@google/gemini-cli-core 0.64.0-preview.0 → 0.65.0-nightly.20261008.g44d764ee5

package/dist/docs/changelogs/index.md

@@ -18,6 +18,20 @@ on GitHub.
 | [Preview](preview.md) | Experimental features ready for early feedback. |
 | [Stable](latest.md)   | Stable, recommended for general use.            |
 
+## Announcements: v0.63.0 - 2026-10-06
+
+- **Autonomous Plan Execution:** Enabled autonomous plan execution in
+  non-interactive mode to support unattended agent workflows
+  ([#29539](https://github.com/google-gemini/gemini-cli/pull/29539) by
+  @urielefrenvirtusa).
+- **Core Stability and Memory Lifecycle:** Bounded tool output sizes and
+  optimized memory management in long-running agent loops while preventing
+  infinite authentication loops across headless and supervisor environments
+  ([#29451](https://github.com/google-gemini/gemini-cli/pull/29451) by
+  @diegogodinezr,
+  [#29448](https://github.com/google-gemini/gemini-cli/pull/29448) by
+  @villahernandez-coder).
+
 ## Announcements: v0.61.0 - 2026-09-23
 
 - **Core Security Hardening:** Prevented indirect prompt injection

package/dist/docs/changelogs/latest.md

@@ -1,6 +1,6 @@
-# Latest stable release: v0.61.0
+# Latest stable release: v0.63.0
 
-Released: September 23, 2026
+Released: October 6, 2026
 
 For most users, our latest stable release is the recommended release. Install
 the latest stable version with:
@@ -11,41 +11,62 @@ npm install -g @google/gemini-cli
 
 ## Highlights
 
-- **Prompt Injection Defense:** Enhanced security by preventing indirect prompt
-  injection attacks through build file modifications and untrusted command
-  flags.
-- **Sandbox & State Hardening:** Hardened filesystem boundaries and isolated
-  internal runtime state to ensure more secure execution environments.
-- **Agent Loop Robustness:** Guaranteed that internal state properties within
-  `AgentLoopContext` are fully preserved during object spread operations,
-  improving agent reliability.
-- **Versioned Model Preserves:** Ensured explicit versioned Flash model IDs are
-  correctly preserved and used directly during routing and execution.
+- **Autonomous Plan Execution:** Enabled autonomous plan execution in
+  non-interactive mode, allowing automated agent workflows to run multi-step
+  plans without requiring interactive user confirmation.
+- **Memory Lifecycle & Output Bounding:** Bounded tool output sizes and
+  optimized the memory lifecycle in long-running agent loops to prevent memory
+  exhaustion, while formatting full output when truncation is disabled.
+- **Authentication Resilience:** Prevented infinite authentication loops caused
+  by file contention, headless keyring environments, and supervisor state drops,
+  ensuring reliable credential handling across environments.
+- **CLI & Connection Recovery UX:** Displayed a retry progress indicator during
+  connection recovery, restored paused stdin after capability detection, and
+  ensured automatic temporary directory cleanup upon background shell execution
+  exit.
 
 ## What's Changed
 
-- Changelog for v0.60.0-preview.0 by @gemini-cli-robot in
-  [#29251](https://github.com/google-gemini/gemini-cli/pull/29251)
-- chore(release): bump version to 0.61.0-nightly.20260908.gc647533d6 by
+- fix(cli): display retry progress indicator during connection recovery (#28340)
+  by @amelidev in
+  [#29468](https://github.com/google-gemini/gemini-cli/pull/29468)
+- Changelog for v0.61.0-preview.1 by @gemini-cli-robot in
+  [#29469](https://github.com/google-gemini/gemini-cli/pull/29469)
+- Changelog for v0.61.0 by @gemini-cli-robot in
+  [#29472](https://github.com/google-gemini/gemini-cli/pull/29472)
+- fix(cli): distinguish missing MCP enablement config from malformed JSON by
+  @jesussamuel-byte in
+  [#29446](https://github.com/google-gemini/gemini-cli/pull/29446)
+- fix(cli): restore paused stdin after capability detection by @ugorla-dev in
+  [#29487](https://github.com/google-gemini/gemini-cli/pull/29487)
+- fix(core): bound tool output size and optimize memory lifecycle in
+  long-running agent loops by @diegogodinezr in
+  [#29451](https://github.com/google-gemini/gemini-cli/pull/29451)
+- fix(core): remove invalid diff.external override by @urielefrenvirtusa in
+  [#29467](https://github.com/google-gemini/gemini-cli/pull/29467)
+- chore(release): bump version to 0.63.0-nightly.20260923.gf50ba8608 by
   @gemini-cli-robot in
-  [#29254](https://github.com/google-gemini/gemini-cli/pull/29254)
-- Changelog for v0.59.0 by @gemini-cli-robot in
-  [#29253](https://github.com/google-gemini/gemini-cli/pull/29253)
-- fix(core): preserve explicit versioned Flash model IDs by @SandyTao520 in
-  [#29252](https://github.com/google-gemini/gemini-cli/pull/29252)
-- fix(core): prevent indirect prompt injection via build file modifications and
-  untrusted flags by @villahernandez-coder in
-  [#29250](https://github.com/google-gemini/gemini-cli/pull/29250)
-- fix(sandbox): harden filesystem boundaries and isolate runtime state by
-  @diegogodinezr in
-  [#29214](https://github.com/google-gemini/gemini-cli/pull/29214)
-- fix(core): ensure AgentLoopContext properties are preserved across object
-  spread by @diegogodinezr in
-  [#29335](https://github.com/google-gemini/gemini-cli/pull/29335)
-- fix(patch): cherry-pick 62364cb to release/v0.61.0-preview.0-pr-29443 to patch
-  version v0.61.0-preview.0 and create version 0.61.0-preview.1 by
-  @gemini-cli-robot in
-  [#29455](https://github.com/google-gemini/gemini-cli/pull/29455)
+  [#29471](https://github.com/google-gemini/gemini-cli/pull/29471)
+- Changelog for v0.62.0-preview.0 by @gemini-cli-robot in
+  [#29470](https://github.com/google-gemini/gemini-cli/pull/29470)
+- fix(core): clean up temporary directory when background shell execution exits
+  by @jesussamuel-byte in
+  [#29437](https://github.com/google-gemini/gemini-cli/pull/29437)
+- fix(acp): resolve session before config initialization and avoid same-minute
+  filename collisions by @jesussamuel-byte in
+  [#29463](https://github.com/google-gemini/gemini-cli/pull/29463)
+- fix(core): align policy redirection gates, path validation, and workflow
+  parsing by @DavidAPierce in
+  [#29506](https://github.com/google-gemini/gemini-cli/pull/29506)
+- fix(auth): prevent infinite auth loop from file contention, headless keyring,
+  and supervisor state drops (#28341) by @villahernandez-coder in
+  [#29448](https://github.com/google-gemini/gemini-cli/pull/29448)
+- fix(core): enable autonomous plan execution in non-interactive mode by
+  @urielefrenvirtusa in
+  [#29539](https://github.com/google-gemini/gemini-cli/pull/29539)
+- fix(core): disable truncation when maxChars <= 0 in formatTruncatedToolOutput
+  by @diegogodinezr in
+  [#29542](https://github.com/google-gemini/gemini-cli/pull/29542)
 
 **Full Changelog**:
-https://github.com/google-gemini/gemini-cli/compare/v0.60.0...v0.61.0
+https://github.com/google-gemini/gemini-cli/compare/v0.62.0...v0.63.0

package/dist/docs/changelogs/preview.md

@@ -1,6 +1,6 @@
-# Preview release: v0.63.0-preview.0
+# Preview release: v0.64.0-preview.0
 
-Released: September 29, 2026
+Released: October 6, 2026
 
 Our preview release includes the latest, new, and experimental features. This
 release may not be as stable as our [latest weekly release](latest.md).
@@ -13,62 +13,67 @@ npm install -g @google/gemini-cli@preview
 
 ## Highlights
 
-- **Autonomous Plan Execution**: Enabled autonomous plan execution in
-  non-interactive mode, allowing automated agent workflows to run multi-step
-  plans without requiring interactive user confirmation.
-- **Memory Lifecycle & Output Bounding**: Bounded tool output sizes and
-  optimized the memory lifecycle in long-running agent loops to prevent memory
-  leaks, while ensuring full output formatting when truncation is disabled.
-- **Authentication Resilience**: Prevented infinite authentication loops caused
-  by file contention, headless keyring environments, and supervisor state drops,
-  ensuring reliable credential handling across environments.
-- **CLI & Connection Recovery UX**: Displayed a retry progress indicator during
-  connection recovery, restored paused stdin after capability detection, and
-  ensured automatic temporary directory cleanup upon background shell execution
-  exit.
+- **Atomic File Operations & State Recovery**: Serialized file tool operations
+  with atomic writes and introduced atomic CLI state persistence with automatic
+  recovery from backup on corruption.
+- **Chat Recording Optimization**: Implemented append-only delta patching and
+  bounded history windowing in ChatRecordingService to optimize memory and disk
+  efficiency during long-running sessions.
+- **CLI Input & Reference Resolution**: Added support for resolving `@file:line`
+  references, resolved CPU hangs and quote swallowing on `@` symbols within code
+  blocks, and prevented ghost text wrap hangs.
+- **Terminal UI & Interaction Stability**: Ensured Ctrl+C emergency aborts reach
+  active cancellation handlers, made selection list confirmation with Enter and
+  Spacebar reliable, and fixed Windows ConPTY IME cursor forwarding.
 
 ## What's Changed
 
-- fix(cli): display retry progress indicator during connection recovery (#28340)
-  by @amelidev in
-  [#29468](https://github.com/google-gemini/gemini-cli/pull/29468)
-- Changelog for v0.61.0-preview.1 by @gemini-cli-robot in
-  [#29469](https://github.com/google-gemini/gemini-cli/pull/29469)
-- Changelog for v0.61.0 by @gemini-cli-robot in
-  [#29472](https://github.com/google-gemini/gemini-cli/pull/29472)
-- fix(cli): distinguish missing MCP enablement config from malformed JSON by
-  @jesussamuel-byte in
-  [#29446](https://github.com/google-gemini/gemini-cli/pull/29446)
-- fix(cli): restore paused stdin after capability detection by @ugorla-dev in
-  [#29487](https://github.com/google-gemini/gemini-cli/pull/29487)
-- fix(core): bound tool output size and optimize memory lifecycle in
-  long-running agent loops by @diegogodinezr in
-  [#29451](https://github.com/google-gemini/gemini-cli/pull/29451)
-- fix(core): remove invalid diff.external override by @urielefrenvirtusa in
-  [#29467](https://github.com/google-gemini/gemini-cli/pull/29467)
-- chore(release): bump version to 0.63.0-nightly.20260923.gf50ba8608 by
+- refactor(a2a-server): implement V1 to V2 settings migration logic by
+  @jvargassanchez-dot in
+  [#29450](https://github.com/google-gemini/gemini-cli/pull/29450)
+- fix(acp): bridge PromptResponse.usage and emit usage_update notifications
+  (#29389) by @elberthc-byte in
+  [#29549](https://github.com/google-gemini/gemini-cli/pull/29549)
+- Changelog for v0.63.0-preview.0 by @gemini-cli-robot in
+  [#29565](https://github.com/google-gemini/gemini-cli/pull/29565)
+- fix(cli): propagate resolved folder trust state in headless mode (#29031) by
+  @amelidev in [#29528](https://github.com/google-gemini/gemini-cli/pull/29528)
+- chore(release): bump version to 0.64.0-nightly.20260929.gd75234cae by
   @gemini-cli-robot in
-  [#29471](https://github.com/google-gemini/gemini-cli/pull/29471)
-- Changelog for v0.62.0-preview.0 by @gemini-cli-robot in
-  [#29470](https://github.com/google-gemini/gemini-cli/pull/29470)
-- fix(core): clean up temporary directory when background shell execution exits
-  by @jesussamuel-byte in
-  [#29437](https://github.com/google-gemini/gemini-cli/pull/29437)
-- fix(acp): resolve session before config initialization and avoid same-minute
-  filename collisions by @jesussamuel-byte in
-  [#29463](https://github.com/google-gemini/gemini-cli/pull/29463)
-- fix(core): align policy redirection gates, path validation, and workflow
-  parsing by @DavidAPierce in
-  [#29506](https://github.com/google-gemini/gemini-cli/pull/29506)
-- fix(auth): prevent infinite auth loop from file contention, headless keyring,
-  and supervisor state drops (#28341) by @villahernandez-coder in
-  [#29448](https://github.com/google-gemini/gemini-cli/pull/29448)
-- fix(core): enable autonomous plan execution in non-interactive mode by
+  [#29567](https://github.com/google-gemini/gemini-cli/pull/29567)
+- fix(cli): prevent CPU hang and quote swallowing on @ within code (#29434) by
+  @elberthc-byte in
+  [#29557](https://github.com/google-gemini/gemini-cli/pull/29557)
+- fix(core): serialize file tool operations and make writes atomic (#29078) by
+  @elberthc-byte in
+  [#29499](https://github.com/google-gemini/gemini-cli/pull/29499)
+- fix(core): implement append-only delta patching and bounded history windowing
+  in ChatRecordingService by @jvargassanchez-dot in
+  [#29568](https://github.com/google-gemini/gemini-cli/pull/29568)
+- fix(cli): persist state atomically and recover from backup on corruption by
   @urielefrenvirtusa in
-  [#29539](https://github.com/google-gemini/gemini-cli/pull/29539)
-- fix(core): disable truncation when maxChars <= 0 in formatTruncatedToolOutput
-  by @diegogodinezr in
-  [#29542](https://github.com/google-gemini/gemini-cli/pull/29542)
+  [#29558](https://github.com/google-gemini/gemini-cli/pull/29558)
+- fix(cli): ensure Ctrl+C emergency abort reaches cancellation handler during
+  active operations by @urielefrenvirtusa in
+  [#29586](https://github.com/google-gemini/gemini-cli/pull/29586)
+- fix(cli): resolve @file:line references and prevent ghost text wrap hang by
+  @jesussamuel-byte in
+  [#29581](https://github.com/google-gemini/gemini-cli/pull/29581)
+- fix(ui): ensure Windows ConPTY forwards IME cursor position by
+  @jesussamuel-byte in
+  [#29560](https://github.com/google-gemini/gemini-cli/pull/29560)
+- fix(cli): retry directory removal on Windows locking errors during extension
+  updates by @jesussamuel-byte in
+  [#29540](https://github.com/google-gemini/gemini-cli/pull/29540)
+- fix(acp): resolve session by exact id and handle listener cleanup on session
+  failure by @diegogodinezr in
+  [#29580](https://github.com/google-gemini/gemini-cli/pull/29580)
+- fix(cli): preserve scroll position and partition pending height budget by
+  @luisfelipe-alt in
+  [#29520](https://github.com/google-gemini/gemini-cli/pull/29520)
+- fix(cli): ensure Enter and Spacebar reliably confirm selection list options by
+  @ugorla-dev in
+  [#29502](https://github.com/google-gemini/gemini-cli/pull/29502)
 
 **Full Changelog**:
-https://github.com/google-gemini/gemini-cli/compare/v0.62.0-preview.0...v0.63.0-preview.0
+https://github.com/google-gemini/gemini-cli/compare/v0.63.0-preview.0...v0.64.0-preview.0

package/dist/docs/cli/telemetry.md

@@ -42,6 +42,7 @@ Environment variables can override these settings.
 | `target`       | `GEMINI_TELEMETRY_TARGET`         | Where to send telemetry data                        | `"gcp"`/`"local"` | `"local"`               |
 | `otlpEndpoint` | `GEMINI_TELEMETRY_OTLP_ENDPOINT`  | OTLP collector endpoint                             | URL string        | `http://localhost:4317` |
 | `otlpProtocol` | `GEMINI_TELEMETRY_OTLP_PROTOCOL`  | OTLP transport protocol                             | `"grpc"`/`"http"` | `"grpc"`                |
+| `otlpHeaders`  | `GEMINI_TELEMETRY_OTLP_HEADERS`   | Custom headers for OTLP exporter requests           | JSON/`key=value`  | -                       |
 | `outfile`      | `GEMINI_TELEMETRY_OUTFILE`        | Save telemetry to file (overrides `otlpEndpoint`)   | file path         | -                       |
 | `logPrompts`   | `GEMINI_TELEMETRY_LOG_PROMPTS`    | Include prompts in telemetry logs                   | `true`/`false`    | `true`                  |
 | `useCollector` | `GEMINI_TELEMETRY_USE_COLLECTOR`  | Use external OTLP collector (advanced)              | `true`/`false`    | `false`                 |

package/dist/docs/reference/configuration.md

@@ -2550,6 +2550,8 @@ see [Telemetry](../cli/telemetry.md).
   - **`otlpEndpoint`** (string): The endpoint for the OTLP Exporter.
   - **`otlpProtocol`** (string): The protocol for the OTLP Exporter (`grpc` or
     `http`).
+  - **`otlpHeaders`** (object): Custom headers to send with OTLP Exporter
+    requests.
   - **`logPrompts`** (boolean): Whether or not to include the content of user
     prompts in the logs.
   - **`outfile`** (string): The file to write telemetry to when `target` is
@@ -2766,6 +2768,11 @@ the `advanced.excludedEnvVars` setting in your `settings.json` file.
 - **`GEMINI_TELEMETRY_OTLP_PROTOCOL`**:
   - Sets the OTLP protocol (`grpc` or `http`).
   - Overrides the `telemetry.otlpProtocol` setting.
+- **`GEMINI_TELEMETRY_OTLP_HEADERS`**:
+  - Sets custom headers for OTLP exporter requests (as a JSON object string or
+    comma-separated `key=value` pairs; also falls back to
+    `OTEL_EXPORTER_OTLP_HEADERS`).
+  - Merges with and overrides headers in the `telemetry.otlpHeaders` setting.
 - **`GEMINI_TELEMETRY_LOG_PROMPTS`**:
   - Set to `true` or `1` to enable or disable logging of user prompts. Any other
     value is treated as disabling it.

package/dist/docs/tools/mcp-server.md

@@ -326,17 +326,31 @@ This feature will not work in:
 
 <!-- prettier-ignore -->
 > [!IMPORTANT]
-> To protect against OAuth Identity Provider (IdP) mix-up attacks, Gemini CLI
-> validates the `iss` (issuer) parameter per
-> [RFC 9207](https://www.rfc-editor.org/rfc/rfc9207). When an expected issuer is
-> discovered or configured, authorization servers **must** return the `iss`
-> parameter in the callback redirect matching the issuer URL. Responses missing
-> `iss` or with mismatched issuers are rejected with HTTP 400.
+> Gemini CLI validates the `iss` (issuer) parameter in OAuth authorization
+> responses per [RFC 9207](https://www.rfc-editor.org/rfc/rfc9207) and the MCP
+> specification:
+>
+> - Whenever the `iss` parameter is present in the callback redirect and an
+>   expected `issuer` is discovered or configured, `iss` **must** match the
+>   expected issuer URL.
+> - When the authorization server metadata sets
+>   `authorization_response_iss_parameter_supported: true`, the callback
+>   redirect **must** include the `iss` parameter.
+> - When the discovered authorization server metadata omits
+>   `authorization_response_iss_parameter_supported` or sets it to `false` (for
+>   example, providers that do not declare RFC 9207 support), callbacks without
+>   `iss` are accepted.
+> - When you configure `issuer` explicitly in `settings.json` and Gemini CLI
+>   doesn't discover authorization server metadata, the callback redirect
+>   **must** include the `iss` parameter. To accept callbacks without `iss` for
+>   such a server, set `authorizationResponseIssParameterSupported` to `false`
+>   in the `oauth` configuration.
 
 ##### Expected authorization callback example
 
-When the authorization server redirects the user back to Gemini CLI, the
-redirect URI must include the `iss` parameter:
+When the authorization server declares
+`authorization_response_iss_parameter_supported: true`, the redirect URI must
+include the `iss` parameter:
 
 ```http
 HTTP/1.1 302 Found
@@ -344,10 +358,14 @@ Location: http://localhost:<port>/oauth/callback?code=AUTH_CODE&state=STATE&iss=
 ```
 
 - **Valid response (accepted):** `iss` matches the configured or discovered
-  issuer (`https://auth.example.com`).
-- **Missing `iss` (rejected):**
-  `http://localhost:<port>/oauth/callback?code=AUTH_CODE&state=STATE` (fails
-  with HTTP 400: `Missing issuer parameter in response`).
+  issuer (`https://auth.example.com`), or `iss` is omitted when the discovered
+  metadata doesn't set `authorization_response_iss_parameter_supported` to
+  `true`.
+- **Missing `iss` when required (rejected):**
+  `http://localhost:<port>/oauth/callback?code=AUTH_CODE&state=STATE` when
+  `authorization_response_iss_parameter_supported` is `true`, or when `issuer`
+  is configured explicitly without discovered metadata (fails with HTTP 400:
+  `Missing issuer parameter in response`).
 - **Mismatched `iss` (rejected):** `iss` points to a different domain or
   includes userinfo (fails with HTTP 400: `Issuer mismatch`).
 
@@ -373,6 +391,12 @@ If your remote MCP server uses an authorization server with a known issuer URL:
 }
 ```
 
+With this configuration, Gemini CLI requires the `iss` parameter in the
+authorization callback. If the authorization server doesn't return `iss` in its
+redirects, add `"authorizationResponseIssParameterSupported": false` to the
+`oauth` block. Gemini CLI then accepts callbacks without `iss` while still
+rejecting any `iss` value that doesn't match the configured `issuer`.
+
 #### Managing OAuth authentication
 
 Use the `/mcp auth` command to manage OAuth authentication:
@@ -398,6 +422,11 @@ Use the `/mcp auth` command to manage OAuth authentication:
   if omitted)
 - **`issuer`** (string): Authorization server issuer URL (auto-discovered if
   omitted; validated per RFC 9207)
+- **`authorizationResponseIssParameterSupported`** (boolean): Whether the
+  authorization server returns the `iss` parameter in authorization responses
+  (RFC 9207). Auto-discovered from the authorization server metadata; defaults
+  to `true` when `issuer` is configured explicitly without discovered metadata.
+  Set to `false` to accept callbacks without `iss` for such a server.
 - **`tokenUrl`** (string): OAuth token endpoint (auto-discovered if omitted)
 - **`scopes`** (string[]): Required OAuth scopes
 - **`redirectUri`** (string): Custom redirect URI (defaults to an OS-assigned

package/dist/src/agents/auth-provider/oauth2-provider.d.ts

@@ -21,6 +21,7 @@ export declare class OAuth2AuthProvider extends BaseA2AAuthProvider {
     readonly type = "oauth2";
     private readonly tokenStorage;
     private cachedToken;
+    private pendingAuthPromise;
     /** Resolved OAuth URLs — may come from config or agent card. */
     private authorizationUrl;
     private tokenUrl;
@@ -33,13 +34,21 @@ export declare class OAuth2AuthProvider extends BaseA2AAuthProvider {
     initialize(): Promise<void>;
     /**
      * Return an Authorization header with a valid Bearer token.
-     * Refreshes or triggers interactive auth as needed.
+     * Refreshes or triggers interactive auth as needed, deduplicating concurrent requests.
      */
     headers(): Promise<HttpHeaders>;
+    /**
+     * Refresh an expired token or run interactive browser-based authentication.
+     */
+    private acquireToken;
+    /**
+     * Return the maximum number of consecutive authentication retries allowed.
+     */
+    protected getMaxAuthRetries(): number;
     /**
      * On 401/403, clear the cached token and re-authenticate (up to MAX_AUTH_RETRIES).
      */
-    shouldRetryWithHeaders(_req: RequestInit, res: Response): Promise<HttpHeaders | undefined>;
+    shouldRetryWithHeaders(req: RequestInit, res: Response): Promise<HttpHeaders | undefined>;
     /**
      * Merge authorization_url, token_url, and scopes from the agent card's
      * `securitySchemes` when not already provided via user config.

package/dist/src/agents/auth-provider/oauth2-provider.js

@@ -27,6 +27,7 @@ export class OAuth2AuthProvider extends BaseA2AAuthProvider {
     type = 'oauth2';
     tokenStorage;
     cachedToken = null;
+    pendingAuthPromise = null;
     /** Resolved OAuth URLs — may come from config or agent card. */
     authorizationUrl;
     tokenUrl;
@@ -61,15 +62,30 @@ export class OAuth2AuthProvider extends BaseA2AAuthProvider {
     }
     /**
      * Return an Authorization header with a valid Bearer token.
-     * Refreshes or triggers interactive auth as needed.
+     * Refreshes or triggers interactive auth as needed, deduplicating concurrent requests.
      */
     async headers() {
-        // 1. Valid cached token → return immediately.
+        // 1. Valid cached token → return immediately and reset retry counter.
         if (this.cachedToken &&
             !this.tokenStorage.isTokenExpired(this.cachedToken)) {
+            this.authRetryCount = 0;
             return { Authorization: `Bearer ${this.cachedToken.accessToken}` };
         }
-        // 2. Expired but has refresh token → attempt silent refresh.
+        // 2. Coalesce concurrent token refresh / interactive auth requests.
+        if (!this.pendingAuthPromise) {
+            this.pendingAuthPromise = this.acquireToken().finally(() => {
+                this.pendingAuthPromise = null;
+            });
+        }
+        const token = await this.pendingAuthPromise;
+        this.authRetryCount = 0;
+        return { Authorization: `Bearer ${token.accessToken}` };
+    }
+    /**
+     * Refresh an expired token or run interactive browser-based authentication.
+     */
+    async acquireToken() {
+        // 1. Expired but has refresh token → attempt silent refresh.
         if (this.cachedToken?.refreshToken &&
             this.tokenUrl &&
             this.config.client_id) {
@@ -81,34 +97,58 @@ export class OAuth2AuthProvider extends BaseA2AAuthProvider {
                 }, this.cachedToken.refreshToken, this.tokenUrl);
                 this.cachedToken = this.toOAuthToken(refreshed, this.cachedToken.refreshToken);
                 await this.persistToken();
-                return { Authorization: `Bearer ${this.cachedToken.accessToken}` };
+                return this.cachedToken;
             }
             catch (error) {
                 debugLogger.debug(`[OAuth2AuthProvider] Refresh failed, falling back to interactive flow: ${getErrorMessage(error)}`);
                 // Clear stale credentials and fall through to interactive flow.
+                this.cachedToken = null;
                 await this.tokenStorage.deleteCredentials(this.agentName);
             }
         }
-        // 3. No valid token → interactive browser-based auth.
+        // 2. No valid token → interactive browser-based auth.
         this.cachedToken = await this.authenticateInteractively();
-        return { Authorization: `Bearer ${this.cachedToken.accessToken}` };
+        return this.cachedToken;
+    }
+    /**
+     * Return the maximum number of consecutive authentication retries allowed.
+     */
+    getMaxAuthRetries() {
+        return BaseA2AAuthProvider.MAX_AUTH_RETRIES;
     }
     /**
      * On 401/403, clear the cached token and re-authenticate (up to MAX_AUTH_RETRIES).
      */
-    async shouldRetryWithHeaders(_req, res) {
+    async shouldRetryWithHeaders(req, res) {
         if (res.status !== 401 && res.status !== 403) {
             this.authRetryCount = 0;
             return undefined;
         }
-        if (this.authRetryCount >= BaseA2AAuthProvider.MAX_AUTH_RETRIES) {
+        const reqHeaders = new Headers(req.headers);
+        const reqToken = reqHeaders.get('Authorization')?.split(' ')[1];
+        // If the token used in the request is already different from our current cached token
+        // (or if the cached token has already been cleared), another concurrent request has
+        // already initiated the re-authentication flow. We can safely retry with the new
+        // token without incrementing the retry count or clearing credentials again.
+        if (reqToken &&
+            (!this.cachedToken || reqToken !== this.cachedToken.accessToken)) {
+            debugLogger.debug('[OAuth2AuthProvider] Token already cleared or updated by another request, retrying with new token');
+            const retryCount = this.authRetryCount;
+            const headers = await this.headers();
+            this.authRetryCount = Math.max(this.authRetryCount, retryCount);
+            return headers;
+        }
+        if (this.authRetryCount >= this.getMaxAuthRetries()) {
             return undefined;
         }
-        this.authRetryCount++;
+        const nextRetryCount = this.authRetryCount + 1;
+        this.authRetryCount = nextRetryCount;
         debugLogger.debug('[OAuth2AuthProvider] Auth failure, clearing token and re-authenticating');
         this.cachedToken = null;
         await this.tokenStorage.deleteCredentials(this.agentName);
-        return this.headers();
+        const headers = await this.headers();
+        this.authRetryCount = nextRetryCount;
+        return headers;
     }
     // ---------------------------------------------------------------------------
     // Private helpers
@@ -174,7 +214,10 @@ export class OAuth2AuthProvider extends BaseA2AAuthProvider {
         /* resource= */ undefined);
         const consent = await getConsentForOauth(`Authentication required for A2A agent: '${this.agentName}'.`);
         if (!consent) {
-            throw new FatalCancellationError('Authentication cancelled by user.');
+            const cancelError = new FatalCancellationError('Authentication cancelled by user.');
+            callbackServer.response.catch(() => { });
+            callbackServer.cancel?.(cancelError);
+            throw cancelError;
         }
         coreEvents.emitFeedback('info', `→ Opening your browser for OAuth sign-in...
 

package/dist/src/agents/auth-provider/oauth2-provider.js.map

@@ -1 +1 @@
-{"version":3,"file":"oauth2-provider.js","sourceRoot":"","sources":["../../../../src/agents/auth-provider/oauth2-provider.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,EAAoB,wBAAwB,EAAE,MAAM,oBAAoB,CAAC;AAEhF,OAAO,EAAE,mBAAmB,EAAE,MAAM,oBAAoB,CAAC;AAEzD,OAAO,EAAE,oBAAoB,EAAE,MAAM,kCAAkC,CAAC;AAExE,OAAO,EACL,kBAAkB,EAClB,mBAAmB,EACnB,cAAc,EACd,qBAAqB,EACrB,oBAAoB,EACpB,kBAAkB,GAEnB,MAAM,2BAA2B,CAAC;AACnC,OAAO,EAAE,mBAAmB,EAAE,MAAM,wCAAwC,CAAC;AAC7E,OAAO,EAAE,kBAAkB,EAAE,MAAM,4BAA4B,CAAC;AAChE,OAAO,EAAE,sBAAsB,EAAE,eAAe,EAAE,MAAM,uBAAuB,CAAC;AAChF,OAAO,EAAE,UAAU,EAAE,MAAM,uBAAuB,CAAC;AACnD,OAAO,EAAE,WAAW,EAAE,MAAM,4BAA4B,CAAC;AACzD,OAAO,EAAE,OAAO,EAAE,MAAM,yBAAyB,CAAC;AAElD;;;;;;GAMG;AACH,MAAM,OAAO,kBAAmB,SAAQ,mBAAmB;IAYtC;IACA;IAEA;IAdV,IAAI,GAAG,QAAQ,CAAC;IAER,YAAY,CAAuB;IAC5C,WAAW,GAAsB,IAAI,CAAC;IAE9C,gEAAgE;IACxD,gBAAgB,CAAqB;IACrC,QAAQ,CAAqB;IAC7B,MAAM,CAAuB;IAErC,YACmB,MAAwB,EACxB,SAAiB,EAClC,SAAqB,EACJ,YAAqB;QAEtC,KAAK,EAAE,CAAC;QALS,WAAM,GAAN,MAAM,CAAkB;QACxB,cAAS,GAAT,SAAS,CAAQ;QAEjB,iBAAY,GAAZ,YAAY,CAAS;QAGtC,IAAI,CAAC,YAAY,GAAG,IAAI,oBAAoB,CAC1C,OAAO,CAAC,qBAAqB,EAAE,EAC/B,gBAAgB,CACjB,CAAC;QAEF,yBAAyB;QACzB,IAAI,CAAC,gBAAgB,GAAG,MAAM,CAAC,iBAAiB,CAAC;QACjD,IAAI,CAAC,QAAQ,GAAG,MAAM,CAAC,SAAS,CAAC;QACjC,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC,MAAM,CAAC;QAE5B,iFAAiF;QACjF,IAAI,CAAC,sBAAsB,CAAC,SAAS,CAAC,CAAC;IACzC,CAAC;IAED;;;OAGG;IACM,KAAK,CAAC,UAAU;QACvB,0EAA0E;QAC1E,IAAI,CAAC,CAAC,IAAI,CAAC,gBAAgB,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,IAAI,CAAC,YAAY,EAAE,CAAC;YACpE,MAAM,IAAI,CAAC,sBAAsB,EAAE,CAAC;QACtC,CAAC;QAED,MAAM,WAAW,GAAG,MAAM,IAAI,CAAC,YAAY,CAAC,cAAc,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;QAC3E,IAAI,WAAW,IAAI,CAAC,IAAI,CAAC,YAAY,CAAC,cAAc,CAAC,WAAW,CAAC,KAAK,CAAC,EAAE,CAAC;YACxE,IAAI,CAAC,WAAW,GAAG,WAAW,CAAC,KAAK,CAAC;YACrC,WAAW,CAAC,KAAK,CACf,uDAAuD,IAAI,CAAC,SAAS,GAAG,CACzE,CAAC;QACJ,CAAC;IACH,CAAC;IAED;;;OAGG;IACM,KAAK,CAAC,OAAO;QACpB,8CAA8C;QAC9C,IACE,IAAI,CAAC,WAAW;YAChB,CAAC,IAAI,CAAC,YAAY,CAAC,cAAc,CAAC,IAAI,CAAC,WAAW,CAAC,EACnD,CAAC;YACD,OAAO,EAAE,aAAa,EAAE,UAAU,IAAI,CAAC,WAAW,CAAC,WAAW,EAAE,EAAE,CAAC;QACrE,CAAC;QAED,6DAA6D;QAC7D,IACE,IAAI,CAAC,WAAW,EAAE,YAAY;YAC9B,IAAI,CAAC,QAAQ;YACb,IAAI,CAAC,MAAM,CAAC,SAAS,EACrB,CAAC;YACD,IAAI,CAAC;gBACH,MAAM,SAAS,GAAG,MAAM,kBAAkB,CACxC;oBACE,QAAQ,EAAE,IAAI,CAAC,MAAM,CAAC,SAAS;oBAC/B,YAAY,EAAE,IAAI,CAAC,MAAM,CAAC,aAAa;oBACvC,MAAM,EAAE,IAAI,CAAC,MAAM;iBACpB,EACD,IAAI,CAAC,WAAW,CAAC,YAAY,EAC7B,IAAI,CAAC,QAAQ,CACd,CAAC;gBAEF,IAAI,CAAC,WAAW,GAAG,IAAI,CAAC,YAAY,CAClC,SAAS,EACT,IAAI,CAAC,WAAW,CAAC,YAAY,CAC9B,CAAC;gBACF,MAAM,IAAI,CAAC,YAAY,EAAE,CAAC;gBAC1B,OAAO,EAAE,aAAa,EAAE,UAAU,IAAI,CAAC,WAAW,CAAC,WAAW,EAAE,EAAE,CAAC;YACrE,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,WAAW,CAAC,KAAK,CACf,0EAA0E,eAAe,CAAC,KAAK,CAAC,EAAE,CACnG,CAAC;gBACF,gEAAgE;gBAChE,MAAM,IAAI,CAAC,YAAY,CAAC,iBAAiB,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;YAC5D,CAAC;QACH,CAAC;QAED,sDAAsD;QACtD,IAAI,CAAC,WAAW,GAAG,MAAM,IAAI,CAAC,yBAAyB,EAAE,CAAC;QAC1D,OAAO,EAAE,aAAa,EAAE,UAAU,IAAI,CAAC,WAAW,CAAC,WAAW,EAAE,EAAE,CAAC;IACrE,CAAC;IAED;;OAEG;IACM,KAAK,CAAC,sBAAsB,CACnC,IAAiB,EACjB,GAAa;QAEb,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;YAC7C,IAAI,CAAC,cAAc,GAAG,CAAC,CAAC;YACxB,OAAO,SAAS,CAAC;QACnB,CAAC;QAED,IAAI,IAAI,CAAC,cAAc,IAAI,mBAAmB,CAAC,gBAAgB,EAAE,CAAC;YAChE,OAAO,SAAS,CAAC;QACnB,CAAC;QACD,IAAI,CAAC,cAAc,EAAE,CAAC;QAEtB,WAAW,CAAC,KAAK,CACf,yEAAyE,CAC1E,CAAC;QACF,IAAI,CAAC,WAAW,GAAG,IAAI,CAAC;QACxB,MAAM,IAAI,CAAC,YAAY,CAAC,iBAAiB,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;QAE1D,OAAO,IAAI,CAAC,OAAO,EAAE,CAAC;IACxB,CAAC;IAED,8EAA8E;IAC9E,kBAAkB;IAClB,8EAA8E;IAE9E;;;OAGG;IACK,sBAAsB,CAC5B,SAAqD;QAErD,IAAI,CAAC,SAAS,EAAE,eAAe;YAAE,OAAO;QAExC,KAAK,MAAM,MAAM,IAAI,MAAM,CAAC,MAAM,CAAC,SAAS,CAAC,eAAe,CAAC,EAAE,CAAC;YAC9D,IAAI,MAAM,CAAC,IAAI,KAAK,QAAQ,IAAI,MAAM,CAAC,KAAK,CAAC,iBAAiB,EAAE,CAAC;gBAC/D,MAAM,IAAI,GAAG,MAAM,CAAC,KAAK,CAAC,iBAAiB,CAAC;gBAC5C,IAAI,CAAC,gBAAgB,KAAK,IAAI,CAAC,gBAAgB,CAAC;gBAChD,IAAI,CAAC,QAAQ,KAAK,IAAI,CAAC,QAAQ,CAAC;gBAChC,IAAI,CAAC,MAAM,KAAK,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;gBACzC,MAAM,CAAC,iCAAiC;YAC1C,CAAC;QACH,CAAC;IACH,CAAC;IAED;;;OAGG;IACK,KAAK,CAAC,sBAAsB;QAClC,IAAI,CAAC,IAAI,CAAC,YAAY;YAAE,OAAO;QAE/B,IAAI,CAAC;YACH,WAAW,CAAC,KAAK,CACf,iDAAiD,IAAI,CAAC,YAAY,EAAE,CACrE,CAAC;YACF,MAAM,QAAQ,GAAG,IAAI,wBAAwB,EAAE,CAAC;YAChD,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,OAAO,CAAC,IAAI,CAAC,YAAY,EAAE,EAAE,CAAC,CAAC;YAC3D,IAAI,CAAC,sBAAsB,CAAC,IAAI,CAAC,CAAC;QACpC,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,WAAW,CAAC,IAAI,CACd,4EAA4E,eAAe,CAAC,KAAK,CAAC,EAAE,CACrG,CAAC;QACJ,CAAC;IACH,CAAC;IAED;;OAEG;IACK,KAAK,CAAC,yBAAyB;QACrC,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,SAAS,EAAE,CAAC;YAC3B,MAAM,IAAI,KAAK,CACb,oCAAoC,IAAI,CAAC,SAAS,0BAA0B;gBAC1E,4DAA4D,CAC/D,CAAC;QACJ,CAAC;QACD,IAAI,CAAC,IAAI,CAAC,gBAAgB,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,CAAC;YAC7C,MAAM,IAAI,KAAK,CACb,oCAAoC,IAAI,CAAC,SAAS,8CAA8C;gBAC9F,6FAA6F,CAChG,CAAC;QACJ,CAAC;QAED,MAAM,UAAU,GAAoB;YAClC,QAAQ,EAAE,IAAI,CAAC,MAAM,CAAC,SAAS;YAC/B,YAAY,EAAE,IAAI,CAAC,MAAM,CAAC,aAAa;YACvC,gBAAgB,EAAE,IAAI,CAAC,gBAAgB;YACvC,QAAQ,EAAE,IAAI,CAAC,QAAQ;YACvB,MAAM,EAAE,IAAI,CAAC,MAAM;SACpB,CAAC;QAEF,MAAM,UAAU,GAAG,kBAAkB,EAAE,CAAC;QACxC,MAAM,aAAa,GAAG,cAAc,CAAC,UAAU,CAAC,WAAW,CAAC,CAAC;QAC7D,MAAM,cAAc,GAAG,mBAAmB,CAAC,UAAU,CAAC,KAAK,EAAE,aAAa,CAAC,CAAC;QAC5E,MAAM,YAAY,GAAG,MAAM,cAAc,CAAC,IAAI,CAAC;QAE/C,MAAM,OAAO,GAAG,qBAAqB,CACnC,UAAU,EACV,UAAU,EACV,YAAY;QACZ,eAAe,CAAC,SAAS,CAC1B,CAAC;QAEF,MAAM,OAAO,GAAG,MAAM,kBAAkB,CACtC,2CAA2C,IAAI,CAAC,SAAS,IAAI,CAC9D,CAAC;QACF,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,MAAM,IAAI,sBAAsB,CAAC,mCAAmC,CAAC,CAAC;QACxE,CAAC;QAED,UAAU,CAAC,YAAY,CACrB,MAAM,EACN;;CAEL;YACO;CACP;YACO,GAAG,OAAO;;CAEjB;YACO;CACP;YACO,6EAA6E,CAChF,CAAC;QAEF,IAAI,CAAC;YACH,MAAM,mBAAmB,CAAC,OAAO,CAAC,CAAC;QACrC,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,WAAW,CAAC,IAAI,CACd,uCAAuC,EACvC,eAAe,CAAC,KAAK,CAAC,CACvB,CAAC;QACJ,CAAC;QAED,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,cAAc,CAAC,QAAQ,CAAC;QAC/C,WAAW,CAAC,KAAK,CACf,yDAAyD,CAC1D,CAAC;QAEF,MAAM,aAAa,GAAG,MAAM,oBAAoB,CAC9C,UAAU,EACV,IAAI,EACJ,UAAU,CAAC,YAAY,EACvB,YAAY;QACZ,eAAe,CAAC,SAAS,CAC1B,CAAC;QAEF,IAAI,CAAC,aAAa,CAAC,YAAY,EAAE,CAAC;YAChC,MAAM,IAAI,KAAK,CAAC,8CAA8C,CAAC,CAAC;QAClE,CAAC;QAED,MAAM,KAAK,GAAG,IAAI,CAAC,YAAY,CAAC,aAAa,CAAC,CAAC;QAC/C,IAAI,CAAC,WAAW,GAAG,KAAK,CAAC;QACzB,MAAM,IAAI,CAAC,YAAY,EAAE,CAAC;QAE1B,WAAW,CAAC,KAAK,CAAC,kDAAkD,CAAC,CAAC;QACtE,OAAO,KAAK,CAAC;IACf,CAAC;IAED;;OAEG;IACK,YAAY,CAClB,QAMC,EACD,oBAA6B;QAE7B,MAAM,KAAK,GAAe;YACxB,WAAW,EAAE,QAAQ,CAAC,YAAY;YAClC,SAAS,EAAE,QAAQ,CAAC,UAAU,IAAI,QAAQ;YAC1C,YAAY,EAAE,QAAQ,CAAC,aAAa,IAAI,oBAAoB;YAC5D,KAAK,EAAE,QAAQ,CAAC,KAAK;SACtB,CAAC;QAEF,IAAI,QAAQ,CAAC,UAAU,EAAE,CAAC;YACxB,KAAK,CAAC,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,QAAQ,CAAC,UAAU,GAAG,IAAI,CAAC;QAC5D,CAAC;QAED,OAAO,KAAK,CAAC;IACf,CAAC;IAED;;OAEG;IACK,KAAK,CAAC,YAAY;QACxB,IAAI,CAAC,IAAI,CAAC,WAAW;YAAE,OAAO;QAC9B,MAAM,IAAI,CAAC,YAAY,CAAC,SAAS,CAC/B,IAAI,CAAC,SAAS,EACd,IAAI,CAAC,WAAW,EAChB,IAAI,CAAC,MAAM,CAAC,SAAS,EACrB,IAAI,CAAC,QAAQ,CACd,CAAC;IACJ,CAAC;CACF"}
+{"version":3,"file":"oauth2-provider.js","sourceRoot":"","sources":["../../../../src/agents/auth-provider/oauth2-provider.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,EAAoB,wBAAwB,EAAE,MAAM,oBAAoB,CAAC;AAEhF,OAAO,EAAE,mBAAmB,EAAE,MAAM,oBAAoB,CAAC;AAEzD,OAAO,EAAE,oBAAoB,EAAE,MAAM,kCAAkC,CAAC;AAExE,OAAO,EACL,kBAAkB,EAClB,mBAAmB,EACnB,cAAc,EACd,qBAAqB,EACrB,oBAAoB,EACpB,kBAAkB,GAEnB,MAAM,2BAA2B,CAAC;AACnC,OAAO,EAAE,mBAAmB,EAAE,MAAM,wCAAwC,CAAC;AAC7E,OAAO,EAAE,kBAAkB,EAAE,MAAM,4BAA4B,CAAC;AAChE,OAAO,EAAE,sBAAsB,EAAE,eAAe,EAAE,MAAM,uBAAuB,CAAC;AAChF,OAAO,EAAE,UAAU,EAAE,MAAM,uBAAuB,CAAC;AACnD,OAAO,EAAE,WAAW,EAAE,MAAM,4BAA4B,CAAC;AACzD,OAAO,EAAE,OAAO,EAAE,MAAM,yBAAyB,CAAC;AAElD;;;;;;GAMG;AACH,MAAM,OAAO,kBAAmB,SAAQ,mBAAmB;IAatC;IACA;IAEA;IAfV,IAAI,GAAG,QAAQ,CAAC;IAER,YAAY,CAAuB;IAC5C,WAAW,GAAsB,IAAI,CAAC;IACtC,kBAAkB,GAA+B,IAAI,CAAC;IAE9D,gEAAgE;IACxD,gBAAgB,CAAqB;IACrC,QAAQ,CAAqB;IAC7B,MAAM,CAAuB;IAErC,YACmB,MAAwB,EACxB,SAAiB,EAClC,SAAqB,EACJ,YAAqB;QAEtC,KAAK,EAAE,CAAC;QALS,WAAM,GAAN,MAAM,CAAkB;QACxB,cAAS,GAAT,SAAS,CAAQ;QAEjB,iBAAY,GAAZ,YAAY,CAAS;QAGtC,IAAI,CAAC,YAAY,GAAG,IAAI,oBAAoB,CAC1C,OAAO,CAAC,qBAAqB,EAAE,EAC/B,gBAAgB,CACjB,CAAC;QAEF,yBAAyB;QACzB,IAAI,CAAC,gBAAgB,GAAG,MAAM,CAAC,iBAAiB,CAAC;QACjD,IAAI,CAAC,QAAQ,GAAG,MAAM,CAAC,SAAS,CAAC;QACjC,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC,MAAM,CAAC;QAE5B,iFAAiF;QACjF,IAAI,CAAC,sBAAsB,CAAC,SAAS,CAAC,CAAC;IACzC,CAAC;IAED;;;OAGG;IACM,KAAK,CAAC,UAAU;QACvB,0EAA0E;QAC1E,IAAI,CAAC,CAAC,IAAI,CAAC,gBAAgB,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,IAAI,CAAC,YAAY,EAAE,CAAC;YACpE,MAAM,IAAI,CAAC,sBAAsB,EAAE,CAAC;QACtC,CAAC;QAED,MAAM,WAAW,GAAG,MAAM,IAAI,CAAC,YAAY,CAAC,cAAc,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;QAC3E,IAAI,WAAW,IAAI,CAAC,IAAI,CAAC,YAAY,CAAC,cAAc,CAAC,WAAW,CAAC,KAAK,CAAC,EAAE,CAAC;YACxE,IAAI,CAAC,WAAW,GAAG,WAAW,CAAC,KAAK,CAAC;YACrC,WAAW,CAAC,KAAK,CACf,uDAAuD,IAAI,CAAC,SAAS,GAAG,CACzE,CAAC;QACJ,CAAC;IACH,CAAC;IAED;;;OAGG;IACM,KAAK,CAAC,OAAO;QACpB,sEAAsE;QACtE,IACE,IAAI,CAAC,WAAW;YAChB,CAAC,IAAI,CAAC,YAAY,CAAC,cAAc,CAAC,IAAI,CAAC,WAAW,CAAC,EACnD,CAAC;YACD,IAAI,CAAC,cAAc,GAAG,CAAC,CAAC;YACxB,OAAO,EAAE,aAAa,EAAE,UAAU,IAAI,CAAC,WAAW,CAAC,WAAW,EAAE,EAAE,CAAC;QACrE,CAAC;QAED,oEAAoE;QACpE,IAAI,CAAC,IAAI,CAAC,kBAAkB,EAAE,CAAC;YAC7B,IAAI,CAAC,kBAAkB,GAAG,IAAI,CAAC,YAAY,EAAE,CAAC,OAAO,CAAC,GAAG,EAAE;gBACzD,IAAI,CAAC,kBAAkB,GAAG,IAAI,CAAC;YACjC,CAAC,CAAC,CAAC;QACL,CAAC;QAED,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,kBAAkB,CAAC;QAC5C,IAAI,CAAC,cAAc,GAAG,CAAC,CAAC;QACxB,OAAO,EAAE,aAAa,EAAE,UAAU,KAAK,CAAC,WAAW,EAAE,EAAE,CAAC;IAC1D,CAAC;IAED;;OAEG;IACK,KAAK,CAAC,YAAY;QACxB,6DAA6D;QAC7D,IACE,IAAI,CAAC,WAAW,EAAE,YAAY;YAC9B,IAAI,CAAC,QAAQ;YACb,IAAI,CAAC,MAAM,CAAC,SAAS,EACrB,CAAC;YACD,IAAI,CAAC;gBACH,MAAM,SAAS,GAAG,MAAM,kBAAkB,CACxC;oBACE,QAAQ,EAAE,IAAI,CAAC,MAAM,CAAC,SAAS;oBAC/B,YAAY,EAAE,IAAI,CAAC,MAAM,CAAC,aAAa;oBACvC,MAAM,EAAE,IAAI,CAAC,MAAM;iBACpB,EACD,IAAI,CAAC,WAAW,CAAC,YAAY,EAC7B,IAAI,CAAC,QAAQ,CACd,CAAC;gBAEF,IAAI,CAAC,WAAW,GAAG,IAAI,CAAC,YAAY,CAClC,SAAS,EACT,IAAI,CAAC,WAAW,CAAC,YAAY,CAC9B,CAAC;gBACF,MAAM,IAAI,CAAC,YAAY,EAAE,CAAC;gBAC1B,OAAO,IAAI,CAAC,WAAW,CAAC;YAC1B,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,WAAW,CAAC,KAAK,CACf,0EAA0E,eAAe,CAAC,KAAK,CAAC,EAAE,CACnG,CAAC;gBACF,gEAAgE;gBAChE,IAAI,CAAC,WAAW,GAAG,IAAI,CAAC;gBACxB,MAAM,IAAI,CAAC,YAAY,CAAC,iBAAiB,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;YAC5D,CAAC;QACH,CAAC;QAED,sDAAsD;QACtD,IAAI,CAAC,WAAW,GAAG,MAAM,IAAI,CAAC,yBAAyB,EAAE,CAAC;QAC1D,OAAO,IAAI,CAAC,WAAW,CAAC;IAC1B,CAAC;IAED;;OAEG;IACO,iBAAiB;QACzB,OAAO,mBAAmB,CAAC,gBAAgB,CAAC;IAC9C,CAAC;IAED;;OAEG;IACM,KAAK,CAAC,sBAAsB,CACnC,GAAgB,EAChB,GAAa;QAEb,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;YAC7C,IAAI,CAAC,cAAc,GAAG,CAAC,CAAC;YACxB,OAAO,SAAS,CAAC;QACnB,CAAC;QAED,MAAM,UAAU,GAAG,IAAI,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;QAC5C,MAAM,QAAQ,GAAG,UAAU,CAAC,GAAG,CAAC,eAAe,CAAC,EAAE,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;QAEhE,sFAAsF;QACtF,oFAAoF;QACpF,iFAAiF;QACjF,4EAA4E;QAC5E,IACE,QAAQ;YACR,CAAC,CAAC,IAAI,CAAC,WAAW,IAAI,QAAQ,KAAK,IAAI,CAAC,WAAW,CAAC,WAAW,CAAC,EAChE,CAAC;YACD,WAAW,CAAC,KAAK,CACf,mGAAmG,CACpG,CAAC;YACF,MAAM,UAAU,GAAG,IAAI,CAAC,cAAc,CAAC;YACvC,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,OAAO,EAAE,CAAC;YACrC,IAAI,CAAC,cAAc,GAAG,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,cAAc,EAAE,UAAU,CAAC,CAAC;YAChE,OAAO,OAAO,CAAC;QACjB,CAAC;QAED,IAAI,IAAI,CAAC,cAAc,IAAI,IAAI,CAAC,iBAAiB,EAAE,EAAE,CAAC;YACpD,OAAO,SAAS,CAAC;QACnB,CAAC;QACD,MAAM,cAAc,GAAG,IAAI,CAAC,cAAc,GAAG,CAAC,CAAC;QAC/C,IAAI,CAAC,cAAc,GAAG,cAAc,CAAC;QAErC,WAAW,CAAC,KAAK,CACf,yEAAyE,CAC1E,CAAC;QACF,IAAI,CAAC,WAAW,GAAG,IAAI,CAAC;QACxB,MAAM,IAAI,CAAC,YAAY,CAAC,iBAAiB,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;QAE1D,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,OAAO,EAAE,CAAC;QACrC,IAAI,CAAC,cAAc,GAAG,cAAc,CAAC;QACrC,OAAO,OAAO,CAAC;IACjB,CAAC;IAED,8EAA8E;IAC9E,kBAAkB;IAClB,8EAA8E;IAE9E;;;OAGG;IACK,sBAAsB,CAC5B,SAAqD;QAErD,IAAI,CAAC,SAAS,EAAE,eAAe;YAAE,OAAO;QAExC,KAAK,MAAM,MAAM,IAAI,MAAM,CAAC,MAAM,CAAC,SAAS,CAAC,eAAe,CAAC,EAAE,CAAC;YAC9D,IAAI,MAAM,CAAC,IAAI,KAAK,QAAQ,IAAI,MAAM,CAAC,KAAK,CAAC,iBAAiB,EAAE,CAAC;gBAC/D,MAAM,IAAI,GAAG,MAAM,CAAC,KAAK,CAAC,iBAAiB,CAAC;gBAC5C,IAAI,CAAC,gBAAgB,KAAK,IAAI,CAAC,gBAAgB,CAAC;gBAChD,IAAI,CAAC,QAAQ,KAAK,IAAI,CAAC,QAAQ,CAAC;gBAChC,IAAI,CAAC,MAAM,KAAK,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;gBACzC,MAAM,CAAC,iCAAiC;YAC1C,CAAC;QACH,CAAC;IACH,CAAC;IAED;;;OAGG;IACK,KAAK,CAAC,sBAAsB;QAClC,IAAI,CAAC,IAAI,CAAC,YAAY;YAAE,OAAO;QAE/B,IAAI,CAAC;YACH,WAAW,CAAC,KAAK,CACf,iDAAiD,IAAI,CAAC,YAAY,EAAE,CACrE,CAAC;YACF,MAAM,QAAQ,GAAG,IAAI,wBAAwB,EAAE,CAAC;YAChD,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,OAAO,CAAC,IAAI,CAAC,YAAY,EAAE,EAAE,CAAC,CAAC;YAC3D,IAAI,CAAC,sBAAsB,CAAC,IAAI,CAAC,CAAC;QACpC,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,WAAW,CAAC,IAAI,CACd,4EAA4E,eAAe,CAAC,KAAK,CAAC,EAAE,CACrG,CAAC;QACJ,CAAC;IACH,CAAC;IAED;;OAEG;IACK,KAAK,CAAC,yBAAyB;QACrC,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,SAAS,EAAE,CAAC;YAC3B,MAAM,IAAI,KAAK,CACb,oCAAoC,IAAI,CAAC,SAAS,0BAA0B;gBAC1E,4DAA4D,CAC/D,CAAC;QACJ,CAAC;QACD,IAAI,CAAC,IAAI,CAAC,gBAAgB,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,CAAC;YAC7C,MAAM,IAAI,KAAK,CACb,oCAAoC,IAAI,CAAC,SAAS,8CAA8C;gBAC9F,6FAA6F,CAChG,CAAC;QACJ,CAAC;QAED,MAAM,UAAU,GAAoB;YAClC,QAAQ,EAAE,IAAI,CAAC,MAAM,CAAC,SAAS;YAC/B,YAAY,EAAE,IAAI,CAAC,MAAM,CAAC,aAAa;YACvC,gBAAgB,EAAE,IAAI,CAAC,gBAAgB;YACvC,QAAQ,EAAE,IAAI,CAAC,QAAQ;YACvB,MAAM,EAAE,IAAI,CAAC,MAAM;SACpB,CAAC;QAEF,MAAM,UAAU,GAAG,kBAAkB,EAAE,CAAC;QACxC,MAAM,aAAa,GAAG,cAAc,CAAC,UAAU,CAAC,WAAW,CAAC,CAAC;QAC7D,MAAM,cAAc,GAAG,mBAAmB,CAAC,UAAU,CAAC,KAAK,EAAE,aAAa,CAAC,CAAC;QAC5E,MAAM,YAAY,GAAG,MAAM,cAAc,CAAC,IAAI,CAAC;QAE/C,MAAM,OAAO,GAAG,qBAAqB,CACnC,UAAU,EACV,UAAU,EACV,YAAY;QACZ,eAAe,CAAC,SAAS,CAC1B,CAAC;QAEF,MAAM,OAAO,GAAG,MAAM,kBAAkB,CACtC,2CAA2C,IAAI,CAAC,SAAS,IAAI,CAC9D,CAAC;QACF,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,MAAM,WAAW,GAAG,IAAI,sBAAsB,CAC5C,mCAAmC,CACpC,CAAC;YACF,cAAc,CAAC,QAAQ,CAAC,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;YACxC,cAAc,CAAC,MAAM,EAAE,CAAC,WAAW,CAAC,CAAC;YACrC,MAAM,WAAW,CAAC;QACpB,CAAC;QAED,UAAU,CAAC,YAAY,CACrB,MAAM,EACN;;CAEL;YACO;CACP;YACO,GAAG,OAAO;;CAEjB;YACO;CACP;YACO,6EAA6E,CAChF,CAAC;QAEF,IAAI,CAAC;YACH,MAAM,mBAAmB,CAAC,OAAO,CAAC,CAAC;QACrC,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,WAAW,CAAC,IAAI,CACd,uCAAuC,EACvC,eAAe,CAAC,KAAK,CAAC,CACvB,CAAC;QACJ,CAAC;QAED,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,cAAc,CAAC,QAAQ,CAAC;QAC/C,WAAW,CAAC,KAAK,CACf,yDAAyD,CAC1D,CAAC;QAEF,MAAM,aAAa,GAAG,MAAM,oBAAoB,CAC9C,UAAU,EACV,IAAI,EACJ,UAAU,CAAC,YAAY,EACvB,YAAY;QACZ,eAAe,CAAC,SAAS,CAC1B,CAAC;QAEF,IAAI,CAAC,aAAa,CAAC,YAAY,EAAE,CAAC;YAChC,MAAM,IAAI,KAAK,CAAC,8CAA8C,CAAC,CAAC;QAClE,CAAC;QAED,MAAM,KAAK,GAAG,IAAI,CAAC,YAAY,CAAC,aAAa,CAAC,CAAC;QAC/C,IAAI,CAAC,WAAW,GAAG,KAAK,CAAC;QACzB,MAAM,IAAI,CAAC,YAAY,EAAE,CAAC;QAE1B,WAAW,CAAC,KAAK,CAAC,kDAAkD,CAAC,CAAC;QACtE,OAAO,KAAK,CAAC;IACf,CAAC;IAED;;OAEG;IACK,YAAY,CAClB,QAMC,EACD,oBAA6B;QAE7B,MAAM,KAAK,GAAe;YACxB,WAAW,EAAE,QAAQ,CAAC,YAAY;YAClC,SAAS,EAAE,QAAQ,CAAC,UAAU,IAAI,QAAQ;YAC1C,YAAY,EAAE,QAAQ,CAAC,aAAa,IAAI,oBAAoB;YAC5D,KAAK,EAAE,QAAQ,CAAC,KAAK;SACtB,CAAC;QAEF,IAAI,QAAQ,CAAC,UAAU,EAAE,CAAC;YACxB,KAAK,CAAC,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,QAAQ,CAAC,UAAU,GAAG,IAAI,CAAC;QAC5D,CAAC;QAED,OAAO,KAAK,CAAC;IACf,CAAC;IAED;;OAEG;IACK,KAAK,CAAC,YAAY;QACxB,IAAI,CAAC,IAAI,CAAC,WAAW;YAAE,OAAO;QAC9B,MAAM,IAAI,CAAC,YAAY,CAAC,SAAS,CAC/B,IAAI,CAAC,SAAS,EACd,IAAI,CAAC,WAAW,EAChB,IAAI,CAAC,MAAM,CAAC,SAAS,EACrB,IAAI,CAAC,QAAQ,CACd,CAAC;IACJ,CAAC;CACF"}