google-cloud-privilegedaccessmanager 0.4.1__tar.gz → 0.4.2__tar.gz

{google_cloud_privilegedaccessmanager-0.4.1/google_cloud_privilegedaccessmanager.egg-info → google_cloud_privilegedaccessmanager-0.4.2}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: google-cloud-privilegedaccessmanager
-Version: 0.4.1
+Version: 0.4.2
 Summary: Google Cloud Privilegedaccessmanager API client library
 Home-page: https://github.com/googleapis/google-cloud-python/tree/main/packages/google-cloud-privilegedaccessmanager
 Author: Google LLC
@@ -17,17 +17,17 @@ Classifier: Programming Language :: Python :: 3.11
 Classifier: Programming Language :: Python :: 3.12
 Classifier: Programming Language :: Python :: 3.13
 Classifier: Programming Language :: Python :: 3.14
+Classifier: Programming Language :: Python :: 3.15
 Classifier: Operating System :: OS Independent
 Classifier: Topic :: Internet
 Requires-Python: >=3.10
 License-File: LICENSE
-Requires-Dist: google-api-core[grpc]<3.0.0,>=2.17.1
+Requires-Dist: google-api-core[grpc]<3.0.0,>=2.28.0
 Requires-Dist: google-auth!=2.24.0,!=2.25.0,<3.0.0,>=2.14.1
 Requires-Dist: grpcio<2.0.0,>=1.59.0
 Requires-Dist: grpcio<2.0.0,>=1.75.1; python_version >= "3.14"
-Requires-Dist: proto-plus<2.0.0,>=1.22.3
-Requires-Dist: proto-plus<2.0.0,>=1.25.0; python_version >= "3.13"
-Requires-Dist: protobuf<8.0.0,>=4.25.8
+Requires-Dist: proto-plus<2.0.0,>=1.26.1
+Requires-Dist: protobuf<8.0.0,>=6.33.5
 Dynamic: author
 Dynamic: author-email
 Dynamic: classifier

{google_cloud_privilegedaccessmanager-0.4.1 → google_cloud_privilegedaccessmanager-0.4.2}/google/cloud/privilegedaccessmanager/gapic_version.py

@@ -13,4 +13,4 @@
 # See the License for the specific language governing permissions and
 # limitations under the License.
 #
-__version__ = "0.4.1"  # {x-release-please-version}
+__version__ = "0.4.2"  # {x-release-please-version}

google_cloud_privilegedaccessmanager-0.4.2/google/cloud/privilegedaccessmanager_v1/__init__.py

@@ -0,0 +1,101 @@
+# -*- coding: utf-8 -*-
+# Copyright 2026 Google LLC
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+#
+import google.api_core as api_core
+
+from google.cloud.privilegedaccessmanager_v1 import gapic_version as package_version
+
+__version__ = package_version.__version__
+
+# PEP 0810: Explicit Lazy Imports
+# Python 3.15+ natively intercepts and defers these imports.
+# Developers can disable this behavior and force eager imports.
+# For more information, see:
+# https://docs.python.org/3.15/library/sys.html#sys.set_lazy_imports_filter
+# Older Python versions safely ignore this variable.
+__lazy_modules__ = {
+    "google.cloud.privilegedaccessmanager_v1.services.privileged_access_manager",
+    "google.cloud.privilegedaccessmanager_v1.types.privilegedaccessmanager",
+}
+
+
+from .services.privileged_access_manager import (
+    PrivilegedAccessManagerAsyncClient,
+    PrivilegedAccessManagerClient,
+)
+from .types.privilegedaccessmanager import (
+    AccessControlEntry,
+    ApprovalWorkflow,
+    ApproveGrantRequest,
+    CheckOnboardingStatusRequest,
+    CheckOnboardingStatusResponse,
+    CreateEntitlementRequest,
+    CreateGrantRequest,
+    DeleteEntitlementRequest,
+    DenyGrantRequest,
+    Entitlement,
+    GetEntitlementRequest,
+    GetGrantRequest,
+    Grant,
+    Justification,
+    ListEntitlementsRequest,
+    ListEntitlementsResponse,
+    ListGrantsRequest,
+    ListGrantsResponse,
+    ManualApprovals,
+    OperationMetadata,
+    PrivilegedAccess,
+    RevokeGrantRequest,
+    SearchEntitlementsRequest,
+    SearchEntitlementsResponse,
+    SearchGrantsRequest,
+    SearchGrantsResponse,
+    UpdateEntitlementRequest,
+)
+
+__all__ = (
+    "PrivilegedAccessManagerAsyncClient",
+    "AccessControlEntry",
+    "ApprovalWorkflow",
+    "ApproveGrantRequest",
+    "CheckOnboardingStatusRequest",
+    "CheckOnboardingStatusResponse",
+    "CreateEntitlementRequest",
+    "CreateGrantRequest",
+    "DeleteEntitlementRequest",
+    "DenyGrantRequest",
+    "Entitlement",
+    "GetEntitlementRequest",
+    "GetGrantRequest",
+    "Grant",
+    "Justification",
+    "ListEntitlementsRequest",
+    "ListEntitlementsResponse",
+    "ListGrantsRequest",
+    "ListGrantsResponse",
+    "ManualApprovals",
+    "OperationMetadata",
+    "PrivilegedAccess",
+    "PrivilegedAccessManagerClient",
+    "RevokeGrantRequest",
+    "SearchEntitlementsRequest",
+    "SearchEntitlementsResponse",
+    "SearchGrantsRequest",
+    "SearchGrantsResponse",
+    "UpdateEntitlementRequest",
+)
+
+api_core.check_python_version("google.cloud.privilegedaccessmanager_v1")
+api_core.check_dependency_versions("google.cloud.privilegedaccessmanager_v1")

google_cloud_privilegedaccessmanager-0.4.2/google/cloud/privilegedaccessmanager_v1/_compat.py

@@ -0,0 +1,262 @@
+# -*- coding: utf-8 -*-
+# Copyright 2026 Google LLC
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+#
+"""A compatibility module for older versions of google-api-core."""
+
+import json
+import os
+from typing import Any, Dict, List, Optional, Tuple
+from urllib.parse import urlparse, urlunparse
+
+from google.api_core import path_template
+from google.api_core.universe import EmptyUniverseError
+from google.auth.exceptions import MutualTLSChannelError
+from google.protobuf import json_format
+
+try:
+    # note: `#type: ignore` is added because the return type for `should_use_client_cert`
+    # is different than that of the fallback implementation below. This will be removed once
+    # we bump the minimum supported version of google-auth.
+    from google.auth.transport.mtls import should_use_client_cert  # type: ignore
+except ImportError:  # pragma: NO COVER
+
+    def should_use_client_cert():
+        """Returns whether client certificate should be used for mTLS."""
+        use_client_cert = os.getenv(
+            "GOOGLE_API_USE_CLIENT_CERTIFICATE", "false"
+        ).lower()
+        if use_client_cert not in ("true", "false"):
+            raise ValueError(
+                "Environment variable `GOOGLE_API_USE_CLIENT_CERTIFICATE` must be"
+                " either `true` or `false`"
+            )
+        return use_client_cert == "true"
+
+
+def read_environment_variables():
+    """Returns the environment variables used by the client.
+
+    Returns:
+        Tuple[bool, str, str]: returns the GOOGLE_API_USE_CLIENT_CERTIFICATE,
+        GOOGLE_API_USE_MTLS_ENDPOINT, and GOOGLE_CLOUD_UNIVERSE_DOMAIN environment variables.
+
+    Raises:
+        ValueError: If GOOGLE_API_USE_CLIENT_CERTIFICATE is not
+            any of ["true", "false"].
+        google.auth.exceptions.MutualTLSChannelError: If GOOGLE_API_USE_MTLS_ENDPOINT
+            is not any of ["auto", "never", "always"].
+    """
+    use_client_cert = should_use_client_cert()
+    use_mtls_endpoint = os.getenv("GOOGLE_API_USE_MTLS_ENDPOINT", "auto").lower()
+    universe_domain_env = os.getenv("GOOGLE_CLOUD_UNIVERSE_DOMAIN")
+    if use_mtls_endpoint not in ("auto", "never", "always"):
+        raise MutualTLSChannelError(
+            "Environment variable `GOOGLE_API_USE_MTLS_ENDPOINT` must be `never`,"
+            " `auto` or `always`"
+        )
+    return use_client_cert, use_mtls_endpoint, universe_domain_env
+
+
+DEFAULT_UNIVERSE = "googleapis.com"
+
+try:
+    from google.api_core.universe import get_default_mtls_endpoint
+except ImportError:  # pragma: NO COVER
+
+    def get_default_mtls_endpoint(api_endpoint: Optional[str]) -> Optional[str]:
+        """Converts api endpoint to mTLS endpoint.
+
+        Convert "*.sandbox.googleapis.com" and "*.googleapis.com" to
+        "*.mtls.sandbox.googleapis.com" and "*.mtls.googleapis.com" respectively.
+        Other URLs (including those that do not match these domain suffixes or
+        already contain '.mtls.') are passed through as-is.
+
+        Args:
+            api_endpoint (Optional[str]): the api endpoint to convert.
+
+        Returns:
+            Optional[str]: converted mTLS api endpoint.
+        """
+        if not api_endpoint or ".mtls." in api_endpoint.lower():
+            return api_endpoint
+
+        has_scheme = "://" in api_endpoint
+        if not has_scheme:
+            parsed = urlparse("//" + api_endpoint)
+        else:
+            parsed = urlparse(api_endpoint)
+
+        host = parsed.hostname
+        if not host:
+            return api_endpoint
+
+        port = f":{parsed.port}" if parsed.port else ""
+
+        lowered_host = host.lower()
+        suffix_sandbox = ".sandbox.googleapis.com"
+        suffix_google = ".googleapis.com"
+        if lowered_host.endswith(suffix_sandbox):
+            new_host = host[: -len(suffix_sandbox)] + ".mtls.sandbox.googleapis.com"
+        elif lowered_host.endswith(suffix_google):
+            new_host = host[: -len(suffix_google)] + ".mtls.googleapis.com"
+        else:
+            return api_endpoint
+
+        netloc = new_host + port
+        new_parsed = parsed._replace(netloc=netloc)
+
+        if not has_scheme:
+            return urlunparse(new_parsed)[2:]
+        else:
+            return urlunparse(new_parsed)
+
+
+try:
+    from google.api_core.universe import get_api_endpoint
+except ImportError:  # pragma: NO COVER
+
+    def get_api_endpoint(
+        api_override: Optional[str],
+        universe_domain: str,
+        default_universe: str,
+        default_mtls_endpoint: Optional[str],
+        default_endpoint_template: str,
+        use_mtls: bool,
+    ) -> str:
+        """Return the API endpoint used by the client.
+
+        Args:
+            api_override (Optional[str]): The API endpoint override. If specified,
+                this is always returned.
+            universe_domain (str): The universe domain used by the client.
+            default_universe (str): The default universe domain.
+            default_mtls_endpoint (Optional[str]): The default mTLS endpoint.
+            default_endpoint_template (str): The default endpoint template containing
+                a placeholder `{UNIVERSE_DOMAIN}`.
+            use_mtls (bool): Whether to use the mTLS endpoint.
+
+        Returns:
+            str: The API endpoint to be used by the client.
+
+        Raises:
+            google.auth.exceptions.MutualTLSChannelError: If mTLS is requested but
+                not supported in the configured universe domain.
+            ValueError: If mTLS is requested but no mTLS endpoint is available.
+        """
+        if api_override is not None:
+            return api_override
+
+        if use_mtls:
+            if universe_domain.lower() != default_universe.lower():
+                raise MutualTLSChannelError(
+                    f"mTLS is not supported in any universe other than {default_universe}."
+                )
+            if not default_mtls_endpoint:
+                raise ValueError("mTLS endpoint is not available.")
+            return default_mtls_endpoint
+        else:
+            return default_endpoint_template.format(UNIVERSE_DOMAIN=universe_domain)
+
+
+try:
+    from google.api_core.universe import get_universe_domain
+except ImportError:  # pragma: NO COVER
+
+    def get_universe_domain(
+        *potential_universes: Optional[str],
+        default_universe: str,
+    ) -> str:
+        """Return the universe domain used by the client.
+
+        Args:
+            *potential_universes (Optional[str]): Potential universe domains in order of preference.
+            default_universe (str): The default universe domain.
+
+        Returns:
+            str: The universe domain to be used by the client.
+
+        Raises:
+            EmptyUniverseError: If the resolved universe domain is an empty string.
+        """
+        resolved = next(
+            (x.strip() for x in potential_universes if x is not None),
+            default_universe,
+        )
+
+        if not resolved:
+            raise EmptyUniverseError()
+        return resolved
+
+
+try:
+    from google.api_core.rest_helpers import transcode_request  # type: ignore
+except ImportError:  # pragma: NO COVER
+
+    def transcode_request(
+        http_options: List[Dict[str, str]],
+        request: Any,
+        required_fields_default_values: Optional[Dict[str, Any]] = None,
+        rest_numeric_enums: bool = False,
+    ) -> Tuple[Dict[str, Any], Optional[str], Dict[str, Any]]:
+        """Transcodes a request into HTTP method, URI, body, and query parameters.
+
+        Args:
+            http_options (List[Dict[str, str]]): List of HTTP transcoding rules.
+            request (Any): The protobuf or proto-plus request message.
+            required_fields_default_values (Optional[Dict[str, Any]]): Dictionary
+                of required fields default values to merge into query parameters if missing.
+            rest_numeric_enums (bool): Whether to encode enums as integers.
+
+        Returns:
+            Tuple[Dict[str, Any], Optional[str], Dict[str, Any]]: A tuple containing:
+                - The raw transcoded request dictionary (containing keys like 'uri', 'method').
+                - The serialized request body JSON string, or None if no body.
+                - The query parameters dictionary.
+        """
+        if request is None:
+            raise TypeError("request cannot be None")
+
+        # Convert proto-plus message to its underlying protobuf message if needed
+        pb_request = getattr(request, "_pb", request)
+
+        transcoded_request = path_template.transcode(http_options, pb_request)
+
+        body_json = None
+        if transcoded_request.get("body") is not None:
+            body_json = json_format.MessageToJson(
+                transcoded_request["body"],
+                use_integers_for_enums=rest_numeric_enums,
+            )
+
+        query_params_json = {}
+        if transcoded_request.get("query_params") is not None:
+            query_params_json = json.loads(
+                json_format.MessageToJson(
+                    transcoded_request["query_params"],
+                    use_integers_for_enums=rest_numeric_enums,
+                )
+            )
+
+        # If required_fields_default_values is provided, we merge default values for missing
+        # required fields into the query parameters.
+        if required_fields_default_values:
+            for k, v in required_fields_default_values.items():
+                if k not in query_params_json:
+                    query_params_json[k] = v
+
+        if rest_numeric_enums:
+            query_params_json["$alt"] = "json;enum-encoding=int"
+
+        return transcoded_request, body_json, query_params_json

{google_cloud_privilegedaccessmanager-0.4.1 → google_cloud_privilegedaccessmanager-0.4.2}/google/cloud/privilegedaccessmanager_v1/gapic_version.py

@@ -13,4 +13,4 @@
 # See the License for the specific language governing permissions and
 # limitations under the License.
 #
-__version__ = "0.4.1"  # {x-release-please-version}
+__version__ = "0.4.2"  # {x-release-please-version}

{google_cloud_privilegedaccessmanager-0.4.1 → google_cloud_privilegedaccessmanager-0.4.2}/google/cloud/privilegedaccessmanager_v1/services/privileged_access_manager/async_client.py

@@ -2281,9 +2281,7 @@ class PrivilegedAccessManagerAsyncClient:
 DEFAULT_CLIENT_INFO = gapic_v1.client_info.ClientInfo(
     gapic_version=package_version.__version__
 )
-
-if hasattr(DEFAULT_CLIENT_INFO, "protobuf_runtime_version"):  # pragma: NO COVER
-    DEFAULT_CLIENT_INFO.protobuf_runtime_version = google.protobuf.__version__
+DEFAULT_CLIENT_INFO.protobuf_runtime_version = google.protobuf.__version__
 
 
 __all__ = ("PrivilegedAccessManagerAsyncClient",)

{google_cloud_privilegedaccessmanager-0.4.1 → google_cloud_privilegedaccessmanager-0.4.2}/google/cloud/privilegedaccessmanager_v1/services/privileged_access_manager/client.py

@@ -46,6 +46,13 @@ from google.auth.transport.grpc import SslCredentials  # type: ignore
 from google.oauth2 import service_account  # type: ignore
 
 from google.cloud.privilegedaccessmanager_v1 import gapic_version as package_version
+from google.cloud.privilegedaccessmanager_v1._compat import (
+    get_api_endpoint,
+    get_default_mtls_endpoint,
+    get_universe_domain,
+    read_environment_variables,
+    should_use_client_cert,
+)
 
 try:
     OptionalRetry = Union[retries.Retry, gapic_v1.method._MethodDefault, None]
@@ -140,77 +147,13 @@ class PrivilegedAccessManagerClient(metaclass=PrivilegedAccessManagerClientMeta)
       over.
     """
 
-    @staticmethod
-    def _get_default_mtls_endpoint(api_endpoint) -> Optional[str]:
-        """Converts api endpoint to mTLS endpoint.
-
-        Convert "*.sandbox.googleapis.com" and "*.googleapis.com" to
-        "*.mtls.sandbox.googleapis.com" and "*.mtls.googleapis.com" respectively.
-        Args:
-            api_endpoint (Optional[str]): the api endpoint to convert.
-        Returns:
-            Optional[str]: converted mTLS api endpoint.
-        """
-        if not api_endpoint:
-            return api_endpoint
-
-        mtls_endpoint_re = re.compile(
-            r"(?P<name>[^.]+)(?P<mtls>\.mtls)?(?P<sandbox>\.sandbox)?(?P<googledomain>\.googleapis\.com)?"
-        )
-
-        m = mtls_endpoint_re.match(api_endpoint)
-        if m is None:
-            # Could not parse api_endpoint; return as-is.
-            return api_endpoint
-
-        name, mtls, sandbox, googledomain = m.groups()
-        if mtls or not googledomain:
-            return api_endpoint
-
-        if sandbox:
-            return api_endpoint.replace(
-                "sandbox.googleapis.com", "mtls.sandbox.googleapis.com"
-            )
-
-        return api_endpoint.replace(".googleapis.com", ".mtls.googleapis.com")
-
     # Note: DEFAULT_ENDPOINT is deprecated. Use _DEFAULT_ENDPOINT_TEMPLATE instead.
     DEFAULT_ENDPOINT = "privilegedaccessmanager.googleapis.com"
-    DEFAULT_MTLS_ENDPOINT = _get_default_mtls_endpoint.__func__(  # type: ignore
-        DEFAULT_ENDPOINT
-    )
+    DEFAULT_MTLS_ENDPOINT = get_default_mtls_endpoint(DEFAULT_ENDPOINT)
 
     _DEFAULT_ENDPOINT_TEMPLATE = "privilegedaccessmanager.{UNIVERSE_DOMAIN}"
     _DEFAULT_UNIVERSE = "googleapis.com"
 
-    @staticmethod
-    def _use_client_cert_effective():
-        """Returns whether client certificate should be used for mTLS if the
-        google-auth version supports should_use_client_cert automatic mTLS enablement.
-
-        Alternatively, read from the GOOGLE_API_USE_CLIENT_CERTIFICATE env var.
-
-        Returns:
-            bool: whether client certificate should be used for mTLS
-        Raises:
-            ValueError: (If using a version of google-auth without should_use_client_cert and
-            GOOGLE_API_USE_CLIENT_CERTIFICATE is set to an unexpected value.)
-        """
-        # check if google-auth version supports should_use_client_cert for automatic mTLS enablement
-        if hasattr(mtls, "should_use_client_cert"):  # pragma: NO COVER
-            return mtls.should_use_client_cert()
-        else:  # pragma: NO COVER
-            # if unsupported, fallback to reading from env var
-            use_client_cert_str = os.getenv(
-                "GOOGLE_API_USE_CLIENT_CERTIFICATE", "false"
-            ).lower()
-            if use_client_cert_str not in ("true", "false"):
-                raise ValueError(
-                    "Environment variable `GOOGLE_API_USE_CLIENT_CERTIFICATE` must be"
-                    " either `true` or `false`"
-                )
-            return use_client_cert_str == "true"
-
     @classmethod
     def from_service_account_info(cls, info: dict, *args, **kwargs):
         """Creates an instance of this client using the provided credentials
@@ -424,7 +367,7 @@ class PrivilegedAccessManagerClient(metaclass=PrivilegedAccessManagerClientMeta)
         )
         if client_options is None:
             client_options = client_options_lib.ClientOptions()
-        use_client_cert = PrivilegedAccessManagerClient._use_client_cert_effective()
+        use_client_cert = should_use_client_cert()
         use_mtls_endpoint = os.getenv("GOOGLE_API_USE_MTLS_ENDPOINT", "auto")
         if use_mtls_endpoint not in ("auto", "never", "always"):
             raise MutualTLSChannelError(
@@ -445,35 +388,12 @@ class PrivilegedAccessManagerClient(metaclass=PrivilegedAccessManagerClientMeta)
         elif use_mtls_endpoint == "always" or (
             use_mtls_endpoint == "auto" and client_cert_source
         ):
-            api_endpoint = cls.DEFAULT_MTLS_ENDPOINT
+            api_endpoint = cls.DEFAULT_MTLS_ENDPOINT  # type: ignore
         else:
             api_endpoint = cls.DEFAULT_ENDPOINT
 
         return api_endpoint, client_cert_source
 
-    @staticmethod
-    def _read_environment_variables():
-        """Returns the environment variables used by the client.
-
-        Returns:
-            Tuple[bool, str, str]: returns the GOOGLE_API_USE_CLIENT_CERTIFICATE,
-            GOOGLE_API_USE_MTLS_ENDPOINT, and GOOGLE_CLOUD_UNIVERSE_DOMAIN environment variables.
-
-        Raises:
-            ValueError: If GOOGLE_API_USE_CLIENT_CERTIFICATE is not
-                any of ["true", "false"].
-            google.auth.exceptions.MutualTLSChannelError: If GOOGLE_API_USE_MTLS_ENDPOINT
-                is not any of ["auto", "never", "always"].
-        """
-        use_client_cert = PrivilegedAccessManagerClient._use_client_cert_effective()
-        use_mtls_endpoint = os.getenv("GOOGLE_API_USE_MTLS_ENDPOINT", "auto").lower()
-        universe_domain_env = os.getenv("GOOGLE_CLOUD_UNIVERSE_DOMAIN")
-        if use_mtls_endpoint not in ("auto", "never", "always"):
-            raise MutualTLSChannelError(
-                "Environment variable `GOOGLE_API_USE_MTLS_ENDPOINT` must be `never`, `auto` or `always`"
-            )
-        return use_client_cert, use_mtls_endpoint, universe_domain_env
-
     @staticmethod
     def _get_client_cert_source(provided_cert_source, use_cert_flag):
         """Return the client cert source to be used by the client.
@@ -493,67 +413,6 @@ class PrivilegedAccessManagerClient(metaclass=PrivilegedAccessManagerClientMeta)
                 client_cert_source = mtls.default_client_cert_source()
         return client_cert_source
 
-    @staticmethod
-    def _get_api_endpoint(
-        api_override, client_cert_source, universe_domain, use_mtls_endpoint
-    ) -> str:
-        """Return the API endpoint used by the client.
-
-        Args:
-            api_override (str): The API endpoint override. If specified, this is always
-                the return value of this function and the other arguments are not used.
-            client_cert_source (bytes): The client certificate source used by the client.
-            universe_domain (str): The universe domain used by the client.
-            use_mtls_endpoint (str): How to use the mTLS endpoint, which depends also on the other parameters.
-                Possible values are "always", "auto", or "never".
-
-        Returns:
-            str: The API endpoint to be used by the client.
-        """
-        if api_override is not None:
-            api_endpoint = api_override
-        elif use_mtls_endpoint == "always" or (
-            use_mtls_endpoint == "auto" and client_cert_source
-        ):
-            _default_universe = PrivilegedAccessManagerClient._DEFAULT_UNIVERSE
-            if universe_domain != _default_universe:
-                raise MutualTLSChannelError(
-                    f"mTLS is not supported in any universe other than {_default_universe}."
-                )
-            api_endpoint = PrivilegedAccessManagerClient.DEFAULT_MTLS_ENDPOINT
-        else:
-            api_endpoint = (
-                PrivilegedAccessManagerClient._DEFAULT_ENDPOINT_TEMPLATE.format(
-                    UNIVERSE_DOMAIN=universe_domain
-                )
-            )
-        return api_endpoint
-
-    @staticmethod
-    def _get_universe_domain(
-        client_universe_domain: Optional[str], universe_domain_env: Optional[str]
-    ) -> str:
-        """Return the universe domain used by the client.
-
-        Args:
-            client_universe_domain (Optional[str]): The universe domain configured via the client options.
-            universe_domain_env (Optional[str]): The universe domain configured via the "GOOGLE_CLOUD_UNIVERSE_DOMAIN" environment variable.
-
-        Returns:
-            str: The universe domain to be used by the client.
-
-        Raises:
-            ValueError: If the universe domain is an empty string.
-        """
-        universe_domain = PrivilegedAccessManagerClient._DEFAULT_UNIVERSE
-        if client_universe_domain is not None:
-            universe_domain = client_universe_domain
-        elif universe_domain_env is not None:
-            universe_domain = universe_domain_env
-        if len(universe_domain.strip()) == 0:
-            raise ValueError("Universe Domain cannot be an empty string.")
-        return universe_domain
-
     def _validate_universe_domain(self):
         """Validates client's and credentials' universe domains are consistent.
 
@@ -687,15 +546,17 @@ class PrivilegedAccessManagerClient(metaclass=PrivilegedAccessManagerClientMeta)
         universe_domain_opt = getattr(self._client_options, "universe_domain", None)
 
         self._use_client_cert, self._use_mtls_endpoint, self._universe_domain_env = (
-            PrivilegedAccessManagerClient._read_environment_variables()
+            read_environment_variables()
         )
         self._client_cert_source = (
             PrivilegedAccessManagerClient._get_client_cert_source(
                 self._client_options.client_cert_source, self._use_client_cert
             )
         )
-        self._universe_domain = PrivilegedAccessManagerClient._get_universe_domain(
-            universe_domain_opt, self._universe_domain_env
+        self._universe_domain = get_universe_domain(
+            universe_domain_opt,
+            self._universe_domain_env,
+            default_universe=PrivilegedAccessManagerClient._DEFAULT_UNIVERSE,
         )
         self._api_endpoint: str = ""  # updated below, depending on `transport`
 
@@ -730,14 +591,14 @@ class PrivilegedAccessManagerClient(metaclass=PrivilegedAccessManagerClientMeta)
             self._transport = cast(PrivilegedAccessManagerTransport, transport)
             self._api_endpoint = self._transport.host
 
-        self._api_endpoint = (
-            self._api_endpoint
-            or PrivilegedAccessManagerClient._get_api_endpoint(
-                self._client_options.api_endpoint,
-                self._client_cert_source,
-                self._universe_domain,
-                self._use_mtls_endpoint,
-            )
+        self._api_endpoint = self._api_endpoint or get_api_endpoint(
+            api_override=self._client_options.api_endpoint,
+            universe_domain=self._universe_domain,
+            default_universe=PrivilegedAccessManagerClient._DEFAULT_UNIVERSE,
+            default_mtls_endpoint=PrivilegedAccessManagerClient.DEFAULT_MTLS_ENDPOINT,
+            default_endpoint_template=PrivilegedAccessManagerClient._DEFAULT_ENDPOINT_TEMPLATE,
+            use_mtls=self._use_mtls_endpoint == "always"
+            or (self._use_mtls_endpoint == "auto" and self._client_cert_source),
         )
 
         if not transport_provided:
@@ -2719,8 +2580,6 @@ class PrivilegedAccessManagerClient(metaclass=PrivilegedAccessManagerClientMeta)
 DEFAULT_CLIENT_INFO = gapic_v1.client_info.ClientInfo(
     gapic_version=package_version.__version__
 )
-
-if hasattr(DEFAULT_CLIENT_INFO, "protobuf_runtime_version"):  # pragma: NO COVER
-    DEFAULT_CLIENT_INFO.protobuf_runtime_version = google.protobuf.__version__
+DEFAULT_CLIENT_INFO.protobuf_runtime_version = google.protobuf.__version__
 
 __all__ = ("PrivilegedAccessManagerClient",)