@google/adk 2.2.0 → 2.3.0

package/dist/esm/utils/streaming_utils.js

@@ -206,7 +206,7 @@ const _NonProgressiveStrategy = class _NonProgressiveStrategy {
     this.thoughtText = "";
   }
   async *processResponse(llmResponse) {
-    var _a;
+    var _a, _b;
     if ((_a = llmResponse.content) == null ? void 0 : _a.parts) {
       const nonTextParts = [];
       let sawTextPart = false;
@@ -226,7 +226,8 @@ const _NonProgressiveStrategy = class _NonProgressiveStrategy {
         nonTextParts.push(part);
       }
       if (nonTextParts.length > 0) {
-        if (this.thoughtText || this.text) {
+        const startsWithInlineData = !!((_b = llmResponse.content.parts[0]) == null ? void 0 : _b.inlineData);
+        if (!startsWithInlineData && (this.thoughtText || this.text)) {
           const parts = [];
           if (this.thoughtText) {
             parts.push({ text: this.thoughtText, thought: true });
@@ -277,13 +278,12 @@ const _NonProgressiveStrategy = class _NonProgressiveStrategy {
 };
 __name(_NonProgressiveStrategy, "NonProgressiveStrategy");
 let NonProgressiveStrategy = _NonProgressiveStrategy;
-const _StreamingResponseAggregator = class _StreamingResponseAggregator {
-  constructor(isProgressiveMode = isFeatureEnabled(
-    FeatureName.PROGRESSIVE_SSE_STREAMING
-  )) {
-    this.isProgressiveMode = isProgressiveMode;
+const _GeminiStreamingResponseAggregator = class _GeminiStreamingResponseAggregator {
+  constructor({
+    isProgressiveMode = isFeatureEnabled(FeatureName.PROGRESSIVE_SSE_STREAMING)
+  } = {}) {
     this.lastThoughtSignature = {};
-    this.strategy = this.isProgressiveMode ? new ProgressiveStrategy() : new NonProgressiveStrategy();
+    this.strategy = isProgressiveMode ? new ProgressiveStrategy() : new NonProgressiveStrategy();
   }
   async *processResponse(response) {
     var _a, _b;
@@ -356,13 +356,13 @@ const _StreamingResponseAggregator = class _StreamingResponseAggregator {
     };
   }
 };
-__name(_StreamingResponseAggregator, "StreamingResponseAggregator");
-let StreamingResponseAggregator = _StreamingResponseAggregator;
+__name(_GeminiStreamingResponseAggregator, "GeminiStreamingResponseAggregator");
+let GeminiStreamingResponseAggregator = _GeminiStreamingResponseAggregator;
 function isEmptyContentPart(part) {
   return !part.functionCall && !part.functionResponse && !part.fileData && !part.inlineData && !part.executableCode && !part.codeExecutionResult && (!part.text || part.text === "");
 }
 __name(isEmptyContentPart, "isEmptyContentPart");
 export {
-  StreamingResponseAggregator,
+  GeminiStreamingResponseAggregator,
   isEmptyContentPart
 };

package/dist/esm/version.js

@@ -5,7 +5,7 @@ const require = topLevelCreateRequire(import.meta.url);
  * Copyright 2025 Google LLC
  * SPDX-License-Identifier: Apache-2.0
  */
-const version = "2.2.0";
+const version = "2.3.0";
 export {
   version
 };

package/dist/types/a2a/a2a_remote_agent.d.ts

@@ -8,6 +8,7 @@ import { Client, ClientFactory } from '@a2a-js/sdk/client';
 import { BaseAgent, BaseAgentConfig } from '../agents/base_agent.js';
 import { InvocationContext } from '../agents/invocation_context.js';
 import { Event as AdkEvent } from '../events/event.js';
+import { ResolveAgentCardOptions } from './agent_card.js';
 export { AGENT_CARD_PATH };
 /**
  * Type alias for A2A stream event data.
@@ -45,6 +46,14 @@ export interface RemoteA2AAgentConfig extends BaseAgentConfig {
      * Loaded AgentCard or URL to AgentCard.
      */
     agentCard?: AgentCard | string;
+    /**
+     * Controls how a fetched agent card's RPC URL(s) are validated against
+     * the location the card was fetched from. Only relevant when
+     * {@link RemoteA2AAgentConfig.agentCard} is a URL rather than an
+     * already-loaded card object; see {@link ResolveAgentCardOptions} for
+     * what each option relaxes and why both default to failing closed.
+     */
+    resolveAgentCardOptions?: ResolveAgentCardOptions;
     /**
      * Optional pre-initialized Client for connection pooling.
      */

package/dist/types/a2a/agent_card.d.ts

@@ -5,6 +5,49 @@
  */
 import { AgentCard, AgentInterface, AgentSkill } from '@a2a-js/sdk';
 import { RunnableRoot } from '../workflow/run_node_as_invocation.js';
+/**
+ * Options controlling how a fetched agent card's RPC URL(s) are validated
+ * against the location the card was fetched from. See `validateCardRpcTargets`
+ * for what each check defends against and why
+ * both default to failing closed.
+ */
+export interface ResolveAgentCardOptions {
+    /**
+     * Explicit escape hatch to accept a plaintext http:// RPC URL on a
+     * non-loopback host.
+     *
+     * This is intentionally insecure: an RPC URL that isn't https and isn't
+     * on this machine can be intercepted or altered by anything on the
+     * network path, even when its origin matches the card's own. Only set
+     * this for a card source you know serves plain http on a host you
+     * trust (e.g. a private, internal service reached over a channel
+     * that's secured some other way). When set to `true`, a loud warning is
+     * logged for each RPC URL this affects.
+     *
+     * Defaults to `false`: RPC URLs must be https, or http on a loopback
+     * host (localhost, 127.0.0.0/8, ::1, 0.0.0.0, or ::).
+     */
+    allowInsecureRpc?: boolean;
+    /**
+     * Explicit escape hatch to accept an RPC URL whose origin differs from
+     * the location the card was fetched from.
+     *
+     * This is intentionally permissive: it is what lets a compromised or
+     * misconfigured card-hosting endpoint redirect all subsequent A2A
+     * traffic for this agent, including whatever credential material the
+     * request-forwarding path carries, to a different origin than the one
+     * that was actually configured and fetched. The A2A spec allows a card
+     * to point RPC at a different origin than where the card itself is
+     * served from (e.g. static card hosting separate from the API
+     * backend), which is the legitimate case this exists for -- only set
+     * this when that's a shape you actually expect. When set to `true`, a
+     * loud warning is logged for each RPC URL this affects.
+     *
+     * Defaults to `false`: every RPC URL must share the origin the card
+     * was fetched from.
+     */
+    allowCrossOriginRpc?: boolean;
+}
 /**
  * Resolves the AgentCard from the provided source.
  *
@@ -17,7 +60,7 @@ import { RunnableRoot } from '../workflow/run_node_as_invocation.js';
  * private addresses stay allowed: they are where a locally served or
  * VPC-internal peer agent lives.
  */
-export declare function resolveAgentCard(agentCard: AgentCard | string): Promise<AgentCard>;
+export declare function resolveAgentCard(agentCard: AgentCard | string, options?: ResolveAgentCardOptions): Promise<AgentCard>;
 /**
  * Converts an ADK agent to an A2A AgentCard.
  */

package/dist/types/a2a/agent_to_a2a.d.ts

@@ -11,6 +11,7 @@ import { BaseMemoryService } from '../memory/base_memory_service.js';
 import { Runner } from '../runner/runner.js';
 import { BaseSessionService } from '../sessions/base_session_service.js';
 import { RunnableRoot } from '../workflow/run_node_as_invocation.js';
+import { ResolveAgentCardOptions } from './agent_card.js';
 import { AdkDefaultRequestHandler, getA2aRequestMetadata } from './request_metadata.js';
 export { AdkDefaultRequestHandler, getA2aRequestMetadata };
 /**
@@ -39,6 +40,14 @@ export interface ToA2aOptions {
     basePath?: string;
     /** Optional pre-built AgentCard object or path to agent card JSON */
     agentCard?: AgentCard | string;
+    /**
+     * Controls how a fetched agent card's RPC URL(s) are validated against
+     * the location the card was fetched from. Only relevant when
+     * {@link ToA2aOptions.agentCard} is a URL rather than an already-loaded
+     * card object or file path; see {@link ResolveAgentCardOptions} for
+     * what each option relaxes and why both default to failing closed.
+     */
+    resolveAgentCardOptions?: ResolveAgentCardOptions;
     /** Optional pre-built Runner object */
     runner?: Runner;
     /** Optional session service */

package/dist/types/a2a/index.d.ts

@@ -10,6 +10,7 @@
 export { AGENT_CARD_PATH, RemoteA2AAgent } from './a2a_remote_agent.js';
 export type { A2AStreamEventData, AfterA2ARequestCallback, BeforeA2ARequestCallback, RemoteA2AAgentConfig, } from './a2a_remote_agent.js';
 export { getA2AAgentCard } from './agent_card.js';
+export type { ResolveAgentCardOptions } from './agent_card.js';
 export { A2AAgentExecutor } from './agent_executor.js';
 export type { AfterEventCallback, AfterExecuteCallback, AgentExecutorConfig, BeforeExecuteCallback, RunnerOrRunnerConfig, } from './agent_executor.js';
 export { AdkDefaultRequestHandler, getA2aRequestMetadata, toA2a, } from './agent_to_a2a.js';

package/dist/types/agents/functions.d.ts

@@ -9,11 +9,14 @@ import { Event } from '../events/event.js';
 import { BaseTool } from '../tools/base_tool.js';
 import { ResumeInputs } from '../tools/resume_inputs.js';
 import { ToolConfirmation } from '../tools/tool_confirmation.js';
+import { Context } from './context.js';
 import { SingleAfterToolCallback, SingleBeforeToolCallback } from './llm_agent.js';
 export { AF_FUNCTION_CALL_ID_PREFIX, generateClientFunctionCallId, populateClientFunctionCallId, } from '../events/event.js';
 export { REQUEST_CONFIRMATION_FUNCTION_CALL_NAME, REQUEST_CREDENTIAL_FUNCTION_CALL_NAME, REQUEST_INPUT_FUNCTION_CALL_NAME, reservedFunctionCallName, } from './framework_function_calls.js';
 export declare const functionsExportedForTestingOnly: {
     handleFunctionCallList: typeof handleFunctionCallList;
+    handleFunctionCallsLive: typeof handleFunctionCallsLive;
+    processFunctionLiveHelper: typeof processFunctionLiveHelper;
     generateAuthEvent: typeof generateAuthEvent;
     generateRequestConfirmationEvent: typeof generateRequestConfirmationEvent;
 };
@@ -63,6 +66,23 @@ export declare function handleFunctionCallsAsync({ invocationContext, functionCa
     toolConfirmationDict?: Record<string, ToolConfirmation>;
     resumeInputsDict?: Record<string, ResumeInputs>;
 }): Promise<Event | null>;
+/**
+ * Handles function calls in a live (bidirectional streaming) session.
+ *
+ * Supports regular sync/async tools, async-generator streaming tools that push
+ * incremental results onto `invocationContext.liveRequestQueue`, and the
+ * `stop_streaming` control call that cancels an active streaming tool task.
+ */
+export declare function handleFunctionCallsLive({ invocationContext, functionCallEvent, toolsDict, beforeToolCallbacks, afterToolCallbacks, filters, toolConfirmationDict, resumeInputsDict, }: {
+    invocationContext: InvocationContext;
+    functionCallEvent: Event;
+    toolsDict: Record<string, BaseTool>;
+    beforeToolCallbacks: SingleBeforeToolCallback[];
+    afterToolCallbacks: SingleAfterToolCallback[];
+    filters?: Set<string>;
+    toolConfirmationDict?: Record<string, ToolConfirmation>;
+    resumeInputsDict?: Record<string, ResumeInputs>;
+}): Promise<Event | null>;
 /**
  * Whether `tool` is the placeholder handed to the on-tool-error callbacks for a
  * function call naming a tool this agent cannot call.
@@ -76,7 +96,7 @@ export declare function isToolNotFound(tool: unknown): boolean;
  * function calls instead of an event.
  * This is also used by llm_agent execution flow in preprocessing.
  */
-export declare function handleFunctionCallList({ invocationContext, functionCalls, toolsDict, beforeToolCallbacks, afterToolCallbacks, filters, toolConfirmationDict, resumeInputsDict, }: {
+export declare function handleFunctionCallList({ invocationContext, functionCalls, toolsDict, beforeToolCallbacks, afterToolCallbacks, filters, toolConfirmationDict, resumeInputsDict, isLive, }: {
     invocationContext: InvocationContext;
     functionCalls: FunctionCall[];
     toolsDict: Record<string, BaseTool>;
@@ -91,11 +111,23 @@ export declare function handleFunctionCallList({ invocationContext, functionCall
      * approval; see {@link ResumeInputs}.
      */
     resumeInputsDict?: Record<string, ResumeInputs>;
+    isLive?: boolean;
 }): Promise<Event | null>;
 /**
  * Merges a list of function response events into a single event.
  */
 export declare function mergeParallelFunctionResponseEvents(functionResponseEvents: Event[]): Event;
+/**
+ * Executes a single tool call in live mode, supporting `stop_streaming`,
+ * async-generator streaming tools, and standard sync/async tools.
+ */
+declare function processFunctionLiveHelper({ tool, toolContext, functionCall, functionArgs, invocationContext, }: {
+    tool: BaseTool;
+    toolContext: Context;
+    functionCall: FunctionCall;
+    functionArgs: Record<string, unknown>;
+    invocationContext: InvocationContext;
+}): Promise<unknown>;
 /**
  * Finds the most recent event before `endIndex` that contains a function call
  * with the given ID.

package/dist/types/agents/invocation_context.d.ts

@@ -59,6 +59,24 @@ export interface InvocationContextParams {
      */
     a2aMetadata?: Record<string, unknown>;
 }
+/**
+ * A unique symbol to identify {@link LlmCallsLimitExceededError} instances.
+ */
+declare const LLM_CALLS_LIMIT_EXCEEDED_ERROR_SIGNATURE_SYMBOL: unique symbol;
+/**
+ * Error thrown when the number of LLM calls in an invocation exceeds {@link RunConfig.maxLlmCalls}.
+ */
+export declare class LlmCallsLimitExceededError extends Error {
+    readonly [LLM_CALLS_LIMIT_EXCEEDED_ERROR_SIGNATURE_SYMBOL] = true;
+    constructor(message: string);
+}
+/**
+ * Type guard to check if an object is an instance of {@link LlmCallsLimitExceededError}.
+ *
+ * @param obj The object to check.
+ * @returns True if the object is an instance of {@link LlmCallsLimitExceededError}.
+ */
+export declare function isLlmCallsLimitExceededError(obj: unknown): obj is LlmCallsLimitExceededError;
 /**
  * An invocation context represents the data of a single invocation of an agent.
  *
@@ -198,7 +216,7 @@ export declare class InvocationContext {
      * The live request queue feeding the model on the bidirectional (live) path.
      * Set only for invocations started via `runner.runLive`.
      */
-    readonly liveRequestQueue?: LiveRequestQueue;
+    liveRequestQueue?: LiveRequestQueue;
     /**
      * The most recent session resumption handle observed on the live path.
      * Updated as the server emits resumption updates so a reconnect can restore
@@ -255,3 +273,4 @@ export declare function newInvocationContextId(): string;
  * @throws if the invocation is driving a bare node rather than an agent.
  */
 export declare function requireAgent(ctx: InvocationContext): BaseAgent;
+export {};

package/dist/types/agents/langgraph_agent.d.ts

@@ -0,0 +1,153 @@
+/**
+ * @license
+ * Copyright 2026 Google LLC
+ * SPDX-License-Identifier: Apache-2.0
+ */
+import { Event } from '../events/event.js';
+import { BaseAgent, BaseAgentConfig } from './base_agent.js';
+import { InvocationContext } from './invocation_context.js';
+/**
+ * Text or structured content part inside a LangGraph message content array.
+ */
+export interface LangGraphContentPart {
+    readonly type?: string;
+    readonly text?: string;
+}
+/**
+ * Content carried by a LangGraph message (`string` or an array of content parts).
+ */
+export type LangGraphMessageContent = string | ReadonlyArray<string | LangGraphContentPart>;
+/**
+ * Structural representation of a message exchanged with a LangGraph graph.
+ */
+export interface LangGraphMessageLike {
+    /**
+     * Text or structured content of the message.
+     */
+    readonly content: LangGraphMessageContent;
+    /**
+     * Optional role or message type identifier (`'human'`, `'ai'`, or `'system'`).
+     */
+    readonly type?: string;
+}
+/**
+ * Represents a human user message passed to a LangGraph graph.
+ */
+export interface LangGraphHumanMessage extends LangGraphMessageLike {
+    readonly type: 'human';
+    readonly content: string;
+}
+/**
+ * Represents an AI assistant message passed to or returned by a LangGraph graph.
+ */
+export interface LangGraphAIMessage extends LangGraphMessageLike {
+    readonly type: 'ai';
+    readonly content: LangGraphMessageContent;
+}
+/**
+ * Represents a system instruction message passed to a LangGraph graph.
+ */
+export interface LangGraphSystemMessage extends LangGraphMessageLike {
+    readonly type: 'system';
+    readonly content: string;
+}
+/**
+ * Runnable configuration passed to a compiled LangGraph graph invocation.
+ */
+export interface LangGraphRunnableConfig {
+    readonly configurable: {
+        /**
+         * Thread identifier expected in `snake_case` by LangGraph.js checkpointers.
+         */
+        readonly thread_id: string;
+    };
+}
+/**
+ * State snapshot returned by a compiled LangGraph graph's `getState` method.
+ */
+export interface LangGraphStateSnapshot {
+    readonly values?: {
+        readonly messages?: readonly LangGraphMessageLike[];
+    };
+}
+/**
+ * Input state passed to a compiled LangGraph graph's `invoke` method.
+ */
+export interface LangGraphInvokeInput {
+    readonly messages: readonly LangGraphMessageLike[];
+}
+/**
+ * Output state returned by a compiled LangGraph graph's `invoke` method.
+ */
+export interface LangGraphInvokeOutput {
+    readonly messages?: readonly LangGraphMessageLike[];
+}
+/**
+ * Structural interface for a compiled LangGraph graph.
+ */
+export interface CompiledGraphLike {
+    /**
+     * Optional checkpointer configured on the compiled graph for multi-turn state persistence.
+     */
+    readonly checkpointer?: unknown;
+    /**
+     * Optional helper returning the underlying graph representation.
+     */
+    getGraph?(...args: unknown[]): unknown;
+    /**
+     * Retrieves the current graph state for the given runnable configuration.
+     */
+    getState?(config: LangGraphRunnableConfig): LangGraphStateSnapshot | undefined | Promise<LangGraphStateSnapshot | undefined>;
+    /**
+     * Invokes the compiled graph with the given message list and runnable configuration.
+     */
+    invoke(input: LangGraphInvokeInput, config: LangGraphRunnableConfig): LangGraphInvokeOutput | Promise<LangGraphInvokeOutput>;
+}
+/**
+ * Configuration options for {@link LangGraphAgent}.
+ */
+export interface LangGraphAgentConfig extends BaseAgentConfig {
+    /**
+     * The compiled LangGraph graph to execute.
+     */
+    graph: CompiledGraphLike;
+    /**
+     * Optional system instruction prepended when the graph state has no existing messages.
+     */
+    instruction?: string;
+}
+/**
+ * Extracts the trailing contiguous sequence of human user messages from `events`.
+ *
+ * @param events The session events to inspect.
+ * @returns The trailing user messages in chronological order.
+ */
+export declare function getLastHumanMessages(events: readonly Event[]): LangGraphHumanMessage[];
+declare const LANGGRAPH_AGENT_SIGNATURE_SYMBOL: unique symbol;
+/**
+ * Type guard to check if an object is an instance of {@link LangGraphAgent}.
+ *
+ * @param obj The object to check.
+ * @returns True if the object is an instance of {@link LangGraphAgent}.
+ */
+export declare function isLangGraphAgent(obj: unknown): obj is LangGraphAgent;
+/**
+ * An agent that wraps a compiled LangGraph graph for single-turn and multi-turn execution.
+ */
+export declare class LangGraphAgent extends BaseAgent<LangGraphAgentConfig> {
+    readonly [LANGGRAPH_AGENT_SIGNATURE_SYMBOL] = true;
+    /**
+     * The compiled LangGraph graph executed by this agent.
+     */
+    readonly graph: CompiledGraphLike;
+    /**
+     * System instruction prepended when the graph state contains no prior messages.
+     */
+    readonly instruction: string;
+    constructor(config: LangGraphAgentConfig);
+    protected runAsyncImpl(ctx: InvocationContext): AsyncGenerator<Event, void, void>;
+    protected runLiveImpl(_ctx: InvocationContext): AsyncGenerator<Event, void, void>;
+    private getMessages;
+    private getConversationWithAgent;
+}
+export {};

package/dist/types/agents/remote_agent.d.ts

@@ -0,0 +1,68 @@
+/**
+ * @license
+ * Copyright 2026 Google LLC
+ * SPDX-License-Identifier: Apache-2.0
+ */
+import { Event } from '../events/event.js';
+import { BaseAgent, BaseAgentConfig } from './base_agent.js';
+import { InvocationContext } from './invocation_context.js';
+/**
+ * Custom `fetch` function signature accepted by {@link RemoteAgentConfig.fetchImpl}.
+ */
+export type RemoteAgentFetch = typeof fetch;
+/**
+ * Configuration options for {@link RemoteAgent}.
+ */
+export interface RemoteAgentConfig extends BaseAgentConfig {
+    /**
+     * Remote HTTP endpoint URL that accepts an invocation payload and returns a JSON array of events.
+     */
+    url: string;
+    /**
+     * Request timeout in milliseconds; defaults to `120_000` (120 seconds).
+     */
+    timeoutMs?: number;
+    /**
+     * Optional custom `fetch` implementation used for HTTP requests.
+     */
+    fetchImpl?: RemoteAgentFetch;
+    /**
+     * Sub-agents are disabled on {@link RemoteAgent}.
+     */
+    subAgents?: never;
+}
+declare const REMOTE_AGENT_SIGNATURE_SYMBOL: unique symbol;
+/**
+ * Type guard to check if an object is an instance of {@link RemoteAgent}.
+ *
+ * @param obj The object to check.
+ * @returns True if the object is an instance of {@link RemoteAgent}.
+ */
+export declare function isRemoteAgent(obj: unknown): obj is RemoteAgent;
+/**
+ * Experimental agent that forwards invocation context and session state to a
+ * remote HTTP endpoint.
+ *
+ * Trust assumption: returned event payloads (including `id`, `timestamp`, and
+ * `actions` such as `stateDelta`, `artifactDelta`, `transferToAgent`, and
+ * `escalate`) are deserialized via `transformToCamelCaseEvent` and passed
+ * to {@link createEvent} without schema or authorization filtering; only
+ * `author` is overwritten with this agent's `name`. Configure `url` only with a
+ * trusted remote endpoint.
+ */
+export declare class RemoteAgent extends BaseAgent<RemoteAgentConfig> {
+    readonly [REMOTE_AGENT_SIGNATURE_SYMBOL] = true;
+    /**
+     * Remote HTTP endpoint URL.
+     */
+    readonly url: string;
+    /**
+     * Request timeout in milliseconds.
+     */
+    readonly timeoutMs: number;
+    private readonly fetchImpl;
+    constructor(config: RemoteAgentConfig);
+    protected runAsyncImpl(ctx: InvocationContext): AsyncGenerator<Event, void, void>;
+    protected runLiveImpl(_ctx: InvocationContext): AsyncGenerator<Event, void, void>;
+}
+export {};

package/dist/types/auth/auth_handler.d.ts

@@ -12,7 +12,12 @@ import { AuthConfig } from './auth_tool.js';
  * This class should only be used by Agent Development Kit.
  */
 export declare class AuthHandler {
-    private readonly authConfig;
+    authConfig: AuthConfig;
+    /**
+     * @param authConfig The auth config this handler reads. It stays readable
+     *     and replaceable after construction; each method reads the current
+     *     value.
+     */
     constructor(authConfig: AuthConfig);
     getAuthResponse(state: State): AuthCredential | undefined;
     /**
@@ -22,6 +27,24 @@ export declare class AuthHandler {
      * @throws Error: If the auth config has no credentialKey.
      */
     parseAndStoreAuthResponse(state: State): Promise<void>;
+    /**
+     * Builds the auth request to send to the client.
+     *
+     * The result is always a new object, and its `exchangedAuthCredential` is
+     * never an object held by {@link authConfig}. A caller that fills in the
+     * response, for example `exchangedAuthCredential.oauth2.authResponseUri`,
+     * therefore leaves the handler's credentials unchanged.
+     *
+     * When the config is returned as is, because the scheme is not OAuth2 or
+     * OpenID Connect or the exchanged credential already has an auth URI, the
+     * result is a deep copy of the whole config. In the other branches only the
+     * exchanged credential is guaranteed independent: `authScheme` and
+     * `rawAuthCredential` are the handler's own objects.
+     *
+     * @return The auth config to request from the client.
+     * @throws Error: If an OAuth2 or OpenID Connect scheme has no raw
+     *     credential, no `oauth2` on it, or no client ID and secret.
+     */
     generateAuthRequest(): AuthConfig;
     /**
      * Generates an response containing the auth uri for user to sign in.
@@ -30,6 +53,10 @@ export declare class AuthHandler {
      * challenge derived from the credential's code verifier, and the returned
      * credential carries the verifier the later token exchange must send.
      *
+     * The URI leaves out `redirect_uri` when the credential has no
+     * `redirectUri`, so the provider uses the redirect registered for the
+     * client, and leaves out `scope` when the scheme lists no scopes.
+     *
      * @return An AuthCredential object containing the auth URI and state.
      * @throws Error: If the authorization endpoint is not configured in the
      *     auth scheme, or the credential requests a code challenge method other

package/dist/types/auth/auth_schemes.d.ts

@@ -23,6 +23,19 @@ export interface OpenIdConnectWithConfig extends OpenAPIV3.OpenIdSecurityScheme
  * OpenIdConnectWithConfig.
  */
 export type AuthScheme = OpenAPIV3.SecuritySchemeObject | OpenIdConnectWithConfig;
+/**
+ * The OpenAPI security scheme types an {@link AuthScheme} can declare.
+ *
+ * The values are the exact strings of the OpenAPI `type` field, so a member
+ * compares equal to `authScheme.type` and can be enumerated at runtime with
+ * `Object.values(AuthSchemeType)`.
+ */
+export declare enum AuthSchemeType {
+    API_KEY = "apiKey",
+    HTTP = "http",
+    OAUTH2 = "oauth2",
+    OPEN_ID_CONNECT = "openIdConnect"
+}
 /**
  * Represents the OAuth2 flow (or grant type).
  */