veryfront 0.1.144 → 0.1.145

package/esm/src/internal-agents/session-manager.js

@@ -1,4 +1,6 @@
 import * as dntShim from "../../_dnt.shims.js";
+import { RunAlreadyExistsError, RunCancelledError, RunNotActiveError, RunResumeSessionManager, WaitConflictError, WaitNotPendingError, } from "../agent/runtime/resume-session.js";
+export { RunNotActiveError };
 function stableJsonStringify(value, depth = 0) {
     if (depth > 64) {
         return JSON.stringify(value);
@@ -17,235 +19,110 @@ function stableJsonStringify(value, depth = 0) {
 function createToolResultKey(result, isError) {
     return `${isError ? "1" : "0"}:${stableJsonStringify(result)}`;
 }
-export class AgentRunCancelledError extends Error {
+export class AgentRunCancelledError extends RunCancelledError {
     constructor(message = "Run cancelled") {
         super(message);
         this.name = "AgentRunCancelledError";
     }
 }
-export class AgentRunAlreadyExistsError extends Error {
+export class AgentRunAlreadyExistsError extends RunAlreadyExistsError {
     constructor(runId) {
-        super(`Run "${runId}" is already active`);
+        super(runId);
         this.name = "AgentRunAlreadyExistsError";
     }
 }
-export class RunNotActiveError extends Error {
-    constructor(runId) {
-        super(`Run "${runId}" is not active`);
-        this.name = "RunNotActiveError";
-    }
-}
-export class ToolResultNotWaitingError extends Error {
+export class ToolResultNotWaitingError extends WaitNotPendingError {
     constructor(runId, toolCallId) {
-        super(`Run "${runId}" is not waiting for tool call "${toolCallId}"`);
+        super(runId, toolCallId);
         this.name = "ToolResultNotWaitingError";
     }
 }
-export class ToolResultConflictError extends Error {
+export class ToolResultConflictError extends WaitConflictError {
     constructor(runId, toolCallId) {
-        super(`Conflicting tool result for run "${runId}" and tool call "${toolCallId}"`);
+        super(runId, toolCallId);
         this.name = "ToolResultConflictError";
     }
 }
 const DEFAULT_WAITING_FOR_TOOL_TTL_MS = 5 * 60 * 1000;
 const DEFAULT_SESSION_TTL_MS = 15 * 60 * 1000;
-const DEFAULT_MAX_CONCURRENT_SESSIONS = 100;
 const AGENT_RUN_SESSION_MANAGER_GLOBAL_KEY = "__veryfrontAgentRunSessionManager";
 export class AgentRunSessionManager {
     options;
-    sessions = new Map();
+    sessions;
     constructor(options = {}) {
         this.options = options;
-    }
-    get waitingForToolTtlMs() {
-        return this.options.waitingForToolTtlMs ?? DEFAULT_WAITING_FOR_TOOL_TTL_MS;
-    }
-    get sessionTtlMs() {
-        return this.options.sessionTtlMs ?? null;
-    }
-    get setTimeoutFn() {
-        return this.options.setTimeoutFn ?? dntShim.dntGlobalThis.setTimeout.bind(dntShim.dntGlobalThis);
-    }
-    get clearTimeoutFn() {
-        return this.options.clearTimeoutFn ?? globalThis.clearTimeout.bind(dntShim.dntGlobalThis);
-    }
-    clearWaitingTimeout(session) {
-        if (session.waitingTimeoutId === null) {
-            return;
-        }
-        this.clearTimeoutFn(session.waitingTimeoutId);
-        session.waitingTimeoutId = null;
-    }
-    clearSessionTimeout(session) {
-        if (session.sessionTimeoutId === null) {
-            return;
-        }
-        this.clearTimeoutFn(session.sessionTimeoutId);
-        session.sessionTimeoutId = null;
-    }
-    scheduleSessionTimeout(session) {
-        if (this.sessionTtlMs === null) {
-            return;
-        }
-        this.clearSessionTimeout(session);
-        session.sessionTimeoutId = this.setTimeoutFn(() => {
-            this.cancelRun(session.runId);
-        }, this.sessionTtlMs);
-    }
-    scheduleWaitingTimeout(session) {
-        this.clearWaitingTimeout(session);
-        session.waitingTimeoutId = this.setTimeoutFn(() => {
-            this.cancelRun(session.runId);
-        }, this.waitingForToolTtlMs);
-    }
-    touchSession(session) {
-        if (session.status === "running" || session.status === "waiting") {
-            this.scheduleSessionTimeout(session);
-        }
-    }
-    finalizeSession(session, status) {
-        session.status = status;
-        this.clearWaitingTimeout(session);
-        this.clearSessionTimeout(session);
-        session.waitingTool = null;
-        this.sessions.delete(session.runId);
-    }
-    get maxConcurrentSessions() {
-        return this.options.maxConcurrentSessions ?? DEFAULT_MAX_CONCURRENT_SESSIONS;
+        const managerOptions = {
+            waitingTtlMs: this.options.waitingForToolTtlMs ?? DEFAULT_WAITING_FOR_TOOL_TTL_MS,
+            sessionTtlMs: this.options.sessionTtlMs ?? null,
+            maxConcurrentSessions: this.options.maxConcurrentSessions,
+            setTimeoutFn: this.options.setTimeoutFn,
+            clearTimeoutFn: this.options.clearTimeoutFn,
+            getConflictKey: (value) => value.key,
+        };
+        this.sessions = new RunResumeSessionManager(managerOptions);
     }
     startRun(input) {
-        const existing = this.sessions.get(input.runId);
-        if (existing && (existing.status === "running" || existing.status === "waiting")) {
-            throw new AgentRunAlreadyExistsError(input.runId);
+        try {
+            return this.sessions.startRun(input);
         }
-        if (this.sessions.size >= this.maxConcurrentSessions) {
-            throw new Error(`Maximum concurrent sessions (${this.maxConcurrentSessions}) reached`);
+        catch (error) {
+            if (error instanceof RunAlreadyExistsError) {
+                throw new AgentRunAlreadyExistsError(input.runId);
+            }
+            throw error;
         }
-        const session = {
-            runId: input.runId,
-            status: "running",
-            abortController: new AbortController(),
-            waitingTool: null,
-            submittedResults: new Map(),
-            waitingTimeoutId: null,
-            sessionTimeoutId: null,
-        };
-        this.sessions.set(input.runId, session);
-        this.touchSession(session);
-        return session.abortController.signal;
     }
     async waitForToolResult(runId, toolCallId) {
-        const session = this.sessions.get(runId);
-        if (!session || session.status === "completed" || session.status === "failed") {
-            throw new RunNotActiveError(runId);
-        }
-        if (session.abortController.signal.aborted || session.status === "cancelled") {
-            throw new AgentRunCancelledError();
+        try {
+            const value = await this.sessions.waitForSignal(runId, toolCallId);
+            return { result: value.result, isError: value.isError };
         }
-        const existingResult = session.submittedResults.get(toolCallId);
-        if (existingResult) {
-            session.status = "running";
-            this.touchSession(session);
-            return { result: existingResult.result, isError: existingResult.isError };
-        }
-        if (session.waitingTool && session.waitingTool.toolCallId !== toolCallId) {
-            throw new ToolResultNotWaitingError(runId, toolCallId);
+        catch (error) {
+            if (error instanceof RunCancelledError) {
+                throw new AgentRunCancelledError();
+            }
+            if (error instanceof WaitNotPendingError) {
+                throw new ToolResultNotWaitingError(runId, toolCallId);
+            }
+            throw error;
         }
-        session.status = "waiting";
-        this.scheduleWaitingTimeout(session);
-        this.touchSession(session);
-        return await new Promise((resolve, reject) => {
-            const abortHandler = () => {
-                this.clearWaitingTimeout(session);
-                session.waitingTool = null;
-                session.status = "cancelled";
-                reject(new AgentRunCancelledError());
-            };
-            session.abortController.signal.addEventListener("abort", abortHandler, { once: true });
-            session.waitingTool = {
-                toolCallId,
-                resolve: (value) => {
-                    session.abortController.signal.removeEventListener("abort", abortHandler);
-                    this.clearWaitingTimeout(session);
-                    session.waitingTool = null;
-                    session.status = "running";
-                    this.touchSession(session);
-                    resolve({ result: value.result, isError: value.isError });
-                },
-                reject: (reason) => {
-                    session.abortController.signal.removeEventListener("abort", abortHandler);
-                    this.clearWaitingTimeout(session);
-                    session.waitingTool = null;
-                    reject(reason);
-                },
-            };
-        });
     }
     submitToolResult(runId, input) {
-        const session = this.sessions.get(runId);
-        if (!session) {
-            throw new RunNotActiveError(runId);
-        }
         const normalized = {
             result: input.result,
             isError: Boolean(input.isError),
             key: createToolResultKey(input.result, Boolean(input.isError)),
         };
-        const existingResult = session.submittedResults.get(input.toolCallId);
-        if (existingResult) {
-            if (existingResult.key === normalized.key) {
-                return { accepted: true, duplicate: true };
+        try {
+            return this.sessions.submitSignal(runId, {
+                waitKey: input.toolCallId,
+                value: normalized,
+            });
+        }
+        catch (error) {
+            if (error instanceof WaitConflictError) {
+                throw new ToolResultConflictError(runId, input.toolCallId);
             }
-            throw new ToolResultConflictError(runId, input.toolCallId);
-        }
-        if (session.status === "completed" || session.status === "failed" ||
-            session.status === "cancelled") {
-            throw new RunNotActiveError(runId);
-        }
-        if (!session.waitingTool || session.waitingTool.toolCallId !== input.toolCallId) {
-            throw new ToolResultNotWaitingError(runId, input.toolCallId);
+            if (error instanceof WaitNotPendingError) {
+                throw new ToolResultNotWaitingError(runId, input.toolCallId);
+            }
+            throw error;
         }
-        session.submittedResults.set(input.toolCallId, normalized);
-        this.touchSession(session);
-        session.waitingTool.resolve(normalized);
-        return { accepted: true };
     }
     cancelRun(runId) {
-        const session = this.sessions.get(runId);
-        if (!session) {
-            return false;
-        }
-        if (session.status === "completed" || session.status === "failed" ||
-            session.status === "cancelled") {
-            return false;
-        }
-        const waitingTool = session.waitingTool;
-        session.abortController.abort(new AgentRunCancelledError());
-        waitingTool?.reject(new AgentRunCancelledError());
-        this.finalizeSession(session, "cancelled");
-        return true;
+        return this.sessions.cancelRun(runId);
     }
     completeRun(runId) {
-        const session = this.sessions.get(runId);
-        if (!session)
-            return;
-        this.finalizeSession(session, "completed");
+        this.sessions.completeRun(runId);
     }
     failRun(runId) {
-        const session = this.sessions.get(runId);
-        if (!session)
-            return;
-        this.finalizeSession(session, "failed");
+        this.sessions.failRun(runId);
     }
     getRunStatus(runId) {
-        return this.sessions.get(runId)?.status ?? null;
+        return this.sessions.getRunStatus(runId);
     }
     reset() {
-        for (const session of this.sessions.values()) {
-            this.clearWaitingTimeout(session);
-            this.clearSessionTimeout(session);
-        }
-        this.sessions.clear();
+        this.sessions.reset();
     }
 }
 function getGlobalAgentRunSessionManager() {

package/esm/src/mcp/index.d.ts

@@ -25,4 +25,6 @@ import "../../_dnt.polyfills.js";
 export type { MCPServerConfig, MCPStats, MCPTool, ToolAnnotations, ToolListEntry, } from "./types.js";
 export { clearMCPRegistry, getMCPRegistry, getMCPStats, registerPrompt, registerResource, registerTool, } from "./registry.js";
 export { createMCPServer, type IntegrationLoaderConfig, MCPServer } from "./server.js";
+export { formatSSEEvent, formatSSEPrimingEvent, formatSSERetry } from "./sse.js";
+export { SessionManager } from "./session.js";
 //# sourceMappingURL=index.d.ts.map

package/esm/src/mcp/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/src/mcp/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,OAAO,yBAAyB,CAAC;AAGjC,YAAY,EACV,eAAe,EACf,QAAQ,EACR,OAAO,EACP,eAAe,EACf,aAAa,GACd,MAAM,YAAY,CAAC;AAEpB,OAAO,EACL,gBAAgB,EAChB,cAAc,EACd,WAAW,EACX,cAAc,EACd,gBAAgB,EAChB,YAAY,GACb,MAAM,eAAe,CAAC;AAEvB,OAAO,EAAE,eAAe,EAAE,KAAK,uBAAuB,EAAE,SAAS,EAAE,MAAM,aAAa,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/src/mcp/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,OAAO,yBAAyB,CAAC;AAGjC,YAAY,EACV,eAAe,EACf,QAAQ,EACR,OAAO,EACP,eAAe,EACf,aAAa,GACd,MAAM,YAAY,CAAC;AAEpB,OAAO,EACL,gBAAgB,EAChB,cAAc,EACd,WAAW,EACX,cAAc,EACd,gBAAgB,EAChB,YAAY,GACb,MAAM,eAAe,CAAC;AAEvB,OAAO,EAAE,eAAe,EAAE,KAAK,uBAAuB,EAAE,SAAS,EAAE,MAAM,aAAa,CAAC;AAEvF,OAAO,EAAE,cAAc,EAAE,qBAAqB,EAAE,cAAc,EAAE,MAAM,UAAU,CAAC;AACjF,OAAO,EAAE,cAAc,EAAE,MAAM,cAAc,CAAC"}

package/esm/src/mcp/index.js

@@ -24,3 +24,5 @@
 import "../../_dnt.polyfills.js";
 export { clearMCPRegistry, getMCPRegistry, getMCPStats, registerPrompt, registerResource, registerTool, } from "./registry.js";
 export { createMCPServer, MCPServer } from "./server.js";
+export { formatSSEEvent, formatSSEPrimingEvent, formatSSERetry } from "./sse.js";
+export { SessionManager } from "./session.js";

package/esm/src/mcp/server.d.ts

@@ -28,6 +28,7 @@ export declare class MCPServer {
     private config;
     private integrationLoader?;
     private integrationsLoaded;
+    private sessionManager;
     constructor(config: MCPServerConfig);
     /**
      * Configure integration tools to be loaded from the API.

package/esm/src/mcp/server.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"server.d.ts","sourceRoot":"","sources":["../../../src/src/mcp/server.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,OAAO,MAAM,qBAAqB,CAAC;AAG/C,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,kBAAkB,CAAC;AAI7D,OAAO,KAAK,EAAE,eAAe,EAAiB,MAAM,YAAY,CAAC;AAMjE,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,0BAA0B,CAAC;AAWzE,KAAK,aAAa,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,OAAO,EAAE,CAAC;AA4DzD,UAAU,cAAc;IACtB,OAAO,EAAE,KAAK,CAAC;IACf,EAAE,CAAC,EAAE,MAAM,GAAG,MAAM,CAAC;IACrB,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,CAAC,EAAE,aAAa,CAAC;CACxB;AAED,UAAU,eAAe;IACvB,OAAO,EAAE,KAAK,CAAC;IACf,EAAE,CAAC,EAAE,MAAM,GAAG,MAAM,CAAC;IACrB,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,KAAK,CAAC,EAAE;QACN,IAAI,EAAE,MAAM,CAAC;QACb,OAAO,EAAE,MAAM,CAAC;QAChB,IAAI,CAAC,EAAE,OAAO,CAAC;KAChB,CAAC;CACH;AAED,MAAM,WAAW,uBAAuB;IACtC,YAAY,EAAE,MAAM,CAAC,MAAM,EAAE,wBAAwB,GAAG,SAAS,CAAC,CAAC;IACnE,UAAU,EAAE,MAAM,CAAC;IACnB,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB;AAID,qBAAa,SAAS;IACpB,OAAO,CAAC,MAAM,CAAkB;IAChC,OAAO,CAAC,iBAAiB,CAAC,CAA0B;IACpD,OAAO,CAAC,kBAAkB,CAAS;gBAEvB,MAAM,EAAE,eAAe;IAQnC;;;;;;OAMG;IACH,oBAAoB,CAAC,MAAM,EAAE,uBAAuB,GAAG,IAAI;IAK3D,aAAa,CAAC,OAAO,EAAE,cAAc,EAAE,OAAO,CAAC,EAAE,oBAAoB,GAAG,OAAO,CAAC,eAAe,CAAC;IAmBhG,OAAO,CAAC,QAAQ;IAoChB,OAAO,CAAC,UAAU;YA2BJ,SAAS;IA6BvB,OAAO,CAAC,QAAQ;IAgDhB,OAAO,CAAC,qBAAqB;IAuB7B,OAAO,CAAC,aAAa;IAoBrB,OAAO,CAAC,YAAY;IA6CpB,OAAO,CAAC,WAAW;IAgBnB,OAAO,CAAC,SAAS;IAuCjB,OAAO,CAAC,QAAQ;IAUhB,iBAAiB,IAAI,CAAC,OAAO,EAAE,OAAO,CAAC,OAAO,KAAK,OAAO,CAAC,OAAO,CAAC,QAAQ,CAAC;IAuD5E,OAAO,CAAC,qBAAqB;YAgBf,YAAY;IAsB1B,OAAO,CAAC,cAAc;YAqBR,0BAA0B;CAqBzC;AAED,wBAAgB,eAAe,CAAC,MAAM,EAAE,eAAe,GAAG,SAAS,CAElE"}
+{"version":3,"file":"server.d.ts","sourceRoot":"","sources":["../../../src/src/mcp/server.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,OAAO,MAAM,qBAAqB,CAAC;AAG/C,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,kBAAkB,CAAC;AAI7D,OAAO,KAAK,EAAE,eAAe,EAAiB,MAAM,YAAY,CAAC;AAMjE,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,0BAA0B,CAAC;AAYzE,KAAK,aAAa,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,OAAO,EAAE,CAAC;AA4DzD,UAAU,cAAc;IACtB,OAAO,EAAE,KAAK,CAAC;IACf,EAAE,CAAC,EAAE,MAAM,GAAG,MAAM,CAAC;IACrB,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,CAAC,EAAE,aAAa,CAAC;CACxB;AAED,UAAU,eAAe;IACvB,OAAO,EAAE,KAAK,CAAC;IACf,EAAE,CAAC,EAAE,MAAM,GAAG,MAAM,CAAC;IACrB,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,KAAK,CAAC,EAAE;QACN,IAAI,EAAE,MAAM,CAAC;QACb,OAAO,EAAE,MAAM,CAAC;QAChB,IAAI,CAAC,EAAE,OAAO,CAAC;KAChB,CAAC;CACH;AAED,MAAM,WAAW,uBAAuB;IACtC,YAAY,EAAE,MAAM,CAAC,MAAM,EAAE,wBAAwB,GAAG,SAAS,CAAC,CAAC;IACnE,UAAU,EAAE,MAAM,CAAC;IACnB,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB;AAID,qBAAa,SAAS;IACpB,OAAO,CAAC,MAAM,CAAkB;IAChC,OAAO,CAAC,iBAAiB,CAAC,CAA0B;IACpD,OAAO,CAAC,kBAAkB,CAAS;IACnC,OAAO,CAAC,cAAc,CAAwB;gBAElC,MAAM,EAAE,eAAe;IAQnC;;;;;;OAMG;IACH,oBAAoB,CAAC,MAAM,EAAE,uBAAuB,GAAG,IAAI;IAK3D,aAAa,CAAC,OAAO,EAAE,cAAc,EAAE,OAAO,CAAC,EAAE,oBAAoB,GAAG,OAAO,CAAC,eAAe,CAAC;IAmBhG,OAAO,CAAC,QAAQ;IAoChB,OAAO,CAAC,UAAU;YA2BJ,SAAS;IA6BvB,OAAO,CAAC,QAAQ;IAgDhB,OAAO,CAAC,qBAAqB;IAuB7B,OAAO,CAAC,aAAa;IAoBrB,OAAO,CAAC,YAAY;IA6CpB,OAAO,CAAC,WAAW;IAgBnB,OAAO,CAAC,SAAS;IAuCjB,OAAO,CAAC,QAAQ;IAUhB,iBAAiB,IAAI,CAAC,OAAO,EAAE,OAAO,CAAC,OAAO,KAAK,OAAO,CAAC,OAAO,CAAC,QAAQ,CAAC;IAiG5E,OAAO,CAAC,qBAAqB;YAgBf,YAAY;IAsB1B,OAAO,CAAC,cAAc;YAsBR,0BAA0B;CAqBzC;AAED,wBAAgB,eAAe,CAAC,MAAM,EAAE,eAAe,GAAG,SAAS,CAElE"}

package/esm/src/mcp/server.js

@@ -10,6 +10,7 @@ import { VERSION } from "../utils/version.js";
 import { validateContentType } from "../security/input-validation/limits.js";
 import { VeryfrontError } from "../security/input-validation/errors.js";
 import { logger as baseLogger } from "../utils/index.js";
+import { SessionManager } from "./session.js";
 const logger = baseLogger.component("mcp-server");
 const MAX_REQUEST_BODY_SIZE = 1_048_576; // 1 MB
 const MAX_CONTEXT_HEADER_LENGTH = 255;
@@ -68,6 +69,7 @@ export class MCPServer {
     config;
     integrationLoader;
     integrationsLoaded = false;
+    sessionManager = new SessionManager();
     constructor(config) {
         this.config = config;
         if (!config.auth || config.auth.type === "none") {
@@ -328,19 +330,33 @@ export class MCPServer {
     createHTTPHandler() {
         return async (request) => {
             const requestOrigin = request.headers.get("Origin");
+            // CORS preflight
             if (request.method === "OPTIONS") {
                 return new dntShim.Response(null, { status: 204, headers: this.getCORSHeaders(requestOrigin) });
             }
+            // Origin validation (DNS rebinding protection)
             if (requestOrigin && this.config.cors?.enabled && this.config.cors.origins?.length) {
                 if (!this.config.cors.origins.includes(requestOrigin)) {
                     return createJSONRPCErrorResponse(403, -32600, "Forbidden: Origin not allowed");
                 }
             }
+            // Auth check (applies to all methods including DELETE)
             if (this.config.auth?.type && this.config.auth.type !== "none") {
                 const authorized = await this.validateAuth(request);
                 if (!authorized)
                     return new dntShim.Response("Unauthorized", { status: 401 });
             }
+            // DELETE = terminate session
+            if (request.method === "DELETE") {
+                const sessionId = request.headers.get("MCP-Session-Id");
+                if (sessionId)
+                    this.sessionManager.terminate(sessionId);
+                return new dntShim.Response(null, { status: 200, headers: this.getCORSHeaders(requestOrigin) });
+            }
+            // Only POST allowed for JSON-RPC messages
+            if (request.method !== "POST") {
+                return new dntShim.Response("Method Not Allowed", { status: 405 });
+            }
             // Enforce request body size limit (fast path via Content-Length header)
             const contentLength = request.headers.get("content-length");
             if (contentLength && Number(contentLength) > MAX_REQUEST_BODY_SIZE) {
@@ -365,14 +381,37 @@ export class MCPServer {
                 // expected: malformed JSON in request body
                 return createJSONRPCErrorResponse(400, -32700, "Parse error");
             }
-            // Extract end-user identity from request headers for per-user token flows
+            // Session management: initialize creates session, everything else requires it
+            const responseHeaders = {
+                ...this.getCORSHeaders(requestOrigin),
+            };
+            if (rpcRequest.method === "initialize") {
+                const context = this.extractRequestContext(request);
+                const rpcResponse = await this.handleRequest(rpcRequest, context);
+                const sessionId = this.sessionManager.create();
+                responseHeaders["MCP-Session-Id"] = sessionId;
+                return createJSONResponse(rpcResponse, { headers: responseHeaders });
+            }
+            // Post-init: require session ID when sessions are active
+            if (this.sessionManager.size > 0) {
+                const sessionId = request.headers.get("MCP-Session-Id");
+                if (!sessionId) {
+                    return createJSONRPCErrorResponse(400, -32600, "Missing MCP-Session-Id header");
+                }
+                if (!this.sessionManager.isValid(sessionId)) {
+                    return createJSONRPCErrorResponse(404, -32600, "Session not found or expired");
+                }
+            }
+            // Notifications have no id member — return 202 Accepted
+            // Note: id:0 is a valid request ID per JSON-RPC 2.0, so check for undefined
+            if (rpcRequest.id === undefined) {
+                const context = this.extractRequestContext(request);
+                await this.handleRequest(rpcRequest, context);
+                return new dntShim.Response(null, { status: 202, headers: responseHeaders });
+            }
             const context = this.extractRequestContext(request);
             const rpcResponse = await this.handleRequest(rpcRequest, context);
-            return createJSONResponse(rpcResponse, {
-                headers: {
-                    ...this.getCORSHeaders(requestOrigin),
-                },
-            });
+            return createJSONResponse(rpcResponse, { headers: responseHeaders });
         };
     }
     extractRequestContext(request) {
@@ -420,8 +459,8 @@ export class MCPServer {
             return {};
         return {
             "Access-Control-Allow-Origin": matchedOrigin,
-            "Access-Control-Allow-Methods": "POST, OPTIONS",
-            "Access-Control-Allow-Headers": "Content-Type, Authorization, X-End-User-Id, X-Project-Id",
+            "Access-Control-Allow-Methods": "POST, GET, DELETE, OPTIONS",
+            "Access-Control-Allow-Headers": "Content-Type, Authorization, MCP-Session-Id, X-End-User-Id, X-Project-Id",
             "Vary": "Origin",
         };
     }

package/esm/src/mcp/session.d.ts

@@ -0,0 +1,9 @@
+export declare class SessionManager {
+    private sessions;
+    create(): string;
+    isValid(id: string): boolean;
+    terminate(id: string): void;
+    get size(): number;
+    clear(): void;
+}
+//# sourceMappingURL=session.d.ts.map

package/esm/src/mcp/session.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"session.d.ts","sourceRoot":"","sources":["../../../src/src/mcp/session.ts"],"names":[],"mappings":"AAMA,qBAAa,cAAc;IACzB,OAAO,CAAC,QAAQ,CAAqB;IAErC,MAAM,IAAI,MAAM;IAMhB,OAAO,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO;IAI5B,SAAS,CAAC,EAAE,EAAE,MAAM,GAAG,IAAI;IAI3B,IAAI,IAAI,IAAI,MAAM,CAEjB;IAED,KAAK,IAAI,IAAI;CAGd"}

package/esm/src/mcp/session.js

@@ -0,0 +1,25 @@
+/**
+ * Manages MCP sessions for the Streamable HTTP transport.
+ * Sessions are created during initialization and validated on subsequent requests.
+ */
+import * as dntShim from "../../_dnt.shims.js";
+export class SessionManager {
+    sessions = new Set();
+    create() {
+        const id = dntShim.crypto.randomUUID();
+        this.sessions.add(id);
+        return id;
+    }
+    isValid(id) {
+        return this.sessions.has(id);
+    }
+    terminate(id) {
+        this.sessions.delete(id);
+    }
+    get size() {
+        return this.sessions.size;
+    }
+    clear() {
+        this.sessions.clear();
+    }
+}

package/esm/src/mcp/sse.d.ts

@@ -0,0 +1,8 @@
+/**
+ * Stateless SSE formatting utilities per the Server-Sent Events standard.
+ * Used by the Streamable HTTP transport for MCP.
+ */
+export declare function formatSSEEvent(data: unknown, id?: string): string;
+export declare function formatSSERetry(ms: number): string;
+export declare function formatSSEPrimingEvent(id: string): string;
+//# sourceMappingURL=sse.d.ts.map

package/esm/src/mcp/sse.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sse.d.ts","sourceRoot":"","sources":["../../../src/src/mcp/sse.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,wBAAgB,cAAc,CAAC,IAAI,EAAE,OAAO,EAAE,EAAE,CAAC,EAAE,MAAM,GAAG,MAAM,CAKjE;AAED,wBAAgB,cAAc,CAAC,EAAE,EAAE,MAAM,GAAG,MAAM,CAEjD;AAED,wBAAgB,qBAAqB,CAAC,EAAE,EAAE,MAAM,GAAG,MAAM,CAExD"}

package/esm/src/mcp/sse.js

@@ -0,0 +1,17 @@
+/**
+ * Stateless SSE formatting utilities per the Server-Sent Events standard.
+ * Used by the Streamable HTTP transport for MCP.
+ */
+export function formatSSEEvent(data, id) {
+    let event = "";
+    if (id)
+        event += `id: ${id}\n`;
+    event += `data: ${JSON.stringify(data)}\n\n`;
+    return event;
+}
+export function formatSSERetry(ms) {
+    return `retry: ${ms}\n\n`;
+}
+export function formatSSEPrimingEvent(id) {
+    return `id: ${id}\ndata: \n\n`;
+}

package/esm/src/platform/cloud/resolver.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"resolver.d.ts","sourceRoot":"","sources":["../../../../src/src/platform/cloud/resolver.ts"],"names":[],"mappings":"AAKA,eAAO,MAAM,6BAA6B,gDAAgD,CAAC;AAC3F,eAAO,MAAM,uCAAuC,kDACH,CAAC;AAElD,MAAM,WAAW,uBAAuB;IACtC,UAAU,EAAE,MAAM,CAAC;IACnB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,iBAAiB,EAAE,OAAO,CAAC;IAC3B,eAAe,EAAE,OAAO,CAAC;CAC1B;AA0CD,wBAAgB,0BAA0B,IAAI,MAAM,GAAG,SAAS,CAE/D;AAED,wBAAgB,4BAA4B,IAAI,MAAM,GAAG,SAAS,CAEjE;AAED,wBAAgB,0BAA0B,IAAI,uBAAuB,CAKpE;AAED,wBAAgB,uBAAuB,IAAI,OAAO,CAgBjD;AAED,wBAAgB,6BAA6B,IAAI,MAAM,CAKtD;AAED,wBAAgB,sCAAsC,IAAI,MAAM,CAK/D"}
+{"version":3,"file":"resolver.d.ts","sourceRoot":"","sources":["../../../../src/src/platform/cloud/resolver.ts"],"names":[],"mappings":"AAMA,eAAO,MAAM,6BAA6B,gDAAgD,CAAC;AAC3F,eAAO,MAAM,uCAAuC,kDACH,CAAC;AAElD,MAAM,WAAW,uBAAuB;IACtC,UAAU,EAAE,MAAM,CAAC;IACnB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,iBAAiB,EAAE,OAAO,CAAC;IAC3B,eAAe,EAAE,OAAO,CAAC;CAC1B;AAmDD,wBAAgB,0BAA0B,IAAI,MAAM,GAAG,SAAS,CAE/D;AAED,wBAAgB,4BAA4B,IAAI,MAAM,GAAG,SAAS,CAEjE;AAED,wBAAgB,0BAA0B,IAAI,uBAAuB,CAOpE;AAED,wBAAgB,uBAAuB,IAAI,OAAO,CAgBjD;AAED,wBAAgB,6BAA6B,IAAI,MAAM,CAKtD;AAED,wBAAgB,sCAAsC,IAAI,MAAM,CAK/D"}

package/esm/src/platform/cloud/resolver.js

@@ -2,6 +2,7 @@ import { getRuntimeConfig, isRuntimeConfigInitialized } from "../../config/index
 import { getApiBaseUrlEnv } from "../../config/env.js";
 import { getCurrentRequestContext } from "../adapters/fs/veryfront/multi-project-adapter.js";
 import { getEnv } from "../compat/process.js";
+import { getCurrentVeryfrontCloudContext } from "../../provider/veryfront-cloud/context.js";
 export const DEFAULT_VERYFRONT_CLOUD_MODEL = "veryfront-cloud/anthropic/claude-sonnet-4-6";
 export const DEFAULT_VERYFRONT_CLOUD_EMBEDDING_MODEL = "veryfront-cloud/openai/text-embedding-3-small";
 function getRuntimeBootstrap() {
@@ -19,18 +20,26 @@ function normalizeCloudModelString(value, fallback) {
     const resolved = value?.trim() || fallback;
     return resolved.startsWith("veryfront-cloud/") ? resolved : `veryfront-cloud/${resolved}`;
 }
+function normalizeServiceLayer(value) {
+    const normalized = value?.trim().toLowerCase();
+    return normalized?.length ? normalized : undefined;
+}
 function getResolvedVeryfrontCloudContext() {
     const requestContext = getCurrentRequestContext();
+    const scopedContext = getCurrentVeryfrontCloudContext();
     const runtimeBootstrap = getRuntimeBootstrap();
     return {
         apiToken: requestContext?.token ??
+            scopedContext?.apiToken ??
             getEnv("VERYFRONT_API_TOKEN") ??
             runtimeBootstrap.apiToken,
         projectSlug: requestContext?.projectSlug ??
+            scopedContext?.projectSlug ??
             getEnv("VERYFRONT_PROJECT_SLUG") ??
             runtimeBootstrap.projectSlug,
-        serviceLayer: getEnv("VERYFRONT_SERVICE_LAYER")?.trim().toLowerCase(),
-        hasRequestContext: requestContext !== null,
+        serviceLayer: normalizeServiceLayer(scopedContext?.serviceLayer) ??
+            normalizeServiceLayer(getEnv("VERYFRONT_SERVICE_LAYER")),
+        hasRequestContext: requestContext !== null || scopedContext !== undefined,
         usesVeryfrontFs: runtimeBootstrap.usesVeryfrontFs,
     };
 }
@@ -41,8 +50,9 @@ export function getVeryfrontCloudProjectSlug() {
     return getResolvedVeryfrontCloudContext().projectSlug;
 }
 export function getVeryfrontCloudBootstrap() {
+    const scopedContext = getCurrentVeryfrontCloudContext();
     return {
-        apiBaseUrl: getApiBaseUrlEnv(),
+        apiBaseUrl: scopedContext?.apiBaseUrl?.trim() || getApiBaseUrlEnv(),
         ...getResolvedVeryfrontCloudContext(),
     };
 }

package/esm/src/provider/index.d.ts

@@ -18,4 +18,6 @@
 import "../../_dnt.polyfills.js";
 export { clearModelProviders, ensureModelReady, findAvailableCloudModel, getRegisteredModelProviders, hasModelProvider, registerModelProvider, resolveModel, } from "./model-registry.js";
 export type { ModelProviderFactory } from "./model-registry.js";
+export { runWithVeryfrontCloudContext, runWithVeryfrontCloudContextAsync, } from "./veryfront-cloud/context.js";
+export type { VeryfrontCloudContext } from "./veryfront-cloud/context.js";
 //# sourceMappingURL=index.d.ts.map

package/esm/src/provider/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/src/provider/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AACH,OAAO,yBAAyB,CAAC;AAGjC,OAAO,EACL,mBAAmB,EACnB,gBAAgB,EAChB,uBAAuB,EACvB,2BAA2B,EAC3B,gBAAgB,EAChB,qBAAqB,EACrB,YAAY,GACb,MAAM,qBAAqB,CAAC;AAC7B,YAAY,EAAE,oBAAoB,EAAE,MAAM,qBAAqB,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/src/provider/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AACH,OAAO,yBAAyB,CAAC;AAGjC,OAAO,EACL,mBAAmB,EACnB,gBAAgB,EAChB,uBAAuB,EACvB,2BAA2B,EAC3B,gBAAgB,EAChB,qBAAqB,EACrB,YAAY,GACb,MAAM,qBAAqB,CAAC;AAC7B,YAAY,EAAE,oBAAoB,EAAE,MAAM,qBAAqB,CAAC;AAChE,OAAO,EACL,4BAA4B,EAC5B,iCAAiC,GAClC,MAAM,8BAA8B,CAAC;AACtC,YAAY,EAAE,qBAAqB,EAAE,MAAM,8BAA8B,CAAC"}

package/esm/src/provider/index.js

@@ -17,3 +17,4 @@
  */
 import "../../_dnt.polyfills.js";
 export { clearModelProviders, ensureModelReady, findAvailableCloudModel, getRegisteredModelProviders, hasModelProvider, registerModelProvider, resolveModel, } from "./model-registry.js";
+export { runWithVeryfrontCloudContext, runWithVeryfrontCloudContextAsync, } from "./veryfront-cloud/context.js";

package/esm/src/provider/veryfront-cloud/context.d.ts

@@ -0,0 +1,10 @@
+export interface VeryfrontCloudContext {
+    apiBaseUrl?: string;
+    apiToken?: string;
+    projectSlug?: string;
+    serviceLayer?: string;
+}
+export declare function runWithVeryfrontCloudContext<T>(context: VeryfrontCloudContext, fn: () => T): T;
+export declare function runWithVeryfrontCloudContextAsync<T>(context: VeryfrontCloudContext, fn: () => Promise<T>): Promise<T>;
+export declare function getCurrentVeryfrontCloudContext(): VeryfrontCloudContext | undefined;
+//# sourceMappingURL=context.d.ts.map

package/esm/src/provider/veryfront-cloud/context.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"context.d.ts","sourceRoot":"","sources":["../../../../src/src/provider/veryfront-cloud/context.ts"],"names":[],"mappings":"AAEA,MAAM,WAAW,qBAAqB;IACpC,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,YAAY,CAAC,EAAE,MAAM,CAAC;CACvB;AAID,wBAAgB,4BAA4B,CAAC,CAAC,EAC5C,OAAO,EAAE,qBAAqB,EAC9B,EAAE,EAAE,MAAM,CAAC,GACV,CAAC,CAEH;AAED,wBAAgB,iCAAiC,CAAC,CAAC,EACjD,OAAO,EAAE,qBAAqB,EAC9B,EAAE,EAAE,MAAM,OAAO,CAAC,CAAC,CAAC,GACnB,OAAO,CAAC,CAAC,CAAC,CAEZ;AAED,wBAAgB,+BAA+B,IAAI,qBAAqB,GAAG,SAAS,CAEnF"}

package/esm/src/provider/veryfront-cloud/context.js

@@ -0,0 +1,11 @@
+import { AsyncLocalStorage } from "node:async_hooks";
+const veryfrontCloudContextStorage = new AsyncLocalStorage();
+export function runWithVeryfrontCloudContext(context, fn) {
+    return veryfrontCloudContextStorage.run(context, fn);
+}
+export function runWithVeryfrontCloudContextAsync(context, fn) {
+    return veryfrontCloudContextStorage.run(context, fn);
+}
+export function getCurrentVeryfrontCloudContext() {
+    return veryfrontCloudContextStorage.getStore();
+}

package/esm/src/tool/index.d.ts

@@ -43,9 +43,11 @@
  * ```
  */
 import "../../_dnt.polyfills.js";
-export type { Tool, ToolConfig, ToolDefinition, ToolExecutionContext } from "./types.js";
+export type { RemoteToolSource, Tool, ToolConfig, ToolDefinition, ToolExecutionContext, } from "./types.js";
 export { dynamicTool, tool } from "./factory.js";
 export type { DynamicToolConfig } from "./factory.js";
+export { createRemoteMCPToolSource } from "./remote-mcp.js";
+export type { RemoteMCPToolSourceConfig } from "./remote-mcp.js";
 export { toolRegistry } from "./registry.js";
 export { executeTool } from "./executor.js";
 export type { JsonSchema } from "./schema/index.js";

package/esm/src/tool/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/src/tool/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2CG;AACH,OAAO,yBAAyB,CAAC;AAGjC,YAAY,EAAE,IAAI,EAAE,UAAU,EAAE,cAAc,EAAE,oBAAoB,EAAE,MAAM,YAAY,CAAC;AAEzF,OAAO,EAAE,WAAW,EAAE,IAAI,EAAE,MAAM,cAAc,CAAC;AACjD,YAAY,EAAE,iBAAiB,EAAE,MAAM,cAAc,CAAC;AAEtD,OAAO,EAAE,YAAY,EAAE,MAAM,eAAe,CAAC;AAE7C,OAAO,EAAE,WAAW,EAAE,MAAM,eAAe,CAAC;AAE5C,YAAY,EAAE,UAAU,EAAE,MAAM,mBAAmB,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/src/tool/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2CG;AACH,OAAO,yBAAyB,CAAC;AAGjC,YAAY,EACV,gBAAgB,EAChB,IAAI,EACJ,UAAU,EACV,cAAc,EACd,oBAAoB,GACrB,MAAM,YAAY,CAAC;AAEpB,OAAO,EAAE,WAAW,EAAE,IAAI,EAAE,MAAM,cAAc,CAAC;AACjD,YAAY,EAAE,iBAAiB,EAAE,MAAM,cAAc,CAAC;AACtD,OAAO,EAAE,yBAAyB,EAAE,MAAM,iBAAiB,CAAC;AAC5D,YAAY,EAAE,yBAAyB,EAAE,MAAM,iBAAiB,CAAC;AAEjE,OAAO,EAAE,YAAY,EAAE,MAAM,eAAe,CAAC;AAE7C,OAAO,EAAE,WAAW,EAAE,MAAM,eAAe,CAAC;AAE5C,YAAY,EAAE,UAAU,EAAE,MAAM,mBAAmB,CAAC"}

package/esm/src/tool/index.js

@@ -44,5 +44,6 @@
  */
 import "../../_dnt.polyfills.js";
 export { dynamicTool, tool } from "./factory.js";
+export { createRemoteMCPToolSource } from "./remote-mcp.js";
 export { toolRegistry } from "./registry.js";
 export { executeTool } from "./executor.js";