@adcp/sdk 16.3.0 → 16.5.0

package/dist/lib/core/TaskExecutor.js

@@ -38,13 +38,20 @@ __export(TaskExecutor_exports, {
   transferDeferredSettlementAcknowledgement: () => transferDeferredSettlementAcknowledgement
 });
 module.exports = __toCommonJS(TaskExecutor_exports);
+var import_mcp_connection_policy = require('../protocols/mcp-connection-policy.js');
 var import_errors = require('../errors/index.js');
+var import_authorization_required = require('../auth/oauth/authorization-required.js');
 var import_webhook_registration = require('./webhook-registration.js');
 var import_adcp_version_config = require('../utils/adcp-version-config.js');
 var import_schema_errors = require('../validation/schema-errors.js');
 var import_crypto = require("crypto");
 var import_protocols = require('../protocols/index.js');
 var import_mcp_tasks = require('../protocols/mcp-tasks.js');
+var import_oauth = require('../auth/oauth/index.js');
+var import_provider_cache = require('../auth/oauth/provider-cache.js');
+var import_address_guards = require('../net/address-guards.js');
+var import_protocol_methods = require('../signing/protocol-methods.js');
+var import_client = require('../signing/client.js');
 var import_prepared_call_context = require('../protocols/prepared-call-context.js');
 var import_auth = require('../auth/index.js');
 var import_signedRequestRejection = require('../protocols/signedRequestRejection.js');
@@ -689,7 +696,11 @@ class TaskExecutor {
    * adaptation runs, so the validator sees the same object the caller wrote.
    * Throws in strict, logs to `debugLogs` in warn, no-ops in off.
    */
-  validateRequest(taskName, params, debugLogs) {
+  validateRequest(taskName, params, debugLogs, adcpVersion) {
+    if (adcpVersion !== void 0) {
+      (0, import_client_hooks.validateOutgoingRequest)(taskName, params, this.requestValidationMode, debugLogs, adcpVersion);
+      return;
+    }
     if (this.config.experimentalIdentity33?.() && this.requestValidationMode !== "off") {
       const outcome = validateIdentity33Payload(taskName, "request", params, this.config.adcpVersion);
       if (!outcome.valid) {
@@ -1273,16 +1284,28 @@ class TaskExecutor {
     if (task && serverTaskId) task.serverTaskId = serverTaskId;
     switch (status) {
       case import_ProtocolResponseParser.ADCP_STATUS.COMPLETED:
-        const completedData = this.extractResponseData(response, debugLogs, taskName, serverVersion);
+        const completedData = this.extractResponseData(
+          response,
+          debugLogs,
+          taskName,
+          serverVersion,
+          options.negotiatedAdcpVersion
+        );
         if (!deferTerminalTaskStatus) this.updateTaskStatus(taskId, "completed", completedData);
-        const operationSuccess = this.isOperationSuccess(completedData, taskName, serverVersion);
+        const operationSuccess = this.isOperationSuccess(
+          completedData,
+          taskName,
+          serverVersion,
+          options.negotiatedAdcpVersion
+        );
         const validationResult = this.validateResponseSchema(
           completedData,
           taskName,
           debugLogs,
           serverVersion,
           params,
-          refinementServedVersion
+          refinementServedVersion,
+          options.negotiatedAdcpVersion
         );
         const finalSuccess = operationSuccess && validationResult.valid;
         const finalError = !finalSuccess ? validationResult.errors.length > 0 ? `Schema validation failed: ${validationResult.errors.join("; ")}` : this.extractOperationError(completedData) : void 0;
@@ -1374,7 +1397,13 @@ class TaskExecutor {
       case import_ProtocolResponseParser.ADCP_STATUS.FAILED:
       case import_ProtocolResponseParser.ADCP_STATUS.REJECTED:
       case import_ProtocolResponseParser.ADCP_STATUS.CANCELED: {
-        const failedData = this.extractResponseData(response, debugLogs, taskName, serverVersion);
+        const failedData = this.extractResponseData(
+          response,
+          debugLogs,
+          taskName,
+          serverVersion,
+          options.negotiatedAdcpVersion
+        );
         const failedPayload = response?.structuredContent === void 0 && response?.content === void 0 && response?.result === void 0 && response?.data != null && typeof response.data === "object" ? response.data : failedData;
         const adcpErrorInfo = (0, import_error_extraction.extractAdcpErrorInfo)(failedPayload);
         const hasStructuredError = !!adcpErrorInfo;
@@ -1402,16 +1431,28 @@ class TaskExecutor {
         };
       }
       default:
-        const defaultData = this.extractResponseData(response, debugLogs, taskName, serverVersion);
+        const defaultData = this.extractResponseData(
+          response,
+          debugLogs,
+          taskName,
+          serverVersion,
+          options.negotiatedAdcpVersion
+        );
         if (defaultData && (defaultData !== response || response.structuredContent || response.result || response.data)) {
-          const defaultSuccess = this.isOperationSuccess(defaultData, taskName, serverVersion);
+          const defaultSuccess = this.isOperationSuccess(
+            defaultData,
+            taskName,
+            serverVersion,
+            options.negotiatedAdcpVersion
+          );
           const defaultValidation = this.validateResponseSchema(
             defaultData,
             taskName,
             debugLogs,
             serverVersion,
             params,
-            refinementServedVersion
+            refinementServedVersion,
+            options.negotiatedAdcpVersion
           );
           const defaultFinalSuccess = defaultSuccess && defaultValidation.valid;
           const defaultFinalError = !defaultFinalSuccess ? defaultValidation.errors.length > 0 ? `Schema validation failed: ${defaultValidation.errors.join("; ")}` : this.extractOperationError(defaultData) : void 0;
@@ -1462,7 +1503,7 @@ class TaskExecutor {
    *
    * @internal Exposed for testing purposes
    */
-  extractResponseData(response, debugLogs, toolName, serverVersion) {
+  extractResponseData(response, debugLogs, toolName, serverVersion, negotiatedAdcpVersion) {
     const a2aState = response?.result?.status?.state;
     if (a2aState === "input-required" || a2aState === "auth-required") {
       const statusParts = response?.result?.status?.message?.parts;
@@ -1503,7 +1544,7 @@ class TaskExecutor {
       }
       const unwrapped = (0, import_response_unwrapper.unwrapProtocolResponse)(response, toolName, void 0, {
         filterInvalidProducts: this.config.filterInvalidProducts,
-        responseAdcpVersion: this.effectiveResponseAdcpVersion(serverVersion)
+        responseAdcpVersion: this.effectiveResponseAdcpVersion(serverVersion, negotiatedAdcpVersion)
       });
       if (response?.structuredContent) {
         this.logDebug(debugLogs, "info", "Successfully extracted MCP data", {
@@ -1534,8 +1575,12 @@ class TaskExecutor {
    * Check if extracted response data represents a successful operation.
    * Handles singular `error`, plural `errors` (AdCP schema), and `success: false`.
    */
-  isOperationSuccess(data, taskName, serverVersion) {
-    return (0, import_response_unwrapper.isAdcpOperationSuccess)(data, taskName, this.effectiveResponseAdcpVersion(serverVersion));
+  isOperationSuccess(data, taskName, serverVersion, negotiatedAdcpVersion) {
+    return (0, import_response_unwrapper.isAdcpOperationSuccess)(
+      data,
+      taskName,
+      this.effectiveResponseAdcpVersion(serverVersion, negotiatedAdcpVersion)
+    );
   }
   /**
    * Extract a human-readable error message from response data.
@@ -1566,7 +1611,13 @@ class TaskExecutor {
    * Handle 'working' status - return as valid intermediate state
    */
   async waitForWorkingCompletion(agent, taskId, taskName, params, initialResponse, messages, inputHandler, options = {}, debugLogs = [], startTime = Date.now(), serverVersion = "v3") {
-    const partialData = this.extractResponseData(initialResponse, debugLogs, taskName, serverVersion);
+    const partialData = this.extractResponseData(
+      initialResponse,
+      debugLogs,
+      taskName,
+      serverVersion,
+      options.negotiatedAdcpVersion
+    );
     const metadata = this.buildMetadata({
       taskId,
       taskName,
@@ -1590,7 +1641,13 @@ class TaskExecutor {
    * Set up submitted task with webhook
    */
   async setupSubmittedTask(agent, taskId, taskName, response, messages, options = {}, debugLogs = [], startTime = Date.now(), deferTerminalTaskStatus = false, serverVersion = "v3") {
-    const partialData = this.extractResponseData(response, debugLogs, taskName, serverVersion);
+    const partialData = this.extractResponseData(
+      response,
+      debugLogs,
+      taskName,
+      serverVersion,
+      options.negotiatedAdcpVersion
+    );
     let webhookUrl = response.webhookUrl;
     if (!webhookUrl && this.config.webhookManager) {
       webhookUrl = this.config.webhookManager.generateUrl(taskId);
@@ -2034,7 +2091,13 @@ class TaskExecutor {
     const operationRoutedContinuation = deferTerminalTaskStatus || directContinuationRecovery;
     const settlementServerTaskId = operationRoutedContinuation ? this.responseParser.getTaskId(response) : void 0;
     if (agent.protocol === "mcp" || !a2aTaskId) {
-      const partialData = this.extractResponseData(response, debugLogs, taskName, serverVersion);
+      const partialData = this.extractResponseData(
+        response,
+        debugLogs,
+        taskName,
+        serverVersion,
+        options.negotiatedAdcpVersion
+      );
       const metadata = this.buildMetadata({
         taskId,
         taskName,
@@ -2055,7 +2118,13 @@ class TaskExecutor {
       };
     }
     if (!inputHandler) {
-      const partialData = this.extractResponseData(response, debugLogs, taskName, serverVersion);
+      const partialData = this.extractResponseData(
+        response,
+        debugLogs,
+        taskName,
+        serverVersion,
+        options.negotiatedAdcpVersion
+      );
       const metadata = this.buildMetadata({
         taskId,
         taskName,
@@ -2082,6 +2151,9 @@ class TaskExecutor {
           a2aTaskId,
           serverVersion,
           ...options.wireAdcpVersion !== void 0 && { wireAdcpVersion: options.wireAdcpVersion },
+          ...options.negotiatedAdcpVersion !== void 0 && {
+            negotiatedAdcpVersion: options.negotiatedAdcpVersion
+          },
           ...options.versionEnvelope !== void 0 && { versionEnvelope: options.versionEnvelope },
           serverVersionSynthetic: this.activeTasks.get(taskId)?.serverVersionSynthetic,
           ...refinementServedVersion !== void 0 && { refinementServedVersion },
@@ -2226,6 +2298,9 @@ class TaskExecutor {
           a2aTaskId,
           serverVersion,
           ...options.wireAdcpVersion !== void 0 && { wireAdcpVersion: options.wireAdcpVersion },
+          ...options.negotiatedAdcpVersion !== void 0 && {
+            negotiatedAdcpVersion: options.negotiatedAdcpVersion
+          },
           ...options.versionEnvelope !== void 0 && { versionEnvelope: options.versionEnvelope },
           serverVersionSynthetic: this.activeTasks.get(taskId)?.serverVersionSynthetic,
           ...refinementServedVersion !== void 0 && { refinementServedVersion },
@@ -2354,22 +2429,79 @@ class TaskExecutor {
    * List tasks for an agent, preferring MCP Tasks protocol when available.
    */
   async listTasksForAgent(agent, transport) {
+    const credentialOwner = agent;
     if (agent.protocol === "mcp") {
-      const authToken = (0, import_auth.getAuthToken)(agent);
+      agent = { ...agent, ...agent.headers && { headers: { ...agent.headers } } };
+      const version = this.config.wireAdcpVersion ?? this.config.adcpVersion ?? import_version.ADCP_VERSION;
+      let signingContext = (0, import_client.buildAgentSigningContext)(agent, { adcpVersion: version });
+      if (signingContext) agent = { ...agent, request_signing: signingContext.signing };
+      const syncTokens = () => {
+        agent.oauth_tokens = credentialOwner.oauth_tokens;
+      };
       try {
-        return await (0, import_mcp_tasks.listMCPTasks)(agent.agent_uri, authToken, void 0, {
-          transport: transport ?? this.config.transport,
-          onTransportActivity: this.config.onTransportActivity,
-          transportActivityContext: {
-            agentId: agent.id
+        if (credentialOwner.oauth_client_credentials) {
+          await (0, import_oauth.ensureClientCredentialsTokens)(credentialOwner, {
+            storage: (0, import_oauth.getAgentStorage)(credentialOwner),
+            allowPrivateIp: transport?.allowPrivateIp ?? (0, import_address_guards.isLikelyPrivateUrl)(agent.agent_uri),
+            fetch: transport?.trustedFetchFn
+          });
+          syncTokens();
+        } else if (credentialOwner.oauth_tokens) {
+          (0, import_provider_cache.getNonInteractiveOAuthProvider)(credentialOwner, {
+            agentHint: credentialOwner.id,
+            storage: (0, import_oauth.getAgentStorage)(credentialOwner),
+            allowHttp: (0, import_address_guards.isLikelyPrivateUrl)(credentialOwner.agent_uri)
+          });
+          (0, import_provider_cache.shareNonInteractiveOAuthProvider)(credentialOwner, agent);
+        }
+        signingContext = (0, import_client.buildAgentSigningContext)(agent, { adcpVersion: version });
+        if (signingContext) {
+          for (let attempt = 0; attempt < 2; attempt++) {
+            await (0, import_client.ensureCapabilityLoaded)(agent, signingContext, async (args) => {
+              const previousOwnerTokens = credentialOwner.oauth_tokens;
+              const previousRequestTokens = agent.oauth_tokens;
+              try {
+                return await import_protocols.ProtocolClient.callTool(agent, import_client.CAPABILITY_OP, args, {
+                  serverVersion: this.lastKnownServerVersion,
+                  adcpVersion: this.config.adcpVersion,
+                  wireAdcpVersion: this.config.wireAdcpVersion,
+                  versionEnvelope: this.config.versionEnvelope,
+                  transport: transport ?? this.config.transport,
+                  onTransportActivity: this.config.onTransportActivity
+                });
+              } finally {
+                if (credentialOwner.oauth_tokens === previousOwnerTokens && agent.oauth_tokens !== previousRequestTokens) {
+                  credentialOwner.oauth_tokens = agent.oauth_tokens;
+                } else {
+                  syncTokens();
+                }
+              }
+            });
+            syncTokens();
+            const current = (0, import_client.buildAgentSigningContext)(agent, { adcpVersion: version });
+            if (current.capabilityCacheKey === signingContext.capabilityCacheKey) break;
+            signingContext.invalidate();
+            if (attempt === 1)
+              throw new import_errors2.ConfigurationError("Task-list authorization changed during discovery; retry the call");
+            signingContext = current;
           }
-        });
+        }
+        return await import_client.signingContextStorage.run(
+          signingContext,
+          () => (0, import_mcp_tasks.listMCPTasks)(agent.agent_uri, (0, import_auth.getAuthToken)(agent), void 0, {
+            signingContext,
+            headers: agent.headers,
+            transport: transport ?? this.config.transport,
+            onTransportActivity: this.config.onTransportActivity,
+            transportActivityContext: { agentId: agent.id }
+          })
+        );
       } catch (err) {
-        if ((0, import_errors2.is401Error)(err)) throw err;
+        if ((0, import_errors2.is401Error)(err) || err instanceof import_errors2.ConfigurationError || err instanceof TypeError) throw err;
       }
     }
     const response = await import_protocols.ProtocolClient.callTool(
-      agent,
+      credentialOwner,
       "tasks/list",
       {},
       {
@@ -2387,13 +2519,16 @@ class TaskExecutor {
    * Task tracking methods (PR #78)
    */
   async listTasks(agent, transport) {
-    const transportSnapshot = snapshotTransportOptions(transport ?? this.config.transport);
-    try {
-      return await this.listTasksForAgent(agent, transportSnapshot);
-    } catch {
-      console.warn("Failed to list tasks (see DEBUG=adcp:* logs for detail)");
-      return [];
-    }
+    return (0, import_mcp_connection_policy.withMCPConnectionPolicy)(transport ?? this.config.transport, async () => {
+      if (agent.request_signing) (0, import_protocol_methods.assertSigningPolicy)(agent.request_signing);
+      const transportSnapshot = snapshotTransportOptions(transport ?? this.config.transport);
+      try {
+        return await this.listTasksForAgent(agent, transportSnapshot);
+      } catch {
+        console.warn("Failed to list tasks (see DEBUG=adcp:* logs for detail)");
+        return [];
+      }
+    });
   }
   async getTaskStatusWithRawResponse(agent, taskId, transport, signal, expectedTaskType, serverVersion, wireAdcpVersion, versionEnvelope, operationId) {
     const toolName = agent.protocol === "mcp" ? "tasks_get" : "tasks/get";
@@ -2469,7 +2604,8 @@ class TaskExecutor {
               a2aCancellationTaskId,
               cancelTransport?.trustedFetchFn,
               cancelTransport?.allowPrivateIp,
-              cancelTransport?.legacyCompat
+              cancelTransport?.legacyCompat,
+              wireAdcpVersion ?? this.config.wireAdcpVersion ?? this.config.adcpVersion ?? import_version.ADCP_VERSION
             ).catch(() => {
             });
           } catch {
@@ -2563,7 +2699,12 @@ class TaskExecutor {
         });
       }
       if (status.status === import_ProtocolResponseParser.ADCP_STATUS.COMPLETED) {
-        const pollSuccess = this.isOperationSuccess(status.result, status.taskType, serverVersion);
+        const pollSuccess = this.isOperationSuccess(
+          status.result,
+          status.taskType,
+          serverVersion,
+          metadataTaskId ? this.activeTasks.get(metadataTaskId)?.options.negotiatedAdcpVersion : void 0
+        );
         if (pollSuccess) {
           return markAuthoritativePolledTerminal(
             (0, import_match.attachMatch)({
@@ -3118,6 +3259,7 @@ class TaskExecutor {
         state.messages,
         {
           ...state.wireAdcpVersion !== void 0 && { wireAdcpVersion: state.wireAdcpVersion },
+          ...state.negotiatedAdcpVersion !== void 0 && { negotiatedAdcpVersion: state.negotiatedAdcpVersion },
           ...state.versionEnvelope !== void 0 && { versionEnvelope: state.versionEnvelope }
         },
         [],
@@ -3339,6 +3481,7 @@ class TaskExecutor {
         // No handler for deferred tasks - input was provided by human
         {
           ...state.wireAdcpVersion !== void 0 && { wireAdcpVersion: state.wireAdcpVersion },
+          ...state.negotiatedAdcpVersion !== void 0 && { negotiatedAdcpVersion: state.negotiatedAdcpVersion },
           ...state.versionEnvelope !== void 0 && { versionEnvelope: state.versionEnvelope }
         },
         [],
@@ -3378,6 +3521,7 @@ class TaskExecutor {
             refinementServedVersion: state.refinementServedVersion
           },
           ...state.wireAdcpVersion !== void 0 && { wireAdcpVersion: state.wireAdcpVersion },
+          ...state.negotiatedAdcpVersion !== void 0 && { negotiatedAdcpVersion: state.negotiatedAdcpVersion },
           ...state.versionEnvelope !== void 0 && { versionEnvelope: state.versionEnvelope },
           ...state.serverVersionSynthetic !== void 0 && {
             serverVersionSynthetic: state.serverVersionSynthetic
@@ -4390,7 +4534,7 @@ class TaskExecutor {
       status: "failed",
       error: error.message || String(error),
       adcpError: adcpErrorInfo,
-      errorInstance: (0, import_signedRequestRejection.getSignedRequestRejection)(error) ?? this.buildErrorInstance(taskId, adcpErrorInfo),
+      errorInstance: (0, import_signedRequestRejection.getSignedRequestRejection)(error) ?? (error instanceof import_authorization_required.NeedsAuthorizationError && (0, import_authorization_required.hasValidatedMcpAuthorizationRequirements)(error.requirements, agent.agent_uri) ? error : this.buildErrorInstance(taskId, adcpErrorInfo)),
       correlationId,
       metadata: this.buildMetadata({
         taskId,
@@ -4564,11 +4708,11 @@ class TaskExecutor {
    * valid so the caller can continue. Off mode short-circuits before
    * AJV runs.
    */
-  validateResponseSchema(response, taskName, debugLogs, serverVersion, requestParams, refinementServedVersion) {
+  validateResponseSchema(response, taskName, debugLogs, serverVersion, requestParams, refinementServedVersion, negotiatedAdcpVersion) {
     const mode = this.responseValidationMode;
     const logViolations = this.config.logSchemaViolations !== false;
     try {
-      const pinnedValidationVersion = this.responseAdcpVersionForValidation() ?? this.config.adcpVersion ?? import_version.ADCP_VERSION;
+      const pinnedValidationVersion = this.responseAdcpVersionForValidation() ?? negotiatedAdcpVersion ?? this.config.adcpVersion ?? import_version.ADCP_VERSION;
       if (taskName === "get_adcp_capabilities") {
         return (0, import_schema_loader.withServedValidationVersion)(
           response,
@@ -4670,8 +4814,8 @@ class TaskExecutor {
     if (this.config.versionEnvelope === "major-only") return "3.0";
     return void 0;
   }
-  effectiveResponseAdcpVersion(serverVersion) {
-    return this.responseAdcpVersionForValidation() ?? this.config.adcpVersion ?? import_version.ADCP_VERSION;
+  effectiveResponseAdcpVersion(serverVersion, negotiatedAdcpVersion) {
+    return this.responseAdcpVersionForValidation() ?? negotiatedAdcpVersion ?? this.config.adcpVersion ?? import_version.ADCP_VERSION;
   }
   /**
    * Update task status and emit events