import Foundation public struct VertexAIOAuthCredentials: Sendable {    public let accessToken: String    public let refreshToken: String    public let clientId: String    public let clientSecret: String    public let projectId: String?    public let email: String?    public let expiryDate: Date?     public init(        accessToken: String,        refreshToken: String,        clientId: String,        clientSecret: String,        projectId: String?,        email: String?,        expiryDate: Date?)    {        self.accessToken = accessToken        self.refreshToken = refreshToken        self.clientId = clientId        self.clientSecret = clientSecret        self.projectId = projectId        self.email = email        self.expiryDate = expiryDate    }     public var needsRefresh: Bool {        guard let expiryDate else { return true }        // Refresh 5 minutes before expiry        return Date().addingTimeInterval(300) > expiryDate    }} public enum VertexAIOAuthCredentialsError: LocalizedError, Sendable {    case notFound    case decodeFailed(String)    case missingTokens    case missingClientCredentials     public var errorDescription: String? {        switch self {        case .notFound:            "gcloud credentials not found. Run `gcloud auth application-default login` to authenticate."        case let .decodeFailed(message):            "Failed to decode gcloud credentials: \(message)"        case .missingTokens:            "gcloud credentials exist but contain no tokens."        case .missingClientCredentials:            "gcloud credentials missing client ID or secret."        }    }} public enum VertexAIOAuthCredentialsStore {    #if DEBUG    @TaskLocal static var gcloudAccessTokenOverrideForTesting: (@Sendable ([String: String]) async throws -> String)?    #endif     private struct ServiceAccountMetadata {        let email: String        let projectId: String?    }     private static func credentialsFilePath(        environment: [String: String] = ProcessInfo.processInfo.environment) -> URL    {        if let path = environment["GOOGLE_APPLICATION_CREDENTIALS"]?.trimmingCharacters(            in: .whitespacesAndNewlines),            !path.isEmpty        {            return URL(fileURLWithPath: path)        }         let home = FileManager.default.homeDirectoryForCurrentUser        // gcloud application default credentials location        if let configDir = environment["CLOUDSDK_CONFIG"]?.trimmingCharacters(            in: .whitespacesAndNewlines),            !configDir.isEmpty        {            return URL(fileURLWithPath: configDir)                .appendingPathComponent("application_default_credentials.json")        }        return home            .appendingPathComponent(".config")            .appendingPathComponent("gcloud")            .appendingPathComponent("application_default_credentials.json")    }     private static func projectFilePath(        environment: [String: String] = ProcessInfo.processInfo.environment) -> URL    {        let home = FileManager.default.homeDirectoryForCurrentUser        if let configDir = environment["CLOUDSDK_CONFIG"]?.trimmingCharacters(            in: .whitespacesAndNewlines),            !configDir.isEmpty        {            return URL(fileURLWithPath: configDir)                .appendingPathComponent("configurations")                .appendingPathComponent("config_default")        }        return home            .appendingPathComponent(".config")            .appendingPathComponent("gcloud")            .appendingPathComponent("configurations")            .appendingPathComponent("config_default")    }     public static func hasCredentials(        environment: [String: String] = ProcessInfo.processInfo.environment) -> Bool    {        let url = self.credentialsFilePath(environment: environment)        guard FileManager.default.fileExists(atPath: url.path),              let data = try? Data(contentsOf: url),              let json = try? self.parseJSONObject(data: data)        else {            return false        }         if self.parseServiceAccountMetadata(json: json) != nil {            return true        }         return (try? self.parseUserCredentials(json: json, environment: environment)) != nil    }     public static func load(        environment: [String: String] = ProcessInfo.processInfo.environment) throws -> VertexAIOAuthCredentials    {        let url = self.credentialsFilePath(environment: environment)        guard FileManager.default.fileExists(atPath: url.path) else {            throw VertexAIOAuthCredentialsError.notFound        }         let data = try Data(contentsOf: url)        return try self.parse(data: data, environment: environment)    }     public static func loadForFetch(        environment: [String: String] = ProcessInfo.processInfo.environment) async throws -> VertexAIOAuthCredentials    {        let url = self.credentialsFilePath(environment: environment)        guard FileManager.default.fileExists(atPath: url.path) else {            throw VertexAIOAuthCredentialsError.notFound        }         let data = try Data(contentsOf: url)        let json = try self.parseJSONObject(data: data)        if let serviceAccount = self.parseServiceAccountMetadata(json: json) {            let token = try await self.printAccessToken(environment: environment)            return VertexAIOAuthCredentials(                accessToken: token,                refreshToken: "",                clientId: "",                clientSecret: "",                projectId: serviceAccount.projectId ?? self.loadProjectId(environment: environment),                email: serviceAccount.email,                expiryDate: Date().addingTimeInterval(50 * 60))        }         return try self.parseUserCredentials(json: json, environment: environment)    }     public static func parse(data: Data) throws -> VertexAIOAuthCredentials {        try self.parse(data: data, environment: ProcessInfo.processInfo.environment)    }     public static func parse(        data: Data,        environment: [String: String]) throws -> VertexAIOAuthCredentials    {        let json = try self.parseJSONObject(data: data)        return try self.parseUserCredentials(json: json, environment: environment)    }     private static func parseJSONObject(data: Data) throws -> [String: Any] {        guard let json = try JSONSerialization.jsonObject(with: data) as? [String: Any] else {            throw VertexAIOAuthCredentialsError.decodeFailed("Invalid JSON")        }        return json    }     private static func parseUserCredentials(        json: [String: Any],        environment: [String: String]) throws -> VertexAIOAuthCredentials    {        // Check for service account credentials        if self.parseServiceAccountMetadata(json: json) != nil {            throw VertexAIOAuthCredentialsError.decodeFailed(                "Service account credentials require `gcloud auth application-default print-access-token`.")        }         // User credentials from gcloud auth application-default login        guard let clientId = json["client_id"] as? String,              let clientSecret = json["client_secret"] as? String        else {            throw VertexAIOAuthCredentialsError.missingClientCredentials        }         guard let refreshToken = json["refresh_token"] as? String, !refreshToken.isEmpty else {            throw VertexAIOAuthCredentialsError.missingTokens        }         // Access token may not be present in the file; we'll need to refresh        let accessToken = json["access_token"] as? String ?? ""         // Try to get project ID from gcloud config        let projectId = Self.loadProjectId(environment: environment)         // Try to extract email from ID token if present        let email = Self.extractEmailFromIdToken(json["id_token"] as? String)         // Parse expiry if present        var expiryDate: Date?        if let expiryStr = json["token_expiry"] as? String {            let formatter = ISO8601DateFormatter()            expiryDate = formatter.date(from: expiryStr)        }         return VertexAIOAuthCredentials(            accessToken: accessToken,            refreshToken: refreshToken,            clientId: clientId,            clientSecret: clientSecret,            projectId: projectId,            email: email,            expiryDate: expiryDate)    }     public static func save(_ credentials: VertexAIOAuthCredentials) throws {        // We don't modify gcloud's credentials file; just cache the access token in memory        // The refresh happens on each app launch if needed    }     private static func parseServiceAccountMetadata(json: [String: Any]) -> ServiceAccountMetadata? {        guard let email = (json["client_email"] as? String)?.trimmingCharacters(in: .whitespacesAndNewlines),              !email.isEmpty,              let privateKey = (json["private_key"] as? String)?.trimmingCharacters(in: .whitespacesAndNewlines),              !privateKey.isEmpty        else {            return nil        }         let projectId = (json["project_id"] as? String)?            .trimmingCharacters(in: .whitespacesAndNewlines)        return ServiceAccountMetadata(            email: email,            projectId: projectId?.isEmpty == false ? projectId : nil)    }     private static func printAccessToken(environment: [String: String]) async throws -> String {        #if DEBUG        if let override = self.gcloudAccessTokenOverrideForTesting {            let token = try await override(environment)            return try self.cleanAccessToken(token)        }        #endif         let env = TTYCommandRunner.enrichedEnvironment(baseEnv: environment)        let result = try await SubprocessRunner.run(            binary: "/usr/bin/env",            arguments: ["gcloud", "auth", "application-default", "print-access-token"],            environment: env,            timeout: 20,            label: "vertexai-gcloud-adc-token")        return try self.cleanAccessToken(result.stdout)    }     private static func cleanAccessToken(_ token: String) throws -> String {        let trimmed = token.trimmingCharacters(in: .whitespacesAndNewlines)        guard !trimmed.isEmpty else {            throw VertexAIOAuthCredentialsError.missingTokens        }        return trimmed    }     private static func loadProjectId(environment: [String: String]) -> String? {        let configPath = self.projectFilePath(environment: environment)        guard let content = try? String(contentsOf: configPath, encoding: .utf8) else {            return environment["GOOGLE_CLOUD_PROJECT"]                ?? environment["GCLOUD_PROJECT"]                ?? environment["CLOUDSDK_CORE_PROJECT"]        }         // Parse INI-style config for project        for line in content.components(separatedBy: .newlines) {            let trimmed = line.trimmingCharacters(in: .whitespaces)            if trimmed.hasPrefix("project") {                let parts = trimmed.components(separatedBy: "=")                if parts.count >= 2 {                    return parts[1].trimmingCharacters(in: .whitespaces)                }            }        }         // Try environment variable        return environment["GOOGLE_CLOUD_PROJECT"]            ?? environment["GCLOUD_PROJECT"]            ?? environment["CLOUDSDK_CORE_PROJECT"]    }     private static func extractEmailFromIdToken(_ token: String?) -> String? {        guard let token, !token.isEmpty else { return nil }         let parts = token.components(separatedBy: ".")        guard parts.count >= 2 else { return nil }         var payload = parts[1]            .replacingOccurrences(of: "-", with: "+")            .replacingOccurrences(of: "_", with: "/")         let remainder = payload.count % 4        if remainder > 0 {            payload += String(repeating: "=", count: 4 - remainder)        }         guard let data = Data(base64Encoded: payload, options: .ignoreUnknownCharacters),              let json = try? JSONSerialization.jsonObject(with: data) as? [String: Any]        else {            return nil        }         return json["email"] as? String    }}