@adcp/sdk 13.0.4 → 13.1.1

package/dist/lib/protocols/a2a-push-notification.d.mts

@@ -0,0 +1,13 @@
+import type { TaskPushNotificationConfig } from '@a2a-js/sdk-v1';
+export interface A2APushNotificationConfig {
+    url: string;
+    token?: string;
+    authentication?: {
+        schemes?: string[];
+        /** Legacy signing-vector spelling accepted at the conformance boundary. */
+        scheme?: string;
+        credentials?: string;
+    };
+}
+/** Map AdCP push registration to the official A2A 1.0 transport shape. */
+export declare function toA2ATaskPushNotificationConfig(config: A2APushNotificationConfig): TaskPushNotificationConfig;

package/dist/lib/protocols/a2a-push-notification.d.ts

@@ -0,0 +1,14 @@
+import type { TaskPushNotificationConfig } from '@a2a-js/sdk-v1';
+export interface A2APushNotificationConfig {
+    url: string;
+    token?: string;
+    authentication?: {
+        schemes?: string[];
+        /** Legacy signing-vector spelling accepted at the conformance boundary. */
+        scheme?: string;
+        credentials?: string;
+    };
+}
+/** Map AdCP push registration to the official A2A 1.0 transport shape. */
+export declare function toA2ATaskPushNotificationConfig(config: A2APushNotificationConfig): TaskPushNotificationConfig;
+//# sourceMappingURL=a2a-push-notification.d.ts.map

package/dist/lib/protocols/a2a-push-notification.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"a2a-push-notification.d.ts","sourceRoot":"","sources":["../../../src/lib/protocols/a2a-push-notification.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,0BAA0B,EAAE,MAAM,gBAAgB,CAAC;AAEjE,MAAM,WAAW,yBAAyB;IACxC,GAAG,EAAE,MAAM,CAAC;IACZ,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,cAAc,CAAC,EAAE;QACf,OAAO,CAAC,EAAE,MAAM,EAAE,CAAC;QACnB,2EAA2E;QAC3E,MAAM,CAAC,EAAE,MAAM,CAAC;QAChB,WAAW,CAAC,EAAE,MAAM,CAAC;KACtB,CAAC;CACH;AAED,0EAA0E;AAC1E,wBAAgB,+BAA+B,CAAC,MAAM,EAAE,yBAAyB,GAAG,0BAA0B,CAe7G"}

package/dist/lib/protocols/a2a-push-notification.js

@@ -0,0 +1,42 @@
+"use strict";
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, { get: all[name], enumerable: true });
+};
+var __copyProps = (to, from, except, desc) => {
+  if (from && typeof from === "object" || typeof from === "function") {
+    for (let key of __getOwnPropNames(from))
+      if (!__hasOwnProp.call(to, key) && key !== except)
+        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
+  }
+  return to;
+};
+var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
+var a2a_push_notification_exports = {};
+__export(a2a_push_notification_exports, {
+  toA2ATaskPushNotificationConfig: () => toA2ATaskPushNotificationConfig
+});
+module.exports = __toCommonJS(a2a_push_notification_exports);
+function toA2ATaskPushNotificationConfig(config) {
+  const authentication = config.authentication;
+  return {
+    tenant: "",
+    id: "",
+    taskId: "",
+    url: config.url,
+    token: config.token ?? "",
+    authentication: authentication ? {
+      scheme: authentication.schemes?.[0] ?? authentication.scheme ?? "",
+      credentials: authentication.credentials ?? ""
+    } : void 0
+  };
+}
+// Annotate the CommonJS export names for ESM import in node:
+0 && (module.exports = {
+  toA2ATaskPushNotificationConfig
+});
+//# sourceMappingURL=a2a-push-notification.js.map

package/dist/lib/protocols/a2a-push-notification.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../../src/lib/protocols/a2a-push-notification.ts"],"sourcesContent":["import type { TaskPushNotificationConfig } from '@a2a-js/sdk-v1';\n\nexport interface A2APushNotificationConfig {\n  url: string;\n  token?: string;\n  authentication?: {\n    schemes?: string[];\n    /** Legacy signing-vector spelling accepted at the conformance boundary. */\n    scheme?: string;\n    credentials?: string;\n  };\n}\n\n/** Map AdCP push registration to the official A2A 1.0 transport shape. */\nexport function toA2ATaskPushNotificationConfig(config: A2APushNotificationConfig): TaskPushNotificationConfig {\n  const authentication = config.authentication;\n  return {\n    tenant: '',\n    id: '',\n    taskId: '',\n    url: config.url,\n    token: config.token ?? '',\n    authentication: authentication\n      ? {\n          scheme: authentication.schemes?.[0] ?? authentication.scheme ?? '',\n          credentials: authentication.credentials ?? '',\n        }\n      : undefined,\n  };\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAAA;AAcO,SAAS,gCAAgC,QAA+D;AAC7G,QAAM,iBAAiB,OAAO;AAC9B,SAAO;AAAA,IACL,QAAQ;AAAA,IACR,IAAI;AAAA,IACJ,QAAQ;AAAA,IACR,KAAK,OAAO;AAAA,IACZ,OAAO,OAAO,SAAS;AAAA,IACvB,gBAAgB,iBACZ;AAAA,MACE,QAAQ,eAAe,UAAU,CAAC,KAAK,eAAe,UAAU;AAAA,MAChE,aAAa,eAAe,eAAe;AAAA,IAC7C,IACA;AAAA,EACN;AACF;","names":[]}

package/dist/lib/protocols/a2a-push-notification.mjs

@@ -0,0 +1,23 @@
+import { fileURLToPath as __adcpFileURLToPath } from "node:url";
+import { dirname as __adcpDirname } from "node:path";
+import { createRequire as __adcpCreateRequire } from "node:module";
+const __dirname = __adcpDirname(__adcpFileURLToPath(import.meta.url));
+const require2 = __adcpCreateRequire(import.meta.url);
+function toA2ATaskPushNotificationConfig(config) {
+  const authentication = config.authentication;
+  return {
+    tenant: "",
+    id: "",
+    taskId: "",
+    url: config.url,
+    token: config.token ?? "",
+    authentication: authentication ? {
+      scheme: authentication.schemes?.[0] ?? authentication.scheme ?? "",
+      credentials: authentication.credentials ?? ""
+    } : void 0
+  };
+}
+export {
+  toA2ATaskPushNotificationConfig
+};
+//# sourceMappingURL=a2a-push-notification.mjs.map

package/dist/lib/protocols/a2a-push-notification.mjs.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../../src/lib/protocols/a2a-push-notification.ts"],"sourcesContent":["import { fileURLToPath as __adcpFileURLToPath } from 'node:url';\nimport { dirname as __adcpDirname } from 'node:path';\nimport { createRequire as __adcpCreateRequire } from 'node:module';\nconst __dirname = __adcpDirname(__adcpFileURLToPath(import.meta.url));\nconst require = __adcpCreateRequire(import.meta.url);\nimport type { TaskPushNotificationConfig } from '@a2a-js/sdk-v1';\n\nexport interface A2APushNotificationConfig {\n  url: string;\n  token?: string;\n  authentication?: {\n    schemes?: string[];\n    /** Legacy signing-vector spelling accepted at the conformance boundary. */\n    scheme?: string;\n    credentials?: string;\n  };\n}\n\n/** Map AdCP push registration to the official A2A 1.0 transport shape. */\nexport function toA2ATaskPushNotificationConfig(config: A2APushNotificationConfig): TaskPushNotificationConfig {\n  const authentication = config.authentication;\n  return {\n    tenant: '',\n    id: '',\n    taskId: '',\n    url: config.url,\n    token: config.token ?? '',\n    authentication: authentication\n      ? {\n          scheme: authentication.schemes?.[0] ?? authentication.scheme ?? '',\n          credentials: authentication.credentials ?? '',\n        }\n      : undefined,\n  };\n}\n"],"mappings":"AAAA,SAAS,iBAAiB,2BAA2B;AACrD,SAAS,WAAW,qBAAqB;AACzC,SAAS,iBAAiB,2BAA2B;AACrD,MAAM,YAAY,cAAc,oBAAoB,YAAY,GAAG,CAAC;AACpE,MAAMA,WAAU,oBAAoB,YAAY,GAAG;AAe5C,SAAS,gCAAgC,QAA+D;AAC7G,QAAM,iBAAiB,OAAO;AAC9B,SAAO;AAAA,IACL,QAAQ;AAAA,IACR,IAAI;AAAA,IACJ,QAAQ;AAAA,IACR,KAAK,OAAO;AAAA,IACZ,OAAO,OAAO,SAAS;AAAA,IACvB,gBAAgB,iBACZ;AAAA,MACE,QAAQ,eAAe,UAAU,CAAC,KAAK,eAAe,UAAU;AAAA,MAChE,aAAa,eAAe,eAAe;AAAA,IAC7C,IACA;AAAA,EACN;AACF;","names":["require"]}

package/dist/lib/protocols/a2a.d.mts

@@ -2,6 +2,10 @@ import type { PushNotificationConfig } from '../types/tools.generated.mjs';
 import type { DebugLogEntry } from '../types/adcp.mjs';
 import { type AgentSigningContext } from '../signing/client.mjs';
 import type { AgentConfig } from '../types/adcp.mjs';
+/** Controls whether A2A v0.3 compatibility is accepted. */
+export interface A2ALegacyCompatOptions {
+    enabled: boolean;
+}
 /**
  * Clear all cached A2A clients. Called by closeConnections('a2a').
  * A2A clients hold no persistent network resources (unlike MCP), so this
@@ -11,9 +15,9 @@ export declare function closeA2AConnections(): void;
 /**
  * Fire-and-forget A2A tasks/cancel for an in-flight task (A2A 0.3.0 §7.4).
  *
- * Sends a raw JSON-RPC 2.0 POST directly to the agent endpoint with the same
- * auth header shape as `callA2AToolImpl` (Bearer + x-adcp-auth). Does NOT
- * enter `callContextStorage` — debug-log capture and 401-cache-eviction are
+ * Uses the official A2A SDK cancel method with the same auth header shape as
+ * `callA2AToolImpl` (Bearer + x-adcp-auth). Does NOT enter
+ * `callContextStorage` — debug-log capture and 401-cache-eviction are
  * intentionally skipped for best-effort cancellation.
  *
  * **Auth-code OAuth gap:** `authToken` is resolved by `getAuthToken(agent)`,
@@ -41,7 +45,13 @@ export declare function closeA2AConnections(): void;
  * @param agent     The agent config (used for URL, auth token, signing).
  * @param taskId    The server-assigned A2A Task.id to cancel.
  */
-export declare function cancelA2ATask(agent: AgentConfig, taskId: string, fetchFn?: typeof fetch, allowPrivateIp?: boolean): Promise<void>;
+export declare function cancelA2ATask(agent: AgentConfig, taskId: string, fetchFn?: typeof fetch, allowPrivateIp?: boolean, legacyCompat?: A2ALegacyCompatOptions): Promise<void>;
+/**
+ * Build an official A2A client from a card URL. Ordinary calls retain the
+ * stable SDK's v0.3 client; native-only compliance calls use the separately
+ * pinned official 1.0 client.
+ */
+export declare function createA2AClientFromCardUrl(cardUrl: string, fetchImpl: typeof fetch, legacyCompat?: A2ALegacyCompatOptions): Promise<any>;
 /**
  * Protocol-level session identifiers that ride on the A2A Message envelope
  * (not in the skill parameters). `contextId` binds sends to a server-side
@@ -54,4 +64,4 @@ export interface A2ASessionIds {
     contextId?: string;
     taskId?: string;
 }
-export declare function callA2ATool(agentUrl: string, toolName: string, parameters: Record<string, unknown>, authToken?: string, debugLogs?: DebugLogEntry[], pushNotificationConfig?: PushNotificationConfig, customHeaders?: Record<string, string>, signingContext?: AgentSigningContext, session?: A2ASessionIds, signal?: AbortSignal, requestTimeoutMs?: number, fetchFn?: typeof fetch, allowPrivateIp?: boolean): Promise<unknown>;
+export declare function callA2ATool(agentUrl: string, toolName: string, parameters: Record<string, unknown>, authToken?: string, debugLogs?: DebugLogEntry[], pushNotificationConfig?: PushNotificationConfig, customHeaders?: Record<string, string>, signingContext?: AgentSigningContext, session?: A2ASessionIds, signal?: AbortSignal, requestTimeoutMs?: number, fetchFn?: typeof fetch, allowPrivateIp?: boolean, legacyCompat?: A2ALegacyCompatOptions): Promise<unknown>;

package/dist/lib/protocols/a2a.d.ts

@@ -2,6 +2,10 @@ import type { PushNotificationConfig } from '../types/tools.generated';
 import type { DebugLogEntry } from '../types/adcp';
 import { type AgentSigningContext } from '../signing/client';
 import type { AgentConfig } from '../types/adcp';
+/** Controls whether A2A v0.3 compatibility is accepted. */
+export interface A2ALegacyCompatOptions {
+    enabled: boolean;
+}
 /**
  * Clear all cached A2A clients. Called by closeConnections('a2a').
  * A2A clients hold no persistent network resources (unlike MCP), so this
@@ -11,9 +15,9 @@ export declare function closeA2AConnections(): void;
 /**
  * Fire-and-forget A2A tasks/cancel for an in-flight task (A2A 0.3.0 §7.4).
  *
- * Sends a raw JSON-RPC 2.0 POST directly to the agent endpoint with the same
- * auth header shape as `callA2AToolImpl` (Bearer + x-adcp-auth). Does NOT
- * enter `callContextStorage` — debug-log capture and 401-cache-eviction are
+ * Uses the official A2A SDK cancel method with the same auth header shape as
+ * `callA2AToolImpl` (Bearer + x-adcp-auth). Does NOT enter
+ * `callContextStorage` — debug-log capture and 401-cache-eviction are
  * intentionally skipped for best-effort cancellation.
  *
  * **Auth-code OAuth gap:** `authToken` is resolved by `getAuthToken(agent)`,
@@ -41,7 +45,13 @@ export declare function closeA2AConnections(): void;
  * @param agent     The agent config (used for URL, auth token, signing).
  * @param taskId    The server-assigned A2A Task.id to cancel.
  */
-export declare function cancelA2ATask(agent: AgentConfig, taskId: string, fetchFn?: typeof fetch, allowPrivateIp?: boolean): Promise<void>;
+export declare function cancelA2ATask(agent: AgentConfig, taskId: string, fetchFn?: typeof fetch, allowPrivateIp?: boolean, legacyCompat?: A2ALegacyCompatOptions): Promise<void>;
+/**
+ * Build an official A2A client from a card URL. Ordinary calls retain the
+ * stable SDK's v0.3 client; native-only compliance calls use the separately
+ * pinned official 1.0 client.
+ */
+export declare function createA2AClientFromCardUrl(cardUrl: string, fetchImpl: typeof fetch, legacyCompat?: A2ALegacyCompatOptions): Promise<any>;
 /**
  * Protocol-level session identifiers that ride on the A2A Message envelope
  * (not in the skill parameters). `contextId` binds sends to a server-side
@@ -54,5 +64,5 @@ export interface A2ASessionIds {
     contextId?: string;
     taskId?: string;
 }
-export declare function callA2ATool(agentUrl: string, toolName: string, parameters: Record<string, unknown>, authToken?: string, debugLogs?: DebugLogEntry[], pushNotificationConfig?: PushNotificationConfig, customHeaders?: Record<string, string>, signingContext?: AgentSigningContext, session?: A2ASessionIds, signal?: AbortSignal, requestTimeoutMs?: number, fetchFn?: typeof fetch, allowPrivateIp?: boolean): Promise<unknown>;
+export declare function callA2ATool(agentUrl: string, toolName: string, parameters: Record<string, unknown>, authToken?: string, debugLogs?: DebugLogEntry[], pushNotificationConfig?: PushNotificationConfig, customHeaders?: Record<string, string>, signingContext?: AgentSigningContext, session?: A2ASessionIds, signal?: AbortSignal, requestTimeoutMs?: number, fetchFn?: typeof fetch, allowPrivateIp?: boolean, legacyCompat?: A2ALegacyCompatOptions): Promise<unknown>;
 //# sourceMappingURL=a2a.d.ts.map

package/dist/lib/protocols/a2a.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"a2a.d.ts","sourceRoot":"","sources":["../../../src/lib/protocols/a2a.ts"],"names":[],"mappings":"AAIA,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,0BAA0B,CAAC;AACvE,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,eAAe,CAAC;AAMnD,OAAO,EAAiD,KAAK,mBAAmB,EAAE,MAAM,mBAAmB,CAAC;AAI5G,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,eAAe,CAAC;AAyIjD;;;;GAIG;AACH,wBAAgB,mBAAmB,IAAI,IAAI,CAG1C;AASD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgCG;AACH,wBAAsB,aAAa,CACjC,KAAK,EAAE,WAAW,EAClB,MAAM,EAAE,MAAM,EACd,OAAO,CAAC,EAAE,OAAO,KAAK,EACtB,cAAc,CAAC,EAAE,OAAO,GACvB,OAAO,CAAC,IAAI,CAAC,CA6Df;AAmMD;;;;;;;GAOG;AACH,MAAM,WAAW,aAAa;IAC5B,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAED,wBAAsB,WAAW,CAC/B,QAAQ,EAAE,MAAM,EAChB,QAAQ,EAAE,MAAM,EAChB,UAAU,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EACnC,SAAS,CAAC,EAAE,MAAM,EAClB,SAAS,GAAE,aAAa,EAAO,EAC/B,sBAAsB,CAAC,EAAE,sBAAsB,EAC/C,aAAa,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,EACtC,cAAc,CAAC,EAAE,mBAAmB,EACpC,OAAO,CAAC,EAAE,aAAa,EACvB,MAAM,CAAC,EAAE,WAAW,EACpB,gBAAgB,CAAC,EAAE,MAAM,EACzB,OAAO,CAAC,EAAE,OAAO,KAAK,EACtB,cAAc,CAAC,EAAE,OAAO,GACvB,OAAO,CAAC,OAAO,CAAC,CAiClB"}
+{"version":3,"file":"a2a.d.ts","sourceRoot":"","sources":["../../../src/lib/protocols/a2a.ts"],"names":[],"mappings":"AAIA,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,0BAA0B,CAAC;AACvE,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,eAAe,CAAC;AAMnD,OAAO,EAAiD,KAAK,mBAAmB,EAAE,MAAM,mBAAmB,CAAC;AAI5G,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,eAAe,CAAC;AAmCjD,2DAA2D;AAC3D,MAAM,WAAW,sBAAsB;IACrC,OAAO,EAAE,OAAO,CAAC;CAClB;AA2GD;;;;GAIG;AACH,wBAAgB,mBAAmB,IAAI,IAAI,CAG1C;AASD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgCG;AACH,wBAAsB,aAAa,CACjC,KAAK,EAAE,WAAW,EAClB,MAAM,EAAE,MAAM,EACd,OAAO,CAAC,EAAE,OAAO,KAAK,EACtB,cAAc,CAAC,EAAE,OAAO,EACxB,YAAY,GAAE,sBAAkD,GAC/D,OAAO,CAAC,IAAI,CAAC,CAuFf;AAED;;;;GAIG;AACH,wBAAsB,0BAA0B,CAC9C,OAAO,EAAE,MAAM,EACf,SAAS,EAAE,OAAO,KAAK,EACvB,YAAY,GAAE,sBAAkD,GAC/D,OAAO,CAAC,GAAG,CAAC,CAMd;AAoOD;;;;;;;GAOG;AACH,MAAM,WAAW,aAAa;IAC5B,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAED,wBAAsB,WAAW,CAC/B,QAAQ,EAAE,MAAM,EAChB,QAAQ,EAAE,MAAM,EAChB,UAAU,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EACnC,SAAS,CAAC,EAAE,MAAM,EAClB,SAAS,GAAE,aAAa,EAAO,EAC/B,sBAAsB,CAAC,EAAE,sBAAsB,EAC/C,aAAa,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,EACtC,cAAc,CAAC,EAAE,mBAAmB,EACpC,OAAO,CAAC,EAAE,aAAa,EACvB,MAAM,CAAC,EAAE,WAAW,EACpB,gBAAgB,CAAC,EAAE,MAAM,EACzB,OAAO,CAAC,EAAE,OAAO,KAAK,EACtB,cAAc,CAAC,EAAE,OAAO,EACxB,YAAY,CAAC,EAAE,sBAAsB,GACpC,OAAO,CAAC,OAAO,CAAC,CAkClB"}

package/dist/lib/protocols/a2a.js

@@ -1,7 +1,9 @@
 "use strict";
+var __create = Object.create;
 var __defProp = Object.defineProperty;
 var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
 var __getOwnPropNames = Object.getOwnPropertyNames;
+var __getProtoOf = Object.getPrototypeOf;
 var __hasOwnProp = Object.prototype.hasOwnProperty;
 var __export = (target, all) => {
   for (var name in all)
@@ -15,12 +17,21 @@ var __copyProps = (to, from, except, desc) => {
   }
   return to;
 };
+var __toESM = (mod, isNodeMode, target) => (target = mod != null ? __create(__getProtoOf(mod)) : {}, __copyProps(
+  // If the importer is in node compatibility mode or this is not an ESM
+  // file that has been converted to a CommonJS file using a Babel-
+  // compatible transform (i.e. "__esModule" has not been set), then set
+  // "default" to the CommonJS "module.exports" for node compatibility.
+  isNodeMode || !mod || !mod.__esModule ? __defProp(target, "default", { value: mod, enumerable: true }) : target,
+  mod
+));
 var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
 var a2a_exports = {};
 __export(a2a_exports, {
   callA2ATool: () => callA2ATool,
   cancelA2ATask: () => cancelA2ATask,
-  closeA2AConnections: () => closeA2AConnections
+  closeA2AConnections: () => closeA2AConnections,
+  createA2AClientFromCardUrl: () => createA2AClientFromCardUrl
 });
 module.exports = __toCommonJS(a2a_exports);
 var import_client = require("@a2a-js/sdk/client");
@@ -47,6 +58,7 @@ const A2AClient = import_client.A2AClient;
 if (!A2AClient) {
   throw new Error("A2A SDK client is required. Please install @a2a-js/sdk");
 }
+const DEFAULT_A2A_LEGACY_COMPAT = Object.freeze({ enabled: true });
 const callContextStorage = new import_node_async_hooks.AsyncLocalStorage();
 const a2aClientCache = /* @__PURE__ */ new Map();
 const pendingA2AClients = /* @__PURE__ */ new Map();
@@ -96,12 +108,18 @@ function closeA2AConnections() {
   pendingA2AClients.clear();
 }
 const CANCEL_TIMEOUT_MS = 5e3;
-async function cancelA2ATask(agent, taskId, fetchFn, allowPrivateIp) {
+async function cancelA2ATask(agent, taskId, fetchFn, allowPrivateIp, legacyCompat = DEFAULT_A2A_LEGACY_COMPAT) {
   if (agent.protocol !== "a2a") {
     return;
   }
   const agentUrl = agent.agent_uri;
-  const transportFetch = (0, import_agent_transport_fetch.createAgentTransportFetch)(agentUrl, { trustedFetchFn: fetchFn, allowPrivateIp });
+  const configuredHeaders = agent.headers ?? {};
+  const transportFetch = (0, import_agent_transport_fetch.createAgentTransportFetch)(agentUrl, {
+    trustedFetchFn: fetchFn,
+    allowPrivateIp,
+    originBoundHeaders: Object.keys(configuredHeaders),
+    crossOriginCredentialPolicy: legacyCompat.enabled === false ? "refuse" : "strip"
+  });
   const authToken = agent.auth_token;
   let requestFetch = (input, init) => transportFetch(input, init);
   if (agent.request_signing && (0, import_agent_fetch.isInlineSigningConfig)(agent.request_signing)) {
@@ -112,10 +130,24 @@ async function cancelA2ATask(agent, taskId, fetchFn, allowPrivateIp) {
   const timeoutSignal = AbortSignal.timeout(CANCEL_TIMEOUT_MS);
   const fetchImpl = (input, init = {}) => {
     const headers = new Headers(init.headers);
-    if (authToken) {
+    const requestUrl = new URL(input instanceof Request ? input.url : input.toString());
+    const nativeCrossOrigin = legacyCompat.enabled === false && requestUrl.origin !== new URL(agentUrl).origin;
+    if (nativeCrossOrigin && (authToken || agent.request_signing)) {
+      const credentialHeaderNames = [
+        ...authToken ? ["authorization", "x-adcp-auth"] : [],
+        ...agent.request_signing ? ["content-digest", "signature", "signature-input"] : []
+      ];
+      throw new Error(
+        `A2A native cancel refused credentialed cross-origin dispatch to ${requestUrl.origin}; credential headers: ${credentialHeaderNames.join(", ")}`
+      );
+    }
+    if (authToken && !nativeCrossOrigin) {
       headers.set("authorization", `Bearer ${authToken}`);
       headers.set("x-adcp-auth", authToken);
     }
+    if (!nativeCrossOrigin) {
+      for (const [name, value] of Object.entries(configuredHeaders)) headers.set(name, value);
+    }
     const signal = init.signal ? AbortSignal.any([init.signal, timeoutSignal]) : timeoutSignal;
     return requestFetch(input, { ...init, headers, signal });
   };
@@ -123,14 +155,26 @@ async function cancelA2ATask(agent, taskId, fetchFn, allowPrivateIp) {
   let lastError;
   for (const cardUrl of (0, import_a2a_discovery.buildCardUrls)(agentUrl)) {
     try {
-      client = await A2AClient.fromCardUrl(cardUrl, { fetchImpl });
+      client = await createA2AClientFromCardUrl(cardUrl, fetchImpl, legacyCompat);
       break;
     } catch (err) {
       lastError = err;
     }
   }
   if (!client) throw lastError instanceof Error ? lastError : new Error("A2A agent card discovery failed");
-  await client.cancelTask({ id: taskId });
+  if (legacyCompat.enabled === false) {
+    const { createNativeCancelTaskRequest } = await import("./a2a-native-v1.js");
+    await client.cancelTask(createNativeCancelTaskRequest(taskId));
+  } else {
+    await client.cancelTask({ id: taskId });
+  }
+}
+async function createA2AClientFromCardUrl(cardUrl, fetchImpl, legacyCompat = DEFAULT_A2A_LEGACY_COMPAT) {
+  if (legacyCompat.enabled === false) {
+    const { createNativeA2AClientFromCardUrl } = await import("./a2a-native-v1.js");
+    return createNativeA2AClientFromCardUrl(cardUrl, fetchImpl);
+  }
+  return A2AClient.fromCardUrl(cardUrl, { fetchImpl });
 }
 async function getOrCreateA2AClient(agentUrl, authToken, customHeaders, bypassCache = false) {
   const signingContext = import_client2.signingContextStorage.getStore();
@@ -177,9 +221,20 @@ async function createA2AClient(agentUrl, authToken) {
 }
 function buildFetchImpl(authToken, agentUrl) {
   const signingContext = import_client2.signingContextStorage.getStore();
+  const creationContext = callContextStorage.getStore();
+  const originBoundCustomHeaderNames = Object.keys(creationContext?.customHeaders ?? {});
   const pinnedFetch = (0, import_agent_transport_fetch.createAgentTransportFetch)(agentUrl, {
-    trustedFetchFn: callContextStorage.getStore()?.fetchFn,
-    allowPrivateIp: callContextStorage.getStore()?.allowPrivateIp
+    trustedFetchFn: creationContext?.fetchFn,
+    allowPrivateIp: creationContext?.allowPrivateIp,
+    originBoundHeaders: originBoundCustomHeaderNames,
+    crossOriginCredentialPolicy: creationContext?.legacyCompat?.enabled === false ? "refuse" : "strip",
+    onOriginBoundHeadersStripped: (headerNames, target) => {
+      callContextStorage.getStore()?.debugLogs.push({
+        type: "warning",
+        message: `A2A: Stripped configured origin-bound headers (${headerNames.join(", ")}) before cross-origin dispatch to ${target.origin}`,
+        timestamp: (/* @__PURE__ */ new Date()).toISOString()
+      });
+    }
   });
   const networkFetch = (0, import_transportDiagnostics.wrapFetchWithTransportDiagnostics)(
     (0, import_responseSizeLimit.wrapFetchWithSizeLimit)((input, init) => pinnedFetch(input, init))
@@ -202,13 +257,32 @@ function buildFetchImpl(authToken, agentUrl) {
     }
     const urlString = typeof url === "string" ? url : url.toString();
     const isDiscoveryRequest = (0, import_a2a_discovery.isAgentCardPath)(urlString);
+    const nativeCrossOrigin = context?.legacyCompat?.enabled === false && new URL(urlString).origin !== new URL(agentUrl).origin;
+    if (nativeCrossOrigin && (authToken || signingContext)) {
+      const targetOrigin = new URL(urlString).origin;
+      const credentialHeaderNames = [
+        ...authToken ? ["authorization", "x-adcp-auth"] : [],
+        ...signingContext ? ["content-digest", "signature", "signature-input"] : []
+      ];
+      throw new Error(
+        `A2A native dispatch refused credentialed cross-origin endpoint ${targetOrigin}; credential headers: ${credentialHeaderNames.join(", ")}`
+      );
+    }
+    const customHeaders = nativeCrossOrigin ? void 0 : context?.customHeaders;
+    if (nativeCrossOrigin && Object.keys(context?.customHeaders ?? {}).length > 0) {
+      context?.debugLogs.push({
+        type: "warning",
+        message: `A2A: Stripped configured origin-bound headers before cross-origin dispatch to ${new URL(urlString).origin}`,
+        timestamp: (/* @__PURE__ */ new Date()).toISOString()
+      });
+    }
     const traceHeaders = isDiscoveryRequest ? {} : (0, import_tracing.injectTraceHeaders)();
     const requestTimeoutMs = isDiscoveryRequest ? (0, import_abort.resolveRequestTimeoutMs)(context?.requestTimeoutMs, import_abort.DEFAULT_REQUEST_TIMEOUT_MS) : (0, import_abort.resolveRequestTimeoutMs)(context?.requestTimeoutMs);
     const headers = {
       ...existingHeaders,
       ...traceHeaders,
-      ...context?.customHeaders,
-      ...authToken && {
+      ...customHeaders,
+      ...authToken && !nativeCrossOrigin && {
         Authorization: `Bearer ${authToken}`,
         "x-adcp-auth": authToken
       }
@@ -249,7 +323,7 @@ function hasTerminalTaskWithDataArtifact(response) {
   if (typeof status?.state !== "string" || !TERMINAL_A2A_STATES.has(status.state)) return false;
   return (0, import_a2a_artifacts.getLatestA2ADataPartFromResponse)(response) !== void 0;
 }
-async function callA2ATool(agentUrl, toolName, parameters, authToken, debugLogs = [], pushNotificationConfig, customHeaders, signingContext, session, signal, requestTimeoutMs, fetchFn, allowPrivateIp) {
+async function callA2ATool(agentUrl, toolName, parameters, authToken, debugLogs = [], pushNotificationConfig, customHeaders, signingContext, session, signal, requestTimeoutMs, fetchFn, allowPrivateIp, legacyCompat) {
   return (0, import_tracing.withSpan)(
     "adcp.a2a.call_tool",
     {
@@ -264,7 +338,8 @@ async function callA2ATool(agentUrl, toolName, parameters, authToken, debugLogs
         signal,
         requestTimeoutMs,
         fetchFn,
-        allowPrivateIp
+        allowPrivateIp,
+        legacyCompat
       };
       return import_client2.signingContextStorage.run(
         signingContext,
@@ -287,6 +362,19 @@ async function callA2ATool(agentUrl, toolName, parameters, authToken, debugLogs
 }
 async function callA2AToolImpl(agentUrl, toolName, parameters, authToken, debugLogs, pushNotificationConfig, context, session) {
   try {
+    if (context.legacyCompat?.enabled === false) {
+      const { callNativeA2ATool } = await import("./a2a-native-v1.js");
+      return await callNativeA2ATool({
+        cardUrls: (0, import_a2a_discovery.buildCardUrls)(agentUrl),
+        fetchImpl: buildFetchImpl(authToken, agentUrl),
+        toolName,
+        parameters,
+        pushNotificationConfig,
+        contextId: session?.contextId,
+        taskId: session?.taskId,
+        signal: context.signal
+      });
+    }
     const client = await getOrCreateA2AClient(
       agentUrl,
       authToken,
@@ -394,6 +482,7 @@ async function callA2AToolImpl(agentUrl, toolName, parameters, authToken, debugL
 0 && (module.exports = {
   callA2ATool,
   cancelA2ATask,
-  closeA2AConnections
+  closeA2AConnections,
+  createA2AClientFromCardUrl
 });
 //# sourceMappingURL=a2a.js.map