@google/gemini-cli 0.65.0-preview.0 → 0.66.0-nightly.20261017.ged96faedf

package/bundle/{liteRtServerManager-JCTYJBV5.js → liteRtServerManager-KAPXZ3EU.js}

@@ -3,11 +3,11 @@ import {
   DEFAULT_PORT,
   getBinaryPath,
   isServerRunning
-} from "./chunk-2WVLIJA5.js";
-import "./chunk-NL7ZHGCH.js";
+} from "./chunk-NU74STQ5.js";
+import "./chunk-5VQUE3OF.js";
 import {
   debugLogger
-} from "./chunk-K7AA35SP.js";
+} from "./chunk-QCWGLPCO.js";
 import "./chunk-664ZODQF.js";
 import "./chunk-IUUIT4SU.js";
 import "./chunk-L6PII3GR.js";
@@ -41,7 +41,7 @@ var LiteRtServerManager = class {
       `[LiteRtServerManager] Auto-starting LiteRT server on port ${port}...`
     );
     try {
-      const { startServer } = await import("./start-AGMBPY3O.js");
+      const { startServer } = await import("./start-5GIUIER3.js");
       const started = await startServer(binaryPath, port);
       if (started) {
         debugLogger.log(`[LiteRtServerManager] Server started on port ${port}`);

package/bundle/{liteRtServerManager-JERG6KYC.js → liteRtServerManager-MSJIWMWP.js}

@@ -3,11 +3,11 @@ import {
   DEFAULT_PORT,
   getBinaryPath,
   isServerRunning
-} from "./chunk-V2R74WAG.js";
-import "./chunk-QJK54DSE.js";
+} from "./chunk-XY2QSBID.js";
+import "./chunk-464WBVYM.js";
 import {
   debugLogger
-} from "./chunk-K7NOVQ6G.js";
+} from "./chunk-ZFQ347ZN.js";
 import "./chunk-664ZODQF.js";
 import "./chunk-IUUIT4SU.js";
 import "./chunk-L6PII3GR.js";
@@ -41,7 +41,7 @@ var LiteRtServerManager = class {
       `[LiteRtServerManager] Auto-starting LiteRT server on port ${port}...`
     );
     try {
-      const { startServer } = await import("./start-MVIPJNQ5.js");
+      const { startServer } = await import("./start-APIVGXZ3.js");
       const started = await startServer(binaryPath, port);
       if (started) {
         debugLogger.log(`[LiteRtServerManager] Server started on port ${port}`);

package/bundle/{liteRtServerManager-22ISMNN2.js → liteRtServerManager-PD2N3GLD.js}

@@ -3,11 +3,11 @@ import {
   DEFAULT_PORT,
   getBinaryPath,
   isServerRunning
-} from "./chunk-43EXRO7A.js";
-import "./chunk-HLOOE7YN.js";
+} from "./chunk-H4U2CWBQ.js";
+import "./chunk-MH4KAY5W.js";
 import {
   debugLogger
-} from "./chunk-TP236FKO.js";
+} from "./chunk-YPLMNSM4.js";
 import "./chunk-664ZODQF.js";
 import "./chunk-IUUIT4SU.js";
 import "./chunk-L6PII3GR.js";
@@ -41,7 +41,7 @@ var LiteRtServerManager = class {
       `[LiteRtServerManager] Auto-starting LiteRT server on port ${port}...`
     );
     try {
-      const { startServer } = await import("./start-RZWSVT55.js");
+      const { startServer } = await import("./start-GJ4TH4KZ.js");
       const started = await startServer(binaryPath, port);
       if (started) {
         debugLogger.log(`[LiteRtServerManager] Server started on port ${port}`);

package/bundle/liteRtServerManager-X5SCFYXM.js

@@ -0,0 +1,65 @@
+const require = (await import('node:module')).createRequire(import.meta.url); const __chunk_filename = (await import('node:url')).fileURLToPath(import.meta.url); const __chunk_dirname = (await import('node:path')).dirname(__chunk_filename);
+import {
+  DEFAULT_PORT,
+  getBinaryPath,
+  isServerRunning
+} from "./chunk-BUG4N6U5.js";
+import "./chunk-LDGJJCVW.js";
+import {
+  debugLogger
+} from "./chunk-YOI4DS3V.js";
+import "./chunk-664ZODQF.js";
+import "./chunk-IUUIT4SU.js";
+import "./chunk-L6PII3GR.js";
+import "./chunk-34MYV7JD.js";
+
+// packages/cli/src/services/liteRtServerManager.ts
+import fs from "node:fs";
+var LiteRtServerManager = class {
+  static async ensureRunning(gemmaSettings) {
+    if (!gemmaSettings?.enabled) return;
+    if (gemmaSettings.autoStartServer === false) return;
+    const binaryPath = getBinaryPath();
+    if (!binaryPath || !fs.existsSync(binaryPath)) {
+      debugLogger.log(
+        '[LiteRtServerManager] Binary not installed, skipping auto-start. Run "gemini gemma setup".'
+      );
+      return;
+    }
+    const port = parseInt(
+      gemmaSettings.classifier?.host?.match(/:(\d+)/)?.[1] ?? "",
+      10
+    ) || DEFAULT_PORT;
+    const running = await isServerRunning(port);
+    if (running) {
+      debugLogger.log(
+        `[LiteRtServerManager] Server already running on port ${port}`
+      );
+      return;
+    }
+    debugLogger.log(
+      `[LiteRtServerManager] Auto-starting LiteRT server on port ${port}...`
+    );
+    try {
+      const { startServer } = await import("./start-WDS52ZNE.js");
+      const started = await startServer(binaryPath, port);
+      if (started) {
+        debugLogger.log(`[LiteRtServerManager] Server started on port ${port}`);
+      } else {
+        debugLogger.warn(
+          `[LiteRtServerManager] Server may not have started correctly on port ${port}`
+        );
+      }
+    } catch (error) {
+      debugLogger.warn("[LiteRtServerManager] Auto-start failed:", error);
+    }
+  }
+};
+export {
+  LiteRtServerManager
+};
+/**
+ * @license
+ * Copyright 2026 Google LLC
+ * SPDX-License-Identifier: Apache-2.0
+ */

package/bundle/{oauth2-provider-XRUER2XR.js → oauth2-provider-IUN6Z4IO.js}

@@ -16,7 +16,7 @@ import {
   openBrowserSecurely,
   refreshAccessToken,
   startCallbackServer
-} from "./chunk-K7AA35SP.js";
+} from "./chunk-YPLMNSM4.js";
 import "./chunk-664ZODQF.js";
 import "./chunk-IUUIT4SU.js";
 import "./chunk-L6PII3GR.js";

package/bundle/{oauth2-provider-477UJQX6.js → oauth2-provider-MKJIQNWP.js}

@@ -16,36 +16,36 @@ import {
   openBrowserSecurely,
   refreshAccessToken,
   startCallbackServer
-} from "./chunk-TP236FKO.js";
+} from "./chunk-YOI4DS3V.js";
 import "./chunk-664ZODQF.js";
 import "./chunk-IUUIT4SU.js";
 import "./chunk-L6PII3GR.js";
 import "./chunk-34MYV7JD.js";
 
-// packages/core/src/agents/auth-provider/oauth2-provider.ts
+// packages/core/dist/src/agents/auth-provider/oauth2-provider.js
 var OAuth2AuthProvider = class extends BaseA2AAuthProvider {
+  config;
+  agentName;
+  agentCardUrl;
+  type = "oauth2";
+  tokenStorage;
+  cachedToken = null;
+  pendingAuthPromise = null;
+  /** Resolved OAuth URLs — may come from config or agent card. */
+  authorizationUrl;
+  tokenUrl;
+  scopes;
   constructor(config, agentName, agentCard, agentCardUrl) {
     super();
     this.config = config;
     this.agentName = agentName;
     this.agentCardUrl = agentCardUrl;
-    this.tokenStorage = new MCPOAuthTokenStorage(
-      Storage.getA2AOAuthTokensPath(),
-      "gemini-cli-a2a"
-    );
+    this.tokenStorage = new MCPOAuthTokenStorage(Storage.getA2AOAuthTokensPath(), "gemini-cli-a2a");
     this.authorizationUrl = config.authorization_url;
     this.tokenUrl = config.token_url;
     this.scopes = config.scopes;
     this.mergeAgentCardDefaults(agentCard);
   }
-  type = "oauth2";
-  tokenStorage;
-  cachedToken = null;
-  pendingAuthPromise = null;
-  /** Resolved OAuth URLs — may come from config or agent card. */
-  authorizationUrl;
-  tokenUrl;
-  scopes;
   /**
    * Initialize the provider by loading any persisted token from storage.
    * Also discovers OAuth URLs from the agent card if not yet resolved.
@@ -57,9 +57,7 @@ var OAuth2AuthProvider = class extends BaseA2AAuthProvider {
     const credentials = await this.tokenStorage.getCredentials(this.agentName);
     if (credentials && !this.tokenStorage.isTokenExpired(credentials.token)) {
       this.cachedToken = credentials.token;
-      debugLogger.debug(
-        `[OAuth2AuthProvider] Loaded valid cached token for "${this.agentName}"`
-      );
+      debugLogger.debug(`[OAuth2AuthProvider] Loaded valid cached token for "${this.agentName}"`);
     }
   }
   /**
@@ -86,25 +84,16 @@ var OAuth2AuthProvider = class extends BaseA2AAuthProvider {
   async acquireToken() {
     if (this.cachedToken?.refreshToken && this.tokenUrl && this.config.client_id) {
       try {
-        const refreshed = await refreshAccessToken(
-          {
-            clientId: this.config.client_id,
-            clientSecret: this.config.client_secret,
-            scopes: this.scopes
-          },
-          this.cachedToken.refreshToken,
-          this.tokenUrl
-        );
-        this.cachedToken = this.toOAuthToken(
-          refreshed,
-          this.cachedToken.refreshToken
-        );
+        const refreshed = await refreshAccessToken({
+          clientId: this.config.client_id,
+          clientSecret: this.config.client_secret,
+          scopes: this.scopes
+        }, this.cachedToken.refreshToken, this.tokenUrl);
+        this.cachedToken = this.toOAuthToken(refreshed, this.cachedToken.refreshToken);
         await this.persistToken();
         return this.cachedToken;
       } catch (error) {
-        debugLogger.debug(
-          `[OAuth2AuthProvider] Refresh failed, falling back to interactive flow: ${getErrorMessage(error)}`
-        );
+        debugLogger.debug(`[OAuth2AuthProvider] Refresh failed, falling back to interactive flow: ${getErrorMessage(error)}`);
         this.cachedToken = null;
         await this.tokenStorage.deleteCredentials(this.agentName);
       }
@@ -129,9 +118,7 @@ var OAuth2AuthProvider = class extends BaseA2AAuthProvider {
     const reqHeaders = new Headers(req.headers);
     const reqToken = reqHeaders.get("Authorization")?.split(" ")[1];
     if (reqToken && (!this.cachedToken || reqToken !== this.cachedToken.accessToken)) {
-      debugLogger.debug(
-        "[OAuth2AuthProvider] Token already cleared or updated by another request, retrying with new token"
-      );
+      debugLogger.debug("[OAuth2AuthProvider] Token already cleared or updated by another request, retrying with new token");
       const retryCount = this.authRetryCount;
       const headers2 = await this.headers();
       this.authRetryCount = Math.max(this.authRetryCount, retryCount);
@@ -142,9 +129,7 @@ var OAuth2AuthProvider = class extends BaseA2AAuthProvider {
     }
     const nextRetryCount = this.authRetryCount + 1;
     this.authRetryCount = nextRetryCount;
-    debugLogger.debug(
-      "[OAuth2AuthProvider] Auth failure, clearing token and re-authenticating"
-    );
+    debugLogger.debug("[OAuth2AuthProvider] Auth failure, clearing token and re-authenticating");
     this.cachedToken = null;
     await this.tokenStorage.deleteCredentials(this.agentName);
     const headers = await this.headers();
@@ -159,7 +144,8 @@ var OAuth2AuthProvider = class extends BaseA2AAuthProvider {
    * `securitySchemes` when not already provided via user config.
    */
   mergeAgentCardDefaults(agentCard) {
-    if (!agentCard?.securitySchemes) return;
+    if (!agentCard?.securitySchemes)
+      return;
     for (const scheme of Object.values(agentCard.securitySchemes)) {
       if (scheme.type === "oauth2" && scheme.flows.authorizationCode) {
         const flow = scheme.flows.authorizationCode;
@@ -175,18 +161,15 @@ var OAuth2AuthProvider = class extends BaseA2AAuthProvider {
    * (which normalizes proto-format cards) and extract OAuth2 URLs.
    */
   async fetchAgentCardDefaults() {
-    if (!this.agentCardUrl) return;
+    if (!this.agentCardUrl)
+      return;
     try {
-      debugLogger.debug(
-        `[OAuth2AuthProvider] Fetching agent card from ${this.agentCardUrl}`
-      );
+      debugLogger.debug(`[OAuth2AuthProvider] Fetching agent card from ${this.agentCardUrl}`);
       const resolver = new DefaultAgentCardResolver();
       const card = await resolver.resolve(this.agentCardUrl, "");
       this.mergeAgentCardDefaults(card);
     } catch (error) {
-      debugLogger.warn(
-        `[OAuth2AuthProvider] Could not fetch agent card for OAuth URL discovery: ${getErrorMessage(error)}`
-      );
+      debugLogger.warn(`[OAuth2AuthProvider] Could not fetch agent card for OAuth URL discovery: ${getErrorMessage(error)}`);
     }
   }
   /**
@@ -194,14 +177,10 @@ var OAuth2AuthProvider = class extends BaseA2AAuthProvider {
    */
   async authenticateInteractively() {
     if (!this.config.client_id) {
-      throw new Error(
-        `OAuth2 authentication for agent "${this.agentName}" requires a client_id. Add client_id to the auth config in your agent definition.`
-      );
+      throw new Error(`OAuth2 authentication for agent "${this.agentName}" requires a client_id. Add client_id to the auth config in your agent definition.`);
     }
     if (!this.authorizationUrl || !this.tokenUrl) {
-      throw new Error(
-        `OAuth2 authentication for agent "${this.agentName}" requires authorization_url and token_url. Provide them in the auth config or ensure the agent card exposes an oauth2 security scheme.`
-      );
+      throw new Error(`OAuth2 authentication for agent "${this.agentName}" requires authorization_url and token_url. Provide them in the auth config or ensure the agent card exposes an oauth2 security scheme.`);
     }
     const flowConfig = {
       clientId: this.config.client_id,
@@ -220,42 +199,29 @@ var OAuth2AuthProvider = class extends BaseA2AAuthProvider {
       redirectPort,
       /* resource= */
       void 0
-      // No MCP resource parameter for A2A.
-    );
-    const consent = await getConsentForOauth(
-      `Authentication required for A2A agent: '${this.agentName}'.`
     );
+    const consent = await getConsentForOauth(`Authentication required for A2A agent: '${this.agentName}'.`);
     if (!consent) {
-      const cancelError = new FatalCancellationError(
-        "Authentication cancelled by user."
-      );
+      const cancelError = new FatalCancellationError("Authentication cancelled by user.");
       callbackServer.response.catch(() => {
       });
       callbackServer.cancel?.(cancelError);
       throw cancelError;
     }
-    coreEvents.emitFeedback(
-      "info",
-      `\u2192 Opening your browser for OAuth sign-in...
+    coreEvents.emitFeedback("info", `\u2192 Opening your browser for OAuth sign-in...
 
 If the browser does not open, copy and paste this URL into your browser:
 ${authUrl}
 
 \u{1F4A1} TIP: Triple-click to select the entire URL, then copy and paste it into your browser.
-\u26A0\uFE0F  Make sure to copy the COMPLETE URL - it may wrap across multiple lines.`
-    );
+\u26A0\uFE0F  Make sure to copy the COMPLETE URL - it may wrap across multiple lines.`);
     try {
       await openBrowserSecurely(authUrl);
     } catch (error) {
-      debugLogger.warn(
-        "Failed to open browser automatically:",
-        getErrorMessage(error)
-      );
+      debugLogger.warn("Failed to open browser automatically:", getErrorMessage(error));
     }
     const { code } = await callbackServer.response;
-    debugLogger.debug(
-      "\u2713 Authorization code received, exchanging for tokens..."
-    );
+    debugLogger.debug("\u2713 Authorization code received, exchanging for tokens...");
     const tokenResponse = await exchangeCodeForToken(
       flowConfig,
       code,
@@ -292,13 +258,9 @@ ${authUrl}
    * Persist the current cached token to disk.
    */
   async persistToken() {
-    if (!this.cachedToken) return;
-    await this.tokenStorage.saveToken(
-      this.agentName,
-      this.cachedToken,
-      this.config.client_id,
-      this.tokenUrl
-    );
+    if (!this.cachedToken)
+      return;
+    await this.tokenStorage.saveToken(this.agentName, this.cachedToken, this.config.client_id, this.tokenUrl);
   }
 };
 export {

package/bundle/{oauth2-provider-MKWWBW4K.js → oauth2-provider-RMF7U2UN.js}

@@ -16,7 +16,7 @@ import {
   openBrowserSecurely,
   refreshAccessToken,
   startCallbackServer
-} from "./chunk-K7NOVQ6G.js";
+} from "./chunk-QCWGLPCO.js";
 import "./chunk-664ZODQF.js";
 import "./chunk-IUUIT4SU.js";
 import "./chunk-L6PII3GR.js";

package/bundle/oauth2-provider-ZM5GWCNX.js

@@ -0,0 +1,273 @@
+const require = (await import('node:module')).createRequire(import.meta.url); const __chunk_filename = (await import('node:url')).fileURLToPath(import.meta.url); const __chunk_dirname = (await import('node:path')).dirname(__chunk_filename);
+import {
+  BaseA2AAuthProvider,
+  DefaultAgentCardResolver,
+  FatalCancellationError,
+  MCPOAuthTokenStorage,
+  Storage,
+  buildAuthorizationUrl,
+  coreEvents,
+  debugLogger,
+  exchangeCodeForToken,
+  generatePKCEParams,
+  getConsentForOauth,
+  getErrorMessage,
+  getPortFromUrl,
+  openBrowserSecurely,
+  refreshAccessToken,
+  startCallbackServer
+} from "./chunk-ZFQ347ZN.js";
+import "./chunk-664ZODQF.js";
+import "./chunk-IUUIT4SU.js";
+import "./chunk-L6PII3GR.js";
+import "./chunk-34MYV7JD.js";
+
+// packages/core/dist/src/agents/auth-provider/oauth2-provider.js
+var OAuth2AuthProvider = class extends BaseA2AAuthProvider {
+  config;
+  agentName;
+  agentCardUrl;
+  type = "oauth2";
+  tokenStorage;
+  cachedToken = null;
+  pendingAuthPromise = null;
+  /** Resolved OAuth URLs — may come from config or agent card. */
+  authorizationUrl;
+  tokenUrl;
+  scopes;
+  constructor(config, agentName, agentCard, agentCardUrl) {
+    super();
+    this.config = config;
+    this.agentName = agentName;
+    this.agentCardUrl = agentCardUrl;
+    this.tokenStorage = new MCPOAuthTokenStorage(Storage.getA2AOAuthTokensPath(), "gemini-cli-a2a");
+    this.authorizationUrl = config.authorization_url;
+    this.tokenUrl = config.token_url;
+    this.scopes = config.scopes;
+    this.mergeAgentCardDefaults(agentCard);
+  }
+  /**
+   * Initialize the provider by loading any persisted token from storage.
+   * Also discovers OAuth URLs from the agent card if not yet resolved.
+   */
+  async initialize() {
+    if ((!this.authorizationUrl || !this.tokenUrl) && this.agentCardUrl) {
+      await this.fetchAgentCardDefaults();
+    }
+    const credentials = await this.tokenStorage.getCredentials(this.agentName);
+    if (credentials && !this.tokenStorage.isTokenExpired(credentials.token)) {
+      this.cachedToken = credentials.token;
+      debugLogger.debug(`[OAuth2AuthProvider] Loaded valid cached token for "${this.agentName}"`);
+    }
+  }
+  /**
+   * Return an Authorization header with a valid Bearer token.
+   * Refreshes or triggers interactive auth as needed, deduplicating concurrent requests.
+   */
+  async headers() {
+    if (this.cachedToken && !this.tokenStorage.isTokenExpired(this.cachedToken)) {
+      this.authRetryCount = 0;
+      return { Authorization: `Bearer ${this.cachedToken.accessToken}` };
+    }
+    if (!this.pendingAuthPromise) {
+      this.pendingAuthPromise = this.acquireToken().finally(() => {
+        this.pendingAuthPromise = null;
+      });
+    }
+    const token = await this.pendingAuthPromise;
+    this.authRetryCount = 0;
+    return { Authorization: `Bearer ${token.accessToken}` };
+  }
+  /**
+   * Refresh an expired token or run interactive browser-based authentication.
+   */
+  async acquireToken() {
+    if (this.cachedToken?.refreshToken && this.tokenUrl && this.config.client_id) {
+      try {
+        const refreshed = await refreshAccessToken({
+          clientId: this.config.client_id,
+          clientSecret: this.config.client_secret,
+          scopes: this.scopes
+        }, this.cachedToken.refreshToken, this.tokenUrl);
+        this.cachedToken = this.toOAuthToken(refreshed, this.cachedToken.refreshToken);
+        await this.persistToken();
+        return this.cachedToken;
+      } catch (error) {
+        debugLogger.debug(`[OAuth2AuthProvider] Refresh failed, falling back to interactive flow: ${getErrorMessage(error)}`);
+        this.cachedToken = null;
+        await this.tokenStorage.deleteCredentials(this.agentName);
+      }
+    }
+    this.cachedToken = await this.authenticateInteractively();
+    return this.cachedToken;
+  }
+  /**
+   * Return the maximum number of consecutive authentication retries allowed.
+   */
+  getMaxAuthRetries() {
+    return BaseA2AAuthProvider.MAX_AUTH_RETRIES;
+  }
+  /**
+   * On 401/403, clear the cached token and re-authenticate (up to MAX_AUTH_RETRIES).
+   */
+  async shouldRetryWithHeaders(req, res) {
+    if (res.status !== 401 && res.status !== 403) {
+      this.authRetryCount = 0;
+      return void 0;
+    }
+    const reqHeaders = new Headers(req.headers);
+    const reqToken = reqHeaders.get("Authorization")?.split(" ")[1];
+    if (reqToken && (!this.cachedToken || reqToken !== this.cachedToken.accessToken)) {
+      debugLogger.debug("[OAuth2AuthProvider] Token already cleared or updated by another request, retrying with new token");
+      const retryCount = this.authRetryCount;
+      const headers2 = await this.headers();
+      this.authRetryCount = Math.max(this.authRetryCount, retryCount);
+      return headers2;
+    }
+    if (this.authRetryCount >= this.getMaxAuthRetries()) {
+      return void 0;
+    }
+    const nextRetryCount = this.authRetryCount + 1;
+    this.authRetryCount = nextRetryCount;
+    debugLogger.debug("[OAuth2AuthProvider] Auth failure, clearing token and re-authenticating");
+    this.cachedToken = null;
+    await this.tokenStorage.deleteCredentials(this.agentName);
+    const headers = await this.headers();
+    this.authRetryCount = nextRetryCount;
+    return headers;
+  }
+  // ---------------------------------------------------------------------------
+  // Private helpers
+  // ---------------------------------------------------------------------------
+  /**
+   * Merge authorization_url, token_url, and scopes from the agent card's
+   * `securitySchemes` when not already provided via user config.
+   */
+  mergeAgentCardDefaults(agentCard) {
+    if (!agentCard?.securitySchemes)
+      return;
+    for (const scheme of Object.values(agentCard.securitySchemes)) {
+      if (scheme.type === "oauth2" && scheme.flows.authorizationCode) {
+        const flow = scheme.flows.authorizationCode;
+        this.authorizationUrl ??= flow.authorizationUrl;
+        this.tokenUrl ??= flow.tokenUrl;
+        this.scopes ??= Object.keys(flow.scopes);
+        break;
+      }
+    }
+  }
+  /**
+   * Fetch the agent card from `agentCardUrl` using `DefaultAgentCardResolver`
+   * (which normalizes proto-format cards) and extract OAuth2 URLs.
+   */
+  async fetchAgentCardDefaults() {
+    if (!this.agentCardUrl)
+      return;
+    try {
+      debugLogger.debug(`[OAuth2AuthProvider] Fetching agent card from ${this.agentCardUrl}`);
+      const resolver = new DefaultAgentCardResolver();
+      const card = await resolver.resolve(this.agentCardUrl, "");
+      this.mergeAgentCardDefaults(card);
+    } catch (error) {
+      debugLogger.warn(`[OAuth2AuthProvider] Could not fetch agent card for OAuth URL discovery: ${getErrorMessage(error)}`);
+    }
+  }
+  /**
+   * Run a full OAuth 2.0 Authorization Code + PKCE flow through the browser.
+   */
+  async authenticateInteractively() {
+    if (!this.config.client_id) {
+      throw new Error(`OAuth2 authentication for agent "${this.agentName}" requires a client_id. Add client_id to the auth config in your agent definition.`);
+    }
+    if (!this.authorizationUrl || !this.tokenUrl) {
+      throw new Error(`OAuth2 authentication for agent "${this.agentName}" requires authorization_url and token_url. Provide them in the auth config or ensure the agent card exposes an oauth2 security scheme.`);
+    }
+    const flowConfig = {
+      clientId: this.config.client_id,
+      clientSecret: this.config.client_secret,
+      authorizationUrl: this.authorizationUrl,
+      tokenUrl: this.tokenUrl,
+      scopes: this.scopes
+    };
+    const pkceParams = generatePKCEParams();
+    const preferredPort = getPortFromUrl(flowConfig.redirectUri);
+    const callbackServer = startCallbackServer(pkceParams.state, preferredPort);
+    const redirectPort = await callbackServer.port;
+    const authUrl = buildAuthorizationUrl(
+      flowConfig,
+      pkceParams,
+      redirectPort,
+      /* resource= */
+      void 0
+    );
+    const consent = await getConsentForOauth(`Authentication required for A2A agent: '${this.agentName}'.`);
+    if (!consent) {
+      const cancelError = new FatalCancellationError("Authentication cancelled by user.");
+      callbackServer.response.catch(() => {
+      });
+      callbackServer.cancel?.(cancelError);
+      throw cancelError;
+    }
+    coreEvents.emitFeedback("info", `\u2192 Opening your browser for OAuth sign-in...
+
+If the browser does not open, copy and paste this URL into your browser:
+${authUrl}
+
+\u{1F4A1} TIP: Triple-click to select the entire URL, then copy and paste it into your browser.
+\u26A0\uFE0F  Make sure to copy the COMPLETE URL - it may wrap across multiple lines.`);
+    try {
+      await openBrowserSecurely(authUrl);
+    } catch (error) {
+      debugLogger.warn("Failed to open browser automatically:", getErrorMessage(error));
+    }
+    const { code } = await callbackServer.response;
+    debugLogger.debug("\u2713 Authorization code received, exchanging for tokens...");
+    const tokenResponse = await exchangeCodeForToken(
+      flowConfig,
+      code,
+      pkceParams.codeVerifier,
+      redirectPort,
+      /* resource= */
+      void 0
+    );
+    if (!tokenResponse.access_token) {
+      throw new Error("No access token received from token endpoint");
+    }
+    const token = this.toOAuthToken(tokenResponse);
+    this.cachedToken = token;
+    await this.persistToken();
+    debugLogger.debug("\u2713 OAuth2 authentication successful! Token saved.");
+    return token;
+  }
+  /**
+   * Convert an `OAuthTokenResponse` into the internal `OAuthToken` format.
+   */
+  toOAuthToken(response, fallbackRefreshToken) {
+    const token = {
+      accessToken: response.access_token,
+      tokenType: response.token_type || "Bearer",
+      refreshToken: response.refresh_token || fallbackRefreshToken,
+      scope: response.scope
+    };
+    if (response.expires_in) {
+      token.expiresAt = Date.now() + response.expires_in * 1e3;
+    }
+    return token;
+  }
+  /**
+   * Persist the current cached token to disk.
+   */
+  async persistToken() {
+    if (!this.cachedToken)
+      return;
+    await this.tokenStorage.saveToken(this.agentName, this.cachedToken, this.config.client_id, this.tokenUrl);
+  }
+};
+export {
+  OAuth2AuthProvider
+};
+/**
+ * @license
+ * Copyright 2026 Google LLC
+ * SPDX-License-Identifier: Apache-2.0
+ */

package/bundle/{start-MVIPJNQ5.js → start-5GIUIER3.js}

@@ -2,12 +2,12 @@ const require = (await import('node:module')).createRequire(import.meta.url); co
 import {
   startCommand,
   startServer
-} from "./chunk-GSQEBEGC.js";
-import "./chunk-K4G5D5ZZ.js";
-import "./chunk-V2R74WAG.js";
-import "./chunk-QJK54DSE.js";
-import "./chunk-S7BCRBI4.js";
-import "./chunk-K7NOVQ6G.js";
+} from "./chunk-RACMC24X.js";
+import "./chunk-RE4V6I3G.js";
+import "./chunk-NU74STQ5.js";
+import "./chunk-5VQUE3OF.js";
+import "./chunk-YP27UYI4.js";
+import "./chunk-QCWGLPCO.js";
 import "./chunk-664ZODQF.js";
 import "./chunk-IUUIT4SU.js";
 import "./chunk-L6PII3GR.js";