@google/adk 2.0.0 → 2.2.0

package/dist/cjs/utils/redact_uri.js

@@ -37,7 +37,21 @@ const SECRET_QUERY_PARAMS = /* @__PURE__ */ new Set([
   "password",
   "passwd",
   "pwd",
-  "sslpassword"
+  "sslpassword",
+  // OAuth2 callback/authorization-response URIs carry their own secrets as
+  // query parameters rather than in userinfo: an authorization `code` is a
+  // single-use, bearer-equivalent credential, and a token response echoed
+  // back via URI can carry `access_token`/`id_token`/`refresh_token`.
+  // Only the query string is scanned: in the implicit and hybrid flows those
+  // token parameters arrive in the fragment, which is left untouched.
+  // `client_secret` is not meant to travel in a URL at all, but is included
+  // here in case a misconfigured flow puts it there anyway.
+  "code",
+  "access_token",
+  "id_token",
+  "refresh_token",
+  "client_secret",
+  "code_verifier"
 ]);
 function redactUriPassword(uri) {
   try {

package/dist/cjs/utils/schema.js

@@ -114,7 +114,7 @@ function objectSchemaFields(schema) {
   return fields != null ? fields : void 0;
 }
 __name(objectSchemaFields, "objectSchemaFields");
-const UNRESOLVABLE_REF = Symbol("unresolvable-ref");
+const UNRESOLVABLE_REF = /* @__PURE__ */ Symbol("unresolvable-ref");
 function compileField(fieldSchema, document) {
   try {
     return compileJsonSchema(inlineRefs(fieldSchema, document));

package/dist/cjs/utils/simple_zod_to_json.js

@@ -114,6 +114,11 @@ function zodObjectToSchema(schema) {
   if (isZodV3Schema(schema)) {
     return (0, import_zod_to_json_schema.zodToJsonSchema)(schema, {
       target: "openApi3",
+      // The genai `Schema` type has no `$ref`, so a pointer back at an earlier
+      // occurrence of a reused sub-schema reaches the model as an untyped
+      // parameter. Inline every occurrence instead. A cycle has no finite
+      // inlining and degrades to an unconstrained schema.
+      $refStrategy: "none",
       emailStrategy: "format:email",
       postProcess: /* @__PURE__ */ __name((jsonSchema) => {
         var _a, _b, _c, _d, _e, _f, _g;

package/dist/cjs/utils/ssrf_guard.js

@@ -0,0 +1,262 @@
+/**
+  * @license
+  * Copyright 2026 Google LLC
+  * SPDX-License-Identifier: Apache-2.0
+  */
+
+"use strict";
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __name = (target, value) => __defProp(target, "name", { value, configurable: true });
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, { get: all[name], enumerable: true });
+};
+var __copyProps = (to, from, except, desc) => {
+  if (from && typeof from === "object" || typeof from === "function") {
+    for (let key of __getOwnPropNames(from))
+      if (!__hasOwnProp.call(to, key) && key !== except)
+        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
+  }
+  return to;
+};
+var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
+var ssrf_guard_exports = {};
+__export(ssrf_guard_exports, {
+  isHttpUrl: () => isHttpUrl,
+  isLinkLocalAddress: () => isLinkLocalAddress,
+  isLocalhostHostname: () => isLocalhostHostname,
+  isNonGlobalAddress: () => isNonGlobalAddress,
+  normalizeHost: () => normalizeHost,
+  resolveHostAddresses: () => resolveHostAddresses
+});
+module.exports = __toCommonJS(ssrf_guard_exports);
+var import_promises = require("node:dns/promises");
+var import_node_net = require("node:net");
+/**
+ * @license
+ * Copyright 2026 Google LLC
+ * SPDX-License-Identifier: Apache-2.0
+ */
+const HTTP_SCHEMES = /* @__PURE__ */ new Set(["http:", "https:"]);
+const NON_GLOBAL_IPV4_CIDRS = [
+  "0.0.0.0/8",
+  // "this host on this network"
+  "10.0.0.0/8",
+  // private
+  "100.64.0.0/10",
+  // shared address space / CGNAT
+  "127.0.0.0/8",
+  // loopback
+  "169.254.0.0/16",
+  // link-local (includes GCP metadata 169.254.169.254)
+  "172.16.0.0/12",
+  // private
+  "192.0.0.0/24",
+  // IETF protocol assignments
+  "192.0.2.0/24",
+  // TEST-NET-1 (documentation)
+  "192.88.99.0/24",
+  // 6to4 relay anycast (deprecated)
+  "192.168.0.0/16",
+  // private
+  "198.18.0.0/15",
+  // benchmarking
+  "198.51.100.0/24",
+  // TEST-NET-2 (documentation)
+  "203.0.113.0/24",
+  // TEST-NET-3 (documentation)
+  "224.0.0.0/4",
+  // multicast
+  "240.0.0.0/4"
+  // reserved / future use (includes 255.255.255.255)
+].map(parseIpv4Cidr);
+const NON_GLOBAL_IPV6_CIDRS = [
+  "::/128",
+  // unspecified
+  "::1/128",
+  // loopback
+  "64:ff9b:1::/48",
+  // local NAT64
+  "100::/64",
+  // discard-only
+  "2001:db8::/32",
+  // documentation
+  "fc00::/7",
+  // unique-local (ULA, private)
+  "fe80::/10",
+  // link-local
+  "ff00::/8"
+  // multicast
+].map(parseIpv6Cidr);
+const LINK_LOCAL_IPV4_CIDR = parseIpv4Cidr("169.254.0.0/16");
+const LINK_LOCAL_IPV6_CIDR = parseIpv6Cidr("fe80::/10");
+const IPV4_MAPPED_CIDR = parseIpv6Cidr("::ffff:0:0/96");
+const NAT64_CIDR = parseIpv6Cidr("64:ff9b::/96");
+const SIX_TO_FOUR_CIDR = parseIpv6Cidr("2002::/16");
+const IPV4_COMPATIBLE_CIDR = parseIpv6Cidr("::/96");
+function isHttpUrl(url) {
+  return HTTP_SCHEMES.has(url.protocol);
+}
+__name(isHttpUrl, "isHttpUrl");
+function isLocalhostHostname(hostname) {
+  const normalized = hostname.replace(/\.+$/, "").toLowerCase();
+  return normalized === "localhost" || normalized.endsWith(".localhost");
+}
+__name(isLocalhostHostname, "isLocalhostHostname");
+function normalizeHost(hostname) {
+  return hostname.startsWith("[") ? hostname.slice(1, -1) : hostname;
+}
+__name(normalizeHost, "normalizeHost");
+function isNonGlobalAddress(address) {
+  return classifyAddress(address, isNonGlobalIpv4, isNonGlobalIpv6);
+}
+__name(isNonGlobalAddress, "isNonGlobalAddress");
+function isLinkLocalAddress(address) {
+  return classifyAddress(address, isLinkLocalIpv4, isLinkLocalIpv6);
+}
+__name(isLinkLocalAddress, "isLinkLocalAddress");
+async function resolveHostAddresses(hostname) {
+  if ((0, import_node_net.isIP)(hostname) !== 0) {
+    return [hostname];
+  }
+  const records = await (0, import_promises.lookup)(hostname, { all: true });
+  const addresses = [...new Set(records.map((record) => record.address))];
+  if (addresses.length === 0) {
+    throw new Error(`Unable to resolve host: ${hostname}`);
+  }
+  return addresses;
+}
+__name(resolveHostAddresses, "resolveHostAddresses");
+function classifyAddress(address, matchesIpv4, matchesIpv6) {
+  const octets = parseIpv4(address);
+  if (octets) {
+    return matchesIpv4(octets);
+  }
+  const hextets = parseIpv6(address);
+  if (hextets) {
+    return matchesIpv6(hextets);
+  }
+  return true;
+}
+__name(classifyAddress, "classifyAddress");
+function parseIpv4(address) {
+  const match = /^(\d{1,3})\.(\d{1,3})\.(\d{1,3})\.(\d{1,3})$/.exec(address);
+  if (!match) {
+    return null;
+  }
+  const octets = match.slice(1).map(Number);
+  if (octets.some((octet) => octet > 255)) {
+    return null;
+  }
+  return octets;
+}
+__name(parseIpv4, "parseIpv4");
+function parseIpv6(address) {
+  if ((0, import_node_net.isIP)(address) !== 6) {
+    return null;
+  }
+  const [head, tail] = address.split("::");
+  const highGroups = head ? expandHextets(head) : [];
+  const lowGroups = tail ? expandHextets(tail) : [];
+  const compressed = address.includes("::") ? new Array(8 - highGroups.length - lowGroups.length).fill(0) : [];
+  return [...highGroups, ...compressed, ...lowGroups];
+}
+__name(parseIpv6, "parseIpv6");
+function expandHextets(fragment) {
+  const hextets = [];
+  for (const group of fragment.split(":")) {
+    if (group.includes(".")) {
+      const octets = parseIpv4(group);
+      hextets.push(octets[0] << 8 | octets[1], octets[2] << 8 | octets[3]);
+    } else {
+      hextets.push(parseInt(group, 16));
+    }
+  }
+  return hextets;
+}
+__name(expandHextets, "expandHextets");
+function ipv4ToInt(octets) {
+  return (octets[0] << 24 | octets[1] << 16 | octets[2] << 8 | octets[3]) >>> 0;
+}
+__name(ipv4ToInt, "ipv4ToInt");
+function hextetsToBigInt(hextets) {
+  let value = 0n;
+  for (const hextet of hextets) {
+    value = value << 16n | BigInt(hextet);
+  }
+  return value;
+}
+__name(hextetsToBigInt, "hextetsToBigInt");
+function parseIpv4Cidr(cidr) {
+  const [address, prefix] = cidr.split("/");
+  const mask = 4294967295 << 32 - Number(prefix) >>> 0;
+  return { base: (ipv4ToInt(parseIpv4(address)) & mask) >>> 0, mask };
+}
+__name(parseIpv4Cidr, "parseIpv4Cidr");
+function parseIpv6Cidr(cidr) {
+  const [address, prefix] = cidr.split("/");
+  return { base: hextetsToBigInt(parseIpv6(address)), prefix: Number(prefix) };
+}
+__name(parseIpv6Cidr, "parseIpv6Cidr");
+function matchesIpv4Cidr(octets, { base, mask }) {
+  return (ipv4ToInt(octets) & mask) >>> 0 === base;
+}
+__name(matchesIpv4Cidr, "matchesIpv4Cidr");
+function matchesIpv6Cidr(hextets, { base, prefix }) {
+  const shift = BigInt(128 - prefix);
+  return hextetsToBigInt(hextets) >> shift === base >> shift;
+}
+__name(matchesIpv6Cidr, "matchesIpv6Cidr");
+function embeddedIpv4(hextets) {
+  if (matchesIpv6Cidr(hextets, SIX_TO_FOUR_CIDR)) {
+    return hextetsToOctets(hextets[1], hextets[2]);
+  }
+  if (matchesIpv6Cidr(hextets, IPV4_MAPPED_CIDR) || matchesIpv6Cidr(hextets, NAT64_CIDR)) {
+    return hextetsToOctets(hextets[6], hextets[7]);
+  }
+  if (matchesIpv6Cidr(hextets, IPV4_COMPATIBLE_CIDR) && (hextets[6] !== 0 || hextets[7] > 1)) {
+    return hextetsToOctets(hextets[6], hextets[7]);
+  }
+  return null;
+}
+__name(embeddedIpv4, "embeddedIpv4");
+function hextetsToOctets(high, low) {
+  return [high >> 8, high & 255, low >> 8, low & 255];
+}
+__name(hextetsToOctets, "hextetsToOctets");
+function isNonGlobalIpv4(octets) {
+  return NON_GLOBAL_IPV4_CIDRS.some((cidr) => matchesIpv4Cidr(octets, cidr));
+}
+__name(isNonGlobalIpv4, "isNonGlobalIpv4");
+function isNonGlobalIpv6(hextets) {
+  const embedded = embeddedIpv4(hextets);
+  if (embedded) {
+    return isNonGlobalIpv4(embedded);
+  }
+  return NON_GLOBAL_IPV6_CIDRS.some((cidr) => matchesIpv6Cidr(hextets, cidr));
+}
+__name(isNonGlobalIpv6, "isNonGlobalIpv6");
+function isLinkLocalIpv4(octets) {
+  return matchesIpv4Cidr(octets, LINK_LOCAL_IPV4_CIDR);
+}
+__name(isLinkLocalIpv4, "isLinkLocalIpv4");
+function isLinkLocalIpv6(hextets) {
+  const embedded = embeddedIpv4(hextets);
+  if (embedded) {
+    return isLinkLocalIpv4(embedded);
+  }
+  return matchesIpv6Cidr(hextets, LINK_LOCAL_IPV6_CIDR);
+}
+__name(isLinkLocalIpv6, "isLinkLocalIpv6");
+// Annotate the CommonJS export names for ESM import in node:
+0 && (module.exports = {
+  isHttpUrl,
+  isLinkLocalAddress,
+  isLocalhostHostname,
+  isNonGlobalAddress,
+  normalizeHost,
+  resolveHostAddresses
+});

package/dist/cjs/version.js

@@ -32,7 +32,7 @@ module.exports = __toCommonJS(version_exports);
  * Copyright 2025 Google LLC
  * SPDX-License-Identifier: Apache-2.0
  */
-const version = "2.0.0";
+const version = "2.2.0";
 // Annotate the CommonJS export names for ESM import in node:
 0 && (module.exports = {
   version

package/dist/cjs/workflow/base_node.js

@@ -45,7 +45,7 @@ var import_hitl_utils = require("./utils/hitl_utils.js");
  * SPDX-License-Identifier: Apache-2.0
  */
 var _a;
-const BASE_NODE_SIGNATURE_SYMBOL = Symbol.for("google.adk.workflow.baseNode");
+const BASE_NODE_SIGNATURE_SYMBOL = /* @__PURE__ */ Symbol.for("google.adk.workflow.baseNode");
 _a = BASE_NODE_SIGNATURE_SYMBOL;
 const _BaseNode = class _BaseNode {
   constructor(config) {

package/dist/cjs/workflow/graph.js

@@ -41,7 +41,7 @@ var import_graph_validation = require("./utils/graph_validation.js");
  * SPDX-License-Identifier: Apache-2.0
  */
 var _a;
-const EDGE_SIGNATURE_SYMBOL = Symbol.for("google.adk.workflow.edge");
+const EDGE_SIGNATURE_SYMBOL = /* @__PURE__ */ Symbol.for("google.adk.workflow.edge");
 const DEFAULT_ROUTE = "__DEFAULT__";
 _a = EDGE_SIGNATURE_SYMBOL;
 const _Edge = class _Edge {

package/dist/cjs/workflow/nodes/node_tool.js

@@ -40,7 +40,7 @@ var import_node_runner = require("../node_runner.js");
  * SPDX-License-Identifier: Apache-2.0
  */
 var _a, _b;
-const NODE_TOOL_SIGNATURE_SYMBOL = Symbol.for("google.adk.workflow.nodeTool");
+const NODE_TOOL_SIGNATURE_SYMBOL = /* @__PURE__ */ Symbol.for("google.adk.workflow.nodeTool");
 const MAX_NODE_TOOL_DEPTH = 8;
 const _NodeTool = class _NodeTool extends (_b = import_base_tool.BaseTool, _a = NODE_TOOL_SIGNATURE_SYMBOL, _b) {
   constructor(node, name, description) {
@@ -121,7 +121,7 @@ const _NodeTool = class _NodeTool extends (_b = import_base_tool.BaseTool, _a =
       // not the node name doubled.
       nodePath: "",
       runId,
-      resumeInputs: collectResumeInputs(toolContext)
+      resumeInputs: toolContext.resumeInputs
     });
     const base = childIc.branch;
     const segment = `${this.name}@${runId}`;
@@ -140,15 +140,6 @@ function isNodeTool(value) {
   return typeof value === "object" && value !== null && NODE_TOOL_SIGNATURE_SYMBOL in value && value[NODE_TOOL_SIGNATURE_SYMBOL] === true;
 }
 __name(isNodeTool, "isNodeTool");
-function collectResumeInputs(toolContext) {
-  var _a2;
-  const payload = (_a2 = toolContext.toolConfirmation) == null ? void 0 : _a2.payload;
-  if (payload && typeof payload === "object") {
-    return payload;
-  }
-  return {};
-}
-__name(collectResumeInputs, "collectResumeInputs");
 // Annotate the CommonJS export names for ESM import in node:
 0 && (module.exports = {
   NodeTool,

package/dist/cjs/workflow/request_input.js

@@ -36,7 +36,7 @@ var import_env_aware_utils = require("../utils/env_aware_utils.js");
  * SPDX-License-Identifier: Apache-2.0
  */
 var _a;
-const REQUEST_INPUT_SIGNATURE_SYMBOL = Symbol.for(
+const REQUEST_INPUT_SIGNATURE_SYMBOL = /* @__PURE__ */ Symbol.for(
   "google.adk.workflow.requestInput"
 );
 _a = REQUEST_INPUT_SIGNATURE_SYMBOL;

package/dist/cjs/workflow/run_llm_agent_as_node.js

@@ -69,7 +69,7 @@ async function appendNodeInputAsUserTurn(ctx, nodeInput) {
     branch: ctx.branch,
     content: toUserContent(nodeInput)
   });
-  if (ctx.isolationScope) {
+  if (ctx.isolationScope !== void 0) {
     userEvent.isolationScope = ctx.isolationScope;
   }
   const sessionService = ctx.invocationContext.sessionService;

package/dist/cjs/workflow/workflow.js

@@ -57,7 +57,7 @@ var import_rehydration_utils = require("./utils/rehydration_utils.js");
  * SPDX-License-Identifier: Apache-2.0
  */
 var _a, _b;
-const WORKFLOW_SIGNATURE_SYMBOL = Symbol.for("google.adk.workflow.workflow");
+const WORKFLOW_SIGNATURE_SYMBOL = /* @__PURE__ */ Symbol.for("google.adk.workflow.workflow");
 const _LoopState = class _LoopState {
   constructor() {
     this.nodes = /* @__PURE__ */ new Map();

package/dist/esm/a2a/a2a_event.js

@@ -240,37 +240,9 @@ function createTaskInputRequiredEvent({
   };
 }
 __name(createTaskInputRequiredEvent, "createTaskInputRequiredEvent");
-function createInputMissingErrorEvent({
-  taskId,
-  contextId,
-  parts,
-  metadata
-}) {
-  return {
-    kind: "status-update",
-    taskId,
-    contextId,
-    final: true,
-    status: {
-      state: "input-required" /* INPUT_REQUIRED */,
-      message: {
-        kind: "message",
-        messageId: randomUUID(),
-        role: "agent",
-        taskId,
-        contextId,
-        parts
-      },
-      timestamp: (/* @__PURE__ */ new Date()).toISOString()
-    },
-    metadata
-  };
-}
-__name(createInputMissingErrorEvent, "createInputMissingErrorEvent");
 export {
   MessageRole,
   TaskState,
-  createInputMissingErrorEvent,
   createTask,
   createTaskArtifactUpdateEvent,
   createTaskCompletedEvent,

package/dist/esm/a2a/a2a_remote_agent.js

@@ -19,12 +19,13 @@ import { MessageRole } from "./a2a_event.js";
 import { A2ARemoteAgentRunProcessor } from "./a2a_remote_agent_run_processor.js";
 import {
   getUserFunctionCallAt,
+  peerRequestedCallIds,
+  toForwardableA2AParts,
   toMissingRemoteSessionParts
 } from "./a2a_remote_agent_utils.js";
 import { resolveAgentCard } from "./agent_card.js";
 import { toAdkEvent } from "./event_converter_utils.js";
 import { getA2ASessionMetadata } from "./metadata_converter_utils.js";
-import { toA2AParts } from "./part_converter_utils.js";
 const _RemoteA2AAgent = class _RemoteA2AAgent extends BaseAgent {
   constructor(a2aConfig) {
     super(a2aConfig);
@@ -67,9 +68,11 @@ const _RemoteA2AAgent = class _RemoteA2AAgent extends BaseAgent {
       let contextId = void 0;
       if (userFnCall) {
         const event = userFnCall.response;
-        parts = toA2AParts(
-          ((_a = event.content) == null ? void 0 : _a.parts) || [],
-          event.longRunningToolIds
+        const peerRequestedIds = peerRequestedCallIds(events, this.name);
+        parts = toForwardableA2AParts(
+          event.content,
+          event.longRunningToolIds,
+          peerRequestedIds
         );
         taskId = userFnCall.taskId;
         contextId = userFnCall.contextId;
@@ -91,9 +94,11 @@ const _RemoteA2AAgent = class _RemoteA2AAgent extends BaseAgent {
       };
       if (taskId) message.taskId = taskId;
       if (contextId) message.contextId = contextId;
+      const metadata = (_a = this.a2aConfig.metadata) != null ? _a : context.a2aMetadata;
       const params = {
         message,
-        configuration: this.a2aConfig.messageSendConfig
+        configuration: this.a2aConfig.messageSendConfig,
+        ...metadata ? { metadata } : {}
       };
       const processor = new A2ARemoteAgentRunProcessor(params);
       if (this.a2aConfig.beforeRequestCallbacks) {

package/dist/esm/a2a/a2a_remote_agent_utils.js

@@ -7,8 +7,11 @@ var __name = (target, value) => __defProp(target, "name", { value, configurable:
  * Copyright 2026 Google LLC
  * SPDX-License-Identifier: Apache-2.0
  */
+import { REQUEST_CREDENTIAL_FUNCTION_CALL_NAME } from "../agents/functions.js";
 import { requireAgent } from "../agents/invocation_context.js";
 import { createEvent } from "../events/event.js";
+import { camelCaseKeys } from "../utils/case_utils.js";
+import { logger } from "../utils/logger.js";
 import { AdkMetadataKeys } from "./metadata_converter_utils.js";
 import { toA2AParts } from "./part_converter_utils.js";
 function getUserFunctionCallAt(session, index) {
@@ -61,23 +64,118 @@ function getFunctionResponseCallId(event) {
   return (_a = responsePart == null ? void 0 : responsePart.functionResponse) == null ? void 0 : _a.id;
 }
 __name(getFunctionResponseCallId, "getFunctionResponseCallId");
+const AUTH_CONFIG_SCHEME_KEY = "authScheme";
+const AUTH_CONFIG_CREDENTIAL_KEYS = [
+  // camelCase only by design: callers normalise the payload with
+  // camelCaseKeys() before these keys are looked up, so the snake_case
+  // spellings (raw_auth_credential, exchanged_auth_credential) are covered.
+  "rawAuthCredential",
+  "exchangedAuthCredential"
+];
+function payloadIsAuthConfig(payload) {
+  if (!payload || typeof payload !== "object" || Array.isArray(payload)) {
+    return false;
+  }
+  const keys = new Set(Object.keys(payload));
+  if (!keys.has(AUTH_CONFIG_SCHEME_KEY)) {
+    return false;
+  }
+  return AUTH_CONFIG_CREDENTIAL_KEYS.some((key) => keys.has(key));
+}
+__name(payloadIsAuthConfig, "payloadIsAuthConfig");
+function isCredentialFunctionCall(functionCall) {
+  if (functionCall.name === REQUEST_CREDENTIAL_FUNCTION_CALL_NAME) {
+    return true;
+  }
+  const args = camelCaseKeys(functionCall.args);
+  if (!args || typeof args !== "object") {
+    return false;
+  }
+  const authConfig = args["authConfig"];
+  return payloadIsAuthConfig(authConfig);
+}
+__name(isCredentialFunctionCall, "isCredentialFunctionCall");
+function isCredentialFunctionResponse(functionResponse) {
+  if (functionResponse.name === REQUEST_CREDENTIAL_FUNCTION_CALL_NAME) {
+    return true;
+  }
+  return payloadIsAuthConfig(camelCaseKeys(functionResponse.response));
+}
+__name(isCredentialFunctionResponse, "isCredentialFunctionResponse");
+function peerRequestedCallIds(events, peerName) {
+  var _a, _b, _c;
+  const peer = /* @__PURE__ */ new Set();
+  const local = /* @__PURE__ */ new Set();
+  for (const event of events) {
+    for (const part of (_b = (_a = event.content) == null ? void 0 : _a.parts) != null ? _b : []) {
+      const id = (_c = part.functionCall) == null ? void 0 : _c.id;
+      if (!id) {
+        continue;
+      }
+      (event.author === peerName ? peer : local).add(id);
+    }
+  }
+  return new Set([...peer].filter((id) => !local.has(id)));
+}
+__name(peerRequestedCallIds, "peerRequestedCallIds");
+function withoutCredentialParts(content, peerRequestedIds) {
+  if (!content || !content.parts) {
+    return content;
+  }
+  const isDroppedCredentialPart = /* @__PURE__ */ __name((part) => {
+    if (part.functionCall && isCredentialFunctionCall(part.functionCall)) {
+      return true;
+    }
+    if (part.functionResponse && isCredentialFunctionResponse(part.functionResponse)) {
+      const id = part.functionResponse.id;
+      return !(id && peerRequestedIds.has(id));
+    }
+    return false;
+  }, "isDroppedCredentialPart");
+  const parts = content.parts.filter((part) => !isDroppedCredentialPart(part));
+  if (parts.length === content.parts.length) {
+    return content;
+  }
+  logger.warn(
+    `Dropped ${content.parts.length - parts.length} credential-bearing part(s) before forwarding to the remote peer -- it did not request them.`
+  );
+  return { ...content, parts };
+}
+__name(withoutCredentialParts, "withoutCredentialParts");
+function toForwardableA2AParts(content, longRunningToolIds, peerRequestedIds) {
+  const scrubbed = withoutCredentialParts(content, peerRequestedIds);
+  if (!(scrubbed == null ? void 0 : scrubbed.parts)) {
+    return [];
+  }
+  return toA2AParts(scrubbed.parts, longRunningToolIds);
+}
+__name(toForwardableA2AParts, "toForwardableA2AParts");
 function toMissingRemoteSessionParts(ctx, session) {
   const events = session.events;
+  const peerName = requireAgent(ctx).name;
   let contextId = void 0;
   let lastRemoteResponseIndex = -1;
   for (let i = events.length - 1; i >= 0; i--) {
     const event = events[i];
-    if (event.author === requireAgent(ctx).name) {
+    if (event.author === peerName) {
       lastRemoteResponseIndex = i;
       const metadata = event.customMetadata || {};
       contextId = metadata[AdkMetadataKeys.CONTEXT_ID];
       break;
     }
   }
+  const peerRequestedIds = peerRequestedCallIds(events, peerName);
   const missingParts = [];
   for (let i = lastRemoteResponseIndex + 1; i < events.length; i++) {
     let event = events[i];
-    if (event.author !== "user" && event.author !== requireAgent(ctx).name) {
+    const scrubbedContent = withoutCredentialParts(
+      event.content,
+      peerRequestedIds
+    );
+    if (scrubbedContent !== event.content) {
+      event = { ...event, content: scrubbedContent };
+    }
+    if (event.author !== "user" && event.author !== peerName) {
       event = presentAsUserMessage(ctx, event);
     }
     if (!event.content || !event.content.parts || event.content.parts.length === 0) {
@@ -136,6 +234,8 @@ export {
   getFunctionResponseCallId,
   getUserFunctionCallAt,
   isFunctionCallEvent,
+  peerRequestedCallIds,
   presentAsUserMessage,
+  toForwardableA2AParts,
   toMissingRemoteSessionParts
 };