import sys

sys.dont_write_bytecode = True

import argparse
import base64
import binascii
import hashlib
import json
import os
import re
import time
from urllib.parse import urlsplit

import requests

sys.path.append(os.path.dirname(os.path.dirname(os.path.abspath(__file__))))

from keycheck_common import (
    append_jsonl,
    append_status,
    commit_status_transaction,
    default_input_file,
    default_proxy_file,
    ensure_output_files,
    iter_findings,
    keycheck_input_mode,
    load_checked_statuses,
    load_known_keys,
    load_known_statuses,
    load_proxies,
    mask_secret,
    recover_status_transaction,
    request_error_message,
    record_cached_keycheck_occurrence,
    record_validation_result,
    require_provider_authority,
    service_output_dir,
    should_skip_key,
    write_keycheck_event,
)


SCRIPT_DIR = os.path.dirname(os.path.abspath(__file__))
PARENT_DIR = os.path.dirname(SCRIPT_DIR)
SERVICE = "gcp"
OUTPUT_DIR = os.getenv("KEYCHECK_OUTPUT_DIR") or service_output_dir(SERVICE)

INPUT_FILE = os.getenv("KEYCHECK_INPUT_FILE") or default_input_file()
PROXY_FILE = os.getenv("KEYCHECK_PROXY_FILE") or default_proxy_file()
PLAIN_FILE = os.path.join(OUTPUT_DIR, "gcp.txt")
CHECKED_FILE = os.path.join(OUTPUT_DIR, "gcpChecked.txt")
RESULTS_FILE = os.path.join(OUTPUT_DIR, "gcpResults.jsonl")

STATUS_FILES = {
    "VALID": os.path.join(OUTPUT_DIR, "gcpAlive.txt"),
    "VERTEX": os.path.join(OUTPUT_DIR, "gcpVertex.txt"),
    "DEAD": os.path.join(OUTPUT_DIR, "gcpDead.txt"),
    "RESTRICTED": os.path.join(OUTPUT_DIR, "gcpRestricted.txt"),
    "NETWORK": os.path.join(OUTPUT_DIR, "gcpNetwork.txt"),
    "UNKNOWN": os.path.join(OUTPUT_DIR, "gcpUnknown.txt"),
    "NO_CONTEXT": os.path.join(OUTPUT_DIR, "gcpNoContext.txt"),
}
VERTEX_GEMINI_FILE = os.path.join(OUTPUT_DIR, "gcpVertexGemini.txt")
VERTEX_ANTHROPIC_FILE = os.path.join(OUTPUT_DIR, "gcpVertexAnthropic.txt")

GOOGLE_TOKEN_URL = "https://oauth2.googleapis.com/token"
TRUSTED_GOOGLE_TOKEN_ENDPOINTS = frozenset({
    GOOGLE_TOKEN_URL,
    "https://accounts.google.com/o/oauth2/token",
})
TOKEN_REDIRECT_STATUSES = {301, 302, 303, 307, 308}
SA_SCOPE = "https://www.googleapis.com/auth/cloud-platform"
MAX_PEM_BYTES = 24 * 1024
MAX_DER_BYTES = 16 * 1024
MAX_DER_LENGTH_BYTES = 2
MIN_RSA_BITS = 2048
MAX_RSA_BITS = 8192
MAX_RSA_INTEGER_BYTES = MAX_RSA_BITS // 8
RSA_ENCRYPTION_OID = bytes.fromhex("2a864886f70d010101")
VERTEX_LOCATIONS = ["global", "us", "eu"]
VERTEX_MODELS = ["gemini-3.6-flash", "gemini-3.1-pro-preview"]
VERTEX_ANTHROPIC_LOCATIONS = ["global", "us", "eu", "us-east5", "europe-west1"]
VERTEX_ANTHROPIC_MODELS = ["claude-opus-5", "claude-opus-4-7", "claude-opus-4-6", "claude-fable-5"]


def transaction_status_files():
    return {
        **STATUS_FILES,
        "RATE_LIMITED": STATUS_FILES["UNKNOWN"],
        "AUX_VERTEX_GEMINI": VERTEX_GEMINI_FILE,
        "AUX_VERTEX_ANTHROPIC": VERTEX_ANTHROPIC_FILE,
    }


def ensure_files():
    ensure_output_files([CHECKED_FILE, RESULTS_FILE, *STATUS_FILES.values(), VERTEX_GEMINI_FILE, VERTEX_ANTHROPIC_FILE, PLAIN_FILE])
    recover_status_transaction(CHECKED_FILE, transaction_status_files())


def b64url(data):
    return base64.urlsafe_b64encode(data).rstrip(b"=").decode()


def validate_google_token_uri(value):
    token_uri = str(value or GOOGLE_TOKEN_URL).strip()
    try:
        parsed = urlsplit(token_uri)
        port = parsed.port
    except (TypeError, ValueError) as exc:
        raise ValueError("invalid Google OAuth token_uri") from exc
    if (
        parsed.scheme != "https"
        or parsed.username is not None
        or parsed.password is not None
        or port not in (None, 443)
        or parsed.query
        or parsed.fragment
        or token_uri not in TRUSTED_GOOGLE_TOKEN_ENDPOINTS
    ):
        raise ValueError("untrusted Google OAuth token_uri")
    return token_uri


class InvalidRSAPrivateKey(ValueError):
    pass


class DERReader:
    def __init__(self, data):
        if not isinstance(data, (bytes, bytearray, memoryview)):
            raise InvalidRSAPrivateKey("DER value is not binary")
        if len(data) > MAX_DER_BYTES:
            raise InvalidRSAPrivateKey("DER value exceeds size limit")
        self.data = data
        self.pos = 0

    def read_tlv(self):
        if len(self.data) - self.pos < 2:
            raise InvalidRSAPrivateKey("truncated DER tag or length")
        tag = self.data[self.pos]
        self.pos += 1
        first_len = self.data[self.pos]
        self.pos += 1
        if first_len & 0x80:
            length_len = first_len & 0x7F
            if length_len == 0:
                raise InvalidRSAPrivateKey("indefinite DER length is not allowed")
            if length_len > MAX_DER_LENGTH_BYTES:
                raise InvalidRSAPrivateKey("DER length-of-length exceeds limit")
            if len(self.data) - self.pos < length_len:
                raise InvalidRSAPrivateKey("truncated DER length")
            length_bytes = self.data[self.pos:self.pos + length_len]
            if length_bytes[0] == 0:
                raise InvalidRSAPrivateKey("non-minimal DER length")
            length = int.from_bytes(length_bytes, "big")
            self.pos += length_len
            if length < 0x80:
                raise InvalidRSAPrivateKey("non-minimal DER length")
        else:
            length = first_len
        if length > MAX_DER_BYTES:
            raise InvalidRSAPrivateKey("DER value length exceeds limit")
        if length > len(self.data) - self.pos:
            raise InvalidRSAPrivateKey("truncated DER value")
        value = self.data[self.pos:self.pos + length]
        self.pos += length
        return tag, value

    def expect(self, tag):
        actual, value = self.read_tlv()
        if actual != tag:
            raise InvalidRSAPrivateKey(f"expected DER tag {tag:#x}, got {actual:#x}")
        return value

    def at_end(self):
        return self.pos == len(self.data)

    def require_eof(self, context="DER structure"):
        if not self.at_end():
            raise InvalidRSAPrivateKey(f"trailing data in {context}")


def der_int(value, name="integer", max_bytes=MAX_RSA_INTEGER_BYTES):
    if not value:
        raise InvalidRSAPrivateKey(f"empty RSA {name}")
    if len(value) > max_bytes + 1:
        raise InvalidRSAPrivateKey(f"RSA {name} exceeds size limit")
    if value[0] & 0x80:
        raise InvalidRSAPrivateKey(f"negative RSA {name}")
    if value[0] == 0:
        if len(value) > 1 and not value[1] & 0x80:
            raise InvalidRSAPrivateKey(f"non-minimal RSA {name}")
        unsigned = value[1:]
    else:
        unsigned = value
    if len(unsigned) > max_bytes:
        raise InvalidRSAPrivateKey(f"RSA {name} exceeds size limit")
    return int.from_bytes(unsigned, "big") if unsigned else 0


def parse_pkcs1_rsa_private_key(data):
    rsa = DERReader(data)
    version = der_int(rsa.expect(0x02), "version", 1)
    if version != 0:
        raise InvalidRSAPrivateKey("unsupported RSA private key version")
    n = der_int(rsa.expect(0x02), "modulus")
    public_exponent = der_int(rsa.expect(0x02), "public exponent")
    d = der_int(rsa.expect(0x02), "private exponent")
    for name in ("prime1", "prime2", "exponent1", "exponent2", "coefficient"):
        der_int(rsa.expect(0x02), name)
    rsa.require_eof("RSA private key")

    modulus_bits = n.bit_length()
    if not MIN_RSA_BITS <= modulus_bits <= MAX_RSA_BITS:
        raise InvalidRSAPrivateKey(
            f"RSA modulus must be between {MIN_RSA_BITS} and {MAX_RSA_BITS} bits"
        )
    if public_exponent == 0:
        raise InvalidRSAPrivateKey("RSA public exponent is zero")
    if d == 0 or d >= n:
        raise InvalidRSAPrivateKey("RSA private exponent is out of range")
    return n, d


def validate_rsa_algorithm_identifier(data):
    algorithm = DERReader(data)
    if algorithm.expect(0x06) != RSA_ENCRYPTION_OID:
        raise InvalidRSAPrivateKey("PKCS#8 key does not use rsaEncryption")
    if not algorithm.at_end() and algorithm.expect(0x05):
        raise InvalidRSAPrivateKey("invalid rsaEncryption parameters")
    algorithm.require_eof("PKCS#8 algorithm identifier")


def parse_rsa_private_key_from_pem(pem):
    pem = str(pem or "")
    if len(pem) > MAX_PEM_BYTES:
        raise InvalidRSAPrivateKey("PEM private key exceeds size limit")
    try:
        pem_bytes = pem.encode("utf-8")
    except UnicodeEncodeError as exc:
        raise InvalidRSAPrivateKey("PEM private key is not valid UTF-8") from exc
    if len(pem_bytes) > MAX_PEM_BYTES:
        raise InvalidRSAPrivateKey("PEM private key exceeds size limit")
    pem = pem.replace("\\n", "\n")
    match = re.fullmatch(
        r"\s*-----BEGIN (RSA PRIVATE KEY|PRIVATE KEY)-----\s*(.*?)\s*-----END \1-----\s*",
        pem,
        re.DOTALL,
    )
    if not match:
        raise InvalidRSAPrivateKey("missing complete PEM private key block")
    body = re.sub(r"\s+", "", match.group(2))
    if len(body) < 256:
        raise InvalidRSAPrivateKey("PEM private key body is too short")
    try:
        der = base64.b64decode(body + ("=" * (-len(body) % 4)), validate=True)
    except (binascii.Error, ValueError) as exc:
        raise InvalidRSAPrivateKey("invalid PEM base64") from exc
    if len(der) > MAX_DER_BYTES:
        raise InvalidRSAPrivateKey("DER private key exceeds size limit")

    reader = DERReader(der)
    top_bytes = reader.expect(0x30)
    reader.require_eof("DER private key")
    top = DERReader(top_bytes)

    # PKCS#8 PrivateKeyInfo: SEQUENCE(version, alg, OCTET STRING(RSAPrivateKey))
    first_tag, first_val = top.read_tlv()
    if first_tag != 0x02:
        raise InvalidRSAPrivateKey("unexpected private key structure")
    second_tag, second_val = top.read_tlv()
    if second_tag == 0x30:
        if der_int(first_val, "PKCS#8 version", 1) != 0:
            raise InvalidRSAPrivateKey("unsupported PKCS#8 version")
        validate_rsa_algorithm_identifier(second_val)
        private_octet = top.expect(0x04)
        top.require_eof("PKCS#8 private key")
        wrapped = DERReader(private_octet)
        rsa_bytes = wrapped.expect(0x30)
        wrapped.require_eof("PKCS#8 private key octets")
        return parse_pkcs1_rsa_private_key(rsa_bytes)
    if second_tag != 0x02:
        raise InvalidRSAPrivateKey("unexpected private key structure")
    return parse_pkcs1_rsa_private_key(top_bytes)


def rsa_pkcs1v15_sha256_sign(message, pem):
    n, d = parse_rsa_private_key_from_pem(pem)
    digest = hashlib.sha256(message).digest()
    digest_info = bytes.fromhex("3031300d060960864801650304020105000420") + digest
    key_len = (n.bit_length() + 7) // 8
    if key_len < len(digest_info) + 11:
        raise InvalidRSAPrivateKey("RSA key too small")
    encoded = b"\x00\x01" + b"\xff" * (key_len - len(digest_info) - 3) + b"\x00" + digest_info
    sig = pow(int.from_bytes(encoded, "big"), d, n).to_bytes(key_len, "big")
    return sig


def make_service_account_assertion(creds):
    now = int(time.time())
    token_uri = validate_google_token_uri(creds.get("token_uri"))
    header = {"alg": "RS256", "typ": "JWT", "kid": creds.get("private_key_id")}
    payload = {
        "iss": creds["client_email"],
        "scope": SA_SCOPE,
        "aud": token_uri,
        "iat": now,
        "exp": now + 3600,
    }
    signing_input = (b64url(json.dumps(header, separators=(",", ":")).encode()) + "." + b64url(json.dumps(payload, separators=(",", ":")).encode())).encode()
    signature = rsa_pkcs1v15_sha256_sign(signing_input, creds["private_key"])
    return signing_input.decode() + "." + b64url(signature), token_uri


def compact_json(data):
    return json.dumps(data, ensure_ascii=False, separators=(",", ":"), sort_keys=True)


def scanner_context_text(finding):
    context = finding.get("ScannerContext") if isinstance(finding, dict) else None
    if isinstance(context, dict):
        return str(context.get("nearby") or "")
    return ""


def parse_json_object(text):
    try:
        return json.loads(text)
    except (TypeError, ValueError):
        pass
    match = re.search(r"\{.*\}", str(text or ""), re.DOTALL)
    if not match:
        return None
    try:
        return json.loads(match.group(0))
    except ValueError:
        return None


def parse_service_account(raw_v2):
    data = parse_json_object(raw_v2)
    if not isinstance(data, dict):
        return None
    required = ["client_email", "private_key", "private_key_id"]
    if not all(data.get(item) for item in required):
        return None
    private_key = str(data.get("private_key") or "")
    if "-----BEGIN" not in private_key or "-----END" not in private_key or len(private_key) < 800:
        return None
    return data


def parse_adc(raw_v2, finding):
    data = parse_json_object(scanner_context_text(finding)) or parse_json_object(raw_v2)
    if not isinstance(data, dict):
        return None
    required = ["client_id", "client_secret", "refresh_token"]
    if not all(data.get(item) for item in required):
        return None
    return data


def extract_candidates(input_file, plain_file):
    seen_plain = set()
    for item in iter_findings(input_file, ["GCP", "GCPApplicationDefaultCredentials"]):
        if item["detector"] == "GCP":
            parsed = parse_service_account(item["raw_v2"])
            detector = "GCP"
        else:
            parsed = parse_adc(item["raw_v2"], item["finding"])
            detector = "GCPApplicationDefaultCredentials"
        if not parsed:
            key = f"{detector}:no_context:{item['source']}"
            yield key, detector, item["source"], item["finding"], None
            continue
        key = compact_json(parsed)
        yield key, detector, item["source"], item["finding"], parsed

    if keycheck_input_mode() == 'jsonl' and os.path.exists(plain_file):
        with open(plain_file, "r", encoding="utf-8", errors="replace") as f:
            content = f.read()
        candidates = []
        whole_file = parse_json_object(content)
        if whole_file:
            candidates.append((plain_file, whole_file))
        for line_num, line in enumerate(content.splitlines(), 1):
            key_text = line.split("\t", 1)[0].strip()
            parsed = parse_json_object(key_text) or parse_json_object(line)
            if parsed:
                candidates.append((f"{plain_file}:{line_num}", parsed))
        for source, parsed in candidates:
            detector = "GCP" if parsed.get("private_key") else "GCPApplicationDefaultCredentials"
            key = compact_json(parsed)
            if key not in seen_plain:
                seen_plain.add(key)
                yield key, detector, source, {}, parsed


def vertex_api_host(location):
    location = str(location or "").strip().lower()
    if location == "global":
        return "aiplatform.googleapis.com"
    if location in ("us", "eu"):
        return f"aiplatform.{location}.rep.googleapis.com"
    return f"{location}-aiplatform.googleapis.com"


def probe_vertex_llm(access_token, project_id, proxy, timeout, locations=None, models=None, max_attempts=2):
    if not project_id:
        return {"enabled": False, "message": "project_id unavailable"}
    headers = {"Authorization": f"Bearer {access_token}", "Content-Type": "application/json"}
    payload = {"contents": [{"role": "user", "parts": [{"text": "ping"}]}]}
    attempts = []
    accepted = []
    tried = 0
    for location in (locations or VERTEX_LOCATIONS):
        for model in (models or VERTEX_MODELS):
            if max_attempts and tried >= max_attempts:
                if accepted:
                    first = accepted[0]
                    return {
                        "enabled": True,
                        "location": first.get("location", ""),
                        "model": first.get("model", ""),
                        "total_tokens": first.get("total_tokens"),
                        "available_models": [f"google/{item['location']}/{item['model']}" for item in accepted],
                        "message": "Vertex countTokens accepted",
                    }
                return {"enabled": False, "message": "; ".join(attempts[:8]) or "Vertex probe attempt limit reached"}
            tried += 1
            url = f"https://{vertex_api_host(location)}/v1/projects/{project_id}/locations/{location}/publishers/google/models/{model}:countTokens"
            try:
                response = requests.post(url, headers=headers, json=payload, proxies=proxy, timeout=timeout)
            except requests.RequestException as exc:
                attempts.append(f"{location}:{model}:network:{str(exc)[:120]}")
                continue
            if response.status_code == 200:
                data = response.json()
                accepted.append({
                    "location": location,
                    "model": model,
                    "total_tokens": data.get("totalTokens") or data.get("total_tokens"),
                })
                continue
            message = request_error_message(response)
            if response.status_code in (400, 401, 403, 404, 429):
                attempts.append(f"{location}:{model}:http_{response.status_code}:{message[:160]}")
                continue
            if response.status_code >= 500:
                attempts.append(f"{location}:{model}:server_{response.status_code}:{message[:160]}")
                continue
            attempts.append(f"{location}:{model}:http_{response.status_code}:{message[:160]}")
    if accepted:
        first = accepted[0]
        return {
            "enabled": True,
            "location": first.get("location", ""),
            "model": first.get("model", ""),
            "total_tokens": first.get("total_tokens"),
            "available_models": [f"google/{item['location']}/{item['model']}" for item in accepted],
            "message": "Vertex countTokens accepted",
        }
    return {"enabled": False, "message": "; ".join(attempts[:8])}


def probe_vertex_anthropic(access_token, project_id, proxy, timeout, locations=None, models=None, max_attempts=2):
    if not project_id:
        return {"enabled": False, "message": "project_id unavailable"}
    models = models or []
    if not models:
        return {"enabled": False, "message": "no Anthropic models configured"}
    headers = {"Authorization": f"Bearer {access_token}", "Content-Type": "application/json"}
    payload = {
        "anthropic_version": "vertex-2023-10-16",
        "messages": [{"role": "user", "content": "ping"}],
        "max_tokens": 1,
    }
    attempts = []
    accepted = []
    tried = 0
    for location in (locations or VERTEX_ANTHROPIC_LOCATIONS):
        for model in models:
            if max_attempts and tried >= max_attempts:
                if accepted:
                    first = accepted[0]
                    return {
                        "enabled": True,
                        "location": first.get("location", ""),
                        "model": first.get("model", ""),
                        "available_models": [f"anthropic/{item['location']}/{item['model']}" for item in accepted],
                        "message": "Vertex Anthropic rawPredict accepted",
                    }
                return {"enabled": False, "message": "; ".join(attempts[:8]) or "Vertex Anthropic probe attempt limit reached"}
            tried += 1
            url = f"https://{vertex_api_host(location)}/v1/projects/{project_id}/locations/{location}/publishers/anthropic/models/{model}:rawPredict"
            try:
                response = requests.post(url, headers=headers, json=payload, proxies=proxy, timeout=timeout)
            except requests.RequestException as exc:
                attempts.append(f"{location}:{model}:network:{str(exc)[:120]}")
                continue
            if response.status_code == 200:
                accepted.append({"location": location, "model": model})
                continue
            message = request_error_message(response)
            if response.status_code in (400, 401, 403, 404, 429):
                attempts.append(f"{location}:{model}:http_{response.status_code}:{message[:160]}")
                continue
            if response.status_code >= 500:
                attempts.append(f"{location}:{model}:server_{response.status_code}:{message[:160]}")
                continue
            attempts.append(f"{location}:{model}:http_{response.status_code}:{message[:160]}")
    if accepted:
        first = accepted[0]
        return {
            "enabled": True,
            "location": first.get("location", ""),
            "model": first.get("model", ""),
            "available_models": [f"anthropic/{item['location']}/{item['model']}" for item in accepted],
            "message": "Vertex Anthropic rawPredict accepted",
        }
    return {"enabled": False, "message": "; ".join(attempts[:8])}


def merge_vertex_results(google_vertex, anthropic_vertex):
    google_vertex = google_vertex or {"enabled": False, "message": ""}
    anthropic_vertex = anthropic_vertex or {"enabled": False, "message": ""}
    available = []
    available.extend(google_vertex.get("available_models") or [])
    available.extend(anthropic_vertex.get("available_models") or [])
    first = google_vertex if google_vertex.get("enabled") else anthropic_vertex if anthropic_vertex.get("enabled") else {}
    messages = []
    if google_vertex.get("message"):
        messages.append(f"google: {google_vertex.get('message')}")
    if anthropic_vertex.get("message"):
        messages.append(f"anthropic: {anthropic_vertex.get('message')}")
    return {
        "enabled": bool(available),
        "location": first.get("location", ""),
        "model": first.get("model", ""),
        "total_tokens": first.get("total_tokens"),
        "available_models": available,
        "google_enabled": bool(google_vertex.get("enabled")),
        "anthropic_enabled": bool(anthropic_vertex.get("enabled")),
        "message": "; ".join(messages),
    }


def check_service_account(creds, proxy, timeout, probe_vertex=False, vertex_timeout=6, vertex_locations=None, vertex_models=None, vertex_max_attempts=2, vertex_anthropic_locations=None, vertex_anthropic_models=None, vertex_anthropic_max_attempts=2):
    try:
        assertion, token_uri = make_service_account_assertion(creds)
    except InvalidRSAPrivateKey as exc:
        return {
            "status": "DEAD",
            "classification": "invalid_private_key",
            "message": f"invalid RSA private key: {exc}",
            "project_id": creds.get("project_id"),
            "client_email": creds.get("client_email"),
        }
    except Exception as exc:
        return {"status": "UNKNOWN", "message": f"failed to build JWT assertion: {exc}"}
    data = {"grant_type": "urn:ietf:params:oauth:grant-type:jwt-bearer", "assertion": assertion}
    try:
        response = requests.post(
            token_uri, data=data, proxies=proxy, timeout=timeout, allow_redirects=False,
        )
    except requests.RequestException as exc:
        return {"status": "NETWORK", "message": str(exc), "project_id": creds.get("project_id"), "client_email": creds.get("client_email")}
    if response.status_code in TOKEN_REDIRECT_STATUSES:
        return {
            "status": "UNKNOWN",
            "http_status": response.status_code,
            "message": "Google OAuth token endpoint redirect refused",
            "project_id": creds.get("project_id"),
            "client_email": creds.get("client_email"),
        }
    if response.status_code == 200:
        payload = response.json()
        result = {
            "status": "VALID",
            "message": "OAuth token issued",
            "project_id": creds.get("project_id"),
            "client_email": creds.get("client_email"),
            "private_key_id": creds.get("private_key_id"),
            "expires_in": payload.get("expires_in"),
        }
        if probe_vertex:
            google_vertex = probe_vertex_llm(
                payload.get("access_token"), creds.get("project_id"), proxy,
                vertex_timeout, vertex_locations, vertex_models, vertex_max_attempts,
            )
            anthropic_vertex = probe_vertex_anthropic(
                payload.get("access_token"), creds.get("project_id"), proxy,
                vertex_timeout, vertex_anthropic_locations, vertex_anthropic_models, vertex_anthropic_max_attempts,
            ) if vertex_anthropic_models else {"enabled": False, "message": ""}
            vertex = merge_vertex_results(google_vertex, anthropic_vertex)
            result.update({
                "vertex_enabled": vertex.get("enabled"),
                "vertex_location": vertex.get("location", ""),
                "vertex_model": vertex.get("model", ""),
                "vertex_available_models": vertex.get("available_models") or [],
                "vertex_google_enabled": vertex.get("google_enabled"),
                "vertex_anthropic_enabled": vertex.get("anthropic_enabled"),
                "vertex_total_tokens": vertex.get("total_tokens"),
                "vertex_message": vertex.get("message", ""),
            })
            if vertex.get("enabled"):
                result["status"] = "VERTEX"
                result["message"] = "OAuth token issued; Vertex countTokens accepted"
        return result
    message = request_error_message(response)
    lower = message.lower()
    if response.status_code in (400, 401) and any(item in lower for item in ("invalid_grant", "invalid_client", "invalid jwt", "invalid signature")):
        return {"status": "DEAD", "http_status": response.status_code, "message": message, "project_id": creds.get("project_id"), "client_email": creds.get("client_email")}
    if response.status_code in (401, 403):
        return {"status": "RESTRICTED", "http_status": response.status_code, "message": message, "project_id": creds.get("project_id"), "client_email": creds.get("client_email")}
    if response.status_code == 429:
        return {"status": "RATE_LIMITED", "http_status": 429, "message": message, "project_id": creds.get("project_id"), "client_email": creds.get("client_email")}
    if response.status_code >= 500:
        return {"status": "NETWORK", "http_status": response.status_code, "message": message, "project_id": creds.get("project_id"), "client_email": creds.get("client_email")}
    return {"status": "UNKNOWN", "http_status": response.status_code, "message": message, "project_id": creds.get("project_id"), "client_email": creds.get("client_email")}


def check_adc(creds, proxy, timeout, probe_vertex=False, vertex_timeout=6, vertex_locations=None, vertex_models=None, vertex_max_attempts=2, vertex_anthropic_locations=None, vertex_anthropic_models=None, vertex_anthropic_max_attempts=2):
    try:
        token_uri = validate_google_token_uri(creds.get("token_uri"))
    except ValueError as exc:
        return {"status": "UNKNOWN", "message": str(exc), "client_id": creds.get("client_id")}
    data = {
        "client_id": creds["client_id"],
        "client_secret": creds["client_secret"],
        "refresh_token": creds["refresh_token"],
        "grant_type": "refresh_token",
    }
    try:
        response = requests.post(
            token_uri, data=data, proxies=proxy, timeout=timeout, allow_redirects=False,
        )
    except requests.RequestException as exc:
        return {"status": "NETWORK", "message": str(exc), "client_id": creds.get("client_id")}
    if response.status_code in TOKEN_REDIRECT_STATUSES:
        return {
            "status": "UNKNOWN",
            "http_status": response.status_code,
            "message": "Google OAuth token endpoint redirect refused",
            "client_id": creds.get("client_id"),
        }
    if response.status_code == 200:
        payload = response.json()
        project_id = creds.get("quota_project_id") or creds.get("project_id")
        result = {"status": "VALID", "message": "refresh token accepted", "client_id": creds.get("client_id"), "project_id": project_id, "expires_in": payload.get("expires_in")}
        if probe_vertex:
            google_vertex = probe_vertex_llm(
                payload.get("access_token"), project_id, proxy,
                vertex_timeout, vertex_locations, vertex_models, vertex_max_attempts,
            )
            anthropic_vertex = probe_vertex_anthropic(
                payload.get("access_token"), project_id, proxy,
                vertex_timeout, vertex_anthropic_locations, vertex_anthropic_models, vertex_anthropic_max_attempts,
            ) if vertex_anthropic_models else {"enabled": False, "message": ""}
            vertex = merge_vertex_results(google_vertex, anthropic_vertex)
            result.update({
                "vertex_enabled": vertex.get("enabled"),
                "vertex_location": vertex.get("location", ""),
                "vertex_model": vertex.get("model", ""),
                "vertex_available_models": vertex.get("available_models") or [],
                "vertex_google_enabled": vertex.get("google_enabled"),
                "vertex_anthropic_enabled": vertex.get("anthropic_enabled"),
                "vertex_total_tokens": vertex.get("total_tokens"),
                "vertex_message": vertex.get("message", ""),
            })
            if vertex.get("enabled"):
                result["status"] = "VERTEX"
                result["message"] = "refresh token accepted; Vertex countTokens accepted"
        return result
    message = request_error_message(response)
    lower = message.lower()
    if response.status_code in (400, 401) and any(item in lower for item in ("invalid_grant", "invalid_client", "unauthorized_client")):
        return {"status": "DEAD", "http_status": response.status_code, "message": message, "client_id": creds.get("client_id")}
    if response.status_code in (401, 403):
        return {"status": "RESTRICTED", "http_status": response.status_code, "message": message, "client_id": creds.get("client_id")}
    if response.status_code == 429:
        return {"status": "RATE_LIMITED", "http_status": 429, "message": message, "client_id": creds.get("client_id")}
    if response.status_code >= 500:
        return {"status": "NETWORK", "http_status": response.status_code, "message": message, "client_id": creds.get("client_id")}
    return {"status": "UNKNOWN", "http_status": response.status_code, "message": message, "client_id": creds.get("client_id")}


def write_result(key, detector, result, source, finding):
    write_keycheck_event(SERVICE, RESULTS_FILE, key, {"detector": detector, **result}, source, finding, detector)
    extra = result.get("client_email") or result.get("client_id") or result.get("project_id") or source
    message = result.get("message", "")
    if result.get("status") == "VERTEX":
        models = result.get("vertex_available_models") or []
        model_text = ",".join(str(item) for item in models) or f"{result.get('vertex_location', '')}/{result.get('vertex_model', '')}".strip("/")
        message = f"{message}; models={model_text}"
    commit_status_transaction(
        CHECKED_FILE, transaction_status_files(), key, result["status"], message, extra,
    )
    if result.get("status") == "VERTEX" and result.get("vertex_google_enabled"):
        append_status(VERTEX_GEMINI_FILE, key, result["status"], message, extra)
    if result.get("status") == "VERTEX" and result.get("vertex_anthropic_enabled"):
        append_status(VERTEX_ANTHROPIC_FILE, key, result["status"], message, extra)
    record_validation_result(SERVICE, key, {"detector": detector, **result}, source, finding, detector)


def parse_args():
    parser = argparse.ArgumentParser(description="GCP credential checker")
    parser.add_argument("--input", default=INPUT_FILE)
    parser.add_argument("--plain", default=PLAIN_FILE)
    parser.add_argument("--proxy-file", default=PROXY_FILE)
    parser.add_argument("--timeout", type=int, default=25)
    parser.add_argument("--max-keys", type=int, default=0)
    parser.add_argument("--retry-network", action="store_true")
    parser.add_argument("--retry-limited", action="store_true")
    parser.add_argument("--retry-unknown", action="store_true")
    parser.add_argument("--retry-valid", action="store_true")
    parser.add_argument("--recheck-all", action="store_true")
    parser.add_argument("--probe-vertex", action="store_true", help="After OAuth succeeds, probe Vertex AI Gemini with countTokens through the configured proxy")
    parser.add_argument("--vertex-timeout", type=int, default=6, help="Seconds per Vertex countTokens request")
    parser.add_argument("--vertex-max-attempts", type=int, default=6, help="Maximum location/model countTokens attempts per credential")
    parser.add_argument("--vertex-locations", default=",".join(VERTEX_LOCATIONS), help="Comma-separated Vertex locations to probe")
    parser.add_argument("--vertex-models", default=",".join(VERTEX_MODELS), help="Comma-separated Vertex models to probe")
    parser.add_argument("--vertex-anthropic-locations", default=",".join(VERTEX_ANTHROPIC_LOCATIONS), help="Comma-separated Vertex Anthropic locations to probe")
    parser.add_argument("--vertex-anthropic-models", default=",".join(VERTEX_ANTHROPIC_MODELS), help="Comma-separated Vertex Anthropic model IDs to probe with rawPredict")
    parser.add_argument("--vertex-anthropic-max-attempts", type=int, default=20, help="Maximum Anthropic location/model attempts per credential")
    return parser.parse_args()


def main():
    require_provider_authority(SERVICE)
    args = parse_args()
    ensure_files()
    proxy_cycler = load_proxies(args.proxy_file)
    checked = load_checked_statuses(CHECKED_FILE)
    known_statuses = load_known_statuses(CHECKED_FILE, STATUS_FILES)
    known = set(known_statuses)
    retry_statuses = set()
    if args.retry_network:
        retry_statuses.add("NETWORK")
    if args.retry_limited:
        retry_statuses.add("RATE_LIMITED")
    if args.retry_unknown:
        retry_statuses.add("UNKNOWN")
    if args.retry_valid:
        retry_statuses.update({"VALID", "VERTEX"})
    vertex_locations = [item.strip() for item in str(args.vertex_locations or "").split(",") if item.strip()]
    vertex_models = [item.strip() for item in str(args.vertex_models or "").split(",") if item.strip()]
    vertex_anthropic_locations = [item.strip() for item in str(args.vertex_anthropic_locations or "").split(",") if item.strip()]
    vertex_anthropic_models = [item.strip() for item in str(args.vertex_anthropic_models or "").split(",") if item.strip()]

    processed = 0
    skipped = 0
    for key, detector, source, finding, parsed in extract_candidates(args.input, args.plain):
        if should_skip_key(
            key, checked, known, args, retry_statuses,
            service=SERVICE, source=source, finding=finding, detector=detector, known_statuses=known_statuses,
        ):
            skipped += 1
            continue
        if args.max_keys and processed >= args.max_keys:
            break
        processed += 1
        print(f"\n[{processed}] {detector} candidate {mask_secret(key)} from {source}", flush=True)
        proxy = next(proxy_cycler) if proxy_cycler else None
        if not parsed:
            result = {"status": "NO_CONTEXT", "message": "credential JSON is incomplete or unavailable"}
        elif detector == "GCP":
            result = check_service_account(
                parsed, proxy, args.timeout, args.probe_vertex,
                args.vertex_timeout, vertex_locations, vertex_models, args.vertex_max_attempts,
                vertex_anthropic_locations, vertex_anthropic_models, args.vertex_anthropic_max_attempts,
            )
        else:
            result = check_adc(
                parsed, proxy, args.timeout, args.probe_vertex,
                args.vertex_timeout, vertex_locations, vertex_models, args.vertex_max_attempts,
                vertex_anthropic_locations, vertex_anthropic_models, args.vertex_anthropic_max_attempts,
            )
        print(f"  STATUS: {result['status']} | {str(result.get('message', ''))[:200]}", flush=True)
        write_result(key, detector, result, source, finding)
        known.add(key)
        checked[key] = result["status"]
        time.sleep(0.1)
    print(f"\nDone. Processed={processed}, skipped={skipped}, results={RESULTS_FILE}")


if __name__ == "__main__":
    main()