@juspay/neurolink 13.8.14 → 13.8.16

package/dist/cli/utils/serverUtils.d.ts

@@ -16,6 +16,10 @@ export declare function readServerApiKeys(): string[];
  * Require one of `apiKeys` as `Authorization: Bearer <key>` or `X-API-Key`.
  * Health probes stay open so orchestrators can reach them, and the dev
  * playground header cannot bypass a key the operator configured.
+ *
+ * Every holder of a key gets the same `{ id: "api-key" }`, marked `shared` so
+ * the agent routes know it names no person and do not warn when a request
+ * names its own userId.
  */
 export declare function createServerApiKeyMiddleware(apiKeys: string[], basePath: string): MiddlewareDefinition;
 /**

package/dist/cli/utils/serverUtils.js

@@ -41,6 +41,10 @@ const matchesKey = (key, token) => key.length === token.length && timingSafeEqua
  * Require one of `apiKeys` as `Authorization: Bearer <key>` or `X-API-Key`.
  * Health probes stay open so orchestrators can reach them, and the dev
  * playground header cannot bypass a key the operator configured.
+ *
+ * Every holder of a key gets the same `{ id: "api-key" }`, marked `shared` so
+ * the agent routes know it names no person and do not warn when a request
+ * names its own userId.
  */
 export function createServerApiKeyMiddleware(apiKeys, basePath) {
     const keys = apiKeys.map((key) => Buffer.from(key, "utf8"));
@@ -53,7 +57,7 @@ export function createServerApiKeyMiddleware(apiKeys, basePath) {
         validate: async (token) => {
             const candidate = Buffer.from(token, "utf8");
             return keys.some((key) => matchesKey(key, candidate))
-                ? { id: "api-key" }
+                ? { id: "api-key", shared: true }
                 : null;
         },
         skipPaths: [`${basePath.replace(/\/+$/, "")}/health`],

package/dist/core/conversationMemoryFactory.d.ts

@@ -2,13 +2,13 @@
  * Conversation Memory Factory for NeuroLink
  * Creates appropriate conversation memory manager based on configuration
  */
-import type { StorageType, ConversationMemoryConfig, RedisStorageConfig } from "../types/index.js";
+import type { StorageType, ConversationMemoryConfig, NeuroLinkEvents, RedisStorageConfig, TypedEventEmitter } from "../types/index.js";
 import { ConversationMemoryManager } from "./conversationMemoryManager.js";
 import { RedisConversationMemoryManager } from "./redisConversationMemoryManager.js";
 /**
  * Creates a conversation memory manager based on configuration
  */
-export declare function createConversationMemoryManager(config: ConversationMemoryConfig, storageType?: StorageType, redisConfig?: RedisStorageConfig): ConversationMemoryManager | RedisConversationMemoryManager;
+export declare function createConversationMemoryManager(config: ConversationMemoryConfig, storageType?: StorageType, redisConfig?: RedisStorageConfig, eventEmitter?: TypedEventEmitter<NeuroLinkEvents>): ConversationMemoryManager | RedisConversationMemoryManager;
 /**
  * Get storage type from environment variable or configuration
  */

package/dist/core/conversationMemoryFactory.js

@@ -8,7 +8,7 @@ import { RedisConversationMemoryManager } from "./redisConversationMemoryManager
 /**
  * Creates a conversation memory manager based on configuration
  */
-export function createConversationMemoryManager(config, storageType = "memory", redisConfig) {
+export function createConversationMemoryManager(config, storageType = "memory", redisConfig, eventEmitter) {
     logger.debug("[conversationMemoryFactory] Creating conversation memory manager", {
         storageType,
         config: {
@@ -38,7 +38,7 @@ export function createConversationMemoryManager(config, storageType = "memory",
             ttl: redisConfig?.ttl || 86400,
             hasConnectionOptions: !!redisConfig?.connectionOptions,
         });
-        const redisManager = new RedisConversationMemoryManager(config, redisConfig);
+        const redisManager = new RedisConversationMemoryManager(config, redisConfig, eventEmitter);
         logger.debug("[conversationMemoryFactory] Redis conversation manager created successfully", {
             managerType: redisManager.constructor.name,
             config: {

package/dist/core/conversationMemoryInitializer.d.ts

@@ -2,7 +2,7 @@
  * Conversation Memory Initializer
  * Provides integration with Redis storage for conversation memory
  */
-import type { ConversationMemoryConfig } from "../types/index.js";
+import type { ConversationMemoryConfig, NeuroLinkEvents, TypedEventEmitter } from "../types/index.js";
 import type { ConversationMemoryManager } from "./conversationMemoryManager.js";
 import type { RedisConversationMemoryManager } from "./redisConversationMemoryManager.js";
 /**
@@ -11,4 +11,4 @@ import type { RedisConversationMemoryManager } from "./redisConversationMemoryMa
  */
 export declare function initializeConversationMemory(config?: {
     conversationMemory?: Partial<ConversationMemoryConfig>;
-}): Promise<ConversationMemoryManager | RedisConversationMemoryManager | null>;
+}, eventEmitter?: TypedEventEmitter<NeuroLinkEvents>): Promise<ConversationMemoryManager | RedisConversationMemoryManager | null>;

package/dist/core/conversationMemoryInitializer.js

@@ -9,7 +9,7 @@ import { createConversationMemoryManager, getRedisConfigFromEnv, getStorageType,
  * Initialize conversation memory for NeuroLink
  * This function decides whether to use in-memory or Redis storage
  */
-export async function initializeConversationMemory(config) {
+export async function initializeConversationMemory(config, eventEmitter) {
     logger.debug("[conversationMemoryInitializer] Initialize conversation memory called", {
         hasConfig: !!config,
         hasMemoryConfig: !!config?.conversationMemory,
@@ -58,7 +58,7 @@ export async function initializeConversationMemory(config) {
             });
             // Create Redis-based conversation memory manager
             logger.debug("[conversationMemoryInitializer] Creating Redis conversation memory manager");
-            const redisMemoryManager = createConversationMemoryManager(memoryConfig, "redis", redisConfig);
+            const redisMemoryManager = createConversationMemoryManager(memoryConfig, "redis", redisConfig, eventEmitter);
             logger.debug("[conversationMemoryInitializer] Checking Redis manager creation result", {
                 managerType: redisMemoryManager?.constructor?.name || "unknown",
                 isRedisType: redisMemoryManager?.constructor?.name ===

package/dist/core/redisConversationMemoryManager.d.ts

@@ -2,7 +2,7 @@
  * Redis Conversation Memory Manager for NeuroLink
  * Redis-based implementation of conversation storage with same interface as ConversationMemoryManager
  */
-import type { ChatMessage, ConversationMemoryConfig, ConversationMemoryStats, RedisConversationObject, RedisStorageConfig, SessionListItem, SessionMemory, SessionMetadata, StoreConversationTurnOptions, AgenticLoopReportMetadata, IConversationMemoryManager } from "../types/index.js";
+import type { ChatMessage, ConversationMemoryConfig, ConversationMemoryStats, RedisConversationObject, RedisStorageConfig, SessionListItem, SessionMemory, SessionMetadata, StoreConversationTurnOptions, AgenticLoopReportMetadata, IConversationMemoryManager, NeuroLinkEvents, TypedEventEmitter } from "../types/index.js";
 /**
  * Redis-based implementation of the ConversationMemoryManager
  * Uses the same interface but stores data in Redis
@@ -13,6 +13,11 @@ export declare class RedisConversationMemoryManager implements IConversationMemo
     private summarizationEngine;
     private redisConfig;
     private redisClient;
+    /**
+     * Receives `conversation:titleGenerated` once a new conversation's title is
+     * stored. Optional because the manager can be constructed standalone.
+     */
+    private readonly eventEmitter?;
     /**
      * Temporary storage for tool execution data to prevent race conditions
      * Key format: "${sessionId}:${userId}"
@@ -28,7 +33,7 @@ export declare class RedisConversationMemoryManager implements IConversationMemo
      * Key format: "${sessionId}:${userId}"
      */
     private summarizationInProgress;
-    constructor(config: ConversationMemoryConfig, redisConfig?: RedisStorageConfig);
+    constructor(config: ConversationMemoryConfig, redisConfig?: RedisStorageConfig, eventEmitter?: TypedEventEmitter<NeuroLinkEvents>);
     /**
      * Initialize the memory manager with Redis connection
      */
@@ -155,6 +160,12 @@ export declare class RedisConversationMemoryManager implements IConversationMemo
      * @returns Complete conversation object with all data, or null if session doesn't exist
      */
     getUserSessionObject(userId: string, sessionId: string): Promise<RedisConversationObject | null>;
+    /**
+     * Announce a stored title. A throwing listener is logged rather than
+     * propagated: the title is already persisted, and the caller's catch block
+     * reports title-generation failures.
+     */
+    private emitTitleGenerated;
     /**
      * Generate a conversation title from the first user message
      * Uses AI to create a concise, descriptive title (5-8 words)

package/dist/core/redisConversationMemoryManager.js

@@ -29,6 +29,11 @@ export class RedisConversationMemoryManager {
     summarizationEngine = new SummarizationEngine();
     redisConfig;
     redisClient = null;
+    /**
+     * Receives `conversation:titleGenerated` once a new conversation's title is
+     * stored. Optional because the manager can be constructed standalone.
+     */
+    eventEmitter;
     /**
      * Temporary storage for tool execution data to prevent race conditions
      * Key format: "${sessionId}:${userId}"
@@ -44,9 +49,10 @@ export class RedisConversationMemoryManager {
      * Key format: "${sessionId}:${userId}"
      */
     summarizationInProgress = new Set();
-    constructor(config, redisConfig = {}) {
+    constructor(config, redisConfig = {}, eventEmitter) {
         this.config = config;
         this.redisConfig = getNormalizedConfig(redisConfig);
+        this.eventEmitter = eventEmitter;
     }
     /**
      * Initialize the memory manager with Redis connection
@@ -419,6 +425,12 @@ export class RedisConversationMemoryManager {
                                 const serializedData = serializeConversation(updatedConversation);
                                 if (this.redisClient) {
                                     await setWithTtl(this.redisClient, updatedRedisKey, serializedData, this.redisConfig.ttl);
+                                    this.emitTitleGenerated({
+                                        sessionId: options.sessionId,
+                                        userId: normalizedUserId,
+                                        title,
+                                        timestamp: Date.now(),
+                                    });
                                 }
                             }
                         }
@@ -1023,6 +1035,24 @@ export class RedisConversationMemoryManager {
             return null;
         }
     }
+    /**
+     * Announce a stored title. A throwing listener is logged rather than
+     * propagated: the title is already persisted, and the caller's catch block
+     * reports title-generation failures.
+     */
+    emitTitleGenerated(event) {
+        try {
+            this.eventEmitter?.emit("conversation:titleGenerated", event);
+        }
+        catch (listenerError) {
+            logger.warn("[RedisConversationMemoryManager] conversation:titleGenerated listener threw", {
+                sessionId: event.sessionId,
+                error: listenerError instanceof Error
+                    ? listenerError.message
+                    : String(listenerError),
+            });
+        }
+    }
     /**
      * Generate a conversation title from the first user message
      * Uses AI to create a concise, descriptive title (5-8 words)

package/dist/neurolink.js

@@ -13851,7 +13851,7 @@ Current user's request: ${currentInput}`;
             // Import the integration module
             const { initializeConversationMemory } = await import("./core/conversationMemoryInitializer.js");
             // Use the integration module to create the appropriate memory manager
-            const memoryManager = await initializeConversationMemory(this.conversationMemoryConfig);
+            const memoryManager = await initializeConversationMemory(this.conversationMemoryConfig, this.emitter);
             // Assign to conversationMemory with proper type to handle both memory manager types
             this.conversationMemory = memoryManager;
             // Reset the lazy init flag since we've now initialized

package/dist/server/abstract/baseServerAdapter.d.ts

@@ -7,7 +7,7 @@ import { EventEmitter } from "events";
 import type { ExternalServerManager } from "../../mcp/externalServerManager.js";
 import type { MCPToolRegistry } from "../../mcp/toolRegistry.js";
 import type { NeuroLink } from "../../neurolink.js";
-import type { MiddlewareDefinition, RedactionConfig, RequiredServerAdapterConfig, RequiredShutdownConfig, RouteDefinition, ServerAdapterConfig, ServerAdapterEvents, ServerContext, ServerLifecycleState, ServerStatus, TrackedConnection } from "../../types/index.js";
+import type { MiddlewareDefinition, RedactionConfig, RequiredServerAdapterConfig, RequiredShutdownConfig, RouteDefinition, ServerAdapterConfig, ServerAdapterEvents, ServerCarriedContext, ServerContext, ServerLifecycleState, ServerStatus, TrackedConnection } from "../../types/index.js";
 /**
  * Abstract base class for server adapters
  * Provides common functionality and defines the interface for framework-specific implementations
@@ -28,6 +28,7 @@ export declare abstract class BaseServerAdapter extends EventEmitter {
     protected lifecycleState: ServerLifecycleState;
     protected activeConnections: Map<string, TrackedConnection>;
     protected readonly shutdownConfig: RequiredShutdownConfig;
+    private carryRequestedByRoutes;
     constructor(neurolink: NeuroLink, config?: ServerAdapterConfig);
     /**
      * Initialize the underlying server framework
@@ -155,6 +156,34 @@ export declare abstract class BaseServerAdapter extends EventEmitter {
      * Only registers health routes if disableBuiltInHealth is false (default)
      */
     protected registerBuiltInRoutes(): Promise<void>;
+    /**
+     * Ask the adapter to carry middleware state (`ctx.user` and the rest) to later
+     * middleware and the route handler, as the `carryMiddlewareState` option does.
+     * `registerAllRoutes()` calls it when given `perUserAuth`, which cannot work
+     * without the user in the handler. It takes effect for requests that start
+     * after the call, so call it before the server starts, as registering routes
+     * is.
+     */
+    enableMiddlewareStateCarry(): void;
+    /** Whether this adapter carries middleware state to the handler. */
+    protected carriesMiddlewareState(): boolean;
+    /**
+     * What middleware has set on its context that later middleware and the route
+     * handler must see. Each step gets a freshly built context, so unless this is
+     * parked in the framework's per-request storage an authenticated `ctx.user`
+     * set by middleware is gone before the handler runs. `undefined` when the
+     * adapter does not carry middleware state, so nothing is parked.
+     */
+    protected captureCarriedContext(ctx: ServerContext): ServerCarriedContext | undefined;
+    /**
+     * Put what `captureCarriedContext` saved onto a freshly built context, and
+     * mark the context as one that received the carry. The agent routes read the
+     * mark: a request that never used to reach its handler with `ctx.user` must
+     * not start being identified by it unless the server opts in. Does nothing
+     * when the adapter does not carry middleware state: the context stays the
+     * fresh one it always was, and unmarked.
+     */
+    protected restoreCarriedContext(ctx: ServerContext, carried: ServerCarriedContext | undefined): void;
     /**
      * Generate unique request ID
      */

package/dist/server/abstract/baseServerAdapter.js

@@ -7,6 +7,7 @@ import { EventEmitter } from "events";
 import { getMetricsAggregator, SpanSerializer, SpanStatus, SpanType, } from "../../observability/index.js";
 import { withTimeout } from "../../utils/errorHandling.js";
 import { logger } from "../../utils/logger.js";
+import { markContextCarried } from "../utils/carriedContextMark.js";
 import { tryImport } from "../../utils/tryImport.js";
 import { DrainTimeoutError, InvalidLifecycleStateError, MissingDependencyError, ServerAdapterError, ShutdownTimeoutError, } from "../errors.js";
 /**
@@ -33,6 +34,9 @@ export class BaseServerAdapter extends EventEmitter {
     lifecycleState = "uninitialized";
     activeConnections = new Map();
     shutdownConfig;
+    // Set by enableMiddlewareStateCarry(); the carryMiddlewareState option is the
+    // other way in.
+    carryRequestedByRoutes = false;
     constructor(neurolink, config = {}) {
         super();
         this.neurolink = neurolink;
@@ -101,6 +105,7 @@ export class BaseServerAdapter extends EventEmitter {
             enableSwagger: config.enableSwagger ?? false,
             disableBuiltInHealth: config.disableBuiltInHealth ?? false,
             shutdown: this.shutdownConfig,
+            carryMiddlewareState: config.carryMiddlewareState ?? false,
         };
     }
     /**
@@ -454,6 +459,72 @@ export class BaseServerAdapter extends EventEmitter {
             });
         }
     }
+    /**
+     * Ask the adapter to carry middleware state (`ctx.user` and the rest) to later
+     * middleware and the route handler, as the `carryMiddlewareState` option does.
+     * `registerAllRoutes()` calls it when given `perUserAuth`, which cannot work
+     * without the user in the handler. It takes effect for requests that start
+     * after the call, so call it before the server starts, as registering routes
+     * is.
+     */
+    enableMiddlewareStateCarry() {
+        this.carryRequestedByRoutes = true;
+    }
+    /** Whether this adapter carries middleware state to the handler. */
+    carriesMiddlewareState() {
+        return this.config.carryMiddlewareState || this.carryRequestedByRoutes;
+    }
+    /**
+     * What middleware has set on its context that later middleware and the route
+     * handler must see. Each step gets a freshly built context, so unless this is
+     * parked in the framework's per-request storage an authenticated `ctx.user`
+     * set by middleware is gone before the handler runs. `undefined` when the
+     * adapter does not carry middleware state, so nothing is parked.
+     */
+    captureCarriedContext(ctx) {
+        if (!this.carriesMiddlewareState()) {
+            return undefined;
+        }
+        return {
+            user: ctx.user,
+            session: ctx.session,
+            metadata: ctx.metadata,
+            abortSignal: ctx.abortSignal,
+            abortController: ctx.abortController,
+        };
+    }
+    /**
+     * Put what `captureCarriedContext` saved onto a freshly built context, and
+     * mark the context as one that received the carry. The agent routes read the
+     * mark: a request that never used to reach its handler with `ctx.user` must
+     * not start being identified by it unless the server opts in. Does nothing
+     * when the adapter does not carry middleware state: the context stays the
+     * fresh one it always was, and unmarked.
+     */
+    restoreCarriedContext(ctx, carried) {
+        if (!this.carriesMiddlewareState()) {
+            return;
+        }
+        markContextCarried(ctx);
+        if (!carried) {
+            return;
+        }
+        if (carried.user) {
+            ctx.user = carried.user;
+        }
+        if (carried.session) {
+            ctx.session = carried.session;
+        }
+        if (carried.metadata) {
+            ctx.metadata = { ...ctx.metadata, ...carried.metadata };
+        }
+        if (carried.abortSignal) {
+            ctx.abortSignal = carried.abortSignal;
+        }
+        if (carried.abortController) {
+            ctx.abortController = carried.abortController;
+        }
+    }
     /**
      * Generate unique request ID
      */

package/dist/server/adapters/expressAdapter.js

@@ -166,6 +166,7 @@ export class ExpressServerAdapter extends BaseServerAdapter {
             if (res.locals.responseHeaders) {
                 ctx.responseHeaders = { ...res.locals.responseHeaders };
             }
+            this.restoreCarriedContext(ctx, res.locals.carriedContext);
             // Emit request event
             this.emit("request", {
                 requestId,
@@ -366,9 +367,13 @@ export class ExpressServerAdapter extends BaseServerAdapter {
                 });
                 // Copy existing response headers to context
                 ctx.responseHeaders = { ...res.locals.responseHeaders };
+                this.restoreCarriedContext(ctx, res.locals.carriedContext);
                 // Execute middleware
                 try {
                     await middleware.handler(ctx, async () => {
+                        // What this middleware set (ctx.user included) is for the next
+                        // middleware and the route handler, which build their own contexts.
+                        res.locals.carriedContext = this.captureCarriedContext(ctx);
                         // After middleware execution, merge response headers back to res.locals
                         if (ctx.responseHeaders) {
                             Object.assign(res.locals.responseHeaders, ctx.responseHeaders);

package/dist/server/adapters/fastifyAdapter.d.ts

@@ -13,6 +13,7 @@ import type { MiddlewareDefinition, RouteDefinition, ServerAdapterConfig } from
 export declare class FastifyServerAdapter extends BaseServerAdapter {
     private app;
     private frameworkInitialized;
+    private connectionIds;
     constructor(neurolink: NeuroLink, config?: ServerAdapterConfig);
     /**
      * Initialize Fastify framework

package/dist/server/adapters/fastifyAdapter.js

@@ -16,6 +16,11 @@ import { isRawBodyContentType, isWebResponse, readWebResponse, } from "../utils/
 export class FastifyServerAdapter extends BaseServerAdapter {
     app = null;
     frameworkInitialized = false;
+    // The shutdown drain's record for each in-flight request. Fastify takes
+    // `request.id` from the caller's X-Request-ID, so that id can repeat across
+    // overlapping requests: a record named after it would be shared, and the
+    // first request to finish would untrack the other.
+    connectionIds = new WeakMap();
     constructor(neurolink, config = {}) {
         super(neurolink, config);
     }
@@ -239,6 +244,7 @@ export class FastifyServerAdapter extends BaseServerAdapter {
                 if (reqWithHeaders.responseHeaders) {
                     ctx.responseHeaders = { ...reqWithHeaders.responseHeaders };
                 }
+                this.restoreCarriedContext(ctx, reqWithHeaders.carriedContext);
                 // Emit request event
                 this.emit("request", {
                     requestId,
@@ -399,8 +405,12 @@ export class FastifyServerAdapter extends BaseServerAdapter {
             });
             // Copy existing response headers to context
             ctx.responseHeaders = { ...reqWithHeaders.responseHeaders };
+            this.restoreCarriedContext(ctx, reqWithHeaders.carriedContext);
             // Execute middleware
             await middleware.handler(ctx, async () => {
+                // What this middleware set (ctx.user included) is for the next
+                // middleware and the route handler, which build their own contexts.
+                reqWithHeaders.carriedContext = this.captureCarriedContext(ctx);
                 // After middleware execution, merge response headers back to request
                 if (ctx.responseHeaders) {
                     Object.assign(reqWithHeaders.responseHeaders, ctx.responseHeaders);
@@ -431,12 +441,15 @@ export class FastifyServerAdapter extends BaseServerAdapter {
         const startupTimeout = this.config.timeout || 30000;
         // Track connections via Fastify hooks (must be registered before listen)
         app.addHook("onRequest", async (request) => {
-            const connectionId = `conn-${request.id}`;
+            const connectionId = `conn-${this.generateRequestId()}`;
+            this.connectionIds.set(request, connectionId);
             this.trackConnection(connectionId, request.raw.socket, request.id);
         });
         app.addHook("onResponse", async (request) => {
-            const connectionId = `conn-${request.id}`;
-            this.untrackConnection(connectionId);
+            const connectionId = this.connectionIds.get(request);
+            if (connectionId) {
+                this.untrackConnection(connectionId);
+            }
         });
         try {
             await withTimeout(app.listen({ port, host }), startupTimeout, new ServerStartError(`Fastify server startup timed out after ${startupTimeout}ms`, undefined, port, host));

package/dist/server/adapters/honoAdapter.d.ts

@@ -16,6 +16,7 @@ export declare class HonoServerAdapter extends BaseServerAdapter {
     private rateLimitStore;
     private rateLimitCleanupInterval?;
     private requestContextStore;
+    private requestIds;
     private HTTPExceptionCtor;
     private streamSSEFn;
     private parseFormBody;
@@ -52,6 +53,11 @@ export declare class HonoServerAdapter extends BaseServerAdapter {
      * Register middleware with Hono
      */
     protected registerFrameworkMiddleware(middleware: MiddlewareDefinition): void;
+    /**
+     * The id of this request: the caller's `X-Request-ID` when sent, otherwise
+     * one generated on first use, and the same one on every later use.
+     */
+    private requestIdFor;
     /**
      * Start the Hono server
      */

package/dist/server/adapters/honoAdapter.js

@@ -6,6 +6,7 @@
 import { logger } from "../../utils/logger.js";
 import { AlreadyRunningError, ServerAdapterError, ServerStopError, wrapError, } from "../errors.js";
 import { BaseServerAdapter } from "../abstract/baseServerAdapter.js";
+import { markContextCarried } from "../utils/carriedContextMark.js";
 import { isErrorResponse } from "../utils/validation.js";
 import { isRawBodyContentType, isWebResponse, parseByteLimit, RawBodyTooLargeError, readBoundedRequestBody, } from "../utils/rawBody.js";
 /**
@@ -17,8 +18,17 @@ export class HonoServerAdapter extends BaseServerAdapter {
     server;
     rateLimitStore = new Map();
     rateLimitCleanupInterval;
-    // Store context by request ID for sharing between middleware and route handlers
-    requestContextStore = new Map();
+    // Context shared between middleware and the route handler. Keyed by the request
+    // object, never by the request id: the id can be the
+    // caller's own X-Request-ID, so two overlapping requests that send the same one
+    // would share a context, and the second would run with the first one's
+    // identity, headers and body. A WeakMap also frees an entry whose handler
+    // never ran.
+    requestContextStore = new WeakMap();
+    // One id per request, for logs and events: the caller's X-Request-ID when sent,
+    // otherwise generated once, so every step reports the same id. With no header
+    // every step used to invent its own.
+    requestIds = new WeakMap();
     // Populated by initializeFramework's dynamic imports; used by methods that
     // run after initialization (route registration, streaming) and so cannot
     // rely on initializeFramework's own local closure variables.
@@ -50,7 +60,7 @@ export class HonoServerAdapter extends BaseServerAdapter {
                     headers[name] = value;
                 });
                 const minCtx = {
-                    requestId: c.req.header("X-Request-ID") || this.generateRequestId(),
+                    requestId: this.requestIdFor(c),
                     method: c.req.method,
                     path: c.req.path,
                     headers,
@@ -162,7 +172,7 @@ export class HonoServerAdapter extends BaseServerAdapter {
         }
         // Global error handler
         this.app.onError((error, c) => {
-            const requestId = c.req.header("X-Request-ID") || this.generateRequestId();
+            const requestId = this.requestIdFor(c);
             this.logRequestError("HonoAdapter", requestId, error);
             this.emitRequestError({
                 requestId,
@@ -217,8 +227,11 @@ export class HonoServerAdapter extends BaseServerAdapter {
     registerFrameworkRoute(route) {
         const method = route.method.toLowerCase();
         this.app[method](route.path, async (c) => {
-            const requestId = c.req.header("X-Request-ID") || this.generateRequestId();
-            const connectionId = `conn-${requestId}`;
+            const requestId = this.requestIdFor(c);
+            // Not derived from the request id, which a caller may repeat: two
+            // overlapping requests would then share one record and the first to
+            // finish would untrack the other.
+            const connectionId = `conn-${this.generateRequestId()}`;
             const startTime = Date.now();
             // Track connection for graceful shutdown
             this.trackConnection(connectionId, undefined, requestId);
@@ -226,12 +239,30 @@ export class HonoServerAdapter extends BaseServerAdapter {
                 // Extract path parameters
                 const params = c.req.param();
                 // Reuse existing context from middleware if available, otherwise create new one
-                const created = this.requestContextStore.get(requestId) ||
-                    (await this.createRequestContext(c, requestId, params));
-                if (isWebResponse(created)) {
-                    return created;
+                const existingCtx = this.requestContextStore.get(c.req.raw);
+                // Middleware ran before the router matched this route, so the shared
+                // context carries no path parameters yet.
+                if (existingCtx) {
+                    existingCtx.params = params;
+                    // The one request the handler already got the middleware's context
+                    // for before this adapter carried it on every request: the caller
+                    // sent its own X-Request-ID, which the old store was keyed by. That
+                    // context stays unmarked, so the agent routes keep trusting its
+                    // ctx.user there. A context found for any other request exists only
+                    // because the server carries middleware state, is new to the
+                    // handler, and is marked.
+                    if (!c.req.header("X-Request-ID")) {
+                        markContextCarried(existingCtx);
+                    }
+                }
+                let ctx = existingCtx;
+                if (!ctx) {
+                    const created = await this.createRequestContext(c, requestId, params);
+                    if (isWebResponse(created)) {
+                        return created;
+                    }
+                    ctx = created;
                 }
-                const ctx = created;
                 // Emit request event
                 this.emit("request", {
                     requestId,
@@ -325,7 +356,7 @@ export class HonoServerAdapter extends BaseServerAdapter {
                 // Untrack connection when request completes
                 this.untrackConnection(connectionId);
                 // Clean up context store to prevent memory leaks
-                this.requestContextStore.delete(requestId);
+                this.requestContextStore.delete(c.req.raw);
             }
         });
     }
@@ -457,9 +488,9 @@ export class HonoServerAdapter extends BaseServerAdapter {
                 // Extract path parameters
                 const params = c.req.param();
                 // Get or generate request ID for context lookup
-                const requestId = c.req.header("X-Request-ID") || this.generateRequestId();
+                const requestId = this.requestIdFor(c);
                 // Reuse existing context from previous middleware if available
-                let ctx = this.requestContextStore.get(requestId);
+                let ctx = this.requestContextStore.get(c.req.raw);
                 if (!ctx) {
                     // Create new context for the first middleware
                     const created = await this.createRequestContext(c, requestId, params);
@@ -467,14 +498,34 @@ export class HonoServerAdapter extends BaseServerAdapter {
                         return created;
                     }
                     ctx = created;
-                    // Store context for sharing between middleware and route handlers
-                    this.requestContextStore.set(requestId, ctx);
+                    // Share the context between the middleware steps and the route
+                    // handler when the server carries middleware state, or when the
+                    // caller sent its own X-Request-ID: the one case the old store, keyed
+                    // by that header, ever found a context again. Otherwise every step
+                    // and the handler build their own, and storing this one would only
+                    // leave it behind.
+                    if (this.carriesMiddlewareState() || c.req.header("X-Request-ID")) {
+                        this.requestContextStore.set(c.req.raw, ctx);
+                    }
                 }
                 // Execute middleware
                 return middleware.handler(ctx, next);
             });
         }
     }
+    /**
+     * The id of this request: the caller's `X-Request-ID` when sent, otherwise
+     * one generated on first use, and the same one on every later use.
+     */
+    requestIdFor(c) {
+        const known = this.requestIds.get(c.req.raw);
+        if (known) {
+            return known;
+        }
+        const id = c.req.header("X-Request-ID") || this.generateRequestId();
+        this.requestIds.set(c.req.raw, id);
+        return id;
+    }
     /**
      * Start the Hono server
      */

package/dist/server/adapters/koaAdapter.js

@@ -261,6 +261,7 @@ export class KoaServerAdapter extends BaseServerAdapter {
             if (ctx.state.responseHeaders) {
                 serverCtx.responseHeaders = { ...ctx.state.responseHeaders };
             }
+            this.restoreCarriedContext(serverCtx, ctx.state.carriedContext);
             // Emit request event
             this.emit("request", {
                 requestId,
@@ -419,8 +420,12 @@ export class KoaServerAdapter extends BaseServerAdapter {
             });
             // Copy existing response headers to context
             serverCtx.responseHeaders = { ...ctx.state.responseHeaders };
+            this.restoreCarriedContext(serverCtx, ctx.state.carriedContext);
             // Execute middleware
             await middleware.handler(serverCtx, async () => {
+                // What this middleware set (ctx.user included) is for the next
+                // middleware and the route handler, which build their own contexts.
+                ctx.state.carriedContext = this.captureCarriedContext(serverCtx);
                 // After middleware execution, merge response headers back to ctx.state
                 if (serverCtx.responseHeaders) {
                     Object.assign(ctx.state.responseHeaders, serverCtx.responseHeaders);