v3.19.3 — Externalize isolated-vm from introspection builds

Fixed

• Native addon bundling crash — \�urb validate\ and \�urb deploy\ introspection builds failed when \isolated-vm\ (an optional peerDependency used by \SandboxEngine) was present in the dependency tree (e.g., via
  pm link\ during development). esbuild cannot bundle .node\ native binaries. Added \external: ['isolated-vm']\ to the introspection esbuild config in both \introspect.ts\ and \deploy.ts. This is not a breaking change — \isolated-vm\ is lazy-loaded via
  equire()\ with a try/catch fallback.

Test Suite

• 6805 tests passing across 330 test files — zero regressions

v3.19.2 — Fix autoDiscover during introspection

Fixed

• Introspection bundle written to wrong directory —
  unIntrospection()\ (used by both \�urb validate\ and \�urb deploy) wrote the esbuild bundle to \os.tmpdir(). When the bundled server executed \�utoDiscover(registry, new URL('./agents', import.meta.url)), \import.meta.url\ resolved to the temp directory, causing relative paths like ./agents\ to point to non-existent locations. The bundle is now written adjacent to the original entrypoint (\dirname(absEntry)/.vurb-introspect-{ts}.mjs), preserving correct \import.meta.url-relative resolution. Affected files: \introspect.ts, \deploy.ts.

Test Suite

• 6805 tests passing across 330 test files — zero regressions

v3.19.1 — @vurb/a2a Protocol Audit: 8 Bug Fixes

Deep audit of the A2A protocol bridge identified and remediated 8 bugs across 6 source files, with 35 regression tests added to prevent reintroduction.

Fixed

• SSE parser multi-line data loss — \parseSseStream()\ overwrote \eventData\ on each \data:\ line instead of concatenating with \n\ per the SSE specification. Any proxy (CloudFront, nginx) splitting JSON across multiple \data:\ lines caused silent data corruption. Now concatenates correctly.
• Streaming path missing tool existence check — \StreamableHttpTransport._createMessageStream()\ called \executeStream()\ without verifying the tool exists. Added optional \hasToolName?()\ to \StreamingExecutorLike\ interface and a guard before streaming execution.
• Streaming path skipped \message.kind\ validation — The sync \message/send\ handler rejects messages without \kind: 'message'\ discriminator, but \message/stream\ accepted them silently. Added the same validation to the streaming path.
• Non-text artifact content silently dropped — \A2AHandler\ mapped all MCP tool result content to \TextPart\ with \ ext: c.text ?? ''. Now preserves non-text content as \DataPart\ with \contentType\ metadata.
• Skill resolution logic duplicated across files — Extracted to a shared \message-utils.ts\ module (single source of truth).
• Protocol version mismatch — \A2A_PROTOCOL_VERSION\ updated from '0.3.0'\ to '1.0.0'\ to match the A2A v1.0+ type schema.
• Pagination cursor NaN guard — \TaskManager.listTasks()\ now handles non-numeric cursor strings safely.
• UUID fallback low entropy — Extended to 14 random characters across two \Math.random()\ calls.

Test Suite

• 35 new regression tests covering all 8 fixes
• 245 total tests across 8 test files in @vurb/a2a\
• 6805 total monorepo tests passing (330 suites)

v3.19.0 — @vurb/a2a: A2A Protocol Bridge with SSE Streaming

@vurb/a2a — A2A Protocol Bridge (NEW PACKAGE)

Spec-compliant A2A v1.0.0 bridge enabling Vurb.ts MCP servers to participate in multi-agent orchestration through standardized Agent Cards, JSON-RPC dispatch, and SSE streaming. First TypeScript MCP framework with native A2A interoperability.

Highlights

• A2AHandler — Framework-agnostic JSON-RPC 2.0 dispatcher for all 11 A2A protocol methods
• StreamableHttpTransport — HTTP transport layer supporting both sync JSON responses and SSE streaming (Express, Hono, Fastify)
• StreamingExecutorLike — Interface for streaming tool executors via AsyncGenerator
• TaskManager — In-memory task lifecycle engine with finite state machine, TTL eviction, cursor-based pagination
• AgentCardCompiler — Auto-compiles MCP tool registry into A2A Agent Card (/.well-known/agent-card.json)
• SSE Utilities — formatSSEEvent(), formatSSEErrorEvent(), parseSseStream()
• Complete Types — 100% A2A v1.0.0 type coverage (20+ interfaces, discriminated unions)
• Error Classes — 6 spec-compliant error classes with JSON-RPC error codes

Test Suite

210 tests across 7 suites — A2AHandler (50), TaskManager (36), AgentCardCompiler (35), Errors (45), SSE (13), Extensions (14), StreamableHttpTransport (17)

Install

npm install @vurb/a2a@3.19.0

See CHANGELOG.md for full details.

v3.18.0 — MCP Server Card (SEP-1649 Auto-Discovery)

MCP Server Card: Auto-Discovery Endpoint (SEP-1649)

Standard /.well-known/mcp/server-card.json endpoint enabling AI clients (Claude, Cursor, ChatGPT) to automatically discover, inspect, and configure MCP servers — zero manual configuration required.

Highlights

• compileServerCard() — Pure-function compiler that aggregates registry metadata (tools, prompts, resources) into the SEP-1649 ServerCardPayload format
• startServer({ serverCard }) — Accepts true (auto-generate) or custom ServerCardConfig. Pre-compiled once at startup as a static JSON string — zero per-request overhead
• HTTP headers — Content-Type: application/json, Cache-Control: public, max-age=300, X-Content-Type-Options: nosniff, Access-Control-Allow-Origin: *
• Types — ServerCardConfig, ServerCardPayload, ServerCardToolEntry, SERVER_CARD_PATH
• Barrel exports — Available from @vurb/core root and @vurb/core/server

Quick Start

await startServer({
    name: 'billing-api',
    version: '2.1.0',
    registry,
    transport: 'http',
    serverCard: {
        title: 'Billing API',
        description: 'Financial operations and invoice management',
        documentationUrl: 'https://docs.example.com/billing',
    },
});

Test Suite

55 tests covering: happy path (16), JSON compliance (5), adversarial inputs (11), edge cases (9), scale/stress (4), idempotency (3), type contracts (6).

Changed

• All @vurb/* cross-dependencies updated to ^3.18.0
• llms.txt updated with feature docs and API reference

Full Changelog: https://github.com/vinkius-labs/vurb.ts/blob/main/CHANGELOG.md#3180---2026-05-01

v3.17.3

Fixed

• @vurb/core — Edge stub missing AsyncLocalStorage (V8 isolate boot crash) — edge-stub.ts did not export AsyncLocalStorage, but @vurb/core's own ask.ts executes new AsyncLocalStorage() at module load time (top-level). When esbuild compiled the server for edge deployment, import { AsyncLocalStorage } from 'node:async_hooks' was resolved to the edge-stub Proxy, which returned an arrow function ((...args) => CRASH(prop)) for the missing property. Arrow functions are not constructable in JavaScript — new (arrow)() throws TypeError: is not a constructor. Added AsyncLocalStorage as a Tier 1 structural stub (real class, synchronous stack-based store) alongside the existing EventEmitter, Readable, Writable, and Server stubs.

Changed

• All @vurb/* cross-dependencies updated to ^3.17.3 — Ensures consistent resolution across the monorepo.

v3.17.2

[3.17.2] - 2026-04-23

Added

• @vurb/yaml — Exported loadFromParsedSpec() from the public API. Enterprise runtimes can now compile directly from a pre-parsed VurbYamlSpec (JSON), avoiding double-serialization overhead.

Fixed

• @vurb/yaml — interpolateParams() now throws a descriptive error when a required {{param}} placeholder is not provided, instead of silently leaving the raw token in the URL/body.
• @vurb/yaml — applyResponseTransform() multi-path extraction now uses the full dot-path as key (dots replaced by underscores), preventing key collisions.

Changed

• @vurb/yaml — ResolvedConnection now carries an optional timeout_ms field. Connection-level timeouts are propagated via AbortSignal.timeout() (default: 30s).
• All @vurb/* cross-dependencies updated to ^3.17.2

v3.17.1

Fixed

• @vurb/yaml — Fixed ReferenceError: crypto is not defined in BasicToolExecutor and YamlMcpServer by importing randomUUID from node:crypto instead of using bare globalThis.crypto.

Added

• @vurb/yaml — Exported reusable MCP handler helpers: buildToolsList(), buildResourcesList(), buildPromptsList(), readResourceContent().
• @vurb/core — Added ./cli export path (@vurb/core/cli) exposing readVurbRc(), writeVurbRc(), loadEnv().

v3.17.0

See CHANGELOG.md for details.

v3.16.0 — MCP Elicitation: Human-in-the-Loop DSL

✨ What's New

MCP Elicitation — Human-in-the-Loop for Agentic Workflows

A new first-class DSL that enables MCP tool handlers to pause execution, request user input via the MCP client, and resume with typed responses — zero boilerplate, full type inference.

Highlights

• \�sk()\ callable namespace — Single import, dual-mode API. Form fields (\�sk.string(), \�sk.number(), \�sk.boolean(), \�sk.enum()) or URL redirect (\�sk.redirect())
• *Fail-fast \AskResponse* — Boolean guards (.accepted, .declined, .cancelled) with a .data\ getter that throws on non-accepted access
• *.interactive()* — Opt-in on \FluentToolBuilder\ or \FluentRouter\ — zero overhead when not used
• AsyncLocalStorage transport — Per-request isolation, no handler signature changes, works across stdio/SSE/Streamable HTTP
• Multi-step wizards — Sequential \�wait ask()\ calls for conversational flows

Quick Example

\\ ypescript
import { initVurb, ask } from '@vurb/core';
const f = initVurb();

const deploy = f.mutation('infra.deploy')
.withString('app_id', 'Application ID')
.interactive()
.handle(async (input) => {
const prefs = await ask('Confirm settings:', {
region: ask.enum(['us-east-1', 'eu-west-1'] as const),
confirm: ask.boolean('I confirm'),
});
if (prefs.declined) return f.error('CANCELLED', 'Aborted.');
return { deployed: true, region: prefs.data.region };
});
\\

Test Suite

• 72 new tests across 4 test files (DSL, response guards, transport isolation, server wiring)
• 5213+ tests passing across the monorepo

Documentation

• Full documentation at vurb.vinkius.com/elicitation

---

Full Changelog: https://github.com/vinkius-labs/vurb.ts/blob/main/CHANGELOG.md