@google/adk 2.2.1 → 2.3.0

package/dist/cjs/tools/agent_tool.js

@@ -38,12 +38,50 @@ var import_variant_utils = require("../utils/variant_utils.js");
 var import_state = require("../sessions/state.js");
 var import_base_tool = require("./base_tool.js");
 var import_forwarding_artifact_service = require("./forwarding_artifact_service.js");
+var import_schema = require("../utils/schema.js");
+var import_simple_zod_to_json = require("../utils/simple_zod_to_json.js");
 /**
  * @license
  * Copyright 2025 Google LLC
  * SPDX-License-Identifier: Apache-2.0
  */
 var _a, _b;
+function excludeNone(value) {
+  if (Array.isArray(value)) {
+    return value.map((item) => excludeNone(item));
+  }
+  if (value !== null && typeof value === "object") {
+    const result = {};
+    for (const [key, val] of Object.entries(value)) {
+      if (val !== null && val !== void 0) {
+        result[key] = excludeNone(val);
+      }
+    }
+    return result;
+  }
+  return value;
+}
+__name(excludeNone, "excludeNone");
+function validateAndStripAgentInput(agent, args) {
+  var _a2;
+  if (typeof args !== "object" || args === null || Array.isArray(args)) {
+    throw new Error("AgentTool input args must be a plain object.");
+  }
+  const schema = (0, import_simple_zod_to_json.isZodSchema)(agent.inputSchema) ? agent.inputSchema : (_a2 = agent.inputSchemaSource) != null ? _a2 : agent.inputSchema;
+  const validated = (0, import_schema.parseWithSchema)(schema, args);
+  return excludeNone(validated);
+}
+__name(validateAndStripAgentInput, "validateAndStripAgentInput");
+function validateAndStripAgentOutput(agent, mergedText) {
+  var _a2;
+  const parsed = JSON.parse(mergedText);
+  const validated = typeof agent.validateOutput === "function" ? agent.validateOutput(parsed) : (0, import_schema.parseWithSchema)(
+    (0, import_simple_zod_to_json.isZodSchema)(agent.outputSchema) ? agent.outputSchema : (_a2 = agent.outputSchemaSource) != null ? _a2 : agent.outputSchema,
+    parsed
+  );
+  return excludeNone(validated);
+}
+__name(validateAndStripAgentOutput, "validateAndStripAgentOutput");
 const AGENT_TOOL_SIGNATURE_SYMBOL = /* @__PURE__ */ Symbol.for("google.adk.agentTool");
 function isAgentTool(obj) {
   return typeof obj === "object" && obj !== null && AGENT_TOOL_SIGNATURE_SYMBOL in obj && obj[AGENT_TOOL_SIGNATURE_SYMBOL] === true;
@@ -97,6 +135,9 @@ const _AgentTool = class _AgentTool extends (_b = import_base_tool.BaseTool, _a
   }) {
     var _a2, _b2, _c, _d, _e, _f;
     const hasInputSchema = (0, import_llm_agent.isLlmAgent)(this.agent) && this.agent.inputSchema;
+    if (hasInputSchema && (0, import_llm_agent.isLlmAgent)(this.agent)) {
+      args = validateAndStripAgentInput(this.agent, args);
+    }
     const content = {
       role: "user",
       parts: [
@@ -151,6 +192,9 @@ const _AgentTool = class _AgentTool extends (_b = import_base_tool.BaseTool, _a
     }
     const hasOutputSchema = (0, import_llm_agent.isLlmAgent)(this.agent) && this.agent.outputSchema;
     const mergedText = lastEvent.content.parts.filter((part) => !part.thought).map((part) => part.text).filter((text) => text).join("\n");
+    if (hasOutputSchema && (0, import_llm_agent.isLlmAgent)(this.agent)) {
+      return validateAndStripAgentOutput(this.agent, mergedText);
+    }
     return hasOutputSchema ? JSON.parse(mergedText) : mergedText;
   }
 };

package/dist/cjs/tools/apihub_tool/apihub_toolset.js

@@ -0,0 +1,142 @@
+/**
+  * @license
+  * Copyright 2026 Google LLC
+  * SPDX-License-Identifier: Apache-2.0
+  */
+
+"use strict";
+var __create = Object.create;
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __getProtoOf = Object.getPrototypeOf;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __name = (target, value) => __defProp(target, "name", { value, configurable: true });
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, { get: all[name], enumerable: true });
+};
+var __copyProps = (to, from, except, desc) => {
+  if (from && typeof from === "object" || typeof from === "function") {
+    for (let key of __getOwnPropNames(from))
+      if (!__hasOwnProp.call(to, key) && key !== except)
+        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
+  }
+  return to;
+};
+var __toESM = (mod, isNodeMode, target) => (target = mod != null ? __create(__getProtoOf(mod)) : {}, __copyProps(
+  // If the importer is in node compatibility mode or this is not an ESM
+  // file that has been converted to a CommonJS file using a Babel-
+  // compatible transform (i.e. "__esModule" has not been set), then set
+  // "default" to the CommonJS "module.exports" for node compatibility.
+  isNodeMode || !mod || !mod.__esModule ? __defProp(target, "default", { value: mod, enumerable: true }) : target,
+  mod
+));
+var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
+var __decorateClass = (decorators, target, key, kind) => {
+  var result = kind > 1 ? void 0 : kind ? __getOwnPropDesc(target, key) : target;
+  for (var i = decorators.length - 1, decorator; i >= 0; i--)
+    if (decorator = decorators[i])
+      result = (kind ? decorator(target, key, result) : decorator(result)) || result;
+  if (kind && result) __defProp(target, key, result);
+  return result;
+};
+var apihub_toolset_exports = {};
+__export(apihub_toolset_exports, {
+  APIHubToolset: () => APIHubToolset
+});
+module.exports = __toCommonJS(apihub_toolset_exports);
+var import_js_yaml = __toESM(require("js-yaml"), 1);
+var import_case_utils = require("../../utils/case_utils.js");
+var import_experimental = require("../../utils/experimental.js");
+var import_base_toolset = require("../base_toolset.js");
+var import_openapi_toolset = require("../openapi_tool/openapi_toolset.js");
+var import_apihub_client = require("./clients/apihub_client.js");
+/**
+ * @license
+ * Copyright 2026 Google LLC
+ * SPDX-License-Identifier: Apache-2.0
+ */
+let APIHubToolset = class extends import_base_toolset.BaseToolset {
+  constructor(options) {
+    var _a, _b, _c, _d;
+    super([]);
+    this.name = (_a = options.name) != null ? _a : "";
+    this.description = (_b = options.description) != null ? _b : "";
+    this.apihubResourceName = options.apihubResourceName;
+    this.lazyLoadSpec = (_c = options.lazyLoadSpec) != null ? _c : false;
+    this.authScheme = options.authScheme;
+    this.authCredential = options.authCredential;
+    this.apihubClient = (_d = options.apihubClient) != null ? _d : new import_apihub_client.APIHubClient({
+      accessToken: options.accessToken,
+      serviceAccountJson: options.serviceAccountJson
+    });
+    if (!this.lazyLoadSpec) {
+      this.toolsetPromise = this.prepareTools();
+      this.toolsetPromise.catch(() => void 0);
+    }
+  }
+  /**
+   * Returns one tool per operation in the spec, or an empty array when the
+   * spec is empty.
+   *
+   * @throws When the spec cannot be fetched or is not valid YAML or JSON.
+   */
+  async getTools(context) {
+    const toolset = await this.loadToolset();
+    return toolset ? toolset.getTools(context) : [];
+  }
+  /**
+   * Returns the tool with the given name, or `undefined` when the spec
+   * produced no such tool.
+   *
+   * Unlike `OpenAPIToolset.getTool`, the result is a Promise, because the spec
+   * may still be loading.
+   *
+   * @param name The tool name, which is the operation ID in snake_case.
+   * @throws When the spec cannot be fetched or is not valid YAML or JSON.
+   */
+  async getTool(name) {
+    const toolset = await this.loadToolset();
+    return toolset == null ? void 0 : toolset.getTool(name);
+  }
+  async close() {
+  }
+  loadToolset() {
+    if (!this.toolsetPromise) {
+      const promise = this.prepareTools();
+      this.toolsetPromise = promise;
+      promise.catch(() => {
+        if (this.toolsetPromise === promise) {
+          this.toolsetPromise = void 0;
+        }
+      });
+    }
+    return this.toolsetPromise;
+  }
+  async prepareTools() {
+    var _a, _b, _c, _d;
+    const spec = await this.apihubClient.getSpecContent(
+      this.apihubResourceName
+    );
+    const specDict = import_js_yaml.default.load(spec);
+    if (!specDict) {
+      return void 0;
+    }
+    this.name || (this.name = (0, import_case_utils.toSnakeCaseName)((_b = (_a = specDict.info) == null ? void 0 : _a.title) != null ? _b : "unnamed"));
+    this.description || (this.description = (_d = (_c = specDict.info) == null ? void 0 : _c.description) != null ? _d : "");
+    return new import_openapi_toolset.OpenAPIToolset({
+      specDict,
+      authScheme: this.authScheme,
+      authCredential: this.authCredential
+    });
+  }
+};
+__name(APIHubToolset, "APIHubToolset");
+APIHubToolset = __decorateClass([
+  import_experimental.experimental
+], APIHubToolset);
+// Annotate the CommonJS export names for ESM import in node:
+0 && (module.exports = {
+  APIHubToolset
+});

package/dist/cjs/tools/apihub_tool/clients/apihub_client.js

@@ -0,0 +1,272 @@
+/**
+  * @license
+  * Copyright 2026 Google LLC
+  * SPDX-License-Identifier: Apache-2.0
+  */
+
+"use strict";
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __name = (target, value) => __defProp(target, "name", { value, configurable: true });
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, { get: all[name], enumerable: true });
+};
+var __copyProps = (to, from, except, desc) => {
+  if (from && typeof from === "object" || typeof from === "function") {
+    for (let key of __getOwnPropNames(from))
+      if (!__hasOwnProp.call(to, key) && key !== except)
+        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
+  }
+  return to;
+};
+var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
+var apihub_client_exports = {};
+__export(apihub_client_exports, {
+  APIHubClient: () => APIHubClient,
+  extractResourceName: () => extractResourceName
+});
+module.exports = __toCommonJS(apihub_client_exports);
+var import_google_auth_library = require("google-auth-library");
+var import_service_account = require("./service_account.js");
+/**
+ * @license
+ * Copyright 2026 Google LLC
+ * SPDX-License-Identifier: Apache-2.0
+ */
+const APIHUB_ROOT_URL = "https://apihub.googleapis.com/v1";
+const CLOUD_PLATFORM_SCOPE = "https://www.googleapis.com/auth/cloud-platform";
+const ACCEPT_HEADER = "application/json, text/plain, */*";
+const _APIHubClient = class _APIHubClient {
+  constructor(options = {}) {
+    if (options.accessToken) {
+      this.accessToken = options.accessToken;
+    } else if (options.serviceAccountJson) {
+      this.serviceAccountJson = options.serviceAccountJson;
+    }
+  }
+  /**
+   * Returns the content of the first spec that `path` resolves to.
+   *
+   * - A path naming an API resolves to the first spec of its first version.
+   * - A path naming an API version resolves to the first spec of that version.
+   * - A path naming an API spec resolves to that spec.
+   *
+   * `path` may be a resource name such as
+   * `projects/my-project/locations/us-central1/apis/my-api`, or a console URL
+   * such as
+   * `https://console.cloud.google.com/apigee/api-hub/locations/us-central1/apis/my-api?project=my-project`.
+   *
+   * @param path The API, API version or API spec to read.
+   * @return The decoded spec content, or `''` when the spec is empty.
+   * @throws When the path cannot be parsed, when the API has no versions, when
+   *     the version has no specs, or when a request fails.
+   */
+  async getSpecContent(path) {
+    var _a, _b;
+    const names = extractResourceName(path);
+    let apiVersionResourceName = names.apiVersionResourceName;
+    let apiSpecResourceName = names.apiSpecResourceName;
+    if (!apiVersionResourceName) {
+      const api = await this.getApi(names.apiResourceName);
+      const versions = (_a = api.versions) != null ? _a : [];
+      if (versions.length === 0) {
+        throw new Error(
+          `No versions found in API Hub resource: ${names.apiResourceName}`
+        );
+      }
+      apiVersionResourceName = versions[0];
+    }
+    if (!apiSpecResourceName) {
+      const apiVersion = await this.getApiVersion(apiVersionResourceName);
+      const specs = (_b = apiVersion.specs) != null ? _b : [];
+      if (specs.length === 0) {
+        throw new Error(
+          `No specs found in API Hub version: ${apiVersionResourceName}`
+        );
+      }
+      apiSpecResourceName = specs[0];
+    }
+    if (apiSpecResourceName) {
+      return this.fetchSpec(apiSpecResourceName);
+    }
+    throw new Error(`No API Hub resource found in path: ${path}`);
+  }
+  /**
+   * Lists the APIs registered in a project and location.
+   *
+   * @param project The Google Cloud project ID.
+   * @param location The API Hub location, for example `us-central1`.
+   * @return The APIs, or an empty array when there are none.
+   */
+  async listApis(project, location) {
+    var _a;
+    const body = await this.get(
+      `${APIHUB_ROOT_URL}/projects/${project}/locations/${location}/apis`
+    );
+    return (_a = body.apis) != null ? _a : [];
+  }
+  /**
+   * Gets an API by resource name.
+   *
+   * @param apiResourceName `projects/{p}/locations/{l}/apis/{a}`.
+   */
+  async getApi(apiResourceName) {
+    return this.get(`${APIHUB_ROOT_URL}/${apiResourceName}`);
+  }
+  /**
+   * Gets an API version by resource name.
+   *
+   * @param apiVersionName `projects/{p}/locations/{l}/apis/{a}/versions/{v}`.
+   */
+  async getApiVersion(apiVersionName) {
+    return this.get(`${APIHUB_ROOT_URL}/${apiVersionName}`);
+  }
+  /** Reads the base64-encoded contents of a spec and decodes them as UTF-8. */
+  async fetchSpec(apiSpecResourceName) {
+    const body = await this.get(
+      `${APIHUB_ROOT_URL}/${apiSpecResourceName}:contents`
+    );
+    if (!body.contents) {
+      return "";
+    }
+    return Buffer.from(body.contents, "base64").toString("utf-8");
+  }
+  /** Sends an authenticated GET request and parses the JSON response. */
+  async get(url) {
+    const response = await fetch(url, {
+      headers: {
+        accept: ACCEPT_HEADER,
+        Authorization: `Bearer ${await this.getAccessToken()}`
+      }
+    });
+    if (!response.ok) {
+      throw new Error(
+        `API Hub request failed with status ${response.status}: ${url}`
+      );
+    }
+    return await response.json();
+  }
+  /**
+   * Returns the bearer token for the next request.
+   *
+   * `GoogleAuth` is created once and reused, so that it can cache the token
+   * and refresh it when it expires.
+   */
+  async getAccessToken() {
+    var _a;
+    if (this.accessToken) {
+      return this.accessToken;
+    }
+    (_a = this.auth) != null ? _a : this.auth = this.createAuth();
+    let token;
+    try {
+      token = await this.auth.getAccessToken();
+    } catch (e) {
+      throw this.tokenError(e);
+    }
+    if (!token) {
+      throw this.tokenError();
+    }
+    return token;
+  }
+  /**
+   * Builds the error for a token that could not be obtained.
+   *
+   * Without a service account, the likely fix is to supply a credential. With
+   * one, the key itself was rejected, so the error says so and gives the
+   * reason.
+   */
+  tokenError(cause) {
+    if (!this.serviceAccountJson) {
+      return new Error(
+        "Please provide a service account or an access token to API Hub client.",
+        { cause }
+      );
+    }
+    const reason = cause === void 0 ? "no token was returned" : cause instanceof Error ? cause.message : String(cause);
+    return new Error(
+      `Failed to get an access token for API Hub client from the given service account: ${reason}`,
+      { cause }
+    );
+  }
+  createAuth() {
+    const scopes = [CLOUD_PLATFORM_SCOPE];
+    if (!this.serviceAccountJson) {
+      return new import_google_auth_library.GoogleAuth({ scopes });
+    }
+    return new import_google_auth_library.GoogleAuth({
+      credentials: (0, import_service_account.parseServiceAccountJson)(this.serviceAccountJson),
+      scopes
+    });
+  }
+};
+__name(_APIHubClient, "APIHubClient");
+let APIHubClient = _APIHubClient;
+function segmentAfter(segments, key) {
+  const index = segments.indexOf(key);
+  if (index === -1 || index + 1 >= segments.length) {
+    return void 0;
+  }
+  return segments[index + 1];
+}
+__name(segmentAfter, "segmentAfter");
+function splitPathAndQuery(urlOrPath) {
+  if (/^[a-zA-Z][a-zA-Z0-9+.-]*:\/\//.test(urlOrPath)) {
+    try {
+      const url = new URL(urlOrPath);
+      return { path: url.pathname, query: url.searchParams };
+    } catch {
+    }
+  }
+  const queryStart = urlOrPath.indexOf("?");
+  if (queryStart === -1) {
+    return { path: urlOrPath, query: new URLSearchParams() };
+  }
+  return {
+    path: urlOrPath.slice(0, queryStart),
+    query: new URLSearchParams(urlOrPath.slice(queryStart + 1))
+  };
+}
+__name(splitPathAndQuery, "splitPathAndQuery");
+function extractResourceName(urlOrPath) {
+  var _a;
+  const { path: rawPath, query } = splitPathAndQuery(urlOrPath);
+  let path = rawPath;
+  if (path.includes("api-hub/")) {
+    path = path.split("api-hub")[1];
+  }
+  const segments = path.split("/").filter((segment) => segment);
+  const project = segments.includes("projects") ? segmentAfter(segments, "projects") : (_a = query.get("project")) != null ? _a : void 0;
+  if (!project) {
+    throw new Error(
+      `Project ID not found in URL or path in APIHubClient. Input path is '${urlOrPath}'. Please make sure there is either '/projects/PROJECT_ID' in the path or 'project=PROJECT_ID' query param in the input.`
+    );
+  }
+  const location = segmentAfter(segments, "locations");
+  if (!location) {
+    throw new Error(
+      `Location not found in URL or path in APIHubClient. Input path is '${urlOrPath}'. Please make sure there is either '/location/LOCATION_ID' in the path.`
+    );
+  }
+  const apiId = segmentAfter(segments, "apis");
+  if (!apiId) {
+    throw new Error(
+      `API id not found in URL or path in APIHubClient. Input path is '${urlOrPath}'. Please make sure there is either '/apis/API_ID' in the path.`
+    );
+  }
+  const versionId = segmentAfter(segments, "versions");
+  const specId = segmentAfter(segments, "specs");
+  const apiResourceName = `projects/${project}/locations/${location}/apis/${apiId}`;
+  const apiVersionResourceName = versionId ? `${apiResourceName}/versions/${versionId}` : void 0;
+  const apiSpecResourceName = apiVersionResourceName && specId ? `${apiVersionResourceName}/specs/${specId}` : void 0;
+  return { apiResourceName, apiVersionResourceName, apiSpecResourceName };
+}
+__name(extractResourceName, "extractResourceName");
+// Annotate the CommonJS export names for ESM import in node:
+0 && (module.exports = {
+  APIHubClient,
+  extractResourceName
+});

package/dist/cjs/tools/apihub_tool/clients/secret_client.js

@@ -0,0 +1,148 @@
+/**
+  * @license
+  * Copyright 2026 Google LLC
+  * SPDX-License-Identifier: Apache-2.0
+  */
+
+"use strict";
+var __create = Object.create;
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __getProtoOf = Object.getPrototypeOf;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __name = (target, value) => __defProp(target, "name", { value, configurable: true });
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, { get: all[name], enumerable: true });
+};
+var __copyProps = (to, from, except, desc) => {
+  if (from && typeof from === "object" || typeof from === "function") {
+    for (let key of __getOwnPropNames(from))
+      if (!__hasOwnProp.call(to, key) && key !== except)
+        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
+  }
+  return to;
+};
+var __toESM = (mod, isNodeMode, target) => (target = mod != null ? __create(__getProtoOf(mod)) : {}, __copyProps(
+  // If the importer is in node compatibility mode or this is not an ESM
+  // file that has been converted to a CommonJS file using a Babel-
+  // compatible transform (i.e. "__esModule" has not been set), then set
+  // "default" to the CommonJS "module.exports" for node compatibility.
+  isNodeMode || !mod || !mod.__esModule ? __defProp(target, "default", { value: mod, enumerable: true }) : target,
+  mod
+));
+var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
+var secret_client_exports = {};
+__export(secret_client_exports, {
+  SecretManagerClient: () => SecretManagerClient
+});
+module.exports = __toCommonJS(secret_client_exports);
+var import_google_auth_library = require("google-auth-library");
+var import_optional_peer = require("../../../utils/optional_peer.js");
+var import_service_account = require("./service_account.js");
+/**
+ * @license
+ * Copyright 2026 Google LLC
+ * SPDX-License-Identifier: Apache-2.0
+ */
+const CLOUD_PLATFORM_SCOPE = "https://www.googleapis.com/auth/cloud-platform";
+const _SecretManagerClient = class _SecretManagerClient {
+  /**
+   * @throws `Invalid service account JSON: ...` when `serviceAccountJson`
+   *     does not parse.
+   */
+  constructor(options = {}) {
+    if (options.serviceAccountJson) {
+      this.credentials = (0, import_service_account.parseServiceAccountJson)(options.serviceAccountJson);
+    } else if (options.authToken) {
+      this.authToken = options.authToken;
+    }
+  }
+  /**
+   * Returns the payload of a secret version as a UTF-8 string.
+   *
+   * @param resourceName The secret version, in the form
+   *     `projects/{project}/secrets/{secret}/versions/{version}`. Use
+   *     `latest` as the version to read the newest one.
+   * @throws When default credentials are needed and cannot be resolved, or
+   *     when Secret Manager returns an error, such as a missing secret or a
+   *     denied permission.
+   */
+  async getSecret(resourceName) {
+    var _a;
+    const client = await this.getClient();
+    const [response] = await client.accessSecretVersion({ name: resourceName });
+    const data = (_a = response.payload) == null ? void 0 : _a.data;
+    if (data === void 0 || data === null) {
+      return "";
+    }
+    if (typeof data === "string") {
+      return data;
+    }
+    return new TextDecoder("utf-8").decode(data);
+  }
+  /**
+   * Resolves the Secret Manager client, loading the optional peer and the
+   * credentials on first use.
+   *
+   * A created client is kept. A failure is not kept, so the next call tries
+   * again, for example once default credentials become available.
+   */
+  getClient() {
+    if (!this.clientPromise) {
+      const promise = this.createClient();
+      this.clientPromise = promise;
+      promise.catch(() => {
+        if (this.clientPromise === promise) {
+          this.clientPromise = void 0;
+        }
+      });
+    }
+    return this.clientPromise;
+  }
+  async createClient() {
+    const { SecretManagerServiceClient } = await (0, import_optional_peer.loadOptionalPeer)(
+      {
+        packageName: "@google-cloud/secret-manager",
+        feature: "SecretManagerClient"
+      },
+      () => Promise.resolve().then(() => __toESM(require("@google-cloud/secret-manager"), 1))
+    );
+    if (this.credentials) {
+      return new SecretManagerServiceClient({ credentials: this.credentials });
+    }
+    if (this.authToken) {
+      const authClient2 = new import_google_auth_library.OAuth2Client();
+      authClient2.setCredentials({ access_token: this.authToken });
+      return new SecretManagerServiceClient({
+        authClient: toSdkAuthClient(authClient2)
+      });
+    }
+    let authClient;
+    try {
+      authClient = await new import_google_auth_library.GoogleAuth({
+        scopes: [CLOUD_PLATFORM_SCOPE]
+      }).getClient();
+    } catch (e) {
+      const message = e instanceof Error ? e.message : String(e);
+      throw new Error(
+        `'serviceAccountJson' or 'authToken' are both missing, and error occurred while trying to use default credentials: ${message}`,
+        { cause: e }
+      );
+    }
+    return new SecretManagerServiceClient({
+      authClient: toSdkAuthClient(authClient)
+    });
+  }
+};
+__name(_SecretManagerClient, "SecretManagerClient");
+let SecretManagerClient = _SecretManagerClient;
+function toSdkAuthClient(authClient) {
+  return authClient;
+}
+__name(toSdkAuthClient, "toSdkAuthClient");
+// Annotate the CommonJS export names for ESM import in node:
+0 && (module.exports = {
+  SecretManagerClient
+});

package/dist/cjs/tools/apihub_tool/clients/service_account.js

@@ -0,0 +1,48 @@
+/**
+  * @license
+  * Copyright 2026 Google LLC
+  * SPDX-License-Identifier: Apache-2.0
+  */
+
+"use strict";
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __name = (target, value) => __defProp(target, "name", { value, configurable: true });
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, { get: all[name], enumerable: true });
+};
+var __copyProps = (to, from, except, desc) => {
+  if (from && typeof from === "object" || typeof from === "function") {
+    for (let key of __getOwnPropNames(from))
+      if (!__hasOwnProp.call(to, key) && key !== except)
+        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
+  }
+  return to;
+};
+var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
+var service_account_exports = {};
+__export(service_account_exports, {
+  parseServiceAccountJson: () => parseServiceAccountJson
+});
+module.exports = __toCommonJS(service_account_exports);
+/**
+ * @license
+ * Copyright 2026 Google LLC
+ * SPDX-License-Identifier: Apache-2.0
+ */
+function parseServiceAccountJson(json) {
+  try {
+    return JSON.parse(json);
+  } catch (e) {
+    const message = e instanceof Error ? e.message : String(e);
+    throw new Error(`Invalid service account JSON: ${message}`, { cause: e });
+  }
+}
+__name(parseServiceAccountJson, "parseServiceAccountJson");
+// Annotate the CommonJS export names for ESM import in node:
+0 && (module.exports = {
+  parseServiceAccountJson
+});