@office-ai/aioncli-core 0.26.0 → 0.30.1

package/dist/src/agents/auth-provider/oauth2-provider.test.js

@@ -0,0 +1,490 @@
+/**
+ * @license
+ * Copyright 2026 Google LLC
+ * SPDX-License-Identifier: Apache-2.0
+ */
+import { describe, it, expect, vi, beforeEach } from 'vitest';
+import { OAuth2AuthProvider } from './oauth2-provider.js';
+// Mock DefaultAgentCardResolver from @a2a-js/sdk/client.
+const mockResolve = vi.fn();
+vi.mock('@a2a-js/sdk/client', async (importOriginal) => {
+    const actual = await importOriginal();
+    return {
+        ...actual,
+        DefaultAgentCardResolver: vi.fn().mockImplementation(() => ({
+            resolve: mockResolve,
+        })),
+    };
+});
+// Mock all external dependencies.
+vi.mock('../../mcp/oauth-token-storage.js', () => {
+    const MCPOAuthTokenStorage = vi.fn().mockImplementation(() => ({
+        getCredentials: vi.fn().mockResolvedValue(null),
+        saveToken: vi.fn().mockResolvedValue(undefined),
+        deleteCredentials: vi.fn().mockResolvedValue(undefined),
+        isTokenExpired: vi.fn().mockReturnValue(false),
+    }));
+    return { MCPOAuthTokenStorage };
+});
+vi.mock('../../utils/oauth-flow.js', () => ({
+    generatePKCEParams: vi.fn().mockReturnValue({
+        codeVerifier: 'test-verifier',
+        codeChallenge: 'test-challenge',
+        state: 'test-state',
+    }),
+    startCallbackServer: vi.fn().mockReturnValue({
+        port: Promise.resolve(12345),
+        response: Promise.resolve({ code: 'test-code', state: 'test-state' }),
+    }),
+    getPortFromUrl: vi.fn().mockReturnValue(undefined),
+    buildAuthorizationUrl: vi
+        .fn()
+        .mockReturnValue('https://auth.example.com/authorize?foo=bar'),
+    exchangeCodeForToken: vi.fn().mockResolvedValue({
+        access_token: 'new-access-token',
+        token_type: 'Bearer',
+        expires_in: 3600,
+        refresh_token: 'new-refresh-token',
+    }),
+    refreshAccessToken: vi.fn().mockResolvedValue({
+        access_token: 'refreshed-access-token',
+        token_type: 'Bearer',
+        expires_in: 3600,
+        refresh_token: 'refreshed-refresh-token',
+    }),
+}));
+vi.mock('../../utils/secure-browser-launcher.js', () => ({
+    openBrowserSecurely: vi.fn().mockResolvedValue(undefined),
+}));
+vi.mock('../../utils/authConsent.js', () => ({
+    getConsentForOauth: vi.fn().mockResolvedValue(true),
+}));
+vi.mock('../../utils/events.js', () => ({
+    coreEvents: {
+        emitFeedback: vi.fn(),
+    },
+}));
+vi.mock('../../utils/debugLogger.js', () => ({
+    debugLogger: {
+        debug: vi.fn(),
+        warn: vi.fn(),
+        error: vi.fn(),
+        log: vi.fn(),
+    },
+}));
+// Re-import mocked modules for assertions.
+const { MCPOAuthTokenStorage } = await import('../../mcp/oauth-token-storage.js');
+const { refreshAccessToken, exchangeCodeForToken, generatePKCEParams, startCallbackServer, buildAuthorizationUrl, } = await import('../../utils/oauth-flow.js');
+const { getConsentForOauth } = await import('../../utils/authConsent.js');
+function createConfig(overrides = {}) {
+    return {
+        type: 'oauth2',
+        client_id: 'test-client-id',
+        authorization_url: 'https://auth.example.com/authorize',
+        token_url: 'https://auth.example.com/token',
+        scopes: ['read', 'write'],
+        ...overrides,
+    };
+}
+function getTokenStorage() {
+    // Access the mocked MCPOAuthTokenStorage instance created in the constructor.
+    const instance = vi.mocked(MCPOAuthTokenStorage).mock.results.at(-1).value;
+    return instance;
+}
+describe('OAuth2AuthProvider', () => {
+    beforeEach(() => {
+        vi.clearAllMocks();
+    });
+    describe('constructor', () => {
+        it('should set type to oauth2', () => {
+            const provider = new OAuth2AuthProvider(createConfig(), 'test-agent');
+            expect(provider.type).toBe('oauth2');
+        });
+        it('should use config values for authorization_url and token_url', () => {
+            const config = createConfig({
+                authorization_url: 'https://custom.example.com/authorize',
+                token_url: 'https://custom.example.com/token',
+            });
+            const provider = new OAuth2AuthProvider(config, 'test-agent');
+            // Verify by calling headers which will trigger interactive flow with these URLs.
+            expect(provider.type).toBe('oauth2');
+        });
+        it('should merge agent card defaults when config values are missing', () => {
+            const config = createConfig({
+                authorization_url: undefined,
+                token_url: undefined,
+                scopes: undefined,
+            });
+            const agentCard = {
+                securitySchemes: {
+                    oauth: {
+                        type: 'oauth2',
+                        flows: {
+                            authorizationCode: {
+                                authorizationUrl: 'https://card.example.com/authorize',
+                                tokenUrl: 'https://card.example.com/token',
+                                scopes: { read: 'Read access', write: 'Write access' },
+                            },
+                        },
+                    },
+                },
+            };
+            const provider = new OAuth2AuthProvider(config, 'test-agent', agentCard);
+            expect(provider.type).toBe('oauth2');
+        });
+        it('should prefer config values over agent card values', async () => {
+            const config = createConfig({
+                authorization_url: 'https://config.example.com/authorize',
+                token_url: 'https://config.example.com/token',
+                scopes: ['custom-scope'],
+            });
+            const agentCard = {
+                securitySchemes: {
+                    oauth: {
+                        type: 'oauth2',
+                        flows: {
+                            authorizationCode: {
+                                authorizationUrl: 'https://card.example.com/authorize',
+                                tokenUrl: 'https://card.example.com/token',
+                                scopes: { read: 'Read access' },
+                            },
+                        },
+                    },
+                },
+            };
+            const provider = new OAuth2AuthProvider(config, 'test-agent', agentCard);
+            await provider.headers();
+            // The config URLs should be used, not the agent card ones.
+            expect(vi.mocked(buildAuthorizationUrl)).toHaveBeenCalledWith(expect.objectContaining({
+                authorizationUrl: 'https://config.example.com/authorize',
+                tokenUrl: 'https://config.example.com/token',
+                scopes: ['custom-scope'],
+            }), expect.anything(), expect.anything(), undefined);
+        });
+    });
+    describe('initialize', () => {
+        it('should load a valid token from storage', async () => {
+            const provider = new OAuth2AuthProvider(createConfig(), 'test-agent');
+            const storage = getTokenStorage();
+            storage.getCredentials.mockResolvedValue({
+                serverName: 'test-agent',
+                token: {
+                    accessToken: 'stored-token',
+                    tokenType: 'Bearer',
+                },
+                updatedAt: Date.now(),
+            });
+            storage.isTokenExpired.mockReturnValue(false);
+            await provider.initialize();
+            const headers = await provider.headers();
+            expect(headers).toEqual({ Authorization: 'Bearer stored-token' });
+        });
+        it('should not cache an expired token from storage', async () => {
+            const provider = new OAuth2AuthProvider(createConfig(), 'test-agent');
+            const storage = getTokenStorage();
+            storage.getCredentials.mockResolvedValue({
+                serverName: 'test-agent',
+                token: {
+                    accessToken: 'expired-token',
+                    tokenType: 'Bearer',
+                    expiresAt: Date.now() - 1000,
+                },
+                updatedAt: Date.now(),
+            });
+            storage.isTokenExpired.mockReturnValue(true);
+            await provider.initialize();
+            // Should trigger interactive flow since cached token is null.
+            const headers = await provider.headers();
+            expect(headers).toEqual({ Authorization: 'Bearer new-access-token' });
+        });
+        it('should handle no stored credentials gracefully', async () => {
+            const provider = new OAuth2AuthProvider(createConfig(), 'test-agent');
+            const storage = getTokenStorage();
+            storage.getCredentials.mockResolvedValue(null);
+            await provider.initialize();
+            // Should trigger interactive flow.
+            const headers = await provider.headers();
+            expect(headers).toEqual({ Authorization: 'Bearer new-access-token' });
+        });
+    });
+    describe('headers', () => {
+        it('should return cached token if valid', async () => {
+            const provider = new OAuth2AuthProvider(createConfig(), 'test-agent');
+            const storage = getTokenStorage();
+            storage.getCredentials.mockResolvedValue({
+                serverName: 'test-agent',
+                token: { accessToken: 'cached-token', tokenType: 'Bearer' },
+                updatedAt: Date.now(),
+            });
+            storage.isTokenExpired.mockReturnValue(false);
+            await provider.initialize();
+            const headers = await provider.headers();
+            expect(headers).toEqual({ Authorization: 'Bearer cached-token' });
+            expect(vi.mocked(exchangeCodeForToken)).not.toHaveBeenCalled();
+            expect(vi.mocked(refreshAccessToken)).not.toHaveBeenCalled();
+        });
+        it('should refresh token when expired with refresh_token available', async () => {
+            const provider = new OAuth2AuthProvider(createConfig(), 'test-agent');
+            const storage = getTokenStorage();
+            // First call: load from storage (expired but with refresh token).
+            storage.getCredentials.mockResolvedValue({
+                serverName: 'test-agent',
+                token: {
+                    accessToken: 'expired-token',
+                    tokenType: 'Bearer',
+                    refreshToken: 'my-refresh-token',
+                    expiresAt: Date.now() - 1000,
+                },
+                updatedAt: Date.now(),
+            });
+            // isTokenExpired: false for initialize (to cache it), true for headers check.
+            storage.isTokenExpired
+                .mockReturnValueOnce(false) // initialize: cache the token
+                .mockReturnValueOnce(true); // headers: token is expired
+            await provider.initialize();
+            const headers = await provider.headers();
+            expect(vi.mocked(refreshAccessToken)).toHaveBeenCalledWith(expect.objectContaining({ clientId: 'test-client-id' }), 'my-refresh-token', 'https://auth.example.com/token');
+            expect(headers).toEqual({
+                Authorization: 'Bearer refreshed-access-token',
+            });
+            expect(storage.saveToken).toHaveBeenCalled();
+        });
+        it('should fall back to interactive flow when refresh fails', async () => {
+            const provider = new OAuth2AuthProvider(createConfig(), 'test-agent');
+            const storage = getTokenStorage();
+            storage.getCredentials.mockResolvedValue({
+                serverName: 'test-agent',
+                token: {
+                    accessToken: 'expired-token',
+                    tokenType: 'Bearer',
+                    refreshToken: 'bad-refresh-token',
+                    expiresAt: Date.now() - 1000,
+                },
+                updatedAt: Date.now(),
+            });
+            storage.isTokenExpired
+                .mockReturnValueOnce(false) // initialize
+                .mockReturnValueOnce(true); // headers
+            vi.mocked(refreshAccessToken).mockRejectedValueOnce(new Error('Refresh failed'));
+            await provider.initialize();
+            const headers = await provider.headers();
+            // Should have deleted stale credentials and done interactive flow.
+            expect(storage.deleteCredentials).toHaveBeenCalledWith('test-agent');
+            expect(headers).toEqual({ Authorization: 'Bearer new-access-token' });
+        });
+        it('should trigger interactive flow when no token exists', async () => {
+            const provider = new OAuth2AuthProvider(createConfig(), 'test-agent');
+            const storage = getTokenStorage();
+            storage.getCredentials.mockResolvedValue(null);
+            await provider.initialize();
+            const headers = await provider.headers();
+            expect(vi.mocked(generatePKCEParams)).toHaveBeenCalled();
+            expect(vi.mocked(startCallbackServer)).toHaveBeenCalled();
+            expect(vi.mocked(exchangeCodeForToken)).toHaveBeenCalled();
+            expect(storage.saveToken).toHaveBeenCalledWith('test-agent', expect.objectContaining({ accessToken: 'new-access-token' }), 'test-client-id', 'https://auth.example.com/token');
+            expect(headers).toEqual({ Authorization: 'Bearer new-access-token' });
+        });
+        it('should throw when user declines consent', async () => {
+            vi.mocked(getConsentForOauth).mockResolvedValueOnce(false);
+            const provider = new OAuth2AuthProvider(createConfig(), 'test-agent');
+            await provider.initialize();
+            await expect(provider.headers()).rejects.toThrow('Authentication cancelled by user');
+        });
+        it('should throw when client_id is missing', async () => {
+            const config = createConfig({ client_id: undefined });
+            const provider = new OAuth2AuthProvider(config, 'test-agent');
+            await provider.initialize();
+            await expect(provider.headers()).rejects.toThrow(/requires a client_id/);
+        });
+        it('should throw when authorization_url and token_url are missing', async () => {
+            const config = createConfig({
+                authorization_url: undefined,
+                token_url: undefined,
+            });
+            const provider = new OAuth2AuthProvider(config, 'test-agent');
+            await provider.initialize();
+            await expect(provider.headers()).rejects.toThrow(/requires authorization_url and token_url/);
+        });
+    });
+    describe('shouldRetryWithHeaders', () => {
+        it('should clear token and re-authenticate on 401', async () => {
+            const provider = new OAuth2AuthProvider(createConfig(), 'test-agent');
+            const storage = getTokenStorage();
+            storage.getCredentials.mockResolvedValue({
+                serverName: 'test-agent',
+                token: { accessToken: 'old-token', tokenType: 'Bearer' },
+                updatedAt: Date.now(),
+            });
+            storage.isTokenExpired.mockReturnValue(false);
+            await provider.initialize();
+            const res = new Response(null, { status: 401 });
+            const retryHeaders = await provider.shouldRetryWithHeaders({}, res);
+            expect(storage.deleteCredentials).toHaveBeenCalledWith('test-agent');
+            expect(retryHeaders).toBeDefined();
+            expect(retryHeaders).toHaveProperty('Authorization');
+        });
+        it('should clear token and re-authenticate on 403', async () => {
+            const provider = new OAuth2AuthProvider(createConfig(), 'test-agent');
+            const storage = getTokenStorage();
+            storage.getCredentials.mockResolvedValue({
+                serverName: 'test-agent',
+                token: { accessToken: 'old-token', tokenType: 'Bearer' },
+                updatedAt: Date.now(),
+            });
+            storage.isTokenExpired.mockReturnValue(false);
+            await provider.initialize();
+            const res = new Response(null, { status: 403 });
+            const retryHeaders = await provider.shouldRetryWithHeaders({}, res);
+            expect(retryHeaders).toBeDefined();
+        });
+        it('should return undefined for non-auth errors', async () => {
+            const provider = new OAuth2AuthProvider(createConfig(), 'test-agent');
+            const res = new Response(null, { status: 500 });
+            const retryHeaders = await provider.shouldRetryWithHeaders({}, res);
+            expect(retryHeaders).toBeUndefined();
+        });
+        it('should respect MAX_AUTH_RETRIES', async () => {
+            const provider = new OAuth2AuthProvider(createConfig(), 'test-agent');
+            const res401 = new Response(null, { status: 401 });
+            // First retry — should succeed.
+            const first = await provider.shouldRetryWithHeaders({}, res401);
+            expect(first).toBeDefined();
+            // Second retry — should succeed.
+            const second = await provider.shouldRetryWithHeaders({}, res401);
+            expect(second).toBeDefined();
+            // Third retry — should be blocked.
+            const third = await provider.shouldRetryWithHeaders({}, res401);
+            expect(third).toBeUndefined();
+        });
+        it('should reset retry count on non-auth response', async () => {
+            const provider = new OAuth2AuthProvider(createConfig(), 'test-agent');
+            const res401 = new Response(null, { status: 401 });
+            const res200 = new Response(null, { status: 200 });
+            await provider.shouldRetryWithHeaders({}, res401);
+            await provider.shouldRetryWithHeaders({}, res200); // resets
+            // Should be able to retry again.
+            const result = await provider.shouldRetryWithHeaders({}, res401);
+            expect(result).toBeDefined();
+        });
+    });
+    describe('token persistence', () => {
+        it('should persist token after successful interactive auth', async () => {
+            const provider = new OAuth2AuthProvider(createConfig(), 'test-agent');
+            const storage = getTokenStorage();
+            await provider.initialize();
+            await provider.headers();
+            expect(storage.saveToken).toHaveBeenCalledWith('test-agent', expect.objectContaining({
+                accessToken: 'new-access-token',
+                tokenType: 'Bearer',
+                refreshToken: 'new-refresh-token',
+            }), 'test-client-id', 'https://auth.example.com/token');
+        });
+        it('should persist token after successful refresh', async () => {
+            const provider = new OAuth2AuthProvider(createConfig(), 'test-agent');
+            const storage = getTokenStorage();
+            storage.getCredentials.mockResolvedValue({
+                serverName: 'test-agent',
+                token: {
+                    accessToken: 'expired-token',
+                    tokenType: 'Bearer',
+                    refreshToken: 'my-refresh-token',
+                },
+                updatedAt: Date.now(),
+            });
+            storage.isTokenExpired
+                .mockReturnValueOnce(false)
+                .mockReturnValueOnce(true);
+            await provider.initialize();
+            await provider.headers();
+            expect(storage.saveToken).toHaveBeenCalledWith('test-agent', expect.objectContaining({
+                accessToken: 'refreshed-access-token',
+            }), 'test-client-id', 'https://auth.example.com/token');
+        });
+    });
+    describe('agent card integration', () => {
+        it('should discover URLs from agent card when not in config', async () => {
+            const config = createConfig({
+                authorization_url: undefined,
+                token_url: undefined,
+                scopes: undefined,
+            });
+            const agentCard = {
+                securitySchemes: {
+                    myOauth: {
+                        type: 'oauth2',
+                        flows: {
+                            authorizationCode: {
+                                authorizationUrl: 'https://card.example.com/auth',
+                                tokenUrl: 'https://card.example.com/token',
+                                scopes: { profile: 'View profile', email: 'View email' },
+                            },
+                        },
+                    },
+                },
+            };
+            const provider = new OAuth2AuthProvider(config, 'card-agent', agentCard);
+            await provider.initialize();
+            await provider.headers();
+            expect(vi.mocked(buildAuthorizationUrl)).toHaveBeenCalledWith(expect.objectContaining({
+                authorizationUrl: 'https://card.example.com/auth',
+                tokenUrl: 'https://card.example.com/token',
+                scopes: ['profile', 'email'],
+            }), expect.anything(), expect.anything(), undefined);
+        });
+        it('should discover URLs from agentCardUrl via DefaultAgentCardResolver during initialize', async () => {
+            const config = createConfig({
+                authorization_url: undefined,
+                token_url: undefined,
+                scopes: undefined,
+            });
+            // Simulate a normalized agent card returned by DefaultAgentCardResolver.
+            mockResolve.mockResolvedValue({
+                securitySchemes: {
+                    myOauth: {
+                        type: 'oauth2',
+                        flows: {
+                            authorizationCode: {
+                                authorizationUrl: 'https://discovered.example.com/auth',
+                                tokenUrl: 'https://discovered.example.com/token',
+                                scopes: { openid: 'OpenID', profile: 'Profile' },
+                            },
+                        },
+                    },
+                },
+            });
+            // No agentCard passed to constructor — only agentCardUrl.
+            const provider = new OAuth2AuthProvider(config, 'discover-agent', undefined, 'https://example.com/.well-known/agent-card.json');
+            await provider.initialize();
+            await provider.headers();
+            expect(mockResolve).toHaveBeenCalledWith('https://example.com/.well-known/agent-card.json', '');
+            expect(vi.mocked(buildAuthorizationUrl)).toHaveBeenCalledWith(expect.objectContaining({
+                authorizationUrl: 'https://discovered.example.com/auth',
+                tokenUrl: 'https://discovered.example.com/token',
+                scopes: ['openid', 'profile'],
+            }), expect.anything(), expect.anything(), undefined);
+        });
+        it('should ignore agent card with no authorizationCode flow', () => {
+            const config = createConfig({
+                authorization_url: undefined,
+                token_url: undefined,
+            });
+            const agentCard = {
+                securitySchemes: {
+                    myOauth: {
+                        type: 'oauth2',
+                        flows: {
+                            clientCredentials: {
+                                tokenUrl: 'https://card.example.com/token',
+                                scopes: {},
+                            },
+                        },
+                    },
+                },
+            };
+            // Should not throw — just won't have URLs.
+            const provider = new OAuth2AuthProvider(config, 'card-agent', agentCard);
+            expect(provider.type).toBe('oauth2');
+        });
+    });
+});
+//# sourceMappingURL=oauth2-provider.test.js.map

package/dist/src/agents/auth-provider/oauth2-provider.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"oauth2-provider.test.js","sourceRoot":"","sources":["../../../../src/agents/auth-provider/oauth2-provider.test.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,EAAE,QAAQ,EAAE,EAAE,EAAE,MAAM,EAAE,EAAE,EAAE,UAAU,EAAE,MAAM,QAAQ,CAAC;AAC9D,OAAO,EAAE,kBAAkB,EAAE,MAAM,sBAAsB,CAAC;AAI1D,yDAAyD;AACzD,MAAM,WAAW,GAAG,EAAE,CAAC,EAAE,EAAE,CAAC;AAC5B,EAAE,CAAC,IAAI,CAAC,oBAAoB,EAAE,KAAK,EAAE,cAAc,EAAE,EAAE;IACrD,MAAM,MAAM,GAAG,MAAM,cAAc,EAAuC,CAAC;IAC3E,OAAO;QACL,GAAG,MAAM;QACT,wBAAwB,EAAE,EAAE,CAAC,EAAE,EAAE,CAAC,kBAAkB,CAAC,GAAG,EAAE,CAAC,CAAC;YAC1D,OAAO,EAAE,WAAW;SACrB,CAAC,CAAC;KACJ,CAAC;AACJ,CAAC,CAAC,CAAC;AAEH,kCAAkC;AAClC,EAAE,CAAC,IAAI,CAAC,kCAAkC,EAAE,GAAG,EAAE;IAC/C,MAAM,oBAAoB,GAAG,EAAE,CAAC,EAAE,EAAE,CAAC,kBAAkB,CAAC,GAAG,EAAE,CAAC,CAAC;QAC7D,cAAc,EAAE,EAAE,CAAC,EAAE,EAAE,CAAC,iBAAiB,CAAC,IAAI,CAAC;QAC/C,SAAS,EAAE,EAAE,CAAC,EAAE,EAAE,CAAC,iBAAiB,CAAC,SAAS,CAAC;QAC/C,iBAAiB,EAAE,EAAE,CAAC,EAAE,EAAE,CAAC,iBAAiB,CAAC,SAAS,CAAC;QACvD,cAAc,EAAE,EAAE,CAAC,EAAE,EAAE,CAAC,eAAe,CAAC,KAAK,CAAC;KAC/C,CAAC,CAAC,CAAC;IACJ,OAAO,EAAE,oBAAoB,EAAE,CAAC;AAClC,CAAC,CAAC,CAAC;AAEH,EAAE,CAAC,IAAI,CAAC,2BAA2B,EAAE,GAAG,EAAE,CAAC,CAAC;IAC1C,kBAAkB,EAAE,EAAE,CAAC,EAAE,EAAE,CAAC,eAAe,CAAC;QAC1C,YAAY,EAAE,eAAe;QAC7B,aAAa,EAAE,gBAAgB;QAC/B,KAAK,EAAE,YAAY;KACpB,CAAC;IACF,mBAAmB,EAAE,EAAE,CAAC,EAAE,EAAE,CAAC,eAAe,CAAC;QAC3C,IAAI,EAAE,OAAO,CAAC,OAAO,CAAC,KAAK,CAAC;QAC5B,QAAQ,EAAE,OAAO,CAAC,OAAO,CAAC,EAAE,IAAI,EAAE,WAAW,EAAE,KAAK,EAAE,YAAY,EAAE,CAAC;KACtE,CAAC;IACF,cAAc,EAAE,EAAE,CAAC,EAAE,EAAE,CAAC,eAAe,CAAC,SAAS,CAAC;IAClD,qBAAqB,EAAE,EAAE;SACtB,EAAE,EAAE;SACJ,eAAe,CAAC,4CAA4C,CAAC;IAChE,oBAAoB,EAAE,EAAE,CAAC,EAAE,EAAE,CAAC,iBAAiB,CAAC;QAC9C,YAAY,EAAE,kBAAkB;QAChC,UAAU,EAAE,QAAQ;QACpB,UAAU,EAAE,IAAI;QAChB,aAAa,EAAE,mBAAmB;KACnC,CAAC;IACF,kBAAkB,EAAE,EAAE,CAAC,EAAE,EAAE,CAAC,iBAAiB,CAAC;QAC5C,YAAY,EAAE,wBAAwB;QACtC,UAAU,EAAE,QAAQ;QACpB,UAAU,EAAE,IAAI;QAChB,aAAa,EAAE,yBAAyB;KACzC,CAAC;CACH,CAAC,CAAC,CAAC;AAEJ,EAAE,CAAC,IAAI,CAAC,wCAAwC,EAAE,GAAG,EAAE,CAAC,CAAC;IACvD,mBAAmB,EAAE,EAAE,CAAC,EAAE,EAAE,CAAC,iBAAiB,CAAC,SAAS,CAAC;CAC1D,CAAC,CAAC,CAAC;AAEJ,EAAE,CAAC,IAAI,CAAC,4BAA4B,EAAE,GAAG,EAAE,CAAC,CAAC;IAC3C,kBAAkB,EAAE,EAAE,CAAC,EAAE,EAAE,CAAC,iBAAiB,CAAC,IAAI,CAAC;CACpD,CAAC,CAAC,CAAC;AAEJ,EAAE,CAAC,IAAI,CAAC,uBAAuB,EAAE,GAAG,EAAE,CAAC,CAAC;IACtC,UAAU,EAAE;QACV,YAAY,EAAE,EAAE,CAAC,EAAE,EAAE;KACtB;CACF,CAAC,CAAC,CAAC;AAEJ,EAAE,CAAC,IAAI,CAAC,4BAA4B,EAAE,GAAG,EAAE,CAAC,CAAC;IAC3C,WAAW,EAAE;QACX,KAAK,EAAE,EAAE,CAAC,EAAE,EAAE;QACd,IAAI,EAAE,EAAE,CAAC,EAAE,EAAE;QACb,KAAK,EAAE,EAAE,CAAC,EAAE,EAAE;QACd,GAAG,EAAE,EAAE,CAAC,EAAE,EAAE;KACb;CACF,CAAC,CAAC,CAAC;AAEJ,2CAA2C;AAC3C,MAAM,EAAE,oBAAoB,EAAE,GAAG,MAAM,MAAM,CAC3C,kCAAkC,CACnC,CAAC;AACF,MAAM,EACJ,kBAAkB,EAClB,oBAAoB,EACpB,kBAAkB,EAClB,mBAAmB,EACnB,qBAAqB,GACtB,GAAG,MAAM,MAAM,CAAC,2BAA2B,CAAC,CAAC;AAC9C,MAAM,EAAE,kBAAkB,EAAE,GAAG,MAAM,MAAM,CAAC,4BAA4B,CAAC,CAAC;AAE1E,SAAS,YAAY,CACnB,YAAuC,EAAE;IAEzC,OAAO;QACL,IAAI,EAAE,QAAQ;QACd,SAAS,EAAE,gBAAgB;QAC3B,iBAAiB,EAAE,oCAAoC;QACvD,SAAS,EAAE,gCAAgC;QAC3C,MAAM,EAAE,CAAC,MAAM,EAAE,OAAO,CAAC;QACzB,GAAG,SAAS;KACb,CAAC;AACJ,CAAC;AAED,SAAS,eAAe;IACtB,8EAA8E;IAC9E,MAAM,QAAQ,GAAG,EAAE,CAAC,MAAM,CAAC,oBAAoB,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,CAAC,CAAE,CAAC,KAAK,CAAC;IAC5E,OAAO,QAKN,CAAC;AACJ,CAAC;AAED,QAAQ,CAAC,oBAAoB,EAAE,GAAG,EAAE;IAClC,UAAU,CAAC,GAAG,EAAE;QACd,EAAE,CAAC,aAAa,EAAE,CAAC;IACrB,CAAC,CAAC,CAAC;IAEH,QAAQ,CAAC,aAAa,EAAE,GAAG,EAAE;QAC3B,EAAE,CAAC,2BAA2B,EAAE,GAAG,EAAE;YACnC,MAAM,QAAQ,GAAG,IAAI,kBAAkB,CAAC,YAAY,EAAE,EAAE,YAAY,CAAC,CAAC;YACtE,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QACvC,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,8DAA8D,EAAE,GAAG,EAAE;YACtE,MAAM,MAAM,GAAG,YAAY,CAAC;gBAC1B,iBAAiB,EAAE,sCAAsC;gBACzD,SAAS,EAAE,kCAAkC;aAC9C,CAAC,CAAC;YACH,MAAM,QAAQ,GAAG,IAAI,kBAAkB,CAAC,MAAM,EAAE,YAAY,CAAC,CAAC;YAC9D,iFAAiF;YACjF,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QACvC,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,iEAAiE,EAAE,GAAG,EAAE;YACzE,MAAM,MAAM,GAAG,YAAY,CAAC;gBAC1B,iBAAiB,EAAE,SAAS;gBAC5B,SAAS,EAAE,SAAS;gBACpB,MAAM,EAAE,SAAS;aAClB,CAAC,CAAC;YAEH,MAAM,SAAS,GAAG;gBAChB,eAAe,EAAE;oBACf,KAAK,EAAE;wBACL,IAAI,EAAE,QAAiB;wBACvB,KAAK,EAAE;4BACL,iBAAiB,EAAE;gCACjB,gBAAgB,EAAE,oCAAoC;gCACtD,QAAQ,EAAE,gCAAgC;gCAC1C,MAAM,EAAE,EAAE,IAAI,EAAE,aAAa,EAAE,KAAK,EAAE,cAAc,EAAE;6BACvD;yBACF;qBACF;iBACF;aACsB,CAAC;YAE1B,MAAM,QAAQ,GAAG,IAAI,kBAAkB,CAAC,MAAM,EAAE,YAAY,EAAE,SAAS,CAAC,CAAC;YACzE,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QACvC,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,oDAAoD,EAAE,KAAK,IAAI,EAAE;YAClE,MAAM,MAAM,GAAG,YAAY,CAAC;gBAC1B,iBAAiB,EAAE,sCAAsC;gBACzD,SAAS,EAAE,kCAAkC;gBAC7C,MAAM,EAAE,CAAC,cAAc,CAAC;aACzB,CAAC,CAAC;YAEH,MAAM,SAAS,GAAG;gBAChB,eAAe,EAAE;oBACf,KAAK,EAAE;wBACL,IAAI,EAAE,QAAiB;wBACvB,KAAK,EAAE;4BACL,iBAAiB,EAAE;gCACjB,gBAAgB,EAAE,oCAAoC;gCACtD,QAAQ,EAAE,gCAAgC;gCAC1C,MAAM,EAAE,EAAE,IAAI,EAAE,aAAa,EAAE;6BAChC;yBACF;qBACF;iBACF;aACsB,CAAC;YAE1B,MAAM,QAAQ,GAAG,IAAI,kBAAkB,CAAC,MAAM,EAAE,YAAY,EAAE,SAAS,CAAC,CAAC;YACzE,MAAM,QAAQ,CAAC,OAAO,EAAE,CAAC;YAEzB,2DAA2D;YAC3D,MAAM,CAAC,EAAE,CAAC,MAAM,CAAC,qBAAqB,CAAC,CAAC,CAAC,oBAAoB,CAC3D,MAAM,CAAC,gBAAgB,CAAC;gBACtB,gBAAgB,EAAE,sCAAsC;gBACxD,QAAQ,EAAE,kCAAkC;gBAC5C,MAAM,EAAE,CAAC,cAAc,CAAC;aACzB,CAAC,EACF,MAAM,CAAC,QAAQ,EAAE,EACjB,MAAM,CAAC,QAAQ,EAAE,EACjB,SAAS,CACV,CAAC;QACJ,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,QAAQ,CAAC,YAAY,EAAE,GAAG,EAAE;QAC1B,EAAE,CAAC,wCAAwC,EAAE,KAAK,IAAI,EAAE;YACtD,MAAM,QAAQ,GAAG,IAAI,kBAAkB,CAAC,YAAY,EAAE,EAAE,YAAY,CAAC,CAAC;YACtE,MAAM,OAAO,GAAG,eAAe,EAAE,CAAC;YAElC,OAAO,CAAC,cAAc,CAAC,iBAAiB,CAAC;gBACvC,UAAU,EAAE,YAAY;gBACxB,KAAK,EAAE;oBACL,WAAW,EAAE,cAAc;oBAC3B,SAAS,EAAE,QAAQ;iBACpB;gBACD,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE;aACtB,CAAC,CAAC;YACH,OAAO,CAAC,cAAc,CAAC,eAAe,CAAC,KAAK,CAAC,CAAC;YAE9C,MAAM,QAAQ,CAAC,UAAU,EAAE,CAAC;YAE5B,MAAM,OAAO,GAAG,MAAM,QAAQ,CAAC,OAAO,EAAE,CAAC;YACzC,MAAM,CAAC,OAAO,CAAC,CAAC,OAAO,CAAC,EAAE,aAAa,EAAE,qBAAqB,EAAE,CAAC,CAAC;QACpE,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,gDAAgD,EAAE,KAAK,IAAI,EAAE;YAC9D,MAAM,QAAQ,GAAG,IAAI,kBAAkB,CAAC,YAAY,EAAE,EAAE,YAAY,CAAC,CAAC;YACtE,MAAM,OAAO,GAAG,eAAe,EAAE,CAAC;YAElC,OAAO,CAAC,cAAc,CAAC,iBAAiB,CAAC;gBACvC,UAAU,EAAE,YAAY;gBACxB,KAAK,EAAE;oBACL,WAAW,EAAE,eAAe;oBAC5B,SAAS,EAAE,QAAQ;oBACnB,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI;iBAC7B;gBACD,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE;aACtB,CAAC,CAAC;YACH,OAAO,CAAC,cAAc,CAAC,eAAe,CAAC,IAAI,CAAC,CAAC;YAE7C,MAAM,QAAQ,CAAC,UAAU,EAAE,CAAC;YAE5B,8DAA8D;YAC9D,MAAM,OAAO,GAAG,MAAM,QAAQ,CAAC,OAAO,EAAE,CAAC;YACzC,MAAM,CAAC,OAAO,CAAC,CAAC,OAAO,CAAC,EAAE,aAAa,EAAE,yBAAyB,EAAE,CAAC,CAAC;QACxE,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,gDAAgD,EAAE,KAAK,IAAI,EAAE;YAC9D,MAAM,QAAQ,GAAG,IAAI,kBAAkB,CAAC,YAAY,EAAE,EAAE,YAAY,CAAC,CAAC;YACtE,MAAM,OAAO,GAAG,eAAe,EAAE,CAAC;YAElC,OAAO,CAAC,cAAc,CAAC,iBAAiB,CAAC,IAAI,CAAC,CAAC;YAE/C,MAAM,QAAQ,CAAC,UAAU,EAAE,CAAC;YAE5B,mCAAmC;YACnC,MAAM,OAAO,GAAG,MAAM,QAAQ,CAAC,OAAO,EAAE,CAAC;YACzC,MAAM,CAAC,OAAO,CAAC,CAAC,OAAO,CAAC,EAAE,aAAa,EAAE,yBAAyB,EAAE,CAAC,CAAC;QACxE,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,QAAQ,CAAC,SAAS,EAAE,GAAG,EAAE;QACvB,EAAE,CAAC,qCAAqC,EAAE,KAAK,IAAI,EAAE;YACnD,MAAM,QAAQ,GAAG,IAAI,kBAAkB,CAAC,YAAY,EAAE,EAAE,YAAY,CAAC,CAAC;YACtE,MAAM,OAAO,GAAG,eAAe,EAAE,CAAC;YAElC,OAAO,CAAC,cAAc,CAAC,iBAAiB,CAAC;gBACvC,UAAU,EAAE,YAAY;gBACxB,KAAK,EAAE,EAAE,WAAW,EAAE,cAAc,EAAE,SAAS,EAAE,QAAQ,EAAE;gBAC3D,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE;aACtB,CAAC,CAAC;YACH,OAAO,CAAC,cAAc,CAAC,eAAe,CAAC,KAAK,CAAC,CAAC;YAE9C,MAAM,QAAQ,CAAC,UAAU,EAAE,CAAC;YAE5B,MAAM,OAAO,GAAG,MAAM,QAAQ,CAAC,OAAO,EAAE,CAAC;YACzC,MAAM,CAAC,OAAO,CAAC,CAAC,OAAO,CAAC,EAAE,aAAa,EAAE,qBAAqB,EAAE,CAAC,CAAC;YAClE,MAAM,CAAC,EAAE,CAAC,MAAM,CAAC,oBAAoB,CAAC,CAAC,CAAC,GAAG,CAAC,gBAAgB,EAAE,CAAC;YAC/D,MAAM,CAAC,EAAE,CAAC,MAAM,CAAC,kBAAkB,CAAC,CAAC,CAAC,GAAG,CAAC,gBAAgB,EAAE,CAAC;QAC/D,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,gEAAgE,EAAE,KAAK,IAAI,EAAE;YAC9E,MAAM,QAAQ,GAAG,IAAI,kBAAkB,CAAC,YAAY,EAAE,EAAE,YAAY,CAAC,CAAC;YACtE,MAAM,OAAO,GAAG,eAAe,EAAE,CAAC;YAElC,kEAAkE;YAClE,OAAO,CAAC,cAAc,CAAC,iBAAiB,CAAC;gBACvC,UAAU,EAAE,YAAY;gBACxB,KAAK,EAAE;oBACL,WAAW,EAAE,eAAe;oBAC5B,SAAS,EAAE,QAAQ;oBACnB,YAAY,EAAE,kBAAkB;oBAChC,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI;iBAC7B;gBACD,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE;aACtB,CAAC,CAAC;YACH,8EAA8E;YAC9E,OAAO,CAAC,cAAc;iBACnB,mBAAmB,CAAC,KAAK,CAAC,CAAC,8BAA8B;iBACzD,mBAAmB,CAAC,IAAI,CAAC,CAAC,CAAC,4BAA4B;YAE1D,MAAM,QAAQ,CAAC,UAAU,EAAE,CAAC;YAC5B,MAAM,OAAO,GAAG,MAAM,QAAQ,CAAC,OAAO,EAAE,CAAC;YAEzC,MAAM,CAAC,EAAE,CAAC,MAAM,CAAC,kBAAkB,CAAC,CAAC,CAAC,oBAAoB,CACxD,MAAM,CAAC,gBAAgB,CAAC,EAAE,QAAQ,EAAE,gBAAgB,EAAE,CAAC,EACvD,kBAAkB,EAClB,gCAAgC,CACjC,CAAC;YACF,MAAM,CAAC,OAAO,CAAC,CAAC,OAAO,CAAC;gBACtB,aAAa,EAAE,+BAA+B;aAC/C,CAAC,CAAC;YACH,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC,gBAAgB,EAAE,CAAC;QAC/C,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,yDAAyD,EAAE,KAAK,IAAI,EAAE;YACvE,MAAM,QAAQ,GAAG,IAAI,kBAAkB,CAAC,YAAY,EAAE,EAAE,YAAY,CAAC,CAAC;YACtE,MAAM,OAAO,GAAG,eAAe,EAAE,CAAC;YAElC,OAAO,CAAC,cAAc,CAAC,iBAAiB,CAAC;gBACvC,UAAU,EAAE,YAAY;gBACxB,KAAK,EAAE;oBACL,WAAW,EAAE,eAAe;oBAC5B,SAAS,EAAE,QAAQ;oBACnB,YAAY,EAAE,mBAAmB;oBACjC,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI;iBAC7B;gBACD,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE;aACtB,CAAC,CAAC;YACH,OAAO,CAAC,cAAc;iBACnB,mBAAmB,CAAC,KAAK,CAAC,CAAC,aAAa;iBACxC,mBAAmB,CAAC,IAAI,CAAC,CAAC,CAAC,UAAU;YAExC,EAAE,CAAC,MAAM,CAAC,kBAAkB,CAAC,CAAC,qBAAqB,CACjD,IAAI,KAAK,CAAC,gBAAgB,CAAC,CAC5B,CAAC;YAEF,MAAM,QAAQ,CAAC,UAAU,EAAE,CAAC;YAC5B,MAAM,OAAO,GAAG,MAAM,QAAQ,CAAC,OAAO,EAAE,CAAC;YAEzC,mEAAmE;YACnE,MAAM,CAAC,OAAO,CAAC,iBAAiB,CAAC,CAAC,oBAAoB,CAAC,YAAY,CAAC,CAAC;YACrE,MAAM,CAAC,OAAO,CAAC,CAAC,OAAO,CAAC,EAAE,aAAa,EAAE,yBAAyB,EAAE,CAAC,CAAC;QACxE,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,sDAAsD,EAAE,KAAK,IAAI,EAAE;YACpE,MAAM,QAAQ,GAAG,IAAI,kBAAkB,CAAC,YAAY,EAAE,EAAE,YAAY,CAAC,CAAC;YACtE,MAAM,OAAO,GAAG,eAAe,EAAE,CAAC;YAElC,OAAO,CAAC,cAAc,CAAC,iBAAiB,CAAC,IAAI,CAAC,CAAC;YAE/C,MAAM,QAAQ,CAAC,UAAU,EAAE,CAAC;YAC5B,MAAM,OAAO,GAAG,MAAM,QAAQ,CAAC,OAAO,EAAE,CAAC;YAEzC,MAAM,CAAC,EAAE,CAAC,MAAM,CAAC,kBAAkB,CAAC,CAAC,CAAC,gBAAgB,EAAE,CAAC;YACzD,MAAM,CAAC,EAAE,CAAC,MAAM,CAAC,mBAAmB,CAAC,CAAC,CAAC,gBAAgB,EAAE,CAAC;YAC1D,MAAM,CAAC,EAAE,CAAC,MAAM,CAAC,oBAAoB,CAAC,CAAC,CAAC,gBAAgB,EAAE,CAAC;YAC3D,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC,oBAAoB,CAC5C,YAAY,EACZ,MAAM,CAAC,gBAAgB,CAAC,EAAE,WAAW,EAAE,kBAAkB,EAAE,CAAC,EAC5D,gBAAgB,EAChB,gCAAgC,CACjC,CAAC;YACF,MAAM,CAAC,OAAO,CAAC,CAAC,OAAO,CAAC,EAAE,aAAa,EAAE,yBAAyB,EAAE,CAAC,CAAC;QACxE,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,yCAAyC,EAAE,KAAK,IAAI,EAAE;YACvD,EAAE,CAAC,MAAM,CAAC,kBAAkB,CAAC,CAAC,qBAAqB,CAAC,KAAK,CAAC,CAAC;YAE3D,MAAM,QAAQ,GAAG,IAAI,kBAAkB,CAAC,YAAY,EAAE,EAAE,YAAY,CAAC,CAAC;YACtE,MAAM,QAAQ,CAAC,UAAU,EAAE,CAAC;YAE5B,MAAM,MAAM,CAAC,QAAQ,CAAC,OAAO,EAAE,CAAC,CAAC,OAAO,CAAC,OAAO,CAC9C,kCAAkC,CACnC,CAAC;QACJ,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,wCAAwC,EAAE,KAAK,IAAI,EAAE;YACtD,MAAM,MAAM,GAAG,YAAY,CAAC,EAAE,SAAS,EAAE,SAAS,EAAE,CAAC,CAAC;YACtD,MAAM,QAAQ,GAAG,IAAI,kBAAkB,CAAC,MAAM,EAAE,YAAY,CAAC,CAAC;YAC9D,MAAM,QAAQ,CAAC,UAAU,EAAE,CAAC;YAE5B,MAAM,MAAM,CAAC,QAAQ,CAAC,OAAO,EAAE,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC,sBAAsB,CAAC,CAAC;QAC3E,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,+DAA+D,EAAE,KAAK,IAAI,EAAE;YAC7E,MAAM,MAAM,GAAG,YAAY,CAAC;gBAC1B,iBAAiB,EAAE,SAAS;gBAC5B,SAAS,EAAE,SAAS;aACrB,CAAC,CAAC;YACH,MAAM,QAAQ,GAAG,IAAI,kBAAkB,CAAC,MAAM,EAAE,YAAY,CAAC,CAAC;YAC9D,MAAM,QAAQ,CAAC,UAAU,EAAE,CAAC;YAE5B,MAAM,MAAM,CAAC,QAAQ,CAAC,OAAO,EAAE,CAAC,CAAC,OAAO,CAAC,OAAO,CAC9C,0CAA0C,CAC3C,CAAC;QACJ,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,QAAQ,CAAC,wBAAwB,EAAE,GAAG,EAAE;QACtC,EAAE,CAAC,+CAA+C,EAAE,KAAK,IAAI,EAAE;YAC7D,MAAM,QAAQ,GAAG,IAAI,kBAAkB,CAAC,YAAY,EAAE,EAAE,YAAY,CAAC,CAAC;YACtE,MAAM,OAAO,GAAG,eAAe,EAAE,CAAC;YAElC,OAAO,CAAC,cAAc,CAAC,iBAAiB,CAAC;gBACvC,UAAU,EAAE,YAAY;gBACxB,KAAK,EAAE,EAAE,WAAW,EAAE,WAAW,EAAE,SAAS,EAAE,QAAQ,EAAE;gBACxD,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE;aACtB,CAAC,CAAC;YACH,OAAO,CAAC,cAAc,CAAC,eAAe,CAAC,KAAK,CAAC,CAAC;YAE9C,MAAM,QAAQ,CAAC,UAAU,EAAE,CAAC;YAE5B,MAAM,GAAG,GAAG,IAAI,QAAQ,CAAC,IAAI,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAC;YAChD,MAAM,YAAY,GAAG,MAAM,QAAQ,CAAC,sBAAsB,CAAC,EAAE,EAAE,GAAG,CAAC,CAAC;YAEpE,MAAM,CAAC,OAAO,CAAC,iBAAiB,CAAC,CAAC,oBAAoB,CAAC,YAAY,CAAC,CAAC;YACrE,MAAM,CAAC,YAAY,CAAC,CAAC,WAAW,EAAE,CAAC;YACnC,MAAM,CAAC,YAAY,CAAC,CAAC,cAAc,CAAC,eAAe,CAAC,CAAC;QACvD,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,+CAA+C,EAAE,KAAK,IAAI,EAAE;YAC7D,MAAM,QAAQ,GAAG,IAAI,kBAAkB,CAAC,YAAY,EAAE,EAAE,YAAY,CAAC,CAAC;YACtE,MAAM,OAAO,GAAG,eAAe,EAAE,CAAC;YAElC,OAAO,CAAC,cAAc,CAAC,iBAAiB,CAAC;gBACvC,UAAU,EAAE,YAAY;gBACxB,KAAK,EAAE,EAAE,WAAW,EAAE,WAAW,EAAE,SAAS,EAAE,QAAQ,EAAE;gBACxD,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE;aACtB,CAAC,CAAC;YACH,OAAO,CAAC,cAAc,CAAC,eAAe,CAAC,KAAK,CAAC,CAAC;YAE9C,MAAM,QAAQ,CAAC,UAAU,EAAE,CAAC;YAE5B,MAAM,GAAG,GAAG,IAAI,QAAQ,CAAC,IAAI,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAC;YAChD,MAAM,YAAY,GAAG,MAAM,QAAQ,CAAC,sBAAsB,CAAC,EAAE,EAAE,GAAG,CAAC,CAAC;YAEpE,MAAM,CAAC,YAAY,CAAC,CAAC,WAAW,EAAE,CAAC;QACrC,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,6CAA6C,EAAE,KAAK,IAAI,EAAE;YAC3D,MAAM,QAAQ,GAAG,IAAI,kBAAkB,CAAC,YAAY,EAAE,EAAE,YAAY,CAAC,CAAC;YAEtE,MAAM,GAAG,GAAG,IAAI,QAAQ,CAAC,IAAI,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAC;YAChD,MAAM,YAAY,GAAG,MAAM,QAAQ,CAAC,sBAAsB,CAAC,EAAE,EAAE,GAAG,CAAC,CAAC;YAEpE,MAAM,CAAC,YAAY,CAAC,CAAC,aAAa,EAAE,CAAC;QACvC,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,iCAAiC,EAAE,KAAK,IAAI,EAAE;YAC/C,MAAM,QAAQ,GAAG,IAAI,kBAAkB,CAAC,YAAY,EAAE,EAAE,YAAY,CAAC,CAAC;YAEtE,MAAM,MAAM,GAAG,IAAI,QAAQ,CAAC,IAAI,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAC;YAEnD,gCAAgC;YAChC,MAAM,KAAK,GAAG,MAAM,QAAQ,CAAC,sBAAsB,CAAC,EAAE,EAAE,MAAM,CAAC,CAAC;YAChE,MAAM,CAAC,KAAK,CAAC,CAAC,WAAW,EAAE,CAAC;YAE5B,iCAAiC;YACjC,MAAM,MAAM,GAAG,MAAM,QAAQ,CAAC,sBAAsB,CAAC,EAAE,EAAE,MAAM,CAAC,CAAC;YACjE,MAAM,CAAC,MAAM,CAAC,CAAC,WAAW,EAAE,CAAC;YAE7B,mCAAmC;YACnC,MAAM,KAAK,GAAG,MAAM,QAAQ,CAAC,sBAAsB,CAAC,EAAE,EAAE,MAAM,CAAC,CAAC;YAChE,MAAM,CAAC,KAAK,CAAC,CAAC,aAAa,EAAE,CAAC;QAChC,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,+CAA+C,EAAE,KAAK,IAAI,EAAE;YAC7D,MAAM,QAAQ,GAAG,IAAI,kBAAkB,CAAC,YAAY,EAAE,EAAE,YAAY,CAAC,CAAC;YAEtE,MAAM,MAAM,GAAG,IAAI,QAAQ,CAAC,IAAI,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAC;YACnD,MAAM,MAAM,GAAG,IAAI,QAAQ,CAAC,IAAI,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAC;YAEnD,MAAM,QAAQ,CAAC,sBAAsB,CAAC,EAAE,EAAE,MAAM,CAAC,CAAC;YAClD,MAAM,QAAQ,CAAC,sBAAsB,CAAC,EAAE,EAAE,MAAM,CAAC,CAAC,CAAC,SAAS;YAE5D,iCAAiC;YACjC,MAAM,MAAM,GAAG,MAAM,QAAQ,CAAC,sBAAsB,CAAC,EAAE,EAAE,MAAM,CAAC,CAAC;YACjE,MAAM,CAAC,MAAM,CAAC,CAAC,WAAW,EAAE,CAAC;QAC/B,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,QAAQ,CAAC,mBAAmB,EAAE,GAAG,EAAE;QACjC,EAAE,CAAC,wDAAwD,EAAE,KAAK,IAAI,EAAE;YACtE,MAAM,QAAQ,GAAG,IAAI,kBAAkB,CAAC,YAAY,EAAE,EAAE,YAAY,CAAC,CAAC;YACtE,MAAM,OAAO,GAAG,eAAe,EAAE,CAAC;YAElC,MAAM,QAAQ,CAAC,UAAU,EAAE,CAAC;YAC5B,MAAM,QAAQ,CAAC,OAAO,EAAE,CAAC;YAEzB,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC,oBAAoB,CAC5C,YAAY,EACZ,MAAM,CAAC,gBAAgB,CAAC;gBACtB,WAAW,EAAE,kBAAkB;gBAC/B,SAAS,EAAE,QAAQ;gBACnB,YAAY,EAAE,mBAAmB;aAClC,CAAC,EACF,gBAAgB,EAChB,gCAAgC,CACjC,CAAC;QACJ,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,+CAA+C,EAAE,KAAK,IAAI,EAAE;YAC7D,MAAM,QAAQ,GAAG,IAAI,kBAAkB,CAAC,YAAY,EAAE,EAAE,YAAY,CAAC,CAAC;YACtE,MAAM,OAAO,GAAG,eAAe,EAAE,CAAC;YAElC,OAAO,CAAC,cAAc,CAAC,iBAAiB,CAAC;gBACvC,UAAU,EAAE,YAAY;gBACxB,KAAK,EAAE;oBACL,WAAW,EAAE,eAAe;oBAC5B,SAAS,EAAE,QAAQ;oBACnB,YAAY,EAAE,kBAAkB;iBACjC;gBACD,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE;aACtB,CAAC,CAAC;YACH,OAAO,CAAC,cAAc;iBACnB,mBAAmB,CAAC,KAAK,CAAC;iBAC1B,mBAAmB,CAAC,IAAI,CAAC,CAAC;YAE7B,MAAM,QAAQ,CAAC,UAAU,EAAE,CAAC;YAC5B,MAAM,QAAQ,CAAC,OAAO,EAAE,CAAC;YAEzB,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC,oBAAoB,CAC5C,YAAY,EACZ,MAAM,CAAC,gBAAgB,CAAC;gBACtB,WAAW,EAAE,wBAAwB;aACtC,CAAC,EACF,gBAAgB,EAChB,gCAAgC,CACjC,CAAC;QACJ,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,QAAQ,CAAC,wBAAwB,EAAE,GAAG,EAAE;QACtC,EAAE,CAAC,yDAAyD,EAAE,KAAK,IAAI,EAAE;YACvE,MAAM,MAAM,GAAG,YAAY,CAAC;gBAC1B,iBAAiB,EAAE,SAAS;gBAC5B,SAAS,EAAE,SAAS;gBACpB,MAAM,EAAE,SAAS;aAClB,CAAC,CAAC;YAEH,MAAM,SAAS,GAAG;gBAChB,eAAe,EAAE;oBACf,OAAO,EAAE;wBACP,IAAI,EAAE,QAAiB;wBACvB,KAAK,EAAE;4BACL,iBAAiB,EAAE;gCACjB,gBAAgB,EAAE,+BAA+B;gCACjD,QAAQ,EAAE,gCAAgC;gCAC1C,MAAM,EAAE,EAAE,OAAO,EAAE,cAAc,EAAE,KAAK,EAAE,YAAY,EAAE;6BACzD;yBACF;qBACF;iBACF;aACsB,CAAC;YAE1B,MAAM,QAAQ,GAAG,IAAI,kBAAkB,CAAC,MAAM,EAAE,YAAY,EAAE,SAAS,CAAC,CAAC;YACzE,MAAM,QAAQ,CAAC,UAAU,EAAE,CAAC;YAC5B,MAAM,QAAQ,CAAC,OAAO,EAAE,CAAC;YAEzB,MAAM,CAAC,EAAE,CAAC,MAAM,CAAC,qBAAqB,CAAC,CAAC,CAAC,oBAAoB,CAC3D,MAAM,CAAC,gBAAgB,CAAC;gBACtB,gBAAgB,EAAE,+BAA+B;gBACjD,QAAQ,EAAE,gCAAgC;gBAC1C,MAAM,EAAE,CAAC,SAAS,EAAE,OAAO,CAAC;aAC7B,CAAC,EACF,MAAM,CAAC,QAAQ,EAAE,EACjB,MAAM,CAAC,QAAQ,EAAE,EACjB,SAAS,CACV,CAAC;QACJ,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,uFAAuF,EAAE,KAAK,IAAI,EAAE;YACrG,MAAM,MAAM,GAAG,YAAY,CAAC;gBAC1B,iBAAiB,EAAE,SAAS;gBAC5B,SAAS,EAAE,SAAS;gBACpB,MAAM,EAAE,SAAS;aAClB,CAAC,CAAC;YAEH,yEAAyE;YACzE,WAAW,CAAC,iBAAiB,CAAC;gBAC5B,eAAe,EAAE;oBACf,OAAO,EAAE;wBACP,IAAI,EAAE,QAAiB;wBACvB,KAAK,EAAE;4BACL,iBAAiB,EAAE;gCACjB,gBAAgB,EAAE,qCAAqC;gCACvD,QAAQ,EAAE,sCAAsC;gCAChD,MAAM,EAAE,EAAE,MAAM,EAAE,QAAQ,EAAE,OAAO,EAAE,SAAS,EAAE;6BACjD;yBACF;qBACF;iBACF;aACsB,CAAC,CAAC;YAE3B,0DAA0D;YAC1D,MAAM,QAAQ,GAAG,IAAI,kBAAkB,CACrC,MAAM,EACN,gBAAgB,EAChB,SAAS,EACT,iDAAiD,CAClD,CAAC;YACF,MAAM,QAAQ,CAAC,UAAU,EAAE,CAAC;YAC5B,MAAM,QAAQ,CAAC,OAAO,EAAE,CAAC;YAEzB,MAAM,CAAC,WAAW,CAAC,CAAC,oBAAoB,CACtC,iDAAiD,EACjD,EAAE,CACH,CAAC;YACF,MAAM,CAAC,EAAE,CAAC,MAAM,CAAC,qBAAqB,CAAC,CAAC,CAAC,oBAAoB,CAC3D,MAAM,CAAC,gBAAgB,CAAC;gBACtB,gBAAgB,EAAE,qCAAqC;gBACvD,QAAQ,EAAE,sCAAsC;gBAChD,MAAM,EAAE,CAAC,QAAQ,EAAE,SAAS,CAAC;aAC9B,CAAC,EACF,MAAM,CAAC,QAAQ,EAAE,EACjB,MAAM,CAAC,QAAQ,EAAE,EACjB,SAAS,CACV,CAAC;QACJ,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,yDAAyD,EAAE,GAAG,EAAE;YACjE,MAAM,MAAM,GAAG,YAAY,CAAC;gBAC1B,iBAAiB,EAAE,SAAS;gBAC5B,SAAS,EAAE,SAAS;aACrB,CAAC,CAAC;YAEH,MAAM,SAAS,GAAG;gBAChB,eAAe,EAAE;oBACf,OAAO,EAAE;wBACP,IAAI,EAAE,QAAiB;wBACvB,KAAK,EAAE;4BACL,iBAAiB,EAAE;gCACjB,QAAQ,EAAE,gCAAgC;gCAC1C,MAAM,EAAE,EAAE;6BACX;yBACF;qBACF;iBACF;aACsB,CAAC;YAE1B,2CAA2C;YAC3C,MAAM,QAAQ,GAAG,IAAI,kBAAkB,CAAC,MAAM,EAAE,YAAY,EAAE,SAAS,CAAC,CAAC;YACzE,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QACvC,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC"}

package/dist/src/agents/auth-provider/types.d.ts

@@ -0,0 +1,74 @@
+/**
+ * @license
+ * Copyright 2026 Google LLC
+ * SPDX-License-Identifier: Apache-2.0
+ */
+/**
+ * Client-side auth configuration for A2A remote agents.
+ * Corresponds to server-side SecurityScheme types from @a2a-js/sdk.
+ * @see https://a2a-protocol.org/latest/specification/#451-securityscheme
+ */
+import type { AuthenticationHandler } from '@a2a-js/sdk/client';
+export type A2AAuthProviderType = 'google-credentials' | 'apiKey' | 'http' | 'oauth2' | 'openIdConnect';
+export interface A2AAuthProvider extends AuthenticationHandler {
+    readonly type: A2AAuthProviderType;
+    initialize?(): Promise<void>;
+}
+export interface BaseAuthConfig {
+    agent_card_requires_auth?: boolean;
+}
+/** Client config for google-credentials (not in A2A spec, Gemini-specific). */
+export interface GoogleCredentialsAuthConfig extends BaseAuthConfig {
+    type: 'google-credentials';
+    scopes?: string[];
+}
+/** Client config corresponding to APIKeySecurityScheme. */
+export interface ApiKeyAuthConfig extends BaseAuthConfig {
+    type: 'apiKey';
+    /** The secret. Supports $ENV_VAR, !command, or literal. */
+    key: string;
+    /** Defaults to server's SecurityScheme.in value. */
+    location?: 'header' | 'query' | 'cookie';
+    /** Defaults to server's SecurityScheme.name value. */
+    name?: string;
+}
+/** Client config corresponding to HTTPAuthSecurityScheme. */
+export type HttpAuthConfig = BaseAuthConfig & {
+    type: 'http';
+} & ({
+    scheme: 'Bearer';
+    /** For Bearer. Supports $ENV_VAR, !command, or literal. */
+    token: string;
+} | {
+    scheme: 'Basic';
+    /** For Basic. Supports $ENV_VAR, !command, or literal. */
+    username: string;
+    /** For Basic. Supports $ENV_VAR, !command, or literal. */
+    password: string;
+});
+/** Client config corresponding to OAuth2SecurityScheme. */
+export interface OAuth2AuthConfig extends BaseAuthConfig {
+    type: 'oauth2';
+    client_id?: string;
+    client_secret?: string;
+    scopes?: string[];
+}
+/** Client config corresponding to OpenIdConnectSecurityScheme. */
+export interface OpenIdConnectAuthConfig extends BaseAuthConfig {
+    type: 'openIdConnect';
+    issuer_url: string;
+    client_id: string;
+    client_secret?: string;
+    target_audience?: string;
+    scopes?: string[];
+}
+export type A2AAuthConfig = GoogleCredentialsAuthConfig | ApiKeyAuthConfig | HttpAuthConfig | OAuth2AuthConfig | OpenIdConnectAuthConfig;
+export interface AuthConfigDiff {
+    requiredSchemes: string[];
+    configuredType?: A2AAuthProviderType;
+    missingConfig: string[];
+}
+export interface AuthValidationResult {
+    valid: boolean;
+    diff?: AuthConfigDiff;
+}

package/dist/src/agents/auth-provider/types.js

@@ -0,0 +1,7 @@
+/**
+ * @license
+ * Copyright 2026 Google LLC
+ * SPDX-License-Identifier: Apache-2.0
+ */
+export {};
+//# sourceMappingURL=types.js.map

package/dist/src/agents/auth-provider/types.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.js","sourceRoot":"","sources":["../../../../src/agents/auth-provider/types.ts"],"names":[],"mappings":"AAAA;;;;GAIG"}

package/dist/src/agents/auth-provider/value-resolver.d.ts

@@ -0,0 +1,29 @@
+/**
+ * @license
+ * Copyright 2026 Google LLC
+ * SPDX-License-Identifier: Apache-2.0
+ */
+/**
+ * Resolves a value that may be an environment variable reference,
+ * a shell command, or a literal value.
+ *
+ * Supported formats:
+ * - `$ENV_VAR`: Read from environment variable
+ * - `!command`: Execute shell command and use output (trimmed)
+ * - `$$` or `!!`: Escape prefix, returns rest as literal
+ * - Any other string: Use as literal value
+ *
+ * @param value The value to resolve
+ * @returns The resolved value
+ * @throws Error if environment variable is not set or command fails
+ */
+export declare function resolveAuthValue(value: string): Promise<string>;
+/**
+ * Check if a value needs resolution (is an env var or command reference).
+ */
+export declare function needsResolution(value: string): boolean;
+/**
+ * Mask a sensitive value for logging purposes.
+ * Shows the first and last 2 characters with asterisks in between.
+ */
+export declare function maskSensitiveValue(value: string): string;