@adcp/sdk 13.0.4 → 13.1.1

package/dist/lib/core/SingleAgentClient.mjs

@@ -14,6 +14,7 @@ import { withTaskDeadline } from "./task-deadline.mjs";
 import { createMCPRequestHeaders } from "../auth/index.mjs";
 import { isAbortOrTimeoutError } from "../protocols/abort.mjs";
 import { normalizeTransportOptions } from "../protocols/index.mjs";
+import { createA2AClientFromCardUrl } from "../protocols/a2a.mjs";
 import {
   AuthenticationRequiredError,
   ConfigurationError,
@@ -24,6 +25,7 @@ import {
   is401Error
 } from "../errors/index.mjs";
 import { createAgentTransportFetch, isLikelyPrivateUrl } from "../net/index.mjs";
+import { isCredentialHeaderName } from "../net/credential-headers.mjs";
 import {
   discoverAuthorizationRequirements,
   NeedsAuthorizationError,
@@ -981,20 +983,22 @@ class SingleAgentClient {
     const sizeLimitedFetch = wrapFetchWithSizeLimit(
       createAgentTransportFetch(agentUri, {
         trustedFetchFn: transport?.trustedFetchFn,
-        allowPrivateIp: transport?.allowPrivateIp
+        allowPrivateIp: transport?.allowPrivateIp,
+        originBoundHeaders: Object.keys(this.normalizedAgent.headers ?? {}),
+        crossOriginCredentialPolicy: transport?.legacyCompat?.enabled === false ? "refuse" : "strip"
       })
     );
     const authToken = this.normalizedAgent.oauth_client_credentials ? this.normalizedAgent.oauth_tokens?.access_token : this.normalizedAgent.auth_token;
     let got401 = false;
     const fetchImpl = async (url, requestInit) => {
-      const headers = {
-        ...requestInit?.headers,
-        ...this.normalizedAgent.headers,
-        ...authToken && {
-          Authorization: `Bearer ${authToken}`,
-          "x-adcp-auth": authToken
-        }
-      };
+      const headers = buildA2ADiscoveryHeaders(requestInit?.headers, this.normalizedAgent.headers, authToken);
+      assertNativeA2ADiscoveryCredentialOrigin(
+        agentUri,
+        url,
+        transport?.legacyCompat?.enabled,
+        headers,
+        this.normalizedAgent.headers
+      );
       const response = await withAbortSignal(
         [readOptions?.signal, requestInit?.signal],
         requestTimeoutMs,
@@ -1011,7 +1015,10 @@ class SingleAgentClient {
       let lastError = new Error(`A2A agent card not found at ${cardUrls.join(", ")}`);
       for (const cardUrl of cardUrls) {
         try {
-          client = await withResponseSizeLimit(maxResponseBytes, () => A2AClient.fromCardUrl(cardUrl, { fetchImpl }));
+          client = await withResponseSizeLimit(
+            maxResponseBytes,
+            () => createA2AClientFromCardUrl(cardUrl, fetchImpl, transport?.legacyCompat)
+          );
           break;
         } catch (err) {
           lastError = err;
@@ -1021,11 +1028,18 @@ class SingleAgentClient {
       if (!client) {
         throw lastError;
       }
-      const agentCard = await withResponseSizeLimit(
-        maxResponseBytes,
-        async () => client.agentCardPromise ? client.agentCardPromise : client.agentCard
-      );
-      if (agentCard?.url) {
+      const agentCard = await withResponseSizeLimit(maxResponseBytes, async () => {
+        if (transport?.legacyCompat?.enabled === false) {
+          return client.getAgentCard();
+        }
+        const compatibleClient = client;
+        return typeof compatibleClient.getAgentCard === "function" ? compatibleClient.getAgentCard() : compatibleClient.agentCardPromise ?? compatibleClient.agentCard;
+      });
+      if (transport?.legacyCompat?.enabled === false) {
+        const nativeJsonRpc = selectNativeJsonRpcInterface(agentCard);
+        if (nativeJsonRpc) return nativeJsonRpc.url;
+      }
+      if (agentCard && "url" in agentCard && typeof agentCard.url === "string" && agentCard.url.length > 0) {
         return agentCard.url;
       }
       return this.computeBaseUrl(agentUri);
@@ -3807,7 +3821,7 @@ Hint: this usually means agent_uri does not include the MCP endpoint path. The S
    * Get the fully resolved agent configuration
    *
    * This async method ensures the agent config has the canonical URL resolved:
-   * - For A2A: Fetches the agent card and uses its 'url' field
+   * - For A2A: Fetches the agent card and uses its selected native interface or legacy `url`
    * - For MCP: Performs endpoint discovery
    *
    * @returns Promise resolving to agent config with canonical URL
@@ -3870,7 +3884,8 @@ Hint: this usually means agent_uri does not include the MCP endpoint path. The S
       return this.canonicalBaseUrl;
     }
     if (this.normalizedAgent.protocol === "a2a") {
-      await this.ensureCanonicalUrlResolved();
+      const resolved = await this.ensureCanonicalUrlResolved();
+      return resolved.agent_uri;
     } else if (this.normalizedAgent.protocol === "mcp") {
       await this.ensureEndpointDiscovered();
     }
@@ -4220,34 +4235,22 @@ Hint: this usually means agent_uri does not include the MCP endpoint path. The S
       const authToken = await ensureReadAuthToken();
       const agentHeaders = this.normalizedAgent.headers ?? {};
       const sizeLimitedFetch = wrapFetchWithSizeLimit(
-        (input, init) => transport?.trustedFetchFn ? transport.trustedFetchFn(input, init) : fetch(input, init)
+        createAgentTransportFetch(this.normalizedAgent.agent_uri, {
+          trustedFetchFn: transport?.trustedFetchFn,
+          allowPrivateIp: transport?.allowPrivateIp,
+          originBoundHeaders: Object.keys(agentHeaders),
+          crossOriginCredentialPolicy: transport?.legacyCompat?.enabled === false ? "refuse" : "strip"
+        })
       );
-      const normalizeHeaders = (headers) => {
-        const normalized = {};
-        if (!headers) return normalized;
-        if (headers instanceof Headers) {
-          headers.forEach((value, key) => {
-            normalized[key] = value;
-          });
-        } else if (Array.isArray(headers)) {
-          for (const [key, value] of headers) {
-            normalized[key] = value;
-          }
-        } else {
-          Object.assign(normalized, headers);
-        }
-        return normalized;
-      };
-      const buildHeaders = (requestInit) => ({
-        ...normalizeHeaders(requestInit?.headers),
-        ...agentHeaders,
-        ...authToken && {
-          Authorization: `Bearer ${authToken}`,
-          "x-adcp-auth": authToken
-        }
-      });
       const fetchImpl = async (url, requestInit) => {
-        const headers = buildHeaders(requestInit);
+        const headers = buildA2ADiscoveryHeaders(requestInit?.headers, agentHeaders, authToken);
+        assertNativeA2ADiscoveryCredentialOrigin(
+          this.normalizedAgent.agent_uri,
+          url,
+          transport?.legacyCompat?.enabled,
+          headers,
+          agentHeaders
+        );
         return withAbortSignal(
           [options?.signal, requestInit?.signal],
           requestTimeoutMs,
@@ -4259,7 +4262,10 @@ Hint: this usually means agent_uri does not include the MCP endpoint path. The S
       let lastCardError = new Error(`A2A agent card not found at ${cardUrls.join(", ")}`);
       for (const cardUrl of cardUrls) {
         try {
-          client = await withResponseSizeLimit(maxResponseBytes, () => A2AClient.fromCardUrl(cardUrl, { fetchImpl }));
+          client = await withResponseSizeLimit(
+            maxResponseBytes,
+            () => createA2AClientFromCardUrl(cardUrl, fetchImpl, transport?.legacyCompat)
+          );
           break;
         } catch (err) {
           lastCardError = err;
@@ -4268,10 +4274,10 @@ Hint: this usually means agent_uri does not include the MCP endpoint path. The S
       if (!client) {
         throw lastCardError;
       }
-      const agentCard = await withResponseSizeLimit(
-        maxResponseBytes,
-        async () => client.agentCardPromise ? client.agentCardPromise : client.agentCard
-      );
+      const agentCard = await withResponseSizeLimit(maxResponseBytes, async () => {
+        const compatibleClient = client;
+        return typeof compatibleClient.getAgentCard === "function" ? compatibleClient.getAgentCard() : compatibleClient.agentCardPromise ?? compatibleClient.agentCard;
+      });
       const tools = agentCard?.skills ? agentCard.skills.map(
         (skill) => ({
           name: skill.id || skill.name,
@@ -4800,6 +4806,40 @@ Hint: this usually means agent_uri does not include the MCP endpoint path. The S
     return schemaMap[taskType] || null;
   }
 }
+function selectNativeJsonRpcInterface(card) {
+  let selected;
+  for (const agentInterface of card.supportedInterfaces ?? []) {
+    if (agentInterface.protocolBinding.toUpperCase() !== "JSONRPC") continue;
+    if (!selected || agentInterface.protocolVersion === "1.0") selected = agentInterface;
+  }
+  return selected;
+}
+function buildA2ADiscoveryHeaders(requestHeaders, agentHeaders, authToken) {
+  const headers = new Headers(requestHeaders);
+  for (const [name, value] of Object.entries(agentHeaders ?? {})) {
+    headers.set(name, value);
+  }
+  if (authToken) {
+    headers.set("authorization", `Bearer ${authToken}`);
+    headers.set("x-adcp-auth", authToken);
+  }
+  return headers;
+}
+function assertNativeA2ADiscoveryCredentialOrigin(agentUrl, requestUrl, legacyCompatEnabled, headers, configuredHeaders) {
+  if (legacyCompatEnabled !== false) return;
+  const targetUrl = requestUrl instanceof Request ? requestUrl.url : requestUrl.toString();
+  if (new URL(targetUrl).origin === new URL(agentUrl).origin) return;
+  const configuredHeaderNames = new Set(Object.keys(configuredHeaders ?? {}).map((name) => name.toLowerCase()));
+  const credentialHeaders = [];
+  headers.forEach((_value, name) => {
+    if (configuredHeaderNames.has(name.toLowerCase()) || isCredentialHeaderName(name)) credentialHeaders.push(name);
+  });
+  if (credentialHeaders.length === 0) return;
+  const targetOrigin = new URL(targetUrl).origin;
+  throw new Error(
+    `A2A native discovery refused credentialed cross-origin dispatch to ${targetOrigin}; credential headers: ${credentialHeaders.map((name) => name.toLowerCase()).sort().join(", ")}`
+  );
+}
 let hasWarnedAboutUnverifiedWebhookReceive = false;
 function warnUnverifiedWebhookReceive() {
   if (hasWarnedAboutUnverifiedWebhookReceive) return;