4AjG >dZddlmZddlZdZddZddd ZdddZdS)u7Shared Google service-account authentication for OpenMontage tools. Lets the Google provider tools (``google_tts``, ``google_imagen``) authenticate with a service-account JSON key file via OAuth Bearer tokens — in addition to the existing API-key path. This is what makes ``GOOGLE_APPLICATION_CREDENTIALS`` actually work end to end. The ``google-auth`` package is imported lazily so this module never adds an import-time cost for tools that only use API keys, and so a missing dependency surfaces as an actionable runtime error rather than a hard import failure. ) annotationsNz.https://www.googleapis.com/auth/cloud-platformreturnboolctjd}t|otj|S)zDTrue when GOOGLE_APPLICATION_CREDENTIALS points to an existing file.GOOGLE_APPLICATION_CREDENTIALS)osenvirongetrpathexists)r s G/app/working/workspaces/default/OpenMontage/tools/google_credentials.pyservice_account_configuredrs7 :>>: ; ;D --- . ..creds_project_id str | Nonectjdp?tjdp tjdp|S)zResolve the GCP project id from env vars, falling back to the key file's. Vertex AI needs an explicit project id; TTS does not. We prefer an explicit env override so users can target a project other than the key's own. GOOGLE_CLOUD_PROJECTGOOGLE_CLOUD_PROJECT_IDGCLOUD_PROJECT)rr r )rs r resolve_project_idrsS -..  :>>3 4 4  :>>* + +   rscopeslist[str] | Nonetuple[str, str | None]c |tg} ddlm}ddlm}n"#t $r}t d|d}~wwxYwtj d}|rtj |st d |j ||}||n(#t$r}t d |d ||d}~wwxYw|jt#|d dfS) uMint an OAuth access token from the service-account JSON. Returns ``(access_token, project_id)``. ``project_id`` is the one embedded in the key file (callers should still prefer :func:`resolve_project_id`). Raises: RuntimeError: if ``google-auth`` is missing or the credentials cannot be loaded/refreshed — with a message the agent can surface verbatim. Nr)Request)service_accountzaService-account auth requires the 'google-auth' package. Install it with: pip install google-authrzqGOOGLE_APPLICATION_CREDENTIALS is not set or points to a missing file; cannot use service-account authentication.)rz8Failed to load/refresh service-account credentials from z: project_id)CLOUD_PLATFORM_SCOPEgoogle.auth.transport.requestsr google.oauth2r ImportError RuntimeErrorrr r r r Credentialsfrom_service_account_filerefresh Exceptiontokengetattr)rrrexcr credss r get_access_tokenr+)si~&'::::::1111111  7    :>>: ; ;D  rw~~d++  ?   +EE F    ggii     Tt T Ts T T    ;|T:: ::s(  838 9C C*C%%C*)rr)N)rrrr)rrrr)__doc__ __future__rrrrrr+rr r/s  #""""" H////     ';';';';';';';r