A2A SDK for JavaScript 1.3

Apply the Node.js 24 and TypeScript 5.9 prompts first. These rules cover @a2a-js/sdk 1.3, implementing A2A Protocol 1.0. Apply them to each enabled client or server transport and to any persistent stores.

Discovery, cards, and client transports

• Constrain DefaultAgentCardResolver with its fetchImpl option or a custom AgentCardResolver: resolve baseUrl and path, allow only approved HTTPS destinations, reject private and metadata addresses after DNS resolution and redirects, and bound response bytes and time. The default resolver fetches and parses the card without an application egress policy.
• Validate each discovered supportedInterfaces URL, protocol version, and tenant before ClientFactory.createFromUrl or createFromAgentCard selects a transport. Scope RequestOptions.serviceParameters, interceptors, and transport credentials to the approved agent and final destination; a trusted card origin does not authorize every endpoint it advertises.
• Pass an explicit allowlist of factories as ClientFactoryOptions.transports. preferredTransports may fall back to the card's preferences, and ClientFactoryOptions.createFrom merges factories rather than removing originals.
• Give GrpcTransportFactory verified TLS grpcChannelCredentials and secure the server channel; the transport otherwise uses grpc.credentials.createInsecure(). An HTTPS card URL does not secure gRPC.
• Verify a signed public card before creating a transport and pass a verifier to Client.getAgentCard for extended-card refreshes. Verification is optional; the client caches a