feat: [ces] update public libraries for CES v1

packages/google-cloud-ces/README.md

@@ -107,6 +107,7 @@ Samples are in the [`samples/`][homepage_samples] directory. Each sample's `READ
 | update toolset | [source code](https://github.com/googleapis/google-cloud-node/blob/main/packages/google-cloud-ces/samples/generated/v1/agent_service.update_toolset.js) |
 | bidi run session | [source code](https://github.com/googleapis/google-cloud-node/blob/main/packages/google-cloud-ces/samples/generated/v1/session_service.bidi_run_session.js) |
 | run session | [source code](https://github.com/googleapis/google-cloud-node/blob/main/packages/google-cloud-ces/samples/generated/v1/session_service.run_session.js) |
+| stream run session | [source code](https://github.com/googleapis/google-cloud-node/blob/main/packages/google-cloud-ces/samples/generated/v1/session_service.stream_run_session.js) |
 | cloud | [source code](https://github.com/googleapis/google-cloud-node/blob/main/packages/google-cloud-ces/samples/generated/v1/snippet_metadata_google.cloud.ces.v1.json) |
 | execute tool | [source code](https://github.com/googleapis/google-cloud-node/blob/main/packages/google-cloud-ces/samples/generated/v1/tool_service.execute_tool.js) |
 | retrieve tool schema | [source code](https://github.com/googleapis/google-cloud-node/blob/main/packages/google-cloud-ces/samples/generated/v1/tool_service.retrieve_tool_schema.js) |
@@ -195,6 +196,7 @@ Samples are in the [`samples/`][homepage_samples] directory. Each sample's `READ
 | upload evaluation audio | [source code](https://github.com/googleapis/google-cloud-node/blob/main/packages/google-cloud-ces/samples/generated/v1beta/evaluation_service.upload_evaluation_audio.js) |
 | bidi run session | [source code](https://github.com/googleapis/google-cloud-node/blob/main/packages/google-cloud-ces/samples/generated/v1beta/session_service.bidi_run_session.js) |
 | run session | [source code](https://github.com/googleapis/google-cloud-node/blob/main/packages/google-cloud-ces/samples/generated/v1beta/session_service.run_session.js) |
+| stream run session | [source code](https://github.com/googleapis/google-cloud-node/blob/main/packages/google-cloud-ces/samples/generated/v1beta/session_service.stream_run_session.js) |
 | cloud | [source code](https://github.com/googleapis/google-cloud-node/blob/main/packages/google-cloud-ces/samples/generated/v1beta/snippet_metadata_google.cloud.ces.v1beta.json) |
 | execute tool | [source code](https://github.com/googleapis/google-cloud-node/blob/main/packages/google-cloud-ces/samples/generated/v1beta/tool_service.execute_tool.js) |
 | retrieve tool schema | [source code](https://github.com/googleapis/google-cloud-node/blob/main/packages/google-cloud-ces/samples/generated/v1beta/tool_service.retrieve_tool_schema.js) |

packages/google-cloud-ces/protos/google/cloud/ces/v1/agent_service.proto

@@ -628,6 +628,14 @@ message ExportAppRequest {
   // app. The format of this URI must be `gs://<bucket-name>/<object-name>`. The
   // exported app archive will be written directly to the specified GCS object.
   string gcs_uri = 3 [(google.api.field_behavior) = OPTIONAL];
+
+  // Optional. The resource name of the app version to export.
+  // Format:
+  // `projects/{project}/locations/{location}/apps/{app}/versions/{version}`.
+  string app_version = 4 [
+    (google.api.field_behavior) = OPTIONAL,
+    (google.api.resource_reference) = { type: "ces.googleapis.com/AppVersion" }
+  ];
 }
 
 // Response message for

packages/google-cloud-ces/protos/google/cloud/ces/v1/agent_tool.proto

@@ -0,0 +1,41 @@
+// Copyright 2026 Google LLC
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+syntax = "proto3";
+
+package google.cloud.ces.v1;
+
+import "google/api/field_behavior.proto";
+import "google/api/resource.proto";
+
+option go_package = "cloud.google.com/go/ces/apiv1/cespb;cespb";
+option java_multiple_files = true;
+option java_outer_classname = "AgentToolProto";
+option java_package = "com.google.cloud.ces.v1";
+
+// Represents a tool that allows the agent to call another agent.
+message AgentTool {
+  // Required. The name of the agent tool.
+  string name = 1 [(google.api.field_behavior) = REQUIRED];
+
+  // Optional. Description of the tool's purpose.
+  string description = 2 [(google.api.field_behavior) = OPTIONAL];
+
+  // Optional. The resource name of the root agent that is the entry point of
+  // the tool. Format: `projects/{project}/locations/{location}/agents/{agent}`
+  string root_agent = 3 [
+    (google.api.field_behavior) = OPTIONAL,
+    (google.api.resource_reference) = { type: "ces.googleapis.com/Agent" }
+  ];
+}

packages/google-cloud-ces/protos/google/cloud/ces/v1/app.proto

@@ -122,6 +122,10 @@ message App {
   // Optional. Logging settings of the app.
   LoggingSettings logging_settings = 8 [(google.api.field_behavior) = OPTIONAL];
 
+  // Optional. Error handling settings of the app.
+  ErrorHandlingSettings error_handling_settings = 34
+      [(google.api.field_behavior) = OPTIONAL];
+
   // Optional. The default LLM model settings for the app.
   // Individual resources (e.g. agents, guardrails) can override these
   // configurations as needed.
@@ -216,8 +220,11 @@ message LanguageSettings {
   // pre-built instructions to improve handling of multilingual input.
   bool enable_multilingual_support = 3 [(google.api.field_behavior) = OPTIONAL];
 
-  // Optional. The action to perform when an agent receives input in an
-  // unsupported language.
+  // Optional. Deprecated: This feature is no longer supported. Use
+  // `enable_multilingual_support` instead to improve handling of multilingual
+  // input.
+  // The action to perform when an agent receives input in an unsupported
+  // language.
   //
   // This can be a predefined action or a custom tool call.
   // Valid values are:
@@ -226,7 +233,8 @@ message LanguageSettings {
   // an [EndSession][google.cloud.ces.v1.EndSession] signal with corresponding
   // [metadata][google.cloud.ces.v1.EndSession.metadata] to terminate the
   // conversation.
-  string fallback_action = 4 [(google.api.field_behavior) = OPTIONAL];
+  string fallback_action = 4
+      [deprecated = true, (google.api.field_behavior) = OPTIONAL];
 }
 
 // Configuration for how the input and output audio should be processed and
@@ -402,6 +410,30 @@ message LoggingSettings {
       [(google.api.field_behavior) = OPTIONAL];
 }
 
+// Settings to describe how errors should be handled in the app.
+message ErrorHandlingSettings {
+  // Defines the strategy for handling errors.
+  enum ErrorHandlingStrategy {
+    // Unspecified error handling strategy.
+    ERROR_HANDLING_STRATEGY_UNSPECIFIED = 0;
+
+    // No specific handling is enabled.
+    NONE = 1;
+
+    // A fallback message will be returned to the user in case of
+    // system errors (e.g. LLM errors).
+    FALLBACK_RESPONSE = 2;
+
+    // An [EndSession][google.cloud.ces.v1.EndSession] signal will be emitted in
+    // case of system errors (e.g. LLM errors).
+    END_SESSION = 3;
+  }
+
+  // Optional. The strategy to use for error handling.
+  ErrorHandlingStrategy error_handling_strategy = 1
+      [(google.api.field_behavior) = OPTIONAL];
+}
+
 // Threshold settings for metrics in an Evaluation.
 message EvaluationMetricsThresholds {
   // Settings for golden evaluations.

packages/google-cloud-ces/protos/google/cloud/ces/v1/bigquery_export.proto

@@ -28,13 +28,13 @@ message BigQueryExportSettings {
   // Optional. Indicates whether the BigQuery export is enabled.
   bool enabled = 1 [(google.api.field_behavior) = OPTIONAL];
 
-  // Optional. The project ID of the BigQuery dataset to export the data to.
+  // Optional. The **project ID** of the BigQuery dataset to export the data to.
   //
   // Note: If the BigQuery dataset is in a different project from the app,
   // you should grant `roles/bigquery.admin` role to the CES service agent
   // `service-<PROJECT-NUMBER>@gcp-sa-ces.iam.gserviceaccount.com`.
   string project = 2 [(google.api.field_behavior) = OPTIONAL];
 
-  // Optional. The BigQuery dataset to export the data to.
+  // Optional. The BigQuery **dataset ID** to export the data to.
   string dataset = 3 [(google.api.field_behavior) = OPTIONAL];
 }

packages/google-cloud-ces/protos/google/cloud/ces/v1/common.proto

@@ -148,11 +148,14 @@ message TlsConfig {
     // is empty or unspecified, CES will use Google's default trust
     // store to verify certificates. N.B. Make sure the HTTPS server
     // certificates are signed with "subject alt name". For instance a
-    // certificate can be self-signed using the following command,
+    // certificate can be self-signed using the following command:
+    //
+    // ```
     //    openssl x509 -req -days 200 -in example.com.csr \
     //      -signkey example.com.key \
     //      -out example.com.crt \
     //      -extfile <(printf "\nsubjectAltName='DNS:www.example.com'")
+    // ```
     bytes cert = 2 [(google.api.field_behavior) = REQUIRED];
   }
 
@@ -239,6 +242,9 @@ message ChannelProfile {
 
       // Widget supports only chat input.
       CHAT_ONLY = 3;
+
+      // Widget supports chat, voice, and video input.
+      CHAT_VOICE_AND_VIDEO = 4;
     }
 
     // Theme of the web widget.
@@ -289,6 +295,9 @@ message ChannelProfile {
 
     // Five9 channel.
     FIVE9 = 7;
+
+    // Third party contact center integration channel.
+    CONTACT_CENTER_INTEGRATION = 8;
   }
 
   // Optional. The unique identifier of the channel profile.

packages/google-cloud-ces/protos/google/cloud/ces/v1/deployment.proto

@@ -38,17 +38,19 @@ message Deployment {
 
   // Identifier. The resource name of the deployment.
   // Format:
-  // projects/{project}/locations/{location}/apps/{app}/deployments/{deployment}
+  // `projects/{project}/locations/{location}/apps/{app}/deployments/{deployment}`
   string name = 1 [(google.api.field_behavior) = IDENTIFIER];
 
   // Required. Display name of the deployment.
   string display_name = 8 [(google.api.field_behavior) = REQUIRED];
 
-  // Required. The resource name of the app version to deploy.
+  // Optional. The resource name of the app version to deploy.
   // Format:
-  // projects/{project}/locations/{location}/apps/{app}/versions/{version}
+  // `projects/{project}/locations/{location}/apps/{app}/versions/{version}`
+  // Use `projects/{project}/locations/{location}/apps/{app}/versions/-` to use
+  // the draft app.
   string app_version = 2 [
-    (google.api.field_behavior) = REQUIRED,
+    (google.api.field_behavior) = OPTIONAL,
     (google.api.resource_reference) = { type: "ces.googleapis.com/AppVersion" }
   ];
 

packages/google-cloud-ces/protos/google/cloud/ces/v1/example.proto

@@ -102,6 +102,9 @@ message Chunk {
     // Optional. Transcript associated with the audio.
     string transcript = 9 [(google.api.field_behavior) = OPTIONAL];
 
+    // Optional. Blob data.
+    Blob blob = 7 [(google.api.field_behavior) = OPTIONAL];
+
     // Optional. Custom payload data.
     google.protobuf.Struct payload = 11
         [(google.api.field_behavior) = OPTIONAL];

packages/google-cloud-ces/protos/google/cloud/ces/v1/mcp_tool.proto

@@ -66,4 +66,12 @@ message McpTool {
   // service names within a perimeter.
   ServiceDirectoryConfig service_directory_config = 8
       [(google.api.field_behavior) = OPTIONAL];
+
+  // Optional. The custom headers to send in the request to the MCP server. The
+  // values must be in the format `$context.variables.<name_of_variable>` and
+  // can be set in the session variables. See
+  // https://docs.cloud.google.com/customer-engagement-ai/conversational-agents/ps/tool/open-api#openapi-injection
+  // for more details.
+  map<string, string> custom_headers = 9
+      [(google.api.field_behavior) = OPTIONAL];
 }

packages/google-cloud-ces/protos/google/cloud/ces/v1/mcp_toolset.proto

@@ -51,4 +51,12 @@ message McpToolset {
   // Optional. The TLS configuration. Includes the custom server certificates
   // that the client should trust.
   TlsConfig tls_config = 4 [(google.api.field_behavior) = OPTIONAL];
+
+  // Optional. The custom headers to send in the request to the MCP server. The
+  // values must be in the format `$context.variables.<name_of_variable>` and
+  // can be set in the session variables. See
+  // https://docs.cloud.google.com/customer-engagement-ai/conversational-agents/ps/tool/open-api#openapi-injection
+  // for more details.
+  map<string, string> custom_headers = 5
+      [(google.api.field_behavior) = OPTIONAL];
 }

packages/google-cloud-ces/protos/google/cloud/ces/v1/security_settings.proto

@@ -0,0 +1,85 @@
+// Copyright 2026 Google LLC
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+syntax = "proto3";
+
+package google.cloud.ces.v1;
+
+import "google/api/field_behavior.proto";
+import "google/api/resource.proto";
+import "google/protobuf/timestamp.proto";
+
+option go_package = "cloud.google.com/go/ces/apiv1/cespb;cespb";
+option java_multiple_files = true;
+option java_outer_classname = "SecuritySettingsProto";
+option java_package = "com.google.cloud.ces.v1";
+
+// Project/Location level security settings for CES.
+message SecuritySettings {
+  option (google.api.resource) = {
+    type: "ces.googleapis.com/SecuritySettings"
+    pattern: "projects/{project}/locations/{location}/securitySettings"
+    plural: "securitySettings"
+    singular: "securitySettings"
+  };
+
+  // Identifier. The unique identifier of the security settings.
+  // Format: `projects/{project}/locations/{location}/securitySettings`
+  string name = 1 [(google.api.field_behavior) = IDENTIFIER];
+
+  // Optional. Endpoint control related settings.
+  EndpointControlPolicy endpoint_control_policy = 2
+      [(google.api.field_behavior) = OPTIONAL];
+
+  // Output only. Create time of the security settings.
+  google.protobuf.Timestamp create_time = 3
+      [(google.api.field_behavior) = OUTPUT_ONLY];
+
+  // Output only. Last update time of the security settings.
+  google.protobuf.Timestamp update_time = 4
+      [(google.api.field_behavior) = OUTPUT_ONLY];
+
+  // Output only. Etag of the security settings.
+  string etag = 5 [(google.api.field_behavior) = OUTPUT_ONLY];
+}
+
+// Defines project/location level endpoint control policy.
+message EndpointControlPolicy {
+  // Defines the scope in which this policy's allowed_origins list is
+  // enforced.
+  enum EnforcementScope {
+    // Unspecified. This policy will be treated as VPCSC_ONLY.
+    ENFORCEMENT_SCOPE_UNSPECIFIED = 0;
+
+    // This policy applies only when VPC-SC is active.
+    VPCSC_ONLY = 1;
+
+    // This policy ALWAYS applies, regardless of VPC-SC status.
+    ALWAYS = 2;
+  }
+
+  // Optional. The scope in which this policy's allowed_origins list is
+  // enforced.
+  EnforcementScope enforcement_scope = 1
+      [(google.api.field_behavior) = OPTIONAL];
+
+  // Optional. The allowed HTTP(s) origins that tools in the App are able to
+  // directly call. The enforcement depends on the value of
+  // enforcement_scope and the VPC-SC status of the project.
+  // If a port number is not provided, all ports will be allowed. Otherwise,
+  // the port number must match exactly. For example, "https://example.com"
+  // will match "https://example.com:443" and any other port.
+  // "https://example.com:443" will only match "https://example.com:443".
+  repeated string allowed_origins = 2 [(google.api.field_behavior) = OPTIONAL];
+}