@openclaw/googlechat 2026.5.20 → 2026.5.22

package/node_modules/google-auth-library/build/src/auth/pluggable-auth-client.js

@@ -0,0 +1,220 @@
+"use strict";
+// Copyright 2022 Google LLC
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//      http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.PluggableAuthClient = exports.ExecutableError = void 0;
+const baseexternalclient_1 = require("./baseexternalclient");
+const executable_response_1 = require("./executable-response");
+const pluggable_auth_handler_1 = require("./pluggable-auth-handler");
+var pluggable_auth_handler_2 = require("./pluggable-auth-handler");
+Object.defineProperty(exports, "ExecutableError", { enumerable: true, get: function () { return pluggable_auth_handler_2.ExecutableError; } });
+/**
+ * The default executable timeout when none is provided, in milliseconds.
+ */
+const DEFAULT_EXECUTABLE_TIMEOUT_MILLIS = 30 * 1000;
+/**
+ * The minimum allowed executable timeout in milliseconds.
+ */
+const MINIMUM_EXECUTABLE_TIMEOUT_MILLIS = 5 * 1000;
+/**
+ * The maximum allowed executable timeout in milliseconds.
+ */
+const MAXIMUM_EXECUTABLE_TIMEOUT_MILLIS = 120 * 1000;
+/**
+ * The environment variable to check to see if executable can be run.
+ * Value must be set to '1' for the executable to run.
+ */
+const GOOGLE_EXTERNAL_ACCOUNT_ALLOW_EXECUTABLES = 'GOOGLE_EXTERNAL_ACCOUNT_ALLOW_EXECUTABLES';
+/**
+ * The maximum currently supported executable version.
+ */
+const MAXIMUM_EXECUTABLE_VERSION = 1;
+/**
+ * PluggableAuthClient enables the exchange of workload identity pool external credentials for
+ * Google access tokens by retrieving 3rd party tokens through a user supplied executable. These
+ * scripts/executables are completely independent of the Google Cloud Auth libraries. These
+ * credentials plug into ADC and will call the specified executable to retrieve the 3rd party token
+ * to be exchanged for a Google access token.
+ *
+ * <p>To use these credentials, the GOOGLE_EXTERNAL_ACCOUNT_ALLOW_EXECUTABLES environment variable
+ * must be set to '1'. This is for security reasons.
+ *
+ * <p>Both OIDC and SAML are supported. The executable must adhere to a specific response format
+ * defined below.
+ *
+ * <p>The executable must print out the 3rd party token to STDOUT in JSON format. When an
+ * output_file is specified in the credential configuration, the executable must also handle writing the
+ * JSON response to this file.
+ *
+ * <pre>
+ * OIDC response sample:
+ * {
+ *   "version": 1,
+ *   "success": true,
+ *   "token_type": "urn:ietf:params:oauth:token-type:id_token",
+ *   "id_token": "HEADER.PAYLOAD.SIGNATURE",
+ *   "expiration_time": 1620433341
+ * }
+ *
+ * SAML2 response sample:
+ * {
+ *   "version": 1,
+ *   "success": true,
+ *   "token_type": "urn:ietf:params:oauth:token-type:saml2",
+ *   "saml_response": "...",
+ *   "expiration_time": 1620433341
+ * }
+ *
+ * Error response sample:
+ * {
+ *   "version": 1,
+ *   "success": false,
+ *   "code": "401",
+ *   "message": "Error message."
+ * }
+ * </pre>
+ *
+ * <p>The "expiration_time" field in the JSON response is only required for successful
+ * responses when an output file was specified in the credential configuration
+ *
+ * <p>The auth libraries will populate certain environment variables that will be accessible by the
+ * executable, such as: GOOGLE_EXTERNAL_ACCOUNT_AUDIENCE, GOOGLE_EXTERNAL_ACCOUNT_TOKEN_TYPE,
+ * GOOGLE_EXTERNAL_ACCOUNT_INTERACTIVE, GOOGLE_EXTERNAL_ACCOUNT_IMPERSONATED_EMAIL, and
+ * GOOGLE_EXTERNAL_ACCOUNT_OUTPUT_FILE.
+ *
+ * <p>Please see this repositories README for a complete executable request/response specification.
+ */
+class PluggableAuthClient extends baseexternalclient_1.BaseExternalAccountClient {
+    /**
+     * The command used to retrieve the third party token.
+     */
+    command;
+    /**
+     * The timeout in milliseconds for running executable,
+     * set to default if none provided.
+     */
+    timeoutMillis;
+    /**
+     * The path to file to check for cached executable response.
+     */
+    outputFile;
+    /**
+     * Executable and output file handler.
+     */
+    handler;
+    /**
+     * Instantiates a PluggableAuthClient instance using the provided JSON
+     * object loaded from an external account credentials file.
+     * An error is thrown if the credential is not a valid pluggable auth credential.
+     * @param options The external account options object typically loaded from
+     *   the external account JSON credential file.
+     */
+    constructor(options) {
+        super(options);
+        if (!options.credential_source.executable) {
+            throw new Error('No valid Pluggable Auth "credential_source" provided.');
+        }
+        this.command = options.credential_source.executable.command;
+        if (!this.command) {
+            throw new Error('No valid Pluggable Auth "credential_source" provided.');
+        }
+        // Check if the provided timeout exists and if it is valid.
+        if (options.credential_source.executable.timeout_millis === undefined) {
+            this.timeoutMillis = DEFAULT_EXECUTABLE_TIMEOUT_MILLIS;
+        }
+        else {
+            this.timeoutMillis = options.credential_source.executable.timeout_millis;
+            if (this.timeoutMillis < MINIMUM_EXECUTABLE_TIMEOUT_MILLIS ||
+                this.timeoutMillis > MAXIMUM_EXECUTABLE_TIMEOUT_MILLIS) {
+                throw new Error(`Timeout must be between ${MINIMUM_EXECUTABLE_TIMEOUT_MILLIS} and ` +
+                    `${MAXIMUM_EXECUTABLE_TIMEOUT_MILLIS} milliseconds.`);
+            }
+        }
+        this.outputFile = options.credential_source.executable.output_file;
+        this.handler = new pluggable_auth_handler_1.PluggableAuthHandler({
+            command: this.command,
+            timeoutMillis: this.timeoutMillis,
+            outputFile: this.outputFile,
+        });
+        this.credentialSourceType = 'executable';
+    }
+    /**
+     * Triggered when an external subject token is needed to be exchanged for a
+     * GCP access token via GCP STS endpoint.
+     * This uses the `options.credential_source` object to figure out how
+     * to retrieve the token using the current environment. In this case,
+     * this calls a user provided executable which returns the subject token.
+     * The logic is summarized as:
+     * 1. Validated that the executable is allowed to run. The
+     *    GOOGLE_EXTERNAL_ACCOUNT_ALLOW_EXECUTABLES environment must be set to
+     *    1 for security reasons.
+     * 2. If an output file is specified by the user, check the file location
+     *    for a response. If the file exists and contains a valid response,
+     *    return the subject token from the file.
+     * 3. Call the provided executable and return response.
+     * @return A promise that resolves with the external subject token.
+     */
+    async retrieveSubjectToken() {
+        // Check if the executable is allowed to run.
+        if (process.env[GOOGLE_EXTERNAL_ACCOUNT_ALLOW_EXECUTABLES] !== '1') {
+            throw new Error('Pluggable Auth executables need to be explicitly allowed to run by ' +
+                'setting the GOOGLE_EXTERNAL_ACCOUNT_ALLOW_EXECUTABLES environment ' +
+                'Variable to 1.');
+        }
+        let executableResponse = undefined;
+        // Try to get cached executable response from output file.
+        if (this.outputFile) {
+            executableResponse = await this.handler.retrieveCachedResponse();
+        }
+        // If no response from output file, call the executable.
+        if (!executableResponse) {
+            // Set up environment map with required values for the executable.
+            const envMap = new Map();
+            envMap.set('GOOGLE_EXTERNAL_ACCOUNT_AUDIENCE', this.audience);
+            envMap.set('GOOGLE_EXTERNAL_ACCOUNT_TOKEN_TYPE', this.subjectTokenType);
+            // Always set to 0 because interactive mode is not supported.
+            envMap.set('GOOGLE_EXTERNAL_ACCOUNT_INTERACTIVE', '0');
+            if (this.outputFile) {
+                envMap.set('GOOGLE_EXTERNAL_ACCOUNT_OUTPUT_FILE', this.outputFile);
+            }
+            const serviceAccountEmail = this.getServiceAccountEmail();
+            if (serviceAccountEmail) {
+                envMap.set('GOOGLE_EXTERNAL_ACCOUNT_IMPERSONATED_EMAIL', serviceAccountEmail);
+            }
+            executableResponse =
+                await this.handler.retrieveResponseFromExecutable(envMap);
+        }
+        if (executableResponse.version > MAXIMUM_EXECUTABLE_VERSION) {
+            throw new Error(`Version of executable is not currently supported, maximum supported version is ${MAXIMUM_EXECUTABLE_VERSION}.`);
+        }
+        // Check that response was successful.
+        if (!executableResponse.success) {
+            throw new pluggable_auth_handler_1.ExecutableError(executableResponse.errorMessage, executableResponse.errorCode);
+        }
+        // Check that response contains expiration time if output file was specified.
+        if (this.outputFile) {
+            if (!executableResponse.expirationTime) {
+                throw new executable_response_1.InvalidExpirationTimeFieldError('The executable response must contain the `expiration_time` field for successful responses when an output_file has been specified in the configuration.');
+            }
+        }
+        // Check that response is not expired.
+        if (executableResponse.isExpired()) {
+            throw new Error('Executable response is expired.');
+        }
+        // Return subject token from response.
+        return executableResponse.subjectToken;
+    }
+}
+exports.PluggableAuthClient = PluggableAuthClient;
+//# sourceMappingURL=pluggable-auth-client.js.map

package/node_modules/google-auth-library/build/src/auth/pluggable-auth-handler.d.ts

@@ -0,0 +1,61 @@
+import { ExecutableResponse } from './executable-response';
+/**
+ * Error thrown from the executable run by PluggableAuthClient.
+ */
+export declare class ExecutableError extends Error {
+    /**
+     * The exit code returned by the executable.
+     */
+    readonly code: string;
+    constructor(message: string, code: string);
+}
+/**
+ * Defines the options used for the PluggableAuthHandler class.
+ */
+export interface PluggableAuthHandlerOptions {
+    /**
+     * The command used to retrieve the third party token.
+     */
+    command: string;
+    /**
+     * The timeout in milliseconds for running executable,
+     * set to default if none provided.
+     */
+    timeoutMillis: number;
+    /**
+     * The path to file to check for cached executable response.
+     */
+    outputFile?: string;
+}
+/**
+ * A handler used to retrieve 3rd party token responses from user defined
+ * executables and cached file output for the PluggableAuthClient class.
+ */
+export declare class PluggableAuthHandler {
+    private readonly commandComponents;
+    private readonly timeoutMillis;
+    private readonly outputFile?;
+    /**
+     * Instantiates a PluggableAuthHandler instance using the provided
+     * PluggableAuthHandlerOptions object.
+     */
+    constructor(options: PluggableAuthHandlerOptions);
+    /**
+     * Calls user provided executable to get a 3rd party subject token and
+     * returns the response.
+     * @param envMap a Map of additional Environment Variables required for
+     *   the executable.
+     * @return A promise that resolves with the executable response.
+     */
+    retrieveResponseFromExecutable(envMap: Map<string, string>): Promise<ExecutableResponse>;
+    /**
+     * Checks user provided output file for response from previous run of
+     * executable and return the response if it exists, is formatted correctly, and is not expired.
+     */
+    retrieveCachedResponse(): Promise<ExecutableResponse | undefined>;
+    /**
+     * Parses given command string into component array, splitting on spaces unless
+     * spaces are between quotation marks.
+     */
+    private static parseCommand;
+}

package/node_modules/google-auth-library/build/src/auth/pluggable-auth-handler.js

@@ -0,0 +1,174 @@
+"use strict";
+// Copyright 2022 Google LLC
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//      http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.PluggableAuthHandler = exports.ExecutableError = void 0;
+const executable_response_1 = require("./executable-response");
+const childProcess = require("child_process");
+const fs = require("fs");
+/**
+ * Error thrown from the executable run by PluggableAuthClient.
+ */
+class ExecutableError extends Error {
+    /**
+     * The exit code returned by the executable.
+     */
+    code;
+    constructor(message, code) {
+        super(`The executable failed with exit code: ${code} and error message: ${message}.`);
+        this.code = code;
+        Object.setPrototypeOf(this, new.target.prototype);
+    }
+}
+exports.ExecutableError = ExecutableError;
+/**
+ * A handler used to retrieve 3rd party token responses from user defined
+ * executables and cached file output for the PluggableAuthClient class.
+ */
+class PluggableAuthHandler {
+    commandComponents;
+    timeoutMillis;
+    outputFile;
+    /**
+     * Instantiates a PluggableAuthHandler instance using the provided
+     * PluggableAuthHandlerOptions object.
+     */
+    constructor(options) {
+        if (!options.command) {
+            throw new Error('No command provided.');
+        }
+        this.commandComponents = PluggableAuthHandler.parseCommand(options.command);
+        this.timeoutMillis = options.timeoutMillis;
+        if (!this.timeoutMillis) {
+            throw new Error('No timeoutMillis provided.');
+        }
+        this.outputFile = options.outputFile;
+    }
+    /**
+     * Calls user provided executable to get a 3rd party subject token and
+     * returns the response.
+     * @param envMap a Map of additional Environment Variables required for
+     *   the executable.
+     * @return A promise that resolves with the executable response.
+     */
+    retrieveResponseFromExecutable(envMap) {
+        return new Promise((resolve, reject) => {
+            // Spawn process to run executable using added environment variables.
+            const child = childProcess.spawn(this.commandComponents[0], this.commandComponents.slice(1), {
+                env: { ...process.env, ...Object.fromEntries(envMap) },
+            });
+            let output = '';
+            // Append stdout to output as executable runs.
+            child.stdout.on('data', (data) => {
+                output += data;
+            });
+            // Append stderr as executable runs.
+            child.stderr.on('data', (err) => {
+                output += err;
+            });
+            // Set up a timeout to end the child process and throw an error.
+            const timeout = setTimeout(() => {
+                // Kill child process and remove listeners so 'close' event doesn't get
+                // read after child process is killed.
+                child.removeAllListeners();
+                child.kill();
+                return reject(new Error('The executable failed to finish within the timeout specified.'));
+            }, this.timeoutMillis);
+            child.on('close', (code) => {
+                // Cancel timeout if executable closes before timeout is reached.
+                clearTimeout(timeout);
+                if (code === 0) {
+                    // If the executable completed successfully, try to return the parsed response.
+                    try {
+                        const responseJson = JSON.parse(output);
+                        const response = new executable_response_1.ExecutableResponse(responseJson);
+                        return resolve(response);
+                    }
+                    catch (error) {
+                        if (error instanceof executable_response_1.ExecutableResponseError) {
+                            return reject(error);
+                        }
+                        return reject(new executable_response_1.ExecutableResponseError(`The executable returned an invalid response: ${output}`));
+                    }
+                }
+                else {
+                    return reject(new ExecutableError(output, code.toString()));
+                }
+            });
+        });
+    }
+    /**
+     * Checks user provided output file for response from previous run of
+     * executable and return the response if it exists, is formatted correctly, and is not expired.
+     */
+    async retrieveCachedResponse() {
+        if (!this.outputFile || this.outputFile.length === 0) {
+            return undefined;
+        }
+        let filePath;
+        try {
+            filePath = await fs.promises.realpath(this.outputFile);
+        }
+        catch {
+            // If file path cannot be resolved, return undefined.
+            return undefined;
+        }
+        if (!(await fs.promises.lstat(filePath)).isFile()) {
+            // If path does not lead to file, return undefined.
+            return undefined;
+        }
+        const responseString = await fs.promises.readFile(filePath, {
+            encoding: 'utf8',
+        });
+        if (responseString === '') {
+            return undefined;
+        }
+        try {
+            const responseJson = JSON.parse(responseString);
+            const response = new executable_response_1.ExecutableResponse(responseJson);
+            // Check if response is successful and unexpired.
+            if (response.isValid()) {
+                return new executable_response_1.ExecutableResponse(responseJson);
+            }
+            return undefined;
+        }
+        catch (error) {
+            if (error instanceof executable_response_1.ExecutableResponseError) {
+                throw error;
+            }
+            throw new executable_response_1.ExecutableResponseError(`The output file contained an invalid response: ${responseString}`);
+        }
+    }
+    /**
+     * Parses given command string into component array, splitting on spaces unless
+     * spaces are between quotation marks.
+     */
+    static parseCommand(command) {
+        // Split the command into components by splitting on spaces,
+        // unless spaces are contained in quotation marks.
+        const components = command.match(/(?:[^\s"]+|"[^"]*")+/g);
+        if (!components) {
+            throw new Error(`Provided command: "${command}" could not be parsed.`);
+        }
+        // Remove quotation marks from the beginning and end of each component if they are present.
+        for (let i = 0; i < components.length; i++) {
+            if (components[i][0] === '"' && components[i].slice(-1) === '"') {
+                components[i] = components[i].slice(1, -1);
+            }
+        }
+        return components;
+    }
+}
+exports.PluggableAuthHandler = PluggableAuthHandler;
+//# sourceMappingURL=pluggable-auth-handler.js.map

package/node_modules/google-auth-library/build/src/auth/refreshclient.d.ts

@@ -0,0 +1,75 @@
+import * as stream from 'stream';
+import { JWTInput } from './credentials';
+import { GetTokenResponse, OAuth2Client, OAuth2ClientOptions } from './oauth2client';
+export declare const USER_REFRESH_ACCOUNT_TYPE = "authorized_user";
+export interface UserRefreshClientOptions extends OAuth2ClientOptions {
+    /**
+     * The authentication client ID.
+     */
+    clientId?: string;
+    /**
+     * The authentication client secret.
+     */
+    clientSecret?: string;
+    /**
+     * The authentication refresh token.
+     */
+    refreshToken?: string;
+}
+export declare class UserRefreshClient extends OAuth2Client {
+    _refreshToken?: string | null;
+    /**
+     * The User Refresh Token client.
+     *
+     * @param optionsOrClientId The User Refresh Token client options. Passing an `clientId` directly is **@DEPRECATED**.
+     * @param clientSecret **@DEPRECATED**. Provide a {@link UserRefreshClientOptions `UserRefreshClientOptions`} object in the first parameter instead.
+     * @param refreshToken **@DEPRECATED**. Provide a {@link UserRefreshClientOptions `UserRefreshClientOptions`} object in the first parameter instead.
+     * @param eagerRefreshThresholdMillis **@DEPRECATED**. Provide a {@link UserRefreshClientOptions `UserRefreshClientOptions`} object in the first parameter instead.
+     * @param forceRefreshOnFailure **@DEPRECATED**. Provide a {@link UserRefreshClientOptions `UserRefreshClientOptions`} object in the first parameter instead.
+     */
+    constructor(optionsOrClientId?: string | UserRefreshClientOptions, 
+    /**
+     * @deprecated - provide a {@link UserRefreshClientOptions `UserRefreshClientOptions`} object in the first parameter instead
+     */
+    clientSecret?: UserRefreshClientOptions['clientSecret'], 
+    /**
+     * @deprecated - provide a {@link UserRefreshClientOptions `UserRefreshClientOptions`} object in the first parameter instead
+     */
+    refreshToken?: UserRefreshClientOptions['refreshToken'], 
+    /**
+     * @deprecated - provide a {@link UserRefreshClientOptions `UserRefreshClientOptions`} object in the first parameter instead
+     */
+    eagerRefreshThresholdMillis?: UserRefreshClientOptions['eagerRefreshThresholdMillis'], 
+    /**
+     * @deprecated - provide a {@link UserRefreshClientOptions `UserRefreshClientOptions`} object in the first parameter instead
+     */
+    forceRefreshOnFailure?: UserRefreshClientOptions['forceRefreshOnFailure']);
+    /**
+     * Refreshes the access token.
+     * @param refreshToken An ignored refreshToken..
+     * @param callback Optional callback.
+     */
+    protected refreshTokenNoCache(): Promise<GetTokenResponse>;
+    fetchIdToken(targetAudience: string): Promise<string>;
+    /**
+     * Create a UserRefreshClient credentials instance using the given input
+     * options.
+     * @param json The input object.
+     */
+    fromJSON(json: JWTInput): void;
+    /**
+     * Create a UserRefreshClient credentials instance using the given input
+     * stream.
+     * @param inputStream The input stream.
+     * @param callback Optional callback.
+     */
+    fromStream(inputStream: stream.Readable): Promise<void>;
+    fromStream(inputStream: stream.Readable, callback: (err?: Error) => void): void;
+    private fromStreamAsync;
+    /**
+     * Create a UserRefreshClient credentials instance using the given input
+     * options.
+     * @param json The input object.
+     */
+    static fromJSON(json: JWTInput): UserRefreshClient;
+}