grpc 1.81.1 → 1.83.0

data/src/core/client_channel/retry_throttle.h

@@ -23,21 +23,19 @@
 
 #include <atomic>
 
-#include "src/core/filter/blackboard.h"
+#include "src/core/service_config/service_config.h"
+#include "src/core/util/ref_counted.h"
 #include "src/core/util/ref_counted_ptr.h"
 
 namespace grpc_core {
-namespace internal {
 
-/// Tracks retry throttling data for an individual server name.
-class RetryThrottler final : public Blackboard::Entry {
+/// Tracks retry throttling data for a channel.
+class RetryThrottler final : public RefCounted<RetryThrottler> {
  public:
   static RefCountedPtr<RetryThrottler> Create(
       uintptr_t max_milli_tokens, uintptr_t milli_token_ratio,
       RefCountedPtr<RetryThrottler> previous);
 
-  static UniqueTypeName Type();
-
   // Do not instantiate directly -- use Create() instead.
   RetryThrottler(uintptr_t max_milli_tokens, uintptr_t milli_token_ratio,
                  uintptr_t milli_tokens);
@@ -56,6 +54,14 @@ class RetryThrottler final : public Blackboard::Entry {
     return milli_tokens_.load(std::memory_order_relaxed);
   }
 
+  static absl::string_view ChannelArgName() {
+    return "grpc.internal.retry_throttler";
+  }
+  static int ChannelArgsCompare(const RetryThrottler* a,
+                                const RetryThrottler* b) {
+    return QsortCompare(a, b);
+  }
+
  private:
   void SetReplacement(RefCountedPtr<RetryThrottler> replacement);
 
@@ -70,7 +76,18 @@ class RetryThrottler final : public Blackboard::Entry {
   std::atomic<RetryThrottler*> replacement_{nullptr};
 };
 
-}  // namespace internal
+// Tracks retry throttler state across service config updates and
+// handles adding the current throttler to channel args.
+class RetryThrottlerChannelArgsUpdater final {
+ public:
+  // Applies the latest service config update and adds the current
+  // throttler to channel args if needed.
+  void Update(const ServiceConfig& service_config, ChannelArgs& args);
+
+ private:
+  RefCountedPtr<RetryThrottler> throttler_;
+};
+
 }  // namespace grpc_core
 
 #endif  // GRPC_SRC_CORE_CLIENT_CHANNEL_RETRY_THROTTLE_H

data/src/core/client_channel/subchannel.cc

@@ -1616,7 +1616,7 @@ void NewSubchannel::QueuedCall::ResumeOnConnectionLocked(
   // It's possible that the subchannel will get quota for the call
   // and try to resume it before buffered_call_ contains any batches.
   // In that case, we will not be holding the call combiner here, so we
-  // must not yeild it.  That's why we use
+  // must not yield it.  That's why we use
   // YieldCallCombinerIfPendingBatchesFound here.
   if (!error.ok()) {
     buffered_call_.Fail(error,

data/src/core/{filter/blackboard.cc → config/experiment_env_var.cc}

@@ -1,5 +1,4 @@
-//
-// Copyright 2024 gRPC authors.
+// Copyright 2026 gRPC authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
@@ -12,22 +11,20 @@
 // WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
 // See the License for the specific language governing permissions and
 // limitations under the License.
-//
 
-#include "src/core/filter/blackboard.h"
+#include "src/core/config/experiment_env_var.h"
 
-namespace grpc_core {
+#include "src/core/util/env.h"
+#include "src/core/util/string.h"
 
-RefCountedPtr<Blackboard::Entry> Blackboard::Get(UniqueTypeName type,
-                                                 const std::string& key) const {
-  auto it = map_.find(std::pair(type, key));
-  if (it == map_.end()) return nullptr;
-  return it->second;
-}
+namespace grpc_core {
 
-void Blackboard::Set(UniqueTypeName type, const std::string& key,
-                     RefCountedPtr<Entry> entry) {
-  map_[std::pair(type, key)] = std::move(entry);
+bool IsExperimentEnvVarEnabled(const char* name, bool default_value) {
+  auto value = GetEnv(name);
+  if (!value.has_value()) return default_value;
+  bool parsed_value;
+  bool parse_succeeded = gpr_parse_bool_value(value->c_str(), &parsed_value);
+  return parse_succeeded && parsed_value;
 }
 
 }  // namespace grpc_core

data/src/core/config/experiment_env_var.h

@@ -0,0 +1,26 @@
+// Copyright 2026 gRPC authors.
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+#ifndef GRPC_SRC_CORE_CONFIG_EXPERIMENT_ENV_VAR_H
+#define GRPC_SRC_CORE_CONFIG_EXPERIMENT_ENV_VAR_H
+
+namespace grpc_core {
+
+// Returns true if the specified experiment env var is enabled.
+// If the env var is not set, returns default_value.
+bool IsExperimentEnvVarEnabled(const char* name, bool default_value = false);
+
+}  // namespace grpc_core
+
+#endif  // GRPC_SRC_CORE_CONFIG_EXPERIMENT_ENV_VAR_H

data/src/core/credentials/call/external/external_account_credentials.cc

@@ -33,7 +33,9 @@
 #include "src/core/credentials/call/external/file_external_account_credentials.h"
 #include "src/core/credentials/call/external/url_external_account_credentials.h"
 #include "src/core/credentials/call/json_util.h"
+#include "src/core/credentials/call/regional_access_boundary_fetcher.h"
 #include "src/core/credentials/transport/transport_credentials.h"
+#include "src/core/lib/promise/map.h"
 #include "src/core/lib/transport/status_conversion.h"
 #include "src/core/util/grpc_check.h"
 #include "src/core/util/http_client/httpcli_ssl_credentials.h"
@@ -72,6 +74,33 @@ namespace grpc_core {
 // ExternalAccountCredentials::NoOpFetchBody
 //
 
+namespace {
+
+class TokenWithRegionalAccessBoundary final
+    : public TokenFetcherCredentials::Token {
+ public:
+  TokenWithRegionalAccessBoundary(Slice token, Timestamp expiration,
+                                  RefCountedPtr<RegionalAccessBoundaryFetcher>
+                                      regional_access_boundary_fetcher)
+      : Token(std::move(token), expiration),
+        regional_access_boundary_fetcher_(
+            std::move(regional_access_boundary_fetcher)) {
+    CHECK(regional_access_boundary_fetcher_ != nullptr);
+  }
+
+  void AddTokenToClientInitialMetadata(ClientMetadata& metadata) override {
+    Token::AddTokenToClientInitialMetadata(metadata);
+    regional_access_boundary_fetcher_->Fetch(token().as_string_view(),
+                                             metadata);
+  }
+
+ private:
+  RefCountedPtr<RegionalAccessBoundaryFetcher>
+      regional_access_boundary_fetcher_;
+};
+
+}  // namespace
+
 ExternalAccountCredentials::NoOpFetchBody::NoOpFetchBody(
     grpc_event_engine::experimental::EventEngine& event_engine,
     absl::AnyInvocable<void(absl::StatusOr<std::string>)> on_done,
@@ -411,8 +440,14 @@ void ExternalAccountCredentials::ExternalFetchRequest::FinishTokenFetch(
         GRPC_CREDENTIALS_OK) {
       result = GRPC_ERROR_CREATE("Could not parse oauth token");
     } else {
-      result = MakeRefCounted<Token>(std::move(*token_value),
-                                     Timestamp::Now() + token_lifetime);
+      if (creds_->regional_access_boundary_fetcher_ != nullptr) {
+        result = MakeRefCounted<TokenWithRegionalAccessBoundary>(
+            std::move(*token_value), Timestamp::Now() + token_lifetime,
+            creds_->regional_access_boundary_fetcher_->Ref());
+      } else {
+        result = MakeRefCounted<TokenFetcherCredentials::Token>(
+            std::move(*token_value), Timestamp::Now() + token_lifetime);
+      }
     }
   }
   creds_->event_engine().Run([on_done = std::exchange(on_done_, nullptr),
@@ -442,21 +477,56 @@ bool ExternalAccountCredentials::ExternalFetchRequest::MaybeFailLocked(
 
 namespace {
 
+struct WorkloadIdentityPoolFields {
+  absl::string_view project;
+  absl::string_view pool_id;
+};
+
+// Expression to match:
+// //iam.googleapis.com/projects/<project>/locations/global/workloadIdentityPools/<pool-id>/providers/.+
+//
+// Returns the project and pool ID within the WorkloadIdentityPoolFields struct
+// if the audience matches the Workload Identity Pool format, otherwise returns
+// std::nullopt.
+std::optional<WorkloadIdentityPoolFields> MatchWorkloadIdentityPoolAudience(
+    absl::string_view audience) {
+  // Match "//iam.googleapis.com/projects/"
+  if (!absl::ConsumePrefix(&audience, "//iam.googleapis.com/projects/")) {
+    return std::nullopt;
+  }
+  // Match "<project>/locations/global/workloadIdentityPools/"
+  auto location_pos = audience.find("/locations/global/workloadIdentityPools/");
+  if (location_pos == absl::string_view::npos) return std::nullopt;
+  auto project = audience.substr(0, location_pos);
+  if (project.empty()) return std::nullopt;
+  audience.remove_prefix(
+      location_pos + sizeof("/locations/global/workloadIdentityPools/") - 1);
+  // Match "<pool-id>/providers/"
+  auto provider_pos = audience.find("/providers/");
+  if (provider_pos == absl::string_view::npos) return std::nullopt;
+  auto pool_id = audience.substr(0, provider_pos);
+  if (pool_id.empty()) return std::nullopt;
+  return WorkloadIdentityPoolFields{project, pool_id};
+}
+
 // Expression to match:
 // //iam.googleapis.com/locations/[^/]+/workforcePools/[^/]+/providers/.+
-bool MatchWorkforcePoolAudience(absl::string_view audience) {
+// Returns the workforce pool ID if the audience matches the Workforce Pool
+// format, otherwise returns an empty string view.
+absl::string_view MatchWorkforcePoolAudience(absl::string_view audience) {
   // Match "//iam.googleapis.com/locations/"
-  if (!absl::ConsumePrefix(&audience, "//iam.googleapis.com")) return false;
-  if (!absl::ConsumePrefix(&audience, "/locations/")) return false;
+  if (!absl::ConsumePrefix(&audience, "//iam.googleapis.com")) return "";
+  if (!absl::ConsumePrefix(&audience, "/locations/")) return "";
   // Match "[^/]+/workforcePools/"
   std::pair<absl::string_view, absl::string_view> workforce_pools_split_result =
       absl::StrSplit(audience, absl::MaxSplits("/workforcePools/", 1));
-  if (absl::StrContains(workforce_pools_split_result.first, '/')) return false;
+  if (absl::StrContains(workforce_pools_split_result.first, '/')) return "";
   // Match "[^/]+/providers/.+"
   std::pair<absl::string_view, absl::string_view> providers_split_result =
       absl::StrSplit(workforce_pools_split_result.second,
                      absl::MaxSplits("/providers/", 1));
-  return !absl::StrContains(providers_split_result.first, '/');
+  if (absl::StrContains(providers_split_result.first, '/')) return "";
+  return providers_split_result.first;
 }
 
 }  // namespace
@@ -533,7 +603,9 @@ ExternalAccountCredentials::Create(
   }
   it = json.object().find("workforce_pool_user_project");
   if (it != json.object().end()) {
-    if (MatchWorkforcePoolAudience(options.audience)) {
+    if (auto workforce_pool_id = MatchWorkforcePoolAudience(options.audience);
+        !workforce_pool_id.empty()) {
+      options.workforce_pool_id = std::string(workforce_pool_id);
       options.workforce_pool_user_project = it->second.string();
     } else {
       return GRPC_ERROR_CREATE(
@@ -541,6 +613,14 @@ ExternalAccountCredentials::Create(
           "pool credentials");
     }
   }
+  if (auto workload_identity_pool_fields =
+          MatchWorkloadIdentityPoolAudience(options.audience);
+      workload_identity_pool_fields.has_value()) {
+    options.workload_pool_project =
+        std::string(workload_identity_pool_fields->project);
+    options.workload_pool_id =
+        std::string(workload_identity_pool_fields->pool_id);
+  }
   it = json.object().find("service_account_impersonation");
   options.service_account_impersonation.token_lifetime_seconds =
       IMPERSONATED_CRED_DEFAULT_LIFETIME_IN_SECONDS;
@@ -590,20 +670,53 @@ ExternalAccountCredentials::Create(
   if (!error.ok()) return error;
   return creds;
 }
+namespace {
+
+std::string BuildRegionalAccessBoundaryUrl(
+    const ExternalAccountCredentials::Options& options) {
+  if (!options.service_account_impersonation_url.empty()) {
+    absl::string_view url = options.service_account_impersonation_url;
+    absl::string_view::size_type start = url.find("serviceAccounts/");
+    absl::string_view::size_type end = url.find(":generateAccessToken");
+    if (start != absl::string_view::npos && end != absl::string_view::npos &&
+        start + 16 < end) {
+      absl::string_view email = url.substr(start + 16, end - (start + 16));
+      return absl::StrFormat(
+          "https://iamcredentials.googleapis.com/v1/projects/-/serviceAccounts/"
+          "%s/allowedLocations",
+          email);
+    }
+  }
+  if (!options.workforce_pool_id.empty()) {
+    return absl::StrFormat(
+        "https://iamcredentials.googleapis.com/v1/locations/global/"
+        "workforcePools/%s/allowedLocations",
+        options.workforce_pool_id);
+  } else if (!options.workload_pool_project.empty() &&
+             !options.workload_pool_id.empty()) {
+    return absl::StrFormat(
+        "https://iamcredentials.googleapis.com/v1/projects/"
+        "%s/locations/global/workloadIdentityPools/%s/allowedLocations",
+        options.workload_pool_project, options.workload_pool_id);
+  }
+  return "";
+}
+
+}  // namespace
 
 ExternalAccountCredentials::ExternalAccountCredentials(
     Options options, std::vector<std::string> scopes,
     std::shared_ptr<grpc_event_engine::experimental::EventEngine> event_engine)
-    : TokenFetcherCredentials(std::move(event_engine)),
-      options_(std::move(options)) {
+    : TokenFetcherCredentials(event_engine),
+      options_(std::move(options)),
+      regional_access_boundary_fetcher_(RegionalAccessBoundaryFetcher::Create(
+          BuildRegionalAccessBoundaryUrl(options_), std::move(event_engine))) {
   if (scopes.empty()) {
     scopes.push_back(GOOGLE_CLOUD_PLATFORM_DEFAULT_SCOPE);
   }
   scopes_ = std::move(scopes);
 }
 
-ExternalAccountCredentials::~ExternalAccountCredentials() {}
-
 std::string ExternalAccountCredentials::MetricsHeaderValue() {
   return absl::StrFormat(
       "gl-cpp/unknown auth/%s google-byoid-sdk source/%s sa-impersonation/%v "

data/src/core/credentials/call/external/external_account_credentials.h

@@ -27,6 +27,7 @@
 #include <vector>
 
 #include "src/core/credentials/call/oauth2/oauth2_credentials.h"
+#include "src/core/credentials/call/regional_access_boundary_fetcher.h"
 #include "src/core/credentials/call/token_fetcher/token_fetcher_credentials.h"
 #include "src/core/lib/iomgr/closure.h"
 #include "src/core/lib/iomgr/error.h"
@@ -64,6 +65,9 @@ class ExternalAccountCredentials : public TokenFetcherCredentials {
     std::string client_id;
     std::string client_secret;
     std::string workforce_pool_user_project;
+    std::string workforce_pool_id;
+    std::string workload_pool_project;
+    std::string workload_pool_id;
   };
 
   static absl::StatusOr<RefCountedPtr<ExternalAccountCredentials>> Create(
@@ -75,7 +79,6 @@ class ExternalAccountCredentials : public TokenFetcherCredentials {
       Options options, std::vector<std::string> scopes,
       std::shared_ptr<grpc_event_engine::experimental::EventEngine>
           event_engine = nullptr);
-  ~ExternalAccountCredentials() override;
 
  protected:
   // A base class for a cancellable fetch operation.
@@ -200,6 +203,8 @@ class ExternalAccountCredentials : public TokenFetcherCredentials {
 
   Options options_;
   std::vector<std::string> scopes_;
+  RefCountedPtr<RegionalAccessBoundaryFetcher>
+      regional_access_boundary_fetcher_;
 };
 
 }  // namespace grpc_core

data/src/core/credentials/call/jwt/jwt_credentials.cc

@@ -18,6 +18,7 @@
 #include "src/core/credentials/call/jwt/jwt_credentials.h"
 
 #include <grpc/credentials.h>
+#include <grpc/event_engine/event_engine.h>
 #include <grpc/support/alloc.h>
 #include <grpc/support/json.h>
 #include <grpc/support/port_platform.h>
@@ -101,6 +102,10 @@ grpc_service_account_jwt_access_credentials::GetRequestMetadata(
         absl::UnauthenticatedError("Could not generate JWT."));
   }
 
+  if (regional_access_boundary_fetcher_ != nullptr) {
+    regional_access_boundary_fetcher_->Fetch(jwt_value->as_string_view(),
+                                             *initial_metadata);
+  }
   initial_metadata->Append(
       GRPC_AUTHORIZATION_METADATA_KEY, std::move(*jwt_value),
       [](absl::string_view, const grpc_core::Slice&) { abort(); });
@@ -110,7 +115,12 @@ grpc_service_account_jwt_access_credentials::GetRequestMetadata(
 grpc_service_account_jwt_access_credentials::
     grpc_service_account_jwt_access_credentials(grpc_auth_json_key key,
                                                 gpr_timespec token_lifetime)
-    : key_(key) {
+    : key_(key),
+      regional_access_boundary_fetcher_(
+          grpc_core::RegionalAccessBoundaryFetcher::Create(absl::StrFormat(
+              "https://iamcredentials.googleapis.com/v1/projects/-/"
+              "serviceAccounts/%s/allowedLocations",
+              key_.client_email))) {
   gpr_timespec max_token_lifetime = grpc_max_auth_token_lifetime();
   if (gpr_time_cmp(token_lifetime, max_token_lifetime) > 0) {
     VLOG(2) << "Cropping token lifetime to maximum allowed value ("

data/src/core/credentials/call/jwt/jwt_credentials.h

@@ -31,6 +31,7 @@
 
 #include "src/core/credentials/call/call_credentials.h"
 #include "src/core/credentials/call/jwt/json_token.h"
+#include "src/core/credentials/call/regional_access_boundary_fetcher.h"
 #include "src/core/lib/promise/arena_promise.h"
 #include "src/core/lib/slice/slice.h"
 #include "src/core/lib/transport/transport.h"
@@ -88,6 +89,8 @@ class grpc_service_account_jwt_access_credentials
 
   grpc_auth_json_key key_;
   gpr_timespec jwt_lifetime_;
+  grpc_core::RefCountedPtr<grpc_core::RegionalAccessBoundaryFetcher>
+      regional_access_boundary_fetcher_;
 };
 
 // Private constructor for jwt credentials from an already parsed json key.

data/src/core/credentials/call/oauth2/oauth2_credentials.cc

@@ -19,6 +19,7 @@
 #include "src/core/credentials/call/oauth2/oauth2_credentials.h"
 
 #include <grpc/credentials.h>
+#include <grpc/event_engine/event_engine.h>
 #include <grpc/grpc.h>
 #include <grpc/grpc_security.h>
 #include <grpc/slice.h>
@@ -37,13 +38,11 @@
 
 #include "src/core/call/metadata_batch.h"
 #include "src/core/credentials/call/json_util.h"
-#include "src/core/credentials/call/token_fetcher/token_fetcher_credentials.h"
+#include "src/core/credentials/call/regional_access_boundary_fetcher.h"
 #include "src/core/credentials/transport/transport_credentials.h"
 #include "src/core/lib/debug/trace.h"
 #include "src/core/lib/iomgr/error.h"
-#include "src/core/lib/iomgr/pollset_set.h"
-#include "src/core/lib/promise/context.h"
-#include "src/core/lib/promise/poll.h"
+#include "src/core/lib/promise/map.h"
 #include "src/core/lib/promise/promise.h"
 #include "src/core/lib/transport/error_utils.h"
 #include "src/core/util/grpc_check.h"
@@ -258,25 +257,48 @@ Oauth2TokenFetcherCredentials::FetchToken(
 
 namespace {
 
+class TokenWithEmail final : public grpc_core::TokenFetcherCredentials::Token {
+ public:
+  TokenWithEmail(
+      grpc_core::Slice token, grpc_core::Timestamp expiration,
+      grpc_core::RefCountedPtr<grpc_core::EmailFetcher> email_fetcher)
+      : Token(std::move(token), expiration),
+        email_fetcher_(std::move(email_fetcher)) {}
+
+  void AddTokenToClientInitialMetadata(
+      grpc_core::ClientMetadata& metadata) override {
+    Token::AddTokenToClientInitialMetadata(metadata);
+    email_fetcher_->Fetch(token().as_string_view(), metadata);
+  }
+
+ private:
+  grpc_core::RefCountedPtr<grpc_core::EmailFetcher> email_fetcher_;
+};
+
 class grpc_compute_engine_token_fetcher_credentials
-    : public grpc_core::Oauth2TokenFetcherCredentials {
+    : public grpc_core::HttpTokenFetcherCredentials {
  public:
-  grpc_compute_engine_token_fetcher_credentials() = default;
+  grpc_compute_engine_token_fetcher_credentials()
+      : email_fetcher_(grpc_core::MakeRefCounted<grpc_core::EmailFetcher>()) {}
   explicit grpc_compute_engine_token_fetcher_credentials(
       std::vector<grpc_core::URI::QueryParam> query_params)
-      : query_params_(std::move(query_params)) {}
-  ~grpc_compute_engine_token_fetcher_credentials() override = default;
+      : email_fetcher_(grpc_core::MakeRefCounted<grpc_core::EmailFetcher>()),
+        query_params_(std::move(query_params)) {}
 
   std::string debug_string() override {
-    return absl::StrFormat(
-        "GoogleComputeEngineTokenFetcherCredentials{%s}",
-        grpc_core::Oauth2TokenFetcherCredentials::debug_string());
+    return "GoogleComputeEngineTokenFetcherCredentials";
+  }
+
+  grpc_core::UniqueTypeName type() const override {
+    static grpc_core::UniqueTypeName::Factory kFactory("ComputeEngine");
+    return kFactory.Create();
   }
 
  private:
   grpc_core::OrphanablePtr<grpc_core::HttpRequest> StartHttpRequest(
       grpc_polling_entity* pollent, grpc_core::Timestamp deadline,
       grpc_http_response* response, grpc_closure* on_complete) override {
+    memset(response, 0, sizeof(*response));
     grpc_http_header header = {const_cast<char*>("Metadata-Flavor"),
                                const_cast<char*>("Google")};
     grpc_http_request request;
@@ -300,6 +322,37 @@ class grpc_compute_engine_token_fetcher_credentials
     return http_request;
   }
 
+  grpc_core::OrphanablePtr<FetchRequest> FetchToken(
+      grpc_core::Timestamp deadline,
+      absl::AnyInvocable<void(absl::StatusOr<grpc_core::RefCountedPtr<
+                                  TokenFetcherCredentials::Token>>)>
+          on_done) override {
+    email_fetcher_->StartEmailFetch();
+    return grpc_core::MakeOrphanable<HttpFetchRequest>(
+        this, deadline,
+        [email_fetcher = email_fetcher_, on_done = std::move(on_done)](
+            absl::StatusOr<grpc_http_response> response) mutable {
+          if (!response.ok()) {
+            on_done(response.status());
+            return;
+          }
+          std::optional<grpc_core::Slice> access_token_value;
+          grpc_core::Duration token_lifetime;
+          grpc_credentials_status status =
+              grpc_oauth2_token_fetcher_credentials_parse_server_response(
+                  &(*response), &access_token_value, &token_lifetime);
+          if (status != GRPC_CREDENTIALS_OK) {
+            on_done(absl::UnavailableError("error parsing oauth2 token"));
+            return;
+          }
+          on_done(grpc_core::MakeRefCounted<TokenWithEmail>(
+              std::move(*access_token_value),
+              grpc_core::Timestamp::Now() + token_lifetime,
+              std::move(email_fetcher)));
+        });
+  }
+
+  grpc_core::RefCountedPtr<grpc_core::EmailFetcher> email_fetcher_;
   std::vector<grpc_core::URI::QueryParam> query_params_;
 };
 }  // namespace

data/src/core/credentials/call/oauth2/oauth2_credentials.h

@@ -35,7 +35,6 @@
 #include "src/core/lib/iomgr/closure.h"
 #include "src/core/lib/iomgr/error.h"
 #include "src/core/lib/iomgr/polling_entity.h"
-#include "src/core/lib/promise/activity.h"
 #include "src/core/lib/promise/arena_promise.h"
 #include "src/core/lib/slice/slice.h"
 #include "src/core/lib/transport/transport.h"