const require = (await import('node:module')).createRequire(import.meta.url); const __chunk_filename = (await import('node:url')).fileURLToPath(import.meta.url); const __chunk_dirname = (await import('node:path')).dirname(__chunk_filename);
import{$j as A,Xj as a,Zj as p,_j as m,ak as T,bk as w,ck as y,dk as U,ek as C,oc as f,sf as g}from"./chunk-5NLMIA5F.js";import{Id as l,Ud as k,b as o,na as d,zd as n}from"./chunk-SX66NO2U.js";import"./chunk-TWIC4BKL.js";import"./chunk-JAFVB6DI.js";import"./chunk-A5A5SUZN.js";import"./chunk-YUXORC52.js";var v=class extends a{config;agentName;agentCardUrl;type="oauth2";tokenStorage;cachedToken=null;authorizationUrl;tokenUrl;scopes;constructor(e,t,r,i){super(),this.config=e,this.agentName=t,this.agentCardUrl=i,this.tokenStorage=new m(d.getA2AOAuthTokensPath(),"gemini-cli-a2a"),this.authorizationUrl=e.authorization_url,this.tokenUrl=e.token_url,this.scopes=e.scopes,this.mergeAgentCardDefaults(r)}async initialize(){(!this.authorizationUrl||!this.tokenUrl)&&this.agentCardUrl&&await this.fetchAgentCardDefaults();let e=await this.tokenStorage.getCredentials(this.agentName);e&&!this.tokenStorage.isTokenExpired(e.token)&&(this.cachedToken=e.token,o.debug(`[OAuth2AuthProvider] Loaded valid cached token for "${this.agentName}"`))}async headers(){if(this.cachedToken&&!this.tokenStorage.isTokenExpired(this.cachedToken))return{Authorization:`Bearer ${this.cachedToken.accessToken}`};if(this.cachedToken?.refreshToken&&this.tokenUrl&&this.config.client_id)try{let e=await C({clientId:this.config.client_id,clientSecret:this.config.client_secret,scopes:this.scopes},this.cachedToken.refreshToken,this.tokenUrl);return this.cachedToken=this.toOAuthToken(e,this.cachedToken.refreshToken),await this.persistToken(),{Authorization:`Bearer ${this.cachedToken.accessToken}`}}catch(e){o.debug(`[OAuth2AuthProvider] Refresh failed, falling back to interactive flow: ${n(e)}`),await this.tokenStorage.deleteCredentials(this.agentName)}return this.cachedToken=await this.authenticateInteractively(),{Authorization:`Bearer ${this.cachedToken.accessToken}`}}async shouldRetryWithHeaders(e,t){if(t.status!==401&&t.status!==403){this.authRetryCount=0;return}if(!(this.authRetryCount>=a.MAX_AUTH_RETRIES))return this.authRetryCount++,o.debug("[OAuth2AuthProvider] Auth failure, clearing token and re-authenticating"),this.cachedToken=null,await this.tokenStorage.deleteCredentials(this.agentName),this.headers()}mergeAgentCardDefaults(e){if(e?.securitySchemes){for(let t of Object.values(e.securitySchemes))if(t.type==="oauth2"&&t.flows.authorizationCode){let r=t.flows.authorizationCode;this.authorizationUrl??=r.authorizationUrl,this.tokenUrl??=r.tokenUrl,this.scopes??=Object.keys(r.scopes);break}}}async fetchAgentCardDefaults(){if(this.agentCardUrl)try{o.debug(`[OAuth2AuthProvider] Fetching agent card from ${this.agentCardUrl}`);let t=await new p().resolve(this.agentCardUrl,"");this.mergeAgentCardDefaults(t)}catch(e){o.warn(`[OAuth2AuthProvider] Could not fetch agent card for OAuth URL discovery: ${n(e)}`)}}async authenticateInteractively(){if(!this.config.client_id)throw new Error(`OAuth2 authentication for agent "${this.agentName}" requires a client_id. Add client_id to the auth config in your agent definition.`);if(!this.authorizationUrl||!this.tokenUrl)throw new Error(`OAuth2 authentication for agent "${this.agentName}" requires authorization_url and token_url. Provide them in the auth config or ensure the agent card exposes an oauth2 security scheme.`);let e={clientId:this.config.client_id,clientSecret:this.config.client_secret,authorizationUrl:this.authorizationUrl,tokenUrl:this.tokenUrl,scopes:this.scopes},t=A(),r=w(e.redirectUri),i=T(t.state,r),s=await i.port,h=y(e,t,s,void 0);if(!await f(`Authentication required for A2A agent: '${this.agentName}'.`))throw new l("Authentication cancelled by user.");k.emitFeedback("info",`\u2192 Opening your browser for OAuth sign-in...

If the browser does not open, copy and paste this URL into your browser:
${h}

\u{1F4A1} TIP: Triple-click to select the entire URL, then copy and paste it into your browser.
\u26A0\uFE0F  Make sure to copy the COMPLETE URL - it may wrap across multiple lines.`);try{await g(h)}catch(b){o.warn("Failed to open browser automatically:",n(b))}let{code:_}=await i.response;o.debug("\u2713 Authorization code received, exchanging for tokens...");let c=await U(e,_,t.codeVerifier,s,void 0);if(!c.access_token)throw new Error("No access token received from token endpoint");let u=this.toOAuthToken(c);return this.cachedToken=u,await this.persistToken(),o.debug("\u2713 OAuth2 authentication successful! Token saved."),u}toOAuthToken(e,t){let r={accessToken:e.access_token,tokenType:e.token_type||"Bearer",refreshToken:e.refresh_token||t,scope:e.scope};return e.expires_in&&(r.expiresAt=Date.now()+e.expires_in*1e3),r}async persistToken(){this.cachedToken&&await this.tokenStorage.saveToken(this.agentName,this.cachedToken,this.config.client_id,this.tokenUrl)}};export{v as OAuth2AuthProvider};
/**
 * @license
 * Copyright 2026 Google LLC
 * SPDX-License-Identifier: Apache-2.0
 */
