@adcp/sdk 15.4.0 → 15.5.0

package/dist/lib/protocols/mcp.mjs

@@ -35,6 +35,20 @@ import {
   registerMCPConnectionScopePending
 } from "./mcp-scope.mjs";
 import { terminateSessionBestEffort } from "./session-termination.mjs";
+import {
+  applyMCPCallHeaders,
+  isCorrelationHeader,
+  withAmbientIdentityHeaders,
+  closeWhenIdle,
+  linkedCallSignal,
+  joinPendingConnection,
+  RETRY_CONNECT,
+  requestTimeoutFor,
+  runCallPhase,
+  runWithMCPCallContext,
+  splitConnectionHeaders,
+  trackConnectionUse
+} from "./mcp-call-context.mjs";
 import { createAgentTransportFetch } from "../net/agent-transport-fetch.mjs";
 const connectionCache = /* @__PURE__ */ new Map();
 const pendingConnections = /* @__PURE__ */ new Map();
@@ -43,11 +57,9 @@ const pendingOAuthConnections = /* @__PURE__ */ new Map();
 const streamableTransports = /* @__PURE__ */ new WeakMap();
 const oauthProviderIds = /* @__PURE__ */ new WeakMap();
 const transportFetchFnIds = /* @__PURE__ */ new WeakMap();
-const transportSignalIds = /* @__PURE__ */ new WeakMap();
 const MAX_CACHED_CONNECTIONS = 20;
 let nextOAuthProviderId = 0;
 let nextTransportFetchFnId = 0;
-let nextTransportSignalId = 0;
 let connectionGeneration = 0;
 let oauthConnectionGeneration = 0;
 async function closeMCPClient(client, terminateSession = true) {
@@ -67,7 +79,7 @@ function trackStreamableHTTPUrl(url) {
     if (oldest) knownStreamableHTTPUrls.delete(oldest);
   }
 }
-function connectionCacheKey(agentUrl, authToken, signingCacheKey, authHeaders, transportFetch, signal, requestTimeoutMs, allowPrivateIp) {
+function connectionCacheKey(agentUrl, authToken, signingCacheKey, authHeaders, transportFetch, allowPrivateIp) {
   const parts = [agentUrl];
   const fingerprint = authToken ?? extractAuthHeader(authHeaders);
   if (fingerprint) parts.push(cacheDisambiguator(fingerprint));
@@ -75,8 +87,6 @@ function connectionCacheKey(agentUrl, authToken, signingCacheKey, authHeaders, t
   if (headersKey) parts.push(`headers:${headersKey}`);
   if (signingCacheKey) parts.push(signingCacheKey);
   if (transportFetch) parts.push(`fetch:${getTransportFetchFnDisambiguator(transportFetch)}`);
-  if (signal) parts.push(`signal:${getTransportSignalDisambiguator(signal)}`);
-  if (requestTimeoutMs !== void 0) parts.push(`timeout:${requestTimeoutMs}`);
   if (allowPrivateIp !== void 0) parts.push(`allow-private-ip:${allowPrivateIp}`);
   const scopeKey = currentMCPConnectionScopeKey();
   if (scopeKey) parts.push(scopeKey);
@@ -94,18 +104,19 @@ function extractAuthHeader(headers) {
   return void 0;
 }
 function headersCacheDisambiguator(headers) {
-  const entries = Object.entries(headers ?? {}).filter(([key]) => {
-    const lower = key.toLowerCase();
-    return lower !== "traceparent" && lower !== "tracestate" && lower !== "baggage";
-  }).map(([key, value]) => [key.toLowerCase(), value]).sort(([a], [b]) => a.localeCompare(b));
+  const entries = Object.entries(splitConnectionHeaders(headers).identity).map(([key, value]) => [key.toLowerCase(), value]).sort(([a], [b]) => a.localeCompare(b));
   return entries.length > 0 ? cacheDisambiguator(JSON.stringify(entries)) : void 0;
 }
-function withPerRequestTraceHeaders(fetchImpl) {
+function withPerRequestTraceHeaders(fetchImpl, directDefaults) {
   return (input, init) => {
     const headers = new Headers(input instanceof Request ? input.headers : void 0);
     new Headers(init?.headers).forEach((value, key) => headers.set(key, value));
-    for (const [key, value] of Object.entries(injectTraceHeaders())) headers.set(key, value);
-    return fetchImpl(input, { ...init, headers });
+    applyMCPCallHeaders(headers, directDefaults);
+    if (headers.has("traceparent")) return fetchImpl(input, { ...init, headers, ...linkedCallSignal(init) });
+    for (const [key, value] of Object.entries(injectTraceHeaders())) {
+      if (isCorrelationHeader(key) && !headers.has(key)) headers.set(key, value);
+    }
+    return fetchImpl(input, { ...init, headers, ...linkedCallSignal(init) });
   };
 }
 function getCachedConnection(key) {
@@ -122,7 +133,7 @@ function evictLeastRecentlyUsed() {
   if (!lruKey) return;
   const oldClient = connectionCache.get(lruKey);
   connectionCache.delete(lruKey);
-  if (oldClient) void closeMCPClient(oldClient).catch(() => {
+  if (oldClient) void closeWhenIdle(oldClient, () => closeMCPClient(oldClient)).catch(() => {
   });
 }
 function evictLeastRecentlyUsedOAuth() {
@@ -131,7 +142,7 @@ function evictLeastRecentlyUsedOAuth() {
   if (!lruKey) return;
   const oldClient = oauthConnectionCache.get(lruKey);
   oauthConnectionCache.delete(lruKey);
-  if (oldClient) void closeMCPClient(oldClient).catch(() => {
+  if (oldClient) void closeWhenIdle(oldClient, () => closeMCPClient(oldClient)).catch(() => {
   });
 }
 async function closeOAuthConnections() {
@@ -172,31 +183,37 @@ async function closeMCPConnections() {
   await closeModernMCPConnections();
 }
 async function getOrCreateConnection(cacheKey, baseUrl, authHeaders, debugLogs, label, transportFetch, requestOptions = {}) {
-  const cached = getCachedConnection(cacheKey);
-  if (cached) return cached;
-  const pending = pendingConnections.get(cacheKey);
-  if (pending) return pending;
-  const generation = connectionGeneration;
-  const promise = connectMCPWithFallback(baseUrl, authHeaders, debugLogs, label, transportFetch, requestOptions).then(async (client) => {
-    if (generation !== connectionGeneration) {
-      await closeMCPClient(client).catch(() => {
-      });
-      throw new Error(`MCP ${label} completed after connection teardown`);
+  for (let attempt = 0; ; attempt++) {
+    const cached = getCachedConnection(cacheKey);
+    if (cached) return cached;
+    const pending = pendingConnections.get(cacheKey);
+    if (pending) {
+      const joined = await joinPendingConnection(pending, requestOptions, attempt);
+      if (joined === RETRY_CONNECT) continue;
+      return joined;
     }
-    connectionCache.set(cacheKey, client);
-    registerMCPConnectionScopeCleanup("legacy", cacheKey, async () => {
-      if (connectionCache.get(cacheKey) !== client) return;
-      connectionCache.delete(cacheKey);
-      await closeMCPClient(client);
+    const generation = connectionGeneration;
+    const promise = connectMCPWithFallback(baseUrl, authHeaders, debugLogs, label, transportFetch, requestOptions).then(async (client) => {
+      if (generation !== connectionGeneration) {
+        await closeMCPClient(client).catch(() => {
+        });
+        throw new Error(`MCP ${label} completed after connection teardown`);
+      }
+      connectionCache.set(cacheKey, client);
+      registerMCPConnectionScopeCleanup("legacy", cacheKey, async () => {
+        if (connectionCache.get(cacheKey) !== client) return;
+        connectionCache.delete(cacheKey);
+        await closeMCPClient(client);
+      });
+      evictLeastRecentlyUsed();
+      return client;
+    }).finally(() => {
+      if (pendingConnections.get(cacheKey) === promise) pendingConnections.delete(cacheKey);
     });
-    evictLeastRecentlyUsed();
-    return client;
-  }).finally(() => {
-    if (pendingConnections.get(cacheKey) === promise) pendingConnections.delete(cacheKey);
-  });
-  pendingConnections.set(cacheKey, promise);
-  registerMCPConnectionScopePending(promise);
-  return promise;
+    pendingConnections.set(cacheKey, promise);
+    registerMCPConnectionScopePending(promise);
+    return promise;
+  }
 }
 function getOAuthProviderDisambiguator(authProvider) {
   let id = oauthProviderIds.get(authProvider);
@@ -214,25 +231,15 @@ function getTransportFetchFnDisambiguator(fetchFn) {
   }
   return id;
 }
-function getTransportSignalDisambiguator(signal) {
-  let id = transportSignalIds.get(signal);
-  if (!id) {
-    id = cacheDisambiguator(`transport-signal:${++nextTransportSignalId}`);
-    transportSignalIds.set(signal, id);
-  }
-  return id;
-}
 function customHeadersDisambiguator(customHeaders) {
   return headersCacheDisambiguator(customHeaders);
 }
-function oauthConnectionCacheKey(agentUrl, authProvider, signingCacheKey, customHeaders, fetchFn, signal, requestTimeoutMs, allowPrivateIp) {
+function oauthConnectionCacheKey(agentUrl, authProvider, signingCacheKey, customHeaders, fetchFn, allowPrivateIp) {
   const parts = [`${agentUrl}::oauth:${getOAuthProviderDisambiguator(authProvider)}`];
   if (signingCacheKey) parts.push(signingCacheKey);
   const headersKey = customHeadersDisambiguator(customHeaders);
   if (headersKey) parts.push(`headers:${headersKey}`);
   if (fetchFn) parts.push(`fetch:${getTransportFetchFnDisambiguator(fetchFn)}`);
-  if (signal) parts.push(`signal:${getTransportSignalDisambiguator(signal)}`);
-  if (requestTimeoutMs !== void 0) parts.push(`timeout:${requestTimeoutMs}`);
   if (allowPrivateIp !== void 0) parts.push(`allow-private-ip:${allowPrivateIp}`);
   const scopeKey = currentMCPConnectionScopeKey();
   if (scopeKey) parts.push(scopeKey);
@@ -247,39 +254,52 @@ function getCachedOAuthConnection(key) {
   return client;
 }
 async function getOrCreateOAuthConnection(cacheKey, options) {
-  const cached = getCachedOAuthConnection(cacheKey);
-  if (cached) return cached;
-  const pending = pendingOAuthConnections.get(cacheKey);
-  if (pending) return pending;
-  const generation = oauthConnectionGeneration;
-  const promise = connectMCP(options).then(async ({ client }) => {
-    if (generation !== oauthConnectionGeneration) {
-      await closeMCPClient(client).catch(() => {
-      });
-      throw new Error("OAuth MCP connection completed after connection teardown");
+  for (let attempt = 0; ; attempt++) {
+    const cached = getCachedOAuthConnection(cacheKey);
+    if (cached) return cached;
+    const pending = pendingOAuthConnections.get(cacheKey);
+    if (pending) {
+      const joined = await joinPendingConnection(pending, options, attempt);
+      if (joined === RETRY_CONNECT) continue;
+      return joined;
     }
-    oauthConnectionCache.set(cacheKey, client);
-    registerMCPConnectionScopeCleanup("oauth", cacheKey, async () => {
-      if (oauthConnectionCache.get(cacheKey) !== client) return;
-      oauthConnectionCache.delete(cacheKey);
-      await closeMCPClient(client);
+    const generation = oauthConnectionGeneration;
+    const promise = connectMCP(options).then(async ({ client }) => {
+      if (generation !== oauthConnectionGeneration) {
+        await closeMCPClient(client).catch(() => {
+        });
+        throw new Error("OAuth MCP connection completed after connection teardown");
+      }
+      oauthConnectionCache.set(cacheKey, client);
+      registerMCPConnectionScopeCleanup("oauth", cacheKey, async () => {
+        if (oauthConnectionCache.get(cacheKey) !== client) return;
+        oauthConnectionCache.delete(cacheKey);
+        await closeMCPClient(client);
+      });
+      evictLeastRecentlyUsedOAuth();
+      return client;
+    }).finally(() => {
+      if (pendingOAuthConnections.get(cacheKey) === promise) pendingOAuthConnections.delete(cacheKey);
     });
-    evictLeastRecentlyUsedOAuth();
-    return client;
-  }).finally(() => {
-    if (pendingOAuthConnections.get(cacheKey) === promise) pendingOAuthConnections.delete(cacheKey);
-  });
-  pendingOAuthConnections.set(cacheKey, promise);
-  registerMCPConnectionScopePending(promise);
-  return promise;
+    pendingOAuthConnections.set(cacheKey, promise);
+    registerMCPConnectionScopePending(promise);
+    return promise;
+  }
 }
 async function withCachedOAuthConnection(options, label, fn) {
-  const guardedConnection = options.signal !== void 0 || options.requestTimeoutMs !== void 0 || options.fetchFn !== void 0;
+  options = { ...options, customHeaders: withAmbientIdentityHeaders(options.customHeaders) };
+  return runWithMCPCallContext(
+    callContextFor(options.customHeaders, options.requestTimeoutMs),
+    () => withCachedOAuthConnectionImpl(options, label, fn)
+  );
+}
+async function withCachedOAuthConnectionImpl(options, label, fn) {
+  const guardedConnection = options.fetchFn !== void 0;
   if (guardedConnection && currentMCPConnectionScopeKey() === void 0) {
     const { client } = await connectMCP(options);
     let succeeded = false;
     try {
-      const result = await fn(client);
+      const result = await runCallPhase(options.signal, () => fn(client));
       succeeded = true;
       return result;
     } finally {
@@ -293,13 +313,11 @@ async function withCachedOAuthConnection(options, label, fn) {
     options.signingContext?.cacheKey,
     options.customHeaders,
     options.fetchFn,
-    options.signal,
-    options.requestTimeoutMs,
     options.allowPrivateIp
   );
   const mcpClient = await getOrCreateOAuthConnection(cacheKey, options);
   try {
-    return await fn(mcpClient);
+    return await trackConnectionUse(mcpClient, () => runCallPhase(options.signal, () => fn(mcpClient)));
   } catch (error) {
     const errorMessage = error instanceof Error ? error.message : String(error);
     options.debugLogs.push({
@@ -308,52 +326,38 @@ async function withCachedOAuthConnection(options, label, fn) {
       timestamp: (/* @__PURE__ */ new Date()).toISOString(),
       error
     });
+    if (isAbortOrTimeoutError(error)) throw error;
     if (is401Error(error)) {
-      oauthConnectionCache.delete(cacheKey);
-      try {
-        await closeMCPClient(mcpClient, false);
-      } catch {
-      }
       options.debugLogs.push({
         type: "warning",
         message: `MCP: OAuth authentication issue detected for ${label}; evicted cached connection`,
         timestamp: (/* @__PURE__ */ new Date()).toISOString()
       });
-      throw error;
-    }
-    if (isAbortOrTimeoutError(error)) {
-      oauthConnectionCache.delete(cacheKey);
-      try {
-        await closeMCPClient(mcpClient, false);
-      } catch {
-      }
-      throw error;
-    }
-    if (httpStatusOf(error) === 404) {
-      oauthConnectionCache.delete(cacheKey);
-      try {
-        await closeMCPClient(mcpClient, false);
-      } catch {
-      }
-      throw error;
-    }
-    oauthConnectionCache.delete(cacheKey);
-    try {
-      await closeMCPClient(mcpClient, false);
-    } catch {
     }
+    await retireLegacyConnection(oauthConnectionCache, cacheKey, mcpClient);
     throw error;
   }
 }
 async function withCachedConnection(agentUrl, authToken, authHeaders, debugLogs, label, fn, transportFetch, requestOptions = {}) {
+  authHeaders = withAmbientIdentityHeaders(authHeaders);
+  return runWithMCPCallContext(
+    callContextFor(authHeaders, requestOptions.requestTimeoutMs),
+    () => withCachedConnectionImpl(agentUrl, authToken, authHeaders, debugLogs, label, fn, transportFetch, requestOptions)
+  );
+}
+async function withCachedConnectionImpl(agentUrl, authToken, authHeaders, debugLogs, label, fn, transportFetch, requestOptions) {
   const signingContext = signingContextStorage.getStore();
   const baseUrl = new URL(agentUrl);
-  const guardedConnection = transportFetch !== void 0 || requestOptions.signal !== void 0 || requestOptions.requestTimeoutMs !== void 0;
+  const guardedConnection = transportFetch !== void 0;
   if (guardedConnection && currentMCPConnectionScopeKey() === void 0) {
     const client = await connectMCPWithFallback(baseUrl, authHeaders, debugLogs, label, transportFetch, requestOptions);
     let succeeded = false;
     try {
-      const result = await withAbortSignal([requestOptions.signal], void 0, () => fn(client));
+      const result = await withAbortSignal(
+        [requestOptions.signal],
+        void 0,
+        () => runCallPhase(requestOptions.signal, () => fn(client))
+      );
       succeeded = true;
       return result;
     } finally {
@@ -367,8 +371,6 @@ async function withCachedConnection(agentUrl, authToken, authHeaders, debugLogs,
     signingContext?.cacheKey,
     authHeaders,
     transportFetch,
-    requestOptions.signal,
-    requestOptions.requestTimeoutMs,
     requestOptions.allowPrivateIp
   );
   const mcpClient = await getOrCreateConnection(
@@ -381,7 +383,7 @@ async function withCachedConnection(agentUrl, authToken, authHeaders, debugLogs,
     requestOptions
   );
   try {
-    return await fn(mcpClient);
+    return await trackConnectionUse(mcpClient, () => runCallPhase(requestOptions.signal, () => fn(mcpClient)));
   } catch (error) {
     const errorMessage = error instanceof Error ? error.message : String(error);
     debugLogs.push({
@@ -390,48 +392,63 @@ async function withCachedConnection(agentUrl, authToken, authHeaders, debugLogs,
       timestamp: (/* @__PURE__ */ new Date()).toISOString(),
       error
     });
+    if (isAbortOrTimeoutError(error)) throw error;
     if (is401Error(error)) {
-      connectionCache.delete(cacheKey);
-      try {
-        await closeMCPClient(mcpClient, false);
-      } catch {
-      }
       debugLogs.push({
         type: "warning",
         message: `MCP: Authentication issue detected for ${label} - headers may not be reaching server`,
         timestamp: (/* @__PURE__ */ new Date()).toISOString()
       });
-      throw error;
-    }
-    if (isAbortOrTimeoutError(error)) {
-      connectionCache.delete(cacheKey);
-      try {
-        await closeMCPClient(mcpClient, false);
-      } catch {
-      }
-      throw error;
-    }
-    if (httpStatusOf(error) === 404) {
-      connectionCache.delete(cacheKey);
-      try {
-        await closeMCPClient(mcpClient, false);
-      } catch {
-      }
+    } else if (httpStatusOf(error) === 404) {
       debugLogs.push({
         type: "warning",
         message: `MCP: Session not found for ${label}; evicted cached connection without retry`,
         timestamp: (/* @__PURE__ */ new Date()).toISOString()
       });
-      throw error;
-    }
-    connectionCache.delete(cacheKey);
-    try {
-      await closeMCPClient(mcpClient, false);
-    } catch {
     }
+    await retireLegacyConnection(connectionCache, cacheKey, mcpClient);
     throw error;
   }
 }
+async function withScopedLegacyConnection(options, label, fn) {
+  if (currentMCPConnectionScopeKey() === void 0) return void 0;
+  const debugLogs = options.debugLogs ?? [];
+  if (options.authProvider) {
+    return {
+      value: await withCachedOAuthConnection({ ...options, authProvider: options.authProvider, debugLogs }, label, fn)
+    };
+  }
+  const authHeaders = createMCPRequestHeaders(options.customHeaders, options.authToken);
+  return {
+    value: await withCachedConnection(
+      options.agentUrl,
+      options.authToken,
+      authHeaders,
+      debugLogs,
+      label,
+      fn,
+      options.fetchFn,
+      {
+        signal: options.signal,
+        requestTimeoutMs: options.requestTimeoutMs,
+        allowPrivateIp: options.allowPrivateIp
+      }
+    )
+  };
+}
+function callContextFor(headers, requestTimeoutMs) {
+  const { perRequest } = splitConnectionHeaders(headers);
+  const timeoutMs = resolveRequestTimeoutMs(requestTimeoutMs);
+  return {
+    ...Object.keys(perRequest).length > 0 && { headers: perRequest },
+    ...timeoutMs !== void 0 && { requestTimeoutMs: timeoutMs }
+  };
+}
+async function retireLegacyConnection(cache, cacheKey, client) {
+  if (cache.get(cacheKey) === client) cache.delete(cacheKey);
+  await closeWhenIdle(client, () => closeMCPClient(client, false)).catch(() => {
+  });
+}
 function httpStatusOf(error, depth = 0) {
   if (!error || typeof error !== "object" || depth > 4) return void 0;
   const candidate = error;
@@ -441,6 +458,7 @@ function httpStatusOf(error, depth = 0) {
   return httpStatusOf(candidate.cause, depth + 1);
 }
 async function connectMCPWithFallback(url, authHeaders, debugLogs = [], label = "connection", transportFetch, requestOptions = {}) {
+  authHeaders = withAmbientIdentityHeaders(authHeaders);
   return withSpan(
     "adcp.mcp.connect",
     {
@@ -463,11 +481,15 @@ async function connectMCPWithFallbackImpl(url, authHeaders, debugLogs = [], labe
     trustedFetchFn: transportFetch,
     allowPrivateIp: requestOptions.allowPrivateIp
   });
-  const networkFetch = (input, init) => {
-    const signals = [init?.signal ?? void 0].filter((signal2) => signal2 !== void 0);
-    const signal = signals.length === 0 ? void 0 : signals.length === 1 ? signals[0] : AbortSignal.any(signals);
-    return rawNetworkFetch(input, { ...init, signal });
-  };
+  const networkFetch = (input, init) => (
+    // Cancellation stays linked for the entire response-body lifetime, through
+    // `init.signal`: the v1 transport does not forward a request's own signal, so
+    // the active call's signal is linked to that call's POST at the outermost
+    // transport wrapper (aborting one call cancels its HTTP request without
+    // closing a session other calls share). The background GET/SSE listener
+    // never carries a call signal.
+    rawNetworkFetch(input, { ...init, signal: init?.signal ?? void 0 })
+  );
   const sizeLimited = wrapFetchWithSizeLimit(networkFetch);
   const diagnosticFetch = wrapFetchWithTransportDiagnostics(sizeLimited);
   const baseFetch = signingContext ? buildAgentSigningFetch({
@@ -477,8 +499,8 @@ async function connectMCPWithFallbackImpl(url, authHeaders, debugLogs = [], labe
     adcpVersion: signingContext.adcpVersion
   }) : diagnosticFetch;
   const transportOptions = {
-    requestInit: { headers: authHeaders, redirect: "manual" },
-    fetch: wrapFetchWithCapture(withPerRequestTraceHeaders(baseFetch))
+    requestInit: { headers: splitConnectionHeaders(authHeaders).identity, redirect: "manual" },
+    fetch: wrapFetchWithCapture(withPerRequestTraceHeaders(baseFetch, splitConnectionHeaders(authHeaders).perRequest))
   };
   let failedClient;
   try {
@@ -572,8 +594,10 @@ async function connectMCPWithFallbackImpl(url, authHeaders, debugLogs = [], labe
     try {
       await client.connect(
         new SSEClientTransport(url, {
-          requestInit: { headers: authHeaders, redirect: "manual" },
-          fetch: wrapFetchWithCapture(withPerRequestTraceHeaders(baseFetch))
+          requestInit: { headers: splitConnectionHeaders(authHeaders).identity, redirect: "manual" },
+          fetch: wrapFetchWithCapture(
+            withPerRequestTraceHeaders(baseFetch, splitConnectionHeaders(authHeaders).perRequest)
+          )
         }),
         mcpRequestOptions
       );
@@ -720,11 +744,11 @@ async function connectMCP(options) {
       return normalized !== "authorization" && normalized !== "x-adcp-auth";
     })
   ) : customHeaders;
-  const authHeaders = createMCPRequestHeaders(filteredCustomHeaders, authToken);
+  const authHeaders = withAmbientIdentityHeaders(createMCPRequestHeaders(filteredCustomHeaders, authToken));
   const hasNonAcceptCustomHeaders = Object.keys(filteredCustomHeaders ?? {}).some(
     (key) => key.toLowerCase() !== "accept"
   );
-  transportOptions.requestInit = { headers: authHeaders, redirect: "manual" };
+  transportOptions.requestInit = { headers: splitConnectionHeaders(authHeaders).identity, redirect: "manual" };
   if (authProvider) {
     transportOptions.authProvider = authProvider;
     debugLogs.push({
@@ -745,18 +769,27 @@ async function connectMCP(options) {
       timestamp: (/* @__PURE__ */ new Date()).toISOString()
     });
   }
-  const requestTimeoutMs = resolveRequestTimeoutMs(configuredRequestTimeoutMs);
   const clientRequestTimeoutMs = resolveClientRequestTimeoutMs(configuredRequestTimeoutMs);
+  const directRequestTimeoutMs = resolveRequestTimeoutMs(configuredRequestTimeoutMs);
   const requestOptions = {
     ...signal && { signal },
     ...clientRequestTimeoutMs !== void 0 && { timeout: clientRequestTimeoutMs }
   };
   const rawNetworkFetch = createAgentTransportFetch(agentUrl, { trustedFetchFn: fetchFn, allowPrivateIp });
   const sizeLimited = wrapFetchWithSizeLimit(
-    (input, init) => withAbortSignal(
-      [init?.signal],
-      requestTimeoutMs,
-      (linkedSignal) => rawNetworkFetch(input, { ...init, signal: linkedSignal })
+    (input, init) => (
+      // Inside a call context the deadline is that call's; a direct caller who
+      // holds the returned client keeps the timeout configured on connect. The
+      // call's own signal is already linked into `init.signal` for the whole
+      // response body, so aborting one call cancels its streamed POST only.
+      withAbortSignal(
+        [init?.signal],
+        requestTimeoutFor(init, directRequestTimeoutMs),
+        (deadline) => rawNetworkFetch(input, {
+          ...init,
+          signal: init?.signal && deadline ? AbortSignal.any([init.signal, deadline]) : deadline ?? init?.signal
+        })
+      )
     )
   );
   const diagnosticFetch = wrapFetchWithTransportDiagnostics(sizeLimited);
@@ -766,7 +799,9 @@ async function connectMCP(options) {
     getCapability: signingContext.getCapability,
     adcpVersion: signingContext.adcpVersion
   }) : diagnosticFetch;
-  transportOptions.fetch = wrapFetchWithCapture(withPerRequestTraceHeaders(signedFetch));
+  transportOptions.fetch = wrapFetchWithCapture(
+    withPerRequestTraceHeaders(signedFetch, splitConnectionHeaders(authHeaders).perRequest)
+  );
   const transport = new StreamableHTTPClientTransport(baseUrl, transportOptions);
   try {
     await mcpClient.connect(transport, requestOptions);
@@ -889,5 +924,6 @@ export {
   closeOAuthConnections,
   connectMCP,
   connectMCPWithFallback,
-  withCachedConnection
+  withCachedConnection,
+  withScopedLegacyConnection
 };

package/dist/lib/protocols/transportDiagnostics.d.mts

@@ -1,4 +1,19 @@
-export type TransportActivityType = 'request_started' | 'response_received' | 'request_failed';
+/**
+ * Lifecycle events for one transport request.
+ *
+ * - `request_started`: the request is about to be sent.
+ * - `response_received`: response **headers** arrived. For captured bodies,
+ *   dispatch waits for the bounded preview. Its `durationMs` is time to
+ *   headers, not time to completion; it does not mean the reply finished.
+ * - `response_completed`: the caller finished with a response body that was not
+ *   captured (SSE, no finite declared length, non-text, or over the capture
+ *   limit). Emitted at most once, with an `outcome`, total `bytes` and total
+ *   `durationMs`.
+ * - `request_failed`: the request failed before response headers arrived.
+ */
+export type TransportActivityType = 'request_started' | 'response_received' | 'response_completed' | 'request_failed';
+/** How an uncaptured response body finished. */
+export type TransportResponseOutcome = 'ended' | 'errored' | 'aborted' | 'cancelled';
 export interface TransportActivityContext {
     agentId: string;
     protocol: 'mcp' | 'a2a';
@@ -34,6 +49,23 @@ export interface TransportActivity {
     responseHeaders?: Record<string, string>;
     responseBody?: string;
     responseBodyTruncated?: boolean;
+    /**
+     * On `response_received`: `true` when the body is streamed uncaptured, so a
+     * `response_completed` event will follow once the caller finishes reading,
+     * cancels, or aborts it. The event then means "headers received", not
+     * "reply finished".
+     */
+    streaming?: boolean;
+    /**
+     * On `response_completed`: how the body ended. `ended` is EOF, `errored` is a
+     * stream error, `aborted` is an `AbortSignal` abort (including a cancel after the
+     * signal fired) or abort-style error, and `cancelled` is the consumer
+     * cancelling the body without an abort, including SDK cleanup after it has
+     * delivered a successful MCP result.
+     */
+    outcome?: TransportResponseOutcome;
+    /** On `response_completed`: body bytes that passed through before the outcome. */
+    bytes?: number;
     errorName?: string;
     errorMessage?: string;
 }

package/dist/lib/protocols/transportDiagnostics.d.ts

@@ -1,4 +1,19 @@
-export type TransportActivityType = 'request_started' | 'response_received' | 'request_failed';
+/**
+ * Lifecycle events for one transport request.
+ *
+ * - `request_started`: the request is about to be sent.
+ * - `response_received`: response **headers** arrived. For captured bodies,
+ *   dispatch waits for the bounded preview. Its `durationMs` is time to
+ *   headers, not time to completion; it does not mean the reply finished.
+ * - `response_completed`: the caller finished with a response body that was not
+ *   captured (SSE, no finite declared length, non-text, or over the capture
+ *   limit). Emitted at most once, with an `outcome`, total `bytes` and total
+ *   `durationMs`.
+ * - `request_failed`: the request failed before response headers arrived.
+ */
+export type TransportActivityType = 'request_started' | 'response_received' | 'response_completed' | 'request_failed';
+/** How an uncaptured response body finished. */
+export type TransportResponseOutcome = 'ended' | 'errored' | 'aborted' | 'cancelled';
 export interface TransportActivityContext {
     agentId: string;
     protocol: 'mcp' | 'a2a';
@@ -34,6 +49,23 @@ export interface TransportActivity {
     responseHeaders?: Record<string, string>;
     responseBody?: string;
     responseBodyTruncated?: boolean;
+    /**
+     * On `response_received`: `true` when the body is streamed uncaptured, so a
+     * `response_completed` event will follow once the caller finishes reading,
+     * cancels, or aborts it. The event then means "headers received", not
+     * "reply finished".
+     */
+    streaming?: boolean;
+    /**
+     * On `response_completed`: how the body ended. `ended` is EOF, `errored` is a
+     * stream error, `aborted` is an `AbortSignal` abort (including a cancel after the
+     * signal fired) or abort-style error, and `cancelled` is the consumer
+     * cancelling the body without an abort, including SDK cleanup after it has
+     * delivered a successful MCP result.
+     */
+    outcome?: TransportResponseOutcome;
+    /** On `response_completed`: body bytes that passed through before the outcome. */
+    bytes?: number;
     errorName?: string;
     errorMessage?: string;
 }