@google/adk 2.2.1 → 2.3.0

package/dist/cjs/utils/env_aware_utils.js

@@ -70,14 +70,10 @@ function randomUUID() {
 __name(randomUUID, "randomUUID");
 function base64Encode(data) {
   if (isBrowser()) {
+    const bytes = typeof data === "string" ? new TextEncoder().encode(data) : data;
     let strData = "";
-    if (typeof data === "string") {
-      strData = data;
-    } else {
-      const len = data.byteLength;
-      for (let i = 0; i < len; i++) {
-        strData += String.fromCharCode(data[i]);
-      }
+    for (let i = 0; i < bytes.length; i++) {
+      strData += String.fromCharCode(bytes[i]);
     }
     return window.btoa(strData);
   }
@@ -86,7 +82,9 @@ function base64Encode(data) {
 __name(base64Encode, "base64Encode");
 function base64Decode(data) {
   if (isBrowser()) {
-    return window.atob(data);
+    const binary = window.atob(data);
+    const bytes = Uint8Array.from(binary, (char) => char.charCodeAt(0));
+    return new TextDecoder("utf-8", { ignoreBOM: true }).decode(bytes);
   }
   return Buffer.from(data, "base64").toString();
 }

package/dist/cjs/utils/error_utils.js

@@ -25,7 +25,8 @@ var __copyProps = (to, from, except, desc) => {
 var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
 var error_utils_exports = {};
 __export(error_utils_exports, {
-  formatError: () => formatError
+  formatError: () => formatError,
+  getErrorMessage: () => getErrorMessage
 });
 module.exports = __toCommonJS(error_utils_exports);
 /**
@@ -55,16 +56,14 @@ function truncateBody(body) {
   return body.length > MAX_RESPONSE_BODY_LENGTH ? body.slice(0, MAX_RESPONSE_BODY_LENGTH) + TRUNCATION_MARKER : body;
 }
 __name(truncateBody, "truncateBody");
-function baseMessage(err) {
-  if (err instanceof Error) {
-    return err.message;
-  }
-  if (typeof err === "string") {
-    return err;
+function getErrorMessage(err) {
+  const record = asRecord(err);
+  if (record !== void 0 && typeof record["message"] === "string") {
+    return record["message"];
   }
   return String(err);
 }
-__name(baseMessage, "baseMessage");
+__name(getErrorMessage, "getErrorMessage");
 function extractHttpDetails(err) {
   var _a, _b;
   const record = asRecord(err);
@@ -97,7 +96,7 @@ function formatErrorRecursive(err, seen) {
   }
   if (typeof err === "object") {
     if (seen.has(err)) {
-      return baseMessage(err);
+      return getErrorMessage(err);
     }
     seen.add(err);
   }
@@ -105,7 +104,7 @@ function formatErrorRecursive(err, seen) {
     return err.errors.map((sub) => formatErrorRecursive(sub, seen)).join(" | ");
   }
   const http = extractHttpDetails(err);
-  const base = baseMessage(err);
+  const base = getErrorMessage(err);
   const cause = (_a = asRecord(err)) == null ? void 0 : _a["cause"];
   const causeMessage = cause !== void 0 ? formatErrorRecursive(cause, seen) : void 0;
   let message = base.length > 0 ? base : UNKNOWN_ERROR;
@@ -124,5 +123,6 @@ function formatError(err) {
 __name(formatError, "formatError");
 // Annotate the CommonJS export names for ESM import in node:
 0 && (module.exports = {
-  formatError
+  formatError,
+  getErrorMessage
 });

package/dist/cjs/utils/file_extension_utils.js

@@ -37,7 +37,17 @@ var import_code_execution_utils = require("../code_executors/code_execution_util
  */
 const MIME_TYPE_MAP = {
   ".js": { mimeType: "text/javascript", encoding: import_code_execution_utils.FileContentEncoding.UTF8 },
+  ".cjs": { mimeType: "text/javascript", encoding: import_code_execution_utils.FileContentEncoding.UTF8 },
+  ".mjs": { mimeType: "text/javascript", encoding: import_code_execution_utils.FileContentEncoding.UTF8 },
+  ".ts": { mimeType: "text/javascript", encoding: import_code_execution_utils.FileContentEncoding.UTF8 },
+  ".cts": { mimeType: "text/javascript", encoding: import_code_execution_utils.FileContentEncoding.UTF8 },
+  ".mts": { mimeType: "text/javascript", encoding: import_code_execution_utils.FileContentEncoding.UTF8 },
   ".py": { mimeType: "text/x-python", encoding: import_code_execution_utils.FileContentEncoding.UTF8 },
+  ".sh": { mimeType: "text/x-shellscript", encoding: import_code_execution_utils.FileContentEncoding.UTF8 },
+  ".bash": {
+    mimeType: "text/x-shellscript",
+    encoding: import_code_execution_utils.FileContentEncoding.UTF8
+  },
   ".md": { mimeType: "text/markdown", encoding: import_code_execution_utils.FileContentEncoding.UTF8 },
   ".txt": { mimeType: "text/plain", encoding: import_code_execution_utils.FileContentEncoding.UTF8 },
   ".html": { mimeType: "text/html", encoding: import_code_execution_utils.FileContentEncoding.UTF8 },
@@ -51,6 +61,7 @@ const MIME_TYPE_MAP = {
   ".png": { mimeType: "image/png", encoding: import_code_execution_utils.FileContentEncoding.BASE64 },
   ".jpg": { mimeType: "image/jpeg", encoding: import_code_execution_utils.FileContentEncoding.BASE64 },
   ".jpeg": { mimeType: "image/jpeg", encoding: import_code_execution_utils.FileContentEncoding.BASE64 },
+  ".gif": { mimeType: "image/gif", encoding: import_code_execution_utils.FileContentEncoding.BASE64 },
   ".pdf": { mimeType: "application/pdf", encoding: import_code_execution_utils.FileContentEncoding.BASE64 }
 };
 const EXTENSION_TO_LANGUAGE = {

package/dist/cjs/utils/file_utils.js

@@ -35,13 +35,13 @@ var __toESM = (mod, isNodeMode, target) => (target = mod != null ? __create(__ge
 var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
 var file_utils_exports = {};
 __export(file_utils_exports, {
-  EXTENSION_TO_MIME_TYPE: () => EXTENSION_TO_MIME_TYPE,
   guessMimeType: () => guessMimeType,
   materializeFiles: () => materializeFiles
 });
 module.exports = __toCommonJS(file_utils_exports);
 var fs = __toESM(require("node:fs/promises"), 1);
 var path = __toESM(require("node:path"), 1);
+var import_file_extension_utils = require("./file_extension_utils.js");
 /**
  * @license
  * Copyright 2026 Google LLC
@@ -97,34 +97,12 @@ async function materializeFiles(files, dir) {
   return createdFiles;
 }
 __name(materializeFiles, "materializeFiles");
-const EXTENSION_TO_MIME_TYPE = {
-  "pdf": "application/pdf",
-  "jpg": "image/jpeg",
-  "jpeg": "image/jpeg",
-  "png": "image/png",
-  "gif": "image/gif",
-  "csv": "text/csv",
-  "json": "application/json",
-  "xml": "application/xml",
-  "sh": "text/x-shellscript",
-  "bash": "text/x-shellscript",
-  "py": "text/x-python",
-  "js": "text/javascript",
-  "cjs": "text/javascript",
-  "mjs": "text/javascript",
-  "ts": "text/javascript",
-  "cts": "text/javascript",
-  "mts": "text/javascript"
-};
 function guessMimeType(filePath) {
-  var _a;
-  const ext = ((_a = filePath.split(".").pop()) == null ? void 0 : _a.toLowerCase()) || "";
-  return EXTENSION_TO_MIME_TYPE[ext] || "application/octet-stream";
+  return (0, import_file_extension_utils.getMimeTypeAndEncoding)(path.extname(filePath)).mimeType;
 }
 __name(guessMimeType, "guessMimeType");
 // Annotate the CommonJS export names for ESM import in node:
 0 && (module.exports = {
-  EXTENSION_TO_MIME_TYPE,
   guessMimeType,
   materializeFiles
 });

package/dist/cjs/utils/gemini_schema_util.js

@@ -72,6 +72,9 @@ function toGeminiSchema(mcpSchema) {
   }
   function recursiveConvert(mcp) {
     var _a;
+    if (typeof mcp === "boolean") {
+      mcp = { type: "object" };
+    }
     const sourceType = (_a = mcp.anyOf) != null ? _a : mcp.type;
     let isNullable = false;
     let nonNullTypes;
@@ -162,7 +165,7 @@ function toGeminiSchema(mcpSchema) {
         geminiSchema.required = mcp.required;
       }
     } else if (geminiType === import_genai.Type.ARRAY) {
-      if (mcp.items) {
+      if (mcp.items || mcp.items === false) {
         geminiSchema.items = recursiveConvert(mcp.items);
       }
     }

package/dist/cjs/utils/json_utils.js

@@ -0,0 +1,49 @@
+/**
+  * @license
+  * Copyright 2026 Google LLC
+  * SPDX-License-Identifier: Apache-2.0
+  */
+
+"use strict";
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __name = (target, value) => __defProp(target, "name", { value, configurable: true });
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, { get: all[name], enumerable: true });
+};
+var __copyProps = (to, from, except, desc) => {
+  if (from && typeof from === "object" || typeof from === "function") {
+    for (let key of __getOwnPropNames(from))
+      if (!__hasOwnProp.call(to, key) && key !== except)
+        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
+  }
+  return to;
+};
+var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
+var json_utils_exports = {};
+__export(json_utils_exports, {
+  isJsonObject: () => isJsonObject,
+  toJsonObject: () => toJsonObject
+});
+module.exports = __toCommonJS(json_utils_exports);
+/**
+ * @license
+ * Copyright 2026 Google LLC
+ * SPDX-License-Identifier: Apache-2.0
+ */
+function isJsonObject(value) {
+  return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+__name(isJsonObject, "isJsonObject");
+function toJsonObject(value) {
+  return isJsonObject(value) ? value : {};
+}
+__name(toJsonObject, "toJsonObject");
+// Annotate the CommonJS export names for ESM import in node:
+0 && (module.exports = {
+  isJsonObject,
+  toJsonObject
+});

package/dist/cjs/utils/live_connection_utils.js

@@ -204,12 +204,11 @@ const _LiveResponseAggregator = class _LiveResponseAggregator {
           yield this.buildFullTextResponse(this.text, this.isThought);
           this.text = "";
           this.isThought = false;
-        } else {
-          yield {
-            interrupted: serverContent.interrupted,
-            ...this.modelVersion ? { modelVersion: this.modelVersion } : {}
-          };
         }
+        yield {
+          interrupted: serverContent.interrupted,
+          ...this.modelVersion ? { modelVersion: this.modelVersion } : {}
+        };
       }
     }
     if (message.toolCall) {

package/dist/cjs/utils/logger_node.js

@@ -46,6 +46,12 @@ var import_logger = require("./logger.js");
  * Copyright 2026 Google LLC
  * SPDX-License-Identifier: Apache-2.0
  */
+const WINSTON_LEVEL_NAMES = {
+  [import_logger.LogLevel.DEBUG]: "debug",
+  [import_logger.LogLevel.INFO]: "info",
+  [import_logger.LogLevel.WARN]: "warn",
+  [import_logger.LogLevel.ERROR]: "error"
+};
 const _WinstonLogger = class _WinstonLogger {
   constructor() {
     this.logLevel = import_logger.LogLevel.INFO;
@@ -79,7 +85,7 @@ const _WinstonLogger = class _WinstonLogger {
     if (this.logLevel > level) {
       return;
     }
-    this.logger.log(level.toString(), messages.join(" "));
+    this.logger.log(WINSTON_LEVEL_NAMES[level], messages.join(" "));
   }
   debug(...messages) {
     if (this.logLevel > import_logger.LogLevel.DEBUG) {

package/dist/cjs/utils/object_notation_utils.js

@@ -26,7 +26,8 @@ var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: tru
 var object_notation_utils_exports = {};
 __export(object_notation_utils_exports, {
   toCamelCase: () => toCamelCase,
-  toSnakeCase: () => toSnakeCase
+  toSnakeCase: () => toSnakeCase,
+  toSnakeCaseKey: () => toSnakeCaseKey
 });
 module.exports = __toCommonJS(object_notation_utils_exports);
 /**
@@ -46,7 +47,8 @@ const toCamelCaseKey = /* @__PURE__ */ __name((key) => key.replace(
   /_([a-z])/g,
   (_match, letter) => letter.toUpperCase()
 ), "toCamelCaseKey");
-const toSnakeCaseKey = /* @__PURE__ */ __name((key) => key.replace(/[A-Z]/g, (g) => "_" + g.toLowerCase()), "toSnakeCaseKey");
+const CAMEL_BOUNDARY = /(?<=[a-z0-9])(?=[A-Z])|(?<=[A-Z])(?=[A-Z][a-z])/g;
+const toSnakeCaseKey = /* @__PURE__ */ __name((key) => key.replace(CAMEL_BOUNDARY, "_").toLowerCase().replace(/-/g, "_"), "toSnakeCaseKey");
 function toNotation(obj, converter, parentKey = "", preserveKeys = []) {
   if (Array.isArray(obj)) {
     return obj.map(
@@ -78,5 +80,6 @@ __name(toNotation, "toNotation");
 // Annotate the CommonJS export names for ESM import in node:
 0 && (module.exports = {
   toCamelCase,
-  toSnakeCase
+  toSnakeCase,
+  toSnakeCaseKey
 });

package/dist/cjs/utils/streaming_utils.js

@@ -25,7 +25,7 @@ var __copyProps = (to, from, except, desc) => {
 var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
 var streaming_utils_exports = {};
 __export(streaming_utils_exports, {
-  StreamingResponseAggregator: () => StreamingResponseAggregator,
+  GeminiStreamingResponseAggregator: () => GeminiStreamingResponseAggregator,
   isEmptyContentPart: () => isEmptyContentPart
 });
 module.exports = __toCommonJS(streaming_utils_exports);
@@ -231,7 +231,7 @@ const _NonProgressiveStrategy = class _NonProgressiveStrategy {
     this.thoughtText = "";
   }
   async *processResponse(llmResponse) {
-    var _a;
+    var _a, _b;
     if ((_a = llmResponse.content) == null ? void 0 : _a.parts) {
       const nonTextParts = [];
       let sawTextPart = false;
@@ -251,7 +251,8 @@ const _NonProgressiveStrategy = class _NonProgressiveStrategy {
         nonTextParts.push(part);
       }
       if (nonTextParts.length > 0) {
-        if (this.thoughtText || this.text) {
+        const startsWithInlineData = !!((_b = llmResponse.content.parts[0]) == null ? void 0 : _b.inlineData);
+        if (!startsWithInlineData && (this.thoughtText || this.text)) {
           const parts = [];
           if (this.thoughtText) {
             parts.push({ text: this.thoughtText, thought: true });
@@ -302,13 +303,12 @@ const _NonProgressiveStrategy = class _NonProgressiveStrategy {
 };
 __name(_NonProgressiveStrategy, "NonProgressiveStrategy");
 let NonProgressiveStrategy = _NonProgressiveStrategy;
-const _StreamingResponseAggregator = class _StreamingResponseAggregator {
-  constructor(isProgressiveMode = (0, import_feature_registry.isFeatureEnabled)(
-    import_feature_registry.FeatureName.PROGRESSIVE_SSE_STREAMING
-  )) {
-    this.isProgressiveMode = isProgressiveMode;
+const _GeminiStreamingResponseAggregator = class _GeminiStreamingResponseAggregator {
+  constructor({
+    isProgressiveMode = (0, import_feature_registry.isFeatureEnabled)(import_feature_registry.FeatureName.PROGRESSIVE_SSE_STREAMING)
+  } = {}) {
     this.lastThoughtSignature = {};
-    this.strategy = this.isProgressiveMode ? new ProgressiveStrategy() : new NonProgressiveStrategy();
+    this.strategy = isProgressiveMode ? new ProgressiveStrategy() : new NonProgressiveStrategy();
   }
   async *processResponse(response) {
     var _a, _b;
@@ -381,14 +381,14 @@ const _StreamingResponseAggregator = class _StreamingResponseAggregator {
     };
   }
 };
-__name(_StreamingResponseAggregator, "StreamingResponseAggregator");
-let StreamingResponseAggregator = _StreamingResponseAggregator;
+__name(_GeminiStreamingResponseAggregator, "GeminiStreamingResponseAggregator");
+let GeminiStreamingResponseAggregator = _GeminiStreamingResponseAggregator;
 function isEmptyContentPart(part) {
   return !part.functionCall && !part.functionResponse && !part.fileData && !part.inlineData && !part.executableCode && !part.codeExecutionResult && (!part.text || part.text === "");
 }
 __name(isEmptyContentPart, "isEmptyContentPart");
 // Annotate the CommonJS export names for ESM import in node:
 0 && (module.exports = {
-  StreamingResponseAggregator,
+  GeminiStreamingResponseAggregator,
   isEmptyContentPart
 });

package/dist/cjs/version.js

@@ -32,7 +32,7 @@ module.exports = __toCommonJS(version_exports);
  * Copyright 2025 Google LLC
  * SPDX-License-Identifier: Apache-2.0
  */
-const version = "2.2.1";
+const version = "2.3.0";
 // Annotate the CommonJS export names for ESM import in node:
 0 && (module.exports = {
   version

package/dist/esm/a2a/a2a_remote_agent.js

@@ -43,7 +43,10 @@ const _RemoteA2AAgent = class _RemoteA2AAgent extends BaseAgent {
       this.client = this.a2aConfig.client;
     }
     if (this.a2aConfig.agentCard) {
-      this.card = await resolveAgentCard(this.a2aConfig.agentCard);
+      this.card = await resolveAgentCard(
+        this.a2aConfig.agentCard,
+        this.a2aConfig.resolveAgentCardOptions
+      );
       if (!this.client) {
         const factory = this.a2aConfig.clientFactory || new ClientFactory();
         this.client = await factory.createFromAgentCard(this.card);

package/dist/esm/a2a/agent_card.js

@@ -22,25 +22,27 @@ import { isBaseTool } from "../tools/base_tool.js";
 import { isBaseToolset } from "../tools/base_toolset.js";
 import { logger } from "../utils/logger.js";
 import {
-  isHttpUrl,
   isLinkLocalAddress,
+  isLocalhostHostname,
   normalizeHost,
   resolveHostAddresses
 } from "../utils/ssrf_guard.js";
 import { isWorkflow } from "../workflow/workflow.js";
-const WINDOWS_DRIVE_PROTOCOL = /^[a-z]:$/i;
-async function resolveAgentCard(agentCard) {
+async function resolveAgentCard(agentCard, options = {}) {
   if (typeof agentCard === "object") {
     return agentCard;
   }
-  const url = parseCardUrl(agentCard);
-  if (url && isHttpUrl(url)) {
-    await assertHostAllowed(url);
+  const source = agentCard;
+  if (source.startsWith("http://") || source.startsWith("https://")) {
+    await refuseLinkLocalHost(source);
     const resolver = new DefaultAgentCardResolver({
-      fetchImpl: noRedirectFetch(agentCard)
+      fetchImpl: refuseRedirectFetch
     });
-    return resolver.resolve(agentCard);
+    const card = await resolver.resolve(source);
+    validateCardRpcTargets(card, source, options);
+    return card;
   }
+  const url = parseCardUrl(source);
   if (url && url.protocol !== "file:") {
     throw new Error(
       `Unsupported agent card URL scheme "${url.protocol}": ${agentCard}. Use http://, https:// or file://, or pass a filesystem path with no scheme.`
@@ -49,6 +51,31 @@ async function resolveAgentCard(agentCard) {
   return readAgentCardFile(agentCard, url);
 }
 __name(resolveAgentCard, "resolveAgentCard");
+const WINDOWS_DRIVE_PROTOCOL = /^[a-z]:$/i;
+async function refuseLinkLocalHost(source) {
+  const hostname = normalizeHost(new URL(source).hostname);
+  if (isLocalhostHostname(hostname)) {
+    return;
+  }
+  const addresses = await resolveHostAddresses(hostname);
+  if (addresses.some((address) => isLinkLocalAddress(address))) {
+    throw new Error(
+      `Refusing to fetch agent card from a link-local address: ${hostname}`
+    );
+  }
+}
+__name(refuseLinkLocalHost, "refuseLinkLocalHost");
+async function refuseRedirectFetch(url, init) {
+  const response = await fetch(url, { ...init, redirect: "manual" });
+  if (response.status === 0 || response.status >= 300 && response.status < 400) {
+    const location = response.headers.get("location");
+    throw new Error(
+      `Refusing to follow a redirect from the agent card endpoint (status ${response.status}, location ${location}): ${url}`
+    );
+  }
+  return response;
+}
+__name(refuseRedirectFetch, "refuseRedirectFetch");
 function parseCardUrl(source) {
   let url;
   try {
@@ -71,32 +98,81 @@ async function readAgentCardFile(source, url) {
   }
 }
 __name(readAgentCardFile, "readAgentCardFile");
-function noRedirectFetch(source) {
-  return async (input, init) => {
-    const response = await fetch(input, { ...init, redirect: "manual" });
-    if (isRedirect(response.status)) {
+function validateCardRpcTargets(card, source, options) {
+  var _a;
+  let parsedSource;
+  try {
+    parsedSource = new URL(source);
+  } catch (err) {
+    throw new Error(
+      `Invalid agent card source URL: ${source}: ${err.message}`
+    );
+  }
+  const rpcUrls = [
+    card.url,
+    ...((_a = card.additionalInterfaces) != null ? _a : []).map((i) => i.url)
+  ];
+  for (const rpcUrl of rpcUrls) {
+    let parsed;
+    try {
+      parsed = new URL(rpcUrl);
+    } catch (err) {
       throw new Error(
-        `Refusing to follow a redirect while fetching the agent card from ${source} (status ${response.status}, location ${response.headers.get("location")}). Configure the final URL instead.`
+        `Invalid RPC URL in agent card: ${rpcUrl}: ${err.message}`
       );
     }
-    return response;
-  };
+    if (parsed.protocol !== "https:" && !isLoopbackHost(parsed.hostname)) {
+      if (options.allowInsecureRpc === true) {
+        logger.warn(
+          `SECURITY WARNING: accepting a plaintext http RPC URL on a non-loopback host because \`allowInsecureRpc: true\` was set: ${rpcUrl}. This connection can be intercepted or altered by anything on the network path.`
+        );
+      } else {
+        throw new Error(
+          `Agent card RPC URL must use https, or http on a loopback host: ${rpcUrl}`
+        );
+      }
+    }
+    if (!sameOriginForRpc(parsedSource, parsed)) {
+      if (options.allowCrossOriginRpc === true) {
+        logger.warn(
+          `SECURITY WARNING: accepting an agent card RPC URL whose origin differs from the location the card was fetched from because \`allowCrossOriginRpc: true\` was set (fetched from ${source}): ${rpcUrl}.`
+        );
+      } else {
+        throw new Error(
+          `Agent card RPC URL must have the same origin as the location the card was fetched from (${source}): ${rpcUrl}`
+        );
+      }
+    }
+  }
 }
-__name(noRedirectFetch, "noRedirectFetch");
-function isRedirect(status) {
-  return status === 0 || status >= 300 && status < 400;
+__name(validateCardRpcTargets, "validateCardRpcTargets");
+function sameOriginForRpc(source, rpc) {
+  const sourceIsLoopback = isLoopbackHost(source.hostname);
+  const rpcIsLoopback = isLoopbackHost(rpc.hostname);
+  if (sourceIsLoopback && rpcIsLoopback) {
+    return source.protocol === rpc.protocol && effectivePort(source) === effectivePort(rpc);
+  }
+  return source.origin === rpc.origin;
 }
-__name(isRedirect, "isRedirect");
-async function assertHostAllowed(url) {
-  const host = normalizeHost(url.hostname);
-  const addresses = await resolveHostAddresses(host);
-  if (addresses.some(isLinkLocalAddress)) {
-    throw new Error(
-      `Refusing to fetch agent card from a link-local address: ${host}`
-    );
+__name(sameOriginForRpc, "sameOriginForRpc");
+function effectivePort(url) {
+  if (url.port) {
+    return url.port;
+  }
+  if (url.protocol === "https:") {
+    return "443";
   }
+  if (url.protocol === "http:") {
+    return "80";
+  }
+  return url.port;
+}
+__name(effectivePort, "effectivePort");
+function isLoopbackHost(hostname) {
+  const bare = hostname.replace(/^\[|\]$/g, "").toLowerCase();
+  return bare === "localhost" || bare === "127.0.0.1" || bare === "::1" || bare === "0.0.0.0" || bare === "::" || /^127\.\d{1,3}\.\d{1,3}\.\d{1,3}$/.test(bare);
 }
-__name(assertHostAllowed, "assertHostAllowed");
+__name(isLoopbackHost, "isLoopbackHost");
 async function getA2AAgentCard(agent, transports) {
   return {
     name: agent.name,

package/dist/esm/a2a/agent_to_a2a.js

@@ -34,7 +34,10 @@ import { StreamingMode } from "../agents/run_config.js";
 import { InMemorySessionService } from "../sessions/in_memory_session_service.js";
 import { logger } from "../utils/logger.js";
 import { loadOptionalPeer } from "../utils/optional_peer.js";
-import { getA2AAgentCard, resolveAgentCard } from "./agent_card.js";
+import {
+  getA2AAgentCard,
+  resolveAgentCard
+} from "./agent_card.js";
 import { A2AAgentExecutor } from "./agent_executor.js";
 import {
   AdkDefaultRequestHandler,
@@ -73,7 +76,7 @@ async function toA2a(agent, options = {}) {
   const protocol = (_c = options.protocol) != null ? _c : "http";
   const basePath = options.basePath || "";
   const rpcUrl = `${protocol}://${host}:${port}${basePath}`;
-  const agentCard = options.agentCard ? await resolveAgentCard(options.agentCard) : await getA2AAgentCard(agent, [
+  const agentCard = options.agentCard ? await resolveAgentCard(options.agentCard, options.resolveAgentCardOptions) : await getA2AAgentCard(agent, [
     {
       url: `${rpcUrl}/jsonrpc`,
       transport: "JSONRPC"