[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"skill:01M69907JRH699J82773R7BSZJ":3,"skill-same:01M69907JRH699J82773R7BSZJ":102},{"skillNo":4,"name":5,"nameZh":6,"description":7,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":16,"categories":17,"keywords":28,"publishedAt":49,"linkOnly":50,"markdownContent":51,"markdownBody":52,"frontMatter":53,"refName":57,"commitSha":58,"skillDirectory":59,"forksCount":60,"repositoryHtmlUrl":61,"repositoryHomepageUrl":6,"ownerHtmlUrl":62,"ownerBlogUrl":63,"ownerDescription":64,"updatedAt":65,"install":66,"resources":79},"01M69907JRH699J82773R7BSZJ","bigquery-udfs",null,"Creates, deploys, and troubleshoots BigQuery User-Defined Functions (UDFs) and Remote Functions across SQL, JavaScript, Python, and Cloud Run endpoints. Use when writing custom scalar or aggregate functions in BigQuery, installing PyPI packages or Cloud Storage libraries in a Python or JavaScript UDF, or calling Google Cloud and external APIs from a Python UDF (WITH CONNECTION) or Remote Function. Don't use for standard BigQuery table\u002Fdataset CRUD (use bigquery-basics), DataFrames client workflows (use bigquery-bigframes), or BigQuery ML models (use bigquery-ai-ml).","google\u002Fskills","google","https:\u002F\u002Favatars.githubusercontent.com\u002Fu\u002F1342004?v=4","01M698VYEFDM0VJBZDYYJ2T83S","Google","01M698WR0H76ENHE587T9EJT89",24122,"Apache-2.0","https:\u002F\u002Fgithub.com\u002Fgoogle\u002Fskills\u002Fblob\u002Fmain\u002Fskills\u002Fcloud\u002Fbigquery-udfs\u002FSKILL.md",[18,23],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000010","后端与接口","SCENARIO","使用场景",{"categoryNo":24,"categoryName":25,"taxonomyType":26,"taxonomyTypeDesc":27},"01JBSEEDCAT000000000000033","数据分析师","PROFESSION","适用职业",[29,30,31,32,33,34,35,36,37,38,39,40,41,42,43,44,45,46,47,48,9],"bigquery","bigquery udfs","when","cloud run","table","storage","sql","run","packages","libraries","across","crud","dataset","workflows","remote","dataframes","Cloud Storage","python","google cloud","writing","2026-11-10 10:12:30",false,"---\nname: bigquery-udfs\nmetadata:\n  version: \"1.0.2\"\n  category: BigDataAndAnalytics\ndescription: >-\n  Creates, deploys, and troubleshoots BigQuery User-Defined Functions (UDFs)\n  and Remote Functions across SQL, JavaScript, Python, and Cloud Run endpoints.\n  Use when writing custom scalar or aggregate functions in BigQuery, installing\n  PyPI packages or Cloud Storage libraries in a Python or JavaScript UDF, or\n  calling Google Cloud and external APIs from a Python UDF (WITH CONNECTION) or\n  Remote Function. Don't use for standard BigQuery table\u002Fdataset CRUD (use\n  bigquery-basics), DataFrames client workflows (use bigquery-bigframes), or\n  BigQuery ML models (use bigquery-ai-ml).\n---\n\n# BigQuery User-Defined Functions (UDFs)\n\nBigQuery User-Defined Functions (UDFs) extend GoogleSQL with custom logic\nwritten in SQL, JavaScript, managed Python (`python-3.11`), or hosted externally\nas Remote Functions on Cloud Run and Cloud Run functions.\n\n## Usage Attribution\n\n**MUST READ**: Before executing any `gcloud`, REST API, or MCP command, you\nMUST read and follow the instructions in\n[Usage Attribution](references\u002Fattribution.md).\n\n## Choosing the Right UDF Type\n\nAlways select the lightest-weight runtime that satisfies the requirement,\nbecause BigQuery optimizes native SQL expressions inline while external runtimes\nincur serialization and container startup overhead:\n\nUDF Type                                       | Connection Required?       | When to Use                                                                                                                                                                     | Key Constraints\n:--------------------------------------------- | :------------------------- | :------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ | :--------------\n**SQL UDF** (Default)                          | No                         | Composable expressions, regex, struct\u002Farray manipulation, aggregate functions (`CREATE AGGREGATE FUNCTION`), or polymorphic `ANY TYPE` parameters.                              | Lowest latency; zero external dependencies; supports `TEMP` or persistent functions.\n**JavaScript UDF**                             | No                         | Custom string\u002FJSON logic or bundling `.js` libraries from Cloud Storage (`gs:\u002F\u002F`).                                                                                              | Runs in V8 sandbox; `INT64` unsupported as input (pass as `FLOAT64` or `STRING`). Max 32 KB inline code, 1 MB per external resource. Supports `TEMP` or persistent functions.\n**Managed Python UDF (Offline)**               | **No**                     | Pure compute using Python 3.11, PyPI wheels (`packages=[...]`), Cloud Storage `.py` modules (`library=[...]`), or vectorized Pandas\u002FPyArrow batches.                            | Persistent functions only (`CREATE TEMP FUNCTION` unsupported). Outbound network blocked. Max container size: 4 vCPU \u002F 16 GiB. `JSON`, `RANGE`, `INTERVAL`, `GEOGRAPHY` unsupported.\n**Managed Python UDF (`WITH CONNECTION`)**     | **Yes** (`CLOUD_RESOURCE`) | Invoking Google Cloud APIs (e.g., Cloud Translation, Gemini Enterprise Agent Platform) or online HTTP endpoints directly from Python inside BigQuery containers.                | Requires `WITH CONNECTION`. Outbound traffic restricted to `restricted.googleapis.com` in VPC-SC perimeters (VPC networks unsupported). Max container size: 4 vCPU \u002F 16 GiB.\n**Remote Function (`REMOTE WITH CONNECTION`)** | **Yes** (`CLOUD_RESOURCE`) | Calling external APIs or microservices when you need non-Python runtimes (Go, Java, Node.js), private VPC network access, GPUs, or custom Cloud Run scaling.                    | Requires Cloud Run HTTPS endpoint implementing BigQuery JSON batch contract and `roles\u002Frun.invoker`. Max input 5 MB per row; response limit 15 MB (Cloud Run) \u002F 10 MB (1st gen).\n\n## Prerequisites & Setup\n\nEnsure the Google Cloud project has an active billing account attached (see\n[BigQuery Pricing](https:\u002F\u002Fdocs.cloud.google.com\u002Fbigquery\u002Fpricing)):\n\n1.  **Install and Authenticate Google Cloud SDK**: Install the\n    [Google Cloud SDK](https:\u002F\u002Fdocs.cloud.google.com\u002Fsdk\u002Fdocs\u002Finstall)\n    and authenticate:\n\n    ```bash\n    gcloud auth login\n    ```\n\n    Pass `--project={project_id}` and `--region={region}` (or `--location` for\n    `bq`) explicitly on each command instead of running `gcloud config set`,\n    which persists beyond the task. Default to `us-central1` when the user has\n    not specified a region (see\n    [BigQuery Locations](https:\u002F\u002Fdocs.cloud.google.com\u002Fbigquery\u002Fdocs\u002Flocations.md.txt)).\n\n2.  **Enable Required APIs**:\n\n    -   For SQL, JavaScript, and offline Python UDFs: `bigquery.googleapis.com`\n    -   Additionally for Python UDFs calling APIs (`WITH CONNECTION`) and Remote\n        Functions: `bigqueryconnection.googleapis.com` (and `run.googleapis.com`\n        for Remote Functions)\n\n    ```bash\n    CLOUDSDK_METRICS_REQUEST_ATTRIBUTION=\"agent-skills\u002F1.0 (skill:bigquery-udfs)\" \\\n    gcloud services enable bigquery.googleapis.com \\\n      bigqueryconnection.googleapis.com \\\n      run.googleapis.com --quiet\n    ```\n\n3.  **Verify Required IAM Roles**:\n\n    -   **All UDFs**: `roles\u002Fbigquery.dataEditor` on the dataset and\n        `roles\u002Fbigquery.jobUser` on the project.\n    -   **When using `WITH CONNECTION` (API-calling Python UDFs & Remote\n        Functions)**:\n        -   UDF Creator: `roles\u002Fbigquery.connectionAdmin` on the project (plus\n            `resourcemanager.projects.setIamPolicy`, e.g.,\n            `roles\u002Fresourcemanager.projectIamAdmin`, when granting project-level\n            IAM roles to the connection service account via `GRANT ... ON\n            PROJECT`).\n        -   UDF Caller: `roles\u002Fbigquery.connectionUser` on the connection.\n\n--------------------------------------------------------------------------------\n\n## Core Implementation Patterns\n\n### 1. SQL UDFs (Scalar & Templated)\n\nUse `CREATE OR REPLACE FUNCTION` for persistent UDFs or `CREATE TEMP FUNCTION`\nfor query-scoped functions. Use `ANY TYPE` for polymorphic parameters:\n\n```sql\nCREATE OR REPLACE FUNCTION `{project_id}.{dataset_id}.normalize_phone`(\n  raw_phone STRING,\n  country_code ANY TYPE\n)\nRETURNS STRING\nAS (\n  CONCAT('+', CAST(country_code AS STRING), '-', REGEXP_REPLACE(raw_phone, r'[^0-9]', ''))\n);\n```\n\nSee [SQL and JavaScript UDFs](references\u002Fsql-and-js-udfs.md) for aggregate UDFs\n(`CREATE AGGREGATE FUNCTION`) and JavaScript Cloud Storage library loading.\n\n### 2. JavaScript UDFs\n\nUse raw triple-quoted strings (`r\"\"\"...\"\"\"`) to avoid escaping backslashes:\n\n```sql\nCREATE OR REPLACE FUNCTION `{project_id}.{dataset_id}.extract_url_query_keys`(\n  url_str STRING\n)\nRETURNS ARRAY\u003CSTRING>\nDETERMINISTIC\nLANGUAGE js\nOPTIONS (\n  library = ['gs:\u002F\u002F{bucket_name}\u002Flibs\u002Furi-parser.js']\n)\nAS r\"\"\"\n  if (!url_str) return [];\n  try {\n    return URIParser.getQueryKeys(url_str);\n  } catch (err) {\n    return [];\n  }\n\"\"\";\n```\n\n### 3. Managed Python UDFs (With and Without Connection)\n\nPython UDFs must be persistent (do not use `TEMP`), specify `runtime_version =\n'python-3.11'`, and define an `entry_point`. `numpy`, `pandas`, and `pyarrow`\nare pre-installed in the `python-3.11` base image.\n\nBigQuery defaults to `container_memory = '512Mi'`, `container_cpu = 1.0`, and\n`container_request_concurrency = 80`. Omit these options when the defaults are\nsufficient, and configure them explicitly only when a workload requires custom\ncontainer sizing or concurrency (see [Python UDFs](references\u002Fpython-udfs.md)).\n\nTop-level Python statements (`import`, helper functions, classes, and `def\n{entry_point}(...)`) inside `AS r'''...'''` must have **zero leading\nindentation** (flush to the left margin). Indenting top-level Python definitions\nto align with surrounding SQL causes an `IndentationError` when BigQuery loads\nthe container module.\n\n#### A. Offline \u002F Vectorized Python UDF (No Connection Needed)\n\nOmit `WITH CONNECTION` when the UDF only performs computation or uses PyPI\npackages (`packages=[...]`) \u002F Cloud Storage libraries (`library=['gs:\u002F\u002F...']`).\nTo vectorize execution over batches of rows, annotate the parameter with\n`pd.DataFrame` (or `pyarrow.RecordBatch`) and return a `pd.Series`:\n\n> [!WARNING] **Vectorized operations must be row-independent**: BigQuery calls\n> vectorized UDFs on arbitrary row batches (up to `max_batching_rows`). Do NOT\n> compute global column statistics (such as z-scores, dataset mean\u002Fstd, or rank)\n> across `df`, because each batch only sees an arbitrary slice of rows. Use SQL\n> window functions (`(val - AVG(val) OVER()) \u002F NULLIF(STDDEV(val) OVER(), 0)`)\n> for dataset-wide statistics. Vectorized Python UDFs should perform\n> row-independent calculations (e.g. geometric distances or multi-column math).\n\n```sql\nCREATE OR REPLACE FUNCTION `{project_id}.{dataset_id}.vectorized_distance`(\n  x1 FLOAT64, y1 FLOAT64, x2 FLOAT64, y2 FLOAT64\n)\nRETURNS FLOAT64\nLANGUAGE python\nOPTIONS (\n  runtime_version = 'python-3.11',\n  entry_point = 'compute_distance'\n)\nAS r'''\nimport numpy as np\nimport pandas as pd\n\ndef compute_distance(df: pd.DataFrame) -> pd.Series:\n    return pd.Series(\n        np.hypot(df['x2'] - df['x1'], df['y2'] - df['y1']),\n        index=df.index,\n    )\n''';\n```\n\n#### B. Online Python UDF Calling an External \u002F Cloud API (`WITH CONNECTION`)\n\nInclude `WITH CONNECTION` **only** when the Python code makes outbound network\nor API calls at runtime.\n\nAlways configure explicit timeouts, logging, and prescriptive exception handling\nin the `try...except` block:\n\n-   **Transient errors only → `NULL`**: Catch retryable exceptions\n    (`google.api_core.exceptions.TooManyRequests`, `ServiceUnavailable`,\n    `DeadlineExceeded`, `InternalServerError`, and `RetryError`), log them with\n    `logging.warning`, and return `None` so a transient blip does not abort the\n    query. Do **not** catch the base class `GoogleAPICallError` here: it also\n    matches `PermissionDenied`, `Unauthenticated`, and `InvalidArgument`.\n-   **Fatal errors → raise**: Let auth, permission, and invalid-argument errors\n    propagate (or log and re-raise as `RuntimeError`) so they surface as a user\n    error on the query instead of silently producing `NULL`s.\n-   **Never log row values**: Anyone with Cloud Logging access can read UDF logs\n    regardless of BigQuery table permissions. Log exception types and messages,\n    not input or output data. Logs are only emitted when the session sets `SET\n    @@udf.properties = JSON '{\"enableDebugOutput\": true}';`.\n-   **Set a per-request `timeout`**: `Retry(timeout=...)` only caps the total\n    retry duration; also pass `timeout=` on each client call.\n\n1.  **Create a Cloud Resource Connection and Retrieve its Service Account**:\n\n    ```bash\n    bq mk --connection --connection_type=CLOUD_RESOURCE \\\n      --location={region} --project_id={project_id} {connection_id}\n\n    bq show --connection {project_id}.{region}.{connection_id}\n    ```\n2.  **Grant Permissions to the Connection Service Account**: Grant\n    `roles\u002Fserviceusage.serviceUsageConsumer` on `{project_id}` plus the\n    required API role (e.g., `roles\u002Fcloudtranslate.user`) on the target project.\n    Running `GRANT ... ON PROJECT` modifies the project's IAM policy and\n    requires `resourcemanager.projects.setIamPolicy` (for example,\n    `roles\u002Fresourcemanager.projectIamAdmin`); **confirm with the user before\n    running project-level IAM grants**. The DCL `connection:` grantee takes the\n    connection path (`[project_id.]location.connection_id`), not the service\n    account email; BigQuery resolves the connection's service account\n    automatically (use `\"serviceAccount:{connection_sa_email}\"` to grant by\n    email instead):\n\n    ```sql\n    GRANT `roles\u002Fserviceusage.serviceUsageConsumer`\n    ON PROJECT `{project_id}`\n    TO \"connection:{project_id}.{region}.{connection_id}\";\n\n    GRANT `roles\u002Fcloudtranslate.user`\n    ON PROJECT `{project_id}`\n    TO \"connection:{project_id}.{region}.{connection_id}\";\n    ```\n3.  **Create the Python UDF with `WITH CONNECTION`** (keep top-level Python\n    statements flush-left at column 0):\n\n```sql\nCREATE OR REPLACE FUNCTION `{project_id}.{dataset_id}.translate_to_es`(\n  text STRING\n)\nRETURNS STRING\nLANGUAGE python\nWITH CONNECTION `{project_id}.{region}.{connection_id}`\nOPTIONS (\n  entry_point = 'do_translate',\n  runtime_version = 'python-3.11',\n  packages = ['google-cloud-translate>=3.11', 'google-api-core']\n)\nAS r'''\nimport logging\nfrom google.api_core import exceptions\nfrom google.api_core.retry import Retry\nfrom google.cloud import translate\n\nclient = translate.TranslationServiceClient()\n\nTRANSIENT_ERRORS = (\n    exceptions.TooManyRequests,\n    exceptions.ServiceUnavailable,\n    exceptions.DeadlineExceeded,\n    exceptions.InternalServerError,\n    exceptions.RetryError,\n)\n\ndef do_translate(text: str) -> str:\n    if not text:\n        return None\n    try:\n        # Note: Replace {project_id} with your Google Cloud Project ID\n        response = client.translate_text(\n            request={\n                \"parent\": \"projects\u002F{project_id}\u002Flocations\u002Fus-central1\",\n                \"contents\": [text],\n                \"target_language_code\": \"es\",\n                \"mime_type\": \"text\u002Fplain\",\n            },\n            retry=Retry(timeout=30.0),  # Total retry budget.\n            timeout=10.0,  # Per-attempt deadline.\n        )\n        return response.translations[0].translated_text\n    except TRANSIENT_ERRORS as e:\n        # Log the error type only; never log row values.\n        logging.warning(\"Transient Translation API error: %s\", type(e).__name__)\n        return None\n    except exceptions.GoogleAPICallError as e:\n        # PermissionDenied, Unauthenticated, InvalidArgument, etc. are fatal.\n        logging.error(\"Fatal Translation API error: %s: %s\", type(e).__name__, e)\n        raise RuntimeError(f\"Translation failed: {type(e).__name__}\") from e\n''';\n```\n\nSee [Python UDFs](references\u002Fpython-udfs.md) for container sizing\n(`container_cpu`, `container_memory`, `container_request_concurrency`), Cloud\nLogging (`SET @@udf.properties = JSON '{\"enableDebugOutput\": true}';`), and\nchecking container build status via `INFORMATION_SCHEMA.ROUTINES`.\n\n### 4. Remote Functions (Cloud Run Endpoints)\n\nUse Remote Functions when the endpoint is hosted on Cloud Run or Cloud Run\nfunctions (for non-Python languages, VPC networking, or custom hardware):\n\n1.  **Grant `roles\u002Frun.invoker` to the Connection Service Account** (confirm\n    with the user before modifying the Cloud Run service IAM policy):\n\n    ```bash\n    CLOUDSDK_METRICS_REQUEST_ATTRIBUTION=\"agent-skills\u002F1.0 (skill:bigquery-udfs)\" \\\n    gcloud run services add-iam-policy-binding {cloud_run_service} \\\n      --region={region} \\\n      --member=\"serviceAccount:{connection_sa_email}\" \\\n      --role=\"roles\u002Frun.invoker\"\n    ```\n2.  **Register the Remote Function**: The endpoint must accept `{\"calls\":\n    [[arg1, ...], ...]}` and return `{\"replies\": [res1, ...]}` with matching\n    element count:\n\n    ```sql\n    CREATE OR REPLACE FUNCTION `{project_id}.{dataset_id}.enrich_address`(\n      street STRING, postal_code STRING\n    )\n    RETURNS JSON\n    REMOTE WITH CONNECTION `{project_id}.{region}.{connection_id}`\n    OPTIONS (\n      endpoint = 'https:\u002F\u002F{cloud_run_service_url}',\n      max_batching_rows = 1000\n    );\n    ```\n\nSee [Remote Functions](references\u002Fremote-functions.md) for Cloud Run handler\ntemplates, batch limits (`max_batching_rows`, 5 MB max input per row, 15 MB max\nresponse on Cloud Run \u002F 10 MB on 1st gen functions), and error\u002Fretry semantics\n(BigQuery automatically retries a batch only on HTTP `408`, `429`, `500`, `503`,\nor `504`; any other non-200 status or JSON `{\"errorMessage\": \"...\"}` fails the\nquery without retrying).\n\n--------------------------------------------------------------------------------\n\n## Validation Checklist\n\nAfter generating or modifying a UDF, follow this validate→fix→repeat loop:\n\n-   [ ] **Step 1 — Validate Python code before BigQuery DDL**: For Python UDFs,\n    validate the Python function and `packages` dependencies *before* submitting\n    the BigQuery DDL—either locally with `python3` test inputs (`None`, edge\n    cases, `pd.DataFrame` batches) or in a containerized Cloud Run Job (`gcloud\n    run jobs deploy {job_name} --source . --region={region}` and `gcloud run\n    jobs execute {job_name} --region={region} --wait`; see\n    [Python UDFs Validation](references\u002Fpython-udfs.md#validation-workflow)).\n-   [ ] **Step 2 — Execute DDL and poll container build status**: Run `CREATE OR\n    REPLACE FUNCTION`. Because the DDL statement returns *before* the Python\n    container image finishes building, poll `INFORMATION_SCHEMA.ROUTINES` until\n    `build_state` transitions from `IN_PROGRESS` to `SUCCEEDED` (or fix and\n    re-run if `FAILED`):\n\n    ```sql\n    SELECT build_status.*\n    FROM `{project_id}.{dataset_id}`.INFORMATION_SCHEMA.ROUTINES\n    WHERE routine_name = '{udf_name}';\n    ```\n-   [ ] **Step 3 — Test the UDF with SQL `SELECT`**: Once `build_state =\n    'SUCCEEDED'` (or immediately after DDL for SQL\u002FJS UDFs), run a test `SELECT`\n    query covering `NULL` and valid inputs.\n\n## Cleanup & Teardown\n\nDelete unused routines, connections, Cloud Run services, and staged Cloud\nStorage artifacts (note that the size of all Python UDF containers per project\nand per region is restricted to a sum total of 10 GiB):\n\n```bash\nbq query --use_legacy_sql=false \"DROP FUNCTION IF EXISTS \\`{project_id}.{dataset_id}.{udf_name}\\`;\"\nbq rm --connection --location={region} {connection_id}\nCLOUDSDK_METRICS_REQUEST_ATTRIBUTION=\"agent-skills\u002F1.0 (skill:bigquery-udfs)\" \\\ngcloud run services delete {cloud_run_service} --region={region} --project={project_id}\nCLOUDSDK_METRICS_REQUEST_ATTRIBUTION=\"agent-skills\u002F1.0 (skill:bigquery-udfs)\" \\\ngcloud storage rm gs:\u002F\u002F{bucket_name}\u002Fudf_libs\u002Fbundle.js\n```\n\n## Reference Directory\n\n-   [SQL and JavaScript UDFs](references\u002Fsql-and-js-udfs.md): Templated SQL\n    parameters (`ANY TYPE`), aggregate UDFs, JavaScript type mappings, and Cloud\n    Storage library loading\n    (`https:\u002F\u002Fdocs.cloud.google.com\u002Fbigquery\u002Fdocs\u002Fuser-defined-functions.md.txt`).\n-   [Python UDFs](references\u002Fpython-udfs.md): Offline vs. `WITH CONNECTION`\n    online service access, Pandas\u002FPyArrow vectorization, container resource\n    limits (`container_cpu`\u002F`container_memory`), and Cloud Logging debugging\n    (`https:\u002F\u002Fdocs.cloud.google.com\u002Fbigquery\u002Fdocs\u002Fuser-defined-functions-python.md.txt`).\n-   [Remote Functions](references\u002Fremote-functions.md): Cloud Run HTTP request\n    and response JSON schema, batch sizing, retry semantics, and VPC egress\n    (`https:\u002F\u002Fdocs.cloud.google.com\u002Fbigquery\u002Fdocs\u002Fremote-functions.md.txt`).\n-   [IAM, Authorized Routines, and Quotas](references\u002Fiam-and-quotas.md):\n    Sharing routines across datasets (`Authorized Routines`), container quotas,\n    and troubleshooting errors.\n\n## Related Skills\n\n-   **BigQuery Basics** (`bigquery-basics`): Dataset, table, and job management.\n-   The `bigquery-bigframes` skill: Creating Python UDFs from Python via\n    `@bpd.udf`.\n-   The `bigquery-ai-ml` skill: Built-in `AI.GENERATE_TEXT` and\n    `AI.GENERATE` functions.\n","# BigQuery User-Defined Functions (UDFs)\n\nBigQuery User-Defined Functions (UDFs) extend GoogleSQL with custom logic\nwritten in SQL, JavaScript, managed Python (`python-3.11`), or hosted externally\nas Remote Functions on Cloud Run and Cloud Run functions.\n\n## Usage Attribution\n\n**MUST READ**: Before executing any `gcloud`, REST API, or MCP command, you\nMUST read and follow the instructions in\n[Usage Attribution](references\u002Fattribution.md).\n\n## Choosing the Right UDF Type\n\nAlways select the lightest-weight runtime that satisfies the requirement,\nbecause BigQuery optimizes native SQL expressions inline while external runtimes\nincur serialization and container startup overhead:\n\nUDF Type                                       | Connection Required?       | When to Use                                                                                                                                                                     | Key Constraints\n:--------------------------------------------- | :------------------------- | :------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ | :--------------\n**SQL UDF** (Default)                          | No                         | Composable expressions, regex, struct\u002Farray manipulation, aggregate functions (`CREATE AGGREGATE FUNCTION`), or polymorphic `ANY TYPE` parameters.                              | Lowest latency; zero external dependencies; supports `TEMP` or persistent functions.\n**JavaScript UDF**                             | No                         | Custom string\u002FJSON logic or bundling `.js` libraries from Cloud Storage (`gs:\u002F\u002F`).                                                                                              | Runs in V8 sandbox; `INT64` unsupported as input (pass as `FLOAT64` or `STRING`). Max 32 KB inline code, 1 MB per external resource. Supports `TEMP` or persistent functions.\n**Managed Python UDF (Offline)**               | **No**                     | Pure compute using Python 3.11, PyPI wheels (`packages=[...]`), Cloud Storage `.py` modules (`library=[...]`), or vectorized Pandas\u002FPyArrow batches.                            | Persistent functions only (`CREATE TEMP FUNCTION` unsupported). Outbound network blocked. Max container size: 4 vCPU \u002F 16 GiB. `JSON`, `RANGE`, `INTERVAL`, `GEOGRAPHY` unsupported.\n**Managed Python UDF (`WITH CONNECTION`)**     | **Yes** (`CLOUD_RESOURCE`) | Invoking Google Cloud APIs (e.g., Cloud Translation, Gemini Enterprise Agent Platform) or online HTTP endpoints directly from Python inside BigQuery containers.                | Requires `WITH CONNECTION`. Outbound traffic restricted to `restricted.googleapis.com` in VPC-SC perimeters (VPC networks unsupported). Max container size: 4 vCPU \u002F 16 GiB.\n**Remote Function (`REMOTE WITH CONNECTION`)** | **Yes** (`CLOUD_RESOURCE`) | Calling external APIs or microservices when you need non-Python runtimes (Go, Java, Node.js), private VPC network access, GPUs, or custom Cloud Run scaling.                    | Requires Cloud Run HTTPS endpoint implementing BigQuery JSON batch contract and `roles\u002Frun.invoker`. Max input 5 MB per row; response limit 15 MB (Cloud Run) \u002F 10 MB (1st gen).\n\n## Prerequisites & Setup\n\nEnsure the Google Cloud project has an active billing account attached (see\n[BigQuery Pricing](https:\u002F\u002Fdocs.cloud.google.com\u002Fbigquery\u002Fpricing)):\n\n1.  **Install and Authenticate Google Cloud SDK**: Install the\n    [Google Cloud SDK](https:\u002F\u002Fdocs.cloud.google.com\u002Fsdk\u002Fdocs\u002Finstall)\n    and authenticate:\n\n    ```bash\n    gcloud auth login\n    ```\n\n    Pass `--project={project_id}` and `--region={region}` (or `--location` for\n    `bq`) explicitly on each command instead of running `gcloud config set`,\n    which persists beyond the task. Default to `us-central1` when the user has\n    not specified a region (see\n    [BigQuery Locations](https:\u002F\u002Fdocs.cloud.google.com\u002Fbigquery\u002Fdocs\u002Flocations.md.txt)).\n\n2.  **Enable Required APIs**:\n\n    -   For SQL, JavaScript, and offline Python UDFs: `bigquery.googleapis.com`\n    -   Additionally for Python UDFs calling APIs (`WITH CONNECTION`) and Remote\n        Functions: `bigqueryconnection.googleapis.com` (and `run.googleapis.com`\n        for Remote Functions)\n\n    ```bash\n    CLOUDSDK_METRICS_REQUEST_ATTRIBUTION=\"agent-skills\u002F1.0 (skill:bigquery-udfs)\" \\\n    gcloud services enable bigquery.googleapis.com \\\n      bigqueryconnection.googleapis.com \\\n      run.googleapis.com --quiet\n    ```\n\n3.  **Verify Required IAM Roles**:\n\n    -   **All UDFs**: `roles\u002Fbigquery.dataEditor` on the dataset and\n        `roles\u002Fbigquery.jobUser` on the project.\n    -   **When using `WITH CONNECTION` (API-calling Python UDFs & Remote\n        Functions)**:\n        -   UDF Creator: `roles\u002Fbigquery.connectionAdmin` on the project (plus\n            `resourcemanager.projects.setIamPolicy`, e.g.,\n            `roles\u002Fresourcemanager.projectIamAdmin`, when granting project-level\n            IAM roles to the connection service account via `GRANT ... ON\n            PROJECT`).\n        -   UDF Caller: `roles\u002Fbigquery.connectionUser` on the connection.\n\n--------------------------------------------------------------------------------\n\n## Core Implementation Patterns\n\n### 1. SQL UDFs (Scalar & Templated)\n\nUse `CREATE OR REPLACE FUNCTION` for persistent UDFs or `CREATE TEMP FUNCTION`\nfor query-scoped functions. Use `ANY TYPE` for polymorphic parameters:\n\n```sql\nCREATE OR REPLACE FUNCTION `{project_id}.{dataset_id}.normalize_phone`(\n  raw_phone STRING,\n  country_code ANY TYPE\n)\nRETURNS STRING\nAS (\n  CONCAT('+', CAST(country_code AS STRING), '-', REGEXP_REPLACE(raw_phone, r'[^0-9]', ''))\n);\n```\n\nSee [SQL and JavaScript UDFs](references\u002Fsql-and-js-udfs.md) for aggregate UDFs\n(`CREATE AGGREGATE FUNCTION`) and JavaScript Cloud Storage library loading.\n\n### 2. JavaScript UDFs\n\nUse raw triple-quoted strings (`r\"\"\"...\"\"\"`) to avoid escaping backslashes:\n\n```sql\nCREATE OR REPLACE FUNCTION `{project_id}.{dataset_id}.extract_url_query_keys`(\n  url_str STRING\n)\nRETURNS ARRAY\u003CSTRING>\nDETERMINISTIC\nLANGUAGE js\nOPTIONS (\n  library = ['gs:\u002F\u002F{bucket_name}\u002Flibs\u002Furi-parser.js']\n)\nAS r\"\"\"\n  if (!url_str) return [];\n  try {\n    return URIParser.getQueryKeys(url_str);\n  } catch (err) {\n    return [];\n  }\n\"\"\";\n```\n\n### 3. Managed Python UDFs (With and Without Connection)\n\nPython UDFs must be persistent (do not use `TEMP`), specify `runtime_version =\n'python-3.11'`, and define an `entry_point`. `numpy`, `pandas`, and `pyarrow`\nare pre-installed in the `python-3.11` base image.\n\nBigQuery defaults to `container_memory = '512Mi'`, `container_cpu = 1.0`, and\n`container_request_concurrency = 80`. Omit these options when the defaults are\nsufficient, and configure them explicitly only when a workload requires custom\ncontainer sizing or concurrency (see [Python UDFs](references\u002Fpython-udfs.md)).\n\nTop-level Python statements (`import`, helper functions, classes, and `def\n{entry_point}(...)`) inside `AS r'''...'''` must have **zero leading\nindentation** (flush to the left margin). Indenting top-level Python definitions\nto align with surrounding SQL causes an `IndentationError` when BigQuery loads\nthe container module.\n\n#### A. Offline \u002F Vectorized Python UDF (No Connection Needed)\n\nOmit `WITH CONNECTION` when the UDF only performs computation or uses PyPI\npackages (`packages=[...]`) \u002F Cloud Storage libraries (`library=['gs:\u002F\u002F...']`).\nTo vectorize execution over batches of rows, annotate the parameter with\n`pd.DataFrame` (or `pyarrow.RecordBatch`) and return a `pd.Series`:\n\n> [!WARNING] **Vectorized operations must be row-independent**: BigQuery calls\n> vectorized UDFs on arbitrary row batches (up to `max_batching_rows`). Do NOT\n> compute global column statistics (such as z-scores, dataset mean\u002Fstd, or rank)\n> across `df`, because each batch only sees an arbitrary slice of rows. Use SQL\n> window functions (`(val - AVG(val) OVER()) \u002F NULLIF(STDDEV(val) OVER(), 0)`)\n> for dataset-wide statistics. Vectorized Python UDFs should perform\n> row-independent calculations (e.g. geometric distances or multi-column math).\n\n```sql\nCREATE OR REPLACE FUNCTION `{project_id}.{dataset_id}.vectorized_distance`(\n  x1 FLOAT64, y1 FLOAT64, x2 FLOAT64, y2 FLOAT64\n)\nRETURNS FLOAT64\nLANGUAGE python\nOPTIONS (\n  runtime_version = 'python-3.11',\n  entry_point = 'compute_distance'\n)\nAS r'''\nimport numpy as np\nimport pandas as pd\n\ndef compute_distance(df: pd.DataFrame) -> pd.Series:\n    return pd.Series(\n        np.hypot(df['x2'] - df['x1'], df['y2'] - df['y1']),\n        index=df.index,\n    )\n''';\n```\n\n#### B. Online Python UDF Calling an External \u002F Cloud API (`WITH CONNECTION`)\n\nInclude `WITH CONNECTION` **only** when the Python code makes outbound network\nor API calls at runtime.\n\nAlways configure explicit timeouts, logging, and prescriptive exception handling\nin the `try...except` block:\n\n-   **Transient errors only → `NULL`**: Catch retryable exceptions\n    (`google.api_core.exceptions.TooManyRequests`, `ServiceUnavailable`,\n    `DeadlineExceeded`, `InternalServerError`, and `RetryError`), log them with\n    `logging.warning`, and return `None` so a transient blip does not abort the\n    query. Do **not** catch the base class `GoogleAPICallError` here: it also\n    matches `PermissionDenied`, `Unauthenticated`, and `InvalidArgument`.\n-   **Fatal errors → raise**: Let auth, permission, and invalid-argument errors\n    propagate (or log and re-raise as `RuntimeError`) so they surface as a user\n    error on the query instead of silently producing `NULL`s.\n-   **Never log row values**: Anyone with Cloud Logging access can read UDF logs\n    regardless of BigQuery table permissions. Log exception types and messages,\n    not input or output data. Logs are only emitted when the session sets `SET\n    @@udf.properties = JSON '{\"enableDebugOutput\": true}';`.\n-   **Set a per-request `timeout`**: `Retry(timeout=...)` only caps the total\n    retry duration; also pass `timeout=` on each client call.\n\n1.  **Create a Cloud Resource Connection and Retrieve its Service Account**:\n\n    ```bash\n    bq mk --connection --connection_type=CLOUD_RESOURCE \\\n      --location={region} --project_id={project_id} {connection_id}\n\n    bq show --connection {project_id}.{region}.{connection_id}\n    ```\n2.  **Grant Permissions to the Connection Service Account**: Grant\n    `roles\u002Fserviceusage.serviceUsageConsumer` on `{project_id}` plus the\n    required API role (e.g., `roles\u002Fcloudtranslate.user`) on the target project.\n    Running `GRANT ... ON PROJECT` modifies the project's IAM policy and\n    requires `resourcemanager.projects.setIamPolicy` (for example,\n    `roles\u002Fresourcemanager.projectIamAdmin`); **confirm with the user before\n    running project-level IAM grants**. The DCL `connection:` grantee takes the\n    connection path (`[project_id.]location.connection_id`), not the service\n    account email; BigQuery resolves the connection's service account\n    automatically (use `\"serviceAccount:{connection_sa_email}\"` to grant by\n    email instead):\n\n    ```sql\n    GRANT `roles\u002Fserviceusage.serviceUsageConsumer`\n    ON PROJECT `{project_id}`\n    TO \"connection:{project_id}.{region}.{connection_id}\";\n\n    GRANT `roles\u002Fcloudtranslate.user`\n    ON PROJECT `{project_id}`\n    TO \"connection:{project_id}.{region}.{connection_id}\";\n    ```\n3.  **Create the Python UDF with `WITH CONNECTION`** (keep top-level Python\n    statements flush-left at column 0):\n\n```sql\nCREATE OR REPLACE FUNCTION `{project_id}.{dataset_id}.translate_to_es`(\n  text STRING\n)\nRETURNS STRING\nLANGUAGE python\nWITH CONNECTION `{project_id}.{region}.{connection_id}`\nOPTIONS (\n  entry_point = 'do_translate',\n  runtime_version = 'python-3.11',\n  packages = ['google-cloud-translate>=3.11', 'google-api-core']\n)\nAS r'''\nimport logging\nfrom google.api_core import exceptions\nfrom google.api_core.retry import Retry\nfrom google.cloud import translate\n\nclient = translate.TranslationServiceClient()\n\nTRANSIENT_ERRORS = (\n    exceptions.TooManyRequests,\n    exceptions.ServiceUnavailable,\n    exceptions.DeadlineExceeded,\n    exceptions.InternalServerError,\n    exceptions.RetryError,\n)\n\ndef do_translate(text: str) -> str:\n    if not text:\n        return None\n    try:\n        # Note: Replace {project_id} with your Google Cloud Project ID\n        response = client.translate_text(\n            request={\n                \"parent\": \"projects\u002F{project_id}\u002Flocations\u002Fus-central1\",\n                \"contents\": [text],\n                \"target_language_code\": \"es\",\n                \"mime_type\": \"text\u002Fplain\",\n            },\n            retry=Retry(timeout=30.0),  # Total retry budget.\n            timeout=10.0,  # Per-attempt deadline.\n        )\n        return response.translations[0].translated_text\n    except TRANSIENT_ERRORS as e:\n        # Log the error type only; never log row values.\n        logging.warning(\"Transient Translation API error: %s\", type(e).__name__)\n        return None\n    except exceptions.GoogleAPICallError as e:\n        # PermissionDenied, Unauthenticated, InvalidArgument, etc. are fatal.\n        logging.error(\"Fatal Translation API error: %s: %s\", type(e).__name__, e)\n        raise RuntimeError(f\"Translation failed: {type(e).__name__}\") from e\n''';\n```\n\nSee [Python UDFs](references\u002Fpython-udfs.md) for container sizing\n(`container_cpu`, `container_memory`, `container_request_concurrency`), Cloud\nLogging (`SET @@udf.properties = JSON '{\"enableDebugOutput\": true}';`), and\nchecking container build status via `INFORMATION_SCHEMA.ROUTINES`.\n\n### 4. Remote Functions (Cloud Run Endpoints)\n\nUse Remote Functions when the endpoint is hosted on Cloud Run or Cloud Run\nfunctions (for non-Python languages, VPC networking, or custom hardware):\n\n1.  **Grant `roles\u002Frun.invoker` to the Connection Service Account** (confirm\n    with the user before modifying the Cloud Run service IAM policy):\n\n    ```bash\n    CLOUDSDK_METRICS_REQUEST_ATTRIBUTION=\"agent-skills\u002F1.0 (skill:bigquery-udfs)\" \\\n    gcloud run services add-iam-policy-binding {cloud_run_service} \\\n      --region={region} \\\n      --member=\"serviceAccount:{connection_sa_email}\" \\\n      --role=\"roles\u002Frun.invoker\"\n    ```\n2.  **Register the Remote Function**: The endpoint must accept `{\"calls\":\n    [[arg1, ...], ...]}` and return `{\"replies\": [res1, ...]}` with matching\n    element count:\n\n    ```sql\n    CREATE OR REPLACE FUNCTION `{project_id}.{dataset_id}.enrich_address`(\n      street STRING, postal_code STRING\n    )\n    RETURNS JSON\n    REMOTE WITH CONNECTION `{project_id}.{region}.{connection_id}`\n    OPTIONS (\n      endpoint = 'https:\u002F\u002F{cloud_run_service_url}',\n      max_batching_rows = 1000\n    );\n    ```\n\nSee [Remote Functions](references\u002Fremote-functions.md) for Cloud Run handler\ntemplates, batch limits (`max_batching_rows`, 5 MB max input per row, 15 MB max\nresponse on Cloud Run \u002F 10 MB on 1st gen functions), and error\u002Fretry semantics\n(BigQuery automatically retries a batch only on HTTP `408`, `429`, `500`, `503`,\nor `504`; any other non-200 status or JSON `{\"errorMessage\": \"...\"}` fails the\nquery without retrying).\n\n--------------------------------------------------------------------------------\n\n## Validation Checklist\n\nAfter generating or modifying a UDF, follow this validate→fix→repeat loop:\n\n-   [ ] **Step 1 — Validate Python code before BigQuery DDL**: For Python UDFs,\n    validate the Python function and `packages` dependencies *before* submitting\n    the BigQuery DDL—either locally with `python3` test inputs (`None`, edge\n    cases, `pd.DataFrame` batches) or in a containerized Cloud Run Job (`gcloud\n    run jobs deploy {job_name} --source . --region={region}` and `gcloud run\n    jobs execute {job_name} --region={region} --wait`; see\n    [Python UDFs Validation](references\u002Fpython-udfs.md#validation-workflow)).\n-   [ ] **Step 2 — Execute DDL and poll container build status**: Run `CREATE OR\n    REPLACE FUNCTION`. Because the DDL statement returns *before* the Python\n    container image finishes building, poll `INFORMATION_SCHEMA.ROUTINES` until\n    `build_state` transitions from `IN_PROGRESS` to `SUCCEEDED` (or fix and\n    re-run if `FAILED`):\n\n    ```sql\n    SELECT build_status.*\n    FROM `{project_id}.{dataset_id}`.INFORMATION_SCHEMA.ROUTINES\n    WHERE routine_name = '{udf_name}';\n    ```\n-   [ ] **Step 3 — Test the UDF with SQL `SELECT`**: Once `build_state =\n    'SUCCEEDED'` (or immediately after DDL for SQL\u002FJS UDFs), run a test `SELECT`\n    query covering `NULL` and valid inputs.\n\n## Cleanup & Teardown\n\nDelete unused routines, connections, Cloud Run services, and staged Cloud\nStorage artifacts (note that the size of all Python UDF containers per project\nand per region is restricted to a sum total of 10 GiB):\n\n```bash\nbq query --use_legacy_sql=false \"DROP FUNCTION IF EXISTS \\`{project_id}.{dataset_id}.{udf_name}\\`;\"\nbq rm --connection --location={region} {connection_id}\nCLOUDSDK_METRICS_REQUEST_ATTRIBUTION=\"agent-skills\u002F1.0 (skill:bigquery-udfs)\" \\\ngcloud run services delete {cloud_run_service} --region={region} --project={project_id}\nCLOUDSDK_METRICS_REQUEST_ATTRIBUTION=\"agent-skills\u002F1.0 (skill:bigquery-udfs)\" \\\ngcloud storage rm gs:\u002F\u002F{bucket_name}\u002Fudf_libs\u002Fbundle.js\n```\n\n## Reference Directory\n\n-   [SQL and JavaScript UDFs](references\u002Fsql-and-js-udfs.md): Templated SQL\n    parameters (`ANY TYPE`), aggregate UDFs, JavaScript type mappings, and Cloud\n    Storage library loading\n    (`https:\u002F\u002Fdocs.cloud.google.com\u002Fbigquery\u002Fdocs\u002Fuser-defined-functions.md.txt`).\n-   [Python UDFs](references\u002Fpython-udfs.md): Offline vs. `WITH CONNECTION`\n    online service access, Pandas\u002FPyArrow vectorization, container resource\n    limits (`container_cpu`\u002F`container_memory`), and Cloud Logging debugging\n    (`https:\u002F\u002Fdocs.cloud.google.com\u002Fbigquery\u002Fdocs\u002Fuser-defined-functions-python.md.txt`).\n-   [Remote Functions](references\u002Fremote-functions.md): Cloud Run HTTP request\n    and response JSON schema, batch sizing, retry semantics, and VPC egress\n    (`https:\u002F\u002Fdocs.cloud.google.com\u002Fbigquery\u002Fdocs\u002Fremote-functions.md.txt`).\n-   [IAM, Authorized Routines, and Quotas](references\u002Fiam-and-quotas.md):\n    Sharing routines across datasets (`Authorized Routines`), container quotas,\n    and troubleshooting errors.\n\n## Related Skills\n\n-   **BigQuery Basics** (`bigquery-basics`): Dataset, table, and job management.\n-   The `bigquery-bigframes` skill: Creating Python UDFs from Python via\n    `@bpd.udf`.\n-   The `bigquery-ai-ml` skill: Built-in `AI.GENERATE_TEXT` and\n    `AI.GENERATE` functions.\n",{"name":5,"metadata":54,"description":7},{"version":55,"category":56},"1.0.2","BigDataAndAnalytics","main","4c6800d20130b5a3233e414609f1241013cec8cc","skills\u002Fcloud\u002Fbigquery-udfs",2005,"https:\u002F\u002Fgithub.com\u002Fgoogle\u002Fskills","https:\u002F\u002Fgithub.com\u002Fgoogle","https:\u002F\u002Fopensource.google\u002F","Google ❤️ Open Source","2026-11-14 01:51:35",{"source":8,"skillName":5,"commands":67,"prompt":77,"zipAvailable":78},[68,71,74],{"tool":69,"command":70},"npx","npx skills add google\u002Fskills --skill bigquery-udfs",{"tool":72,"command":73},"bunx","bunx skills add google\u002Fskills --skill bigquery-udfs",{"tool":75,"command":76},"pnpm","pnpm dlx skills add google\u002Fskills --skill bigquery-udfs","安装技能，技能地址：https:\u002F\u002Fgithub.com\u002Fgoogle\u002Fskills\u002Fblob\u002Fmain\u002Fskills\u002Fcloud\u002Fbigquery-udfs\u002FSKILL.md",true,[80,86,90,94,98],{"path":81,"resourceType":82,"resourceTypeDesc":83,"sizeBytes":84,"sourceHtmlUrl":85},"references\u002Fattribution.md","REFERENCE","参考文档",1883,"https:\u002F\u002Fgithub.com\u002Fgoogle\u002Fskills\u002Fblob\u002Fmain\u002Fskills\u002Fcloud\u002Fbigquery-udfs\u002Freferences\u002Fattribution.md",{"path":87,"resourceType":82,"resourceTypeDesc":83,"sizeBytes":88,"sourceHtmlUrl":89},"references\u002Fiam-and-quotas.md",7363,"https:\u002F\u002Fgithub.com\u002Fgoogle\u002Fskills\u002Fblob\u002Fmain\u002Fskills\u002Fcloud\u002Fbigquery-udfs\u002Freferences\u002Fiam-and-quotas.md",{"path":91,"resourceType":82,"resourceTypeDesc":83,"sizeBytes":92,"sourceHtmlUrl":93},"references\u002Fpython-udfs.md",19619,"https:\u002F\u002Fgithub.com\u002Fgoogle\u002Fskills\u002Fblob\u002Fmain\u002Fskills\u002Fcloud\u002Fbigquery-udfs\u002Freferences\u002Fpython-udfs.md",{"path":95,"resourceType":82,"resourceTypeDesc":83,"sizeBytes":96,"sourceHtmlUrl":97},"references\u002Fremote-functions.md",7153,"https:\u002F\u002Fgithub.com\u002Fgoogle\u002Fskills\u002Fblob\u002Fmain\u002Fskills\u002Fcloud\u002Fbigquery-udfs\u002Freferences\u002Fremote-functions.md",{"path":99,"resourceType":82,"resourceTypeDesc":83,"sizeBytes":100,"sourceHtmlUrl":101},"references\u002Fsql-and-js-udfs.md",6729,"https:\u002F\u002Fgithub.com\u002Fgoogle\u002Fskills\u002Fblob\u002Fmain\u002Fskills\u002Fcloud\u002Fbigquery-udfs\u002Freferences\u002Fsql-and-js-udfs.md",[103,135,164,192,219,243],{"skillNo":104,"name":105,"nameZh":6,"description":106,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":107,"categories":108,"keywords":113,"publishedAt":49},"01M6998S2EZKD3GEJ7F943RZTE","sign-in-with-google-web","Implement, configure, and secure Sign In With Google (SiwG) using Google Identity Services (GIS \u002F `https:\u002F\u002Faccounts.google.com\u002Fgsi\u002Fclient`) across web architectures. Use when creating Google sign-in buttons, implementing Google One Tap with FedCM, integrating GIS in React\u002FNext.js\u002FAngular\u002FHTML, verifying ID tokens on backend runtimes (Python\u002FNode.js\u002FGo\u002FJava), enforcing Google Workspace domain restrictions (`hd`), securing client-side ID tokens via WebCrypto nonces or encrypted IndexedDB, embedding in cross-origin iframes via the Intermediate Iframe API (`https:\u002F\u002Faccounts.google.com\u002Fgsi\u002Fintermediate`), configuring Content Security Policy (CSP), COOP, and Permissions Policy (`identity-credentials-get`) headers, or handling sign-out and revocation. Don't use for legacy Google Sign-In (`gapi.auth2`), Google Cloud IAM service accounts, or Android\u002FiOS native Credential Manager.","https:\u002F\u002Fgithub.com\u002Fgoogle\u002Fskills\u002Fblob\u002Fmain\u002Fskills\u002Fidentity\u002Fsign-in-with-google-web\u002FSKILL.md",[109,112],{"categoryNo":110,"categoryName":111,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000009","前端开发",{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},[9,114,115,116,117,118,119,120,121,47,122,123,46,124,125,126,127,128,129,130,131,132,133,134],"sign in with google web","sign","with","web","android","go","security","google workspace","implement","policy","implementing","react","iam","permissions","buttons","secure","manager","identity","architectures","domain","runtimes",{"skillNo":136,"name":137,"nameZh":6,"description":138,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":139,"categories":140,"keywords":148,"publishedAt":49},"01M6998PHPDCAD684VW5WRG83D","dpop-adoption","Implement and debug OAuth 2.0 DPoP (RFC 9449) refresh token sender-constraining for WebCrypto, Node.js ES6, and browser runtimes integrating with Google's OAuth platform. Use when configuring non-extractable asymmetric key pairs (P-256), generating DPoP Proof JWTs for authorization code exchange and token refresh, or handling 400 use_dpop_nonce challenge retry loops at oauth2.googleapis.com\u002Ftoken. Don't use for unconstrained OAuth 2.0 flows (where refresh tokens are not bound to a client key pair), or for Google Cloud IAM \u002F service account authentication.","https:\u002F\u002Fgithub.com\u002Fgoogle\u002Fskills\u002Fblob\u002Fmain\u002Fskills\u002Fidentity\u002Fdpop-adoption\u002FSKILL.md",[141,142,145],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},{"categoryNo":143,"categoryName":144,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000023","Skill与智能体开发",{"categoryNo":146,"categoryName":147,"taxonomyType":26,"taxonomyTypeDesc":27},"01JBSEEDCAT000000000000030","开发工程师",[149,150,9,47,151,152,153,154,155,156,126,157,158,159,160,161,162,131,134,163,31],"dpop adoption","adoption","es6","retry","authentication","flows","challenge","code","browser","loops","at","node","token","pair","platform",{"skillNo":165,"name":166,"nameZh":6,"description":167,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":168,"categories":169,"keywords":176,"publishedAt":49},"01M6998M72TC73EEAQH4XC7EXW","retrieving-developer-knowledge","Searches, retrieves, and synthesizes official Google developer documentation across Google Cloud, AI\u002FGemini, Android, Chrome, Web, Flutter, Go, Firebase, and other Google developer platforms. Integrates with the Developer Knowledge MCP server (search_documents, get_documents, answer_query) or the Developer Knowledge REST API fallback. Use when searching for gcloud CLI commands, API syntax, IAM permissions, official documentation, architectural comparisons, or product choice overviews. Don't use for local filesystem lookups or non-Google documentation.","https:\u002F\u002Fgithub.com\u002Fgoogle\u002Fskills\u002Fblob\u002Fmain\u002Fskills\u002Fdevelopers\u002Fretrieving-developer-knowledge\u002FSKILL.md",[170,171,174,175],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},{"categoryNo":172,"categoryName":173,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000021","资料检索与研究",{"categoryNo":143,"categoryName":144,"taxonomyType":21,"taxonomyTypeDesc":22},{"categoryNo":146,"categoryName":147,"taxonomyType":26,"taxonomyTypeDesc":27},[177,178,179,180,47,181,182,183,184,185,186,187,188,31,189,190,39,126,191,127],"retrieving developer knowledge","knowledge","developer","MCP","mcp server","official","developer documentation","get","search","local","choice","documents","query","api","documentation",{"skillNo":193,"name":194,"nameZh":6,"description":195,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":196,"categories":197,"keywords":198,"publishedAt":49},"01M6998J2CZEXS9BES9S3WWFKC","migrate-to-rust","Clones, analyzes, plans, and migrates legacy codebases (C++, Fortran, Java, Python, C, Shell) from a GitHub URL or local directory to a modern, high-performance, deterministic, 100% Safe Rust architecture, tracking live telemetry across every task bucket, test failure\u002Ffix cycle, and Profile-Guided Optimization (PGO) stage, and producing a first-person AI storytelling report and interactive HTML infographic. Use when migrating a GitHub repository or local codebase to Rust, porting legacy C++, Fortran, Python, or Java workloads to memory-safe Rust, designing Struct-of-Arrays (SoA) or SIMD Rust architectures, or optimizing Rust ports with LLVM PGO. Don't use for unrelated non-Rust refactoring or single-line syntax questions.","https:\u002F\u002Fgithub.com\u002Fgoogle\u002Fskills\u002Fblob\u002Fmain\u002Fskills\u002Fdevelopers\u002Fmigrate-to-rust\u002FSKILL.md",[],[199,200,201,202,203,204,205,206,46,207,208,209,210,211,212,186,213,214,215,31,216,217,39,218],"migrate to rust","rust","migrate","github","memory","performance","directory","safe","ports","llvm","soa","cycle","porting","fix","arrays","infographic","high-performance","URL","architecture","unrelated",{"skillNo":220,"name":221,"nameZh":6,"description":222,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":223,"categories":224,"keywords":228,"publishedAt":49},"01M6998GCC3K29WZ82KXMB9E02","finding-google-skills","Google platform decision and setup guidance, loaded on demand from Google's skill catalog. Use when a developer is choosing or setting up part of their stack, such as where to run a service, a database, storage, messaging, authentication, analytics, ads, or AI model serving, and a Google product is a reasonable candidate - whether or not a vendor is named - or when a request names a Google product or API. Brings in the matching Google skill so the answer can weigh Google options, their trade-offs, and when they are not the right fit. Skip when the stack is already settled on another provider and no Google product is named, or the task involves no platform choice.","https:\u002F\u002Fgithub.com\u002Fgoogle\u002Fskills\u002Fblob\u002Fmain\u002Fskills\u002Fdevelopers\u002Ffinding-google-skills\u002FSKILL.md",[225,226,227],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},{"categoryNo":143,"categoryName":144,"taxonomyType":21,"taxonomyTypeDesc":22},{"categoryNo":146,"categoryName":147,"taxonomyType":26,"taxonomyTypeDesc":27},[9,229,34,230,231,163,232,233,234,235,236,153,237,238,239,187,240,241,31,242,190],"finding google skills","as","messaging","model","trade-offs","provider","answer","fit","catalog","up","decision","use","database","candidate",{"skillNo":244,"name":245,"nameZh":6,"description":246,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":247,"categories":248,"keywords":251,"publishedAt":49},"01M6998DWNHTH0BS6W1CY8ZXMP","workload-manager-basics","Use this skill to manage Google Cloud Workload Manager evaluations, rules, scanned resources, and validation results by using public client libraries and the REST API. Use when you need to inspect workload best-practice rules, create and run evaluations for Google Cloud general best practices, SAP, SQL Server, or custom organizational rules, review violations, export results to BigQuery, or automate Workload Manager through client libraries because no service-specific public CLI or MCP server is available. Don't use for general Google Compute Engine instance management, VPC configuration, or standard IAM auditing.","https:\u002F\u002Fgithub.com\u002Fgoogle\u002Fskills\u002Fblob\u002Fmain\u002Fskills\u002Fcloud\u002Fworkload-manager-basics\u002FSKILL.md",[249,250],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},{"categoryNo":143,"categoryName":144,"taxonomyType":21,"taxonomyTypeDesc":22},[252,253,130,254,9,180,255,47,181,256,257,258,259,31,260,190,126,261,38,262,36],"workload manager basics","workload","basics","cli","review","vpc","resources","inspect","you","create","server"]