fix(auth): make googleapis_auth web-compatible by removing transitive dart:io imports

[kevmoo]

• Replace the import of ../auth_io.dart in auth_client.dart with access_credentials.dart to avoid importing dart:io on the web.
• Introduce conditional imports for serviceAccountEmailFromMetadataServer in auth_client_signing_extension.dart and iam_signer.dart. This prevents importing package:google_cloud (which depends on dart:io) on the web, while retaining full functionality on the Dart VM.
• Document that GCE metadata server fallback/querying is unsupported on the web and throws UnsupportedError, meaning serviceAccountEmail is required on the web for signing.
• Prepares v2.3.2.

Fixes #746

[github-actions]

Package publishing

Package	Version	Status	Publish tag (post-merge)
package:_discoveryapis_commons	1.0.8-wip	WIP (no publish necessary)
package:discoveryapis_generator	1.1.0-wip	WIP (no publish necessary)
package:googleapis	17.0.0-wip	WIP (no publish necessary)
package:googleapis_auth	2.3.2	ready to publish	googleapis_auth-v2.3.2
package:googleapis_beta	9.1.0-wip	WIP (no publish necessary)

Documentation at https://github.com/dart-lang/ecosystem/wiki/Publishing-automation.

[github-actions]

PR Health

API leaks ✔️

The following packages contain symbols visible in the public API, but not exported by the library. Export these symbols or remove them from your publicly visible API.

Package	Leaked API symbol	Leaking sources

This check can be disabled by tagging the PR with skip-leaking-check.

Unused Dependencies ✔️

Package	Status
googleapis_auth	✔️ All dependencies utilized correctly.

For details on how to fix these, see dependency_validator.

This check can be disabled by tagging the PR with skip-unused-dependencies-check.

License Headers ✔️

// Copyright 2026 Google LLC
//
// Use of this source code is governed by a BSD-style
// license that can be found in the LICENSE file or at
// https://developers.google.com/open-source/licenses/bsd

Files
no missing headers

All source files should start with a license header.

This check can be disabled by tagging the PR with skip-license-check.

Changelog Entry ✔️

Package	Changed Files

Changes to files need to be accounted for in their respective changelogs.

This check can be disabled by tagging the PR with skip-changelog-check.

Breaking changes ✔️

Package	Change	Current Version	New Version	Needed Version	Looking good?
googleapis_auth	None	2.3.1	2.3.2	2.3.1	✔️

This check can be disabled by tagging the PR with skip-breaking-check.

[srujzs]

Thanks! I think it's better than the current state in 2.3.1, but if we're going the conditional import route, can we not just split out the APIs that can only be run on the VM into a separate file and have that be exported by auth_io.dart?

I believe that would be a breaking change to APIs like sign though.

[kevmoo]

Thanks! I think it's better than the current state in 2.3.1, but if we're going the conditional import route, can we not just split out the APIs that can only be run on the VM into a separate file and have that be exported by auth_io.dart?

I believe that would be a breaking change to APIs like sign though.

Yep! This is the less breaking version of what we already shipped. Need to follow-up with the breaking change.

I'll update the commit message to NOT close the issue!