@openclaw/googlechat 2026.5.20 → 2026.5.22

package/node_modules/google-auth-library/build/src/auth/oauth2common.d.ts

@@ -0,0 +1,103 @@
+import { Gaxios, GaxiosOptions } from 'gaxios';
+/**
+ * OAuth error codes.
+ * https://tools.ietf.org/html/rfc6749#section-5.2
+ */
+type OAuthErrorCode = 'invalid_request' | 'invalid_client' | 'invalid_grant' | 'unauthorized_client' | 'unsupported_grant_type' | 'invalid_scope' | string;
+/**
+ * The standard OAuth error response.
+ * https://tools.ietf.org/html/rfc6749#section-5.2
+ */
+export interface OAuthErrorResponse {
+    error: OAuthErrorCode;
+    error_description?: string;
+    error_uri?: string;
+}
+/**
+ * OAuth client authentication types.
+ * https://tools.ietf.org/html/rfc6749#section-2.3
+ */
+export type ConfidentialClientType = 'basic' | 'request-body';
+/**
+ * Defines the client authentication credentials for basic and request-body
+ * credentials.
+ * https://tools.ietf.org/html/rfc6749#section-2.3.1
+ */
+export interface ClientAuthentication {
+    confidentialClientType: ConfidentialClientType;
+    clientId: string;
+    clientSecret?: string;
+}
+export interface OAuthClientAuthHandlerOptions {
+    /**
+     * Defines the client authentication credentials for basic and request-body
+     * credentials.
+     */
+    clientAuthentication?: ClientAuthentication;
+    /**
+     * An optional transporter to use.
+     */
+    transporter?: Gaxios;
+}
+/**
+ * Abstract class for handling client authentication in OAuth-based
+ * operations.
+ * When request-body client authentication is used, only application/json and
+ * application/x-www-form-urlencoded content types for HTTP methods that support
+ * request bodies are supported.
+ */
+export declare abstract class OAuthClientAuthHandler {
+    #private;
+    protected transporter: Gaxios;
+    /**
+     * Instantiates an OAuth client authentication handler.
+     * @param options The OAuth Client Auth Handler instance options. Passing an `ClientAuthentication` directly is **@DEPRECATED**.
+     */
+    constructor(options?: ClientAuthentication | OAuthClientAuthHandlerOptions);
+    /**
+     * Applies client authentication on the OAuth request's headers or POST
+     * body but does not process the request.
+     * @param opts The GaxiosOptions whose headers or data are to be modified
+     *   depending on the client authentication mechanism to be used.
+     * @param bearerToken The optional bearer token to use for authentication.
+     *   When this is used, no client authentication credentials are needed.
+     */
+    protected applyClientAuthenticationOptions(opts: GaxiosOptions, bearerToken?: string): void;
+    /**
+     * Applies client authentication on the request's header if either
+     * basic authentication or bearer token authentication is selected.
+     *
+     * @param opts The GaxiosOptions whose headers or data are to be modified
+     *   depending on the client authentication mechanism to be used.
+     * @param bearerToken The optional bearer token to use for authentication.
+     *   When this is used, no client authentication credentials are needed.
+     */
+    private injectAuthenticatedHeaders;
+    /**
+     * Applies client authentication on the request's body if request-body
+     * client authentication is selected.
+     *
+     * @param opts The GaxiosOptions whose headers or data are to be modified
+     *   depending on the client authentication mechanism to be used.
+     */
+    private injectAuthenticatedRequestBody;
+    /**
+     * Retry config for Auth-related requests.
+     *
+     * @remarks
+     *
+     * This is not a part of the default {@link AuthClient.transporter transporter/gaxios}
+     * config as some downstream APIs would prefer if customers explicitly enable retries,
+     * such as GCS.
+     */
+    protected static get RETRY_CONFIG(): GaxiosOptions;
+}
+/**
+ * Converts an OAuth error response to a native JavaScript Error.
+ * @param resp The OAuth error response to convert to a native Error object.
+ * @param err The optional original error. If provided, the error properties
+ *   will be copied to the new error.
+ * @return The converted native Error object.
+ */
+export declare function getErrorFromOAuthErrorResponse(resp: OAuthErrorResponse, err?: Error): Error;
+export {};

package/node_modules/google-auth-library/build/src/auth/oauth2common.js

@@ -0,0 +1,189 @@
+"use strict";
+// Copyright 2021 Google LLC
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//      http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.OAuthClientAuthHandler = void 0;
+exports.getErrorFromOAuthErrorResponse = getErrorFromOAuthErrorResponse;
+const gaxios_1 = require("gaxios");
+const crypto_1 = require("../crypto/crypto");
+/** List of HTTP methods that accept request bodies. */
+const METHODS_SUPPORTING_REQUEST_BODY = ['PUT', 'POST', 'PATCH'];
+/**
+ * Abstract class for handling client authentication in OAuth-based
+ * operations.
+ * When request-body client authentication is used, only application/json and
+ * application/x-www-form-urlencoded content types for HTTP methods that support
+ * request bodies are supported.
+ */
+class OAuthClientAuthHandler {
+    #crypto = (0, crypto_1.createCrypto)();
+    #clientAuthentication;
+    transporter;
+    /**
+     * Instantiates an OAuth client authentication handler.
+     * @param options The OAuth Client Auth Handler instance options. Passing an `ClientAuthentication` directly is **@DEPRECATED**.
+     */
+    constructor(options) {
+        if (options && 'clientId' in options) {
+            this.#clientAuthentication = options;
+            this.transporter = new gaxios_1.Gaxios();
+        }
+        else {
+            this.#clientAuthentication = options?.clientAuthentication;
+            this.transporter = options?.transporter || new gaxios_1.Gaxios();
+        }
+    }
+    /**
+     * Applies client authentication on the OAuth request's headers or POST
+     * body but does not process the request.
+     * @param opts The GaxiosOptions whose headers or data are to be modified
+     *   depending on the client authentication mechanism to be used.
+     * @param bearerToken The optional bearer token to use for authentication.
+     *   When this is used, no client authentication credentials are needed.
+     */
+    applyClientAuthenticationOptions(opts, bearerToken) {
+        opts.headers = gaxios_1.Gaxios.mergeHeaders(opts.headers);
+        // Inject authenticated header.
+        this.injectAuthenticatedHeaders(opts, bearerToken);
+        // Inject authenticated request body.
+        if (!bearerToken) {
+            this.injectAuthenticatedRequestBody(opts);
+        }
+    }
+    /**
+     * Applies client authentication on the request's header if either
+     * basic authentication or bearer token authentication is selected.
+     *
+     * @param opts The GaxiosOptions whose headers or data are to be modified
+     *   depending on the client authentication mechanism to be used.
+     * @param bearerToken The optional bearer token to use for authentication.
+     *   When this is used, no client authentication credentials are needed.
+     */
+    injectAuthenticatedHeaders(opts, bearerToken) {
+        // Bearer token prioritized higher than basic Auth.
+        if (bearerToken) {
+            opts.headers = gaxios_1.Gaxios.mergeHeaders(opts.headers, {
+                authorization: `Bearer ${bearerToken}`,
+            });
+        }
+        else if (this.#clientAuthentication?.confidentialClientType === 'basic') {
+            opts.headers = gaxios_1.Gaxios.mergeHeaders(opts.headers);
+            const clientId = this.#clientAuthentication.clientId;
+            const clientSecret = this.#clientAuthentication.clientSecret || '';
+            const base64EncodedCreds = this.#crypto.encodeBase64StringUtf8(`${clientId}:${clientSecret}`);
+            gaxios_1.Gaxios.mergeHeaders(opts.headers, {
+                authorization: `Basic ${base64EncodedCreds}`,
+            });
+        }
+    }
+    /**
+     * Applies client authentication on the request's body if request-body
+     * client authentication is selected.
+     *
+     * @param opts The GaxiosOptions whose headers or data are to be modified
+     *   depending on the client authentication mechanism to be used.
+     */
+    injectAuthenticatedRequestBody(opts) {
+        if (this.#clientAuthentication?.confidentialClientType === 'request-body') {
+            const method = (opts.method || 'GET').toUpperCase();
+            if (!METHODS_SUPPORTING_REQUEST_BODY.includes(method)) {
+                throw new Error(`${method} HTTP method does not support ` +
+                    `${this.#clientAuthentication.confidentialClientType} ` +
+                    'client authentication');
+            }
+            // Get content-type
+            const headers = new Headers(opts.headers);
+            const contentType = headers.get('content-type');
+            // Inject authenticated request body
+            if (contentType?.startsWith('application/x-www-form-urlencoded') ||
+                opts.data instanceof URLSearchParams) {
+                const data = new URLSearchParams(opts.data ?? '');
+                data.append('client_id', this.#clientAuthentication.clientId);
+                data.append('client_secret', this.#clientAuthentication.clientSecret || '');
+                opts.data = data;
+            }
+            else if (contentType?.startsWith('application/json')) {
+                opts.data = opts.data || {};
+                Object.assign(opts.data, {
+                    client_id: this.#clientAuthentication.clientId,
+                    client_secret: this.#clientAuthentication.clientSecret || '',
+                });
+            }
+            else {
+                throw new Error(`${contentType} content-types are not supported with ` +
+                    `${this.#clientAuthentication.confidentialClientType} ` +
+                    'client authentication');
+            }
+        }
+    }
+    /**
+     * Retry config for Auth-related requests.
+     *
+     * @remarks
+     *
+     * This is not a part of the default {@link AuthClient.transporter transporter/gaxios}
+     * config as some downstream APIs would prefer if customers explicitly enable retries,
+     * such as GCS.
+     */
+    static get RETRY_CONFIG() {
+        return {
+            retry: true,
+            retryConfig: {
+                httpMethodsToRetry: ['GET', 'PUT', 'POST', 'HEAD', 'OPTIONS', 'DELETE'],
+            },
+        };
+    }
+}
+exports.OAuthClientAuthHandler = OAuthClientAuthHandler;
+/**
+ * Converts an OAuth error response to a native JavaScript Error.
+ * @param resp The OAuth error response to convert to a native Error object.
+ * @param err The optional original error. If provided, the error properties
+ *   will be copied to the new error.
+ * @return The converted native Error object.
+ */
+function getErrorFromOAuthErrorResponse(resp, err) {
+    // Error response.
+    const errorCode = resp.error;
+    const errorDescription = resp.error_description;
+    const errorUri = resp.error_uri;
+    let message = `Error code ${errorCode}`;
+    if (typeof errorDescription !== 'undefined') {
+        message += `: ${errorDescription}`;
+    }
+    if (typeof errorUri !== 'undefined') {
+        message += ` - ${errorUri}`;
+    }
+    const newError = new Error(message);
+    // Copy properties from original error to newly generated error.
+    if (err) {
+        const keys = Object.keys(err);
+        if (err.stack) {
+            // Copy error.stack if available.
+            keys.push('stack');
+        }
+        keys.forEach(key => {
+            // Do not overwrite the message field.
+            if (key !== 'message') {
+                Object.defineProperty(newError, key, {
+                    value: err[key],
+                    writable: false,
+                    enumerable: true,
+                });
+            }
+        });
+    }
+    return newError;
+}
+//# sourceMappingURL=oauth2common.js.map

package/node_modules/google-auth-library/build/src/auth/passthrough.d.ts

@@ -0,0 +1,37 @@
+import { GaxiosOptions } from 'gaxios';
+import { AuthClient, GetAccessTokenResponse } from './authclient';
+/**
+ * An AuthClient without any Authentication information. Useful for:
+ * - Anonymous access
+ * - Local Emulators
+ * - Testing Environments
+ *
+ */
+export declare class PassThroughClient extends AuthClient {
+    /**
+     * Creates a request without any authentication headers or checks.
+     *
+     * @remarks
+     *
+     * In testing environments it may be useful to change the provided
+     * {@link AuthClient.transporter} for any desired request overrides/handling.
+     *
+     * @param opts
+     * @returns The response of the request.
+     */
+    request<T>(opts: GaxiosOptions): Promise<import("gaxios").GaxiosResponse<T>>;
+    /**
+     * A required method of the base class.
+     * Always will return an empty object.
+     *
+     * @returns {}
+     */
+    getAccessToken(): Promise<GetAccessTokenResponse>;
+    /**
+     * A required method of the base class.
+     * Always will return an empty object.
+     *
+     * @returns {}
+     */
+    getRequestHeaders(): Promise<Headers>;
+}

package/node_modules/google-auth-library/build/src/auth/passthrough.js

@@ -0,0 +1,60 @@
+"use strict";
+// Copyright 2024 Google LLC
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//      http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.PassThroughClient = void 0;
+const authclient_1 = require("./authclient");
+/**
+ * An AuthClient without any Authentication information. Useful for:
+ * - Anonymous access
+ * - Local Emulators
+ * - Testing Environments
+ *
+ */
+class PassThroughClient extends authclient_1.AuthClient {
+    /**
+     * Creates a request without any authentication headers or checks.
+     *
+     * @remarks
+     *
+     * In testing environments it may be useful to change the provided
+     * {@link AuthClient.transporter} for any desired request overrides/handling.
+     *
+     * @param opts
+     * @returns The response of the request.
+     */
+    async request(opts) {
+        return this.transporter.request(opts);
+    }
+    /**
+     * A required method of the base class.
+     * Always will return an empty object.
+     *
+     * @returns {}
+     */
+    async getAccessToken() {
+        return {};
+    }
+    /**
+     * A required method of the base class.
+     * Always will return an empty object.
+     *
+     * @returns {}
+     */
+    async getRequestHeaders() {
+        return new Headers();
+    }
+}
+exports.PassThroughClient = PassThroughClient;
+//# sourceMappingURL=passthrough.js.map

package/node_modules/google-auth-library/build/src/auth/pluggable-auth-client.d.ts

@@ -0,0 +1,141 @@
+import { BaseExternalAccountClient, BaseExternalAccountClientOptions } from './baseexternalclient';
+export { ExecutableError } from './pluggable-auth-handler';
+/**
+ * Defines the credential source portion of the configuration for PluggableAuthClient.
+ *
+ * <p>Command is the only required field. If timeout_millis is not specified, the library will
+ * default to a 30-second timeout.
+ *
+ * <pre>
+ * Sample credential source for Pluggable Auth Client:
+ * {
+ *   ...
+ *   "credential_source": {
+ *     "executable": {
+ *       "command": "/path/to/get/credentials.sh --arg1=value1 --arg2=value2",
+ *       "timeout_millis": 5000,
+ *       "output_file": "/path/to/generated/cached/credentials"
+ *     }
+ *   }
+ * }
+ * </pre>
+ */
+export interface PluggableAuthClientOptions extends BaseExternalAccountClientOptions {
+    credential_source: {
+        executable: {
+            /**
+             * The command used to retrieve the 3rd party token.
+             */
+            command: string;
+            /**
+             * The timeout for executable to run in milliseconds. If none is provided it
+             * will be set to the default timeout of 30 seconds.
+             */
+            timeout_millis?: number;
+            /**
+             * An optional output file location that will be checked for a cached response
+             * from a previous run of the executable.
+             */
+            output_file?: string;
+        };
+    };
+}
+/**
+ * PluggableAuthClient enables the exchange of workload identity pool external credentials for
+ * Google access tokens by retrieving 3rd party tokens through a user supplied executable. These
+ * scripts/executables are completely independent of the Google Cloud Auth libraries. These
+ * credentials plug into ADC and will call the specified executable to retrieve the 3rd party token
+ * to be exchanged for a Google access token.
+ *
+ * <p>To use these credentials, the GOOGLE_EXTERNAL_ACCOUNT_ALLOW_EXECUTABLES environment variable
+ * must be set to '1'. This is for security reasons.
+ *
+ * <p>Both OIDC and SAML are supported. The executable must adhere to a specific response format
+ * defined below.
+ *
+ * <p>The executable must print out the 3rd party token to STDOUT in JSON format. When an
+ * output_file is specified in the credential configuration, the executable must also handle writing the
+ * JSON response to this file.
+ *
+ * <pre>
+ * OIDC response sample:
+ * {
+ *   "version": 1,
+ *   "success": true,
+ *   "token_type": "urn:ietf:params:oauth:token-type:id_token",
+ *   "id_token": "HEADER.PAYLOAD.SIGNATURE",
+ *   "expiration_time": 1620433341
+ * }
+ *
+ * SAML2 response sample:
+ * {
+ *   "version": 1,
+ *   "success": true,
+ *   "token_type": "urn:ietf:params:oauth:token-type:saml2",
+ *   "saml_response": "...",
+ *   "expiration_time": 1620433341
+ * }
+ *
+ * Error response sample:
+ * {
+ *   "version": 1,
+ *   "success": false,
+ *   "code": "401",
+ *   "message": "Error message."
+ * }
+ * </pre>
+ *
+ * <p>The "expiration_time" field in the JSON response is only required for successful
+ * responses when an output file was specified in the credential configuration
+ *
+ * <p>The auth libraries will populate certain environment variables that will be accessible by the
+ * executable, such as: GOOGLE_EXTERNAL_ACCOUNT_AUDIENCE, GOOGLE_EXTERNAL_ACCOUNT_TOKEN_TYPE,
+ * GOOGLE_EXTERNAL_ACCOUNT_INTERACTIVE, GOOGLE_EXTERNAL_ACCOUNT_IMPERSONATED_EMAIL, and
+ * GOOGLE_EXTERNAL_ACCOUNT_OUTPUT_FILE.
+ *
+ * <p>Please see this repositories README for a complete executable request/response specification.
+ */
+export declare class PluggableAuthClient extends BaseExternalAccountClient {
+    /**
+     * The command used to retrieve the third party token.
+     */
+    private readonly command;
+    /**
+     * The timeout in milliseconds for running executable,
+     * set to default if none provided.
+     */
+    private readonly timeoutMillis;
+    /**
+     * The path to file to check for cached executable response.
+     */
+    private readonly outputFile?;
+    /**
+     * Executable and output file handler.
+     */
+    private readonly handler;
+    /**
+     * Instantiates a PluggableAuthClient instance using the provided JSON
+     * object loaded from an external account credentials file.
+     * An error is thrown if the credential is not a valid pluggable auth credential.
+     * @param options The external account options object typically loaded from
+     *   the external account JSON credential file.
+     */
+    constructor(options: PluggableAuthClientOptions);
+    /**
+     * Triggered when an external subject token is needed to be exchanged for a
+     * GCP access token via GCP STS endpoint.
+     * This uses the `options.credential_source` object to figure out how
+     * to retrieve the token using the current environment. In this case,
+     * this calls a user provided executable which returns the subject token.
+     * The logic is summarized as:
+     * 1. Validated that the executable is allowed to run. The
+     *    GOOGLE_EXTERNAL_ACCOUNT_ALLOW_EXECUTABLES environment must be set to
+     *    1 for security reasons.
+     * 2. If an output file is specified by the user, check the file location
+     *    for a response. If the file exists and contains a valid response,
+     *    return the subject token from the file.
+     * 3. Call the provided executable and return response.
+     * @return A promise that resolves with the external subject token.
+     */
+    retrieveSubjectToken(): Promise<string>;
+}