@google/adk 2.0.0 → 2.2.0

package/dist/cjs/agents/processors/nl_planning_processor.js

@@ -0,0 +1,114 @@
+/**
+  * @license
+  * Copyright 2026 Google LLC
+  * SPDX-License-Identifier: Apache-2.0
+  */
+
+"use strict";
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __name = (target, value) => __defProp(target, "name", { value, configurable: true });
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, { get: all[name], enumerable: true });
+};
+var __copyProps = (to, from, except, desc) => {
+  if (from && typeof from === "object" || typeof from === "function") {
+    for (let key of __getOwnPropNames(from))
+      if (!__hasOwnProp.call(to, key) && key !== except)
+        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
+  }
+  return to;
+};
+var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
+var nl_planning_processor_exports = {};
+__export(nl_planning_processor_exports, {
+  NL_PLANNING_REQUEST_PROCESSOR: () => NL_PLANNING_REQUEST_PROCESSOR,
+  NL_PLANNING_RESPONSE_PROCESSOR: () => NL_PLANNING_RESPONSE_PROCESSOR,
+  NlPlanningRequestProcessor: () => NlPlanningRequestProcessor,
+  NlPlanningResponseProcessor: () => NlPlanningResponseProcessor
+});
+module.exports = __toCommonJS(nl_planning_processor_exports);
+var import_llm_request = require("../../models/llm_request.js");
+var import_base_planner = require("../../planners/base_planner.js");
+var import_built_in_planner = require("../../planners/built_in_planner.js");
+var import_context = require("../context.js");
+var import_llm_agent = require("../llm_agent.js");
+var import_readonly_context = require("../readonly_context.js");
+var import_base_llm_processor = require("./base_llm_processor.js");
+/**
+ * @license
+ * Copyright 2026 Google LLC
+ * SPDX-License-Identifier: Apache-2.0
+ */
+function getPlanner(invocationContext) {
+  const agent = invocationContext.agent;
+  if (!(0, import_llm_agent.isLlmAgent)(agent) || !(0, import_base_planner.isBasePlanner)(agent.planner)) {
+    return void 0;
+  }
+  return agent.planner;
+}
+__name(getPlanner, "getPlanner");
+function removeThought(part) {
+  const { thought: _thought, ...rest } = part;
+  return rest;
+}
+__name(removeThought, "removeThought");
+function removeThoughtFromContents(contents) {
+  return contents.map(
+    (content) => content.parts ? { ...content, parts: content.parts.map(removeThought) } : content
+  );
+}
+__name(removeThoughtFromContents, "removeThoughtFromContents");
+const _NlPlanningRequestProcessor = class _NlPlanningRequestProcessor extends import_base_llm_processor.BaseLlmRequestProcessor {
+  // eslint-disable-next-line require-yield -- this processor only mutates the request and has no event to emit
+  async *runAsync(invocationContext, llmRequest) {
+    const planner = getPlanner(invocationContext);
+    if (!planner) {
+      return;
+    }
+    if ((0, import_built_in_planner.isBuiltInPlanner)(planner)) {
+      planner.applyThinkingConfig(llmRequest);
+    }
+    const planningInstruction = planner.buildPlanningInstruction(
+      new import_readonly_context.ReadonlyContext(invocationContext),
+      llmRequest
+    );
+    if (planningInstruction) {
+      (0, import_llm_request.appendInstructions)(llmRequest, [planningInstruction]);
+    }
+    llmRequest.contents = removeThoughtFromContents(llmRequest.contents);
+  }
+};
+__name(_NlPlanningRequestProcessor, "NlPlanningRequestProcessor");
+let NlPlanningRequestProcessor = _NlPlanningRequestProcessor;
+const _NlPlanningResponseProcessor = class _NlPlanningResponseProcessor extends import_base_llm_processor.BaseLlmResponseProcessor {
+  // eslint-disable-next-line require-yield -- this processor only rewrites the response and has no event to emit
+  async *runAsync(invocationContext, llmResponse) {
+    var _a, _b;
+    const planner = getPlanner(invocationContext);
+    if (!planner || !((_b = (_a = llmResponse.content) == null ? void 0 : _a.parts) == null ? void 0 : _b.length)) {
+      return;
+    }
+    const processedParts = planner.processPlanningResponse(
+      new import_context.Context({ invocationContext }),
+      llmResponse.content.parts
+    );
+    if (processedParts !== void 0) {
+      llmResponse.content = { ...llmResponse.content, parts: processedParts };
+    }
+  }
+};
+__name(_NlPlanningResponseProcessor, "NlPlanningResponseProcessor");
+let NlPlanningResponseProcessor = _NlPlanningResponseProcessor;
+const NL_PLANNING_REQUEST_PROCESSOR = new NlPlanningRequestProcessor();
+const NL_PLANNING_RESPONSE_PROCESSOR = new NlPlanningResponseProcessor();
+// Annotate the CommonJS export names for ESM import in node:
+0 && (module.exports = {
+  NL_PLANNING_REQUEST_PROCESSOR,
+  NL_PLANNING_RESPONSE_PROCESSOR,
+  NlPlanningRequestProcessor,
+  NlPlanningResponseProcessor
+});

package/dist/cjs/agents/processors/request_confirmation_llm_request_processor.js

@@ -73,7 +73,8 @@ const _RequestConfirmationLlmRequestProcessor = class _RequestConfirmationLlmReq
     }
     const approvals = collectApprovals(
       events,
-      (_a = runConfig == null ? void 0 : runConfig.plainTextToolConfirmation) != null ? _a : false
+      (_a = runConfig == null ? void 0 : runConfig.plainTextToolConfirmation) != null ? _a : false,
+      agent.name
     );
     if (approvals.size === 0) {
       return;
@@ -134,7 +135,7 @@ function eventsInScope(invocationContext) {
   );
 }
 __name(eventsInScope, "eventsInScope");
-function collectApprovals(events, allowPlainText) {
+function collectApprovals(events, allowPlainText, agentName) {
   const approvals = /* @__PURE__ */ new Map();
   const latestUserEvent = findLatestUserEvent(events);
   if (!latestUserEvent) {
@@ -153,7 +154,7 @@ function collectApprovals(events, allowPlainText) {
     );
   }
   if (approvals.size === 0 && allowPlainText) {
-    return mapPlainTextConfirmation(events);
+    return mapPlainTextConfirmation(events, agentName);
   }
   return approvals;
 }
@@ -185,6 +186,9 @@ function collectGateCandidates(events, approvals, agentName) {
             functionCallId: functionCall.id
           });
         }
+        import_logger.logger.debug(
+          `Skipping tool confirmation from event ${event.id}: authored by ${event.author}, not by ${agentName}.`
+        );
         continue;
       }
       const pinned = pinnedCall(functionCall);
@@ -197,7 +201,7 @@ function collectGateCandidates(events, approvals, agentName) {
           functionCallId: functionCall.id
         });
       }
-      if (hasRespondedAfter(events, pinned.id, index)) {
+      if (hasRespondedAfter(events, pinned.id, index, agentName)) {
         continue;
       }
       candidates.push({ pinned, confirmation });
@@ -257,16 +261,16 @@ function agentAuthoredCalls(events, agentName) {
 }
 __name(agentAuthoredCalls, "agentAuthoredCalls");
 function dynamicallyRequestedCallIds(events, agentName) {
+  var _a;
   const requested = /* @__PURE__ */ new Set();
   for (const event of events) {
     if (event.author !== agentName) {
       continue;
     }
-    const confirmations = event.actions.requestedToolConfirmations;
-    for (const functionResponse of (0, import_event.getFunctionResponses)(event)) {
-      if (functionResponse.id && functionResponse.id in confirmations) {
-        requested.add(functionResponse.id);
-      }
+    for (const functionCallId of Object.keys(
+      (_a = event.actions.requestedToolConfirmations) != null ? _a : {}
+    )) {
+      requested.add(functionCallId);
     }
   }
   return requested;
@@ -284,9 +288,9 @@ function pinnedCall(functionCall) {
   return pinned;
 }
 __name(pinnedCall, "pinnedCall");
-function hasRespondedAfter(events, pinnedCallId, gateIndex) {
+function hasRespondedAfter(events, pinnedCallId, gateIndex, agentName) {
   return events.slice(gateIndex + 1).some(
-    (event) => (0, import_event.getFunctionResponses)(event).some(
+    (event) => event.author === agentName && (0, import_event.getFunctionResponses)(event).some(
       (functionResponse) => functionResponse.id === pinnedCallId
     )
   );
@@ -323,7 +327,7 @@ const NEGATIVE = /* @__PURE__ */ new Set([
   "cancel",
   "cancelled"
 ]);
-function mapPlainTextConfirmation(events) {
+function mapPlainTextConfirmation(events, agentName) {
   var _a, _b;
   const none = /* @__PURE__ */ new Map();
   let turnIndex = -1;
@@ -361,6 +365,9 @@ function mapPlainTextConfirmation(events) {
     if (event.author === "user") {
       break;
     }
+    if (event.author !== agentName) {
+      continue;
+    }
     for (const fc of (0, import_event.getFunctionCalls)(event)) {
       if (fc.name === import_functions.REQUEST_CONFIRMATION_FUNCTION_CALL_NAME && fc.id && !answered.has(fc.id)) {
         pendingId = fc.id;

package/dist/cjs/agents/processors/request_input_llm_request_processor.js

@@ -30,7 +30,6 @@ __export(request_input_llm_request_processor_exports, {
 });
 module.exports = __toCommonJS(request_input_llm_request_processor_exports);
 var import_event = require("../../events/event.js");
-var import_tool_confirmation = require("../../tools/tool_confirmation.js");
 var import_async_queue = require("../../utils/async_queue.js");
 var import_node_tool = require("../../workflow/nodes/node_tool.js");
 var import_hitl_utils = require("../../workflow/utils/hitl_utils.js");
@@ -90,12 +89,9 @@ const _RequestInputLlmRequestProcessor = class _RequestInputLlmRequestProcessor
     if (Object.keys(pending).length === 0) {
       return;
     }
-    const toolConfirmationDict = {};
+    const resumeInputsDict = {};
     for (const id of Object.keys(pending)) {
-      toolConfirmationDict[id] = new import_tool_confirmation.ToolConfirmation({
-        confirmed: true,
-        payload: resumeInputs
-      });
+      resumeInputsDict[id] = resumeInputs;
     }
     const eventQueue = new import_async_queue.AsyncQueue();
     invocationContext.eventQueue = eventQueue;
@@ -108,7 +104,7 @@ const _RequestInputLlmRequestProcessor = class _RequestInputLlmRequestProcessor
           beforeToolCallbacks: agent.canonicalBeforeToolCallbacks,
           afterToolCallbacks: agent.canonicalAfterToolCallbacks,
           filters: new Set(Object.keys(pending)),
-          toolConfirmationDict
+          resumeInputsDict
         });
       } finally {
         eventQueue.close();

package/dist/cjs/agents/readonly_context.js

@@ -78,6 +78,12 @@ const _ReadonlyContext = class _ReadonlyContext {
       {}
     );
   }
+  /**
+   * Request-level metadata passed from an incoming A2A request or caller.
+   */
+  get a2aMetadata() {
+    return this.invocationContext.a2aMetadata;
+  }
 };
 __name(_ReadonlyContext, "ReadonlyContext");
 let ReadonlyContext = _ReadonlyContext;

package/dist/cjs/agents/routed_agent.js

@@ -37,7 +37,7 @@ var import_failover_utils = require("../utils/failover_utils.js");
  * SPDX-License-Identifier: Apache-2.0
  */
 var _a, _b;
-const ROUTED_AGENT_SIGNATURE_SYMBOL = Symbol.for("google.adk.routedAgent");
+const ROUTED_AGENT_SIGNATURE_SYMBOL = /* @__PURE__ */ Symbol.for("google.adk.routedAgent");
 function isRoutedAgent(obj) {
   return typeof obj === "object" && obj !== null && ROUTED_AGENT_SIGNATURE_SYMBOL in obj && obj[ROUTED_AGENT_SIGNATURE_SYMBOL] === true;
 }

package/dist/cjs/agents/sequential_agent.js

@@ -49,7 +49,7 @@ var import_readonly_context = require("./readonly_context.js");
  */
 var _a, _b;
 const TASK_COMPLETED_TOOL_NAME = "task_completed";
-const SEQUENTIAL_AGENT_SIGNATURE_SYMBOL = Symbol.for(
+const SEQUENTIAL_AGENT_SIGNATURE_SYMBOL = /* @__PURE__ */ Symbol.for(
   "google.adk.sequentialAgent"
 );
 function isSequentialAgent(obj) {

package/dist/cjs/apps/app.js

@@ -49,7 +49,7 @@ function validateAppName(name) {
   }
 }
 __name(validateAppName, "validateAppName");
-const APP_SIGNATURE_SYMBOL = Symbol.for("google.adk.app");
+const APP_SIGNATURE_SYMBOL = /* @__PURE__ */ Symbol.for("google.adk.app");
 function isApp(obj) {
   return typeof obj === "object" && obj !== null && APP_SIGNATURE_SYMBOL in obj && obj[APP_SIGNATURE_SYMBOL] === true;
 }

package/dist/cjs/artifacts/file_artifact_service.js

@@ -514,10 +514,9 @@ async function* iterateArtifactDirs(dir) {
     );
     if (hasVersions) {
       yield dir;
-      return;
     }
     for (const entry of entries) {
-      if (entry.isDirectory()) {
+      if (entry.isDirectory() && entry.name !== "versions") {
         const subdir = path.join(dir, entry.name);
         for await (const foundDir of iterateArtifactDirs(subdir)) {
           yield foundDir;

package/dist/cjs/artifacts/gcs_artifact_service.js

@@ -82,9 +82,7 @@ const _GcsArtifactService = class _GcsArtifactService {
         version
       })
     );
-    const customMetadata = {
-      ...request.customMetadata
-    };
+    const customMetadata = stringifyMetadataValues(request.customMetadata);
     if (request.artifact.inlineData) {
       if (request.artifact.inlineData.displayName) {
         customMetadata[GCS_DISPLAY_NAME_METADATA_KEY] = request.artifact.inlineData.displayName;
@@ -208,10 +206,9 @@ const _GcsArtifactService = class _GcsArtifactService {
     const [files] = await bucket.getFiles({ prefix: searchPrefix });
     const versions = [];
     for (const file of files) {
-      const version = file.name.split("/").pop();
-      const v = parseInt(version, 10);
-      if (!isNaN(v)) {
-        versions.push(v);
+      const suffix = file.name.slice(searchPrefix.length);
+      if (/^\d+$/.test(suffix)) {
+        versions.push(Number(suffix));
       }
     }
     return versions.sort((a, b) => a - b);
@@ -277,6 +274,15 @@ function getFileName({
   return version !== void 0 ? `${prefix}/${version}` : prefix;
 }
 __name(getFileName, "getFileName");
+function stringifyMetadataValues(customMetadata) {
+  return Object.fromEntries(
+    Object.entries(customMetadata != null ? customMetadata : {}).map(([key, value]) => [
+      key,
+      String(value)
+    ])
+  );
+}
+__name(stringifyMetadataValues, "stringifyMetadataValues");
 function extractArtifactKeys(files, fileNamePrefix, keyPrefix = "") {
   const keys = /* @__PURE__ */ new Set();
   for (const file of files) {

package/dist/cjs/artifacts/scoped_artifact_service.js

@@ -33,12 +33,21 @@ module.exports = __toCommonJS(scoped_artifact_service_exports);
  * Copyright 2026 Google LLC
  * SPDX-License-Identifier: Apache-2.0
  */
+var _a;
+const SESSION_ARTIFACT_SERVICE_SIGNATURE_SYMBOL = /* @__PURE__ */ Symbol.for(
+  "google.adk.sessionArtifactService"
+);
+_a = SESSION_ARTIFACT_SERVICE_SIGNATURE_SYMBOL;
 const _ScopedArtifactService = class _ScopedArtifactService {
   constructor(delegate, appName, userId, sessionId) {
     this.delegate = delegate;
     this.appName = appName;
     this.userId = userId;
     this.sessionId = sessionId;
+    /**
+     * Brands this class as a session-scoped artifact service.
+     */
+    this[_a] = true;
   }
   async saveArtifact(request) {
     return this.delegate.saveArtifact({

package/dist/cjs/artifacts/session_artifact_service.js

@@ -9,6 +9,11 @@ var __defProp = Object.defineProperty;
 var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
 var __getOwnPropNames = Object.getOwnPropertyNames;
 var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __name = (target, value) => __defProp(target, "name", { value, configurable: true });
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, { get: all[name], enumerable: true });
+};
 var __copyProps = (to, from, except, desc) => {
   if (from && typeof from === "object" || typeof from === "function") {
     for (let key of __getOwnPropNames(from))
@@ -19,9 +24,23 @@ var __copyProps = (to, from, except, desc) => {
 };
 var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
 var session_artifact_service_exports = {};
+__export(session_artifact_service_exports, {
+  isSessionArtifactService: () => isSessionArtifactService
+});
 module.exports = __toCommonJS(session_artifact_service_exports);
 /**
  * @license
  * Copyright 2026 Google LLC
  * SPDX-License-Identifier: Apache-2.0
  */
+const SESSION_ARTIFACT_SERVICE_SIGNATURE_SYMBOL = /* @__PURE__ */ Symbol.for(
+  "google.adk.sessionArtifactService"
+);
+function isSessionArtifactService(service) {
+  return typeof service === "object" && service !== null && SESSION_ARTIFACT_SERVICE_SIGNATURE_SYMBOL in service && service[SESSION_ARTIFACT_SERVICE_SIGNATURE_SYMBOL] === true;
+}
+__name(isSessionArtifactService, "isSessionArtifactService");
+// Annotate the CommonJS export names for ESM import in node:
+0 && (module.exports = {
+  isSessionArtifactService
+});

package/dist/cjs/auth/auth_credential.js

@@ -9,6 +9,7 @@ var __defProp = Object.defineProperty;
 var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
 var __getOwnPropNames = Object.getOwnPropertyNames;
 var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __name = (target, value) => __defProp(target, "name", { value, configurable: true });
 var __export = (target, all) => {
   for (var name in all)
     __defProp(target, name, { get: all[name], enumerable: true });
@@ -24,7 +25,8 @@ var __copyProps = (to, from, except, desc) => {
 var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
 var auth_credential_exports = {};
 __export(auth_credential_exports, {
-  AuthCredentialTypes: () => AuthCredentialTypes
+  AuthCredentialTypes: () => AuthCredentialTypes,
+  isAuthCredential: () => isAuthCredential
 });
 module.exports = __toCommonJS(auth_credential_exports);
 /**
@@ -40,7 +42,15 @@ var AuthCredentialTypes = /* @__PURE__ */ ((AuthCredentialTypes2) => {
   AuthCredentialTypes2["SERVICE_ACCOUNT"] = "serviceAccount";
   return AuthCredentialTypes2;
 })(AuthCredentialTypes || {});
+const AUTH_CREDENTIAL_TYPES = new Set(
+  Object.values(AuthCredentialTypes)
+);
+function isAuthCredential(value) {
+  return typeof value === "object" && value !== null && "authType" in value && AUTH_CREDENTIAL_TYPES.has(value.authType);
+}
+__name(isAuthCredential, "isAuthCredential");
 // Annotate the CommonJS export names for ESM import in node:
 0 && (module.exports = {
-  AuthCredentialTypes
+  AuthCredentialTypes,
+  isAuthCredential
 });

package/dist/cjs/auth/auth_handler.js

@@ -30,11 +30,13 @@ __export(auth_handler_exports, {
 module.exports = __toCommonJS(auth_handler_exports);
 var import_env_aware_utils = require("../utils/env_aware_utils.js");
 var import_oauth2_credential_exchanger = require("./oauth2/oauth2_credential_exchanger.js");
+var import_oauth2_utils = require("./oauth2/oauth2_utils.js");
 /**
  * @license
  * Copyright 2025 Google LLC
  * SPDX-License-Identifier: Apache-2.0
  */
+const S256_CODE_CHALLENGE_METHOD = "S256";
 const _AuthHandler = class _AuthHandler {
   constructor(authConfig) {
     this.authConfig = authConfig;
@@ -43,7 +45,16 @@ const _AuthHandler = class _AuthHandler {
     const credentialKey = "temp:" + this.authConfig.credentialKey;
     return state.get(credentialKey);
   }
+  /**
+   * Stores the exchanged credential in the session state.
+   *
+   * @param state The session state to store the credential in.
+   * @throws Error: If the auth config has no credentialKey.
+   */
   async parseAndStoreAuthResponse(state) {
+    if (!this.authConfig.credentialKey) {
+      throw new Error("credentialKey is empty.");
+    }
     const credentialKey = "temp:" + this.authConfig.credentialKey;
     const authSchemeType = this.authConfig.authScheme.type;
     if (!["oauth2", "openIdConnect"].includes(authSchemeType)) {
@@ -99,9 +110,14 @@ const _AuthHandler = class _AuthHandler {
   /**
    * Generates an response containing the auth uri for user to sign in.
    *
+   * When the credential requests PKCE, the URI also carries the S256 code
+   * challenge derived from the credential's code verifier, and the returned
+   * credential carries the verifier the later token exchange must send.
+   *
    * @return An AuthCredential object containing the auth URI and state.
    * @throws Error: If the authorization endpoint is not configured in the
-   *     auth scheme.
+   *     auth scheme, or the credential requests a code challenge method other
+   *     than 'S256'.
    */
   generateAuthUri() {
     const authScheme = this.authConfig.authScheme;
@@ -109,6 +125,13 @@ const _AuthHandler = class _AuthHandler {
     if (!authCredential || !authCredential.oauth2) {
       return authCredential;
     }
+    const oauth2 = authCredential.oauth2;
+    const codeChallengeMethod = oauth2.codeChallengeMethod;
+    if (codeChallengeMethod && codeChallengeMethod !== S256_CODE_CHALLENGE_METHOD) {
+      throw new Error(
+        `Unsupported codeChallengeMethod: ${codeChallengeMethod}. Only '${S256_CODE_CHALLENGE_METHOD}' is supported.`
+      );
+    }
     let authorizationEndpoint = "";
     let scopes = [];
     if ("authorizationEndpoint" in authScheme) {
@@ -133,22 +156,35 @@ const _AuthHandler = class _AuthHandler {
     }
     const state = (0, import_env_aware_utils.randomUUID)();
     const url = new URL(authorizationEndpoint);
-    url.searchParams.set("client_id", authCredential.oauth2.clientId || "");
-    url.searchParams.set(
-      "redirect_uri",
-      authCredential.oauth2.redirectUri || ""
-    );
+    url.searchParams.set("client_id", oauth2.clientId || "");
+    url.searchParams.set("redirect_uri", oauth2.redirectUri || "");
     url.searchParams.set("response_type", "code");
     url.searchParams.set("scope", scopes.join(" "));
     url.searchParams.set("state", state);
     url.searchParams.set("access_type", "offline");
     url.searchParams.set("prompt", "consent");
+    if (oauth2.audience) {
+      url.searchParams.set("audience", oauth2.audience);
+    }
+    if (oauth2.nonce) {
+      url.searchParams.set("nonce", oauth2.nonce);
+    }
+    let codeVerifier = oauth2.codeVerifier;
+    if (codeChallengeMethod) {
+      codeVerifier != null ? codeVerifier : codeVerifier = (0, import_oauth2_utils.generateCodeVerifier)();
+      url.searchParams.set(
+        "code_challenge",
+        (0, import_oauth2_utils.createS256CodeChallenge)(codeVerifier)
+      );
+      url.searchParams.set("code_challenge_method", codeChallengeMethod);
+    }
     const exchangedAuthCredential = {
       ...authCredential,
       oauth2: {
-        ...authCredential.oauth2,
+        ...oauth2,
         authUri: url.toString(),
-        state
+        state,
+        codeVerifier
       }
     };
     return exchangedAuthCredential;

package/dist/cjs/auth/oauth2/oauth2_credential_refresher.js

@@ -41,7 +41,7 @@ const _OAuth2CredentialRefresher = class _OAuth2CredentialRefresher {
    *
    * @param authCredential The OAuth2 credential to check.
    * @param authScheme The OAuth2 authentication scheme (optional).
-   * @returns True if the credential needs to be refreshed, False otherwise.
+   * @returns True if the credential needs to be refreshed, false otherwise.
    */
   async isRefreshNeeded(authCredential) {
     if (!authCredential.oauth2) {

package/dist/cjs/auth/oauth2/oauth2_utils.js

@@ -26,19 +26,32 @@ var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: tru
 var oauth2_utils_exports = {};
 __export(oauth2_utils_exports, {
   createOAuth2TokenRequestBody: () => createOAuth2TokenRequestBody,
+  createS256CodeChallenge: () => createS256CodeChallenge,
   fetchOAuth2Tokens: () => fetchOAuth2Tokens,
+  generateCodeVerifier: () => generateCodeVerifier,
   getTokenEndpoint: () => getTokenEndpoint,
   isTokenExpired: () => isTokenExpired,
   parseAuthorizationCode: () => parseAuthorizationCode
 });
 module.exports = __toCommonJS(oauth2_utils_exports);
+var import_node_crypto = require("node:crypto");
 var import_logger = require("../../utils/logger.js");
+var import_redact_uri = require("../../utils/redact_uri.js");
 var import_oauth2_discovery = require("./oauth2_discovery.js");
 /**
  * @license
  * Copyright 2026 Google LLC
  * SPDX-License-Identifier: Apache-2.0
  */
+const CODE_VERIFIER_BYTES = 36;
+function generateCodeVerifier() {
+  return (0, import_node_crypto.randomBytes)(CODE_VERIFIER_BYTES).toString("base64url");
+}
+__name(generateCodeVerifier, "generateCodeVerifier");
+function createS256CodeChallenge(codeVerifier) {
+  return (0, import_node_crypto.createHash)("sha256").update(codeVerifier).digest("base64url");
+}
+__name(createS256CodeChallenge, "createS256CodeChallenge");
 function getTokenEndpoint(authScheme) {
   if (authScheme.type === "openIdConnect" && authScheme.tokenEndpoint) {
     return authScheme.tokenEndpoint;
@@ -93,8 +106,8 @@ function parseAuthorizationCode(uri) {
   try {
     const url = new URL(uri);
     return url.searchParams.get("code") || void 0;
-  } catch (e) {
-    import_logger.logger.warn(`Failed to parse authorization URI ${uri}: ${e}`);
+  } catch {
+    import_logger.logger.warn(`Failed to parse authorization URI ${(0, import_redact_uri.redactUriPassword)(uri)}`);
     return void 0;
   }
 }
@@ -129,7 +142,9 @@ __name(isTokenExpired, "isTokenExpired");
 // Annotate the CommonJS export names for ESM import in node:
 0 && (module.exports = {
   createOAuth2TokenRequestBody,
+  createS256CodeChallenge,
   fetchOAuth2Tokens,
+  generateCodeVerifier,
   getTokenEndpoint,
   isTokenExpired,
   parseAuthorizationCode

package/dist/cjs/code_executors/base_code_executor.js

@@ -35,7 +35,7 @@ module.exports = __toCommonJS(base_code_executor_exports);
  * SPDX-License-Identifier: Apache-2.0
  */
 var _a;
-const BASE_CODE_EXECUTOR_SIGNATURE_SYMBOL = Symbol.for(
+const BASE_CODE_EXECUTOR_SIGNATURE_SYMBOL = /* @__PURE__ */ Symbol.for(
   "google.adk.baseCodeExecutor"
 );
 function isBaseCodeExecutor(obj) {

package/dist/cjs/code_executors/built_in_code_executor.js

@@ -37,7 +37,7 @@ var import_base_code_executor = require("./base_code_executor.js");
  * SPDX-License-Identifier: Apache-2.0
  */
 var _a, _b;
-const BUILT_IN_CODE_EXECUTOR_SIGNATURE_SYMBOL = Symbol.for(
+const BUILT_IN_CODE_EXECUTOR_SIGNATURE_SYMBOL = /* @__PURE__ */ Symbol.for(
   "google.adk.builtInCodeExecutor"
 );
 function isBuiltInCodeExecutor(obj) {

package/dist/cjs/code_executors/code_execution_utils.js

@@ -70,7 +70,7 @@ function extractCodeAndTruncateContent(content, codeBlockDelimiters) {
     const part = content.parts[i];
     if (part.executableCode && (i === content.parts.length - 1 || !content.parts[i + 1].codeExecutionResult)) {
       content.parts = content.parts.slice(0, i + 1);
-      return part.executableCode.code;
+      return part.executableCode.code || "";
     }
   }
   const textParts = content.parts.filter((part) => part.text);
@@ -145,12 +145,12 @@ function convertCodeExecutionParts(content, codeBlockDelimiter, executionResultD
   const lastPart = content.parts[content.parts.length - 1];
   if (lastPart.executableCode) {
     content.parts[content.parts.length - 1] = {
-      text: codeBlockDelimiter[0] + lastPart.executableCode.code + codeBlockDelimiter[1]
+      text: codeBlockDelimiter[0] + (lastPart.executableCode.code || "") + codeBlockDelimiter[1]
     };
   } else if (content.parts.length == 1 && lastPart.codeExecutionResult) {
-    content.parts[content.parts.length - 1] = {
-      text: executionResultDelimiters[0] + lastPart.codeExecutionResult.output + executionResultDelimiters[1]
-    };
+    const output = lastPart.codeExecutionResult.output;
+    const text = output == null ? "" : executionResultDelimiters[0] + output + executionResultDelimiters[1];
+    content.parts[content.parts.length - 1] = { text };
     content.role = "user";
   }
 }