@xiaoso/dsh-tool-plus 0.1.0-beta.2 → 0.1.0-beta.4

package/lib/google-auth-B6gjsZvg.mjs

@@ -0,0 +1,232 @@
+import { installBunShim as __installBunShim } from "./bun-shim.mjs";
+__installBunShim();
+import { F as $envpos, S as debug, y as isEnoent } from "./src-BgpusnsB.mjs";
+import { c as OAuthError, g as MissingApiKeyError, t as ConfigurationError } from "./error-Dd8DIqs-.mjs";
+import { n as raceWithSignal } from "./abort-dIkZBV7Q.mjs";
+import * as path from "node:path";
+import * as os from "node:os";
+import { Buffer } from "node:buffer";
+//#region node_modules/.pnpm/@oh-my-pi+pi-ai@17.3.5/node_modules/@oh-my-pi/pi-ai/src/providers/google-auth.ts
+/**
+* Application Default Credentials (ADC) resolution for Vertex AI.
+*
+* Replaces `google-auth-library` with a direct WebCrypto + REST implementation.
+* Sources, in priority order:
+*   1. `GOOGLE_APPLICATION_CREDENTIALS` env → file with `type: "service_account"` (RS256 JWT exchange)
+*     or `type: "authorized_user"` (refresh-token exchange).
+*   2. `~/.config/gcloud/application_default_credentials.json` (user ADC, same authorized_user flow).
+*   3. GCE / Cloud Run metadata server (`metadata.google.internal`).
+*
+* Tokens are cached per source key and refreshed `GOOGLE_VERTEX_REFRESH_SKEW_MS` before expiry
+* (default 60s). Concurrent callers waiting on a refresh share the same in-flight promise.
+*/
+const OAUTH_TOKEN_URL = "https://oauth2.googleapis.com/token";
+const METADATA_TOKEN_URL = "http://metadata.google.internal/computeMetadata/v1/instance/service-accounts/default/token";
+const CLOUD_PLATFORM_SCOPE = "https://www.googleapis.com/auth/cloud-platform";
+const JWT_BEARER_GRANT = "urn:ietf:params:oauth:grant-type:jwt-bearer";
+const tokenCache = /* @__PURE__ */ new Map();
+const inflight = /* @__PURE__ */ new Map();
+function getRefreshSkewMs() {
+	return $envpos("GOOGLE_VERTEX_REFRESH_SKEW_MS", 6e4);
+}
+function userAdcPath() {
+	return path.join(os.homedir(), ".config", "gcloud", "application_default_credentials.json");
+}
+async function readJsonFile(filePath) {
+	try {
+		return await Bun.file(filePath).json();
+	} catch (err) {
+		if (isEnoent(err)) return void 0;
+		throw err;
+	}
+}
+async function loadAdcCredentials() {
+	const gacPath = Bun.env.GOOGLE_APPLICATION_CREDENTIALS;
+	if (gacPath) {
+		const creds = await readJsonFile(gacPath);
+		if (!creds) throw new ConfigurationError(`GOOGLE_APPLICATION_CREDENTIALS points to a missing file: ${gacPath}`);
+		return {
+			source: `gac:${gacPath}`,
+			creds
+		};
+	}
+	const userPath = userAdcPath();
+	const creds = await readJsonFile(userPath);
+	if (creds) return {
+		source: `user:${userPath}`,
+		creds
+	};
+}
+function base64UrlEncode(bytes) {
+	const buf = typeof bytes === "string" ? Buffer.from(bytes, "utf8") : bytes;
+	return Buffer.from(buf.buffer, buf.byteOffset, buf.byteLength).toString("base64url");
+}
+function pemToPkcs8(pem) {
+	const body = pem.replace(/-----BEGIN [^-]+-----/g, "").replace(/-----END [^-]+-----/g, "").replace(/\s+/g, "");
+	if (!body) throw new ConfigurationError("Invalid PEM: empty body");
+	return Uint8Array.fromBase64(body);
+}
+async function signJwtRs256(claims, privateKeyPem, keyId) {
+	const header = {
+		alg: "RS256",
+		typ: "JWT"
+	};
+	if (keyId) header.kid = keyId;
+	const payload = `${base64UrlEncode(JSON.stringify(header))}.${base64UrlEncode(JSON.stringify(claims))}`;
+	const key = await globalThis.crypto.subtle.importKey("pkcs8", pemToPkcs8(privateKeyPem), {
+		name: "RSASSA-PKCS1-v1_5",
+		hash: "SHA-256"
+	}, false, ["sign"]);
+	return `${payload}.${base64UrlEncode(new Uint8Array(await globalThis.crypto.subtle.sign("RSASSA-PKCS1-v1_5", key, new TextEncoder().encode(payload))))}`;
+}
+async function exchangeJwtForToken(creds, signal, fetchImpl) {
+	const now = Math.floor(Date.now() / 1e3);
+	const assertion = await signJwtRs256({
+		iss: creds.client_email,
+		scope: CLOUD_PLATFORM_SCOPE,
+		aud: OAUTH_TOKEN_URL,
+		exp: now + 3600,
+		iat: now
+	}, creds.private_key, creds.private_key_id);
+	const body = new URLSearchParams({
+		grant_type: JWT_BEARER_GRANT,
+		assertion
+	});
+	return postForToken(OAUTH_TOKEN_URL, body, signal, fetchImpl);
+}
+async function exchangeRefreshToken(creds, signal, fetchImpl) {
+	const body = new URLSearchParams({
+		client_id: creds.client_id,
+		client_secret: creds.client_secret,
+		refresh_token: creds.refresh_token,
+		grant_type: "refresh_token"
+	});
+	return postForToken(OAUTH_TOKEN_URL, body, signal, fetchImpl);
+}
+async function fetchMetadataToken(signal, fetchImpl) {
+	const timeout = AbortSignal.timeout(2e3);
+	const combined = signal ? AbortSignal.any([signal, timeout]) : timeout;
+	try {
+		const response = await fetchImpl(METADATA_TOKEN_URL, {
+			method: "GET",
+			headers: { "Metadata-Flavor": "Google" },
+			signal: combined
+		});
+		if (!response.ok) return void 0;
+		return await response.json();
+	} catch {
+		return;
+	}
+}
+async function postForToken(url, body, signal, fetchImpl) {
+	const response = await fetchImpl(url, {
+		method: "POST",
+		headers: { "Content-Type": "application/x-www-form-urlencoded" },
+		body: body.toString(),
+		signal
+	});
+	if (!response.ok) {
+		const detail = await response.text().catch(() => "");
+		throw new OAuthError(`Google OAuth token exchange failed (${response.status}): ${detail}`, {
+			kind: "token-exchange",
+			provider: "google-vertex",
+			status: response.status
+		});
+	}
+	return await response.json();
+}
+async function resolveAccessTokenUncached(signal, fetchImpl) {
+	const adc = await loadAdcCredentials();
+	if (adc) {
+		const creds = adc.creds;
+		let token;
+		if (creds.type === "impersonated_service_account") {
+			const targetPrincipal = /(?<target>[^/]+):(generateAccessToken|generateIdToken)$/.exec(creds.service_account_impersonation_url)?.groups?.target;
+			if (!targetPrincipal) throw new RangeError(`Cannot extract target principal from ${creds.service_account_impersonation_url}`);
+			const sourceToken = creds.source_credentials.type === "service_account" ? await exchangeJwtForToken(creds.source_credentials, signal, fetchImpl) : await exchangeRefreshToken(creds.source_credentials, signal, fetchImpl);
+			const response = await fetchImpl(`https://iamcredentials.googleapis.com/v1/projects/-/serviceAccounts/${targetPrincipal}:generateAccessToken`, {
+				method: "POST",
+				headers: {
+					"Content-Type": "application/json",
+					Authorization: `Bearer ${sourceToken.access_token}`
+				},
+				body: JSON.stringify({
+					delegates: creds.delegates ?? [],
+					scope: [CLOUD_PLATFORM_SCOPE],
+					lifetime: "3600s"
+				}),
+				signal
+			});
+			if (!response.ok) {
+				const detail = await response.text().catch(() => "");
+				throw new OAuthError(`Google Impersonation token exchange failed (${response.status}): ${detail}`, {
+					kind: "token-exchange",
+					provider: "google-vertex",
+					status: response.status
+				});
+			}
+			const data = await response.json();
+			const expiresIn = Math.max(0, Math.floor((new Date(data.expireTime).getTime() - Date.now()) / 1e3));
+			token = {
+				access_token: data.accessToken,
+				expires_in: expiresIn,
+				token_type: "Bearer"
+			};
+		} else token = creds.type === "service_account" ? await exchangeJwtForToken(creds, signal, fetchImpl) : await exchangeRefreshToken(creds, signal, fetchImpl);
+		return {
+			source: adc.source,
+			token
+		};
+	}
+	const metadata = await fetchMetadataToken(signal, fetchImpl);
+	if (metadata) return {
+		source: "metadata",
+		token: metadata
+	};
+	throw new MissingApiKeyError(void 0, "Vertex AI requires Application Default Credentials. Set GOOGLE_APPLICATION_CREDENTIALS, run `gcloud auth application-default login`, or run on a GCE/Cloud Run instance with a service account.");
+}
+/**
+* Bound for the detached (signal-free) shared token resolution: a hung OAuth
+* exchange or metadata fetch must not pin the inflight slot forever — every
+* later call would await the stuck promise until process restart.
+*/
+const SHARED_TOKEN_RESOLVE_TIMEOUT_MS = 3e4;
+/**
+* Returns a Bearer access token suitable for the `Authorization` header on Vertex AI calls.
+* The token is cached in module scope and refreshed `GOOGLE_VERTEX_REFRESH_SKEW_MS` ms before it expires.
+*/
+async function getVertexAccessToken(options) {
+	const explicitToken = Bun.env.GOOGLE_CLOUD_ACCESS_TOKEN || Bun.env.CLOUDSDK_AUTH_ACCESS_TOKEN;
+	if (explicitToken) return explicitToken;
+	const fetchImpl = options?.fetch ?? globalThis.fetch.bind(globalThis);
+	const skew = getRefreshSkewMs();
+	const now = Date.now();
+	for (const [source, cached] of tokenCache) {
+		if (cached.expiresAtMs - skew > now) return cached.token;
+		tokenCache.delete(source);
+	}
+	const cacheKey = "vertex-adc";
+	const existing = inflight.get(cacheKey);
+	if (existing) return raceWithSignal(existing, options?.signal);
+	const promise = (async () => {
+		try {
+			const { source, token } = await resolveAccessTokenUncached(AbortSignal.timeout(SHARED_TOKEN_RESOLVE_TIMEOUT_MS), fetchImpl);
+			const expiresAtMs = Date.now() + Math.max(0, token.expires_in * 1e3);
+			tokenCache.set(source, {
+				token: token.access_token,
+				expiresAtMs
+			});
+			debug("vertex.adc acquired access token", {
+				source,
+				expiresInSec: token.expires_in
+			});
+			return token.access_token;
+		} finally {
+			inflight.delete(cacheKey);
+		}
+	})();
+	inflight.set(cacheKey, promise);
+	return raceWithSignal(promise, options?.signal);
+}
+//#endregion
+export { getVertexAccessToken as t };

package/lib/google-auth-De7_s3eo.mjs

@@ -0,0 +1,232 @@
+import { installBunShim as __installBunShim } from "./bun-shim.mjs";
+__installBunShim();
+import { F as $envpos, S as debug, y as isEnoent } from "./src-lDmkSRbm.mjs";
+import { c as OAuthError, g as MissingApiKeyError, t as ConfigurationError } from "./error-yCSG0mGC.mjs";
+import { n as raceWithSignal } from "./abort-D1_Z5Ut5.mjs";
+import * as path from "node:path";
+import * as os from "node:os";
+import { Buffer } from "node:buffer";
+//#region node_modules/.pnpm/@oh-my-pi+pi-ai@17.3.5/node_modules/@oh-my-pi/pi-ai/src/providers/google-auth.ts
+/**
+* Application Default Credentials (ADC) resolution for Vertex AI.
+*
+* Replaces `google-auth-library` with a direct WebCrypto + REST implementation.
+* Sources, in priority order:
+*   1. `GOOGLE_APPLICATION_CREDENTIALS` env → file with `type: "service_account"` (RS256 JWT exchange)
+*     or `type: "authorized_user"` (refresh-token exchange).
+*   2. `~/.config/gcloud/application_default_credentials.json` (user ADC, same authorized_user flow).
+*   3. GCE / Cloud Run metadata server (`metadata.google.internal`).
+*
+* Tokens are cached per source key and refreshed `GOOGLE_VERTEX_REFRESH_SKEW_MS` before expiry
+* (default 60s). Concurrent callers waiting on a refresh share the same in-flight promise.
+*/
+const OAUTH_TOKEN_URL = "https://oauth2.googleapis.com/token";
+const METADATA_TOKEN_URL = "http://metadata.google.internal/computeMetadata/v1/instance/service-accounts/default/token";
+const CLOUD_PLATFORM_SCOPE = "https://www.googleapis.com/auth/cloud-platform";
+const JWT_BEARER_GRANT = "urn:ietf:params:oauth:grant-type:jwt-bearer";
+const tokenCache = /* @__PURE__ */ new Map();
+const inflight = /* @__PURE__ */ new Map();
+function getRefreshSkewMs() {
+	return $envpos("GOOGLE_VERTEX_REFRESH_SKEW_MS", 6e4);
+}
+function userAdcPath() {
+	return path.join(os.homedir(), ".config", "gcloud", "application_default_credentials.json");
+}
+async function readJsonFile(filePath) {
+	try {
+		return await Bun.file(filePath).json();
+	} catch (err) {
+		if (isEnoent(err)) return void 0;
+		throw err;
+	}
+}
+async function loadAdcCredentials() {
+	const gacPath = Bun.env.GOOGLE_APPLICATION_CREDENTIALS;
+	if (gacPath) {
+		const creds = await readJsonFile(gacPath);
+		if (!creds) throw new ConfigurationError(`GOOGLE_APPLICATION_CREDENTIALS points to a missing file: ${gacPath}`);
+		return {
+			source: `gac:${gacPath}`,
+			creds
+		};
+	}
+	const userPath = userAdcPath();
+	const creds = await readJsonFile(userPath);
+	if (creds) return {
+		source: `user:${userPath}`,
+		creds
+	};
+}
+function base64UrlEncode(bytes) {
+	const buf = typeof bytes === "string" ? Buffer.from(bytes, "utf8") : bytes;
+	return Buffer.from(buf.buffer, buf.byteOffset, buf.byteLength).toString("base64url");
+}
+function pemToPkcs8(pem) {
+	const body = pem.replace(/-----BEGIN [^-]+-----/g, "").replace(/-----END [^-]+-----/g, "").replace(/\s+/g, "");
+	if (!body) throw new ConfigurationError("Invalid PEM: empty body");
+	return Uint8Array.fromBase64(body);
+}
+async function signJwtRs256(claims, privateKeyPem, keyId) {
+	const header = {
+		alg: "RS256",
+		typ: "JWT"
+	};
+	if (keyId) header.kid = keyId;
+	const payload = `${base64UrlEncode(JSON.stringify(header))}.${base64UrlEncode(JSON.stringify(claims))}`;
+	const key = await globalThis.crypto.subtle.importKey("pkcs8", pemToPkcs8(privateKeyPem), {
+		name: "RSASSA-PKCS1-v1_5",
+		hash: "SHA-256"
+	}, false, ["sign"]);
+	return `${payload}.${base64UrlEncode(new Uint8Array(await globalThis.crypto.subtle.sign("RSASSA-PKCS1-v1_5", key, new TextEncoder().encode(payload))))}`;
+}
+async function exchangeJwtForToken(creds, signal, fetchImpl) {
+	const now = Math.floor(Date.now() / 1e3);
+	const assertion = await signJwtRs256({
+		iss: creds.client_email,
+		scope: CLOUD_PLATFORM_SCOPE,
+		aud: OAUTH_TOKEN_URL,
+		exp: now + 3600,
+		iat: now
+	}, creds.private_key, creds.private_key_id);
+	const body = new URLSearchParams({
+		grant_type: JWT_BEARER_GRANT,
+		assertion
+	});
+	return postForToken(OAUTH_TOKEN_URL, body, signal, fetchImpl);
+}
+async function exchangeRefreshToken(creds, signal, fetchImpl) {
+	const body = new URLSearchParams({
+		client_id: creds.client_id,
+		client_secret: creds.client_secret,
+		refresh_token: creds.refresh_token,
+		grant_type: "refresh_token"
+	});
+	return postForToken(OAUTH_TOKEN_URL, body, signal, fetchImpl);
+}
+async function fetchMetadataToken(signal, fetchImpl) {
+	const timeout = AbortSignal.timeout(2e3);
+	const combined = signal ? AbortSignal.any([signal, timeout]) : timeout;
+	try {
+		const response = await fetchImpl(METADATA_TOKEN_URL, {
+			method: "GET",
+			headers: { "Metadata-Flavor": "Google" },
+			signal: combined
+		});
+		if (!response.ok) return void 0;
+		return await response.json();
+	} catch {
+		return;
+	}
+}
+async function postForToken(url, body, signal, fetchImpl) {
+	const response = await fetchImpl(url, {
+		method: "POST",
+		headers: { "Content-Type": "application/x-www-form-urlencoded" },
+		body: body.toString(),
+		signal
+	});
+	if (!response.ok) {
+		const detail = await response.text().catch(() => "");
+		throw new OAuthError(`Google OAuth token exchange failed (${response.status}): ${detail}`, {
+			kind: "token-exchange",
+			provider: "google-vertex",
+			status: response.status
+		});
+	}
+	return await response.json();
+}
+async function resolveAccessTokenUncached(signal, fetchImpl) {
+	const adc = await loadAdcCredentials();
+	if (adc) {
+		const creds = adc.creds;
+		let token;
+		if (creds.type === "impersonated_service_account") {
+			const targetPrincipal = /(?<target>[^/]+):(generateAccessToken|generateIdToken)$/.exec(creds.service_account_impersonation_url)?.groups?.target;
+			if (!targetPrincipal) throw new RangeError(`Cannot extract target principal from ${creds.service_account_impersonation_url}`);
+			const sourceToken = creds.source_credentials.type === "service_account" ? await exchangeJwtForToken(creds.source_credentials, signal, fetchImpl) : await exchangeRefreshToken(creds.source_credentials, signal, fetchImpl);
+			const response = await fetchImpl(`https://iamcredentials.googleapis.com/v1/projects/-/serviceAccounts/${targetPrincipal}:generateAccessToken`, {
+				method: "POST",
+				headers: {
+					"Content-Type": "application/json",
+					Authorization: `Bearer ${sourceToken.access_token}`
+				},
+				body: JSON.stringify({
+					delegates: creds.delegates ?? [],
+					scope: [CLOUD_PLATFORM_SCOPE],
+					lifetime: "3600s"
+				}),
+				signal
+			});
+			if (!response.ok) {
+				const detail = await response.text().catch(() => "");
+				throw new OAuthError(`Google Impersonation token exchange failed (${response.status}): ${detail}`, {
+					kind: "token-exchange",
+					provider: "google-vertex",
+					status: response.status
+				});
+			}
+			const data = await response.json();
+			const expiresIn = Math.max(0, Math.floor((new Date(data.expireTime).getTime() - Date.now()) / 1e3));
+			token = {
+				access_token: data.accessToken,
+				expires_in: expiresIn,
+				token_type: "Bearer"
+			};
+		} else token = creds.type === "service_account" ? await exchangeJwtForToken(creds, signal, fetchImpl) : await exchangeRefreshToken(creds, signal, fetchImpl);
+		return {
+			source: adc.source,
+			token
+		};
+	}
+	const metadata = await fetchMetadataToken(signal, fetchImpl);
+	if (metadata) return {
+		source: "metadata",
+		token: metadata
+	};
+	throw new MissingApiKeyError(void 0, "Vertex AI requires Application Default Credentials. Set GOOGLE_APPLICATION_CREDENTIALS, run `gcloud auth application-default login`, or run on a GCE/Cloud Run instance with a service account.");
+}
+/**
+* Bound for the detached (signal-free) shared token resolution: a hung OAuth
+* exchange or metadata fetch must not pin the inflight slot forever — every
+* later call would await the stuck promise until process restart.
+*/
+const SHARED_TOKEN_RESOLVE_TIMEOUT_MS = 3e4;
+/**
+* Returns a Bearer access token suitable for the `Authorization` header on Vertex AI calls.
+* The token is cached in module scope and refreshed `GOOGLE_VERTEX_REFRESH_SKEW_MS` ms before it expires.
+*/
+async function getVertexAccessToken(options) {
+	const explicitToken = Bun.env.GOOGLE_CLOUD_ACCESS_TOKEN || Bun.env.CLOUDSDK_AUTH_ACCESS_TOKEN;
+	if (explicitToken) return explicitToken;
+	const fetchImpl = options?.fetch ?? globalThis.fetch.bind(globalThis);
+	const skew = getRefreshSkewMs();
+	const now = Date.now();
+	for (const [source, cached] of tokenCache) {
+		if (cached.expiresAtMs - skew > now) return cached.token;
+		tokenCache.delete(source);
+	}
+	const cacheKey = "vertex-adc";
+	const existing = inflight.get(cacheKey);
+	if (existing) return raceWithSignal(existing, options?.signal);
+	const promise = (async () => {
+		try {
+			const { source, token } = await resolveAccessTokenUncached(AbortSignal.timeout(SHARED_TOKEN_RESOLVE_TIMEOUT_MS), fetchImpl);
+			const expiresAtMs = Date.now() + Math.max(0, token.expires_in * 1e3);
+			tokenCache.set(source, {
+				token: token.access_token,
+				expiresAtMs
+			});
+			debug("vertex.adc acquired access token", {
+				source,
+				expiresInSec: token.expires_in
+			});
+			return token.access_token;
+		} finally {
+			inflight.delete(cacheKey);
+		}
+	})();
+	inflight.set(cacheKey, promise);
+	return raceWithSignal(promise, options?.signal);
+}
+//#endregion
+export { getVertexAccessToken as t };

package/lib/google-auth-DhqpOYrX.mjs

@@ -0,0 +1,232 @@
+import { installBunShim as __installBunShim } from "./bun-shim.mjs";
+__installBunShim();
+import { F as $envpos, S as debug, y as isEnoent } from "./src-DTid0g4K.mjs";
+import { c as OAuthError, g as MissingApiKeyError, t as ConfigurationError } from "./error-B3bevhrs.mjs";
+import { n as raceWithSignal } from "./abort-B7izMMna.mjs";
+import * as path from "node:path";
+import * as os from "node:os";
+import { Buffer } from "node:buffer";
+//#region node_modules/.pnpm/@oh-my-pi+pi-ai@17.3.5/node_modules/@oh-my-pi/pi-ai/src/providers/google-auth.ts
+/**
+* Application Default Credentials (ADC) resolution for Vertex AI.
+*
+* Replaces `google-auth-library` with a direct WebCrypto + REST implementation.
+* Sources, in priority order:
+*   1. `GOOGLE_APPLICATION_CREDENTIALS` env → file with `type: "service_account"` (RS256 JWT exchange)
+*     or `type: "authorized_user"` (refresh-token exchange).
+*   2. `~/.config/gcloud/application_default_credentials.json` (user ADC, same authorized_user flow).
+*   3. GCE / Cloud Run metadata server (`metadata.google.internal`).
+*
+* Tokens are cached per source key and refreshed `GOOGLE_VERTEX_REFRESH_SKEW_MS` before expiry
+* (default 60s). Concurrent callers waiting on a refresh share the same in-flight promise.
+*/
+const OAUTH_TOKEN_URL = "https://oauth2.googleapis.com/token";
+const METADATA_TOKEN_URL = "http://metadata.google.internal/computeMetadata/v1/instance/service-accounts/default/token";
+const CLOUD_PLATFORM_SCOPE = "https://www.googleapis.com/auth/cloud-platform";
+const JWT_BEARER_GRANT = "urn:ietf:params:oauth:grant-type:jwt-bearer";
+const tokenCache = /* @__PURE__ */ new Map();
+const inflight = /* @__PURE__ */ new Map();
+function getRefreshSkewMs() {
+	return $envpos("GOOGLE_VERTEX_REFRESH_SKEW_MS", 6e4);
+}
+function userAdcPath() {
+	return path.join(os.homedir(), ".config", "gcloud", "application_default_credentials.json");
+}
+async function readJsonFile(filePath) {
+	try {
+		return await Bun.file(filePath).json();
+	} catch (err) {
+		if (isEnoent(err)) return void 0;
+		throw err;
+	}
+}
+async function loadAdcCredentials() {
+	const gacPath = Bun.env.GOOGLE_APPLICATION_CREDENTIALS;
+	if (gacPath) {
+		const creds = await readJsonFile(gacPath);
+		if (!creds) throw new ConfigurationError(`GOOGLE_APPLICATION_CREDENTIALS points to a missing file: ${gacPath}`);
+		return {
+			source: `gac:${gacPath}`,
+			creds
+		};
+	}
+	const userPath = userAdcPath();
+	const creds = await readJsonFile(userPath);
+	if (creds) return {
+		source: `user:${userPath}`,
+		creds
+	};
+}
+function base64UrlEncode(bytes) {
+	const buf = typeof bytes === "string" ? Buffer.from(bytes, "utf8") : bytes;
+	return Buffer.from(buf.buffer, buf.byteOffset, buf.byteLength).toString("base64url");
+}
+function pemToPkcs8(pem) {
+	const body = pem.replace(/-----BEGIN [^-]+-----/g, "").replace(/-----END [^-]+-----/g, "").replace(/\s+/g, "");
+	if (!body) throw new ConfigurationError("Invalid PEM: empty body");
+	return Uint8Array.fromBase64(body);
+}
+async function signJwtRs256(claims, privateKeyPem, keyId) {
+	const header = {
+		alg: "RS256",
+		typ: "JWT"
+	};
+	if (keyId) header.kid = keyId;
+	const payload = `${base64UrlEncode(JSON.stringify(header))}.${base64UrlEncode(JSON.stringify(claims))}`;
+	const key = await globalThis.crypto.subtle.importKey("pkcs8", pemToPkcs8(privateKeyPem), {
+		name: "RSASSA-PKCS1-v1_5",
+		hash: "SHA-256"
+	}, false, ["sign"]);
+	return `${payload}.${base64UrlEncode(new Uint8Array(await globalThis.crypto.subtle.sign("RSASSA-PKCS1-v1_5", key, new TextEncoder().encode(payload))))}`;
+}
+async function exchangeJwtForToken(creds, signal, fetchImpl) {
+	const now = Math.floor(Date.now() / 1e3);
+	const assertion = await signJwtRs256({
+		iss: creds.client_email,
+		scope: CLOUD_PLATFORM_SCOPE,
+		aud: OAUTH_TOKEN_URL,
+		exp: now + 3600,
+		iat: now
+	}, creds.private_key, creds.private_key_id);
+	const body = new URLSearchParams({
+		grant_type: JWT_BEARER_GRANT,
+		assertion
+	});
+	return postForToken(OAUTH_TOKEN_URL, body, signal, fetchImpl);
+}
+async function exchangeRefreshToken(creds, signal, fetchImpl) {
+	const body = new URLSearchParams({
+		client_id: creds.client_id,
+		client_secret: creds.client_secret,
+		refresh_token: creds.refresh_token,
+		grant_type: "refresh_token"
+	});
+	return postForToken(OAUTH_TOKEN_URL, body, signal, fetchImpl);
+}
+async function fetchMetadataToken(signal, fetchImpl) {
+	const timeout = AbortSignal.timeout(2e3);
+	const combined = signal ? AbortSignal.any([signal, timeout]) : timeout;
+	try {
+		const response = await fetchImpl(METADATA_TOKEN_URL, {
+			method: "GET",
+			headers: { "Metadata-Flavor": "Google" },
+			signal: combined
+		});
+		if (!response.ok) return void 0;
+		return await response.json();
+	} catch {
+		return;
+	}
+}
+async function postForToken(url, body, signal, fetchImpl) {
+	const response = await fetchImpl(url, {
+		method: "POST",
+		headers: { "Content-Type": "application/x-www-form-urlencoded" },
+		body: body.toString(),
+		signal
+	});
+	if (!response.ok) {
+		const detail = await response.text().catch(() => "");
+		throw new OAuthError(`Google OAuth token exchange failed (${response.status}): ${detail}`, {
+			kind: "token-exchange",
+			provider: "google-vertex",
+			status: response.status
+		});
+	}
+	return await response.json();
+}
+async function resolveAccessTokenUncached(signal, fetchImpl) {
+	const adc = await loadAdcCredentials();
+	if (adc) {
+		const creds = adc.creds;
+		let token;
+		if (creds.type === "impersonated_service_account") {
+			const targetPrincipal = /(?<target>[^/]+):(generateAccessToken|generateIdToken)$/.exec(creds.service_account_impersonation_url)?.groups?.target;
+			if (!targetPrincipal) throw new RangeError(`Cannot extract target principal from ${creds.service_account_impersonation_url}`);
+			const sourceToken = creds.source_credentials.type === "service_account" ? await exchangeJwtForToken(creds.source_credentials, signal, fetchImpl) : await exchangeRefreshToken(creds.source_credentials, signal, fetchImpl);
+			const response = await fetchImpl(`https://iamcredentials.googleapis.com/v1/projects/-/serviceAccounts/${targetPrincipal}:generateAccessToken`, {
+				method: "POST",
+				headers: {
+					"Content-Type": "application/json",
+					Authorization: `Bearer ${sourceToken.access_token}`
+				},
+				body: JSON.stringify({
+					delegates: creds.delegates ?? [],
+					scope: [CLOUD_PLATFORM_SCOPE],
+					lifetime: "3600s"
+				}),
+				signal
+			});
+			if (!response.ok) {
+				const detail = await response.text().catch(() => "");
+				throw new OAuthError(`Google Impersonation token exchange failed (${response.status}): ${detail}`, {
+					kind: "token-exchange",
+					provider: "google-vertex",
+					status: response.status
+				});
+			}
+			const data = await response.json();
+			const expiresIn = Math.max(0, Math.floor((new Date(data.expireTime).getTime() - Date.now()) / 1e3));
+			token = {
+				access_token: data.accessToken,
+				expires_in: expiresIn,
+				token_type: "Bearer"
+			};
+		} else token = creds.type === "service_account" ? await exchangeJwtForToken(creds, signal, fetchImpl) : await exchangeRefreshToken(creds, signal, fetchImpl);
+		return {
+			source: adc.source,
+			token
+		};
+	}
+	const metadata = await fetchMetadataToken(signal, fetchImpl);
+	if (metadata) return {
+		source: "metadata",
+		token: metadata
+	};
+	throw new MissingApiKeyError(void 0, "Vertex AI requires Application Default Credentials. Set GOOGLE_APPLICATION_CREDENTIALS, run `gcloud auth application-default login`, or run on a GCE/Cloud Run instance with a service account.");
+}
+/**
+* Bound for the detached (signal-free) shared token resolution: a hung OAuth
+* exchange or metadata fetch must not pin the inflight slot forever — every
+* later call would await the stuck promise until process restart.
+*/
+const SHARED_TOKEN_RESOLVE_TIMEOUT_MS = 3e4;
+/**
+* Returns a Bearer access token suitable for the `Authorization` header on Vertex AI calls.
+* The token is cached in module scope and refreshed `GOOGLE_VERTEX_REFRESH_SKEW_MS` ms before it expires.
+*/
+async function getVertexAccessToken(options) {
+	const explicitToken = Bun.env.GOOGLE_CLOUD_ACCESS_TOKEN || Bun.env.CLOUDSDK_AUTH_ACCESS_TOKEN;
+	if (explicitToken) return explicitToken;
+	const fetchImpl = options?.fetch ?? globalThis.fetch.bind(globalThis);
+	const skew = getRefreshSkewMs();
+	const now = Date.now();
+	for (const [source, cached] of tokenCache) {
+		if (cached.expiresAtMs - skew > now) return cached.token;
+		tokenCache.delete(source);
+	}
+	const cacheKey = "vertex-adc";
+	const existing = inflight.get(cacheKey);
+	if (existing) return raceWithSignal(existing, options?.signal);
+	const promise = (async () => {
+		try {
+			const { source, token } = await resolveAccessTokenUncached(AbortSignal.timeout(SHARED_TOKEN_RESOLVE_TIMEOUT_MS), fetchImpl);
+			const expiresAtMs = Date.now() + Math.max(0, token.expires_in * 1e3);
+			tokenCache.set(source, {
+				token: token.access_token,
+				expiresAtMs
+			});
+			debug("vertex.adc acquired access token", {
+				source,
+				expiresInSec: token.expires_in
+			});
+			return token.access_token;
+		} finally {
+			inflight.delete(cacheKey);
+		}
+	})();
+	inflight.set(cacheKey, promise);
+	return raceWithSignal(promise, options?.signal);
+}
+//#endregion
+export { getVertexAccessToken as t };