@google/adk 2.1.0 → 2.2.0

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (143) hide show
  1. package/dist/cjs/a2a/agent_card.js +8 -0
  2. package/dist/cjs/a2a/agent_executor.js +8 -3
  3. package/dist/cjs/agents/llm_agent.js +15 -1
  4. package/dist/cjs/agents/processors/content_processor_utils.js +10 -2
  5. package/dist/cjs/agents/processors/nl_planning_processor.js +114 -0
  6. package/dist/cjs/artifacts/gcs_artifact_service.js +13 -7
  7. package/dist/cjs/auth/auth_credential.js +12 -2
  8. package/dist/cjs/code_executors/code_execution_utils.js +3 -3
  9. package/dist/cjs/common.js +45 -0
  10. package/dist/cjs/examples/example.js +92 -0
  11. package/dist/cjs/examples/example_util.js +28 -4
  12. package/dist/cjs/examples/index.js +39 -0
  13. package/dist/cjs/examples/vertex_ai_example_store.js +39 -0
  14. package/dist/cjs/index.js +46 -0
  15. package/dist/cjs/memory/vertex_ai_memory_bank_service.js +17 -5
  16. package/dist/cjs/models/base_llm.js +1 -6
  17. package/dist/cjs/models/chrome_prompt_llm.js +16 -2
  18. package/dist/cjs/models/chrome_prompt_utils.js +54 -2
  19. package/dist/cjs/models/gemini_llm_connection.js +5 -4
  20. package/dist/cjs/planners/base_planner.js +56 -0
  21. package/dist/cjs/planners/built_in_planner.js +85 -0
  22. package/dist/cjs/planners/plan_re_act_planner.js +172 -0
  23. package/dist/cjs/plugins/base_plugin.js +46 -61
  24. package/dist/cjs/tools/example_tool.js +1 -1
  25. package/dist/cjs/tools/mcp/mcp_session_manager.js +14 -8
  26. package/dist/cjs/tools/openapi_tool/auth/auth_helpers.js +281 -2
  27. package/dist/cjs/tools/openapi_tool/auth/credential_exchangers/auto_auth_credential_exchanger.js +15 -1
  28. package/dist/cjs/tools/openapi_tool/auth/credential_exchangers/base_auth_credential_exchanger.js +70 -0
  29. package/dist/cjs/tools/openapi_tool/auth/credential_exchangers/oauth2_exchanger.js +120 -0
  30. package/dist/cjs/tools/openapi_tool/auth/credential_exchangers/service_account_exchanger.js +10 -10
  31. package/dist/cjs/tools/openapi_tool/common/common.js +139 -0
  32. package/dist/cjs/tools/openapi_tool/openapi_spec_parser/openapi_spec_parser.js +11 -6
  33. package/dist/cjs/tools/openapi_tool/openapi_spec_parser/operation_parser.js +73 -13
  34. package/dist/cjs/tools/openapi_tool/openapi_spec_parser/tool_auth_handler.js +146 -34
  35. package/dist/cjs/tools/openapi_tool/openapi_toolset.js +14 -2
  36. package/dist/cjs/tools/openapi_tool/rest_api_tool.js +90 -28
  37. package/dist/cjs/tools/skill/skill_toolset.js +2 -0
  38. package/dist/cjs/tools/tool_context.js +41 -0
  39. package/dist/cjs/tools/webmcp/index.js +37 -0
  40. package/dist/cjs/tools/webmcp/webmcp_tool.js +156 -0
  41. package/dist/cjs/tools/webmcp/webmcp_toolset.js +116 -0
  42. package/dist/cjs/tools/webmcp/webmcp_types.js +50 -0
  43. package/dist/cjs/utils/case_utils.js +52 -2
  44. package/dist/cjs/utils/client_labels.js +67 -0
  45. package/dist/cjs/utils/gemini_schema_util.js +103 -3
  46. package/dist/cjs/utils/hash_utils.js +73 -0
  47. package/dist/cjs/utils/live_connection_utils.js +10 -9
  48. package/dist/cjs/utils/model_name.js +17 -2
  49. package/dist/cjs/utils/simple_zod_to_json.js +5 -0
  50. package/dist/cjs/version.js +1 -1
  51. package/dist/esm/a2a/agent_card.js +8 -0
  52. package/dist/esm/a2a/agent_executor.js +8 -3
  53. package/dist/esm/agents/llm_agent.js +18 -1
  54. package/dist/esm/agents/processors/content_processor_utils.js +10 -2
  55. package/dist/esm/agents/processors/nl_planning_processor.js +87 -0
  56. package/dist/esm/artifacts/gcs_artifact_service.js +13 -7
  57. package/dist/esm/auth/auth_credential.js +11 -1
  58. package/dist/esm/code_executors/code_execution_utils.js +3 -3
  59. package/dist/esm/common.js +38 -2
  60. package/dist/esm/examples/example.js +85 -0
  61. package/dist/esm/examples/example_util.js +25 -3
  62. package/dist/esm/examples/index.js +11 -0
  63. package/dist/esm/examples/vertex_ai_example_store.js +11 -0
  64. package/dist/esm/index.js +51 -1
  65. package/dist/esm/memory/vertex_ai_memory_bank_service.js +17 -5
  66. package/dist/esm/models/base_llm.js +2 -7
  67. package/dist/esm/models/chrome_prompt_llm.js +20 -3
  68. package/dist/esm/models/chrome_prompt_utils.js +51 -2
  69. package/dist/esm/models/gemini_llm_connection.js +6 -5
  70. package/dist/esm/planners/base_planner.js +28 -0
  71. package/dist/esm/planners/built_in_planner.js +57 -0
  72. package/dist/esm/planners/plan_re_act_planner.js +145 -0
  73. package/dist/esm/plugins/base_plugin.js +46 -61
  74. package/dist/esm/tools/example_tool.js +1 -1
  75. package/dist/esm/tools/mcp/mcp_session_manager.js +14 -8
  76. package/dist/esm/tools/openapi_tool/auth/auth_helpers.js +272 -1
  77. package/dist/esm/tools/openapi_tool/auth/credential_exchangers/auto_auth_credential_exchanger.js +15 -1
  78. package/dist/esm/tools/openapi_tool/auth/credential_exchangers/base_auth_credential_exchanger.js +43 -0
  79. package/dist/esm/tools/openapi_tool/auth/credential_exchangers/oauth2_exchanger.js +93 -0
  80. package/dist/esm/tools/openapi_tool/auth/credential_exchangers/service_account_exchanger.js +10 -12
  81. package/dist/esm/tools/openapi_tool/common/common.js +112 -0
  82. package/dist/esm/tools/openapi_tool/openapi_spec_parser/openapi_spec_parser.js +11 -6
  83. package/dist/esm/tools/openapi_tool/openapi_spec_parser/operation_parser.js +80 -13
  84. package/dist/esm/tools/openapi_tool/openapi_spec_parser/tool_auth_handler.js +146 -33
  85. package/dist/esm/tools/openapi_tool/openapi_toolset.js +14 -2
  86. package/dist/esm/tools/openapi_tool/rest_api_tool.js +89 -28
  87. package/dist/esm/tools/skill/skill_toolset.js +2 -0
  88. package/dist/esm/tools/tool_context.js +15 -0
  89. package/dist/esm/tools/webmcp/index.js +10 -0
  90. package/dist/esm/tools/webmcp/webmcp_tool.js +131 -0
  91. package/dist/esm/tools/webmcp/webmcp_toolset.js +89 -0
  92. package/dist/esm/tools/webmcp/webmcp_types.js +22 -0
  93. package/dist/esm/utils/case_utils.js +49 -1
  94. package/dist/esm/utils/client_labels.js +65 -0
  95. package/dist/esm/utils/gemini_schema_util.js +102 -3
  96. package/dist/esm/utils/hash_utils.js +45 -0
  97. package/dist/esm/utils/live_connection_utils.js +11 -10
  98. package/dist/esm/utils/model_name.js +15 -2
  99. package/dist/esm/utils/simple_zod_to_json.js +5 -0
  100. package/dist/esm/version.js +1 -1
  101. package/dist/types/agents/llm_agent.d.ts +12 -1
  102. package/dist/types/agents/processors/nl_planning_processor.d.ts +30 -0
  103. package/dist/types/auth/auth_credential.d.ts +9 -0
  104. package/dist/types/common.d.ts +16 -4
  105. package/dist/types/examples/base_example_provider.d.ts +2 -2
  106. package/dist/types/examples/example.d.ts +75 -0
  107. package/dist/types/examples/example_util.d.ts +13 -2
  108. package/dist/types/examples/index.d.ts +18 -0
  109. package/dist/types/examples/vertex_ai_example_store.d.ts +7 -0
  110. package/dist/types/index.d.ts +12 -3
  111. package/dist/types/memory/memory_entry.d.ts +15 -0
  112. package/dist/types/memory/vertex_ai_memory_bank_service.d.ts +9 -0
  113. package/dist/types/models/chrome_prompt_utils.d.ts +29 -0
  114. package/dist/types/planners/base_planner.d.ts +50 -0
  115. package/dist/types/planners/built_in_planner.d.ts +53 -0
  116. package/dist/types/planners/plan_re_act_planner.d.ts +21 -0
  117. package/dist/types/plugins/base_plugin.d.ts +52 -52
  118. package/dist/types/skills/skill_registry.d.ts +8 -0
  119. package/dist/types/tools/openapi_tool/auth/auth_helpers.d.ts +110 -1
  120. package/dist/types/tools/openapi_tool/auth/credential_exchangers/auto_auth_credential_exchanger.d.ts +32 -2
  121. package/dist/types/tools/openapi_tool/auth/credential_exchangers/base_auth_credential_exchanger.d.ts +35 -0
  122. package/dist/types/tools/openapi_tool/auth/credential_exchangers/oauth2_exchanger.d.ts +54 -0
  123. package/dist/types/tools/openapi_tool/common/common.d.ts +60 -0
  124. package/dist/types/tools/openapi_tool/openapi_spec_parser/openapi_spec_parser.d.ts +7 -0
  125. package/dist/types/tools/openapi_tool/openapi_spec_parser/operation_parser.d.ts +56 -2
  126. package/dist/types/tools/openapi_tool/openapi_spec_parser/tool_auth_handler.d.ts +73 -5
  127. package/dist/types/tools/openapi_tool/openapi_toolset.d.ts +11 -0
  128. package/dist/types/tools/openapi_tool/rest_api_tool.d.ts +42 -8
  129. package/dist/types/tools/tool_context.d.ts +19 -0
  130. package/dist/types/tools/webmcp/index.d.ts +12 -0
  131. package/dist/types/tools/webmcp/webmcp_tool.d.ts +47 -0
  132. package/dist/types/tools/webmcp/webmcp_toolset.d.ts +67 -0
  133. package/dist/types/tools/webmcp/webmcp_types.d.ts +69 -0
  134. package/dist/types/utils/case_utils.d.ts +36 -0
  135. package/dist/types/utils/client_labels.d.ts +33 -0
  136. package/dist/types/utils/gemini_schema_util.d.ts +13 -0
  137. package/dist/types/utils/hash_utils.d.ts +25 -0
  138. package/dist/types/utils/logger.d.ts +10 -2
  139. package/dist/types/utils/model_name.d.ts +30 -2
  140. package/dist/types/version.d.ts +1 -1
  141. package/dist/web/index_web.js +112 -79
  142. package/dist/web/index_web.js.map +4 -4
  143. package/package.json +8 -2
@@ -28,6 +28,7 @@ var __toESM = (mod, isNodeMode, target) => (target = mod != null ? __create(__ge
28
28
  * Copyright 2025 Google LLC
29
29
  * SPDX-License-Identifier: Apache-2.0
30
30
  */
31
+ import { mergeTrackingHeaders } from "../../utils/client_labels.js";
31
32
  import { formatError } from "../../utils/error_utils.js";
32
33
  import { logger } from "../../utils/logger.js";
33
34
  import { loadOptionalPeer } from "../../utils/optional_peer.js";
@@ -39,13 +40,24 @@ function logTransportError(err) {
39
40
  logger.error("MCP transport error: " + formatError(err));
40
41
  }
41
42
  __name(logTransportError, "logTransportError");
43
+ function buildTransportOptions(params) {
44
+ const { transportOptions, header } = params;
45
+ const callerHeaders = (transportOptions == null ? void 0 : transportOptions.requestInit) === void 0 ? header : transportOptions.requestInit.headers;
46
+ return {
47
+ ...transportOptions,
48
+ requestInit: {
49
+ ...transportOptions == null ? void 0 : transportOptions.requestInit,
50
+ headers: mergeTrackingHeaders(callerHeaders)
51
+ }
52
+ };
53
+ }
54
+ __name(buildTransportOptions, "buildTransportOptions");
42
55
  const _MCPSessionManager = class _MCPSessionManager {
43
56
  constructor(connectionParams) {
44
57
  this.activeSessions = /* @__PURE__ */ new Set();
45
58
  this.connectionParams = connectionParams;
46
59
  }
47
60
  async createSession() {
48
- var _a;
49
61
  const { Client } = await loadOptionalPeer(
50
62
  MCP_SDK,
51
63
  () => Promise.resolve().then(() => __toESM(require("@modelcontextprotocol/sdk/client/index.js"), 1))
@@ -66,19 +78,13 @@ const _MCPSessionManager = class _MCPSessionManager {
66
78
  break;
67
79
  }
68
80
  case "StreamableHTTPConnectionParams": {
69
- const options = (_a = this.connectionParams.transportOptions) != null ? _a : {};
70
- if (!options.requestInit && this.connectionParams.header !== void 0) {
71
- options.requestInit = {
72
- headers: this.connectionParams.header
73
- };
74
- }
75
81
  const { StreamableHTTPClientTransport } = await loadOptionalPeer(
76
82
  MCP_SDK,
77
83
  () => Promise.resolve().then(() => __toESM(require("@modelcontextprotocol/sdk/client/streamableHttp.js"), 1))
78
84
  );
79
85
  const transport = new StreamableHTTPClientTransport(
80
86
  new URL(this.connectionParams.url),
81
- options
87
+ buildTransportOptions(this.connectionParams)
82
88
  );
83
89
  transport.onerror = logTransportError;
84
90
  await client.connect(transport);
@@ -7,9 +7,74 @@ var __name = (target, value) => __defProp(target, "name", { value, configurable:
7
7
  * Copyright 2026 Google LLC
8
8
  * SPDX-License-Identifier: Apache-2.0
9
9
  */
10
+ import { z } from "zod";
10
11
  import {
11
12
  AuthCredentialTypes
12
13
  } from "../../../auth/auth_credential.js";
14
+ import { camelCaseKeys } from "../../../utils/case_utils.js";
15
+ const INTERNAL_AUTH_PREFIX = "_auth_prefix_vaf_";
16
+ const API_KEY_LOCATIONS = ["header", "query", "cookie"];
17
+ const OPENID_FETCH_TIMEOUT_MS = 1e4;
18
+ const REQUIRED_CREDENTIAL_FIELDS = ["client_id", "client_secret"];
19
+ const scopesSchema = z.record(z.string(), z.string()).default({});
20
+ const OAuthFlowsSchema = z.looseObject({
21
+ implicit: z.looseObject({
22
+ authorizationUrl: z.string(),
23
+ refreshUrl: z.string().optional(),
24
+ scopes: scopesSchema
25
+ }).optional(),
26
+ password: z.looseObject({
27
+ tokenUrl: z.string(),
28
+ refreshUrl: z.string().optional(),
29
+ scopes: scopesSchema
30
+ }).optional(),
31
+ clientCredentials: z.looseObject({
32
+ tokenUrl: z.string(),
33
+ refreshUrl: z.string().optional(),
34
+ scopes: scopesSchema
35
+ }).optional(),
36
+ authorizationCode: z.looseObject({
37
+ authorizationUrl: z.string(),
38
+ tokenUrl: z.string(),
39
+ refreshUrl: z.string().optional(),
40
+ scopes: scopesSchema
41
+ }).optional()
42
+ });
43
+ const ApiKeySchemeSchema = z.looseObject({
44
+ type: z.literal("apiKey"),
45
+ description: z.string().optional(),
46
+ name: z.string(),
47
+ in: z.enum(API_KEY_LOCATIONS)
48
+ });
49
+ const HttpSchemeSchema = z.looseObject({
50
+ type: z.literal("http"),
51
+ description: z.string().optional(),
52
+ scheme: z.string(),
53
+ bearerFormat: z.string().optional()
54
+ });
55
+ const Oauth2SchemeSchema = z.looseObject({
56
+ type: z.literal("oauth2"),
57
+ description: z.string().optional(),
58
+ flows: OAuthFlowsSchema
59
+ });
60
+ const OpenIdConnectSchemeSchema = z.looseObject({
61
+ type: z.literal("openIdConnect"),
62
+ description: z.string().optional(),
63
+ openIdConnectUrl: z.string()
64
+ });
65
+ const OpenIdConnectConfigSchema = z.looseObject({
66
+ type: z.literal("openIdConnect").default("openIdConnect"),
67
+ description: z.string().optional(),
68
+ openIdConnectUrl: z.string().default(""),
69
+ authorizationEndpoint: z.string(),
70
+ tokenEndpoint: z.string(),
71
+ userinfoEndpoint: z.string().optional(),
72
+ revocationEndpoint: z.string().optional(),
73
+ tokenEndpointAuthMethodsSupported: z.array(z.string()).optional(),
74
+ grantTypesSupported: z.array(z.string()).optional(),
75
+ scopes: z.array(z.string()).optional()
76
+ });
77
+ const JsonObjectSchema = z.record(z.string(), z.unknown());
13
78
  function applyCredential(url, headers, credential, authScheme) {
14
79
  var _a;
15
80
  if (!credential) return url;
@@ -57,8 +122,214 @@ function createBearerScheme() {
57
122
  };
58
123
  }
59
124
  __name(createBearerScheme, "createBearerScheme");
125
+ function isApiKeyLocation(value) {
126
+ return API_KEY_LOCATIONS.some((location) => location === value);
127
+ }
128
+ __name(isApiKeyLocation, "isApiKeyLocation");
129
+ function bearerJwtScheme() {
130
+ return { type: "http", scheme: "bearer", bearerFormat: "JWT" };
131
+ }
132
+ __name(bearerJwtScheme, "bearerJwtScheme");
133
+ function bearerTokenParam(authScheme, token) {
134
+ var _a;
135
+ const param = {
136
+ originalName: "Authorization",
137
+ paramLocation: "header",
138
+ paramSchema: { type: "string" },
139
+ description: (_a = authScheme.description) != null ? _a : "Bearer token",
140
+ name: `${INTERNAL_AUTH_PREFIX}Authorization`,
141
+ required: true
142
+ };
143
+ return [param, { [param.name]: `Bearer ${token}` }];
144
+ }
145
+ __name(bearerTokenParam, "bearerTokenParam");
146
+ function tokenToSchemeCredential(tokenType, location, name, credentialValue) {
147
+ if (tokenType === "apikey") {
148
+ if (!isApiKeyLocation(location)) {
149
+ throw new Error(`Invalid location for apiKey: ${location}`);
150
+ }
151
+ const authScheme = {
152
+ type: "apiKey",
153
+ in: location,
154
+ name: name != null ? name : ""
155
+ };
156
+ const authCredential = credentialValue ? { authType: AuthCredentialTypes.API_KEY, apiKey: credentialValue } : void 0;
157
+ return [authScheme, authCredential];
158
+ }
159
+ if (tokenType === "oauth2Token") {
160
+ const authCredential = credentialValue ? {
161
+ authType: AuthCredentialTypes.HTTP,
162
+ http: { scheme: "bearer", credentials: { token: credentialValue } }
163
+ } : void 0;
164
+ return [bearerJwtScheme(), authCredential];
165
+ }
166
+ throw new Error(`Invalid security scheme type: ${tokenType}`);
167
+ }
168
+ __name(tokenToSchemeCredential, "tokenToSchemeCredential");
169
+ function serviceAccountDictToSchemeCredential(config, scopes) {
170
+ const authCredential = {
171
+ authType: AuthCredentialTypes.SERVICE_ACCOUNT,
172
+ serviceAccount: {
173
+ // The reference calls `ServiceAccountCredential.model_construct`, which
174
+ // skips validation on purpose, so the port does not validate either.
175
+ serviceAccountCredential: camelCaseKeys(
176
+ config
177
+ ),
178
+ scopes
179
+ }
180
+ };
181
+ return [bearerJwtScheme(), authCredential];
182
+ }
183
+ __name(serviceAccountDictToSchemeCredential, "serviceAccountDictToSchemeCredential");
184
+ function serviceAccountSchemeCredential(config) {
185
+ const authCredential = {
186
+ authType: AuthCredentialTypes.SERVICE_ACCOUNT,
187
+ serviceAccount: config
188
+ };
189
+ return [bearerJwtScheme(), authCredential];
190
+ }
191
+ __name(serviceAccountSchemeCredential, "serviceAccountSchemeCredential");
192
+ function openidDictToSchemeCredential(configDict, scopes, credentialDict) {
193
+ const parsedConfig = OpenIdConnectConfigSchema.safeParse(
194
+ camelCaseKeys(configDict)
195
+ );
196
+ if (!parsedConfig.success) {
197
+ throw new Error(
198
+ `Invalid OpenID Connect configuration: ${z.prettifyError(parsedConfig.error)}`
199
+ );
200
+ }
201
+ const openidScheme = { ...parsedConfig.data, scopes };
202
+ const values = Object.values(credentialDict);
203
+ if (values.length === 1) {
204
+ const wrapped = JsonObjectSchema.safeParse(values[0]);
205
+ if (wrapped.success && "client_id" in wrapped.data && "client_secret" in wrapped.data) {
206
+ credentialDict = wrapped.data;
207
+ }
208
+ }
209
+ const missingFields = REQUIRED_CREDENTIAL_FIELDS.filter(
210
+ (field) => !(field in credentialDict)
211
+ );
212
+ if (missingFields.length > 0) {
213
+ throw new Error(
214
+ `Missing required fields in credential_dict: ${missingFields.join(", ")}`
215
+ );
216
+ }
217
+ const authCredential = {
218
+ authType: AuthCredentialTypes.OPEN_ID_CONNECT,
219
+ oauth2: {
220
+ clientId: String(credentialDict["client_id"]),
221
+ clientSecret: String(credentialDict["client_secret"]),
222
+ redirectUri: "redirect_uri" in credentialDict ? String(credentialDict["redirect_uri"]) : void 0
223
+ }
224
+ };
225
+ return [openidScheme, authCredential];
226
+ }
227
+ __name(openidDictToSchemeCredential, "openidDictToSchemeCredential");
228
+ async function openidUrlToSchemeCredential(openidUrl, scopes, credentialDict) {
229
+ let response;
230
+ try {
231
+ response = await fetch(openidUrl, {
232
+ signal: AbortSignal.timeout(OPENID_FETCH_TIMEOUT_MS)
233
+ });
234
+ if (!response.ok) {
235
+ throw new Error(`responded with status ${response.status}`);
236
+ }
237
+ } catch (e) {
238
+ throw new Error(
239
+ `Failed to fetch OpenID configuration from ${openidUrl}: ${String(e)}`
240
+ );
241
+ }
242
+ let configDict;
243
+ try {
244
+ configDict = JsonObjectSchema.parse(await response.json());
245
+ } catch (e) {
246
+ throw new Error(
247
+ `Invalid JSON response from OpenID configuration endpoint ${openidUrl}: ${String(e)}`
248
+ );
249
+ }
250
+ return openidDictToSchemeCredential(
251
+ { ...configDict, openIdConnectUrl: openidUrl },
252
+ scopes,
253
+ credentialDict
254
+ );
255
+ }
256
+ __name(openidUrlToSchemeCredential, "openidUrlToSchemeCredential");
257
+ function credentialToParam(authScheme, authCredential) {
258
+ var _a, _b, _c, _d;
259
+ if (!authCredential) {
260
+ return [void 0, void 0];
261
+ }
262
+ if (authScheme.type === "apiKey" && authCredential.apiKey) {
263
+ if (!isApiKeyLocation(authScheme.in)) {
264
+ throw new Error(`Invalid API Key location: ${authScheme.in}`);
265
+ }
266
+ const paramName = authScheme.name || "";
267
+ const param = {
268
+ originalName: paramName,
269
+ paramLocation: authScheme.in,
270
+ paramSchema: { type: "string" },
271
+ description: (_a = authScheme.description) != null ? _a : "",
272
+ name: INTERNAL_AUTH_PREFIX + paramName,
273
+ required: true
274
+ };
275
+ return [param, { [param.name]: authCredential.apiKey }];
276
+ }
277
+ if (authCredential.authType === AuthCredentialTypes.HTTP) {
278
+ const credentials = (_b = authCredential.http) == null ? void 0 : _b.credentials;
279
+ if (credentials == null ? void 0 : credentials.token) {
280
+ return bearerTokenParam(authScheme, credentials.token);
281
+ }
282
+ if ((credentials == null ? void 0 : credentials.username) || (credentials == null ? void 0 : credentials.password)) {
283
+ throw new Error("Basic Authentication is not supported.");
284
+ }
285
+ throw new Error("Invalid HTTP auth credentials");
286
+ }
287
+ if (authScheme.type === "oauth2" || authScheme.type === "openIdConnect") {
288
+ const token = (_d = (_c = authCredential.http) == null ? void 0 : _c.credentials) == null ? void 0 : _d.token;
289
+ return token ? bearerTokenParam(authScheme, token) : [void 0, void 0];
290
+ }
291
+ throw new Error("Invalid security scheme and credential combination");
292
+ }
293
+ __name(credentialToParam, "credentialToParam");
294
+ function parseSecurityScheme(schema, data) {
295
+ const result = schema.safeParse(data);
296
+ if (!result.success) {
297
+ throw new Error(
298
+ `Invalid security scheme data: ${z.prettifyError(result.error)}`
299
+ );
300
+ }
301
+ return result.data;
302
+ }
303
+ __name(parseSecurityScheme, "parseSecurityScheme");
304
+ function dictToAuthScheme(data) {
305
+ if (!("type" in data)) {
306
+ throw new Error("Missing 'type' field in security scheme dictionary.");
307
+ }
308
+ const securityType = data["type"];
309
+ switch (securityType) {
310
+ case "apiKey":
311
+ return parseSecurityScheme(ApiKeySchemeSchema, data);
312
+ case "http":
313
+ return parseSecurityScheme(HttpSchemeSchema, data);
314
+ case "oauth2":
315
+ return parseSecurityScheme(Oauth2SchemeSchema, data);
316
+ case "openIdConnect":
317
+ return parseSecurityScheme(OpenIdConnectSchemeSchema, data);
318
+ default:
319
+ throw new Error(`Invalid security scheme type: ${securityType}`);
320
+ }
321
+ }
322
+ __name(dictToAuthScheme, "dictToAuthScheme");
60
323
  export {
324
+ INTERNAL_AUTH_PREFIX,
61
325
  applyCredential,
62
326
  createApiKeyScheme,
63
- createBearerScheme
327
+ createBearerScheme,
328
+ credentialToParam,
329
+ dictToAuthScheme,
330
+ openidDictToSchemeCredential,
331
+ openidUrlToSchemeCredential,
332
+ serviceAccountDictToSchemeCredential,
333
+ serviceAccountSchemeCredential,
334
+ tokenToSchemeCredential
64
335
  };
@@ -23,7 +23,12 @@ import { OAuth2CredentialExchanger } from "../../../../auth/oauth2/oauth2_creden
23
23
  import { experimental } from "../../../../utils/experimental.js";
24
24
  import { ServiceAccountCredentialExchanger } from "./service_account_exchanger.js";
25
25
  let AutoAuthCredentialExchanger = class {
26
- constructor() {
26
+ /**
27
+ * @param customExchangers - Optional exchangers that add to or override the
28
+ * built-in ones. The key is the auth credential type; the value is the
29
+ * exchanger instance to use for that type.
30
+ */
31
+ constructor(customExchangers) {
27
32
  this.exchangers = /* @__PURE__ */ new Map();
28
33
  this.exchangers.set(
29
34
  AuthCredentialTypes.OAUTH2,
@@ -37,9 +42,18 @@ let AutoAuthCredentialExchanger = class {
37
42
  AuthCredentialTypes.SERVICE_ACCOUNT,
38
43
  new ServiceAccountCredentialExchanger()
39
44
  );
45
+ for (const authType of Object.values(AuthCredentialTypes)) {
46
+ const customExchanger = customExchangers == null ? void 0 : customExchangers[authType];
47
+ if (customExchanger) {
48
+ this.exchangers.set(authType, customExchanger);
49
+ }
50
+ }
40
51
  }
41
52
  async exchange(params) {
42
53
  const { authCredential, authScheme } = params;
54
+ if (!authCredential) {
55
+ return null;
56
+ }
43
57
  const exchanger = this.exchangers.get(authCredential.authType);
44
58
  if (!exchanger) {
45
59
  return {
@@ -0,0 +1,43 @@
1
+ import {createRequire as topLevelCreateRequire} from 'module';
2
+ const require = topLevelCreateRequire(import.meta.url);
3
+ var __defProp = Object.defineProperty;
4
+ var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
5
+ var __name = (target, value) => __defProp(target, "name", { value, configurable: true });
6
+ var __decorateClass = (decorators, target, key, kind) => {
7
+ var result = kind > 1 ? void 0 : kind ? __getOwnPropDesc(target, key) : target;
8
+ for (var i = decorators.length - 1, decorator; i >= 0; i--)
9
+ if (decorator = decorators[i])
10
+ result = (kind ? decorator(target, key, result) : decorator(result)) || result;
11
+ if (kind && result) __defProp(target, key, result);
12
+ return result;
13
+ };
14
+ /**
15
+ * @license
16
+ * Copyright 2026 Google LLC
17
+ * SPDX-License-Identifier: Apache-2.0
18
+ */
19
+ import { experimental } from "../../../../utils/experimental.js";
20
+ const _AuthCredentialMissingError = class _AuthCredentialMissingError extends Error {
21
+ constructor(message) {
22
+ super(message);
23
+ this.name = "AuthCredentialMissingError";
24
+ }
25
+ };
26
+ __name(_AuthCredentialMissingError, "AuthCredentialMissingError");
27
+ let AuthCredentialMissingError = _AuthCredentialMissingError;
28
+ let BaseAuthCredentialExchanger = class {
29
+ exchangeCredential(_authScheme, _authCredential) {
30
+ throw new Error("Subclasses must implement exchangeCredential.");
31
+ }
32
+ };
33
+ __name(BaseAuthCredentialExchanger, "BaseAuthCredentialExchanger");
34
+ __decorateClass([
35
+ experimental
36
+ ], BaseAuthCredentialExchanger.prototype, "exchangeCredential", 1);
37
+ BaseAuthCredentialExchanger = __decorateClass([
38
+ experimental
39
+ ], BaseAuthCredentialExchanger);
40
+ export {
41
+ AuthCredentialMissingError,
42
+ BaseAuthCredentialExchanger
43
+ };
@@ -0,0 +1,93 @@
1
+ import {createRequire as topLevelCreateRequire} from 'module';
2
+ const require = topLevelCreateRequire(import.meta.url);
3
+ var __defProp = Object.defineProperty;
4
+ var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
5
+ var __name = (target, value) => __defProp(target, "name", { value, configurable: true });
6
+ var __decorateClass = (decorators, target, key, kind) => {
7
+ var result = kind > 1 ? void 0 : kind ? __getOwnPropDesc(target, key) : target;
8
+ for (var i = decorators.length - 1, decorator; i >= 0; i--)
9
+ if (decorator = decorators[i])
10
+ result = (kind ? decorator(target, key, result) : decorator(result)) || result;
11
+ if (kind && result) __defProp(target, key, result);
12
+ return result;
13
+ };
14
+ /**
15
+ * @license
16
+ * Copyright 2026 Google LLC
17
+ * SPDX-License-Identifier: Apache-2.0
18
+ */
19
+ import {
20
+ AuthCredentialTypes
21
+ } from "../../../../auth/auth_credential.js";
22
+ import { experimental } from "../../../../utils/experimental.js";
23
+ function checkSchemeCredentialType(authScheme, authCredential) {
24
+ if (!authCredential) {
25
+ throw new Error(
26
+ "auth_credential is empty. Please create AuthCredential using OAuth2Auth."
27
+ );
28
+ }
29
+ if (authScheme.type !== "openIdConnect" && authScheme.type !== "oauth2") {
30
+ throw new Error(
31
+ `Invalid security scheme, expect AuthSchemeType.openIdConnect or AuthSchemeType.oauth2 auth scheme, but got ${authScheme.type}`
32
+ );
33
+ }
34
+ if (!authCredential.oauth2 && !authCredential.http) {
35
+ throw new Error(
36
+ "auth_credential is not configured with oauth2. Please create AuthCredential and set OAuth2Auth."
37
+ );
38
+ }
39
+ }
40
+ __name(checkSchemeCredentialType, "checkSchemeCredentialType");
41
+ function generateAuthToken(authCredential) {
42
+ var _a;
43
+ const accessToken = (_a = authCredential.oauth2) == null ? void 0 : _a.accessToken;
44
+ if (!accessToken) {
45
+ return authCredential;
46
+ }
47
+ return {
48
+ authType: AuthCredentialTypes.HTTP,
49
+ http: {
50
+ scheme: "bearer",
51
+ credentials: { token: accessToken }
52
+ }
53
+ };
54
+ }
55
+ __name(generateAuthToken, "generateAuthToken");
56
+ function exchangeCredential(authScheme, authCredential) {
57
+ var _a, _b;
58
+ checkSchemeCredentialType(authScheme, authCredential);
59
+ if (authCredential.http) {
60
+ return authCredential;
61
+ }
62
+ if (((_a = authCredential.oauth2) == null ? void 0 : _a.accessToken) || ((_b = authCredential.oauth2) == null ? void 0 : _b.refreshToken)) {
63
+ return generateAuthToken(authCredential);
64
+ }
65
+ return null;
66
+ }
67
+ __name(exchangeCredential, "exchangeCredential");
68
+ let OAuth2BearerExchanger = class {
69
+ async exchange(params) {
70
+ const { authScheme, authCredential } = params;
71
+ if (!authScheme) {
72
+ throw new Error("authScheme is required for OAuth2 credential exchange");
73
+ }
74
+ const credential = exchangeCredential(authScheme, authCredential);
75
+ return {
76
+ credential: credential != null ? credential : authCredential,
77
+ wasExchanged: credential !== null && credential !== authCredential
78
+ };
79
+ }
80
+ };
81
+ __name(OAuth2BearerExchanger, "OAuth2BearerExchanger");
82
+ __decorateClass([
83
+ experimental
84
+ ], OAuth2BearerExchanger.prototype, "exchange", 1);
85
+ OAuth2BearerExchanger = __decorateClass([
86
+ experimental
87
+ ], OAuth2BearerExchanger);
88
+ export {
89
+ OAuth2BearerExchanger,
90
+ checkSchemeCredentialType,
91
+ exchangeCredential,
92
+ generateAuthToken
93
+ };
@@ -20,18 +20,15 @@ import { GoogleAuth, JWT } from "google-auth-library";
20
20
  import {
21
21
  AuthCredentialTypes
22
22
  } from "../../../../auth/auth_credential.js";
23
- import {
24
- CredentialExchangeError
25
- } from "../../../../auth/exchanger/base_credential_exchanger.js";
26
23
  import { experimental } from "../../../../utils/experimental.js";
24
+ import { AuthCredentialMissingError } from "./base_auth_credential_exchanger.js";
27
25
  const DEFAULT_SCOPES = ["https://www.googleapis.com/auth/cloud-platform"];
26
+ const MISSING_SERVICE_ACCOUNT_CREDENTIALS = "Service account credentials are missing. Please provide them, or set `useDefaultCredential: true` to use application default credentials in a hosted service like Cloud Run.";
28
27
  let ServiceAccountCredentialExchanger = class {
29
28
  async exchange(params) {
30
29
  const { authCredential } = params;
31
- if (authCredential.authType !== AuthCredentialTypes.SERVICE_ACCOUNT || !authCredential.serviceAccount) {
32
- throw new CredentialExchangeError(
33
- "Invalid credential type for ServiceAccountCredentialExchanger"
34
- );
30
+ if (!authCredential.serviceAccount) {
31
+ throw new AuthCredentialMissingError(MISSING_SERVICE_ACCOUNT_CREDENTIALS);
35
32
  }
36
33
  const saConfig = authCredential.serviceAccount;
37
34
  if (saConfig.useDefaultCredential) {
@@ -61,7 +58,7 @@ let ServiceAccountCredentialExchanger = class {
61
58
  wasExchanged: true
62
59
  };
63
60
  } catch (error) {
64
- throw new CredentialExchangeError(
61
+ throw new AuthCredentialMissingError(
65
62
  `Failed to exchange default service account token: ${error.message}`
66
63
  );
67
64
  }
@@ -69,14 +66,15 @@ let ServiceAccountCredentialExchanger = class {
69
66
  async exchangeForExplicitCredential(saConfig) {
70
67
  const creds = saConfig.serviceAccountCredential;
71
68
  if (!creds) {
72
- throw new CredentialExchangeError(
73
- "Service account credentials are missing."
74
- );
69
+ throw new AuthCredentialMissingError(MISSING_SERVICE_ACCOUNT_CREDENTIALS);
75
70
  }
76
71
  try {
77
72
  const client = new JWT({
78
73
  email: creds.clientEmail,
79
74
  key: creds.privateKey,
75
+ keyId: creds.privateKeyId,
76
+ projectId: creds.projectId,
77
+ universeDomain: creds.universeDomain,
80
78
  scopes: saConfig.scopes
81
79
  });
82
80
  const tokens = await client.authorize();
@@ -95,7 +93,7 @@ let ServiceAccountCredentialExchanger = class {
95
93
  wasExchanged: true
96
94
  };
97
95
  } catch (error) {
98
- throw new CredentialExchangeError(
96
+ throw new AuthCredentialMissingError(
99
97
  `Failed to exchange explicit service account token: ${error.message}`
100
98
  );
101
99
  }
@@ -0,0 +1,112 @@
1
+ import {createRequire as topLevelCreateRequire} from 'module';
2
+ const require = topLevelCreateRequire(import.meta.url);
3
+ var __defProp = Object.defineProperty;
4
+ var __name = (target, value) => __defProp(target, "name", { value, configurable: true });
5
+ /**
6
+ * @license
7
+ * Copyright 2026 Google LLC
8
+ * SPDX-License-Identifier: Apache-2.0
9
+ */
10
+ import {
11
+ renameReservedKeywords,
12
+ toSnakeCaseName
13
+ } from "../../../utils/case_utils.js";
14
+ const ANY_TYPE_HINT = "Any";
15
+ const PARAM_PROPERTY_INDENT = " ";
16
+ const RETURN_PROPERTY_INDENT = " ";
17
+ const TYPE_HINTS = {
18
+ integer: "int",
19
+ number: "float",
20
+ boolean: "bool",
21
+ string: "str",
22
+ object: "Dict[str, Any]"
23
+ };
24
+ function getTypeHint(schema) {
25
+ var _a;
26
+ if (!(schema == null ? void 0 : schema.type)) {
27
+ return ANY_TYPE_HINT;
28
+ }
29
+ if (schema.type === "array") {
30
+ return `List[${getArrayItemTypeHint(schema.items)}]`;
31
+ }
32
+ return (_a = TYPE_HINTS[schema.type]) != null ? _a : ANY_TYPE_HINT;
33
+ }
34
+ __name(getTypeHint, "getTypeHint");
35
+ function getArrayItemTypeHint(items) {
36
+ var _a, _b;
37
+ const itemType = (_a = resolveSchema(items)) == null ? void 0 : _a.type;
38
+ if (!itemType || itemType === "array") {
39
+ return ANY_TYPE_HINT;
40
+ }
41
+ return (_b = TYPE_HINTS[itemType]) != null ? _b : ANY_TYPE_HINT;
42
+ }
43
+ __name(getArrayItemTypeHint, "getArrayItemTypeHint");
44
+ function generateParamDoc(param) {
45
+ var _a, _b;
46
+ const description = (_b = (_a = param.description) == null ? void 0 : _a.trim()) != null ? _b : "";
47
+ const typeHint = getTypeHint(param.paramSchema);
48
+ return `${param.name} (${typeHint}): ${description}` + describeProperties(param.paramSchema, PARAM_PROPERTY_INDENT);
49
+ }
50
+ __name(generateParamDoc, "generateParamDoc");
51
+ function generateReturnDoc(responses) {
52
+ var _a;
53
+ const response = Object.entries(responses).filter(([code]) => /^2(\d\d|XX)$/i.test(code)).sort(([a], [b]) => {
54
+ const numeric = /* @__PURE__ */ __name((c) => /^\d+$/.test(c) ? Number(c) : Infinity, "numeric");
55
+ return numeric(a) - numeric(b);
56
+ }).map(([, value]) => value).find(hasContent);
57
+ if (!response) {
58
+ return "";
59
+ }
60
+ const description = (response.description || "").trim();
61
+ const firstMimeType = Object.keys(response.content)[0];
62
+ const schema = resolveSchema((_a = response.content[firstMimeType]) == null ? void 0 : _a.schema);
63
+ return `Returns (${getTypeHint(schema)}): ${description}` + describeProperties(schema, RETURN_PROPERTY_INDENT);
64
+ }
65
+ __name(generateReturnDoc, "generateReturnDoc");
66
+ function hasContent(response) {
67
+ return !("$ref" in response) && response.content !== void 0 && Object.keys(response.content).length > 0;
68
+ }
69
+ __name(hasContent, "hasContent");
70
+ function resolveSchema(schema) {
71
+ return schema && !("$ref" in schema) ? schema : void 0;
72
+ }
73
+ __name(resolveSchema, "resolveSchema");
74
+ function describeProperties(schema, indent) {
75
+ var _a;
76
+ if ((schema == null ? void 0 : schema.type) !== "object") {
77
+ return "";
78
+ }
79
+ const properties = Object.entries((_a = schema.properties) != null ? _a : {});
80
+ if (properties.length === 0) {
81
+ return "";
82
+ }
83
+ return properties.reduce((doc, [propName, propDetails]) => {
84
+ var _a2;
85
+ const propSchema = resolveSchema(propDetails);
86
+ if (!propSchema) {
87
+ return doc;
88
+ }
89
+ const propDesc = (_a2 = propSchema.description) != null ? _a2 : "";
90
+ return `${doc}${indent}${propName} (${getTypeHint(propSchema)}): ${propDesc}
91
+ `;
92
+ }, " Object properties:\n");
93
+ }
94
+ __name(describeProperties, "describeProperties");
95
+ function createApiParameter(init) {
96
+ var _a;
97
+ return {
98
+ originalName: init.originalName,
99
+ paramLocation: init.paramLocation,
100
+ paramSchema: init.paramSchema,
101
+ description: init.description || init.paramSchema.description || "",
102
+ name: init.name || renameReservedKeywords(toSnakeCaseName(init.originalName)),
103
+ required: (_a = init.required) != null ? _a : false
104
+ };
105
+ }
106
+ __name(createApiParameter, "createApiParameter");
107
+ export {
108
+ createApiParameter,
109
+ generateParamDoc,
110
+ generateReturnDoc,
111
+ getTypeHint
112
+ };