@google/adk 2.1.0 → 2.2.1

package/dist/types/plugins/debug_logging_plugin.d.ts

@@ -0,0 +1,157 @@
+/**
+ * @license
+ * Copyright 2026 Google LLC
+ * SPDX-License-Identifier: Apache-2.0
+ */
+import { Content } from '@google/genai';
+import { BaseAgent } from '../agents/base_agent.js';
+import { Context } from '../agents/context.js';
+import { InvocationContext } from '../agents/invocation_context.js';
+import { Event } from '../events/event.js';
+import { LlmRequest } from '../models/llm_request.js';
+import { LlmResponse } from '../models/llm_response.js';
+import { BaseTool } from '../tools/base_tool.js';
+import { BasePlugin } from './base_plugin.js';
+declare const DEBUG_LOGGING_PLUGIN_SYMBOL: unique symbol;
+/**
+ * Options for configuring {@link DebugLoggingPlugin}.
+ */
+export interface DebugLoggingPluginOptions {
+    /**
+     * The name of the plugin instance.
+     * @defaultValue 'debug_logging_plugin'
+     */
+    name?: string;
+    /**
+     * Path to the output YAML debug file.
+     * @defaultValue 'adk_debug.yaml'
+     */
+    outputPath?: string;
+    /**
+     * Whether to include a session state snapshot at the end of each invocation.
+     * @defaultValue true
+     */
+    includeSessionState?: boolean;
+    /**
+     * Whether to include full system instructions in LLM request logs.
+     * @defaultValue true
+     */
+    includeSystemInstruction?: boolean;
+}
+/**
+ * A single debug log entry recorded during an invocation.
+ */
+export interface DebugEntry {
+    timestamp: string;
+    entry_type: string;
+    invocation_id?: string;
+    agent_name?: string;
+    data: Record<string, unknown>;
+}
+/**
+ * Per-invocation debug state written as a YAML document.
+ */
+export interface InvocationDebugState {
+    invocation_id: string;
+    session_id: string;
+    app_name: string;
+    user_id?: string;
+    start_time: string;
+    entries: DebugEntry[];
+}
+/**
+ * Type guard to check if an object is an instance of {@link DebugLoggingPlugin}.
+ */
+export declare function isDebugLoggingPlugin(obj: unknown): obj is DebugLoggingPlugin;
+/**
+ * A plugin that captures complete debug information to a YAML file.
+ *
+ * This plugin records detailed interaction data including:
+ * - LLM requests (model, system instruction, contents, tools)
+ * - LLM responses (content, usage metadata, errors)
+ * - Function calls with arguments
+ * - Function responses with results
+ * - Events yielded from the runner
+ * - Session state at the end of each invocation
+ *
+ * Each invocation is appended to the output file as a separate YAML document
+ * (separated by `---`). Credentials, sensitive keys, `temp:`-scoped state keys,
+ * and armored private key blocks are automatically redacted to `[REDACTED]`.
+ */
+export declare class DebugLoggingPlugin extends BasePlugin {
+    readonly [DEBUG_LOGGING_PLUGIN_SYMBOL] = true;
+    readonly outputPath: string;
+    readonly includeSessionState: boolean;
+    readonly includeSystemInstruction: boolean;
+    private readonly invocationStates;
+    private warnedAboutOutputMode;
+    constructor(options?: DebugLoggingPluginOptions);
+    /**
+     * Exposes active invocation states for testing and inspection.
+     */
+    getInvocationState(invocationId: string): InvocationDebugState | undefined;
+    private getTimestamp;
+    /**
+     * Serializes a Gemini `Content` object to a dictionary for YAML output.
+     */
+    serializeContent(content: Content | null | undefined): Record<string, unknown> | null;
+    /**
+     * Safely serializes an arbitrary value to a YAML/JSON-compatible format with
+     * credential, sensitive key, and private key redaction.
+     */
+    safeSerialize(obj: unknown, depth?: number): unknown;
+    private addEntry;
+    onUserMessageCallback({ invocationContext, userMessage, }: {
+        invocationContext: InvocationContext;
+        userMessage: Content;
+    }): Promise<Content | undefined>;
+    beforeRunCallback({ invocationContext, }: {
+        invocationContext: InvocationContext;
+    }): Promise<Content | undefined>;
+    onEventCallback({ invocationContext, event, }: {
+        invocationContext: InvocationContext;
+        event: Event;
+    }): Promise<Event | undefined>;
+    afterRunCallback({ invocationContext, }: {
+        invocationContext: InvocationContext;
+    }): Promise<void>;
+    beforeAgentCallback({ callbackContext, }: {
+        agent: BaseAgent;
+        callbackContext: Context;
+    }): Promise<Content | undefined>;
+    afterAgentCallback({ callbackContext, }: {
+        agent: BaseAgent;
+        callbackContext: Context;
+    }): Promise<Content | undefined>;
+    beforeModelCallback({ callbackContext, llmRequest, }: {
+        callbackContext: Context;
+        llmRequest: LlmRequest;
+    }): Promise<LlmResponse | undefined>;
+    afterModelCallback({ callbackContext, llmResponse, }: {
+        callbackContext: Context;
+        llmResponse: LlmResponse;
+    }): Promise<LlmResponse | undefined>;
+    onModelErrorCallback({ callbackContext, llmRequest, error, }: {
+        callbackContext: Context;
+        llmRequest: LlmRequest;
+        error: Error;
+    }): Promise<LlmResponse | undefined>;
+    beforeToolCallback({ tool, toolArgs, toolContext, }: {
+        tool: BaseTool;
+        toolArgs: Record<string, unknown>;
+        toolContext: Context;
+    }): Promise<Record<string, unknown> | undefined>;
+    afterToolCallback({ tool, toolContext, result, }: {
+        tool: BaseTool;
+        toolArgs: Record<string, unknown>;
+        toolContext: Context;
+        result: Record<string, unknown>;
+    }): Promise<Record<string, unknown> | undefined>;
+    onToolErrorCallback({ tool, toolArgs, toolContext, error, }: {
+        tool: BaseTool;
+        toolArgs: Record<string, unknown>;
+        toolContext: Context;
+        error: Error;
+    }): Promise<Record<string, unknown> | undefined>;
+}
+export {};

package/dist/types/plugins/tool_call_integrity_plugin.d.ts

@@ -0,0 +1,116 @@
+/**
+ * @license
+ * Copyright 2026 Google LLC
+ * SPDX-License-Identifier: Apache-2.0
+ */
+/**
+ * Optional HMAC integrity check for function calls stored in the session.
+ *
+ * Mirrors adk-python's `google.adk.plugins._tool_call_integrity_plugin`.
+ */
+import { Content } from '@google/genai';
+import { Context } from '../agents/context.js';
+import { InvocationContext } from '../agents/invocation_context.js';
+import { Event } from '../events/event.js';
+import { BaseTool } from '../tools/base_tool.js';
+import { BasePlugin } from './base_plugin.js';
+/** `customMetadata` key holding `{functionCallId: stamp}`. */
+export declare const TOOL_CALL_HMAC_METADATA_KEY = "__adk_internal_fc_hmac";
+/** A function call in the session failed its integrity check. */
+export declare class ToolCallIntegrityError extends Error {
+    constructor(message: string);
+}
+/** Options for {@link ToolCallIntegrityPlugin}. */
+export interface ToolCallIntegrityPluginOptions {
+    /**
+     * The HMAC key, or a list of keys during rotation. The first key stamps new
+     * calls; every key is accepted when verifying.
+     */
+    secretKey: Uint8Array | readonly Uint8Array[];
+    /**
+     * Log a warning instead of throwing for function calls that have no stamp,
+     * such as calls stored before the plugin was installed. Such calls also run,
+     * so this reports tampering that removes a stamp but does not prevent it. A
+     * stamp that is present but wrong is always rejected. Defaults to `false`.
+     */
+    allowUnstampedCalls?: boolean;
+    /** The plugin name. Defaults to `'tool_call_integrity'`. */
+    name?: string;
+}
+/**
+ * Stamps function calls and verifies them before runs and tool calls.
+ *
+ * `onEventCallback` adds `"v1:" + HMAC-SHA256(key, payload)` for each function
+ * call to `event.customMetadata["__adk_internal_fc_hmac"]`, and throws
+ * {@link ToolCallIntegrityError} for a response that repeats a call ID before
+ * it is stored. `beforeRunCallback` recomputes the HMAC for every function call
+ * with an ID in the session history, answered or not, and throws when a stamp
+ * is wrong, malformed, repeated or left over from a call that no longer
+ * matches. `beforeToolCallback` lets a tool run only when every stored copy of
+ * its call verifies and the tool's name and arguments match one of them; it
+ * always refuses a call with no ID. Unstamped calls are rejected unless
+ * `allowUnstampedCalls` is set, in which case they are logged.
+ *
+ * Events without function calls are ignored. Events marked as restored are not
+ * verified, and their function calls are never executed. ADK marks events
+ * restored by `adk run --replay`, and {@link prepareRestoredEvent} marks events
+ * that your code copies. Anyone who can write to the session store can also
+ * set the marker, but `beforeToolCallback` still refuses those events' calls.
+ *
+ * `PluginManager` re-throws plugin errors as a generic `Error`; the
+ * {@link ToolCallIntegrityError} is its `cause`.
+ *
+ * Register this plugin before other plugins. `PluginManager` stops at the first
+ * `onEventCallback` that returns an event, and a later plugin must not change
+ * function calls or replace `customMetadata`.
+ *
+ * Requires the Web Crypto API (`globalThis.crypto.subtle`), available in
+ * browsers and in Node.js 19 and later.
+ *
+ * Example:
+ * ```typescript
+ * const plugin = new ToolCallIntegrityPlugin({secretKey: keyBytes});
+ * const app = {name: 'my_app', rootAgent: agent, plugins: [plugin]};
+ *
+ * // Key rotation: stamp with the new key, accept both.
+ * new ToolCallIntegrityPlugin({secretKey: [newKeyBytes, oldKeyBytes]});
+ * ```
+ */
+export declare class ToolCallIntegrityPlugin extends BasePlugin {
+    private readonly keys;
+    private readonly allowUnstampedCalls;
+    private cryptoKeys?;
+    /**
+     * @throws {Error} If `secretKey` is empty or contains a key that is not
+     *     non-empty bytes.
+     */
+    constructor(options: ToolCallIntegrityPluginOptions);
+    /**
+     * Returns a copy with internal metadata removed and marked as restored.
+     *
+     * Use it on events that your code copies into another session, so that the
+     * history passes the integrity check. The copy only keeps the history: its
+     * function calls are never executed.
+     *
+     * @param event The event to copy. It is not modified.
+     * @returns The marked copy, ready to append to the new session.
+     */
+    static prepareRestoredEvent(event: Event): Event;
+    private getCryptoKeys;
+    private sign;
+    /** `subtle.verify` compares in constant time. */
+    private verify;
+    private unstamped;
+    onEventCallback({ invocationContext, event, }: {
+        invocationContext: InvocationContext;
+        event: Event;
+    }): Promise<Event | undefined>;
+    beforeRunCallback({ invocationContext, }: {
+        invocationContext: InvocationContext;
+    }): Promise<Content | undefined>;
+    beforeToolCallback({ tool, toolArgs, toolContext, }: {
+        tool: BaseTool;
+        toolArgs: Record<string, unknown>;
+        toolContext: Context;
+    }): Promise<Record<string, unknown> | undefined>;
+}

package/dist/types/skills/skill_registry.d.ts

@@ -26,4 +26,12 @@ export interface SkillRegistry {
      * Returns the description for the search_skills tool.
      */
     searchToolDescription?(): string | undefined;
+    /**
+     * Releases resources held by the registry, such as network clients or
+     * temporary credentials.
+     *
+     * Optional: registries that hold no resources may omit it. `SkillToolset`
+     * invokes it, when present, from its own `close()`.
+     */
+    close?(): Promise<void>;
 }

package/dist/types/tools/openapi_tool/auth/auth_helpers.d.ts

@@ -4,7 +4,14 @@
  * SPDX-License-Identifier: Apache-2.0
  */
 import { OpenAPIV3 } from 'openapi-types';
-import { AuthCredential } from '../../../auth/auth_credential.js';
+import { AuthCredential, ServiceAccount } from '../../../auth/auth_credential.js';
+import { AuthScheme, OpenIdConnectWithConfig } from '../../../auth/auth_schemes.js';
+import { ApiParameter } from '../openapi_spec_parser/operation_parser.js';
+/**
+ * Prefix that marks a tool parameter as auth-injected rather than
+ * model-supplied.
+ */
+export declare const INTERNAL_AUTH_PREFIX = "_auth_prefix_vaf_";
 /**
  * Applies the given credential to the request headers and URL.
  *
@@ -28,3 +35,105 @@ export declare function createApiKeyScheme(name: string, inLocation: 'header' |
  * Helper to create a simple Bearer Token auth scheme.
  */
 export declare function createBearerScheme(): OpenAPIV3.SecuritySchemeObject;
+/**
+ * Creates an AuthScheme and AuthCredential for an API key or a bearer token.
+ *
+ * @example
+ * // API key in a header.
+ * const [scheme, credential] = tokenToSchemeCredential(
+ *   'apikey', 'header', 'X-API-Key', 'your_api_key_value');
+ *
+ * @example
+ * // OAuth2 bearer token in the Authorization header.
+ * const [scheme, credential] = tokenToSchemeCredential(
+ *   'oauth2Token', 'header', 'Authorization', 'your_bearer_token_value');
+ *
+ * @param tokenType `'apikey'` or `'oauth2Token'`.
+ * @param location Where the API key travels. Ignored for `'oauth2Token'`,
+ *   because a bearer token always travels in the Authorization header.
+ * @param name The name of the header, query parameter, or cookie.
+ * @param credentialValue The API key or token value. Omit it to build the
+ *   scheme alone.
+ * @returns A `[scheme, credential]` pair. The credential is `undefined` when
+ *   `credentialValue` is omitted.
+ * @throws Error For an unsupported token type or API key location.
+ */
+export declare function tokenToSchemeCredential(tokenType: 'apikey' | 'oauth2Token', location?: 'header' | 'query' | 'cookie', name?: string, credentialValue?: string): [AuthScheme, AuthCredential | undefined];
+/**
+ * Creates a bearer scheme and a service-account credential from a raw Google
+ * service-account JSON object.
+ *
+ * @param config The parsed service-account key file.
+ * @param scopes The scopes to request.
+ * @returns A `[scheme, credential]` pair.
+ */
+export declare function serviceAccountDictToSchemeCredential(config: Record<string, unknown>, scopes: string[]): [AuthScheme, AuthCredential];
+/**
+ * Creates a bearer scheme and a service-account credential from an already
+ * built `ServiceAccount`.
+ *
+ * @param config The service-account configuration.
+ * @returns A `[scheme, credential]` pair.
+ */
+export declare function serviceAccountSchemeCredential(config: ServiceAccount): [AuthScheme, AuthCredential];
+/**
+ * Builds an OpenID Connect scheme and credential from a configuration object
+ * and a client-secret object.
+ *
+ * @param configDict An OpenID Connect configuration. Snake_case keys, as a
+ *   discovery document delivers them, are accepted and normalized.
+ * @param scopes The scopes to request.
+ * @param credentialDict The Google OAuth client secret. Its keys stay
+ *   snake_case, because it is an on-disk wire format. A `{web: {…}}` or
+ *   `{installed: {…}}` wrapper is unwrapped.
+ * @returns A `[scheme, credential]` pair.
+ * @throws Error When the configuration or the client secret is incomplete.
+ */
+export declare function openidDictToSchemeCredential(configDict: Record<string, unknown>, scopes: string[], credentialDict: Record<string, unknown>): [OpenIdConnectWithConfig, AuthCredential];
+/**
+ * Fetches an OpenID Connect discovery document and pairs it with a client
+ * secret.
+ *
+ * The URL is used as given. A caller that accepts it from an untrusted source
+ * has to validate it first, because this function performs the request.
+ *
+ * @param openidUrl The OpenID Connect discovery URL.
+ * @param scopes The scopes to request.
+ * @param credentialDict The Google OAuth client secret, keyed snake_case.
+ * @returns A `[scheme, credential]` pair.
+ * @throws Error When the request fails, the body is not a JSON object, or the
+ *   configuration is incomplete.
+ */
+export declare function openidUrlToSchemeCredential(openidUrl: string, scopes: string[], credentialDict: Record<string, unknown>): Promise<[OpenIdConnectWithConfig, AuthCredential]>;
+/**
+ * Converts a scheme and credential into the tool parameter that carries the
+ * credential, plus the value to send for it.
+ *
+ * Service-account, OAuth2, and OpenID Connect credentials reach this function
+ * already exchanged for a bearer token, so they take the HTTP branch.
+ *
+ * @param authScheme The auth scheme.
+ * @param authCredential The auth credential.
+ * @returns A `[parameter, values]` pair, both `undefined` when the credential
+ *   carries nothing to send.
+ * @throws Error For basic authentication, which is not supported, and for a
+ *   scheme and credential combination that cannot be expressed as a parameter.
+ */
+export declare function credentialToParam(authScheme: AuthScheme, authCredential?: AuthCredential): [ApiParameter | undefined, Record<string, string> | undefined];
+/**
+ * Converts a security scheme object out of an OpenAPI document into an
+ * `AuthScheme`.
+ *
+ * @example
+ * const scheme = dictToAuthScheme({
+ *   type: 'apiKey',
+ *   in: 'header',
+ *   name: 'X-API-Key',
+ * });
+ *
+ * @param data The security scheme object.
+ * @returns The validated auth scheme.
+ * @throws Error When `type` is missing or unrecognised, or the rest of the
+ *   object does not match the shape that type requires.
+ */
+export declare function dictToAuthScheme(data: Record<string, unknown>): AuthScheme;

package/dist/types/tools/openapi_tool/auth/credential_exchangers/auto_auth_credential_exchanger.d.ts

@@ -3,17 +3,47 @@
  * Copyright 2026 Google LLC
  * SPDX-License-Identifier: Apache-2.0
  */
-import { AuthCredential } from '../../../../auth/auth_credential.js';
+import { AuthCredential, AuthCredentialTypes } from '../../../../auth/auth_credential.js';
 import { AuthScheme } from '../../../../auth/auth_schemes.js';
 import { BaseCredentialExchanger, ExchangeResult } from '../../../../auth/exchanger/base_credential_exchanger.js';
+/**
+ * A map from auth credential type to the exchanger that handles it, merged
+ * over the built-in defaults.
+ */
+export type CustomCredentialExchangers = Partial<Record<AuthCredentialTypes, BaseCredentialExchanger>>;
 /**
  * Automatically selects the appropriate credential exchanger based on the auth scheme.
+ * Ported from Python implementation.
+ *
+ * @example
+ * // Common case: a built-in exchanger handles the credential.
+ * const exchanger = new AutoAuthCredentialExchanger();
+ * const result = await exchanger.exchange({
+ *   authScheme: serviceAccountScheme,
+ *   authCredential: serviceAccountCredential,
+ * });
+ * // result.credential carries an OAuth token as a bearer token.
+ *
+ * @example
+ * // Use CustomAuthExchanger for OAuth2 instead of the built-in exchanger.
+ * const exchanger = new AutoAuthCredentialExchanger({
+ *   [AuthCredentialTypes.OAUTH2]: new CustomAuthExchanger(),
+ * });
  */
 export declare class AutoAuthCredentialExchanger implements BaseCredentialExchanger {
     private exchangers;
-    constructor();
+    /**
+     * @param customExchangers - Optional exchangers that add to or override the
+     *   built-in ones. The key is the auth credential type; the value is the
+     *   exchanger instance to use for that type.
+     */
+    constructor(customExchangers?: CustomCredentialExchangers);
     exchange(params: {
         authScheme?: AuthScheme;
         authCredential: AuthCredential;
     }): Promise<ExchangeResult>;
+    exchange(params: {
+        authScheme?: AuthScheme;
+        authCredential?: AuthCredential;
+    }): Promise<ExchangeResult | null>;
 }

package/dist/types/tools/openapi_tool/auth/credential_exchangers/base_auth_credential_exchanger.d.ts

@@ -0,0 +1,35 @@
+/**
+ * @license
+ * Copyright 2026 Google LLC
+ * SPDX-License-Identifier: Apache-2.0
+ */
+import { AuthCredential } from '../../../../auth/auth_credential.js';
+import { AuthScheme } from '../../../../auth/auth_schemes.js';
+/**
+ * Error raised when a required authentication credential is missing.
+ */
+export declare class AuthCredentialMissingError extends Error {
+    constructor(message: string);
+}
+/**
+ * Base class for authentication credential exchangers.
+ *
+ * A subclass exchanges the credential an OpenAPI tool was configured with for
+ * one that can be sent to the API. The base implementation always throws, so a
+ * subclass that forgets to override the method fails on the first call rather
+ * than silently returning nothing.
+ */
+export declare class BaseAuthCredentialExchanger {
+    /**
+     * Exchanges the provided authentication credential for a usable
+     * token or credential.
+     *
+     * @param _authScheme The security scheme.
+     * @param _authCredential The authentication credential.
+     * @returns An updated AuthCredential object containing the fetched
+     *     credential. For simple schemes like API key, it may return the original
+     *     credential if no exchange is needed.
+     * @throws {Error} If the method is not implemented by a subclass.
+     */
+    exchangeCredential(_authScheme: AuthScheme, _authCredential?: AuthCredential): AuthCredential;
+}

package/dist/types/tools/openapi_tool/auth/credential_exchangers/oauth2_exchanger.d.ts

@@ -0,0 +1,54 @@
+/**
+ * @license
+ * Copyright 2026 Google LLC
+ * SPDX-License-Identifier: Apache-2.0
+ */
+import { AuthCredential } from '../../../../auth/auth_credential.js';
+import { AuthScheme } from '../../../../auth/auth_schemes.js';
+import { BaseCredentialExchanger, ExchangeResult } from '../../../../auth/exchanger/base_credential_exchanger.js';
+/**
+ * Validates that the scheme and the credential can produce a bearer token.
+ *
+ * @param authScheme - The OpenID Connect or OAuth2 auth scheme.
+ * @param authCredential - The auth credential to validate.
+ * @throws Error - If the credential is absent, the scheme is
+ *     not OpenID Connect or OAuth2, or the credential carries neither `oauth2`
+ *     nor `http`.
+ */
+export declare function checkSchemeCredentialType(authScheme: AuthScheme, authCredential?: AuthCredential): asserts authCredential is AuthCredential;
+/**
+ * Converts an OAuth2 access token into an HTTP bearer credential.
+ *
+ * @param authCredential - The auth credential holding the access token.
+ * @returns A new credential holding the access token as an HTTP bearer token,
+ *     or the original credential when there is no access token to convert. The
+ *     input credential is never modified.
+ */
+export declare function generateAuthToken(authCredential: AuthCredential): AuthCredential;
+/**
+ * Exchanges an OAuth2 or OpenID Connect credential for an HTTP bearer one.
+ *
+ * @param authScheme - The auth scheme.
+ * @param authCredential - The auth credential.
+ * @returns The credential unchanged when it already carries `http`, a new HTTP
+ *     bearer credential when it carries an access token, or `null` when there
+ *     is no token to convert.
+ * @throws Error - If the scheme or the credential is invalid.
+ */
+export declare function exchangeCredential(authScheme: AuthScheme, authCredential?: AuthCredential): AuthCredential | null;
+/**
+ * Converts OAuth2 and OpenID Connect credentials into HTTP bearer credentials.
+ *
+ * Ports `OAuth2CredentialExchanger` from adk-python
+ * `src/google/adk/tools/openapi_tool/auth/credential_exchangers/oauth2_exchanger.py`
+ * at tag `v0.1.0`. The adk-js class carries a different name because
+ * `OAuth2CredentialExchanger` in `core/src/auth/oauth2/` already owns that one,
+ * and it solves a different problem: it fetches tokens from the token endpoint,
+ * where this class converts a token it is given.
+ */
+export declare class OAuth2BearerExchanger implements BaseCredentialExchanger {
+    exchange(params: {
+        authScheme?: AuthScheme;
+        authCredential: AuthCredential;
+    }): Promise<ExchangeResult>;
+}

package/dist/types/tools/openapi_tool/common/common.d.ts

@@ -0,0 +1,60 @@
+/**
+ * @license
+ * Copyright 2026 Google LLC
+ * SPDX-License-Identifier: Apache-2.0
+ */
+import { OpenAPIV3 } from 'openapi-types';
+import { ApiParameter } from '../openapi_spec_parser/operation_parser.js';
+/**
+ * The type hints these helpers emit are Python tokens, in a TypeScript SDK,
+ * on purpose. They are assembled into a tool description that reaches the
+ * model, so the same OpenAPI operation has to describe itself identically in
+ * adk-js and in adk-python. The reference is adk-python
+ * `src/google/adk/tools/openapi_tool/common/common.py`.
+ */
+/** Input to {@link createApiParameter}; `name` is derived when omitted. */
+export interface ApiParameterInit {
+    originalName: string;
+    paramLocation: string;
+    paramSchema: OpenAPIV3.SchemaObject;
+    description?: string;
+    name?: string;
+    required?: boolean;
+}
+/**
+ * Returns the Python type hint for an OpenAPI schema.
+ *
+ * @param schema The schema to describe, if any.
+ * @returns A Python type name such as `str`, `List[int]` or `Dict[str, Any]`.
+ *     A missing or unrecognised type gives `Any`.
+ */
+export declare function getTypeHint(schema: OpenAPIV3.SchemaObject | undefined): string;
+/**
+ * Generates the docstring line documenting one parameter.
+ *
+ * @param param The parameter to document.
+ * @returns A line of the form `name (type): description`, followed by an
+ *     indented property list when the schema is an object with properties.
+ */
+export declare function generateParamDoc(param: ApiParameter): string;
+/**
+ * Generates the docstring block documenting the return value.
+ *
+ * Uses the 2xx response with the smallest status code that has content.
+ *
+ * @param responses The responses of an OpenAPI operation.
+ * @returns A line of the form `Returns (type): description`, or `''` when no
+ *     2xx response has content.
+ */
+export declare function generateReturnDoc(responses: OpenAPIV3.ResponsesObject): string;
+/**
+ * Builds an {@link ApiParameter}, deriving the fields adk-python derives in
+ * `ApiParameter.model_post_init`.
+ *
+ * `name` falls back to the reserved-word-safe snake_case form of
+ * `originalName`, and `description` falls back to the schema description.
+ *
+ * @param init The parameter fields.
+ * @returns The parameter with its derived fields filled in.
+ */
+export declare function createApiParameter(init: ApiParameterInit): ApiParameter;

package/dist/types/tools/openapi_tool/openapi_spec_parser/openapi_spec_parser.d.ts

@@ -4,6 +4,7 @@
  * SPDX-License-Identifier: Apache-2.0
  */
 import { OpenAPIV3 } from 'openapi-types';
+import { AuthCredential } from '../../../auth/auth_credential.js';
 import { ApiParameter } from './operation_parser.js';
 export interface OperationEndpoint {
     baseUrl: string;
@@ -18,6 +19,12 @@ export interface ParsedOperation {
     parameters: ApiParameter[];
     returnValue?: ApiParameter;
     authScheme?: OpenAPIV3.SecuritySchemeObject;
+    /**
+     * Credential for the operation. The parser leaves this undefined; a caller
+     * that builds a `ParsedOperation` by hand can set it, and `OpenAPIToolset`
+     * passes it to the tool it creates.
+     */
+    authCredential?: AuthCredential;
 }
 export declare class OpenApiSpecParser {
     private preservePropertyNames;