@mcp-ts/sdk 2.3.4 → 2.4.1

package/dist/server/index.js

@@ -156,22 +156,9 @@ init_cjs_shims();
 // src/server/storage/redis-backend.ts
 init_cjs_shims();
 
-// src/shared/constants.ts
-init_cjs_shims();
-var SESSION_TTL_SECONDS = 43200;
-var STATE_EXPIRATION_MS = 10 * 60 * 1e3;
-var TOKEN_EXPIRY_BUFFER_MS = 5 * 60 * 1e3;
-var DEFAULT_CLIENT_NAME = "MCP Assistant";
-var DEFAULT_CLIENT_URI = "https://mcp-assistant.in";
-var DEFAULT_LOGO_URI = "https://mcp-assistant.in/logo.svg";
-var DEFAULT_POLICY_URI = "https://mcp-assistant.in/privacy";
-var SOFTWARE_ID = "@mcp-ts";
-var SOFTWARE_VERSION = "1.3.4";
-var MCP_CLIENT_NAME = "mcp-ts-oauth-client";
-var MCP_CLIENT_VERSION = "2.0";
-
 // src/shared/utils.ts
 init_cjs_shims();
+var OAUTH_STATE_SEPARATOR = ".";
 var firstChar = nanoid.customAlphabet(
   "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz",
   1
@@ -190,13 +177,99 @@ function sanitizeServerLabel(name) {
 function generateSessionId() {
   return firstChar() + rest();
 }
+function formatOAuthState(nonce, sessionId) {
+  return `${nonce}${OAUTH_STATE_SEPARATOR}${sessionId}`;
+}
+function parseOAuthState(state) {
+  const separatorIndex = state.indexOf(OAUTH_STATE_SEPARATOR);
+  if (separatorIndex <= 0 || separatorIndex === state.length - 1) {
+    return void 0;
+  }
+  const nonce = state.slice(0, separatorIndex);
+  const sessionId = state.slice(separatorIndex + 1);
+  if (!nonce || !sessionId || sessionId.includes(OAUTH_STATE_SEPARATOR)) {
+    return void 0;
+  }
+  return { nonce, sessionId };
+}
+
+// src/server/storage/session-lifecycle.ts
+init_cjs_shims();
+
+// src/shared/constants.ts
+init_cjs_shims();
+var STATE_EXPIRATION_MS = 10 * 60 * 1e3;
+var DORMANT_SESSION_EXPIRATION_MS = 30 * 24 * 60 * 60 * 1e3;
+var DORMANT_SESSION_EXPIRATION_SECONDS = Math.floor(DORMANT_SESSION_EXPIRATION_MS / 1e3);
+var DEFAULT_CLIENT_NAME = "MCP Assistant";
+var DEFAULT_CLIENT_URI = "https://mcp-assistant.in";
+var DEFAULT_LOGO_URI = "https://mcp-assistant.in/logo.svg";
+var DEFAULT_POLICY_URI = "https://mcp-assistant.in/privacy";
+var SOFTWARE_ID = "@mcp-ts";
+var SOFTWARE_VERSION = "2.3.4";
+var MCP_CLIENT_NAME = "mcp-ts-oauth-client";
+var MCP_CLIENT_VERSION = "2.0";
+
+// src/server/storage/session-lifecycle.ts
+function resolveSessionExpiresAt(status = "pending", referenceTime = Date.now()) {
+  return status === "active" ? null : referenceTime + STATE_EXPIRATION_MS;
+}
+function resolveSessionRedisTtlSeconds(session) {
+  return session.status === "active" ? DORMANT_SESSION_EXPIRATION_SECONDS : Math.floor(STATE_EXPIRATION_MS / 1e3);
+}
+function normalizeNewSession(session, now = Date.now()) {
+  const createdAt = session.createdAt || now;
+  const updatedAt = session.updatedAt ?? createdAt;
+  const status = session.status ?? "pending";
+  return {
+    ...session,
+    status,
+    createdAt,
+    updatedAt,
+    expiresAt: resolveSessionExpiresAt(status, status === "active" ? updatedAt : createdAt)
+  };
+}
+function mergeSessionUpdate(current, data, now = Date.now()) {
+  const updatedAt = data.updatedAt ?? now;
+  const updated = {
+    ...current,
+    ...data,
+    updatedAt
+  };
+  const status = updated.status ?? "pending";
+  return {
+    ...updated,
+    status,
+    expiresAt: resolveSessionExpiresAt(status, updatedAt)
+  };
+}
+function normalizeStoredSession(session) {
+  const createdAt = session.createdAt || Date.now();
+  const updatedAt = session.updatedAt ?? createdAt;
+  const status = session.status ?? "pending";
+  const expiresAt = status === "active" ? null : session.expiresAt ?? resolveSessionExpiresAt(status, createdAt);
+  return {
+    ...session,
+    status,
+    createdAt,
+    updatedAt,
+    expiresAt
+  };
+}
+function isSessionExpired(session, now = Date.now()) {
+  const hydrated = normalizeStoredSession(session);
+  if (hydrated.status === "active") {
+    return hydrated.updatedAt !== void 0 && hydrated.updatedAt < now - DORMANT_SESSION_EXPIRATION_MS;
+  }
+  return typeof hydrated.expiresAt === "number" && hydrated.expiresAt < now;
+}
 
 // src/server/storage/redis-backend.ts
 var RedisStorageBackend = class {
   constructor(redis2) {
     this.redis = redis2;
-    __publicField(this, "DEFAULT_TTL", SESSION_TTL_SECONDS);
     __publicField(this, "KEY_PREFIX", "mcp:session:");
+    __publicField(this, "CREDENTIALS_KEY_PREFIX", "mcp:credentials:");
     __publicField(this, "USER_ID_KEY_PREFIX", "mcp:userId:");
     __publicField(this, "USER_ID_KEY_SUFFIX", ":sessions");
   }
@@ -215,6 +288,9 @@ var RedisStorageBackend = class {
   getSessionKey(userId, sessionId) {
     return `${this.KEY_PREFIX}${userId}:${sessionId}`;
   }
+  getCredentialsKey(userId, sessionId) {
+    return `${this.CREDENTIALS_KEY_PREFIX}${userId}:${sessionId}`;
+  }
   /**
    * Generates Redis key for tracking all sessions for a user
    * @private
@@ -252,15 +328,16 @@ var RedisStorageBackend = class {
   generateSessionId() {
     return generateSessionId();
   }
-  async create(session, ttl) {
+  async create(session) {
     const { sessionId, userId } = session;
     if (!sessionId || !userId) throw new Error("userId and sessionId required");
     const sessionKey = this.getSessionKey(userId, sessionId);
     const userIdKey = this.getUserIdKey(userId);
-    const effectiveTtl = ttl ?? this.DEFAULT_TTL;
+    const sessionWithLifecycle = normalizeNewSession(session);
+    const effectiveTtl = resolveSessionRedisTtlSeconds(sessionWithLifecycle);
     const result = await this.redis.set(
       sessionKey,
-      JSON.stringify(session),
+      JSON.stringify(sessionWithLifecycle),
       "EX",
       effectiveTtl,
       "NX"
@@ -270,9 +347,8 @@ var RedisStorageBackend = class {
     }
     await this.redis.sadd(userIdKey, sessionId);
   }
-  async update(userId, sessionId, data, ttl) {
+  async update(userId, sessionId, data) {
     const sessionKey = this.getSessionKey(userId, sessionId);
-    const effectiveTtl = ttl ?? this.DEFAULT_TTL;
     const script = `
             local currentStr = redis.call("GET", KEYS[1])
             if not currentStr then
@@ -280,26 +356,47 @@ var RedisStorageBackend = class {
             end
 
             local current = cjson.decode(currentStr)
-            local updates = cjson.decode(ARGV[1])
-
-            for k,v in pairs(updates) do
-                current[k] = v
-            end
+            local updated = cjson.decode(ARGV[1])
 
-            redis.call("SET", KEYS[1], cjson.encode(current), "EX", ARGV[2])
+            redis.call("SET", KEYS[1], cjson.encode(updated), "EX", ARGV[2])
             return 1
         `;
+    const current = await this.get(userId, sessionId);
+    if (!current) {
+      throw new Error(`Session ${sessionId} not found for userId ${userId}`);
+    }
+    const updated = mergeSessionUpdate(current, data);
+    const effectiveTtl = resolveSessionRedisTtlSeconds(updated);
     const result = await this.redis.eval(
       script,
       1,
       sessionKey,
-      JSON.stringify(data),
+      JSON.stringify(updated),
       effectiveTtl
     );
     if (result === 0) {
       throw new Error(`Session ${sessionId} not found for userId ${userId}`);
     }
   }
+  async patchCredentials(userId, sessionId, data) {
+    const sessionKey = this.getSessionKey(userId, sessionId);
+    const credentialsKey = this.getCredentialsKey(userId, sessionId);
+    const sessionExists = await this.redis.exists(sessionKey);
+    if (!sessionExists) {
+      throw new Error(`Session ${sessionId} not found for userId ${userId}`);
+    }
+    const session = await this.get(userId, sessionId);
+    const currentTtl = await this.redis.ttl(sessionKey);
+    const effectiveTtl = currentTtl > 0 && session ? currentTtl : resolveSessionRedisTtlSeconds(session ?? { status: "pending" });
+    const currentStr = await this.redis.get(credentialsKey);
+    const current = currentStr ? JSON.parse(currentStr) : { sessionId, userId };
+    const credentials = { ...current, ...data, sessionId, userId };
+    if (effectiveTtl > 0) {
+      await this.redis.set(credentialsKey, JSON.stringify(credentials), "EX", effectiveTtl);
+    } else {
+      await this.redis.set(credentialsKey, JSON.stringify(credentials));
+    }
+  }
   async get(userId, sessionId) {
     try {
       const sessionKey = this.getSessionKey(userId, sessionId);
@@ -307,13 +404,28 @@ var RedisStorageBackend = class {
       if (!sessionDataStr) {
         return null;
       }
-      const Session = JSON.parse(sessionDataStr);
-      return Session;
+      const session = JSON.parse(sessionDataStr);
+      return normalizeStoredSession(session);
     } catch (error) {
       console.error("[RedisStorageBackend] Failed to get session:", error);
       return null;
     }
   }
+  async getCredentials(userId, sessionId) {
+    const session = await this.get(userId, sessionId);
+    if (!session) return null;
+    const credentialsStr = await this.redis.get(this.getCredentialsKey(userId, sessionId));
+    return credentialsStr ? JSON.parse(credentialsStr) : { sessionId, userId };
+  }
+  async clearCredentials(userId, sessionId) {
+    await this.patchCredentials(userId, sessionId, {
+      clientInformation: null,
+      tokens: null,
+      codeVerifier: null,
+      clientId: null,
+      oauthState: null
+    });
+  }
   async listIds(userId) {
     const sessions2 = await this.list(userId);
     return sessions2.map((session) => session.sessionId);
@@ -333,7 +445,7 @@ var RedisStorageBackend = class {
       if (staleSessionIds.length > 0) {
         await this.redis.srem(userIdKey, ...staleSessionIds);
       }
-      return results.filter((session) => session !== null);
+      return results.filter((session) => session !== null).map((session) => normalizeStoredSession(session));
     } catch (error) {
       console.error(`[RedisStorageBackend] Failed to get session data for ${userId}:`, error);
       return [];
@@ -342,9 +454,10 @@ var RedisStorageBackend = class {
   async delete(userId, sessionId) {
     try {
       const sessionKey = this.getSessionKey(userId, sessionId);
+      const credentialsKey = this.getCredentialsKey(userId, sessionId);
       const userIdKey = this.getUserIdKey(userId);
       await this.redis.srem(userIdKey, sessionId);
-      await this.redis.del(sessionKey);
+      await this.redis.del(sessionKey, credentialsKey);
     } catch (error) {
       console.error("[RedisStorageBackend] Failed to remove session:", error);
     }
@@ -359,7 +472,7 @@ var RedisStorageBackend = class {
             return null;
           }
           try {
-            return JSON.parse(data).sessionId;
+            return normalizeStoredSession(JSON.parse(data)).sessionId;
           } catch (error) {
             console.error("[RedisStorageBackend] Failed to parse session while listing all session IDs:", error);
             return null;
@@ -375,8 +488,9 @@ var RedisStorageBackend = class {
   async clearAll() {
     try {
       const keys = await this.scanKeys(`${this.KEY_PREFIX}*`);
+      const credentialKeys = await this.scanKeys(`${this.CREDENTIALS_KEY_PREFIX}*`);
       const userIdKeys = await this.scanKeys(`${this.USER_ID_KEY_PREFIX}*${this.USER_ID_KEY_SUFFIX}`);
-      const allKeys = [...keys, ...userIdKeys];
+      const allKeys = [...keys, ...credentialKeys, ...userIdKeys];
       if (allKeys.length > 0) {
         await this.redis.del(...allKeys);
       }
@@ -400,6 +514,7 @@ var RedisStorageBackend = class {
         const staleSessionIds = sessionIds.filter((_, index) => existenceChecks[index] === 0);
         if (staleSessionIds.length > 0) {
           await this.redis.srem(userIdKey, ...staleSessionIds);
+          await this.redis.del(...staleSessionIds.map((sessionId) => this.getCredentialsKey(userId, sessionId)));
         }
         const remainingCount = await this.redis.scard(userIdKey);
         if (remainingCount === 0) {
@@ -425,6 +540,7 @@ var MemoryStorageBackend = class {
   constructor() {
     // Map<userId:sessionId, Session>
     __publicField(this, "sessions", /* @__PURE__ */ new Map());
+    __publicField(this, "credentials", /* @__PURE__ */ new Map());
     // Map<userId, Set<sessionId>>
     __publicField(this, "userIdSessions", /* @__PURE__ */ new Map());
   }
@@ -437,36 +553,55 @@ var MemoryStorageBackend = class {
   generateSessionId() {
     return generateSessionId();
   }
-  async create(session, ttl) {
+  async create(session) {
     const { sessionId, userId } = session;
     if (!sessionId || !userId) throw new Error("userId and sessionId required");
     const sessionKey = this.getSessionKey(userId, sessionId);
     if (this.sessions.has(sessionKey)) {
       throw new Error(`Session ${sessionId} already exists`);
     }
-    this.sessions.set(sessionKey, session);
+    this.sessions.set(sessionKey, normalizeNewSession(session));
     if (!this.userIdSessions.has(userId)) {
       this.userIdSessions.set(userId, /* @__PURE__ */ new Set());
     }
     this.userIdSessions.get(userId).add(sessionId);
   }
-  async update(userId, sessionId, data, ttl) {
+  async update(userId, sessionId, data) {
     if (!userId || !sessionId) throw new Error("userId and sessionId required");
     const sessionKey = this.getSessionKey(userId, sessionId);
     const current = this.sessions.get(sessionKey);
     if (!current) {
       throw new Error(`Session ${sessionId} not found`);
     }
-    const updated = {
-      ...current,
-      ...data
-    };
+    const updated = mergeSessionUpdate(current, data);
     this.sessions.set(sessionKey, updated);
   }
+  async patchCredentials(userId, sessionId, data) {
+    const sessionKey = this.getSessionKey(userId, sessionId);
+    if (!this.sessions.has(sessionKey)) {
+      throw new Error(`Session ${sessionId} not found`);
+    }
+    const current = this.credentials.get(sessionKey) ?? { sessionId, userId };
+    this.credentials.set(sessionKey, { ...current, ...data, sessionId, userId });
+  }
   async get(userId, sessionId) {
     const sessionKey = this.getSessionKey(userId, sessionId);
     return this.sessions.get(sessionKey) || null;
   }
+  async getCredentials(userId, sessionId) {
+    const sessionKey = this.getSessionKey(userId, sessionId);
+    if (!this.sessions.has(sessionKey)) return null;
+    return this.credentials.get(sessionKey) ?? { sessionId, userId };
+  }
+  async clearCredentials(userId, sessionId) {
+    await this.patchCredentials(userId, sessionId, {
+      clientInformation: null,
+      tokens: null,
+      codeVerifier: null,
+      clientId: null,
+      oauthState: null
+    });
+  }
   async listIds(userId) {
     const set = this.userIdSessions.get(userId);
     return set ? Array.from(set) : [];
@@ -486,6 +621,7 @@ var MemoryStorageBackend = class {
   async delete(userId, sessionId) {
     const sessionKey = this.getSessionKey(userId, sessionId);
     this.sessions.delete(sessionKey);
+    this.credentials.delete(sessionKey);
     const set = this.userIdSessions.get(userId);
     if (set) {
       set.delete(sessionId);
@@ -499,9 +635,22 @@ var MemoryStorageBackend = class {
   }
   async clearAll() {
     this.sessions.clear();
+    this.credentials.clear();
     this.userIdSessions.clear();
   }
   async cleanupExpired() {
+    for (const [key, session] of this.sessions.entries()) {
+      if (!isSessionExpired(session)) continue;
+      this.sessions.delete(key);
+      this.credentials.delete(key);
+      const set = this.userIdSessions.get(session.userId);
+      if (set) {
+        set.delete(session.sessionId);
+        if (set.size === 0) {
+          this.userIdSessions.delete(session.userId);
+        }
+      }
+    }
   }
   async disconnect() {
   }
@@ -516,6 +665,7 @@ var FileStorageBackend = class {
   constructor(options = {}) {
     __publicField(this, "filePath");
     __publicField(this, "memoryCache", null);
+    __publicField(this, "credentialsCache", null);
     __publicField(this, "initialized", false);
     this.filePath = options.path || "./sessions.json";
   }
@@ -530,14 +680,22 @@ var FileStorageBackend = class {
       const data = await fs2.promises.readFile(this.filePath, "utf-8");
       const json = JSON.parse(data);
       this.memoryCache = /* @__PURE__ */ new Map();
-      if (Array.isArray(json)) {
-        json.forEach((s) => {
-          this.memoryCache.set(this.getSessionKey(s.userId || "unknown", s.sessionId), s);
+      this.credentialsCache = /* @__PURE__ */ new Map();
+      if (Array.isArray(json.sessions)) {
+        json.sessions.forEach((s) => {
+          const session = normalizeStoredSession(s);
+          this.memoryCache.set(this.getSessionKey(session.userId || "unknown", session.sessionId), session);
+        });
+      }
+      if (Array.isArray(json.credentials)) {
+        json.credentials.forEach((c) => {
+          this.credentialsCache.set(this.getSessionKey(c.userId, c.sessionId), c);
         });
       }
     } catch (error) {
       if (error.code === "ENOENT") {
         this.memoryCache = /* @__PURE__ */ new Map();
+        this.credentialsCache = /* @__PURE__ */ new Map();
         await this.flush();
       } else {
         console.error("[FileStorage] Failed to load sessions:", error);
@@ -551,9 +709,11 @@ var FileStorageBackend = class {
     if (!this.initialized) await this.init();
   }
   async flush() {
-    if (!this.memoryCache) return;
-    const sessions2 = Array.from(this.memoryCache.values());
-    await fs2.promises.writeFile(this.filePath, JSON.stringify(sessions2, null, 2), "utf-8");
+    if (!this.memoryCache || !this.credentialsCache) return;
+    await fs2.promises.writeFile(this.filePath, JSON.stringify({
+      sessions: Array.from(this.memoryCache.values()),
+      credentials: Array.from(this.credentialsCache.values())
+    }, null, 2), "utf-8");
   }
   getSessionKey(userId, sessionId) {
     return `${userId}:${sessionId}`;
@@ -561,7 +721,7 @@ var FileStorageBackend = class {
   generateSessionId() {
     return generateSessionId();
   }
-  async create(session, ttl) {
+  async create(session) {
     await this.ensureInitialized();
     const { sessionId, userId } = session;
     if (!sessionId || !userId) throw new Error("userId and sessionId required");
@@ -569,10 +729,10 @@ var FileStorageBackend = class {
     if (this.memoryCache.has(sessionKey)) {
       throw new Error(`Session ${sessionId} already exists`);
     }
-    this.memoryCache.set(sessionKey, session);
+    this.memoryCache.set(sessionKey, normalizeNewSession(session));
     await this.flush();
   }
-  async update(userId, sessionId, data, ttl) {
+  async update(userId, sessionId, data) {
     await this.ensureInitialized();
     if (!userId || !sessionId) throw new Error("userId and sessionId required");
     const sessionKey = this.getSessionKey(userId, sessionId);
@@ -580,18 +740,40 @@ var FileStorageBackend = class {
     if (!current) {
       throw new Error(`Session ${sessionId} not found`);
     }
-    const updated = {
-      ...current,
-      ...data
-    };
+    const updated = mergeSessionUpdate(current, data);
     this.memoryCache.set(sessionKey, updated);
     await this.flush();
   }
+  async patchCredentials(userId, sessionId, data) {
+    await this.ensureInitialized();
+    const sessionKey = this.getSessionKey(userId, sessionId);
+    if (!this.memoryCache.has(sessionKey)) {
+      throw new Error(`Session ${sessionId} not found`);
+    }
+    const current = this.credentialsCache.get(sessionKey) ?? { sessionId, userId };
+    this.credentialsCache.set(sessionKey, { ...current, ...data, sessionId, userId });
+    await this.flush();
+  }
   async get(userId, sessionId) {
     await this.ensureInitialized();
     const sessionKey = this.getSessionKey(userId, sessionId);
     return this.memoryCache.get(sessionKey) || null;
   }
+  async getCredentials(userId, sessionId) {
+    await this.ensureInitialized();
+    const sessionKey = this.getSessionKey(userId, sessionId);
+    if (!this.memoryCache.has(sessionKey)) return null;
+    return this.credentialsCache.get(sessionKey) ?? { sessionId, userId };
+  }
+  async clearCredentials(userId, sessionId) {
+    await this.patchCredentials(userId, sessionId, {
+      clientInformation: null,
+      tokens: null,
+      codeVerifier: null,
+      clientId: null,
+      oauthState: null
+    });
+  }
   async list(userId) {
     await this.ensureInitialized();
     return Array.from(this.memoryCache.values()).filter((s) => s.userId === userId);
@@ -603,7 +785,9 @@ var FileStorageBackend = class {
   async delete(userId, sessionId) {
     await this.ensureInitialized();
     const sessionKey = this.getSessionKey(userId, sessionId);
-    if (this.memoryCache.delete(sessionKey)) {
+    const deleted = this.memoryCache.delete(sessionKey);
+    this.credentialsCache.delete(sessionKey);
+    if (deleted) {
       await this.flush();
     }
   }
@@ -614,10 +798,21 @@ var FileStorageBackend = class {
   async clearAll() {
     await this.ensureInitialized();
     this.memoryCache.clear();
+    this.credentialsCache.clear();
     await this.flush();
   }
   async cleanupExpired() {
     await this.ensureInitialized();
+    let changed = false;
+    for (const [key, session] of this.memoryCache.entries()) {
+      if (!isSessionExpired(session)) continue;
+      this.memoryCache.delete(key);
+      this.credentialsCache.delete(key);
+      changed = true;
+    }
+    if (changed) {
+      await this.flush();
+    }
   }
   async disconnect() {
   }
@@ -629,10 +824,12 @@ var SqliteStorage = class {
   constructor(options = {}) {
     __publicField(this, "db", null);
     __publicField(this, "table");
+    __publicField(this, "credentialsTable");
     __publicField(this, "initialized", false);
     __publicField(this, "dbPath");
     this.dbPath = options.path || "./sessions.db";
     this.table = options.table || "mcp_sessions";
+    this.credentialsTable = `${this.table}_credentials`;
   }
   async init() {
     if (this.initialized) return;
@@ -643,6 +840,7 @@ var SqliteStorage = class {
         fs2__namespace.mkdirSync(dir, { recursive: true });
       }
       this.db = new DatabaseConstructor(this.dbPath);
+      this.db.pragma("foreign_keys = ON");
       this.db.exec(`
                 CREATE TABLE IF NOT EXISTS ${this.table} (
                     sessionId TEXT PRIMARY KEY,
@@ -651,6 +849,13 @@ var SqliteStorage = class {
                     expiresAt INTEGER
                 );
                 CREATE INDEX IF NOT EXISTS idx_${this.table}_userId ON ${this.table}(userId);
+                CREATE TABLE IF NOT EXISTS ${this.credentialsTable} (
+                    sessionId TEXT NOT NULL,
+                    userId TEXT NOT NULL,
+                    data TEXT NOT NULL,
+                    PRIMARY KEY (userId, sessionId),
+                    FOREIGN KEY (sessionId) REFERENCES ${this.table}(sessionId) ON DELETE CASCADE
+                );
             `);
       this.initialized = true;
       console.log(`[mcp-ts][Storage] SQLite: \u2713 database at ${this.dbPath} verified.`);
@@ -671,18 +876,18 @@ var SqliteStorage = class {
   generateSessionId() {
     return generateSessionId();
   }
-  async create(session, ttl) {
+  async create(session) {
     this.ensureInitialized();
     const { sessionId, userId } = session;
     if (!sessionId || !userId) {
       throw new Error("userId and sessionId required");
     }
-    const expiresAt = ttl ? Date.now() + ttl * 1e3 : null;
+    const sessionWithLifecycle = normalizeNewSession(session);
     try {
       const stmt = this.db.prepare(
         `INSERT INTO ${this.table} (sessionId, userId, data, expiresAt) VALUES (?, ?, ?, ?)`
       );
-      stmt.run(sessionId, userId, JSON.stringify(session), expiresAt);
+      stmt.run(sessionId, userId, JSON.stringify(sessionWithLifecycle), sessionWithLifecycle.expiresAt ?? null);
     } catch (error) {
       if (error.code === "SQLITE_CONSTRAINT_PRIMARYKEY") {
         throw new Error(`Session ${sessionId} already exists`);
@@ -690,7 +895,7 @@ var SqliteStorage = class {
       throw error;
     }
   }
-  async update(userId, sessionId, data, ttl) {
+  async update(userId, sessionId, data) {
     this.ensureInitialized();
     if (!sessionId || !userId) {
       throw new Error("userId and sessionId required");
@@ -699,12 +904,25 @@ var SqliteStorage = class {
     if (!currentSession) {
       throw new Error(`Session ${sessionId} not found for userId ${userId}`);
     }
-    const updatedSession = { ...currentSession, ...data };
-    const expiresAt = ttl ? Date.now() + ttl * 1e3 : null;
+    const updatedSession = mergeSessionUpdate(currentSession, data);
     const stmt = this.db.prepare(
       `UPDATE ${this.table} SET data = ?, expiresAt = ? WHERE sessionId = ? AND userId = ?`
     );
-    stmt.run(JSON.stringify(updatedSession), expiresAt, sessionId, userId);
+    stmt.run(JSON.stringify(updatedSession), updatedSession.expiresAt ?? null, sessionId, userId);
+  }
+  async patchCredentials(userId, sessionId, data) {
+    this.ensureInitialized();
+    if (!await this.get(userId, sessionId)) {
+      throw new Error(`Session ${sessionId} not found for userId ${userId}`);
+    }
+    const current = await this.getCredentials(userId, sessionId) ?? { sessionId, userId };
+    const credentials = { ...current, ...data, sessionId, userId };
+    const stmt = this.db.prepare(
+      `INSERT INTO ${this.credentialsTable} (sessionId, userId, data)
+             VALUES (?, ?, ?)
+             ON CONFLICT(userId, sessionId) DO UPDATE SET data = excluded.data`
+    );
+    stmt.run(sessionId, userId, JSON.stringify(credentials));
   }
   async get(userId, sessionId) {
     this.ensureInitialized();
@@ -713,7 +931,25 @@ var SqliteStorage = class {
     );
     const row = stmt.get(sessionId, userId);
     if (!row) return null;
-    return JSON.parse(row.data);
+    return normalizeStoredSession(JSON.parse(row.data));
+  }
+  async getCredentials(userId, sessionId) {
+    this.ensureInitialized();
+    if (!await this.get(userId, sessionId)) return null;
+    const stmt = this.db.prepare(
+      `SELECT data FROM ${this.credentialsTable} WHERE sessionId = ? AND userId = ?`
+    );
+    const row = stmt.get(sessionId, userId);
+    return row ? JSON.parse(row.data) : { sessionId, userId };
+  }
+  async clearCredentials(userId, sessionId) {
+    await this.patchCredentials(userId, sessionId, {
+      clientInformation: null,
+      tokens: null,
+      codeVerifier: null,
+      clientId: null,
+      oauthState: null
+    });
   }
   async list(userId) {
     this.ensureInitialized();
@@ -721,7 +957,7 @@ var SqliteStorage = class {
       `SELECT data FROM ${this.table} WHERE userId = ?`
     );
     const rows = stmt.all(userId);
-    return rows.map((row) => JSON.parse(row.data));
+    return rows.map((row) => normalizeStoredSession(JSON.parse(row.data)));
   }
   async listIds(userId) {
     this.ensureInitialized();
@@ -736,6 +972,9 @@ var SqliteStorage = class {
     const stmt = this.db.prepare(
       `DELETE FROM ${this.table} WHERE sessionId = ? AND userId = ?`
     );
+    this.db.prepare(
+      `DELETE FROM ${this.credentialsTable} WHERE sessionId = ? AND userId = ?`
+    ).run(sessionId, userId);
     stmt.run(sessionId, userId);
   }
   async listAllIds() {
@@ -746,16 +985,28 @@ var SqliteStorage = class {
   }
   async clearAll() {
     this.ensureInitialized();
+    this.db.prepare(`DELETE FROM ${this.credentialsTable}`).run();
     const stmt = this.db.prepare(`DELETE FROM ${this.table}`);
     stmt.run();
   }
   async cleanupExpired() {
     this.ensureInitialized();
-    const now = Date.now();
-    const stmt = this.db.prepare(
-      `DELETE FROM ${this.table} WHERE expiresAt IS NOT NULL AND expiresAt < ?`
-    );
-    stmt.run(now);
+    const rows = this.db.prepare(`SELECT sessionId, userId, data FROM ${this.table}`).all();
+    const deleteStmt = this.db.prepare(`DELETE FROM ${this.table} WHERE sessionId = ? AND userId = ?`);
+    for (const row of rows) {
+      const session = normalizeStoredSession(JSON.parse(row.data));
+      if (isSessionExpired(session)) {
+        deleteStmt.run(row.sessionId, row.userId);
+      }
+    }
+    this.db.prepare(
+      `DELETE FROM ${this.credentialsTable}
+             WHERE NOT EXISTS (
+                SELECT 1 FROM ${this.table}
+                WHERE ${this.table}.sessionId = ${this.credentialsTable}.sessionId
+                  AND ${this.table}.userId = ${this.credentialsTable}.userId
+             )`
+    ).run();
   }
   async disconnect() {
     if (this.db) {
@@ -840,19 +1091,21 @@ function decryptObject(data) {
 var SupabaseStorageBackend = class {
   constructor(supabase) {
     this.supabase = supabase;
-    __publicField(this, "DEFAULT_TTL", SESSION_TTL_SECONDS);
   }
   async init() {
-    const { error } = await this.supabase.from("mcp_sessions").select("session_id").limit(0);
-    if (error) {
-      if (error.code === "42P01") {
-        throw new Error(
-          '[SupabaseStorage] Table "mcp_sessions" not found in your database. Please run "npx mcp-ts supabase-init" in your project to set up the required table and RLS policies.'
-        );
-      }
-      throw new Error(`[SupabaseStorage] Initialization check failed: ${error.message}`);
+    await this.assertTable("mcp_sessions", "session_id");
+    await this.assertTable("mcp_credentials", "session_id");
+    console.log("[mcp-ts][Storage] Supabase: storage tables verified.");
+  }
+  async assertTable(table, column) {
+    const { error } = await this.supabase.from(table).select(column).limit(0);
+    if (!error) return;
+    if (error.code === "42P01") {
+      throw new Error(
+        `[SupabaseStorage] Table "${table}" not found in your database. Please run "npx mcp-ts supabase-init" to set up the required storage schema.`
+      );
     }
-    console.log('[mcp-ts][Storage] Supabase: \u2713 "mcp_sessions" table verified.');
+    throw new Error(`[SupabaseStorage] Initialization check failed for "${table}": ${error.message}`);
   }
   generateSessionId() {
     return generateSessionId();
@@ -866,37 +1119,49 @@ var SupabaseStorageBackend = class {
       transportType: row.transport_type,
       callbackUrl: row.callback_url,
       createdAt: new Date(row.created_at).getTime(),
+      updatedAt: new Date(row.updated_at ?? row.created_at).getTime(),
+      expiresAt: row.expires_at ? new Date(row.expires_at).getTime() : null,
       userId: row.user_id,
       headers: decryptObject(row.headers),
-      active: row.active,
-      clientInformation: row.client_information,
-      tokens: decryptObject(row.tokens),
-      codeVerifier: row.code_verifier,
-      clientId: row.client_id
+      authUrl: row.auth_url,
+      status: row.status ?? "pending"
     };
   }
-  async create(session, ttl) {
+  mapRowToCredentials(row, userId, sessionId) {
+    return {
+      sessionId,
+      userId,
+      clientInformation: decryptObject(row?.client_information),
+      tokens: decryptObject(row?.tokens),
+      codeVerifier: decryptObject(row?.code_verifier),
+      clientId: row?.client_id,
+      oauthState: row?.oauth_state
+    };
+  }
+  hasCredentialData(data) {
+    return "clientInformation" in data || "tokens" in data || "codeVerifier" in data || "clientId" in data || "oauthState" in data;
+  }
+  async create(session) {
     const { sessionId, userId } = session;
     if (!sessionId || !userId) throw new Error("userId and sessionId required");
-    const effectiveTtl = ttl ?? this.DEFAULT_TTL;
-    const expiresAt = new Date(Date.now() + effectiveTtl * 1e3).toISOString();
+    const status = session.status ?? "pending";
+    const createdAt = new Date(session.createdAt || Date.now()).toISOString();
+    const updatedAt = new Date(session.updatedAt ?? session.createdAt ?? Date.now()).toISOString();
+    const expiresAt = resolveSessionExpiresAt(status, new Date(createdAt).getTime());
     const { error } = await this.supabase.from("mcp_sessions").insert({
       session_id: sessionId,
       user_id: userId,
-      // Maps user_id to userId to support RLS using auth.uid()
       server_id: session.serverId,
       server_name: session.serverName,
       server_url: session.serverUrl,
       transport_type: session.transportType,
       callback_url: session.callbackUrl,
-      created_at: new Date(session.createdAt || Date.now()).toISOString(),
+      created_at: createdAt,
+      updated_at: updatedAt,
       headers: encryptObject(session.headers),
-      active: session.active ?? false,
-      client_information: session.clientInformation,
-      tokens: encryptObject(session.tokens),
-      code_verifier: session.codeVerifier,
-      client_id: session.clientId,
-      expires_at: expiresAt
+      auth_url: session.authUrl ?? null,
+      status,
+      expires_at: expiresAt === null ? null : new Date(expiresAt).toISOString()
     });
     if (error) {
       if (error.code === "23505") {
@@ -905,11 +1170,8 @@ var SupabaseStorageBackend = class {
       throw new Error(`Failed to create session in Supabase: ${error.message}`);
     }
   }
-  async update(userId, sessionId, data, ttl) {
-    const effectiveTtl = ttl ?? this.DEFAULT_TTL;
-    const expiresAt = new Date(Date.now() + effectiveTtl * 1e3).toISOString();
+  async update(userId, sessionId, data) {
     const updateData = {
-      expires_at: expiresAt,
       updated_at: (/* @__PURE__ */ new Date()).toISOString()
     };
     if ("serverId" in data) updateData.server_id = data.serverId;
@@ -917,20 +1179,50 @@ var SupabaseStorageBackend = class {
     if ("serverUrl" in data) updateData.server_url = data.serverUrl;
     if ("transportType" in data) updateData.transport_type = data.transportType;
     if ("callbackUrl" in data) updateData.callback_url = data.callbackUrl;
-    if ("active" in data) updateData.active = data.active;
+    if ("status" in data) {
+      const status = data.status ?? "pending";
+      const expiresAt = resolveSessionExpiresAt(status);
+      updateData.status = status;
+      updateData.expires_at = expiresAt === null ? null : new Date(expiresAt).toISOString();
+    }
     if ("headers" in data) updateData.headers = encryptObject(data.headers);
-    if ("clientInformation" in data) updateData.client_information = data.clientInformation;
-    if ("tokens" in data) updateData.tokens = data.tokens === void 0 ? null : encryptObject(data.tokens);
-    if ("codeVerifier" in data) updateData.code_verifier = data.codeVerifier;
-    if ("clientId" in data) updateData.client_id = data.clientId;
-    const { data: updatedRows, error } = await this.supabase.from("mcp_sessions").update(updateData).eq("user_id", userId).eq("session_id", sessionId).select("id");
-    if (error) {
-      throw new Error(`Failed to update session: ${error.message}`);
+    if ("authUrl" in data) updateData.auth_url = data.authUrl ?? null;
+    const shouldUpdateSession = Object.keys(updateData).some((key) => key !== "updated_at");
+    let updatedRows = null;
+    if (shouldUpdateSession) {
+      const result = await this.supabase.from("mcp_sessions").update(updateData).eq("user_id", userId).eq("session_id", sessionId).select("id");
+      if (result.error) {
+        throw new Error(`Failed to update session: ${result.error.message}`);
+      }
+      updatedRows = result.data;
+    } else {
+      const result = await this.supabase.from("mcp_sessions").select("id").eq("user_id", userId).eq("session_id", sessionId);
+      if (result.error) {
+        throw new Error(`Failed to update session: ${result.error.message}`);
+      }
+      updatedRows = result.data;
     }
     if (!updatedRows || updatedRows.length === 0) {
       throw new Error(`Session ${sessionId} not found for userId ${userId}`);
     }
   }
+  async patchCredentials(userId, sessionId, data) {
+    if (!this.hasCredentialData(data)) return;
+    const row = {
+      user_id: userId,
+      session_id: sessionId,
+      updated_at: (/* @__PURE__ */ new Date()).toISOString()
+    };
+    if ("clientInformation" in data) row.client_information = data.clientInformation == null ? null : encryptObject(data.clientInformation);
+    if ("tokens" in data) row.tokens = data.tokens == null ? null : encryptObject(data.tokens);
+    if ("codeVerifier" in data) row.code_verifier = data.codeVerifier == null ? null : encryptObject(data.codeVerifier);
+    if ("clientId" in data) row.client_id = data.clientId ?? null;
+    if ("oauthState" in data) row.oauth_state = data.oauthState ?? null;
+    const { error } = await this.supabase.from("mcp_credentials").upsert(row, { onConflict: "user_id,session_id" });
+    if (error) {
+      throw new Error(`Failed to update credentials: ${error.message}`);
+    }
+  }
   async get(userId, sessionId) {
     const { data, error } = await this.supabase.from("mcp_sessions").select("*").eq("user_id", userId).eq("session_id", sessionId).maybeSingle();
     if (error) {
@@ -940,6 +1232,21 @@ var SupabaseStorageBackend = class {
     if (!data) return null;
     return this.mapRowToSessionData(data);
   }
+  async getCredentials(userId, sessionId) {
+    const { data, error } = await this.supabase.from("mcp_credentials").select("*").eq("user_id", userId).eq("session_id", sessionId).maybeSingle();
+    if (error) {
+      console.error("[SupabaseStorage] Failed to get credentials:", error);
+      return null;
+    }
+    if (data) {
+      return this.mapRowToCredentials(data, userId, sessionId);
+    }
+    const { data: sessionRows, error: sessionError } = await this.supabase.from("mcp_sessions").select("id").eq("user_id", userId).eq("session_id", sessionId);
+    if (sessionError || !sessionRows || sessionRows.length === 0) {
+      return null;
+    }
+    return { sessionId, userId };
+  }
   async list(userId) {
     const { data, error } = await this.supabase.from("mcp_sessions").select("*").eq("user_id", userId);
     if (error) {
@@ -948,6 +1255,12 @@ var SupabaseStorageBackend = class {
     }
     return data.map((row) => this.mapRowToSessionData(row));
   }
+  async clearCredentials(userId, sessionId) {
+    const { error } = await this.supabase.from("mcp_credentials").delete().eq("user_id", userId).eq("session_id", sessionId);
+    if (error) {
+      throw new Error(`Failed to clear credentials: ${error.message}`);
+    }
+  }
   async delete(userId, sessionId) {
     const { error } = await this.supabase.from("mcp_sessions").delete().eq("user_id", userId).eq("session_id", sessionId);
     if (error) {
@@ -971,15 +1284,24 @@ var SupabaseStorageBackend = class {
     return data.map((row) => row.session_id);
   }
   async clearAll() {
+    const { error: credentialsError } = await this.supabase.from("mcp_credentials").delete().neq("session_id", "");
+    if (credentialsError) {
+      console.error("[SupabaseStorage] Failed to clear credentials:", credentialsError);
+    }
     const { error } = await this.supabase.from("mcp_sessions").delete().neq("session_id", "");
     if (error) {
       console.error("[SupabaseStorage] Failed to clear sessions:", error);
     }
   }
   async cleanupExpired() {
-    const { error } = await this.supabase.from("mcp_sessions").delete().lt("expires_at", (/* @__PURE__ */ new Date()).toISOString());
-    if (error) {
-      console.error("[SupabaseStorage] Failed to cleanup expired sessions:", error);
+    const { error: transientError } = await this.supabase.from("mcp_sessions").delete().not("expires_at", "is", null).neq("status", "active").lt("expires_at", (/* @__PURE__ */ new Date()).toISOString());
+    if (transientError) {
+      console.error("[SupabaseStorage] Failed to cleanup expired inactive sessions:", transientError);
+    }
+    const dormantCutoff = new Date(Date.now() - DORMANT_SESSION_EXPIRATION_MS).toISOString();
+    const { error: dormantError } = await this.supabase.from("mcp_sessions").delete().eq("status", "active").lt("updated_at", dormantCutoff);
+    if (dormantError) {
+      console.error("[SupabaseStorage] Failed to cleanup dormant active sessions:", dormantError);
     }
   }
   async disconnect() {
@@ -991,23 +1313,29 @@ init_cjs_shims();
 var NeonStorageBackend = class {
   constructor(sql, options = {}) {
     this.sql = sql;
-    __publicField(this, "DEFAULT_TTL", SESSION_TTL_SECONDS);
     __publicField(this, "tableName");
+    __publicField(this, "credentialsTableName");
     const schema = options.schema || "public";
     const table = options.table || "mcp_sessions";
+    const credentialsTable = options.credentialsTable || "mcp_credentials";
     this.tableName = `${this.quoteIdentifier(schema)}.${this.quoteIdentifier(table)}`;
+    this.credentialsTableName = `${this.quoteIdentifier(schema)}.${this.quoteIdentifier(credentialsTable)}`;
   }
   async init() {
+    await this.assertTable(this.tableName, "mcp_sessions");
+    await this.assertTable(this.credentialsTableName, "mcp_credentials");
+    console.log("[mcp-ts][Storage] Neon: storage tables verified.");
+  }
+  async assertTable(qualifiedName, displayName) {
     const [{ exists } = { exists: null }] = await this.sql.query(
       "SELECT to_regclass($1) AS exists",
-      [this.tableName.replace(/"/g, "")]
+      [qualifiedName.replace(/"/g, "")]
     );
     if (!exists) {
       throw new Error(
-        '[NeonStorage] Table "mcp_sessions" not found in your database. Please create it using the Neon storage guide in docs/storage-backends/neon.md.'
+        `[NeonStorage] Table "${displayName}" not found in your database. Please create it using the Neon storage guide in docs/storage-backends/neon.md.`
       );
     }
-    console.log('[mcp-ts][Storage] Neon: "mcp_sessions" table verified.');
   }
   generateSessionId() {
     return generateSessionId();
@@ -1027,20 +1355,35 @@ var NeonStorageBackend = class {
       transportType: row.transport_type,
       callbackUrl: row.callback_url,
       createdAt: new Date(row.created_at).getTime(),
+      updatedAt: new Date(row.updated_at ?? row.created_at).getTime(),
+      expiresAt: row.expires_at ? new Date(row.expires_at).getTime() : null,
       userId: row.user_id,
       headers: decryptObject(row.headers),
-      active: row.active ?? false,
-      clientInformation: row.client_information,
+      authUrl: row.auth_url ?? void 0,
+      status: row.status ?? "pending"
+    };
+  }
+  mapRowToCredentials(row, userId, sessionId) {
+    return {
+      sessionId,
+      userId,
+      clientInformation: decryptObject(row.client_information),
       tokens: decryptObject(row.tokens),
-      codeVerifier: row.code_verifier ?? void 0,
-      clientId: row.client_id ?? void 0
+      codeVerifier: decryptObject(row.code_verifier),
+      clientId: row.client_id ?? void 0,
+      oauthState: row.oauth_state
     };
   }
-  async create(session, ttl) {
+  hasCredentialData(data) {
+    return "clientInformation" in data || "tokens" in data || "codeVerifier" in data || "clientId" in data || "oauthState" in data;
+  }
+  async create(session) {
     const { sessionId, userId } = session;
     if (!sessionId || !userId) throw new Error("userId and sessionId required");
-    const effectiveTtl = ttl ?? this.DEFAULT_TTL;
-    const expiresAt = new Date(Date.now() + effectiveTtl * 1e3).toISOString();
+    const status = session.status ?? "pending";
+    const createdAt = new Date(session.createdAt || Date.now()).toISOString();
+    const updatedAt = new Date(session.updatedAt ?? session.createdAt ?? Date.now()).toISOString();
+    const expiresAt = resolveSessionExpiresAt(status, new Date(createdAt).getTime());
     try {
       await this.sql.query(
         `INSERT INTO ${this.tableName} (
@@ -1052,16 +1395,14 @@ var NeonStorageBackend = class {
                     transport_type,
                     callback_url,
                     created_at,
+                    updated_at,
                     headers,
-                    active,
-                    client_information,
-                    tokens,
-                    code_verifier,
-                    client_id,
+                    auth_url,
+                    status,
                     expires_at
                 ) VALUES (
                     $1, $2, $3, $4, $5, $6, $7, $8,
-                    $9, $10, $11, $12, $13, $14, $15
+                    $9, $10, $11, $12, $13
                 )`,
         [
           sessionId,
@@ -1071,14 +1412,12 @@ var NeonStorageBackend = class {
           session.serverUrl,
           session.transportType,
           session.callbackUrl,
-          new Date(session.createdAt || Date.now()).toISOString(),
+          createdAt,
+          updatedAt,
           encryptObject(session.headers),
-          session.active ?? false,
-          session.clientInformation,
-          encryptObject(session.tokens),
-          session.codeVerifier,
-          session.clientId,
-          expiresAt
+          session.authUrl ?? null,
+          status,
+          expiresAt === null ? null : new Date(expiresAt).toISOString()
         ]
       );
     } catch (error) {
@@ -1088,52 +1427,86 @@ var NeonStorageBackend = class {
       throw new Error(`Failed to create session in Neon: ${error.message}`);
     }
   }
-  async update(userId, sessionId, data, ttl) {
+  async update(userId, sessionId, data) {
     const currentSession = await this.get(userId, sessionId);
     if (!currentSession) {
       throw new Error(`Session ${sessionId} not found for userId ${userId}`);
     }
     const updatedSession = { ...currentSession, ...data };
-    const effectiveTtl = ttl ?? this.DEFAULT_TTL;
-    const expiresAt = new Date(Date.now() + effectiveTtl * 1e3).toISOString();
-    const updatedRows = await this.sql.query(
-      `UPDATE ${this.tableName}
-             SET
-                server_id = $1,
-                server_name = $2,
-                server_url = $3,
-                transport_type = $4,
-                callback_url = $5,
-                active = $6,
-                headers = $7,
-                client_information = $8,
-                tokens = $9,
-                code_verifier = $10,
-                client_id = $11,
-                expires_at = $12,
-                updated_at = now()
-             WHERE user_id = $13 AND session_id = $14
-             RETURNING id`,
+    const status = updatedSession.status ?? "pending";
+    const expiresAt = resolveSessionExpiresAt(status);
+    const shouldUpdateSession = "serverId" in data || "serverName" in data || "serverUrl" in data || "transportType" in data || "callbackUrl" in data || "status" in data || "headers" in data || "authUrl" in data;
+    if (shouldUpdateSession) {
+      const updatedRows = await this.sql.query(
+        `UPDATE ${this.tableName}
+                 SET
+                    server_id = $1,
+                    server_name = $2,
+                    server_url = $3,
+                    transport_type = $4,
+                    callback_url = $5,
+                    status = $6,
+                    headers = $7,
+                    auth_url = $8,
+                    expires_at = $9,
+                    updated_at = now()
+                 WHERE user_id = $10 AND session_id = $11
+                 RETURNING id`,
+        [
+          updatedSession.serverId,
+          updatedSession.serverName,
+          updatedSession.serverUrl,
+          updatedSession.transportType,
+          updatedSession.callbackUrl,
+          status,
+          encryptObject(updatedSession.headers),
+          updatedSession.authUrl ?? null,
+          expiresAt === null ? null : new Date(expiresAt).toISOString(),
+          userId,
+          sessionId
+        ]
+      );
+      if (updatedRows.length === 0) {
+        throw new Error(`Session ${sessionId} not found for userId ${userId}`);
+      }
+    }
+  }
+  async patchCredentials(userId, sessionId, data) {
+    if (!this.hasCredentialData(data)) return;
+    await this.sql.query(
+      `INSERT INTO ${this.credentialsTableName} (
+                user_id,
+                session_id,
+                client_information,
+                tokens,
+                code_verifier,
+                client_id,
+                oauth_state,
+                updated_at
+            ) VALUES ($1, $2, $3, $4, $5, $6, $7, now())
+            ON CONFLICT (user_id, session_id)
+            DO UPDATE SET
+                client_information = CASE WHEN $8 THEN EXCLUDED.client_information ELSE ${this.credentialsTableName}.client_information END,
+                tokens = CASE WHEN $9 THEN EXCLUDED.tokens ELSE ${this.credentialsTableName}.tokens END,
+                code_verifier = CASE WHEN $10 THEN EXCLUDED.code_verifier ELSE ${this.credentialsTableName}.code_verifier END,
+                client_id = CASE WHEN $11 THEN EXCLUDED.client_id ELSE ${this.credentialsTableName}.client_id END,
+                oauth_state = CASE WHEN $12 THEN EXCLUDED.oauth_state ELSE ${this.credentialsTableName}.oauth_state END,
+                updated_at = now()`,
       [
-        updatedSession.serverId,
-        updatedSession.serverName,
-        updatedSession.serverUrl,
-        updatedSession.transportType,
-        updatedSession.callbackUrl,
-        updatedSession.active ?? false,
-        encryptObject(updatedSession.headers),
-        updatedSession.clientInformation,
-        updatedSession.tokens === void 0 ? null : encryptObject(updatedSession.tokens),
-        updatedSession.codeVerifier,
-        updatedSession.clientId,
-        expiresAt,
         userId,
-        sessionId
+        sessionId,
+        "clientInformation" in data ? data.clientInformation == null ? null : encryptObject(data.clientInformation) : null,
+        "tokens" in data ? data.tokens == null ? null : encryptObject(data.tokens) : null,
+        "codeVerifier" in data ? data.codeVerifier == null ? null : encryptObject(data.codeVerifier) : null,
+        "clientId" in data ? data.clientId ?? null : null,
+        "oauthState" in data ? data.oauthState ?? null : null,
+        "clientInformation" in data,
+        "tokens" in data,
+        "codeVerifier" in data,
+        "clientId" in data,
+        "oauthState" in data
       ]
     );
-    if (updatedRows.length === 0) {
-      throw new Error(`Session ${sessionId} not found for userId ${userId}`);
-    }
   }
   async get(userId, sessionId) {
     try {
@@ -1141,12 +1514,32 @@ var NeonStorageBackend = class {
         `SELECT * FROM ${this.tableName} WHERE user_id = $1 AND session_id = $2`,
         [userId, sessionId]
       );
-      return rows[0] ? this.mapRowToSessionData(rows[0]) : null;
+      if (!rows[0]) return null;
+      return this.mapRowToSessionData(rows[0]);
     } catch (error) {
       console.error("[NeonStorage] Failed to get session:", error);
       return null;
     }
   }
+  async getCredentials(userId, sessionId) {
+    try {
+      const credentialRows = await this.sql.query(
+        `SELECT * FROM ${this.credentialsTableName} WHERE user_id = $1 AND session_id = $2`,
+        [userId, sessionId]
+      );
+      if (credentialRows[0]) {
+        return this.mapRowToCredentials(credentialRows[0], userId, sessionId);
+      }
+      const sessionRows = await this.sql.query(
+        `SELECT id FROM ${this.tableName} WHERE user_id = $1 AND session_id = $2`,
+        [userId, sessionId]
+      );
+      return sessionRows[0] ? { sessionId, userId } : null;
+    } catch (error) {
+      console.error("[NeonStorage] Failed to get credentials:", error);
+      return null;
+    }
+  }
   async list(userId) {
     try {
       const rows = await this.sql.query(
@@ -1159,6 +1552,16 @@ var NeonStorageBackend = class {
       return [];
     }
   }
+  async clearCredentials(userId, sessionId) {
+    try {
+      await this.sql.query(
+        `DELETE FROM ${this.credentialsTableName} WHERE user_id = $1 AND session_id = $2`,
+        [userId, sessionId]
+      );
+    } catch (error) {
+      console.error("[NeonStorage] Failed to clear credentials:", error);
+    }
+  }
   async delete(userId, sessionId) {
     try {
       await this.sql.query(
@@ -1194,6 +1597,7 @@ var NeonStorageBackend = class {
   }
   async clearAll() {
     try {
+      await this.sql.query(`DELETE FROM ${this.credentialsTableName}`);
       await this.sql.query(`DELETE FROM ${this.tableName}`);
     } catch (error) {
       console.error("[NeonStorage] Failed to clear sessions:", error);
@@ -1202,9 +1606,17 @@ var NeonStorageBackend = class {
   async cleanupExpired() {
     try {
       await this.sql.query(
-        `DELETE FROM ${this.tableName} WHERE expires_at < $1`,
+        `DELETE FROM ${this.tableName}
+                 WHERE expires_at IS NOT NULL
+                   AND expires_at < $1
+                   AND status <> 'active'`,
         [(/* @__PURE__ */ new Date()).toISOString()]
       );
+      await this.sql.query(
+        `DELETE FROM ${this.tableName}
+                 WHERE status = 'active' AND updated_at < $1`,
+        [new Date(Date.now() - DORMANT_SESSION_EXPIRATION_MS).toISOString()]
+      );
     } catch (error) {
       console.error("[NeonStorage] Failed to cleanup expired sessions:", error);
     }
@@ -1254,26 +1666,24 @@ function emitSessionMutation(event) {
 function createSessionMutationEvent(prop, args) {
   const timestamp = Date.now();
   if (prop === "create") {
-    const [session, ttl] = args;
+    const [session] = args;
     if (!session?.userId || !session?.sessionId) return null;
     return {
       type: "create",
       userId: session.userId,
       sessionId: session.sessionId,
       session,
-      ttl,
       timestamp
     };
   }
   if (prop === "update") {
-    const [userId, sessionId, patch, ttl] = args;
+    const [userId, sessionId, patch] = args;
     if (!userId || !sessionId) return null;
     return {
       type: "update",
       userId,
       sessionId,
       patch,
-      ttl,
       timestamp
     };
   }
@@ -1469,7 +1879,6 @@ var StorageOAuthClientProvider = class {
     __publicField(this, "_authUrl");
     __publicField(this, "_clientId");
     __publicField(this, "onRedirectCallback");
-    __publicField(this, "tokenExpiresAt");
     this.userId = options.userId;
     this.serverId = options.serverId;
     this.sessionId = options.sessionId;
@@ -1503,30 +1912,30 @@ var StorageOAuthClientProvider = class {
     this._clientId = clientId_;
   }
   /**
-   * Loads OAuth data from the session store
+   * Loads OAuth credentials from the session store
    * @private
    */
-  async getSessionData() {
-    const data = await sessions.get(this.userId, this.sessionId);
+  async getCredentials() {
+    const data = await sessions.getCredentials(this.userId, this.sessionId);
     if (!data) {
-      return {};
+      return { userId: this.userId, sessionId: this.sessionId };
     }
     return data;
   }
   /**
-   * Saves OAuth data to the session store
-   * @param data - Partial OAuth data to save
+   * Saves OAuth credentials to the session store
+   * @param data - Partial OAuth credentials to save
    * @private
    * @throws Error if session doesn't exist (session must be created by controller layer)
    */
-  async saveSessionData(data) {
-    await sessions.update(this.userId, this.sessionId, data);
+  async patchCredentials(data) {
+    await sessions.patchCredentials(this.userId, this.sessionId, data);
   }
   /**
    * Retrieves stored OAuth client information
    */
   async clientInformation() {
-    const data = await this.getSessionData();
+    const data = await this.getCredentials();
     if (data.clientId && !this._clientId) {
       this._clientId = data.clientId;
     }
@@ -1545,7 +1954,7 @@ var StorageOAuthClientProvider = class {
    * Stores OAuth client information
    */
   async saveClientInformation(clientInformation) {
-    await this.saveSessionData({
+    await this.patchCredentials({
       clientInformation,
       clientId: clientInformation.client_id
     });
@@ -1555,29 +1964,58 @@ var StorageOAuthClientProvider = class {
    * Stores OAuth tokens
    */
   async saveTokens(tokens) {
-    const data = { tokens };
-    if (tokens.expires_in) {
-      this.tokenExpiresAt = Date.now() + tokens.expires_in * 1e3 - TOKEN_EXPIRY_BUFFER_MS;
-    }
-    await this.saveSessionData(data);
+    await this.patchCredentials({ tokens });
   }
   get authUrl() {
     return this._authUrl;
   }
   async state() {
-    return this.sessionId;
+    const nonce = nanoid.nanoid(32);
+    await this.patchCredentials({
+      oauthState: {
+        nonce,
+        sessionId: this.sessionId,
+        serverId: this.serverId,
+        createdAt: Date.now()
+      },
+      codeVerifier: null
+    });
+    return formatOAuthState(nonce, this.sessionId);
   }
-  async checkState(_state) {
-    const data = await sessions.get(this.userId, this.sessionId);
+  async checkState(state) {
+    const parsed = parseOAuthState(state);
+    if (!parsed) {
+      return { valid: false, error: "Invalid OAuth state" };
+    }
+    if (parsed.sessionId !== this.sessionId) {
+      return { valid: false, error: "OAuth state mismatch" };
+    }
+    const data = await sessions.getCredentials(this.userId, parsed.sessionId);
     if (!data) {
       return { valid: false, error: "Session not found" };
     }
-    return { valid: true, serverId: this.serverId };
+    const oauthState = data.oauthState;
+    if (!oauthState) {
+      return { valid: false, error: "OAuth state not found" };
+    }
+    if (oauthState.nonce !== parsed.nonce || oauthState.sessionId !== parsed.sessionId || oauthState.serverId !== this.serverId) {
+      return { valid: false, error: "OAuth state mismatch" };
+    }
+    if (Date.now() - oauthState.createdAt > STATE_EXPIRATION_MS) {
+      return { valid: false, error: "OAuth state expired" };
+    }
+    return { valid: true, serverId: oauthState.serverId };
   }
-  async consumeState(_state) {
+  async consumeState(state) {
+    const result = await this.checkState(state);
+    if (!result.valid) {
+      throw new Error(result.error || "Invalid OAuth state");
+    }
+    await this.patchCredentials({ oauthState: null });
   }
   async redirectToAuthorization(authUrl) {
     this._authUrl = authUrl.toString();
+    await sessions.update(this.userId, this.sessionId, { authUrl: this._authUrl });
     if (this.onRedirectCallback) {
       this.onRedirectCallback(authUrl.toString());
     }
@@ -1588,21 +2026,25 @@ var StorageOAuthClientProvider = class {
     } else {
       const updates = {};
       if (scope === "client") {
-        updates.clientInformation = void 0;
-        updates.clientId = void 0;
+        updates.clientInformation = null;
+        updates.clientId = null;
       } else if (scope === "tokens") {
-        updates.tokens = void 0;
+        updates.tokens = null;
       } else if (scope === "verifier") {
-        updates.codeVerifier = void 0;
+        updates.codeVerifier = null;
       }
-      await this.saveSessionData(updates);
+      await this.patchCredentials(updates);
     }
   }
   async saveCodeVerifier(verifier) {
-    await this.saveSessionData({ codeVerifier: verifier });
+    const data = await this.getCredentials();
+    if (data.codeVerifier) {
+      return;
+    }
+    await this.patchCredentials({ codeVerifier: verifier });
   }
   async codeVerifier() {
-    const data = await this.getSessionData();
+    const data = await this.getCredentials();
     if (data.clientId && !this._clientId) {
       this._clientId = data.clientId;
     }
@@ -1612,23 +2054,14 @@ var StorageOAuthClientProvider = class {
     return data.codeVerifier;
   }
   async deleteCodeVerifier() {
-    await this.saveSessionData({ codeVerifier: void 0 });
+    await this.patchCredentials({ codeVerifier: null });
   }
   async tokens() {
-    const data = await this.getSessionData();
+    const data = await this.getCredentials();
     if (data.clientId && !this._clientId) {
       this._clientId = data.clientId;
     }
-    return data.tokens;
-  }
-  isTokenExpired() {
-    if (!this.tokenExpiresAt) {
-      return false;
-    }
-    return Date.now() >= this.tokenExpiresAt;
-  }
-  setTokenExpiresAt(expiresAt) {
-    this.tokenExpiresAt = expiresAt;
+    return data.tokens ?? void 0;
   }
 };
 
@@ -1855,7 +2288,7 @@ var MCPClient = class {
        * Observation: SDK 1.24.0+ connections may hang indefinitely in some environments.
        * This wrapper enforces a timeout and properly uses AbortController to unblock the request.
        */
-      fetch: (url, init) => {
+      fetch: async (url, init) => {
         const timeout = 3e4;
         const controller = new AbortController();
         const timeoutId = setTimeout(() => controller.abort(), timeout);
@@ -1863,7 +2296,17 @@ var MCPClient = class {
           // @ts-ignore: AbortSignal.any is available in Node 20+
           AbortSignal.any ? AbortSignal.any([init.signal, controller.signal]) : controller.signal
         ) : controller.signal;
-        return fetch(url, { ...init, signal }).finally(() => clearTimeout(timeoutId));
+        try {
+          const response = await fetch(url, { ...init, signal });
+          const hasSessionHeader = init?.headers && new Headers(init.headers).has("mcp-session-id");
+          if (response.status === 404 && hasSessionHeader) {
+            this.client = null;
+            throw new Error("MCP_SESSION_EXPIRED: Downstream session was not found on the server.");
+          }
+          return response;
+        } finally {
+          clearTimeout(timeoutId);
+        }
       }
     };
     if (type === "sse") {
@@ -1884,17 +2327,18 @@ var MCPClient = class {
     }
     this.emitStateChange("INITIALIZING");
     this.emitProgress("Loading session configuration...");
+    let existingSession = null;
     if (!this.serverUrl || !this.callbackUrl || !this.serverId) {
-      const sessionData = await sessions.get(this.userId, this.sessionId);
-      if (!sessionData) {
+      existingSession = await sessions.get(this.userId, this.sessionId);
+      if (!existingSession) {
         throw new Error(`Session not found: ${this.sessionId}`);
       }
-      this.serverUrl = this.serverUrl || sessionData.serverUrl;
-      this.callbackUrl = this.callbackUrl || sessionData.callbackUrl;
-      this.serverName = this.serverName || sessionData.serverName;
-      this.serverId = this.serverId || sessionData.serverId || "unknown";
-      this.headers = this.headers || sessionData.headers;
-      this.createdAt = sessionData.createdAt;
+      this.serverUrl = this.serverUrl || existingSession.serverUrl;
+      this.callbackUrl = this.callbackUrl || existingSession.callbackUrl;
+      this.serverName = this.serverName || existingSession.serverName;
+      this.serverId = this.serverId || existingSession.serverId || "unknown";
+      this.headers = this.headers || existingSession.headers;
+      this.createdAt = existingSession.createdAt;
     }
     if (!this.serverUrl || !this.callbackUrl || !this.serverId) {
       throw new Error("Missing required connection metadata");
@@ -1938,10 +2382,13 @@ var MCPClient = class {
         }
       );
     }
-    const existingSession = await sessions.get(this.userId, this.sessionId);
+    if (existingSession === null) {
+      existingSession = await sessions.get(this.userId, this.sessionId);
+    }
     if (!existingSession && this.serverId && this.serverUrl && this.callbackUrl) {
       this.createdAt = Date.now();
-      console.log(`[MCPClient] Creating initial session ${this.sessionId} for OAuth flow`);
+      const updatedAt = this.createdAt;
+      console.log(`[MCPClient] Creating pending session ${this.sessionId} for connection setup`);
       await sessions.create({
         sessionId: this.sessionId,
         userId: this.userId,
@@ -1952,18 +2399,18 @@ var MCPClient = class {
         transportType: this.transportType || "streamable-http",
         headers: this.headers,
         createdAt: this.createdAt,
-        active: false
-      }, Math.floor(STATE_EXPIRATION_MS / 1e3));
+        updatedAt,
+        status: "pending"
+      });
     }
   }
   /**
    * Saves current session state to the session store
    * Creates new session if it doesn't exist, updates if it does
-   * @param ttl - Time-to-live in seconds (defaults to 12hr for connected sessions)
-   * @param active - Session status marker used to avoid unnecessary TTL rewrites
+   * @param status - Session lifecycle status used by storage cleanup
    * @private
    */
-  async saveSession(ttl = SESSION_TTL_SECONDS, active = true) {
+  async saveSession(status = "active", existingSession) {
     if (!this.sessionId || !this.serverId || !this.serverUrl || !this.callbackUrl) {
       return;
     }
@@ -1977,13 +2424,29 @@ var MCPClient = class {
       transportType: this.transportType || "streamable-http",
       headers: this.headers,
       createdAt: this.createdAt || Date.now(),
-      active
+      updatedAt: Date.now(),
+      status
     };
-    const existingSession = await sessions.get(this.userId, this.sessionId);
+    if (status === "active") {
+      sessionData.authUrl = null;
+    }
+    if (existingSession === void 0) {
+      existingSession = await sessions.get(this.userId, this.sessionId);
+    }
     if (existingSession) {
-      await sessions.update(this.userId, this.sessionId, sessionData, ttl);
+      await sessions.update(this.userId, this.sessionId, sessionData);
     } else {
-      await sessions.create(sessionData, ttl);
+      await sessions.create(sessionData);
+    }
+  }
+  /**
+   * Removes transient setup/auth sessions without masking the original error.
+   * @private
+   */
+  async deleteTransientSession() {
+    try {
+      await sessions.delete(this.userId, this.sessionId);
+    } catch {
     }
   }
   /**
@@ -2035,6 +2498,14 @@ var MCPClient = class {
    * @throws {Error} When connection fails for other reasons
    */
   async connect() {
+    if (this.client?.transport) {
+      this.transport = null;
+      try {
+        await this.client.close();
+      } catch {
+      }
+      this.client = null;
+    }
     await this.initialize();
     if (!this.client || !this.oauthProvider) {
       const error = "Client or OAuth provider not initialized";
@@ -2048,8 +2519,8 @@ var MCPClient = class {
       this.transportType = transportType;
       this.emitStateChange("CONNECTED");
       this.emitProgress("Connected successfully");
-      console.log(`[MCPClient] Saving session ${this.sessionId} with 12hr TTL (connect success)`);
-      await this.saveSession(SESSION_TTL_SECONDS, true);
+      console.log(`[MCPClient] Saving active session ${this.sessionId} (connect success)`);
+      await this.saveSession("active");
     } catch (error) {
       if (error instanceof auth_js.UnauthorizedError || error instanceof Error && error.message.toLowerCase().includes("unauthorized")) {
         let authUrl = "";
@@ -2061,15 +2532,12 @@ var MCPClient = class {
           const message = detail.toLowerCase() === "unauthorized" ? "OAuth authorization URL not available" : `OAuth authorization URL not available: ${detail}`;
           this.emitError(message, "auth");
           this.emitStateChange("FAILED");
-          try {
-            await sessions.delete(this.userId, this.sessionId);
-          } catch {
-          }
+          await this.deleteTransientSession();
           throw new Error(message);
         }
         this.emitStateChange("AUTHENTICATING");
-        console.log(`[MCPClient] Saving session ${this.sessionId} with 10min TTL (OAuth pending)`);
-        await this.saveSession(Math.floor(STATE_EXPIRATION_MS / 1e3), false);
+        console.log(`[MCPClient] Saving pending OAuth session ${this.sessionId}`);
+        await this.saveSession("pending");
         if (this.serverId) {
           this._onConnectionEvent.fire({
             type: "auth_required",
@@ -2089,7 +2557,7 @@ var MCPClient = class {
       this.emitStateChange("FAILED");
       try {
         const existingSession = await sessions.get(this.userId, this.sessionId);
-        if (!existingSession || existingSession.active !== true) {
+        if (!existingSession || existingSession.status !== "active") {
           await sessions.delete(this.userId, this.sessionId);
         }
       } catch {
@@ -2104,7 +2572,7 @@ var MCPClient = class {
    * @param authCode - Authorization code received from OAuth callback
    */
   // TODO: needs to be optimized
-  async finishAuth(authCode) {
+  async finishAuth(authCode, state) {
     this.emitStateChange("AUTHENTICATING");
     this.emitProgress("Exchanging authorization code for tokens...");
     await this.initialize();
@@ -2114,6 +2582,16 @@ var MCPClient = class {
       this.emitStateChange("FAILED");
       throw new Error(error);
     }
+    if (state) {
+      const stateCheck = await this.oauthProvider.checkState(state);
+      if (!stateCheck.valid) {
+        const error = stateCheck.error || "Invalid OAuth state";
+        this.emitError(error, "auth");
+        this.emitStateChange("FAILED");
+        throw new Error(error);
+      }
+      await this.oauthProvider.consumeState(state);
+    }
     const transportsToTry = this.transportType ? [this.transportType] : ["streamable-http", "sse"];
     let lastError;
     let tokensExchanged = false;
@@ -2153,8 +2631,8 @@ var MCPClient = class {
         await this.client.connect(this.transport);
         this.transportType = currentType;
         this.emitStateChange("CONNECTED");
-        console.log(`[MCPClient] Updating session ${this.sessionId} to 12hr TTL (OAuth complete)`);
-        await this.saveSession(SESSION_TTL_SECONDS, true);
+        console.log(`[MCPClient] Saving active session ${this.sessionId} (OAuth complete)`);
+        await this.saveSession("active");
         return;
       } catch (error) {
         lastError = error;
@@ -2167,12 +2645,14 @@ var MCPClient = class {
           const msg = error instanceof Error ? error.message : "Authentication failed";
           this.emitError(msg, "auth");
           this.emitStateChange("FAILED");
+          await this.deleteTransientSession();
           throw error;
         }
         if (isLastAttempt) {
           const msg = error instanceof Error ? error.message : "Authentication failed";
           this.emitError(msg, "auth");
           this.emitStateChange("FAILED");
+          await this.deleteTransientSession();
           throw error;
         }
         this.emitProgress(`Auth attempt with ${currentType} failed: ${errorMessage}. Retrying...`);
@@ -2182,6 +2662,7 @@ var MCPClient = class {
       const errorMessage = lastError instanceof Error ? lastError.message : "Authentication failed";
       this.emitError(errorMessage, "auth");
       this.emitStateChange("FAILED");
+      await this.deleteTransientSession();
       throw lastError;
     }
   }
@@ -2403,7 +2884,7 @@ var MCPClient = class {
       await this.oauthProvider.invalidateCredentials("all");
     }
     await sessions.delete(this.userId, this.sessionId);
-    this.disconnect();
+    await this.disconnect();
   }
   /**
    * Checks if the client is currently connected to an MCP server
@@ -2413,10 +2894,21 @@ var MCPClient = class {
     return this.client !== null;
   }
   /**
-   * Disconnects from the MCP server and cleans up resources
-   * Does not remove session from Redis - use clearSession() for that
+   * Disconnects from the MCP server and cleans up resources.
+   * Does not remove session from Redis — use clearSession() for that.
+   *
+   * For Streamable HTTP sessions, sends an HTTP DELETE to the MCP endpoint
+   * before closing, as recommended by the MCP Streamable HTTP spec
+   * (section "Session Management", rule 5). This is best-effort — errors
+   * (e.g. server already restarted, 404/405 responses) are silently ignored.
    */
-  disconnect(reason) {
+  async disconnect() {
+    if (this.transport instanceof streamableHttp_js.StreamableHTTPClientTransport) {
+      try {
+        await this.transport.terminateSession();
+      } catch {
+      }
+    }
     if (this.client) {
       this.client.close();
     }
@@ -2428,7 +2920,6 @@ var MCPClient = class {
         type: "disconnected",
         sessionId: this.sessionId,
         serverId: this.serverId,
-        reason,
         timestamp: Date.now()
       });
       this._onObservabilityEvent.fire({
@@ -2437,9 +2928,7 @@ var MCPClient = class {
         message: `Disconnected from ${this.serverId}`,
         sessionId: this.sessionId,
         serverId: this.serverId,
-        payload: {
-          reason: reason || "unknown"
-        },
+        payload: {},
         timestamp: Date.now(),
         id: nanoid.nanoid()
       });
@@ -2496,48 +2985,6 @@ var MCPClient = class {
   getSessionId() {
     return this.sessionId;
   }
-  /**
-   * Gets MCP server configuration for all active user sessions
-   * Loads sessions from storage and returns server connection metadata.
-   * OAuth refresh is handled by SDK transports through their authProvider.
-   * @deprecated This returns legacy connection metadata only and does not
-   * include OAuth tokens or generated Authorization headers. Prefer
-   * MultiSessionClient or explicit MCPClient instances so SDK transports can
-   * own OAuth refresh and reauthorization.
-   * @param userId - User ID to fetch sessions for
-   * @returns Object keyed by sanitized server labels containing transport and url.
-   * @static
-   */
-  static async getMcpServerConfig(userId) {
-    const mcpConfig = {};
-    const sessionList = await sessions.list(userId);
-    await Promise.all(
-      sessionList.map(async (sessionData) => {
-        const { sessionId } = sessionData;
-        try {
-          if (!sessionData.serverId || !sessionData.transportType || !sessionData.serverUrl || !sessionData.callbackUrl) {
-            await sessions.delete(userId, sessionId);
-            return;
-          }
-          const label = sanitizeServerLabel(
-            sessionData.serverName || sessionData.serverId || "server"
-          );
-          mcpConfig[label] = {
-            transport: sessionData.transportType,
-            url: sessionData.serverUrl,
-            ...sessionData.serverName && {
-              serverName: sessionData.serverName,
-              serverLabel: label
-            }
-          };
-        } catch (error) {
-          await sessions.delete(userId, sessionId);
-          console.warn(`[MCP] Failed to process session ${sessionId}:`, error);
-        }
-      })
-    );
-    return mcpConfig;
-  }
 };
 
 // src/server/mcp/multi-session-client.ts
@@ -2573,18 +3020,13 @@ var MultiSessionClient = class {
    *
    * A session is considered connectable when:
    * - It has a `serverId`, `serverUrl`, and `callbackUrl` (i.e. it was fully initialized)
-   * - Its `active` flag is not explicitly `false` — sessions with `active: false` are
-   *   either mid-OAuth flow, auth-pending, or previously failed. We skip those here
+   * - Its status is `active`. Pending sessions are skipped here
    *   and let the OAuth flow complete separately before we try to reconnect them.
-   *
-   * Note: Sessions where `active` is `undefined` (legacy records) are included
-   * for backwards compatibility.
    */
   async getActiveSessions() {
     const sessionList = await sessions.list(this.userId);
     const valid = sessionList.filter(
-      (s) => s.serverId && s.serverUrl && s.callbackUrl && s.active !== false
-      // exclude OAuth-pending / failed sessions
+      (s) => s.serverId && s.serverUrl && s.callbackUrl && s.status === "active"
     );
     return valid;
   }
@@ -2605,6 +3047,9 @@ var MultiSessionClient = class {
    * Connects a single session, with built-in deduplication to prevent race conditions.
    *
    * - If a client for this session already exists and is connected, returns immediately.
+   * - If the existing client entry is no longer connected (e.g. it was explicitly
+   *   disconnected), it is evicted so that `establishConnectionWithRetries` creates a
+   *   fresh transport — preventing "Client already connected" errors from the SDK.
    * - If a connection attempt for this session is already in-flight (e.g. from a
    *   concurrent call), it joins the existing promise instead of starting a new one.
    *   This is the key concurrency lock — the `connectionPromises` map acts as a
@@ -2612,9 +3057,12 @@ var MultiSessionClient = class {
    * - On completion (success or failure), the promise is cleaned up from the map.
    */
   async connectSession(session) {
-    const existingClient = this.clients.find((c) => c.getSessionId() === session.sessionId);
-    if (existingClient?.isConnected()) {
-      return;
+    const existing = this.clients.find((c) => c.getSessionId() === session.sessionId);
+    if (existing) {
+      if (existing.isConnected()) {
+        return;
+      }
+      this.clients = this.clients.filter((c) => c !== existing);
     }
     if (this.connectionPromises.has(session.sessionId)) {
       return this.connectionPromises.get(session.sessionId);
@@ -2689,8 +3137,24 @@ var MultiSessionClient = class {
    */
   async connect() {
     const sessions2 = await this.getActiveSessions();
+    const activeSessionIds = new Set(sessions2.map((s) => s.sessionId));
+    this.clients = this.clients.filter((c) => activeSessionIds.has(c.getSessionId()));
     await this.connectInBatches(sessions2);
   }
+  /**
+   * Drops all cached `MCPClient` instances and reconnects fresh from storage.
+   *
+   * Call this when downstream MCP servers have expired their transport sessions
+   * (e.g. after a remote server restart) and subsequent tool calls return
+   * "Session not found. Reconnect without session header." errors.
+   *
+   * OAuth tokens are preserved in the storage backend — no re-authentication
+   * is required. Only the in-memory transport sessions are cleared.
+   */
+  async reconnect() {
+    await this.disconnect();
+    await this.connect();
+  }
   /**
    * Returns all currently connected `MCPClient` instances.
    *
@@ -2703,11 +3167,15 @@ var MultiSessionClient = class {
   /**
    * Gracefully disconnects all active MCP clients and clears the internal client list.
    *
+   * For Streamable HTTP sessions, each client sends an HTTP DELETE to its MCP
+   * endpoint per the spec before closing locally. All disconnects run in
+   * parallel so shutdown is not serialised across many sessions.
+   *
    * Call this during server shutdown or when a user logs out to free up
    * underlying transport resources (SSE streams, HTTP connections, etc.).
    */
-  disconnect() {
-    this.clients.forEach((client) => client.disconnect());
+  async disconnect() {
+    await Promise.all(this.clients.map((client) => client.disconnect()));
     this.clients = [];
   }
 };
@@ -2859,7 +3327,8 @@ var SSEConnectionManager = class {
         serverUrl: s.serverUrl,
         transport: s.transportType,
         createdAt: s.createdAt,
-        active: s.active !== false
+        updatedAt: s.updatedAt ?? s.createdAt,
+        status: s.status ?? "pending"
       }))
     };
   }
@@ -2875,7 +3344,7 @@ var SSEConnectionManager = class {
       (s) => s.serverId === serverId || s.serverUrl === serverUrl
     );
     if (duplicate) {
-      if (duplicate.active === false) {
+      if (duplicate.status === "pending") {
         await this.getSession({ sessionId: duplicate.sessionId });
         return {
           sessionId: duplicate.sessionId,
@@ -2940,7 +3409,6 @@ var SSEConnectionManager = class {
     const client = this.clients.get(sessionId);
     if (client) {
       await client.clearSession();
-      client.disconnect();
       this.clients.delete(sessionId);
     } else {
       await sessions.delete(this.userId, sessionId);
@@ -3062,7 +3530,10 @@ var SSEConnectionManager = class {
    * Complete OAuth authorization flow
    */
   async finishAuth(params) {
-    const { sessionId, code } = params;
+    const { code } = params;
+    const oauthState = params.state;
+    const parsedState = parseOAuthState(oauthState);
+    const sessionId = parsedState?.sessionId || oauthState;
     const session = await sessions.get(this.userId, sessionId);
     if (!session) {
       throw new Error("Session not found");
@@ -3087,7 +3558,7 @@ var SSEConnectionManager = class {
         headers: session.headers
       });
       client.onConnectionEvent((event) => this.emitConnectionEvent(event));
-      await client.finishAuth(code);
+      await client.finishAuth(code, oauthState);
       this.clients.set(sessionId, client);
       const tools = await client.listTools();
       return { success: true, toolCount: tools.tools.length };
@@ -3146,14 +3617,14 @@ var SSEConnectionManager = class {
   /**
    * Cleanup and close all connections
    */
-  dispose() {
+  async dispose() {
     this.isActive = false;
     if (this.heartbeatTimer) {
       clearInterval(this.heartbeatTimer);
     }
-    for (const client of this.clients.values()) {
-      client.disconnect();
-    }
+    await Promise.all(
+      Array.from(this.clients.values()).map((client) => client.disconnect())
+    );
     this.clients.clear();
   }
 };