@openclaw/googlechat 2026.5.20 → 2026.5.22

package/node_modules/google-auth-library/build/src/auth/authclient.d.ts

@@ -0,0 +1,298 @@
+import { EventEmitter } from 'events';
+import { Gaxios, GaxiosOptions, GaxiosPromise, GaxiosResponse } from 'gaxios';
+import { Credentials } from './credentials';
+import { OriginalAndCamel } from '../util';
+/**
+ * An interface for enforcing `fetch`-type compliance.
+ *
+ * @remarks
+ *
+ * This provides type guarantees during build-time, ensuring the `fetch` method is 1:1
+ * compatible with the `Gaxios#fetch` API.
+ */
+interface GaxiosFetchCompliance {
+    fetch: typeof fetch | Gaxios['fetch'];
+}
+/**
+ * Easy access to symbol-indexed strings on config objects.
+ */
+export type SymbolIndexString = {
+    [key: symbol]: string | undefined;
+};
+/**
+ * Base auth configurations (e.g. from JWT or `.json` files) with conventional
+ * camelCased options.
+ *
+ * @privateRemarks
+ *
+ * This interface is purposely not exported so that it can be removed once
+ * {@link https://github.com/microsoft/TypeScript/issues/50715} has been
+ * resolved. Then, we can use {@link OriginalAndCamel} to shrink this interface.
+ *
+ * Tracking: {@link https://github.com/googleapis/google-auth-library-nodejs/issues/1686}
+ */
+interface AuthJSONOptions {
+    /**
+     * The project ID corresponding to the current credentials if available.
+     */
+    project_id: string | null;
+    /**
+     * An alias for {@link AuthJSONOptions.project_id `project_id`}.
+     */
+    projectId: AuthJSONOptions['project_id'];
+    /**
+     * The quota project ID. The quota project can be used by client libraries for the billing purpose.
+     * See {@link https://cloud.google.com/docs/quota Working with quotas}
+     */
+    quota_project_id: string;
+    /**
+     * An alias for {@link AuthJSONOptions.quota_project_id `quota_project_id`}.
+     */
+    quotaProjectId: AuthJSONOptions['quota_project_id'];
+    /**
+     * The default service domain for a given Cloud universe.
+     *
+     * @example
+     * 'googleapis.com'
+     */
+    universe_domain: string;
+    /**
+     * An alias for {@link AuthJSONOptions.universe_domain `universe_domain`}.
+     */
+    universeDomain: AuthJSONOptions['universe_domain'];
+}
+/**
+ * Base `AuthClient` configuration.
+ *
+ * The camelCased options are aliases of the snake_cased options, supporting both
+ * JSON API and JS conventions.
+ */
+export interface AuthClientOptions extends Partial<OriginalAndCamel<AuthJSONOptions>> {
+    /**
+     * An API key to use, optional.
+     */
+    apiKey?: string;
+    credentials?: Credentials;
+    /**
+     * The {@link Gaxios `Gaxios`} instance used for making requests.
+     *
+     * @see {@link AuthClientOptions.useAuthRequestParameters}
+     */
+    transporter?: Gaxios;
+    /**
+     * Provides default options to the transporter, such as {@link GaxiosOptions.agent `agent`} or
+     *  {@link GaxiosOptions.retryConfig `retryConfig`}.
+     *
+     * This option is ignored if {@link AuthClientOptions.transporter `gaxios`} has been provided
+     */
+    transporterOptions?: GaxiosOptions;
+    /**
+     * The expiration threshold in milliseconds before forcing token refresh of
+     * unexpired tokens.
+     */
+    eagerRefreshThresholdMillis?: number;
+    /**
+     * Whether to attempt to refresh tokens on status 401/403 responses
+     * even if an attempt is made to refresh the token preemptively based
+     * on the expiry_date.
+     */
+    forceRefreshOnFailure?: boolean;
+    /**
+     * Enables/disables the adding of the AuthClient's default interceptor.
+     *
+     * @see {@link AuthClientOptions.transporter}
+     *
+     * @remarks
+     *
+     * Disabling is useful for debugging and experimentation.
+     *
+     * @default true
+     */
+    useAuthRequestParameters?: boolean;
+}
+/**
+ * The default cloud universe
+ *
+ * @see {@link AuthJSONOptions.universe_domain}
+ */
+export declare const DEFAULT_UNIVERSE = "googleapis.com";
+/**
+ * The default {@link AuthClientOptions.eagerRefreshThresholdMillis}
+ */
+export declare const DEFAULT_EAGER_REFRESH_THRESHOLD_MILLIS: number;
+/**
+ * Defines the root interface for all clients that generate credentials
+ * for calling Google APIs. All clients should implement this interface.
+ */
+export interface CredentialsClient {
+    projectId?: AuthClientOptions['projectId'];
+    eagerRefreshThresholdMillis: NonNullable<AuthClientOptions['eagerRefreshThresholdMillis']>;
+    forceRefreshOnFailure: NonNullable<AuthClientOptions['forceRefreshOnFailure']>;
+    /**
+     * @return A promise that resolves with the current GCP access token
+     *   response. If the current credential is expired, a new one is retrieved.
+     */
+    getAccessToken(): Promise<GetAccessTokenResponse>;
+    /**
+     * The main authentication interface. It takes an optional url which when
+     * present is the endpoint being accessed, and returns a Promise which
+     * resolves with authorization header fields.
+     *
+     * The result has the form:
+     * { authorization: 'Bearer <access_token_value>' }
+     * @param url The URI being authorized.
+     */
+    getRequestHeaders(url?: string | URL): Promise<Headers>;
+    /**
+     * Provides an alternative Gaxios request implementation with auth credentials
+     */
+    request<T>(opts: GaxiosOptions): GaxiosPromise<T>;
+    /**
+     * Sets the auth credentials.
+     */
+    setCredentials(credentials: Credentials): void;
+    /**
+     * Subscribes a listener to the tokens event triggered when a token is
+     * generated.
+     *
+     * @param event The tokens event to subscribe to.
+     * @param listener The listener that triggers on event trigger.
+     * @return The current client instance.
+     */
+    on(event: 'tokens', listener: (tokens: Credentials) => void): this;
+}
+export declare interface AuthClient {
+    on(event: 'tokens', listener: (tokens: Credentials) => void): this;
+}
+/**
+ * The base of all Auth Clients.
+ */
+export declare abstract class AuthClient extends EventEmitter implements CredentialsClient, GaxiosFetchCompliance {
+    apiKey?: string;
+    projectId?: string | null;
+    /**
+     * The quota project ID. The quota project can be used by client libraries for the billing purpose.
+     * See {@link https://cloud.google.com/docs/quota Working with quotas}
+     */
+    quotaProjectId?: string;
+    /**
+     * The {@link Gaxios `Gaxios`} instance used for making requests.
+     */
+    transporter: Gaxios;
+    credentials: Credentials;
+    eagerRefreshThresholdMillis: number;
+    forceRefreshOnFailure: boolean;
+    universeDomain: string;
+    /**
+     * Symbols that can be added to GaxiosOptions to specify the method name that is
+     * making an RPC call, for logging purposes, as well as a string ID that can be
+     * used to correlate calls and responses.
+     */
+    static readonly RequestMethodNameSymbol: unique symbol;
+    static readonly RequestLogIdSymbol: unique symbol;
+    constructor(opts?: AuthClientOptions);
+    /**
+     * A {@link fetch `fetch`} compliant API for {@link AuthClient}.
+     *
+     * @see {@link AuthClient.request} for the classic method.
+     *
+     * @remarks
+     *
+     * This is useful as a drop-in replacement for `fetch` API usage.
+     *
+     * @example
+     *
+     * ```ts
+     * const authClient = new AuthClient();
+     * const fetchWithAuthClient: typeof fetch = (...args) => authClient.fetch(...args);
+     * await fetchWithAuthClient('https://example.com');
+     * ```
+     *
+     * @param args `fetch` API or {@link Gaxios.fetch `Gaxios#fetch`} parameters
+     * @returns the {@link GaxiosResponse} with Gaxios-added properties
+     */
+    fetch<T>(...args: Parameters<Gaxios['fetch']>): GaxiosPromise<T>;
+    /**
+     * The public request API in which credentials may be added to the request.
+     *
+     * @see {@link AuthClient.fetch} for the modern method.
+     *
+     * @param options options for `gaxios`
+     */
+    abstract request<T>(options: GaxiosOptions): GaxiosPromise<T>;
+    /**
+     * The main authentication interface. It takes an optional url which when
+     * present is the endpoint being accessed, and returns a Promise which
+     * resolves with authorization header fields.
+     *
+     * The result has the form:
+     * ```ts
+     * new Headers({'authorization': 'Bearer <access_token_value>'});
+     * ```
+     *
+     * @param url The URI being authorized.
+     */
+    abstract getRequestHeaders(url?: string | URL): Promise<Headers>;
+    /**
+     * @return A promise that resolves with the current GCP access token
+     *   response. If the current credential is expired, a new one is retrieved.
+     */
+    abstract getAccessToken(): Promise<{
+        token?: string | null;
+        res?: GaxiosResponse | null;
+    }>;
+    /**
+     * Sets the auth credentials.
+     */
+    setCredentials(credentials: Credentials): void;
+    /**
+     * Append additional headers, e.g., x-goog-user-project, shared across the
+     * classes inheriting AuthClient. This method should be used by any method
+     * that overrides getRequestMetadataAsync(), which is a shared helper for
+     * setting request information in both gRPC and HTTP API calls.
+     *
+     * @param headers object to append additional headers to.
+     */
+    protected addSharedMetadataHeaders(headers: Headers): Headers;
+    /**
+     * Adds the `x-goog-user-project` and `authorization` headers to the target Headers
+     * object, if they exist on the source.
+     *
+     * @param target the headers to target
+     * @param source the headers to source from
+     * @returns the target headers
+     */
+    protected addUserProjectAndAuthHeaders<T extends Headers>(target: T, source: Headers): T;
+    static log: import("google-logging-utils").AdhocDebugLogFunction;
+    static readonly DEFAULT_REQUEST_INTERCEPTOR: Parameters<Gaxios['interceptors']['request']['add']>[0];
+    static readonly DEFAULT_RESPONSE_INTERCEPTOR: Parameters<Gaxios['interceptors']['response']['add']>[0];
+    /**
+     * Sets the method name that is making a Gaxios request, so that logging may tag
+     * log lines with the operation.
+     * @param config A Gaxios request config
+     * @param methodName The method name making the call
+     */
+    static setMethodName(config: GaxiosOptions, methodName: string): void;
+    /**
+     * Retry config for Auth-related requests.
+     *
+     * @remarks
+     *
+     * This is not a part of the default {@link AuthClient.transporter transporter/gaxios}
+     * config as some downstream APIs would prefer if customers explicitly enable retries,
+     * such as GCS.
+     */
+    protected static get RETRY_CONFIG(): GaxiosOptions;
+}
+export type HeadersInit = ConstructorParameters<typeof Headers>[0];
+export interface GetAccessTokenResponse {
+    token?: string | null;
+    res?: GaxiosResponse | null;
+}
+/**
+ * @deprecated - use the Promise API instead
+ */
+export interface BodyResponseCallback<T> {
+    (err: Error | null, res?: GaxiosResponse<T> | null): void;
+}
+export {};

package/node_modules/google-auth-library/build/src/auth/authclient.js

@@ -0,0 +1,286 @@
+"use strict";
+// Copyright 2012 Google LLC
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//      http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.AuthClient = exports.DEFAULT_EAGER_REFRESH_THRESHOLD_MILLIS = exports.DEFAULT_UNIVERSE = void 0;
+const events_1 = require("events");
+const gaxios_1 = require("gaxios");
+const util_1 = require("../util");
+const google_logging_utils_1 = require("google-logging-utils");
+const shared_cjs_1 = require("../shared.cjs");
+/**
+ * The default cloud universe
+ *
+ * @see {@link AuthJSONOptions.universe_domain}
+ */
+exports.DEFAULT_UNIVERSE = 'googleapis.com';
+/**
+ * The default {@link AuthClientOptions.eagerRefreshThresholdMillis}
+ */
+exports.DEFAULT_EAGER_REFRESH_THRESHOLD_MILLIS = 5 * 60 * 1000;
+/**
+ * The base of all Auth Clients.
+ */
+class AuthClient extends events_1.EventEmitter {
+    apiKey;
+    projectId;
+    /**
+     * The quota project ID. The quota project can be used by client libraries for the billing purpose.
+     * See {@link https://cloud.google.com/docs/quota Working with quotas}
+     */
+    quotaProjectId;
+    /**
+     * The {@link Gaxios `Gaxios`} instance used for making requests.
+     */
+    transporter;
+    credentials = {};
+    eagerRefreshThresholdMillis = exports.DEFAULT_EAGER_REFRESH_THRESHOLD_MILLIS;
+    forceRefreshOnFailure = false;
+    universeDomain = exports.DEFAULT_UNIVERSE;
+    /**
+     * Symbols that can be added to GaxiosOptions to specify the method name that is
+     * making an RPC call, for logging purposes, as well as a string ID that can be
+     * used to correlate calls and responses.
+     */
+    static RequestMethodNameSymbol = Symbol('request method name');
+    static RequestLogIdSymbol = Symbol('request log id');
+    constructor(opts = {}) {
+        super();
+        const options = (0, util_1.originalOrCamelOptions)(opts);
+        // Shared auth options
+        this.apiKey = opts.apiKey;
+        this.projectId = options.get('project_id') ?? null;
+        this.quotaProjectId = options.get('quota_project_id');
+        this.credentials = options.get('credentials') ?? {};
+        this.universeDomain = options.get('universe_domain') ?? exports.DEFAULT_UNIVERSE;
+        // Shared client options
+        this.transporter = opts.transporter ?? new gaxios_1.Gaxios(opts.transporterOptions);
+        if (options.get('useAuthRequestParameters') !== false) {
+            this.transporter.interceptors.request.add(AuthClient.DEFAULT_REQUEST_INTERCEPTOR);
+            this.transporter.interceptors.response.add(AuthClient.DEFAULT_RESPONSE_INTERCEPTOR);
+        }
+        if (opts.eagerRefreshThresholdMillis) {
+            this.eagerRefreshThresholdMillis = opts.eagerRefreshThresholdMillis;
+        }
+        this.forceRefreshOnFailure = opts.forceRefreshOnFailure ?? false;
+    }
+    /**
+     * A {@link fetch `fetch`} compliant API for {@link AuthClient}.
+     *
+     * @see {@link AuthClient.request} for the classic method.
+     *
+     * @remarks
+     *
+     * This is useful as a drop-in replacement for `fetch` API usage.
+     *
+     * @example
+     *
+     * ```ts
+     * const authClient = new AuthClient();
+     * const fetchWithAuthClient: typeof fetch = (...args) => authClient.fetch(...args);
+     * await fetchWithAuthClient('https://example.com');
+     * ```
+     *
+     * @param args `fetch` API or {@link Gaxios.fetch `Gaxios#fetch`} parameters
+     * @returns the {@link GaxiosResponse} with Gaxios-added properties
+     */
+    fetch(...args) {
+        // Up to 2 parameters in either overload
+        const input = args[0];
+        const init = args[1];
+        let url = undefined;
+        const headers = new Headers();
+        // prepare URL
+        if (typeof input === 'string') {
+            url = new URL(input);
+        }
+        else if (input instanceof URL) {
+            url = input;
+        }
+        else if (input && input.url) {
+            url = new URL(input.url);
+        }
+        // prepare headers
+        if (input && typeof input === 'object' && 'headers' in input) {
+            gaxios_1.Gaxios.mergeHeaders(headers, input.headers);
+        }
+        if (init) {
+            gaxios_1.Gaxios.mergeHeaders(headers, new Headers(init.headers));
+        }
+        // prepare request
+        if (typeof input === 'object' && !(input instanceof URL)) {
+            // input must have been a non-URL object
+            return this.request({ ...init, ...input, headers, url });
+        }
+        else {
+            // input must have been a string or URL
+            return this.request({ ...init, headers, url });
+        }
+    }
+    /**
+     * Sets the auth credentials.
+     */
+    setCredentials(credentials) {
+        this.credentials = credentials;
+    }
+    /**
+     * Append additional headers, e.g., x-goog-user-project, shared across the
+     * classes inheriting AuthClient. This method should be used by any method
+     * that overrides getRequestMetadataAsync(), which is a shared helper for
+     * setting request information in both gRPC and HTTP API calls.
+     *
+     * @param headers object to append additional headers to.
+     */
+    addSharedMetadataHeaders(headers) {
+        // quota_project_id, stored in application_default_credentials.json, is set in
+        // the x-goog-user-project header, to indicate an alternate account for
+        // billing and quota:
+        if (!headers.has('x-goog-user-project') && // don't override a value the user sets.
+            this.quotaProjectId) {
+            headers.set('x-goog-user-project', this.quotaProjectId);
+        }
+        return headers;
+    }
+    /**
+     * Adds the `x-goog-user-project` and `authorization` headers to the target Headers
+     * object, if they exist on the source.
+     *
+     * @param target the headers to target
+     * @param source the headers to source from
+     * @returns the target headers
+     */
+    addUserProjectAndAuthHeaders(target, source) {
+        const xGoogUserProject = source.get('x-goog-user-project');
+        const authorizationHeader = source.get('authorization');
+        if (xGoogUserProject) {
+            target.set('x-goog-user-project', xGoogUserProject);
+        }
+        if (authorizationHeader) {
+            target.set('authorization', authorizationHeader);
+        }
+        return target;
+    }
+    static log = (0, google_logging_utils_1.log)('auth');
+    static DEFAULT_REQUEST_INTERCEPTOR = {
+        resolved: async (config) => {
+            // Set `x-goog-api-client`, if not already set
+            if (!config.headers.has('x-goog-api-client')) {
+                const nodeVersion = process.version.replace(/^v/, '');
+                config.headers.set('x-goog-api-client', `gl-node/${nodeVersion}`);
+            }
+            // Set `User-Agent`
+            const userAgent = config.headers.get('User-Agent');
+            if (!userAgent) {
+                config.headers.set('User-Agent', shared_cjs_1.USER_AGENT);
+            }
+            else if (!userAgent.includes(`${shared_cjs_1.PRODUCT_NAME}/`)) {
+                config.headers.set('User-Agent', `${userAgent} ${shared_cjs_1.USER_AGENT}`);
+            }
+            try {
+                const symbols = config;
+                const methodName = symbols[AuthClient.RequestMethodNameSymbol];
+                // This doesn't need to be very unique or interesting, it's just an aid for
+                // matching requests to responses.
+                const logId = `${Math.floor(Math.random() * 1000)}`;
+                symbols[AuthClient.RequestLogIdSymbol] = logId;
+                // Boil down the object we're printing out.
+                const logObject = {
+                    url: config.url,
+                    headers: config.headers,
+                };
+                if (methodName) {
+                    AuthClient.log.info('%s [%s] request %j', methodName, logId, logObject);
+                }
+                else {
+                    AuthClient.log.info('[%s] request %j', logId, logObject);
+                }
+            }
+            catch (e) {
+                // Logging must not create new errors; swallow them all.
+            }
+            return config;
+        },
+    };
+    static DEFAULT_RESPONSE_INTERCEPTOR = {
+        resolved: async (response) => {
+            try {
+                const symbols = response.config;
+                const methodName = symbols[AuthClient.RequestMethodNameSymbol];
+                const logId = symbols[AuthClient.RequestLogIdSymbol];
+                if (methodName) {
+                    AuthClient.log.info('%s [%s] response %j', methodName, logId, response.data);
+                }
+                else {
+                    AuthClient.log.info('[%s] response %j', logId, response.data);
+                }
+            }
+            catch (e) {
+                // Logging must not create new errors; swallow them all.
+            }
+            return response;
+        },
+        rejected: async (error) => {
+            try {
+                const symbols = error.config;
+                const methodName = symbols[AuthClient.RequestMethodNameSymbol];
+                const logId = symbols[AuthClient.RequestLogIdSymbol];
+                if (methodName) {
+                    AuthClient.log.info('%s [%s] error %j', methodName, logId, error.response?.data);
+                }
+                else {
+                    AuthClient.log.error('[%s] error %j', logId, error.response?.data);
+                }
+            }
+            catch (e) {
+                // Logging must not create new errors; swallow them all.
+            }
+            // Re-throw the error.
+            throw error;
+        },
+    };
+    /**
+     * Sets the method name that is making a Gaxios request, so that logging may tag
+     * log lines with the operation.
+     * @param config A Gaxios request config
+     * @param methodName The method name making the call
+     */
+    static setMethodName(config, methodName) {
+        try {
+            const symbols = config;
+            symbols[AuthClient.RequestMethodNameSymbol] = methodName;
+        }
+        catch (e) {
+            // Logging must not create new errors; swallow them all.
+        }
+    }
+    /**
+     * Retry config for Auth-related requests.
+     *
+     * @remarks
+     *
+     * This is not a part of the default {@link AuthClient.transporter transporter/gaxios}
+     * config as some downstream APIs would prefer if customers explicitly enable retries,
+     * such as GCS.
+     */
+    static get RETRY_CONFIG() {
+        return {
+            retry: true,
+            retryConfig: {
+                httpMethodsToRetry: ['GET', 'PUT', 'POST', 'HEAD', 'OPTIONS', 'DELETE'],
+            },
+        };
+    }
+}
+exports.AuthClient = AuthClient;
+//# sourceMappingURL=authclient.js.map

package/node_modules/google-auth-library/build/src/auth/awsclient.d.ts

@@ -0,0 +1,115 @@
+import { AwsSecurityCredentials } from './awsrequestsigner';
+import { BaseExternalAccountClient, BaseExternalAccountClientOptions, ExternalAccountSupplierContext } from './baseexternalclient';
+import { SnakeToCamelObject } from '../util';
+/**
+ * AWS credentials JSON interface. This is used for AWS workloads.
+ */
+export interface AwsClientOptions extends BaseExternalAccountClientOptions {
+    /**
+     * Object containing options to retrieve AWS security credentials. A valid credential
+     * source or a aws security credentials supplier should be specified.
+     */
+    credential_source?: {
+        /**
+         * AWS environment ID. Currently only 'AWS1' is supported.
+         */
+        environment_id: string;
+        /**
+         * The EC2 metadata URL to retrieve the current AWS region from. If this is
+         * not provided, the region should be present in the AWS_REGION or AWS_DEFAULT_REGION
+         * environment variables.
+         */
+        region_url?: string;
+        /**
+         * The EC2 metadata URL to retrieve AWS security credentials. If this is not provided,
+         * the credentials should be present in the AWS_ACCESS_KEY_ID, AWS_SECRET_ACCESS_KEY,
+         * and AWS_SESSION_TOKEN environment variables.
+         */
+        url?: string;
+        /**
+         * The regional GetCallerIdentity action URL, used to determine the account
+         * ID and its roles.
+         */
+        regional_cred_verification_url: string;
+        /**
+         *  The imdsv2 session token url is used to fetch session token from AWS
+         *  which is later sent through headers for metadata requests. If the
+         *  field is missing, then session token won't be fetched and sent with
+         *  the metadata requests.
+         *  The session token is required for IMDSv2 but optional for IMDSv1
+         */
+        imdsv2_session_token_url?: string;
+    };
+    /**
+     * The AWS security credentials supplier to call to retrieve the AWS region
+     * and AWS security credentials. Either this or a valid credential source
+     * must be specified.
+     */
+    aws_security_credentials_supplier?: AwsSecurityCredentialsSupplier;
+}
+/**
+ * Supplier interface for AWS security credentials. This can be implemented to
+ * return an AWS region and AWS security credentials. These credentials can
+ * then be exchanged for a GCP token by an {@link AwsClient}.
+ */
+export interface AwsSecurityCredentialsSupplier {
+    /**
+     * Gets the active AWS region.
+     * @param context {@link ExternalAccountSupplierContext} from the calling
+     *   {@link AwsClient}, contains the requested audience and subject token type
+     *   for the external account identity as well as the transport from the
+     *   calling client to use for requests.
+     * @return A promise that resolves with the AWS region string.
+     */
+    getAwsRegion: (context: ExternalAccountSupplierContext) => Promise<string>;
+    /**
+     * Gets valid AWS security credentials for the requested external account
+     * identity. Note that these are not cached by the calling {@link AwsClient},
+     * so caching should be including in the implementation.
+     * @param context {@link ExternalAccountSupplierContext} from the calling
+     *   {@link AwsClient}, contains the requested audience and subject token type
+     *   for the external account identity as well as the transport from the
+     *   calling client to use for requests.
+     * @return A promise that resolves with the requested {@link AwsSecurityCredentials}.
+     */
+    getAwsSecurityCredentials: (context: ExternalAccountSupplierContext) => Promise<AwsSecurityCredentials>;
+}
+/**
+ * AWS external account client. This is used for AWS workloads, where
+ * AWS STS GetCallerIdentity serialized signed requests are exchanged for
+ * GCP access token.
+ */
+export declare class AwsClient extends BaseExternalAccountClient {
+    #private;
+    private readonly environmentId?;
+    private readonly awsSecurityCredentialsSupplier;
+    private readonly regionalCredVerificationUrl;
+    private awsRequestSigner;
+    private region;
+    /**
+     * @deprecated AWS client no validates the EC2 metadata address.
+     **/
+    static AWS_EC2_METADATA_IPV4_ADDRESS: string;
+    /**
+     * @deprecated AWS client no validates the EC2 metadata address.
+     **/
+    static AWS_EC2_METADATA_IPV6_ADDRESS: string;
+    /**
+     * Instantiates an AwsClient instance using the provided JSON
+     * object loaded from an external account credentials file.
+     * An error is thrown if the credential is not a valid AWS credential.
+     * @param options The external account options object typically loaded
+     *   from the external account JSON credential file.
+     */
+    constructor(options: AwsClientOptions | SnakeToCamelObject<AwsClientOptions>);
+    private validateEnvironmentId;
+    /**
+     * Triggered when an external subject token is needed to be exchanged for a
+     * GCP access token via GCP STS endpoint. This will call the
+     * {@link AwsSecurityCredentialsSupplier} to retrieve an AWS region and AWS
+     * Security Credentials, then use them to create a signed AWS STS request that
+     * can be exchanged for a GCP access token.
+     * @return A promise that resolves with the external subject token.
+     */
+    retrieveSubjectToken(): Promise<string>;
+}