@google/adk 1.6.0 → 2.1.0

package/dist/cjs/tools/load_web_page.js

@@ -9,6 +9,7 @@ var __defProp = Object.defineProperty;
 var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
 var __getOwnPropNames = Object.getOwnPropertyNames;
 var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __name = (target, value) => __defProp(target, "name", { value, configurable: true });
 var __export = (target, all) => {
   for (var name in all)
     __defProp(target, name, { get: all[name], enumerable: true });
@@ -28,201 +29,53 @@ __export(load_web_page_exports, {
   loadWebPage: () => loadWebPage
 });
 module.exports = __toCommonJS(load_web_page_exports);
-var import_promises = require("node:dns/promises");
-var import_node_net = require("node:net");
 var import_zod = require("zod");
+var import_ssrf_guard = require("../utils/ssrf_guard.js");
 var import_function_tool = require("./function_tool.js");
 /**
  * @license
  * Copyright 2026 Google LLC
  * SPDX-License-Identifier: Apache-2.0
  */
-const ALLOWED_SCHEMES = /* @__PURE__ */ new Set(["http:", "https:"]);
 const DEFAULT_TIMEOUT_MS = 3e4;
-const BLOCKED_IPV4_CIDRS = [
-  "0.0.0.0/8",
-  // "this host on this network"
-  "10.0.0.0/8",
-  // private
-  "100.64.0.0/10",
-  // shared address space / CGNAT
-  "127.0.0.0/8",
-  // loopback
-  "169.254.0.0/16",
-  // link-local (includes GCP metadata 169.254.169.254)
-  "172.16.0.0/12",
-  // private
-  "192.0.0.0/24",
-  // IETF protocol assignments
-  "192.0.2.0/24",
-  // TEST-NET-1 (documentation)
-  "192.88.99.0/24",
-  // 6to4 relay anycast (deprecated)
-  "192.168.0.0/16",
-  // private
-  "198.18.0.0/15",
-  // benchmarking
-  "198.51.100.0/24",
-  // TEST-NET-2 (documentation)
-  "203.0.113.0/24",
-  // TEST-NET-3 (documentation)
-  "224.0.0.0/4",
-  // multicast
-  "240.0.0.0/4"
-  // reserved / future use (includes 255.255.255.255)
-].map(parseIpv4Cidr);
-const BLOCKED_IPV6_CIDRS = [
-  "::/128",
-  // unspecified
-  "::1/128",
-  // loopback
-  "64:ff9b:1::/48",
-  // local NAT64
-  "100::/64",
-  // discard-only
-  "2001:db8::/32",
-  // documentation
-  "fc00::/7",
-  // unique-local (ULA, private)
-  "fe80::/10",
-  // link-local
-  "ff00::/8"
-  // multicast
-].map(parseIpv6Cidr);
 function failedToFetchMessage(url) {
   return `Failed to fetch url: ${url}`;
 }
-function isBlockedHostname(hostname) {
-  const normalized = hostname.replace(/\.+$/, "").toLowerCase();
-  return normalized === "localhost" || normalized.endsWith(".localhost");
-}
-function normalizeHost(hostname) {
-  return hostname.startsWith("[") ? hostname.slice(1, -1) : hostname;
-}
-function parseIpv4(address) {
-  const match = /^(\d{1,3})\.(\d{1,3})\.(\d{1,3})\.(\d{1,3})$/.exec(address);
-  if (!match) {
-    return null;
-  }
-  const octets = match.slice(1).map(Number);
-  if (octets.some((octet) => octet > 255)) {
-    return null;
-  }
-  return octets;
-}
-function parseIpv6(address) {
-  if ((0, import_node_net.isIP)(address) !== 6) {
-    return null;
-  }
-  const [head, tail] = address.split("::");
-  const highGroups = head ? expandHextets(head) : [];
-  const lowGroups = tail ? expandHextets(tail) : [];
-  const compressed = address.includes("::") ? new Array(8 - highGroups.length - lowGroups.length).fill(0) : [];
-  return [...highGroups, ...compressed, ...lowGroups];
-}
-function expandHextets(fragment) {
-  const hextets = [];
-  for (const group of fragment.split(":")) {
-    if (group.includes(".")) {
-      const octets = parseIpv4(group);
-      hextets.push(octets[0] << 8 | octets[1], octets[2] << 8 | octets[3]);
-    } else {
-      hextets.push(parseInt(group, 16));
-    }
-  }
-  return hextets;
-}
-function ipv4ToInt(octets) {
-  return (octets[0] << 24 | octets[1] << 16 | octets[2] << 8 | octets[3]) >>> 0;
-}
-function hextetsToBigInt(hextets) {
-  let value = 0n;
-  for (const hextet of hextets) {
-    value = value << 16n | BigInt(hextet);
-  }
-  return value;
-}
-function parseIpv4Cidr(cidr) {
-  const [address, prefix] = cidr.split("/");
-  const mask = 4294967295 << 32 - Number(prefix) >>> 0;
-  return { base: (ipv4ToInt(parseIpv4(address)) & mask) >>> 0, mask };
-}
-function parseIpv6Cidr(cidr) {
-  const [address, prefix] = cidr.split("/");
-  return { base: hextetsToBigInt(parseIpv6(address)), prefix: Number(prefix) };
-}
-function isBlockedIpv4(octets) {
-  const value = ipv4ToInt(octets);
-  return BLOCKED_IPV4_CIDRS.some(
-    ({ base, mask }) => (value & mask) >>> 0 === base
-  );
-}
-function isBlockedIpv6(hextets) {
-  const value = hextetsToBigInt(hextets);
-  if (value >> 32n === 0xffffn) {
-    return isBlockedIpv4([
-      Number(value >> 24n & 0xffn),
-      Number(value >> 16n & 0xffn),
-      Number(value >> 8n & 0xffn),
-      Number(value & 0xffn)
-    ]);
-  }
-  return BLOCKED_IPV6_CIDRS.some(
-    ({ base, prefix }) => value >> BigInt(128 - prefix) === base >> BigInt(128 - prefix)
-  );
-}
-function isBlockedAddress(address) {
-  const octets = parseIpv4(address);
-  if (octets) {
-    return isBlockedIpv4(octets);
-  }
-  const hextets = parseIpv6(address);
-  if (hextets) {
-    return isBlockedIpv6(hextets);
-  }
-  return true;
-}
-async function resolveHostAddresses(hostname) {
-  if ((0, import_node_net.isIP)(hostname) !== 0) {
-    return [hostname];
-  }
-  const records = await (0, import_promises.lookup)(hostname, { all: true });
-  const addresses = [...new Set(records.map((record) => record.address))];
-  if (addresses.length === 0) {
-    throw new Error(`Unable to resolve host: ${hostname}`);
-  }
-  return addresses;
-}
+__name(failedToFetchMessage, "failedToFetchMessage");
 function assertUrlAllowed(url) {
   const parsed = new URL(url);
-  if (!ALLOWED_SCHEMES.has(parsed.protocol)) {
+  if (!(0, import_ssrf_guard.isHttpUrl)(parsed)) {
     throw new Error(`Unsupported url scheme: ${url}`);
   }
-  if (isBlockedHostname(parsed.hostname)) {
+  if ((0, import_ssrf_guard.isLocalhostHostname)(parsed.hostname)) {
     throw new Error(`Blocked host: ${parsed.hostname}`);
   }
   return parsed;
 }
+__name(assertUrlAllowed, "assertUrlAllowed");
 async function validateResolvedAddresses(hostname) {
-  const addresses = await resolveHostAddresses(hostname);
-  if (addresses.some(isBlockedAddress)) {
+  const addresses = await (0, import_ssrf_guard.resolveHostAddresses)(hostname);
+  if (addresses.some(import_ssrf_guard.isNonGlobalAddress)) {
     throw new Error(`Blocked host: ${hostname}`);
   }
 }
+__name(validateResolvedAddresses, "validateResolvedAddresses");
 function decodeHtmlEntities(text) {
   return text.replace(/&nbsp;/g, " ").replace(/&#39;/g, "'").replace(/&#x27;/g, "'").replace(/&quot;/g, '"').replace(/&lt;/g, "<").replace(/&gt;/g, ">").replace(/&amp;/g, "&");
 }
+__name(decodeHtmlEntities, "decodeHtmlEntities");
 function htmlToText(html) {
   const withoutCode = html.replace(/<script[\s\S]*?<\/script>/gi, " ").replace(/<style[\s\S]*?<\/style>/gi, " ").replace(/<!--[\s\S]*?-->/g, " ");
   const text = decodeHtmlEntities(withoutCode.replace(/<[^>]+>/g, "\n"));
   return text.split("\n").map((line) => line.trim()).filter((line) => line.split(/\s+/).filter(Boolean).length > 3).join("\n");
 }
+__name(htmlToText, "htmlToText");
 async function loadWebPage(url, options) {
   var _a;
   const timeoutMs = (_a = options == null ? void 0 : options.timeoutMs) != null ? _a : DEFAULT_TIMEOUT_MS;
   try {
     const parsed = assertUrlAllowed(url);
-    await validateResolvedAddresses(normalizeHost(parsed.hostname));
+    await validateResolvedAddresses((0, import_ssrf_guard.normalizeHost)(parsed.hostname));
     const response = await fetch(url, {
       redirect: "manual",
       signal: AbortSignal.timeout(timeoutMs)
@@ -235,13 +88,14 @@ async function loadWebPage(url, options) {
     return failedToFetchMessage(url);
   }
 }
+__name(loadWebPage, "loadWebPage");
 const LOAD_WEB_PAGE = new import_function_tool.FunctionTool({
   name: "load_web_page",
   description: "Fetches the content at the given URL and returns the readable text extracted from the page.",
   parameters: import_zod.z.object({
     url: import_zod.z.string().describe("The URL to fetch and extract text from.")
   }),
-  execute: ({ url }) => loadWebPage(url)
+  execute: /* @__PURE__ */ __name(({ url }) => loadWebPage(url), "execute")
 });
 // Annotate the CommonJS export names for ESM import in node:
 0 && (module.exports = {

package/dist/cjs/tools/long_running_tool.js

@@ -9,6 +9,7 @@ var __defProp = Object.defineProperty;
 var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
 var __getOwnPropNames = Object.getOwnPropertyNames;
 var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __name = (target, value) => __defProp(target, "name", { value, configurable: true });
 var __export = (target, all) => {
   for (var name in all)
     __defProp(target, name, { get: all[name], enumerable: true });
@@ -36,7 +37,7 @@ var import_function_tool = require("./function_tool.js");
 const LONG_RUNNING_INSTRUCTION = `
 
 NOTE: This is a long-running operation. Do not call this tool again if it has already returned some intermediate or pending status.`;
-class LongRunningFunctionTool extends import_function_tool.FunctionTool {
+const _LongRunningFunctionTool = class _LongRunningFunctionTool extends import_function_tool.FunctionTool {
   /**
    * The constructor acts as the user-friendly factory.
    * @param options The configuration for the tool.
@@ -57,7 +58,9 @@ class LongRunningFunctionTool extends import_function_tool.FunctionTool {
     }
     return declaration;
   }
-}
+};
+__name(_LongRunningFunctionTool, "LongRunningFunctionTool");
+let LongRunningFunctionTool = _LongRunningFunctionTool;
 // Annotate the CommonJS export names for ESM import in node:
 0 && (module.exports = {
   LongRunningFunctionTool

package/dist/cjs/tools/mcp/index.js

@@ -0,0 +1,39 @@
+/**
+  * @license
+  * Copyright 2026 Google LLC
+  * SPDX-License-Identifier: Apache-2.0
+  */
+
+"use strict";
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __copyProps = (to, from, except, desc) => {
+  if (from && typeof from === "object" || typeof from === "function") {
+    for (let key of __getOwnPropNames(from))
+      if (!__hasOwnProp.call(to, key) && key !== except)
+        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
+  }
+  return to;
+};
+var __reExport = (target, mod, secondTarget) => (__copyProps(target, mod, "default"), secondTarget && __copyProps(secondTarget, mod, "default"));
+var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
+var mcp_exports = {};
+module.exports = __toCommonJS(mcp_exports);
+__reExport(mcp_exports, require("./load_mcp_resource_tool.js"), module.exports);
+__reExport(mcp_exports, require("./mcp_session_manager.js"), module.exports);
+__reExport(mcp_exports, require("./mcp_tool.js"), module.exports);
+__reExport(mcp_exports, require("./mcp_toolset.js"), module.exports);
+/**
+ * @license
+ * Copyright 2026 Google LLC
+ * SPDX-License-Identifier: Apache-2.0
+ */
+// Annotate the CommonJS export names for ESM import in node:
+0 && (module.exports = {
+  ...require("./load_mcp_resource_tool.js"),
+  ...require("./mcp_session_manager.js"),
+  ...require("./mcp_tool.js"),
+  ...require("./mcp_toolset.js")
+});

package/dist/cjs/tools/mcp/load_mcp_resource_tool.js

@@ -9,6 +9,7 @@ var __defProp = Object.defineProperty;
 var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
 var __getOwnPropNames = Object.getOwnPropertyNames;
 var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __name = (target, value) => __defProp(target, "name", { value, configurable: true });
 var __export = (target, all) => {
   for (var name in all)
     __defProp(target, name, { get: all[name], enumerable: true });
@@ -36,7 +37,7 @@ var import_base_tool = require("../base_tool.js");
  * Copyright 2026 Google LLC
  * SPDX-License-Identifier: Apache-2.0
  */
-class LoadMcpResourceTool extends import_base_tool.BaseTool {
+const _LoadMcpResourceTool = class _LoadMcpResourceTool extends import_base_tool.BaseTool {
   constructor(mcpToolset) {
     super({
       name: "load_mcp_resource",
@@ -94,13 +95,42 @@ before answering questions related to the resources.`
     } catch (e) {
       import_logger.logger.warn(`Failed to list MCP resources: ${e}`);
     }
-    const lastContent = llmRequest.contents.at(-1);
-    const functionResponse = (_b = (_a = lastContent == null ? void 0 : lastContent.parts) == null ? void 0 : _a[0]) == null ? void 0 : _b.functionResponse;
-    if (!functionResponse || functionResponse.name !== this.name) {
+    const contents = llmRequest.contents;
+    if (!contents || contents.length === 0) {
       return;
     }
-    const response = functionResponse.response || {};
-    const requestedResourceNames = response["resource_names"] || [];
+    let startIndex = 0;
+    for (let i = contents.length - 1; i >= 0; i--) {
+      const content = contents[i];
+      const hasFunctionResponse = (_a = content.parts) == null ? void 0 : _a.some(
+        (part) => part.functionResponse !== void 0
+      );
+      const hasFunctionCall = (_b = content.parts) == null ? void 0 : _b.some(
+        (part) => part.functionCall !== void 0
+      );
+      if (content.role === "model" && !hasFunctionCall || content.role === "user" && !hasFunctionResponse) {
+        startIndex = i;
+        break;
+      }
+    }
+    const requestedResourceNames = [];
+    for (let i = startIndex; i < contents.length; i++) {
+      const content = contents[i];
+      if (content.role === "user" && content.parts) {
+        for (const part of content.parts) {
+          const functionResponse = part.functionResponse;
+          if (functionResponse && functionResponse.name === this.name) {
+            const response = functionResponse.response || {};
+            const names = response["resource_names"] || [];
+            for (const name of names) {
+              if (name && !requestedResourceNames.includes(name)) {
+                requestedResourceNames.push(name);
+              }
+            }
+          }
+        }
+      }
+    }
     for (const resourceName of requestedResourceNames) {
       try {
         const resourceContents = await this.mcpToolset.readResource(resourceName);
@@ -133,7 +163,9 @@ before answering questions related to the resources.`
     }
     return { text: `[Unknown content type for ${resourceName}]` };
   }
-}
+};
+__name(_LoadMcpResourceTool, "LoadMcpResourceTool");
+let LoadMcpResourceTool = _LoadMcpResourceTool;
 // Annotate the CommonJS export names for ESM import in node:
 0 && (module.exports = {
   LoadMcpResourceTool

package/dist/cjs/tools/mcp/mcp_session_manager.js

@@ -5,10 +5,13 @@
   */
 
 "use strict";
+var __create = Object.create;
 var __defProp = Object.defineProperty;
 var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
 var __getOwnPropNames = Object.getOwnPropertyNames;
+var __getProtoOf = Object.getPrototypeOf;
 var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __name = (target, value) => __defProp(target, "name", { value, configurable: true });
 var __export = (target, all) => {
   for (var name in all)
     __defProp(target, name, { get: all[name], enumerable: true });
@@ -21,37 +24,56 @@ var __copyProps = (to, from, except, desc) => {
   }
   return to;
 };
+var __toESM = (mod, isNodeMode, target) => (target = mod != null ? __create(__getProtoOf(mod)) : {}, __copyProps(
+  // If the importer is in node compatibility mode or this is not an ESM
+  // file that has been converted to a CommonJS file using a Babel-
+  // compatible transform (i.e. "__esModule" has not been set), then set
+  // "default" to the CommonJS "module.exports" for node compatibility.
+  isNodeMode || !mod || !mod.__esModule ? __defProp(target, "default", { value: mod, enumerable: true }) : target,
+  mod
+));
 var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
 var mcp_session_manager_exports = {};
 __export(mcp_session_manager_exports, {
   MCPSessionManager: () => MCPSessionManager
 });
 module.exports = __toCommonJS(mcp_session_manager_exports);
-var import_client = require("@modelcontextprotocol/sdk/client/index.js");
-var import_stdio = require("@modelcontextprotocol/sdk/client/stdio.js");
-var import_streamableHttp = require("@modelcontextprotocol/sdk/client/streamableHttp.js");
 var import_error_utils = require("../../utils/error_utils.js");
 var import_logger = require("../../utils/logger.js");
+var import_optional_peer = require("../../utils/optional_peer.js");
 /**
  * @license
  * Copyright 2025 Google LLC
  * SPDX-License-Identifier: Apache-2.0
  */
+const MCP_SDK = {
+  packageName: "@modelcontextprotocol/sdk",
+  feature: "MCPSessionManager (and the MCP tools built on it)"
+};
 function logTransportError(err) {
   import_logger.logger.error("MCP transport error: " + (0, import_error_utils.formatError)(err));
 }
-class MCPSessionManager {
+__name(logTransportError, "logTransportError");
+const _MCPSessionManager = class _MCPSessionManager {
   constructor(connectionParams) {
     this.activeSessions = /* @__PURE__ */ new Set();
     this.connectionParams = connectionParams;
   }
   async createSession() {
     var _a;
-    const client = new import_client.Client({ name: "MCPClient", version: "1.0.0" });
+    const { Client } = await (0, import_optional_peer.loadOptionalPeer)(
+      MCP_SDK,
+      () => Promise.resolve().then(() => __toESM(require("@modelcontextprotocol/sdk/client/index.js"), 1))
+    );
+    const client = new Client({ name: "MCPClient", version: "1.0.0" });
     try {
       switch (this.connectionParams.type) {
         case "StdioConnectionParams": {
-          const transport = new import_stdio.StdioClientTransport(
+          const { StdioClientTransport } = await (0, import_optional_peer.loadOptionalPeer)(
+            MCP_SDK,
+            () => Promise.resolve().then(() => __toESM(require("@modelcontextprotocol/sdk/client/stdio.js"), 1))
+          );
+          const transport = new StdioClientTransport(
             this.connectionParams.serverParams
           );
           transport.onerror = logTransportError;
@@ -65,7 +87,11 @@ class MCPSessionManager {
               headers: this.connectionParams.header
             };
           }
-          const transport = new import_streamableHttp.StreamableHTTPClientTransport(
+          const { StreamableHTTPClientTransport } = await (0, import_optional_peer.loadOptionalPeer)(
+            MCP_SDK,
+            () => Promise.resolve().then(() => __toESM(require("@modelcontextprotocol/sdk/client/streamableHttp.js"), 1))
+          );
+          const transport = new StreamableHTTPClientTransport(
             new URL(this.connectionParams.url),
             options
           );
@@ -95,7 +121,9 @@ class MCPSessionManager {
   getActiveSessions() {
     return Array.from(this.activeSessions);
   }
-}
+};
+__name(_MCPSessionManager, "MCPSessionManager");
+let MCPSessionManager = _MCPSessionManager;
 // Annotate the CommonJS export names for ESM import in node:
 0 && (module.exports = {
   MCPSessionManager

package/dist/cjs/tools/mcp/mcp_tool.js

@@ -9,6 +9,7 @@ var __defProp = Object.defineProperty;
 var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
 var __getOwnPropNames = Object.getOwnPropertyNames;
 var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __name = (target, value) => __defProp(target, "name", { value, configurable: true });
 var __export = (target, all) => {
   for (var name in all)
     __defProp(target, name, { get: all[name], enumerable: true });
@@ -34,7 +35,7 @@ var import_base_tool = require("../base_tool.js");
  * Copyright 2025 Google LLC
  * SPDX-License-Identifier: Apache-2.0
  */
-class MCPTool extends import_base_tool.BaseTool {
+const _MCPTool = class _MCPTool extends import_base_tool.BaseTool {
   constructor(mcpTool, mcpSessionManager, originalName) {
     super({ name: mcpTool.name, description: mcpTool.description || "" });
     this.mcpTool = mcpTool;
@@ -64,7 +65,9 @@ class MCPTool extends import_base_tool.BaseTool {
       await this.mcpSessionManager.closeSession(session);
     }
   }
-}
+};
+__name(_MCPTool, "MCPTool");
+let MCPTool = _MCPTool;
 // Annotate the CommonJS export names for ESM import in node:
 0 && (module.exports = {
   MCPTool

package/dist/cjs/tools/mcp/mcp_toolset.js

@@ -9,6 +9,7 @@ var __defProp = Object.defineProperty;
 var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
 var __getOwnPropNames = Object.getOwnPropertyNames;
 var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __name = (target, value) => __defProp(target, "name", { value, configurable: true });
 var __export = (target, all) => {
   for (var name in all)
     __defProp(target, name, { get: all[name], enumerable: true });
@@ -36,7 +37,7 @@ var import_mcp_tool = require("./mcp_tool.js");
  * Copyright 2025 Google LLC
  * SPDX-License-Identifier: Apache-2.0
  */
-class MCPToolset extends import_base_toolset.BaseToolset {
+const _MCPToolset = class _MCPToolset extends import_base_toolset.BaseToolset {
   constructor(connectionParams, toolFilter = [], prefix) {
     super(toolFilter, prefix);
     this.mcpSessionManager = new import_mcp_session_manager.MCPSessionManager(connectionParams);
@@ -144,7 +145,9 @@ class MCPToolset extends import_base_toolset.BaseToolset {
       sessions.map((session) => this.mcpSessionManager.closeSession(session))
     );
   }
-}
+};
+__name(_MCPToolset, "MCPToolset");
+let MCPToolset = _MCPToolset;
 // Annotate the CommonJS export names for ESM import in node:
 0 && (module.exports = {
   MCPToolset

package/dist/cjs/tools/openapi_tool/auth/auth_helpers.js

@@ -9,6 +9,7 @@ var __defProp = Object.defineProperty;
 var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
 var __getOwnPropNames = Object.getOwnPropertyNames;
 var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __name = (target, value) => __defProp(target, "name", { value, configurable: true });
 var __export = (target, all) => {
   for (var name in all)
     __defProp(target, name, { get: all[name], enumerable: true });
@@ -29,12 +30,14 @@ __export(auth_helpers_exports, {
   createBearerScheme: () => createBearerScheme
 });
 module.exports = __toCommonJS(auth_helpers_exports);
+var import_auth_credential = require("../../../auth/auth_credential.js");
 /**
  * @license
  * Copyright 2026 Google LLC
  * SPDX-License-Identifier: Apache-2.0
  */
 function applyCredential(url, headers, credential, authScheme) {
+  var _a;
   if (!credential) return url;
   if (credential.apiKey) {
     let inLocation;
@@ -52,11 +55,19 @@ function applyCredential(url, headers, credential, authScheme) {
     } else {
       headers["Authorization"] = credential.apiKey;
     }
-  } else if (credential.http && credential.http.credentials && credential.http.credentials.token) {
-    headers["Authorization"] = `Bearer ${credential.http.credentials.token}`;
+  } else if (credential.authType === import_auth_credential.AuthCredentialTypes.HTTP || credential.http) {
+    const httpCredentials = (_a = credential.http) == null ? void 0 : _a.credentials;
+    if (httpCredentials == null ? void 0 : httpCredentials.token) {
+      headers["Authorization"] = `Bearer ${httpCredentials.token}`;
+    } else if ((httpCredentials == null ? void 0 : httpCredentials.username) || (httpCredentials == null ? void 0 : httpCredentials.password)) {
+      throw new Error("Basic Authentication is not supported.");
+    } else {
+      throw new Error("Invalid HTTP auth credentials");
+    }
   }
   return url;
 }
+__name(applyCredential, "applyCredential");
 function createApiKeyScheme(name, inLocation) {
   return {
     type: "apiKey",
@@ -64,12 +75,14 @@ function createApiKeyScheme(name, inLocation) {
     in: inLocation
   };
 }
+__name(createApiKeyScheme, "createApiKeyScheme");
 function createBearerScheme() {
   return {
     type: "http",
     scheme: "bearer"
   };
 }
+__name(createBearerScheme, "createBearerScheme");
 // Annotate the CommonJS export names for ESM import in node:
 0 && (module.exports = {
   applyCredential,

package/dist/cjs/tools/openapi_tool/auth/credential_exchangers/auto_auth_credential_exchanger.js

@@ -9,6 +9,7 @@ var __defProp = Object.defineProperty;
 var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
 var __getOwnPropNames = Object.getOwnPropertyNames;
 var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __name = (target, value) => __defProp(target, "name", { value, configurable: true });
 var __export = (target, all) => {
   for (var name in all)
     __defProp(target, name, { get: all[name], enumerable: true });
@@ -72,6 +73,7 @@ let AutoAuthCredentialExchanger = class {
     return exchanger.exchange({ authScheme, authCredential });
   }
 };
+__name(AutoAuthCredentialExchanger, "AutoAuthCredentialExchanger");
 __decorateClass([
   import_experimental.experimental
 ], AutoAuthCredentialExchanger.prototype, "exchange", 1);

package/dist/cjs/tools/openapi_tool/auth/credential_exchangers/service_account_exchanger.js

@@ -9,6 +9,7 @@ var __defProp = Object.defineProperty;
 var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
 var __getOwnPropNames = Object.getOwnPropertyNames;
 var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __name = (target, value) => __defProp(target, "name", { value, configurable: true });
 var __export = (target, all) => {
   for (var name in all)
     __defProp(target, name, { get: all[name], enumerable: true });
@@ -121,6 +122,7 @@ let ServiceAccountCredentialExchanger = class {
     }
   }
 };
+__name(ServiceAccountCredentialExchanger, "ServiceAccountCredentialExchanger");
 __decorateClass([
   import_experimental.experimental
 ], ServiceAccountCredentialExchanger.prototype, "exchange", 1);