…a client (#18196)

Migrating over @gkevinzheng PR from bigtable monorepo
googleapis/python-bigtable#1296

### Original description:

> 
> **Changes made:**
> 
> - Refactored `_MappableAttributesMixin` to `helpers.py` for use in
`RowRange`.
> - Used `RowRange` and `ReadRowsQuery` from the data client as backing
data sources for `RowRange` and `RowSet` respectively.
> 

Note to reviewers: This PR has already been reviewed and merged to a
staging branch, with the intention of doing a single merge to main. We
are now planning to slowly rollout these changes back to the main
branch. Minimal re-review should be necessary

---------

Co-authored-by: Kevin Zheng <147537668+gkevinzheng@users.noreply.github.com>

**⚠️ Note to Reviewers:** 
> The files under `google/cloud/spanner_v1/omni/proto/`
(`authentication_pb2*`, `login_pb2*`, `login_pb2_grpc*`) are
auto-generated.
> 
> The core hand-written logic is contained in the OPAQUE cryptography
module, `LoginClient`, `SpannerOmniCredentials`, and the client/DB-API
integrations.

This PR introduces native username/password authentication support for
Spanner Omni endpoints using the OPAQUE password-authenticated key
exchange (PAKE) protocol, maintaining parity with the Go and Java client
implementations.

Java implementation -
googleapis/google-cloud-java#13470
Go implementation -
googleapis/google-cloud-go#20085

**Key Changes:**
* **Omni Login Protocol:** Added generated protobufs
(`authentication_pb2*`, `login_pb2*`, `login_pb2_grpc*`) and a gRPC
`LoginClient` to handle the authentication handshake with Spanner Omni
endpoints over the `LoginService/Login` bi-directional stream.
* **OPAQUE Protocol (`opaque.py`):** Implements the client-side OPAQUE
protocol utilizing NIST P-256 elliptic curve arithmetic
(`cryptography`), Argon2id stretching with defensive parameter
validation, RFC 9380 hash-to-curve / random oracle mapping, and
constant-time MAC verification.
* **Security & Memory Safety:** Ensures in-place zeroization of
intermediate keys, stretched passwords, and shared secrets using mutable
byte buffers inside `finally` blocks.
* **SpannerOmniCredentials & Interceptors (`credentials.py`):**
Implements `SpannerOmniCredentials` subclassing
`google.auth.credentials.Credentials` to manage Bearer access token
lifecycle, automatic expiry checks, and transparent token refreshes.
Provides dedicated interceptors for both synchronous `grpc` and
asynchronous `grpc.aio` channels across all RPC patterns (unary-unary,
unary-stream, stream-unary, stream-stream).
* **Client & DB-API Integration:**
- Extended `spanner_v1.Client` and `spanner_v1.AsyncClient` to accept
`username`, `password`, and `instance_type="omni"`, automatically wiring
up `SpannerOmniCredentials`.
- Updated `google.cloud.spanner_dbapi.connect()` to accept `username`
and `password` for DB-API connections.
- Updated sync and async transport factories to attach Bearer auth
interceptors to Omni gRPC channels.
* **Testing:** Added comprehensive unit test suites covering the OPAQUE
cryptographic engine, `LoginClient` state machine, credentials
lifecycle/interceptors, DB-API connect options, and system test
configurations for both sync and async client workflows against live
Spanner Omni instances.

---

### Running Integration Tests

To run integration tests against a live Spanner Omni instance with auth
login, set the following environment variables:

```bash
export SPANNER_OMNI=localhost:15000
export CA_CERTIFICATE=/path/to/ca.crt
export SPANNER_OMNI_USER=admin
export SPANNER_OMNI_PASSWORD=admin

python -m pytest -v -s --disable-warnings tests/system/ \
  -o asyncio_mode=auto \
  -o asyncio_default_test_loop_scope=session \
  -o asyncio_default_fixture_loop_scope=session
```
***

…urce attributes (E) (#18272)

)

Migrating over @gkevinzheng PR from bigtable monorepo
googleapis/python-bigtable#1298

### Original description:

> According to go/rst_stream, `INTERNAL` errors with error messages
related to an `rst_stream` error should be interpreted as `UNAVAILABLE`
errors instead of internal errors. This PR creates a custom retry
predicate to allow retrying of `INTERNAL` errors with rst_stream
specific error messages if the `ServiceUnavailable` exception is allowed
to be retried.


Note to reviewers: This PR has already been reviewed and merged to a
staging branch, with the intention of doing a single merge to main. We
are now planning to slowly rollout these changes back to the main
branch. Minimal re-review should be necessary

---------

Co-authored-by: Kevin Zheng <147537668+gkevinzheng@users.noreply.github.com>
Co-authored-by: gemini-code-assist[bot] <176961590+gemini-code-assist[bot]@users.noreply.github.com>

Migrating over @gkevinzheng PR from bigtable monorepo
googleapis/python-bigtable#1299

### Original description:

> 
> **Changes Made:**
> - Added methods to convert `Row` and `Cell` objects in the data client
to `PartialRowData` and `Cell` objects in the legacy client.
> - Removed legacy client code related to processing `ReadRowResponse`
chunks and testing `ReadRowResponse` chunks.
> - Removed `_update_message_request` from `RowSet` because it's no
longer needed to create a `ReadRowQuery`
> - Rerouted `read_row` and `read_rows` to use their data client
counterparts in `table.py`.
> 

### Additional Changes:

Applied some guards against removed semi-private APIs, after internal
discussion:

-
6941199:
we had a couple technically public, but not meant to be accessed
attributes. This commit replaces them with properties that raise a
warning and return None, rather than completely removing them
-
c9617ac:
Similarily, the PartialRowsData constructor was technically public, but
not intended to be used. This change returns an empty generator when the
previous constructor is used, with a warning
-
b51292e:
handles a bug that could occur if None is passed for retries
-
92da437:
added better typing to generator

Note to reviewers: This PR has already been reviewed and merged to a
staging branch, with the intention of doing a single merge to main. We
are now planning to slowly rollout these changes back to the main
branch. Minimal re-review should be necessary

---------

Co-authored-by: Kevin Zheng <147537668+gkevinzheng@users.noreply.github.com>

Spanner is currently creating a diff in the regeneration check, due to
changes not present in the post-processing script, and missing headers

This PR adds a pre-submit to catch these issues before merge, and fixes
the spanner issue

Fixes #18378

snapshot.py is generated from _async/snapshot.py, but the generated file
had picked up code the async source never had. Running the generator
deleted it. The drift came in via 25aba4f (PR #16488): a branch
authored before the CrossSync migration but merged after it, so it
edited snapshot.py as if that file were still hand-maintained.

Fixes:
- Port the _transaction_begin_event guard and the read()/execute_sql()
docstrings back into _async/snapshot.py, so the generator reproduces
them instead of dropping them.
- Use CrossSync.Lock / CrossSync.Event instead of raw threading, so the
primitives survive the async -> sync conversion.
- De-duplicate the guard: read() and execute_sql() had identical copies,
now one _wait_for_transaction_begin() helper.
- Async fix: read()/execute_sql() raised "Transaction has not begun."
when a concurrent inline begin was in flight. They now wait for it,
matching the sync client.
- generate.py: format with ruff instead of black. The repo uses ruff, so
every run produced a formatting-only diff.
- generate.py: exit non-zero when given a file instead of a directory.
It used to print "Generated 0 artifacts" and do nothing, which is how
the drift went unnoticed.
- Delete snapshot_helpers.py, an orphaned generated file with a stale
copy of execute_sql that nothing imports.
- Add tests for the guard, which had none.
- Speed up 4 tests that each waited out the real 30s begin timeout. They
passed, just slowly; two were already slow on main. They now patch the
timeout constant and assert the specific error message. Unit suite: 204s
-> 57s.

Regenerating now leaves the tree unchanged:
PYTHONPATH=.cross_sync python3 .cross_sync/generate.py \
google/cloud/spanner_v1/_async/ git diff --exit-code
google/cloud/spanner_v1/

…rt (#18384)

This PR introduces a `BSONType` base class and implements one of the 8
types that we need to add to support BSON compatibility for Firestore.

- It establishes a contract for how a BSON class will look like.
- It implements BSONObjectID which is a field in BSON.
- it adds support to write a field of type `BSONTYPE` (in this case
`BSONObjectID` only) which can be registered by the backend. Support for
read is not added intentionally to keep these changes simple. Once we
establish the baseline for all types. adding support for read which will
require decoding will be done separately.



Some more information that explains what the code is doing:
**`BSONType` Interface**: Defines the `to_map_value()` method, which
returns the wire representation (e.g. `{"__oid__": "<hex_string>"}`).
- **Integration**: When writing document fields (`doc_ref.set({"_id":
BSONObjectID(...)})`), `_helpers.encode_value()` intercepts
`isinstance(value, BSONType)` and delegates wire serialization to
`encode_value(value.to_map_value())`. This behaviour is similar to what
we do for existing types.
 
 
 Some design decisions:
1. Using `isinstance(value, BSONType)` in `encode_value()` allows all
future BSON types (`BSONDecimal128`, `BSONRegex`, etc.) to be serialized
without modifying `_helpers.py` again.
2. **Flexible Input & Normalization**: `BSONObjectID` accepts both
24-character hex strings and 12 raw bytes, automatically normalizing hex
strings to lowercase.
3. **Memory Efficiency**: `BSONObjectID` uses `__slots__ = ("_value",)`
for low overhead and implements `__eq__` and `__hash__` so instances can
be used as dictionary keys and set elements.
 
 Fixes: b/562164333

This PR adds write support for BSON `MinKey` and `MaxKey` query range
boundary sentinels in Cloud Firestore Enterprise databases.

- **`BSONMinKey`**: Sentinel representing the lowest possible value in
BSON sort order, serializing to `{"__min__": None}`.
- **`BSONMaxKey`**: Sentinel representing the highest possible value in
BSON sort order, serializing to `{"__max__": None}`.

Fixes b/562164019 🦕

…ndas-gbq` in ua. (#18369)

For internal issue b/540939659 and a follow-up to
#18364

🦕

feat: update API sources and regenerate.

## Debug Info
### System Details
- Python version: Python 3.13.15
- OS: Linux 6.18.14-1rodete4-amd64 x86_64
- Librarian version: v0.42.0

### Commands Executed
- `python3 -m venv "$VENV_DIR" && source "$VENV_DIR/bin/activate"`
- `pip install --upgrade pip`
- `go run github.com/googleapis/librarian/cmd/librarian@v0.42.0 update
sources.googleapis`
- `go run github.com/googleapis/librarian/cmd/librarian@v0.42.0 install`
- `go run github.com/googleapis/librarian/cmd/librarian@v0.42.0 generate
--all`
- `git add .`
- `git commit -m "feat: update API sources and regenerate"`

…services (#18398)

Onboard google/cloud/networkservices/v1beta1 API
(google-cloud-network-services).

Internal tracking bug http://b/561920844

## Debug Info
### System Details
- Python version: Python 3.13.15
- OS: Linux 6.18.14-1rodete4-amd64 x86_64
- Librarian version: v0.42.0

### Commands Executed
- `python3 -m venv venv && source venv/bin/activate`
- `pip install --upgrade pip`
- `go run github.com/googleapis/librarian/cmd/librarian@v0.42.0 install`
- `go run github.com/googleapis/librarian/cmd/librarian@v0.42.0 add
google/cloud/networkservices/v1beta1`
- `go run github.com/googleapis/librarian/cmd/librarian@v0.42.0 generate
-v google-cloud-network-services`
- `go run github.com/googleapis/librarian/cmd/librarian@v0.42.0 tidy`
- `git add .`
- `git commit -m "feat(google/cloud/networkservices/v1beta1): add
google-cloud-network-services"`

This PR adds support for BSONInt32 in the Firestore Python SDK.
`BSONInt32` allows developers to explicitly store 32-bit signed integer
values in Firestore documents according to the official Firestore BSON
specification.

Added `BSONInt32` class: Introduces a container class that holds 32-bit
signed integers between $-2,147,483,648$ and $2,147,483,647$.
Input Validation: Automatically rejects booleans and non-integer types
with a TypeError, and raises a `ValueError` if a number is outside
32-bit signed integer bounds.
Wire Format: Serializes to `{"__int__": value}` for Firestore BSON
document writes.
Package Exports: Exported `BSONInt32` in `google.cloud.firestore` and
`google.cloud.firestore_v1`, and updated post-processing generator rules
to preserve exports during regeneration.
Testing: Added unit tests covering validation, equality, hashing,
copying, and pickling, plus verified sync and async document writes on
Firestore Enterprise DB.

Fixes b/562163919 🦕

This PR resolves the following failure seen in presubmit `regenerate`
added in #18382

```
librarian: library not found: "google-cloud-spanner-dbapi-driver"
```

See
https://github.com/googleapis/google-cloud-python/actions/runs/35147389581/job/104966812092?pr=18342

Previously, the pre-release check was running post-submit, using kokoro.
It would be marked as failed if there were any issues with unreleased
dependencies

We want to avoid any failing tests. Pre-release is meant to be an early
warning system, not a release blocker. Instead, this test will run
nightly, and open issues for any early warnings it finds

When execute_update() or batch_update() starts an inline begin
(transaction_id is None), it acquires self._lock while waiting for the
transaction ID from the server. If that request failed with an error,
the lock was never released.

This was a latent bug in _async/transaction.py that became an active
deadlock when async/sync parity was recently restored in snapshot.py:
reintroducing _wait_for_transaction_begin() meant subsequent queries in
the same transaction now try to acquire self._lock and hang.

Wrap the request execution in try...finally in _async/transaction.py and
regenerate sync transaction.py so self._lock is always released.

Also:
- Add unit tests for failed inline begin in both async and sync clients.
- Add a GitHub Actions workflow to run Spanner mock server tests in CI.
- Include the mockserver session in default local Nox runs.

…#18410)

Add `google/cloud/network_services_v1beta1/gapic_version.py` and snippet
metadata to `packages/google-cloud-network-services` in
`release-please-bulk-config.json` so that release-please bumps v1beta1
version files on release.

Follow-up to #18398.

Empty commit, to trigger release please run on network-services v1beta.
This is needed because release please don't recognize
#18410 relevant to
the package.

🤖 I have created a release *beep* *boop*
---


<details><summary>google-ads-admanager: 0.10.5</summary>

##
[0.10.5](google-ads-admanager-v0.10.4...google-ads-admanager-v0.10.5)
(2026-09-17)


### Features

* update API sources and regenerate
([#18396](#18396))
([e9f8e59](e9f8e59))
* update API sources and regenerate.
([e9f8e59](e9f8e59))
</details>

<details><summary>google-ads-datamanager: 0.9.3</summary>

##
[0.9.3](google-ads-datamanager-v0.9.2...google-ads-datamanager-v0.9.3)
(2026-09-17)


### Features

* update API sources and regenerate
([#18396](#18396))
([e9f8e59](e9f8e59))
* update API sources and regenerate.
([e9f8e59](e9f8e59))
</details>

<details><summary>google-analytics-data: 0.23.1</summary>

##
[0.23.1](google-analytics-data-v0.23.0...google-analytics-data-v0.23.1)
(2026-09-17)


### Features

* update API sources and regenerate
([#18396](#18396))
([e9f8e59](e9f8e59))
* update API sources and regenerate.
([e9f8e59](e9f8e59))
</details>

<details><summary>google-api-core: 2.38.0</summary>

##
[2.38.0](google-api-core-v2.37.0...google-api-core-v2.38.0)
(2026-09-17)


### Features

* **core:** add request hook to enrich T4 network spans with GCP
resource attributes (E)
([#18272](#18272))
([1ca95e9](1ca95e9))
</details>

<details><summary>google-apps-meet: 0.5.1</summary>

##
[0.5.1](google-apps-meet-v0.5.0...google-apps-meet-v0.5.1)
(2026-09-17)


### Features

* update API sources and regenerate
([#18396](#18396))
([e9f8e59](e9f8e59))
* update API sources and regenerate.
([e9f8e59](e9f8e59))
</details>

<details><summary>google-cloud-api-gateway: 1.17.0</summary>

##
[1.17.0](google-cloud-api-gateway-v1.16.0...google-cloud-api-gateway-v1.17.0)
(2026-09-17)


### Features

* update API sources and regenerate
([#18396](#18396))
([e9f8e59](e9f8e59))
* update API sources and regenerate.
([e9f8e59](e9f8e59))
</details>

<details><summary>google-cloud-auditmanager: 0.3.2</summary>

##
[0.3.2](google-cloud-auditmanager-v0.3.1...google-cloud-auditmanager-v0.3.2)
(2026-09-17)


### Features

* update API sources and regenerate
([#18396](#18396))
([e9f8e59](e9f8e59))
* update API sources and regenerate.
([e9f8e59](e9f8e59))
</details>

<details><summary>google-cloud-backupdr: 0.10.2</summary>

##
[0.10.2](google-cloud-backupdr-v0.10.1...google-cloud-backupdr-v0.10.2)
(2026-09-17)


### Features

* **google/cloud/backupdr/v1beta:** add google-cloud-backupdr
([#18399](#18399))
([91b7ae7](91b7ae7))
</details>

<details><summary>google-cloud-bigquery: 3.45.2</summary>

##
[3.45.2](google-cloud-bigquery-v3.45.1...google-cloud-bigquery-v3.45.2)
(2026-09-17)


### Bug Fixes

* disambiguate google-cloud-bigquery `to_dataframe` usage from
`pandas-gbq` in ua.
([#18369](#18369))
([0d7d59c](0d7d59c))
</details>

<details><summary>google-cloud-bigtable: 2.46.0</summary>

##
[2.46.0](google-cloud-bigtable-v2.45.0...google-cloud-bigtable-v2.46.0)
(2026-09-17)


### Features

* **bigtable:** Rerouted RowSet and RowRange to use ReadRows from data
client
([#18196](#18196))
([1857302](1857302))
* Rerouted ReadRows to data client
([#18198](#18198))
([934cd2d](934cd2d))
* update API sources and regenerate
([#18396](#18396))
([e9f8e59](e9f8e59))
* update API sources and regenerate.
([e9f8e59](e9f8e59))


### Bug Fixes

* **bigtable:** Added rst_stream exception handling for ReadRows.
([#18197](#18197))
([f30df60](f30df60))
</details>

<details><summary>google-cloud-compute: 1.54.0</summary>

##
[1.54.0](google-cloud-compute-v1.53.0...google-cloud-compute-v1.54.0)
(2026-09-17)


### Features

* update API sources and regenerate
([#18396](#18396))
([e9f8e59](e9f8e59))
* update API sources and regenerate.
([e9f8e59](e9f8e59))
</details>

<details><summary>google-cloud-compute-v1beta: 0.12.6</summary>

##
[0.12.6](google-cloud-compute-v1beta-v0.12.5...google-cloud-compute-v1beta-v0.12.6)
(2026-09-17)


### Features

* update API sources and regenerate
([#18396](#18396))
([e9f8e59](e9f8e59))
* update API sources and regenerate.
([e9f8e59](e9f8e59))
</details>

<details><summary>google-cloud-devicestreaming: 0.5.1</summary>

##
[0.5.1](google-cloud-devicestreaming-v0.5.0...google-cloud-devicestreaming-v0.5.1)
(2026-09-17)


### Features

* update API sources and regenerate
([#18396](#18396))
([e9f8e59](e9f8e59))
* update API sources and regenerate.
([e9f8e59](e9f8e59))
</details>

<details><summary>google-cloud-discoveryengine: 0.20.4</summary>

##
[0.20.4](google-cloud-discoveryengine-v0.20.3...google-cloud-discoveryengine-v0.20.4)
(2026-09-17)


### Features

* update API sources and regenerate
([#18396](#18396))
([e9f8e59](e9f8e59))
* update API sources and regenerate.
([e9f8e59](e9f8e59))
</details>

<details><summary>google-cloud-firestore: 2.31.0</summary>

##
[2.31.0](google-cloud-firestore-v2.30.0...google-cloud-firestore-v2.31.0)
(2026-09-17)


### Features

* **firestore:** add BSONInt32 support
([#18388](#18388))
([136d4b9](136d4b9))
* **firestore:** add BSONMinKey and BSONMaxKey support
([#18385](#18385))
([9a1fb24](9a1fb24))
</details>

<details><summary>google-cloud-kms: 3.17.0</summary>

##
[3.17.0](google-cloud-kms-v3.16.0...google-cloud-kms-v3.17.0)
(2026-09-17)


### Features

* update API sources and regenerate
([#18396](#18396))
([e9f8e59](e9f8e59))
* update API sources and regenerate.
([e9f8e59](e9f8e59))
</details>

<details><summary>google-cloud-network-services: 0.10.3</summary>

##
[0.10.3](google-cloud-network-services-v0.10.2...google-cloud-network-services-v0.10.3)
(2026-09-17)


### Features

* **google/cloud/networkservices/v1beta1:** add
google-cloud-network-services
([#18398](#18398))
([8df34ce](8df34ce))


### Bug Fixes

* empty commit to bump v1beta version
([#18411](#18411))
([3b3cc6f](3b3cc6f))
</details>

<details><summary>google-cloud-pubsub: 2.41.0</summary>

##
[2.41.0](google-cloud-pubsub-v2.40.0...google-cloud-pubsub-v2.41.0)
(2026-09-17)


### Features

* update API sources and regenerate
([#18396](#18396))
([e9f8e59](e9f8e59))
* update API sources and regenerate.
([e9f8e59](e9f8e59))
</details>

<details><summary>google-cloud-securesourcemanager: 0.6.2</summary>

##
[0.6.2](google-cloud-securesourcemanager-v0.6.1...google-cloud-securesourcemanager-v0.6.2)
(2026-09-17)


### Features

* update API sources and regenerate
([#18396](#18396))
([e9f8e59](e9f8e59))
* update API sources and regenerate.
([e9f8e59](e9f8e59))
</details>

<details><summary>google-maps-solar: 0.6.1</summary>

##
[0.6.1](google-maps-solar-v0.6.0...google-maps-solar-v0.6.1)
(2026-09-17)


### Features

* update API sources and regenerate
([#18396](#18396))
([e9f8e59](e9f8e59))
* update API sources and regenerate.
([e9f8e59](e9f8e59))
</details>

---
This PR was generated with [Release
Please](https://github.com/googleapis/release-please). See
[documentation](https://github.com/googleapis/release-please#release-please).

---------

Co-authored-by: release-please[bot] <55107282+release-please[bot]@users.noreply.github.com>