@google/adk 0.6.0 → 1.0.0

package/dist/cjs/auth/oauth2/oauth2_credential_refresher.js

@@ -0,0 +1,109 @@
+/**
+  * @license
+  * Copyright 2026 Google LLC
+  * SPDX-License-Identifier: Apache-2.0
+  */
+
+"use strict";
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, { get: all[name], enumerable: true });
+};
+var __copyProps = (to, from, except, desc) => {
+  if (from && typeof from === "object" || typeof from === "function") {
+    for (let key of __getOwnPropNames(from))
+      if (!__hasOwnProp.call(to, key) && key !== except)
+        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
+  }
+  return to;
+};
+var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
+var oauth2_credential_refresher_exports = {};
+__export(oauth2_credential_refresher_exports, {
+  OAuth2CredentialRefresher: () => OAuth2CredentialRefresher
+});
+module.exports = __toCommonJS(oauth2_credential_refresher_exports);
+var import_logger = require("../../utils/logger.js");
+var import_oauth2_utils = require("./oauth2_utils.js");
+/**
+ * @license
+ * Copyright 2026 Google LLC
+ * SPDX-License-Identifier: Apache-2.0
+ */
+class OAuth2CredentialRefresher {
+  /**
+   * Check if the OAuth2 credential needs to be refreshed.
+   *
+   * @param authCredential The OAuth2 credential to check.
+   * @param authScheme The OAuth2 authentication scheme (optional).
+   * @returns True if the credential needs to be refreshed, False otherwise.
+   */
+  async isRefreshNeeded(authCredential) {
+    if (!authCredential.oauth2) {
+      return false;
+    }
+    if (authCredential.oauth2 && authCredential.oauth2.expiresAt) {
+      return (0, import_oauth2_utils.isTokenExpired)(authCredential.oauth2);
+    }
+    return false;
+  }
+  /**
+   * Refresh the OAuth2 credential.
+   *
+   * @param authCredential The OAuth2 credential to refresh.
+   * @param authScheme The OAuth2 authentication scheme.
+   * @returns The refreshed credential.
+   */
+  async refresh(authCredential, authScheme) {
+    if (!authCredential.oauth2 || !authScheme) {
+      return authCredential;
+    }
+    if (!authCredential.oauth2.refreshToken) {
+      import_logger.logger.warn("No refresh token available to refresh credential");
+      return authCredential;
+    }
+    const isNeeded = await this.isRefreshNeeded(authCredential);
+    if (!isNeeded) {
+      return authCredential;
+    }
+    const tokenEndpoint = (0, import_oauth2_utils.getTokenEndpoint)(authScheme);
+    if (!tokenEndpoint) {
+      import_logger.logger.warn("Token endpoint not found in auth scheme.");
+      return authCredential;
+    }
+    if (!authCredential.oauth2.clientId || !authCredential.oauth2.clientSecret) {
+      import_logger.logger.warn("clientId and clientSecret are required for token refresh.");
+      return authCredential;
+    }
+    const body = new URLSearchParams();
+    body.set("grant_type", "refresh_token");
+    body.set("refresh_token", authCredential.oauth2.refreshToken);
+    body.set("client_id", authCredential.oauth2.clientId);
+    body.set("client_secret", authCredential.oauth2.clientSecret);
+    try {
+      const data = await (0, import_oauth2_utils.fetchOAuth2Tokens)(tokenEndpoint, body);
+      const updatedOAuth2 = {
+        ...authCredential.oauth2,
+        accessToken: data.accessToken || authCredential.oauth2.accessToken,
+        refreshToken: data.refreshToken || authCredential.oauth2.refreshToken,
+        expiresIn: data.expiresIn,
+        expiresAt: data.expiresAt || authCredential.oauth2.expiresAt
+      };
+      return {
+        ...authCredential,
+        oauth2: updatedOAuth2
+      };
+    } catch (error) {
+      import_logger.logger.error("Failed to refresh tokens:", error);
+      return authCredential;
+    }
+  }
+}
+// Annotate the CommonJS export names for ESM import in node:
+0 && (module.exports = {
+  OAuth2CredentialRefresher
+});

package/dist/cjs/auth/oauth2/oauth2_discovery.js

@@ -0,0 +1,186 @@
+/**
+  * @license
+  * Copyright 2026 Google LLC
+  * SPDX-License-Identifier: Apache-2.0
+  */
+
+"use strict";
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, { get: all[name], enumerable: true });
+};
+var __copyProps = (to, from, except, desc) => {
+  if (from && typeof from === "object" || typeof from === "function") {
+    for (let key of __getOwnPropNames(from))
+      if (!__hasOwnProp.call(to, key) && key !== except)
+        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
+  }
+  return to;
+};
+var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
+var oauth2_discovery_exports = {};
+__export(oauth2_discovery_exports, {
+  AuthorizationServerMetadataSchema: () => AuthorizationServerMetadataSchema,
+  OAuth2DiscoveryManager: () => OAuth2DiscoveryManager,
+  ProtectedResourceMetadataSchema: () => ProtectedResourceMetadataSchema
+});
+module.exports = __toCommonJS(oauth2_discovery_exports);
+var import_zod = require("zod");
+var import_logger = require("../../utils/logger.js");
+/**
+ * @license
+ * Copyright 2026 Google LLC
+ * SPDX-License-Identifier: Apache-2.0
+ */
+const AuthorizationServerMetadataSchema = import_zod.z.object({
+  issuer: import_zod.z.string(),
+  authorization_endpoint: import_zod.z.string(),
+  token_endpoint: import_zod.z.string(),
+  scopes_supported: import_zod.z.array(import_zod.z.string()).optional(),
+  registration_endpoint: import_zod.z.string().optional()
+});
+const ProtectedResourceMetadataSchema = import_zod.z.object({
+  resource: import_zod.z.string(),
+  authorization_servers: import_zod.z.array(import_zod.z.string()).default([])
+});
+class OAuth2DiscoveryManager {
+  /**
+   * Discovers the OAuth2 authorization server metadata.
+   */
+  async discoverAuthServerMetadata(issuerUrl) {
+    if (!validateDiscoveryUrl(issuerUrl)) {
+      return void 0;
+    }
+    let baseUrl;
+    let path;
+    try {
+      const url = new URL(issuerUrl);
+      baseUrl = `${url.protocol}//${url.host}`;
+      path = url.pathname;
+    } catch (e) {
+      import_logger.logger.warn(`Failed to parse issuerUrl ${issuerUrl}: ${e}`);
+      return void 0;
+    }
+    const endpointsToTry = [];
+    if (path && path !== "/") {
+      endpointsToTry.push(
+        `${baseUrl}/.well-known/oauth-authorization-server${path}`,
+        `${baseUrl}/.well-known/openid-configuration${path}`,
+        `${baseUrl}${path}/.well-known/openid-configuration`
+      );
+    } else {
+      endpointsToTry.push(
+        `${baseUrl}/.well-known/oauth-authorization-server`,
+        `${baseUrl}/.well-known/openid-configuration`
+      );
+    }
+    for (const endpoint of endpointsToTry) {
+      try {
+        const response = await fetch(endpoint, {
+          method: "GET",
+          headers: {
+            Accept: "application/json"
+          }
+        });
+        if (!response.ok) {
+          continue;
+        }
+        const data = await response.json();
+        const metadata = AuthorizationServerMetadataSchema.parse(data);
+        if (metadata.issuer.replace(/\/$/, "") === issuerUrl.replace(/\/$/, "")) {
+          return metadata;
+        } else {
+          import_logger.logger.warn(
+            `Issuer in metadata ${metadata.issuer} does not match issuerUrl ${issuerUrl}`
+          );
+        }
+      } catch (e) {
+        import_logger.logger.debug(`Failed to fetch metadata from ${endpoint}: ${e}`);
+      }
+    }
+    return void 0;
+  }
+  /**
+   * Discovers the OAuth2 protected resource metadata.
+   */
+  async discoverResourceMetadata(resourceUrl) {
+    if (!validateDiscoveryUrl(resourceUrl)) {
+      return void 0;
+    }
+    let baseUrl;
+    let path;
+    try {
+      const url = new URL(resourceUrl);
+      baseUrl = `${url.protocol}//${url.host}`;
+      path = url.pathname;
+    } catch (e) {
+      import_logger.logger.warn(`Failed to parse resourceUrl ${resourceUrl}: ${e}`);
+      return void 0;
+    }
+    let wellKnownEndpoint;
+    if (path && path !== "/") {
+      wellKnownEndpoint = `${baseUrl}/.well-known/oauth-protected-resource${path}`;
+    } else {
+      wellKnownEndpoint = `${baseUrl}/.well-known/oauth-protected-resource`;
+    }
+    try {
+      const response = await fetch(wellKnownEndpoint, {
+        method: "GET",
+        headers: {
+          Accept: "application/json"
+        }
+      });
+      if (!response.ok) {
+        return void 0;
+      }
+      const data = await response.json();
+      const metadata = ProtectedResourceMetadataSchema.parse(data);
+      if (metadata.resource.replace(/\/$/, "") === resourceUrl.replace(/\/$/, "")) {
+        return metadata;
+      } else {
+        import_logger.logger.warn(
+          `Resource in metadata ${metadata.resource} does not match resourceUrl ${resourceUrl}`
+        );
+      }
+    } catch (e) {
+      import_logger.logger.debug(`Failed to fetch metadata from ${wellKnownEndpoint}: ${e}`);
+    }
+    return void 0;
+  }
+}
+function validateDiscoveryUrl(urlStr) {
+  try {
+    const url = new URL(urlStr);
+    if (url.protocol !== "https:") {
+      import_logger.logger.warn(`Unsafe protocol for discovery URL: ${url.protocol}`);
+      return false;
+    }
+    const host = url.hostname.toLowerCase();
+    if (host === "localhost" || host === "127.0.0.1" || host === "[::1]" || host.startsWith("10.") || host.startsWith("192.168.") || host.startsWith("169.254.")) {
+      import_logger.logger.warn(`Unsafe host for discovery URL: ${host}`);
+      return false;
+    }
+    const match = host.match(/^172\.(\d+)\./);
+    if (match) {
+      const secondOctet = parseInt(match[1], 10);
+      if (secondOctet >= 16 && secondOctet <= 31) {
+        import_logger.logger.warn(`Unsafe host for discovery URL: ${host}`);
+        return false;
+      }
+    }
+    return true;
+  } catch (e) {
+    import_logger.logger.warn(`Failed to parse URL for validation ${urlStr}: ${e}`);
+    return false;
+  }
+}
+// Annotate the CommonJS export names for ESM import in node:
+0 && (module.exports = {
+  AuthorizationServerMetadataSchema,
+  OAuth2DiscoveryManager,
+  ProtectedResourceMetadataSchema
+});

package/dist/cjs/auth/oauth2/oauth2_utils.js

@@ -0,0 +1,119 @@
+/**
+  * @license
+  * Copyright 2026 Google LLC
+  * SPDX-License-Identifier: Apache-2.0
+  */
+
+"use strict";
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, { get: all[name], enumerable: true });
+};
+var __copyProps = (to, from, except, desc) => {
+  if (from && typeof from === "object" || typeof from === "function") {
+    for (let key of __getOwnPropNames(from))
+      if (!__hasOwnProp.call(to, key) && key !== except)
+        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
+  }
+  return to;
+};
+var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
+var oauth2_utils_exports = {};
+__export(oauth2_utils_exports, {
+  createOAuth2TokenRequestBody: () => createOAuth2TokenRequestBody,
+  fetchOAuth2Tokens: () => fetchOAuth2Tokens,
+  getTokenEndpoint: () => getTokenEndpoint,
+  isTokenExpired: () => isTokenExpired,
+  parseAuthorizationCode: () => parseAuthorizationCode
+});
+module.exports = __toCommonJS(oauth2_utils_exports);
+var import_logger = require("../../utils/logger.js");
+/**
+ * @license
+ * Copyright 2026 Google LLC
+ * SPDX-License-Identifier: Apache-2.0
+ */
+function getTokenEndpoint(authScheme) {
+  if (authScheme.type === "openIdConnect" && authScheme.tokenEndpoint) {
+    return authScheme.tokenEndpoint;
+  }
+  if (authScheme.type === "oauth2" && authScheme.flows) {
+    const flows = authScheme.flows;
+    const flow = flows.authorizationCode || flows.clientCredentials || flows.password || flows.implicit;
+    if (flow && "tokenUrl" in flow) {
+      return flow.tokenUrl;
+    }
+  }
+  return void 0;
+}
+async function fetchOAuth2Tokens(endpoint, body) {
+  try {
+    const response = await fetch(endpoint, {
+      method: "POST",
+      headers: {
+        "Content-Type": "application/x-www-form-urlencoded"
+      },
+      body: body.toString()
+    });
+    if (!response.ok) {
+      throw new Error(`Token request failed with status ${response.status}`);
+    }
+    const data = await response.json();
+    return {
+      accessToken: data.access_token,
+      refreshToken: data.refresh_token,
+      idToken: data.id_token,
+      expiresIn: data.expires_in,
+      expiresAt: data.expires_in ? Date.now() + data.expires_in * 1e3 : void 0
+    };
+  } catch (e) {
+    import_logger.logger.error(`Failed to fetch OAuth2 tokens: ${e}`);
+    throw e;
+  }
+}
+function parseAuthorizationCode(uri) {
+  try {
+    const url = new URL(uri);
+    return url.searchParams.get("code") || void 0;
+  } catch (e) {
+    import_logger.logger.warn(`Failed to parse authorization URI ${uri}: ${e}`);
+    return void 0;
+  }
+}
+function createOAuth2TokenRequestBody(params) {
+  const body = new URLSearchParams();
+  body.set("grant_type", params.grantType);
+  body.set("client_id", params.clientId);
+  body.set("client_secret", params.clientSecret);
+  if (params.grantType === "authorization_code") {
+    body.set("code", params.code);
+    if (params.redirectUri) {
+      body.set("redirect_uri", params.redirectUri);
+    }
+    if (params.codeVerifier) {
+      body.set("code_verifier", params.codeVerifier);
+    }
+  } else if (params.grantType === "refresh_token") {
+    body.set("refresh_token", params.refreshToken);
+  }
+  return body;
+}
+function isTokenExpired(token, leeway = 60) {
+  if (typeof token.expiresAt !== "number") {
+    return false;
+  }
+  const expirationThreshold = token.expiresAt - leeway * 1e3;
+  return expirationThreshold < Date.now();
+}
+// Annotate the CommonJS export names for ESM import in node:
+0 && (module.exports = {
+  createOAuth2TokenRequestBody,
+  fetchOAuth2Tokens,
+  getTokenEndpoint,
+  isTokenExpired,
+  parseAuthorizationCode
+});

package/dist/cjs/auth/refresher/base_credential_refresher.js

@@ -0,0 +1,44 @@
+/**
+  * @license
+  * Copyright 2026 Google LLC
+  * SPDX-License-Identifier: Apache-2.0
+  */
+
+"use strict";
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, { get: all[name], enumerable: true });
+};
+var __copyProps = (to, from, except, desc) => {
+  if (from && typeof from === "object" || typeof from === "function") {
+    for (let key of __getOwnPropNames(from))
+      if (!__hasOwnProp.call(to, key) && key !== except)
+        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
+  }
+  return to;
+};
+var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
+var base_credential_refresher_exports = {};
+__export(base_credential_refresher_exports, {
+  CredentialRefresherError: () => CredentialRefresherError
+});
+module.exports = __toCommonJS(base_credential_refresher_exports);
+/**
+ * @license
+ * Copyright 2026 Google LLC
+ * SPDX-License-Identifier: Apache-2.0
+ */
+class CredentialRefresherError extends Error {
+  constructor(message) {
+    super(message);
+    this.name = "CredentialRefresherError";
+  }
+}
+// Annotate the CommonJS export names for ESM import in node:
+0 && (module.exports = {
+  CredentialRefresherError
+});

package/dist/cjs/auth/refresher/credential_refresher_registry.js

@@ -0,0 +1,68 @@
+/**
+  * @license
+  * Copyright 2026 Google LLC
+  * SPDX-License-Identifier: Apache-2.0
+  */
+
+"use strict";
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, { get: all[name], enumerable: true });
+};
+var __copyProps = (to, from, except, desc) => {
+  if (from && typeof from === "object" || typeof from === "function") {
+    for (let key of __getOwnPropNames(from))
+      if (!__hasOwnProp.call(to, key) && key !== except)
+        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
+  }
+  return to;
+};
+var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
+var credential_refresher_registry_exports = {};
+__export(credential_refresher_registry_exports, {
+  CredentialRefresherRegistry: () => CredentialRefresherRegistry
+});
+module.exports = __toCommonJS(credential_refresher_registry_exports);
+var import_auth_credential = require("../auth_credential.js");
+/**
+ * @license
+ * Copyright 2026 Google LLC
+ * SPDX-License-Identifier: Apache-2.0
+ */
+class CredentialRefresherRegistry {
+  constructor() {
+    this.refreshers = {
+      [import_auth_credential.AuthCredentialTypes.API_KEY]: void 0,
+      [import_auth_credential.AuthCredentialTypes.HTTP]: void 0,
+      [import_auth_credential.AuthCredentialTypes.OAUTH2]: void 0,
+      [import_auth_credential.AuthCredentialTypes.OPEN_ID_CONNECT]: void 0,
+      [import_auth_credential.AuthCredentialTypes.SERVICE_ACCOUNT]: void 0
+    };
+  }
+  /**
+   * Register a refresher instance for a credential type.
+   *
+   * @param credentialType The credential type to register for.
+   * @param refresherInstance The refresher instance to register.
+   */
+  register(credentialType, refresherInstance) {
+    this.refreshers[credentialType] = refresherInstance;
+  }
+  /**
+   * Get the refresher instance for a credential type.
+   *
+   * @param credentialType The credential type to get refresher for.
+   * @returns The refresher instance if registered, undefined otherwise.
+   */
+  getRefresher(credentialType) {
+    return this.refreshers[credentialType];
+  }
+}
+// Annotate the CommonJS export names for ESM import in node:
+0 && (module.exports = {
+  CredentialRefresherRegistry
+});

package/dist/cjs/code_executors/base_code_executor.js

@@ -64,16 +64,20 @@ class BaseCodeExecutor {
     this.errorRetryAttempts = 2;
     /**
      * The list of the enclosing delimiters to identify the code blocks.
-     * For example, the delimiter('```python\\n', '\\n```') can be  used to
-     * identify code blocks with the following format::
+     * For example, the delimiter('```javascript\\n', '\\n```') can be used to
+     * identify code blocks with the following format:
      *
-     * ```python
-     *  print("hello")
+     * ```javascript
+     *  console.log("hello")
      * ```
      */
     this.codeBlockDelimiters = [
       ["```tool_code\n", "\n```"],
-      ["```python\n", "\n```"]
+      ["```python\n", "\n```"],
+      ["```javascript\n", "\n```"],
+      ["```typescript\n", "\n```"],
+      ["```bash\n", "\n```"],
+      ["```sh\n", "\n```"]
     ];
     /**
      * The delimiters to format the code execution result.

package/dist/cjs/code_executors/code_execution_utils.js

@@ -24,6 +24,8 @@ var __copyProps = (to, from, except, desc) => {
 var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
 var code_execution_utils_exports = {};
 __export(code_execution_utils_exports, {
+  CodeExecutionLanguage: () => CodeExecutionLanguage,
+  FileContentEncoding: () => FileContentEncoding,
   buildCodeExecutionResultPart: () => buildCodeExecutionResultPart,
   buildExecutableCodePart: () => buildExecutableCodePart,
   convertCodeExecutionParts: () => convertCodeExecutionParts,
@@ -39,6 +41,21 @@ var import_env_aware_utils = require("../utils/env_aware_utils.js");
  * Copyright 2025 Google LLC
  * SPDX-License-Identifier: Apache-2.0
  */
+var FileContentEncoding = /* @__PURE__ */ ((FileContentEncoding2) => {
+  FileContentEncoding2["UTF8"] = "utf-8";
+  FileContentEncoding2["BASE64"] = "base64";
+  return FileContentEncoding2;
+})(FileContentEncoding || {});
+var CodeExecutionLanguage = /* @__PURE__ */ ((CodeExecutionLanguage2) => {
+  CodeExecutionLanguage2["UNSPECIFIED"] = "unspecified";
+  CodeExecutionLanguage2["PYTHON"] = "python";
+  CodeExecutionLanguage2["JAVASCRIPT"] = "javascript";
+  CodeExecutionLanguage2["TYPESCRIPT"] = "typescript";
+  CodeExecutionLanguage2["SHELL"] = "shell";
+  CodeExecutionLanguage2["POWERSHELL"] = "powershell";
+  CodeExecutionLanguage2["WINDOWS_CMD"] = "cmd";
+  return CodeExecutionLanguage2;
+})(CodeExecutionLanguage || {});
 function getEncodedFileContent(data) {
   return (0, import_env_aware_utils.isBase64Encoded)(data) ? data : (0, import_env_aware_utils.base64Encode)(data);
 }
@@ -134,6 +151,8 @@ function convertCodeExecutionParts(content, codeBlockDelimiter, executionResultD
 }
 // Annotate the CommonJS export names for ESM import in node:
 0 && (module.exports = {
+  CodeExecutionLanguage,
+  FileContentEncoding,
   buildCodeExecutionResultPart,
   buildExecutableCodePart,
   convertCodeExecutionParts,