@google/adk 2.0.0 → 2.1.0

package/dist/web/auth/oauth2/oauth2_credential_exchanger.js

@@ -1,194 +0,0 @@
-import {createRequire as topLevelCreateRequire} from 'module';
-const require = topLevelCreateRequire(import.meta.url);
-var __defProp = Object.defineProperty;
-var __defProps = Object.defineProperties;
-var __getOwnPropDescs = Object.getOwnPropertyDescriptors;
-var __getOwnPropSymbols = Object.getOwnPropertySymbols;
-var __hasOwnProp = Object.prototype.hasOwnProperty;
-var __propIsEnum = Object.prototype.propertyIsEnumerable;
-var __defNormalProp = (obj, key, value) => key in obj ? __defProp(obj, key, { enumerable: true, configurable: true, writable: true, value }) : obj[key] = value;
-var __spreadValues = (a, b) => {
-  for (var prop in b || (b = {}))
-    if (__hasOwnProp.call(b, prop))
-      __defNormalProp(a, prop, b[prop]);
-  if (__getOwnPropSymbols)
-    for (var prop of __getOwnPropSymbols(b)) {
-      if (__propIsEnum.call(b, prop))
-        __defNormalProp(a, prop, b[prop]);
-    }
-  return a;
-};
-var __spreadProps = (a, b) => __defProps(a, __getOwnPropDescs(b));
-var __name = (target, value) => __defProp(target, "name", { value, configurable: true });
-/**
- * @license
- * Copyright 2026 Google LLC
- * SPDX-License-Identifier: Apache-2.0
- */
-import { logger } from "../../utils/logger.js";
-import {
-  getOAuthGrantTypeFromFlow,
-  OAuthGrantType
-} from "../auth_schemes.js";
-import {
-  CredentialExchangeError
-} from "../exchanger/base_credential_exchanger.js";
-import {
-  createOAuth2TokenRequestBody,
-  fetchOAuth2Tokens,
-  getTokenEndpoint,
-  parseAuthorizationCode
-} from "./oauth2_utils.js";
-const _OAuth2CredentialExchanger = class _OAuth2CredentialExchanger {
-  async exchange({
-    authCredential,
-    authScheme
-  }) {
-    var _a;
-    if (!authScheme) {
-      throw new CredentialExchangeError(
-        "authScheme is required for OAuth2 credential exchange"
-      );
-    }
-    if ((_a = authCredential.oauth2) == null ? void 0 : _a.accessToken) {
-      return {
-        credential: authCredential,
-        wasExchanged: false
-      };
-    }
-    const grantType = determineGrantType(authScheme);
-    if (grantType === OAuthGrantType.CLIENT_CREDENTIALS) {
-      return exchangeClientCredentials({ authCredential, authScheme });
-    }
-    if (grantType === OAuthGrantType.AUTHORIZATION_CODE) {
-      return exchangeAuthorizationCode({ authCredential, authScheme });
-    }
-    logger.warn("Unsupported OAuth2 grant type: ".concat(grantType));
-    return {
-      credential: authCredential,
-      wasExchanged: false
-    };
-  }
-};
-__name(_OAuth2CredentialExchanger, "OAuth2CredentialExchanger");
-let OAuth2CredentialExchanger = _OAuth2CredentialExchanger;
-function determineGrantType(authScheme) {
-  var _a;
-  if ("flows" in authScheme && authScheme.flows) {
-    return getOAuthGrantTypeFromFlow(authScheme.flows);
-  }
-  if (authScheme.grantTypesSupported) {
-    const oidcScheme = authScheme;
-    if ((_a = oidcScheme.grantTypesSupported) == null ? void 0 : _a.includes("client_credentials")) {
-      return OAuthGrantType.CLIENT_CREDENTIALS;
-    }
-    return OAuthGrantType.AUTHORIZATION_CODE;
-  }
-  return void 0;
-}
-__name(determineGrantType, "determineGrantType");
-async function exchangeClientCredentials({
-  authCredential,
-  authScheme
-}) {
-  var _a, _b;
-  const tokenEndpoint = getTokenEndpoint(authScheme);
-  if (!tokenEndpoint) {
-    throw new CredentialExchangeError(
-      "Token endpoint not found in auth scheme."
-    );
-  }
-  if (!((_a = authCredential.oauth2) == null ? void 0 : _a.clientId) || !((_b = authCredential.oauth2) == null ? void 0 : _b.clientSecret)) {
-    throw new CredentialExchangeError(
-      "clientId and clientSecret are required for client credentials exchange."
-    );
-  }
-  const body = createOAuth2TokenRequestBody({
-    grantType: "client_credentials",
-    clientId: authCredential.oauth2.clientId,
-    clientSecret: authCredential.oauth2.clientSecret
-  });
-  try {
-    const oauth2Auth = await fetchOAuth2Tokens(tokenEndpoint, body);
-    return {
-      credential: __spreadProps(__spreadValues({}, authCredential), {
-        oauth2: __spreadValues(__spreadValues({}, authCredential.oauth2), oauth2Auth)
-      }),
-      wasExchanged: true
-    };
-  } catch (error) {
-    throw new CredentialExchangeError(
-      "Failed to exchange tokens: ".concat(error instanceof Error ? error.message : String(error))
-    );
-  }
-}
-__name(exchangeClientCredentials, "exchangeClientCredentials");
-async function exchangeAuthorizationCode({
-  authCredential,
-  authScheme
-}) {
-  var _a, _b, _c, _d;
-  const tokenEndpoint = getTokenEndpoint(authScheme);
-  if (!tokenEndpoint) {
-    throw new CredentialExchangeError(
-      "Token endpoint not found in auth scheme."
-    );
-  }
-  if (!((_a = authCredential.oauth2) == null ? void 0 : _a.clientId) || !((_b = authCredential.oauth2) == null ? void 0 : _b.clientSecret) || !((_c = authCredential.oauth2) == null ? void 0 : _c.authCode) && !((_d = authCredential.oauth2) == null ? void 0 : _d.authResponseUri)) {
-    throw new CredentialExchangeError(
-      "clientId, clientSecret, and either authCode or authResponseUri are required for authorization code exchange."
-    );
-  }
-  let code = authCredential.oauth2.authCode;
-  if (!code && authCredential.oauth2.authResponseUri) {
-    code = parseAuthorizationCode(authCredential.oauth2.authResponseUri);
-  }
-  if (authCredential.oauth2.authResponseUri && authCredential.oauth2.state) {
-    try {
-      const url = new URL(authCredential.oauth2.authResponseUri);
-      const receivedState = url.searchParams.get("state") || void 0;
-      if (authCredential.oauth2.state !== receivedState) {
-        throw new CredentialExchangeError(
-          "State mismatch detected. Potential CSRF attack."
-        );
-      }
-    } catch (e) {
-      throw new CredentialExchangeError(
-        "Failed to parse authResponseUri for state validation: ".concat(e instanceof Error ? e.message : String(e))
-      );
-    }
-  }
-  if (!code) {
-    throw new CredentialExchangeError(
-      "Authorization code not found in auth response."
-    );
-  }
-  const body = createOAuth2TokenRequestBody({
-    grantType: "authorization_code",
-    clientId: authCredential.oauth2.clientId,
-    clientSecret: authCredential.oauth2.clientSecret,
-    code,
-    redirectUri: authCredential.oauth2.redirectUri,
-    codeVerifier: authCredential.oauth2.codeVerifier
-  });
-  try {
-    const oauth2Auth = await fetchOAuth2Tokens(tokenEndpoint, body);
-    return {
-      credential: __spreadProps(__spreadValues({}, authCredential), {
-        oauth2: __spreadValues(__spreadValues({}, authCredential.oauth2), oauth2Auth)
-      }),
-      wasExchanged: true
-    };
-  } catch (error) {
-    throw new CredentialExchangeError(
-      "Failed to exchange tokens: ".concat(error instanceof Error ? error.message : String(error))
-    );
-  }
-}
-__name(exchangeAuthorizationCode, "exchangeAuthorizationCode");
-export {
-  OAuth2CredentialExchanger,
-  determineGrantType,
-  exchangeAuthorizationCode,
-  exchangeClientCredentials
-};

package/dist/web/auth/oauth2/oauth2_credential_refresher.js

@@ -1,105 +0,0 @@
-import {createRequire as topLevelCreateRequire} from 'module';
-const require = topLevelCreateRequire(import.meta.url);
-var __defProp = Object.defineProperty;
-var __defProps = Object.defineProperties;
-var __getOwnPropDescs = Object.getOwnPropertyDescriptors;
-var __getOwnPropSymbols = Object.getOwnPropertySymbols;
-var __hasOwnProp = Object.prototype.hasOwnProperty;
-var __propIsEnum = Object.prototype.propertyIsEnumerable;
-var __defNormalProp = (obj, key, value) => key in obj ? __defProp(obj, key, { enumerable: true, configurable: true, writable: true, value }) : obj[key] = value;
-var __spreadValues = (a, b) => {
-  for (var prop in b || (b = {}))
-    if (__hasOwnProp.call(b, prop))
-      __defNormalProp(a, prop, b[prop]);
-  if (__getOwnPropSymbols)
-    for (var prop of __getOwnPropSymbols(b)) {
-      if (__propIsEnum.call(b, prop))
-        __defNormalProp(a, prop, b[prop]);
-    }
-  return a;
-};
-var __spreadProps = (a, b) => __defProps(a, __getOwnPropDescs(b));
-var __name = (target, value) => __defProp(target, "name", { value, configurable: true });
-/**
- * @license
- * Copyright 2026 Google LLC
- * SPDX-License-Identifier: Apache-2.0
- */
-import { logger } from "../../utils/logger.js";
-import {
-  fetchOAuth2Tokens,
-  getTokenEndpoint,
-  isTokenExpired
-} from "./oauth2_utils.js";
-const _OAuth2CredentialRefresher = class _OAuth2CredentialRefresher {
-  /**
-   * Check if the OAuth2 credential needs to be refreshed.
-   *
-   * @param authCredential The OAuth2 credential to check.
-   * @param authScheme The OAuth2 authentication scheme (optional).
-   * @returns True if the credential needs to be refreshed, False otherwise.
-   */
-  async isRefreshNeeded(authCredential) {
-    if (!authCredential.oauth2) {
-      return false;
-    }
-    if (authCredential.oauth2 && authCredential.oauth2.expiresAt) {
-      return isTokenExpired(authCredential.oauth2);
-    }
-    return false;
-  }
-  /**
-   * Refresh the OAuth2 credential.
-   *
-   * @param authCredential The OAuth2 credential to refresh.
-   * @param authScheme The OAuth2 authentication scheme.
-   * @returns The refreshed credential.
-   */
-  async refresh(authCredential, authScheme) {
-    if (!authCredential.oauth2 || !authScheme) {
-      return authCredential;
-    }
-    if (!authCredential.oauth2.refreshToken) {
-      logger.warn("No refresh token available to refresh credential");
-      return authCredential;
-    }
-    const isNeeded = await this.isRefreshNeeded(authCredential);
-    if (!isNeeded) {
-      return authCredential;
-    }
-    const tokenEndpoint = getTokenEndpoint(authScheme);
-    if (!tokenEndpoint) {
-      logger.warn("Token endpoint not found in auth scheme.");
-      return authCredential;
-    }
-    if (!authCredential.oauth2.clientId || !authCredential.oauth2.clientSecret) {
-      logger.warn("clientId and clientSecret are required for token refresh.");
-      return authCredential;
-    }
-    const body = new URLSearchParams();
-    body.set("grant_type", "refresh_token");
-    body.set("refresh_token", authCredential.oauth2.refreshToken);
-    body.set("client_id", authCredential.oauth2.clientId);
-    body.set("client_secret", authCredential.oauth2.clientSecret);
-    try {
-      const data = await fetchOAuth2Tokens(tokenEndpoint, body);
-      const updatedOAuth2 = __spreadProps(__spreadValues({}, authCredential.oauth2), {
-        accessToken: data.accessToken || authCredential.oauth2.accessToken,
-        refreshToken: data.refreshToken || authCredential.oauth2.refreshToken,
-        expiresIn: data.expiresIn,
-        expiresAt: data.expiresAt || authCredential.oauth2.expiresAt
-      });
-      return __spreadProps(__spreadValues({}, authCredential), {
-        oauth2: updatedOAuth2
-      });
-    } catch (error) {
-      logger.error("Failed to refresh tokens:", error);
-      return authCredential;
-    }
-  }
-};
-__name(_OAuth2CredentialRefresher, "OAuth2CredentialRefresher");
-let OAuth2CredentialRefresher = _OAuth2CredentialRefresher;
-export {
-  OAuth2CredentialRefresher
-};

package/dist/web/auth/oauth2/oauth2_discovery.js

@@ -1,196 +0,0 @@
-import {createRequire as topLevelCreateRequire} from 'module';
-const require = topLevelCreateRequire(import.meta.url);
-var __defProp = Object.defineProperty;
-var __name = (target, value) => __defProp(target, "name", { value, configurable: true });
-/**
- * @license
- * Copyright 2026 Google LLC
- * SPDX-License-Identifier: Apache-2.0
- */
-import { z } from "zod";
-import { logger } from "../../utils/logger.js";
-const AuthorizationServerMetadataSchema = z.object({
-  issuer: z.string(),
-  authorization_endpoint: z.string(),
-  token_endpoint: z.string(),
-  scopes_supported: z.array(z.string()).optional(),
-  registration_endpoint: z.string().optional()
-});
-const ProtectedResourceMetadataSchema = z.object({
-  resource: z.string(),
-  authorization_servers: z.array(z.string()).default([])
-});
-const _OAuth2DiscoveryManager = class _OAuth2DiscoveryManager {
-  /**
-   * Discovers the OAuth2 authorization server metadata.
-   */
-  async discoverAuthServerMetadata(issuerUrl) {
-    if (!validateDiscoveryUrl(issuerUrl)) {
-      return void 0;
-    }
-    let baseUrl;
-    let path;
-    try {
-      const url = new URL(issuerUrl);
-      baseUrl = "".concat(url.protocol, "//").concat(url.host);
-      path = url.pathname;
-    } catch (e) {
-      logger.warn("Failed to parse issuerUrl ".concat(issuerUrl, ": ").concat(e));
-      return void 0;
-    }
-    const endpointsToTry = [];
-    if (path && path !== "/") {
-      endpointsToTry.push(
-        "".concat(baseUrl, "/.well-known/oauth-authorization-server").concat(path),
-        "".concat(baseUrl, "/.well-known/openid-configuration").concat(path),
-        "".concat(baseUrl).concat(path, "/.well-known/openid-configuration")
-      );
-    } else {
-      endpointsToTry.push(
-        "".concat(baseUrl, "/.well-known/oauth-authorization-server"),
-        "".concat(baseUrl, "/.well-known/openid-configuration")
-      );
-    }
-    for (const endpoint of endpointsToTry) {
-      try {
-        const response = await fetch(endpoint, {
-          method: "GET",
-          headers: {
-            Accept: "application/json"
-          },
-          // Never follow redirects: validateDiscoveryUrl only checks the
-          // initial URL, so following a 3xx would let a validated host
-          // redirect discovery to a private/cloud-metadata address (CWE-918).
-          redirect: "error"
-        });
-        if (!response.ok) {
-          continue;
-        }
-        const data = await response.json();
-        const metadata = AuthorizationServerMetadataSchema.parse(data);
-        if (metadata.issuer.replace(/\/$/, "") === issuerUrl.replace(/\/$/, "")) {
-          return metadata;
-        } else {
-          logger.warn(
-            "Issuer in metadata ".concat(metadata.issuer, " does not match issuerUrl ").concat(issuerUrl)
-          );
-        }
-      } catch (e) {
-        logger.debug("Failed to fetch metadata from ".concat(endpoint, ": ").concat(e));
-      }
-    }
-    return void 0;
-  }
-  /**
-   * Discovers the OAuth2 protected resource metadata.
-   */
-  async discoverResourceMetadata(resourceUrl) {
-    if (!validateDiscoveryUrl(resourceUrl)) {
-      return void 0;
-    }
-    let baseUrl;
-    let path;
-    try {
-      const url = new URL(resourceUrl);
-      baseUrl = "".concat(url.protocol, "//").concat(url.host);
-      path = url.pathname;
-    } catch (e) {
-      logger.warn("Failed to parse resourceUrl ".concat(resourceUrl, ": ").concat(e));
-      return void 0;
-    }
-    let wellKnownEndpoint;
-    if (path && path !== "/") {
-      wellKnownEndpoint = "".concat(baseUrl, "/.well-known/oauth-protected-resource").concat(path);
-    } else {
-      wellKnownEndpoint = "".concat(baseUrl, "/.well-known/oauth-protected-resource");
-    }
-    try {
-      const response = await fetch(wellKnownEndpoint, {
-        method: "GET",
-        headers: {
-          Accept: "application/json"
-        },
-        // Never follow redirects: validateDiscoveryUrl only checks the
-        // initial URL, so following a 3xx would let a validated host
-        // redirect discovery to a private/cloud-metadata address (CWE-918).
-        redirect: "error"
-      });
-      if (!response.ok) {
-        return void 0;
-      }
-      const data = await response.json();
-      const metadata = ProtectedResourceMetadataSchema.parse(data);
-      if (metadata.resource.replace(/\/$/, "") === resourceUrl.replace(/\/$/, "")) {
-        return metadata;
-      } else {
-        logger.warn(
-          "Resource in metadata ".concat(metadata.resource, " does not match resourceUrl ").concat(resourceUrl)
-        );
-      }
-    } catch (e) {
-      logger.debug("Failed to fetch metadata from ".concat(wellKnownEndpoint, ": ").concat(e));
-    }
-    return void 0;
-  }
-};
-__name(_OAuth2DiscoveryManager, "OAuth2DiscoveryManager");
-let OAuth2DiscoveryManager = _OAuth2DiscoveryManager;
-function normaliseHostname(raw) {
-  const stripped = raw.replace(/^\[|\]$/g, "");
-  const m = stripped.match(/^::ffff:([0-9a-f]{1,4}):([0-9a-f]{1,4})$/i);
-  if (m) {
-    const hi = parseInt(m[1], 16);
-    const lo = parseInt(m[2], 16);
-    return [hi >> 8 & 255, hi & 255, lo >> 8 & 255, lo & 255].join(".");
-  }
-  const mDot = stripped.match(/^::ffff:(\d+\.\d+\.\d+\.\d+)$/i);
-  if (mDot) return mDot[1];
-  return raw;
-}
-__name(normaliseHostname, "normaliseHostname");
-function validateDiscoveryUrl(urlStr) {
-  try {
-    const url = new URL(urlStr);
-    if (url.protocol !== "https:") {
-      logger.warn("Unsafe protocol for discovery URL: ".concat(url.protocol));
-      return false;
-    }
-    const host = normaliseHostname(url.hostname.toLowerCase());
-    if (host === "localhost" || host === "metadata.google.internal" || host === "metadata.goog" || host.startsWith("127.") || host === "[::1]" || host === "[::]" || host === "0.0.0.0" || host.startsWith("10.") || host.startsWith("192.168.") || host.startsWith("169.254.")) {
-      logger.warn("Unsafe host for discovery URL: ".concat(host));
-      return false;
-    }
-    const match = host.match(/^172\.(\d+)\./);
-    if (match) {
-      const secondOctet = parseInt(match[1], 10);
-      if (secondOctet >= 16 && secondOctet <= 31) {
-        logger.warn("Unsafe host for discovery URL: ".concat(host));
-        return false;
-      }
-    }
-    const cgnatMatch = host.match(/^100\.(\d+)\./);
-    if (cgnatMatch) {
-      const secondOctet = parseInt(cgnatMatch[1], 10);
-      if (secondOctet >= 64 && secondOctet <= 127) {
-        logger.warn("Unsafe host for discovery URL: ".concat(host));
-        return false;
-      }
-    }
-    if (/^\[(f[cd][0-9a-f]{2}|fe[89ab][0-9a-f]):/i.test(url.hostname)) {
-      logger.warn("Unsafe host for discovery URL: ".concat(url.hostname));
-      return false;
-    }
-    return true;
-  } catch (e) {
-    logger.warn("Failed to parse URL for validation ".concat(urlStr, ": ").concat(e));
-    return false;
-  }
-}
-__name(validateDiscoveryUrl, "validateDiscoveryUrl");
-export {
-  AuthorizationServerMetadataSchema,
-  OAuth2DiscoveryManager,
-  ProtectedResourceMetadataSchema,
-  normaliseHostname,
-  validateDiscoveryUrl
-};

package/dist/web/auth/oauth2/oauth2_utils.js

@@ -1,105 +0,0 @@
-import {createRequire as topLevelCreateRequire} from 'module';
-const require = topLevelCreateRequire(import.meta.url);
-var __defProp = Object.defineProperty;
-var __name = (target, value) => __defProp(target, "name", { value, configurable: true });
-/**
- * @license
- * Copyright 2026 Google LLC
- * SPDX-License-Identifier: Apache-2.0
- */
-import { logger } from "../../utils/logger.js";
-import { validateDiscoveryUrl } from "./oauth2_discovery.js";
-function getTokenEndpoint(authScheme) {
-  if (authScheme.type === "openIdConnect" && authScheme.tokenEndpoint) {
-    return authScheme.tokenEndpoint;
-  }
-  if (authScheme.type === "oauth2" && authScheme.flows) {
-    const flows = authScheme.flows;
-    const flow = flows.authorizationCode || flows.clientCredentials || flows.password || flows.implicit;
-    if (flow && "tokenUrl" in flow) {
-      return flow.tokenUrl;
-    }
-  }
-  return void 0;
-}
-__name(getTokenEndpoint, "getTokenEndpoint");
-async function fetchOAuth2Tokens(endpoint, body) {
-  if (!validateDiscoveryUrl(endpoint)) {
-    throw new Error(
-      "SSRF protection: OAuth2 token endpoint '".concat(endpoint, "' is not allowed. Must use HTTPS and must not target private/loopback/cloud-metadata addresses.")
-    );
-  }
-  try {
-    const response = await fetch(endpoint, {
-      method: "POST",
-      headers: {
-        "Content-Type": "application/x-www-form-urlencoded"
-      },
-      body: body.toString(),
-      // Never follow redirects: the SSRF blocklist only validates `endpoint`,
-      // so a validated host that responds with a 3xx could otherwise redirect
-      // this credential-bearing POST (client_secret/refresh_token) to a
-      // private/cloud-metadata address (CWE-918).
-      redirect: "error"
-    });
-    if (!response.ok) {
-      throw new Error("Token request failed with status ".concat(response.status));
-    }
-    const data = await response.json();
-    return {
-      accessToken: data.access_token,
-      refreshToken: data.refresh_token,
-      idToken: data.id_token,
-      expiresIn: data.expires_in,
-      expiresAt: data.expires_in ? Date.now() + data.expires_in * 1e3 : void 0
-    };
-  } catch (e) {
-    logger.error("Failed to fetch OAuth2 tokens: ".concat(e));
-    throw e;
-  }
-}
-__name(fetchOAuth2Tokens, "fetchOAuth2Tokens");
-function parseAuthorizationCode(uri) {
-  try {
-    const url = new URL(uri);
-    return url.searchParams.get("code") || void 0;
-  } catch (e) {
-    logger.warn("Failed to parse authorization URI ".concat(uri, ": ").concat(e));
-    return void 0;
-  }
-}
-__name(parseAuthorizationCode, "parseAuthorizationCode");
-function createOAuth2TokenRequestBody(params) {
-  const body = new URLSearchParams();
-  body.set("grant_type", params.grantType);
-  body.set("client_id", params.clientId);
-  body.set("client_secret", params.clientSecret);
-  if (params.grantType === "authorization_code") {
-    body.set("code", params.code);
-    if (params.redirectUri) {
-      body.set("redirect_uri", params.redirectUri);
-    }
-    if (params.codeVerifier) {
-      body.set("code_verifier", params.codeVerifier);
-    }
-  } else if (params.grantType === "refresh_token") {
-    body.set("refresh_token", params.refreshToken);
-  }
-  return body;
-}
-__name(createOAuth2TokenRequestBody, "createOAuth2TokenRequestBody");
-function isTokenExpired(token, leeway = 60) {
-  if (typeof token.expiresAt !== "number") {
-    return false;
-  }
-  const expirationThreshold = token.expiresAt - leeway * 1e3;
-  return expirationThreshold < Date.now();
-}
-__name(isTokenExpired, "isTokenExpired");
-export {
-  createOAuth2TokenRequestBody,
-  fetchOAuth2Tokens,
-  getTokenEndpoint,
-  isTokenExpired,
-  parseAuthorizationCode
-};

package/dist/web/auth/refresher/credential_refresher_registry.js

@@ -1,44 +0,0 @@
-import {createRequire as topLevelCreateRequire} from 'module';
-const require = topLevelCreateRequire(import.meta.url);
-var __defProp = Object.defineProperty;
-var __name = (target, value) => __defProp(target, "name", { value, configurable: true });
-/**
- * @license
- * Copyright 2026 Google LLC
- * SPDX-License-Identifier: Apache-2.0
- */
-import { AuthCredentialTypes } from "../auth_credential.js";
-const _CredentialRefresherRegistry = class _CredentialRefresherRegistry {
-  constructor() {
-    this.refreshers = {
-      [AuthCredentialTypes.API_KEY]: void 0,
-      [AuthCredentialTypes.HTTP]: void 0,
-      [AuthCredentialTypes.OAUTH2]: void 0,
-      [AuthCredentialTypes.OPEN_ID_CONNECT]: void 0,
-      [AuthCredentialTypes.SERVICE_ACCOUNT]: void 0
-    };
-  }
-  /**
-   * Register a refresher instance for a credential type.
-   *
-   * @param credentialType The credential type to register for.
-   * @param refresherInstance The refresher instance to register.
-   */
-  register(credentialType, refresherInstance) {
-    this.refreshers[credentialType] = refresherInstance;
-  }
-  /**
-   * Get the refresher instance for a credential type.
-   *
-   * @param credentialType The credential type to get refresher for.
-   * @returns The refresher instance if registered, undefined otherwise.
-   */
-  getRefresher(credentialType) {
-    return this.refreshers[credentialType];
-  }
-};
-__name(_CredentialRefresherRegistry, "CredentialRefresherRegistry");
-let CredentialRefresherRegistry = _CredentialRefresherRegistry;
-export {
-  CredentialRefresherRegistry
-};