Add Google application credentials authentication

commit: 2806fa12bf6323d11700a5a10e13448562a5376c
author: Eckhart Koeppen · 3mo ago · 2026-07-06 11:03 UTC
committer: Eckhart Köppen · 3mo ago · 2026-07-14 09:01 UTC
parent: f2588cf
signature: unsigned

3 files · +169 -1

M README.md +24 -1


@@ -546,7 +546,7 @@ Credential lookup order for Google:
546	546
547	547		Use `/login` and pick api key to paste an AI Studio key. zot probes `/v1beta/models` once and stores the key under `google` in `auth.json`.
548	548
549		-	> Auth model: API key only. Google does not issue OAuth tokens for consumer Gemini Advanced / Google One AI Premium subscriptions, so there is no "log in with your Google subscription" flow. Programmatic access requires either an AI Studio API key (this provider) or a Vertex AI / GCP service-account credential (not yet wired up in zot). The `/login subscription` step quietly downgrades to the api-key form when you pick Google so you don't end up in a dead end.
	549	+	> Auth model: API key only (this provider). Google does not issue OAuth tokens for consumer Gemini Advanced / Google One AI Premium subscriptions, so there is no "log in with your Google subscription" flow. The `/login subscription` step quietly downgrades to the api-key form when you pick Google so you don't end up in a dead end. If you need OAuth/service-account auth instead of an API key, use the `google-vertex` provider below.
550	550
551	551		> Free-tier rate limits. AI Studio's free tier has tight per-minute and per-day caps that vary by model: `gemini-2.5-pro` is the strictest (a few requests per minute, ~50 per day), Flash and Flash-Lite are far more generous. If a Pro turn 429s with `"You exceeded your current quota"` while Flash on the same key still works, you've hit the Pro free-tier RPD. Either switch to Flash for agent loops, or [enable billing](https://aistudio.google.com/app/apikey) on your AI Studio project to flip the same key from free to pay-as-you-go pricing (`$1.25/M` input, `$10/M` output for Pro).
552	552

@@ -554,6 +554,29 @@ Reasoning levels (`--reasoning off\|minimum\|low\|medium\|high\|xhigh\|max`, also conf
554	554
555	555		You can add additional Gemini model IDs to `models.json` under the `google` provider.
556	556
	557	+	### Google Enterprise Agent Platform (formerly Google Vertex AI)
	558	+
	559	+	zot also has built-in support for [Google Enterprise Agent Platform](https://cloud.google.com/products/gemini-enterprise-agent-platform), Google's enterprise/GCP-hosted Gemini endpoint. Unlike the AI Studio `google` provider above, Google Enterprise Agent Platform supports Google Cloud service-account and Application Default Credentials (ADC) auth in addition to a plain API key — no consumer Google login, but full GCP-style credential support.
	560	+
	561	+	```bash
	562	+	zot --provider google-vertex
	563	+	```
	564	+
	565	+	Required configuration (env vars, read at construction time):
	566	+
	567	+	- `GOOGLE_CLOUD_PROJECT` — required, your GCP project id.
	568	+	- `GOOGLE_CLOUD_LOCATION` — optional, defaults to `us-central1`.
	569	+
	570	+	Credential lookup order for Vertex:
	571	+
	572	+	1. `GOOGLE_CLOUD_API_KEY` — simplest option; an API key created in the GCP console, sent as `x-goog-api-key`. Used directly, no token exchange.
	573	+	2. `GOOGLE_APPLICATION_CREDENTIALS` — path to a service-account JSON key. zot signs a JWT with the key's private key and exchanges it at `https://oauth2.googleapis.com/token` for a short-lived (1h) access token, cached in memory and refreshed on demand.
	574	+	3. Default ADC file — if neither of the above is set, zot falls back to `~/.config/gcloud/application_default_credentials.json`, i.e. whatever `gcloud auth application-default login` produced. Both credential shapes found there are supported:
	575	+	- `type: "service_account"` — same JWT/token-exchange flow as above.
	576	+	- `type: "authorized_user"` — the user-OAuth shape gcloud writes; zot reads the `client_id`/`client_secret`/`refresh_token` and exchanges the refresh token for an access token, with the same caching/refresh behavior.
	577	+
	578	+	If none of these are available, zot errors with `vertex: no auth — set GOOGLE_CLOUD_API_KEY or GOOGLE_APPLICATION_CREDENTIALS`.
	579	+
557	580		### Local models with ollama
558	581
559	582		zot works with [ollama](https://ollama.com) out of the box. Ollama serves an OpenAI-compatible API locally, so any model you have pulled works with zot.


@@ -546,7 +546,7 @@ Credential lookup order for Google:
546			546
547		Use `/login` and pick api key to paste an AI Studio key. zot probes `/v1beta/models` once and stores the key under `google` in `auth.json`.	547		Use `/login` and pick api key to paste an AI Studio key. zot probes `/v1beta/models` once and stores the key under `google` in `auth.json`.
548			548
549	-	> Auth model: API key only. Google does not issue OAuth tokens for consumer Gemini Advanced / Google One AI Premium subscriptions, so there is no "log in with your Google subscription" flow. Programmatic access requires either an AI Studio API key (this provider) or a Vertex AI / GCP service-account credential (not yet wired up in zot). The `/login subscription` step quietly downgrades to the api-key form when you pick Google so you don't end up in a dead end.	549	+	> Auth model: API key only (this provider). Google does not issue OAuth tokens for consumer Gemini Advanced / Google One AI Premium subscriptions, so there is no "log in with your Google subscription" flow. The `/login subscription` step quietly downgrades to the api-key form when you pick Google so you don't end up in a dead end. If you need OAuth/service-account auth instead of an API key, use the `google-vertex` provider below.
550			550
551		> Free-tier rate limits. AI Studio's free tier has tight per-minute and per-day caps that vary by model: `gemini-2.5-pro` is the strictest (a few requests per minute, ~50 per day), Flash and Flash-Lite are far more generous. If a Pro turn 429s with `"You exceeded your current quota"` while Flash on the same key still works, you've hit the Pro free-tier RPD. Either switch to Flash for agent loops, or [enable billing](https://aistudio.google.com/app/apikey) on your AI Studio project to flip the same key from free to pay-as-you-go pricing (`$1.25/M` input, `$10/M` output for Pro).	551		> Free-tier rate limits. AI Studio's free tier has tight per-minute and per-day caps that vary by model: `gemini-2.5-pro` is the strictest (a few requests per minute, ~50 per day), Flash and Flash-Lite are far more generous. If a Pro turn 429s with `"You exceeded your current quota"` while Flash on the same key still works, you've hit the Pro free-tier RPD. Either switch to Flash for agent loops, or [enable billing](https://aistudio.google.com/app/apikey) on your AI Studio project to flip the same key from free to pay-as-you-go pricing (`$1.25/M` input, `$10/M` output for Pro).
552			552

@@ -554,6 +554,29 @@ Reasoning levels (`--reasoning off\|minimum\|low\|medium\|high\|xhigh\|max`, also conf
554			554
555		You can add additional Gemini model IDs to `models.json` under the `google` provider.	555		You can add additional Gemini model IDs to `models.json` under the `google` provider.
556			556
			557	+	### Google Enterprise Agent Platform (formerly Google Vertex AI)
			558	+
			559	+	zot also has built-in support for [Google Enterprise Agent Platform](https://cloud.google.com/products/gemini-enterprise-agent-platform), Google's enterprise/GCP-hosted Gemini endpoint. Unlike the AI Studio `google` provider above, Google Enterprise Agent Platform supports Google Cloud service-account and Application Default Credentials (ADC) auth in addition to a plain API key — no consumer Google login, but full GCP-style credential support.
			560	+
			561	+	```bash
			562	+	zot --provider google-vertex
			563	+	```
			564	+
			565	+	Required configuration (env vars, read at construction time):
			566	+
			567	+	- `GOOGLE_CLOUD_PROJECT` — required, your GCP project id.
			568	+	- `GOOGLE_CLOUD_LOCATION` — optional, defaults to `us-central1`.
			569	+
			570	+	Credential lookup order for Vertex:
			571	+
			572	+	1. `GOOGLE_CLOUD_API_KEY` — simplest option; an API key created in the GCP console, sent as `x-goog-api-key`. Used directly, no token exchange.
			573	+	2. `GOOGLE_APPLICATION_CREDENTIALS` — path to a service-account JSON key. zot signs a JWT with the key's private key and exchanges it at `https://oauth2.googleapis.com/token` for a short-lived (1h) access token, cached in memory and refreshed on demand.
			574	+	3. Default ADC file — if neither of the above is set, zot falls back to `~/.config/gcloud/application_default_credentials.json`, i.e. whatever `gcloud auth application-default login` produced. Both credential shapes found there are supported:
			575	+	- `type: "service_account"` — same JWT/token-exchange flow as above.
			576	+	- `type: "authorized_user"` — the user-OAuth shape gcloud writes; zot reads the `client_id`/`client_secret`/`refresh_token` and exchanges the refresh token for an access token, with the same caching/refresh behavior.
			577	+
			578	+	If none of these are available, zot errors with `vertex: no auth — set GOOGLE_CLOUD_API_KEY or GOOGLE_APPLICATION_CREDENTIALS`.
			579	+
557		### Local models with ollama	580		### Local models with ollama
558			581
559		zot works with [ollama](https://ollama.com) out of the box. Ollama serves an OpenAI-compatible API locally, so any model you have pulled works with zot.	582		zot works with [ollama](https://ollama.com) out of the box. Ollama serves an OpenAI-compatible API locally, so any model you have pulled works with zot.

M packages/agent/config.go +12 -0


@@ -376,6 +376,18 @@ func ResolveCredentialFull(provider, explicit string) (cred, method, accountID s
376	376		if v := os.Getenv("GOOGLE_CLOUD_API_KEY"); v != "" {
377	377		return v, "apikey", "", nil
378	378		}
	379	+	// Check for Application Default Credentials (gcloud auth application-default login)
	380	+	// or service account JSON, matching the actual NewVertex client behavior.
	381	+	if os.Getenv("GOOGLE_APPLICATION_CREDENTIALS") != "" {
	382	+	return "<adc>", "apikey", "", nil
	383	+	}
	384	+	// Check for the default ADC path that gcloud writes to
	385	+	if home, err := os.UserHomeDir(); err == nil {
	386	+	adcPath := filepath.Join(home, ".config", "gcloud", "application_default_credentials.json")
	387	+	if _, err := os.Stat(adcPath); err == nil {
	388	+	return "<adc>", "apikey", "", nil
	389	+	}
	390	+	}
379	391		case "azure-openai-responses":
380	392		if v := os.Getenv("AZURE_OPENAI_API_KEY"); v != "" {
381	393		return v, "apikey", "", nil


@@ -376,6 +376,18 @@ func ResolveCredentialFull(provider, explicit string) (cred, method, accountID s
376	if v := os.Getenv("GOOGLE_CLOUD_API_KEY"); v != "" {	376		if v := os.Getenv("GOOGLE_CLOUD_API_KEY"); v != "" {
377	return v, "apikey", "", nil	377		return v, "apikey", "", nil
378	}	378		}
		379	+	// Check for Application Default Credentials (gcloud auth application-default login)
		380	+	// or service account JSON, matching the actual NewVertex client behavior.
		381	+	if os.Getenv("GOOGLE_APPLICATION_CREDENTIALS") != "" {
		382	+	return "<adc>", "apikey", "", nil
		383	+	}
		384	+	// Check for the default ADC path that gcloud writes to
		385	+	if home, err := os.UserHomeDir(); err == nil {
		386	+	adcPath := filepath.Join(home, ".config", "gcloud", "application_default_credentials.json")
		387	+	if _, err := os.Stat(adcPath); err == nil {
		388	+	return "<adc>", "apikey", "", nil
		389	+	}
		390	+	}
379	case "azure-openai-responses":	391		case "azure-openai-responses":
380	if v := os.Getenv("AZURE_OPENAI_API_KEY"); v != "" {	392		if v := os.Getenv("AZURE_OPENAI_API_KEY"); v != "" {
381	return v, "apikey", "", nil	393		return v, "apikey", "", nil

A packages/agent/config_gcp_test.go +133 -0

@@ -0,0 +1,133 @@
	1	+	package agent
	2	+
	3	+	import (
	4	+	"os"
	5	+	"path/filepath"
	6	+	"testing"
	7	+	)
	8	+
	9	+	// TestResolveCredentialGoogleVertexAPIKey confirms that GOOGLE_CLOUD_API_KEY
	10	+	// takes top priority for the google-vertex provider and is returned with
	11	+	// method "apikey".
	12	+	func TestResolveCredentialGoogleVertexAPIKey(t *testing.T) {
	13	+	t.Setenv("ZOT_HOME", t.TempDir())
	14	+	t.Setenv("HOME", t.TempDir())
	15	+	t.Setenv("GOOGLE_CLOUD_API_KEY", "gcp-key-123")
	16	+	t.Setenv("GOOGLE_APPLICATION_CREDENTIALS", "")
	17	+
	18	+	cred, method, _, err := ResolveCredentialFull("google-vertex", "")
	19	+	if err != nil {
	20	+	t.Fatalf("ResolveCredentialFull failed: %v", err)
	21	+	}
	22	+	if cred != "gcp-key-123" {
	23	+	t.Errorf("cred = %q, want %q", cred, "gcp-key-123")
	24	+	}
	25	+	if method != "apikey" {
	26	+	t.Errorf("method = %q, want apikey", method)
	27	+	}
	28	+	}
	29	+
	30	+	// TestResolveCredentialGoogleVertexApplicationCredentialsEnv confirms that
	31	+	// when GOOGLE_APPLICATION_CREDENTIALS is set (service account JSON path),
	32	+	// resolution returns the "<adc>" sentinel with method "apikey", matching
	33	+	// the real NewVertex client's ADC-based auth flow.
	34	+	func TestResolveCredentialGoogleVertexApplicationCredentialsEnv(t *testing.T) {
	35	+	t.Setenv("ZOT_HOME", t.TempDir())
	36	+	t.Setenv("HOME", t.TempDir())
	37	+	t.Setenv("GOOGLE_CLOUD_API_KEY", "")
	38	+	t.Setenv("GOOGLE_APPLICATION_CREDENTIALS", "/path/to/service-account.json")
	39	+
	40	+	cred, method, _, err := ResolveCredentialFull("google-vertex", "")
	41	+	if err != nil {
	42	+	t.Fatalf("ResolveCredentialFull failed: %v", err)
	43	+	}
	44	+	if cred != "<adc>" {
	45	+	t.Errorf("cred = %q, want <adc>", cred)
	46	+	}
	47	+	if method != "apikey" {
	48	+	t.Errorf("method = %q, want apikey", method)
	49	+	}
	50	+	}
	51	+
	52	+	// TestResolveCredentialGoogleVertexDefaultADCFile confirms that, absent any
	53	+	// env vars, the presence of the default gcloud ADC file
	54	+	// (~/.config/gcloud/application_default_credentials.json) is detected and
	55	+	// resolves to the "<adc>" sentinel.
	56	+	func TestResolveCredentialGoogleVertexDefaultADCFile(t *testing.T) {
	57	+	home := t.TempDir()
	58	+	t.Setenv("ZOT_HOME", t.TempDir())
	59	+	t.Setenv("HOME", home)
	60	+	t.Setenv("GOOGLE_CLOUD_API_KEY", "")
	61	+	t.Setenv("GOOGLE_APPLICATION_CREDENTIALS", "")
	62	+
	63	+	adcDir := filepath.Join(home, ".config", "gcloud")
	64	+	if err := os.MkdirAll(adcDir, 0o755); err != nil {
	65	+	t.Fatal(err)
	66	+	}
	67	+	adcPath := filepath.Join(adcDir, "application_default_credentials.json")
	68	+	if err := os.WriteFile(adcPath, []byte(`{"type":"authorized_user"}`), 0o600); err != nil {
	69	+	t.Fatal(err)
	70	+	}
	71	+
	72	+	cred, method, _, err := ResolveCredentialFull("google-vertex", "")
	73	+	if err != nil {
	74	+	t.Fatalf("ResolveCredentialFull failed: %v", err)
	75	+	}
	76	+	if cred != "<adc>" {
	77	+	t.Errorf("cred = %q, want <adc>", cred)
	78	+	}
	79	+	if method != "apikey" {
	80	+	t.Errorf("method = %q, want apikey", method)
	81	+	}
	82	+	}
	83	+
	84	+	// TestResolveCredentialGoogleVertexPrecedence confirms GOOGLE_CLOUD_API_KEY
	85	+	// wins over GOOGLE_APPLICATION_CREDENTIALS and the default ADC file when
	86	+	// multiple credential sources are present simultaneously.
	87	+	func TestResolveCredentialGoogleVertexPrecedence(t *testing.T) {
	88	+	home := t.TempDir()
	89	+	t.Setenv("ZOT_HOME", t.TempDir())
	90	+	t.Setenv("HOME", home)
	91	+	t.Setenv("GOOGLE_CLOUD_API_KEY", "explicit-key")
	92	+	t.Setenv("GOOGLE_APPLICATION_CREDENTIALS", "/path/to/sa.json")
	93	+
	94	+	adcDir := filepath.Join(home, ".config", "gcloud")
	95	+	if err := os.MkdirAll(adcDir, 0o755); err != nil {
	96	+	t.Fatal(err)
	97	+	}
	98	+	adcPath := filepath.Join(adcDir, "application_default_credentials.json")
	99	+	if err := os.WriteFile(adcPath, []byte(`{"type":"authorized_user"}`), 0o600); err != nil {
	100	+	t.Fatal(err)
	101	+	}
	102	+
	103	+	cred, method, _, err := ResolveCredentialFull("google-vertex", "")
	104	+	if err != nil {
	105	+	t.Fatalf("ResolveCredentialFull failed: %v", err)
	106	+	}
	107	+	if cred != "explicit-key" {
	108	+	t.Errorf("cred = %q, want explicit-key (API key must win over ADC)", cred)
	109	+	}
	110	+	if method != "apikey" {
	111	+	t.Errorf("method = %q, want apikey", method)
	112	+	}
	113	+	}
	114	+
	115	+	// TestResolveCredentialGoogleVertexNoCredentials confirms that when none of
	116	+	// the Vertex credential sources are present (no env vars, no ADC file, no
	117	+	// auth.json entry), resolution fails with an error rather than silently
	118	+	// returning an empty credential.
	119	+	func TestResolveCredentialGoogleVertexNoCredentials(t *testing.T) {
	120	+	home := t.TempDir()
	121	+	t.Setenv("ZOT_HOME", t.TempDir())
	122	+	t.Setenv("HOME", home)
	123	+	t.Setenv("GOOGLE_CLOUD_API_KEY", "")
	124	+	t.Setenv("GOOGLE_APPLICATION_CREDENTIALS", "")
	125	+
	126	+	cred, method, _, err := ResolveCredentialFull("google-vertex", "")
	127	+	if err == nil {
	128	+	t.Fatalf("expected error, got cred=%q method=%q", cred, method)
	129	+	}
	130	+	if cred != "" \|\| method != "" {
	131	+	t.Errorf("expected empty cred/method on error, got cred=%q method=%q", cred, method)
	132	+	}
	133	+	}

@@ -0,0 +1,133 @@
	1	+	package agent
	2	+
	3	+	import (
	4	+	"os"
	5	+	"path/filepath"
	6	+	"testing"
	7	+	)
	8	+
	9	+	// TestResolveCredentialGoogleVertexAPIKey confirms that GOOGLE_CLOUD_API_KEY
	10	+	// takes top priority for the google-vertex provider and is returned with
	11	+	// method "apikey".
	12	+	func TestResolveCredentialGoogleVertexAPIKey(t *testing.T) {
	13	+	t.Setenv("ZOT_HOME", t.TempDir())
	14	+	t.Setenv("HOME", t.TempDir())
	15	+	t.Setenv("GOOGLE_CLOUD_API_KEY", "gcp-key-123")
	16	+	t.Setenv("GOOGLE_APPLICATION_CREDENTIALS", "")
	17	+
	18	+	cred, method, _, err := ResolveCredentialFull("google-vertex", "")
	19	+	if err != nil {
	20	+	t.Fatalf("ResolveCredentialFull failed: %v", err)
	21	+	}
	22	+	if cred != "gcp-key-123" {
	23	+	t.Errorf("cred = %q, want %q", cred, "gcp-key-123")
	24	+	}
	25	+	if method != "apikey" {
	26	+	t.Errorf("method = %q, want apikey", method)
	27	+	}
	28	+	}
	29	+
	30	+	// TestResolveCredentialGoogleVertexApplicationCredentialsEnv confirms that
	31	+	// when GOOGLE_APPLICATION_CREDENTIALS is set (service account JSON path),
	32	+	// resolution returns the "<adc>" sentinel with method "apikey", matching
	33	+	// the real NewVertex client's ADC-based auth flow.
	34	+	func TestResolveCredentialGoogleVertexApplicationCredentialsEnv(t *testing.T) {
	35	+	t.Setenv("ZOT_HOME", t.TempDir())
	36	+	t.Setenv("HOME", t.TempDir())
	37	+	t.Setenv("GOOGLE_CLOUD_API_KEY", "")
	38	+	t.Setenv("GOOGLE_APPLICATION_CREDENTIALS", "/path/to/service-account.json")
	39	+
	40	+	cred, method, _, err := ResolveCredentialFull("google-vertex", "")
	41	+	if err != nil {
	42	+	t.Fatalf("ResolveCredentialFull failed: %v", err)
	43	+	}
	44	+	if cred != "<adc>" {
	45	+	t.Errorf("cred = %q, want <adc>", cred)
	46	+	}
	47	+	if method != "apikey" {
	48	+	t.Errorf("method = %q, want apikey", method)
	49	+	}
	50	+	}
	51	+
	52	+	// TestResolveCredentialGoogleVertexDefaultADCFile confirms that, absent any
	53	+	// env vars, the presence of the default gcloud ADC file
	54	+	// (~/.config/gcloud/application_default_credentials.json) is detected and
	55	+	// resolves to the "<adc>" sentinel.
	56	+	func TestResolveCredentialGoogleVertexDefaultADCFile(t *testing.T) {
	57	+	home := t.TempDir()
	58	+	t.Setenv("ZOT_HOME", t.TempDir())
	59	+	t.Setenv("HOME", home)
	60	+	t.Setenv("GOOGLE_CLOUD_API_KEY", "")
	61	+	t.Setenv("GOOGLE_APPLICATION_CREDENTIALS", "")
	62	+
	63	+	adcDir := filepath.Join(home, ".config", "gcloud")
	64	+	if err := os.MkdirAll(adcDir, 0o755); err != nil {
	65	+	t.Fatal(err)
	66	+	}
	67	+	adcPath := filepath.Join(adcDir, "application_default_credentials.json")
	68	+	if err := os.WriteFile(adcPath, []byte(`{"type":"authorized_user"}`), 0o600); err != nil {
	69	+	t.Fatal(err)
	70	+	}
	71	+
	72	+	cred, method, _, err := ResolveCredentialFull("google-vertex", "")
	73	+	if err != nil {
	74	+	t.Fatalf("ResolveCredentialFull failed: %v", err)
	75	+	}
	76	+	if cred != "<adc>" {
	77	+	t.Errorf("cred = %q, want <adc>", cred)
	78	+	}
	79	+	if method != "apikey" {
	80	+	t.Errorf("method = %q, want apikey", method)
	81	+	}
	82	+	}
	83	+
	84	+	// TestResolveCredentialGoogleVertexPrecedence confirms GOOGLE_CLOUD_API_KEY
	85	+	// wins over GOOGLE_APPLICATION_CREDENTIALS and the default ADC file when
	86	+	// multiple credential sources are present simultaneously.
	87	+	func TestResolveCredentialGoogleVertexPrecedence(t *testing.T) {
	88	+	home := t.TempDir()
	89	+	t.Setenv("ZOT_HOME", t.TempDir())
	90	+	t.Setenv("HOME", home)
	91	+	t.Setenv("GOOGLE_CLOUD_API_KEY", "explicit-key")
	92	+	t.Setenv("GOOGLE_APPLICATION_CREDENTIALS", "/path/to/sa.json")
	93	+
	94	+	adcDir := filepath.Join(home, ".config", "gcloud")
	95	+	if err := os.MkdirAll(adcDir, 0o755); err != nil {
	96	+	t.Fatal(err)
	97	+	}
	98	+	adcPath := filepath.Join(adcDir, "application_default_credentials.json")
	99	+	if err := os.WriteFile(adcPath, []byte(`{"type":"authorized_user"}`), 0o600); err != nil {
	100	+	t.Fatal(err)
	101	+	}
	102	+
	103	+	cred, method, _, err := ResolveCredentialFull("google-vertex", "")
	104	+	if err != nil {
	105	+	t.Fatalf("ResolveCredentialFull failed: %v", err)
	106	+	}
	107	+	if cred != "explicit-key" {
	108	+	t.Errorf("cred = %q, want explicit-key (API key must win over ADC)", cred)
	109	+	}
	110	+	if method != "apikey" {
	111	+	t.Errorf("method = %q, want apikey", method)
	112	+	}
	113	+	}
	114	+
	115	+	// TestResolveCredentialGoogleVertexNoCredentials confirms that when none of
	116	+	// the Vertex credential sources are present (no env vars, no ADC file, no
	117	+	// auth.json entry), resolution fails with an error rather than silently
	118	+	// returning an empty credential.
	119	+	func TestResolveCredentialGoogleVertexNoCredentials(t *testing.T) {
	120	+	home := t.TempDir()
	121	+	t.Setenv("ZOT_HOME", t.TempDir())
	122	+	t.Setenv("HOME", home)
	123	+	t.Setenv("GOOGLE_CLOUD_API_KEY", "")
	124	+	t.Setenv("GOOGLE_APPLICATION_CREDENTIALS", "")
	125	+
	126	+	cred, method, _, err := ResolveCredentialFull("google-vertex", "")
	127	+	if err == nil {
	128	+	t.Fatalf("expected error, got cred=%q method=%q", cred, method)
	129	+	}
	130	+	if cred != "" \|\| method != "" {
	131	+	t.Errorf("expected empty cred/method on error, got cred=%q method=%q", cred, method)
	132	+	}
	133	+	}