@adcp/sdk 14.0.0-beta.10 → 14.0.0-beta.12

package/dist/lib/core/SingleAgentClient.js

@@ -43,7 +43,7 @@ var import_reporting_version = require('../media-buy/reporting-version.js');
 var import_version2 = require('../adapters/version/index.js');
 var import_schema_loader = require('../validation/schema-loader.js');
 var import_idempotency = require('../utils/idempotency.js');
-var import_client = require("@a2a-js/sdk/client");
+var import_a2a = require('../protocols/a2a.js');
 var import_TaskExecutor = require('./TaskExecutor.js');
 var import_match = require('./match.js');
 var import_request_proposals_guard = require('./request-proposals-guard.js');
@@ -79,8 +79,52 @@ var import_augment_response = require('../v2/projection/augment-response.js');
 var import_legacy_metadata = require('../v2/projection/legacy-metadata.js');
 var import_types = require('../v2/projection/types.js');
 var import_jcs = require('../utils/jcs.js');
-const A2AClient = import_client.A2AClient;
 const CAPABILITY_DISCOVERY_CONTEXT = /* @__PURE__ */ Symbol("capabilityDiscoveryContext");
+function a2aUrlString(input) {
+  return typeof input === "string" ? input : input instanceof URL ? input.toString() : input.url;
+}
+function a2aScopedHeaders(input, requestHeaders, configuredAgentUrl, agentHeaders, authToken) {
+  const normalized = {};
+  new Headers(requestHeaders).forEach((value, key) => {
+    normalized[key] = value;
+  });
+  const sameOrigin = new URL(a2aUrlString(input)).origin === new URL(configuredAgentUrl).origin;
+  if (!sameOrigin) {
+    for (const key of Object.keys(normalized)) {
+      if (!["accept", "content-type", "a2a-version", "a2a-extensions"].includes(key.toLowerCase())) {
+        delete normalized[key];
+      }
+    }
+    return normalized;
+  }
+  return {
+    ...normalized,
+    ...agentHeaders,
+    ...authToken && {
+      Authorization: `Bearer ${authToken}`,
+      "x-adcp-auth": authToken
+    }
+  };
+}
+function sameA2AProtocolVersion(left, right) {
+  if (typeof left !== "string" || typeof right !== "string") return false;
+  const normalize = (value) => value.split(".").slice(0, 2).join(".");
+  return normalize(left) === normalize(right);
+}
+function selectA2AJsonRpcUrl(agentCard, protocolVersion, configuredAgentUrl) {
+  const interfaces = Array.isArray(agentCard?.supportedInterfaces) ? agentCard.supportedInterfaces.filter(
+    (candidate) => candidate?.protocolBinding === "JSONRPC" && typeof candidate?.url === "string"
+  ) : [];
+  const selected = interfaces.find((candidate) => sameA2AProtocolVersion(candidate.protocolVersion, protocolVersion)) ?? interfaces.find((candidate) => sameA2AProtocolVersion(candidate.protocolVersion, "1.0")) ?? interfaces[0];
+  if (!selected) return void 0;
+  const resolved = new URL(selected.url, configuredAgentUrl);
+  if (resolved.origin !== new URL(configuredAgentUrl).origin) {
+    throw new Error(
+      `A2A Agent Card selected a cross-origin JSON-RPC endpoint (${resolved.origin}); configure that endpoint explicitly before sending credentials`
+    );
+  }
+  return resolved.toString();
+}
 function creativeSchemaSupport(value, depth = 0) {
   if (depth > 24 || value === null || typeof value !== "object") return "unknown";
   if (Array.isArray(value)) {
@@ -1412,14 +1456,7 @@ class SingleAgentClient {
     const authToken = this.normalizedAgent.oauth_client_credentials ? this.normalizedAgent.oauth_tokens?.access_token : this.normalizedAgent.auth_token;
     let got401 = false;
     const fetchImpl = async (url, requestInit) => {
-      const headers = {
-        ...requestInit?.headers,
-        ...this.normalizedAgent.headers,
-        ...authToken && {
-          Authorization: `Bearer ${authToken}`,
-          "x-adcp-auth": authToken
-        }
-      };
+      const headers = a2aScopedHeaders(url, requestInit?.headers, agentUri, this.normalizedAgent.headers, authToken);
       const response = await (0, import_abort2.withAbortSignal)(
         [readOptions?.signal, requestInit?.signal],
         requestTimeoutMs,
@@ -1436,7 +1473,7 @@ class SingleAgentClient {
       let lastError = new Error(`A2A agent card not found at ${cardUrls.join(", ")}`);
       for (const cardUrl of cardUrls) {
         try {
-          client = await withResponseSizeLimit(maxResponseBytes, () => A2AClient.fromCardUrl(cardUrl, { fetchImpl }));
+          client = await withResponseSizeLimit(maxResponseBytes, () => (0, import_a2a.createA2AClientFromCardUrl)(cardUrl, fetchImpl));
           break;
         } catch (err) {
           lastError = err;
@@ -1446,13 +1483,12 @@ class SingleAgentClient {
       if (!client) {
         throw lastError;
       }
-      const agentCard = await withResponseSizeLimit(
-        maxResponseBytes,
-        async () => client.agentCardPromise ? client.agentCardPromise : client.agentCard
-      );
-      if (agentCard?.url) {
-        return agentCard.url;
-      }
+      const agentCard = await withResponseSizeLimit(maxResponseBytes, async () => {
+        const compatibleClient = client;
+        return typeof compatibleClient.getAgentCard === "function" ? compatibleClient.getAgentCard() : compatibleClient.agentCardPromise ?? compatibleClient.agentCard;
+      });
+      const canonicalUrl = selectA2AJsonRpcUrl(agentCard, client.protocolVersion, agentUri);
+      if (canonicalUrl) return canonicalUrl;
       return this.computeBaseUrl(agentUri);
     } catch (error) {
       if ((0, import_errors.is401Error)(error, got401)) {
@@ -2402,8 +2438,9 @@ Hint: this usually means agent_uri does not include the MCP endpoint path. The S
         "Unsupported webhook payload format: received a bare delivery report result. Webhook POST bodies must be an MCP envelope with top-level idempotency_key, operation_id, task_id, task_type, status, timestamp, and result, or an A2A task/status event. Put delivery fields under result."
       );
     }
-    if ("kind" in payload && (payload.kind === "task" || payload.kind === "status-update")) {
-      const a2aPayload = payload;
+    const normalizedA2APayload = normalizeA2AWebhookEnvelope(payload);
+    if (normalizedA2APayload) {
+      const a2aPayload = normalizedA2APayload;
       const statusMessageData = latestA2AWebhookMessageData(a2aPayload.status?.message?.parts);
       const artifactExtraction = a2aPayload.kind === "task" ? (0, import_a2a_artifacts.getLatestA2ADataPartFromTask)(a2aPayload) : void 0;
       const artifactData = artifactExtraction?.data;
@@ -2455,7 +2492,7 @@ Hint: this usually means agent_uri does not include the MCP endpoint path. The S
         );
       }
       const result = Object.hasOwn(adcpData, "result") ? adcpData.result : adcpData;
-      const textParts = Array.isArray(a2aPayload.status?.message?.parts) ? a2aPayload.status.message.parts.filter((part) => part.kind === "text" && "text" in part).map((part) => "text" in part ? part.text : "") : [];
+      const textParts = latestA2AWebhookTextParts(a2aPayload.status?.message?.parts);
       return {
         operation_id: operationId,
         context_id: import_ProtocolResponseParser.responseParser.getContextId(wrapped),
@@ -5421,35 +5458,15 @@ Hint: this usually means agent_uri does not include the MCP endpoint path. The S
       const { wrapFetchWithSizeLimit } = await import("../protocols/responseSizeLimit.js");
       const authToken = await ensureReadAuthToken();
       const agentHeaders = this.normalizedAgent.headers ?? {};
+      const configuredAgentUrl = this.normalizedAgent.agent_uri;
       const sizeLimitedFetch = wrapFetchWithSizeLimit(
-        (input, init) => transport?.trustedFetchFn ? transport.trustedFetchFn(input, init) : fetch(input, init)
+        (0, import_net.createAgentTransportFetch)(configuredAgentUrl, {
+          trustedFetchFn: transport?.trustedFetchFn,
+          allowPrivateIp: transport?.allowPrivateIp
+        })
       );
-      const normalizeHeaders = (headers) => {
-        const normalized = {};
-        if (!headers) return normalized;
-        if (headers instanceof Headers) {
-          headers.forEach((value, key) => {
-            normalized[key] = value;
-          });
-        } else if (Array.isArray(headers)) {
-          for (const [key, value] of headers) {
-            normalized[key] = value;
-          }
-        } else {
-          Object.assign(normalized, headers);
-        }
-        return normalized;
-      };
-      const buildHeaders = (requestInit) => ({
-        ...normalizeHeaders(requestInit?.headers),
-        ...agentHeaders,
-        ...authToken && {
-          Authorization: `Bearer ${authToken}`,
-          "x-adcp-auth": authToken
-        }
-      });
       const fetchImpl = async (url, requestInit) => {
-        const headers = buildHeaders(requestInit);
+        const headers = a2aScopedHeaders(url, requestInit?.headers, configuredAgentUrl, agentHeaders, authToken);
         return (0, import_abort2.withAbortSignal)(
           [options?.signal, requestInit?.signal],
           requestTimeoutMs,
@@ -5461,7 +5478,7 @@ Hint: this usually means agent_uri does not include the MCP endpoint path. The S
       let lastCardError = new Error(`A2A agent card not found at ${cardUrls.join(", ")}`);
       for (const cardUrl of cardUrls) {
         try {
-          client = await withResponseSizeLimit(maxResponseBytes, () => A2AClient.fromCardUrl(cardUrl, { fetchImpl }));
+          client = await withResponseSizeLimit(maxResponseBytes, () => (0, import_a2a.createA2AClientFromCardUrl)(cardUrl, fetchImpl));
           break;
         } catch (err) {
           lastCardError = err;
@@ -5470,10 +5487,10 @@ Hint: this usually means agent_uri does not include the MCP endpoint path. The S
       if (!client) {
         throw lastCardError;
       }
-      const agentCard = await withResponseSizeLimit(
-        maxResponseBytes,
-        async () => client.agentCardPromise ? client.agentCardPromise : client.agentCard
-      );
+      const agentCard = await withResponseSizeLimit(maxResponseBytes, async () => {
+        const compatibleClient = client;
+        return typeof compatibleClient.getAgentCard === "function" ? compatibleClient.getAgentCard() : compatibleClient.agentCardPromise ?? compatibleClient.agentCard;
+      });
       const tools = agentCard?.skills ? agentCard.skills.map(
         (skill) => ({
           name: skill.id || skill.name,
@@ -5483,7 +5500,7 @@ Hint: this usually means agent_uri does not include the MCP endpoint path. The S
         })
       ) : [];
       return {
-        name: agentCard?.displayName || agentCard?.name || this.normalizedAgent.name,
+        name: agentCard?.name || this.normalizedAgent.name,
         description: agentCard?.description,
         protocol: this.normalizedAgent.protocol,
         url: this.normalizedAgent.agent_uri,
@@ -6201,26 +6218,55 @@ function normalizeRfc9421WebhookHeaders(headers) {
 function isBareDeliveryReport(payload) {
   return typeof payload.notification_type === "string" && ("media_buy_deliveries" in payload || "creative_deliveries" in payload || "reporting_period" in payload) && !("result" in payload) && !("task_id" in payload);
 }
+function normalizeA2AWebhookEnvelope(payload) {
+  if (payload.kind === "task" || payload.kind === "status-update") return payload;
+  const oneof = isObjectRecord(payload.payload) ? payload.payload : void 0;
+  const oneofCase = oneof?.$case;
+  const oneofValue = isObjectRecord(oneof?.value) ? oneof.value : void 0;
+  if (oneofValue && oneofCase === "task") return { ...oneofValue, kind: "task" };
+  if (oneofValue && oneofCase === "statusUpdate") return { ...oneofValue, kind: "status-update" };
+  if (isObjectRecord(payload.task)) return { ...payload.task, kind: "task" };
+  if (isObjectRecord(payload.statusUpdate)) return { ...payload.statusUpdate, kind: "status-update" };
+  if (typeof payload.id === "string" && isObjectRecord(payload.status) && Array.isArray(payload.artifacts)) {
+    return { ...payload, kind: "task" };
+  }
+  if (typeof payload.taskId === "string" && isObjectRecord(payload.status) && !("artifact" in payload)) {
+    return { ...payload, kind: "status-update" };
+  }
+  return void 0;
+}
+function a2aWebhookPartValue(part, expectedCase) {
+  if (!isObjectRecord(part)) return void 0;
+  if (part.kind === expectedCase) return part[expectedCase];
+  if (part.kind === void 0 && Object.hasOwn(part, expectedCase)) return part[expectedCase];
+  const content = isObjectRecord(part.content) ? part.content : void 0;
+  return content?.$case === expectedCase ? content.value : void 0;
+}
 function latestA2AWebhookMessageData(parts) {
   if (!Array.isArray(parts)) return void 0;
   for (let index = parts.length - 1; index >= 0; index -= 1) {
-    const part = parts[index];
-    if (!isObjectRecord(part) || part.kind !== "data" || !isObjectRecord(part.data)) continue;
-    return part.data;
+    const data = a2aWebhookPartValue(parts[index], "data");
+    if (!isObjectRecord(data)) continue;
+    return data;
   }
   return void 0;
 }
+function latestA2AWebhookTextParts(parts) {
+  if (!Array.isArray(parts)) return [];
+  return parts.map((part) => a2aWebhookPartValue(part, "text")).filter((value) => typeof value === "string");
+}
 function extractSignedWebhookRoute(payload) {
   if (!isObjectRecord(payload)) return { ok: true };
+  const normalizedA2A = normalizeA2AWebhookEnvelope(payload);
   const records = [payload];
-  if (payload.kind === "task" || payload.kind === "status-update") {
+  if (normalizedA2A) {
     records.length = 0;
-    const status = isObjectRecord(payload.status) ? payload.status : void 0;
+    const status = isObjectRecord(normalizedA2A.status) ? normalizedA2A.status : void 0;
     const message = isObjectRecord(status?.message) ? status.message : void 0;
     const messageData = latestA2AWebhookMessageData(message?.parts);
     if (messageData) records.push(messageData);
-    if (payload.kind === "task") {
-      const artifactData = (0, import_a2a_artifacts.getLatestA2ADataPartFromTask)(payload)?.data;
+    if (normalizedA2A.kind === "task") {
+      const artifactData = (0, import_a2a_artifacts.getLatestA2ADataPartFromTask)(normalizedA2A)?.data;
       if (artifactData) records.push(artifactData);
     }
   }
@@ -6249,11 +6295,14 @@ function extractSignedWebhookRoute(payload) {
 function legacyA2AArtifactStatus(payload, artifact) {
   if (payload.kind !== "task" || !isObjectRecord(artifact) || typeof artifact.name !== "string") return void 0;
   const transportState = payload.status?.state;
-  if (artifact.name === "result" && transportState === "completed") return "completed";
+  if (artifact.name === "result" && (transportState === "completed" || transportState === "TASK_STATE_COMPLETED" || transportState === 3))
+    return "completed";
   if (artifact.name !== "error") return void 0;
-  if (transportState === "failed" || transportState === "rejected" || transportState === "canceled") {
-    return transportState;
-  }
+  if (transportState === "failed" || transportState === "TASK_STATE_FAILED" || transportState === 4) return "failed";
+  if (transportState === "rejected" || transportState === "TASK_STATE_REJECTED" || transportState === 7)
+    return "rejected";
+  if (transportState === "canceled" || transportState === "TASK_STATE_CANCELED" || transportState === 5)
+    return "canceled";
   return void 0;
 }
 function isMcpWebhookCandidate(payload) {