@adcp/sdk 15.4.0 → 15.6.0

package/dist/lib/protocols/mcp.js

@@ -26,7 +26,8 @@ __export(mcp_exports, {
   closeOAuthConnections: () => closeOAuthConnections,
   connectMCP: () => connectMCP,
   connectMCPWithFallback: () => connectMCPWithFallback,
-  withCachedConnection: () => withCachedConnection
+  withCachedConnection: () => withCachedConnection,
+  withScopedLegacyConnection: () => withScopedLegacyConnection
 });
 module.exports = __toCommonJS(mcp_exports);
 var import_client = require("@modelcontextprotocol/sdk/client/index.js");
@@ -48,6 +49,7 @@ var import_abort = require('./abort.js');
 var import_mcp_modern = require('./mcp-modern.js');
 var import_mcp_scope = require('./mcp-scope.js');
 var import_session_termination = require('./session-termination.js');
+var import_mcp_call_context = require('./mcp-call-context.js');
 var import_agent_transport_fetch = require('../net/agent-transport-fetch.js');
 const connectionCache = /* @__PURE__ */ new Map();
 const pendingConnections = /* @__PURE__ */ new Map();
@@ -56,11 +58,9 @@ const pendingOAuthConnections = /* @__PURE__ */ new Map();
 const streamableTransports = /* @__PURE__ */ new WeakMap();
 const oauthProviderIds = /* @__PURE__ */ new WeakMap();
 const transportFetchFnIds = /* @__PURE__ */ new WeakMap();
-const transportSignalIds = /* @__PURE__ */ new WeakMap();
 const MAX_CACHED_CONNECTIONS = 20;
 let nextOAuthProviderId = 0;
 let nextTransportFetchFnId = 0;
-let nextTransportSignalId = 0;
 let connectionGeneration = 0;
 let oauthConnectionGeneration = 0;
 async function closeMCPClient(client, terminateSession = true) {
@@ -80,7 +80,7 @@ function trackStreamableHTTPUrl(url) {
     if (oldest) knownStreamableHTTPUrls.delete(oldest);
   }
 }
-function connectionCacheKey(agentUrl, authToken, signingCacheKey, authHeaders, transportFetch, signal, requestTimeoutMs, allowPrivateIp) {
+function connectionCacheKey(agentUrl, authToken, signingCacheKey, authHeaders, transportFetch, allowPrivateIp) {
   const parts = [agentUrl];
   const fingerprint = authToken ?? extractAuthHeader(authHeaders);
   if (fingerprint) parts.push(cacheDisambiguator(fingerprint));
@@ -88,8 +88,6 @@ function connectionCacheKey(agentUrl, authToken, signingCacheKey, authHeaders, t
   if (headersKey) parts.push(`headers:${headersKey}`);
   if (signingCacheKey) parts.push(signingCacheKey);
   if (transportFetch) parts.push(`fetch:${getTransportFetchFnDisambiguator(transportFetch)}`);
-  if (signal) parts.push(`signal:${getTransportSignalDisambiguator(signal)}`);
-  if (requestTimeoutMs !== void 0) parts.push(`timeout:${requestTimeoutMs}`);
   if (allowPrivateIp !== void 0) parts.push(`allow-private-ip:${allowPrivateIp}`);
   const scopeKey = (0, import_mcp_scope.currentMCPConnectionScopeKey)();
   if (scopeKey) parts.push(scopeKey);
@@ -107,18 +105,19 @@ function extractAuthHeader(headers) {
   return void 0;
 }
 function headersCacheDisambiguator(headers) {
-  const entries = Object.entries(headers ?? {}).filter(([key]) => {
-    const lower = key.toLowerCase();
-    return lower !== "traceparent" && lower !== "tracestate" && lower !== "baggage";
-  }).map(([key, value]) => [key.toLowerCase(), value]).sort(([a], [b]) => a.localeCompare(b));
+  const entries = Object.entries((0, import_mcp_call_context.splitConnectionHeaders)(headers).identity).map(([key, value]) => [key.toLowerCase(), value]).sort(([a], [b]) => a.localeCompare(b));
   return entries.length > 0 ? cacheDisambiguator(JSON.stringify(entries)) : void 0;
 }
-function withPerRequestTraceHeaders(fetchImpl) {
+function withPerRequestTraceHeaders(fetchImpl, directDefaults) {
   return (input, init) => {
     const headers = new Headers(input instanceof Request ? input.headers : void 0);
     new Headers(init?.headers).forEach((value, key) => headers.set(key, value));
-    for (const [key, value] of Object.entries((0, import_tracing.injectTraceHeaders)())) headers.set(key, value);
-    return fetchImpl(input, { ...init, headers });
+    (0, import_mcp_call_context.applyMCPCallHeaders)(headers, directDefaults);
+    if (headers.has("traceparent")) return fetchImpl(input, { ...init, headers, ...(0, import_mcp_call_context.linkedCallSignal)(init) });
+    for (const [key, value] of Object.entries((0, import_tracing.injectTraceHeaders)())) {
+      if ((0, import_mcp_call_context.isCorrelationHeader)(key) && !headers.has(key)) headers.set(key, value);
+    }
+    return fetchImpl(input, { ...init, headers, ...(0, import_mcp_call_context.linkedCallSignal)(init) });
   };
 }
 function getCachedConnection(key) {
@@ -135,7 +134,7 @@ function evictLeastRecentlyUsed() {
   if (!lruKey) return;
   const oldClient = connectionCache.get(lruKey);
   connectionCache.delete(lruKey);
-  if (oldClient) void closeMCPClient(oldClient).catch(() => {
+  if (oldClient) void (0, import_mcp_call_context.closeWhenIdle)(oldClient, () => closeMCPClient(oldClient)).catch(() => {
   });
 }
 function evictLeastRecentlyUsedOAuth() {
@@ -144,7 +143,7 @@ function evictLeastRecentlyUsedOAuth() {
   if (!lruKey) return;
   const oldClient = oauthConnectionCache.get(lruKey);
   oauthConnectionCache.delete(lruKey);
-  if (oldClient) void closeMCPClient(oldClient).catch(() => {
+  if (oldClient) void (0, import_mcp_call_context.closeWhenIdle)(oldClient, () => closeMCPClient(oldClient)).catch(() => {
   });
 }
 async function closeOAuthConnections() {
@@ -185,31 +184,37 @@ async function closeMCPConnections() {
   await (0, import_mcp_modern.closeModernMCPConnections)();
 }
 async function getOrCreateConnection(cacheKey, baseUrl, authHeaders, debugLogs, label, transportFetch, requestOptions = {}) {
-  const cached = getCachedConnection(cacheKey);
-  if (cached) return cached;
-  const pending = pendingConnections.get(cacheKey);
-  if (pending) return pending;
-  const generation = connectionGeneration;
-  const promise = connectMCPWithFallback(baseUrl, authHeaders, debugLogs, label, transportFetch, requestOptions).then(async (client) => {
-    if (generation !== connectionGeneration) {
-      await closeMCPClient(client).catch(() => {
-      });
-      throw new Error(`MCP ${label} completed after connection teardown`);
+  for (let attempt = 0; ; attempt++) {
+    const cached = getCachedConnection(cacheKey);
+    if (cached) return cached;
+    const pending = pendingConnections.get(cacheKey);
+    if (pending) {
+      const joined = await (0, import_mcp_call_context.joinPendingConnection)(pending, requestOptions, attempt);
+      if (joined === import_mcp_call_context.RETRY_CONNECT) continue;
+      return joined;
     }
-    connectionCache.set(cacheKey, client);
-    (0, import_mcp_scope.registerMCPConnectionScopeCleanup)("legacy", cacheKey, async () => {
-      if (connectionCache.get(cacheKey) !== client) return;
-      connectionCache.delete(cacheKey);
-      await closeMCPClient(client);
+    const generation = connectionGeneration;
+    const promise = connectMCPWithFallback(baseUrl, authHeaders, debugLogs, label, transportFetch, requestOptions).then(async (client) => {
+      if (generation !== connectionGeneration) {
+        await closeMCPClient(client).catch(() => {
+        });
+        throw new Error(`MCP ${label} completed after connection teardown`);
+      }
+      connectionCache.set(cacheKey, client);
+      (0, import_mcp_scope.registerMCPConnectionScopeCleanup)("legacy", cacheKey, async () => {
+        if (connectionCache.get(cacheKey) !== client) return;
+        connectionCache.delete(cacheKey);
+        await closeMCPClient(client);
+      });
+      evictLeastRecentlyUsed();
+      return client;
+    }).finally(() => {
+      if (pendingConnections.get(cacheKey) === promise) pendingConnections.delete(cacheKey);
     });
-    evictLeastRecentlyUsed();
-    return client;
-  }).finally(() => {
-    if (pendingConnections.get(cacheKey) === promise) pendingConnections.delete(cacheKey);
-  });
-  pendingConnections.set(cacheKey, promise);
-  (0, import_mcp_scope.registerMCPConnectionScopePending)(promise);
-  return promise;
+    pendingConnections.set(cacheKey, promise);
+    (0, import_mcp_scope.registerMCPConnectionScopePending)(promise);
+    return promise;
+  }
 }
 function getOAuthProviderDisambiguator(authProvider) {
   let id = oauthProviderIds.get(authProvider);
@@ -227,25 +232,15 @@ function getTransportFetchFnDisambiguator(fetchFn) {
   }
   return id;
 }
-function getTransportSignalDisambiguator(signal) {
-  let id = transportSignalIds.get(signal);
-  if (!id) {
-    id = cacheDisambiguator(`transport-signal:${++nextTransportSignalId}`);
-    transportSignalIds.set(signal, id);
-  }
-  return id;
-}
 function customHeadersDisambiguator(customHeaders) {
   return headersCacheDisambiguator(customHeaders);
 }
-function oauthConnectionCacheKey(agentUrl, authProvider, signingCacheKey, customHeaders, fetchFn, signal, requestTimeoutMs, allowPrivateIp) {
+function oauthConnectionCacheKey(agentUrl, authProvider, signingCacheKey, customHeaders, fetchFn, allowPrivateIp) {
   const parts = [`${agentUrl}::oauth:${getOAuthProviderDisambiguator(authProvider)}`];
   if (signingCacheKey) parts.push(signingCacheKey);
   const headersKey = customHeadersDisambiguator(customHeaders);
   if (headersKey) parts.push(`headers:${headersKey}`);
   if (fetchFn) parts.push(`fetch:${getTransportFetchFnDisambiguator(fetchFn)}`);
-  if (signal) parts.push(`signal:${getTransportSignalDisambiguator(signal)}`);
-  if (requestTimeoutMs !== void 0) parts.push(`timeout:${requestTimeoutMs}`);
   if (allowPrivateIp !== void 0) parts.push(`allow-private-ip:${allowPrivateIp}`);
   const scopeKey = (0, import_mcp_scope.currentMCPConnectionScopeKey)();
   if (scopeKey) parts.push(scopeKey);
@@ -260,39 +255,52 @@ function getCachedOAuthConnection(key) {
   return client;
 }
 async function getOrCreateOAuthConnection(cacheKey, options) {
-  const cached = getCachedOAuthConnection(cacheKey);
-  if (cached) return cached;
-  const pending = pendingOAuthConnections.get(cacheKey);
-  if (pending) return pending;
-  const generation = oauthConnectionGeneration;
-  const promise = connectMCP(options).then(async ({ client }) => {
-    if (generation !== oauthConnectionGeneration) {
-      await closeMCPClient(client).catch(() => {
-      });
-      throw new Error("OAuth MCP connection completed after connection teardown");
+  for (let attempt = 0; ; attempt++) {
+    const cached = getCachedOAuthConnection(cacheKey);
+    if (cached) return cached;
+    const pending = pendingOAuthConnections.get(cacheKey);
+    if (pending) {
+      const joined = await (0, import_mcp_call_context.joinPendingConnection)(pending, options, attempt);
+      if (joined === import_mcp_call_context.RETRY_CONNECT) continue;
+      return joined;
     }
-    oauthConnectionCache.set(cacheKey, client);
-    (0, import_mcp_scope.registerMCPConnectionScopeCleanup)("oauth", cacheKey, async () => {
-      if (oauthConnectionCache.get(cacheKey) !== client) return;
-      oauthConnectionCache.delete(cacheKey);
-      await closeMCPClient(client);
+    const generation = oauthConnectionGeneration;
+    const promise = connectMCP(options).then(async ({ client }) => {
+      if (generation !== oauthConnectionGeneration) {
+        await closeMCPClient(client).catch(() => {
+        });
+        throw new Error("OAuth MCP connection completed after connection teardown");
+      }
+      oauthConnectionCache.set(cacheKey, client);
+      (0, import_mcp_scope.registerMCPConnectionScopeCleanup)("oauth", cacheKey, async () => {
+        if (oauthConnectionCache.get(cacheKey) !== client) return;
+        oauthConnectionCache.delete(cacheKey);
+        await closeMCPClient(client);
+      });
+      evictLeastRecentlyUsedOAuth();
+      return client;
+    }).finally(() => {
+      if (pendingOAuthConnections.get(cacheKey) === promise) pendingOAuthConnections.delete(cacheKey);
     });
-    evictLeastRecentlyUsedOAuth();
-    return client;
-  }).finally(() => {
-    if (pendingOAuthConnections.get(cacheKey) === promise) pendingOAuthConnections.delete(cacheKey);
-  });
-  pendingOAuthConnections.set(cacheKey, promise);
-  (0, import_mcp_scope.registerMCPConnectionScopePending)(promise);
-  return promise;
+    pendingOAuthConnections.set(cacheKey, promise);
+    (0, import_mcp_scope.registerMCPConnectionScopePending)(promise);
+    return promise;
+  }
 }
 async function withCachedOAuthConnection(options, label, fn) {
-  const guardedConnection = options.signal !== void 0 || options.requestTimeoutMs !== void 0 || options.fetchFn !== void 0;
+  options = { ...options, customHeaders: (0, import_mcp_call_context.withAmbientIdentityHeaders)(options.customHeaders) };
+  return (0, import_mcp_call_context.runWithMCPCallContext)(
+    callContextFor(options.customHeaders, options.requestTimeoutMs),
+    () => withCachedOAuthConnectionImpl(options, label, fn)
+  );
+}
+async function withCachedOAuthConnectionImpl(options, label, fn) {
+  const guardedConnection = options.fetchFn !== void 0;
   if (guardedConnection && (0, import_mcp_scope.currentMCPConnectionScopeKey)() === void 0) {
     const { client } = await connectMCP(options);
     let succeeded = false;
     try {
-      const result = await fn(client);
+      const result = await (0, import_mcp_call_context.runCallPhase)(options.signal, () => fn(client));
       succeeded = true;
       return result;
     } finally {
@@ -306,13 +314,11 @@ async function withCachedOAuthConnection(options, label, fn) {
     options.signingContext?.cacheKey,
     options.customHeaders,
     options.fetchFn,
-    options.signal,
-    options.requestTimeoutMs,
     options.allowPrivateIp
   );
   const mcpClient = await getOrCreateOAuthConnection(cacheKey, options);
   try {
-    return await fn(mcpClient);
+    return await (0, import_mcp_call_context.trackConnectionUse)(mcpClient, () => (0, import_mcp_call_context.runCallPhase)(options.signal, () => fn(mcpClient)));
   } catch (error) {
     const errorMessage = error instanceof Error ? error.message : String(error);
     options.debugLogs.push({
@@ -321,52 +327,38 @@ async function withCachedOAuthConnection(options, label, fn) {
       timestamp: (/* @__PURE__ */ new Date()).toISOString(),
       error
     });
+    if ((0, import_abort.isAbortOrTimeoutError)(error)) throw error;
     if ((0, import_errors.is401Error)(error)) {
-      oauthConnectionCache.delete(cacheKey);
-      try {
-        await closeMCPClient(mcpClient, false);
-      } catch {
-      }
       options.debugLogs.push({
         type: "warning",
         message: `MCP: OAuth authentication issue detected for ${label}; evicted cached connection`,
         timestamp: (/* @__PURE__ */ new Date()).toISOString()
       });
-      throw error;
-    }
-    if ((0, import_abort.isAbortOrTimeoutError)(error)) {
-      oauthConnectionCache.delete(cacheKey);
-      try {
-        await closeMCPClient(mcpClient, false);
-      } catch {
-      }
-      throw error;
-    }
-    if (httpStatusOf(error) === 404) {
-      oauthConnectionCache.delete(cacheKey);
-      try {
-        await closeMCPClient(mcpClient, false);
-      } catch {
-      }
-      throw error;
-    }
-    oauthConnectionCache.delete(cacheKey);
-    try {
-      await closeMCPClient(mcpClient, false);
-    } catch {
     }
+    await retireLegacyConnection(oauthConnectionCache, cacheKey, mcpClient);
     throw error;
   }
 }
 async function withCachedConnection(agentUrl, authToken, authHeaders, debugLogs, label, fn, transportFetch, requestOptions = {}) {
+  authHeaders = (0, import_mcp_call_context.withAmbientIdentityHeaders)(authHeaders);
+  return (0, import_mcp_call_context.runWithMCPCallContext)(
+    callContextFor(authHeaders, requestOptions.requestTimeoutMs),
+    () => withCachedConnectionImpl(agentUrl, authToken, authHeaders, debugLogs, label, fn, transportFetch, requestOptions)
+  );
+}
+async function withCachedConnectionImpl(agentUrl, authToken, authHeaders, debugLogs, label, fn, transportFetch, requestOptions) {
   const signingContext = import_client2.signingContextStorage.getStore();
   const baseUrl = new URL(agentUrl);
-  const guardedConnection = transportFetch !== void 0 || requestOptions.signal !== void 0 || requestOptions.requestTimeoutMs !== void 0;
+  const guardedConnection = transportFetch !== void 0;
   if (guardedConnection && (0, import_mcp_scope.currentMCPConnectionScopeKey)() === void 0) {
     const client = await connectMCPWithFallback(baseUrl, authHeaders, debugLogs, label, transportFetch, requestOptions);
     let succeeded = false;
     try {
-      const result = await (0, import_abort.withAbortSignal)([requestOptions.signal], void 0, () => fn(client));
+      const result = await (0, import_abort.withAbortSignal)(
+        [requestOptions.signal],
+        void 0,
+        () => (0, import_mcp_call_context.runCallPhase)(requestOptions.signal, () => fn(client))
+      );
       succeeded = true;
       return result;
     } finally {
@@ -380,8 +372,6 @@ async function withCachedConnection(agentUrl, authToken, authHeaders, debugLogs,
     signingContext?.cacheKey,
     authHeaders,
     transportFetch,
-    requestOptions.signal,
-    requestOptions.requestTimeoutMs,
     requestOptions.allowPrivateIp
   );
   const mcpClient = await getOrCreateConnection(
@@ -394,7 +384,7 @@ async function withCachedConnection(agentUrl, authToken, authHeaders, debugLogs,
     requestOptions
   );
   try {
-    return await fn(mcpClient);
+    return await (0, import_mcp_call_context.trackConnectionUse)(mcpClient, () => (0, import_mcp_call_context.runCallPhase)(requestOptions.signal, () => fn(mcpClient)));
   } catch (error) {
     const errorMessage = error instanceof Error ? error.message : String(error);
     debugLogs.push({
@@ -403,48 +393,63 @@ async function withCachedConnection(agentUrl, authToken, authHeaders, debugLogs,
       timestamp: (/* @__PURE__ */ new Date()).toISOString(),
       error
     });
+    if ((0, import_abort.isAbortOrTimeoutError)(error)) throw error;
     if ((0, import_errors.is401Error)(error)) {
-      connectionCache.delete(cacheKey);
-      try {
-        await closeMCPClient(mcpClient, false);
-      } catch {
-      }
       debugLogs.push({
         type: "warning",
         message: `MCP: Authentication issue detected for ${label} - headers may not be reaching server`,
         timestamp: (/* @__PURE__ */ new Date()).toISOString()
       });
-      throw error;
-    }
-    if ((0, import_abort.isAbortOrTimeoutError)(error)) {
-      connectionCache.delete(cacheKey);
-      try {
-        await closeMCPClient(mcpClient, false);
-      } catch {
-      }
-      throw error;
-    }
-    if (httpStatusOf(error) === 404) {
-      connectionCache.delete(cacheKey);
-      try {
-        await closeMCPClient(mcpClient, false);
-      } catch {
-      }
+    } else if (httpStatusOf(error) === 404) {
       debugLogs.push({
         type: "warning",
         message: `MCP: Session not found for ${label}; evicted cached connection without retry`,
         timestamp: (/* @__PURE__ */ new Date()).toISOString()
       });
-      throw error;
-    }
-    connectionCache.delete(cacheKey);
-    try {
-      await closeMCPClient(mcpClient, false);
-    } catch {
     }
+    await retireLegacyConnection(connectionCache, cacheKey, mcpClient);
     throw error;
   }
 }
+async function withScopedLegacyConnection(options, label, fn) {
+  if ((0, import_mcp_scope.currentMCPConnectionScopeKey)() === void 0) return void 0;
+  const debugLogs = options.debugLogs ?? [];
+  if (options.authProvider) {
+    return {
+      value: await withCachedOAuthConnection({ ...options, authProvider: options.authProvider, debugLogs }, label, fn)
+    };
+  }
+  const authHeaders = (0, import_auth2.createMCPRequestHeaders)(options.customHeaders, options.authToken);
+  return {
+    value: await withCachedConnection(
+      options.agentUrl,
+      options.authToken,
+      authHeaders,
+      debugLogs,
+      label,
+      fn,
+      options.fetchFn,
+      {
+        signal: options.signal,
+        requestTimeoutMs: options.requestTimeoutMs,
+        allowPrivateIp: options.allowPrivateIp
+      }
+    )
+  };
+}
+function callContextFor(headers, requestTimeoutMs) {
+  const { perRequest } = (0, import_mcp_call_context.splitConnectionHeaders)(headers);
+  const timeoutMs = (0, import_abort.resolveRequestTimeoutMs)(requestTimeoutMs);
+  return {
+    ...Object.keys(perRequest).length > 0 && { headers: perRequest },
+    ...timeoutMs !== void 0 && { requestTimeoutMs: timeoutMs }
+  };
+}
+async function retireLegacyConnection(cache, cacheKey, client) {
+  if (cache.get(cacheKey) === client) cache.delete(cacheKey);
+  await (0, import_mcp_call_context.closeWhenIdle)(client, () => closeMCPClient(client, false)).catch(() => {
+  });
+}
 function httpStatusOf(error, depth = 0) {
   if (!error || typeof error !== "object" || depth > 4) return void 0;
   const candidate = error;
@@ -454,6 +459,7 @@ function httpStatusOf(error, depth = 0) {
   return httpStatusOf(candidate.cause, depth + 1);
 }
 async function connectMCPWithFallback(url, authHeaders, debugLogs = [], label = "connection", transportFetch, requestOptions = {}) {
+  authHeaders = (0, import_mcp_call_context.withAmbientIdentityHeaders)(authHeaders);
   return (0, import_tracing.withSpan)(
     "adcp.mcp.connect",
     {
@@ -476,11 +482,15 @@ async function connectMCPWithFallbackImpl(url, authHeaders, debugLogs = [], labe
     trustedFetchFn: transportFetch,
     allowPrivateIp: requestOptions.allowPrivateIp
   });
-  const networkFetch = (input, init) => {
-    const signals = [init?.signal ?? void 0].filter((signal2) => signal2 !== void 0);
-    const signal = signals.length === 0 ? void 0 : signals.length === 1 ? signals[0] : AbortSignal.any(signals);
-    return rawNetworkFetch(input, { ...init, signal });
-  };
+  const networkFetch = (input, init) => (
+    // Cancellation stays linked for the entire response-body lifetime, through
+    // `init.signal`: the v1 transport does not forward a request's own signal, so
+    // the active call's signal is linked to that call's POST at the outermost
+    // transport wrapper (aborting one call cancels its HTTP request without
+    // closing a session other calls share). The background GET/SSE listener
+    // never carries a call signal.
+    rawNetworkFetch(input, { ...init, signal: init?.signal ?? void 0 })
+  );
   const sizeLimited = (0, import_responseSizeLimit.wrapFetchWithSizeLimit)(networkFetch);
   const diagnosticFetch = (0, import_transportDiagnostics.wrapFetchWithTransportDiagnostics)(sizeLimited);
   const baseFetch = signingContext ? (0, import_client2.buildAgentSigningFetch)({
@@ -490,8 +500,8 @@ async function connectMCPWithFallbackImpl(url, authHeaders, debugLogs = [], labe
     adcpVersion: signingContext.adcpVersion
   }) : diagnosticFetch;
   const transportOptions = {
-    requestInit: { headers: authHeaders, redirect: "manual" },
-    fetch: (0, import_rawResponseCapture.wrapFetchWithCapture)(withPerRequestTraceHeaders(baseFetch))
+    requestInit: { headers: (0, import_mcp_call_context.splitConnectionHeaders)(authHeaders).identity, redirect: "manual" },
+    fetch: (0, import_rawResponseCapture.wrapFetchWithCapture)(withPerRequestTraceHeaders(baseFetch, (0, import_mcp_call_context.splitConnectionHeaders)(authHeaders).perRequest))
   };
   let failedClient;
   try {
@@ -585,8 +595,10 @@ async function connectMCPWithFallbackImpl(url, authHeaders, debugLogs = [], labe
     try {
       await client.connect(
         new import_sse.SSEClientTransport(url, {
-          requestInit: { headers: authHeaders, redirect: "manual" },
-          fetch: (0, import_rawResponseCapture.wrapFetchWithCapture)(withPerRequestTraceHeaders(baseFetch))
+          requestInit: { headers: (0, import_mcp_call_context.splitConnectionHeaders)(authHeaders).identity, redirect: "manual" },
+          fetch: (0, import_rawResponseCapture.wrapFetchWithCapture)(
+            withPerRequestTraceHeaders(baseFetch, (0, import_mcp_call_context.splitConnectionHeaders)(authHeaders).perRequest)
+          )
         }),
         mcpRequestOptions
       );
@@ -733,11 +745,11 @@ async function connectMCP(options) {
       return normalized !== "authorization" && normalized !== "x-adcp-auth";
     })
   ) : customHeaders;
-  const authHeaders = (0, import_auth2.createMCPRequestHeaders)(filteredCustomHeaders, authToken);
+  const authHeaders = (0, import_mcp_call_context.withAmbientIdentityHeaders)((0, import_auth2.createMCPRequestHeaders)(filteredCustomHeaders, authToken));
   const hasNonAcceptCustomHeaders = Object.keys(filteredCustomHeaders ?? {}).some(
     (key) => key.toLowerCase() !== "accept"
   );
-  transportOptions.requestInit = { headers: authHeaders, redirect: "manual" };
+  transportOptions.requestInit = { headers: (0, import_mcp_call_context.splitConnectionHeaders)(authHeaders).identity, redirect: "manual" };
   if (authProvider) {
     transportOptions.authProvider = authProvider;
     debugLogs.push({
@@ -758,18 +770,27 @@ async function connectMCP(options) {
       timestamp: (/* @__PURE__ */ new Date()).toISOString()
     });
   }
-  const requestTimeoutMs = (0, import_abort.resolveRequestTimeoutMs)(configuredRequestTimeoutMs);
   const clientRequestTimeoutMs = (0, import_abort.resolveClientRequestTimeoutMs)(configuredRequestTimeoutMs);
+  const directRequestTimeoutMs = (0, import_abort.resolveRequestTimeoutMs)(configuredRequestTimeoutMs);
   const requestOptions = {
     ...signal && { signal },
     ...clientRequestTimeoutMs !== void 0 && { timeout: clientRequestTimeoutMs }
   };
   const rawNetworkFetch = (0, import_agent_transport_fetch.createAgentTransportFetch)(agentUrl, { trustedFetchFn: fetchFn, allowPrivateIp });
   const sizeLimited = (0, import_responseSizeLimit.wrapFetchWithSizeLimit)(
-    (input, init) => (0, import_abort.withAbortSignal)(
-      [init?.signal],
-      requestTimeoutMs,
-      (linkedSignal) => rawNetworkFetch(input, { ...init, signal: linkedSignal })
+    (input, init) => (
+      // Inside a call context the deadline is that call's; a direct caller who
+      // holds the returned client keeps the timeout configured on connect. The
+      // call's own signal is already linked into `init.signal` for the whole
+      // response body, so aborting one call cancels its streamed POST only.
+      (0, import_abort.withAbortSignal)(
+        [init?.signal],
+        (0, import_mcp_call_context.requestTimeoutFor)(init, directRequestTimeoutMs),
+        (deadline) => rawNetworkFetch(input, {
+          ...init,
+          signal: init?.signal && deadline ? AbortSignal.any([init.signal, deadline]) : deadline ?? init?.signal
+        })
+      )
     )
   );
   const diagnosticFetch = (0, import_transportDiagnostics.wrapFetchWithTransportDiagnostics)(sizeLimited);
@@ -779,7 +800,9 @@ async function connectMCP(options) {
     getCapability: signingContext.getCapability,
     adcpVersion: signingContext.adcpVersion
   }) : diagnosticFetch;
-  transportOptions.fetch = (0, import_rawResponseCapture.wrapFetchWithCapture)(withPerRequestTraceHeaders(signedFetch));
+  transportOptions.fetch = (0, import_rawResponseCapture.wrapFetchWithCapture)(
+    withPerRequestTraceHeaders(signedFetch, (0, import_mcp_call_context.splitConnectionHeaders)(authHeaders).perRequest)
+  );
   const transport = new import_streamableHttp.StreamableHTTPClientTransport(baseUrl, transportOptions);
   try {
     await mcpClient.connect(transport, requestOptions);
@@ -903,5 +926,6 @@ async function callMCPToolWithOAuth(options) {
   closeOAuthConnections,
   connectMCP,
   connectMCPWithFallback,
-  withCachedConnection
+  withCachedConnection,
+  withScopedLegacyConnection
 });