A2A SDK for JavaScript 1.1.0

Apply the Node.js 24 and TypeScript 5.9 prompts first. These rules target @a2a-js/sdk 1.1.0 implementing A2A Protocol 1.0. The package declares Node.js >=20; use the supported Node.js 24 baseline.

Discovery and transport selection

• Supply a constrained fetchImpl in the DefaultAgentCardResolver options or use a custom AgentCardResolver for discovery. Validate the final URL after resolving baseUrl and path, and enforce the outbound destination policy, redirects, response-size limit, and deadline; the default resolver fetches and parses JSON without these application controls.
• Validate supportedInterfaces URLs, protocol versions, and tenant claims before ClientFactory.createFromUrl or createFromAgentCard selects a transport. Scope credentials injected through serviceParameters, interceptors, or transport fetchImpl to the approved agent and destination; discovery at a trusted origin does not authorize every advertised endpoint.
• Use createAuthenticatingFetchWithRetry only with agent/session-scoped AuthenticationHandler state. Restrict shouldRetryWithHeaders to expected authentication failures and replay-safe requests: it runs after every response and can repeat successful writes. Reject untrusted init.headers, which override both initial and refreshed authentication headers.
• Set ClientFactoryOptions.transports to the allowed factories explicitly. preferredTransports falls back to card preferences, and ClientFactoryOptions.createFrom merges transport factories with the originals; neither option removes an unwanted transport.
• Pass