@google/adk 1.6.0 → 2.1.0

package/dist/types/tools/vertex_rag_retrieval_tool.d.ts

@@ -4,7 +4,8 @@
  * SPDX-License-Identifier: Apache-2.0
  */
 import { VertexRagStore } from '@google/genai';
-import { BaseTool, ToolProcessLlmRequest } from './base_tool.js';
+import { ToolProcessLlmRequest } from './base_tool.js';
+import { BuiltInTool } from './built_in_tool.js';
 /**
  * A tool that retrieves relevant content from a Vertex AI RAG corpus to ground
  * model responses.
@@ -19,24 +20,24 @@ import { BaseTool, ToolProcessLlmRequest } from './base_tool.js';
  *
  * @example
  * ```ts
- * import { VertexRagRetrievalTool } from '@google/adk';
- * import { VertexRagStore } from '@google/genai';
+ * import {LlmAgent, VertexRagRetrievalTool} from '@google/adk';
  *
  * const ragTool = new VertexRagRetrievalTool({
- *   ragResources: [{ragCorpus: 'projects/my-project/locations/us-central1/ragCorpora/my-corpus'}],
+ *   ragResources: [
+ *     {ragCorpus: 'projects/my-project/locations/us-central1/ragCorpora/my-corpus'},
+ *   ],
  *   similarityTopK: 5,
  * });
  *
- * const agent = new LlmAgent({ tools: [ragTool], ... });
+ * const agent = new LlmAgent({
+ *   name: 'rag_agent',
+ *   model: 'gemini-2.5-flash',
+ *   tools: [ragTool],
+ * });
  * ```
  */
-export declare class VertexRagRetrievalTool extends BaseTool {
+export declare class VertexRagRetrievalTool extends BuiltInTool {
     private readonly vertexRagStore;
     constructor(config: VertexRagStore);
-    /**
-     * This tool is executed server-side by the Vertex AI RAG Engine.
-     * Local execution is not required.
-     */
-    runAsync(): Promise<unknown>;
-    processLlmRequest({ llmRequest, }: ToolProcessLlmRequest): Promise<void>;
+    protected applyBuiltInConfig({ llmRequest, }: ToolProcessLlmRequest): Promise<void>;
 }

package/dist/types/utils/async_queue.d.ts

@@ -4,15 +4,47 @@
  * SPDX-License-Identifier: Apache-2.0
  */
 /**
- * A generic, async-safe queue that implements AsyncIterable.
+ * A generic, single-consumer async queue that implements AsyncIterable,
+ * bridging a *push* producer to a *pull* consumer (`for await (const x of q)`).
+ *
+ * Producers call {@link push} as values are produced and {@link close} (or
+ * {@link fail}) when finished. A single consumer drains the queue.
+ *
+ * Semantics:
+ *  - Buffered items are always delivered before an end/error signal.
+ *  - {@link close} ends iteration cleanly (`done: true`); idempotent.
+ *  - {@link fail} surfaces the error to the consumer *after* any buffered items
+ *    have been drained; it is sticky (first failure wins) and also closes the
+ *    queue, so a later `close()` can't discard the error.
+ *  - {@link push} after close/fail is ignored (the producer has already
+ *    signalled completion).
  */
 export declare class AsyncQueue<T> implements AsyncIterable<T> {
     private queue;
     private resolvers;
     private closed;
-    private errorVal?;
+    private failure?;
+    /** Whether the queue has been closed or failed. */
+    get isClosed(): boolean;
+    /** Number of items buffered and not yet consumed. */
+    get size(): number;
+    /**
+     * Enqueues a value. If a consumer is currently awaiting, it is resolved
+     * immediately; otherwise the value is buffered. No-op once closed/failed.
+     */
     push(value: T): void;
+    /**
+     * Signals that production failed. Buffered items are still delivered first;
+     * once the buffer drains, the consumer's next `next()` rejects with `error`.
+     * Sticky (first failure wins) and closes the queue.
+     */
+    fail(error: unknown): void;
+    /** @deprecated Alias for {@link fail}; kept for existing callers. */
     error(err: unknown): void;
+    /**
+     * Signals that no more items will be produced. Any awaiting consumer receives
+     * `{done: true}`. Idempotent.
+     */
     close(): void;
     [Symbol.asyncIterator](): AsyncIterator<T>;
 }

package/dist/types/utils/crypto_shim.d.ts

@@ -14,3 +14,19 @@
  * back to and the only correct move is to fail rather than degrade.
  */
 export declare function randomUUID(): string;
+/**
+ * Stand-in for `createHash`, reached from the PKCE helpers in
+ * `auth/oauth2/oauth2_utils.ts`.
+ *
+ * A PKCE code challenge needs a synchronous SHA-256, and the Web Crypto API
+ * offers none: `crypto.subtle.digest` is asynchronous, while `generateAuthUri`
+ * is called from synchronous public API. PKCE is therefore unavailable in the
+ * bundled web build, and this throws rather than emit an authorization request
+ * with a missing or forged challenge.
+ */
+export declare function createHash(_algorithm: string): never;
+/**
+ * Stand-in for `randomBytes`, reached when the PKCE helpers in
+ * `auth/oauth2/oauth2_utils.ts` generate a code verifier.
+ */
+export declare function randomBytes(_size: number): never;

package/dist/types/utils/deprecated.d.ts

@@ -0,0 +1,21 @@
+/**
+ * @license
+ * Copyright 2026 Google LLC
+ * SPDX-License-Identifier: Apache-2.0
+ */
+/** Resets the warned-once registry. Test-only. */
+export declare function resetDeprecationWarnings(): void;
+type Constructor = new (...args: any[]) => any;
+/**
+ * Marks a class as deprecated, logging `reason` once the first time it is
+ * instantiated.
+ *
+ * The JSDoc `@deprecated` tag is what a reader and an editor see; this is what
+ * someone running the code sees, so a deprecation is not silent to a caller who
+ * never opens the source. Mirrors `typing_extensions.deprecated`, which
+ * adk-python applies to the same classes, and follows the shape of
+ * {@link experimental}: one warning per class, not per instance, so a hot loop
+ * does not turn into a wall of logs.
+ */
+export declare function deprecated(reason: string): <T extends Constructor>(target: T) => T;
+export {};

package/dist/types/utils/env_aware_utils.d.ts

@@ -59,3 +59,19 @@ export declare function isBase64Encoded(data: string): boolean;
  * @return The boolean value of the environment variable.
  */
 export declare function getBooleanEnvVar(envVar: string): boolean;
+/**
+ * Returns whether Google GenAI enterprise mode is enabled.
+ *
+ * `GOOGLE_GENAI_USE_ENTERPRISE` takes precedence whenever it is set, even when
+ * it is set to a falsy value. `GOOGLE_GENAI_USE_VERTEXAI` is only consulted
+ * when `GOOGLE_GENAI_USE_ENTERPRISE` is absent.
+ *
+ * Setting the deprecated `GOOGLE_GENAI_USE_VERTEXAI` logs a deprecation
+ * warning, whether it is used or overridden. When both variables are set the
+ * warning also states that `GOOGLE_GENAI_USE_VERTEXAI` is ignored, so a stale
+ * value silently overridden by the new variable is still surfaced. This is
+ * read per request, so the warning is logged only once.
+ *
+ * @return True if enterprise mode is enabled, false otherwise.
+ */
+export declare function isEnterpriseModeEnabled(): boolean;

package/dist/types/utils/file_utils.d.ts

@@ -5,9 +5,17 @@
  */
 import { File } from '../code_executors/code_execution_utils.js';
 /**
- * Creates files with the given paths in the current working directory.
+ * Writes `files` into `dir`, refusing any entry that resolves outside of it.
+ *
+ * `dir` is deliberately required and has no default: file names typically
+ * originate from a code executor's output (i.e. from model- or skill-controlled
+ * content), so the destination must be a dedicated directory chosen by the
+ * caller. Defaulting to `process.cwd()` would let such content drop files into
+ * the host application's working directory.
+ *
  * @param files The files to materialize.
+ * @param dir The directory to materialize the files into.
  */
-export declare function materializeFiles(files: File[], dir?: string): Promise<File[]>;
+export declare function materializeFiles(files: File[], dir: string): Promise<File[]>;
 export declare const EXTENSION_TO_MIME_TYPE: Record<string, string>;
 export declare function guessMimeType(filePath: string): string;

package/dist/types/utils/gemini_schema_util.d.ts

@@ -4,12 +4,10 @@
  * SPDX-License-Identifier: Apache-2.0
  */
 import { Schema } from '@google/genai';
-import { z } from 'zod';
-declare const MCPToolSchemaObject: z.ZodObject<{
-    type: z.ZodLiteral<"object">;
-    properties: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodUnknown>>;
-    required: z.ZodOptional<z.ZodArray<z.ZodString>>;
-}, z.core.$strip>;
-type MCPToolSchema = z.infer<typeof MCPToolSchemaObject>;
+type MCPToolSchema = {
+    type: 'object';
+    properties?: Record<string, unknown>;
+    required?: string[];
+};
 export declare function toGeminiSchema(mcpSchema?: MCPToolSchema): Schema | undefined;
 export {};

package/dist/types/utils/genai_schema_to_json.d.ts

@@ -0,0 +1,25 @@
+/**
+ * @license
+ * Copyright 2026 Google LLC
+ * SPDX-License-Identifier: Apache-2.0
+ */
+import { Schema } from '@google/genai';
+/**
+ * Converts a genai `Schema` into a standard JSON Schema object.
+ *
+ * This is the inverse of `zodObjectToSchema`, which renders Zod into the
+ * genai/OpenAPI dialect. The two dialects differ in four ways, all handled
+ * here:
+ *
+ * - `type` is an uppercase enum (`STRING`) rather than a JSON Schema type name
+ *   (`string`). `TYPE_UNSPECIFIED` means "no constraint" and is dropped.
+ * - `nullable: true` widens the type, which JSON Schema expresses as a type
+ *   union (`['string', 'null']`).
+ * - Count and length bounds are stringified (`maxItems: '5'`).
+ * - `propertyOrdering` and `example` have no JSON Schema equivalent.
+ *
+ * Everything else (`description`, `title`, `default`, `pattern`, `required`,
+ * `minimum`, `maximum`, `format`) is already JSON-Schema-shaped and passes
+ * through, with `items`, `properties` and `anyOf` converted recursively.
+ */
+export declare function genaiSchemaToJsonSchema(schema: Schema): Record<string, unknown>;

package/dist/types/utils/logger.d.ts

@@ -1,3 +1,8 @@
+/**
+ * @license
+ * Copyright 2025 Google LLC
+ * SPDX-License-Identifier: Apache-2.0
+ */
 /** Log levels for the logger. */
 export declare enum LogLevel {
     DEBUG = 0,
@@ -16,6 +21,13 @@ export interface Logger {
     error(...args: unknown[]): void;
     setLogLevel(level: LogLevel): void;
 }
+/** The `console` method each level is written with. */
+export declare const CONSOLE_METHOD: {
+    readonly 0: "debug";
+    readonly 1: "info";
+    readonly 2: "warn";
+    readonly 3: "error";
+};
 /**
  * Sets a custom logger for ADK, or null to disable logging.
  */
@@ -25,7 +37,17 @@ export declare function setLogger(customLogger: Logger | null): void;
  */
 export declare function getLogger(): Logger;
 /**
- * Resets the logger to the default SimpleLogger.
+ * Resets the logger to the built-in console logger.
+ *
+ * This is the inverse of {@link setLogger}: it reinstates the built-in logger
+ * after a custom one has been installed. Prefer it over `setLogger(null)`,
+ * which installs a no-op logger that discards every message rather than
+ * restoring default output. On Node it also replaces the winston-backed logger
+ * that the Node entry point installs.
+ *
+ * The default logger is constructed fresh, so a log level previously applied
+ * with {@link setLogLevel} is discarded and the level returns to
+ * `LogLevel.INFO`.
  */
 export declare function resetLogger(): void;
 /**

package/dist/types/utils/logger_browser.d.ts

@@ -0,0 +1,28 @@
+/**
+ * @license
+ * Copyright 2026 Google LLC
+ * SPDX-License-Identifier: Apache-2.0
+ */
+/**
+ * The browser logger implementation.
+ *
+ * It mirrors the Node logger (`logger_node.ts`): a dedicated `Logger` class plus
+ * an `install*` function that the browser entry point (`core/src/index_web.ts`)
+ * wires in through `setLogger`. It writes through `console` and colours the
+ * level with a `%c` CSS directive, which browser dev consoles render (ANSI
+ * escape codes, as winston emits on Node, are not rendered there).
+ * See https://github.com/google/adk-js/issues/611.
+ */
+import { Logger, LogLevel } from './logger.js';
+/** The default logger in the browser. Writes coloured lines through `console`. */
+export declare class BrowserLogger implements Logger {
+    private logLevel;
+    setLogLevel(level: LogLevel): void;
+    log(level: LogLevel, ...messages: unknown[]): void;
+    debug(...messages: unknown[]): void;
+    info(...messages: unknown[]): void;
+    warn(...messages: unknown[]): void;
+    error(...messages: unknown[]): void;
+}
+/** Makes the colour-aware browser logger the current ADK logger. */
+export declare function installBrowserLogger(): void;

package/dist/types/utils/logger_node.d.ts

@@ -0,0 +1,20 @@
+/**
+ * @license
+ * Copyright 2026 Google LLC
+ * SPDX-License-Identifier: Apache-2.0
+ */
+import { Logger, LogLevel } from './logger.js';
+/** The default logger on Node. Writes through winston. */
+export declare class WinstonLogger implements Logger {
+    private readonly logger;
+    private logLevel;
+    constructor();
+    setLogLevel(level: LogLevel): void;
+    log(level: LogLevel, ...messages: unknown[]): void;
+    debug(...messages: unknown[]): void;
+    info(...messages: unknown[]): void;
+    warn(...messages: unknown[]): void;
+    error(...messages: unknown[]): void;
+}
+/** Makes the winston-backed logger the current ADK logger. */
+export declare function installNodeLogger(): void;

package/dist/types/utils/optional_peer.d.ts

@@ -0,0 +1,36 @@
+/**
+ * @license
+ * Copyright 2026 Google LLC
+ * SPDX-License-Identifier: Apache-2.0
+ */
+/** Describes the optional peer dependency a feature is asking for. */
+export interface OptionalPeer {
+    /** The npm package name, e.g. `@google-cloud/storage`. */
+    packageName: string;
+    /** The ADK feature that needs it, used in the error message. */
+    feature: string;
+}
+/**
+ * Loads an optional peer dependency, translating "not installed" into an
+ * actionable error.
+ *
+ * The dynamic `import()` is passed in as a thunk rather than being built from
+ * `packageName`, so that the specifier stays a literal in the calling module
+ * and remains visible to bundlers and to test doubles installed with
+ * `vi.mock()`.
+ *
+ * ```ts
+ * const {Storage} = await loadOptionalPeer(
+ *   {packageName: '@google-cloud/storage', feature: 'GcsArtifactService'},
+ *   () => import('@google-cloud/storage'),
+ * );
+ * ```
+ *
+ * @param peer The package being loaded and the feature that needs it.
+ * @param load Thunk performing the dynamic `import()`.
+ * @return The imported module namespace.
+ * @throws If the package is not installed, an error naming the feature and
+ *   the `npm install` command that fixes it. Any other load failure is
+ *   rethrown unchanged.
+ */
+export declare function loadOptionalPeer<T>(peer: OptionalPeer, load: () => Promise<T>): Promise<T>;

package/dist/types/utils/output_schema_utils.d.ts

@@ -8,9 +8,9 @@
  * time as tools, which is strictly more reliable than the prompt-based
  * `set_model_response` workaround.
  *
- * Early Access Program model names encode no numeric version, so
- * `isGemini2OrAbove` rejects them even on Vertex AI. The Python
- * implementation accepts them; that gap lives in the shared predicate.
+ * Early Access Program model names encode no numeric version, so this returns
+ * `false` for them even on Vertex AI, where they do support the capability.
+ * That under-reporting is a known gap.
  *
  * @param modelString A simple or path-based model name.
  * @return True if the model supports an output schema alongside tools.

package/dist/types/utils/redact_inline_data.d.ts

@@ -0,0 +1,16 @@
+/**
+ * @license
+ * Copyright 2026 Google LLC
+ * SPDX-License-Identifier: Apache-2.0
+ */
+/**
+ * Serializes a value as JSON with every inline attachment payload elided.
+ *
+ * An `Event` carrying an image, an audio clip or a PDF holds the whole
+ * attachment as a base64 string at `content.parts[].inlineData.data`. Passing
+ * such an event to `JSON.stringify` writes those bytes into whatever collects
+ * the log, which is a different trust boundary from whoever uploaded the file.
+ * Each blob keeps its descriptive fields and reports how many characters were
+ * elided in place of the payload.
+ */
+export declare function stringifyWithRedactedInlineData(value: unknown): string;

package/dist/types/utils/redact_uri.d.ts

@@ -0,0 +1,32 @@
+/**
+ * @license
+ * Copyright 2026 Google LLC
+ * SPDX-License-Identifier: Apache-2.0
+ */
+/**
+ * Redacts credentials from a URI so it can be safely included in error
+ * messages and logs.
+ *
+ * A database or session-service connection URI such as
+ * `postgres://user:password@host:5432/db` embeds the password in its userinfo
+ * component. An OAuth2 callback/authorization-response URI instead carries
+ * its secret (an authorization code, or an echoed token) as a query
+ * parameter, for example `https://app/callback?code=SECRET&state=xyz`.
+ * Including either verbatim in a thrown Error or log entry leaks the
+ * credential to wherever those are collected (log files, error-tracking
+ * services, stdout captured by an orchestrator), which is frequently a
+ * different trust boundary from whoever holds the credential.
+ *
+ * The same connection-string credential can also arrive as a query
+ * parameter rather than userinfo, for example
+ * `postgres://user@host/db?password=secret`, which several drivers accept
+ * and which reaches the same error paths. All forms above are masked.
+ *
+ * The rest of the URI is kept intact for debugging, mirroring the semantics of
+ * Go's `net/url.URL.Redacted()`. A URI carrying no credential is returned
+ * unchanged, byte for byte.
+ *
+ * If the input cannot be parsed as a URL, only its scheme prefix is returned so
+ * that a credential embedded in an otherwise-unparseable string is not leaked.
+ */
+export declare function redactUriPassword(uri: string): string;

package/dist/types/utils/schema.d.ts

@@ -0,0 +1,73 @@
+/**
+ * @license
+ * Copyright 2026 Google LLC
+ * SPDX-License-Identifier: Apache-2.0
+ */
+/**
+ * A single, reusable abstraction over the schema formats ADK APIs accept: a Zod
+ * v3 type, a Zod v4 type, or a genai `Schema`. Mirrors the union
+ * `FunctionTool` uses for its parameters, but at the `ZodType` level (any
+ * schema, not just an object) so it also fits value validation.
+ */
+import { Schema } from '@google/genai';
+import { z as z3 } from 'zod/v3';
+import { z as z4 } from 'zod/v4';
+/**
+ * A schema accepted by ADK APIs, expressed as a Zod v3 type, a Zod v4 type, or
+ * a genai `Schema`.
+ *
+ * Use `parseWithSchema` to validate a value against one, and `toJsonSchema` to
+ * render one as a plain JSON Schema.
+ */
+export type SchemaLike = z3.ZodType | z4.ZodType | Schema;
+/**
+ * Validates `value` against `schema`, returning the parsed value.
+ *
+ * Every schema form ADK accepts is enforced:
+ *
+ * - Zod v3/v4: runs `schema.parse(value)`.
+ * - genai `Schema`: converted to JSON Schema and compiled to a Zod type once
+ *   (then cached), so a declaration written in the genai dialect is checked
+ *   just as a Zod one is.
+ * - `undefined`: returns `value` unchanged.
+ *
+ * A genai `Schema` that has no Zod equivalent is left unenforced rather than
+ * rejected — see {@link genaiSchemaValidator}.
+ */
+export declare function parseWithSchema<T>(schema: SchemaLike | undefined, value: T): T;
+/**
+ * Renders a {@link SchemaLike} as a plain JSON Schema object.
+ *
+ * Zod v3 and v4 schemas are converted with their respective serializers. A
+ * genai `Schema` is translated out of the genai/OpenAPI dialect (uppercase
+ * type names, stringified bounds, `nullable`) so that every schema form
+ * produces the same JSON Schema shape for a consumer to read.
+ */
+export declare function toJsonSchema(schema: SchemaLike): Record<string, unknown>;
+/**
+ * Compiles a plain JSON Schema into a validator, for schemas that survive only
+ * in serialized form — a `RequestInput.responseSchema` reaches the resume that
+ * answers it as the JSON Schema recorded on the interrupt event, not as the
+ * original {@link SchemaLike}.
+ *
+ * Returns `undefined` when the schema cannot be compiled (JSON Schema is wider
+ * than Zod can express). Callers treat that as "no contract to check" rather
+ * than failing: refusing data because we could not build the validator would be
+ * worse than the unchecked pass-through this replaces.
+ */
+export declare function compileJsonSchema(jsonSchema: unknown): z4.ZodType | undefined;
+/**
+ * Decomposes an object {@link SchemaLike} into its declared fields, each mapped
+ * to a validator for that field alone.
+ *
+ * This is what lets a *partial* object be checked key by key. A state schema
+ * declares the keys a workflow may write, but the state holds only the ones
+ * written so far, so validating the whole object against the schema would
+ * reject it for missing fields that simply have not been set yet.
+ *
+ * Returns `undefined` when the schema is not an object schema or cannot be
+ * decomposed, and maps a field to `undefined` when that field's own schema has
+ * no Zod equivalent. Both mean "unvalidatable" rather than invalid, consistent
+ * with {@link parseWithSchema}.
+ */
+export declare function objectSchemaFields(schema: SchemaLike): Map<string, z4.ZodType | undefined> | undefined;

package/dist/types/utils/simple_zod_to_json.d.ts

@@ -6,8 +6,16 @@
 import { Schema } from '@google/genai';
 import { z as z3 } from 'zod/v3';
 import { z as z4 } from 'zod/v4';
+type ZodSchema<T = unknown> = z3.ZodType<T> | z4.ZodType<T>;
+/** Returns true if the value is a Zod schema (v3 or v4). */
+export declare function isZodSchema(obj: unknown): obj is ZodSchema;
+/** Returns true if the value is a Zod v3 schema. */
+export declare function isZodV3Schema(obj: unknown): obj is z3.ZodTypeAny;
+/** Returns true if the value is a Zod v4 schema. */
+export declare function isZodV4Schema(obj: unknown): obj is z4.ZodType;
 /**
  * Returns true if the given object is a ZodObject (supports both Zod v3 and v4).
  */
 export declare function isZodObject(obj: unknown): obj is z3.ZodObject<z3.ZodRawShape> | z4.ZodObject<z4.ZodRawShape>;
 export declare function zodObjectToSchema(schema: z3.ZodObject<z3.ZodRawShape> | z4.ZodObject<z4.ZodRawShape>): Schema;
+export {};

package/dist/types/utils/ssrf_guard.d.ts

@@ -0,0 +1,32 @@
+/**
+ * @license
+ * Copyright 2026 Google LLC
+ * SPDX-License-Identifier: Apache-2.0
+ */
+/** Returns `true` when `url` uses a scheme that may be fetched. */
+export declare function isHttpUrl(url: URL): boolean;
+/**
+ * Returns `true` for `localhost` and any `*.localhost` name (case-insensitive,
+ * ignoring a trailing dot), matching Python's `_is_blocked_hostname` helper.
+ */
+export declare function isLocalhostHostname(hostname: string): boolean;
+/** Strips the surrounding brackets from an IPv6 URL hostname (`[::1]` → `::1`). */
+export declare function normalizeHost(hostname: string): string;
+/**
+ * Returns `true` when `address` is not globally routable (private, loopback,
+ * link-local, shared, reserved, multicast, ...). Unparseable input fails closed
+ * (blocked).
+ */
+export declare function isNonGlobalAddress(address: string): boolean;
+/**
+ * Returns `true` when `address` is link-local: IPv4 `169.254.0.0/16` (which
+ * holds the cloud metadata endpoint), IPv6 `fe80::/10`, or an IPv6 address that
+ * embeds a link-local IPv4. Unparseable input fails closed (blocked).
+ */
+export declare function isLinkLocalAddress(address: string): boolean;
+/**
+ * Resolves `hostname` to a de-duplicated list of IP addresses. IP literals are
+ * returned as-is; hostnames are resolved via DNS. Throws when resolution yields
+ * no address.
+ */
+export declare function resolveHostAddresses(hostname: string): Promise<string[]>;

package/dist/types/utils/vertex_ai_utils.d.ts

@@ -7,6 +7,10 @@ export declare const EXPRESS_MODE_UNSUPPORTED_MESSAGE: string;
 /**
  * Validates and returns the API key for Express Mode.
  *
+ * The key is only returned when enterprise mode is enabled via
+ * `GOOGLE_GENAI_USE_ENTERPRISE` (or the deprecated
+ * `GOOGLE_GENAI_USE_VERTEXAI`).
+ *
  * @param project The project id.
  * @param location The location.
  * @param expressModeApiKey The API key for Express Mode.

package/dist/types/version.d.ts

@@ -3,4 +3,4 @@
  * Copyright 2025 Google LLC
  * SPDX-License-Identifier: Apache-2.0
  */
-export declare const version = "1.6.0";
+export declare const version = "2.1.0";