import { GoogleAuth } from "google-auth-library";
let cachedAuth = null;
let cachedProjectId = null;
export function initVertexAuth(serviceAccountJson) {
    let parsed;
    try {
        parsed = JSON.parse(serviceAccountJson);
    }
    catch {
        // Never surface the raw JSON (it contains the private key) in the error.
        throw new Error("Invalid service account JSON: could not parse");
    }
    if (!parsed.project_id || parsed.type !== "service_account") {
        throw new Error("Invalid service account JSON: missing project_id or type !== service_account");
    }
    // Build the client first; only commit module state once construction succeeds,
    // so a throw can't leave isVertexInitialized() true with mismatched creds.
    const auth = new GoogleAuth({
        credentials: parsed,
        scopes: ["https://www.googleapis.com/auth/cloud-platform"],
    });
    cachedAuth = auth;
    cachedProjectId = parsed.project_id;
    return { projectId: parsed.project_id };
}
export async function getVertexAccessToken() {
    if (!cachedAuth)
        throw new Error("Vertex AI not initialized — call initVertexAuth first");
    const client = await cachedAuth.getClient();
    const tokenRes = await client.getAccessToken();
    if (!tokenRes.token)
        throw new Error("Failed to obtain Vertex AI access token");
    return tokenRes.token;
}
export function getVertexProjectId() {
    return cachedProjectId;
}
export function isVertexInitialized() {
    return cachedAuth !== null && cachedProjectId !== null;
}
export function clearVertexAuth() {
    cachedAuth = null;
    cachedProjectId = null;
}
