@office-ai/aioncli-core 0.30.0 → 0.30.1

package/dist/src/agents/auth-provider/http-provider.d.ts

@@ -0,0 +1,28 @@
+/**
+ * @license
+ * Copyright 2026 Google LLC
+ * SPDX-License-Identifier: Apache-2.0
+ */
+import type { HttpHeaders } from '@a2a-js/sdk/client';
+import { BaseA2AAuthProvider } from './base-provider.js';
+import type { HttpAuthConfig } from './types.js';
+/**
+ * Authentication provider for HTTP authentication schemes.
+ * Supports Bearer, Basic, and any IANA-registered scheme via raw value.
+ */
+export declare class HttpAuthProvider extends BaseA2AAuthProvider {
+    private readonly config;
+    readonly type: "http";
+    private resolvedToken?;
+    private resolvedUsername?;
+    private resolvedPassword?;
+    private resolvedValue?;
+    constructor(config: HttpAuthConfig);
+    initialize(): Promise<void>;
+    headers(): Promise<HttpHeaders>;
+    /**
+     * Re-resolves credentials on auth failure (e.g. rotated tokens via $ENV or !command).
+     * Respects MAX_AUTH_RETRIES from the base class to prevent infinite loops.
+     */
+    shouldRetryWithHeaders(req: RequestInit, res: Response): Promise<HttpHeaders | undefined>;
+}

package/dist/src/agents/auth-provider/http-provider.js

@@ -0,0 +1,73 @@
+/**
+ * @license
+ * Copyright 2026 Google LLC
+ * SPDX-License-Identifier: Apache-2.0
+ */
+import { BaseA2AAuthProvider } from './base-provider.js';
+import { resolveAuthValue } from './value-resolver.js';
+import { debugLogger } from '../../utils/debugLogger.js';
+/**
+ * Authentication provider for HTTP authentication schemes.
+ * Supports Bearer, Basic, and any IANA-registered scheme via raw value.
+ */
+export class HttpAuthProvider extends BaseA2AAuthProvider {
+    config;
+    type = 'http';
+    resolvedToken;
+    resolvedUsername;
+    resolvedPassword;
+    resolvedValue;
+    constructor(config) {
+        super();
+        this.config = config;
+    }
+    async initialize() {
+        const config = this.config;
+        if ('token' in config) {
+            this.resolvedToken = await resolveAuthValue(config.token);
+        }
+        else if ('username' in config) {
+            this.resolvedUsername = await resolveAuthValue(config.username);
+            this.resolvedPassword = await resolveAuthValue(config.password);
+        }
+        else {
+            // Generic raw value for any other IANA-registered scheme
+            this.resolvedValue = await resolveAuthValue(config.value);
+        }
+        debugLogger.debug(`[HttpAuthProvider] Initialized with scheme: ${this.config.scheme}`);
+    }
+    async headers() {
+        const config = this.config;
+        if ('token' in config) {
+            if (!this.resolvedToken)
+                throw new Error('HttpAuthProvider not initialized');
+            return { Authorization: `Bearer ${this.resolvedToken}` };
+        }
+        if ('username' in config) {
+            if (!this.resolvedUsername || !this.resolvedPassword) {
+                throw new Error('HttpAuthProvider not initialized');
+            }
+            const credentials = Buffer.from(`${this.resolvedUsername}:${this.resolvedPassword}`).toString('base64');
+            return { Authorization: `Basic ${credentials}` };
+        }
+        // Generic raw value for any other IANA-registered scheme
+        if (!this.resolvedValue)
+            throw new Error('HttpAuthProvider not initialized');
+        return { Authorization: `${config.scheme} ${this.resolvedValue}` };
+    }
+    /**
+     * Re-resolves credentials on auth failure (e.g. rotated tokens via $ENV or !command).
+     * Respects MAX_AUTH_RETRIES from the base class to prevent infinite loops.
+     */
+    async shouldRetryWithHeaders(req, res) {
+        if (res.status === 401 || res.status === 403) {
+            if (this.authRetryCount >= BaseA2AAuthProvider.MAX_AUTH_RETRIES) {
+                return undefined;
+            }
+            debugLogger.debug('[HttpAuthProvider] Re-resolving values after auth failure');
+            await this.initialize();
+        }
+        return super.shouldRetryWithHeaders(req, res);
+    }
+}
+//# sourceMappingURL=http-provider.js.map

package/dist/src/agents/auth-provider/http-provider.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"http-provider.js","sourceRoot":"","sources":["../../../../src/agents/auth-provider/http-provider.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAGH,OAAO,EAAE,mBAAmB,EAAE,MAAM,oBAAoB,CAAC;AAEzD,OAAO,EAAE,gBAAgB,EAAE,MAAM,qBAAqB,CAAC;AACvD,OAAO,EAAE,WAAW,EAAE,MAAM,4BAA4B,CAAC;AAEzD;;;GAGG;AACH,MAAM,OAAO,gBAAiB,SAAQ,mBAAmB;IAQ1B;IAPpB,IAAI,GAAG,MAAe,CAAC;IAExB,aAAa,CAAU;IACvB,gBAAgB,CAAU;IAC1B,gBAAgB,CAAU;IAC1B,aAAa,CAAU;IAE/B,YAA6B,MAAsB;QACjD,KAAK,EAAE,CAAC;QADmB,WAAM,GAAN,MAAM,CAAgB;IAEnD,CAAC;IAEQ,KAAK,CAAC,UAAU;QACvB,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC;QAC3B,IAAI,OAAO,IAAI,MAAM,EAAE,CAAC;YACtB,IAAI,CAAC,aAAa,GAAG,MAAM,gBAAgB,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QAC5D,CAAC;aAAM,IAAI,UAAU,IAAI,MAAM,EAAE,CAAC;YAChC,IAAI,CAAC,gBAAgB,GAAG,MAAM,gBAAgB,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;YAChE,IAAI,CAAC,gBAAgB,GAAG,MAAM,gBAAgB,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;QAClE,CAAC;aAAM,CAAC;YACN,yDAAyD;YACzD,IAAI,CAAC,aAAa,GAAG,MAAM,gBAAgB,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QAC5D,CAAC;QACD,WAAW,CAAC,KAAK,CACf,+CAA+C,IAAI,CAAC,MAAM,CAAC,MAAM,EAAE,CACpE,CAAC;IACJ,CAAC;IAEQ,KAAK,CAAC,OAAO;QACpB,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC;QAC3B,IAAI,OAAO,IAAI,MAAM,EAAE,CAAC;YACtB,IAAI,CAAC,IAAI,CAAC,aAAa;gBACrB,MAAM,IAAI,KAAK,CAAC,kCAAkC,CAAC,CAAC;YACtD,OAAO,EAAE,aAAa,EAAE,UAAU,IAAI,CAAC,aAAa,EAAE,EAAE,CAAC;QAC3D,CAAC;QAED,IAAI,UAAU,IAAI,MAAM,EAAE,CAAC;YACzB,IAAI,CAAC,IAAI,CAAC,gBAAgB,IAAI,CAAC,IAAI,CAAC,gBAAgB,EAAE,CAAC;gBACrD,MAAM,IAAI,KAAK,CAAC,kCAAkC,CAAC,CAAC;YACtD,CAAC;YACD,MAAM,WAAW,GAAG,MAAM,CAAC,IAAI,CAC7B,GAAG,IAAI,CAAC,gBAAgB,IAAI,IAAI,CAAC,gBAAgB,EAAE,CACpD,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;YACrB,OAAO,EAAE,aAAa,EAAE,SAAS,WAAW,EAAE,EAAE,CAAC;QACnD,CAAC;QAED,yDAAyD;QACzD,IAAI,CAAC,IAAI,CAAC,aAAa;YACrB,MAAM,IAAI,KAAK,CAAC,kCAAkC,CAAC,CAAC;QACtD,OAAO,EAAE,aAAa,EAAE,GAAG,MAAM,CAAC,MAAM,IAAI,IAAI,CAAC,aAAa,EAAE,EAAE,CAAC;IACrE,CAAC;IAED;;;OAGG;IACM,KAAK,CAAC,sBAAsB,CACnC,GAAgB,EAChB,GAAa;QAEb,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;YAC7C,IAAI,IAAI,CAAC,cAAc,IAAI,mBAAmB,CAAC,gBAAgB,EAAE,CAAC;gBAChE,OAAO,SAAS,CAAC;YACnB,CAAC;YACD,WAAW,CAAC,KAAK,CACf,2DAA2D,CAC5D,CAAC;YACF,MAAM,IAAI,CAAC,UAAU,EAAE,CAAC;QAC1B,CAAC;QACD,OAAO,KAAK,CAAC,sBAAsB,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;IAChD,CAAC;CACF"}

package/dist/src/agents/auth-provider/http-provider.test.d.ts

@@ -0,0 +1,6 @@
+/**
+ * @license
+ * Copyright 2026 Google LLC
+ * SPDX-License-Identifier: Apache-2.0
+ */
+export {};

package/dist/src/agents/auth-provider/http-provider.test.js

@@ -0,0 +1,112 @@
+/**
+ * @license
+ * Copyright 2026 Google LLC
+ * SPDX-License-Identifier: Apache-2.0
+ */
+import { describe, it, expect, vi, beforeEach } from 'vitest';
+import { HttpAuthProvider } from './http-provider.js';
+describe('HttpAuthProvider', () => {
+    beforeEach(() => {
+        vi.clearAllMocks();
+    });
+    describe('Bearer Authentication', () => {
+        it('should provide Bearer token header', async () => {
+            const config = {
+                type: 'http',
+                scheme: 'Bearer',
+                token: 'test-token',
+            };
+            const provider = new HttpAuthProvider(config);
+            await provider.initialize();
+            const headers = await provider.headers();
+            expect(headers).toEqual({ Authorization: 'Bearer test-token' });
+        });
+        it('should resolve token from environment variable', async () => {
+            process.env['TEST_TOKEN'] = 'env-token';
+            const config = {
+                type: 'http',
+                scheme: 'Bearer',
+                token: '$TEST_TOKEN',
+            };
+            const provider = new HttpAuthProvider(config);
+            await provider.initialize();
+            const headers = await provider.headers();
+            expect(headers).toEqual({ Authorization: 'Bearer env-token' });
+            delete process.env['TEST_TOKEN'];
+        });
+    });
+    describe('Basic Authentication', () => {
+        it('should provide Basic auth header', async () => {
+            const config = {
+                type: 'http',
+                scheme: 'Basic',
+                username: 'user',
+                password: 'password',
+            };
+            const provider = new HttpAuthProvider(config);
+            await provider.initialize();
+            const headers = await provider.headers();
+            const expected = Buffer.from('user:password').toString('base64');
+            expect(headers).toEqual({ Authorization: `Basic ${expected}` });
+        });
+    });
+    describe('Generic/Raw Authentication', () => {
+        it('should provide custom scheme with raw value', async () => {
+            const config = {
+                type: 'http',
+                scheme: 'CustomScheme',
+                value: 'raw-value-here',
+            };
+            const provider = new HttpAuthProvider(config);
+            await provider.initialize();
+            const headers = await provider.headers();
+            expect(headers).toEqual({ Authorization: 'CustomScheme raw-value-here' });
+        });
+        it('should support Digest via raw value', async () => {
+            const config = {
+                type: 'http',
+                scheme: 'Digest',
+                value: 'username="foo", response="bar"',
+            };
+            const provider = new HttpAuthProvider(config);
+            await provider.initialize();
+            const headers = await provider.headers();
+            expect(headers).toEqual({
+                Authorization: 'Digest username="foo", response="bar"',
+            });
+        });
+    });
+    describe('Retry logic', () => {
+        it('should re-initialize on 401 for Bearer', async () => {
+            const config = {
+                type: 'http',
+                scheme: 'Bearer',
+                token: '$DYNAMIC_TOKEN',
+            };
+            process.env['DYNAMIC_TOKEN'] = 'first';
+            const provider = new HttpAuthProvider(config);
+            await provider.initialize();
+            process.env['DYNAMIC_TOKEN'] = 'second';
+            const mockResponse = { status: 401 };
+            const retryHeaders = await provider.shouldRetryWithHeaders({}, mockResponse);
+            expect(retryHeaders).toEqual({ Authorization: 'Bearer second' });
+            delete process.env['DYNAMIC_TOKEN'];
+        });
+        it('should stop after max retries', async () => {
+            const config = {
+                type: 'http',
+                scheme: 'Bearer',
+                token: 'token',
+            };
+            const provider = new HttpAuthProvider(config);
+            await provider.initialize();
+            const mockResponse = { status: 401 };
+            // MAX_AUTH_RETRIES is 2
+            await provider.shouldRetryWithHeaders({}, mockResponse);
+            await provider.shouldRetryWithHeaders({}, mockResponse);
+            const third = await provider.shouldRetryWithHeaders({}, mockResponse);
+            expect(third).toBeUndefined();
+        });
+    });
+});
+//# sourceMappingURL=http-provider.test.js.map

package/dist/src/agents/auth-provider/http-provider.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"http-provider.test.js","sourceRoot":"","sources":["../../../../src/agents/auth-provider/http-provider.test.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,EAAE,QAAQ,EAAE,EAAE,EAAE,MAAM,EAAE,EAAE,EAAE,UAAU,EAAE,MAAM,QAAQ,CAAC;AAC9D,OAAO,EAAE,gBAAgB,EAAE,MAAM,oBAAoB,CAAC;AAEtD,QAAQ,CAAC,kBAAkB,EAAE,GAAG,EAAE;IAChC,UAAU,CAAC,GAAG,EAAE;QACd,EAAE,CAAC,aAAa,EAAE,CAAC;IACrB,CAAC,CAAC,CAAC;IAEH,QAAQ,CAAC,uBAAuB,EAAE,GAAG,EAAE;QACrC,EAAE,CAAC,oCAAoC,EAAE,KAAK,IAAI,EAAE;YAClD,MAAM,MAAM,GAAG;gBACb,IAAI,EAAE,MAAe;gBACrB,MAAM,EAAE,QAAiB;gBACzB,KAAK,EAAE,YAAY;aACpB,CAAC;YACF,MAAM,QAAQ,GAAG,IAAI,gBAAgB,CAAC,MAAM,CAAC,CAAC;YAC9C,MAAM,QAAQ,CAAC,UAAU,EAAE,CAAC;YAE5B,MAAM,OAAO,GAAG,MAAM,QAAQ,CAAC,OAAO,EAAE,CAAC;YACzC,MAAM,CAAC,OAAO,CAAC,CAAC,OAAO,CAAC,EAAE,aAAa,EAAE,mBAAmB,EAAE,CAAC,CAAC;QAClE,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,gDAAgD,EAAE,KAAK,IAAI,EAAE;YAC9D,OAAO,CAAC,GAAG,CAAC,YAAY,CAAC,GAAG,WAAW,CAAC;YACxC,MAAM,MAAM,GAAG;gBACb,IAAI,EAAE,MAAe;gBACrB,MAAM,EAAE,QAAiB;gBACzB,KAAK,EAAE,aAAa;aACrB,CAAC;YACF,MAAM,QAAQ,GAAG,IAAI,gBAAgB,CAAC,MAAM,CAAC,CAAC;YAC9C,MAAM,QAAQ,CAAC,UAAU,EAAE,CAAC;YAE5B,MAAM,OAAO,GAAG,MAAM,QAAQ,CAAC,OAAO,EAAE,CAAC;YACzC,MAAM,CAAC,OAAO,CAAC,CAAC,OAAO,CAAC,EAAE,aAAa,EAAE,kBAAkB,EAAE,CAAC,CAAC;YAC/D,OAAO,OAAO,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC;QACnC,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,QAAQ,CAAC,sBAAsB,EAAE,GAAG,EAAE;QACpC,EAAE,CAAC,kCAAkC,EAAE,KAAK,IAAI,EAAE;YAChD,MAAM,MAAM,GAAG;gBACb,IAAI,EAAE,MAAe;gBACrB,MAAM,EAAE,OAAgB;gBACxB,QAAQ,EAAE,MAAM;gBAChB,QAAQ,EAAE,UAAU;aACrB,CAAC;YACF,MAAM,QAAQ,GAAG,IAAI,gBAAgB,CAAC,MAAM,CAAC,CAAC;YAC9C,MAAM,QAAQ,CAAC,UAAU,EAAE,CAAC;YAE5B,MAAM,OAAO,GAAG,MAAM,QAAQ,CAAC,OAAO,EAAE,CAAC;YACzC,MAAM,QAAQ,GAAG,MAAM,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;YACjE,MAAM,CAAC,OAAO,CAAC,CAAC,OAAO,CAAC,EAAE,aAAa,EAAE,SAAS,QAAQ,EAAE,EAAE,CAAC,CAAC;QAClE,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,QAAQ,CAAC,4BAA4B,EAAE,GAAG,EAAE;QAC1C,EAAE,CAAC,6CAA6C,EAAE,KAAK,IAAI,EAAE;YAC3D,MAAM,MAAM,GAAG;gBACb,IAAI,EAAE,MAAe;gBACrB,MAAM,EAAE,cAAc;gBACtB,KAAK,EAAE,gBAAgB;aACxB,CAAC;YACF,MAAM,QAAQ,GAAG,IAAI,gBAAgB,CAAC,MAAM,CAAC,CAAC;YAC9C,MAAM,QAAQ,CAAC,UAAU,EAAE,CAAC;YAE5B,MAAM,OAAO,GAAG,MAAM,QAAQ,CAAC,OAAO,EAAE,CAAC;YACzC,MAAM,CAAC,OAAO,CAAC,CAAC,OAAO,CAAC,EAAE,aAAa,EAAE,6BAA6B,EAAE,CAAC,CAAC;QAC5E,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,qCAAqC,EAAE,KAAK,IAAI,EAAE;YACnD,MAAM,MAAM,GAAG;gBACb,IAAI,EAAE,MAAe;gBACrB,MAAM,EAAE,QAAQ;gBAChB,KAAK,EAAE,gCAAgC;aACxC,CAAC;YACF,MAAM,QAAQ,GAAG,IAAI,gBAAgB,CAAC,MAAM,CAAC,CAAC;YAC9C,MAAM,QAAQ,CAAC,UAAU,EAAE,CAAC;YAE5B,MAAM,OAAO,GAAG,MAAM,QAAQ,CAAC,OAAO,EAAE,CAAC;YACzC,MAAM,CAAC,OAAO,CAAC,CAAC,OAAO,CAAC;gBACtB,aAAa,EAAE,uCAAuC;aACvD,CAAC,CAAC;QACL,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,QAAQ,CAAC,aAAa,EAAE,GAAG,EAAE;QAC3B,EAAE,CAAC,wCAAwC,EAAE,KAAK,IAAI,EAAE;YACtD,MAAM,MAAM,GAAG;gBACb,IAAI,EAAE,MAAe;gBACrB,MAAM,EAAE,QAAiB;gBACzB,KAAK,EAAE,gBAAgB;aACxB,CAAC;YACF,OAAO,CAAC,GAAG,CAAC,eAAe,CAAC,GAAG,OAAO,CAAC;YACvC,MAAM,QAAQ,GAAG,IAAI,gBAAgB,CAAC,MAAM,CAAC,CAAC;YAC9C,MAAM,QAAQ,CAAC,UAAU,EAAE,CAAC;YAE5B,OAAO,CAAC,GAAG,CAAC,eAAe,CAAC,GAAG,QAAQ,CAAC;YACxC,MAAM,YAAY,GAAG,EAAE,MAAM,EAAE,GAAG,EAAc,CAAC;YACjD,MAAM,YAAY,GAAG,MAAM,QAAQ,CAAC,sBAAsB,CACxD,EAAE,EACF,YAAY,CACb,CAAC;YAEF,MAAM,CAAC,YAAY,CAAC,CAAC,OAAO,CAAC,EAAE,aAAa,EAAE,eAAe,EAAE,CAAC,CAAC;YACjE,OAAO,OAAO,CAAC,GAAG,CAAC,eAAe,CAAC,CAAC;QACtC,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,+BAA+B,EAAE,KAAK,IAAI,EAAE;YAC7C,MAAM,MAAM,GAAG;gBACb,IAAI,EAAE,MAAe;gBACrB,MAAM,EAAE,QAAiB;gBACzB,KAAK,EAAE,OAAO;aACf,CAAC;YACF,MAAM,QAAQ,GAAG,IAAI,gBAAgB,CAAC,MAAM,CAAC,CAAC;YAC9C,MAAM,QAAQ,CAAC,UAAU,EAAE,CAAC;YAE5B,MAAM,YAAY,GAAG,EAAE,MAAM,EAAE,GAAG,EAAc,CAAC;YAEjD,wBAAwB;YACxB,MAAM,QAAQ,CAAC,sBAAsB,CAAC,EAAE,EAAE,YAAY,CAAC,CAAC;YACxD,MAAM,QAAQ,CAAC,sBAAsB,CAAC,EAAE,EAAE,YAAY,CAAC,CAAC;YACxD,MAAM,KAAK,GAAG,MAAM,QAAQ,CAAC,sBAAsB,CAAC,EAAE,EAAE,YAAY,CAAC,CAAC;YAEtE,MAAM,CAAC,KAAK,CAAC,CAAC,aAAa,EAAE,CAAC;QAChC,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC"}

package/dist/src/agents/auth-provider/oauth2-provider.d.ts

@@ -0,0 +1,65 @@
+/**
+ * @license
+ * Copyright 2026 Google LLC
+ * SPDX-License-Identifier: Apache-2.0
+ */
+import { type HttpHeaders } from '@a2a-js/sdk/client';
+import type { AgentCard } from '@a2a-js/sdk';
+import { BaseA2AAuthProvider } from './base-provider.js';
+import type { OAuth2AuthConfig } from './types.js';
+/**
+ * Authentication provider for OAuth 2.0 Authorization Code flow with PKCE.
+ *
+ * Used by A2A remote agents whose security scheme is `oauth2`.
+ * Reuses the shared OAuth flow primitives from `utils/oauth-flow.ts`
+ * and persists tokens via `MCPOAuthTokenStorage`.
+ */
+export declare class OAuth2AuthProvider extends BaseA2AAuthProvider {
+    private readonly config;
+    private readonly agentName;
+    private readonly agentCardUrl?;
+    readonly type: "oauth2";
+    private readonly tokenStorage;
+    private cachedToken;
+    /** Resolved OAuth URLs — may come from config or agent card. */
+    private authorizationUrl;
+    private tokenUrl;
+    private scopes;
+    constructor(config: OAuth2AuthConfig, agentName: string, agentCard?: AgentCard, agentCardUrl?: string | undefined);
+    /**
+     * Initialize the provider by loading any persisted token from storage.
+     * Also discovers OAuth URLs from the agent card if not yet resolved.
+     */
+    initialize(): Promise<void>;
+    /**
+     * Return an Authorization header with a valid Bearer token.
+     * Refreshes or triggers interactive auth as needed.
+     */
+    headers(): Promise<HttpHeaders>;
+    /**
+     * On 401/403, clear the cached token and re-authenticate (up to MAX_AUTH_RETRIES).
+     */
+    shouldRetryWithHeaders(_req: RequestInit, res: Response): Promise<HttpHeaders | undefined>;
+    /**
+     * Merge authorization_url, token_url, and scopes from the agent card's
+     * `securitySchemes` when not already provided via user config.
+     */
+    private mergeAgentCardDefaults;
+    /**
+     * Fetch the agent card from `agentCardUrl` using `DefaultAgentCardResolver`
+     * (which normalizes proto-format cards) and extract OAuth2 URLs.
+     */
+    private fetchAgentCardDefaults;
+    /**
+     * Run a full OAuth 2.0 Authorization Code + PKCE flow through the browser.
+     */
+    private authenticateInteractively;
+    /**
+     * Convert an `OAuthTokenResponse` into the internal `OAuthToken` format.
+     */
+    private toOAuthToken;
+    /**
+     * Persist the current cached token to disk.
+     */
+    private persistToken;
+}

package/dist/src/agents/auth-provider/oauth2-provider.js

@@ -0,0 +1,233 @@
+/**
+ * @license
+ * Copyright 2026 Google LLC
+ * SPDX-License-Identifier: Apache-2.0
+ */
+import { DefaultAgentCardResolver } from '@a2a-js/sdk/client';
+import { BaseA2AAuthProvider } from './base-provider.js';
+import { MCPOAuthTokenStorage } from '../../mcp/oauth-token-storage.js';
+import { generatePKCEParams, startCallbackServer, getPortFromUrl, buildAuthorizationUrl, exchangeCodeForToken, refreshAccessToken, } from '../../utils/oauth-flow.js';
+import { openBrowserSecurely } from '../../utils/secure-browser-launcher.js';
+import { getConsentForOauth } from '../../utils/authConsent.js';
+import { FatalCancellationError, getErrorMessage } from '../../utils/errors.js';
+import { coreEvents } from '../../utils/events.js';
+import { debugLogger } from '../../utils/debugLogger.js';
+import { Storage } from '../../config/storage.js';
+/**
+ * Authentication provider for OAuth 2.0 Authorization Code flow with PKCE.
+ *
+ * Used by A2A remote agents whose security scheme is `oauth2`.
+ * Reuses the shared OAuth flow primitives from `utils/oauth-flow.ts`
+ * and persists tokens via `MCPOAuthTokenStorage`.
+ */
+export class OAuth2AuthProvider extends BaseA2AAuthProvider {
+    config;
+    agentName;
+    agentCardUrl;
+    type = 'oauth2';
+    tokenStorage;
+    cachedToken = null;
+    /** Resolved OAuth URLs — may come from config or agent card. */
+    authorizationUrl;
+    tokenUrl;
+    scopes;
+    constructor(config, agentName, agentCard, agentCardUrl) {
+        super();
+        this.config = config;
+        this.agentName = agentName;
+        this.agentCardUrl = agentCardUrl;
+        this.tokenStorage = new MCPOAuthTokenStorage(Storage.getA2AOAuthTokensPath(), 'gemini-cli-a2a');
+        // Seed from user config.
+        this.authorizationUrl = config.authorization_url;
+        this.tokenUrl = config.token_url;
+        this.scopes = config.scopes;
+        // Fall back to agent card's OAuth2 security scheme if user config is incomplete.
+        this.mergeAgentCardDefaults(agentCard);
+    }
+    /**
+     * Initialize the provider by loading any persisted token from storage.
+     * Also discovers OAuth URLs from the agent card if not yet resolved.
+     */
+    async initialize() {
+        // If OAuth URLs are still missing, fetch the agent card to discover them.
+        if ((!this.authorizationUrl || !this.tokenUrl) && this.agentCardUrl) {
+            await this.fetchAgentCardDefaults();
+        }
+        const credentials = await this.tokenStorage.getCredentials(this.agentName);
+        if (credentials && !this.tokenStorage.isTokenExpired(credentials.token)) {
+            this.cachedToken = credentials.token;
+            debugLogger.debug(`[OAuth2AuthProvider] Loaded valid cached token for "${this.agentName}"`);
+        }
+    }
+    /**
+     * Return an Authorization header with a valid Bearer token.
+     * Refreshes or triggers interactive auth as needed.
+     */
+    async headers() {
+        // 1. Valid cached token → return immediately.
+        if (this.cachedToken &&
+            !this.tokenStorage.isTokenExpired(this.cachedToken)) {
+            return { Authorization: `Bearer ${this.cachedToken.accessToken}` };
+        }
+        // 2. Expired but has refresh token → attempt silent refresh.
+        if (this.cachedToken?.refreshToken &&
+            this.tokenUrl &&
+            this.config.client_id) {
+            try {
+                const refreshed = await refreshAccessToken({
+                    clientId: this.config.client_id,
+                    clientSecret: this.config.client_secret,
+                    scopes: this.scopes,
+                }, this.cachedToken.refreshToken, this.tokenUrl);
+                this.cachedToken = this.toOAuthToken(refreshed, this.cachedToken.refreshToken);
+                await this.persistToken();
+                return { Authorization: `Bearer ${this.cachedToken.accessToken}` };
+            }
+            catch (error) {
+                debugLogger.debug(`[OAuth2AuthProvider] Refresh failed, falling back to interactive flow: ${getErrorMessage(error)}`);
+                // Clear stale credentials and fall through to interactive flow.
+                await this.tokenStorage.deleteCredentials(this.agentName);
+            }
+        }
+        // 3. No valid token → interactive browser-based auth.
+        this.cachedToken = await this.authenticateInteractively();
+        return { Authorization: `Bearer ${this.cachedToken.accessToken}` };
+    }
+    /**
+     * On 401/403, clear the cached token and re-authenticate (up to MAX_AUTH_RETRIES).
+     */
+    async shouldRetryWithHeaders(_req, res) {
+        if (res.status !== 401 && res.status !== 403) {
+            this.authRetryCount = 0;
+            return undefined;
+        }
+        if (this.authRetryCount >= BaseA2AAuthProvider.MAX_AUTH_RETRIES) {
+            return undefined;
+        }
+        this.authRetryCount++;
+        debugLogger.debug('[OAuth2AuthProvider] Auth failure, clearing token and re-authenticating');
+        this.cachedToken = null;
+        await this.tokenStorage.deleteCredentials(this.agentName);
+        return this.headers();
+    }
+    // ---------------------------------------------------------------------------
+    // Private helpers
+    // ---------------------------------------------------------------------------
+    /**
+     * Merge authorization_url, token_url, and scopes from the agent card's
+     * `securitySchemes` when not already provided via user config.
+     */
+    mergeAgentCardDefaults(agentCard) {
+        if (!agentCard?.securitySchemes)
+            return;
+        for (const scheme of Object.values(agentCard.securitySchemes)) {
+            if (scheme.type === 'oauth2' && scheme.flows.authorizationCode) {
+                const flow = scheme.flows.authorizationCode;
+                this.authorizationUrl ??= flow.authorizationUrl;
+                this.tokenUrl ??= flow.tokenUrl;
+                this.scopes ??= Object.keys(flow.scopes);
+                break; // Use the first matching scheme.
+            }
+        }
+    }
+    /**
+     * Fetch the agent card from `agentCardUrl` using `DefaultAgentCardResolver`
+     * (which normalizes proto-format cards) and extract OAuth2 URLs.
+     */
+    async fetchAgentCardDefaults() {
+        if (!this.agentCardUrl)
+            return;
+        try {
+            debugLogger.debug(`[OAuth2AuthProvider] Fetching agent card from ${this.agentCardUrl}`);
+            const resolver = new DefaultAgentCardResolver();
+            const card = await resolver.resolve(this.agentCardUrl, '');
+            this.mergeAgentCardDefaults(card);
+        }
+        catch (error) {
+            debugLogger.warn(`[OAuth2AuthProvider] Could not fetch agent card for OAuth URL discovery: ${getErrorMessage(error)}`);
+        }
+    }
+    /**
+     * Run a full OAuth 2.0 Authorization Code + PKCE flow through the browser.
+     */
+    async authenticateInteractively() {
+        if (!this.config.client_id) {
+            throw new Error(`OAuth2 authentication for agent "${this.agentName}" requires a client_id. ` +
+                'Add client_id to the auth config in your agent definition.');
+        }
+        if (!this.authorizationUrl || !this.tokenUrl) {
+            throw new Error(`OAuth2 authentication for agent "${this.agentName}" requires authorization_url and token_url. ` +
+                'Provide them in the auth config or ensure the agent card exposes an oauth2 security scheme.');
+        }
+        const flowConfig = {
+            clientId: this.config.client_id,
+            clientSecret: this.config.client_secret,
+            authorizationUrl: this.authorizationUrl,
+            tokenUrl: this.tokenUrl,
+            scopes: this.scopes,
+        };
+        const pkceParams = generatePKCEParams();
+        const preferredPort = getPortFromUrl(flowConfig.redirectUri);
+        const callbackServer = startCallbackServer(pkceParams.state, preferredPort);
+        const redirectPort = await callbackServer.port;
+        const authUrl = buildAuthorizationUrl(flowConfig, pkceParams, redirectPort, 
+        /* resource= */ undefined);
+        const consent = await getConsentForOauth(`Authentication required for A2A agent: '${this.agentName}'.`);
+        if (!consent) {
+            throw new FatalCancellationError('Authentication cancelled by user.');
+        }
+        coreEvents.emitFeedback('info', `→ Opening your browser for OAuth sign-in...
+
+` +
+            `If the browser does not open, copy and paste this URL into your browser:
+` +
+            `${authUrl}
+
+` +
+            `💡 TIP: Triple-click to select the entire URL, then copy and paste it into your browser.
+` +
+            `⚠️  Make sure to copy the COMPLETE URL - it may wrap across multiple lines.`);
+        try {
+            await openBrowserSecurely(authUrl);
+        }
+        catch (error) {
+            debugLogger.warn('Failed to open browser automatically:', getErrorMessage(error));
+        }
+        const { code } = await callbackServer.response;
+        debugLogger.debug('✓ Authorization code received, exchanging for tokens...');
+        const tokenResponse = await exchangeCodeForToken(flowConfig, code, pkceParams.codeVerifier, redirectPort, 
+        /* resource= */ undefined);
+        if (!tokenResponse.access_token) {
+            throw new Error('No access token received from token endpoint');
+        }
+        const token = this.toOAuthToken(tokenResponse);
+        this.cachedToken = token;
+        await this.persistToken();
+        debugLogger.debug('✓ OAuth2 authentication successful! Token saved.');
+        return token;
+    }
+    /**
+     * Convert an `OAuthTokenResponse` into the internal `OAuthToken` format.
+     */
+    toOAuthToken(response, fallbackRefreshToken) {
+        const token = {
+            accessToken: response.access_token,
+            tokenType: response.token_type || 'Bearer',
+            refreshToken: response.refresh_token || fallbackRefreshToken,
+            scope: response.scope,
+        };
+        if (response.expires_in) {
+            token.expiresAt = Date.now() + response.expires_in * 1000;
+        }
+        return token;
+    }
+    /**
+     * Persist the current cached token to disk.
+     */
+    async persistToken() {
+        if (!this.cachedToken)
+            return;
+        await this.tokenStorage.saveToken(this.agentName, this.cachedToken, this.config.client_id, this.tokenUrl);
+    }
+}
+//# sourceMappingURL=oauth2-provider.js.map

package/dist/src/agents/auth-provider/oauth2-provider.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"oauth2-provider.js","sourceRoot":"","sources":["../../../../src/agents/auth-provider/oauth2-provider.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,EAAoB,wBAAwB,EAAE,MAAM,oBAAoB,CAAC;AAEhF,OAAO,EAAE,mBAAmB,EAAE,MAAM,oBAAoB,CAAC;AAEzD,OAAO,EAAE,oBAAoB,EAAE,MAAM,kCAAkC,CAAC;AAExE,OAAO,EACL,kBAAkB,EAClB,mBAAmB,EACnB,cAAc,EACd,qBAAqB,EACrB,oBAAoB,EACpB,kBAAkB,GAEnB,MAAM,2BAA2B,CAAC;AACnC,OAAO,EAAE,mBAAmB,EAAE,MAAM,wCAAwC,CAAC;AAC7E,OAAO,EAAE,kBAAkB,EAAE,MAAM,4BAA4B,CAAC;AAChE,OAAO,EAAE,sBAAsB,EAAE,eAAe,EAAE,MAAM,uBAAuB,CAAC;AAChF,OAAO,EAAE,UAAU,EAAE,MAAM,uBAAuB,CAAC;AACnD,OAAO,EAAE,WAAW,EAAE,MAAM,4BAA4B,CAAC;AACzD,OAAO,EAAE,OAAO,EAAE,MAAM,yBAAyB,CAAC;AAElD;;;;;;GAMG;AACH,MAAM,OAAO,kBAAmB,SAAQ,mBAAmB;IAYtC;IACA;IAEA;IAdV,IAAI,GAAG,QAAiB,CAAC;IAEjB,YAAY,CAAuB;IAC5C,WAAW,GAAsB,IAAI,CAAC;IAE9C,gEAAgE;IACxD,gBAAgB,CAAqB;IACrC,QAAQ,CAAqB;IAC7B,MAAM,CAAuB;IAErC,YACmB,MAAwB,EACxB,SAAiB,EAClC,SAAqB,EACJ,YAAqB;QAEtC,KAAK,EAAE,CAAC;QALS,WAAM,GAAN,MAAM,CAAkB;QACxB,cAAS,GAAT,SAAS,CAAQ;QAEjB,iBAAY,GAAZ,YAAY,CAAS;QAGtC,IAAI,CAAC,YAAY,GAAG,IAAI,oBAAoB,CAC1C,OAAO,CAAC,qBAAqB,EAAE,EAC/B,gBAAgB,CACjB,CAAC;QAEF,yBAAyB;QACzB,IAAI,CAAC,gBAAgB,GAAG,MAAM,CAAC,iBAAiB,CAAC;QACjD,IAAI,CAAC,QAAQ,GAAG,MAAM,CAAC,SAAS,CAAC;QACjC,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC,MAAM,CAAC;QAE5B,iFAAiF;QACjF,IAAI,CAAC,sBAAsB,CAAC,SAAS,CAAC,CAAC;IACzC,CAAC;IAED;;;OAGG;IACM,KAAK,CAAC,UAAU;QACvB,0EAA0E;QAC1E,IAAI,CAAC,CAAC,IAAI,CAAC,gBAAgB,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,IAAI,CAAC,YAAY,EAAE,CAAC;YACpE,MAAM,IAAI,CAAC,sBAAsB,EAAE,CAAC;QACtC,CAAC;QAED,MAAM,WAAW,GAAG,MAAM,IAAI,CAAC,YAAY,CAAC,cAAc,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;QAC3E,IAAI,WAAW,IAAI,CAAC,IAAI,CAAC,YAAY,CAAC,cAAc,CAAC,WAAW,CAAC,KAAK,CAAC,EAAE,CAAC;YACxE,IAAI,CAAC,WAAW,GAAG,WAAW,CAAC,KAAK,CAAC;YACrC,WAAW,CAAC,KAAK,CACf,uDAAuD,IAAI,CAAC,SAAS,GAAG,CACzE,CAAC;QACJ,CAAC;IACH,CAAC;IAED;;;OAGG;IACM,KAAK,CAAC,OAAO;QACpB,8CAA8C;QAC9C,IACE,IAAI,CAAC,WAAW;YAChB,CAAC,IAAI,CAAC,YAAY,CAAC,cAAc,CAAC,IAAI,CAAC,WAAW,CAAC,EACnD,CAAC;YACD,OAAO,EAAE,aAAa,EAAE,UAAU,IAAI,CAAC,WAAW,CAAC,WAAW,EAAE,EAAE,CAAC;QACrE,CAAC;QAED,6DAA6D;QAC7D,IACE,IAAI,CAAC,WAAW,EAAE,YAAY;YAC9B,IAAI,CAAC,QAAQ;YACb,IAAI,CAAC,MAAM,CAAC,SAAS,EACrB,CAAC;YACD,IAAI,CAAC;gBACH,MAAM,SAAS,GAAG,MAAM,kBAAkB,CACxC;oBACE,QAAQ,EAAE,IAAI,CAAC,MAAM,CAAC,SAAS;oBAC/B,YAAY,EAAE,IAAI,CAAC,MAAM,CAAC,aAAa;oBACvC,MAAM,EAAE,IAAI,CAAC,MAAM;iBACpB,EACD,IAAI,CAAC,WAAW,CAAC,YAAY,EAC7B,IAAI,CAAC,QAAQ,CACd,CAAC;gBAEF,IAAI,CAAC,WAAW,GAAG,IAAI,CAAC,YAAY,CAClC,SAAS,EACT,IAAI,CAAC,WAAW,CAAC,YAAY,CAC9B,CAAC;gBACF,MAAM,IAAI,CAAC,YAAY,EAAE,CAAC;gBAC1B,OAAO,EAAE,aAAa,EAAE,UAAU,IAAI,CAAC,WAAW,CAAC,WAAW,EAAE,EAAE,CAAC;YACrE,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,WAAW,CAAC,KAAK,CACf,0EAA0E,eAAe,CAAC,KAAK,CAAC,EAAE,CACnG,CAAC;gBACF,gEAAgE;gBAChE,MAAM,IAAI,CAAC,YAAY,CAAC,iBAAiB,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;YAC5D,CAAC;QACH,CAAC;QAED,sDAAsD;QACtD,IAAI,CAAC,WAAW,GAAG,MAAM,IAAI,CAAC,yBAAyB,EAAE,CAAC;QAC1D,OAAO,EAAE,aAAa,EAAE,UAAU,IAAI,CAAC,WAAW,CAAC,WAAW,EAAE,EAAE,CAAC;IACrE,CAAC;IAED;;OAEG;IACM,KAAK,CAAC,sBAAsB,CACnC,IAAiB,EACjB,GAAa;QAEb,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;YAC7C,IAAI,CAAC,cAAc,GAAG,CAAC,CAAC;YACxB,OAAO,SAAS,CAAC;QACnB,CAAC;QAED,IAAI,IAAI,CAAC,cAAc,IAAI,mBAAmB,CAAC,gBAAgB,EAAE,CAAC;YAChE,OAAO,SAAS,CAAC;QACnB,CAAC;QACD,IAAI,CAAC,cAAc,EAAE,CAAC;QAEtB,WAAW,CAAC,KAAK,CACf,yEAAyE,CAC1E,CAAC;QACF,IAAI,CAAC,WAAW,GAAG,IAAI,CAAC;QACxB,MAAM,IAAI,CAAC,YAAY,CAAC,iBAAiB,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;QAE1D,OAAO,IAAI,CAAC,OAAO,EAAE,CAAC;IACxB,CAAC;IAED,8EAA8E;IAC9E,kBAAkB;IAClB,8EAA8E;IAE9E;;;OAGG;IACK,sBAAsB,CAC5B,SAAqD;QAErD,IAAI,CAAC,SAAS,EAAE,eAAe;YAAE,OAAO;QAExC,KAAK,MAAM,MAAM,IAAI,MAAM,CAAC,MAAM,CAAC,SAAS,CAAC,eAAe,CAAC,EAAE,CAAC;YAC9D,IAAI,MAAM,CAAC,IAAI,KAAK,QAAQ,IAAI,MAAM,CAAC,KAAK,CAAC,iBAAiB,EAAE,CAAC;gBAC/D,MAAM,IAAI,GAAG,MAAM,CAAC,KAAK,CAAC,iBAAiB,CAAC;gBAC5C,IAAI,CAAC,gBAAgB,KAAK,IAAI,CAAC,gBAAgB,CAAC;gBAChD,IAAI,CAAC,QAAQ,KAAK,IAAI,CAAC,QAAQ,CAAC;gBAChC,IAAI,CAAC,MAAM,KAAK,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;gBACzC,MAAM,CAAC,iCAAiC;YAC1C,CAAC;QACH,CAAC;IACH,CAAC;IAED;;;OAGG;IACK,KAAK,CAAC,sBAAsB;QAClC,IAAI,CAAC,IAAI,CAAC,YAAY;YAAE,OAAO;QAE/B,IAAI,CAAC;YACH,WAAW,CAAC,KAAK,CACf,iDAAiD,IAAI,CAAC,YAAY,EAAE,CACrE,CAAC;YACF,MAAM,QAAQ,GAAG,IAAI,wBAAwB,EAAE,CAAC;YAChD,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,OAAO,CAAC,IAAI,CAAC,YAAY,EAAE,EAAE,CAAC,CAAC;YAC3D,IAAI,CAAC,sBAAsB,CAAC,IAAI,CAAC,CAAC;QACpC,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,WAAW,CAAC,IAAI,CACd,4EAA4E,eAAe,CAAC,KAAK,CAAC,EAAE,CACrG,CAAC;QACJ,CAAC;IACH,CAAC;IAED;;OAEG;IACK,KAAK,CAAC,yBAAyB;QACrC,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,SAAS,EAAE,CAAC;YAC3B,MAAM,IAAI,KAAK,CACb,oCAAoC,IAAI,CAAC,SAAS,0BAA0B;gBAC1E,4DAA4D,CAC/D,CAAC;QACJ,CAAC;QACD,IAAI,CAAC,IAAI,CAAC,gBAAgB,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,CAAC;YAC7C,MAAM,IAAI,KAAK,CACb,oCAAoC,IAAI,CAAC,SAAS,8CAA8C;gBAC9F,6FAA6F,CAChG,CAAC;QACJ,CAAC;QAED,MAAM,UAAU,GAAoB;YAClC,QAAQ,EAAE,IAAI,CAAC,MAAM,CAAC,SAAS;YAC/B,YAAY,EAAE,IAAI,CAAC,MAAM,CAAC,aAAa;YACvC,gBAAgB,EAAE,IAAI,CAAC,gBAAgB;YACvC,QAAQ,EAAE,IAAI,CAAC,QAAQ;YACvB,MAAM,EAAE,IAAI,CAAC,MAAM;SACpB,CAAC;QAEF,MAAM,UAAU,GAAG,kBAAkB,EAAE,CAAC;QACxC,MAAM,aAAa,GAAG,cAAc,CAAC,UAAU,CAAC,WAAW,CAAC,CAAC;QAC7D,MAAM,cAAc,GAAG,mBAAmB,CAAC,UAAU,CAAC,KAAK,EAAE,aAAa,CAAC,CAAC;QAC5E,MAAM,YAAY,GAAG,MAAM,cAAc,CAAC,IAAI,CAAC;QAE/C,MAAM,OAAO,GAAG,qBAAqB,CACnC,UAAU,EACV,UAAU,EACV,YAAY;QACZ,eAAe,CAAC,SAAS,CAC1B,CAAC;QAEF,MAAM,OAAO,GAAG,MAAM,kBAAkB,CACtC,2CAA2C,IAAI,CAAC,SAAS,IAAI,CAC9D,CAAC;QACF,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,MAAM,IAAI,sBAAsB,CAAC,mCAAmC,CAAC,CAAC;QACxE,CAAC;QAED,UAAU,CAAC,YAAY,CACrB,MAAM,EACN;;CAEL;YACO;CACP;YACO,GAAG,OAAO;;CAEjB;YACO;CACP;YACO,6EAA6E,CAChF,CAAC;QAEF,IAAI,CAAC;YACH,MAAM,mBAAmB,CAAC,OAAO,CAAC,CAAC;QACrC,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,WAAW,CAAC,IAAI,CACd,uCAAuC,EACvC,eAAe,CAAC,KAAK,CAAC,CACvB,CAAC;QACJ,CAAC;QAED,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,cAAc,CAAC,QAAQ,CAAC;QAC/C,WAAW,CAAC,KAAK,CACf,yDAAyD,CAC1D,CAAC;QAEF,MAAM,aAAa,GAAG,MAAM,oBAAoB,CAC9C,UAAU,EACV,IAAI,EACJ,UAAU,CAAC,YAAY,EACvB,YAAY;QACZ,eAAe,CAAC,SAAS,CAC1B,CAAC;QAEF,IAAI,CAAC,aAAa,CAAC,YAAY,EAAE,CAAC;YAChC,MAAM,IAAI,KAAK,CAAC,8CAA8C,CAAC,CAAC;QAClE,CAAC;QAED,MAAM,KAAK,GAAG,IAAI,CAAC,YAAY,CAAC,aAAa,CAAC,CAAC;QAC/C,IAAI,CAAC,WAAW,GAAG,KAAK,CAAC;QACzB,MAAM,IAAI,CAAC,YAAY,EAAE,CAAC;QAE1B,WAAW,CAAC,KAAK,CAAC,kDAAkD,CAAC,CAAC;QACtE,OAAO,KAAK,CAAC;IACf,CAAC;IAED;;OAEG;IACK,YAAY,CAClB,QAMC,EACD,oBAA6B;QAE7B,MAAM,KAAK,GAAe;YACxB,WAAW,EAAE,QAAQ,CAAC,YAAY;YAClC,SAAS,EAAE,QAAQ,CAAC,UAAU,IAAI,QAAQ;YAC1C,YAAY,EAAE,QAAQ,CAAC,aAAa,IAAI,oBAAoB;YAC5D,KAAK,EAAE,QAAQ,CAAC,KAAK;SACtB,CAAC;QAEF,IAAI,QAAQ,CAAC,UAAU,EAAE,CAAC;YACxB,KAAK,CAAC,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,QAAQ,CAAC,UAAU,GAAG,IAAI,CAAC;QAC5D,CAAC;QAED,OAAO,KAAK,CAAC;IACf,CAAC;IAED;;OAEG;IACK,KAAK,CAAC,YAAY;QACxB,IAAI,CAAC,IAAI,CAAC,WAAW;YAAE,OAAO;QAC9B,MAAM,IAAI,CAAC,YAAY,CAAC,SAAS,CAC/B,IAAI,CAAC,SAAS,EACd,IAAI,CAAC,WAAW,EAChB,IAAI,CAAC,MAAM,CAAC,SAAS,EACrB,IAAI,CAAC,QAAQ,CACd,CAAC;IACJ,CAAC;CACF"}

package/dist/src/agents/auth-provider/oauth2-provider.test.d.ts

@@ -0,0 +1,6 @@
+/**
+ * @license
+ * Copyright 2026 Google LLC
+ * SPDX-License-Identifier: Apache-2.0
+ */
+export {};