@googleapis/sts 2.1.5 → 3.0.0

package/CHANGELOG.md

@@ -1,5 +1,37 @@
 # Changelog
 
+## [3.0.0](https://github.com/googleapis/google-api-nodejs-client/compare/sts-v2.1.8...sts-v3.0.0) (2022-10-28)
+
+
+### ⚠ BREAKING CHANGES
+
+* **build:** This release has breaking changes.
+
+### Features
+
+* **build:** run the generator (submodules now require Node 12) ([#3073](https://github.com/googleapis/google-api-nodejs-client/issues/3073)) ([eda0707](https://github.com/googleapis/google-api-nodejs-client/commit/eda07079dadab46a80b6f9ede618f4f43030169e))
+
+## [2.1.8](https://github.com/googleapis/google-api-nodejs-client/compare/sts-v2.1.7...sts-v2.1.8) (2022-09-21)
+
+
+### Bug Fixes
+
+* **sts:** update the API ([e8c3e2e](https://github.com/googleapis/google-api-nodejs-client/commit/e8c3e2e2cab3f84bd92b740ff732302eacd7e5d8))
+
+## [2.1.7](https://github.com/googleapis/google-api-nodejs-client/compare/sts-v2.1.6...sts-v2.1.7) (2022-08-19)
+
+
+### Bug Fixes
+
+* **sts:** update the API ([f58c1c1](https://github.com/googleapis/google-api-nodejs-client/commit/f58c1c1988865c543bd842980b0485d78c4f1244))
+
+## [2.1.6](https://github.com/googleapis/google-api-nodejs-client/compare/sts-v2.1.5...sts-v2.1.6) (2022-07-04)
+
+
+### Bug Fixes
+
+* **sts:** update the API ([45f39eb](https://github.com/googleapis/google-api-nodejs-client/commit/45f39eb5522a0520131880bd4c58663180e61dab))
+
 ## [2.1.5](https://github.com/googleapis/google-api-nodejs-client/compare/sts-v2.1.4...sts-v2.1.5) (2022-06-21)
 
 

package/build/index.js

@@ -12,22 +12,23 @@
 // See the License for the specific language governing permissions and
 // limitations under the License.
 Object.defineProperty(exports, "__esModule", { value: true });
+exports.AuthPlus = exports.sts_v1beta = exports.sts_v1 = exports.auth = exports.sts = exports.VERSIONS = void 0;
 /*! THIS FILE IS AUTO-GENERATED */
 const googleapis_common_1 = require("googleapis-common");
 const v1_1 = require("./v1");
-exports.sts_v1 = v1_1.sts_v1;
+Object.defineProperty(exports, "sts_v1", { enumerable: true, get: function () { return v1_1.sts_v1; } });
 const v1beta_1 = require("./v1beta");
-exports.sts_v1beta = v1beta_1.sts_v1beta;
+Object.defineProperty(exports, "sts_v1beta", { enumerable: true, get: function () { return v1beta_1.sts_v1beta; } });
 exports.VERSIONS = {
     v1: v1_1.sts_v1.Sts,
     v1beta: v1beta_1.sts_v1beta.Sts,
 };
 function sts(versionOrOptions) {
-    return googleapis_common_1.getAPI('sts', versionOrOptions, exports.VERSIONS, this);
+    return (0, googleapis_common_1.getAPI)('sts', versionOrOptions, exports.VERSIONS, this);
 }
 exports.sts = sts;
 const auth = new googleapis_common_1.AuthPlus();
 exports.auth = auth;
 var googleapis_common_2 = require("googleapis-common");
-exports.AuthPlus = googleapis_common_2.AuthPlus;
+Object.defineProperty(exports, "AuthPlus", { enumerable: true, get: function () { return googleapis_common_2.AuthPlus; } });
 //# sourceMappingURL=index.js.map

package/build/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../index.ts"],"names":[],"mappings":";AAAA,4BAA4B;AAC5B,kEAAkE;AAClE,mEAAmE;AACnE,0CAA0C;AAC1C,EAAE;AACF,gDAAgD;AAChD,EAAE;AACF,sEAAsE;AACtE,oEAAoE;AACpE,2EAA2E;AAC3E,sEAAsE;AACtE,iCAAiC;;AAEjC,kCAAkC;AAElC,yDAAuE;AACvE,6BAA4B;AAqBpB,iBArBA,WAAM,CAqBA;AApBd,qCAAoC;AAqB5B,qBArBA,mBAAU,CAqBA;AAnBL,QAAA,QAAQ,GAAG;IACtB,EAAE,EAAE,WAAM,CAAC,GAAG;IACd,MAAM,EAAE,mBAAU,CAAC,GAAG;CACvB,CAAC;AAMF,SAAgB,GAAG,CAEjB,gBAAuE;IAEvE,OAAO,0BAAM,CAAI,KAAK,EAAE,gBAAgB,EAAE,gBAAQ,EAAE,IAAI,CAAC,CAAC;AAC5D,CAAC;AALD,kBAKC;AAED,MAAM,IAAI,GAAG,IAAI,4BAAQ,EAAE,CAAC;AACpB,oBAAI;AAGZ,uDAS2B;AARzB,uCAAA,QAAQ,CAAA"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../index.ts"],"names":[],"mappings":";AAAA,4BAA4B;AAC5B,kEAAkE;AAClE,mEAAmE;AACnE,0CAA0C;AAC1C,EAAE;AACF,gDAAgD;AAChD,EAAE;AACF,sEAAsE;AACtE,oEAAoE;AACpE,2EAA2E;AAC3E,sEAAsE;AACtE,iCAAiC;;;AAEjC,kCAAkC;AAElC,yDAAuE;AACvE,6BAA4B;AAqBpB,uFArBA,WAAM,OAqBA;AApBd,qCAAoC;AAqB5B,2FArBA,mBAAU,OAqBA;AAnBL,QAAA,QAAQ,GAAG;IACtB,EAAE,EAAE,WAAM,CAAC,GAAG;IACd,MAAM,EAAE,mBAAU,CAAC,GAAG;CACvB,CAAC;AAMF,SAAgB,GAAG,CAEjB,gBAAuE;IAEvE,OAAO,IAAA,0BAAM,EAAI,KAAK,EAAE,gBAAgB,EAAE,gBAAQ,EAAE,IAAI,CAAC,CAAC;AAC5D,CAAC;AALD,kBAKC;AAED,MAAM,IAAI,GAAG,IAAI,4BAAQ,EAAE,CAAC;AACpB,oBAAI;AAGZ,uDAS2B;AARzB,6GAAA,QAAQ,OAAA"}

package/build/v1.d.ts

@@ -80,7 +80,7 @@ export declare namespace sts_v1 {
          */
         condition?: Schema$GoogleTypeExpr;
         /**
-         * Specifies the principals requesting access for a Google Cloud resource. `members` can have the following values: * `allUsers`: A special identifier that represents anyone who is on the internet; with or without a Google account. * `allAuthenticatedUsers`: A special identifier that represents anyone who is authenticated with a Google account or a service account. * `user:{emailid\}`: An email address that represents a specific Google account. For example, `alice@example.com` . * `serviceAccount:{emailid\}`: An email address that represents a service account. For example, `my-other-app@appspot.gserviceaccount.com`. * `group:{emailid\}`: An email address that represents a Google group. For example, `admins@example.com`. * `deleted:user:{emailid\}?uid={uniqueid\}`: An email address (plus unique identifier) representing a user that has been recently deleted. For example, `alice@example.com?uid=123456789012345678901`. If the user is recovered, this value reverts to `user:{emailid\}` and the recovered user retains the role in the binding. * `deleted:serviceAccount:{emailid\}?uid={uniqueid\}`: An email address (plus unique identifier) representing a service account that has been recently deleted. For example, `my-other-app@appspot.gserviceaccount.com?uid=123456789012345678901`. If the service account is undeleted, this value reverts to `serviceAccount:{emailid\}` and the undeleted service account retains the role in the binding. * `deleted:group:{emailid\}?uid={uniqueid\}`: An email address (plus unique identifier) representing a Google group that has been recently deleted. For example, `admins@example.com?uid=123456789012345678901`. If the group is recovered, this value reverts to `group:{emailid\}` and the recovered group retains the role in the binding. * `domain:{domain\}`: The G Suite domain (primary) that represents all the users of that domain. For example, `google.com` or `example.com`.
+         * Specifies the principals requesting access for a Google Cloud resource. `members` can have the following values: * `allUsers`: A special identifier that represents anyone who is on the internet; with or without a Google account. * `allAuthenticatedUsers`: A special identifier that represents anyone who is authenticated with a Google account or a service account. Does not include identities that come from external identity providers (IdPs) through identity federation. * `user:{emailid\}`: An email address that represents a specific Google account. For example, `alice@example.com` . * `serviceAccount:{emailid\}`: An email address that represents a Google service account. For example, `my-other-app@appspot.gserviceaccount.com`. * `serviceAccount:{projectid\}.svc.id.goog[{namespace\}/{kubernetes-sa\}]`: An identifier for a [Kubernetes service account](https://cloud.google.com/kubernetes-engine/docs/how-to/kubernetes-service-accounts). For example, `my-project.svc.id.goog[my-namespace/my-kubernetes-sa]`. * `group:{emailid\}`: An email address that represents a Google group. For example, `admins@example.com`. * `deleted:user:{emailid\}?uid={uniqueid\}`: An email address (plus unique identifier) representing a user that has been recently deleted. For example, `alice@example.com?uid=123456789012345678901`. If the user is recovered, this value reverts to `user:{emailid\}` and the recovered user retains the role in the binding. * `deleted:serviceAccount:{emailid\}?uid={uniqueid\}`: An email address (plus unique identifier) representing a service account that has been recently deleted. For example, `my-other-app@appspot.gserviceaccount.com?uid=123456789012345678901`. If the service account is undeleted, this value reverts to `serviceAccount:{emailid\}` and the undeleted service account retains the role in the binding. * `deleted:group:{emailid\}?uid={uniqueid\}`: An email address (plus unique identifier) representing a Google group that has been recently deleted. For example, `admins@example.com?uid=123456789012345678901`. If the group is recovered, this value reverts to `group:{emailid\}` and the recovered group retains the role in the binding. * `domain:{domain\}`: The G Suite domain (primary) that represents all the users of that domain. For example, `google.com` or `example.com`.
          */
         members?: string[] | null;
         /**
@@ -162,7 +162,7 @@ export declare namespace sts_v1 {
      */
     export interface Schema$GoogleIdentityStsV1ExchangeTokenRequest {
         /**
-         * The full resource name of the identity provider; for example: `//iam.googleapis.com/projects//locations/global/workloadIdentityPools//providers/`. Required when exchanging an external credential for a Google access token.
+         * The full resource name of the identity provider; for example: `//iam.googleapis.com/projects//locations/global/workloadIdentityPools//providers/` for workload identity pool providers, or `//iam.googleapis.com/locations/global/workforcePools//providers/` for workforce pool providers. Required when exchanging an external credential for a Google access token.
          */
         audience?: string | null;
         /**
@@ -170,7 +170,7 @@ export declare namespace sts_v1 {
          */
         grantType?: string | null;
         /**
-         * A set of features that Security Token Service supports, in addition to the standard OAuth 2.0 token exchange, formatted as a serialized JSON object of Options.
+         * A set of features that Security Token Service supports, in addition to the standard OAuth 2.0 token exchange, formatted as a serialized JSON object of Options. The size of the parameter value must not exceed 4096 characters.
          */
         options?: string | null;
         /**
@@ -182,7 +182,7 @@ export declare namespace sts_v1 {
          */
         scope?: string | null;
         /**
-         * Required. The input token. This token is either an external credential issued by a workload identity pool provider, or a short-lived access token issued by Google. If the token is an OIDC JWT, it must use the JWT format defined in [RFC 7523](https://tools.ietf.org/html/rfc7523), and the `subject_token_type` must be either `urn:ietf:params:oauth:token-type:jwt` or `urn:ietf:params:oauth:token-type:id_token`. The following headers are required: - `kid`: The identifier of the signing key securing the JWT. - `alg`: The cryptographic algorithm securing the JWT. Must be `RS256` or `ES256`. The following payload fields are required. For more information, see [RFC 7523, Section 3](https://tools.ietf.org/html/rfc7523#section-3): - `iss`: The issuer of the token. The issuer must provide a discovery document at the URL `/.well-known/openid-configuration`, where `` is the value of this field. The document must be formatted according to section 4.2 of the [OIDC 1.0 Discovery specification](https://openid.net/specs/openid-connect-discovery-1_0.html#ProviderConfigurationResponse). - `iat`: The issue time, in seconds, since the Unix epoch. Must be in the past. - `exp`: The expiration time, in seconds, since the Unix epoch. Must be less than 48 hours after `iat`. Shorter expiration times are more secure. If possible, we recommend setting an expiration time less than 6 hours. - `sub`: The identity asserted in the JWT. - `aud`: For workload identity pools, this must be a value specified in the allowed audiences for the workload identity pool provider, or one of the audiences allowed by default if no audiences were specified. See https://cloud.google.com/iam/docs/reference/rest/v1/projects.locations.workloadIdentityPools.providers#oidc Example header: ``` { "alg": "RS256", "kid": "us-east-11" \} ``` Example payload: ``` { "iss": "https://accounts.google.com", "iat": 1517963104, "exp": 1517966704, "aud": "//iam.googleapis.com/projects/1234567890123/locations/global/workloadIdentityPools/my-pool/providers/my-provider", "sub": "113475438248934895348", "my_claims": { "additional_claim": "value" \} \} ``` If `subject_token` is for AWS, it must be a serialized `GetCallerIdentity` token. This token contains the same information as a request to the AWS [`GetCallerIdentity()`](https://docs.aws.amazon.com/STS/latest/APIReference/API_GetCallerIdentity) method, as well as the AWS [signature](https://docs.aws.amazon.com/general/latest/gr/signing_aws_api_requests.html) for the request information. Use Signature Version 4. Format the request as URL-encoded JSON, and set the `subject_token_type` parameter to `urn:ietf:params:aws:token-type:aws4_request`. The following parameters are required: - `url`: The URL of the AWS STS endpoint for `GetCallerIdentity()`, such as `https://sts.amazonaws.com?Action=GetCallerIdentity&Version=2011-06-15`. Regional endpoints are also supported. - `method`: The HTTP request method: `POST`. - `headers`: The HTTP request headers, which must include: - `Authorization`: The request signature. - `x-amz-date`: The time you will send the request, formatted as an [ISO8601 Basic](https://docs.aws.amazon.com/general/latest/gr/sigv4_elements.html#sigv4_elements_date) string. This value is typically set to the current time and is used to help prevent replay attacks. - `host`: The hostname of the `url` field; for example, `sts.amazonaws.com`. - `x-goog-cloud-target-resource`: The full, canonical resource name of the workload identity pool provider, with or without an `https:` prefix. To help ensure data integrity, we recommend including this header in the `SignedHeaders` field of the signed request. For example: //iam.googleapis.com/projects//locations/global/workloadIdentityPools//providers/ https://iam.googleapis.com/projects//locations/global/workloadIdentityPools//providers/ If you are using temporary security credentials provided by AWS, you must also include the header `x-amz-security-token`, with the value set to the session token. The following example shows a `GetCallerIdentity` token: ``` { "headers": [ {"key": "x-amz-date", "value": "20200815T015049Z"\}, {"key": "Authorization", "value": "AWS4-HMAC-SHA256+Credential=$credential,+SignedHeaders=host;x-amz-date;x-goog-cloud-target-resource,+Signature=$signature"\}, {"key": "x-goog-cloud-target-resource", "value": "//iam.googleapis.com/projects//locations/global/workloadIdentityPools//providers/"\}, {"key": "host", "value": "sts.amazonaws.com"\} . ], "method": "POST", "url": "https://sts.amazonaws.com?Action=GetCallerIdentity&Version=2011-06-15" \} ``` If the token is a SAML 2.0 assertion, it must use the format defined in [the SAML 2.0 spec](https://www.oasis-open.org/committees/download.php/56776/sstc-saml-core-errata-2.0-wd-07.pdf), and the `subject_token_type` must be `urn:ietf:params:oauth:token-type:saml2`. See [Verification of external credentials](https://cloud.google.com/iam/docs/using-workload-identity-federation#verification_of_external_credentials) for details on how SAML 2.0 assertions are validated during token exchanges. You can also use a Google-issued OAuth 2.0 access token with this field to obtain an access token with new security attributes applied, such as a Credential Access Boundary. In this case, set `subject_token_type` to `urn:ietf:params:oauth:token-type:access_token`. If an access token already contains security attributes, you cannot apply additional security attributes.
+         * Required. The input token. This token is either an external credential issued by a workload identity pool provider, or a short-lived access token issued by Google. If the token is an OIDC JWT, it must use the JWT format defined in [RFC 7523](https://tools.ietf.org/html/rfc7523), and the `subject_token_type` must be either `urn:ietf:params:oauth:token-type:jwt` or `urn:ietf:params:oauth:token-type:id_token`. The following headers are required: - `kid`: The identifier of the signing key securing the JWT. - `alg`: The cryptographic algorithm securing the JWT. Must be `RS256` or `ES256`. The following payload fields are required. For more information, see [RFC 7523, Section 3](https://tools.ietf.org/html/rfc7523#section-3): - `iss`: The issuer of the token. The issuer must provide a discovery document at the URL `/.well-known/openid-configuration`, where `` is the value of this field. The document must be formatted according to section 4.2 of the [OIDC 1.0 Discovery specification](https://openid.net/specs/openid-connect-discovery-1_0.html#ProviderConfigurationResponse). - `iat`: The issue time, in seconds, since the Unix epoch. Must be in the past. - `exp`: The expiration time, in seconds, since the Unix epoch. Must be less than 48 hours after `iat`. Shorter expiration times are more secure. If possible, we recommend setting an expiration time less than 6 hours. - `sub`: The identity asserted in the JWT. - `aud`: For workload identity pools, this must be a value specified in the allowed audiences for the workload identity pool provider, or one of the audiences allowed by default if no audiences were specified. See https://cloud.google.com/iam/docs/reference/rest/v1/projects.locations.workloadIdentityPools.providers#oidc. For workforce pools, this must match the client ID specified in the provider configuration. See https://cloud.google.com/iam/docs/reference/rest/v1/locations.workforcePools.providers#oidc. Example header: ``` { "alg": "RS256", "kid": "us-east-11" \} ``` Example payload: ``` { "iss": "https://accounts.google.com", "iat": 1517963104, "exp": 1517966704, "aud": "//iam.googleapis.com/projects/1234567890123/locations/global/workloadIdentityPools/my-pool/providers/my-provider", "sub": "113475438248934895348", "my_claims": { "additional_claim": "value" \} \} ``` If `subject_token` is for AWS, it must be a serialized `GetCallerIdentity` token. This token contains the same information as a request to the AWS [`GetCallerIdentity()`](https://docs.aws.amazon.com/STS/latest/APIReference/API_GetCallerIdentity) method, as well as the AWS [signature](https://docs.aws.amazon.com/general/latest/gr/signing_aws_api_requests.html) for the request information. Use Signature Version 4. Format the request as URL-encoded JSON, and set the `subject_token_type` parameter to `urn:ietf:params:aws:token-type:aws4_request`. The following parameters are required: - `url`: The URL of the AWS STS endpoint for `GetCallerIdentity()`, such as `https://sts.amazonaws.com?Action=GetCallerIdentity&Version=2011-06-15`. Regional endpoints are also supported. - `method`: The HTTP request method: `POST`. - `headers`: The HTTP request headers, which must include: - `Authorization`: The request signature. - `x-amz-date`: The time you will send the request, formatted as an [ISO8601 Basic](https://docs.aws.amazon.com/general/latest/gr/sigv4_elements.html#sigv4_elements_date) string. This value is typically set to the current time and is used to help prevent replay attacks. - `host`: The hostname of the `url` field; for example, `sts.amazonaws.com`. - `x-goog-cloud-target-resource`: The full, canonical resource name of the workload identity pool provider, with or without an `https:` prefix. To help ensure data integrity, we recommend including this header in the `SignedHeaders` field of the signed request. For example: //iam.googleapis.com/projects//locations/global/workloadIdentityPools//providers/ https://iam.googleapis.com/projects//locations/global/workloadIdentityPools//providers/ If you are using temporary security credentials provided by AWS, you must also include the header `x-amz-security-token`, with the value set to the session token. The following example shows a `GetCallerIdentity` token: ``` { "headers": [ {"key": "x-amz-date", "value": "20200815T015049Z"\}, {"key": "Authorization", "value": "AWS4-HMAC-SHA256+Credential=$credential,+SignedHeaders=host;x-amz-date;x-goog-cloud-target-resource,+Signature=$signature"\}, {"key": "x-goog-cloud-target-resource", "value": "//iam.googleapis.com/projects//locations/global/workloadIdentityPools//providers/"\}, {"key": "host", "value": "sts.amazonaws.com"\} . ], "method": "POST", "url": "https://sts.amazonaws.com?Action=GetCallerIdentity&Version=2011-06-15" \} ``` If the token is a SAML 2.0 assertion, it must use the format defined in [the SAML 2.0 spec](https://www.oasis-open.org/committees/download.php/56776/sstc-saml-core-errata-2.0-wd-07.pdf), and the `subject_token_type` must be `urn:ietf:params:oauth:token-type:saml2`. See [Verification of external credentials](https://cloud.google.com/iam/docs/using-workload-identity-federation#verification_of_external_credentials) for details on how SAML 2.0 assertions are validated during token exchanges. You can also use a Google-issued OAuth 2.0 access token with this field to obtain an access token with new security attributes applied, such as a Credential Access Boundary. In this case, set `subject_token_type` to `urn:ietf:params:oauth:token-type:access_token`. If an access token already contains security attributes, you cannot apply additional security attributes.
          */
         subjectToken?: string | null;
         /**
@@ -257,7 +257,7 @@ export declare namespace sts_v1 {
          */
         sub?: string | null;
         /**
-         * The human-readable identifier for the token principal subject. For example, if the provided token is associated with a workload identity pool, this field contains a value in the following format: `principal://iam.googleapis.com/projects//locations/global/workloadIdentityPools//subject/`
+         * The human-readable identifier for the token principal subject. For example, if the provided token is associated with a workload identity pool, this field contains a value in the following format: `principal://iam.googleapis.com/projects//locations/global/workloadIdentityPools//subject/`. If the provided token is associated with a workforce pool, this field contains a value in the following format: `principal://iam.googleapis.com/locations/global/workforcePools//subject/`.
          */
         username?: string | null;
     }
@@ -372,7 +372,7 @@ export declare namespace sts_v1 {
         introspect(params: Params$Resource$V1$Introspect, callback: BodyResponseCallback<Schema$GoogleIdentityStsV1IntrospectTokenResponse>): void;
         introspect(callback: BodyResponseCallback<Schema$GoogleIdentityStsV1IntrospectTokenResponse>): void;
         /**
-         * Exchanges a credential for a Google OAuth 2.0 access token. The token asserts an external identity within an identity pool, or it applies a Credential Access Boundary to a Google access token. When you call this method, do not send the `Authorization` HTTP header in the request. This method does not require the `Authorization` header, and using the header can cause the request to fail.
+         * Exchanges a credential for a Google OAuth 2.0 access token. The token asserts an external identity within an identity pool, or it applies a Credential Access Boundary to a Google access token. Note that workforce pools do not support Credential Access Boundary at the moment. When you call this method, do not send the `Authorization` HTTP header in the request. This method does not require the `Authorization` header, and using the header can cause the request to fail.
          * @example
          * ```js
          * // Before running the sample:

package/build/v1.js

@@ -12,6 +12,7 @@
 // See the License for the specific language governing permissions and
 // limitations under the License.
 Object.defineProperty(exports, "__esModule", { value: true });
+exports.sts_v1 = void 0;
 /* eslint-disable @typescript-eslint/no-explicit-any */
 /* eslint-disable @typescript-eslint/no-unused-vars */
 /* eslint-disable @typescript-eslint/no-empty-interface */
@@ -69,10 +70,10 @@ var sts_v1;
                 context: this.context,
             };
             if (callback) {
-                googleapis_common_1.createAPIRequest(parameters, callback);
+                (0, googleapis_common_1.createAPIRequest)(parameters, callback);
             }
             else {
-                return googleapis_common_1.createAPIRequest(parameters);
+                return (0, googleapis_common_1.createAPIRequest)(parameters);
             }
         }
         token(paramsOrCallback, optionsOrCallback, callback) {
@@ -99,10 +100,10 @@ var sts_v1;
                 context: this.context,
             };
             if (callback) {
-                googleapis_common_1.createAPIRequest(parameters, callback);
+                (0, googleapis_common_1.createAPIRequest)(parameters, callback);
             }
             else {
-                return googleapis_common_1.createAPIRequest(parameters);
+                return (0, googleapis_common_1.createAPIRequest)(parameters);
             }
         }
     }

package/build/v1.js.map

@@ -1 +1 @@
-{"version":3,"file":"v1.js","sourceRoot":"","sources":["../v1.ts"],"names":[],"mappings":";AAAA,4BAA4B;AAC5B,kEAAkE;AAClE,mEAAmE;AACnE,0CAA0C;AAC1C,EAAE;AACF,gDAAgD;AAChD,EAAE;AACF,sEAAsE;AACtE,oEAAoE;AACpE,2EAA2E;AAC3E,sEAAsE;AACtE,iCAAiC;;AAEjC,uDAAuD;AACvD,sDAAsD;AACtD,0DAA0D;AAC1D,oDAAoD;AACpD,4CAA4C;AAE5C,yDAe2B;AAG3B,IAAiB,MAAM,CAwnBtB;AAxnBD,WAAiB,MAAM;IAgErB;;;;;;;;;;OAUG;IACH,MAAa,GAAG;QAId,YAAY,OAAsB,EAAE,MAA2B;YAC7D,IAAI,CAAC,OAAO,GAAG;gBACb,QAAQ,EAAE,OAAO,IAAI,EAAE;gBACvB,MAAM;aACP,CAAC;YAEF,IAAI,CAAC,EAAE,GAAG,IAAI,WAAW,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QAC1C,CAAC;KACF;IAZY,UAAG,MAYf,CAAA;IAuOD,MAAa,WAAW;QAEtB,YAAY,OAA0B;YACpC,IAAI,CAAC,OAAO,GAAG,OAAO,CAAC;QACzB,CAAC;QA4FD,UAAU,CACR,gBAGkC,EAClC,iBAIkC,EAClC,QAEkC;YAKlC,IAAI,MAAM,GAAG,CAAC,gBAAgB,IAAI,EAAE,CAAkC,CAAC;YACvE,IAAI,OAAO,GAAG,CAAC,iBAAiB,IAAI,EAAE,CAAkB,CAAC;YAEzD,IAAI,OAAO,gBAAgB,KAAK,UAAU,EAAE;gBAC1C,QAAQ,GAAG,gBAAgB,CAAC;gBAC5B,MAAM,GAAG,EAAmC,CAAC;gBAC7C,OAAO,GAAG,EAAE,CAAC;aACd;YAED,IAAI,OAAO,iBAAiB,KAAK,UAAU,EAAE;gBAC3C,QAAQ,GAAG,iBAAiB,CAAC;gBAC7B,OAAO,GAAG,EAAE,CAAC;aACd;YAED,MAAM,OAAO,GAAG,OAAO,CAAC,OAAO,IAAI,6BAA6B,CAAC;YACjE,MAAM,UAAU,GAAG;gBACjB,OAAO,EAAE,MAAM,CAAC,MAAM,CACpB;oBACE,GAAG,EAAE,CAAC,OAAO,GAAG,gBAAgB,CAAC,CAAC,OAAO,CAAC,cAAc,EAAE,IAAI,CAAC;oBAC/D,MAAM,EAAE,MAAM;iBACf,EACD,OAAO,CACR;gBACD,MAAM;gBACN,cAAc,EAAE,EAAE;gBAClB,UAAU,EAAE,EAAE;gBACd,OAAO,EAAE,IAAI,CAAC,OAAO;aACtB,CAAC;YACF,IAAI,QAAQ,EAAE;gBACZ,oCAAgB,CACd,UAAU,EACV,QAAyC,CAC1C,CAAC;aACH;iBAAM;gBACL,OAAO,oCAAgB,CACrB,UAAU,CACX,CAAC;aACH;QACH,CAAC;QA6FD,KAAK,CACH,gBAGkC,EAClC,iBAIkC,EAClC,QAEkC;YAKlC,IAAI,MAAM,GAAG,CAAC,gBAAgB,IAAI,EAAE,CAA6B,CAAC;YAClE,IAAI,OAAO,GAAG,CAAC,iBAAiB,IAAI,EAAE,CAAkB,CAAC;YAEzD,IAAI,OAAO,gBAAgB,KAAK,UAAU,EAAE;gBAC1C,QAAQ,GAAG,gBAAgB,CAAC;gBAC5B,MAAM,GAAG,EAA8B,CAAC;gBACxC,OAAO,GAAG,EAAE,CAAC;aACd;YAED,IAAI,OAAO,iBAAiB,KAAK,UAAU,EAAE;gBAC3C,QAAQ,GAAG,iBAAiB,CAAC;gBAC7B,OAAO,GAAG,EAAE,CAAC;aACd;YAED,MAAM,OAAO,GAAG,OAAO,CAAC,OAAO,IAAI,6BAA6B,CAAC;YACjE,MAAM,UAAU,GAAG;gBACjB,OAAO,EAAE,MAAM,CAAC,MAAM,CACpB;oBACE,GAAG,EAAE,CAAC,OAAO,GAAG,WAAW,CAAC,CAAC,OAAO,CAAC,cAAc,EAAE,IAAI,CAAC;oBAC1D,MAAM,EAAE,MAAM;iBACf,EACD,OAAO,CACR;gBACD,MAAM;gBACN,cAAc,EAAE,EAAE;gBAClB,UAAU,EAAE,EAAE;gBACd,OAAO,EAAE,IAAI,CAAC,OAAO;aACtB,CAAC;YACF,IAAI,QAAQ,EAAE;gBACZ,oCAAgB,CACd,UAAU,EACV,QAAyC,CAC1C,CAAC;aACH;iBAAM;gBACL,OAAO,oCAAgB,CACrB,UAAU,CACX,CAAC;aACH;QACH,CAAC;KACF;IA5SY,kBAAW,cA4SvB,CAAA;AAcH,CAAC,EAxnBgB,MAAM,GAAN,cAAM,KAAN,cAAM,QAwnBtB"}
+{"version":3,"file":"v1.js","sourceRoot":"","sources":["../v1.ts"],"names":[],"mappings":";AAAA,4BAA4B;AAC5B,kEAAkE;AAClE,mEAAmE;AACnE,0CAA0C;AAC1C,EAAE;AACF,gDAAgD;AAChD,EAAE;AACF,sEAAsE;AACtE,oEAAoE;AACpE,2EAA2E;AAC3E,sEAAsE;AACtE,iCAAiC;;;AAEjC,uDAAuD;AACvD,sDAAsD;AACtD,0DAA0D;AAC1D,oDAAoD;AACpD,4CAA4C;AAE5C,yDAe2B;AAG3B,IAAiB,MAAM,CAwnBtB;AAxnBD,WAAiB,MAAM;IAgErB;;;;;;;;;;OAUG;IACH,MAAa,GAAG;QAId,YAAY,OAAsB,EAAE,MAA2B;YAC7D,IAAI,CAAC,OAAO,GAAG;gBACb,QAAQ,EAAE,OAAO,IAAI,EAAE;gBACvB,MAAM;aACP,CAAC;YAEF,IAAI,CAAC,EAAE,GAAG,IAAI,WAAW,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QAC1C,CAAC;KACF;IAZY,UAAG,MAYf,CAAA;IAuOD,MAAa,WAAW;QAEtB,YAAY,OAA0B;YACpC,IAAI,CAAC,OAAO,GAAG,OAAO,CAAC;QACzB,CAAC;QA4FD,UAAU,CACR,gBAGkC,EAClC,iBAIkC,EAClC,QAEkC;YAKlC,IAAI,MAAM,GAAG,CAAC,gBAAgB,IAAI,EAAE,CAAkC,CAAC;YACvE,IAAI,OAAO,GAAG,CAAC,iBAAiB,IAAI,EAAE,CAAkB,CAAC;YAEzD,IAAI,OAAO,gBAAgB,KAAK,UAAU,EAAE;gBAC1C,QAAQ,GAAG,gBAAgB,CAAC;gBAC5B,MAAM,GAAG,EAAmC,CAAC;gBAC7C,OAAO,GAAG,EAAE,CAAC;aACd;YAED,IAAI,OAAO,iBAAiB,KAAK,UAAU,EAAE;gBAC3C,QAAQ,GAAG,iBAAiB,CAAC;gBAC7B,OAAO,GAAG,EAAE,CAAC;aACd;YAED,MAAM,OAAO,GAAG,OAAO,CAAC,OAAO,IAAI,6BAA6B,CAAC;YACjE,MAAM,UAAU,GAAG;gBACjB,OAAO,EAAE,MAAM,CAAC,MAAM,CACpB;oBACE,GAAG,EAAE,CAAC,OAAO,GAAG,gBAAgB,CAAC,CAAC,OAAO,CAAC,cAAc,EAAE,IAAI,CAAC;oBAC/D,MAAM,EAAE,MAAM;iBACf,EACD,OAAO,CACR;gBACD,MAAM;gBACN,cAAc,EAAE,EAAE;gBAClB,UAAU,EAAE,EAAE;gBACd,OAAO,EAAE,IAAI,CAAC,OAAO;aACtB,CAAC;YACF,IAAI,QAAQ,EAAE;gBACZ,IAAA,oCAAgB,EACd,UAAU,EACV,QAAyC,CAC1C,CAAC;aACH;iBAAM;gBACL,OAAO,IAAA,oCAAgB,EACrB,UAAU,CACX,CAAC;aACH;QACH,CAAC;QA6FD,KAAK,CACH,gBAGkC,EAClC,iBAIkC,EAClC,QAEkC;YAKlC,IAAI,MAAM,GAAG,CAAC,gBAAgB,IAAI,EAAE,CAA6B,CAAC;YAClE,IAAI,OAAO,GAAG,CAAC,iBAAiB,IAAI,EAAE,CAAkB,CAAC;YAEzD,IAAI,OAAO,gBAAgB,KAAK,UAAU,EAAE;gBAC1C,QAAQ,GAAG,gBAAgB,CAAC;gBAC5B,MAAM,GAAG,EAA8B,CAAC;gBACxC,OAAO,GAAG,EAAE,CAAC;aACd;YAED,IAAI,OAAO,iBAAiB,KAAK,UAAU,EAAE;gBAC3C,QAAQ,GAAG,iBAAiB,CAAC;gBAC7B,OAAO,GAAG,EAAE,CAAC;aACd;YAED,MAAM,OAAO,GAAG,OAAO,CAAC,OAAO,IAAI,6BAA6B,CAAC;YACjE,MAAM,UAAU,GAAG;gBACjB,OAAO,EAAE,MAAM,CAAC,MAAM,CACpB;oBACE,GAAG,EAAE,CAAC,OAAO,GAAG,WAAW,CAAC,CAAC,OAAO,CAAC,cAAc,EAAE,IAAI,CAAC;oBAC1D,MAAM,EAAE,MAAM;iBACf,EACD,OAAO,CACR;gBACD,MAAM;gBACN,cAAc,EAAE,EAAE;gBAClB,UAAU,EAAE,EAAE;gBACd,OAAO,EAAE,IAAI,CAAC,OAAO;aACtB,CAAC;YACF,IAAI,QAAQ,EAAE;gBACZ,IAAA,oCAAgB,EACd,UAAU,EACV,QAAyC,CAC1C,CAAC;aACH;iBAAM;gBACL,OAAO,IAAA,oCAAgB,EACrB,UAAU,CACX,CAAC;aACH;QACH,CAAC;KACF;IA5SY,kBAAW,cA4SvB,CAAA;AAcH,CAAC,EAxnBgB,MAAM,GAAN,cAAM,KAAN,cAAM,QAwnBtB"}

package/build/v1beta.d.ts

@@ -80,7 +80,7 @@ export declare namespace sts_v1beta {
          */
         condition?: Schema$GoogleTypeExpr;
         /**
-         * Specifies the principals requesting access for a Google Cloud resource. `members` can have the following values: * `allUsers`: A special identifier that represents anyone who is on the internet; with or without a Google account. * `allAuthenticatedUsers`: A special identifier that represents anyone who is authenticated with a Google account or a service account. * `user:{emailid\}`: An email address that represents a specific Google account. For example, `alice@example.com` . * `serviceAccount:{emailid\}`: An email address that represents a service account. For example, `my-other-app@appspot.gserviceaccount.com`. * `group:{emailid\}`: An email address that represents a Google group. For example, `admins@example.com`. * `deleted:user:{emailid\}?uid={uniqueid\}`: An email address (plus unique identifier) representing a user that has been recently deleted. For example, `alice@example.com?uid=123456789012345678901`. If the user is recovered, this value reverts to `user:{emailid\}` and the recovered user retains the role in the binding. * `deleted:serviceAccount:{emailid\}?uid={uniqueid\}`: An email address (plus unique identifier) representing a service account that has been recently deleted. For example, `my-other-app@appspot.gserviceaccount.com?uid=123456789012345678901`. If the service account is undeleted, this value reverts to `serviceAccount:{emailid\}` and the undeleted service account retains the role in the binding. * `deleted:group:{emailid\}?uid={uniqueid\}`: An email address (plus unique identifier) representing a Google group that has been recently deleted. For example, `admins@example.com?uid=123456789012345678901`. If the group is recovered, this value reverts to `group:{emailid\}` and the recovered group retains the role in the binding. * `domain:{domain\}`: The G Suite domain (primary) that represents all the users of that domain. For example, `google.com` or `example.com`.
+         * Specifies the principals requesting access for a Google Cloud resource. `members` can have the following values: * `allUsers`: A special identifier that represents anyone who is on the internet; with or without a Google account. * `allAuthenticatedUsers`: A special identifier that represents anyone who is authenticated with a Google account or a service account. Does not include identities that come from external identity providers (IdPs) through identity federation. * `user:{emailid\}`: An email address that represents a specific Google account. For example, `alice@example.com` . * `serviceAccount:{emailid\}`: An email address that represents a Google service account. For example, `my-other-app@appspot.gserviceaccount.com`. * `serviceAccount:{projectid\}.svc.id.goog[{namespace\}/{kubernetes-sa\}]`: An identifier for a [Kubernetes service account](https://cloud.google.com/kubernetes-engine/docs/how-to/kubernetes-service-accounts). For example, `my-project.svc.id.goog[my-namespace/my-kubernetes-sa]`. * `group:{emailid\}`: An email address that represents a Google group. For example, `admins@example.com`. * `deleted:user:{emailid\}?uid={uniqueid\}`: An email address (plus unique identifier) representing a user that has been recently deleted. For example, `alice@example.com?uid=123456789012345678901`. If the user is recovered, this value reverts to `user:{emailid\}` and the recovered user retains the role in the binding. * `deleted:serviceAccount:{emailid\}?uid={uniqueid\}`: An email address (plus unique identifier) representing a service account that has been recently deleted. For example, `my-other-app@appspot.gserviceaccount.com?uid=123456789012345678901`. If the service account is undeleted, this value reverts to `serviceAccount:{emailid\}` and the undeleted service account retains the role in the binding. * `deleted:group:{emailid\}?uid={uniqueid\}`: An email address (plus unique identifier) representing a Google group that has been recently deleted. For example, `admins@example.com?uid=123456789012345678901`. If the group is recovered, this value reverts to `group:{emailid\}` and the recovered group retains the role in the binding. * `domain:{domain\}`: The G Suite domain (primary) that represents all the users of that domain. For example, `google.com` or `example.com`.
          */
         members?: string[] | null;
         /**
@@ -153,7 +153,7 @@ export declare namespace sts_v1beta {
          */
         grantType?: string | null;
         /**
-         * A set of features that Security Token Service supports, in addition to the standard OAuth 2.0 token exchange, formatted as a serialized JSON object of Options.
+         * A set of features that Security Token Service supports, in addition to the standard OAuth 2.0 token exchange, formatted as a serialized JSON object of Options. The size of the parameter value must not exceed 4096 characters.
          */
         options?: string | null;
         /**

package/build/v1beta.js

@@ -12,6 +12,7 @@
 // See the License for the specific language governing permissions and
 // limitations under the License.
 Object.defineProperty(exports, "__esModule", { value: true });
+exports.sts_v1beta = void 0;
 /* eslint-disable @typescript-eslint/no-explicit-any */
 /* eslint-disable @typescript-eslint/no-unused-vars */
 /* eslint-disable @typescript-eslint/no-empty-interface */
@@ -69,10 +70,10 @@ var sts_v1beta;
                 context: this.context,
             };
             if (callback) {
-                googleapis_common_1.createAPIRequest(parameters, callback);
+                (0, googleapis_common_1.createAPIRequest)(parameters, callback);
             }
             else {
-                return googleapis_common_1.createAPIRequest(parameters);
+                return (0, googleapis_common_1.createAPIRequest)(parameters);
             }
         }
     }

package/build/v1beta.js.map

@@ -1 +1 @@
-{"version":3,"file":"v1beta.js","sourceRoot":"","sources":["../v1beta.ts"],"names":[],"mappings":";AAAA,4BAA4B;AAC5B,kEAAkE;AAClE,mEAAmE;AACnE,0CAA0C;AAC1C,EAAE;AACF,gDAAgD;AAChD,EAAE;AACF,sEAAsE;AACtE,oEAAoE;AACpE,2EAA2E;AAC3E,sEAAsE;AACtE,iCAAiC;;AAEjC,uDAAuD;AACvD,sDAAsD;AACtD,0DAA0D;AAC1D,oDAAoD;AACpD,4CAA4C;AAE5C,yDAe2B;AAG3B,IAAiB,UAAU,CA6a1B;AA7aD,WAAiB,UAAU;IAgEzB;;;;;;;;;;OAUG;IACH,MAAa,GAAG;QAId,YAAY,OAAsB,EAAE,MAA2B;YAC7D,IAAI,CAAC,OAAO,GAAG;gBACb,QAAQ,EAAE,OAAO,IAAI,EAAE;gBACvB,MAAM;aACP,CAAC;YAEF,IAAI,CAAC,MAAM,GAAG,IAAI,eAAe,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QAClD,CAAC;KACF;IAZY,cAAG,MAYf,CAAA;IAqLD,MAAa,eAAe;QAE1B,YAAY,OAA0B;YACpC,IAAI,CAAC,OAAO,GAAG,OAAO,CAAC;QACzB,CAAC;QA6FD,KAAK,CACH,gBAGkC,EAClC,iBAIkC,EAClC,QAEkC;YAKlC,IAAI,MAAM,GAAG,CAAC,gBAAgB,IAAI,EAAE,CAAiC,CAAC;YACtE,IAAI,OAAO,GAAG,CAAC,iBAAiB,IAAI,EAAE,CAAkB,CAAC;YAEzD,IAAI,OAAO,gBAAgB,KAAK,UAAU,EAAE;gBAC1C,QAAQ,GAAG,gBAAgB,CAAC;gBAC5B,MAAM,GAAG,EAAkC,CAAC;gBAC5C,OAAO,GAAG,EAAE,CAAC;aACd;YAED,IAAI,OAAO,iBAAiB,KAAK,UAAU,EAAE;gBAC3C,QAAQ,GAAG,iBAAiB,CAAC;gBAC7B,OAAO,GAAG,EAAE,CAAC;aACd;YAED,MAAM,OAAO,GAAG,OAAO,CAAC,OAAO,IAAI,6BAA6B,CAAC;YACjE,MAAM,UAAU,GAAG;gBACjB,OAAO,EAAE,MAAM,CAAC,MAAM,CACpB;oBACE,GAAG,EAAE,CAAC,OAAO,GAAG,eAAe,CAAC,CAAC,OAAO,CAAC,cAAc,EAAE,IAAI,CAAC;oBAC9D,MAAM,EAAE,MAAM;iBACf,EACD,OAAO,CACR;gBACD,MAAM;gBACN,cAAc,EAAE,EAAE;gBAClB,UAAU,EAAE,EAAE;gBACd,OAAO,EAAE,IAAI,CAAC,OAAO;aACtB,CAAC;YACF,IAAI,QAAQ,EAAE;gBACZ,oCAAgB,CACd,UAAU,EACV,QAAyC,CAC1C,CAAC;aACH;iBAAM;gBACL,OAAO,oCAAgB,CACrB,UAAU,CACX,CAAC;aACH;QACH,CAAC;KACF;IAzJY,0BAAe,kBAyJ3B,CAAA;AAQH,CAAC,EA7agB,UAAU,GAAV,kBAAU,KAAV,kBAAU,QA6a1B"}
+{"version":3,"file":"v1beta.js","sourceRoot":"","sources":["../v1beta.ts"],"names":[],"mappings":";AAAA,4BAA4B;AAC5B,kEAAkE;AAClE,mEAAmE;AACnE,0CAA0C;AAC1C,EAAE;AACF,gDAAgD;AAChD,EAAE;AACF,sEAAsE;AACtE,oEAAoE;AACpE,2EAA2E;AAC3E,sEAAsE;AACtE,iCAAiC;;;AAEjC,uDAAuD;AACvD,sDAAsD;AACtD,0DAA0D;AAC1D,oDAAoD;AACpD,4CAA4C;AAE5C,yDAe2B;AAG3B,IAAiB,UAAU,CA6a1B;AA7aD,WAAiB,UAAU;IAgEzB;;;;;;;;;;OAUG;IACH,MAAa,GAAG;QAId,YAAY,OAAsB,EAAE,MAA2B;YAC7D,IAAI,CAAC,OAAO,GAAG;gBACb,QAAQ,EAAE,OAAO,IAAI,EAAE;gBACvB,MAAM;aACP,CAAC;YAEF,IAAI,CAAC,MAAM,GAAG,IAAI,eAAe,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QAClD,CAAC;KACF;IAZY,cAAG,MAYf,CAAA;IAqLD,MAAa,eAAe;QAE1B,YAAY,OAA0B;YACpC,IAAI,CAAC,OAAO,GAAG,OAAO,CAAC;QACzB,CAAC;QA6FD,KAAK,CACH,gBAGkC,EAClC,iBAIkC,EAClC,QAEkC;YAKlC,IAAI,MAAM,GAAG,CAAC,gBAAgB,IAAI,EAAE,CAAiC,CAAC;YACtE,IAAI,OAAO,GAAG,CAAC,iBAAiB,IAAI,EAAE,CAAkB,CAAC;YAEzD,IAAI,OAAO,gBAAgB,KAAK,UAAU,EAAE;gBAC1C,QAAQ,GAAG,gBAAgB,CAAC;gBAC5B,MAAM,GAAG,EAAkC,CAAC;gBAC5C,OAAO,GAAG,EAAE,CAAC;aACd;YAED,IAAI,OAAO,iBAAiB,KAAK,UAAU,EAAE;gBAC3C,QAAQ,GAAG,iBAAiB,CAAC;gBAC7B,OAAO,GAAG,EAAE,CAAC;aACd;YAED,MAAM,OAAO,GAAG,OAAO,CAAC,OAAO,IAAI,6BAA6B,CAAC;YACjE,MAAM,UAAU,GAAG;gBACjB,OAAO,EAAE,MAAM,CAAC,MAAM,CACpB;oBACE,GAAG,EAAE,CAAC,OAAO,GAAG,eAAe,CAAC,CAAC,OAAO,CAAC,cAAc,EAAE,IAAI,CAAC;oBAC9D,MAAM,EAAE,MAAM;iBACf,EACD,OAAO,CACR;gBACD,MAAM;gBACN,cAAc,EAAE,EAAE;gBAClB,UAAU,EAAE,EAAE;gBACd,OAAO,EAAE,IAAI,CAAC,OAAO;aACtB,CAAC;YACF,IAAI,QAAQ,EAAE;gBACZ,IAAA,oCAAgB,EACd,UAAU,EACV,QAAyC,CAC1C,CAAC;aACH;iBAAM;gBACL,OAAO,IAAA,oCAAgB,EACrB,UAAU,CACX,CAAC;aACH;QACH,CAAC;KACF;IAzJY,0BAAe,kBAyJ3B,CAAA;AAQH,CAAC,EA7agB,UAAU,GAAV,kBAAU,KAAV,kBAAU,QA6a1B"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@googleapis/sts",
-  "version": "2.1.5",
+  "version": "3.0.0",
   "description": "sts",
   "main": "build/index.js",
   "types": "build/index.d.ts",
@@ -18,7 +18,7 @@
     "url": "https://github.com/googleapis/google-api-nodejs-client.git"
   },
   "engines": {
-    "node": ">=10.0.0"
+    "node": ">=12.0.0"
   },
   "scripts": {
     "fix": "gts fix",
@@ -28,15 +28,15 @@
     "webpack": "webpack"
   },
   "dependencies": {
-    "googleapis-common": "^5.0.1"
+    "googleapis-common": "^6.0.3"
   },
   "devDependencies": {
     "@microsoft/api-documenter": "^7.8.10",
     "@microsoft/api-extractor": "^7.8.10",
-    "gts": "^2.0.0",
+    "gts": "^3.1.1",
     "null-loader": "^4.0.0",
     "ts-loader": "^9.0.0",
-    "typescript": "~3.7.0",
+    "typescript": "~4.8.4",
     "webpack": "^5.0.0",
     "webpack-cli": "^4.0.0"
   }

package/v1.ts

@@ -133,7 +133,7 @@ export namespace sts_v1 {
      */
     condition?: Schema$GoogleTypeExpr;
     /**
-     * Specifies the principals requesting access for a Google Cloud resource. `members` can have the following values: * `allUsers`: A special identifier that represents anyone who is on the internet; with or without a Google account. * `allAuthenticatedUsers`: A special identifier that represents anyone who is authenticated with a Google account or a service account. * `user:{emailid\}`: An email address that represents a specific Google account. For example, `alice@example.com` . * `serviceAccount:{emailid\}`: An email address that represents a service account. For example, `my-other-app@appspot.gserviceaccount.com`. * `group:{emailid\}`: An email address that represents a Google group. For example, `admins@example.com`. * `deleted:user:{emailid\}?uid={uniqueid\}`: An email address (plus unique identifier) representing a user that has been recently deleted. For example, `alice@example.com?uid=123456789012345678901`. If the user is recovered, this value reverts to `user:{emailid\}` and the recovered user retains the role in the binding. * `deleted:serviceAccount:{emailid\}?uid={uniqueid\}`: An email address (plus unique identifier) representing a service account that has been recently deleted. For example, `my-other-app@appspot.gserviceaccount.com?uid=123456789012345678901`. If the service account is undeleted, this value reverts to `serviceAccount:{emailid\}` and the undeleted service account retains the role in the binding. * `deleted:group:{emailid\}?uid={uniqueid\}`: An email address (plus unique identifier) representing a Google group that has been recently deleted. For example, `admins@example.com?uid=123456789012345678901`. If the group is recovered, this value reverts to `group:{emailid\}` and the recovered group retains the role in the binding. * `domain:{domain\}`: The G Suite domain (primary) that represents all the users of that domain. For example, `google.com` or `example.com`.
+     * Specifies the principals requesting access for a Google Cloud resource. `members` can have the following values: * `allUsers`: A special identifier that represents anyone who is on the internet; with or without a Google account. * `allAuthenticatedUsers`: A special identifier that represents anyone who is authenticated with a Google account or a service account. Does not include identities that come from external identity providers (IdPs) through identity federation. * `user:{emailid\}`: An email address that represents a specific Google account. For example, `alice@example.com` . * `serviceAccount:{emailid\}`: An email address that represents a Google service account. For example, `my-other-app@appspot.gserviceaccount.com`. * `serviceAccount:{projectid\}.svc.id.goog[{namespace\}/{kubernetes-sa\}]`: An identifier for a [Kubernetes service account](https://cloud.google.com/kubernetes-engine/docs/how-to/kubernetes-service-accounts). For example, `my-project.svc.id.goog[my-namespace/my-kubernetes-sa]`. * `group:{emailid\}`: An email address that represents a Google group. For example, `admins@example.com`. * `deleted:user:{emailid\}?uid={uniqueid\}`: An email address (plus unique identifier) representing a user that has been recently deleted. For example, `alice@example.com?uid=123456789012345678901`. If the user is recovered, this value reverts to `user:{emailid\}` and the recovered user retains the role in the binding. * `deleted:serviceAccount:{emailid\}?uid={uniqueid\}`: An email address (plus unique identifier) representing a service account that has been recently deleted. For example, `my-other-app@appspot.gserviceaccount.com?uid=123456789012345678901`. If the service account is undeleted, this value reverts to `serviceAccount:{emailid\}` and the undeleted service account retains the role in the binding. * `deleted:group:{emailid\}?uid={uniqueid\}`: An email address (plus unique identifier) representing a Google group that has been recently deleted. For example, `admins@example.com?uid=123456789012345678901`. If the group is recovered, this value reverts to `group:{emailid\}` and the recovered group retains the role in the binding. * `domain:{domain\}`: The G Suite domain (primary) that represents all the users of that domain. For example, `google.com` or `example.com`.
      */
     members?: string[] | null;
     /**
@@ -215,7 +215,7 @@ export namespace sts_v1 {
    */
   export interface Schema$GoogleIdentityStsV1ExchangeTokenRequest {
     /**
-     * The full resource name of the identity provider; for example: `//iam.googleapis.com/projects//locations/global/workloadIdentityPools//providers/`. Required when exchanging an external credential for a Google access token.
+     * The full resource name of the identity provider; for example: `//iam.googleapis.com/projects//locations/global/workloadIdentityPools//providers/` for workload identity pool providers, or `//iam.googleapis.com/locations/global/workforcePools//providers/` for workforce pool providers. Required when exchanging an external credential for a Google access token.
      */
     audience?: string | null;
     /**
@@ -223,7 +223,7 @@ export namespace sts_v1 {
      */
     grantType?: string | null;
     /**
-     * A set of features that Security Token Service supports, in addition to the standard OAuth 2.0 token exchange, formatted as a serialized JSON object of Options.
+     * A set of features that Security Token Service supports, in addition to the standard OAuth 2.0 token exchange, formatted as a serialized JSON object of Options. The size of the parameter value must not exceed 4096 characters.
      */
     options?: string | null;
     /**
@@ -235,7 +235,7 @@ export namespace sts_v1 {
      */
     scope?: string | null;
     /**
-     * Required. The input token. This token is either an external credential issued by a workload identity pool provider, or a short-lived access token issued by Google. If the token is an OIDC JWT, it must use the JWT format defined in [RFC 7523](https://tools.ietf.org/html/rfc7523), and the `subject_token_type` must be either `urn:ietf:params:oauth:token-type:jwt` or `urn:ietf:params:oauth:token-type:id_token`. The following headers are required: - `kid`: The identifier of the signing key securing the JWT. - `alg`: The cryptographic algorithm securing the JWT. Must be `RS256` or `ES256`. The following payload fields are required. For more information, see [RFC 7523, Section 3](https://tools.ietf.org/html/rfc7523#section-3): - `iss`: The issuer of the token. The issuer must provide a discovery document at the URL `/.well-known/openid-configuration`, where `` is the value of this field. The document must be formatted according to section 4.2 of the [OIDC 1.0 Discovery specification](https://openid.net/specs/openid-connect-discovery-1_0.html#ProviderConfigurationResponse). - `iat`: The issue time, in seconds, since the Unix epoch. Must be in the past. - `exp`: The expiration time, in seconds, since the Unix epoch. Must be less than 48 hours after `iat`. Shorter expiration times are more secure. If possible, we recommend setting an expiration time less than 6 hours. - `sub`: The identity asserted in the JWT. - `aud`: For workload identity pools, this must be a value specified in the allowed audiences for the workload identity pool provider, or one of the audiences allowed by default if no audiences were specified. See https://cloud.google.com/iam/docs/reference/rest/v1/projects.locations.workloadIdentityPools.providers#oidc Example header: ``` { "alg": "RS256", "kid": "us-east-11" \} ``` Example payload: ``` { "iss": "https://accounts.google.com", "iat": 1517963104, "exp": 1517966704, "aud": "//iam.googleapis.com/projects/1234567890123/locations/global/workloadIdentityPools/my-pool/providers/my-provider", "sub": "113475438248934895348", "my_claims": { "additional_claim": "value" \} \} ``` If `subject_token` is for AWS, it must be a serialized `GetCallerIdentity` token. This token contains the same information as a request to the AWS [`GetCallerIdentity()`](https://docs.aws.amazon.com/STS/latest/APIReference/API_GetCallerIdentity) method, as well as the AWS [signature](https://docs.aws.amazon.com/general/latest/gr/signing_aws_api_requests.html) for the request information. Use Signature Version 4. Format the request as URL-encoded JSON, and set the `subject_token_type` parameter to `urn:ietf:params:aws:token-type:aws4_request`. The following parameters are required: - `url`: The URL of the AWS STS endpoint for `GetCallerIdentity()`, such as `https://sts.amazonaws.com?Action=GetCallerIdentity&Version=2011-06-15`. Regional endpoints are also supported. - `method`: The HTTP request method: `POST`. - `headers`: The HTTP request headers, which must include: - `Authorization`: The request signature. - `x-amz-date`: The time you will send the request, formatted as an [ISO8601 Basic](https://docs.aws.amazon.com/general/latest/gr/sigv4_elements.html#sigv4_elements_date) string. This value is typically set to the current time and is used to help prevent replay attacks. - `host`: The hostname of the `url` field; for example, `sts.amazonaws.com`. - `x-goog-cloud-target-resource`: The full, canonical resource name of the workload identity pool provider, with or without an `https:` prefix. To help ensure data integrity, we recommend including this header in the `SignedHeaders` field of the signed request. For example: //iam.googleapis.com/projects//locations/global/workloadIdentityPools//providers/ https://iam.googleapis.com/projects//locations/global/workloadIdentityPools//providers/ If you are using temporary security credentials provided by AWS, you must also include the header `x-amz-security-token`, with the value set to the session token. The following example shows a `GetCallerIdentity` token: ``` { "headers": [ {"key": "x-amz-date", "value": "20200815T015049Z"\}, {"key": "Authorization", "value": "AWS4-HMAC-SHA256+Credential=$credential,+SignedHeaders=host;x-amz-date;x-goog-cloud-target-resource,+Signature=$signature"\}, {"key": "x-goog-cloud-target-resource", "value": "//iam.googleapis.com/projects//locations/global/workloadIdentityPools//providers/"\}, {"key": "host", "value": "sts.amazonaws.com"\} . ], "method": "POST", "url": "https://sts.amazonaws.com?Action=GetCallerIdentity&Version=2011-06-15" \} ``` If the token is a SAML 2.0 assertion, it must use the format defined in [the SAML 2.0 spec](https://www.oasis-open.org/committees/download.php/56776/sstc-saml-core-errata-2.0-wd-07.pdf), and the `subject_token_type` must be `urn:ietf:params:oauth:token-type:saml2`. See [Verification of external credentials](https://cloud.google.com/iam/docs/using-workload-identity-federation#verification_of_external_credentials) for details on how SAML 2.0 assertions are validated during token exchanges. You can also use a Google-issued OAuth 2.0 access token with this field to obtain an access token with new security attributes applied, such as a Credential Access Boundary. In this case, set `subject_token_type` to `urn:ietf:params:oauth:token-type:access_token`. If an access token already contains security attributes, you cannot apply additional security attributes.
+     * Required. The input token. This token is either an external credential issued by a workload identity pool provider, or a short-lived access token issued by Google. If the token is an OIDC JWT, it must use the JWT format defined in [RFC 7523](https://tools.ietf.org/html/rfc7523), and the `subject_token_type` must be either `urn:ietf:params:oauth:token-type:jwt` or `urn:ietf:params:oauth:token-type:id_token`. The following headers are required: - `kid`: The identifier of the signing key securing the JWT. - `alg`: The cryptographic algorithm securing the JWT. Must be `RS256` or `ES256`. The following payload fields are required. For more information, see [RFC 7523, Section 3](https://tools.ietf.org/html/rfc7523#section-3): - `iss`: The issuer of the token. The issuer must provide a discovery document at the URL `/.well-known/openid-configuration`, where `` is the value of this field. The document must be formatted according to section 4.2 of the [OIDC 1.0 Discovery specification](https://openid.net/specs/openid-connect-discovery-1_0.html#ProviderConfigurationResponse). - `iat`: The issue time, in seconds, since the Unix epoch. Must be in the past. - `exp`: The expiration time, in seconds, since the Unix epoch. Must be less than 48 hours after `iat`. Shorter expiration times are more secure. If possible, we recommend setting an expiration time less than 6 hours. - `sub`: The identity asserted in the JWT. - `aud`: For workload identity pools, this must be a value specified in the allowed audiences for the workload identity pool provider, or one of the audiences allowed by default if no audiences were specified. See https://cloud.google.com/iam/docs/reference/rest/v1/projects.locations.workloadIdentityPools.providers#oidc. For workforce pools, this must match the client ID specified in the provider configuration. See https://cloud.google.com/iam/docs/reference/rest/v1/locations.workforcePools.providers#oidc. Example header: ``` { "alg": "RS256", "kid": "us-east-11" \} ``` Example payload: ``` { "iss": "https://accounts.google.com", "iat": 1517963104, "exp": 1517966704, "aud": "//iam.googleapis.com/projects/1234567890123/locations/global/workloadIdentityPools/my-pool/providers/my-provider", "sub": "113475438248934895348", "my_claims": { "additional_claim": "value" \} \} ``` If `subject_token` is for AWS, it must be a serialized `GetCallerIdentity` token. This token contains the same information as a request to the AWS [`GetCallerIdentity()`](https://docs.aws.amazon.com/STS/latest/APIReference/API_GetCallerIdentity) method, as well as the AWS [signature](https://docs.aws.amazon.com/general/latest/gr/signing_aws_api_requests.html) for the request information. Use Signature Version 4. Format the request as URL-encoded JSON, and set the `subject_token_type` parameter to `urn:ietf:params:aws:token-type:aws4_request`. The following parameters are required: - `url`: The URL of the AWS STS endpoint for `GetCallerIdentity()`, such as `https://sts.amazonaws.com?Action=GetCallerIdentity&Version=2011-06-15`. Regional endpoints are also supported. - `method`: The HTTP request method: `POST`. - `headers`: The HTTP request headers, which must include: - `Authorization`: The request signature. - `x-amz-date`: The time you will send the request, formatted as an [ISO8601 Basic](https://docs.aws.amazon.com/general/latest/gr/sigv4_elements.html#sigv4_elements_date) string. This value is typically set to the current time and is used to help prevent replay attacks. - `host`: The hostname of the `url` field; for example, `sts.amazonaws.com`. - `x-goog-cloud-target-resource`: The full, canonical resource name of the workload identity pool provider, with or without an `https:` prefix. To help ensure data integrity, we recommend including this header in the `SignedHeaders` field of the signed request. For example: //iam.googleapis.com/projects//locations/global/workloadIdentityPools//providers/ https://iam.googleapis.com/projects//locations/global/workloadIdentityPools//providers/ If you are using temporary security credentials provided by AWS, you must also include the header `x-amz-security-token`, with the value set to the session token. The following example shows a `GetCallerIdentity` token: ``` { "headers": [ {"key": "x-amz-date", "value": "20200815T015049Z"\}, {"key": "Authorization", "value": "AWS4-HMAC-SHA256+Credential=$credential,+SignedHeaders=host;x-amz-date;x-goog-cloud-target-resource,+Signature=$signature"\}, {"key": "x-goog-cloud-target-resource", "value": "//iam.googleapis.com/projects//locations/global/workloadIdentityPools//providers/"\}, {"key": "host", "value": "sts.amazonaws.com"\} . ], "method": "POST", "url": "https://sts.amazonaws.com?Action=GetCallerIdentity&Version=2011-06-15" \} ``` If the token is a SAML 2.0 assertion, it must use the format defined in [the SAML 2.0 spec](https://www.oasis-open.org/committees/download.php/56776/sstc-saml-core-errata-2.0-wd-07.pdf), and the `subject_token_type` must be `urn:ietf:params:oauth:token-type:saml2`. See [Verification of external credentials](https://cloud.google.com/iam/docs/using-workload-identity-federation#verification_of_external_credentials) for details on how SAML 2.0 assertions are validated during token exchanges. You can also use a Google-issued OAuth 2.0 access token with this field to obtain an access token with new security attributes applied, such as a Credential Access Boundary. In this case, set `subject_token_type` to `urn:ietf:params:oauth:token-type:access_token`. If an access token already contains security attributes, you cannot apply additional security attributes.
      */
     subjectToken?: string | null;
     /**
@@ -310,7 +310,7 @@ export namespace sts_v1 {
      */
     sub?: string | null;
     /**
-     * The human-readable identifier for the token principal subject. For example, if the provided token is associated with a workload identity pool, this field contains a value in the following format: `principal://iam.googleapis.com/projects//locations/global/workloadIdentityPools//subject/`
+     * The human-readable identifier for the token principal subject. For example, if the provided token is associated with a workload identity pool, this field contains a value in the following format: `principal://iam.googleapis.com/projects//locations/global/workloadIdentityPools//subject/`. If the provided token is associated with a workforce pool, this field contains a value in the following format: `principal://iam.googleapis.com/locations/global/workforcePools//subject/`.
      */
     username?: string | null;
   }
@@ -507,7 +507,7 @@ export namespace sts_v1 {
     }
 
     /**
-     * Exchanges a credential for a Google OAuth 2.0 access token. The token asserts an external identity within an identity pool, or it applies a Credential Access Boundary to a Google access token. When you call this method, do not send the `Authorization` HTTP header in the request. This method does not require the `Authorization` header, and using the header can cause the request to fail.
+     * Exchanges a credential for a Google OAuth 2.0 access token. The token asserts an external identity within an identity pool, or it applies a Credential Access Boundary to a Google access token. Note that workforce pools do not support Credential Access Boundary at the moment. When you call this method, do not send the `Authorization` HTTP header in the request. This method does not require the `Authorization` header, and using the header can cause the request to fail.
      * @example
      * ```js
      * // Before running the sample:

package/v1beta.ts

@@ -133,7 +133,7 @@ export namespace sts_v1beta {
      */
     condition?: Schema$GoogleTypeExpr;
     /**
-     * Specifies the principals requesting access for a Google Cloud resource. `members` can have the following values: * `allUsers`: A special identifier that represents anyone who is on the internet; with or without a Google account. * `allAuthenticatedUsers`: A special identifier that represents anyone who is authenticated with a Google account or a service account. * `user:{emailid\}`: An email address that represents a specific Google account. For example, `alice@example.com` . * `serviceAccount:{emailid\}`: An email address that represents a service account. For example, `my-other-app@appspot.gserviceaccount.com`. * `group:{emailid\}`: An email address that represents a Google group. For example, `admins@example.com`. * `deleted:user:{emailid\}?uid={uniqueid\}`: An email address (plus unique identifier) representing a user that has been recently deleted. For example, `alice@example.com?uid=123456789012345678901`. If the user is recovered, this value reverts to `user:{emailid\}` and the recovered user retains the role in the binding. * `deleted:serviceAccount:{emailid\}?uid={uniqueid\}`: An email address (plus unique identifier) representing a service account that has been recently deleted. For example, `my-other-app@appspot.gserviceaccount.com?uid=123456789012345678901`. If the service account is undeleted, this value reverts to `serviceAccount:{emailid\}` and the undeleted service account retains the role in the binding. * `deleted:group:{emailid\}?uid={uniqueid\}`: An email address (plus unique identifier) representing a Google group that has been recently deleted. For example, `admins@example.com?uid=123456789012345678901`. If the group is recovered, this value reverts to `group:{emailid\}` and the recovered group retains the role in the binding. * `domain:{domain\}`: The G Suite domain (primary) that represents all the users of that domain. For example, `google.com` or `example.com`.
+     * Specifies the principals requesting access for a Google Cloud resource. `members` can have the following values: * `allUsers`: A special identifier that represents anyone who is on the internet; with or without a Google account. * `allAuthenticatedUsers`: A special identifier that represents anyone who is authenticated with a Google account or a service account. Does not include identities that come from external identity providers (IdPs) through identity federation. * `user:{emailid\}`: An email address that represents a specific Google account. For example, `alice@example.com` . * `serviceAccount:{emailid\}`: An email address that represents a Google service account. For example, `my-other-app@appspot.gserviceaccount.com`. * `serviceAccount:{projectid\}.svc.id.goog[{namespace\}/{kubernetes-sa\}]`: An identifier for a [Kubernetes service account](https://cloud.google.com/kubernetes-engine/docs/how-to/kubernetes-service-accounts). For example, `my-project.svc.id.goog[my-namespace/my-kubernetes-sa]`. * `group:{emailid\}`: An email address that represents a Google group. For example, `admins@example.com`. * `deleted:user:{emailid\}?uid={uniqueid\}`: An email address (plus unique identifier) representing a user that has been recently deleted. For example, `alice@example.com?uid=123456789012345678901`. If the user is recovered, this value reverts to `user:{emailid\}` and the recovered user retains the role in the binding. * `deleted:serviceAccount:{emailid\}?uid={uniqueid\}`: An email address (plus unique identifier) representing a service account that has been recently deleted. For example, `my-other-app@appspot.gserviceaccount.com?uid=123456789012345678901`. If the service account is undeleted, this value reverts to `serviceAccount:{emailid\}` and the undeleted service account retains the role in the binding. * `deleted:group:{emailid\}?uid={uniqueid\}`: An email address (plus unique identifier) representing a Google group that has been recently deleted. For example, `admins@example.com?uid=123456789012345678901`. If the group is recovered, this value reverts to `group:{emailid\}` and the recovered group retains the role in the binding. * `domain:{domain\}`: The G Suite domain (primary) that represents all the users of that domain. For example, `google.com` or `example.com`.
      */
     members?: string[] | null;
     /**
@@ -206,7 +206,7 @@ export namespace sts_v1beta {
      */
     grantType?: string | null;
     /**
-     * A set of features that Security Token Service supports, in addition to the standard OAuth 2.0 token exchange, formatted as a serialized JSON object of Options.
+     * A set of features that Security Token Service supports, in addition to the standard OAuth 2.0 token exchange, formatted as a serialized JSON object of Options. The size of the parameter value must not exceed 4096 characters.
      */
     options?: string | null;
     /**