feat(auth): pass `serviceAccountEmail` parameter to ADC signBlob (#731)

googleapis_auth/CHANGELOG.md

diff --git a/googleapis_auth/CHANGELOG.md b/googleapis_auth/CHANGELOG.md
index 249dfcb..ac6bd32 100644
--- a/googleapis_auth/CHANGELOG.md
+++ b/googleapis_auth/CHANGELOG.md
@@ -16,6 +16,8 @@
 - Replaced generic exception and error throws (such as `Exception`, `ArgumentError`, 
   and `UnsupportedError`) with more specific exception types throughout the package to
   improve error handling and debuggability.
+- `AuthClientSigningExtension.sign()` now accepts an optional `serviceAccountEmail`
+  parameter that is passed down to `signBlob`.
 
 ## 2.1.0
 

googleapis_auth/lib/src/auth_client_signing_extension.dart

diff --git a/googleapis_auth/lib/src/auth_client_signing_extension.dart b/googleapis_auth/lib/src/auth_client_signing_extension.dart
index 8d68735..cf9ea7f 100644
--- a/googleapis_auth/lib/src/auth_client_signing_extension.dart
+++ b/googleapis_auth/lib/src/auth_client_signing_extension.dart
@@ -55,24 +55,32 @@
         refresh: refresh,
       );
 
-  /// Signs some bytes using the credentials from this auth client.
+  /// Signs the given [data] using the credentials from this auth client.
   ///
-  /// The signing behavior depends on the auth client type:
-  /// - [ImpersonatedAuthClient]: Uses IAM signBlob API to sign using the
-  ///   target principal.
-  /// - Auth clients with service account credentials: Signs locally using
-  ///   RSA-SHA256.
-  /// - Other auth clients: Uses IAM signBlob API with the default service
-  ///   account.
+  /// This method has three modes of operation depending on the client and
+  /// parameters:
   ///
-  /// [serviceAccountCredentials] can be provided to sign the data locally
-  /// using RSA-SHA256 if the credentials have a private key.
+  /// 1.  **Impersonated client:** If this client is an
+  ///     [ImpersonatedAuthClient], signing is delegated to its `sign` method.
+  ///     The `serviceAccountCredentials`, `serviceAccountEmail`, and
+  ///     `endpoint` parameters of this extension method are ignored.
   ///
-  /// [endpoint] is an optional custom IAM Credentials API endpoint. This is
-  /// useful when working with different universe domains. If not provided,
-  /// the endpoint is automatically determined from the credential's universe
-  /// domain (e.g., `https://iamcredentials.googleapis.com` for the default
-  /// universe, or a custom universe domain from the service account JSON).
+  /// 2.  **Local signing with private key:** If [serviceAccountCredentials] are
+  ///     provided, they are used to sign the data locally using RSA-SHA256 if
+  ///     the credentials have a private key. The `serviceAccountEmail`
+  ///     and `endpoint` parameters are ignored.
+  ///
+  /// 3.  **IAM API signing:** Otherwise, this will call the IAM Credentials API
+  ///     `signBlob` endpoint.
+  ///     - The [serviceAccountEmail] can be provided to specify which service
+  ///       account to use. If not provided, it will be inferred from the
+  ///       environment (e.g., GCE metadata server).
+  ///     - The [endpoint] is an optional custom IAM Credentials API endpoint.
+  ///       This is useful when working with different universe domains. If not
+  ///       provided, the endpoint is automatically determined from the
+  ///       credential's universe domain (e.g.,
+  ///       `https://iamcredentials.googleapis.com` for the default universe,
+  ///       or a custom universe domain from the service account JSON).
   ///
   /// Returns the signature as a String (base64-encoded).
   ///
@@ -91,6 +99,7 @@
   Future<String> sign(
     List<int> data, {
     ServiceAccountCredentials? serviceAccountCredentials,
+    String? serviceAccountEmail,
     String? endpoint,
   }) async {
     // Check if this is an impersonated client
@@ -104,6 +113,11 @@
       return base64Encode(serviceAccountCredentials.sign(data));
     }
 
-    return (await signBlob(this, data, endpoint: endpoint)).signedBlob;
+    return (await signBlob(
+      this,
+      data,
+      serviceAccountEmail: serviceAccountEmail,
+      endpoint: endpoint,
+    )).signedBlob;
   }
 }