@google/adk 1.3.0 → 1.4.0

package/dist/web/agents/instructions.js

@@ -15,9 +15,6 @@ async function resolveKey(key, isOptional, rawMatch, readonlyContext) {
       throw new Error("Artifact service is not initialized.");
     }
     const artifact = await invocationContext.artifactService.loadArtifact({
-      appName: invocationContext.session.appName,
-      userId: invocationContext.session.userId,
-      sessionId: invocationContext.session.id,
       filename: fileName
     });
     if (!artifact) {
@@ -26,19 +23,40 @@ async function resolveKey(key, isOptional, rawMatch, readonlyContext) {
       }
       throw new Error("Artifact ".concat(fileName, " not found."));
     }
-    return String(artifact);
+    return formatValue(artifact, true);
   }
   if (!isValidStateName(key)) {
     return rawMatch;
   }
   if (key in invocationContext.session.state) {
-    return String(invocationContext.session.state[key]);
+    return formatValue(invocationContext.session.state[key], false);
   }
   if (isOptional) {
     return "";
   }
   throw new Error("Context variable not found: `".concat(key, "`."));
 }
+function formatValue(value, isArtifact = false) {
+  if (typeof value === "string") {
+    return value;
+  }
+  if (typeof value === "object" && value !== null) {
+    if (isArtifact && "text" in value && typeof value.text === "string") {
+      return value.text;
+    }
+    try {
+      const json = JSON.stringify(value);
+      if (json !== void 0) {
+        return json;
+      }
+    } catch (e) {
+      throw new Error(
+        "Failed to serialize value for instruction template: ".concat(e instanceof Error ? e.message : String(e))
+      );
+    }
+  }
+  return String(value);
+}
 async function injectSessionState(template, readonlyContext) {
   const pattern = /\{+[^{}]*}+/g;
   const matches = Array.from(template.matchAll(pattern));

package/dist/web/agents/invocation_context.js

@@ -30,11 +30,7 @@ class InvocationContext {
    * @param params The parameters for creating an invocation context.
    */
   constructor(params) {
-    /**
-     * A container to keep track of different kinds of costs incurred as a part of
-     * this invocation.
-     */
-    this.invocationCostManager = new InvocationCostManager();
+    var _a;
     this.artifactService = params.artifactService;
     this.sessionService = params.sessionService;
     this.memoryService = params.memoryService;
@@ -49,6 +45,7 @@ class InvocationContext {
     this.activeStreamingTools = params.activeStreamingTools;
     this.pluginManager = params.pluginManager;
     this.abortSignal = params.abortSignal;
+    this.invocationCostManager = (_a = params.invocationCostManager) != null ? _a : new InvocationCostManager();
   }
   /**
    * The app name of the current session.

package/dist/web/agents/llm_agent.js

@@ -106,6 +106,7 @@ import { CONTENT_REQUEST_PROCESSOR } from "./processors/content_request_processo
 import { ContextCompactorRequestProcessor } from "./processors/context_compactor_request_processor.js";
 import { IDENTITY_LLM_REQUEST_PROCESSOR } from "./processors/identity_llm_request_processor.js";
 import { INSTRUCTIONS_LLM_REQUEST_PROCESSOR } from "./processors/instructions_llm_request_processor.js";
+import { INTERACTIONS_REQUEST_PROCESSOR } from "./processors/interactions_request_processor.js";
 import { REQUEST_CONFIRMATION_LLM_REQUEST_PROCESSOR } from "./processors/request_confirmation_llm_request_processor.js";
 import { TOOL_FILTER_REQUEST_PROCESSOR } from "./processors/tool_filter_request_processor.js";
 import { ReadonlyContext } from "./readonly_context.js";
@@ -150,6 +151,7 @@ class LlmAgent extends (_b = BaseAgent, _a = LLM_AGENT_SIGNATURE_SYMBOL, _b) {
       INSTRUCTIONS_LLM_REQUEST_PROCESSOR,
       REQUEST_CONFIRMATION_LLM_REQUEST_PROCESSOR,
       CONTENT_REQUEST_PROCESSOR,
+      INTERACTIONS_REQUEST_PROCESSOR,
       CODE_EXECUTION_REQUEST_PROCESSOR,
       TOOL_FILTER_REQUEST_PROCESSOR
     ];
@@ -605,7 +607,7 @@ class LlmAgent extends (_b = BaseAgent, _a = LLM_AGENT_SIGNATURE_SYMBOL, _b) {
   }
   postprocess(invocationContext, llmRequest, llmResponse, modelResponseEvent) {
     return __asyncGenerator(this, null, function* () {
-      var _a2, _b2, _c, _d, _e;
+      var _a2, _b2, _c, _d, _e, _f;
       for (const processor of this.responseProcessors) {
         try {
           for (var iter = __forAwait(processor.runAsync(
@@ -629,7 +631,7 @@ class LlmAgent extends (_b = BaseAgent, _a = LLM_AGENT_SIGNATURE_SYMBOL, _b) {
           }
         }
       }
-      if (!llmResponse.content && !llmResponse.errorCode && !llmResponse.interrupted) {
+      if ((!llmResponse.content || ((_b2 = llmResponse.content.parts) == null ? void 0 : _b2.length) === 0) && !llmResponse.errorCode && !llmResponse.interrupted) {
         return;
       }
       const mergedEvent = createEvent(__spreadValues(__spreadValues({}, modelResponseEvent), llmResponse));
@@ -650,10 +652,10 @@ class LlmAgent extends (_b = BaseAgent, _a = LLM_AGENT_SIGNATURE_SYMBOL, _b) {
         }
       }
       yield mergedEvent;
-      if (!((_b2 = getFunctionCalls(mergedEvent)) == null ? void 0 : _b2.length)) {
+      if (!((_c = getFunctionCalls(mergedEvent)) == null ? void 0 : _c.length)) {
         return;
       }
-      if ((_c = invocationContext.runConfig) == null ? void 0 : _c.pauseOnToolCalls) {
+      if ((_d = invocationContext.runConfig) == null ? void 0 : _d.pauseOnToolCalls) {
         invocationContext.endInvocation = true;
         return;
       }
@@ -664,7 +666,7 @@ class LlmAgent extends (_b = BaseAgent, _a = LLM_AGENT_SIGNATURE_SYMBOL, _b) {
         beforeToolCallbacks: this.canonicalBeforeToolCallbacks,
         afterToolCallbacks: this.canonicalAfterToolCallbacks
       }));
-      if (!functionResponseEvent || ((_d = invocationContext.abortSignal) == null ? void 0 : _d.aborted)) {
+      if (!functionResponseEvent || ((_e = invocationContext.abortSignal) == null ? void 0 : _e.aborted)) {
         return;
       }
       const authEvent = generateAuthEvent(
@@ -691,7 +693,7 @@ class LlmAgent extends (_b = BaseAgent, _a = LLM_AGENT_SIGNATURE_SYMBOL, _b) {
         try {
           for (var iter2 = __forAwait(nextAgent.runAsync(invocationContext)), more2, temp2, error2; more2 = !(temp2 = yield new __await(iter2.next())).done; more2 = false) {
             const event = temp2.value;
-            if ((_e = invocationContext.abortSignal) == null ? void 0 : _e.aborted) {
+            if ((_f = invocationContext.abortSignal) == null ? void 0 : _f.aborted) {
               return;
             }
             yield event;

package/dist/web/agents/processors/code_execution_request_processor.js

@@ -327,9 +327,6 @@ async function postProcessCodeExecutionResult(invocationContext, codeExecutorCon
   }
   for (const outputFile of codeExecutionResult.outputFiles) {
     const version = await invocationContext.artifactService.saveArtifact({
-      appName: invocationContext.appName || "",
-      userId: invocationContext.userId || "",
-      sessionId: invocationContext.session.id,
       filename: outputFile.name,
       artifact: {
         inlineData: { data: outputFile.content, mimeType: outputFile.mimeType }

package/dist/web/agents/processors/content_processor_utils.js

@@ -35,10 +35,21 @@ import {
   getFunctionResponses
 } from "../../events/event.js";
 import {
-  removeClientFunctionCallId,
+  AF_FUNCTION_CALL_ID_PREFIX,
   REQUEST_CONFIRMATION_FUNCTION_CALL_NAME,
   REQUEST_EUC_FUNCTION_CALL_NAME
 } from "../functions.js";
+function removeClientFunctionCallId(content) {
+  var _a, _b, _c, _d, _e;
+  for (const part of (_a = content == null ? void 0 : content.parts) != null ? _a : []) {
+    if ((_c = (_b = part.functionCall) == null ? void 0 : _b.id) == null ? void 0 : _c.startsWith(AF_FUNCTION_CALL_ID_PREFIX)) {
+      part.functionCall.id = void 0;
+    }
+    if ((_e = (_d = part.functionResponse) == null ? void 0 : _d.id) == null ? void 0 : _e.startsWith(AF_FUNCTION_CALL_ID_PREFIX)) {
+      part.functionResponse.id = void 0;
+    }
+  }
+}
 function getContents(events, agentName, currentBranch) {
   var _a, _b, _c;
   const filteredEvents = [];
@@ -344,5 +355,6 @@ function convertCompactedEvent(event) {
 export {
   getContents,
   getCurrentTurnContents,
-  mergeFunctionResponseEvents
+  mergeFunctionResponseEvents,
+  removeClientFunctionCallId
 };

package/dist/web/agents/processors/context_compactor_request_processor.js

@@ -40,20 +40,22 @@ class ContextCompactorRequestProcessor {
    */
   runAsync(invocationContext, _llmRequest) {
     return __asyncGenerator(this, null, function* () {
+      var _a;
       for (const compactor of this.compactors) {
         const shouldCompact = yield new __await(Promise.resolve(
           compactor.shouldCompact(invocationContext)
         ));
         if (shouldCompact) {
+          const trigger = (_a = compactor.trigger) != null ? _a : ContextCompactionTrigger.Auto;
           yield new __await(invocationContext.pluginManager.runBeforeContextCompaction({
             invocationContext,
-            trigger: ContextCompactionTrigger.Auto
+            trigger
           }));
           const oldEvents = new Set(invocationContext.session.events);
           yield new __await(Promise.resolve(compactor.compact(invocationContext)));
           yield new __await(invocationContext.pluginManager.runAfterContextCompaction({
             invocationContext,
-            trigger: ContextCompactionTrigger.Auto
+            trigger
           }));
           const newEvents = invocationContext.session.events.filter(
             (e) => !oldEvents.has(e)

package/dist/web/agents/processors/interactions_request_processor.js

@@ -0,0 +1,52 @@
+import {createRequire as topLevelCreateRequire} from 'module';
+const require = topLevelCreateRequire(import.meta.url);
+var __knownSymbol = (name, symbol) => (symbol = Symbol[name]) ? symbol : Symbol.for("Symbol." + name);
+var __await = function(promise, isYieldStar) {
+  this[0] = promise;
+  this[1] = isYieldStar;
+};
+var __asyncGenerator = (__this, __arguments, generator) => {
+  var resume = (k, v, yes, no) => {
+    try {
+      var x = generator[k](v), isAwait = (v = x.value) instanceof __await, done = x.done;
+      Promise.resolve(isAwait ? v[0] : v).then((y) => isAwait ? resume(k === "return" ? k : "next", v[1] ? { done: y.done, value: y.value } : y, yes, no) : yes({ value: y, done })).catch((e) => resume("throw", e, yes, no));
+    } catch (e) {
+      no(e);
+    }
+  }, method = (k) => it[k] = (x) => new Promise((yes, no) => resume(k, x, yes, no)), it = {};
+  return generator = generator.apply(__this, __arguments), it[__knownSymbol("asyncIterator")] = () => it, method("next"), method("throw"), method("return"), it;
+};
+/**
+ * @license
+ * Copyright 2026 Google LLC
+ * SPDX-License-Identifier: Apache-2.0
+ */
+import { isGemini } from "../../models/google_llm.js";
+import { isLlmAgent } from "../llm_agent.js";
+class InteractionsRequestProcessor {
+  // eslint-disable-next-line require-yield
+  runAsync(invocationContext, llmRequest) {
+    return __asyncGenerator(this, null, function* () {
+      const agent = invocationContext.agent;
+      if (!agent || !isLlmAgent(agent)) {
+        return;
+      }
+      const model = agent.canonicalModel;
+      if (isGemini(model) && model.useInteractionsApi) {
+        const events = invocationContext.session.events;
+        for (let i = events.length - 1; i >= 0; i--) {
+          const event = events[i];
+          if (event.branch === invocationContext.branch && event.author === agent.name && event.interactionId) {
+            llmRequest.previousInteractionId = event.interactionId;
+            break;
+          }
+        }
+      }
+    });
+  }
+}
+const INTERACTIONS_REQUEST_PROCESSOR = new InteractionsRequestProcessor();
+export {
+  INTERACTIONS_REQUEST_PROCESSOR,
+  InteractionsRequestProcessor
+};

package/dist/web/apps/app.js

@@ -0,0 +1,49 @@
+import {createRequire as topLevelCreateRequire} from 'module';
+const require = topLevelCreateRequire(import.meta.url);
+/**
+ * @license
+ * Copyright 2026 Google LLC
+ * SPDX-License-Identifier: Apache-2.0
+ */
+var _a;
+import { isBaseAgent } from "../agents/base_agent.js";
+const VALID_APP_NAME_RE = /^[a-zA-Z][a-zA-Z0-9_-]*$/;
+function validateAppName(name) {
+  if (!VALID_APP_NAME_RE.test(name)) {
+    throw new Error(
+      "Invalid app name '".concat(name, "': must start with a letter and can only consist of letters, digits, underscores, and hyphens.")
+    );
+  }
+  if (name === "user") {
+    throw new Error("App name cannot be 'user'; reserved for end-user input.");
+  }
+}
+const APP_SIGNATURE_SYMBOL = Symbol.for("google.adk.app");
+function isApp(obj) {
+  return typeof obj === "object" && obj !== null && APP_SIGNATURE_SYMBOL in obj && obj[APP_SIGNATURE_SYMBOL] === true;
+}
+_a = APP_SIGNATURE_SYMBOL;
+class App {
+  constructor(options) {
+    this[_a] = true;
+    var _a2, _b, _c, _d;
+    validateAppName(options.name);
+    if (options.rootAgent === void 0 || options.rootAgent === null) {
+      throw new Error("rootAgent must be provided.");
+    }
+    if (!isBaseAgent(options.rootAgent)) {
+      throw new TypeError(
+        "rootAgent must be a BaseAgent instance, got ".concat((_c = (_b = (_a2 = options.rootAgent) == null ? void 0 : _a2.constructor) == null ? void 0 : _b.name) != null ? _c : typeof options.rootAgent)
+      );
+    }
+    this.name = options.name;
+    this.rootAgent = options.rootAgent;
+    this.plugins = (_d = options.plugins) != null ? _d : [];
+    this.resumabilityConfig = options.resumabilityConfig;
+  }
+}
+export {
+  App,
+  isApp,
+  validateAppName
+};

package/dist/web/apps/resumability_config.js

@@ -0,0 +1,31 @@
+import {createRequire as topLevelCreateRequire} from 'module';
+const require = topLevelCreateRequire(import.meta.url);
+var __defProp = Object.defineProperty;
+var __getOwnPropSymbols = Object.getOwnPropertySymbols;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __propIsEnum = Object.prototype.propertyIsEnumerable;
+var __defNormalProp = (obj, key, value) => key in obj ? __defProp(obj, key, { enumerable: true, configurable: true, writable: true, value }) : obj[key] = value;
+var __spreadValues = (a, b) => {
+  for (var prop in b || (b = {}))
+    if (__hasOwnProp.call(b, prop))
+      __defNormalProp(a, prop, b[prop]);
+  if (__getOwnPropSymbols)
+    for (var prop of __getOwnPropSymbols(b)) {
+      if (__propIsEnum.call(b, prop))
+        __defNormalProp(a, prop, b[prop]);
+    }
+  return a;
+};
+/**
+ * @license
+ * Copyright 2026 Google LLC
+ * SPDX-License-Identifier: Apache-2.0
+ */
+function createResumabilityConfig(params = {}) {
+  return __spreadValues({
+    isResumable: false
+  }, params);
+}
+export {
+  createResumabilityConfig
+};

package/dist/web/artifacts/file_artifact_service.js

@@ -43,7 +43,7 @@ class FileArtifactService {
     artifact,
     customMetadata
   }) {
-    if (!artifact.inlineData && !artifact.text) {
+    if (!artifact.inlineData && !artifact.text && !artifact.fileData) {
       throw new Error("Artifact must have either inlineData or text content.");
     }
     const artifactDir = getArtifactDir(
@@ -61,12 +61,19 @@ class FileArtifactService {
     const storedFilename = path.basename(artifactDir);
     const contentPath = path.join(versionDir, storedFilename);
     let mimeType;
+    let fileUri;
     if (artifact.inlineData) {
       const data = artifact.inlineData.data || "";
       await fs.writeFile(contentPath, Buffer.from(data, "base64"));
       mimeType = artifact.inlineData.mimeType || "application/octet-stream";
     } else if (artifact.text !== void 0) {
       await fs.writeFile(contentPath, artifact.text, "utf-8");
+    } else {
+      fileUri = artifact.fileData.fileUri;
+      if (!fileUri) {
+        throw new Error("Artifact fileData must have a fileUri.");
+      }
+      mimeType = artifact.fileData.mimeType;
     }
     const canonicalUri = await getCanonicalUri(
       this.rootDir,
@@ -78,6 +85,7 @@ class FileArtifactService {
     const metadata = {
       fileName: filename,
       mimeType,
+      fileUri,
       version: nextVersion,
       canonicalUri,
       customMetadata
@@ -129,6 +137,11 @@ class FileArtifactService {
       );
       const metadataPath = path.join(versionDir, "metadata.json");
       const metadata = await readMetadata(metadataPath);
+      if (metadata.fileUri) {
+        return {
+          fileData: { fileUri: metadata.fileUri, mimeType: metadata.mimeType }
+        };
+      }
       const storedFilename = path.basename(artifactDir);
       let contentPath = path.join(versionDir, storedFilename);
       if (metadata.canonicalUri) {

package/dist/web/artifacts/gcs_artifact_service.js

@@ -27,12 +27,16 @@ var __spreadProps = (a, b) => __defProps(a, __getOwnPropDescs(b));
 import { Storage } from "@google-cloud/storage";
 import { createPartFromBase64, createPartFromText } from "@google/genai";
 import { logger } from "../utils/logger.js";
+const GCS_FILE_URI_METADATA_KEY = "adkFileUri";
+const GCS_FILE_MIME_TYPE_METADATA_KEY = "adkFileMimeType";
+const GCS_DISPLAY_NAME_METADATA_KEY = "adkDisplayName";
+const GCS_IS_TEXT_METADATA_KEY = "adkIsText";
 class GcsArtifactService {
-  constructor(bucket) {
-    this.bucket = new Storage().bucket(bucket);
+  constructor(bucket, options) {
+    this.bucket = new Storage(options).bucket(bucket);
   }
   async saveArtifact(request) {
-    if (!request.artifact.inlineData && !request.artifact.text) {
+    if (!request.artifact.inlineData && !request.artifact.text && !request.artifact.fileData) {
       throw new Error("Artifact must have either inlineData or text content.");
     }
     const versions = await this.listVersions(request);
@@ -42,24 +46,46 @@ class GcsArtifactService {
         version
       }))
     );
-    const metadata = request.customMetadata || {};
+    const customMetadata = __spreadValues({}, request.customMetadata);
     if (request.artifact.inlineData) {
+      if (request.artifact.inlineData.displayName) {
+        customMetadata[GCS_DISPLAY_NAME_METADATA_KEY] = request.artifact.inlineData.displayName;
+      }
       await file.save(
         Buffer.from(request.artifact.inlineData.data || "", "base64"),
         {
           contentType: request.artifact.inlineData.mimeType,
-          metadata
+          metadata: { metadata: customMetadata }
         }
       );
       return version;
+    } else if (request.artifact.text !== void 0) {
+      await file.save(request.artifact.text, {
+        contentType: "text/plain",
+        metadata: {
+          metadata: __spreadProps(__spreadValues({}, customMetadata), { [GCS_IS_TEXT_METADATA_KEY]: "true" })
+        }
+      });
+      return version;
+    } else {
+      const fileData = request.artifact.fileData;
+      const fileUri = fileData == null ? void 0 : fileData.fileUri;
+      if (!fileUri) {
+        throw new Error("Artifact fileData must have a fileUri.");
+      }
+      customMetadata[GCS_FILE_URI_METADATA_KEY] = fileUri;
+      if (fileData.mimeType) {
+        customMetadata[GCS_FILE_MIME_TYPE_METADATA_KEY] = fileData.mimeType;
+      }
+      await file.save("", {
+        contentType: fileData.mimeType || void 0,
+        metadata: { metadata: customMetadata }
+      });
+      return version;
     }
-    await file.save(request.artifact.text, {
-      contentType: "text/plain",
-      metadata
-    });
-    return version;
   }
   async loadArtifact(request) {
+    var _a, _b, _c;
     try {
       let version = request.version;
       if (version === void 0) {
@@ -74,11 +100,25 @@ class GcsArtifactService {
           version
         }))
       );
-      const [[metadata], [rawDataBuffer]] = await Promise.all([
-        file.getMetadata(),
-        file.download()
-      ]);
-      if (metadata.contentType === "text/plain") {
+      const [metadata] = await file.getMetadata();
+      const customMeta = (_a = metadata.metadata) != null ? _a : {};
+      const fileUri = customMeta[GCS_FILE_URI_METADATA_KEY];
+      if (fileUri) {
+        const mimeType = (_c = (_b = customMeta[GCS_FILE_MIME_TYPE_METADATA_KEY]) != null ? _b : metadata.contentType) != null ? _c : void 0;
+        return { fileData: { fileUri, mimeType } };
+      }
+      const [rawDataBuffer] = await file.download();
+      const displayName = customMeta[GCS_DISPLAY_NAME_METADATA_KEY];
+      if (displayName) {
+        return {
+          inlineData: {
+            data: rawDataBuffer.toString("base64"),
+            mimeType: metadata.contentType,
+            displayName
+          }
+        };
+      }
+      if (customMeta[GCS_IS_TEXT_METADATA_KEY] === "true" || metadata.contentType === "text/plain") {
         return createPartFromText(rawDataBuffer.toString("utf-8"));
       }
       return createPartFromBase64(

package/dist/web/artifacts/in_memory_artifact_service.js

@@ -20,7 +20,7 @@ class InMemoryArtifactService {
     artifact,
     customMetadata
   }) {
-    if (!artifact.inlineData && !artifact.text) {
+    if (!artifact.inlineData && !artifact.text && !artifact.fileData) {
       return Promise.reject(
         new Error("Artifact must have either inlineData or text content.")
       );
@@ -34,6 +34,10 @@ class InMemoryArtifactService {
       version,
       customMetadata
     };
+    if (!artifact.inlineData && artifact.text === void 0) {
+      const fileData = artifact.fileData;
+      metadata.mimeType = fileData.mimeType;
+    }
     this.artifacts[path].push({ part: artifact, metadata });
     return Promise.resolve(version);
   }

package/dist/web/artifacts/scoped_artifact_service.js

@@ -0,0 +1,86 @@
+import {createRequire as topLevelCreateRequire} from 'module';
+const require = topLevelCreateRequire(import.meta.url);
+var __defProp = Object.defineProperty;
+var __getOwnPropSymbols = Object.getOwnPropertySymbols;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __propIsEnum = Object.prototype.propertyIsEnumerable;
+var __defNormalProp = (obj, key, value) => key in obj ? __defProp(obj, key, { enumerable: true, configurable: true, writable: true, value }) : obj[key] = value;
+var __spreadValues = (a, b) => {
+  for (var prop in b || (b = {}))
+    if (__hasOwnProp.call(b, prop))
+      __defNormalProp(a, prop, b[prop]);
+  if (__getOwnPropSymbols)
+    for (var prop of __getOwnPropSymbols(b)) {
+      if (__propIsEnum.call(b, prop))
+        __defNormalProp(a, prop, b[prop]);
+    }
+  return a;
+};
+/**
+ * @license
+ * Copyright 2026 Google LLC
+ * SPDX-License-Identifier: Apache-2.0
+ */
+class ScopedArtifactService {
+  constructor(delegate, appName, userId, sessionId) {
+    this.delegate = delegate;
+    this.appName = appName;
+    this.userId = userId;
+    this.sessionId = sessionId;
+  }
+  async saveArtifact(request) {
+    return this.delegate.saveArtifact(__spreadValues({
+      appName: this.appName,
+      userId: this.userId,
+      sessionId: this.sessionId
+    }, request));
+  }
+  async loadArtifact(request) {
+    return this.delegate.loadArtifact(__spreadValues({
+      appName: this.appName,
+      userId: this.userId,
+      sessionId: this.sessionId
+    }, request));
+  }
+  async listArtifactKeys() {
+    return this.delegate.listArtifactKeys({
+      appName: this.appName,
+      userId: this.userId,
+      sessionId: this.sessionId
+    });
+  }
+  async deleteArtifact(filename) {
+    return this.delegate.deleteArtifact({
+      appName: this.appName,
+      userId: this.userId,
+      sessionId: this.sessionId,
+      filename
+    });
+  }
+  async listVersions(filename) {
+    return this.delegate.listVersions({
+      appName: this.appName,
+      userId: this.userId,
+      sessionId: this.sessionId,
+      filename
+    });
+  }
+  async listArtifactVersions(filename) {
+    return this.delegate.listArtifactVersions({
+      appName: this.appName,
+      userId: this.userId,
+      sessionId: this.sessionId,
+      filename
+    });
+  }
+  async getArtifactVersion(request) {
+    return this.delegate.getArtifactVersion(__spreadValues({
+      appName: this.appName,
+      userId: this.userId,
+      sessionId: this.sessionId
+    }, request));
+  }
+}
+export {
+  ScopedArtifactService
+};

package/dist/web/artifacts/session_artifact_service.js

@@ -0,0 +1,7 @@
+import {createRequire as topLevelCreateRequire} from 'module';
+const require = topLevelCreateRequire(import.meta.url);
+/**
+ * @license
+ * Copyright 2026 Google LLC
+ * SPDX-License-Identifier: Apache-2.0
+ */

package/dist/web/auth/oauth2/oauth2_discovery.js

@@ -55,7 +55,11 @@ class OAuth2DiscoveryManager {
           method: "GET",
           headers: {
             Accept: "application/json"
-          }
+          },
+          // Never follow redirects: validateDiscoveryUrl only checks the
+          // initial URL, so following a 3xx would let a validated host
+          // redirect discovery to a private/cloud-metadata address (CWE-918).
+          redirect: "error"
         });
         if (!response.ok) {
           continue;
@@ -103,7 +107,11 @@ class OAuth2DiscoveryManager {
         method: "GET",
         headers: {
           Accept: "application/json"
-        }
+        },
+        // Never follow redirects: validateDiscoveryUrl only checks the
+        // initial URL, so following a 3xx would let a validated host
+        // redirect discovery to a private/cloud-metadata address (CWE-918).
+        redirect: "error"
       });
       if (!response.ok) {
         return void 0;
@@ -143,7 +151,7 @@ function validateDiscoveryUrl(urlStr) {
       return false;
     }
     const host = normaliseHostname(url.hostname.toLowerCase());
-    if (host === "localhost" || host === "metadata.google.internal" || host === "metadata.goog" || host.startsWith("127.") || host === "[::1]" || host === "0.0.0.0" || host.startsWith("10.") || host.startsWith("192.168.") || host.startsWith("169.254.")) {
+    if (host === "localhost" || host === "metadata.google.internal" || host === "metadata.goog" || host.startsWith("127.") || host === "[::1]" || host === "[::]" || host === "0.0.0.0" || host.startsWith("10.") || host.startsWith("192.168.") || host.startsWith("169.254.")) {
       logger.warn("Unsafe host for discovery URL: ".concat(host));
       return false;
     }
@@ -176,5 +184,7 @@ function validateDiscoveryUrl(urlStr) {
 export {
   AuthorizationServerMetadataSchema,
   OAuth2DiscoveryManager,
-  ProtectedResourceMetadataSchema
+  ProtectedResourceMetadataSchema,
+  normaliseHostname,
+  validateDiscoveryUrl
 };