@adcp/sdk 12.0.6 → 12.1.1

package/dist/lib/core/SingleAgentClient.js

@@ -65,6 +65,7 @@ var import_v2_5 = require('../adapters/legacy/v2-5/index.js');
 var import_property_policy = require('../media-buy/property-policy.js');
 var import_targeting_helpers = require('../server/targeting-helpers.js');
 const A2AClient = import_client.A2AClient;
+const CAPABILITY_DISCOVERY_CONTEXT = /* @__PURE__ */ Symbol("capabilityDiscoveryContext");
 class UnsupportedFeatureError extends Error {
   constructor(feature, serverVersion, message) {
     super(message || `Feature '${feature}' requires AdCP v3 but server is ${serverVersion}`);
@@ -255,20 +256,34 @@ class SingleAgentClient {
   async ensureEndpointDiscovered(options) {
     (0, import_abort2.throwIfAborted)(options?.signal);
     const needsDiscovery = this.normalizedAgent._needsDiscovery;
+    const transport = options?.transport ?? this.config.transport;
+    const usesScopedFetch = transport?.fetchFn !== void 0;
     if (!needsDiscovery) {
       return this.normalizedAgent;
     }
-    if (this.discoveredAgent) {
+    if (!usesScopedFetch && this.discoveredAgent) {
       return this.discoveredAgent;
     }
-    if (this.discoveredEndpoint) {
+    if (!usesScopedFetch && this.discoveredEndpoint) {
       this.discoveredAgent = {
         ...this.normalizedAgent,
         agent_uri: this.discoveredEndpoint
       };
       return this.discoveredAgent;
     }
-    this.discoveredEndpoint = await this.discoverMCPEndpoint(this.normalizedAgent.agent_uri, options);
+    if (this.normalizedAgent.oauth_client_credentials) {
+      const { ensureClientCredentialsTokens, getAgentStorage } = await import("../auth/oauth/index.js");
+      await ensureClientCredentialsTokens(this.normalizedAgent, {
+        storage: getAgentStorage(this.normalizedAgent),
+        allowPrivateIp: (0, import_net.isLikelyPrivateUrl)(this.normalizedAgent.agent_uri),
+        fetch: transport?.fetchFn
+      });
+    }
+    const discoveredEndpoint = await this.discoverMCPEndpoint(this.normalizedAgent.agent_uri, options);
+    if (usesScopedFetch) {
+      return { ...this.normalizedAgent, agent_uri: discoveredEndpoint };
+    }
+    this.discoveredEndpoint = discoveredEndpoint;
     this.canonicalBaseUrl = this.computeBaseUrl(this.discoveredEndpoint);
     this.discoveredAgent = {
       ...this.normalizedAgent,
@@ -285,17 +300,27 @@ class SingleAgentClient {
   async ensureCanonicalUrlResolved(options) {
     (0, import_abort2.throwIfAborted)(options?.signal);
     const needsCanonicalUrl = this.normalizedAgent._needsCanonicalUrl;
+    const transport = options?.transport ?? this.config.transport;
+    const usesScopedFetch = transport?.fetchFn !== void 0;
     if (!needsCanonicalUrl) {
       return this.normalizedAgent;
     }
-    if (this.canonicalBaseUrl) {
+    if (!usesScopedFetch && this.canonicalBaseUrl) {
       return {
         ...this.normalizedAgent,
         agent_uri: this.canonicalBaseUrl
       };
     }
+    if (this.normalizedAgent.oauth_client_credentials) {
+      const { ensureClientCredentialsTokens, getAgentStorage } = await import("../auth/oauth/index.js");
+      await ensureClientCredentialsTokens(this.normalizedAgent, {
+        storage: getAgentStorage(this.normalizedAgent),
+        allowPrivateIp: (0, import_net.isLikelyPrivateUrl)(this.normalizedAgent.agent_uri),
+        fetch: transport?.fetchFn
+      });
+    }
     const canonicalUrl = await this.fetchA2ACanonicalUrl(this.normalizedAgent.agent_uri, options);
-    this.canonicalBaseUrl = canonicalUrl;
+    if (!usesScopedFetch) this.canonicalBaseUrl = canonicalUrl;
     return {
       ...this.normalizedAgent,
       agent_uri: canonicalUrl
@@ -313,8 +338,10 @@ class SingleAgentClient {
     const transport = readOptions?.transport ?? this.config.transport;
     const maxResponseBytes = transport?.maxResponseBytes;
     const requestTimeoutMs = (0, import_abort2.resolveRequestTimeoutMs)(transport?.requestTimeoutMs, import_abort2.DEFAULT_REQUEST_TIMEOUT_MS);
-    const sizeLimitedFetch = wrapFetchWithSizeLimit((input, init) => fetch(input, init));
-    const authToken = this.normalizedAgent.auth_token;
+    const sizeLimitedFetch = wrapFetchWithSizeLimit(
+      (input, init) => transport?.fetchFn ? transport.fetchFn(input, init) : fetch(input, init)
+    );
+    const authToken = this.normalizedAgent.oauth_client_credentials ? this.normalizedAgent.oauth_tokens?.access_token : this.normalizedAgent.auth_token;
     let got401 = false;
     const fetchImpl = async (url, requestInit) => {
       const headers = {
@@ -362,13 +389,17 @@ class SingleAgentClient {
     } catch (error) {
       if ((0, import_errors.is401Error)(error, got401)) {
         const requirements = await (0, import_authorization_required.discoverAuthorizationRequirements)(agentUri, {
-          allowPrivateIp: (0, import_net.isLikelyPrivateUrl)(agentUri)
+          allowPrivateIp: (0, import_net.isLikelyPrivateUrl)(agentUri),
+          fetchFn: transport?.fetchFn
         });
         if (requirements) {
           throw new import_authorization_required.NeedsAuthorizationError(requirements);
         }
-        const challenge = await (0, import_authorization_required.probeAuthChallenge)(agentUri, { allowPrivateIp: (0, import_net.isLikelyPrivateUrl)(agentUri) });
-        const oauthMetadata = await (0, import_discovery.discoverOAuthMetadata)(agentUri);
+        const challenge = await (0, import_authorization_required.probeAuthChallenge)(agentUri, {
+          allowPrivateIp: (0, import_net.isLikelyPrivateUrl)(agentUri),
+          fetchFn: transport?.fetchFn
+        });
+        const oauthMetadata = await (0, import_discovery.discoverOAuthMetadata)(agentUri, { fetch: transport?.fetchFn });
         throw new import_errors.AuthenticationRequiredError(agentUri, oauthMetadata || void 0, void 0, challenge ?? void 0);
       }
       throw error;
@@ -409,31 +440,45 @@ class SingleAgentClient {
     (0, import_abort2.throwIfAborted)(options?.signal);
     const { connectMCPWithFallback } = await import("../protocols/mcp.js");
     const { probeModernMCPConnection } = await import("../protocols/mcp-modern.js");
-    const authToken = this.agent.auth_token;
+    const usesScopedFetch = (options?.transport ?? this.config.transport)?.fetchFn !== void 0;
+    const authToken = this.normalizedAgent.oauth_client_credentials ? this.normalizedAgent.oauth_tokens?.access_token : this.agent.auth_token;
     const agentHeaders = this.agent.headers;
     const authHeaders = { ...agentHeaders, ...(0, import_auth.createMCPAuthHeaders)(authToken) };
-    const authProvider = this.normalizedAgent.oauth_tokens ? (await import("../auth/oauth/index.js")).createNonInteractiveOAuthProvider(this.normalizedAgent, {
-      agentHint: this.normalizedAgent.id
+    const authProvider = this.normalizedAgent.oauth_tokens && !this.normalizedAgent.oauth_client_credentials ? (await import("../auth/oauth/index.js")).createNonInteractiveOAuthProvider(this.normalizedAgent, {
+      agentHint: this.normalizedAgent.id,
+      allowHttp: (0, import_net.isLikelyPrivateUrl)(this.normalizedAgent.agent_uri)
     }) : void 0;
     const testEndpoint = async (url) => {
       try {
         const modern = await probeModernMCPConnection(url, authToken, agentHeaders, {
           authProvider,
           signal: options?.signal,
-          requestTimeoutMs: options?.transport?.requestTimeoutMs ?? this.config.transport?.requestTimeoutMs
+          requestTimeoutMs: options?.transport?.requestTimeoutMs ?? this.config.transport?.requestTimeoutMs,
+          fetchFn: options?.transport?.fetchFn ?? this.config.transport?.fetchFn
         });
         if (modern.connected) {
-          this.discoveredMcpEra = modern.era;
-          this.discoveredMcpEraAt = Date.now();
+          if (!usesScopedFetch) {
+            this.discoveredMcpEra = modern.era;
+            this.discoveredMcpEraAt = Date.now();
+          }
           return { success: true };
         }
-        const client = await connectMCPWithFallback(new URL(url), authHeaders, [], "endpoint discovery", void 0, {
-          signal: options?.signal,
-          requestTimeoutMs: options?.transport?.requestTimeoutMs ?? this.config.transport?.requestTimeoutMs
-        });
+        const client = await connectMCPWithFallback(
+          new URL(url),
+          authHeaders,
+          [],
+          "endpoint discovery",
+          options?.transport?.fetchFn ?? this.config.transport?.fetchFn,
+          {
+            signal: options?.signal,
+            requestTimeoutMs: options?.transport?.requestTimeoutMs ?? this.config.transport?.requestTimeoutMs
+          }
+        );
         await client.close();
-        this.discoveredMcpEra = "legacy";
-        this.discoveredMcpEraAt = Date.now();
+        if (!usesScopedFetch) {
+          this.discoveredMcpEra = "legacy";
+          this.discoveredMcpEraAt = Date.now();
+        }
         return { success: true };
       } catch (error) {
         if ((0, import_abort.isAbortOrTimeoutError)(error)) {
@@ -475,13 +520,19 @@ class SingleAgentClient {
     }
     if (got401) {
       const requirements = await (0, import_authorization_required.discoverAuthorizationRequirements)(providedUri, {
-        allowPrivateIp: (0, import_net.isLikelyPrivateUrl)(providedUri)
+        allowPrivateIp: (0, import_net.isLikelyPrivateUrl)(providedUri),
+        fetchFn: options?.transport?.fetchFn ?? this.config.transport?.fetchFn
       });
       if (requirements) {
         throw new import_authorization_required.NeedsAuthorizationError(requirements);
       }
-      const challenge = await (0, import_authorization_required.probeAuthChallenge)(providedUri, { allowPrivateIp: (0, import_net.isLikelyPrivateUrl)(providedUri) });
-      const oauthMetadata = await (0, import_discovery.discoverOAuthMetadata)(providedUri);
+      const challenge = await (0, import_authorization_required.probeAuthChallenge)(providedUri, {
+        allowPrivateIp: (0, import_net.isLikelyPrivateUrl)(providedUri),
+        fetchFn: options?.transport?.fetchFn ?? this.config.transport?.fetchFn
+      });
+      const oauthMetadata = await (0, import_discovery.discoverOAuthMetadata)(providedUri, {
+        fetch: options?.transport?.fetchFn ?? this.config.transport?.fetchFn
+      });
       throw new import_errors.AuthenticationRequiredError(providedUri, oauthMetadata || void 0, void 0, challenge ?? void 0);
     }
     throw new Error(
@@ -981,13 +1032,19 @@ Hint: this usually means agent_uri does not include the MCP endpoint path. The S
     if (!options?.skipIdempotencyAutoInject && !options?.skipAccountValidation) {
       this.executor.validateRequest(taskType, normalizedParams);
     }
-    const serverVersion = await this.detectServerVersion(options);
+    const capabilityDiscoveryContext = {};
+    const detectionOptions = {
+      ...options,
+      [CAPABILITY_DISCOVERY_CONTEXT]: capabilityDiscoveryContext
+    };
+    const serverVersion = await this.detectServerVersion(detectionOptions);
     const inputSchemaStripLogs = [];
     const { params: adaptedParams, driftLogs: adaptDriftLogs } = this.adaptRequest(
       taskType,
       normalizedParams,
       serverVersion,
-      inputSchemaStripLogs
+      inputSchemaStripLogs,
+      capabilityDiscoveryContext.toolSchemas
     );
     const v25DriftLogs = [...adaptDriftLogs];
     if (webhookDriftLog) v25DriftLogs.push(webhookDriftLog);
@@ -1373,17 +1430,17 @@ Hint: this usually means agent_uri does not include the MCP endpoint path. The S
    * 3.1-only fields for a 3.0 seller). Returns the adapted params and any
    * drift log entries describing what was changed.
    *
-   * Runs after `detectServerVersion` so `cachedCapabilities` is populated
-   * and the protocol-version adapters see the seller's declared caps.
+   * Runs after `detectServerVersion` so capabilities are available and the
+   * current call's tool schemas can be supplied without cross-tenant caching.
    */
-  adaptRequest(taskType, params, serverVersion, debugLogs) {
+  adaptRequest(taskType, params, serverVersion, debugLogs, perCallToolSchemas) {
     const driftLogs = [];
     let adapted = params;
     if (serverVersion !== "v3") {
       const pair = (0, import_v2_5.getV25Adapter)(taskType);
       if (pair) adapted = pair.adaptRequest(adapted);
     }
-    const toolSchema = this.cachedToolSchemas?.get(taskType);
+    const toolSchema = (perCallToolSchemas ?? this.cachedToolSchemas)?.get(taskType);
     if (toolSchema && Object.keys(toolSchema).length > 0) {
       const declaredFields = new Set(Object.keys(toolSchema));
       const adapterAliases = [["brand_manifest", "brand"]];
@@ -2062,13 +2119,19 @@ Hint: this usually means agent_uri does not include the MCP endpoint path. The S
       if (!options?.skipIdempotencyAutoInject && !options?.skipAccountValidation) {
         this.executor.validateRequest(taskName, normalizedParams);
       }
-      const serverVersion = await this.detectServerVersion(options);
+      const capabilityDiscoveryContext = {};
+      const detectionOptions = {
+        ...options,
+        [CAPABILITY_DISCOVERY_CONTEXT]: capabilityDiscoveryContext
+      };
+      const serverVersion = await this.detectServerVersion(detectionOptions);
       const inputSchemaStripLogs = [];
       const { params: adaptedParams, driftLogs: adaptDriftLogs } = this.adaptRequest(
         taskName,
         normalizedParams,
         serverVersion,
-        inputSchemaStripLogs
+        inputSchemaStripLogs,
+        capabilityDiscoveryContext.toolSchemas
       );
       const v25DriftLogs = [...adaptDriftLogs];
       if (webhookDriftLog) v25DriftLogs.push(webhookDriftLog);
@@ -2443,6 +2506,16 @@ Hint: this usually means agent_uri does not include the MCP endpoint path. The S
       ...options?.signal && { signal: options.signal },
       ...clientRequestTimeoutMs !== void 0 && { timeout: clientRequestTimeoutMs }
     };
+    const ensureReadAuthToken = async () => {
+      if (!this.normalizedAgent.oauth_client_credentials) return this.normalizedAgent.auth_token;
+      const { ensureClientCredentialsTokens, getAgentStorage } = await import("../auth/oauth/index.js");
+      await ensureClientCredentialsTokens(this.normalizedAgent, {
+        storage: getAgentStorage(this.normalizedAgent),
+        allowPrivateIp: (0, import_net.isLikelyPrivateUrl)(this.normalizedAgent.agent_uri),
+        fetch: transport?.fetchFn
+      });
+      return this.normalizedAgent.oauth_tokens?.access_token;
+    };
     if (this.normalizedAgent.protocol === "mcp") {
       if (this.normalizedAgent._inProcessMcpClient) {
         const mcpClient2 = this.normalizedAgent._inProcessMcpClient;
@@ -2464,6 +2537,7 @@ Hint: this usually means agent_uri does not include the MCP endpoint path. The S
           tools
         };
       }
+      const readAuthToken = await ensureReadAuthToken();
       const agent = await this.ensureEndpointDiscovered(options);
       const { connectMCP } = await import("../protocols/mcp.js");
       const { tryListModernMCPTools } = await import("../protocols/mcp-modern.js");
@@ -2474,25 +2548,30 @@ Hint: this usually means agent_uri does not include the MCP endpoint path. The S
       if (transport?.requestTimeoutMs !== void 0) {
         connectOptions.requestTimeoutMs = transport.requestTimeoutMs;
       }
+      if (transport?.fetchFn) {
+        connectOptions.fetchFn = transport.fetchFn;
+      }
       if (this.normalizedAgent.headers && Object.keys(this.normalizedAgent.headers).length > 0) {
         connectOptions.customHeaders = this.normalizedAgent.headers;
       }
       let authProvider;
-      if (this.normalizedAgent.oauth_tokens) {
+      if (this.normalizedAgent.oauth_tokens && !this.normalizedAgent.oauth_client_credentials) {
         const { createNonInteractiveOAuthProvider } = await import("../auth/oauth/index.js");
         authProvider = createNonInteractiveOAuthProvider(this.normalizedAgent, {
-          agentHint: this.normalizedAgent.id
+          agentHint: this.normalizedAgent.id,
+          allowHttp: (0, import_net.isLikelyPrivateUrl)(this.normalizedAgent.agent_uri)
         });
         connectOptions.authProvider = authProvider;
-      } else if (this.normalizedAgent.auth_token) {
-        connectOptions.authToken = this.normalizedAgent.auth_token;
+      } else if (readAuthToken) {
+        connectOptions.authToken = readAuthToken;
       }
-      const modernTools = this.discoveredMcpEra === "legacy" && Date.now() - this.discoveredMcpEraAt < 5 * 60 * 1e3 ? { handled: false } : await withResponseSizeLimit(
+      const modernTools = !transport?.fetchFn && this.discoveredMcpEra === "legacy" && Date.now() - this.discoveredMcpEraAt < 5 * 60 * 1e3 ? { handled: false } : await withResponseSizeLimit(
         maxResponseBytes,
-        () => tryListModernMCPTools(agent.agent_uri, this.normalizedAgent.auth_token, this.normalizedAgent.headers, {
+        () => tryListModernMCPTools(agent.agent_uri, readAuthToken, this.normalizedAgent.headers, {
           authProvider,
           signal: options?.signal,
-          requestTimeoutMs: transport?.requestTimeoutMs
+          requestTimeoutMs: transport?.requestTimeoutMs,
+          fetchFn: transport?.fetchFn
         })
       );
       if (modernTools.handled) {
@@ -2537,9 +2616,11 @@ Hint: this usually means agent_uri does not include the MCP endpoint path. The S
       }
     } else if (this.normalizedAgent.protocol === "a2a") {
       const { wrapFetchWithSizeLimit } = await import("../protocols/responseSizeLimit.js");
-      const authToken = this.normalizedAgent.auth_token;
+      const authToken = await ensureReadAuthToken();
       const agentHeaders = this.normalizedAgent.headers ?? {};
-      const sizeLimitedFetch = wrapFetchWithSizeLimit((input, init) => fetch(input, init));
+      const sizeLimitedFetch = wrapFetchWithSizeLimit(
+        (input, init) => transport?.fetchFn ? transport.fetchFn(input, init) : fetch(input, init)
+      );
       const normalizeHeaders = (headers) => {
         const normalized = {};
         if (!headers) return normalized;
@@ -2630,7 +2711,10 @@ Hint: this usually means agent_uri does not include the MCP endpoint path. The S
    */
   async getCapabilities(options) {
     (0, import_abort2.throwIfAborted)(options?.signal);
-    if (this.cachedCapabilities) {
+    const discoveryContext = options?.[CAPABILITY_DISCOVERY_CONTEXT];
+    const usesScopedFetch = (options?.transport ?? this.config.transport)?.fetchFn !== void 0;
+    if (!usesScopedFetch && this.cachedCapabilities) {
+      if (discoveryContext) discoveryContext.toolSchemas = this.cachedToolSchemas;
       this.maybeWarnV2Sunset(this.cachedCapabilities);
       return this.cachedCapabilities;
     }
@@ -2639,9 +2723,11 @@ Hint: this usually means agent_uri does not include the MCP endpoint path. The S
       name: t.name,
       description: t.description
     }));
-    this.cachedToolSchemas = new Map(
+    const discoveredToolSchemas = new Map(
       agentInfo.tools.filter((t) => t.inputSchema?.properties).map((t) => [t.name, t.inputSchema.properties])
     );
+    if (discoveryContext) discoveryContext.toolSchemas = discoveredToolSchemas;
+    if (!usesScopedFetch) this.cachedToolSchemas = discoveredToolSchemas;
     const hasCapabilitiesTool = tools.some((t) => t.name === "get_adcp_capabilities");
     if (hasCapabilitiesTool) {
       try {
@@ -2655,9 +2741,10 @@ Hint: this usually means agent_uri does not include the MCP endpoint path. The S
           throw (0, import_abort2.createTimeoutError)(requestTimeoutMs);
         }
         if (result.success && result.data) {
-          this.cachedCapabilities = (0, import_capabilities.augmentCapabilitiesFromTools)((0, import_capabilities.parseCapabilitiesResponse)(result.data), tools);
-          this.maybeWarnV2Sunset(this.cachedCapabilities);
-          return this.cachedCapabilities;
+          const capabilities3 = (0, import_capabilities.augmentCapabilitiesFromTools)((0, import_capabilities.parseCapabilitiesResponse)(result.data), tools);
+          if (!usesScopedFetch) this.cachedCapabilities = capabilities3;
+          this.maybeWarnV2Sunset(capabilities3);
+          return capabilities3;
         }
         if (result.data && (0, import_capabilities.looksLikeV3Capabilities)(result.data)) {
           console.warn(
@@ -2670,9 +2757,10 @@ Hint: this usually means agent_uri does not include the MCP endpoint path. The S
             version: "v3",
             majorVersions: parsed.majorVersions.includes(3) ? parsed.majorVersions : [3]
           };
-          this.cachedCapabilities = (0, import_capabilities.augmentCapabilitiesFromTools)(v3Capabilities, tools);
-          this.maybeWarnV2Sunset(this.cachedCapabilities);
-          return this.cachedCapabilities;
+          const capabilities3 = (0, import_capabilities.augmentCapabilitiesFromTools)(v3Capabilities, tools);
+          if (!usesScopedFetch) this.cachedCapabilities = capabilities3;
+          this.maybeWarnV2Sunset(capabilities3);
+          return capabilities3;
         }
         console.warn(
           `[AdCP] Agent "${this.agent.id}" advertises get_adcp_capabilities but the call returned non-success and the response is not v3-shaped \u2014 treating as v3 (synthetic) since the agent has the v3-only discovery tool. This client routes to v3 adapters, but calls reading capability details (idempotency TTL, supported_versions, feature flags) will fail until the agent operator fixes the capabilities endpoint.`,
@@ -2690,15 +2778,17 @@ Hint: this usually means agent_uri does not include the MCP endpoint path. The S
           `[AdCP] Agent "${this.agent.id}" advertises get_adcp_capabilities but the call threw \u2014 treating as v3 (synthetic) since the agent has the v3-only discovery tool. This client routes to v3 adapters, but calls reading capability details (idempotency TTL, supported_versions, feature flags) will fail until the agent operator fixes the capabilities endpoint.`
         );
       }
-      this.cachedCapabilities = (0, import_capabilities.augmentCapabilitiesFromTools)((0, import_capabilities.buildSyntheticV3Capabilities)(tools), tools);
-      this.maybeWarnV2Sunset(this.cachedCapabilities);
-      return this.cachedCapabilities;
+      const capabilities2 = (0, import_capabilities.augmentCapabilitiesFromTools)((0, import_capabilities.buildSyntheticV3Capabilities)(tools), tools);
+      if (!usesScopedFetch) this.cachedCapabilities = capabilities2;
+      this.maybeWarnV2Sunset(capabilities2);
+      return capabilities2;
     }
     console.warn(
       `[AdCP] Agent "${this.agent.id}" detected as v2 (no get_adcp_capabilities tool). Tools: [${tools.map((t) => t.name).join(", ")}]`
     );
-    this.cachedCapabilities = (0, import_capabilities.buildSyntheticCapabilities)(tools);
-    return this.cachedCapabilities;
+    const capabilities = (0, import_capabilities.buildSyntheticCapabilities)(tools);
+    if (!usesScopedFetch) this.cachedCapabilities = capabilities;
+    return capabilities;
   }
   /**
    * Emit a one-time warning when the agent reports v2 capabilities.