@google/adk 1.6.0 → 2.1.0

package/dist/cjs/auth/auth_preprocessor.js

@@ -9,6 +9,7 @@ var __defProp = Object.defineProperty;
 var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
 var __getOwnPropNames = Object.getOwnPropertyNames;
 var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __name = (target, value) => __defProp(target, "name", { value, configurable: true });
 var __export = (target, all) => {
   for (var name in all)
     __defProp(target, name, { get: all[name], enumerable: true });
@@ -35,62 +36,66 @@ var import_readonly_context = require("../agents/readonly_context.js");
 var import_event = require("../events/event.js");
 var import_state = require("../sessions/state.js");
 var import_case_utils = require("../utils/case_utils.js");
+var import_logger = require("../utils/logger.js");
 var import_auth_handler = require("./auth_handler.js");
+var import_credential_response_binding = require("./credential_response_binding.js");
 /**
  * @license
  * Copyright 2026 Google LLC
  * SPDX-License-Identifier: Apache-2.0
  */
 const TOOLSET_AUTH_CREDENTIAL_ID_PREFIX = "_adk_toolset_auth_";
-async function storeAuthAndCollectResumeTargets(events, authFcIds, authResponses, state) {
-  const requestedAuthConfigById = {};
+function requestedAuthConfigs(events, authFcIds, agentName) {
+  const requests = /* @__PURE__ */ new Map();
   for (const event of events) {
-    const eventFunctionCalls = (0, import_event.getFunctionCalls)(event);
-    for (const functionCall of eventFunctionCalls) {
-      if (functionCall.id && authFcIds.has(functionCall.id) && functionCall.name === import_functions.REQUEST_EUC_FUNCTION_CALL_NAME) {
-        const args = (0, import_case_utils.camelCaseKeys)(functionCall.args);
-        const authConfig = args == null ? void 0 : args.authConfig;
-        if (authConfig) {
-          requestedAuthConfigById[functionCall.id] = authConfig;
-        }
-      }
+    if (event.author !== agentName) {
+      continue;
     }
-  }
-  for (const fcId of authFcIds) {
-    const authConfig = authResponses[fcId];
-    const requestedAuthConfig = requestedAuthConfigById[fcId];
-    if (requestedAuthConfig && requestedAuthConfig.credentialKey) {
-      authConfig.credentialKey = requestedAuthConfig.credentialKey;
+    for (const functionCall of (0, import_event.getFunctionCalls)(event)) {
+      if (!functionCall.id || !authFcIds.has(functionCall.id) || functionCall.name !== import_functions.REQUEST_CREDENTIAL_FUNCTION_CALL_NAME) {
+        continue;
+      }
+      const args = (0, import_case_utils.camelCaseKeys)(functionCall.args);
+      if (args == null ? void 0 : args.authConfig) {
+        requests.set(functionCall.id, { config: args.authConfig, args });
+      }
     }
-    await new import_auth_handler.AuthHandler(authConfig).parseAndStoreAuthResponse(state);
   }
+  return requests;
+}
+__name(requestedAuthConfigs, "requestedAuthConfigs");
+async function storeAuthAndCollectResumeTargets(events, authFcIds, authResponses, state, agentName) {
+  var _a;
+  const requests = requestedAuthConfigs(events, authFcIds, agentName);
   const toolsToResume = /* @__PURE__ */ new Set();
   for (const fcId of authFcIds) {
-    const requestedAuthConfig = requestedAuthConfigById[fcId];
-    if (!requestedAuthConfig) {
+    const request = requests.get(fcId);
+    if (!request) {
+      import_logger.logger.warn(
+        `Ignoring credential response '${fcId}': no matching request from this agent.`
+      );
       continue;
     }
-    for (const event of events) {
-      const eventFunctionCalls = (0, import_event.getFunctionCalls)(event);
-      for (const functionCall of eventFunctionCalls) {
-        if (functionCall.id === fcId && functionCall.name === import_functions.REQUEST_EUC_FUNCTION_CALL_NAME) {
-          const args = (0, import_case_utils.camelCaseKeys)(
-            functionCall.args
-          );
-          const functionCallId = args == null ? void 0 : args.functionCallId;
-          if (functionCallId) {
-            if (functionCallId.startsWith(TOOLSET_AUTH_CREDENTIAL_ID_PREFIX)) {
-              continue;
-            }
-            toolsToResume.add(functionCallId);
-          }
-        }
-      }
+    const authConfig = (0, import_credential_response_binding.bindCredentialResponse)(
+      request.config,
+      authResponses[fcId]
+    );
+    if (!authConfig) {
+      import_logger.logger.warn(
+        `Ignoring credential response '${fcId}': it carries no credential for the request this agent raised.`
+      );
+      continue;
+    }
+    await new import_auth_handler.AuthHandler(authConfig).parseAndStoreAuthResponse(state);
+    const functionCallId = (_a = request.args) == null ? void 0 : _a.functionCallId;
+    if (functionCallId && !functionCallId.startsWith(TOOLSET_AUTH_CREDENTIAL_ID_PREFIX)) {
+      toolsToResume.add(functionCallId);
     }
   }
   return toolsToResume;
 }
-class AuthPreprocessor extends import_base_llm_processor.BaseLlmRequestProcessor {
+__name(storeAuthAndCollectResumeTargets, "storeAuthAndCollectResumeTargets");
+const _AuthPreprocessor = class _AuthPreprocessor extends import_base_llm_processor.BaseLlmRequestProcessor {
   async *runAsync(invocationContext) {
     const agent = invocationContext.agent;
     if (!(0, import_llm_agent.isLlmAgent)(agent)) {
@@ -118,7 +123,7 @@ class AuthPreprocessor extends import_base_llm_processor.BaseLlmRequestProcessor
     const authFcIds = /* @__PURE__ */ new Set();
     const authResponses = {};
     for (const functionCallResponse of responses) {
-      if (functionCallResponse.name !== import_functions.REQUEST_EUC_FUNCTION_CALL_NAME) {
+      if (functionCallResponse.name !== import_functions.REQUEST_CREDENTIAL_FUNCTION_CALL_NAME) {
         continue;
       }
       if (functionCallResponse.id) {
@@ -134,7 +139,8 @@ class AuthPreprocessor extends import_base_llm_processor.BaseLlmRequestProcessor
       events,
       authFcIds,
       authResponses,
-      state
+      state,
+      agent.name
     );
     if (toolsToResume.size === 0) {
       return;
@@ -171,7 +177,9 @@ class AuthPreprocessor extends import_base_llm_processor.BaseLlmRequestProcessor
       }
     }
   }
-}
+};
+__name(_AuthPreprocessor, "AuthPreprocessor");
+let AuthPreprocessor = _AuthPreprocessor;
 const AUTH_PREPROCESSOR = new AuthPreprocessor();
 // Annotate the CommonJS export names for ESM import in node:
 0 && (module.exports = {

package/dist/cjs/auth/auth_provider_registry.js

@@ -9,6 +9,7 @@ var __defProp = Object.defineProperty;
 var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
 var __getOwnPropNames = Object.getOwnPropertyNames;
 var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __name = (target, value) => __defProp(target, "name", { value, configurable: true });
 var __export = (target, all) => {
   for (var name in all)
     __defProp(target, name, { get: all[name], enumerable: true });
@@ -32,7 +33,7 @@ module.exports = __toCommonJS(auth_provider_registry_exports);
  * Copyright 2026 Google LLC
  * SPDX-License-Identifier: Apache-2.0
  */
-class AuthProviderRegistry {
+const _AuthProviderRegistry = class _AuthProviderRegistry {
   constructor() {
     this.providers = /* @__PURE__ */ new Map();
   }
@@ -54,7 +55,9 @@ class AuthProviderRegistry {
   getProvider(authScheme) {
     return this.providers.get(authScheme.type);
   }
-}
+};
+__name(_AuthProviderRegistry, "AuthProviderRegistry");
+let AuthProviderRegistry = _AuthProviderRegistry;
 // Annotate the CommonJS export names for ESM import in node:
 0 && (module.exports = {
   AuthProviderRegistry

package/dist/cjs/auth/auth_schemes.js

@@ -9,6 +9,7 @@ var __defProp = Object.defineProperty;
 var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
 var __getOwnPropNames = Object.getOwnPropertyNames;
 var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __name = (target, value) => __defProp(target, "name", { value, configurable: true });
 var __export = (target, all) => {
   for (var name in all)
     __defProp(target, name, { get: all[name], enumerable: true });
@@ -55,6 +56,7 @@ function getOAuthGrantTypeFromFlow(flow) {
   }
   return void 0;
 }
+__name(getOAuthGrantTypeFromFlow, "getOAuthGrantTypeFromFlow");
 // Annotate the CommonJS export names for ESM import in node:
 0 && (module.exports = {
   OAuthGrantType,

package/dist/cjs/auth/credential_response_binding.js

@@ -0,0 +1,101 @@
+/**
+  * @license
+  * Copyright 2026 Google LLC
+  * SPDX-License-Identifier: Apache-2.0
+  */
+
+"use strict";
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __name = (target, value) => __defProp(target, "name", { value, configurable: true });
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, { get: all[name], enumerable: true });
+};
+var __copyProps = (to, from, except, desc) => {
+  if (from && typeof from === "object" || typeof from === "function") {
+    for (let key of __getOwnPropNames(from))
+      if (!__hasOwnProp.call(to, key) && key !== except)
+        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
+  }
+  return to;
+};
+var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
+var credential_response_binding_exports = {};
+__export(credential_response_binding_exports, {
+  bindCredentialResponse: () => bindCredentialResponse
+});
+module.exports = __toCommonJS(credential_response_binding_exports);
+/**
+ * @license
+ * Copyright 2026 Google LLC
+ * SPDX-License-Identifier: Apache-2.0
+ */
+function readField(source, name) {
+  if (typeof source !== "object" || source === null) {
+    return void 0;
+  }
+  const record = source;
+  if (name in record) {
+    return record[name];
+  }
+  return record[name.replace(/[A-Z]/g, (c) => `_${c.toLowerCase()}`)];
+}
+__name(readField, "readField");
+function readString(source, name) {
+  const value = readField(source, name);
+  return typeof value === "string" ? value : void 0;
+}
+__name(readString, "readString");
+function bindCredential(request, supplied) {
+  var _a;
+  const requested = request.exchangedAuthCredential;
+  if (!((_a = requested == null ? void 0 : requested.oauth2) == null ? void 0 : _a.authUri)) {
+    return supplied;
+  }
+  const suppliedOAuth2 = readField(supplied, "oauth2");
+  const answer = {};
+  const authResponseUri = readString(suppliedOAuth2, "authResponseUri");
+  if (authResponseUri !== void 0) {
+    answer.authResponseUri = authResponseUri;
+  }
+  const authCode = readString(suppliedOAuth2, "authCode");
+  if (authCode !== void 0) {
+    answer.authCode = authCode;
+  }
+  if (authResponseUri === void 0 && authCode === void 0) {
+    return void 0;
+  }
+  return {
+    ...requested,
+    oauth2: { ...requested.oauth2, ...answer }
+  };
+}
+__name(bindCredential, "bindCredential");
+function bindCredentialResponse(request, response) {
+  const { authScheme, credentialKey } = request;
+  if (!authScheme || !credentialKey) {
+    return void 0;
+  }
+  const supplied = readField(response, "exchangedAuthCredential");
+  if (typeof supplied !== "object" || supplied === null) {
+    return void 0;
+  }
+  const exchangedAuthCredential = bindCredential(request, supplied);
+  if (!exchangedAuthCredential) {
+    return void 0;
+  }
+  return {
+    authScheme,
+    credentialKey,
+    rawAuthCredential: request.rawAuthCredential,
+    exchangedAuthCredential
+  };
+}
+__name(bindCredentialResponse, "bindCredentialResponse");
+// Annotate the CommonJS export names for ESM import in node:
+0 && (module.exports = {
+  bindCredentialResponse
+});

package/dist/cjs/auth/credential_service/in_memory_credential_service.js

@@ -9,6 +9,7 @@ var __defProp = Object.defineProperty;
 var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
 var __getOwnPropNames = Object.getOwnPropertyNames;
 var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __name = (target, value) => __defProp(target, "name", { value, configurable: true });
 var __export = (target, all) => {
   for (var name in all)
     __defProp(target, name, { get: all[name], enumerable: true });
@@ -32,7 +33,7 @@ module.exports = __toCommonJS(in_memory_credential_service_exports);
  * Copyright 2025 Google LLC
  * SPDX-License-Identifier: Apache-2.0
  */
-class InMemoryCredentialService {
+const _InMemoryCredentialService = class _InMemoryCredentialService {
   constructor() {
     /**
      * A map from app name to a map from user ID to a map from credential key to
@@ -67,7 +68,9 @@ class InMemoryCredentialService {
     }
     return this.credentials[appName][userId];
   }
-}
+};
+__name(_InMemoryCredentialService, "InMemoryCredentialService");
+let InMemoryCredentialService = _InMemoryCredentialService;
 // Annotate the CommonJS export names for ESM import in node:
 0 && (module.exports = {
   InMemoryCredentialService

package/dist/cjs/auth/credential_service/session_state_credential_service.js

@@ -9,6 +9,7 @@ var __defProp = Object.defineProperty;
 var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
 var __getOwnPropNames = Object.getOwnPropertyNames;
 var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __name = (target, value) => __defProp(target, "name", { value, configurable: true });
 var __export = (target, all) => {
   for (var name in all)
     __defProp(target, name, { get: all[name], enumerable: true });
@@ -32,7 +33,7 @@ module.exports = __toCommonJS(session_state_credential_service_exports);
  * Copyright 2026 Google LLC
  * SPDX-License-Identifier: Apache-2.0
  */
-class SessionStateCredentialService {
+const _SessionStateCredentialService = class _SessionStateCredentialService {
   loadCredential(authConfig, toolContext) {
     return Promise.resolve(toolContext.state.get(authConfig.credentialKey));
   }
@@ -44,7 +45,9 @@ class SessionStateCredentialService {
       );
     }
   }
-}
+};
+__name(_SessionStateCredentialService, "SessionStateCredentialService");
+let SessionStateCredentialService = _SessionStateCredentialService;
 // Annotate the CommonJS export names for ESM import in node:
 0 && (module.exports = {
   SessionStateCredentialService

package/dist/cjs/auth/exchanger/base_credential_exchanger.js

@@ -9,6 +9,7 @@ var __defProp = Object.defineProperty;
 var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
 var __getOwnPropNames = Object.getOwnPropertyNames;
 var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __name = (target, value) => __defProp(target, "name", { value, configurable: true });
 var __export = (target, all) => {
   for (var name in all)
     __defProp(target, name, { get: all[name], enumerable: true });
@@ -32,8 +33,10 @@ module.exports = __toCommonJS(base_credential_exchanger_exports);
  * Copyright 2025 Google LLC
  * SPDX-License-Identifier: Apache-2.0
  */
-class CredentialExchangeError extends Error {
-}
+const _CredentialExchangeError = class _CredentialExchangeError extends Error {
+};
+__name(_CredentialExchangeError, "CredentialExchangeError");
+let CredentialExchangeError = _CredentialExchangeError;
 // Annotate the CommonJS export names for ESM import in node:
 0 && (module.exports = {
   CredentialExchangeError

package/dist/cjs/auth/exchanger/credential_exchanger_registry.js

@@ -9,6 +9,7 @@ var __defProp = Object.defineProperty;
 var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
 var __getOwnPropNames = Object.getOwnPropertyNames;
 var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __name = (target, value) => __defProp(target, "name", { value, configurable: true });
 var __export = (target, all) => {
   for (var name in all)
     __defProp(target, name, { get: all[name], enumerable: true });
@@ -32,7 +33,7 @@ module.exports = __toCommonJS(credential_exchanger_registry_exports);
  * Copyright 2025 Google LLC
  * SPDX-License-Identifier: Apache-2.0
  */
-class CredentialExchangerRegistry {
+const _CredentialExchangerRegistry = class _CredentialExchangerRegistry {
   constructor() {
     this.exchangers = {};
   }
@@ -52,7 +53,9 @@ class CredentialExchangerRegistry {
   getExchanger(credentialType) {
     return this.exchangers[credentialType];
   }
-}
+};
+__name(_CredentialExchangerRegistry, "CredentialExchangerRegistry");
+let CredentialExchangerRegistry = _CredentialExchangerRegistry;
 // Annotate the CommonJS export names for ESM import in node:
 0 && (module.exports = {
   CredentialExchangerRegistry

package/dist/cjs/auth/oauth2/oauth2_credential_exchanger.js

@@ -9,6 +9,7 @@ var __defProp = Object.defineProperty;
 var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
 var __getOwnPropNames = Object.getOwnPropertyNames;
 var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __name = (target, value) => __defProp(target, "name", { value, configurable: true });
 var __export = (target, all) => {
   for (var name in all)
     __defProp(target, name, { get: all[name], enumerable: true });
@@ -39,7 +40,7 @@ var import_oauth2_utils = require("./oauth2_utils.js");
  * Copyright 2026 Google LLC
  * SPDX-License-Identifier: Apache-2.0
  */
-class OAuth2CredentialExchanger {
+const _OAuth2CredentialExchanger = class _OAuth2CredentialExchanger {
   async exchange({
     authCredential,
     authScheme
@@ -69,7 +70,9 @@ class OAuth2CredentialExchanger {
       wasExchanged: false
     };
   }
-}
+};
+__name(_OAuth2CredentialExchanger, "OAuth2CredentialExchanger");
+let OAuth2CredentialExchanger = _OAuth2CredentialExchanger;
 function determineGrantType(authScheme) {
   var _a;
   if ("flows" in authScheme && authScheme.flows) {
@@ -84,6 +87,7 @@ function determineGrantType(authScheme) {
   }
   return void 0;
 }
+__name(determineGrantType, "determineGrantType");
 async function exchangeClientCredentials({
   authCredential,
   authScheme
@@ -123,6 +127,7 @@ async function exchangeClientCredentials({
     );
   }
 }
+__name(exchangeClientCredentials, "exchangeClientCredentials");
 async function exchangeAuthorizationCode({
   authCredential,
   authScheme
@@ -189,6 +194,7 @@ async function exchangeAuthorizationCode({
     );
   }
 }
+__name(exchangeAuthorizationCode, "exchangeAuthorizationCode");
 // Annotate the CommonJS export names for ESM import in node:
 0 && (module.exports = {
   OAuth2CredentialExchanger,

package/dist/cjs/auth/oauth2/oauth2_credential_refresher.js

@@ -9,6 +9,7 @@ var __defProp = Object.defineProperty;
 var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
 var __getOwnPropNames = Object.getOwnPropertyNames;
 var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __name = (target, value) => __defProp(target, "name", { value, configurable: true });
 var __export = (target, all) => {
   for (var name in all)
     __defProp(target, name, { get: all[name], enumerable: true });
@@ -34,13 +35,13 @@ var import_oauth2_utils = require("./oauth2_utils.js");
  * Copyright 2026 Google LLC
  * SPDX-License-Identifier: Apache-2.0
  */
-class OAuth2CredentialRefresher {
+const _OAuth2CredentialRefresher = class _OAuth2CredentialRefresher {
   /**
    * Check if the OAuth2 credential needs to be refreshed.
    *
    * @param authCredential The OAuth2 credential to check.
    * @param authScheme The OAuth2 authentication scheme (optional).
-   * @returns True if the credential needs to be refreshed, False otherwise.
+   * @returns True if the credential needs to be refreshed, false otherwise.
    */
   async isRefreshNeeded(authCredential) {
     if (!authCredential.oauth2) {
@@ -102,7 +103,9 @@ class OAuth2CredentialRefresher {
       return authCredential;
     }
   }
-}
+};
+__name(_OAuth2CredentialRefresher, "OAuth2CredentialRefresher");
+let OAuth2CredentialRefresher = _OAuth2CredentialRefresher;
 // Annotate the CommonJS export names for ESM import in node:
 0 && (module.exports = {
   OAuth2CredentialRefresher

package/dist/cjs/auth/oauth2/oauth2_discovery.js

@@ -9,6 +9,7 @@ var __defProp = Object.defineProperty;
 var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
 var __getOwnPropNames = Object.getOwnPropertyNames;
 var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __name = (target, value) => __defProp(target, "name", { value, configurable: true });
 var __export = (target, all) => {
   for (var name in all)
     __defProp(target, name, { get: all[name], enumerable: true });
@@ -49,7 +50,7 @@ const ProtectedResourceMetadataSchema = import_zod.z.object({
   resource: import_zod.z.string(),
   authorization_servers: import_zod.z.array(import_zod.z.string()).default([])
 });
-class OAuth2DiscoveryManager {
+const _OAuth2DiscoveryManager = class _OAuth2DiscoveryManager {
   /**
    * Discovers the OAuth2 authorization server metadata.
    */
@@ -161,7 +162,9 @@ class OAuth2DiscoveryManager {
     }
     return void 0;
   }
-}
+};
+__name(_OAuth2DiscoveryManager, "OAuth2DiscoveryManager");
+let OAuth2DiscoveryManager = _OAuth2DiscoveryManager;
 function normaliseHostname(raw) {
   const stripped = raw.replace(/^\[|\]$/g, "");
   const m = stripped.match(/^::ffff:([0-9a-f]{1,4}):([0-9a-f]{1,4})$/i);
@@ -174,6 +177,7 @@ function normaliseHostname(raw) {
   if (mDot) return mDot[1];
   return raw;
 }
+__name(normaliseHostname, "normaliseHostname");
 function validateDiscoveryUrl(urlStr) {
   try {
     const url = new URL(urlStr);
@@ -212,6 +216,7 @@ function validateDiscoveryUrl(urlStr) {
     return false;
   }
 }
+__name(validateDiscoveryUrl, "validateDiscoveryUrl");
 // Annotate the CommonJS export names for ESM import in node:
 0 && (module.exports = {
   AuthorizationServerMetadataSchema,

package/dist/cjs/auth/oauth2/oauth2_utils.js

@@ -9,6 +9,7 @@ var __defProp = Object.defineProperty;
 var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
 var __getOwnPropNames = Object.getOwnPropertyNames;
 var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __name = (target, value) => __defProp(target, "name", { value, configurable: true });
 var __export = (target, all) => {
   for (var name in all)
     __defProp(target, name, { get: all[name], enumerable: true });
@@ -25,19 +26,32 @@ var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: tru
 var oauth2_utils_exports = {};
 __export(oauth2_utils_exports, {
   createOAuth2TokenRequestBody: () => createOAuth2TokenRequestBody,
+  createS256CodeChallenge: () => createS256CodeChallenge,
   fetchOAuth2Tokens: () => fetchOAuth2Tokens,
+  generateCodeVerifier: () => generateCodeVerifier,
   getTokenEndpoint: () => getTokenEndpoint,
   isTokenExpired: () => isTokenExpired,
   parseAuthorizationCode: () => parseAuthorizationCode
 });
 module.exports = __toCommonJS(oauth2_utils_exports);
+var import_node_crypto = require("node:crypto");
 var import_logger = require("../../utils/logger.js");
+var import_redact_uri = require("../../utils/redact_uri.js");
 var import_oauth2_discovery = require("./oauth2_discovery.js");
 /**
  * @license
  * Copyright 2026 Google LLC
  * SPDX-License-Identifier: Apache-2.0
  */
+const CODE_VERIFIER_BYTES = 36;
+function generateCodeVerifier() {
+  return (0, import_node_crypto.randomBytes)(CODE_VERIFIER_BYTES).toString("base64url");
+}
+__name(generateCodeVerifier, "generateCodeVerifier");
+function createS256CodeChallenge(codeVerifier) {
+  return (0, import_node_crypto.createHash)("sha256").update(codeVerifier).digest("base64url");
+}
+__name(createS256CodeChallenge, "createS256CodeChallenge");
 function getTokenEndpoint(authScheme) {
   if (authScheme.type === "openIdConnect" && authScheme.tokenEndpoint) {
     return authScheme.tokenEndpoint;
@@ -51,6 +65,7 @@ function getTokenEndpoint(authScheme) {
   }
   return void 0;
 }
+__name(getTokenEndpoint, "getTokenEndpoint");
 async function fetchOAuth2Tokens(endpoint, body) {
   if (!(0, import_oauth2_discovery.validateDiscoveryUrl)(endpoint)) {
     throw new Error(
@@ -86,15 +101,17 @@ async function fetchOAuth2Tokens(endpoint, body) {
     throw e;
   }
 }
+__name(fetchOAuth2Tokens, "fetchOAuth2Tokens");
 function parseAuthorizationCode(uri) {
   try {
     const url = new URL(uri);
     return url.searchParams.get("code") || void 0;
-  } catch (e) {
-    import_logger.logger.warn(`Failed to parse authorization URI ${uri}: ${e}`);
+  } catch {
+    import_logger.logger.warn(`Failed to parse authorization URI ${(0, import_redact_uri.redactUriPassword)(uri)}`);
     return void 0;
   }
 }
+__name(parseAuthorizationCode, "parseAuthorizationCode");
 function createOAuth2TokenRequestBody(params) {
   const body = new URLSearchParams();
   body.set("grant_type", params.grantType);
@@ -113,6 +130,7 @@ function createOAuth2TokenRequestBody(params) {
   }
   return body;
 }
+__name(createOAuth2TokenRequestBody, "createOAuth2TokenRequestBody");
 function isTokenExpired(token, leeway = 60) {
   if (typeof token.expiresAt !== "number") {
     return false;
@@ -120,10 +138,13 @@ function isTokenExpired(token, leeway = 60) {
   const expirationThreshold = token.expiresAt - leeway * 1e3;
   return expirationThreshold < Date.now();
 }
+__name(isTokenExpired, "isTokenExpired");
 // Annotate the CommonJS export names for ESM import in node:
 0 && (module.exports = {
   createOAuth2TokenRequestBody,
+  createS256CodeChallenge,
   fetchOAuth2Tokens,
+  generateCodeVerifier,
   getTokenEndpoint,
   isTokenExpired,
   parseAuthorizationCode

package/dist/cjs/auth/refresher/base_credential_refresher.js

@@ -9,6 +9,7 @@ var __defProp = Object.defineProperty;
 var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
 var __getOwnPropNames = Object.getOwnPropertyNames;
 var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __name = (target, value) => __defProp(target, "name", { value, configurable: true });
 var __export = (target, all) => {
   for (var name in all)
     __defProp(target, name, { get: all[name], enumerable: true });
@@ -32,12 +33,14 @@ module.exports = __toCommonJS(base_credential_refresher_exports);
  * Copyright 2026 Google LLC
  * SPDX-License-Identifier: Apache-2.0
  */
-class CredentialRefresherError extends Error {
+const _CredentialRefresherError = class _CredentialRefresherError extends Error {
   constructor(message) {
     super(message);
     this.name = "CredentialRefresherError";
   }
-}
+};
+__name(_CredentialRefresherError, "CredentialRefresherError");
+let CredentialRefresherError = _CredentialRefresherError;
 // Annotate the CommonJS export names for ESM import in node:
 0 && (module.exports = {
   CredentialRefresherError

package/dist/cjs/auth/refresher/credential_refresher_registry.js

@@ -9,6 +9,7 @@ var __defProp = Object.defineProperty;
 var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
 var __getOwnPropNames = Object.getOwnPropertyNames;
 var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __name = (target, value) => __defProp(target, "name", { value, configurable: true });
 var __export = (target, all) => {
   for (var name in all)
     __defProp(target, name, { get: all[name], enumerable: true });
@@ -33,7 +34,7 @@ var import_auth_credential = require("../auth_credential.js");
  * Copyright 2026 Google LLC
  * SPDX-License-Identifier: Apache-2.0
  */
-class CredentialRefresherRegistry {
+const _CredentialRefresherRegistry = class _CredentialRefresherRegistry {
   constructor() {
     this.refreshers = {
       [import_auth_credential.AuthCredentialTypes.API_KEY]: void 0,
@@ -61,7 +62,9 @@ class CredentialRefresherRegistry {
   getRefresher(credentialType) {
     return this.refreshers[credentialType];
   }
-}
+};
+__name(_CredentialRefresherRegistry, "CredentialRefresherRegistry");
+let CredentialRefresherRegistry = _CredentialRefresherRegistry;
 // Annotate the CommonJS export names for ESM import in node:
 0 && (module.exports = {
   CredentialRefresherRegistry