@openclaw/googlechat 2026.5.20 → 2026.5.22

package/node_modules/google-auth-library/build/src/auth/iam.d.ts

@@ -0,0 +1,23 @@
+export interface RequestMetadata {
+    'x-goog-iam-authority-selector': string;
+    'x-goog-iam-authorization-token': string;
+}
+export declare class IAMAuth {
+    selector: string;
+    token: string;
+    /**
+     * IAM credentials.
+     *
+     * @param selector the iam authority selector
+     * @param token the token
+     * @constructor
+     */
+    constructor(selector: string, token: string);
+    /**
+     * Acquire the HTTP headers required to make an authenticated request.
+     */
+    getRequestHeaders(): {
+        'x-goog-iam-authority-selector': string;
+        'x-goog-iam-authorization-token': string;
+    };
+}

package/node_modules/google-auth-library/build/src/auth/iam.js

@@ -0,0 +1,44 @@
+"use strict";
+// Copyright 2014 Google LLC
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//      http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.IAMAuth = void 0;
+class IAMAuth {
+    selector;
+    token;
+    /**
+     * IAM credentials.
+     *
+     * @param selector the iam authority selector
+     * @param token the token
+     * @constructor
+     */
+    constructor(selector, token) {
+        this.selector = selector;
+        this.token = token;
+        this.selector = selector;
+        this.token = token;
+    }
+    /**
+     * Acquire the HTTP headers required to make an authenticated request.
+     */
+    getRequestHeaders() {
+        return {
+            'x-goog-iam-authority-selector': this.selector,
+            'x-goog-iam-authorization-token': this.token,
+        };
+    }
+}
+exports.IAMAuth = IAMAuth;
+//# sourceMappingURL=iam.js.map

package/node_modules/google-auth-library/build/src/auth/identitypoolclient.d.ts

@@ -0,0 +1,132 @@
+import { BaseExternalAccountClient, BaseExternalAccountClientOptions, ExternalAccountSupplierContext } from './baseexternalclient';
+import { SnakeToCamelObject } from '../util';
+export type SubjectTokenFormatType = 'json' | 'text';
+export interface SubjectTokenJsonResponse {
+    [key: string]: string;
+}
+/**
+ * Supplier interface for subject tokens. This can be implemented to
+ * return a subject token which can then be exchanged for a GCP token by an
+ * {@link IdentityPoolClient}.
+ */
+export interface SubjectTokenSupplier {
+    /**
+     * Gets a valid subject token for the requested external account identity.
+     * Note that these are not cached by the calling {@link IdentityPoolClient},
+     * so caching should be including in the implementation.
+     * @param context {@link ExternalAccountSupplierContext} from the calling
+     *   {@link IdentityPoolClient}, contains the requested audience and subject token type
+     *   for the external account identity as well as the transport from the
+     *   calling client to use for requests.
+     * @return A promise that resolves with the requested subject token string.
+     */
+    getSubjectToken: (context: ExternalAccountSupplierContext) => Promise<string>;
+}
+/**
+ * Url-sourced/file-sourced credentials json interface.
+ * This is used for K8s and Azure workloads.
+ */
+export interface IdentityPoolClientOptions extends BaseExternalAccountClientOptions {
+    /**
+     * Object containing options to retrieve identity pool credentials. A valid credential
+     * source or a subject token supplier must be specified.
+     */
+    credential_source?: {
+        /**
+         * The file location to read the subject token from. Either this, a URL
+         * or a certificate location should be specified.
+         */
+        file?: string;
+        /**
+         * The URL to call to retrieve the subject token. Either this, a file
+         * location or a certificate location should be specified.
+         */
+        url?: string;
+        /**
+         * Optional headers to send on the request to the specified URL.
+         */
+        headers?: {
+            [key: string]: string;
+        };
+        /**
+         * The format that the subject token is in the file or the URL response.
+         * If not provided, will default to reading the text string directly.
+         */
+        format?: {
+            /**
+             * The format type. Can either be 'text' or 'json'.
+             */
+            type: SubjectTokenFormatType;
+            /**
+             * The field name containing the subject token value if the type is 'json'.
+             */
+            subject_token_field_name?: string;
+        };
+        /**
+         * The certificate location to call to retrieve the subject token. Either this, a file
+         * location, or an url should be specified.
+         * @example
+         * File Format:
+         * ```json
+         * {
+         * "cert_configs": {
+         *    "workload": {
+         *      "key_path": "$PATH_TO_LEAF_KEY",
+         *      "cert_path": "$PATH_TO_LEAF_CERT"
+         *    }
+         *  }
+         * }
+         * ```
+         */
+        certificate?: {
+            /**
+             * Specify whether the certificate config should be used from the default location.
+             * Either this or the certificate_config_location must be provided.
+             * The certificate config file must be in the following JSON format:
+             */
+            use_default_certificate_config?: boolean;
+            /**
+             * Location to fetch certificate config from in case default config is not to be used.
+             * Either this or use_default_certificate_config=true should be provided.
+             */
+            certificate_config_location?: string;
+            /**
+             * TrustChainPath specifies the path to a PEM-formatted file containing the X.509 certificate trust chain.
+             * The file should contain any intermediate certificates needed to connect
+             * the mTLS leaf certificate to a root certificate in the trust store.
+             */
+            trust_chain_path?: string;
+        };
+    };
+    /**
+     * The subject token supplier to call to retrieve the subject token to exchange
+     * for a GCP access token. Either this or a valid credential source should
+     * be specified.
+     */
+    subject_token_supplier?: SubjectTokenSupplier;
+}
+/**
+ * Defines the Url-sourced and file-sourced external account clients mainly
+ * used for K8s and Azure workloads.
+ */
+export declare class IdentityPoolClient extends BaseExternalAccountClient {
+    private readonly subjectTokenSupplier;
+    /**
+     * Instantiate an IdentityPoolClient instance using the provided JSON
+     * object loaded from an external account credentials file.
+     * An error is thrown if the credential is not a valid file-sourced or
+     * url-sourced credential or a workforce pool user project is provided
+     * with a non workforce audience.
+     * @param options The external account options object typically loaded
+     *   from the external account JSON credential file. The camelCased options
+     *   are aliases for the snake_cased options.
+     */
+    constructor(options: IdentityPoolClientOptions | SnakeToCamelObject<IdentityPoolClientOptions>);
+    /**
+     * Triggered when a external subject token is needed to be exchanged for a GCP
+     * access token via GCP STS endpoint. Gets a subject token by calling
+     * the configured {@link SubjectTokenSupplier}
+     * @return A promise that resolves with the external subject token.
+     */
+    retrieveSubjectToken(): Promise<string>;
+}

package/node_modules/google-auth-library/build/src/auth/identitypoolclient.js

@@ -0,0 +1,131 @@
+"use strict";
+// Copyright 2021 Google LLC
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//      http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.IdentityPoolClient = void 0;
+const baseexternalclient_1 = require("./baseexternalclient");
+const util_1 = require("../util");
+const filesubjecttokensupplier_1 = require("./filesubjecttokensupplier");
+const urlsubjecttokensupplier_1 = require("./urlsubjecttokensupplier");
+const certificatesubjecttokensupplier_1 = require("./certificatesubjecttokensupplier");
+const stscredentials_1 = require("./stscredentials");
+const gaxios_1 = require("gaxios");
+/**
+ * Defines the Url-sourced and file-sourced external account clients mainly
+ * used for K8s and Azure workloads.
+ */
+class IdentityPoolClient extends baseexternalclient_1.BaseExternalAccountClient {
+    subjectTokenSupplier;
+    /**
+     * Instantiate an IdentityPoolClient instance using the provided JSON
+     * object loaded from an external account credentials file.
+     * An error is thrown if the credential is not a valid file-sourced or
+     * url-sourced credential or a workforce pool user project is provided
+     * with a non workforce audience.
+     * @param options The external account options object typically loaded
+     *   from the external account JSON credential file. The camelCased options
+     *   are aliases for the snake_cased options.
+     */
+    constructor(options) {
+        super(options);
+        const opts = (0, util_1.originalOrCamelOptions)(options);
+        const credentialSource = opts.get('credential_source');
+        const subjectTokenSupplier = opts.get('subject_token_supplier');
+        // Validate credential sourcing configuration.
+        if (!credentialSource && !subjectTokenSupplier) {
+            throw new Error('A credential source or subject token supplier must be specified.');
+        }
+        if (credentialSource && subjectTokenSupplier) {
+            throw new Error('Only one of credential source or subject token supplier can be specified.');
+        }
+        if (subjectTokenSupplier) {
+            this.subjectTokenSupplier = subjectTokenSupplier;
+            this.credentialSourceType = 'programmatic';
+        }
+        else {
+            const credentialSourceOpts = (0, util_1.originalOrCamelOptions)(credentialSource);
+            const formatOpts = (0, util_1.originalOrCamelOptions)(credentialSourceOpts.get('format'));
+            // Text is the default format type.
+            const formatType = formatOpts.get('type') || 'text';
+            const formatSubjectTokenFieldName = formatOpts.get('subject_token_field_name');
+            if (formatType !== 'json' && formatType !== 'text') {
+                throw new Error(`Invalid credential_source format "${formatType}"`);
+            }
+            if (formatType === 'json' && !formatSubjectTokenFieldName) {
+                throw new Error('Missing subject_token_field_name for JSON credential_source format');
+            }
+            const file = credentialSourceOpts.get('file');
+            const url = credentialSourceOpts.get('url');
+            const certificate = credentialSourceOpts.get('certificate');
+            const headers = credentialSourceOpts.get('headers');
+            if ((file && url) || (url && certificate) || (file && certificate)) {
+                throw new Error('No valid Identity Pool "credential_source" provided, must be either file, url, or certificate.');
+            }
+            else if (file) {
+                this.credentialSourceType = 'file';
+                this.subjectTokenSupplier = new filesubjecttokensupplier_1.FileSubjectTokenSupplier({
+                    filePath: file,
+                    formatType: formatType,
+                    subjectTokenFieldName: formatSubjectTokenFieldName,
+                });
+            }
+            else if (url) {
+                this.credentialSourceType = 'url';
+                this.subjectTokenSupplier = new urlsubjecttokensupplier_1.UrlSubjectTokenSupplier({
+                    url: url,
+                    formatType: formatType,
+                    subjectTokenFieldName: formatSubjectTokenFieldName,
+                    headers: headers,
+                    additionalGaxiosOptions: IdentityPoolClient.RETRY_CONFIG,
+                });
+            }
+            else if (certificate) {
+                this.credentialSourceType = 'certificate';
+                const certificateSubjecttokensupplier = new certificatesubjecttokensupplier_1.CertificateSubjectTokenSupplier({
+                    useDefaultCertificateConfig: certificate.use_default_certificate_config,
+                    certificateConfigLocation: certificate.certificate_config_location,
+                    trustChainPath: certificate.trust_chain_path,
+                });
+                this.subjectTokenSupplier = certificateSubjecttokensupplier;
+            }
+            else {
+                throw new Error('No valid Identity Pool "credential_source" provided, must be either file, url, or certificate.');
+            }
+        }
+    }
+    /**
+     * Triggered when a external subject token is needed to be exchanged for a GCP
+     * access token via GCP STS endpoint. Gets a subject token by calling
+     * the configured {@link SubjectTokenSupplier}
+     * @return A promise that resolves with the external subject token.
+     */
+    async retrieveSubjectToken() {
+        const subjectToken = await this.subjectTokenSupplier.getSubjectToken(this.supplierContext);
+        if (this.subjectTokenSupplier instanceof certificatesubjecttokensupplier_1.CertificateSubjectTokenSupplier) {
+            const mtlsAgent = await this.subjectTokenSupplier.createMtlsHttpsAgent();
+            this.stsCredential = new stscredentials_1.StsCredentials({
+                tokenExchangeEndpoint: this.getTokenUrl(),
+                clientAuthentication: this.clientAuth,
+                transporter: new gaxios_1.Gaxios({ agent: mtlsAgent }),
+            });
+            this.transporter = new gaxios_1.Gaxios({
+                ...(this.transporter.defaults || {}),
+                agent: mtlsAgent,
+            });
+        }
+        return subjectToken;
+    }
+}
+exports.IdentityPoolClient = IdentityPoolClient;
+//# sourceMappingURL=identitypoolclient.js.map

package/node_modules/google-auth-library/build/src/auth/idtokenclient.d.ts

@@ -0,0 +1,27 @@
+import { OAuth2Client, OAuth2ClientOptions, RequestMetadataResponse } from './oauth2client';
+export interface IdTokenOptions extends OAuth2ClientOptions {
+    /**
+     * The client to make the request to fetch an ID token.
+     */
+    idTokenProvider: IdTokenProvider;
+    /**
+     * The audience to use when requesting an ID token.
+     */
+    targetAudience: string;
+}
+export interface IdTokenProvider {
+    fetchIdToken: (targetAudience: string) => Promise<string>;
+}
+export declare class IdTokenClient extends OAuth2Client {
+    targetAudience: string;
+    idTokenProvider: IdTokenProvider;
+    /**
+     * Google ID Token client
+     *
+     * Retrieve ID token from the metadata server.
+     * See: https://cloud.google.com/docs/authentication/get-id-token#metadata-server
+     */
+    constructor(options: IdTokenOptions);
+    protected getRequestMetadataAsync(): Promise<RequestMetadataResponse>;
+    private getIdTokenExpiryDate;
+}

package/node_modules/google-auth-library/build/src/auth/idtokenclient.js

@@ -0,0 +1,56 @@
+"use strict";
+// Copyright 2020 Google LLC
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//      http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.IdTokenClient = void 0;
+const oauth2client_1 = require("./oauth2client");
+class IdTokenClient extends oauth2client_1.OAuth2Client {
+    targetAudience;
+    idTokenProvider;
+    /**
+     * Google ID Token client
+     *
+     * Retrieve ID token from the metadata server.
+     * See: https://cloud.google.com/docs/authentication/get-id-token#metadata-server
+     */
+    constructor(options) {
+        super(options);
+        this.targetAudience = options.targetAudience;
+        this.idTokenProvider = options.idTokenProvider;
+    }
+    async getRequestMetadataAsync() {
+        if (!this.credentials.id_token ||
+            !this.credentials.expiry_date ||
+            this.isTokenExpiring()) {
+            const idToken = await this.idTokenProvider.fetchIdToken(this.targetAudience);
+            this.credentials = {
+                id_token: idToken,
+                expiry_date: this.getIdTokenExpiryDate(idToken),
+            };
+        }
+        const headers = new Headers({
+            authorization: 'Bearer ' + this.credentials.id_token,
+        });
+        return { headers };
+    }
+    getIdTokenExpiryDate(idToken) {
+        const payloadB64 = idToken.split('.')[1];
+        if (payloadB64) {
+            const payload = JSON.parse(Buffer.from(payloadB64, 'base64').toString('ascii'));
+            return payload.exp * 1000;
+        }
+    }
+}
+exports.IdTokenClient = IdTokenClient;
+//# sourceMappingURL=idtokenclient.js.map

package/node_modules/google-auth-library/build/src/auth/impersonated.d.ts

@@ -0,0 +1,134 @@
+/**
+ * Copyright 2021 Google LLC
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+import { GetTokenResponse, OAuth2Client, OAuth2ClientOptions } from './oauth2client';
+import { AuthClient } from './authclient';
+import { IdTokenProvider } from './idtokenclient';
+import { SignBlobResponse } from './googleauth';
+export interface ImpersonatedOptions extends OAuth2ClientOptions {
+    /**
+     * Client used to perform exchange for impersonated client.
+     */
+    sourceClient?: AuthClient;
+    /**
+     * The service account to impersonate.
+     */
+    targetPrincipal?: string;
+    /**
+     * Scopes to request during the authorization grant.
+     */
+    targetScopes?: string[];
+    /**
+     * The chained list of delegates required to grant the final access_token.
+     */
+    delegates?: string[];
+    /**
+     * Number of seconds the delegated credential should be valid.
+     */
+    lifetime?: number | 3600;
+    /**
+     * API endpoint to fetch token from.
+     */
+    endpoint?: string;
+}
+export declare const IMPERSONATED_ACCOUNT_TYPE = "impersonated_service_account";
+export interface TokenResponse {
+    accessToken: string;
+    expireTime: string;
+}
+export interface FetchIdTokenOptions {
+    /**
+     * Include the service account email in the token.
+     * If set to `true`, the token will contain `email` and `email_verified` claims.
+     */
+    includeEmail: boolean;
+}
+export interface FetchIdTokenResponse {
+    /** The OpenId Connect ID token. */
+    token: string;
+}
+export declare class Impersonated extends OAuth2Client implements IdTokenProvider {
+    private sourceClient;
+    private targetPrincipal;
+    private targetScopes;
+    private delegates;
+    private lifetime;
+    private endpoint;
+    /**
+     * Impersonated service account credentials.
+     *
+     * Create a new access token by impersonating another service account.
+     *
+     * Impersonated Credentials allowing credentials issued to a user or
+     * service account to impersonate another. The source project using
+     * Impersonated Credentials must enable the "IAMCredentials" API.
+     * Also, the target service account must grant the orginating principal
+     * the "Service Account Token Creator" IAM role.
+     *
+     * **IMPORTANT**: This method does not validate the credential configuration.
+     * A security risk occurs when a credential configuration configured with
+     * malicious URLs is used. When the credential configuration is accepted from
+     * an untrusted source, you should validate it before using it with this
+     * method. For more details, see
+     * https://cloud.google.com/docs/authentication/external/externally-sourced-credentials.
+     *
+     * @param {object} options - The configuration object.
+     * @param {object} [options.sourceClient] the source credential used as to
+     * acquire the impersonated credentials.
+     * @param {string} [options.targetPrincipal] the service account to
+     * impersonate.
+     * @param {string[]} [options.delegates] the chained list of delegates
+     * required to grant the final access_token. If set, the sequence of
+     * identities must have "Service Account Token Creator" capability granted to
+     * the preceding identity. For example, if set to [serviceAccountB,
+     * serviceAccountC], the sourceCredential must have the Token Creator role on
+     * serviceAccountB. serviceAccountB must have the Token Creator on
+     * serviceAccountC. Finally, C must have Token Creator on target_principal.
+     * If left unset, sourceCredential must have that role on targetPrincipal.
+     * @param {string[]} [options.targetScopes] scopes to request during the
+     * authorization grant.
+     * @param {number} [options.lifetime] number of seconds the delegated
+     * credential should be valid for up to 3600 seconds by default, or 43,200
+     * seconds by extending the token's lifetime, see:
+     * https://cloud.google.com/iam/docs/creating-short-lived-service-account-credentials#sa-credentials-oauth
+     * @param {string} [options.endpoint] api endpoint override.
+     */
+    constructor(options?: ImpersonatedOptions);
+    /**
+     * Signs some bytes.
+     *
+     * {@link https://cloud.google.com/iam/docs/reference/credentials/rest/v1/projects.serviceAccounts/signBlob Reference Documentation}
+     * @param blobToSign String to sign.
+     *
+     * @returns A {@link SignBlobResponse} denoting the keyID and signedBlob in base64 string
+     */
+    sign(blobToSign: string): Promise<SignBlobResponse>;
+    /** The service account email to be impersonated. */
+    getTargetPrincipal(): string;
+    /**
+     * Refreshes the access token.
+     */
+    protected refreshToken(): Promise<GetTokenResponse>;
+    /**
+     * Generates an OpenID Connect ID token for a service account.
+     *
+     * {@link https://cloud.google.com/iam/docs/reference/credentials/rest/v1/projects.serviceAccounts/generateIdToken Reference Documentation}
+     *
+     * @param targetAudience the audience for the fetched ID token.
+     * @param options the for the request
+     * @return an OpenID Connect ID token
+     */
+    fetchIdToken(targetAudience: string, options?: FetchIdTokenOptions): Promise<string>;
+}