A2A SDK for Java 1.4

Apply these rules to A2A Java client, server, transport, and extras code. The SDK implements A2A Protocol 1.0 with optional protocol 0.3 compatibility; its minimum Java runtime is 17. The included Java 25 prompt supplies the language and runtime controls.

Agent discovery and client credentials

• Give A2ACardResolver.builder().baseUrl(...) an approved HTTPS origin. Treat a fetched or registry-supplied AgentCard as untrusted data: approve its supportedInterfaces URLs, transport, tenant, advertised security schemes, and requested capabilities before Client.builder(card) connects or sends credentials. Keep private network and metadata destinations out of client egress, including any custom card path and redirect.
• Account for A2ACardResolver.getAgentCard() retrying the originally supplied base URL after a 404 at the computed well-known URL; scope authHeader(s) to an approved destination on both requests. Do not derive a credential-bearing card URL from an untrusted message or card.
• Bind credentials in ClientCallContext and AuthInterceptor to the intended agent, principal, and security scheme. Accept API-key header injection only for the SDK's allowed header names and APIKeySecurityScheme.Location.HEADER; do not add a card-chosen header, cookie, or query credential through a custom interceptor.
• Keep redirect following disabled for credential-bearing A2AHttpClient requests, including POST and SSE paths in injected JDK, Vert.x, Android, or CDI clients. If a redirect is required, approve the new origin and reselect credentials before another request;