@openclaw/googlechat 2026.5.20-beta.2 → 2026.5.22

package/node_modules/google-auth-library/build/src/auth/impersonated.js

@@ -0,0 +1,197 @@
+"use strict";
+/**
+ * Copyright 2021 Google LLC
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.Impersonated = exports.IMPERSONATED_ACCOUNT_TYPE = void 0;
+const oauth2client_1 = require("./oauth2client");
+const gaxios_1 = require("gaxios");
+const util_1 = require("../util");
+exports.IMPERSONATED_ACCOUNT_TYPE = 'impersonated_service_account';
+class Impersonated extends oauth2client_1.OAuth2Client {
+    sourceClient;
+    targetPrincipal;
+    targetScopes;
+    delegates;
+    lifetime;
+    endpoint;
+    /**
+     * Impersonated service account credentials.
+     *
+     * Create a new access token by impersonating another service account.
+     *
+     * Impersonated Credentials allowing credentials issued to a user or
+     * service account to impersonate another. The source project using
+     * Impersonated Credentials must enable the "IAMCredentials" API.
+     * Also, the target service account must grant the orginating principal
+     * the "Service Account Token Creator" IAM role.
+     *
+     * **IMPORTANT**: This method does not validate the credential configuration.
+     * A security risk occurs when a credential configuration configured with
+     * malicious URLs is used. When the credential configuration is accepted from
+     * an untrusted source, you should validate it before using it with this
+     * method. For more details, see
+     * https://cloud.google.com/docs/authentication/external/externally-sourced-credentials.
+     *
+     * @param {object} options - The configuration object.
+     * @param {object} [options.sourceClient] the source credential used as to
+     * acquire the impersonated credentials.
+     * @param {string} [options.targetPrincipal] the service account to
+     * impersonate.
+     * @param {string[]} [options.delegates] the chained list of delegates
+     * required to grant the final access_token. If set, the sequence of
+     * identities must have "Service Account Token Creator" capability granted to
+     * the preceding identity. For example, if set to [serviceAccountB,
+     * serviceAccountC], the sourceCredential must have the Token Creator role on
+     * serviceAccountB. serviceAccountB must have the Token Creator on
+     * serviceAccountC. Finally, C must have Token Creator on target_principal.
+     * If left unset, sourceCredential must have that role on targetPrincipal.
+     * @param {string[]} [options.targetScopes] scopes to request during the
+     * authorization grant.
+     * @param {number} [options.lifetime] number of seconds the delegated
+     * credential should be valid for up to 3600 seconds by default, or 43,200
+     * seconds by extending the token's lifetime, see:
+     * https://cloud.google.com/iam/docs/creating-short-lived-service-account-credentials#sa-credentials-oauth
+     * @param {string} [options.endpoint] api endpoint override.
+     */
+    constructor(options = {}) {
+        super(options);
+        // Start with an expired refresh token, which will automatically be
+        // refreshed before the first API call is made.
+        this.credentials = {
+            expiry_date: 1,
+            refresh_token: 'impersonated-placeholder',
+        };
+        this.sourceClient = options.sourceClient ?? new oauth2client_1.OAuth2Client();
+        this.targetPrincipal = options.targetPrincipal ?? '';
+        this.delegates = options.delegates ?? [];
+        this.targetScopes = options.targetScopes ?? [];
+        this.lifetime = options.lifetime ?? 3600;
+        const usingExplicitUniverseDomain = !!(0, util_1.originalOrCamelOptions)(options).get('universe_domain');
+        if (!usingExplicitUniverseDomain) {
+            // override the default universe with the source's universe
+            this.universeDomain = this.sourceClient.universeDomain;
+        }
+        else if (this.sourceClient.universeDomain !== this.universeDomain) {
+            // non-default universe and is not matching the source - this could be a credential leak
+            throw new RangeError(`Universe domain ${this.sourceClient.universeDomain} in source credentials does not match ${this.universeDomain} universe domain set for impersonated credentials.`);
+        }
+        this.endpoint =
+            options.endpoint ?? `https://iamcredentials.${this.universeDomain}`;
+    }
+    /**
+     * Signs some bytes.
+     *
+     * {@link https://cloud.google.com/iam/docs/reference/credentials/rest/v1/projects.serviceAccounts/signBlob Reference Documentation}
+     * @param blobToSign String to sign.
+     *
+     * @returns A {@link SignBlobResponse} denoting the keyID and signedBlob in base64 string
+     */
+    async sign(blobToSign) {
+        await this.sourceClient.getAccessToken();
+        const name = `projects/-/serviceAccounts/${this.targetPrincipal}`;
+        const u = `${this.endpoint}/v1/${name}:signBlob`;
+        const body = {
+            delegates: this.delegates,
+            payload: Buffer.from(blobToSign).toString('base64'),
+        };
+        const res = await this.sourceClient.request({
+            ...Impersonated.RETRY_CONFIG,
+            url: u,
+            data: body,
+            method: 'POST',
+        });
+        return res.data;
+    }
+    /** The service account email to be impersonated. */
+    getTargetPrincipal() {
+        return this.targetPrincipal;
+    }
+    /**
+     * Refreshes the access token.
+     */
+    async refreshToken() {
+        try {
+            await this.sourceClient.getAccessToken();
+            const name = 'projects/-/serviceAccounts/' + this.targetPrincipal;
+            const u = `${this.endpoint}/v1/${name}:generateAccessToken`;
+            const body = {
+                delegates: this.delegates,
+                scope: this.targetScopes,
+                lifetime: this.lifetime + 's',
+            };
+            const res = await this.sourceClient.request({
+                ...Impersonated.RETRY_CONFIG,
+                url: u,
+                data: body,
+                method: 'POST',
+            });
+            const tokenResponse = res.data;
+            this.credentials.access_token = tokenResponse.accessToken;
+            this.credentials.expiry_date = Date.parse(tokenResponse.expireTime);
+            return {
+                tokens: this.credentials,
+                res,
+            };
+        }
+        catch (error) {
+            if (!(error instanceof Error))
+                throw error;
+            let status = 0;
+            let message = '';
+            if (error instanceof gaxios_1.GaxiosError) {
+                status = error?.response?.data?.error?.status;
+                message = error?.response?.data?.error?.message;
+            }
+            if (status && message) {
+                error.message = `${status}: unable to impersonate: ${message}`;
+                throw error;
+            }
+            else {
+                error.message = `unable to impersonate: ${error}`;
+                throw error;
+            }
+        }
+    }
+    /**
+     * Generates an OpenID Connect ID token for a service account.
+     *
+     * {@link https://cloud.google.com/iam/docs/reference/credentials/rest/v1/projects.serviceAccounts/generateIdToken Reference Documentation}
+     *
+     * @param targetAudience the audience for the fetched ID token.
+     * @param options the for the request
+     * @return an OpenID Connect ID token
+     */
+    async fetchIdToken(targetAudience, options) {
+        await this.sourceClient.getAccessToken();
+        const name = `projects/-/serviceAccounts/${this.targetPrincipal}`;
+        const u = `${this.endpoint}/v1/${name}:generateIdToken`;
+        const body = {
+            delegates: this.delegates,
+            audience: targetAudience,
+            includeEmail: options?.includeEmail ?? true,
+            useEmailAzp: options?.includeEmail ?? true,
+        };
+        const res = await this.sourceClient.request({
+            ...Impersonated.RETRY_CONFIG,
+            url: u,
+            data: body,
+            method: 'POST',
+        });
+        return res.data.token;
+    }
+}
+exports.Impersonated = Impersonated;
+//# sourceMappingURL=impersonated.js.map

package/node_modules/google-auth-library/build/src/auth/jwtaccess.d.ts

@@ -0,0 +1,61 @@
+import * as stream from 'stream';
+import { JWTInput } from './credentials';
+export interface Claims {
+    [index: string]: string;
+}
+export declare class JWTAccess {
+    email?: string | null;
+    key?: string | null;
+    keyId?: string | null;
+    projectId?: string;
+    eagerRefreshThresholdMillis: number;
+    private cache;
+    /**
+     * JWTAccess service account credentials.
+     *
+     * Create a new access token by using the credential to create a new JWT token
+     * that's recognized as the access token.
+     *
+     * @param email the service account email address.
+     * @param key the private key that will be used to sign the token.
+     * @param keyId the ID of the private key used to sign the token.
+     */
+    constructor(email?: string | null, key?: string | null, keyId?: string | null, eagerRefreshThresholdMillis?: number);
+    /**
+     * Ensures that we're caching a key appropriately, giving precedence to scopes vs. url
+     *
+     * @param url The URI being authorized.
+     * @param scopes The scope or scopes being authorized
+     * @returns A string that returns the cached key.
+     */
+    getCachedKey(url?: string, scopes?: string | string[]): string;
+    /**
+     * Get a non-expired access token, after refreshing if necessary.
+     *
+     * @param url The URI being authorized.
+     * @param additionalClaims An object with a set of additional claims to
+     * include in the payload.
+     * @returns An object that includes the authorization header.
+     */
+    getRequestHeaders(url?: string, additionalClaims?: Claims, scopes?: string | string[]): Headers;
+    /**
+     * Returns an expiration time for the JWT token.
+     *
+     * @param iat The issued at time for the JWT.
+     * @returns An expiration time for the JWT.
+     */
+    private static getExpirationTime;
+    /**
+     * Create a JWTAccess credentials instance using the given input options.
+     * @param json The input object.
+     */
+    fromJSON(json: JWTInput): void;
+    /**
+     * Create a JWTAccess credentials instance using the given input stream.
+     * @param inputStream The input stream.
+     * @param callback Optional callback.
+     */
+    fromStream(inputStream: stream.Readable): Promise<void>;
+    fromStream(inputStream: stream.Readable, callback: (err?: Error) => void): void;
+    private fromStreamAsync;
+}

package/node_modules/google-auth-library/build/src/auth/jwtaccess.js

@@ -0,0 +1,201 @@
+"use strict";
+// Copyright 2015 Google LLC
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//      http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.JWTAccess = void 0;
+const jws = require("jws");
+const util_1 = require("../util");
+const DEFAULT_HEADER = {
+    alg: 'RS256',
+    typ: 'JWT',
+};
+class JWTAccess {
+    email;
+    key;
+    keyId;
+    projectId;
+    eagerRefreshThresholdMillis;
+    cache = new util_1.LRUCache({
+        capacity: 500,
+        maxAge: 60 * 60 * 1000,
+    });
+    /**
+     * JWTAccess service account credentials.
+     *
+     * Create a new access token by using the credential to create a new JWT token
+     * that's recognized as the access token.
+     *
+     * @param email the service account email address.
+     * @param key the private key that will be used to sign the token.
+     * @param keyId the ID of the private key used to sign the token.
+     */
+    constructor(email, key, keyId, eagerRefreshThresholdMillis) {
+        this.email = email;
+        this.key = key;
+        this.keyId = keyId;
+        this.eagerRefreshThresholdMillis =
+            eagerRefreshThresholdMillis ?? 5 * 60 * 1000;
+    }
+    /**
+     * Ensures that we're caching a key appropriately, giving precedence to scopes vs. url
+     *
+     * @param url The URI being authorized.
+     * @param scopes The scope or scopes being authorized
+     * @returns A string that returns the cached key.
+     */
+    getCachedKey(url, scopes) {
+        let cacheKey = url;
+        if (scopes && Array.isArray(scopes) && scopes.length) {
+            cacheKey = url ? `${url}_${scopes.join('_')}` : `${scopes.join('_')}`;
+        }
+        else if (typeof scopes === 'string') {
+            cacheKey = url ? `${url}_${scopes}` : scopes;
+        }
+        if (!cacheKey) {
+            throw Error('Scopes or url must be provided');
+        }
+        return cacheKey;
+    }
+    /**
+     * Get a non-expired access token, after refreshing if necessary.
+     *
+     * @param url The URI being authorized.
+     * @param additionalClaims An object with a set of additional claims to
+     * include in the payload.
+     * @returns An object that includes the authorization header.
+     */
+    getRequestHeaders(url, additionalClaims, scopes) {
+        // Return cached authorization headers, unless we are within
+        // eagerRefreshThresholdMillis ms of them expiring:
+        const key = this.getCachedKey(url, scopes);
+        const cachedToken = this.cache.get(key);
+        const now = Date.now();
+        if (cachedToken &&
+            cachedToken.expiration - now > this.eagerRefreshThresholdMillis) {
+            // Copying headers into a new `Headers` object to avoid potential leakage -
+            // as this is a cache it is possible for multiple requests to reference this
+            // same value.
+            return new Headers(cachedToken.headers);
+        }
+        const iat = Math.floor(Date.now() / 1000);
+        const exp = JWTAccess.getExpirationTime(iat);
+        let defaultClaims;
+        // Turn scopes into space-separated string
+        if (Array.isArray(scopes)) {
+            scopes = scopes.join(' ');
+        }
+        // If scopes are specified, sign with scopes
+        if (scopes) {
+            defaultClaims = {
+                iss: this.email,
+                sub: this.email,
+                scope: scopes,
+                exp,
+                iat,
+            };
+        }
+        else {
+            defaultClaims = {
+                iss: this.email,
+                sub: this.email,
+                aud: url,
+                exp,
+                iat,
+            };
+        }
+        // if additionalClaims are provided, ensure they do not collide with
+        // other required claims.
+        if (additionalClaims) {
+            for (const claim in defaultClaims) {
+                if (additionalClaims[claim]) {
+                    throw new Error(`The '${claim}' property is not allowed when passing additionalClaims. This claim is included in the JWT by default.`);
+                }
+            }
+        }
+        const header = this.keyId
+            ? { ...DEFAULT_HEADER, kid: this.keyId }
+            : DEFAULT_HEADER;
+        const payload = Object.assign(defaultClaims, additionalClaims);
+        // Sign the jwt and add it to the cache
+        const signedJWT = jws.sign({ header, payload, secret: this.key });
+        const headers = new Headers({ authorization: `Bearer ${signedJWT}` });
+        this.cache.set(key, {
+            expiration: exp * 1000,
+            headers,
+        });
+        return headers;
+    }
+    /**
+     * Returns an expiration time for the JWT token.
+     *
+     * @param iat The issued at time for the JWT.
+     * @returns An expiration time for the JWT.
+     */
+    static getExpirationTime(iat) {
+        const exp = iat + 3600; // 3600 seconds = 1 hour
+        return exp;
+    }
+    /**
+     * Create a JWTAccess credentials instance using the given input options.
+     * @param json The input object.
+     */
+    fromJSON(json) {
+        if (!json) {
+            throw new Error('Must pass in a JSON object containing the service account auth settings.');
+        }
+        if (!json.client_email) {
+            throw new Error('The incoming JSON object does not contain a client_email field');
+        }
+        if (!json.private_key) {
+            throw new Error('The incoming JSON object does not contain a private_key field');
+        }
+        // Extract the relevant information from the json key file.
+        this.email = json.client_email;
+        this.key = json.private_key;
+        this.keyId = json.private_key_id;
+        this.projectId = json.project_id;
+    }
+    fromStream(inputStream, callback) {
+        if (callback) {
+            this.fromStreamAsync(inputStream).then(() => callback(), callback);
+        }
+        else {
+            return this.fromStreamAsync(inputStream);
+        }
+    }
+    fromStreamAsync(inputStream) {
+        return new Promise((resolve, reject) => {
+            if (!inputStream) {
+                reject(new Error('Must pass in a stream containing the service account auth settings.'));
+            }
+            let s = '';
+            inputStream
+                .setEncoding('utf8')
+                .on('data', chunk => (s += chunk))
+                .on('error', reject)
+                .on('end', () => {
+                try {
+                    const data = JSON.parse(s);
+                    this.fromJSON(data);
+                    resolve();
+                }
+                catch (err) {
+                    reject(err);
+                }
+            });
+        });
+    }
+}
+exports.JWTAccess = JWTAccess;
+//# sourceMappingURL=jwtaccess.js.map

package/node_modules/google-auth-library/build/src/auth/jwtclient.d.ts

@@ -0,0 +1,137 @@
+import { GoogleToken } from '../gtoken/googleToken';
+import * as stream from 'stream';
+import { CredentialBody, Credentials, JWTInput } from './credentials';
+import { IdTokenProvider } from './idtokenclient';
+import { GetTokenResponse, OAuth2Client, OAuth2ClientOptions, RequestMetadataResponse } from './oauth2client';
+export interface JWTOptions extends OAuth2ClientOptions {
+    /**
+     * The service account email address.
+     */
+    email?: string;
+    /**
+     * The path to private key file. Not necessary if {@link JWTOptions.key} has been provided.
+     */
+    keyFile?: string;
+    /**
+     * The value of key. Not necessary if {@link JWTOptions.keyFile} has been provided.
+     */
+    key?: string;
+    /**
+     * The list of requested scopes or a single scope.
+     */
+    keyId?: string;
+    /**
+     * The impersonated account's email address.
+     */
+    scopes?: string | string[];
+    /**
+     * The ID of the key.
+     */
+    subject?: string;
+    /**
+     * Additional claims, such as target audience.
+     *
+     * @example
+     * ```
+     * {target_audience: 'targetAudience'}
+     * ```
+     */
+    additionalClaims?: {};
+}
+export declare class JWT extends OAuth2Client implements IdTokenProvider {
+    email?: string;
+    keyFile?: string;
+    key?: string;
+    keyId?: string;
+    defaultScopes?: string | string[];
+    scopes?: string | string[];
+    scope?: string;
+    subject?: string;
+    gtoken?: GoogleToken;
+    additionalClaims?: {};
+    useJWTAccessWithScope?: boolean;
+    defaultServicePath?: string;
+    private access?;
+    /**
+     * JWT service account credentials.
+     *
+     * Retrieve access token using gtoken.
+     *
+     * @param options the
+     */
+    constructor(options?: JWTOptions);
+    /**
+     * Creates a copy of the credential with the specified scopes.
+     * @param scopes List of requested scopes or a single scope.
+     * @return The cloned instance.
+     */
+    createScoped(scopes?: string | string[]): JWT;
+    /**
+     * Obtains the metadata to be sent with the request.
+     *
+     * @param url the URI being authorized.
+     */
+    protected getRequestMetadataAsync(url?: string | null): Promise<RequestMetadataResponse>;
+    /**
+     * Fetches an ID token.
+     * @param targetAudience the audience for the fetched ID token.
+     */
+    fetchIdToken(targetAudience: string): Promise<string>;
+    /**
+     * Determine if there are currently scopes available.
+     */
+    private hasUserScopes;
+    /**
+     * Are there any default or user scopes defined.
+     */
+    private hasAnyScopes;
+    /**
+     * Get the initial access token using gToken.
+     * @param callback Optional callback.
+     * @returns Promise that resolves with credentials
+     */
+    authorize(): Promise<Credentials>;
+    authorize(callback: (err: Error | null, result?: Credentials) => void): void;
+    private authorizeAsync;
+    /**
+     * Refreshes the access token.
+     * @param refreshToken ignored
+     * @private
+     */
+    protected refreshTokenNoCache(): Promise<GetTokenResponse>;
+    /**
+     * Create a gToken if it doesn't already exist.
+     */
+    private createGToken;
+    /**
+     * Create a JWT credentials instance using the given input options.
+     * @param json The input object.
+     *
+     * @remarks
+     *
+     * **Important**: If you accept a credential configuration (credential JSON/File/Stream) from an external source for authentication to Google Cloud, you must validate it before providing it to any Google API or library. Providing an unvalidated credential configuration to Google APIs can compromise the security of your systems and data. For more information, refer to {@link https://cloud.google.com/docs/authentication/external/externally-sourced-credentials Validate credential configurations from external sources}.
+     */
+    fromJSON(json: JWTInput): void;
+    /**
+     * Create a JWT credentials instance using the given input stream.
+     * @param inputStream The input stream.
+     * @param callback Optional callback.
+     *
+     * @remarks
+     *
+     * **Important**: If you accept a credential configuration (credential JSON/File/Stream) from an external source for authentication to Google Cloud, you must validate it before providing it to any Google API or library. Providing an unvalidated credential configuration to Google APIs can compromise the security of your systems and data. For more information, refer to {@link https://cloud.google.com/docs/authentication/external/externally-sourced-credentials Validate credential configurations from external sources}.
+     */
+    fromStream(inputStream: stream.Readable): Promise<void>;
+    fromStream(inputStream: stream.Readable, callback: (err?: Error | null) => void): void;
+    private fromStreamAsync;
+    /**
+     * Creates a JWT credentials instance using an API Key for authentication.
+     * @param apiKey The API Key in string form.
+     */
+    fromAPIKey(apiKey: string): void;
+    /**
+     * Using the key or keyFile on the JWT client, obtain an object that contains
+     * the key and the client email.
+     */
+    getCredentials(): Promise<CredentialBody>;
+}