@google/adk 2.0.0 → 2.2.0

package/dist/cjs/tools/openapi_tool/auth/auth_helpers.js

@@ -25,17 +25,92 @@ var __copyProps = (to, from, except, desc) => {
 var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
 var auth_helpers_exports = {};
 __export(auth_helpers_exports, {
+  INTERNAL_AUTH_PREFIX: () => INTERNAL_AUTH_PREFIX,
   applyCredential: () => applyCredential,
   createApiKeyScheme: () => createApiKeyScheme,
-  createBearerScheme: () => createBearerScheme
+  createBearerScheme: () => createBearerScheme,
+  credentialToParam: () => credentialToParam,
+  dictToAuthScheme: () => dictToAuthScheme,
+  openidDictToSchemeCredential: () => openidDictToSchemeCredential,
+  openidUrlToSchemeCredential: () => openidUrlToSchemeCredential,
+  serviceAccountDictToSchemeCredential: () => serviceAccountDictToSchemeCredential,
+  serviceAccountSchemeCredential: () => serviceAccountSchemeCredential,
+  tokenToSchemeCredential: () => tokenToSchemeCredential
 });
 module.exports = __toCommonJS(auth_helpers_exports);
+var import_zod = require("zod");
+var import_auth_credential = require("../../../auth/auth_credential.js");
+var import_case_utils = require("../../../utils/case_utils.js");
 /**
  * @license
  * Copyright 2026 Google LLC
  * SPDX-License-Identifier: Apache-2.0
  */
+const INTERNAL_AUTH_PREFIX = "_auth_prefix_vaf_";
+const API_KEY_LOCATIONS = ["header", "query", "cookie"];
+const OPENID_FETCH_TIMEOUT_MS = 1e4;
+const REQUIRED_CREDENTIAL_FIELDS = ["client_id", "client_secret"];
+const scopesSchema = import_zod.z.record(import_zod.z.string(), import_zod.z.string()).default({});
+const OAuthFlowsSchema = import_zod.z.looseObject({
+  implicit: import_zod.z.looseObject({
+    authorizationUrl: import_zod.z.string(),
+    refreshUrl: import_zod.z.string().optional(),
+    scopes: scopesSchema
+  }).optional(),
+  password: import_zod.z.looseObject({
+    tokenUrl: import_zod.z.string(),
+    refreshUrl: import_zod.z.string().optional(),
+    scopes: scopesSchema
+  }).optional(),
+  clientCredentials: import_zod.z.looseObject({
+    tokenUrl: import_zod.z.string(),
+    refreshUrl: import_zod.z.string().optional(),
+    scopes: scopesSchema
+  }).optional(),
+  authorizationCode: import_zod.z.looseObject({
+    authorizationUrl: import_zod.z.string(),
+    tokenUrl: import_zod.z.string(),
+    refreshUrl: import_zod.z.string().optional(),
+    scopes: scopesSchema
+  }).optional()
+});
+const ApiKeySchemeSchema = import_zod.z.looseObject({
+  type: import_zod.z.literal("apiKey"),
+  description: import_zod.z.string().optional(),
+  name: import_zod.z.string(),
+  in: import_zod.z.enum(API_KEY_LOCATIONS)
+});
+const HttpSchemeSchema = import_zod.z.looseObject({
+  type: import_zod.z.literal("http"),
+  description: import_zod.z.string().optional(),
+  scheme: import_zod.z.string(),
+  bearerFormat: import_zod.z.string().optional()
+});
+const Oauth2SchemeSchema = import_zod.z.looseObject({
+  type: import_zod.z.literal("oauth2"),
+  description: import_zod.z.string().optional(),
+  flows: OAuthFlowsSchema
+});
+const OpenIdConnectSchemeSchema = import_zod.z.looseObject({
+  type: import_zod.z.literal("openIdConnect"),
+  description: import_zod.z.string().optional(),
+  openIdConnectUrl: import_zod.z.string()
+});
+const OpenIdConnectConfigSchema = import_zod.z.looseObject({
+  type: import_zod.z.literal("openIdConnect").default("openIdConnect"),
+  description: import_zod.z.string().optional(),
+  openIdConnectUrl: import_zod.z.string().default(""),
+  authorizationEndpoint: import_zod.z.string(),
+  tokenEndpoint: import_zod.z.string(),
+  userinfoEndpoint: import_zod.z.string().optional(),
+  revocationEndpoint: import_zod.z.string().optional(),
+  tokenEndpointAuthMethodsSupported: import_zod.z.array(import_zod.z.string()).optional(),
+  grantTypesSupported: import_zod.z.array(import_zod.z.string()).optional(),
+  scopes: import_zod.z.array(import_zod.z.string()).optional()
+});
+const JsonObjectSchema = import_zod.z.record(import_zod.z.string(), import_zod.z.unknown());
 function applyCredential(url, headers, credential, authScheme) {
+  var _a;
   if (!credential) return url;
   if (credential.apiKey) {
     let inLocation;
@@ -53,8 +128,15 @@ function applyCredential(url, headers, credential, authScheme) {
     } else {
       headers["Authorization"] = credential.apiKey;
     }
-  } else if (credential.http && credential.http.credentials && credential.http.credentials.token) {
-    headers["Authorization"] = `Bearer ${credential.http.credentials.token}`;
+  } else if (credential.authType === import_auth_credential.AuthCredentialTypes.HTTP || credential.http) {
+    const httpCredentials = (_a = credential.http) == null ? void 0 : _a.credentials;
+    if (httpCredentials == null ? void 0 : httpCredentials.token) {
+      headers["Authorization"] = `Bearer ${httpCredentials.token}`;
+    } else if ((httpCredentials == null ? void 0 : httpCredentials.username) || (httpCredentials == null ? void 0 : httpCredentials.password)) {
+      throw new Error("Basic Authentication is not supported.");
+    } else {
+      throw new Error("Invalid HTTP auth credentials");
+    }
   }
   return url;
 }
@@ -74,9 +156,215 @@ function createBearerScheme() {
   };
 }
 __name(createBearerScheme, "createBearerScheme");
+function isApiKeyLocation(value) {
+  return API_KEY_LOCATIONS.some((location) => location === value);
+}
+__name(isApiKeyLocation, "isApiKeyLocation");
+function bearerJwtScheme() {
+  return { type: "http", scheme: "bearer", bearerFormat: "JWT" };
+}
+__name(bearerJwtScheme, "bearerJwtScheme");
+function bearerTokenParam(authScheme, token) {
+  var _a;
+  const param = {
+    originalName: "Authorization",
+    paramLocation: "header",
+    paramSchema: { type: "string" },
+    description: (_a = authScheme.description) != null ? _a : "Bearer token",
+    name: `${INTERNAL_AUTH_PREFIX}Authorization`,
+    required: true
+  };
+  return [param, { [param.name]: `Bearer ${token}` }];
+}
+__name(bearerTokenParam, "bearerTokenParam");
+function tokenToSchemeCredential(tokenType, location, name, credentialValue) {
+  if (tokenType === "apikey") {
+    if (!isApiKeyLocation(location)) {
+      throw new Error(`Invalid location for apiKey: ${location}`);
+    }
+    const authScheme = {
+      type: "apiKey",
+      in: location,
+      name: name != null ? name : ""
+    };
+    const authCredential = credentialValue ? { authType: import_auth_credential.AuthCredentialTypes.API_KEY, apiKey: credentialValue } : void 0;
+    return [authScheme, authCredential];
+  }
+  if (tokenType === "oauth2Token") {
+    const authCredential = credentialValue ? {
+      authType: import_auth_credential.AuthCredentialTypes.HTTP,
+      http: { scheme: "bearer", credentials: { token: credentialValue } }
+    } : void 0;
+    return [bearerJwtScheme(), authCredential];
+  }
+  throw new Error(`Invalid security scheme type: ${tokenType}`);
+}
+__name(tokenToSchemeCredential, "tokenToSchemeCredential");
+function serviceAccountDictToSchemeCredential(config, scopes) {
+  const authCredential = {
+    authType: import_auth_credential.AuthCredentialTypes.SERVICE_ACCOUNT,
+    serviceAccount: {
+      // The reference calls `ServiceAccountCredential.model_construct`, which
+      // skips validation on purpose, so the port does not validate either.
+      serviceAccountCredential: (0, import_case_utils.camelCaseKeys)(
+        config
+      ),
+      scopes
+    }
+  };
+  return [bearerJwtScheme(), authCredential];
+}
+__name(serviceAccountDictToSchemeCredential, "serviceAccountDictToSchemeCredential");
+function serviceAccountSchemeCredential(config) {
+  const authCredential = {
+    authType: import_auth_credential.AuthCredentialTypes.SERVICE_ACCOUNT,
+    serviceAccount: config
+  };
+  return [bearerJwtScheme(), authCredential];
+}
+__name(serviceAccountSchemeCredential, "serviceAccountSchemeCredential");
+function openidDictToSchemeCredential(configDict, scopes, credentialDict) {
+  const parsedConfig = OpenIdConnectConfigSchema.safeParse(
+    (0, import_case_utils.camelCaseKeys)(configDict)
+  );
+  if (!parsedConfig.success) {
+    throw new Error(
+      `Invalid OpenID Connect configuration: ${import_zod.z.prettifyError(parsedConfig.error)}`
+    );
+  }
+  const openidScheme = { ...parsedConfig.data, scopes };
+  const values = Object.values(credentialDict);
+  if (values.length === 1) {
+    const wrapped = JsonObjectSchema.safeParse(values[0]);
+    if (wrapped.success && "client_id" in wrapped.data && "client_secret" in wrapped.data) {
+      credentialDict = wrapped.data;
+    }
+  }
+  const missingFields = REQUIRED_CREDENTIAL_FIELDS.filter(
+    (field) => !(field in credentialDict)
+  );
+  if (missingFields.length > 0) {
+    throw new Error(
+      `Missing required fields in credential_dict: ${missingFields.join(", ")}`
+    );
+  }
+  const authCredential = {
+    authType: import_auth_credential.AuthCredentialTypes.OPEN_ID_CONNECT,
+    oauth2: {
+      clientId: String(credentialDict["client_id"]),
+      clientSecret: String(credentialDict["client_secret"]),
+      redirectUri: "redirect_uri" in credentialDict ? String(credentialDict["redirect_uri"]) : void 0
+    }
+  };
+  return [openidScheme, authCredential];
+}
+__name(openidDictToSchemeCredential, "openidDictToSchemeCredential");
+async function openidUrlToSchemeCredential(openidUrl, scopes, credentialDict) {
+  let response;
+  try {
+    response = await fetch(openidUrl, {
+      signal: AbortSignal.timeout(OPENID_FETCH_TIMEOUT_MS)
+    });
+    if (!response.ok) {
+      throw new Error(`responded with status ${response.status}`);
+    }
+  } catch (e) {
+    throw new Error(
+      `Failed to fetch OpenID configuration from ${openidUrl}: ${String(e)}`
+    );
+  }
+  let configDict;
+  try {
+    configDict = JsonObjectSchema.parse(await response.json());
+  } catch (e) {
+    throw new Error(
+      `Invalid JSON response from OpenID configuration endpoint ${openidUrl}: ${String(e)}`
+    );
+  }
+  return openidDictToSchemeCredential(
+    { ...configDict, openIdConnectUrl: openidUrl },
+    scopes,
+    credentialDict
+  );
+}
+__name(openidUrlToSchemeCredential, "openidUrlToSchemeCredential");
+function credentialToParam(authScheme, authCredential) {
+  var _a, _b, _c, _d;
+  if (!authCredential) {
+    return [void 0, void 0];
+  }
+  if (authScheme.type === "apiKey" && authCredential.apiKey) {
+    if (!isApiKeyLocation(authScheme.in)) {
+      throw new Error(`Invalid API Key location: ${authScheme.in}`);
+    }
+    const paramName = authScheme.name || "";
+    const param = {
+      originalName: paramName,
+      paramLocation: authScheme.in,
+      paramSchema: { type: "string" },
+      description: (_a = authScheme.description) != null ? _a : "",
+      name: INTERNAL_AUTH_PREFIX + paramName,
+      required: true
+    };
+    return [param, { [param.name]: authCredential.apiKey }];
+  }
+  if (authCredential.authType === import_auth_credential.AuthCredentialTypes.HTTP) {
+    const credentials = (_b = authCredential.http) == null ? void 0 : _b.credentials;
+    if (credentials == null ? void 0 : credentials.token) {
+      return bearerTokenParam(authScheme, credentials.token);
+    }
+    if ((credentials == null ? void 0 : credentials.username) || (credentials == null ? void 0 : credentials.password)) {
+      throw new Error("Basic Authentication is not supported.");
+    }
+    throw new Error("Invalid HTTP auth credentials");
+  }
+  if (authScheme.type === "oauth2" || authScheme.type === "openIdConnect") {
+    const token = (_d = (_c = authCredential.http) == null ? void 0 : _c.credentials) == null ? void 0 : _d.token;
+    return token ? bearerTokenParam(authScheme, token) : [void 0, void 0];
+  }
+  throw new Error("Invalid security scheme and credential combination");
+}
+__name(credentialToParam, "credentialToParam");
+function parseSecurityScheme(schema, data) {
+  const result = schema.safeParse(data);
+  if (!result.success) {
+    throw new Error(
+      `Invalid security scheme data: ${import_zod.z.prettifyError(result.error)}`
+    );
+  }
+  return result.data;
+}
+__name(parseSecurityScheme, "parseSecurityScheme");
+function dictToAuthScheme(data) {
+  if (!("type" in data)) {
+    throw new Error("Missing 'type' field in security scheme dictionary.");
+  }
+  const securityType = data["type"];
+  switch (securityType) {
+    case "apiKey":
+      return parseSecurityScheme(ApiKeySchemeSchema, data);
+    case "http":
+      return parseSecurityScheme(HttpSchemeSchema, data);
+    case "oauth2":
+      return parseSecurityScheme(Oauth2SchemeSchema, data);
+    case "openIdConnect":
+      return parseSecurityScheme(OpenIdConnectSchemeSchema, data);
+    default:
+      throw new Error(`Invalid security scheme type: ${securityType}`);
+  }
+}
+__name(dictToAuthScheme, "dictToAuthScheme");
 // Annotate the CommonJS export names for ESM import in node:
 0 && (module.exports = {
+  INTERNAL_AUTH_PREFIX,
   applyCredential,
   createApiKeyScheme,
-  createBearerScheme
+  createBearerScheme,
+  credentialToParam,
+  dictToAuthScheme,
+  openidDictToSchemeCredential,
+  openidUrlToSchemeCredential,
+  serviceAccountDictToSchemeCredential,
+  serviceAccountSchemeCredential,
+  tokenToSchemeCredential
 });

package/dist/cjs/tools/openapi_tool/auth/credential_exchangers/auto_auth_credential_exchanger.js

@@ -46,7 +46,12 @@ var import_service_account_exchanger = require("./service_account_exchanger.js")
  * SPDX-License-Identifier: Apache-2.0
  */
 let AutoAuthCredentialExchanger = class {
-  constructor() {
+  /**
+   * @param customExchangers - Optional exchangers that add to or override the
+   *   built-in ones. The key is the auth credential type; the value is the
+   *   exchanger instance to use for that type.
+   */
+  constructor(customExchangers) {
     this.exchangers = /* @__PURE__ */ new Map();
     this.exchangers.set(
       import_auth_credential.AuthCredentialTypes.OAUTH2,
@@ -60,9 +65,18 @@ let AutoAuthCredentialExchanger = class {
       import_auth_credential.AuthCredentialTypes.SERVICE_ACCOUNT,
       new import_service_account_exchanger.ServiceAccountCredentialExchanger()
     );
+    for (const authType of Object.values(import_auth_credential.AuthCredentialTypes)) {
+      const customExchanger = customExchangers == null ? void 0 : customExchangers[authType];
+      if (customExchanger) {
+        this.exchangers.set(authType, customExchanger);
+      }
+    }
   }
   async exchange(params) {
     const { authCredential, authScheme } = params;
+    if (!authCredential) {
+      return null;
+    }
     const exchanger = this.exchangers.get(authCredential.authType);
     if (!exchanger) {
       return {

package/dist/cjs/tools/openapi_tool/auth/credential_exchangers/base_auth_credential_exchanger.js

@@ -0,0 +1,70 @@
+/**
+  * @license
+  * Copyright 2026 Google LLC
+  * SPDX-License-Identifier: Apache-2.0
+  */
+
+"use strict";
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __name = (target, value) => __defProp(target, "name", { value, configurable: true });
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, { get: all[name], enumerable: true });
+};
+var __copyProps = (to, from, except, desc) => {
+  if (from && typeof from === "object" || typeof from === "function") {
+    for (let key of __getOwnPropNames(from))
+      if (!__hasOwnProp.call(to, key) && key !== except)
+        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
+  }
+  return to;
+};
+var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
+var __decorateClass = (decorators, target, key, kind) => {
+  var result = kind > 1 ? void 0 : kind ? __getOwnPropDesc(target, key) : target;
+  for (var i = decorators.length - 1, decorator; i >= 0; i--)
+    if (decorator = decorators[i])
+      result = (kind ? decorator(target, key, result) : decorator(result)) || result;
+  if (kind && result) __defProp(target, key, result);
+  return result;
+};
+var base_auth_credential_exchanger_exports = {};
+__export(base_auth_credential_exchanger_exports, {
+  AuthCredentialMissingError: () => AuthCredentialMissingError,
+  BaseAuthCredentialExchanger: () => BaseAuthCredentialExchanger
+});
+module.exports = __toCommonJS(base_auth_credential_exchanger_exports);
+var import_experimental = require("../../../../utils/experimental.js");
+/**
+ * @license
+ * Copyright 2026 Google LLC
+ * SPDX-License-Identifier: Apache-2.0
+ */
+const _AuthCredentialMissingError = class _AuthCredentialMissingError extends Error {
+  constructor(message) {
+    super(message);
+    this.name = "AuthCredentialMissingError";
+  }
+};
+__name(_AuthCredentialMissingError, "AuthCredentialMissingError");
+let AuthCredentialMissingError = _AuthCredentialMissingError;
+let BaseAuthCredentialExchanger = class {
+  exchangeCredential(_authScheme, _authCredential) {
+    throw new Error("Subclasses must implement exchangeCredential.");
+  }
+};
+__name(BaseAuthCredentialExchanger, "BaseAuthCredentialExchanger");
+__decorateClass([
+  import_experimental.experimental
+], BaseAuthCredentialExchanger.prototype, "exchangeCredential", 1);
+BaseAuthCredentialExchanger = __decorateClass([
+  import_experimental.experimental
+], BaseAuthCredentialExchanger);
+// Annotate the CommonJS export names for ESM import in node:
+0 && (module.exports = {
+  AuthCredentialMissingError,
+  BaseAuthCredentialExchanger
+});

package/dist/cjs/tools/openapi_tool/auth/credential_exchangers/oauth2_exchanger.js

@@ -0,0 +1,120 @@
+/**
+  * @license
+  * Copyright 2026 Google LLC
+  * SPDX-License-Identifier: Apache-2.0
+  */
+
+"use strict";
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __name = (target, value) => __defProp(target, "name", { value, configurable: true });
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, { get: all[name], enumerable: true });
+};
+var __copyProps = (to, from, except, desc) => {
+  if (from && typeof from === "object" || typeof from === "function") {
+    for (let key of __getOwnPropNames(from))
+      if (!__hasOwnProp.call(to, key) && key !== except)
+        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
+  }
+  return to;
+};
+var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
+var __decorateClass = (decorators, target, key, kind) => {
+  var result = kind > 1 ? void 0 : kind ? __getOwnPropDesc(target, key) : target;
+  for (var i = decorators.length - 1, decorator; i >= 0; i--)
+    if (decorator = decorators[i])
+      result = (kind ? decorator(target, key, result) : decorator(result)) || result;
+  if (kind && result) __defProp(target, key, result);
+  return result;
+};
+var oauth2_exchanger_exports = {};
+__export(oauth2_exchanger_exports, {
+  OAuth2BearerExchanger: () => OAuth2BearerExchanger,
+  checkSchemeCredentialType: () => checkSchemeCredentialType,
+  exchangeCredential: () => exchangeCredential,
+  generateAuthToken: () => generateAuthToken
+});
+module.exports = __toCommonJS(oauth2_exchanger_exports);
+var import_auth_credential = require("../../../../auth/auth_credential.js");
+var import_experimental = require("../../../../utils/experimental.js");
+/**
+ * @license
+ * Copyright 2026 Google LLC
+ * SPDX-License-Identifier: Apache-2.0
+ */
+function checkSchemeCredentialType(authScheme, authCredential) {
+  if (!authCredential) {
+    throw new Error(
+      "auth_credential is empty. Please create AuthCredential using OAuth2Auth."
+    );
+  }
+  if (authScheme.type !== "openIdConnect" && authScheme.type !== "oauth2") {
+    throw new Error(
+      `Invalid security scheme, expect AuthSchemeType.openIdConnect or AuthSchemeType.oauth2 auth scheme, but got ${authScheme.type}`
+    );
+  }
+  if (!authCredential.oauth2 && !authCredential.http) {
+    throw new Error(
+      "auth_credential is not configured with oauth2. Please create AuthCredential and set OAuth2Auth."
+    );
+  }
+}
+__name(checkSchemeCredentialType, "checkSchemeCredentialType");
+function generateAuthToken(authCredential) {
+  var _a;
+  const accessToken = (_a = authCredential.oauth2) == null ? void 0 : _a.accessToken;
+  if (!accessToken) {
+    return authCredential;
+  }
+  return {
+    authType: import_auth_credential.AuthCredentialTypes.HTTP,
+    http: {
+      scheme: "bearer",
+      credentials: { token: accessToken }
+    }
+  };
+}
+__name(generateAuthToken, "generateAuthToken");
+function exchangeCredential(authScheme, authCredential) {
+  var _a, _b;
+  checkSchemeCredentialType(authScheme, authCredential);
+  if (authCredential.http) {
+    return authCredential;
+  }
+  if (((_a = authCredential.oauth2) == null ? void 0 : _a.accessToken) || ((_b = authCredential.oauth2) == null ? void 0 : _b.refreshToken)) {
+    return generateAuthToken(authCredential);
+  }
+  return null;
+}
+__name(exchangeCredential, "exchangeCredential");
+let OAuth2BearerExchanger = class {
+  async exchange(params) {
+    const { authScheme, authCredential } = params;
+    if (!authScheme) {
+      throw new Error("authScheme is required for OAuth2 credential exchange");
+    }
+    const credential = exchangeCredential(authScheme, authCredential);
+    return {
+      credential: credential != null ? credential : authCredential,
+      wasExchanged: credential !== null && credential !== authCredential
+    };
+  }
+};
+__name(OAuth2BearerExchanger, "OAuth2BearerExchanger");
+__decorateClass([
+  import_experimental.experimental
+], OAuth2BearerExchanger.prototype, "exchange", 1);
+OAuth2BearerExchanger = __decorateClass([
+  import_experimental.experimental
+], OAuth2BearerExchanger);
+// Annotate the CommonJS export names for ESM import in node:
+0 && (module.exports = {
+  OAuth2BearerExchanger,
+  checkSchemeCredentialType,
+  exchangeCredential,
+  generateAuthToken
+});

package/dist/cjs/tools/openapi_tool/auth/credential_exchangers/service_account_exchanger.js

@@ -38,21 +38,20 @@ __export(service_account_exchanger_exports, {
 module.exports = __toCommonJS(service_account_exchanger_exports);
 var import_google_auth_library = require("google-auth-library");
 var import_auth_credential = require("../../../../auth/auth_credential.js");
-var import_base_credential_exchanger = require("../../../../auth/exchanger/base_credential_exchanger.js");
 var import_experimental = require("../../../../utils/experimental.js");
+var import_base_auth_credential_exchanger = require("./base_auth_credential_exchanger.js");
 /**
  * @license
  * Copyright 2026 Google LLC
  * SPDX-License-Identifier: Apache-2.0
  */
 const DEFAULT_SCOPES = ["https://www.googleapis.com/auth/cloud-platform"];
+const MISSING_SERVICE_ACCOUNT_CREDENTIALS = "Service account credentials are missing. Please provide them, or set `useDefaultCredential: true` to use application default credentials in a hosted service like Cloud Run.";
 let ServiceAccountCredentialExchanger = class {
   async exchange(params) {
     const { authCredential } = params;
-    if (authCredential.authType !== import_auth_credential.AuthCredentialTypes.SERVICE_ACCOUNT || !authCredential.serviceAccount) {
-      throw new import_base_credential_exchanger.CredentialExchangeError(
-        "Invalid credential type for ServiceAccountCredentialExchanger"
-      );
+    if (!authCredential.serviceAccount) {
+      throw new import_base_auth_credential_exchanger.AuthCredentialMissingError(MISSING_SERVICE_ACCOUNT_CREDENTIALS);
     }
     const saConfig = authCredential.serviceAccount;
     if (saConfig.useDefaultCredential) {
@@ -82,7 +81,7 @@ let ServiceAccountCredentialExchanger = class {
         wasExchanged: true
       };
     } catch (error) {
-      throw new import_base_credential_exchanger.CredentialExchangeError(
+      throw new import_base_auth_credential_exchanger.AuthCredentialMissingError(
         `Failed to exchange default service account token: ${error.message}`
       );
     }
@@ -90,14 +89,15 @@ let ServiceAccountCredentialExchanger = class {
   async exchangeForExplicitCredential(saConfig) {
     const creds = saConfig.serviceAccountCredential;
     if (!creds) {
-      throw new import_base_credential_exchanger.CredentialExchangeError(
-        "Service account credentials are missing."
-      );
+      throw new import_base_auth_credential_exchanger.AuthCredentialMissingError(MISSING_SERVICE_ACCOUNT_CREDENTIALS);
     }
     try {
       const client = new import_google_auth_library.JWT({
         email: creds.clientEmail,
         key: creds.privateKey,
+        keyId: creds.privateKeyId,
+        projectId: creds.projectId,
+        universeDomain: creds.universeDomain,
         scopes: saConfig.scopes
       });
       const tokens = await client.authorize();
@@ -116,7 +116,7 @@ let ServiceAccountCredentialExchanger = class {
         wasExchanged: true
       };
     } catch (error) {
-      throw new import_base_credential_exchanger.CredentialExchangeError(
+      throw new import_base_auth_credential_exchanger.AuthCredentialMissingError(
         `Failed to exchange explicit service account token: ${error.message}`
       );
     }