@openclaw/googlechat 2026.5.20-beta.2 → 2026.5.22

package/node_modules/google-auth-library/build/src/auth/certificatesubjecttokensupplier.js

@@ -0,0 +1,223 @@
+"use strict";
+// Copyright 2025 Google LLC
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//      http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.CertificateSubjectTokenSupplier = exports.InvalidConfigurationError = exports.CertificateSourceUnavailableError = exports.CERTIFICATE_CONFIGURATION_ENV_VARIABLE = void 0;
+const util_1 = require("../util");
+const fs = require("fs");
+const crypto_1 = require("crypto");
+const https = require("https");
+exports.CERTIFICATE_CONFIGURATION_ENV_VARIABLE = 'GOOGLE_API_CERTIFICATE_CONFIG';
+/**
+ * Thrown when the certificate source cannot be located or accessed.
+ */
+class CertificateSourceUnavailableError extends Error {
+    constructor(message) {
+        super(message);
+        this.name = 'CertificateSourceUnavailableError';
+    }
+}
+exports.CertificateSourceUnavailableError = CertificateSourceUnavailableError;
+/**
+ * Thrown for invalid configuration that is not related to file availability.
+ */
+class InvalidConfigurationError extends Error {
+    constructor(message) {
+        super(message);
+        this.name = 'InvalidConfigurationError';
+    }
+}
+exports.InvalidConfigurationError = InvalidConfigurationError;
+/**
+ * A subject token supplier that uses a client certificate for authentication.
+ * It provides the certificate chain as the subject token for identity federation.
+ */
+class CertificateSubjectTokenSupplier {
+    certificateConfigPath;
+    trustChainPath;
+    cert;
+    key;
+    /**
+     * Initializes a new instance of the CertificateSubjectTokenSupplier.
+     * @param opts The configuration options for the supplier.
+     */
+    constructor(opts) {
+        if (!opts.useDefaultCertificateConfig && !opts.certificateConfigLocation) {
+            throw new InvalidConfigurationError('Either `useDefaultCertificateConfig` must be true or a `certificateConfigLocation` must be provided.');
+        }
+        if (opts.useDefaultCertificateConfig && opts.certificateConfigLocation) {
+            throw new InvalidConfigurationError('Both `useDefaultCertificateConfig` and `certificateConfigLocation` cannot be provided.');
+        }
+        this.trustChainPath = opts.trustChainPath;
+        this.certificateConfigPath = opts.certificateConfigLocation ?? '';
+    }
+    /**
+     * Creates an HTTPS agent configured with the client certificate and private key for mTLS.
+     * @returns An mTLS-configured https.Agent.
+     */
+    async createMtlsHttpsAgent() {
+        if (!this.key || !this.cert) {
+            throw new InvalidConfigurationError('Cannot create mTLS Agent with missing certificate or key');
+        }
+        return new https.Agent({ key: this.key, cert: this.cert });
+    }
+    /**
+     * Constructs the subject token, which is the base64-encoded certificate chain.
+     * @returns A promise that resolves with the subject token.
+     */
+    async getSubjectToken() {
+        // The "subject token" in this context is the processed certificate chain.
+        this.certificateConfigPath = await this.#resolveCertificateConfigFilePath();
+        const { certPath, keyPath } = await this.#getCertAndKeyPaths();
+        ({ cert: this.cert, key: this.key } = await this.#getKeyAndCert(certPath, keyPath));
+        return await this.#processChainFromPaths(this.cert);
+    }
+    /**
+     * Resolves the absolute path to the certificate configuration file
+     * by checking the "certificate_config_location" provided in the ADC file,
+     * or the "GOOGLE_API_CERTIFICATE_CONFIG" environment variable
+     * or in the default gcloud path.
+     * @param overridePath An optional path to check first.
+     * @returns The resolved file path.
+     */
+    async #resolveCertificateConfigFilePath() {
+        // 1. Check for the override path from constructor options.
+        const overridePath = this.certificateConfigPath;
+        if (overridePath) {
+            if (await (0, util_1.isValidFile)(overridePath)) {
+                return overridePath;
+            }
+            throw new CertificateSourceUnavailableError(`Provided certificate config path is invalid: ${overridePath}`);
+        }
+        // 2. Check the standard environment variable.
+        const envPath = process.env[exports.CERTIFICATE_CONFIGURATION_ENV_VARIABLE];
+        if (envPath) {
+            if (await (0, util_1.isValidFile)(envPath)) {
+                return envPath;
+            }
+            throw new CertificateSourceUnavailableError(`Path from environment variable "${exports.CERTIFICATE_CONFIGURATION_ENV_VARIABLE}" is invalid: ${envPath}`);
+        }
+        // 3. Check the well-known gcloud config location.
+        const wellKnownPath = (0, util_1.getWellKnownCertificateConfigFileLocation)();
+        if (await (0, util_1.isValidFile)(wellKnownPath)) {
+            return wellKnownPath;
+        }
+        // 4. If none are found, throw an error.
+        throw new CertificateSourceUnavailableError('Could not find certificate configuration file. Searched override path, ' +
+            `the "${exports.CERTIFICATE_CONFIGURATION_ENV_VARIABLE}" env var, and the gcloud path (${wellKnownPath}).`);
+    }
+    /**
+     * Reads and parses the certificate config JSON file to extract the certificate and key paths.
+     * @returns An object containing the certificate and key paths.
+     */
+    async #getCertAndKeyPaths() {
+        const configPath = this.certificateConfigPath;
+        let fileContents;
+        try {
+            fileContents = await fs.promises.readFile(configPath, 'utf8');
+        }
+        catch (err) {
+            throw new CertificateSourceUnavailableError(`Failed to read certificate config file at: ${configPath}`);
+        }
+        try {
+            const config = JSON.parse(fileContents);
+            const certPath = config?.cert_configs?.workload?.cert_path;
+            const keyPath = config?.cert_configs?.workload?.key_path;
+            if (!certPath || !keyPath) {
+                throw new InvalidConfigurationError(`Certificate config file (${configPath}) is missing required "cert_path" or "key_path" in the workload config.`);
+            }
+            return { certPath, keyPath };
+        }
+        catch (e) {
+            if (e instanceof InvalidConfigurationError)
+                throw e;
+            throw new InvalidConfigurationError(`Failed to parse certificate config from ${configPath}: ${e.message}`);
+        }
+    }
+    /**
+     * Reads and parses the cert and key files get their content and check valid format.
+     * @returns An object containing the cert content and key content in buffer format.
+     */
+    async #getKeyAndCert(certPath, keyPath) {
+        let cert, key;
+        try {
+            cert = await fs.promises.readFile(certPath);
+            new crypto_1.X509Certificate(cert);
+        }
+        catch (err) {
+            const message = err instanceof Error ? err.message : String(err);
+            throw new CertificateSourceUnavailableError(`Failed to read certificate file at ${certPath}: ${message}`);
+        }
+        try {
+            key = await fs.promises.readFile(keyPath);
+            (0, crypto_1.createPrivateKey)(key);
+        }
+        catch (err) {
+            const message = err instanceof Error ? err.message : String(err);
+            throw new CertificateSourceUnavailableError(`Failed to read private key file at ${keyPath}: ${message}`);
+        }
+        return { cert, key };
+    }
+    /**
+     * Reads the leaf certificate and trust chain, combines them,
+     * and returns a JSON array of base64-encoded certificates.
+     * @returns A stringified JSON array of the certificate chain.
+     */
+    async #processChainFromPaths(leafCertBuffer) {
+        const leafCert = new crypto_1.X509Certificate(leafCertBuffer);
+        // If no trust chain is provided, just use the successfully parsed leaf certificate.
+        if (!this.trustChainPath) {
+            return JSON.stringify([leafCert.raw.toString('base64')]);
+        }
+        // Handle the trust chain logic.
+        try {
+            const chainPems = await fs.promises.readFile(this.trustChainPath, 'utf8');
+            const pemBlocks = chainPems.match(/-----BEGIN CERTIFICATE-----[^-]+-----END CERTIFICATE-----/g) ?? [];
+            const chainCerts = pemBlocks.map((pem, index) => {
+                try {
+                    return new crypto_1.X509Certificate(pem);
+                }
+                catch (err) {
+                    const message = err instanceof Error ? err.message : String(err);
+                    // Throw a more precise error if a single certificate in the chain is invalid.
+                    throw new InvalidConfigurationError(`Failed to parse certificate at index ${index} in trust chain file ${this.trustChainPath}: ${message}`);
+                }
+            });
+            const leafIndex = chainCerts.findIndex(chainCert => leafCert.raw.equals(chainCert.raw));
+            let finalChain;
+            if (leafIndex === -1) {
+                // Leaf not found, so prepend it to the chain.
+                finalChain = [leafCert, ...chainCerts];
+            }
+            else if (leafIndex === 0) {
+                // Leaf is already the first element, so the chain is correctly ordered.
+                finalChain = chainCerts;
+            }
+            else {
+                // Leaf is in the chain but not at the top, which is invalid.
+                throw new InvalidConfigurationError(`Leaf certificate exists in the trust chain but is not the first entry (found at index ${leafIndex}).`);
+            }
+            return JSON.stringify(finalChain.map(cert => cert.raw.toString('base64')));
+        }
+        catch (err) {
+            // Re-throw our specific configuration errors.
+            if (err instanceof InvalidConfigurationError)
+                throw err;
+            const message = err instanceof Error ? err.message : String(err);
+            throw new CertificateSourceUnavailableError(`Failed to process certificate chain from ${this.trustChainPath}: ${message}`);
+        }
+    }
+}
+exports.CertificateSubjectTokenSupplier = CertificateSubjectTokenSupplier;
+//# sourceMappingURL=certificatesubjecttokensupplier.js.map

package/node_modules/google-auth-library/build/src/auth/computeclient.d.ts

@@ -0,0 +1,37 @@
+import { GaxiosError } from 'gaxios';
+import { GetTokenResponse, OAuth2Client, OAuth2ClientOptions } from './oauth2client';
+export interface ComputeOptions extends OAuth2ClientOptions {
+    /**
+     * The service account email to use, or 'default'. A Compute Engine instance
+     * may have multiple service accounts.
+     */
+    serviceAccountEmail?: string;
+    /**
+     * The scopes that will be requested when acquiring service account
+     * credentials. Only applicable to modern App Engine and Cloud Function
+     * runtimes as of March 2019.
+     */
+    scopes?: string | string[];
+}
+export declare class Compute extends OAuth2Client {
+    readonly serviceAccountEmail: string;
+    scopes: string[];
+    /**
+     * Google Compute Engine service account credentials.
+     *
+     * Retrieve access token from the metadata server.
+     * See: https://cloud.google.com/compute/docs/access/authenticate-workloads#applications
+     */
+    constructor(options?: ComputeOptions);
+    /**
+     * Refreshes the access token.
+     * @param refreshToken Unused parameter
+     */
+    protected refreshTokenNoCache(): Promise<GetTokenResponse>;
+    /**
+     * Fetches an ID token.
+     * @param targetAudience the audience for the fetched ID token.
+     */
+    fetchIdToken(targetAudience: string): Promise<string>;
+    protected wrapError(e: GaxiosError): void;
+}

package/node_modules/google-auth-library/build/src/auth/computeclient.js

@@ -0,0 +1,118 @@
+"use strict";
+// Copyright 2013 Google LLC
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//      http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.Compute = void 0;
+const gaxios_1 = require("gaxios");
+const gcpMetadata = require("gcp-metadata");
+const oauth2client_1 = require("./oauth2client");
+class Compute extends oauth2client_1.OAuth2Client {
+    serviceAccountEmail;
+    scopes;
+    /**
+     * Google Compute Engine service account credentials.
+     *
+     * Retrieve access token from the metadata server.
+     * See: https://cloud.google.com/compute/docs/access/authenticate-workloads#applications
+     */
+    constructor(options = {}) {
+        super(options);
+        // Start with an expired refresh token, which will automatically be
+        // refreshed before the first API call is made.
+        this.credentials = { expiry_date: 1, refresh_token: 'compute-placeholder' };
+        this.serviceAccountEmail = options.serviceAccountEmail || 'default';
+        this.scopes = Array.isArray(options.scopes)
+            ? options.scopes
+            : options.scopes
+                ? [options.scopes]
+                : [];
+    }
+    /**
+     * Refreshes the access token.
+     * @param refreshToken Unused parameter
+     */
+    async refreshTokenNoCache() {
+        const tokenPath = `service-accounts/${this.serviceAccountEmail}/token`;
+        let data;
+        try {
+            const instanceOptions = {
+                property: tokenPath,
+            };
+            if (this.scopes.length > 0) {
+                instanceOptions.params = {
+                    scopes: this.scopes.join(','),
+                };
+            }
+            data = await gcpMetadata.instance(instanceOptions);
+        }
+        catch (e) {
+            if (e instanceof gaxios_1.GaxiosError) {
+                e.message = `Could not refresh access token: ${e.message}`;
+                this.wrapError(e);
+            }
+            throw e;
+        }
+        const tokens = data;
+        if (data && data.expires_in) {
+            tokens.expiry_date = new Date().getTime() + data.expires_in * 1000;
+            delete tokens.expires_in;
+        }
+        this.emit('tokens', tokens);
+        return { tokens, res: null };
+    }
+    /**
+     * Fetches an ID token.
+     * @param targetAudience the audience for the fetched ID token.
+     */
+    async fetchIdToken(targetAudience) {
+        const idTokenPath = `service-accounts/${this.serviceAccountEmail}/identity` +
+            `?format=full&audience=${targetAudience}`;
+        let idToken;
+        try {
+            const instanceOptions = {
+                property: idTokenPath,
+            };
+            idToken = await gcpMetadata.instance(instanceOptions);
+        }
+        catch (e) {
+            if (e instanceof Error) {
+                e.message = `Could not fetch ID token: ${e.message}`;
+            }
+            throw e;
+        }
+        return idToken;
+    }
+    wrapError(e) {
+        const res = e.response;
+        if (res && res.status) {
+            e.status = res.status;
+            if (res.status === 403) {
+                e.message =
+                    'A Forbidden error was returned while attempting to retrieve an access ' +
+                        'token for the Compute Engine built-in service account. This may be because the Compute ' +
+                        'Engine instance does not have the correct permission scopes specified: ' +
+                        e.message;
+            }
+            else if (res.status === 404) {
+                e.message =
+                    'A Not Found error was returned while attempting to retrieve an access' +
+                        'token for the Compute Engine built-in service account. This may be because the Compute ' +
+                        'Engine instance does not have any permission scopes specified: ' +
+                        e.message;
+            }
+        }
+    }
+}
+exports.Compute = Compute;
+//# sourceMappingURL=computeclient.js.map

package/node_modules/google-auth-library/build/src/auth/credentials.d.ts

@@ -0,0 +1,76 @@
+export interface Credentials {
+    /**
+     * This field is only present if the access_type parameter was set to offline in the authentication request. For details, see Refresh tokens.
+     */
+    refresh_token?: string | null;
+    /**
+     * The time in ms at which this token is thought to expire.
+     */
+    expiry_date?: number | null;
+    /**
+     * A token that can be sent to a Google API.
+     */
+    access_token?: string | null;
+    /**
+     * Identifies the type of token returned. At this time, this field always has the value Bearer.
+     */
+    token_type?: string | null;
+    /**
+     * A JWT that contains identity information about the user that is digitally signed by Google.
+     */
+    id_token?: string | null;
+    /**
+     * The scopes of access granted by the access_token expressed as a list of space-delimited, case-sensitive strings.
+     */
+    scope?: string;
+}
+export interface CredentialRequest {
+    /**
+     * This field is only present if the access_type parameter was set to offline in the authentication request. For details, see Refresh tokens.
+     */
+    refresh_token?: string;
+    /**
+     * A token that can be sent to a Google API.
+     */
+    access_token?: string;
+    /**
+     * Identifies the type of token returned. At this time, this field always has the value Bearer.
+     */
+    token_type?: string;
+    /**
+     * The remaining lifetime of the access token in seconds.
+     */
+    expires_in?: number;
+    /**
+     * A JWT that contains identity information about the user that is digitally signed by Google.
+     */
+    id_token?: string;
+    /**
+     * The scopes of access granted by the access_token expressed as a list of space-delimited, case-sensitive strings.
+     */
+    scope?: string;
+}
+export interface JWTInput {
+    type?: string;
+    client_email?: string;
+    private_key?: string;
+    private_key_id?: string;
+    project_id?: string;
+    client_id?: string;
+    client_secret?: string;
+    refresh_token?: string;
+    quota_project_id?: string;
+    universe_domain?: string;
+}
+export interface ImpersonatedJWTInput {
+    type?: string;
+    source_credentials?: JWTInput;
+    service_account_impersonation_url?: string;
+    delegates?: string[];
+    scopes?: string[];
+}
+export interface CredentialBody {
+    client_email?: string;
+    private_key?: string;
+    universe_domain?: string;
+}

package/node_modules/google-auth-library/build/src/auth/credentials.js

@@ -0,0 +1,16 @@
+"use strict";
+// Copyright 2014 Google LLC
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//      http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+Object.defineProperty(exports, "__esModule", { value: true });
+//# sourceMappingURL=credentials.js.map

package/node_modules/google-auth-library/build/src/auth/defaultawssecuritycredentialssupplier.d.ts

@@ -0,0 +1,79 @@
+import { ExternalAccountSupplierContext } from './baseexternalclient';
+import { GaxiosOptions } from 'gaxios';
+import { AwsSecurityCredentialsSupplier } from './awsclient';
+import { AwsSecurityCredentials } from './awsrequestsigner';
+/**
+ * Interface defining the options used to build a {@link DefaultAwsSecurityCredentialsSupplier}.
+ */
+export interface DefaultAwsSecurityCredentialsSupplierOptions {
+    /**
+     * The URL to call to retrieve the active AWS region.
+     **/
+    regionUrl?: string;
+    /**
+     * The URL to call to retrieve AWS security credentials.
+     **/
+    securityCredentialsUrl?: string;
+    /**
+     ** The URL to call to retrieve the IMDSV2 session token.
+     **/
+    imdsV2SessionTokenUrl?: string;
+    /**
+     * Additional Gaxios options to use when making requests to the AWS metadata
+     * endpoints.
+     */
+    additionalGaxiosOptions?: GaxiosOptions;
+}
+/**
+ * Internal AWS security credentials supplier implementation used by {@link AwsClient}
+ * when a credential source is provided instead of a user defined supplier.
+ * The logic is summarized as:
+ * 1. If imdsv2_session_token_url is provided in the credential source, then
+ *    fetch the aws session token and include it in the headers of the
+ *    metadata requests. This is a requirement for IDMSv2 but optional
+ *    for IDMSv1.
+ * 2. Retrieve AWS region from availability-zone.
+ * 3a. Check AWS credentials in environment variables. If not found, get
+ *     from security-credentials endpoint.
+ * 3b. Get AWS credentials from security-credentials endpoint. In order
+ *     to retrieve this, the AWS role needs to be determined by calling
+ *     security-credentials endpoint without any argument. Then the
+ *     credentials can be retrieved via: security-credentials/role_name
+ * 4. Generate the signed request to AWS STS GetCallerIdentity action.
+ * 5. Inject x-goog-cloud-target-resource into header and serialize the
+ *    signed request. This will be the subject-token to pass to GCP STS.
+ */
+export declare class DefaultAwsSecurityCredentialsSupplier implements AwsSecurityCredentialsSupplier {
+    #private;
+    private readonly regionUrl?;
+    private readonly securityCredentialsUrl?;
+    private readonly imdsV2SessionTokenUrl?;
+    private readonly additionalGaxiosOptions?;
+    /**
+     * Instantiates a new DefaultAwsSecurityCredentialsSupplier using information
+     * from the credential_source stored in the ADC file.
+     * @param opts The default aws security credentials supplier options object to
+     *   build the supplier with.
+     */
+    constructor(opts: DefaultAwsSecurityCredentialsSupplierOptions);
+    /**
+     * Returns the active AWS region. This first checks to see if the region
+     * is available as an environment variable. If it is not, then the supplier
+     * will call the region URL.
+     * @param context {@link ExternalAccountSupplierContext} from the calling
+     *   {@link AwsClient}, contains the requested audience and subject token type
+     *   for the external account identity.
+     * @return A promise that resolves with the AWS region string.
+     */
+    getAwsRegion(context: ExternalAccountSupplierContext): Promise<string>;
+    /**
+     * Returns AWS security credentials. This first checks to see if the credentials
+     * is available as environment variables. If it is not, then the supplier
+     * will call the security credentials URL.
+     * @param context {@link ExternalAccountSupplierContext} from the calling
+     *   {@link AwsClient}, contains the requested audience and subject token type
+     *   for the external account identity.
+     * @return A promise that resolves with the AWS security credentials.
+     */
+    getAwsSecurityCredentials(context: ExternalAccountSupplierContext): Promise<AwsSecurityCredentials>;
+}