explicit clients that are determined via ADC JSON
- * config file.
- */
-type JSONClient = JWT | UserRefreshClient | BaseExternalAccountClient | ExternalAccountAuthorizedUserClient | Impersonated;
-interface ProjectIdCallback {
-  (err?: Error | null, projectId?: string | null): void;
-}
-interface CredentialCallback {
-  (err: Error | null, result?: JSONClient): void;
-}
-interface ADCCallback {
-  (err: Error | null, credential?: AuthClient, projectId?: string | null): void;
-}
-interface ADCResponse {
-  credential: AuthClient;
-  projectId: string | null;
-}
-interface GoogleAuthOptions<T extends AuthClient = AnyAuthClient> {
-  /**
-   * An API key to use, optional. Cannot be used with {@link GoogleAuthOptions.credentials `credentials`}.
-   */
-  apiKey?: string;
-  /**
-   * An `AuthClient` to use
-   */
-  authClient?: T;
-  /**
-   * @deprecated This option is being deprecated because of a potential security risk.
-   *
-   * This option does not validate the credential configuration. The security
-   * risk occurs when a credential configuration is accepted from a source that
-   * is not under your control and used without validation on your side.
-   *
-   * The recommended way to provide credentials is to create an `auth` object
-   * using `google-auth-library` and pass it to the client constructor.
-   * This will ensure that unexpected credential types with potential for
-   * malicious intent are not loaded unintentionally. For example:
-   * ```
-   * const {GoogleAuth} = require('google-auth-library');
-   * const auth = new GoogleAuth({
-   *   // Scopes can be specified either as an array or as a single, space-delimited string.
-   *   scopes: 'https://www.googleapis.com/auth/cloud-platform'
-   * });
-   * const client = new MyClient({ auth: auth });
-   * ```
-   *
-   * If you are loading your credential configuration from an untrusted source and have
-   * not mitigated the risks (e.g. by validating the configuration yourself), make
-   * these changes as soon as possible to prevent security risks to your environment.
-   *
-   * Regardless of the method used, it is always your responsibility to validate
-   * configurations received from external sources.
-   *
-   * For more details, see https://cloud.google.com/docs/authentication/external/externally-sourced-credentials.
-   */
-  keyFilename?: string;
-  /**
-   * @deprecated This option is being deprecated because of a potential security risk.
-   *
-   * This option does not validate the credential configuration. The security
-   * risk occurs when a credential configuration is accepted from a source that
-   * is not under your control and used without validation on your side.
-   *
-   * The recommended way to provide credentials is to create an `auth` object
-   * using `google-auth-library` and pass it to the client constructor.
-   * This will ensure that unexpected credential types with potential for
-   * malicious intent are not loaded unintentionally. For example:
-   * ```
-   * const {GoogleAuth} = require('google-auth-library');
-   * const auth = new GoogleAuth({
-   *   // Scopes can be specified either as an array or as a single, space-delimited string.
-   *   scopes: 'https://www.googleapis.com/auth/cloud-platform'
-   * });
-   * const client = new MyClient({ auth: auth });
-   * ```
-   *
-   * If you are loading your credential configuration from an untrusted source and have
-   * not mitigated the risks (e.g. by validating the configuration yourself), make
-   * these changes as soon as possible to prevent security risks to your environment.
-   *
-   * Regardless of the method used, it is always your responsibility to validate
-   * configurations received from external sources.
-   *
-   * For more details, see https://cloud.google.com/docs/authentication/external/externally-sourced-credentials.
-   */
-  keyFile?: string;
-  /**
-   * @deprecated This option is being deprecated because of a potential security risk.
-   *
-   * This option does not validate the credential configuration. The security
-   * risk occurs when a credential configuration is accepted from a source that
-   * is not under your control and used without validation on your side.
-   *
-   * The recommended way to provide credentials is to create an `auth` object
-   * using `google-auth-library` and pass it to the client constructor.
-   * This will ensure that unexpected credential types with potential for
-   * malicious intent are not loaded unintentionally. For example:
-   * ```
-   * const {GoogleAuth} = require('google-auth-library');
-   * const auth = new GoogleAuth({
-   *   // Scopes can be specified either as an array or as a single, space-delimited string.
-   *   scopes: 'https://www.googleapis.com/auth/cloud-platform'
-   * });
-   * const client = new MyClient({ auth: auth });
-   * ```
-   *
-   * If you are loading your credential configuration from an untrusted source and have
-   * not mitigated the risks (e.g. by validating the configuration yourself), make
-   * these changes as soon as possible to prevent security risks to your environment.
-   *
-   * Regardless of the method used, it is always your responsibility to validate
-   * configurations received from external sources.
-   *
-   * For more details, see https://cloud.google.com/docs/authentication/external/externally-sourced-credentials.
-   */
-  credentials?: JWTInput | ExternalAccountClientOptions;
-  /**
-   * `AuthClientOptions` object passed to the constructor of the client
-   */
-  clientOptions?: Extract<ConstructorParameters<AnyAuthClientConstructor>[0], AuthClientOptions>;
-  /**
-   * Required scopes for the desired API request
-   */
-  scopes?: string | string[];
-  /**
-   * Your project ID.
-   */
-  projectId?: string;
-  /**
-   * The default service domain for a given Cloud universe.
-   *
-   * This is an ergonomic equivalent to {@link clientOptions}'s `universeDomain`
-   * property and will be set for all generated {@link AuthClient}s.
-   */
-  universeDomain?: string;
-}
-declare class GoogleAuth<T extends AuthClient = AuthClient> {
-  #private;
-  /**
-   * Caches a value indicating whether the auth layer is running on Google
-   * Compute Engine.
-   * @private
-   */
-  private checkIsGCE?;
-  useJWTAccessWithScope?: boolean;
-  defaultServicePath?: string;
-  get isGCE(): boolean | undefined;
-  private _findProjectIdPromise?;
-  private _cachedProjectId?;
-  jsonContent: JWTInput | ExternalAccountClientOptions | null;
-  apiKey: string | null;
-  cachedCredential: AnyAuthClient | T | null;
-  /**
-   * Scopes populated by the client library by default. We differentiate between
-   * these and user defined scopes when deciding whether to use a self-signed JWT.
-   */
-  defaultScopes?: string | string[];
-  private keyFilename?;
-  private scopes?;
-  private clientOptions;
-  /**
-   * Configuration is resolved in the following order of precedence:
-   * - {@link GoogleAuthOptions.credentials `credentials`}
-   * - {@link GoogleAuthOptions.keyFilename `keyFilename`}
-   * - {@link GoogleAuthOptions.keyFile `keyFile`}
-   *
-   * {@link GoogleAuthOptions.clientOptions `clientOptions`} are passed to the
-   * {@link AuthClient `AuthClient`s}.
-   *
-   * @param opts
-   */
-  constructor(opts?: GoogleAuthOptions<T>);
-  setGapicJWTValues(client: JWT): void;
-  /**
-   * Obtains the default project ID for the application.
-   *
-   * Retrieves in the following order of precedence:
-   * - The `projectId` provided in this object's construction
-   * - GCLOUD_PROJECT or GOOGLE_CLOUD_PROJECT environment variable
-   * - GOOGLE_APPLICATION_CREDENTIALS JSON file
-   * - Cloud SDK: `gcloud config config-helper --format json`
-   * - GCE project ID from metadata server
-   */
-  getProjectId(): Promise<string>;
-  getProjectId(callback: ProjectIdCallback): void;
-  /**
-   * A temporary method for internal `getProjectId` usages where `null` is
-   * acceptable. In a future major release, `getProjectId` should return `null`
-   * (as the `Promise<string | null>` base signature describes) and this private
-   * method should be removed.
-   *
-   * @returns Promise that resolves with project id (or `null`)
-   */
-  private getProjectIdOptional;
-  /**
-   * A private method for finding and caching a projectId.
-   *
-   * Supports environments in order of precedence:
-   * - GCLOUD_PROJECT or GOOGLE_CLOUD_PROJECT environment variable
-   * - GOOGLE_APPLICATION_CREDENTIALS JSON file
-   * - Cloud SDK: `gcloud config config-helper --format json`
-   * - GCE project ID from metadata server
-   *
-   * @returns projectId
-   */
-  private findAndCacheProjectId;
-  private getProjectIdAsync;
-  /**
-   * Retrieves a universe domain from the metadata server via
-   * {@link gcpMetadata.universe}.
-   *
-   * @returns a universe domain
-   */
-  getUniverseDomainFromMetadataServer(): Promise<string>;
-  /**
-   * Retrieves, caches, and returns the universe domain in the following order
-   * of precedence:
-   * - The universe domain in {@link GoogleAuth.clientOptions}
-   * - An existing or ADC {@link AuthClient}'s universe domain
-   * - {@link gcpMetadata.universe}, if {@link Compute} client
-   *
-   * @returns The universe domain
-   */
-  getUniverseDomain(): Promise<string>;
-  /**
-   * @returns Any scopes (user-specified or default scopes specified by the
-   *   client library) that need to be set on the current Auth client.
-   */
-  private getAnyScopes;
-  /**
-   * Obtains the default service-level credentials for the application.
-   * @param callback Optional callback.
-   * @returns Promise that resolves with the ADCResponse (if no callback was
-   * passed).
-   */
-  getApplicationDefault(): Promise<ADCResponse>;
-  getApplicationDefault(callback: ADCCallback): void;
-  getApplicationDefault(options: AuthClientOptions): Promise<ADCResponse>;
-  getApplicationDefault(options: AuthClientOptions, callback: ADCCallback): void;
-  private getApplicationDefaultAsync;
-  /**
-   * Determines whether the auth layer is running on Google Compute Engine.
-   * Checks for GCP Residency, then fallback to checking if metadata server
-   * is available.
-   *
-   * @returns A promise that resolves with the boolean.
-   * @api private
-   */
-  _checkIsGCE(): Promise<boolean>;
-  /**
-   * Attempts to load default credentials from the environment variable path..
-   * @returns Promise that resolves with the OAuth2Client or null.
-   * @api private
-   */
-  _tryGetApplicationCredentialsFromEnvironmentVariable(options?: AuthClientOptions): Promise<JSONClient | null>;
-  /**
-   * Attempts to load default credentials from a well-known file location
-   * @return Promise that resolves with the OAuth2Client or null.
-   * @api private
-   */
-  _tryGetApplicationCredentialsFromWellKnownFile(options?: AuthClientOptions): Promise<JSONClient | null>;
-  /**
-   * Attempts to load default credentials from a file at the given path..
-   * @param filePath The path to the file to read.
-   * @returns Promise that resolves with the OAuth2Client
-   * @api private
-   */
-  _getApplicationCredentialsFromFilePath(filePath: string, options?: AuthClientOptions): Promise<JSONClient>;
-  /**
-   * Create a credentials instance using a given impersonated input options.
-   * @param json The impersonated input object.
-   * @returns JWT or UserRefresh Client with data
-   */
-  fromImpersonatedJSON(json: ImpersonatedJWTInput): Impersonated;
-  /**
-   * Create a credentials instance using the given input options.
-   * This client is not cached.
-   *
-   * **Important**: If you accept a credential configuration (credential JSON/File/Stream) from an external source for authentication to Google Cloud, you must validate it before providing it to any Google API or library. Providing an unvalidated credential configuration to Google APIs can compromise the security of your systems and data. For more information, refer to {@link https://cloud.google.com/docs/authentication/external/externally-sourced-credentials Validate credential configurations from external sources}.
-   *
-   * @deprecated This method is being deprecated because of a potential security risk.
-   *
-   * This method does not validate the credential configuration. The security
-   * risk occurs when a credential configuration is accepted from a source that
-   * is not under your control and used without validation on your side.
-   *
-   * If you know that you will be loading credential configurations of a
-   * specific type, it is recommended to use a credential-type-specific
-   * constructor. This will ensure that an unexpected credential type with
-   * potential for malicious intent is not loaded unintentionally. You might
-   * still have to do validation for certain credential types. Please follow
-   * the recommendation for that method. For example, if you want to load only
-   * service accounts, you can use the `JWT` constructor:
-   * ```
-   * const {JWT} = require('google-auth-library');
-   * const keys = require('/path/to/key.json');
-   * const client = new JWT({
-   *   email: keys.client_email,
-   *   key: keys.private_key,
-   *   scopes: ['https://www.googleapis.com/auth/cloud-platform'],
-   * });
-   * ```
-   *
-   * If you are loading your credential configuration from an untrusted source and have
-   * not mitigated the risks (e.g. by validating the configuration yourself), make
-   * these changes as soon as possible to prevent security risks to your environment.
-   *
-   * Regardless of the method used, it is always your responsibility to validate
-   * configurations received from external sources.
-   *
-   * For more details, see https://cloud.google.com/docs/authentication/external/externally-sourced-credentials.
-   *
-   * @param json The input object.
-   * @param options The JWT or UserRefresh options for the client
-   * @returns JWT or UserRefresh Client with data
-   */
-  fromJSON(json: JWTInput | ImpersonatedJWTInput, options?: AuthClientOptions): JSONClient;
-  /**
-   * Return a JWT or UserRefreshClient from JavaScript object, caching both the
-   * object used to instantiate and the client.
-   * @param json The input object.
-   * @param options The JWT or UserRefresh options for the client
-   * @returns JWT or UserRefresh Client with data
-   */
-  private _cacheClientFromJSON;
-  /**
-   * Create a credentials instance using the given input stream.
-   *
-   * @deprecated This method is being deprecated because of a potential security risk.
-   *
-   * This method does not validate the credential configuration. The security
-   * risk occurs when a credential configuration is accepted from a source that
-   * is not under your control and used without validation on your side.
-   *
-   * If you know that you will be loading credential configurations of a
-   * specific type, it is recommended to read and parse the stream, and then
-   * use a credential-type-specific constructor. This will ensure that an
-   * unexpected credential type with potential for malicious intent is not
-   * loaded unintentionally. You might still have to do validation for certain
-   * credential types. Please follow the recommendation for that method. For
-   * example, if you want to load only service accounts, you can do:
-   * ```
-   * const {JWT} = require('google-auth-library');
-   * const fs = require('fs');
-   *
-   * const stream = fs.createReadStream('path/to/key.json');
-   * const chunks = [];
-   * stream.on('data', (chunk) => chunks.push(chunk));
-   * stream.on('end', () => {
-   *   const keys = JSON.parse(Buffer.concat(chunks).toString());
-   *   const client = new JWT({
-   *     email: keys.client_email,
-   *     key: keys.private_key,
-   *     scopes: ['https://www.googleapis.com/auth/cloud-platform'],
-   *   });
-   *   // use client
-   * });
-   * ```
-   *
-   * If you are loading your credential configuration from an untrusted source and have
-   * not mitigated the risks (e.g. by validating the configuration yourself), make
-   * these changes as soon as possible to prevent security risks to your environment.
-   *
-   * Regardless of the method used, it is always your responsibility to validate
-   * configurations received from external sources.
-   *
-   * For more details, see https://cloud.google.com/docs/authentication/external/externally-sourced-credentials.
-   * @param inputStream The input stream.
-   * @param callback Optional callback.
-   */
-  fromStream(inputStream: stream.Readable): Promise<JSONClient>;
-  fromStream(inputStream: stream.Readable, callback: CredentialCallback): void;
-  fromStream(inputStream: stream.Readable, options: AuthClientOptions): Promise<JSONClient>;
-  fromStream(inputStream: stream.Readable, options: AuthClientOptions, callback: CredentialCallback): void;
-  private fromStreamAsync;
-  /**
-   * Create a credentials instance using the given API key string.
-   * The created client is not cached. In order to create and cache it use the {@link GoogleAuth.getClient `getClient`} method after first providing an {@link GoogleAuth.apiKey `apiKey`}.
-   *
-   * @param apiKey The API key string
-   * @param options An optional options object.
-   * @returns A JWT loaded from the key
-   */
-  fromAPIKey(apiKey: string, options?: AuthClientOptions): JWT;
-  /**
-   * Determines whether the current operating system is Windows.
-   * @api private
-   */
-  private _isWindows;
-  /**
-   * Run the Google Cloud SDK command that prints the default project ID
-   */
-  private getDefaultServiceProjectId;
-  /**
-   * Loads the project id from environment variables.
-   * @api private
-   */
-  private getProductionProjectId;
-  /**
-   * Loads the project id from the GOOGLE_APPLICATION_CREDENTIALS json file.
-   * @api private
-   */
-  private getFileProjectId;
-  /**
-   * Gets the project ID from external account client if available.
-   */
-  private getExternalAccountClientProjectId;
-  /**
-   * Gets the Compute Engine project ID if it can be inferred.
-   */
-  private getGCEProjectId;
-  /**
-   * The callback function handles a credential object that contains the
-   * client_email and private_key (if exists).
-   * getCredentials first checks if the client is using an external account and
-   * uses the service account email in place of client_email.
-   * If that doesn't exist, it checks for these values from the user JSON.
-   * If the user JSON doesn't exist, and the environment is on GCE, it gets the
-   * client_email from the cloud metadata server.
-   * @param callback Callback that handles the credential object that contains
-   * a client_email and optional private key, or the error.
-   * returned
-   */
-  getCredentials(): Promise<CredentialBody>;
-  getCredentials(callback: (err: Error | null, credentials?: CredentialBody) => void): void;
-  private getCredentialsAsync;
-  /**
-   * Automatically obtain an {@link AuthClient `AuthClient`} based on the
-   * provided configuration. If no options were passed, use Application
-   * Default Credentials.
-   */
-  getClient(): Promise<AnyAuthClient | T>;
-  /**
-   * Creates a client which will fetch an ID token for authorization.
-   * @param targetAudience the audience for the fetched ID token.
-   * @returns IdTokenClient for making HTTP calls authenticated with ID tokens.
-   */
-  getIdTokenClient(targetAudience: string): Promise<IdTokenClient>;
-  /**
-   * Automatically obtain application default credentials, and return
-   * an access token for making requests.
-   */
-  getAccessToken(): Promise<string | null | undefined>;
-  /**
-   * Obtain the HTTP headers that will provide authorization for a given
-   * request.
-   */
-  getRequestHeaders(url?: string | URL): Promise<Headers>;
-  /**
-   * Obtain credentials for a request, then attach the appropriate headers to
-   * the request options.
-   * @param opts Axios or Request options on which to attach the headers
-   */
-  authorizeRequest(opts?: Pick<GaxiosOptions, 'url' | 'headers'>): Promise<Pick<GaxiosOptions, "headers" | "url">>;
-  /**
-   * A {@link fetch `fetch`} compliant API for {@link GoogleAuth}.
-   *
-   * @see {@link GoogleAuth.request} for the classic method.
-   *
-   * @remarks
-   *
-   * This is useful as a drop-in replacement for `fetch` API usage.
-   *
-   * @example
-   *
-   * ```ts
-   * const auth = new GoogleAuth();
-   * const fetchWithAuth: typeof fetch = (...args) => auth.fetch(...args);
-   * await fetchWithAuth('https://example.com');
-   * ```
-   *
-   * @param args `fetch` API or {@link Gaxios.fetch `Gaxios#fetch`} parameters
-   * @returns the {@link GaxiosResponse} with Gaxios-added properties
-   */
-  fetch<T>(...args: Parameters<AuthClient['fetch']>): Promise<GaxiosResponse<T>>;
-  /**
-   * Automatically obtain application default credentials, and make an
-   * HTTP request using the given options.
-   *
-   * @see {@link GoogleAuth.fetch} for the modern method.
-   *
-   * @param opts Axios request options for the HTTP request.
-   */
-  request<T>(opts: GaxiosOptions): Promise<GaxiosResponse<T>>;
-  /**
-   * Determine the compute environment in which the code is running.
-   */
-  getEnv(): Promise<GCPEnv>;
-  /**
-   * Sign the given data with the current private key, or go out
-   * to the IAM API to sign it.
-   * @param data The data to be signed.
-   * @param endpoint A custom endpoint to use.
-   *
-   * @example
-   * ```
-   * sign('data', 'https://iamcredentials.googleapis.com/v1/projects/-/serviceAccounts/');
-   * ```
-   */
-  sign(data: string, endpoint?: string): Promise<string>;
-  private signBlob;
-}
-interface SignBlobResponse {
-  keyId: string;
-  signedBlob: string;
-}
-interface ComputeOptions extends OAuth2ClientOptions {
-  /**
-   * The service account email to use, or 'default'. A Compute Engine instance
-   * may have multiple service accounts.
-   */
-  serviceAccountEmail?: string;
-  /**
-   * The scopes that will be requested when acquiring service account
-   * credentials. Only applicable to modern App Engine and Cloud Function
-   * runtimes as of March 2019.
-   */
-  scopes?: string | string[];
-}
-declare class Compute extends OAuth2Client {
-  readonly serviceAccountEmail: string;
-  scopes: string[];
-  /**
-   * Google Compute Engine service account credentials.
-   *
-   * Retrieve access token from the metadata server.
-   * See: https://cloud.google.com/compute/docs/access/authenticate-workloads#applications
-   */
-  constructor(options?: ComputeOptions);
-  /**
-   * Refreshes the access token.
-   * @param refreshToken Unused parameter
-   */
-  protected refreshTokenNoCache(): Promise<GetTokenResponse>;
-  /**
-   * Fetches an ID token.
-   * @param targetAudience the audience for the fetched ID token.
-   */
-  fetchIdToken(targetAudience: string): Promise<string>;
-  protected wrapError(e: GaxiosError): void;
-}
-interface RequestMetadata {
-  'x-goog-iam-authority-selector': string;
-  'x-goog-iam-authorization-token': string;
-}
-declare class IAMAuth {
-  selector: string;
-  token: string;
-  /**
-   * IAM credentials.
-   *
-   * @param selector the iam authority selector
-   * @param token the token
-   * @constructor
-   */
-  constructor(selector: string, token: string);
-  /**
-   * Acquire the HTTP headers required to make an authenticated request.
-   */
-  getRequestHeaders(): {
-    'x-goog-iam-authority-selector': string;
-    'x-goog-iam-authorization-token': string;
-  };
-}
-interface Claims {
-  [index: string]: string;
-}
-declare class JWTAccess {
-  email?: string | null;
-  key?: string | null;
-  keyId?: string | null;
-  projectId?: string;
-  eagerRefreshThresholdMillis: number;
-  private cache;
-  /**
-   * JWTAccess service account credentials.
-   *
-   * Create a new access token by using the credential to create a new JWT token
-   * that's recognized as the access token.
-   *
-   * @param email the service account email address.
-   * @param key the private key that will be used to sign the token.
-   * @param keyId the ID of the private key used to sign the token.
-   */
-  constructor(email?: string | null, key?: string | null, keyId?: string | null, eagerRefreshThresholdMillis?: number);
-  /**
-   * Ensures that we're caching a key appropriately, giving precedence to scopes vs. url
-   *
-   * @param url The URI being authorized.
-   * @param scopes The scope or scopes being authorized
-   * @returns A string that returns the cached key.
-   */
-  getCachedKey(url?: string, scopes?: string | string[]): string;
-  /**
-   * Get a non-expired access token, after refreshing if necessary.
-   *
-   * @param url The URI being authorized.
-   * @param additionalClaims An object with a set of additional claims to
-   * include in the payload.
-   * @returns An object that includes the authorization header.
-   */
-  getRequestHeaders(url?: string, additionalClaims?: Claims, scopes?: string | string[]): Headers;
-  /**
-   * Returns an expiration time for the JWT token.
-   *
-   * @param iat The issued at time for the JWT.
-   * @returns An expiration time for the JWT.
-   */
-  private static getExpirationTime;
-  /**
-   * Create a JWTAccess credentials instance using the given input options.
-   * @param json The input object.
-   */
-  fromJSON(json: JWTInput): void;
-  /**
-   * Create a JWTAccess credentials instance using the given input stream.
-   * @param inputStream The input stream.
-   * @param callback Optional callback.
-   */
-  fromStream(inputStream: stream.Readable): Promise<void>;
-  fromStream(inputStream: stream.Readable, callback: (err?: Error) => void): void;
-  private fromStreamAsync;
-}
-/**
- * Internal interface for tracking the access token expiration time.
- */
-interface CredentialsWithResponse extends Credentials {
-  res?: GaxiosResponse | null;
-}
-/**
- * Internal interface for tracking and returning the Downscoped access token
- * expiration time in epoch time (seconds).
- */
-interface DownscopedAccessTokenResponse extends GetAccessTokenResponse {
-  expirationTime?: number | null;
-}
-/**
- * Defines an upper bound of permissions available for a GCP credential.
- */
-interface CredentialAccessBoundary {
-  accessBoundary: {
-    accessBoundaryRules: AccessBoundaryRule[];
-  };
-}
-/** Defines an upper bound of permissions on a particular resource. */
-interface AccessBoundaryRule {
-  availablePermissions: string[];
-  availableResource: string;
-  availabilityCondition?: AvailabilityCondition;
-}
-/**
- * An optional condition that can be used as part of a
- * CredentialAccessBoundary to further restrict permissions.
- */
-interface AvailabilityCondition {
-  expression: string;
-  title?: string;
-  description?: string;
-}
-interface DownscopedClientOptions extends AuthClientOptions {
-  /**
-   * The source AuthClient to be downscoped based on the provided Credential Access Boundary rules.
-   */
-  authClient: AuthClient;
-  /**
-   * The Credential Access Boundary which contains a list of access boundary rules.
-   * Each rule contains information on the resource that the rule applies to, the upper bound of the
-   * permissions that are available on that resource and an optional
-   * condition to further restrict permissions.
-   */
-  credentialAccessBoundary: CredentialAccessBoundary;
-}
-/**
- * Defines a set of Google credentials that are downscoped from an existing set
- * of Google OAuth2 credentials. This is useful to restrict the Identity and
- * Access Management (IAM) permissions that a short-lived credential can use.
- * The common pattern of usage is to have a token broker with elevated access
- * generate these downscoped credentials from higher access source credentials
- * and pass the downscoped short-lived access tokens to a token consumer via
- * some secure authenticated channel for limited access to Google Cloud Storage
- * resources.
- */
-declare class DownscopedClient extends AuthClient {
-  private readonly authClient;
-  private readonly credentialAccessBoundary;
-  private cachedDownscopedAccessToken;
-  private readonly stsCredential;
-  /**
-   * Instantiates a downscoped client object using the provided source
-   * AuthClient and credential access boundary rules.
-   * To downscope permissions of a source AuthClient, a Credential Access
-   * Boundary that specifies which resources the new credential can access, as
-   * well as an upper bound on the permissions that are available on each
-   * resource, has to be defined. A downscoped client can then be instantiated
-   * using the source AuthClient and the Credential Access Boundary.
-   * @param options the {@link DownscopedClientOptions `DownscopedClientOptions`} to use. Passing an `AuthClient` directly is **@DEPRECATED**.
-   * @param credentialAccessBoundary **@DEPRECATED**. Provide a {@link DownscopedClientOptions `DownscopedClientOptions`} object in the first parameter instead.
-   */
-  constructor(
-  /**
-   * AuthClient is for backwards-compatibility.
-   */
-
-  options: AuthClient | DownscopedClientOptions,
-  /**
-   * @deprecated - provide a {@link DownscopedClientOptions `DownscopedClientOptions`} object in the first parameter instead
-   */
-
-  credentialAccessBoundary?: CredentialAccessBoundary);
-  /**
-   * Provides a mechanism to inject Downscoped access tokens directly.
-   * The expiry_date field is required to facilitate determination of the token
-   * expiration which would make it easier for the token consumer to handle.
-   * @param credentials The Credentials object to set on the current client.
-   */
-  setCredentials(credentials: Credentials): void;
-  getAccessToken(): Promise<DownscopedAccessTokenResponse>;
-  /**
-   * The main authentication interface. It takes an optional url which when
-   * present is the endpoint being accessed, and returns a Promise which
-   * resolves with authorization header fields.
-   *
-   * The result has the form:
-   * { authorization: 'Bearer <access_token_value>' }
-   */
-  getRequestHeaders(): Promise<Headers>;
-  /**
-   * Provides a request implementation with OAuth 2.0 flow. In cases of
-   * HTTP 401 and 403 responses, it automatically asks for a new access token
-   * and replays the unsuccessful request.
-   * @param opts Request options.
-   * @param callback callback.
-   * @return A promise that resolves with the HTTP response when no callback
-   *   is provided.
-   */
-  request<T>(opts: GaxiosOptions): GaxiosPromise<T>;
-  request<T>(opts: GaxiosOptions, callback: BodyResponseCallback<T>): void;
-  /**
-   * Authenticates the provided HTTP request, processes it and resolves with the
-   * returned response.
-   * @param opts The HTTP request options.
-   * @param reAuthRetried Whether the current attempt is a retry after a failed attempt due to an auth failure
-   * @return A promise that resolves with the successful response.
-   */
-  protected requestAsync<T>(opts: GaxiosOptions, reAuthRetried?: boolean): Promise<GaxiosResponse<T>>;
-  /**
-   * Forces token refresh, even if unexpired tokens are currently cached.
-   * GCP access tokens are retrieved from authclient object/source credential.
-   * Then GCP access tokens are exchanged for downscoped access tokens via the
-   * token exchange endpoint.
-   * @return A promise that resolves with the fresh downscoped access token.
-   */
-  protected refreshAccessTokenAsync(): Promise<CredentialsWithResponse>;
-  /**
-   * Returns whether the provided credentials are expired or not.
-   * If there is no expiry time, assumes the token is not expired or expiring.
-   * @param downscopedAccessToken The credentials to check for expiration.
-   * @return Whether the credentials are expired or not.
-   */
-  private isExpired;
-}
-/**
- * An AuthClient without any Authentication information. Useful for:
- * - Anonymous access
- * - Local Emulators
- * - Testing Environments
- *
- */
-declare class PassThroughClient extends AuthClient {
-  /**
-   * Creates a request without any authentication headers or checks.
-   *
-   * @remarks
-   *
-   * In testing environments it may be useful to change the provided
-   * {@link AuthClient.transporter} for any desired request overrides/handling.
-   *
-   * @param opts
-   * @returns The response of the request.
-   */
-  request<T>(opts: GaxiosOptions): Promise<GaxiosResponse<T>>;
-  /**
-   * A required method of the base class.
-   * Always will return an empty object.
-   *
-   * @returns {}
-   */
-  getAccessToken(): Promise<GetAccessTokenResponse>;
-  /**
-   * A required method of the base class.
-   * Always will return an empty object.
-   *
-   * @returns {}
-   */
-  getRequestHeaders(): Promise<Headers>;
-}
-type ALL_EXPORTS = (typeof _$__0)[keyof typeof _$__0];
-/**
- * A union type for all {@link AuthClient `AuthClient`} constructors.
- */
-type AnyAuthClientConstructor = Extract<ALL_EXPORTS, typeof AuthClient>;
-/**
- * A union type for all {@link AuthClient `AuthClient`}s.
- */
-type AnyAuthClient = InstanceType<AnyAuthClientConstructor>;
-declare const auth: GoogleAuth<AuthClient>;
 interface StorageSettings {
   projectId: string;
   retryOptions?: RetryConfig;
@@ -3991,7 +55,7 @@ interface GCStorageOptions extends BaseStorageOptions, Omit<GoogleAuthOptions, "
 interface GCSMetaStorageOptions extends MetaStorageOptions, Omit<GoogleAuthOptions, "authClient" | "projectId">, StorageSettings {
   bucket?: string;
 }
-declare class GCSMetaStorage<T extends File$1 = File$1> extends MetaStorage<T> {
+declare class GCSMetaStorage<T extends File = File> extends MetaStorage<T> {
   readonly config: GCSMetaStorageOptions;
   private authClient;
   private readonly storageBaseURI;
@@ -4040,6 +104,7 @@ declare class GCSMetaStorage<T extends File$1 = File$1> extends MetaStorage<T> {
 declare class GCStorage extends BaseStorage<GCSFile> {
   static override readonly name: string;
   override checksumTypes: string[];
+  override get raw(): GoogleAuth;
   protected meta: MetaStorage;
   private readonly bucket;
   private authClient;