@google/adk 2.1.0 → 2.2.0

package/dist/types/models/chrome_prompt_utils.d.ts

@@ -16,6 +16,20 @@ export declare function collectFunctionDeclarations(llmRequest: LlmRequest): Fun
  *
  * A single-value `enum` is used rather than `const`, because it is semantically
  * identical and more widely supported across constraint engines.
+ *
+ * Every branch sets `additionalProperties: false`, and that is load-bearing
+ * rather than tidy. Omitted, JSON Schema permits extra keys, so a decoder may
+ * emit `,"` after the last required key instead of `}`. The object then never
+ * has to close: the model keeps writing until the output runs out, and the
+ * reply arrives as truncated JSON. Whether it closes in time is left to
+ * sampling, which is why one session can answer a question cleanly and mangle
+ * the next. Closing the branch makes `}` the only legal token once `text` is
+ * written.
+ *
+ * It is set on the envelope only, never pushed into a tool's own argument
+ * schema. Those belong to the caller; some describe objects that legitimately
+ * accept keys they do not list, and forbidding those here would make a valid
+ * call impossible to express.
  */
 export declare function buildToolChoiceSchema(declarations: FunctionDeclaration[]): Record<string, unknown>;
 /** Renders tool declarations into instructions the model can act on. */
@@ -66,3 +80,18 @@ export declare function stripAdkIdentityPreamble(systemPrompt: string): string;
 export declare function isAbortError(error: unknown): boolean;
 export declare function finalText(text: string): LlmResponse;
 export declare function errorResponse(error: unknown): LlmResponse;
+/** Shown when a reply is JSON, is broken, and holds no readable answer. */
+export declare const TRUNCATED_REPLY = "The model started an answer and did not finish it. Ask again.";
+/** True when a reply is the JSON envelope rather than plain prose. */
+export declare function looksLikeEnvelope(raw: string): boolean;
+/**
+ * Reads the answer out of a truncated `{"kind":"final","text":"…` envelope.
+ *
+ * A constrained reply that stops early is usually still readable: the answer
+ * sits in `text` and only the closing quote and brace are missing. Scanning it
+ * out by hand beats `JSON.parse`, which needs the whole document, and beats
+ * showing the envelope to the caller.
+ *
+ * Returns undefined when there is no `text` key to read.
+ */
+export declare function salvageFinalText(raw: string): string | undefined;

package/dist/types/planners/base_planner.d.ts

@@ -0,0 +1,50 @@
+/**
+ * @license
+ * Copyright 2026 Google LLC
+ * SPDX-License-Identifier: Apache-2.0
+ */
+import { Part } from '@google/genai';
+import { Context } from '../agents/context.js';
+import { ReadonlyContext } from '../agents/readonly_context.js';
+import { LlmRequest } from '../models/llm_request.js';
+/**
+ * A unique symbol to identify ADK planner classes.
+ * Defined once and shared by all BasePlanner instances.
+ */
+declare const BASE_PLANNER_SIGNATURE_SYMBOL: unique symbol;
+/**
+ * Type guard to check if an object is an instance of BasePlanner.
+ * @param obj The object to check.
+ * @returns True if the object is an instance of BasePlanner, false otherwise.
+ */
+export declare function isBasePlanner(obj: unknown): obj is BasePlanner;
+/**
+ * Abstract base class for all planners.
+ *
+ * The planner allows the agent to generate plans for the queries to guide its
+ * action.
+ */
+export declare abstract class BasePlanner {
+    /** A unique symbol to identify ADK base planner class. */
+    readonly [BASE_PLANNER_SIGNATURE_SYMBOL] = true;
+    /**
+     * Builds the system instruction to be appended to the LLM request for
+     * planning.
+     *
+     * @param readonlyContext The readonly context of the invocation.
+     * @param llmRequest The LLM request. Readonly.
+     * @returns The planning system instruction, or undefined if no instruction is
+     *     needed.
+     */
+    abstract buildPlanningInstruction(readonlyContext: ReadonlyContext, llmRequest: LlmRequest): string | undefined;
+    /**
+     * Processes the LLM response for planning.
+     *
+     * @param callbackContext The callback context of the invocation.
+     * @param responseParts The LLM response parts. Readonly.
+     * @returns The processed response parts, or undefined if no processing is
+     *     needed.
+     */
+    abstract processPlanningResponse(callbackContext: Context, responseParts: Part[]): Part[] | undefined;
+}
+export {};

package/dist/types/planners/built_in_planner.d.ts

@@ -0,0 +1,53 @@
+/**
+ * @license
+ * Copyright 2026 Google LLC
+ * SPDX-License-Identifier: Apache-2.0
+ */
+import { Part, ThinkingConfig } from '@google/genai';
+import { Context } from '../agents/context.js';
+import { ReadonlyContext } from '../agents/readonly_context.js';
+import { LlmRequest } from '../models/llm_request.js';
+import { BasePlanner } from './base_planner.js';
+/**
+ * A unique symbol to identify ADK built-in planner classes.
+ * Defined once and shared by all BuiltInPlanner instances.
+ */
+declare const BUILT_IN_PLANNER_SIGNATURE_SYMBOL: unique symbol;
+/**
+ * Type guard to check if an object is an instance of BuiltInPlanner.
+ * @param obj The object to check.
+ * @returns True if the object is an instance of BuiltInPlanner, false
+ *     otherwise.
+ */
+export declare function isBuiltInPlanner(obj: unknown): obj is BuiltInPlanner;
+/**
+ * The built-in planner that uses model's built-in thinking features.
+ */
+export declare class BuiltInPlanner extends BasePlanner {
+    /** A unique symbol to identify ADK built-in planner class. */
+    readonly [BUILT_IN_PLANNER_SIGNATURE_SYMBOL] = true;
+    /**
+     * Config for model built-in thinking features. An error will be returned if
+     * this field is set for models that don't support thinking.
+     */
+    thinkingConfig: ThinkingConfig;
+    /**
+     * Initializes the built-in planner.
+     *
+     * @param options.thinkingConfig Config for model built-in thinking features.
+     *     An error will be returned if this field is set for models that don't
+     *     support thinking.
+     */
+    constructor(options: {
+        thinkingConfig: ThinkingConfig;
+    });
+    /**
+     * Applies the thinking config to the LLM request.
+     *
+     * @param llmRequest The LLM request to apply the thinking config to.
+     */
+    applyThinkingConfig(llmRequest: LlmRequest): void;
+    buildPlanningInstruction(_readonlyContext: ReadonlyContext, _llmRequest: LlmRequest): string | undefined;
+    processPlanningResponse(_callbackContext: Context, _responseParts: Part[]): Part[] | undefined;
+}
+export {};

package/dist/types/planners/plan_re_act_planner.d.ts

@@ -0,0 +1,21 @@
+/**
+ * @license
+ * Copyright 2026 Google LLC
+ * SPDX-License-Identifier: Apache-2.0
+ */
+import { Part } from '@google/genai';
+import { Context } from '../agents/context.js';
+import { ReadonlyContext } from '../agents/readonly_context.js';
+import { LlmRequest } from '../models/llm_request.js';
+import { BasePlanner } from './base_planner.js';
+/**
+ * Plan-Re-Act planner that constrains the LLM response to generate a plan
+ * before any action/observation.
+ *
+ * Note: this planner does not require the model to support built-in thinking
+ * features or setting the thinking config.
+ */
+export declare class PlanReActPlanner extends BasePlanner {
+    buildPlanningInstruction(_readonlyContext: ReadonlyContext, _llmRequest: LlmRequest): string;
+    processPlanningResponse(_callbackContext: Context, responseParts: Part[]): Part[] | undefined;
+}

package/dist/types/plugins/base_plugin.d.ts

@@ -121,13 +121,13 @@ export declare abstract class BasePlugin {
      * This callback helps logging and modifying the user message before the
      * runner starts the invocation.
      *
-     * @param params.invocationContext The context for the entire invocation.
-     * @param params.userMessage The message content input by user.
+     * @param _params.invocationContext The context for the entire invocation.
+     * @param _params.userMessage The message content input by user.
      * @returns An optional `Content` to be returned to the ADK. Returning a
      *     value to replace the user message. Returning `undefined` to proceed
      *     normally.
      */
-    onUserMessageCallback(params: {
+    onUserMessageCallback(_params: {
         invocationContext: InvocationContext;
         userMessage: Content;
     }): Promise<Content | undefined>;
@@ -137,13 +137,13 @@ export declare abstract class BasePlugin {
      * This is the first callback to be called in the lifecycle, ideal for global
      * setup or initialization tasks.
      *
-     * @param params.invocationContext The context for the entire invocation, containing
+     * @param _params.invocationContext The context for the entire invocation, containing
      *     session information, the root agent, etc.
      * @returns An optional `Event` to be returned to the ADK. Returning a value
      *     to halt execution of the runner and ends the runner with that event.
      *     Return `undefined` to proceed normally.
      */
-    beforeRunCallback(params: {
+    beforeRunCallback(_params: {
         invocationContext: InvocationContext;
     }): Promise<Content | undefined>;
     /**
@@ -152,15 +152,15 @@ export declare abstract class BasePlugin {
      * This is the ideal place to make modification to the event before the event
      * is handled by the underlying agent app.
      *
-     * @param params.invocationContext The context for the entire invocation.
-     * @param params.event The event raised by the runner.
+     * @param _params.invocationContext The context for the entire invocation.
+     * @param _params.event The event raised by the runner.
      * @returns An optional value. A non-`undefined` return may be used by the
-     *     framework to modify or replace the response. Copy `params.event` when
-     *     constructing a replacement to preserve fields that are not being
-     *     modified, such as event actions. Returning `undefined` allows the
+     *     framework to modify or replace the response. Copy the incoming
+     *     `event` when constructing a replacement to preserve fields that are not
+     *     being modified, such as event actions. Returning `undefined` allows the
      *     original response to be used.
      */
-    onEventCallback(params: {
+    onEventCallback(_params: {
         invocationContext: InvocationContext;
         event: Event;
     }): Promise<Event | undefined>;
@@ -170,10 +170,10 @@ export declare abstract class BasePlugin {
      * This is the final callback in the ADK lifecycle, suitable for cleanup,
      * final logging, or reporting tasks.
      *
-     * @param params.invocationContext The context for the entire invocation.
+     * @param _params.invocationContext The context for the entire invocation.
      * @returns undefined
      */
-    afterRunCallback(params: {
+    afterRunCallback(_params: {
         invocationContext: InvocationContext;
     }): Promise<void>;
     /**
@@ -182,13 +182,13 @@ export declare abstract class BasePlugin {
      * This callback can be used for logging, setup, or to short-circuit the
      * agent's execution by returning a value.
      *
-     * @param params.agent The agent that is about to run.
-     * @param params.callbackContext The context for the agent invocation.
+     * @param _params.agent The agent that is about to run.
+     * @param _params.callbackContext The context for the agent invocation.
      * @returns An optional `Content` object. If a value is returned, it will
      *     bypass the agent's callbacks and its execution, and return this value
      *     directly. Returning `undefined` allows the agent to proceed normally.
      */
-    beforeAgentCallback(params: {
+    beforeAgentCallback(_params: {
         agent: BaseAgent;
         callbackContext: Context;
     }): Promise<Content | undefined>;
@@ -198,13 +198,13 @@ export declare abstract class BasePlugin {
      * This callback can be used to inspect, log, or modify the agent's final
      * result before it is returned.
      *
-     * @param params.agent The agent that has just run.
-     * @param params.callbackContext The context for the agent invocation.
+     * @param _params.agent The agent that has just run.
+     * @param _params.callbackContext The context for the agent invocation.
      * @returns An optional `Content` object. If a value is returned, it will
      *     replace the agent's original result. Returning `undefined` uses the
      *     original, unmodified result.
      */
-    afterAgentCallback(params: {
+    afterAgentCallback(_params: {
         agent: BaseAgent;
         callbackContext: Context;
     }): Promise<Content | undefined>;
@@ -248,13 +248,13 @@ export declare abstract class BasePlugin {
      * object. It can also be used to implement caching by returning a cached
      * `LlmResponse`, which would skip the actual model call.
      *
-     * @param params.callbackContext The context for the current agent call.
-     * @param params.llmRequest The prepared request object to be sent to the model.
+     * @param _params.callbackContext The context for the current agent call.
+     * @param _params.llmRequest The prepared request object to be sent to the model.
      * @returns An optional value. The interpretation of a non-`undefined`
      *     trigger an early exit and returns the response immediately. Returning
      *     `undefined` allows the LLM request to proceed normally.
      */
-    beforeModelCallback(params: {
+    beforeModelCallback(_params: {
         callbackContext: Context;
         llmRequest: LlmRequest;
     }): Promise<LlmResponse | undefined>;
@@ -264,13 +264,13 @@ export declare abstract class BasePlugin {
      * This is the ideal place to log model responses, collect metrics on token
      * usage, or perform post-processing on the raw `LlmResponse`.
      *
-     * @param params.callbackContext The context for the current agent call.
-     * @param params.llmResponse The response object received from the model.
+     * @param _params.callbackContext The context for the current agent call.
+     * @param _params.llmResponse The response object received from the model.
      * @returns An optional value. A non-`undefined` return may be used by the
      *     framework to modify or replace the response. Returning `undefined`
      *     allows the original response to be used.
      */
-    afterModelCallback(params: {
+    afterModelCallback(_params: {
         callbackContext: Context;
         llmResponse: LlmResponse;
     }): Promise<LlmResponse | undefined>;
@@ -280,15 +280,15 @@ export declare abstract class BasePlugin {
      * This callback provides an opportunity to handle model errors gracefully,
      * potentially providing alternative responses or recovery mechanisms.
      *
-     * @param params.callbackContext The context for the current agent call.
-     * @param params.llmRequest The request that was sent to the model when the error
+     * @param _params.callbackContext The context for the current agent call.
+     * @param _params.llmRequest The request that was sent to the model when the error
      *     occurred.
-     * @param params.error The exception that was raised during model execution.
+     * @param _params.error The exception that was raised during model execution.
      * @returns An optional LlmResponse. If an LlmResponse is returned, it will be
      *     used instead of propagating the error. Returning `undefined` allows
      *     the original error to be raised.
      */
-    onModelErrorCallback(params: {
+    onModelErrorCallback(_params: {
         callbackContext: Context;
         llmRequest: LlmRequest;
         error: Error;
@@ -299,13 +299,13 @@ export declare abstract class BasePlugin {
      * This callback provides an opportunity to inspect, log, or modify the
      * available tools before they are selected.
      *
-     * @param params.callbackContext The context for the current agent call.
-     * @param params.tools The available tools.
+     * @param _params.callbackContext The context for the current agent call.
+     * @param _params.tools The available tools.
      * @returns An optional value. A non-`undefined` return may be used by the
      *     framework to modify or replace the available tools. Returning
      *     `undefined` allows the original tools to be used.
      */
-    beforeToolSelection(params: {
+    beforeToolSelection(_params: {
         callbackContext: Context;
         tools: Readonly<Record<string, BaseTool>>;
     }): Promise<Readonly<Record<string, BaseTool>> | undefined>;
@@ -315,10 +315,10 @@ export declare abstract class BasePlugin {
      * This callback provides an opportunity to inspect or modify the context
      * before it is compacted.
      *
-     * @param params.invocationContext The context for the entire invocation.
-     * @param params.trigger The trigger for the context compaction.
+     * @param _params.invocationContext The context for the entire invocation.
+     * @param _params.trigger The trigger for the context compaction.
      */
-    beforeContextCompaction(params: {
+    beforeContextCompaction(_params: {
         invocationContext: InvocationContext;
         trigger: ContextCompactionTrigger;
     }): Promise<void>;
@@ -328,10 +328,10 @@ export declare abstract class BasePlugin {
      * This callback provides an opportunity to inspect the context
      * after it has been compacted.
      *
-     * @param params.invocationContext The context for the entire invocation.
-     * @param params.trigger The trigger for the context compaction.
+     * @param _params.invocationContext The context for the entire invocation.
+     * @param _params.trigger The trigger for the context compaction.
      */
-    afterContextCompaction(params: {
+    afterContextCompaction(_params: {
         invocationContext: InvocationContext;
         trigger: ContextCompactionTrigger;
     }): Promise<void>;
@@ -341,15 +341,15 @@ export declare abstract class BasePlugin {
      * This callback is useful for logging tool usage, input validation, or
      * modifying the arguments before they are passed to the tool.
      *
-     * @param params.tool The tool instance that is about to be executed.
-     * @param params.toolArgs The dictionary of arguments to be used for invoking the
+     * @param _params.tool The tool instance that is about to be executed.
+     * @param _params.toolArgs The dictionary of arguments to be used for invoking the
      *     tool.
-     * @param params.toolContext The context specific to the tool execution.
+     * @param _params.toolContext The context specific to the tool execution.
      * @returns An optional dictionary. If a dictionary is returned, it will stop
      *     the tool execution and return this response immediately. Returning
      *     `undefined` uses the original, unmodified arguments.
      */
-    beforeToolCallback(params: {
+    beforeToolCallback(_params: {
         tool: BaseTool;
         toolArgs: Record<string, unknown>;
         toolContext: Context;
@@ -360,16 +360,16 @@ export declare abstract class BasePlugin {
      * This callback allows for inspecting, logging, or modifying the result
      * returned by a tool.
      *
-     * @param params.tool The tool instance that has just been executed.
-     * @param params.toolArgs The original arguments that were passed to the tool.
-     * @param params.toolContext The context specific to the tool execution.
-     * @param params.result The dictionary returned by the tool invocation.
+     * @param _params.tool The tool instance that has just been executed.
+     * @param _params.toolArgs The original arguments that were passed to the tool.
+     * @param _params.toolContext The context specific to the tool execution.
+     * @param _params.result The dictionary returned by the tool invocation.
      * @returns An optional dictionary. If a dictionary is returned, it will
      *     **replace** the original result from the tool. This allows for
      *     post-processing or altering tool outputs. Returning `undefined` uses
      *     the original, unmodified result.
      */
-    afterToolCallback(params: {
+    afterToolCallback(_params: {
         tool: BaseTool;
         toolArgs: Record<string, unknown>;
         toolContext: Context;
@@ -391,15 +391,15 @@ export declare abstract class BasePlugin {
      * This callback provides an opportunity to handle tool errors gracefully,
      * potentially providing alternative responses or recovery mechanisms.
      *
-     * @param params.tool The tool instance that encountered an error.
-     * @param params.toolArgs The arguments that were passed to the tool.
-     * @param params.toolContext The context specific to the tool execution.
-     * @param params.error The exception that was raised during tool execution.
+     * @param _params.tool The tool instance that encountered an error.
+     * @param _params.toolArgs The arguments that were passed to the tool.
+     * @param _params.toolContext The context specific to the tool execution.
+     * @param _params.error The exception that was raised during tool execution.
      * @returns An optional dictionary. If a dictionary is returned, it will be
      *     used as the tool response instead of propagating the error. Returning
      *     `undefined` allows the original error to be raised.
      */
-    onToolErrorCallback(params: {
+    onToolErrorCallback(_params: {
         tool: BaseTool;
         toolArgs: Record<string, unknown>;
         toolContext: Context;

package/dist/types/skills/skill_registry.d.ts

@@ -26,4 +26,12 @@ export interface SkillRegistry {
      * Returns the description for the search_skills tool.
      */
     searchToolDescription?(): string | undefined;
+    /**
+     * Releases resources held by the registry, such as network clients or
+     * temporary credentials.
+     *
+     * Optional: registries that hold no resources may omit it. `SkillToolset`
+     * invokes it, when present, from its own `close()`.
+     */
+    close?(): Promise<void>;
 }

package/dist/types/tools/openapi_tool/auth/auth_helpers.d.ts

@@ -4,7 +4,14 @@
  * SPDX-License-Identifier: Apache-2.0
  */
 import { OpenAPIV3 } from 'openapi-types';
-import { AuthCredential } from '../../../auth/auth_credential.js';
+import { AuthCredential, ServiceAccount } from '../../../auth/auth_credential.js';
+import { AuthScheme, OpenIdConnectWithConfig } from '../../../auth/auth_schemes.js';
+import { ApiParameter } from '../openapi_spec_parser/operation_parser.js';
+/**
+ * Prefix that marks a tool parameter as auth-injected rather than
+ * model-supplied.
+ */
+export declare const INTERNAL_AUTH_PREFIX = "_auth_prefix_vaf_";
 /**
  * Applies the given credential to the request headers and URL.
  *
@@ -28,3 +35,105 @@ export declare function createApiKeyScheme(name: string, inLocation: 'header' |
  * Helper to create a simple Bearer Token auth scheme.
  */
 export declare function createBearerScheme(): OpenAPIV3.SecuritySchemeObject;
+/**
+ * Creates an AuthScheme and AuthCredential for an API key or a bearer token.
+ *
+ * @example
+ * // API key in a header.
+ * const [scheme, credential] = tokenToSchemeCredential(
+ *   'apikey', 'header', 'X-API-Key', 'your_api_key_value');
+ *
+ * @example
+ * // OAuth2 bearer token in the Authorization header.
+ * const [scheme, credential] = tokenToSchemeCredential(
+ *   'oauth2Token', 'header', 'Authorization', 'your_bearer_token_value');
+ *
+ * @param tokenType `'apikey'` or `'oauth2Token'`.
+ * @param location Where the API key travels. Ignored for `'oauth2Token'`,
+ *   because a bearer token always travels in the Authorization header.
+ * @param name The name of the header, query parameter, or cookie.
+ * @param credentialValue The API key or token value. Omit it to build the
+ *   scheme alone.
+ * @returns A `[scheme, credential]` pair. The credential is `undefined` when
+ *   `credentialValue` is omitted.
+ * @throws Error For an unsupported token type or API key location.
+ */
+export declare function tokenToSchemeCredential(tokenType: 'apikey' | 'oauth2Token', location?: 'header' | 'query' | 'cookie', name?: string, credentialValue?: string): [AuthScheme, AuthCredential | undefined];
+/**
+ * Creates a bearer scheme and a service-account credential from a raw Google
+ * service-account JSON object.
+ *
+ * @param config The parsed service-account key file.
+ * @param scopes The scopes to request.
+ * @returns A `[scheme, credential]` pair.
+ */
+export declare function serviceAccountDictToSchemeCredential(config: Record<string, unknown>, scopes: string[]): [AuthScheme, AuthCredential];
+/**
+ * Creates a bearer scheme and a service-account credential from an already
+ * built `ServiceAccount`.
+ *
+ * @param config The service-account configuration.
+ * @returns A `[scheme, credential]` pair.
+ */
+export declare function serviceAccountSchemeCredential(config: ServiceAccount): [AuthScheme, AuthCredential];
+/**
+ * Builds an OpenID Connect scheme and credential from a configuration object
+ * and a client-secret object.
+ *
+ * @param configDict An OpenID Connect configuration. Snake_case keys, as a
+ *   discovery document delivers them, are accepted and normalized.
+ * @param scopes The scopes to request.
+ * @param credentialDict The Google OAuth client secret. Its keys stay
+ *   snake_case, because it is an on-disk wire format. A `{web: {…}}` or
+ *   `{installed: {…}}` wrapper is unwrapped.
+ * @returns A `[scheme, credential]` pair.
+ * @throws Error When the configuration or the client secret is incomplete.
+ */
+export declare function openidDictToSchemeCredential(configDict: Record<string, unknown>, scopes: string[], credentialDict: Record<string, unknown>): [OpenIdConnectWithConfig, AuthCredential];
+/**
+ * Fetches an OpenID Connect discovery document and pairs it with a client
+ * secret.
+ *
+ * The URL is used as given. A caller that accepts it from an untrusted source
+ * has to validate it first, because this function performs the request.
+ *
+ * @param openidUrl The OpenID Connect discovery URL.
+ * @param scopes The scopes to request.
+ * @param credentialDict The Google OAuth client secret, keyed snake_case.
+ * @returns A `[scheme, credential]` pair.
+ * @throws Error When the request fails, the body is not a JSON object, or the
+ *   configuration is incomplete.
+ */
+export declare function openidUrlToSchemeCredential(openidUrl: string, scopes: string[], credentialDict: Record<string, unknown>): Promise<[OpenIdConnectWithConfig, AuthCredential]>;
+/**
+ * Converts a scheme and credential into the tool parameter that carries the
+ * credential, plus the value to send for it.
+ *
+ * Service-account, OAuth2, and OpenID Connect credentials reach this function
+ * already exchanged for a bearer token, so they take the HTTP branch.
+ *
+ * @param authScheme The auth scheme.
+ * @param authCredential The auth credential.
+ * @returns A `[parameter, values]` pair, both `undefined` when the credential
+ *   carries nothing to send.
+ * @throws Error For basic authentication, which is not supported, and for a
+ *   scheme and credential combination that cannot be expressed as a parameter.
+ */
+export declare function credentialToParam(authScheme: AuthScheme, authCredential?: AuthCredential): [ApiParameter | undefined, Record<string, string> | undefined];
+/**
+ * Converts a security scheme object out of an OpenAPI document into an
+ * `AuthScheme`.
+ *
+ * @example
+ * const scheme = dictToAuthScheme({
+ *   type: 'apiKey',
+ *   in: 'header',
+ *   name: 'X-API-Key',
+ * });
+ *
+ * @param data The security scheme object.
+ * @returns The validated auth scheme.
+ * @throws Error When `type` is missing or unrecognised, or the rest of the
+ *   object does not match the shape that type requires.
+ */
+export declare function dictToAuthScheme(data: Record<string, unknown>): AuthScheme;

package/dist/types/tools/openapi_tool/auth/credential_exchangers/auto_auth_credential_exchanger.d.ts

@@ -3,17 +3,47 @@
  * Copyright 2026 Google LLC
  * SPDX-License-Identifier: Apache-2.0
  */
-import { AuthCredential } from '../../../../auth/auth_credential.js';
+import { AuthCredential, AuthCredentialTypes } from '../../../../auth/auth_credential.js';
 import { AuthScheme } from '../../../../auth/auth_schemes.js';
 import { BaseCredentialExchanger, ExchangeResult } from '../../../../auth/exchanger/base_credential_exchanger.js';
+/**
+ * A map from auth credential type to the exchanger that handles it, merged
+ * over the built-in defaults.
+ */
+export type CustomCredentialExchangers = Partial<Record<AuthCredentialTypes, BaseCredentialExchanger>>;
 /**
  * Automatically selects the appropriate credential exchanger based on the auth scheme.
+ * Ported from Python implementation.
+ *
+ * @example
+ * // Common case: a built-in exchanger handles the credential.
+ * const exchanger = new AutoAuthCredentialExchanger();
+ * const result = await exchanger.exchange({
+ *   authScheme: serviceAccountScheme,
+ *   authCredential: serviceAccountCredential,
+ * });
+ * // result.credential carries an OAuth token as a bearer token.
+ *
+ * @example
+ * // Use CustomAuthExchanger for OAuth2 instead of the built-in exchanger.
+ * const exchanger = new AutoAuthCredentialExchanger({
+ *   [AuthCredentialTypes.OAUTH2]: new CustomAuthExchanger(),
+ * });
  */
 export declare class AutoAuthCredentialExchanger implements BaseCredentialExchanger {
     private exchangers;
-    constructor();
+    /**
+     * @param customExchangers - Optional exchangers that add to or override the
+     *   built-in ones. The key is the auth credential type; the value is the
+     *   exchanger instance to use for that type.
+     */
+    constructor(customExchangers?: CustomCredentialExchangers);
     exchange(params: {
         authScheme?: AuthScheme;
         authCredential: AuthCredential;
     }): Promise<ExchangeResult>;
+    exchange(params: {
+        authScheme?: AuthScheme;
+        authCredential?: AuthCredential;
+    }): Promise<ExchangeResult | null>;
 }

package/dist/types/tools/openapi_tool/auth/credential_exchangers/base_auth_credential_exchanger.d.ts

@@ -0,0 +1,35 @@
+/**
+ * @license
+ * Copyright 2026 Google LLC
+ * SPDX-License-Identifier: Apache-2.0
+ */
+import { AuthCredential } from '../../../../auth/auth_credential.js';
+import { AuthScheme } from '../../../../auth/auth_schemes.js';
+/**
+ * Error raised when a required authentication credential is missing.
+ */
+export declare class AuthCredentialMissingError extends Error {
+    constructor(message: string);
+}
+/**
+ * Base class for authentication credential exchangers.
+ *
+ * A subclass exchanges the credential an OpenAPI tool was configured with for
+ * one that can be sent to the API. The base implementation always throws, so a
+ * subclass that forgets to override the method fails on the first call rather
+ * than silently returning nothing.
+ */
+export declare class BaseAuthCredentialExchanger {
+    /**
+     * Exchanges the provided authentication credential for a usable
+     * token or credential.
+     *
+     * @param _authScheme The security scheme.
+     * @param _authCredential The authentication credential.
+     * @returns An updated AuthCredential object containing the fetched
+     *     credential. For simple schemes like API key, it may return the original
+     *     credential if no exchange is needed.
+     * @throws {Error} If the method is not implemented by a subclass.
+     */
+    exchangeCredential(_authScheme: AuthScheme, _authCredential?: AuthCredential): AuthCredential;
+}