veryfront 0.1.159 → 0.1.162

package/esm/src/tool/remote-source-tools.js

@@ -0,0 +1,33 @@
+import { z } from "zod";
+import { dynamicTool } from "./factory.js";
+function toToolInputRecord(input) {
+    if (typeof input !== "object" || input === null || Array.isArray(input)) {
+        return {};
+    }
+    return Object.fromEntries(Object.entries(input));
+}
+export function createToolsFromRemoteDefinitions(source, definitions, options = {}) {
+    return Object.fromEntries(definitions.map((definition) => {
+        const toolName = options.toolNameAliases?.[definition.name] ?? definition.name;
+        return [
+            toolName,
+            dynamicTool({
+                id: toolName,
+                description: definition.description,
+                inputSchema: z.object({}).passthrough(),
+                inputSchemaJson: definition.parameters,
+                mcp: {
+                    title: definition.title,
+                    annotations: definition.annotations,
+                },
+                execute: async (input, context) => await source.executeTool(definition.name, toToolInputRecord(input), context),
+            }),
+        ];
+    }));
+}
+export async function loadRemoteToolsFromSource(source, options = {}) {
+    const definitions = await source.listTools(options.context);
+    return createToolsFromRemoteDefinitions(source, definitions, {
+        toolNameAliases: options.toolNameAliases,
+    });
+}

package/esm/src/utils/version-constant.d.ts

@@ -1,2 +1,2 @@
-export declare const VERSION = "0.1.159";
+export declare const VERSION = "0.1.162";
 //# sourceMappingURL=version-constant.d.ts.map

package/esm/src/utils/version-constant.js

@@ -1,3 +1,3 @@
 // Keep in sync with deno.json version.
 // scripts/release.ts updates this constant during releases.
-export const VERSION = "0.1.159";
+export const VERSION = "0.1.162";

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "veryfront",
-  "version": "0.1.159",
+  "version": "0.1.162",
   "description": "The simplest way to build AI-powered apps",
   "keywords": [
     "react",

package/src/deno.js

@@ -1,6 +1,6 @@
 export default {
   "name": "veryfront",
-  "version": "0.1.159",
+  "version": "0.1.162",
   "license": "Apache-2.0",
   "nodeModulesDir": "auto",
   "exclude": [

package/src/src/agent/index.ts

@@ -97,7 +97,13 @@ export type {
   MessagePart,
   ModelProvider,
   ModelString,
+  ModelTransportRequest,
+  ModelTransportResolver,
   ResolvedAgentConfig,
+  ResolvedModelTransport,
+  ResolvedRuntimeState,
+  RuntimeStateRequest,
+  RuntimeStateResolver,
   StreamToolCall,
   ToolCall,
   ToolCallPart,

package/src/src/agent/runtime/index.ts

@@ -10,6 +10,8 @@
  *
  * @module ai/agent/runtime
  */
+import * as dntShim from "../../../_dnt.shims.js";
+
 
 import {
   type AgentConfig,
@@ -19,6 +21,7 @@ import {
   getTextFromParts,
   type Message,
   type MessagePart,
+  type ResolvedRuntimeState,
   type ToolCall,
   type ToolResultPart,
 } from "../types.js";
@@ -264,6 +267,19 @@ function getRuntimeAllowedRemoteTools(config: AgentConfig): string[] | undefined
   return raw.every((toolName) => typeof toolName === "string") ? raw : [];
 }
 
+type ResolvedModelTransport = {
+  requestedModel: string;
+  resolvedModelString: string;
+  languageModel: ModelRuntime;
+  headers?: dntShim.HeadersInit;
+  providerOptions?: Record<string, unknown>;
+};
+
+type RuntimeStepState = {
+  systemPrompt: string;
+  context?: Record<string, unknown>;
+};
+
 export class AgentRuntime {
   private id: string;
   private config: AgentConfig;
@@ -279,6 +295,52 @@ export class AgentRuntime {
     this.memory = createMemory<Message>(memoryConfig);
   }
 
+  private async resolveModelTransport(
+    context: Record<string, unknown> | undefined,
+    modelOverride: string | undefined,
+    mode: "generate" | "stream",
+  ): Promise<ResolvedModelTransport> {
+    const requestedModel = resolveConfiguredAgentModel(modelOverride || this.config.model);
+    const resolvedModelString = resolveRuntimeModel(modelOverride || this.config.model);
+    const transport = await this.config.resolveModelTransport?.({
+      agentId: this.id,
+      requestedModel,
+      resolvedModel: resolvedModelString,
+      context,
+      mode,
+    });
+
+    return {
+      requestedModel,
+      resolvedModelString,
+      languageModel: transport?.model ?? resolveModel(resolvedModelString),
+      headers: transport?.headers,
+      providerOptions: transport?.providerOptions,
+    };
+  }
+
+  private async resolveRuntimeState(
+    messages: Message[],
+    context: Record<string, unknown> | undefined,
+    mode: "generate" | "stream",
+    step: number,
+    systemPrompt: string,
+  ): Promise<RuntimeStepState> {
+    const refreshed: ResolvedRuntimeState | undefined = await this.config.resolveRuntimeState?.({
+      agentId: this.id,
+      mode,
+      step,
+      system: systemPrompt,
+      messages: [...messages],
+      context,
+    });
+
+    return {
+      systemPrompt: refreshed?.system ?? systemPrompt,
+      context: refreshed?.context ?? context,
+    };
+  }
+
   /**
    * Generate a response (non-streaming)
    */
@@ -288,8 +350,9 @@ export class AgentRuntime {
     modelOverride?: string,
     maxOutputTokensOverride?: number,
   ): Promise<AgentResponse> {
-    const requestedModel = resolveConfiguredAgentModel(modelOverride || this.config.model);
-    const resolvedModelString = resolveRuntimeModel(modelOverride || this.config.model);
+    const transport = await this.resolveModelTransport(context, modelOverride, "generate");
+    const requestedModel = transport.requestedModel;
+    const resolvedModelString = transport.resolvedModelString;
     if (resolvedModelString !== requestedModel) {
       logger.info(
         `⚡ Using runtime model "${resolvedModelString}" instead of "${requestedModel}".`,
@@ -326,9 +389,12 @@ export class AgentRuntime {
             {
               agentId: this.id,
               projectId: tryGetCacheKeyContext()?.projectId,
-              ...context,
             },
+            context,
             resolvedModelString,
+            transport.languageModel,
+            transport.headers,
+            transport.providerOptions,
             maxOutputTokensOverride,
           ),
       );
@@ -351,8 +417,9 @@ export class AgentRuntime {
     maxOutputTokensOverride?: number,
     abortSignal?: AbortSignal,
   ): Promise<ReadableStream<Uint8Array>> {
-    const requestedModel = resolveConfiguredAgentModel(modelOverride || this.config.model);
-    const resolvedModelString = resolveRuntimeModel(modelOverride || this.config.model);
+    const transport = await this.resolveModelTransport(context, modelOverride, "stream");
+    const requestedModel = transport.requestedModel;
+    const resolvedModelString = transport.resolvedModelString;
     if (resolvedModelString !== requestedModel) {
       logger.info(
         `⚡ Using runtime model "${resolvedModelString}" instead of "${requestedModel}".`,
@@ -389,7 +456,7 @@ export class AgentRuntime {
     // Resolve model BEFORE creating the ReadableStream — if this throws
     // (e.g., no_ai_available), the error propagates to the caller who can
     // return a proper error response (503) instead of a 200 with an error event.
-    const languageModel = resolveModel(resolvedModelString);
+    const languageModel = transport.languageModel;
 
     // Determine inference mode from the resolved model object (not the string),
     // because resolveModel may internally fall back from cloud to local.
@@ -433,8 +500,11 @@ export class AgentRuntime {
             callbacks,
             textPartId,
             toolContext,
+            context,
             resolvedModelString,
             languageModel,
+            transport.headers,
+            transport.providerOptions,
             maxOutputTokensOverride,
             streamAbortSignal,
           );
@@ -474,15 +544,19 @@ export class AgentRuntime {
   private async executeAgentLoop(
     systemPrompt: string,
     messages: Message[],
-    toolContext?: ToolExecutionContext,
+    toolContextBase?: ToolExecutionContext,
+    runtimeContext?: Record<string, unknown>,
     modelString?: string,
+    resolvedModel?: ModelRuntime,
+    headers?: dntShim.HeadersInit,
+    providerOptions?: Record<string, unknown>,
     maxOutputTokensOverride?: number,
   ): Promise<AgentResponse> {
     return withSpan("agent.execution_loop", async (loopSpan) => {
       const { maxAgentSteps } = getPlatformCapabilities();
       const maxSteps = this.computeMaxSteps(maxAgentSteps);
       const effectiveModel = resolveRuntimeModel(modelString || this.config.model);
-      const languageModel = resolveModel(effectiveModel);
+      const languageModel = resolvedModel ?? resolveModel(effectiveModel);
 
       const toolCalls: ToolCall[] = [];
       const currentMessages = [...messages];
@@ -502,11 +576,24 @@ export class AgentRuntime {
       // Request-scoped skill policy (not class-level mutable state)
       let activeSkillPolicy: string[] | undefined;
       const allowedRemoteToolNames = getRuntimeAllowedRemoteTools(this.config);
+      let currentSystemPrompt = systemPrompt;
+      let currentRuntimeContext = runtimeContext;
 
       for (let step = 0; step < maxSteps; step++) {
         this.status = "thinking";
         addSpanEvent(loopSpan, "step_start", { step });
 
+        const runtimeState = await this.resolveRuntimeState(
+          currentMessages,
+          currentRuntimeContext,
+          "generate",
+          step,
+          currentSystemPrompt,
+        );
+        currentSystemPrompt = runtimeState.systemPrompt;
+        currentRuntimeContext = runtimeState.context;
+        const toolContext = { ...toolContextBase, ...currentRuntimeContext };
+
         let tools = isLocal ? [] : await getAvailableTools(this.config.tools, {
           includeSkillTools: Boolean(this.config.skills),
           allowedRemoteToolNames,
@@ -526,7 +613,7 @@ export class AgentRuntime {
           });
           return generateText({
             model: languageModel,
-            system: systemPrompt,
+            system: currentSystemPrompt,
             messages: convertToModelMessages(currentMessages),
             tools: convertToolsToRuntimeTools(tools, {
               model: effectiveModel,
@@ -535,6 +622,8 @@ export class AgentRuntime {
             experimental_repairToolCall: repairToolCall,
             maxOutputTokens: this.resolveMaxOutputTokens(maxOutputTokensOverride),
             temperature: DEFAULT_TEMPERATURE,
+            ...(headers ? { headers } : {}),
+            ...(providerOptions ? { providerOptions } : {}),
           });
         });
 
@@ -764,9 +853,12 @@ export class AgentRuntime {
       onFinish?: (response: AgentResponse) => void;
     },
     textPartId?: string,
-    toolContext?: Record<string, unknown>,
+    toolContextBase?: Record<string, unknown>,
+    runtimeContext?: Record<string, unknown>,
     modelString?: string,
     resolvedModel?: ModelRuntime,
+    headers?: dntShim.HeadersInit,
+    providerOptions?: Record<string, unknown>,
     maxOutputTokensOverride?: number,
     abortSignal?: AbortSignal,
   ): Promise<AgentResponse> {
@@ -795,12 +887,25 @@ export class AgentRuntime {
     let finalFinishReason: string | undefined;
     let latestAssistantText = "";
     const allowedRemoteToolNames = getRuntimeAllowedRemoteTools(this.config);
+    let currentSystemPrompt = systemPrompt;
+    let currentRuntimeContext = runtimeContext;
 
     for (let step = 0; step < maxSteps; step++) {
       throwIfAborted(abortSignal);
       sendSSE(controller, encoder, { type: "step-start" });
       const currentStepToolResults = new Map<string, ToolResultPart>();
 
+      const runtimeState = await this.resolveRuntimeState(
+        currentMessages,
+        currentRuntimeContext,
+        "stream",
+        step,
+        currentSystemPrompt,
+      );
+      currentSystemPrompt = runtimeState.systemPrompt;
+      currentRuntimeContext = runtimeState.context;
+      const toolContext = { ...toolContextBase, ...currentRuntimeContext };
+
       let tools = isLocalStreaming ? [] : await getAvailableTools(this.config.tools, {
         includeSkillTools: Boolean(this.config.skills),
         allowedRemoteToolNames,
@@ -815,7 +920,7 @@ export class AgentRuntime {
 
       const result = streamText({
         model: languageModel,
-        system: systemPrompt,
+        system: currentSystemPrompt,
         messages: convertToModelMessages(currentMessages),
         tools: convertToolsToRuntimeTools(tools, {
           model: effectiveModel,
@@ -824,6 +929,8 @@ export class AgentRuntime {
         experimental_repairToolCall: repairToolCall,
         maxOutputTokens: this.resolveMaxOutputTokens(maxOutputTokensOverride),
         temperature: DEFAULT_TEMPERATURE,
+        ...(headers ? { headers } : {}),
+        ...(providerOptions ? { providerOptions } : {}),
         abortSignal,
       });
 

package/src/src/agent/types.ts

@@ -4,6 +4,7 @@
 import * as dntShim from "../../_dnt.shims.js";
 
 
+import type { ModelRuntime } from "../provider/types.js";
 import type { RemoteToolSource, Tool } from "../tool/index.js";
 import { INVALID_ARGUMENT } from "../errors/error-registry.js";
 import type { Memory } from "./memory/memory-interface.js";
@@ -91,6 +92,16 @@ export interface AgentConfig {
   };
   /** Restrict runtime model overrides to these "provider/model" strings. */
   allowedModels?: ModelString[];
+  /**
+   * Optional request-aware hook for overriding the resolved model runtime and
+   * provider transport options on a per-call basis.
+   */
+  resolveModelTransport?: ModelTransportResolver;
+  /**
+   * Optional step-boundary hook for refreshing the runtime system prompt and
+   * host-owned context during a long-lived run.
+   */
+  resolveRuntimeState?: RuntimeStateResolver;
   /**
    * Enable skills for this agent.
    * - true: include all discovered skills from skills/ directory
@@ -108,6 +119,42 @@ export interface AgentConfig {
 
 export type ResolvedAgentConfig = AgentConfig & { model: ModelString };
 
+export interface ModelTransportRequest {
+  agentId: string;
+  requestedModel: ModelString;
+  resolvedModel: ModelString;
+  context?: Record<string, unknown>;
+  mode: "generate" | "stream";
+}
+
+export interface ResolvedModelTransport {
+  model?: ModelRuntime;
+  headers?: dntShim.HeadersInit;
+  providerOptions?: Record<string, unknown>;
+}
+
+export type ModelTransportResolver = (
+  request: ModelTransportRequest,
+) => ResolvedModelTransport | Promise<ResolvedModelTransport>;
+
+export interface RuntimeStateRequest {
+  agentId: string;
+  mode: "generate" | "stream";
+  step: number;
+  system: string;
+  messages: Message[];
+  context?: Record<string, unknown>;
+}
+
+export interface ResolvedRuntimeState {
+  system?: string;
+  context?: Record<string, unknown>;
+}
+
+export type RuntimeStateResolver = (
+  request: RuntimeStateRequest,
+) => ResolvedRuntimeState | undefined | Promise<ResolvedRuntimeState | undefined>;
+
 // Import for use in AgentMiddleware
 import type { AgentContext, AgentResponse } from "./schemas/index.js";
 

package/src/src/mcp/http-transport.ts

@@ -0,0 +1,163 @@
+import * as dntShim from "../../_dnt.shims.js";
+import type { ToolExecutionContext } from "../tool/index.js";
+import { VeryfrontError } from "../security/input-validation/errors.js";
+import { validateContentType } from "../security/input-validation/limits.js";
+import { SessionManager } from "./session.js";
+
+const MAX_REQUEST_BODY_SIZE = 1_048_576; // 1 MB
+const JSON_CONTENT_TYPE = "application/json";
+
+type JSONRPCParams = Record<string, unknown> | unknown[];
+
+interface JSONRPCRequest {
+  jsonrpc: "2.0";
+  id?: string | number;
+  method: string;
+  params?: JSONRPCParams;
+}
+
+interface JSONRPCResponse {
+  jsonrpc: "2.0";
+  id?: string | number;
+  result?: unknown;
+  error?: {
+    code: number;
+    message: string;
+    data?: unknown;
+  };
+}
+
+export interface MCPHTTPTransportDependencies {
+  authEnabled: boolean;
+  getCORSHeaders: (requestOrigin?: string | null) => Record<string, string>;
+  validateAuth: (request: dntShim.Request) => Promise<boolean>;
+  handleRequest: (
+    request: JSONRPCRequest,
+    context?: ToolExecutionContext,
+  ) => Promise<JSONRPCResponse>;
+  extractRequestContext: (request: dntShim.Request) => ToolExecutionContext | undefined;
+  isOriginAllowed: (requestOrigin?: string | null) => boolean;
+  sessionCapabilities: Map<string, Record<string, unknown>>;
+  sessionManager: SessionManager;
+}
+
+function createJSONResponse(body: unknown, init?: dntShim.ResponseInit): dntShim.Response {
+  const headers = new dntShim.Headers(init?.headers);
+  headers.set("Content-Type", JSON_CONTENT_TYPE);
+  return new dntShim.Response(JSON.stringify(body), { ...init, headers });
+}
+
+function createJSONRPCErrorResponse(status: number, code: number, message: string): dntShim.Response {
+  return createJSONResponse(
+    {
+      jsonrpc: "2.0",
+      id: null,
+      error: { code, message },
+    },
+    { status },
+  );
+}
+
+export function createMCPHTTPHandler(
+  dependencies: MCPHTTPTransportDependencies,
+): (request: dntShim.Request) => Promise<dntShim.Response> {
+  const {
+    authEnabled,
+    getCORSHeaders,
+    validateAuth,
+    handleRequest,
+    extractRequestContext,
+    isOriginAllowed,
+    sessionCapabilities,
+    sessionManager,
+  } = dependencies;
+
+  return async (request: dntShim.Request) => {
+    const requestOrigin = request.headers.get("Origin");
+
+    if (request.method === "OPTIONS") {
+      return new dntShim.Response(null, { status: 204, headers: getCORSHeaders(requestOrigin) });
+    }
+
+    if (!isOriginAllowed(requestOrigin)) {
+      return createJSONRPCErrorResponse(403, -32600, "Forbidden: Origin not allowed");
+    }
+
+    if (authEnabled) {
+      const authorized = await validateAuth(request);
+      if (!authorized) return new dntShim.Response("Unauthorized", { status: 401 });
+    }
+
+    if (request.method === "DELETE") {
+      const sessionId = request.headers.get("MCP-Session-Id");
+      if (sessionId) {
+        sessionManager.terminate(sessionId);
+        sessionCapabilities.delete(sessionId);
+      }
+      return new dntShim.Response(null, { status: 200, headers: getCORSHeaders(requestOrigin) });
+    }
+
+    if (request.method !== "POST") {
+      return new dntShim.Response("Method Not Allowed", { status: 405 });
+    }
+
+    const contentLength = request.headers.get("content-length");
+    if (contentLength && Number(contentLength) > MAX_REQUEST_BODY_SIZE) {
+      return createJSONRPCErrorResponse(413, -32600, "Request body too large");
+    }
+
+    try {
+      validateContentType(request, JSON_CONTENT_TYPE);
+    } catch (error) {
+      const message = error instanceof VeryfrontError ? error.message : "Invalid Content-Type";
+      return createJSONRPCErrorResponse(400, -32700, message);
+    }
+
+    let rpcRequest: JSONRPCRequest;
+    try {
+      const bodyText = await request.text();
+      if (bodyText.length > MAX_REQUEST_BODY_SIZE) {
+        return createJSONRPCErrorResponse(413, -32600, "Request body too large");
+      }
+      rpcRequest = JSON.parse(bodyText) as JSONRPCRequest;
+    } catch (_) {
+      return createJSONRPCErrorResponse(400, -32700, "Parse error");
+    }
+
+    const responseHeaders: Record<string, string> = {
+      ...getCORSHeaders(requestOrigin),
+    };
+
+    if (rpcRequest.method === "initialize") {
+      const context = extractRequestContext(request);
+      const rpcResponse = await handleRequest(rpcRequest, context);
+      const clientCaps =
+        ((rpcRequest.params as Record<string, unknown> | undefined)?.capabilities ??
+          {}) as Record<string, unknown>;
+      const sessionId = sessionManager.create();
+      sessionCapabilities.set(sessionId, clientCaps);
+      responseHeaders["MCP-Session-Id"] = sessionId;
+      return createJSONResponse(rpcResponse, { headers: responseHeaders });
+    }
+
+    if (sessionManager.size > 0) {
+      const sessionId = request.headers.get("MCP-Session-Id");
+      if (!sessionId) {
+        return createJSONRPCErrorResponse(400, -32600, "Missing MCP-Session-Id header");
+      }
+      if (!sessionManager.isValid(sessionId)) {
+        return createJSONRPCErrorResponse(404, -32600, "Session not found or expired");
+      }
+    }
+
+    if (rpcRequest.id === undefined) {
+      const context = extractRequestContext(request);
+      await handleRequest(rpcRequest, context);
+      return new dntShim.Response(null, { status: 202, headers: responseHeaders });
+    }
+
+    const context = extractRequestContext(request);
+    const rpcResponse = await handleRequest(rpcRequest, context);
+    return createJSONResponse(rpcResponse, { headers: responseHeaders });
+  };
+}