@taskforcehq/taskforce 0.3.328 → 0.3.330

package/dist/server/routes/localService.js

@@ -1,10 +1,15 @@
 import { createHash, timingSafeEqual } from 'crypto';
-import { StreamableHTTPServerTransport } from '@modelcontextprotocol/sdk/server/streamableHttp.js';
+import { NodeStreamableHTTPServerTransport } from '@modelcontextprotocol/node';
+import { isJsonContentType } from '@modelcontextprotocol/server';
 import { parseMcpClientId } from '../../mcp/clientRegistry.js';
-import { createTaskforceMcpServer } from '../../mcp/runtime.js';
+import { handleModernMcpHttpRequest, isModernMcpHttpRequest, } from '../../mcp/httpProtocolRouting.js';
+import { createStatelessTaskforceMcpServer, createTaskforceMcpServer, } from '../../mcp/runtime.js';
 import { MCP_TOOL_PROFILES } from '../../mcp/toolRegistry.js';
 import { parseJsonBody } from './primitives.js';
+import { setServerTimingHeader } from './shared.js';
 import { LocalServiceSessionError } from '../localServiceSessions.js';
+import { WorkspaceSyncDurabilityStore } from '../../sync/v3/syncDurabilityStore.js';
+import { assertDurableOperationIdentity, DurableOperationReplayIdentityConflictError, } from '../../sync/v3/durableOperationReplay.js';
 const API_BASE = '/api/taskforce/local-service/v1';
 const ALLOWED_SCOPES = new Set(['tasks:read', 'tasks:write', 'workspace:read']);
 const MAX_REGISTRATION_BODY_BYTES = 32 * 1024;
@@ -16,6 +21,13 @@ function writeJson(res, statusCode, body) {
 function fail(res, statusCode, error, code) {
     writeJson(res, statusCode, { error, code });
 }
+function failMcp(res, statusCode, message) {
+    writeJson(res, statusCode, {
+        jsonrpc: '2.0',
+        error: { code: -32000, message },
+        id: null,
+    });
+}
 function isLoopback(req) {
     const address = String(req.socket.remoteAddress || '').toLowerCase();
     return address === '127.0.0.1' || address === '::1' || address === '::ffff:127.0.0.1';
@@ -59,7 +71,17 @@ function authenticateSession(req, res, context) {
         fail(res, 401, 'A valid local service session bearer is required.', 'SESSION_AUTH_REQUIRED');
         return null;
     }
-    const session = context.sessions.authenticate(token);
+    let session;
+    try {
+        session = context.sessions.authenticate(token);
+    }
+    catch (error) {
+        if (error instanceof LocalServiceSessionError) {
+            fail(res, error.statusCode, error.message, error.code);
+            return null;
+        }
+        throw error;
+    }
     if (!session) {
         fail(res, 401, 'The local service session is invalid or expired.', 'SESSION_INVALID');
         return null;
@@ -110,42 +132,60 @@ function normalizeRegistration(body, context) {
         profileToken: profileToken || null,
     };
 }
-function lookupBoundOperation(core, context, session, operationId, req) {
+function lookupDurableOperation(core, context, session, operationId, req) {
     const url = new URL(req.url || '/', 'http://127.0.0.1');
     const expectedMutationKind = String(url.searchParams.get('mutationKind') || '').trim() || null;
     const expectedPayloadFingerprint = String(url.searchParams.get('payloadFingerprint') || '').trim() || null;
-    const binding = context.sessions.getOperationBinding(session.id, operationId, {
-        mutationKind: expectedMutationKind,
-        payloadFingerprint: expectedPayloadFingerprint,
+    const row = new WorkspaceSyncDurabilityStore(core.getDatabaseAdapter()).readOutboxOperationLookup({
+        tenantId: core.getTenantId(),
+        workspaceId: session.workspaceId,
+        clientId: context.operationClientId,
+        operationId,
     });
-    if (!binding)
-        return null;
-    const row = core.getDatabaseAdapter().prepare(`
-        SELECT status, authoritative_response_json, created_at,
-               mutation_kind, payload_fingerprint
-        FROM workspace_sync_outbox
-        WHERE tenant_id = ?
-          AND workspace_id = ?
-          AND client_id = ?
-          AND operation_id = ?
-        LIMIT 1
-    `).get(core.getTenantId(), session.workspaceId, context.operationClientId, operationId);
     if (!row)
         return null;
-    const responseJson = typeof row.authoritative_response_json === 'string'
-        ? row.authoritative_response_json
-        : null;
+    try {
+        assertDurableOperationIdentity({
+            operationId: row.operationId,
+            domain: row.domain,
+            entityId: row.entityId,
+            mutationKind: row.mutationKind,
+            payloadFingerprint: row.payloadFingerprint,
+        }, {
+            operationId,
+            domain: row.domain,
+            entityId: row.entityId,
+            mutationKind: expectedMutationKind || row.mutationKind,
+            payloadFingerprint: expectedPayloadFingerprint || row.payloadFingerprint,
+        });
+    }
+    catch (error) {
+        if (!(error instanceof DurableOperationReplayIdentityConflictError))
+            throw error;
+        throw new LocalServiceSessionError('Operation identity is assigned to a different durable mutation.', 409, 'OPERATION_IDENTITY_CONFLICT');
+    }
+    const responseJson = row.authoritativeResponseJson;
     if (responseJson && Buffer.byteLength(responseJson, 'utf8') > MAX_MCP_BODY_BYTES) {
         throw new LocalServiceSessionError('Operation response exceeds the local service limit.', 500, 'OPERATION_RESPONSE_INVALID');
     }
+    let response = null;
+    if (responseJson) {
+        try {
+            response = JSON.parse(responseJson);
+        }
+        catch {
+            throw new LocalServiceSessionError('Operation response is invalid.', 500, 'OPERATION_RESPONSE_INVALID');
+        }
+    }
     return {
         operationId,
         status: row.status,
-        createdAt: row.created_at,
-        mutationKind: row.mutation_kind,
-        payloadFingerprint: binding.payloadFingerprint,
-        durablePayloadFingerprint: row.payload_fingerprint,
-        response: responseJson ? JSON.parse(responseJson) : null,
+        createdAt: row.createdAt,
+        mutationKind: row.mutationKind,
+        payloadFingerprint: row.payloadFingerprint,
+        domain: row.domain,
+        entityId: row.entityId,
+        response,
     };
 }
 function auditShutdown(core, context, input) {
@@ -186,6 +226,7 @@ export function registerLocalServiceRoutes(deps) {
             projectIdentity: context.projectIdentity,
             dataIdentity: context.ownershipKey,
             cloudTarget: context.cloudTarget,
+            runtimeContract: context.runtimeContract,
             transports: ['streamable-http'],
             health: {
                 lifecycle: context.sessions.state(),
@@ -254,7 +295,7 @@ export function registerLocalServiceRoutes(deps) {
         if (!session)
             return;
         try {
-            const operation = lookupBoundOperation(deps.core, context, session, params.operationId, req);
+            const operation = lookupDurableOperation(deps.core, context, session, params.operationId, req);
             if (!operation) {
                 fail(res, 404, 'Operation not found.', 'OPERATION_NOT_FOUND');
                 return;
@@ -281,6 +322,7 @@ export function registerLocalServiceRoutes(deps) {
             protocolVersion: context.protocolVersion,
             ownerPid: context.ownerPid,
             cloudTarget: context.cloudTarget,
+            runtimeContract: context.runtimeContract,
             sessions: context.sessions.list(),
             ...(context.diagnostics?.() || {}),
         });
@@ -341,21 +383,34 @@ export function registerLocalServiceRoutes(deps) {
     deps.addRoute('POST', '/mcp', async (req, res) => {
         if (!guardLocalRequest(req, res))
             return;
+        const authStartedAtMs = Date.now();
         const session = authenticateSession(req, res, context);
         if (!session)
             return;
+        if (!isJsonContentType(header(req, 'content-type'))) {
+            failMcp(res, 415, 'Unsupported Media Type: Content-Type must be application/json');
+            return;
+        }
+        const authMs = Date.now() - authStartedAtMs;
         let runtime = null;
+        let runtimeLease = null;
+        let bodyParseMs = 0;
+        let runtimeConstructionMs = 0;
+        let transportConnectMs = 0;
         let requestStarted = false;
         let unregisterCancellation = () => { };
         let resolveCancellation = () => { };
         const cancellation = new Promise((resolve) => { resolveCancellation = resolve; });
         try {
+            const bodyParseStartedAtMs = Date.now();
             const body = await parseJsonBody(req, MAX_MCP_BODY_BYTES);
+            bodyParseMs = Date.now() - bodyParseStartedAtMs;
+            const modernProtocolRequest = await isModernMcpHttpRequest(req, body);
             const cancellationId = body?.method === 'notifications/cancelled'
                 && (typeof body?.params?.requestId === 'string' || typeof body?.params?.requestId === 'number')
                 ? body.params.requestId
                 : null;
-            if (cancellationId !== null) {
+            if (cancellationId !== null && !modernProtocolRequest) {
                 const correlationId = requestCorrelation(req, 'x-taskforce-mcp-cancel-correlation');
                 if (correlationId)
                     context.sessions.cancelRequest(session.id, correlationId);
@@ -375,7 +430,8 @@ export function registerLocalServiceRoutes(deps) {
             }
             if (cancelled)
                 return;
-            runtime = (deps.createMcpServer || createTaskforceMcpServer)({
+            const runtimeStartedAtMs = Date.now();
+            const runtimeOptions = {
                 projectRoot: deps.core.getPaths().projectRoot,
                 tenantId: deps.core.getTenantId(),
                 workspaceId: session.workspaceId,
@@ -384,8 +440,6 @@ export function registerLocalServiceRoutes(deps) {
                 logStartup: false,
                 runtimeMode: 'local',
                 operationIdentityScope: {
-                    generation: context.generation,
-                    sessionId: session.id,
                     connectionInstance: session.connectionInstance,
                 },
                 toolProfile: session.toolProfile,
@@ -402,18 +456,59 @@ export function registerLocalServiceRoutes(deps) {
                     userAgent: header(req, 'user-agent').trim() || null,
                 },
                 onAiProfileBound: (profileId) => context.sessions.bindAiProfile(session.id, profileId),
-                onOperationAccepted: (operation) => context.sessions.recordOperation({
-                    sessionId: session.id,
-                    ...operation,
-                }),
-            });
-            const transport = deps.createMcpTransport?.() || new StreamableHTTPServerTransport({
+            };
+            if (modernProtocolRequest) {
+                const handling = handleModernMcpHttpRequest({
+                    req,
+                    res,
+                    parsedBody: body,
+                    factory: ({ era }) => {
+                        const constructionStartedAtMs = Date.now();
+                        const modernRuntime = createStatelessTaskforceMcpServer({ ...runtimeOptions, protocolEra: era }, deps.createMcpServer || createTaskforceMcpServer);
+                        runtimeConstructionMs = Date.now() - constructionStartedAtMs;
+                        if (!res.headersSent) {
+                            setServerTimingHeader(res, [
+                                { name: 'auth', durationMs: authMs },
+                                { name: 'body-parse', durationMs: bodyParseMs },
+                                { name: 'runtime', durationMs: runtimeConstructionMs },
+                            ]);
+                        }
+                        return modernRuntime.server;
+                    },
+                });
+                await Promise.race([handling, cancellation]);
+                if (cancelled)
+                    void handling.catch(() => undefined);
+                if (cancellationId !== null && res.statusCode === 202) {
+                    const cancellationCorrelation = requestCorrelation(req, 'x-taskforce-mcp-cancel-correlation');
+                    if (cancellationCorrelation) {
+                        context.sessions.cancelRequest(session.id, cancellationCorrelation);
+                    }
+                }
+                return;
+            }
+            runtimeLease = deps.acquireMcpRuntime
+                ? await deps.acquireMcpRuntime({ req, options: runtimeOptions })
+                : null;
+            runtime = runtimeLease?.runtime
+                || createStatelessTaskforceMcpServer(runtimeOptions, deps.createMcpServer || createTaskforceMcpServer);
+            runtimeConstructionMs = Date.now() - runtimeStartedAtMs;
+            const transport = runtimeLease?.transport || deps.createMcpTransport?.() || new NodeStreamableHTTPServerTransport({
                 sessionIdGenerator: undefined,
                 enableJsonResponse: true,
             });
-            await runtime.server.connect(transport);
+            const transportStartedAtMs = Date.now();
+            if (!runtimeLease)
+                await runtime.server.connect(transport);
+            transportConnectMs = Date.now() - transportStartedAtMs;
             if (cancelled)
                 return;
+            setServerTimingHeader(res, [
+                { name: 'auth', durationMs: authMs },
+                { name: 'body-parse', durationMs: bodyParseMs },
+                { name: 'runtime', durationMs: runtimeConstructionMs },
+                { name: 'transport-connect', durationMs: transportConnectMs },
+            ]);
             const handling = transport.handleRequest(req, res, body);
             await Promise.race([handling, cancellation]);
             if (cancelled)
@@ -428,7 +523,10 @@ export function registerLocalServiceRoutes(deps) {
         }
         finally {
             unregisterCancellation();
-            await runtime?.server.close().catch(() => undefined);
+            if (runtimeLease)
+                await runtimeLease.release().catch(() => undefined);
+            else
+                await runtime?.server.close().catch(() => undefined);
             if (requestStarted)
                 context.sessions.endRequest(session.id);
         }

package/dist/server/routes/modelConnections.d.ts

@@ -0,0 +1,24 @@
+import type { IncomingMessage, ServerResponse } from 'node:http';
+import type { TaskforceCore } from '../../core/Taskforce.js';
+import { ModelProviderConnectionService, type ModelProviderConnectionLifecycleHandlers } from '../../services/modelProviderConnectionService.js';
+import { CodexDeviceCodeLoginManager } from '../../services/codexDeviceCodeLoginManager.js';
+import { type RouteHandler } from './primitives.js';
+type ConnectionService = Pick<ModelProviderConnectionService, 'create' | 'list' | 'get' | 'rename' | 'verify' | 'refresh' | 'disconnect' | 'cleanup'>;
+type DeviceCodeLoginManager = Pick<CodexDeviceCodeLoginManager, 'start' | 'get' | 'cancel'>;
+export interface ModelConnectionsRouteDependencies {
+    addRoute: (method: string, path: string, handler: RouteHandler) => void;
+    ensureAppAccess: (req: IncomingMessage, res: ServerResponse) => boolean;
+    resolveAuthenticatedUserId: (req: IncomingMessage) => string | null;
+    resolveRuntimeMode: (req: IncomingMessage) => 'local' | 'cloud';
+    core?: TaskforceCore;
+    service?: ConnectionService;
+    loginManager?: DeviceCodeLoginManager;
+    credentialStoragePath?: string | null;
+    lifecycleHandlers?: Array<{
+        providerKey: string;
+        authenticationType: string;
+        lifecycle: ModelProviderConnectionLifecycleHandlers;
+    }>;
+}
+export declare function registerModelConnectionsRoutes(deps: ModelConnectionsRouteDependencies): void;
+export {};

package/dist/server/routes/modelConnections.js

@@ -0,0 +1,205 @@
+import { INTERNAL_SUBSCRIPTION_MODEL_FEATURE_KEY } from '../../shared/userFeatureGrants.js';
+import { ModelProviderConnectionError, ModelProviderConnectionStore, } from '../../storage/modelProviderConnectionStore.js';
+import { ModelProviderCredentialHomeManager } from '../../services/modelProviderCredentialHome.js';
+import { ModelProviderConnectionService, } from '../../services/modelProviderConnectionService.js';
+import { CodexDeviceCodeLoginManager, } from '../../services/codexDeviceCodeLoginManager.js';
+import { createCodexModelProviderConnectionLifecycleHandlers } from '../../services/codexModelProviderConnectionLifecycle.js';
+import { parseJsonBody } from './primitives.js';
+function writeJson(res, statusCode, payload) {
+    res.writeHead(statusCode, { 'Content-Type': 'application/json' });
+    res.end(JSON.stringify(payload));
+}
+function writeError(res, error) {
+    const knownError = error instanceof ModelProviderConnectionError;
+    const statusCode = Number(error?.statusCode);
+    const safeStatusCode = Number.isInteger(statusCode) && statusCode >= 400 && statusCode <= 599
+        ? statusCode
+        : 500;
+    const code = knownError && typeof error?.code === 'string'
+        ? String(error.code)
+        : 'MODEL_CONNECTION_REQUEST_FAILED';
+    const message = knownError
+        ? String(error?.message || 'Model connection request failed.')
+        : 'Model connection request failed.';
+    writeJson(res, safeStatusCode, { success: false, error: message, code });
+}
+export function registerModelConnectionsRoutes(deps) {
+    const { addRoute, ensureAppAccess, resolveAuthenticatedUserId, resolveRuntimeMode, core, } = deps;
+    let resolvedService = deps.service;
+    let resolvedLoginManager = deps.loginManager;
+    let resolvedStore = null;
+    const store = () => {
+        if (resolvedStore)
+            return resolvedStore;
+        if (!core)
+            throw new Error('Model connection store is unavailable.');
+        resolvedStore = new ModelProviderConnectionStore(core.getDatabaseAdapter(), core.getTenantId());
+        return resolvedStore;
+    };
+    const service = () => {
+        if (resolvedService)
+            return resolvedService;
+        if (!core)
+            throw new Error('Model connection service is unavailable.');
+        const lifecycleHandlers = deps.lifecycleHandlers || [{
+                providerKey: 'openai',
+                authenticationType: 'chatgpt_device_code',
+                lifecycle: createCodexModelProviderConnectionLifecycleHandlers(),
+            }];
+        resolvedService = new ModelProviderConnectionService(store(), new ModelProviderCredentialHomeManager(deps.credentialStoragePath), (userId) => core.hasUserFeatureGrant(userId, INTERNAL_SUBSCRIPTION_MODEL_FEATURE_KEY), lifecycleHandlers);
+        return resolvedService;
+    };
+    const loginManager = () => {
+        if (resolvedLoginManager)
+            return resolvedLoginManager;
+        const connectionService = service();
+        if (!(connectionService instanceof ModelProviderConnectionService)) {
+            throw new Error('Model connection login manager is unavailable.');
+        }
+        resolvedLoginManager = new CodexDeviceCodeLoginManager(connectionService, store());
+        return resolvedLoginManager;
+    };
+    const authorize = (req, res) => {
+        if (!ensureAppAccess(req, res))
+            return null;
+        if (resolveRuntimeMode(req) !== 'cloud') {
+            writeJson(res, 404, {
+                success: false,
+                error: 'Model connections are unavailable in this runtime.',
+                code: 'MODEL_CONNECTIONS_CLOUD_ONLY',
+            });
+            return null;
+        }
+        const userId = String(resolveAuthenticatedUserId(req) || '').trim();
+        if (!userId) {
+            writeJson(res, 401, {
+                success: false,
+                error: 'Authentication is required.',
+                code: 'AUTH_REQUIRED',
+            });
+            return null;
+        }
+        return userId;
+    };
+    addRoute('GET', '/api/taskforce/model-connections', async (req, res) => {
+        const ownerUserId = authorize(req, res);
+        if (!ownerUserId)
+            return;
+        try {
+            writeJson(res, 200, {
+                success: true,
+                eligible: core ? core.hasUserFeatureGrant(ownerUserId, INTERNAL_SUBSCRIPTION_MODEL_FEATURE_KEY) : true,
+                connections: service().list(ownerUserId),
+            });
+        }
+        catch (error) {
+            writeError(res, error);
+        }
+    });
+    addRoute('POST', '/api/taskforce/model-connections', async (req, res) => {
+        const ownerUserId = authorize(req, res);
+        if (!ownerUserId)
+            return;
+        try {
+            const body = await parseJsonBody(req, 16 * 1024);
+            const connection = service().create({
+                ownerUserId,
+                providerKey: String(body?.providerKey || ''),
+                authenticationType: String(body?.authenticationType || ''),
+            });
+            writeJson(res, 201, { success: true, connection });
+        }
+        catch (error) {
+            writeError(res, error);
+        }
+    });
+    addRoute('GET', '/api/taskforce/model-connections/:connectionId', async (req, res, params) => {
+        const ownerUserId = authorize(req, res);
+        if (!ownerUserId)
+            return;
+        try {
+            writeJson(res, 200, {
+                success: true,
+                connection: service().get(ownerUserId, params.connectionId),
+            });
+        }
+        catch (error) {
+            writeError(res, error);
+        }
+    });
+    addRoute('PATCH', '/api/taskforce/model-connections/:connectionId', async (req, res, params) => {
+        const ownerUserId = authorize(req, res);
+        if (!ownerUserId)
+            return;
+        try {
+            const body = await parseJsonBody(req, 16 * 1024);
+            const connection = service().rename(ownerUserId, params.connectionId, body?.displayName);
+            writeJson(res, 200, { success: true, connection });
+        }
+        catch (error) {
+            writeError(res, error);
+        }
+    });
+    addRoute('POST', '/api/taskforce/model-connections/:connectionId/login', async (req, res, params) => {
+        const ownerUserId = authorize(req, res);
+        if (!ownerUserId)
+            return;
+        try {
+            const login = await loginManager().start(ownerUserId, params.connectionId);
+            writeJson(res, 202, { success: true, login });
+        }
+        catch (error) {
+            writeError(res, error);
+        }
+    });
+    addRoute('GET', '/api/taskforce/model-connections/:connectionId/login/:sessionId', async (req, res, params) => {
+        const ownerUserId = authorize(req, res);
+        if (!ownerUserId)
+            return;
+        try {
+            const login = loginManager().get(ownerUserId, params.connectionId, params.sessionId);
+            writeJson(res, 200, { success: true, login });
+        }
+        catch (error) {
+            writeError(res, error);
+        }
+    });
+    addRoute('POST', '/api/taskforce/model-connections/:connectionId/login/:sessionId/cancel', async (req, res, params) => {
+        const ownerUserId = authorize(req, res);
+        if (!ownerUserId)
+            return;
+        try {
+            const login = await loginManager().cancel(ownerUserId, params.connectionId, params.sessionId);
+            writeJson(res, 200, { success: true, login });
+        }
+        catch (error) {
+            writeError(res, error);
+        }
+    });
+    for (const operation of ['verify', 'refresh', 'disconnect']) {
+        addRoute('POST', `/api/taskforce/model-connections/:connectionId/${operation}`, async (req, res, params) => {
+            const ownerUserId = authorize(req, res);
+            if (!ownerUserId)
+                return;
+            try {
+                const connection = await service()[operation](ownerUserId, params.connectionId);
+                writeJson(res, 200, { success: true, connection });
+            }
+            catch (error) {
+                writeError(res, error);
+            }
+        });
+    }
+    addRoute('DELETE', '/api/taskforce/model-connections/:connectionId', async (req, res, params) => {
+        const ownerUserId = authorize(req, res);
+        if (!ownerUserId)
+            return;
+        try {
+            const result = await service().cleanup(ownerUserId, params.connectionId);
+            writeJson(res, 200, { success: true, ...result });
+        }
+        catch (error) {
+            writeError(res, error);
+        }
+    });
+}

package/dist/server/routes/primitives.d.ts

@@ -5,6 +5,7 @@ import type { LocalSyncCoordinatorRouteServices } from '../../sync/coordinator/l
 import type { WorkspaceSyncServerDataServices } from '../../sync/engine/workspaceSyncServerDataServices.js';
 import type { LocalServiceSessionManager } from '../localServiceSessions.js';
 import type { LocalServiceCloudTarget } from '../../config/localServiceCloudTarget.js';
+import type { LocalServiceRuntimeContract } from '../../config/localServiceRuntimeContract.js';
 export interface LocalServiceRouteContext {
     generation: string;
     protocolVersion: string;
@@ -13,6 +14,7 @@ export interface LocalServiceRouteContext {
     bootstrapCapability: string;
     ownershipKey: string;
     cloudTarget: LocalServiceCloudTarget;
+    runtimeContract: LocalServiceRuntimeContract;
     projectIdentity: string;
     operationClientId: string;
     sessions: LocalServiceSessionManager;

package/dist/server/routes/shared.d.ts

@@ -6,9 +6,11 @@
  * routes.ts at runtime.
  */
 import { IncomingMessage, ServerResponse } from 'http';
+import { NodeStreamableHTTPServerTransport } from '@modelcontextprotocol/node';
 import { TaskforceCore } from '../../core/Taskforce.js';
 import type { McpAccessTokenAuthResult, McpOAuthAccessTokenAuthResult, McpAccessTokenScope } from '../../core/Taskforce.js';
 import { type RouteContext } from './primitives.js';
+import { type McpRuntimeFactory, type TaskforceMcpServerOptions } from '../../mcp/runtime.js';
 import { type AiProfileBootstrapConfig } from '../../mcp/aiProfileBootstrap.js';
 import type { AiProfileSeatScope } from '../../shared/aiProfileSeatScope.js';
 import { type RequestPerformanceDiagnostics } from '../../storage/postgresRequestDiagnostics.js';
@@ -100,6 +102,20 @@ export declare function makeAuthenticateCloudMcpRequest(core: TaskforceCore, dep
     resolveAuthenticatedUserId: (req: IncomingMessage) => string;
     writeMcpHttpError: (res: ServerResponse, statusCode: number, message: string, data?: Record<string, unknown>) => void;
 }): (req: IncomingMessage, res: ServerResponse) => CloudMcpRequestAuth | null;
+export type CloudMcpToolPolicy = {
+    requiredScope: McpAccessTokenScope | null;
+    isWrite: boolean;
+};
+export type CloudMcpToolPolicyResolver = (toolName: string) => CloudMcpToolPolicy;
+export interface CloudMcpRuntimeLease {
+    runtime: ReturnType<McpRuntimeFactory>;
+    transport: NodeStreamableHTTPServerTransport;
+    release(): Promise<void>;
+}
+export type AcquireCloudMcpRuntime = (input: {
+    req: IncomingMessage;
+    options: TaskforceMcpServerOptions;
+}) => Promise<CloudMcpRuntimeLease>;
 export declare function makeHandleCloudMcpRequest(core: TaskforceCore, deps: {
     ensureAppAccess: (req: IncomingMessage, res: ServerResponse) => boolean;
     resolveAuthenticatedUserId: (req: IncomingMessage) => string;
@@ -109,6 +125,9 @@ export declare function makeHandleCloudMcpRequest(core: TaskforceCore, deps: {
         workspaceMaxRequests: number;
         windowMs: number;
     };
+    createMcpServer?: McpRuntimeFactory;
+    resolveMcpToolPolicy?: CloudMcpToolPolicyResolver;
+    acquireMcpRuntime?: AcquireCloudMcpRuntime;
 }): (req: IncomingMessage, res: ServerResponse) => Promise<void>;
 export declare function requestHeader(req: IncomingMessage, name: string, fallback?: string): string;
 export declare function requestWorkspaceHeader(req: IncomingMessage): string;