@google/adk 2.0.0 → 2.1.0

package/dist/types/utils/logger.d.ts

@@ -1,3 +1,8 @@
+/**
+ * @license
+ * Copyright 2025 Google LLC
+ * SPDX-License-Identifier: Apache-2.0
+ */
 /** Log levels for the logger. */
 export declare enum LogLevel {
     DEBUG = 0,
@@ -16,6 +21,13 @@ export interface Logger {
     error(...args: unknown[]): void;
     setLogLevel(level: LogLevel): void;
 }
+/** The `console` method each level is written with. */
+export declare const CONSOLE_METHOD: {
+    readonly 0: "debug";
+    readonly 1: "info";
+    readonly 2: "warn";
+    readonly 3: "error";
+};
 /**
  * Sets a custom logger for ADK, or null to disable logging.
  */
@@ -25,7 +37,17 @@ export declare function setLogger(customLogger: Logger | null): void;
  */
 export declare function getLogger(): Logger;
 /**
- * Resets the logger to the default SimpleLogger.
+ * Resets the logger to the built-in console logger.
+ *
+ * This is the inverse of {@link setLogger}: it reinstates the built-in logger
+ * after a custom one has been installed. Prefer it over `setLogger(null)`,
+ * which installs a no-op logger that discards every message rather than
+ * restoring default output. On Node it also replaces the winston-backed logger
+ * that the Node entry point installs.
+ *
+ * The default logger is constructed fresh, so a log level previously applied
+ * with {@link setLogLevel} is discarded and the level returns to
+ * `LogLevel.INFO`.
  */
 export declare function resetLogger(): void;
 /**

package/dist/types/utils/logger_browser.d.ts

@@ -0,0 +1,28 @@
+/**
+ * @license
+ * Copyright 2026 Google LLC
+ * SPDX-License-Identifier: Apache-2.0
+ */
+/**
+ * The browser logger implementation.
+ *
+ * It mirrors the Node logger (`logger_node.ts`): a dedicated `Logger` class plus
+ * an `install*` function that the browser entry point (`core/src/index_web.ts`)
+ * wires in through `setLogger`. It writes through `console` and colours the
+ * level with a `%c` CSS directive, which browser dev consoles render (ANSI
+ * escape codes, as winston emits on Node, are not rendered there).
+ * See https://github.com/google/adk-js/issues/611.
+ */
+import { Logger, LogLevel } from './logger.js';
+/** The default logger in the browser. Writes coloured lines through `console`. */
+export declare class BrowserLogger implements Logger {
+    private logLevel;
+    setLogLevel(level: LogLevel): void;
+    log(level: LogLevel, ...messages: unknown[]): void;
+    debug(...messages: unknown[]): void;
+    info(...messages: unknown[]): void;
+    warn(...messages: unknown[]): void;
+    error(...messages: unknown[]): void;
+}
+/** Makes the colour-aware browser logger the current ADK logger. */
+export declare function installBrowserLogger(): void;

package/dist/types/utils/logger_node.d.ts

@@ -0,0 +1,20 @@
+/**
+ * @license
+ * Copyright 2026 Google LLC
+ * SPDX-License-Identifier: Apache-2.0
+ */
+import { Logger, LogLevel } from './logger.js';
+/** The default logger on Node. Writes through winston. */
+export declare class WinstonLogger implements Logger {
+    private readonly logger;
+    private logLevel;
+    constructor();
+    setLogLevel(level: LogLevel): void;
+    log(level: LogLevel, ...messages: unknown[]): void;
+    debug(...messages: unknown[]): void;
+    info(...messages: unknown[]): void;
+    warn(...messages: unknown[]): void;
+    error(...messages: unknown[]): void;
+}
+/** Makes the winston-backed logger the current ADK logger. */
+export declare function installNodeLogger(): void;

package/dist/types/utils/output_schema_utils.d.ts

@@ -8,9 +8,9 @@
  * time as tools, which is strictly more reliable than the prompt-based
  * `set_model_response` workaround.
  *
- * Early Access Program model names encode no numeric version, so
- * `isGemini2OrAbove` rejects them even on Vertex AI. The Python
- * implementation accepts them; that gap lives in the shared predicate.
+ * Early Access Program model names encode no numeric version, so this returns
+ * `false` for them even on Vertex AI, where they do support the capability.
+ * That under-reporting is a known gap.
  *
  * @param modelString A simple or path-based model name.
  * @return True if the model supports an output schema alongside tools.

package/dist/types/utils/redact_inline_data.d.ts

@@ -0,0 +1,16 @@
+/**
+ * @license
+ * Copyright 2026 Google LLC
+ * SPDX-License-Identifier: Apache-2.0
+ */
+/**
+ * Serializes a value as JSON with every inline attachment payload elided.
+ *
+ * An `Event` carrying an image, an audio clip or a PDF holds the whole
+ * attachment as a base64 string at `content.parts[].inlineData.data`. Passing
+ * such an event to `JSON.stringify` writes those bytes into whatever collects
+ * the log, which is a different trust boundary from whoever uploaded the file.
+ * Each blob keeps its descriptive fields and reports how many characters were
+ * elided in place of the payload.
+ */
+export declare function stringifyWithRedactedInlineData(value: unknown): string;

package/dist/types/utils/redact_uri.d.ts

@@ -4,19 +4,23 @@
  * SPDX-License-Identifier: Apache-2.0
  */
 /**
- * Redacts the credentials from a connection URI so the URI can be safely
- * included in error messages and logs.
+ * Redacts credentials from a URI so it can be safely included in error
+ * messages and logs.
  *
  * A database or session-service connection URI such as
  * `postgres://user:password@host:5432/db` embeds the password in its userinfo
- * component. Including such a URI verbatim in a thrown Error or log entry leaks
- * the credential to wherever those are collected (log files, error-tracking
+ * component. An OAuth2 callback/authorization-response URI instead carries
+ * its secret (an authorization code, or an echoed token) as a query
+ * parameter, for example `https://app/callback?code=SECRET&state=xyz`.
+ * Including either verbatim in a thrown Error or log entry leaks the
+ * credential to wherever those are collected (log files, error-tracking
  * services, stdout captured by an orchestrator), which is frequently a
- * different trust boundary from whoever provisioned the connection string.
+ * different trust boundary from whoever holds the credential.
  *
- * The same credential can instead arrive as a query parameter, for example
- * `postgres://user@host/db?password=secret`, which several drivers accept and
- * which reaches the same error paths. Both forms are masked.
+ * The same connection-string credential can also arrive as a query
+ * parameter rather than userinfo, for example
+ * `postgres://user@host/db?password=secret`, which several drivers accept
+ * and which reaches the same error paths. All forms above are masked.
  *
  * The rest of the URI is kept intact for debugging, mirroring the semantics of
  * Go's `net/url.URL.Redacted()`. A URI carrying no credential is returned

package/dist/types/utils/ssrf_guard.d.ts

@@ -0,0 +1,32 @@
+/**
+ * @license
+ * Copyright 2026 Google LLC
+ * SPDX-License-Identifier: Apache-2.0
+ */
+/** Returns `true` when `url` uses a scheme that may be fetched. */
+export declare function isHttpUrl(url: URL): boolean;
+/**
+ * Returns `true` for `localhost` and any `*.localhost` name (case-insensitive,
+ * ignoring a trailing dot), matching Python's `_is_blocked_hostname` helper.
+ */
+export declare function isLocalhostHostname(hostname: string): boolean;
+/** Strips the surrounding brackets from an IPv6 URL hostname (`[::1]` → `::1`). */
+export declare function normalizeHost(hostname: string): string;
+/**
+ * Returns `true` when `address` is not globally routable (private, loopback,
+ * link-local, shared, reserved, multicast, ...). Unparseable input fails closed
+ * (blocked).
+ */
+export declare function isNonGlobalAddress(address: string): boolean;
+/**
+ * Returns `true` when `address` is link-local: IPv4 `169.254.0.0/16` (which
+ * holds the cloud metadata endpoint), IPv6 `fe80::/10`, or an IPv6 address that
+ * embeds a link-local IPv4. Unparseable input fails closed (blocked).
+ */
+export declare function isLinkLocalAddress(address: string): boolean;
+/**
+ * Resolves `hostname` to a de-duplicated list of IP addresses. IP literals are
+ * returned as-is; hostnames are resolved via DNS. Throws when resolution yields
+ * no address.
+ */
+export declare function resolveHostAddresses(hostname: string): Promise<string[]>;

package/dist/types/version.d.ts

@@ -3,4 +3,4 @@
  * Copyright 2025 Google LLC
  * SPDX-License-Identifier: Apache-2.0
  */
-export declare const version = "2.0.0";
+export declare const version = "2.1.0";