@google/adk 1.4.0 → 1.6.0

package/dist/types/a2a/a2a_remote_agent.d.ts

@@ -68,8 +68,12 @@ export interface RemoteA2AAgentConfig extends BaseAgentConfig {
 }
 /**
  * RemoteA2AAgent delegates execution to a remote agent using the A2A protocol.
+ *
+ * @remarks
+ * A cloned `RemoteA2AAgent` (via {@link BaseAgent.clone}) is a fresh,
+ * uninitialized instance that re-resolves its client and card on first use.
  */
-export declare class RemoteA2AAgent extends BaseAgent {
+export declare class RemoteA2AAgent extends BaseAgent<RemoteA2AAgentConfig> {
     private readonly a2aConfig;
     private client?;
     private card?;

package/dist/types/a2a/agent_to_a2a.d.ts

@@ -4,12 +4,25 @@
  * SPDX-License-Identifier: Apache-2.0
  */
 import { AgentCard } from '@a2a-js/sdk';
+import { UserBuilder } from '@a2a-js/sdk/server/express';
 import express from 'express';
 import { BaseAgent } from '../agents/base_agent.js';
 import { BaseArtifactService } from '../artifacts/base_artifact_service.js';
 import { BaseMemoryService } from '../memory/base_memory_service.js';
 import { Runner } from '../runner/runner.js';
 import { BaseSessionService } from '../sessions/base_session_service.js';
+/**
+ * A request authenticator for the A2A surface.
+ *
+ * This is the `UserBuilder` hook from `@a2a-js/sdk`: an async function that
+ * receives the incoming Express request, validates its credentials (for
+ * example a bearer token or an OIDC ID token) and resolves to the
+ * authenticated `User`. Implementations should reject unauthenticated
+ * requests by throwing (or by resolving to a user whose `isAuthenticated` is
+ * `false`), which prevents the underlying agent and its tools from being
+ * invoked by anonymous callers.
+ */
+export type A2aUserBuilder = UserBuilder;
 /**
  * Options for the `toA2a` function.
  */
@@ -34,6 +47,31 @@ export interface ToA2aOptions {
     artifactService?: BaseArtifactService;
     /** Optional existing express application */
     app?: express.Application;
+    /**
+     * Authenticator used to validate incoming A2A requests.
+     *
+     * A2A is the production-intended inter-agent surface: any network-reachable
+     * caller that can reach it can invoke the agent and its tools with arbitrary
+     * input and read the output. Provide a `UserBuilder` (from
+     * `@a2a-js/sdk/server/express`) that validates the request's credentials —
+     * for example a bearer token or an OIDC ID token — and it will be wired into
+     * both the REST and JSON-RPC handlers.
+     *
+     * When omitted, `toA2a` fails closed and throws unless
+     * {@link ToA2aOptions.allowUnauthenticated} is explicitly set to `true`.
+     */
+    authentication?: A2aUserBuilder;
+    /**
+     * Explicit escape hatch to mount the A2A surface WITHOUT authentication.
+     *
+     * This is intentionally insecure and must only be used for local, trusted
+     * development where the surface is not network reachable. When set to
+     * `true` (and no {@link ToA2aOptions.authentication} is provided), a loud
+     * warning is logged and the handlers are mounted with no authentication.
+     *
+     * Defaults to `false`, which makes `toA2a` fail closed.
+     */
+    allowUnauthenticated?: boolean;
 }
 /**
  * Converts an ADK agent to an Express application with A2A handlers.

package/dist/types/a2a/auth.d.ts

@@ -0,0 +1,30 @@
+/**
+ * @license
+ * Copyright 2026 Google LLC
+ * SPDX-License-Identifier: Apache-2.0
+ */
+import { A2aUserBuilder } from './agent_to_a2a.js';
+/**
+ * Builds an {@link A2aUserBuilder} that authenticates A2A requests against a
+ * shared bearer token.
+ *
+ * Callers must send `Authorization: Bearer <token>`; the credential is
+ * compared against `token` in constant time, and a request with a missing,
+ * malformed or incorrect one is rejected before the agent or any of its tools
+ * is invoked. Serve the surface over HTTPS, or the secret travels in clear
+ * text on every call.
+ *
+ * ```ts
+ * toA2a(agent, {authentication: bearerTokenUserBuilder(process.env.MY_TOKEN)});
+ * ```
+ *
+ * A rejected request surfaces as whatever the `@a2a-js/sdk` handler produces
+ * for a failing `UserBuilder`, which is an HTTP 500 rather than a 401. The
+ * guarantee here is that the agent is never reached, not that the caller gets
+ * a particular status code.
+ *
+ * @param token The shared secret callers must present; surrounding whitespace
+ *   is trimmed, because HTTP strips it from header values anyway.
+ * @throws If `token` is empty or contains only whitespace.
+ */
+export declare function bearerTokenUserBuilder(token: string): A2aUserBuilder;

package/dist/types/a2a/event_converter_utils.d.ts

@@ -27,7 +27,10 @@ export declare function toA2AMessage(event: AdkEvent, { appName, userId, session
  *   status update).
  * @param invocationId - The ADK invocation ID to attach to the resulting event.
  * @param agentName - The name of the agent to use as the event author.
+ * @param branch - The local invocation's branch to attach to the resulting
+ *   event. Must come from the caller's own `InvocationContext`, never from
+ *   the A2A peer: see the comment on `createAdkEventFromMetadata` for why.
  * @returns The converted ADK event, or `undefined` if the A2A event type
  *   produces no content.
  */
-export declare function toAdkEvent(event: A2AEvent, invocationId: string, agentName: string): AdkEvent | undefined;
+export declare function toAdkEvent(event: A2AEvent, invocationId: string, agentName: string, branch?: string): AdkEvent | undefined;

package/dist/types/agents/base_agent.d.ts

@@ -45,12 +45,25 @@ declare const BASE_AGENT_SIGNATURE_SYMBOL: unique symbol;
 export declare function isBaseAgent(obj: unknown): obj is BaseAgent;
 /**
  * Base class for all agents in Agent Development Kit.
+ *
+ * The class is generic over its config type so that {@link clone} can be typed
+ * per subclass (e.g. `LlmAgent.clone({instruction})`). The default keeps bare
+ * `BaseAgent` references valid as `BaseAgent<BaseAgentConfig>`.
  */
-export declare abstract class BaseAgent {
+export declare abstract class BaseAgent<TConfig extends BaseAgentConfig = BaseAgentConfig> {
     /**
      * A unique symbol to identify ADK agent classes.
      */
     readonly [BASE_AGENT_SIGNATURE_SYMBOL] = true;
+    /**
+     * The config this agent was constructed from.
+     *
+     * Stored so {@link clone} can rebuild the agent by re-running the concrete
+     * constructor with overrides applied, which re-derives all state correctly
+     * instead of copying an already-mutated instance. Shallow-copied so later
+     * external mutation of the caller's object does not leak into clones.
+     */
+    protected readonly config: TConfig;
     /**
      * The agent's name.
      * Agent name must be a JS identifier and unique within the agent tree.
@@ -112,6 +125,21 @@ export declare abstract class BaseAgent {
      */
     readonly afterAgentCallback: SingleAgentCallback[];
     constructor(config: BaseAgentConfig);
+    /**
+     * Creates a copy of this agent with the given config fields overridden.
+     *
+     * Mirrors adk-python's `BaseAgent.clone(update=...)`. The clone is a detached
+     * root: its `parentAgent` is always `undefined`. Sub-agents are recursively
+     * cloned (and re-parented to the clone) unless `subAgents` is overridden.
+     * Rebuilding via the concrete constructor re-derives all state, so a cloned
+     * `LlmAgent` gets a fresh `requestProcessors` array rather than sharing the
+     * original's. See google/adk-js#534.
+     *
+     * @param overrides Config fields to override on the clone. Overriding
+     *     `parentAgent` is rejected, matching adk-python.
+     * @returns A new detached agent instance of the same concrete class.
+     */
+    clone(overrides?: Partial<TConfig>): this;
     /**
      * Entry method to run an agent via text-based conversation.
      *

package/dist/types/agents/functions.d.ts

@@ -9,7 +9,7 @@ import { Event } from '../events/event.js';
 import { BaseTool } from '../tools/base_tool.js';
 import { ToolConfirmation } from '../tools/tool_confirmation.js';
 import { SingleAfterToolCallback, SingleBeforeToolCallback } from './llm_agent.js';
-export declare const AF_FUNCTION_CALL_ID_PREFIX = "adk-";
+export { AF_FUNCTION_CALL_ID_PREFIX, generateClientFunctionCallId, populateClientFunctionCallId, } from '../events/event.js';
 export declare const REQUEST_EUC_FUNCTION_CALL_NAME = "adk_request_credential";
 export declare const REQUEST_CONFIRMATION_FUNCTION_CALL_NAME = "adk_request_confirmation";
 export declare const functionsExportedForTestingOnly: {
@@ -17,14 +17,6 @@ export declare const functionsExportedForTestingOnly: {
     generateAuthEvent: typeof generateAuthEvent;
     generateRequestConfirmationEvent: typeof generateRequestConfirmationEvent;
 };
-export declare function generateClientFunctionCallId(): string;
-/**
- * Populates client-side function call IDs.
- *
- * It iterates through all function calls in the event and assigns a
- * unique client-side ID to each one that doesn't already have an ID.
- */
-export declare function populateClientFunctionCallId(modelResponseEvent: Event): void;
 /**
  * Returns a set of function call ids of the long running tools.
  */

package/dist/types/agents/llm_agent.d.ts

@@ -130,6 +130,8 @@ export interface LlmAgentConfig extends BaseAgentConfig {
      *
      * For example: use globalInstruction to make all agents have a stable
      * identity or personality.
+     *
+     * @deprecated Use GlobalInstructionPlugin instead.
      */
     globalInstruction?: string | InstructionProvider;
     /** Tools available to this agent. */
@@ -224,11 +226,12 @@ export declare function isLlmAgent(obj: unknown): obj is LlmAgent;
 /**
  * An agent that uses a large language model to generate responses.
  */
-export declare class LlmAgent extends BaseAgent {
+export declare class LlmAgent extends BaseAgent<LlmAgentConfig> {
     /** A unique symbol to identify ADK LLM agent class. */
     readonly [LLM_AGENT_SIGNATURE_SYMBOL] = true;
     model?: string | BaseLlm;
     instruction: string | InstructionProvider;
+    /** @deprecated Use GlobalInstructionPlugin instead. */
     globalInstruction: string | InstructionProvider;
     tools: ToolUnion[];
     generateContentConfig?: GenerateContentConfig;
@@ -270,6 +273,7 @@ export declare class LlmAgent extends BaseAgent {
      * This method is only for use by Agent Development Kit.
      * @param context The context to retrieve the session state.
      * @returns The resolved globalInstruction field.
+     * @deprecated Use GlobalInstructionPlugin instead.
      */
     canonicalGlobalInstruction(context: ReadonlyContext): Promise<{
         instruction: string;

package/dist/types/agents/loop_agent.d.ts

@@ -34,7 +34,7 @@ export declare function isLoopAgent(obj: unknown): obj is LoopAgent;
  * When sub-agent generates an event with escalate or max_iterations are
  * reached, the loop agent will stop.
  */
-export declare class LoopAgent extends BaseAgent {
+export declare class LoopAgent extends BaseAgent<LoopAgentConfig> {
     /**
      * A unique symbol to identify ADK loop agent class.
      */
@@ -42,6 +42,6 @@ export declare class LoopAgent extends BaseAgent {
     readonly maxIterations: number;
     constructor(config: LoopAgentConfig);
     protected runAsyncImpl(context: InvocationContext): AsyncGenerator<Event, void, void>;
-    protected runLiveImpl(_context: InvocationContext): AsyncGenerator<Event, void, void>;
+    protected runLiveImpl(context: InvocationContext): AsyncGenerator<Event, void, void>;
 }
 export {};

package/dist/types/agents/routed_agent.d.ts

@@ -41,12 +41,35 @@ export interface RoutedAgentConfig extends BaseAgentConfig {
 /**
  * A BaseAgent implementation that delegates to one of multiple agents based on a router function.
  * Routing is strictly limited to the agents passed in the config.
+ *
+ * @remarks
+ * Cloning is supported: {@link RoutedAgent.clone} deep-clones the routing
+ * targets from `config.agents` and re-parents the fresh copies onto the clone,
+ * so the clone is a detached root that routes identically to the original while
+ * leaving the original agent tree untouched.
  */
-export declare class RoutedAgent extends BaseAgent {
+export declare class RoutedAgent extends BaseAgent<RoutedAgentConfig> {
     readonly [ROUTED_AGENT_SIGNATURE_SYMBOL] = true;
     private readonly agents;
     private readonly router;
     constructor(config: RoutedAgentConfig);
+    /**
+     * Creates a detached copy of this routed agent.
+     *
+     * The inherited {@link BaseAgent.clone} only deep-clones `subAgents`, but a
+     * `RoutedAgent` derives its routing targets from `config.agents`. Rebuilding
+     * through the base clone alone would re-read the already-parented original
+     * agents and throw "already has a parent agent". This override deep-clones the
+     * routing targets (unless the caller overrides `agents`) so the rebuilt
+     * constructor re-parents fresh, detached copies. The array-vs-record shape
+     * and, for records, the keys are preserved so the router keeps selecting the
+     * same targets.
+     *
+     * @param overrides Config fields to override on the clone. Overriding
+     *     `parentAgent` is rejected by the base implementation.
+     * @returns A new detached `RoutedAgent` of the same concrete class.
+     */
+    clone(overrides?: Partial<RoutedAgentConfig>): this;
     /**
      * Runs the selected agent via text-based conversation.
      */

package/dist/types/agents/run_config.d.ts

@@ -94,6 +94,7 @@ export interface RunConfig {
  * @throws {Error} When `params.maxLlmCalls` exceeds `Number.MAX_SAFE_INTEGER`.
  */
 export declare function createRunConfig(params?: Partial<RunConfig>): {
+    maxLlmCalls: number;
     speechConfig?: SpeechConfig | undefined;
     responseModalities?: Modality[] | undefined;
     saveInputBlobsAsArtifacts: boolean;
@@ -104,6 +105,5 @@ export declare function createRunConfig(params?: Partial<RunConfig>): {
     enableAffectiveDialog: boolean;
     proactivity?: ProactivityConfig | undefined;
     realtimeInputConfig?: RealtimeInputConfig | undefined;
-    maxLlmCalls: number;
     pauseOnToolCalls: boolean;
 };

package/dist/types/auth/credential_service/in_memory_credential_service.d.ts

@@ -12,6 +12,17 @@ import { BaseCredentialService } from './base_credential_service.js';
  * implementation of credential service
  */
 export declare class InMemoryCredentialService implements BaseCredentialService {
+    /**
+     * A map from app name to a map from user ID to a map from credential key to
+     * credential.
+     *
+     * `appName`, `userId` and `credentialKey` are all attacker-influenced, so
+     * every level is created with `Object.create(null)`. On an ordinary `{}`
+     * literal a key of `__proto__` resolves to the inherited `__proto__`
+     * accessor rather than creating an own property, so nested assignment
+     * pollutes every object in the process, and a lookup of an inherited key
+     * such as `toString` returns a function instead of `undefined`.
+     */
     private readonly credentials;
     loadCredential(authConfig: AuthConfig, toolContext: Context): Promise<AuthCredential | undefined>;
     saveCredential(authConfig: AuthConfig, toolContext: Context): Promise<void>;

package/dist/types/code_executors/unsafe_local_code_executor.d.ts

@@ -23,6 +23,10 @@ export interface UnsafeLocalCodeExecutorOptions {
     pythonCommandPath?: string;
     /**
      * The command to run Shell code. Default is `bash`.
+     *
+     * When it names `powershell` or `pwsh` (with or without `.exe`) the script
+     * is written as `.ps1` and run through PowerShell rather than as a bare
+     * shell script.
      */
     shellCommandPath?: string;
 }
@@ -33,7 +37,7 @@ export interface UnsafeLocalCodeExecutorOptions {
  * **Execution Details**:
  * - **JavaScript**: Executed via `node` (defaults to `process.execPath`).
  * - **Python**: Executed via `python3` on Unix, and `python` on Windows.
- * - **Shell**: Executed via `bash` on Unix, and defaults to `powershell` (injecting ExecutionPolicy Bypass) or `cmd.exe` on Windows.
+ * - **Shell**: Executed via `bash` on Unix, and defaults to `powershell` (injecting `-NoProfile` and `-ExecutionPolicy Bypass`) or `cmd.exe` (injecting `/D`) on Windows.
  *
  * WARNING: This executor runs code in the local environment without sandboxing or security restrictions.
  * Use with caution and only for trusted code.

package/dist/types/common.d.ts

@@ -58,6 +58,8 @@ export type { ExecuteCodeParams } from './code_executors/base_code_executor.js';
 export { BuiltInCodeExecutor } from './code_executors/built_in_code_executor.js';
 export { CodeExecutionLanguage, FileContentEncoding, type CodeExecutionInput, type CodeExecutionResult, type File, } from './code_executors/code_execution_utils.js';
 export { AgentControlledContextCompactor } from './context/agent_controlled_context_compactor.js';
+export { AnchoredContextCompactor } from './context/anchored_context_compactor.js';
+export type { AnchoredContextCompactorOptions } from './context/anchored_context_compactor.js';
 export type { BaseContextCompactor } from './context/base_context_compactor.js';
 export type { BaseSummarizer } from './context/summarizers/base_summarizer.js';
 export { LlmSummarizer } from './context/summarizers/llm_summarizer.js';
@@ -68,9 +70,9 @@ export { TrajectoryThoughtPruningCompactor } from './context/trajectory_thought_
 export type { TrajectoryThoughtPruningCompactorOptions } from './context/trajectory_thought_pruning_compactor.js';
 export { TruncatingContextCompactor } from './context/truncating_context_compactor.js';
 export type { TruncatingContextCompactorOptions } from './context/truncating_context_compactor.js';
-export { isCompactedEvent } from './events/compacted_event.js';
+export { isCompactedEvent, isScratchpadEvent } from './events/compacted_event.js';
 export type { CompactedEvent } from './events/compacted_event.js';
-export { createEvent, getFunctionCalls, getFunctionResponses, hasTrailingCodeExecutionResult, isFinalResponse, stringifyContent, } from './events/event.js';
+export { createEvent, generateClientFunctionCallId, getFunctionCalls, getFunctionResponses, hasThoughts, hasTrailingCodeExecutionResult, isFinalResponse, populateClientFunctionCallId, pruneThoughts, stringifyContent, } from './events/event.js';
 export type { Event } from './events/event.js';
 export { createEventActions } from './events/event_actions.js';
 export type { EventActions } from './events/event_actions.js';
@@ -96,6 +98,7 @@ export type { BaseLlmType } from './models/registry.js';
 export { RoutedLlm } from './models/routed_llm.js';
 export type { LlmRouter } from './models/routed_llm.js';
 export { BasePlugin, ContextCompactionTrigger } from './plugins/base_plugin.js';
+export { GlobalInstructionPlugin } from './plugins/global_instruction_plugin.js';
 export { LoggingPlugin } from './plugins/logging_plugin.js';
 export { PluginManager } from './plugins/plugin_manager.js';
 export { InMemoryPolicyEngine, PolicyOutcome, REQUEST_CONFIRMATION_FUNCTION_CALL_NAME, SecurityPlugin, getAskUserConfirmationFunctionCalls, } from './plugins/security_plugin.js';
@@ -116,15 +119,21 @@ export type { BaseToolParams, RunAsyncToolRequest, ToolProcessLlmRequest, } from
 export { BaseToolset, isBaseToolset } from './tools/base_toolset.js';
 export type { ToolPredicate } from './tools/base_toolset.js';
 export { ConsolidateContextTool } from './tools/consolidate_context_tool.js';
+export { ENTERPRISE_WEB_SEARCH, EnterpriseWebSearchTool, } from './tools/enterprise_web_search_tool.js';
+export { ExampleTool } from './tools/example_tool.js';
 export { EXIT_LOOP, ExitLoopTool } from './tools/exit_loop_tool.js';
 export { FunctionTool, isFunctionTool } from './tools/function_tool.js';
 export type { ToolExecuteArgument, ToolExecuteFunction, ToolInputParameters, ToolOptions, } from './tools/function_tool.js';
+export { getUserChoiceTool } from './tools/get_user_choice_tool.js';
 export { GOOGLE_MAPS_GROUNDING, GoogleMapsGroundingTool, } from './tools/google_maps_grounding_tool.js';
 export { GOOGLE_SEARCH, GoogleSearchTool } from './tools/google_search_tool.js';
 export { LOAD_ARTIFACTS, LoadArtifactsTool, } from './tools/load_artifacts_tool.js';
 export { LOAD_MEMORY, LoadMemoryTool } from './tools/load_memory_tool.js';
+export { LOAD_WEB_PAGE, loadWebPage } from './tools/load_web_page.js';
+export type { LoadWebPageOptions } from './tools/load_web_page.js';
 export { LongRunningFunctionTool } from './tools/long_running_tool.js';
 export { PRELOAD_MEMORY, PreloadMemoryTool, } from './tools/preload_memory_tool.js';
+export { requestInputTool } from './tools/request_input_tool.js';
 export { ToolConfirmation } from './tools/tool_confirmation.js';
 export { URL_CONTEXT, UrlContextTool } from './tools/url_context_tool.js';
 export { VertexAiSearchTool } from './tools/vertex_ai_search_tool.js';

package/dist/types/context/agent_controlled_context_compactor.d.ts

@@ -20,5 +20,4 @@ export declare class AgentControlledContextCompactor implements BaseContextCompa
     shouldCompact(invocationContext: InvocationContext): boolean;
     compact(invocationContext: InvocationContext): Promise<void>;
     private clearFlags;
-    private getActiveEvents;
 }

package/dist/types/context/anchored_context_compactor.d.ts

@@ -0,0 +1,35 @@
+/**
+ * @license
+ * Copyright 2026 Google LLC
+ * SPDX-License-Identifier: Apache-2.0
+ */
+import { InvocationContext } from '../agents/invocation_context.js';
+import { BaseContextCompactor } from './base_context_compactor.js';
+import { BaseSummarizer } from './summarizers/base_summarizer.js';
+export interface AnchoredContextCompactorOptions {
+    /** The maximum number of tokens to retain in the session history before compaction. */
+    tokenThreshold: number;
+    /**
+     * The minimum number of raw events to keep at the end of the session.
+     * Compaction will not affect these tail events (unless needed for tool splits).
+     */
+    eventRetentionSize: number;
+    /** The summarizer used to create the compacted event content. */
+    summarizer: BaseSummarizer;
+}
+/**
+ * A context compactor that maintains a single persistent 'Scratchpad' or
+ * 'State Tracker' event at the top of the context history.
+ *
+ * When compaction is triggered, it merges new raw events into the existing
+ * Scratchpad event and discards them from the active history view.
+ */
+export declare class AnchoredContextCompactor implements BaseContextCompactor {
+    private readonly tokenThreshold;
+    private readonly eventRetentionSize;
+    private readonly summarizer;
+    constructor(options: AnchoredContextCompactorOptions);
+    private getActiveEvents;
+    shouldCompact(invocationContext: InvocationContext): boolean | Promise<boolean>;
+    compact(invocationContext: InvocationContext): Promise<void>;
+}

package/dist/types/context/compaction_utils.d.ts

@@ -0,0 +1,23 @@
+/**
+ * @license
+ * Copyright 2026 Google LLC
+ * SPDX-License-Identifier: Apache-2.0
+ */
+import { Event } from '../events/event.js';
+/**
+ * Filters the events to return only the active events since the latest compaction.
+ * If no compaction has occurred, returns all events.
+ *
+ * @param events The full history of events.
+ * @returns The active events, starting with the latest CompactedEvent if present.
+ */
+export declare function getActiveEvents(events: Event[]): Event[];
+/**
+ * Determines the baseline index to retain from active raw events,
+ * ensuring we don't split between a function call and its response.
+ *
+ * @param rawEvents The active raw events to consider for compaction.
+ * @param eventRetentionSize The minimum number of raw events to keep at the end of the session.
+ * @returns The index in `rawEvents` at which to split. Events before this index will be compacted.
+ */
+export declare function calculateRetainStartIndex(rawEvents: Event[], eventRetentionSize: number): number;

package/dist/types/context/token_based_context_compactor.d.ts

@@ -32,7 +32,6 @@ export declare class TokenBasedContextCompactor implements BaseContextCompactor
     private readonly eventRetentionSize;
     private readonly summarizer;
     constructor(options: TokenBasedContextCompactorOptions);
-    private getActiveEvents;
     shouldCompact(invocationContext: InvocationContext): boolean | Promise<boolean>;
     compact(invocationContext: InvocationContext): Promise<void>;
 }

package/dist/types/events/compacted_event.d.ts

@@ -25,9 +25,19 @@ export interface CompactedEvent extends Event {
      * The summarized content of the compacted events.
      */
     compactedContent: string;
+    /**
+     * Identifies this compacted event as the persistent context scratchpad.
+     */
+    isScratchpad?: boolean;
 }
 /**
  * Type guard to check if an event is a CompactedEvent.
  */
 export declare function isCompactedEvent(event: Event): event is CompactedEvent;
+/**
+ * Type guard to check if an event is a scratchpad CompactedEvent.
+ */
+export declare function isScratchpadEvent(event: Event): event is CompactedEvent & {
+    isScratchpad: true;
+};
 export declare function createCompactedEvent(params?: Partial<CompactedEvent>): CompactedEvent;

package/dist/types/events/event.d.ts

@@ -67,6 +67,15 @@ export declare function isFinalResponse(event: Event): boolean;
  * Returns the function calls in the event.
  */
 export declare function getFunctionCalls(event: Event): FunctionCall[];
+export declare const AF_FUNCTION_CALL_ID_PREFIX = "adk-";
+export declare function generateClientFunctionCallId(): string;
+/**
+ * Populates client-side function call IDs.
+ *
+ * It iterates through all function calls in the event and assigns a
+ * unique client-side ID to each one that doesn't already have an ID.
+ */
+export declare function populateClientFunctionCallId(modelResponseEvent: Event): void;
 /**
  * Returns the function responses in the event.
  */
@@ -82,6 +91,10 @@ export declare function hasTrailingCodeExecutionResult(event: Event): boolean;
  * @returns A single string with the combined text.
  */
 export declare function stringifyContent(event: Event): string;
+/**
+ * Estimates the number of tokens in the event based on usage metadata or characters.
+ */
+export declare function getEventTokens(event: Event): number;
 /**
  * Returns whether the event contains any thought parts.
  */

package/dist/types/index.d.ts

@@ -9,7 +9,8 @@ export { getA2AAgentCard } from './a2a/agent_card.js';
 export { A2AAgentExecutor } from './a2a/agent_executor.js';
 export type { AfterEventCallback, AfterExecuteCallback, AgentExecutorConfig, BeforeExecuteCallback, RunnerOrRunnerConfig, } from './a2a/agent_executor.js';
 export { toA2a } from './a2a/agent_to_a2a.js';
-export type { ToA2aOptions } from './a2a/agent_to_a2a.js';
+export type { A2aUserBuilder, ToA2aOptions } from './a2a/agent_to_a2a.js';
+export { bearerTokenUserBuilder } from './a2a/auth.js';
 export type { ExecutorContext } from './a2a/executor_context.js';
 export { InvocationContext } from './agents/invocation_context.js';
 export { FileArtifactService } from './artifacts/file_artifact_service.js';
@@ -22,13 +23,14 @@ export * from './common.js';
 export { DatabaseSessionService } from './sessions/database_session_service.js';
 export { getSessionServiceFromUri } from './sessions/registry.js';
 export { VertexAiSessionService } from './sessions/vertex_ai_session_service.js';
-export type { VertexAiSessionServiceOptions } from './sessions/vertex_ai_session_service.js';
+export type { VertexAiCreateSessionRequest, VertexAiSessionServiceOptions, } from './sessions/vertex_ai_session_service.js';
 export { loadAllSkillsInDir, loadSkillFromDir, validateSkillDir, } from './skills/loader.js';
-export { RunSkillInlineScriptTool } from './tools/skill/run_skill_inline_script_tool.js';
+export { RunSkillInlineScriptErrorCode, RunSkillInlineScriptTool, } from './tools/skill/run_skill_inline_script_tool.js';
 export { RunSkillScriptTool } from './tools/skill/run_skill_script_tool.js';
 export * from './integrations/agent_registry/agent_registry.js';
 export * from './telemetry/google_cloud.js';
 export * from './telemetry/setup.js';
+export * from './tools/mcp/load_mcp_resource_tool.js';
 export * from './tools/mcp/mcp_session_manager.js';
 export * from './tools/mcp/mcp_tool.js';
 export * from './tools/mcp/mcp_toolset.js';

package/dist/types/memory/in_memory_memory_service.d.ts

@@ -12,6 +12,17 @@ import { BaseMemoryService, SearchMemoryRequest, SearchMemoryResponse } from './
  */
 export declare class InMemoryMemoryService implements BaseMemoryService {
     private readonly memories;
+    /**
+     * A map from user key to a map from session ID to events.
+     *
+     * The inner map is keyed by `session.id`, which arrives off the request path
+     * and contains no `/`, so it can be exactly `__proto__`. On a plain object
+     * literal that key would reach the inherited `__proto__` setter and
+     * re-parent the map instead of creating an own property, silently dropping
+     * the session from the `Object.values` scan in `searchMemory`. The outer key
+     * always contains a `/` (see `getUserKey`) and cannot collide, but is
+     * created the same way for consistency.
+     */
     private readonly sessionEvents;
     addSessionToMemory(session: Session): Promise<void>;
     searchMemory(req: SearchMemoryRequest): Promise<SearchMemoryResponse>;

package/dist/types/plugins/base_plugin.d.ts

@@ -151,8 +151,10 @@ export declare abstract class BasePlugin {
      * @param params.invocationContext The context for the entire invocation.
      * @param params.event The event raised by the runner.
      * @returns An optional value. A non-`undefined` return may be used by the
-     *     framework to modify or replace the response. Returning `undefined`
-     *     allows the original response to be used.
+     *     framework to modify or replace the response. Copy `params.event` when
+     *     constructing a replacement to preserve fields that are not being
+     *     modified, such as event actions. Returning `undefined` allows the
+     *     original response to be used.
      */
     onEventCallback(params: {
         invocationContext: InvocationContext;

package/dist/types/plugins/global_instruction_plugin.d.ts

@@ -0,0 +1,38 @@
+/**
+ * @license
+ * Copyright 2026 Google LLC
+ * SPDX-License-Identifier: Apache-2.0
+ */
+import { Context } from '../agents/context.js';
+import { InstructionProvider } from '../agents/llm_agent.js';
+import { LlmRequest } from '../models/llm_request.js';
+import { LlmResponse } from '../models/llm_response.js';
+import { BasePlugin } from './base_plugin.js';
+/**
+ * Plugin that provides global instructions functionality at the App level.
+ *
+ * This plugin replaces the deprecated globalInstruction field on LlmAgent.
+ * Global instructions are applied to all agents in the application, providing
+ * a consistent way to set application-wide instructions, identity, or
+ * personality.
+ *
+ * The plugin operates through the beforeModelCallback, allowing it to modify
+ * LLM requests before they are sent to the model.
+ */
+export declare class GlobalInstructionPlugin extends BasePlugin {
+    private readonly globalInstruction?;
+    /**
+     * Initializes the GlobalInstructionPlugin.
+     *
+     * @param globalInstruction The instruction to apply globally. Can be a string
+     *     or an InstructionProvider function that takes ReadonlyContext and
+     *     returns a string (sync or async).
+     * @param name The name of the plugin (defaults to 'global_instruction').
+     */
+    constructor(globalInstruction?: string | InstructionProvider, name?: string);
+    beforeModelCallback(params: {
+        callbackContext: Context;
+        llmRequest: LlmRequest;
+    }): Promise<LlmResponse | undefined>;
+    private resolveGlobalInstruction;
+}

package/dist/types/runner/runner.d.ts

@@ -147,7 +147,7 @@ export declare class Runner {
     }): AsyncGenerator<Event, void, undefined>;
     /**
      * Saves artifacts from the message parts and replaces the inline data with
-     * a file name placeholder.
+     * a file name placeholder and optional file reference.
      *
      * @param invocationId The current invocation ID.
      * @param userId The user ID of the session.

package/dist/types/sessions/base_session_service.d.ts

@@ -145,6 +145,14 @@ export declare abstract class BaseSessionService {
 export declare function trimTempDeltaState(event: Event): Event;
 /**
  * Removes temporary state keys from the state.
+ *
+ * The result is a null-prototype map. `state` comes straight off the request
+ * body on a dev server (`POST /apps/:appName/users/:userId/sessions/:sessionId`),
+ * and `JSON.parse` makes `__proto__` an own key, so copying it into a plain
+ * object literal would invoke the inherited `__proto__` setter: the entry is
+ * dropped and the new state object is re-parented onto the attacker's object.
+ * `State.get`/`State.has` use the `in` operator, so every key on that object
+ * would then read back as session state.
  */
 export declare function trimTempState(state: Record<string, unknown>): Record<string, unknown>;
 /**