@adcp/sdk 16.4.0 → 16.6.0

package/dist/lib/core/TaskExecutor.d.mts

@@ -95,6 +95,7 @@ interface WebhookManager {
     registerWebhook(agent: AgentConfig, taskId: string, webhookUrl: string): Promise<void>;
     processWebhook(token: string, body: any): Promise<void>;
 }
+type AdcpTaskStatusTool = 'get_task_status' | 'tasks_get' | 'tasks/get';
 /**
  * Core task execution engine that handles the conversation loop with agents
  */
@@ -210,6 +211,11 @@ export declare class TaskExecutor {
          * dispatches. Per-call options can override individual fields.
          */
         transport?: import('../protocols/index.mjs').TransportOptions;
+        /** Resolve the advertised AdCP work-status tool using the client's scoped discovery evidence. */
+        resolveTaskStatusTool?: (agent: AgentConfig, options: {
+            transport?: import('../protocols/index.mjs').TransportOptions;
+            signal?: AbortSignal;
+        }) => Promise<AdcpTaskStatusTool>;
     });
     /**
      * Access the governance middleware for direct outcome reporting (async tasks).
@@ -328,6 +334,7 @@ export declare class TaskExecutor {
      * Task tracking methods (PR #78)
      */
     listTasks(agent: AgentConfig, transport?: import('../protocols/index.mjs').TransportOptions): Promise<TaskInfo[]>;
+    private resolveTaskStatusTool;
     private getTaskStatusWithRawResponse;
     getTaskStatus(agent: AgentConfig, taskId: string, transport?: import('../protocols/index.mjs').TransportOptions, signal?: AbortSignal, wireOptions?: {
         wireAdcpVersion?: string;

package/dist/lib/core/TaskExecutor.d.ts

@@ -95,6 +95,7 @@ interface WebhookManager {
     registerWebhook(agent: AgentConfig, taskId: string, webhookUrl: string): Promise<void>;
     processWebhook(token: string, body: any): Promise<void>;
 }
+type AdcpTaskStatusTool = 'get_task_status' | 'tasks_get' | 'tasks/get';
 /**
  * Core task execution engine that handles the conversation loop with agents
  */
@@ -210,6 +211,11 @@ export declare class TaskExecutor {
          * dispatches. Per-call options can override individual fields.
          */
         transport?: import('../protocols').TransportOptions;
+        /** Resolve the advertised AdCP work-status tool using the client's scoped discovery evidence. */
+        resolveTaskStatusTool?: (agent: AgentConfig, options: {
+            transport?: import('../protocols').TransportOptions;
+            signal?: AbortSignal;
+        }) => Promise<AdcpTaskStatusTool>;
     });
     /**
      * Access the governance middleware for direct outcome reporting (async tasks).
@@ -328,6 +334,7 @@ export declare class TaskExecutor {
      * Task tracking methods (PR #78)
      */
     listTasks(agent: AgentConfig, transport?: import('../protocols').TransportOptions): Promise<TaskInfo[]>;
+    private resolveTaskStatusTool;
     private getTaskStatusWithRawResponse;
     getTaskStatus(agent: AgentConfig, taskId: string, transport?: import('../protocols').TransportOptions, signal?: AbortSignal, wireOptions?: {
         wireAdcpVersion?: string;

package/dist/lib/core/TaskExecutor.js

@@ -38,13 +38,20 @@ __export(TaskExecutor_exports, {
   transferDeferredSettlementAcknowledgement: () => transferDeferredSettlementAcknowledgement
 });
 module.exports = __toCommonJS(TaskExecutor_exports);
+var import_mcp_connection_policy = require('../protocols/mcp-connection-policy.js');
 var import_errors = require('../errors/index.js');
+var import_authorization_required = require('../auth/oauth/authorization-required.js');
 var import_webhook_registration = require('./webhook-registration.js');
 var import_adcp_version_config = require('../utils/adcp-version-config.js');
 var import_schema_errors = require('../validation/schema-errors.js');
 var import_crypto = require("crypto");
 var import_protocols = require('../protocols/index.js');
 var import_mcp_tasks = require('../protocols/mcp-tasks.js');
+var import_oauth = require('../auth/oauth/index.js');
+var import_provider_cache = require('../auth/oauth/provider-cache.js');
+var import_address_guards = require('../net/address-guards.js');
+var import_protocol_methods = require('../signing/protocol-methods.js');
+var import_client = require('../signing/client.js');
 var import_prepared_call_context = require('../protocols/prepared-call-context.js');
 var import_auth = require('../auth/index.js');
 var import_signedRequestRejection = require('../protocols/signedRequestRejection.js');
@@ -285,7 +292,7 @@ function assertGovernedPayloadHasNoCallbackCredentials(taskName, payload, option
     scanResult.path
   );
 }
-function mapTasksGetResponseToTaskInfo(payload) {
+function mapTasksGetResponseToTaskInfo(payload, adcpVersion) {
   if (payload == null || typeof payload !== "object") {
     return { taskId: "", status: "unknown", taskType: "unknown", createdAt: Date.now(), updatedAt: Date.now() };
   }
@@ -305,7 +312,8 @@ function mapTasksGetResponseToTaskInfo(payload) {
   if (messageField !== void 0) taskInfo.message = messageField;
   if (flat.result !== void 0) {
     taskInfo.result = flat.result != null && typeof flat.result === "object" && !Array.isArray(flat.result) ? (0, import_envelope_status_compat.normalizeLegacyMediaBuyStatusForReturn)(flat.result, {
-      toolName: taskInfo.taskType
+      toolName: taskInfo.taskType,
+      adcpVersion
     }) : flat.result;
   }
   return taskInfo;
@@ -725,6 +733,8 @@ class TaskExecutor {
       status: args.status
     };
     const taskState = this.activeTasks.get(args.taskId);
+    const wireAdcpVersion = taskState?.wireAdcpVersion ?? this.config.wireAdcpVersion;
+    if (wireAdcpVersion !== void 0) meta.wireAdcpVersion = wireAdcpVersion;
     if (taskState?.serverVersion !== void 0) meta.serverVersion = taskState.serverVersion;
     if (taskState?.serverVersionSynthetic !== void 0) {
       meta.serverVersionSynthetic = taskState.serverVersionSynthetic;
@@ -818,6 +828,7 @@ class TaskExecutor {
     }
     const taskState = {
       taskId,
+      wireAdcpVersion: wireAdcpVersion ?? options.negotiatedAdcpVersion ?? options.selectedAdcpVersion,
       taskName,
       params,
       status: "pending",
@@ -1088,7 +1099,7 @@ class TaskExecutor {
         () => import_protocols.ProtocolClient.callTool(agent, taskName, dispatchParams, callOptions)
       );
       (0, import_abort.throwIfAborted)(postDispatchOptions.signal);
-      const respStatus = this.responseParser.getStatus(response);
+      const respStatus = this.responseParser.getStatus(response, taskName);
       taskState.serverTaskId = this.responseParser.getTaskId(response);
       await this.config.onActivity?.({
         type: "protocol_response",
@@ -1271,7 +1282,7 @@ class TaskExecutor {
     };
   }
   async handleAsyncResponse(agent, taskId, taskName, params, response, messages, inputHandler, options = {}, debugLogs = [], startTime = Date.now(), deferTerminalTaskStatus = false, persistPausedContinuation = true, serverVersion = "v3", deferredClientContext, requireDeferredSettlementResumeAuthorization = false, refinementServedVersion) {
-    const status = this.responseParser.getStatus(response);
+    const status = this.responseParser.getStatus(response, taskName);
     const serverTaskId = this.responseParser.getTaskId(response);
     const task = this.activeTasks.get(taskId);
     if (task && serverTaskId) task.serverTaskId = serverTaskId;
@@ -2422,22 +2433,79 @@ class TaskExecutor {
    * List tasks for an agent, preferring MCP Tasks protocol when available.
    */
   async listTasksForAgent(agent, transport) {
+    const credentialOwner = agent;
     if (agent.protocol === "mcp") {
-      const authToken = (0, import_auth.getAuthToken)(agent);
+      agent = { ...agent, ...agent.headers && { headers: { ...agent.headers } } };
+      const version = this.config.wireAdcpVersion ?? this.config.adcpVersion ?? import_version.ADCP_VERSION;
+      let signingContext = (0, import_client.buildAgentSigningContext)(agent, { adcpVersion: version });
+      if (signingContext) agent = { ...agent, request_signing: signingContext.signing };
+      const syncTokens = () => {
+        agent.oauth_tokens = credentialOwner.oauth_tokens;
+      };
       try {
-        return await (0, import_mcp_tasks.listMCPTasks)(agent.agent_uri, authToken, void 0, {
-          transport: transport ?? this.config.transport,
-          onTransportActivity: this.config.onTransportActivity,
-          transportActivityContext: {
-            agentId: agent.id
+        if (credentialOwner.oauth_client_credentials) {
+          await (0, import_oauth.ensureClientCredentialsTokens)(credentialOwner, {
+            storage: (0, import_oauth.getAgentStorage)(credentialOwner),
+            allowPrivateIp: transport?.allowPrivateIp ?? (0, import_address_guards.isLikelyPrivateUrl)(agent.agent_uri),
+            fetch: transport?.trustedFetchFn
+          });
+          syncTokens();
+        } else if (credentialOwner.oauth_tokens) {
+          (0, import_provider_cache.getNonInteractiveOAuthProvider)(credentialOwner, {
+            agentHint: credentialOwner.id,
+            storage: (0, import_oauth.getAgentStorage)(credentialOwner),
+            allowHttp: (0, import_address_guards.isLikelyPrivateUrl)(credentialOwner.agent_uri)
+          });
+          (0, import_provider_cache.shareNonInteractiveOAuthProvider)(credentialOwner, agent);
+        }
+        signingContext = (0, import_client.buildAgentSigningContext)(agent, { adcpVersion: version });
+        if (signingContext) {
+          for (let attempt = 0; attempt < 2; attempt++) {
+            await (0, import_client.ensureCapabilityLoaded)(agent, signingContext, async (args) => {
+              const previousOwnerTokens = credentialOwner.oauth_tokens;
+              const previousRequestTokens = agent.oauth_tokens;
+              try {
+                return await import_protocols.ProtocolClient.callTool(agent, import_client.CAPABILITY_OP, args, {
+                  serverVersion: this.lastKnownServerVersion,
+                  adcpVersion: this.config.adcpVersion,
+                  wireAdcpVersion: this.config.wireAdcpVersion,
+                  versionEnvelope: this.config.versionEnvelope,
+                  transport: transport ?? this.config.transport,
+                  onTransportActivity: this.config.onTransportActivity
+                });
+              } finally {
+                if (credentialOwner.oauth_tokens === previousOwnerTokens && agent.oauth_tokens !== previousRequestTokens) {
+                  credentialOwner.oauth_tokens = agent.oauth_tokens;
+                } else {
+                  syncTokens();
+                }
+              }
+            });
+            syncTokens();
+            const current = (0, import_client.buildAgentSigningContext)(agent, { adcpVersion: version });
+            if (current.capabilityCacheKey === signingContext.capabilityCacheKey) break;
+            signingContext.invalidate();
+            if (attempt === 1)
+              throw new import_errors2.ConfigurationError("Task-list authorization changed during discovery; retry the call");
+            signingContext = current;
           }
-        });
+        }
+        return await import_client.signingContextStorage.run(
+          signingContext,
+          () => (0, import_mcp_tasks.listMCPTasks)(agent.agent_uri, (0, import_auth.getAuthToken)(agent), void 0, {
+            signingContext,
+            headers: agent.headers,
+            transport: transport ?? this.config.transport,
+            onTransportActivity: this.config.onTransportActivity,
+            transportActivityContext: { agentId: agent.id }
+          })
+        );
       } catch (err) {
-        if ((0, import_errors2.is401Error)(err)) throw err;
+        if ((0, import_errors2.is401Error)(err) || err instanceof import_errors2.ConfigurationError || err instanceof TypeError) throw err;
       }
     }
     const response = await import_protocols.ProtocolClient.callTool(
-      agent,
+      credentialOwner,
       "tasks/list",
       {},
       {
@@ -2455,16 +2523,26 @@ class TaskExecutor {
    * Task tracking methods (PR #78)
    */
   async listTasks(agent, transport) {
-    const transportSnapshot = snapshotTransportOptions(transport ?? this.config.transport);
-    try {
-      return await this.listTasksForAgent(agent, transportSnapshot);
-    } catch {
-      console.warn("Failed to list tasks (see DEBUG=adcp:* logs for detail)");
-      return [];
+    return (0, import_mcp_connection_policy.withMCPConnectionPolicy)(transport ?? this.config.transport, async () => {
+      if (agent.request_signing) (0, import_protocol_methods.assertSigningPolicy)(agent.request_signing);
+      const transportSnapshot = snapshotTransportOptions(transport ?? this.config.transport);
+      try {
+        return await this.listTasksForAgent(agent, transportSnapshot);
+      } catch {
+        console.warn("Failed to list tasks (see DEBUG=adcp:* logs for detail)");
+        return [];
+      }
+    });
+  }
+  async resolveTaskStatusTool(agent, transport, signal) {
+    if (this.config.resolveTaskStatusTool) {
+      return this.config.resolveTaskStatusTool(agent, { transport: transport ?? this.config.transport, signal });
     }
+    return agent.protocol === "mcp" ? "tasks_get" : "tasks/get";
   }
-  async getTaskStatusWithRawResponse(agent, taskId, transport, signal, expectedTaskType, serverVersion, wireAdcpVersion, versionEnvelope, operationId) {
-    const toolName = agent.protocol === "mcp" ? "tasks_get" : "tasks/get";
+  async getTaskStatusWithRawResponse(agent, taskId, transport, signal, expectedTaskType, serverVersion, wireAdcpVersion, versionEnvelope, operationId, pollingTool) {
+    const toolName = pollingTool ?? await this.resolveTaskStatusTool(agent, transport, signal);
+    (0, import_abort.throwIfAborted)(signal);
     const response = await import_protocols.ProtocolClient.callTool(
       agent,
       toolName,
@@ -2487,7 +2565,8 @@ class TaskExecutor {
         }
       }
     );
-    const task = mapTasksGetResponseToTaskInfo(response);
+    const resultAdcpVersion = (versionEnvelope ?? this.config.versionEnvelope) === "major-only" ? "3.0" : wireAdcpVersion ?? this.config.wireAdcpVersion ?? this.config.adcpVersion ?? import_version.ADCP_VERSION;
+    const task = mapTasksGetResponseToTaskInfo(response, resultAdcpVersion);
     if (!task.taskId || task.taskId !== taskId) {
       throw new TaskBindingMismatchError(
         "tasks/get returned a task identity that does not match the requested task.",
@@ -2522,6 +2601,7 @@ class TaskExecutor {
     }
     const pollStartTime = Date.now();
     const correlationId = metadataTaskId ?? taskId;
+    let pollingTool;
     const withServerTaskId = (metadata) => ({
       ...metadata,
       serverTaskId: taskId
@@ -2537,7 +2617,8 @@ class TaskExecutor {
               a2aCancellationTaskId,
               cancelTransport?.trustedFetchFn,
               cancelTransport?.allowPrivateIp,
-              cancelTransport?.legacyCompat
+              cancelTransport?.legacyCompat,
+              wireAdcpVersion ?? this.config.wireAdcpVersion ?? this.config.adcpVersion ?? import_version.ADCP_VERSION
             ).catch(() => {
             });
           } catch {
@@ -2561,6 +2642,7 @@ class TaskExecutor {
       let status;
       let rawResponse;
       try {
+        pollingTool ??= await this.resolveTaskStatusTool(agent, transportSnapshot, signal);
         const pollResult = await this.getTaskStatusWithRawResponse(
           agent,
           taskId,
@@ -2570,7 +2652,8 @@ class TaskExecutor {
           serverVersion,
           wireAdcpVersion,
           versionEnvelope,
-          metadataTaskId
+          metadataTaskId,
+          pollingTool
         );
         status = pollResult.task;
         rawResponse = pollResult.rawResponse;
@@ -4466,7 +4549,7 @@ class TaskExecutor {
       status: "failed",
       error: error.message || String(error),
       adcpError: adcpErrorInfo,
-      errorInstance: (0, import_signedRequestRejection.getSignedRequestRejection)(error) ?? this.buildErrorInstance(taskId, adcpErrorInfo),
+      errorInstance: (0, import_signedRequestRejection.getSignedRequestRejection)(error) ?? (error instanceof import_authorization_required.NeedsAuthorizationError && (0, import_authorization_required.hasValidatedMcpAuthorizationRequirements)(error.requirements, agent.agent_uri) ? error : this.buildErrorInstance(taskId, adcpErrorInfo)),
       correlationId,
       metadata: this.buildMetadata({
         taskId,

package/dist/lib/core/TaskExecutor.mjs

@@ -3,7 +3,12 @@ import { dirname as __adcpDirname } from "node:path";
 import { createRequire as __adcpCreateRequire } from "node:module";
 const __dirname = __adcpDirname(__adcpFileURLToPath(import.meta.url));
 const require2 = __adcpCreateRequire(import.meta.url);
+import { withMCPConnectionPolicy } from "../protocols/mcp-connection-policy.mjs";
 import { VersionUnsupportedError } from "../errors/index.mjs";
+import {
+  NeedsAuthorizationError,
+  hasValidatedMcpAuthorizationRequirements
+} from "../auth/oauth/authorization-required.mjs";
 import { deliveryWebhookRegistrationId } from "./webhook-registration.mjs";
 import { isAdcpVersionAtLeast } from "../utils/adcp-version-config.mjs";
 function validateIdentity33Payload(...args) {
@@ -17,6 +22,16 @@ import {
   prepareProtocolToolCall
 } from "../protocols/index.mjs";
 import { listMCPTasks } from "../protocols/mcp-tasks.mjs";
+import { ensureClientCredentialsTokens, getAgentStorage } from "../auth/oauth/index.mjs";
+import { getNonInteractiveOAuthProvider, shareNonInteractiveOAuthProvider } from "../auth/oauth/provider-cache.mjs";
+import { isLikelyPrivateUrl } from "../net/address-guards.mjs";
+import { assertSigningPolicy } from "../signing/protocol-methods.mjs";
+import {
+  buildAgentSigningContext,
+  CAPABILITY_OP,
+  ensureCapabilityLoaded,
+  signingContextStorage
+} from "../signing/client.mjs";
 import { withPreparedProtocolToolCall } from "../protocols/prepared-call-context.mjs";
 import { getAuthToken } from "../auth/index.mjs";
 import { getSignedRequestRejection } from "../protocols/signedRequestRejection.mjs";
@@ -263,7 +278,7 @@ function assertGovernedPayloadHasNoCallbackCredentials(taskName, payload, option
     scanResult.path
   );
 }
-function mapTasksGetResponseToTaskInfo(payload) {
+function mapTasksGetResponseToTaskInfo(payload, adcpVersion) {
   if (payload == null || typeof payload !== "object") {
     return { taskId: "", status: "unknown", taskType: "unknown", createdAt: Date.now(), updatedAt: Date.now() };
   }
@@ -283,7 +298,8 @@ function mapTasksGetResponseToTaskInfo(payload) {
   if (messageField !== void 0) taskInfo.message = messageField;
   if (flat.result !== void 0) {
     taskInfo.result = flat.result != null && typeof flat.result === "object" && !Array.isArray(flat.result) ? normalizeLegacyMediaBuyStatusForReturn(flat.result, {
-      toolName: taskInfo.taskType
+      toolName: taskInfo.taskType,
+      adcpVersion
     }) : flat.result;
   }
   return taskInfo;
@@ -703,6 +719,8 @@ class TaskExecutor {
       status: args.status
     };
     const taskState = this.activeTasks.get(args.taskId);
+    const wireAdcpVersion = taskState?.wireAdcpVersion ?? this.config.wireAdcpVersion;
+    if (wireAdcpVersion !== void 0) meta.wireAdcpVersion = wireAdcpVersion;
     if (taskState?.serverVersion !== void 0) meta.serverVersion = taskState.serverVersion;
     if (taskState?.serverVersionSynthetic !== void 0) {
       meta.serverVersionSynthetic = taskState.serverVersionSynthetic;
@@ -796,6 +814,7 @@ class TaskExecutor {
     }
     const taskState = {
       taskId,
+      wireAdcpVersion: wireAdcpVersion ?? options.negotiatedAdcpVersion ?? options.selectedAdcpVersion,
       taskName,
       params,
       status: "pending",
@@ -1066,7 +1085,7 @@ class TaskExecutor {
         () => ProtocolClient.callTool(agent, taskName, dispatchParams, callOptions)
       );
       throwIfAborted(postDispatchOptions.signal);
-      const respStatus = this.responseParser.getStatus(response);
+      const respStatus = this.responseParser.getStatus(response, taskName);
       taskState.serverTaskId = this.responseParser.getTaskId(response);
       await this.config.onActivity?.({
         type: "protocol_response",
@@ -1249,7 +1268,7 @@ class TaskExecutor {
     };
   }
   async handleAsyncResponse(agent, taskId, taskName, params, response, messages, inputHandler, options = {}, debugLogs = [], startTime = Date.now(), deferTerminalTaskStatus = false, persistPausedContinuation = true, serverVersion = "v3", deferredClientContext, requireDeferredSettlementResumeAuthorization = false, refinementServedVersion) {
-    const status = this.responseParser.getStatus(response);
+    const status = this.responseParser.getStatus(response, taskName);
     const serverTaskId = this.responseParser.getTaskId(response);
     const task = this.activeTasks.get(taskId);
     if (task && serverTaskId) task.serverTaskId = serverTaskId;
@@ -2400,22 +2419,79 @@ class TaskExecutor {
    * List tasks for an agent, preferring MCP Tasks protocol when available.
    */
   async listTasksForAgent(agent, transport) {
+    const credentialOwner = agent;
     if (agent.protocol === "mcp") {
-      const authToken = getAuthToken(agent);
+      agent = { ...agent, ...agent.headers && { headers: { ...agent.headers } } };
+      const version = this.config.wireAdcpVersion ?? this.config.adcpVersion ?? ADCP_VERSION;
+      let signingContext = buildAgentSigningContext(agent, { adcpVersion: version });
+      if (signingContext) agent = { ...agent, request_signing: signingContext.signing };
+      const syncTokens = () => {
+        agent.oauth_tokens = credentialOwner.oauth_tokens;
+      };
       try {
-        return await listMCPTasks(agent.agent_uri, authToken, void 0, {
-          transport: transport ?? this.config.transport,
-          onTransportActivity: this.config.onTransportActivity,
-          transportActivityContext: {
-            agentId: agent.id
+        if (credentialOwner.oauth_client_credentials) {
+          await ensureClientCredentialsTokens(credentialOwner, {
+            storage: getAgentStorage(credentialOwner),
+            allowPrivateIp: transport?.allowPrivateIp ?? isLikelyPrivateUrl(agent.agent_uri),
+            fetch: transport?.trustedFetchFn
+          });
+          syncTokens();
+        } else if (credentialOwner.oauth_tokens) {
+          getNonInteractiveOAuthProvider(credentialOwner, {
+            agentHint: credentialOwner.id,
+            storage: getAgentStorage(credentialOwner),
+            allowHttp: isLikelyPrivateUrl(credentialOwner.agent_uri)
+          });
+          shareNonInteractiveOAuthProvider(credentialOwner, agent);
+        }
+        signingContext = buildAgentSigningContext(agent, { adcpVersion: version });
+        if (signingContext) {
+          for (let attempt = 0; attempt < 2; attempt++) {
+            await ensureCapabilityLoaded(agent, signingContext, async (args) => {
+              const previousOwnerTokens = credentialOwner.oauth_tokens;
+              const previousRequestTokens = agent.oauth_tokens;
+              try {
+                return await ProtocolClient.callTool(agent, CAPABILITY_OP, args, {
+                  serverVersion: this.lastKnownServerVersion,
+                  adcpVersion: this.config.adcpVersion,
+                  wireAdcpVersion: this.config.wireAdcpVersion,
+                  versionEnvelope: this.config.versionEnvelope,
+                  transport: transport ?? this.config.transport,
+                  onTransportActivity: this.config.onTransportActivity
+                });
+              } finally {
+                if (credentialOwner.oauth_tokens === previousOwnerTokens && agent.oauth_tokens !== previousRequestTokens) {
+                  credentialOwner.oauth_tokens = agent.oauth_tokens;
+                } else {
+                  syncTokens();
+                }
+              }
+            });
+            syncTokens();
+            const current = buildAgentSigningContext(agent, { adcpVersion: version });
+            if (current.capabilityCacheKey === signingContext.capabilityCacheKey) break;
+            signingContext.invalidate();
+            if (attempt === 1)
+              throw new ConfigurationError("Task-list authorization changed during discovery; retry the call");
+            signingContext = current;
           }
-        });
+        }
+        return await signingContextStorage.run(
+          signingContext,
+          () => listMCPTasks(agent.agent_uri, getAuthToken(agent), void 0, {
+            signingContext,
+            headers: agent.headers,
+            transport: transport ?? this.config.transport,
+            onTransportActivity: this.config.onTransportActivity,
+            transportActivityContext: { agentId: agent.id }
+          })
+        );
       } catch (err) {
-        if (is401Error(err)) throw err;
+        if (is401Error(err) || err instanceof ConfigurationError || err instanceof TypeError) throw err;
       }
     }
     const response = await ProtocolClient.callTool(
-      agent,
+      credentialOwner,
       "tasks/list",
       {},
       {
@@ -2433,16 +2509,26 @@ class TaskExecutor {
    * Task tracking methods (PR #78)
    */
   async listTasks(agent, transport) {
-    const transportSnapshot = snapshotTransportOptions(transport ?? this.config.transport);
-    try {
-      return await this.listTasksForAgent(agent, transportSnapshot);
-    } catch {
-      console.warn("Failed to list tasks (see DEBUG=adcp:* logs for detail)");
-      return [];
+    return withMCPConnectionPolicy(transport ?? this.config.transport, async () => {
+      if (agent.request_signing) assertSigningPolicy(agent.request_signing);
+      const transportSnapshot = snapshotTransportOptions(transport ?? this.config.transport);
+      try {
+        return await this.listTasksForAgent(agent, transportSnapshot);
+      } catch {
+        console.warn("Failed to list tasks (see DEBUG=adcp:* logs for detail)");
+        return [];
+      }
+    });
+  }
+  async resolveTaskStatusTool(agent, transport, signal) {
+    if (this.config.resolveTaskStatusTool) {
+      return this.config.resolveTaskStatusTool(agent, { transport: transport ?? this.config.transport, signal });
     }
+    return agent.protocol === "mcp" ? "tasks_get" : "tasks/get";
   }
-  async getTaskStatusWithRawResponse(agent, taskId, transport, signal, expectedTaskType, serverVersion, wireAdcpVersion, versionEnvelope, operationId) {
-    const toolName = agent.protocol === "mcp" ? "tasks_get" : "tasks/get";
+  async getTaskStatusWithRawResponse(agent, taskId, transport, signal, expectedTaskType, serverVersion, wireAdcpVersion, versionEnvelope, operationId, pollingTool) {
+    const toolName = pollingTool ?? await this.resolveTaskStatusTool(agent, transport, signal);
+    throwIfAborted(signal);
     const response = await ProtocolClient.callTool(
       agent,
       toolName,
@@ -2465,7 +2551,8 @@ class TaskExecutor {
         }
       }
     );
-    const task = mapTasksGetResponseToTaskInfo(response);
+    const resultAdcpVersion = (versionEnvelope ?? this.config.versionEnvelope) === "major-only" ? "3.0" : wireAdcpVersion ?? this.config.wireAdcpVersion ?? this.config.adcpVersion ?? ADCP_VERSION;
+    const task = mapTasksGetResponseToTaskInfo(response, resultAdcpVersion);
     if (!task.taskId || task.taskId !== taskId) {
       throw new TaskBindingMismatchError(
         "tasks/get returned a task identity that does not match the requested task.",
@@ -2500,6 +2587,7 @@ class TaskExecutor {
     }
     const pollStartTime = Date.now();
     const correlationId = metadataTaskId ?? taskId;
+    let pollingTool;
     const withServerTaskId = (metadata) => ({
       ...metadata,
       serverTaskId: taskId
@@ -2515,7 +2603,8 @@ class TaskExecutor {
               a2aCancellationTaskId,
               cancelTransport?.trustedFetchFn,
               cancelTransport?.allowPrivateIp,
-              cancelTransport?.legacyCompat
+              cancelTransport?.legacyCompat,
+              wireAdcpVersion ?? this.config.wireAdcpVersion ?? this.config.adcpVersion ?? ADCP_VERSION
             ).catch(() => {
             });
           } catch {
@@ -2539,6 +2628,7 @@ class TaskExecutor {
       let status;
       let rawResponse;
       try {
+        pollingTool ??= await this.resolveTaskStatusTool(agent, transportSnapshot, signal);
         const pollResult = await this.getTaskStatusWithRawResponse(
           agent,
           taskId,
@@ -2548,7 +2638,8 @@ class TaskExecutor {
           serverVersion,
           wireAdcpVersion,
           versionEnvelope,
-          metadataTaskId
+          metadataTaskId,
+          pollingTool
         );
         status = pollResult.task;
         rawResponse = pollResult.rawResponse;
@@ -4444,7 +4535,7 @@ class TaskExecutor {
       status: "failed",
       error: error.message || String(error),
       adcpError: adcpErrorInfo,
-      errorInstance: getSignedRequestRejection(error) ?? this.buildErrorInstance(taskId, adcpErrorInfo),
+      errorInstance: getSignedRequestRejection(error) ?? (error instanceof NeedsAuthorizationError && hasValidatedMcpAuthorizationRequirements(error.requirements, agent.agent_uri) ? error : this.buildErrorInstance(taskId, adcpErrorInfo)),
       correlationId,
       metadata: this.buildMetadata({
         taskId,

package/dist/lib/core/agent-discovery-cache.d.mts

@@ -89,6 +89,8 @@ export interface AgentDiscoveryKeyInput {
     authIdentity: string;
     /** Kind of credential presented (`none`, `bearer`, `oauth`, `header`, ...); never its value. */
     credentialKind?: string;
+    /** Local caller principal partition; included only in the opaque digest. */
+    connectionPartition?: string;
     /** Request headers the client sends on every call (correlation and credential headers are dropped here). */
     headers?: Record<string, string>;
     /** Non-secret fingerprint of the request-signing identity, when configured. */

package/dist/lib/core/agent-discovery-cache.d.ts

@@ -89,6 +89,8 @@ export interface AgentDiscoveryKeyInput {
     authIdentity: string;
     /** Kind of credential presented (`none`, `bearer`, `oauth`, `header`, ...); never its value. */
     credentialKind?: string;
+    /** Local caller principal partition; included only in the opaque digest. */
+    connectionPartition?: string;
     /** Request headers the client sends on every call (correlation and credential headers are dropped here). */
     headers?: Record<string, string>;
     /** Non-secret fingerprint of the request-signing identity, when configured. */

package/dist/lib/core/agent-discovery-cache.js

@@ -101,6 +101,7 @@ function agentDiscoveryCacheKey(input) {
       adcpVersion: input.adcpVersion,
       wireAdcpVersion: input.wireAdcpVersion ?? null,
       authIdentity: input.authIdentity,
+      ...input.connectionPartition !== void 0 && { connectionPartition: input.connectionPartition },
       credentialKind: input.credentialKind ?? null,
       headers,
       signing: input.signing ?? null,

package/dist/lib/core/agent-discovery-cache.mjs

@@ -73,6 +73,7 @@ function agentDiscoveryCacheKey(input) {
       adcpVersion: input.adcpVersion,
       wireAdcpVersion: input.wireAdcpVersion ?? null,
       authIdentity: input.authIdentity,
+      ...input.connectionPartition !== void 0 && { connectionPartition: input.connectionPartition },
       credentialKind: input.credentialKind ?? null,
       headers,
       signing: input.signing ?? null,

package/dist/lib/core/task-status.d.mts

@@ -31,3 +31,5 @@ export declare function extractAdcpTaskStatusFromPayload(payload: unknown): ADCP
  * back to the transport-layer status.
  */
 export declare function extractAdcpStatusFromA2aTaskResult(result: unknown): ADCPStatus | undefined;
+/** A status query describes another task; its status/error are data, not the query's lifecycle. */
+export declare function isTaskStatusResponse(value: unknown, toolName?: string): boolean;

package/dist/lib/core/task-status.d.ts

@@ -31,3 +31,5 @@ export declare function extractAdcpTaskStatusFromPayload(payload: unknown): ADCP
  * back to the transport-layer status.
  */
 export declare function extractAdcpStatusFromA2aTaskResult(result: unknown): ADCPStatus | undefined;
+/** A status query describes another task; its status/error are data, not the query's lifecycle. */
+export declare function isTaskStatusResponse(value: unknown, toolName?: string): boolean;

package/dist/lib/core/task-status.js

@@ -22,7 +22,8 @@ __export(task_status_exports, {
   TASK_ENVELOPE_FIELDS: () => TASK_ENVELOPE_FIELDS,
   extractAdcpStatusFromA2aTaskResult: () => extractAdcpStatusFromA2aTaskResult,
   extractAdcpTaskStatusFromPayload: () => extractAdcpTaskStatusFromPayload,
-  isAdcpStatus: () => isAdcpStatus
+  isAdcpStatus: () => isAdcpStatus,
+  isTaskStatusResponse: () => isTaskStatusResponse
 });
 module.exports = __toCommonJS(task_status_exports);
 var import_a2a_artifacts = require('../utils/a2a-artifacts.js');
@@ -80,11 +81,19 @@ function extractAdcpStatusFromA2aTaskResult(result) {
   const extracted = (0, import_a2a_artifacts.getLatestA2ADataPartFromTask)(result);
   return extractAdcpTaskStatusFromPayload(extracted?.data);
 }
+function isTaskStatusResponse(value, toolName) {
+  if (toolName !== "get_task_status" || !value || typeof value !== "object" || Array.isArray(value)) return false;
+  const record = value;
+  return ["task_id", "task_type", "protocol", "status", "created_at", "updated_at"].every(
+    (field) => typeof record[field] === "string"
+  ) && record.adcp_error === void 0 && record.errors === void 0;
+}
 // Annotate the CommonJS export names for ESM import in node:
 0 && (module.exports = {
   ADCP_STATUS,
   TASK_ENVELOPE_FIELDS,
   extractAdcpStatusFromA2aTaskResult,
   extractAdcpTaskStatusFromPayload,
-  isAdcpStatus
+  isAdcpStatus,
+  isTaskStatusResponse
 });