@google/adk 1.3.0 → 1.5.0

package/dist/cjs/tools/mcp/mcp_toolset.js

@@ -75,6 +75,69 @@ class MCPToolset extends import_base_toolset.BaseToolset {
     );
     return tools;
   }
+  /**
+   * Lists the names of the resources advertised by the MCP server.
+   *
+   * @return The resource names available on the server.
+   */
+  async listResources() {
+    const session = await this.mcpSessionManager.createSession();
+    try {
+      const result = await session.listResources();
+      return result.resources.map((resource) => resource.name);
+    } finally {
+      await this.mcpSessionManager.closeSession(session);
+    }
+  }
+  /**
+   * Returns metadata for the resource whose name matches `name`.
+   *
+   * @param name The advertised name of the resource.
+   * @return The matching MCP `Resource`.
+   * @throws If no resource with the given name is advertised by the server.
+   */
+  async getResourceInfo(name) {
+    const session = await this.mcpSessionManager.createSession();
+    let result;
+    try {
+      result = await session.listResources();
+    } finally {
+      await this.mcpSessionManager.closeSession(session);
+    }
+    const resource = result.resources.find(
+      (candidate) => candidate.name === name
+    );
+    if (!resource) {
+      throw new Error(`Resource with name '${name}' not found.`);
+    }
+    return resource;
+  }
+  /**
+   * Reads the contents of the named resource from the MCP server.
+   *
+   * The resource name is resolved to a URI via {@link getResourceInfo} before
+   * reading. Binary contents are returned base64-encoded, exactly as provided
+   * by the server (never decoded and re-encoded).
+   *
+   * @param name The advertised name of the resource to read.
+   * @return The resource contents (text and/or base64-encoded binary).
+   * @throws If the resource is unknown or has no URI.
+   */
+  async readResource(name) {
+    const resourceInfo = await this.getResourceInfo(name);
+    if (!resourceInfo.uri) {
+      throw new Error(`Resource '${name}' has no URI.`);
+    }
+    const session = await this.mcpSessionManager.createSession();
+    try {
+      const result = await session.readResource({
+        uri: resourceInfo.uri
+      });
+      return result.contents;
+    } finally {
+      await this.mcpSessionManager.closeSession(session);
+    }
+  }
   async close() {
     const sessions = this.mcpSessionManager.getActiveSessions();
     await Promise.allSettled(

package/dist/cjs/tools/openapi_tool/openapi_spec_parser/tool_auth_handler.js

@@ -52,20 +52,10 @@ class ToolContextCredentialStore {
   }
   getCredential(authScheme) {
     const key = this.getCredentialKey(authScheme);
-    const state = this.context.state;
-    if (state) {
-      const serialized = state[key];
-      if (serialized) {
-        return serialized;
-      }
-    }
-    return void 0;
+    return this.context.state.get(key);
   }
   storeCredential(key, credential) {
-    const state = this.context.state;
-    if (state) {
-      state[key] = credential;
-    }
+    this.context.state.set(key, credential);
   }
 }
 let ToolAuthHandler = class {
@@ -97,19 +87,22 @@ let ToolAuthHandler = class {
       rawAuthCredential: this.authCredential,
       credentialKey: this.credentialKey || "default_openapi_key"
     };
-    const credential = this.context.getAuthResponse(authConfig);
-    if (credential) {
-      const exchanger = new import_auto_auth_credential_exchanger.AutoAuthCredentialExchanger();
-      const result = await exchanger.exchange({
-        authScheme: this.authScheme,
-        authCredential: credential
-      });
+    const authResponseCredential = this.context.getAuthResponse(authConfig);
+    const credential = authResponseCredential != null ? authResponseCredential : this.authCredential;
+    if (!credential) {
+      this.context.requestCredential(authConfig);
+      return { state: "pending" };
+    }
+    const exchanger = new import_auto_auth_credential_exchanger.AutoAuthCredentialExchanger();
+    const result = await exchanger.exchange({
+      authScheme: this.authScheme,
+      authCredential: credential
+    });
+    if (authResponseCredential || result.wasExchanged) {
       const key = store.getCredentialKey(this.authScheme);
       store.storeCredential(key, result.credential);
-      return { state: "done", authCredential: result.credential };
     }
-    this.context.requestCredential(authConfig);
-    return { state: "pending" };
+    return { state: "done", authCredential: result.credential };
   }
 };
 __decorateClass([

package/dist/cjs/tools/skill/run_skill_inline_script_tool.js

@@ -32,6 +32,7 @@ var __decorateClass = (decorators, target, key, kind) => {
 };
 var run_skill_inline_script_tool_exports = {};
 __export(run_skill_inline_script_tool_exports, {
+  RunSkillInlineScriptErrorCode: () => RunSkillInlineScriptErrorCode,
   RunSkillInlineScriptTool: () => RunSkillInlineScriptTool
 });
 module.exports = __toCommonJS(run_skill_inline_script_tool_exports);
@@ -46,6 +47,15 @@ var import_base_tool = require("../base_tool.js");
  * Copyright 2026 Google LLC
  * SPDX-License-Identifier: Apache-2.0
  */
+var RunSkillInlineScriptErrorCode = /* @__PURE__ */ ((RunSkillInlineScriptErrorCode2) => {
+  RunSkillInlineScriptErrorCode2["MISSING_SCRIPT_CONTENT"] = "MISSING_SCRIPT_CONTENT";
+  RunSkillInlineScriptErrorCode2["MISSING_LANGUAGE"] = "MISSING_LANGUAGE";
+  RunSkillInlineScriptErrorCode2["NO_CODE_EXECUTOR"] = "NO_CODE_EXECUTOR";
+  RunSkillInlineScriptErrorCode2["EXECUTION_ERROR"] = "EXECUTION_ERROR";
+  RunSkillInlineScriptErrorCode2["CONFIRMATION_REJECTED"] = "CONFIRMATION_REJECTED";
+  return RunSkillInlineScriptErrorCode2;
+})(RunSkillInlineScriptErrorCode || {});
+const REQUIRE_CONFIRMATION_MESSAGE = "This tool call needs external confirmation before completion.";
 let RunSkillInlineScriptTool = class extends import_base_tool.BaseTool {
   constructor(toolset) {
     super({
@@ -95,13 +105,13 @@ let RunSkillInlineScriptTool = class extends import_base_tool.BaseTool {
     if (!inlineScriptContent) {
       return {
         error: "Script content is required.",
-        errorCode: "MISSING_SCRIPT_CONTENT"
+        errorCode: "MISSING_SCRIPT_CONTENT" /* MISSING_SCRIPT_CONTENT */
       };
     }
     if (!language) {
       return {
         error: "Language is required.",
-        errorCode: "MISSING_LANGUAGE"
+        errorCode: "MISSING_LANGUAGE" /* MISSING_LANGUAGE */
       };
     }
     let codeExecutor = (_a = this.toolset) == null ? void 0 : _a.codeExecutor;
@@ -114,9 +124,17 @@ let RunSkillInlineScriptTool = class extends import_base_tool.BaseTool {
     if (!codeExecutor) {
       return {
         error: "No code executor configured.",
-        errorCode: "NO_CODE_EXECUTOR"
+        errorCode: "NO_CODE_EXECUTOR" /* NO_CODE_EXECUTOR */
       };
     }
+    const confirmationResult = this.enforceConfirmation(
+      toolContext,
+      inlineScriptContent,
+      language
+    );
+    if (confirmationResult) {
+      return confirmationResult;
+    }
     try {
       const result = await codeExecutor.executeCode({
         invocationContext: toolContext.invocationContext,
@@ -132,9 +150,40 @@ let RunSkillInlineScriptTool = class extends import_base_tool.BaseTool {
     } catch (e) {
       return {
         error: `Failed to execute inline script: ${e.message}`,
-        errorCode: "EXECUTION_ERROR"
+        errorCode: "EXECUTION_ERROR" /* EXECUTION_ERROR */
+      };
+    }
+  }
+  /**
+   * Enforces a human-in-the-loop confirmation gate before executing an inline
+   * script, using the repo's standard tool-confirmation mechanism.
+   *
+   * - When no confirmation has been provided yet, a confirmation is requested
+   *   (surfacing the language and script that would run) and an intermediate
+   *   result is returned so the tool call pauses until the client responds.
+   * - When a confirmation exists but was not confirmed, a rejection error is
+   *   returned and execution is refused.
+   * - When the confirmation is confirmed, `undefined` is returned to allow the
+   *   caller to proceed with execution.
+   */
+  enforceConfirmation(toolContext, scriptContent, language) {
+    const confirmation = toolContext.toolConfirmation;
+    if (!confirmation) {
+      toolContext.requestConfirmation({
+        hint: `Confirmation is required before executing an inline skill script. The agent requested to run the following ${language} script in the code executor. Only approve if you trust its contents:
+
+` + scriptContent,
+        payload: { language, scriptContent }
+      });
+      return { partial: REQUIRE_CONFIRMATION_MESSAGE };
+    }
+    if (!confirmation.confirmed) {
+      return {
+        error: "Inline script execution was not confirmed and was rejected.",
+        errorCode: "CONFIRMATION_REJECTED" /* CONFIRMATION_REJECTED */
       };
     }
+    return void 0;
   }
 };
 RunSkillInlineScriptTool = __decorateClass([
@@ -142,5 +191,6 @@ RunSkillInlineScriptTool = __decorateClass([
 ], RunSkillInlineScriptTool);
 // Annotate the CommonJS export names for ESM import in node:
 0 && (module.exports = {
+  RunSkillInlineScriptErrorCode,
   RunSkillInlineScriptTool
 });

package/dist/cjs/tools/skill/skill_toolset.js

@@ -80,9 +80,11 @@ let SkillToolset = class extends import_base_toolset.BaseToolset {
       new import_list_skills_tool.ListSkillsTool(this),
       new import_load_skill_tool.LoadSkillTool(this),
       new import_load_skill_resource_tool.LoadSkillResourceTool(this),
-      new import_run_skill_script_tool.RunSkillScriptTool(this),
-      new import_run_skill_inline_script_tool.RunSkillInlineScriptTool(this)
+      new import_run_skill_script_tool.RunSkillScriptTool(this)
     ];
+    if (options.allowInlineScripts) {
+      this.tools.push(new import_run_skill_inline_script_tool.RunSkillInlineScriptTool(this));
+    }
     if (this.registry) {
       this.tools.push(new import_search_skills_tool.SearchSkillsTool(this));
     }

package/dist/cjs/utils/async_hooks_shim.js

@@ -0,0 +1,52 @@
+/**
+  * @license
+  * Copyright 2026 Google LLC
+  * SPDX-License-Identifier: Apache-2.0
+  */
+
+"use strict";
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, { get: all[name], enumerable: true });
+};
+var __copyProps = (to, from, except, desc) => {
+  if (from && typeof from === "object" || typeof from === "function") {
+    for (let key of __getOwnPropNames(from))
+      if (!__hasOwnProp.call(to, key) && key !== except)
+        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
+  }
+  return to;
+};
+var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
+var async_hooks_shim_exports = {};
+__export(async_hooks_shim_exports, {
+  AsyncLocalStorage: () => AsyncLocalStorage
+});
+module.exports = __toCommonJS(async_hooks_shim_exports);
+/**
+ * @license
+ * Copyright 2026 Google LLC
+ * SPDX-License-Identifier: Apache-2.0
+ */
+class AsyncLocalStorage {
+  run(store, callback) {
+    const previous = this.store;
+    this.store = store;
+    try {
+      return callback();
+    } finally {
+      this.store = previous;
+    }
+  }
+  getStore() {
+    return this.store;
+  }
+}
+// Annotate the CommonJS export names for ESM import in node:
+0 && (module.exports = {
+  AsyncLocalStorage
+});

package/dist/cjs/utils/branch_trie.js

@@ -0,0 +1,41 @@
+/**
+  * @license
+  * Copyright 2026 Google LLC
+  * SPDX-License-Identifier: Apache-2.0
+  */
+
+"use strict";
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, { get: all[name], enumerable: true });
+};
+var __copyProps = (to, from, except, desc) => {
+  if (from && typeof from === "object" || typeof from === "function") {
+    for (let key of __getOwnPropNames(from))
+      if (!__hasOwnProp.call(to, key) && key !== except)
+        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
+  }
+  return to;
+};
+var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
+var branch_trie_exports = {};
+__export(branch_trie_exports, {
+  isSegmentPrefix: () => isSegmentPrefix
+});
+module.exports = __toCommonJS(branch_trie_exports);
+/**
+ * @license
+ * Copyright 2026 Google LLC
+ * SPDX-License-Identifier: Apache-2.0
+ */
+function isSegmentPrefix(currentBranch, targetBranch) {
+  return !targetBranch || targetBranch === currentBranch || !!currentBranch && currentBranch.startsWith(`${targetBranch}.`);
+}
+// Annotate the CommonJS export names for ESM import in node:
+0 && (module.exports = {
+  isSegmentPrefix
+});

package/dist/cjs/utils/client_labels.js

@@ -24,9 +24,12 @@ var __copyProps = (to, from, except, desc) => {
 var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
 var client_labels_exports = {};
 __export(client_labels_exports, {
-  getClientLabels: () => getClientLabels
+  getClientLabels: () => getClientLabels,
+  parseUserAgent: () => parseUserAgent,
+  runWithClientLabel: () => runWithClientLabel
 });
 module.exports = __toCommonJS(client_labels_exports);
+var import_node_async_hooks = require("node:async_hooks");
 var import_version = require("../version.js");
 var import_env_aware_utils = require("./env_aware_utils.js");
 /**
@@ -38,19 +41,54 @@ const ADK_LABEL = "google-adk";
 const LANGUAGE_LABEL = "gl-typescript";
 const AGENT_ENGINE_TELEMETRY_TAG = "remote_reasoning_engine";
 const AGENT_ENGINE_TELEMETRY_ENV_VARIABLE_NAME = "GOOGLE_CLOUD_AGENT_ENGINE_ID";
+const clientLabelLocalStorage = new import_node_async_hooks.AsyncLocalStorage();
+const USER_AGENT_PATTERNS = [
+  ["Edge", /(?:Edg|Edge|EdgA)\/([0-9.]+)/i],
+  ["Firefox", /(?:Firefox|FxiOS)\/([0-9.]+)/i],
+  ["Chrome", /(?:Chrome|CriOS)\/([0-9.]+)/i],
+  ["Safari", /Version\/([0-9.]+).*Safari/i]
+];
+function parseUserAgent(userAgent) {
+  if (!userAgent) {
+    return "Browser";
+  }
+  for (const [name, regex] of USER_AGENT_PATTERNS) {
+    const match = userAgent.match(regex);
+    if (match) {
+      return `${name}/${match[1]}`;
+    }
+  }
+  return "Browser";
+}
 function _getDefaultLabels() {
   let frameworkLabel = `${ADK_LABEL}/${import_version.version}`;
   if (!(0, import_env_aware_utils.isBrowser)() && process.env[AGENT_ENGINE_TELEMETRY_ENV_VARIABLE_NAME]) {
     frameworkLabel = `${frameworkLabel}+${AGENT_ENGINE_TELEMETRY_TAG}`;
   }
-  const languageLabel = `${LANGUAGE_LABEL}/${(0, import_env_aware_utils.isBrowser)() ? window.navigator.userAgent : process.version}`;
+  const languageLabelDetail = (0, import_env_aware_utils.isBrowser)() ? (
+    // eslint-disable-next-line no-undef
+    parseUserAgent(window.navigator.userAgent)
+  ) : process.version;
+  const languageLabel = `${LANGUAGE_LABEL}/${languageLabelDetail}`;
   return [frameworkLabel, languageLabel];
 }
+function runWithClientLabel(clientLabel, callback) {
+  if (typeof clientLabel !== "string" || clientLabel.trim() === "") {
+    throw new Error("Client label must be a non-empty string.");
+  }
+  return clientLabelLocalStorage.run(clientLabel, callback);
+}
 function getClientLabels() {
   const labels = _getDefaultLabels();
+  const contextLabel = clientLabelLocalStorage.getStore();
+  if (contextLabel) {
+    labels.push(contextLabel);
+  }
   return labels;
 }
 // Annotate the CommonJS export names for ESM import in node:
 0 && (module.exports = {
-  getClientLabels
+  getClientLabels,
+  parseUserAgent,
+  runWithClientLabel
 });

package/dist/cjs/utils/env_aware_utils.js

@@ -61,7 +61,16 @@ function randomUUID() {
 }
 function base64Encode(data) {
   if (isBrowser()) {
-    return window.btoa(data);
+    let strData = "";
+    if (typeof data === "string") {
+      strData = data;
+    } else {
+      const len = data.byteLength;
+      for (let i = 0; i < len; i++) {
+        strData += String.fromCharCode(data[i]);
+      }
+    }
+    return window.btoa(strData);
   }
   return Buffer.from(data).toString("base64");
 }

package/dist/cjs/utils/streaming_utils.js

@@ -30,7 +30,7 @@ __export(streaming_utils_exports, {
 module.exports = __toCommonJS(streaming_utils_exports);
 var import_genai = require("@google/genai");
 var import_jsonpath_plus = require("jsonpath-plus");
-var import_functions = require("../agents/functions.js");
+var import_event = require("../events/event.js");
 var import_feature_registry = require("../features/feature_registry.js");
 var import_llm_response = require("../models/llm_response.js");
 /**
@@ -127,7 +127,7 @@ class ProgressiveStrategy {
         functionCall: {
           name: this.currentFcName,
           args: JSON.parse(JSON.stringify(this.currentFcArgs)),
-          id: (_a = this.currentFcId) != null ? _a : (0, import_functions.generateClientFunctionCallId)()
+          id: (_a = this.currentFcId) != null ? _a : (0, import_event.generateClientFunctionCallId)()
         }
       };
       if (this.currentThoughtSignature) {
@@ -172,7 +172,7 @@ class ProgressiveStrategy {
     }
     if (fc.partialArgs || fc.willContinue) {
       if (!fc.id && !this.currentFcId) {
-        fc.id = (0, import_functions.generateClientFunctionCallId)();
+        fc.id = (0, import_event.generateClientFunctionCallId)();
       }
       if (part.thoughtSignature && !this.currentThoughtSignature) {
         this.currentThoughtSignature = part.thoughtSignature;
@@ -181,7 +181,7 @@ class ProgressiveStrategy {
     } else {
       if (fc.name) {
         if (!fc.id) {
-          fc.id = (0, import_functions.generateClientFunctionCallId)();
+          fc.id = (0, import_event.generateClientFunctionCallId)();
         }
         this.flushTextBufferToSequence();
         this.partsSequence.push(part);
@@ -243,7 +243,7 @@ class NonProgressiveStrategy {
           continue;
         }
         if (part.functionCall && !part.functionCall.id) {
-          part.functionCall.id = (0, import_functions.generateClientFunctionCallId)();
+          part.functionCall.id = (0, import_event.generateClientFunctionCallId)();
         }
         nonTextParts.push(part);
       }
@@ -356,10 +356,16 @@ class StreamingResponseAggregator {
     const candidate = (_b = (_a = this.response) == null ? void 0 : _a.candidates) == null ? void 0 : _b[0];
     const finishReason = (_c = this.finishReason) != null ? _c : candidate == null ? void 0 : candidate.finishReason;
     return {
-      content: {
-        role: "model",
-        parts: finalParts != null ? finalParts : []
-      },
+      // Only attach a model `content` when there are actual parts to emit. When
+      // the turn accumulated no parts (e.g. a function call that was already
+      // flushed, followed by a trailing STOP chunk that carries only usage
+      // metadata) we still surface that trailing metadata, but MUST NOT emit
+      // `content: { parts: [] }`. An empty-parts model turn corrupts the session
+      // history: on the next request the Vertex AI backend rejects the whole
+      // call with HTTP 400 "Unable to submit request because it must include at
+      // least one parts field", which breaks multi-turn tool-using sessions
+      // right after the first tool call (google/adk-js#21, #22).
+      content: finalParts ? { role: "model", parts: finalParts } : void 0,
       groundingMetadata: this.groundingMetadata,
       citationMetadata: this.citationMetadata,
       errorCode: finishReason === import_genai.FinishReason.STOP ? void 0 : finishReason,

package/dist/cjs/utils/task.js

@@ -0,0 +1,62 @@
+/**
+  * @license
+  * Copyright 2026 Google LLC
+  * SPDX-License-Identifier: Apache-2.0
+  */
+
+"use strict";
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, { get: all[name], enumerable: true });
+};
+var __copyProps = (to, from, except, desc) => {
+  if (from && typeof from === "object" || typeof from === "function") {
+    for (let key of __getOwnPropNames(from))
+      if (!__hasOwnProp.call(to, key) && key !== except)
+        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
+  }
+  return to;
+};
+var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
+var task_exports = {};
+__export(task_exports, {
+  Task: () => Task
+});
+module.exports = __toCommonJS(task_exports);
+/**
+ * @license
+ * Copyright 2026 Google LLC
+ * SPDX-License-Identifier: Apache-2.0
+ */
+class Task {
+  constructor(executable) {
+    this.executable = executable;
+    this.isDone = false;
+    this.abortController = new AbortController();
+    const markDone = () => {
+      this.isDone = true;
+    };
+    this.promise = executable(this.abortController.signal);
+    this.promise.then(markDone).catch(markDone);
+  }
+  /**
+   * Cancels the task execution.
+   */
+  cancel() {
+    this.abortController.abort();
+  }
+  /**
+   * Returns true if the task has completed (either resolved or rejected).
+   */
+  done() {
+    return this.isDone;
+  }
+}
+// Annotate the CommonJS export names for ESM import in node:
+0 && (module.exports = {
+  Task
+});

package/dist/cjs/version.js

@@ -32,7 +32,7 @@ module.exports = __toCommonJS(version_exports);
  * Copyright 2025 Google LLC
  * SPDX-License-Identifier: Apache-2.0
  */
-const version = "1.3.0";
+const version = "1.5.0";
 // Annotate the CommonJS export names for ESM import in node:
 0 && (module.exports = {
   version

package/dist/esm/a2a/agent_to_a2a.js

@@ -16,10 +16,26 @@ import {
 import express from "express";
 import { StreamingMode } from "../agents/run_config.js";
 import { InMemorySessionService } from "../sessions/in_memory_session_service.js";
+import { logger } from "../utils/logger.js";
 import { getA2AAgentCard, resolveAgentCard } from "./agent_card.js";
 import { A2AAgentExecutor } from "./agent_executor.js";
+function resolveA2aUserBuilder(options) {
+  if (options.authentication) {
+    return options.authentication;
+  }
+  if (options.allowUnauthenticated === true) {
+    logger.warn(
+      "SECURITY WARNING: Mounting the A2A server WITHOUT authentication because `allowUnauthenticated: true` was set. The agent and all of its tools are exposed to any network-reachable caller, which can invoke them with arbitrary input and read the output. Do NOT use this outside of local, trusted development."
+    );
+    return UserBuilder.noAuthentication;
+  }
+  throw new Error(
+    "toA2a: refusing to mount the A2A server without authentication. The A2A surface lets any network-reachable caller invoke this agent and its tools with arbitrary input and read the output, so it must be authenticated. Provide `authentication` (a UserBuilder that validates the request, e.g. a bearer token or OIDC credential) or, only for local/trusted development, explicitly set `allowUnauthenticated: true`."
+  );
+}
 async function toA2a(agent, options = {}) {
   var _a, _b, _c, _d;
+  const userBuilder = resolveA2aUserBuilder(options);
   const host = (_a = options.host) != null ? _a : "localhost";
   const port = (_b = options.port) != null ? _b : 8e3;
   const protocol = (_c = options.protocol) != null ? _c : "http";
@@ -65,14 +81,14 @@ async function toA2a(agent, options = {}) {
     `${basePath}/rest`,
     restHandler({
       requestHandler,
-      userBuilder: UserBuilder.noAuthentication
+      userBuilder
     })
   );
   app.use(
     `${basePath}/jsonrpc`,
     jsonRpcHandler({
       requestHandler,
-      userBuilder: UserBuilder.noAuthentication
+      userBuilder
     })
   );
   return app;

package/dist/esm/a2a/event_converter_utils.js

@@ -58,13 +58,14 @@ function toAdkEvent(event, invocationId, agentName) {
   }
   return void 0;
 }
-function messageToAdkEvent(msg, invocationId, agentName, parentEvent) {
+function messageToAdkEvent(msg, invocationId, agentName) {
   const parts = toGenAIParts(msg.parts);
+  const content = parts.length === 0 ? void 0 : msg.role === MessageRole.USER ? createUserContent(parts) : createModelContent(parts);
   return {
-    ...createAdkEventFromMetadata(parentEvent || msg),
+    ...createAdkEventFromMetadata(msg),
     invocationId,
     author: msg.role === MessageRole.USER ? MessageRole.USER : agentName,
-    content: msg.role === MessageRole.USER ? createUserContent(parts) : createModelContent(parts),
+    content,
     turnComplete: true,
     partial: false
   };
@@ -110,6 +111,9 @@ function taskStatusUpdateToAdkEvent(a2aEvent, invocationId, agentName) {
     return void 0;
   }
   const parts = toGenAIParts(msg.parts);
+  if (parts.length === 0) {
+    return void 0;
+  }
   return {
     ...createAdkEventFromMetadata(a2aEvent),
     invocationId,
@@ -140,7 +144,7 @@ function taskToAdkEvent(a2aTask, invocationId, agentName) {
   }
   const isTerminal = isTerminalTaskStatusUpdateEvent(a2aTask) || isInputRequiredTaskStatusUpdateEvent(a2aTask);
   const isFailed = isFailedTaskStatusUpdateEvent(a2aTask);
-  if (parts.length === 0 && !isTerminal) {
+  if (parts.length === 0 && !isFailed) {
     return void 0;
   }
   return {

package/dist/esm/a2a/metadata_converter_utils.js

@@ -56,7 +56,7 @@ function getA2AEventMetadata(adkEvent, {
     [A2AMetadataKeys.INVOCATION_ID]: adkEvent.invocationId,
     [A2AMetadataKeys.AUTHOR]: adkEvent.author,
     [A2AMetadataKeys.BRANCH]: adkEvent.branch,
-    [A2AMetadataKeys.ERROR_CODE]: adkEvent.errorMessage,
+    [A2AMetadataKeys.ERROR_CODE]: adkEvent.errorCode,
     [A2AMetadataKeys.ERROR_MESSAGE]: adkEvent.errorMessage,
     [A2AMetadataKeys.CITATION_METADATA]: adkEvent.citationMetadata,
     [A2AMetadataKeys.GROUNDING_METADATA]: adkEvent.groundingMetadata,

package/dist/esm/agents/active_streaming_tool.js

@@ -5,9 +5,14 @@ const require = topLevelCreateRequire(import.meta.url);
  * Copyright 2025 Google LLC
  * SPDX-License-Identifier: Apache-2.0
  */
+import { Task } from "../utils/task.js";
 class ActiveStreamingTool {
   constructor(params = {}) {
-    this.task = params.task;
+    if (params.task instanceof Promise) {
+      this.task = new Task(() => params.task);
+    } else {
+      this.task = params.task;
+    }
     this.stream = params.stream;
   }
 }