@openclaw/googlechat 2026.5.20-beta.2 → 2026.5.22

package/node_modules/google-auth-library/build/src/auth/defaultawssecuritycredentialssupplier.js

@@ -0,0 +1,199 @@
+"use strict";
+// Copyright 2024 Google LLC
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//      http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.DefaultAwsSecurityCredentialsSupplier = void 0;
+const authclient_1 = require("./authclient");
+/**
+ * Internal AWS security credentials supplier implementation used by {@link AwsClient}
+ * when a credential source is provided instead of a user defined supplier.
+ * The logic is summarized as:
+ * 1. If imdsv2_session_token_url is provided in the credential source, then
+ *    fetch the aws session token and include it in the headers of the
+ *    metadata requests. This is a requirement for IDMSv2 but optional
+ *    for IDMSv1.
+ * 2. Retrieve AWS region from availability-zone.
+ * 3a. Check AWS credentials in environment variables. If not found, get
+ *     from security-credentials endpoint.
+ * 3b. Get AWS credentials from security-credentials endpoint. In order
+ *     to retrieve this, the AWS role needs to be determined by calling
+ *     security-credentials endpoint without any argument. Then the
+ *     credentials can be retrieved via: security-credentials/role_name
+ * 4. Generate the signed request to AWS STS GetCallerIdentity action.
+ * 5. Inject x-goog-cloud-target-resource into header and serialize the
+ *    signed request. This will be the subject-token to pass to GCP STS.
+ */
+class DefaultAwsSecurityCredentialsSupplier {
+    regionUrl;
+    securityCredentialsUrl;
+    imdsV2SessionTokenUrl;
+    additionalGaxiosOptions;
+    /**
+     * Instantiates a new DefaultAwsSecurityCredentialsSupplier using information
+     * from the credential_source stored in the ADC file.
+     * @param opts The default aws security credentials supplier options object to
+     *   build the supplier with.
+     */
+    constructor(opts) {
+        this.regionUrl = opts.regionUrl;
+        this.securityCredentialsUrl = opts.securityCredentialsUrl;
+        this.imdsV2SessionTokenUrl = opts.imdsV2SessionTokenUrl;
+        this.additionalGaxiosOptions = opts.additionalGaxiosOptions;
+    }
+    /**
+     * Returns the active AWS region. This first checks to see if the region
+     * is available as an environment variable. If it is not, then the supplier
+     * will call the region URL.
+     * @param context {@link ExternalAccountSupplierContext} from the calling
+     *   {@link AwsClient}, contains the requested audience and subject token type
+     *   for the external account identity.
+     * @return A promise that resolves with the AWS region string.
+     */
+    async getAwsRegion(context) {
+        // Priority order for region determination:
+        // AWS_REGION > AWS_DEFAULT_REGION > metadata server.
+        if (this.#regionFromEnv) {
+            return this.#regionFromEnv;
+        }
+        const metadataHeaders = new Headers();
+        if (!this.#regionFromEnv && this.imdsV2SessionTokenUrl) {
+            metadataHeaders.set('x-aws-ec2-metadata-token', await this.#getImdsV2SessionToken(context.transporter));
+        }
+        if (!this.regionUrl) {
+            throw new RangeError('Unable to determine AWS region due to missing ' +
+                '"options.credential_source.region_url"');
+        }
+        const opts = {
+            ...this.additionalGaxiosOptions,
+            url: this.regionUrl,
+            method: 'GET',
+            responseType: 'text',
+            headers: metadataHeaders,
+        };
+        authclient_1.AuthClient.setMethodName(opts, 'getAwsRegion');
+        const response = await context.transporter.request(opts);
+        // Remove last character. For example, if us-east-2b is returned,
+        // the region would be us-east-2.
+        return response.data.substr(0, response.data.length - 1);
+    }
+    /**
+     * Returns AWS security credentials. This first checks to see if the credentials
+     * is available as environment variables. If it is not, then the supplier
+     * will call the security credentials URL.
+     * @param context {@link ExternalAccountSupplierContext} from the calling
+     *   {@link AwsClient}, contains the requested audience and subject token type
+     *   for the external account identity.
+     * @return A promise that resolves with the AWS security credentials.
+     */
+    async getAwsSecurityCredentials(context) {
+        // Check environment variables for permanent credentials first.
+        // https://docs.aws.amazon.com/general/latest/gr/aws-sec-cred-types.html
+        if (this.#securityCredentialsFromEnv) {
+            return this.#securityCredentialsFromEnv;
+        }
+        const metadataHeaders = new Headers();
+        if (this.imdsV2SessionTokenUrl) {
+            metadataHeaders.set('x-aws-ec2-metadata-token', await this.#getImdsV2SessionToken(context.transporter));
+        }
+        // Since the role on a VM can change, we don't need to cache it.
+        const roleName = await this.#getAwsRoleName(metadataHeaders, context.transporter);
+        // Temporary credentials typically last for several hours.
+        // Expiration is returned in response.
+        // Consider future optimization of this logic to cache AWS tokens
+        // until their natural expiration.
+        const awsCreds = await this.#retrieveAwsSecurityCredentials(roleName, metadataHeaders, context.transporter);
+        return {
+            accessKeyId: awsCreds.AccessKeyId,
+            secretAccessKey: awsCreds.SecretAccessKey,
+            token: awsCreds.Token,
+        };
+    }
+    /**
+     * @param transporter The transporter to use for requests.
+     * @return A promise that resolves with the IMDSv2 Session Token.
+     */
+    async #getImdsV2SessionToken(transporter) {
+        const opts = {
+            ...this.additionalGaxiosOptions,
+            url: this.imdsV2SessionTokenUrl,
+            method: 'PUT',
+            responseType: 'text',
+            headers: { 'x-aws-ec2-metadata-token-ttl-seconds': '300' },
+        };
+        authclient_1.AuthClient.setMethodName(opts, '#getImdsV2SessionToken');
+        const response = await transporter.request(opts);
+        return response.data;
+    }
+    /**
+     * @param headers The headers to be used in the metadata request.
+     * @param transporter The transporter to use for requests.
+     * @return A promise that resolves with the assigned role to the current
+     *   AWS VM. This is needed for calling the security-credentials endpoint.
+     */
+    async #getAwsRoleName(headers, transporter) {
+        if (!this.securityCredentialsUrl) {
+            throw new Error('Unable to determine AWS role name due to missing ' +
+                '"options.credential_source.url"');
+        }
+        const opts = {
+            ...this.additionalGaxiosOptions,
+            url: this.securityCredentialsUrl,
+            method: 'GET',
+            responseType: 'text',
+            headers: headers,
+        };
+        authclient_1.AuthClient.setMethodName(opts, '#getAwsRoleName');
+        const response = await transporter.request(opts);
+        return response.data;
+    }
+    /**
+     * Retrieves the temporary AWS credentials by calling the security-credentials
+     * endpoint as specified in the `credential_source` object.
+     * @param roleName The role attached to the current VM.
+     * @param headers The headers to be used in the metadata request.
+     * @param transporter The transporter to use for requests.
+     * @return A promise that resolves with the temporary AWS credentials
+     *   needed for creating the GetCallerIdentity signed request.
+     */
+    async #retrieveAwsSecurityCredentials(roleName, headers, transporter) {
+        const opts = {
+            ...this.additionalGaxiosOptions,
+            url: `${this.securityCredentialsUrl}/${roleName}`,
+            headers: headers,
+            responseType: 'json',
+        };
+        authclient_1.AuthClient.setMethodName(opts, '#retrieveAwsSecurityCredentials');
+        const response = await transporter.request(opts);
+        return response.data;
+    }
+    get #regionFromEnv() {
+        // The AWS region can be provided through AWS_REGION or AWS_DEFAULT_REGION.
+        // Only one is required.
+        return (process.env['AWS_REGION'] || process.env['AWS_DEFAULT_REGION'] || null);
+    }
+    get #securityCredentialsFromEnv() {
+        // Both AWS_ACCESS_KEY_ID and AWS_SECRET_ACCESS_KEY are required.
+        if (process.env['AWS_ACCESS_KEY_ID'] &&
+            process.env['AWS_SECRET_ACCESS_KEY']) {
+            return {
+                accessKeyId: process.env['AWS_ACCESS_KEY_ID'],
+                secretAccessKey: process.env['AWS_SECRET_ACCESS_KEY'],
+                token: process.env['AWS_SESSION_TOKEN'],
+            };
+        }
+        return null;
+    }
+}
+exports.DefaultAwsSecurityCredentialsSupplier = DefaultAwsSecurityCredentialsSupplier;
+//# sourceMappingURL=defaultawssecuritycredentialssupplier.js.map

package/node_modules/google-auth-library/build/src/auth/downscopedclient.d.ts

@@ -0,0 +1,149 @@
+import { GaxiosOptions, GaxiosPromise, GaxiosResponse } from 'gaxios';
+import { Credentials } from './credentials';
+import { AuthClient, AuthClientOptions, GetAccessTokenResponse, BodyResponseCallback } from './authclient';
+/**
+ * The maximum number of access boundary rules a Credential Access Boundary
+ * can contain.
+ */
+export declare const MAX_ACCESS_BOUNDARY_RULES_COUNT = 10;
+/**
+ * Offset to take into account network delays and server clock skews.
+ */
+export declare const EXPIRATION_TIME_OFFSET: number;
+/**
+ * Internal interface for tracking the access token expiration time.
+ */
+interface CredentialsWithResponse extends Credentials {
+    res?: GaxiosResponse | null;
+}
+/**
+ * Internal interface for tracking and returning the Downscoped access token
+ * expiration time in epoch time (seconds).
+ */
+interface DownscopedAccessTokenResponse extends GetAccessTokenResponse {
+    expirationTime?: number | null;
+}
+/**
+ * Defines an upper bound of permissions available for a GCP credential.
+ */
+export interface CredentialAccessBoundary {
+    accessBoundary: {
+        accessBoundaryRules: AccessBoundaryRule[];
+    };
+}
+/** Defines an upper bound of permissions on a particular resource. */
+interface AccessBoundaryRule {
+    availablePermissions: string[];
+    availableResource: string;
+    availabilityCondition?: AvailabilityCondition;
+}
+/**
+ * An optional condition that can be used as part of a
+ * CredentialAccessBoundary to further restrict permissions.
+ */
+interface AvailabilityCondition {
+    expression: string;
+    title?: string;
+    description?: string;
+}
+export interface DownscopedClientOptions extends AuthClientOptions {
+    /**
+     * The source AuthClient to be downscoped based on the provided Credential Access Boundary rules.
+     */
+    authClient: AuthClient;
+    /**
+     * The Credential Access Boundary which contains a list of access boundary rules.
+     * Each rule contains information on the resource that the rule applies to, the upper bound of the
+     * permissions that are available on that resource and an optional
+     * condition to further restrict permissions.
+     */
+    credentialAccessBoundary: CredentialAccessBoundary;
+}
+/**
+ * Defines a set of Google credentials that are downscoped from an existing set
+ * of Google OAuth2 credentials. This is useful to restrict the Identity and
+ * Access Management (IAM) permissions that a short-lived credential can use.
+ * The common pattern of usage is to have a token broker with elevated access
+ * generate these downscoped credentials from higher access source credentials
+ * and pass the downscoped short-lived access tokens to a token consumer via
+ * some secure authenticated channel for limited access to Google Cloud Storage
+ * resources.
+ */
+export declare class DownscopedClient extends AuthClient {
+    private readonly authClient;
+    private readonly credentialAccessBoundary;
+    private cachedDownscopedAccessToken;
+    private readonly stsCredential;
+    /**
+     * Instantiates a downscoped client object using the provided source
+     * AuthClient and credential access boundary rules.
+     * To downscope permissions of a source AuthClient, a Credential Access
+     * Boundary that specifies which resources the new credential can access, as
+     * well as an upper bound on the permissions that are available on each
+     * resource, has to be defined. A downscoped client can then be instantiated
+     * using the source AuthClient and the Credential Access Boundary.
+     * @param options the {@link DownscopedClientOptions `DownscopedClientOptions`} to use. Passing an `AuthClient` directly is **@DEPRECATED**.
+     * @param credentialAccessBoundary **@DEPRECATED**. Provide a {@link DownscopedClientOptions `DownscopedClientOptions`} object in the first parameter instead.
+     */
+    constructor(
+    /**
+     * AuthClient is for backwards-compatibility.
+     */
+    options: AuthClient | DownscopedClientOptions, 
+    /**
+     * @deprecated - provide a {@link DownscopedClientOptions `DownscopedClientOptions`} object in the first parameter instead
+     */
+    credentialAccessBoundary?: CredentialAccessBoundary);
+    /**
+     * Provides a mechanism to inject Downscoped access tokens directly.
+     * The expiry_date field is required to facilitate determination of the token
+     * expiration which would make it easier for the token consumer to handle.
+     * @param credentials The Credentials object to set on the current client.
+     */
+    setCredentials(credentials: Credentials): void;
+    getAccessToken(): Promise<DownscopedAccessTokenResponse>;
+    /**
+     * The main authentication interface. It takes an optional url which when
+     * present is the endpoint being accessed, and returns a Promise which
+     * resolves with authorization header fields.
+     *
+     * The result has the form:
+     * { authorization: 'Bearer <access_token_value>' }
+     */
+    getRequestHeaders(): Promise<Headers>;
+    /**
+     * Provides a request implementation with OAuth 2.0 flow. In cases of
+     * HTTP 401 and 403 responses, it automatically asks for a new access token
+     * and replays the unsuccessful request.
+     * @param opts Request options.
+     * @param callback callback.
+     * @return A promise that resolves with the HTTP response when no callback
+     *   is provided.
+     */
+    request<T>(opts: GaxiosOptions): GaxiosPromise<T>;
+    request<T>(opts: GaxiosOptions, callback: BodyResponseCallback<T>): void;
+    /**
+     * Authenticates the provided HTTP request, processes it and resolves with the
+     * returned response.
+     * @param opts The HTTP request options.
+     * @param reAuthRetried Whether the current attempt is a retry after a failed attempt due to an auth failure
+     * @return A promise that resolves with the successful response.
+     */
+    protected requestAsync<T>(opts: GaxiosOptions, reAuthRetried?: boolean): Promise<GaxiosResponse<T>>;
+    /**
+     * Forces token refresh, even if unexpired tokens are currently cached.
+     * GCP access tokens are retrieved from authclient object/source credential.
+     * Then GCP access tokens are exchanged for downscoped access tokens via the
+     * token exchange endpoint.
+     * @return A promise that resolves with the fresh downscoped access token.
+     */
+    protected refreshAccessTokenAsync(): Promise<CredentialsWithResponse>;
+    /**
+     * Returns whether the provided credentials are expired or not.
+     * If there is no expiry time, assumes the token is not expired or expiring.
+     * @param downscopedAccessToken The credentials to check for expiration.
+     * @return Whether the credentials are expired or not.
+     */
+    private isExpired;
+}
+export {};

package/node_modules/google-auth-library/build/src/auth/downscopedclient.js

@@ -0,0 +1,273 @@
+"use strict";
+// Copyright 2021 Google LLC
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//      http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.DownscopedClient = exports.EXPIRATION_TIME_OFFSET = exports.MAX_ACCESS_BOUNDARY_RULES_COUNT = void 0;
+const gaxios_1 = require("gaxios");
+const stream = require("stream");
+const authclient_1 = require("./authclient");
+const sts = require("./stscredentials");
+/**
+ * The required token exchange grant_type: rfc8693#section-2.1
+ */
+const STS_GRANT_TYPE = 'urn:ietf:params:oauth:grant-type:token-exchange';
+/**
+ * The requested token exchange requested_token_type: rfc8693#section-2.1
+ */
+const STS_REQUEST_TOKEN_TYPE = 'urn:ietf:params:oauth:token-type:access_token';
+/**
+ * The requested token exchange subject_token_type: rfc8693#section-2.1
+ */
+const STS_SUBJECT_TOKEN_TYPE = 'urn:ietf:params:oauth:token-type:access_token';
+/**
+ * The maximum number of access boundary rules a Credential Access Boundary
+ * can contain.
+ */
+exports.MAX_ACCESS_BOUNDARY_RULES_COUNT = 10;
+/**
+ * Offset to take into account network delays and server clock skews.
+ */
+exports.EXPIRATION_TIME_OFFSET = 5 * 60 * 1000;
+/**
+ * Defines a set of Google credentials that are downscoped from an existing set
+ * of Google OAuth2 credentials. This is useful to restrict the Identity and
+ * Access Management (IAM) permissions that a short-lived credential can use.
+ * The common pattern of usage is to have a token broker with elevated access
+ * generate these downscoped credentials from higher access source credentials
+ * and pass the downscoped short-lived access tokens to a token consumer via
+ * some secure authenticated channel for limited access to Google Cloud Storage
+ * resources.
+ */
+class DownscopedClient extends authclient_1.AuthClient {
+    authClient;
+    credentialAccessBoundary;
+    cachedDownscopedAccessToken;
+    stsCredential;
+    /**
+     * Instantiates a downscoped client object using the provided source
+     * AuthClient and credential access boundary rules.
+     * To downscope permissions of a source AuthClient, a Credential Access
+     * Boundary that specifies which resources the new credential can access, as
+     * well as an upper bound on the permissions that are available on each
+     * resource, has to be defined. A downscoped client can then be instantiated
+     * using the source AuthClient and the Credential Access Boundary.
+     * @param options the {@link DownscopedClientOptions `DownscopedClientOptions`} to use. Passing an `AuthClient` directly is **@DEPRECATED**.
+     * @param credentialAccessBoundary **@DEPRECATED**. Provide a {@link DownscopedClientOptions `DownscopedClientOptions`} object in the first parameter instead.
+     */
+    constructor(
+    /**
+     * AuthClient is for backwards-compatibility.
+     */
+    options, 
+    /**
+     * @deprecated - provide a {@link DownscopedClientOptions `DownscopedClientOptions`} object in the first parameter instead
+     */
+    credentialAccessBoundary = {
+        accessBoundary: {
+            accessBoundaryRules: [],
+        },
+    }) {
+        super(options instanceof authclient_1.AuthClient ? {} : options);
+        if (options instanceof authclient_1.AuthClient) {
+            this.authClient = options;
+            this.credentialAccessBoundary = credentialAccessBoundary;
+        }
+        else {
+            this.authClient = options.authClient;
+            this.credentialAccessBoundary = options.credentialAccessBoundary;
+        }
+        // Check 1-10 Access Boundary Rules are defined within Credential Access
+        // Boundary.
+        if (this.credentialAccessBoundary.accessBoundary.accessBoundaryRules
+            .length === 0) {
+            throw new Error('At least one access boundary rule needs to be defined.');
+        }
+        else if (this.credentialAccessBoundary.accessBoundary.accessBoundaryRules.length >
+            exports.MAX_ACCESS_BOUNDARY_RULES_COUNT) {
+            throw new Error('The provided access boundary has more than ' +
+                `${exports.MAX_ACCESS_BOUNDARY_RULES_COUNT} access boundary rules.`);
+        }
+        // Check at least one permission should be defined in each Access Boundary
+        // Rule.
+        for (const rule of this.credentialAccessBoundary.accessBoundary
+            .accessBoundaryRules) {
+            if (rule.availablePermissions.length === 0) {
+                throw new Error('At least one permission should be defined in access boundary rules.');
+            }
+        }
+        this.stsCredential = new sts.StsCredentials({
+            tokenExchangeEndpoint: `https://sts.${this.universeDomain}/v1/token`,
+        });
+        this.cachedDownscopedAccessToken = null;
+    }
+    /**
+     * Provides a mechanism to inject Downscoped access tokens directly.
+     * The expiry_date field is required to facilitate determination of the token
+     * expiration which would make it easier for the token consumer to handle.
+     * @param credentials The Credentials object to set on the current client.
+     */
+    setCredentials(credentials) {
+        if (!credentials.expiry_date) {
+            throw new Error('The access token expiry_date field is missing in the provided ' +
+                'credentials.');
+        }
+        super.setCredentials(credentials);
+        this.cachedDownscopedAccessToken = credentials;
+    }
+    async getAccessToken() {
+        // If the cached access token is unavailable or expired, force refresh.
+        // The Downscoped access token will be returned in
+        // DownscopedAccessTokenResponse format.
+        if (!this.cachedDownscopedAccessToken ||
+            this.isExpired(this.cachedDownscopedAccessToken)) {
+            await this.refreshAccessTokenAsync();
+        }
+        // Return Downscoped access token in DownscopedAccessTokenResponse format.
+        return {
+            token: this.cachedDownscopedAccessToken.access_token,
+            expirationTime: this.cachedDownscopedAccessToken.expiry_date,
+            res: this.cachedDownscopedAccessToken.res,
+        };
+    }
+    /**
+     * The main authentication interface. It takes an optional url which when
+     * present is the endpoint being accessed, and returns a Promise which
+     * resolves with authorization header fields.
+     *
+     * The result has the form:
+     * { authorization: 'Bearer <access_token_value>' }
+     */
+    async getRequestHeaders() {
+        const accessTokenResponse = await this.getAccessToken();
+        const headers = new Headers({
+            authorization: `Bearer ${accessTokenResponse.token}`,
+        });
+        return this.addSharedMetadataHeaders(headers);
+    }
+    request(opts, callback) {
+        if (callback) {
+            this.requestAsync(opts).then(r => callback(null, r), e => {
+                return callback(e, e.response);
+            });
+        }
+        else {
+            return this.requestAsync(opts);
+        }
+    }
+    /**
+     * Authenticates the provided HTTP request, processes it and resolves with the
+     * returned response.
+     * @param opts The HTTP request options.
+     * @param reAuthRetried Whether the current attempt is a retry after a failed attempt due to an auth failure
+     * @return A promise that resolves with the successful response.
+     */
+    async requestAsync(opts, reAuthRetried = false) {
+        let response;
+        try {
+            const requestHeaders = await this.getRequestHeaders();
+            opts.headers = gaxios_1.Gaxios.mergeHeaders(opts.headers);
+            this.addUserProjectAndAuthHeaders(opts.headers, requestHeaders);
+            response = await this.transporter.request(opts);
+        }
+        catch (e) {
+            const res = e.response;
+            if (res) {
+                const statusCode = res.status;
+                // Retry the request for metadata if the following criteria are true:
+                // - We haven't already retried.  It only makes sense to retry once.
+                // - The response was a 401 or a 403
+                // - The request didn't send a readableStream
+                // - forceRefreshOnFailure is true
+                const isReadableStream = res.config.data instanceof stream.Readable;
+                const isAuthErr = statusCode === 401 || statusCode === 403;
+                if (!reAuthRetried &&
+                    isAuthErr &&
+                    !isReadableStream &&
+                    this.forceRefreshOnFailure) {
+                    await this.refreshAccessTokenAsync();
+                    return await this.requestAsync(opts, true);
+                }
+            }
+            throw e;
+        }
+        return response;
+    }
+    /**
+     * Forces token refresh, even if unexpired tokens are currently cached.
+     * GCP access tokens are retrieved from authclient object/source credential.
+     * Then GCP access tokens are exchanged for downscoped access tokens via the
+     * token exchange endpoint.
+     * @return A promise that resolves with the fresh downscoped access token.
+     */
+    async refreshAccessTokenAsync() {
+        // Retrieve GCP access token from source credential.
+        const subjectToken = (await this.authClient.getAccessToken()).token;
+        // Construct the STS credentials options.
+        const stsCredentialsOptions = {
+            grantType: STS_GRANT_TYPE,
+            requestedTokenType: STS_REQUEST_TOKEN_TYPE,
+            subjectToken: subjectToken,
+            subjectTokenType: STS_SUBJECT_TOKEN_TYPE,
+        };
+        // Exchange the source AuthClient access token for a Downscoped access
+        // token.
+        const stsResponse = await this.stsCredential.exchangeToken(stsCredentialsOptions, undefined, this.credentialAccessBoundary);
+        /**
+         * The STS endpoint will only return the expiration time for the downscoped
+         * access token if the original access token represents a service account.
+         * The downscoped token's expiration time will always match the source
+         * credential expiration. When no expires_in is returned, we can copy the
+         * source credential's expiration time.
+         */
+        const sourceCredExpireDate = this.authClient.credentials?.expiry_date || null;
+        const expiryDate = stsResponse.expires_in
+            ? new Date().getTime() + stsResponse.expires_in * 1000
+            : sourceCredExpireDate;
+        // Save response in cached access token.
+        this.cachedDownscopedAccessToken = {
+            access_token: stsResponse.access_token,
+            expiry_date: expiryDate,
+            res: stsResponse.res,
+        };
+        // Save credentials.
+        this.credentials = {};
+        Object.assign(this.credentials, this.cachedDownscopedAccessToken);
+        delete this.credentials.res;
+        // Trigger tokens event to notify external listeners.
+        this.emit('tokens', {
+            refresh_token: null,
+            expiry_date: this.cachedDownscopedAccessToken.expiry_date,
+            access_token: this.cachedDownscopedAccessToken.access_token,
+            token_type: 'Bearer',
+            id_token: null,
+        });
+        // Return the cached access token.
+        return this.cachedDownscopedAccessToken;
+    }
+    /**
+     * Returns whether the provided credentials are expired or not.
+     * If there is no expiry time, assumes the token is not expired or expiring.
+     * @param downscopedAccessToken The credentials to check for expiration.
+     * @return Whether the credentials are expired or not.
+     */
+    isExpired(downscopedAccessToken) {
+        const now = new Date().getTime();
+        return downscopedAccessToken.expiry_date
+            ? now >=
+                downscopedAccessToken.expiry_date - this.eagerRefreshThresholdMillis
+            : false;
+    }
+}
+exports.DownscopedClient = DownscopedClient;
+//# sourceMappingURL=downscopedclient.js.map

package/node_modules/google-auth-library/build/src/auth/envDetect.d.ts

@@ -0,0 +1,11 @@
+export declare enum GCPEnv {
+    APP_ENGINE = "APP_ENGINE",
+    KUBERNETES_ENGINE = "KUBERNETES_ENGINE",
+    CLOUD_FUNCTIONS = "CLOUD_FUNCTIONS",
+    COMPUTE_ENGINE = "COMPUTE_ENGINE",
+    CLOUD_RUN = "CLOUD_RUN",
+    CLOUD_RUN_JOBS = "CLOUD_RUN_JOBS",
+    NONE = "NONE"
+}
+export declare function clear(): void;
+export declare function getEnv(): Promise<GCPEnv>;