@office-ai/aioncli-core 0.26.0 → 0.30.1

package/dist/src/agents/auth-provider/factory.test.js

@@ -0,0 +1,344 @@
+/**
+ * @license
+ * Copyright 2026 Google LLC
+ * SPDX-License-Identifier: Apache-2.0
+ */
+import { describe, it, expect } from 'vitest';
+import { A2AAuthProviderFactory } from './factory.js';
+describe('A2AAuthProviderFactory', () => {
+    describe('validateAuthConfig', () => {
+        describe('when no security schemes required', () => {
+            it('should return valid when securitySchemes is undefined', () => {
+                const result = A2AAuthProviderFactory.validateAuthConfig(undefined, undefined);
+                expect(result).toEqual({ valid: true });
+            });
+            it('should return valid when securitySchemes is empty', () => {
+                const result = A2AAuthProviderFactory.validateAuthConfig(undefined, {});
+                expect(result).toEqual({ valid: true });
+            });
+            it('should return valid when auth config provided but not required', () => {
+                const authConfig = {
+                    type: 'apiKey',
+                    key: 'test-key',
+                };
+                const result = A2AAuthProviderFactory.validateAuthConfig(authConfig, {});
+                expect(result).toEqual({ valid: true });
+            });
+        });
+        describe('when auth is required but not configured', () => {
+            it('should return invalid with diff', () => {
+                const securitySchemes = {
+                    apiKeyAuth: {
+                        type: 'apiKey',
+                        name: 'X-API-Key',
+                        in: 'header',
+                    },
+                };
+                const result = A2AAuthProviderFactory.validateAuthConfig(undefined, securitySchemes);
+                expect(result.valid).toBe(false);
+                expect(result.diff).toBeDefined();
+                expect(result.diff?.requiredSchemes).toContain('apiKeyAuth');
+                expect(result.diff?.configuredType).toBeUndefined();
+                expect(result.diff?.missingConfig).toContain('Authentication is required but not configured');
+            });
+        });
+        describe('apiKey scheme matching', () => {
+            it('should match apiKey config with apiKey scheme', () => {
+                const authConfig = {
+                    type: 'apiKey',
+                    key: 'my-key',
+                };
+                const securitySchemes = {
+                    apiKeyAuth: {
+                        type: 'apiKey',
+                        name: 'X-API-Key',
+                        in: 'header',
+                    },
+                };
+                const result = A2AAuthProviderFactory.validateAuthConfig(authConfig, securitySchemes);
+                expect(result).toEqual({ valid: true });
+            });
+            it('should not match http config with apiKey scheme', () => {
+                const authConfig = {
+                    type: 'http',
+                    scheme: 'Bearer',
+                    token: 'my-token',
+                };
+                const securitySchemes = {
+                    apiKeyAuth: {
+                        type: 'apiKey',
+                        name: 'X-API-Key',
+                        in: 'header',
+                    },
+                };
+                const result = A2AAuthProviderFactory.validateAuthConfig(authConfig, securitySchemes);
+                expect(result.valid).toBe(false);
+                expect(result.diff?.missingConfig).toContain("Scheme 'apiKeyAuth' requires apiKey authentication");
+            });
+        });
+        describe('http scheme matching', () => {
+            it('should match http Bearer config with http Bearer scheme', () => {
+                const authConfig = {
+                    type: 'http',
+                    scheme: 'Bearer',
+                    token: 'my-token',
+                };
+                const securitySchemes = {
+                    bearerAuth: {
+                        type: 'http',
+                        scheme: 'Bearer',
+                    },
+                };
+                const result = A2AAuthProviderFactory.validateAuthConfig(authConfig, securitySchemes);
+                expect(result).toEqual({ valid: true });
+            });
+            it('should match http Basic config with http Basic scheme', () => {
+                const authConfig = {
+                    type: 'http',
+                    scheme: 'Basic',
+                    username: 'user',
+                    password: 'pass',
+                };
+                const securitySchemes = {
+                    basicAuth: {
+                        type: 'http',
+                        scheme: 'Basic',
+                    },
+                };
+                const result = A2AAuthProviderFactory.validateAuthConfig(authConfig, securitySchemes);
+                expect(result).toEqual({ valid: true });
+            });
+            it('should not match http Basic config with http Bearer scheme', () => {
+                const authConfig = {
+                    type: 'http',
+                    scheme: 'Basic',
+                    username: 'user',
+                    password: 'pass',
+                };
+                const securitySchemes = {
+                    bearerAuth: {
+                        type: 'http',
+                        scheme: 'Bearer',
+                    },
+                };
+                const result = A2AAuthProviderFactory.validateAuthConfig(authConfig, securitySchemes);
+                expect(result.valid).toBe(false);
+                expect(result.diff?.missingConfig).toContain("Scheme 'bearerAuth' requires HTTP Bearer authentication, but Basic was configured");
+            });
+            it('should match google-credentials with http Bearer scheme', () => {
+                const authConfig = {
+                    type: 'google-credentials',
+                };
+                const securitySchemes = {
+                    bearerAuth: {
+                        type: 'http',
+                        scheme: 'Bearer',
+                    },
+                };
+                const result = A2AAuthProviderFactory.validateAuthConfig(authConfig, securitySchemes);
+                expect(result).toEqual({ valid: true });
+            });
+        });
+        describe('oauth2 scheme matching', () => {
+            it('should match oauth2 config with oauth2 scheme', () => {
+                const authConfig = {
+                    type: 'oauth2',
+                };
+                const securitySchemes = {
+                    oauth2Auth: {
+                        type: 'oauth2',
+                        flows: {},
+                    },
+                };
+                const result = A2AAuthProviderFactory.validateAuthConfig(authConfig, securitySchemes);
+                expect(result).toEqual({ valid: true });
+            });
+            it('should not match apiKey config with oauth2 scheme', () => {
+                const authConfig = {
+                    type: 'apiKey',
+                    key: 'my-key',
+                };
+                const securitySchemes = {
+                    oauth2Auth: {
+                        type: 'oauth2',
+                        flows: {},
+                    },
+                };
+                const result = A2AAuthProviderFactory.validateAuthConfig(authConfig, securitySchemes);
+                expect(result.valid).toBe(false);
+                expect(result.diff?.missingConfig).toContain("Scheme 'oauth2Auth' requires OAuth 2.0 authentication");
+            });
+        });
+        describe('openIdConnect scheme matching', () => {
+            it('should match openIdConnect config with openIdConnect scheme', () => {
+                const authConfig = {
+                    type: 'openIdConnect',
+                    issuer_url: 'https://auth.example.com',
+                    client_id: 'client-id',
+                };
+                const securitySchemes = {
+                    oidcAuth: {
+                        type: 'openIdConnect',
+                        openIdConnectUrl: 'https://auth.example.com/.well-known/openid-configuration',
+                    },
+                };
+                const result = A2AAuthProviderFactory.validateAuthConfig(authConfig, securitySchemes);
+                expect(result).toEqual({ valid: true });
+            });
+            it('should not match google-credentials for openIdConnect scheme', () => {
+                const authConfig = {
+                    type: 'google-credentials',
+                };
+                const securitySchemes = {
+                    oidcAuth: {
+                        type: 'openIdConnect',
+                        openIdConnectUrl: 'https://auth.example.com/.well-known/openid-configuration',
+                    },
+                };
+                const result = A2AAuthProviderFactory.validateAuthConfig(authConfig, securitySchemes);
+                expect(result.valid).toBe(false);
+                expect(result.diff?.missingConfig).toContain("Scheme 'oidcAuth' requires OpenID Connect authentication");
+            });
+        });
+        describe('mutualTLS scheme', () => {
+            it('should always fail for mutualTLS (not supported)', () => {
+                const authConfig = {
+                    type: 'apiKey',
+                    key: 'test',
+                };
+                const securitySchemes = {
+                    mtlsAuth: {
+                        type: 'mutualTLS',
+                    },
+                };
+                const result = A2AAuthProviderFactory.validateAuthConfig(authConfig, securitySchemes);
+                expect(result.valid).toBe(false);
+                expect(result.diff?.missingConfig).toContain("Scheme 'mtlsAuth' requires mTLS authentication (not yet supported)");
+            });
+        });
+        describe('multiple security schemes', () => {
+            it('should match if any scheme matches', () => {
+                const authConfig = {
+                    type: 'http',
+                    scheme: 'Bearer',
+                    token: 'my-token',
+                };
+                const securitySchemes = {
+                    apiKeyAuth: {
+                        type: 'apiKey',
+                        name: 'X-API-Key',
+                        in: 'header',
+                    },
+                    bearerAuth: {
+                        type: 'http',
+                        scheme: 'Bearer',
+                    },
+                };
+                const result = A2AAuthProviderFactory.validateAuthConfig(authConfig, securitySchemes);
+                expect(result).toEqual({ valid: true });
+            });
+        });
+    });
+    describe('describeRequiredAuth', () => {
+        it('should describe apiKey scheme', () => {
+            const securitySchemes = {
+                apiKeyAuth: {
+                    type: 'apiKey',
+                    name: 'X-API-Key',
+                    in: 'header',
+                },
+            };
+            const result = A2AAuthProviderFactory.describeRequiredAuth(securitySchemes);
+            expect(result).toBe('API Key (apiKeyAuth): Send X-API-Key in header');
+        });
+        it('should describe http Bearer scheme', () => {
+            const securitySchemes = {
+                bearerAuth: {
+                    type: 'http',
+                    scheme: 'Bearer',
+                },
+            };
+            const result = A2AAuthProviderFactory.describeRequiredAuth(securitySchemes);
+            expect(result).toBe('HTTP Bearer (bearerAuth)');
+        });
+        it('should describe http Basic scheme', () => {
+            const securitySchemes = {
+                basicAuth: {
+                    type: 'http',
+                    scheme: 'Basic',
+                },
+            };
+            const result = A2AAuthProviderFactory.describeRequiredAuth(securitySchemes);
+            expect(result).toBe('HTTP Basic (basicAuth)');
+        });
+        it('should describe oauth2 scheme', () => {
+            const securitySchemes = {
+                oauth2Auth: {
+                    type: 'oauth2',
+                    flows: {},
+                },
+            };
+            const result = A2AAuthProviderFactory.describeRequiredAuth(securitySchemes);
+            expect(result).toBe('OAuth 2.0 (oauth2Auth)');
+        });
+        it('should describe openIdConnect scheme', () => {
+            const securitySchemes = {
+                oidcAuth: {
+                    type: 'openIdConnect',
+                    openIdConnectUrl: 'https://auth.example.com/.well-known/openid-configuration',
+                },
+            };
+            const result = A2AAuthProviderFactory.describeRequiredAuth(securitySchemes);
+            expect(result).toBe('OpenID Connect (oidcAuth)');
+        });
+        it('should describe mutualTLS scheme', () => {
+            const securitySchemes = {
+                mtlsAuth: {
+                    type: 'mutualTLS',
+                },
+            };
+            const result = A2AAuthProviderFactory.describeRequiredAuth(securitySchemes);
+            expect(result).toBe('Mutual TLS (mtlsAuth)');
+        });
+        it('should join multiple schemes with OR', () => {
+            const securitySchemes = {
+                apiKeyAuth: {
+                    type: 'apiKey',
+                    name: 'X-API-Key',
+                    in: 'header',
+                },
+                bearerAuth: {
+                    type: 'http',
+                    scheme: 'Bearer',
+                },
+            };
+            const result = A2AAuthProviderFactory.describeRequiredAuth(securitySchemes);
+            expect(result).toBe('API Key (apiKeyAuth): Send X-API-Key in header OR HTTP Bearer (bearerAuth)');
+        });
+    });
+    describe('create', () => {
+        it('should return undefined when no auth config and no security schemes', async () => {
+            const result = await A2AAuthProviderFactory.create({
+                agentName: 'test-agent',
+            });
+            expect(result).toBeUndefined();
+        });
+        it('should return undefined when no auth config but AgentCard has security schemes', async () => {
+            const result = await A2AAuthProviderFactory.create({
+                agentName: 'test-agent',
+                agentCard: {
+                    securitySchemes: {
+                        apiKeyAuth: {
+                            type: 'apiKey',
+                            name: 'X-API-Key',
+                            in: 'header',
+                        },
+                    },
+                },
+            });
+            // Returns undefined - caller should prompt user to configure auth
+            expect(result).toBeUndefined();
+        });
+    });
+});
+//# sourceMappingURL=factory.test.js.map

package/dist/src/agents/auth-provider/factory.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"factory.test.js","sourceRoot":"","sources":["../../../../src/agents/auth-provider/factory.test.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,EAAE,QAAQ,EAAE,EAAE,EAAE,MAAM,EAAE,MAAM,QAAQ,CAAC;AAC9C,OAAO,EAAE,sBAAsB,EAAE,MAAM,cAAc,CAAC;AAItD,QAAQ,CAAC,wBAAwB,EAAE,GAAG,EAAE;IACtC,QAAQ,CAAC,oBAAoB,EAAE,GAAG,EAAE;QAClC,QAAQ,CAAC,mCAAmC,EAAE,GAAG,EAAE;YACjD,EAAE,CAAC,uDAAuD,EAAE,GAAG,EAAE;gBAC/D,MAAM,MAAM,GAAG,sBAAsB,CAAC,kBAAkB,CACtD,SAAS,EACT,SAAS,CACV,CAAC;gBACF,MAAM,CAAC,MAAM,CAAC,CAAC,OAAO,CAAC,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;YAC1C,CAAC,CAAC,CAAC;YAEH,EAAE,CAAC,mDAAmD,EAAE,GAAG,EAAE;gBAC3D,MAAM,MAAM,GAAG,sBAAsB,CAAC,kBAAkB,CAAC,SAAS,EAAE,EAAE,CAAC,CAAC;gBACxE,MAAM,CAAC,MAAM,CAAC,CAAC,OAAO,CAAC,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;YAC1C,CAAC,CAAC,CAAC;YAEH,EAAE,CAAC,gEAAgE,EAAE,GAAG,EAAE;gBACxE,MAAM,UAAU,GAAkB;oBAChC,IAAI,EAAE,QAAQ;oBACd,GAAG,EAAE,UAAU;iBAChB,CAAC;gBACF,MAAM,MAAM,GAAG,sBAAsB,CAAC,kBAAkB,CACtD,UAAU,EACV,EAAE,CACH,CAAC;gBACF,MAAM,CAAC,MAAM,CAAC,CAAC,OAAO,CAAC,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;YAC1C,CAAC,CAAC,CAAC;QACL,CAAC,CAAC,CAAC;QAEH,QAAQ,CAAC,0CAA0C,EAAE,GAAG,EAAE;YACxD,EAAE,CAAC,iCAAiC,EAAE,GAAG,EAAE;gBACzC,MAAM,eAAe,GAAmC;oBACtD,UAAU,EAAE;wBACV,IAAI,EAAE,QAAQ;wBACd,IAAI,EAAE,WAAW;wBACjB,EAAE,EAAE,QAAQ;qBACb;iBACF,CAAC;gBAEF,MAAM,MAAM,GAAG,sBAAsB,CAAC,kBAAkB,CACtD,SAAS,EACT,eAAe,CAChB,CAAC;gBAEF,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;gBACjC,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,WAAW,EAAE,CAAC;gBAClC,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,eAAe,CAAC,CAAC,SAAS,CAAC,YAAY,CAAC,CAAC;gBAC7D,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,cAAc,CAAC,CAAC,aAAa,EAAE,CAAC;gBACpD,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,aAAa,CAAC,CAAC,SAAS,CAC1C,+CAA+C,CAChD,CAAC;YACJ,CAAC,CAAC,CAAC;QACL,CAAC,CAAC,CAAC;QAEH,QAAQ,CAAC,wBAAwB,EAAE,GAAG,EAAE;YACtC,EAAE,CAAC,+CAA+C,EAAE,GAAG,EAAE;gBACvD,MAAM,UAAU,GAAkB;oBAChC,IAAI,EAAE,QAAQ;oBACd,GAAG,EAAE,QAAQ;iBACd,CAAC;gBACF,MAAM,eAAe,GAAmC;oBACtD,UAAU,EAAE;wBACV,IAAI,EAAE,QAAQ;wBACd,IAAI,EAAE,WAAW;wBACjB,EAAE,EAAE,QAAQ;qBACb;iBACF,CAAC;gBAEF,MAAM,MAAM,GAAG,sBAAsB,CAAC,kBAAkB,CACtD,UAAU,EACV,eAAe,CAChB,CAAC;gBAEF,MAAM,CAAC,MAAM,CAAC,CAAC,OAAO,CAAC,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;YAC1C,CAAC,CAAC,CAAC;YAEH,EAAE,CAAC,iDAAiD,EAAE,GAAG,EAAE;gBACzD,MAAM,UAAU,GAAkB;oBAChC,IAAI,EAAE,MAAM;oBACZ,MAAM,EAAE,QAAQ;oBAChB,KAAK,EAAE,UAAU;iBAClB,CAAC;gBACF,MAAM,eAAe,GAAmC;oBACtD,UAAU,EAAE;wBACV,IAAI,EAAE,QAAQ;wBACd,IAAI,EAAE,WAAW;wBACjB,EAAE,EAAE,QAAQ;qBACb;iBACF,CAAC;gBAEF,MAAM,MAAM,GAAG,sBAAsB,CAAC,kBAAkB,CACtD,UAAU,EACV,eAAe,CAChB,CAAC;gBAEF,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;gBACjC,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,aAAa,CAAC,CAAC,SAAS,CAC1C,oDAAoD,CACrD,CAAC;YACJ,CAAC,CAAC,CAAC;QACL,CAAC,CAAC,CAAC;QAEH,QAAQ,CAAC,sBAAsB,EAAE,GAAG,EAAE;YACpC,EAAE,CAAC,yDAAyD,EAAE,GAAG,EAAE;gBACjE,MAAM,UAAU,GAAkB;oBAChC,IAAI,EAAE,MAAM;oBACZ,MAAM,EAAE,QAAQ;oBAChB,KAAK,EAAE,UAAU;iBAClB,CAAC;gBACF,MAAM,eAAe,GAAmC;oBACtD,UAAU,EAAE;wBACV,IAAI,EAAE,MAAM;wBACZ,MAAM,EAAE,QAAQ;qBACjB;iBACF,CAAC;gBAEF,MAAM,MAAM,GAAG,sBAAsB,CAAC,kBAAkB,CACtD,UAAU,EACV,eAAe,CAChB,CAAC;gBAEF,MAAM,CAAC,MAAM,CAAC,CAAC,OAAO,CAAC,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;YAC1C,CAAC,CAAC,CAAC;YAEH,EAAE,CAAC,uDAAuD,EAAE,GAAG,EAAE;gBAC/D,MAAM,UAAU,GAAkB;oBAChC,IAAI,EAAE,MAAM;oBACZ,MAAM,EAAE,OAAO;oBACf,QAAQ,EAAE,MAAM;oBAChB,QAAQ,EAAE,MAAM;iBACjB,CAAC;gBACF,MAAM,eAAe,GAAmC;oBACtD,SAAS,EAAE;wBACT,IAAI,EAAE,MAAM;wBACZ,MAAM,EAAE,OAAO;qBAChB;iBACF,CAAC;gBAEF,MAAM,MAAM,GAAG,sBAAsB,CAAC,kBAAkB,CACtD,UAAU,EACV,eAAe,CAChB,CAAC;gBAEF,MAAM,CAAC,MAAM,CAAC,CAAC,OAAO,CAAC,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;YAC1C,CAAC,CAAC,CAAC;YAEH,EAAE,CAAC,4DAA4D,EAAE,GAAG,EAAE;gBACpE,MAAM,UAAU,GAAkB;oBAChC,IAAI,EAAE,MAAM;oBACZ,MAAM,EAAE,OAAO;oBACf,QAAQ,EAAE,MAAM;oBAChB,QAAQ,EAAE,MAAM;iBACjB,CAAC;gBACF,MAAM,eAAe,GAAmC;oBACtD,UAAU,EAAE;wBACV,IAAI,EAAE,MAAM;wBACZ,MAAM,EAAE,QAAQ;qBACjB;iBACF,CAAC;gBAEF,MAAM,MAAM,GAAG,sBAAsB,CAAC,kBAAkB,CACtD,UAAU,EACV,eAAe,CAChB,CAAC;gBAEF,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;gBACjC,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,aAAa,CAAC,CAAC,SAAS,CAC1C,mFAAmF,CACpF,CAAC;YACJ,CAAC,CAAC,CAAC;YAEH,EAAE,CAAC,yDAAyD,EAAE,GAAG,EAAE;gBACjE,MAAM,UAAU,GAAkB;oBAChC,IAAI,EAAE,oBAAoB;iBAC3B,CAAC;gBACF,MAAM,eAAe,GAAmC;oBACtD,UAAU,EAAE;wBACV,IAAI,EAAE,MAAM;wBACZ,MAAM,EAAE,QAAQ;qBACjB;iBACF,CAAC;gBAEF,MAAM,MAAM,GAAG,sBAAsB,CAAC,kBAAkB,CACtD,UAAU,EACV,eAAe,CAChB,CAAC;gBAEF,MAAM,CAAC,MAAM,CAAC,CAAC,OAAO,CAAC,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;YAC1C,CAAC,CAAC,CAAC;QACL,CAAC,CAAC,CAAC;QAEH,QAAQ,CAAC,wBAAwB,EAAE,GAAG,EAAE;YACtC,EAAE,CAAC,+CAA+C,EAAE,GAAG,EAAE;gBACvD,MAAM,UAAU,GAAkB;oBAChC,IAAI,EAAE,QAAQ;iBACf,CAAC;gBACF,MAAM,eAAe,GAAmC;oBACtD,UAAU,EAAE;wBACV,IAAI,EAAE,QAAQ;wBACd,KAAK,EAAE,EAAE;qBACV;iBACF,CAAC;gBAEF,MAAM,MAAM,GAAG,sBAAsB,CAAC,kBAAkB,CACtD,UAAU,EACV,eAAe,CAChB,CAAC;gBAEF,MAAM,CAAC,MAAM,CAAC,CAAC,OAAO,CAAC,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;YAC1C,CAAC,CAAC,CAAC;YAEH,EAAE,CAAC,mDAAmD,EAAE,GAAG,EAAE;gBAC3D,MAAM,UAAU,GAAkB;oBAChC,IAAI,EAAE,QAAQ;oBACd,GAAG,EAAE,QAAQ;iBACd,CAAC;gBACF,MAAM,eAAe,GAAmC;oBACtD,UAAU,EAAE;wBACV,IAAI,EAAE,QAAQ;wBACd,KAAK,EAAE,EAAE;qBACV;iBACF,CAAC;gBAEF,MAAM,MAAM,GAAG,sBAAsB,CAAC,kBAAkB,CACtD,UAAU,EACV,eAAe,CAChB,CAAC;gBAEF,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;gBACjC,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,aAAa,CAAC,CAAC,SAAS,CAC1C,uDAAuD,CACxD,CAAC;YACJ,CAAC,CAAC,CAAC;QACL,CAAC,CAAC,CAAC;QAEH,QAAQ,CAAC,+BAA+B,EAAE,GAAG,EAAE;YAC7C,EAAE,CAAC,6DAA6D,EAAE,GAAG,EAAE;gBACrE,MAAM,UAAU,GAAkB;oBAChC,IAAI,EAAE,eAAe;oBACrB,UAAU,EAAE,0BAA0B;oBACtC,SAAS,EAAE,WAAW;iBACvB,CAAC;gBACF,MAAM,eAAe,GAAmC;oBACtD,QAAQ,EAAE;wBACR,IAAI,EAAE,eAAe;wBACrB,gBAAgB,EACd,2DAA2D;qBAC9D;iBACF,CAAC;gBAEF,MAAM,MAAM,GAAG,sBAAsB,CAAC,kBAAkB,CACtD,UAAU,EACV,eAAe,CAChB,CAAC;gBAEF,MAAM,CAAC,MAAM,CAAC,CAAC,OAAO,CAAC,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;YAC1C,CAAC,CAAC,CAAC;YAEH,EAAE,CAAC,8DAA8D,EAAE,GAAG,EAAE;gBACtE,MAAM,UAAU,GAAkB;oBAChC,IAAI,EAAE,oBAAoB;iBAC3B,CAAC;gBACF,MAAM,eAAe,GAAmC;oBACtD,QAAQ,EAAE;wBACR,IAAI,EAAE,eAAe;wBACrB,gBAAgB,EACd,2DAA2D;qBAC9D;iBACF,CAAC;gBAEF,MAAM,MAAM,GAAG,sBAAsB,CAAC,kBAAkB,CACtD,UAAU,EACV,eAAe,CAChB,CAAC;gBAEF,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;gBACjC,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,aAAa,CAAC,CAAC,SAAS,CAC1C,0DAA0D,CAC3D,CAAC;YACJ,CAAC,CAAC,CAAC;QACL,CAAC,CAAC,CAAC;QAEH,QAAQ,CAAC,kBAAkB,EAAE,GAAG,EAAE;YAChC,EAAE,CAAC,kDAAkD,EAAE,GAAG,EAAE;gBAC1D,MAAM,UAAU,GAAkB;oBAChC,IAAI,EAAE,QAAQ;oBACd,GAAG,EAAE,MAAM;iBACZ,CAAC;gBACF,MAAM,eAAe,GAAmC;oBACtD,QAAQ,EAAE;wBACR,IAAI,EAAE,WAAW;qBAClB;iBACF,CAAC;gBAEF,MAAM,MAAM,GAAG,sBAAsB,CAAC,kBAAkB,CACtD,UAAU,EACV,eAAe,CAChB,CAAC;gBAEF,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;gBACjC,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,aAAa,CAAC,CAAC,SAAS,CAC1C,oEAAoE,CACrE,CAAC;YACJ,CAAC,CAAC,CAAC;QACL,CAAC,CAAC,CAAC;QAEH,QAAQ,CAAC,2BAA2B,EAAE,GAAG,EAAE;YACzC,EAAE,CAAC,oCAAoC,EAAE,GAAG,EAAE;gBAC5C,MAAM,UAAU,GAAkB;oBAChC,IAAI,EAAE,MAAM;oBACZ,MAAM,EAAE,QAAQ;oBAChB,KAAK,EAAE,UAAU;iBAClB,CAAC;gBACF,MAAM,eAAe,GAAmC;oBACtD,UAAU,EAAE;wBACV,IAAI,EAAE,QAAQ;wBACd,IAAI,EAAE,WAAW;wBACjB,EAAE,EAAE,QAAQ;qBACb;oBACD,UAAU,EAAE;wBACV,IAAI,EAAE,MAAM;wBACZ,MAAM,EAAE,QAAQ;qBACjB;iBACF,CAAC;gBAEF,MAAM,MAAM,GAAG,sBAAsB,CAAC,kBAAkB,CACtD,UAAU,EACV,eAAe,CAChB,CAAC;gBAEF,MAAM,CAAC,MAAM,CAAC,CAAC,OAAO,CAAC,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;YAC1C,CAAC,CAAC,CAAC;QACL,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,QAAQ,CAAC,sBAAsB,EAAE,GAAG,EAAE;QACpC,EAAE,CAAC,+BAA+B,EAAE,GAAG,EAAE;YACvC,MAAM,eAAe,GAAmC;gBACtD,UAAU,EAAE;oBACV,IAAI,EAAE,QAAQ;oBACd,IAAI,EAAE,WAAW;oBACjB,EAAE,EAAE,QAAQ;iBACb;aACF,CAAC;YAEF,MAAM,MAAM,GACV,sBAAsB,CAAC,oBAAoB,CAAC,eAAe,CAAC,CAAC;YAE/D,MAAM,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,gDAAgD,CAAC,CAAC;QACxE,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,oCAAoC,EAAE,GAAG,EAAE;YAC5C,MAAM,eAAe,GAAmC;gBACtD,UAAU,EAAE;oBACV,IAAI,EAAE,MAAM;oBACZ,MAAM,EAAE,QAAQ;iBACjB;aACF,CAAC;YAEF,MAAM,MAAM,GACV,sBAAsB,CAAC,oBAAoB,CAAC,eAAe,CAAC,CAAC;YAE/D,MAAM,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,0BAA0B,CAAC,CAAC;QAClD,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,mCAAmC,EAAE,GAAG,EAAE;YAC3C,MAAM,eAAe,GAAmC;gBACtD,SAAS,EAAE;oBACT,IAAI,EAAE,MAAM;oBACZ,MAAM,EAAE,OAAO;iBAChB;aACF,CAAC;YAEF,MAAM,MAAM,GACV,sBAAsB,CAAC,oBAAoB,CAAC,eAAe,CAAC,CAAC;YAE/D,MAAM,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,wBAAwB,CAAC,CAAC;QAChD,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,+BAA+B,EAAE,GAAG,EAAE;YACvC,MAAM,eAAe,GAAmC;gBACtD,UAAU,EAAE;oBACV,IAAI,EAAE,QAAQ;oBACd,KAAK,EAAE,EAAE;iBACV;aACF,CAAC;YAEF,MAAM,MAAM,GACV,sBAAsB,CAAC,oBAAoB,CAAC,eAAe,CAAC,CAAC;YAE/D,MAAM,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,wBAAwB,CAAC,CAAC;QAChD,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,sCAAsC,EAAE,GAAG,EAAE;YAC9C,MAAM,eAAe,GAAmC;gBACtD,QAAQ,EAAE;oBACR,IAAI,EAAE,eAAe;oBACrB,gBAAgB,EACd,2DAA2D;iBAC9D;aACF,CAAC;YAEF,MAAM,MAAM,GACV,sBAAsB,CAAC,oBAAoB,CAAC,eAAe,CAAC,CAAC;YAE/D,MAAM,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,2BAA2B,CAAC,CAAC;QACnD,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,kCAAkC,EAAE,GAAG,EAAE;YAC1C,MAAM,eAAe,GAAmC;gBACtD,QAAQ,EAAE;oBACR,IAAI,EAAE,WAAW;iBAClB;aACF,CAAC;YAEF,MAAM,MAAM,GACV,sBAAsB,CAAC,oBAAoB,CAAC,eAAe,CAAC,CAAC;YAE/D,MAAM,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,uBAAuB,CAAC,CAAC;QAC/C,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,sCAAsC,EAAE,GAAG,EAAE;YAC9C,MAAM,eAAe,GAAmC;gBACtD,UAAU,EAAE;oBACV,IAAI,EAAE,QAAQ;oBACd,IAAI,EAAE,WAAW;oBACjB,EAAE,EAAE,QAAQ;iBACb;gBACD,UAAU,EAAE;oBACV,IAAI,EAAE,MAAM;oBACZ,MAAM,EAAE,QAAQ;iBACjB;aACF,CAAC;YAEF,MAAM,MAAM,GACV,sBAAsB,CAAC,oBAAoB,CAAC,eAAe,CAAC,CAAC;YAE/D,MAAM,CAAC,MAAM,CAAC,CAAC,IAAI,CACjB,4EAA4E,CAC7E,CAAC;QACJ,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,QAAQ,CAAC,QAAQ,EAAE,GAAG,EAAE;QACtB,EAAE,CAAC,qEAAqE,EAAE,KAAK,IAAI,EAAE;YACnF,MAAM,MAAM,GAAG,MAAM,sBAAsB,CAAC,MAAM,CAAC;gBACjD,SAAS,EAAE,YAAY;aACxB,CAAC,CAAC;YAEH,MAAM,CAAC,MAAM,CAAC,CAAC,aAAa,EAAE,CAAC;QACjC,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,gFAAgF,EAAE,KAAK,IAAI,EAAE;YAC9F,MAAM,MAAM,GAAG,MAAM,sBAAsB,CAAC,MAAM,CAAC;gBACjD,SAAS,EAAE,YAAY;gBACvB,SAAS,EAAE;oBACT,eAAe,EAAE;wBACf,UAAU,EAAE;4BACV,IAAI,EAAE,QAAQ;4BACd,IAAI,EAAE,WAAW;4BACjB,EAAE,EAAE,QAAQ;yBACb;qBACF;iBACsB;aAC1B,CAAC,CAAC;YAEH,kEAAkE;YAClE,MAAM,CAAC,MAAM,CAAC,CAAC,aAAa,EAAE,CAAC;QACjC,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC"}

package/dist/src/agents/auth-provider/http-provider.d.ts

@@ -0,0 +1,28 @@
+/**
+ * @license
+ * Copyright 2026 Google LLC
+ * SPDX-License-Identifier: Apache-2.0
+ */
+import type { HttpHeaders } from '@a2a-js/sdk/client';
+import { BaseA2AAuthProvider } from './base-provider.js';
+import type { HttpAuthConfig } from './types.js';
+/**
+ * Authentication provider for HTTP authentication schemes.
+ * Supports Bearer, Basic, and any IANA-registered scheme via raw value.
+ */
+export declare class HttpAuthProvider extends BaseA2AAuthProvider {
+    private readonly config;
+    readonly type: "http";
+    private resolvedToken?;
+    private resolvedUsername?;
+    private resolvedPassword?;
+    private resolvedValue?;
+    constructor(config: HttpAuthConfig);
+    initialize(): Promise<void>;
+    headers(): Promise<HttpHeaders>;
+    /**
+     * Re-resolves credentials on auth failure (e.g. rotated tokens via $ENV or !command).
+     * Respects MAX_AUTH_RETRIES from the base class to prevent infinite loops.
+     */
+    shouldRetryWithHeaders(req: RequestInit, res: Response): Promise<HttpHeaders | undefined>;
+}

package/dist/src/agents/auth-provider/http-provider.js

@@ -0,0 +1,73 @@
+/**
+ * @license
+ * Copyright 2026 Google LLC
+ * SPDX-License-Identifier: Apache-2.0
+ */
+import { BaseA2AAuthProvider } from './base-provider.js';
+import { resolveAuthValue } from './value-resolver.js';
+import { debugLogger } from '../../utils/debugLogger.js';
+/**
+ * Authentication provider for HTTP authentication schemes.
+ * Supports Bearer, Basic, and any IANA-registered scheme via raw value.
+ */
+export class HttpAuthProvider extends BaseA2AAuthProvider {
+    config;
+    type = 'http';
+    resolvedToken;
+    resolvedUsername;
+    resolvedPassword;
+    resolvedValue;
+    constructor(config) {
+        super();
+        this.config = config;
+    }
+    async initialize() {
+        const config = this.config;
+        if ('token' in config) {
+            this.resolvedToken = await resolveAuthValue(config.token);
+        }
+        else if ('username' in config) {
+            this.resolvedUsername = await resolveAuthValue(config.username);
+            this.resolvedPassword = await resolveAuthValue(config.password);
+        }
+        else {
+            // Generic raw value for any other IANA-registered scheme
+            this.resolvedValue = await resolveAuthValue(config.value);
+        }
+        debugLogger.debug(`[HttpAuthProvider] Initialized with scheme: ${this.config.scheme}`);
+    }
+    async headers() {
+        const config = this.config;
+        if ('token' in config) {
+            if (!this.resolvedToken)
+                throw new Error('HttpAuthProvider not initialized');
+            return { Authorization: `Bearer ${this.resolvedToken}` };
+        }
+        if ('username' in config) {
+            if (!this.resolvedUsername || !this.resolvedPassword) {
+                throw new Error('HttpAuthProvider not initialized');
+            }
+            const credentials = Buffer.from(`${this.resolvedUsername}:${this.resolvedPassword}`).toString('base64');
+            return { Authorization: `Basic ${credentials}` };
+        }
+        // Generic raw value for any other IANA-registered scheme
+        if (!this.resolvedValue)
+            throw new Error('HttpAuthProvider not initialized');
+        return { Authorization: `${config.scheme} ${this.resolvedValue}` };
+    }
+    /**
+     * Re-resolves credentials on auth failure (e.g. rotated tokens via $ENV or !command).
+     * Respects MAX_AUTH_RETRIES from the base class to prevent infinite loops.
+     */
+    async shouldRetryWithHeaders(req, res) {
+        if (res.status === 401 || res.status === 403) {
+            if (this.authRetryCount >= BaseA2AAuthProvider.MAX_AUTH_RETRIES) {
+                return undefined;
+            }
+            debugLogger.debug('[HttpAuthProvider] Re-resolving values after auth failure');
+            await this.initialize();
+        }
+        return super.shouldRetryWithHeaders(req, res);
+    }
+}
+//# sourceMappingURL=http-provider.js.map

package/dist/src/agents/auth-provider/http-provider.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"http-provider.js","sourceRoot":"","sources":["../../../../src/agents/auth-provider/http-provider.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAGH,OAAO,EAAE,mBAAmB,EAAE,MAAM,oBAAoB,CAAC;AAEzD,OAAO,EAAE,gBAAgB,EAAE,MAAM,qBAAqB,CAAC;AACvD,OAAO,EAAE,WAAW,EAAE,MAAM,4BAA4B,CAAC;AAEzD;;;GAGG;AACH,MAAM,OAAO,gBAAiB,SAAQ,mBAAmB;IAQ1B;IAPpB,IAAI,GAAG,MAAe,CAAC;IAExB,aAAa,CAAU;IACvB,gBAAgB,CAAU;IAC1B,gBAAgB,CAAU;IAC1B,aAAa,CAAU;IAE/B,YAA6B,MAAsB;QACjD,KAAK,EAAE,CAAC;QADmB,WAAM,GAAN,MAAM,CAAgB;IAEnD,CAAC;IAEQ,KAAK,CAAC,UAAU;QACvB,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC;QAC3B,IAAI,OAAO,IAAI,MAAM,EAAE,CAAC;YACtB,IAAI,CAAC,aAAa,GAAG,MAAM,gBAAgB,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QAC5D,CAAC;aAAM,IAAI,UAAU,IAAI,MAAM,EAAE,CAAC;YAChC,IAAI,CAAC,gBAAgB,GAAG,MAAM,gBAAgB,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;YAChE,IAAI,CAAC,gBAAgB,GAAG,MAAM,gBAAgB,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;QAClE,CAAC;aAAM,CAAC;YACN,yDAAyD;YACzD,IAAI,CAAC,aAAa,GAAG,MAAM,gBAAgB,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QAC5D,CAAC;QACD,WAAW,CAAC,KAAK,CACf,+CAA+C,IAAI,CAAC,MAAM,CAAC,MAAM,EAAE,CACpE,CAAC;IACJ,CAAC;IAEQ,KAAK,CAAC,OAAO;QACpB,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC;QAC3B,IAAI,OAAO,IAAI,MAAM,EAAE,CAAC;YACtB,IAAI,CAAC,IAAI,CAAC,aAAa;gBACrB,MAAM,IAAI,KAAK,CAAC,kCAAkC,CAAC,CAAC;YACtD,OAAO,EAAE,aAAa,EAAE,UAAU,IAAI,CAAC,aAAa,EAAE,EAAE,CAAC;QAC3D,CAAC;QAED,IAAI,UAAU,IAAI,MAAM,EAAE,CAAC;YACzB,IAAI,CAAC,IAAI,CAAC,gBAAgB,IAAI,CAAC,IAAI,CAAC,gBAAgB,EAAE,CAAC;gBACrD,MAAM,IAAI,KAAK,CAAC,kCAAkC,CAAC,CAAC;YACtD,CAAC;YACD,MAAM,WAAW,GAAG,MAAM,CAAC,IAAI,CAC7B,GAAG,IAAI,CAAC,gBAAgB,IAAI,IAAI,CAAC,gBAAgB,EAAE,CACpD,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;YACrB,OAAO,EAAE,aAAa,EAAE,SAAS,WAAW,EAAE,EAAE,CAAC;QACnD,CAAC;QAED,yDAAyD;QACzD,IAAI,CAAC,IAAI,CAAC,aAAa;YACrB,MAAM,IAAI,KAAK,CAAC,kCAAkC,CAAC,CAAC;QACtD,OAAO,EAAE,aAAa,EAAE,GAAG,MAAM,CAAC,MAAM,IAAI,IAAI,CAAC,aAAa,EAAE,EAAE,CAAC;IACrE,CAAC;IAED;;;OAGG;IACM,KAAK,CAAC,sBAAsB,CACnC,GAAgB,EAChB,GAAa;QAEb,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;YAC7C,IAAI,IAAI,CAAC,cAAc,IAAI,mBAAmB,CAAC,gBAAgB,EAAE,CAAC;gBAChE,OAAO,SAAS,CAAC;YACnB,CAAC;YACD,WAAW,CAAC,KAAK,CACf,2DAA2D,CAC5D,CAAC;YACF,MAAM,IAAI,CAAC,UAAU,EAAE,CAAC;QAC1B,CAAC;QACD,OAAO,KAAK,CAAC,sBAAsB,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;IAChD,CAAC;CACF"}

package/dist/src/agents/auth-provider/http-provider.test.d.ts

@@ -0,0 +1,6 @@
+/**
+ * @license
+ * Copyright 2026 Google LLC
+ * SPDX-License-Identifier: Apache-2.0
+ */
+export {};

package/dist/src/agents/auth-provider/http-provider.test.js

@@ -0,0 +1,112 @@
+/**
+ * @license
+ * Copyright 2026 Google LLC
+ * SPDX-License-Identifier: Apache-2.0
+ */
+import { describe, it, expect, vi, beforeEach } from 'vitest';
+import { HttpAuthProvider } from './http-provider.js';
+describe('HttpAuthProvider', () => {
+    beforeEach(() => {
+        vi.clearAllMocks();
+    });
+    describe('Bearer Authentication', () => {
+        it('should provide Bearer token header', async () => {
+            const config = {
+                type: 'http',
+                scheme: 'Bearer',
+                token: 'test-token',
+            };
+            const provider = new HttpAuthProvider(config);
+            await provider.initialize();
+            const headers = await provider.headers();
+            expect(headers).toEqual({ Authorization: 'Bearer test-token' });
+        });
+        it('should resolve token from environment variable', async () => {
+            process.env['TEST_TOKEN'] = 'env-token';
+            const config = {
+                type: 'http',
+                scheme: 'Bearer',
+                token: '$TEST_TOKEN',
+            };
+            const provider = new HttpAuthProvider(config);
+            await provider.initialize();
+            const headers = await provider.headers();
+            expect(headers).toEqual({ Authorization: 'Bearer env-token' });
+            delete process.env['TEST_TOKEN'];
+        });
+    });
+    describe('Basic Authentication', () => {
+        it('should provide Basic auth header', async () => {
+            const config = {
+                type: 'http',
+                scheme: 'Basic',
+                username: 'user',
+                password: 'password',
+            };
+            const provider = new HttpAuthProvider(config);
+            await provider.initialize();
+            const headers = await provider.headers();
+            const expected = Buffer.from('user:password').toString('base64');
+            expect(headers).toEqual({ Authorization: `Basic ${expected}` });
+        });
+    });
+    describe('Generic/Raw Authentication', () => {
+        it('should provide custom scheme with raw value', async () => {
+            const config = {
+                type: 'http',
+                scheme: 'CustomScheme',
+                value: 'raw-value-here',
+            };
+            const provider = new HttpAuthProvider(config);
+            await provider.initialize();
+            const headers = await provider.headers();
+            expect(headers).toEqual({ Authorization: 'CustomScheme raw-value-here' });
+        });
+        it('should support Digest via raw value', async () => {
+            const config = {
+                type: 'http',
+                scheme: 'Digest',
+                value: 'username="foo", response="bar"',
+            };
+            const provider = new HttpAuthProvider(config);
+            await provider.initialize();
+            const headers = await provider.headers();
+            expect(headers).toEqual({
+                Authorization: 'Digest username="foo", response="bar"',
+            });
+        });
+    });
+    describe('Retry logic', () => {
+        it('should re-initialize on 401 for Bearer', async () => {
+            const config = {
+                type: 'http',
+                scheme: 'Bearer',
+                token: '$DYNAMIC_TOKEN',
+            };
+            process.env['DYNAMIC_TOKEN'] = 'first';
+            const provider = new HttpAuthProvider(config);
+            await provider.initialize();
+            process.env['DYNAMIC_TOKEN'] = 'second';
+            const mockResponse = { status: 401 };
+            const retryHeaders = await provider.shouldRetryWithHeaders({}, mockResponse);
+            expect(retryHeaders).toEqual({ Authorization: 'Bearer second' });
+            delete process.env['DYNAMIC_TOKEN'];
+        });
+        it('should stop after max retries', async () => {
+            const config = {
+                type: 'http',
+                scheme: 'Bearer',
+                token: 'token',
+            };
+            const provider = new HttpAuthProvider(config);
+            await provider.initialize();
+            const mockResponse = { status: 401 };
+            // MAX_AUTH_RETRIES is 2
+            await provider.shouldRetryWithHeaders({}, mockResponse);
+            await provider.shouldRetryWithHeaders({}, mockResponse);
+            const third = await provider.shouldRetryWithHeaders({}, mockResponse);
+            expect(third).toBeUndefined();
+        });
+    });
+});
+//# sourceMappingURL=http-provider.test.js.map

package/dist/src/agents/auth-provider/http-provider.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"http-provider.test.js","sourceRoot":"","sources":["../../../../src/agents/auth-provider/http-provider.test.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,EAAE,QAAQ,EAAE,EAAE,EAAE,MAAM,EAAE,EAAE,EAAE,UAAU,EAAE,MAAM,QAAQ,CAAC;AAC9D,OAAO,EAAE,gBAAgB,EAAE,MAAM,oBAAoB,CAAC;AAEtD,QAAQ,CAAC,kBAAkB,EAAE,GAAG,EAAE;IAChC,UAAU,CAAC,GAAG,EAAE;QACd,EAAE,CAAC,aAAa,EAAE,CAAC;IACrB,CAAC,CAAC,CAAC;IAEH,QAAQ,CAAC,uBAAuB,EAAE,GAAG,EAAE;QACrC,EAAE,CAAC,oCAAoC,EAAE,KAAK,IAAI,EAAE;YAClD,MAAM,MAAM,GAAG;gBACb,IAAI,EAAE,MAAe;gBACrB,MAAM,EAAE,QAAiB;gBACzB,KAAK,EAAE,YAAY;aACpB,CAAC;YACF,MAAM,QAAQ,GAAG,IAAI,gBAAgB,CAAC,MAAM,CAAC,CAAC;YAC9C,MAAM,QAAQ,CAAC,UAAU,EAAE,CAAC;YAE5B,MAAM,OAAO,GAAG,MAAM,QAAQ,CAAC,OAAO,EAAE,CAAC;YACzC,MAAM,CAAC,OAAO,CAAC,CAAC,OAAO,CAAC,EAAE,aAAa,EAAE,mBAAmB,EAAE,CAAC,CAAC;QAClE,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,gDAAgD,EAAE,KAAK,IAAI,EAAE;YAC9D,OAAO,CAAC,GAAG,CAAC,YAAY,CAAC,GAAG,WAAW,CAAC;YACxC,MAAM,MAAM,GAAG;gBACb,IAAI,EAAE,MAAe;gBACrB,MAAM,EAAE,QAAiB;gBACzB,KAAK,EAAE,aAAa;aACrB,CAAC;YACF,MAAM,QAAQ,GAAG,IAAI,gBAAgB,CAAC,MAAM,CAAC,CAAC;YAC9C,MAAM,QAAQ,CAAC,UAAU,EAAE,CAAC;YAE5B,MAAM,OAAO,GAAG,MAAM,QAAQ,CAAC,OAAO,EAAE,CAAC;YACzC,MAAM,CAAC,OAAO,CAAC,CAAC,OAAO,CAAC,EAAE,aAAa,EAAE,kBAAkB,EAAE,CAAC,CAAC;YAC/D,OAAO,OAAO,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC;QACnC,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,QAAQ,CAAC,sBAAsB,EAAE,GAAG,EAAE;QACpC,EAAE,CAAC,kCAAkC,EAAE,KAAK,IAAI,EAAE;YAChD,MAAM,MAAM,GAAG;gBACb,IAAI,EAAE,MAAe;gBACrB,MAAM,EAAE,OAAgB;gBACxB,QAAQ,EAAE,MAAM;gBAChB,QAAQ,EAAE,UAAU;aACrB,CAAC;YACF,MAAM,QAAQ,GAAG,IAAI,gBAAgB,CAAC,MAAM,CAAC,CAAC;YAC9C,MAAM,QAAQ,CAAC,UAAU,EAAE,CAAC;YAE5B,MAAM,OAAO,GAAG,MAAM,QAAQ,CAAC,OAAO,EAAE,CAAC;YACzC,MAAM,QAAQ,GAAG,MAAM,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;YACjE,MAAM,CAAC,OAAO,CAAC,CAAC,OAAO,CAAC,EAAE,aAAa,EAAE,SAAS,QAAQ,EAAE,EAAE,CAAC,CAAC;QAClE,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,QAAQ,CAAC,4BAA4B,EAAE,GAAG,EAAE;QAC1C,EAAE,CAAC,6CAA6C,EAAE,KAAK,IAAI,EAAE;YAC3D,MAAM,MAAM,GAAG;gBACb,IAAI,EAAE,MAAe;gBACrB,MAAM,EAAE,cAAc;gBACtB,KAAK,EAAE,gBAAgB;aACxB,CAAC;YACF,MAAM,QAAQ,GAAG,IAAI,gBAAgB,CAAC,MAAM,CAAC,CAAC;YAC9C,MAAM,QAAQ,CAAC,UAAU,EAAE,CAAC;YAE5B,MAAM,OAAO,GAAG,MAAM,QAAQ,CAAC,OAAO,EAAE,CAAC;YACzC,MAAM,CAAC,OAAO,CAAC,CAAC,OAAO,CAAC,EAAE,aAAa,EAAE,6BAA6B,EAAE,CAAC,CAAC;QAC5E,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,qCAAqC,EAAE,KAAK,IAAI,EAAE;YACnD,MAAM,MAAM,GAAG;gBACb,IAAI,EAAE,MAAe;gBACrB,MAAM,EAAE,QAAQ;gBAChB,KAAK,EAAE,gCAAgC;aACxC,CAAC;YACF,MAAM,QAAQ,GAAG,IAAI,gBAAgB,CAAC,MAAM,CAAC,CAAC;YAC9C,MAAM,QAAQ,CAAC,UAAU,EAAE,CAAC;YAE5B,MAAM,OAAO,GAAG,MAAM,QAAQ,CAAC,OAAO,EAAE,CAAC;YACzC,MAAM,CAAC,OAAO,CAAC,CAAC,OAAO,CAAC;gBACtB,aAAa,EAAE,uCAAuC;aACvD,CAAC,CAAC;QACL,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,QAAQ,CAAC,aAAa,EAAE,GAAG,EAAE;QAC3B,EAAE,CAAC,wCAAwC,EAAE,KAAK,IAAI,EAAE;YACtD,MAAM,MAAM,GAAG;gBACb,IAAI,EAAE,MAAe;gBACrB,MAAM,EAAE,QAAiB;gBACzB,KAAK,EAAE,gBAAgB;aACxB,CAAC;YACF,OAAO,CAAC,GAAG,CAAC,eAAe,CAAC,GAAG,OAAO,CAAC;YACvC,MAAM,QAAQ,GAAG,IAAI,gBAAgB,CAAC,MAAM,CAAC,CAAC;YAC9C,MAAM,QAAQ,CAAC,UAAU,EAAE,CAAC;YAE5B,OAAO,CAAC,GAAG,CAAC,eAAe,CAAC,GAAG,QAAQ,CAAC;YACxC,MAAM,YAAY,GAAG,EAAE,MAAM,EAAE,GAAG,EAAc,CAAC;YACjD,MAAM,YAAY,GAAG,MAAM,QAAQ,CAAC,sBAAsB,CACxD,EAAE,EACF,YAAY,CACb,CAAC;YAEF,MAAM,CAAC,YAAY,CAAC,CAAC,OAAO,CAAC,EAAE,aAAa,EAAE,eAAe,EAAE,CAAC,CAAC;YACjE,OAAO,OAAO,CAAC,GAAG,CAAC,eAAe,CAAC,CAAC;QACtC,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,+BAA+B,EAAE,KAAK,IAAI,EAAE;YAC7C,MAAM,MAAM,GAAG;gBACb,IAAI,EAAE,MAAe;gBACrB,MAAM,EAAE,QAAiB;gBACzB,KAAK,EAAE,OAAO;aACf,CAAC;YACF,MAAM,QAAQ,GAAG,IAAI,gBAAgB,CAAC,MAAM,CAAC,CAAC;YAC9C,MAAM,QAAQ,CAAC,UAAU,EAAE,CAAC;YAE5B,MAAM,YAAY,GAAG,EAAE,MAAM,EAAE,GAAG,EAAc,CAAC;YAEjD,wBAAwB;YACxB,MAAM,QAAQ,CAAC,sBAAsB,CAAC,EAAE,EAAE,YAAY,CAAC,CAAC;YACxD,MAAM,QAAQ,CAAC,sBAAsB,CAAC,EAAE,EAAE,YAAY,CAAC,CAAC;YACxD,MAAM,KAAK,GAAG,MAAM,QAAQ,CAAC,sBAAsB,CAAC,EAAE,EAAE,YAAY,CAAC,CAAC;YAEtE,MAAM,CAAC,KAAK,CAAC,CAAC,aAAa,EAAE,CAAC;QAChC,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC"}

package/dist/src/agents/auth-provider/oauth2-provider.d.ts

@@ -0,0 +1,65 @@
+/**
+ * @license
+ * Copyright 2026 Google LLC
+ * SPDX-License-Identifier: Apache-2.0
+ */
+import { type HttpHeaders } from '@a2a-js/sdk/client';
+import type { AgentCard } from '@a2a-js/sdk';
+import { BaseA2AAuthProvider } from './base-provider.js';
+import type { OAuth2AuthConfig } from './types.js';
+/**
+ * Authentication provider for OAuth 2.0 Authorization Code flow with PKCE.
+ *
+ * Used by A2A remote agents whose security scheme is `oauth2`.
+ * Reuses the shared OAuth flow primitives from `utils/oauth-flow.ts`
+ * and persists tokens via `MCPOAuthTokenStorage`.
+ */
+export declare class OAuth2AuthProvider extends BaseA2AAuthProvider {
+    private readonly config;
+    private readonly agentName;
+    private readonly agentCardUrl?;
+    readonly type: "oauth2";
+    private readonly tokenStorage;
+    private cachedToken;
+    /** Resolved OAuth URLs — may come from config or agent card. */
+    private authorizationUrl;
+    private tokenUrl;
+    private scopes;
+    constructor(config: OAuth2AuthConfig, agentName: string, agentCard?: AgentCard, agentCardUrl?: string | undefined);
+    /**
+     * Initialize the provider by loading any persisted token from storage.
+     * Also discovers OAuth URLs from the agent card if not yet resolved.
+     */
+    initialize(): Promise<void>;
+    /**
+     * Return an Authorization header with a valid Bearer token.
+     * Refreshes or triggers interactive auth as needed.
+     */
+    headers(): Promise<HttpHeaders>;
+    /**
+     * On 401/403, clear the cached token and re-authenticate (up to MAX_AUTH_RETRIES).
+     */
+    shouldRetryWithHeaders(_req: RequestInit, res: Response): Promise<HttpHeaders | undefined>;
+    /**
+     * Merge authorization_url, token_url, and scopes from the agent card's
+     * `securitySchemes` when not already provided via user config.
+     */
+    private mergeAgentCardDefaults;
+    /**
+     * Fetch the agent card from `agentCardUrl` using `DefaultAgentCardResolver`
+     * (which normalizes proto-format cards) and extract OAuth2 URLs.
+     */
+    private fetchAgentCardDefaults;
+    /**
+     * Run a full OAuth 2.0 Authorization Code + PKCE flow through the browser.
+     */
+    private authenticateInteractively;
+    /**
+     * Convert an `OAuthTokenResponse` into the internal `OAuthToken` format.
+     */
+    private toOAuthToken;
+    /**
+     * Persist the current cached token to disk.
+     */
+    private persistToken;
+}