@mcp-ts/sdk 2.4.0 → 2.4.1

package/dist/{multi-session-client-CnvZEGPY.d.ts → multi-session-client-Bwm-efqg.d.ts}

@@ -1,4 +1,4 @@
-import { b as Event, M as McpConnectionEvent, d as McpObservabilityEvent, c as McpConnectionState } from './events-CK3N--3g.js';
+import { b as Event, M as McpConnectionEvent, d as McpObservabilityEvent, c as McpConnectionState } from './events-C4m7tK1U.js';
 import { ListToolsResult, CallToolResult, ListPromptsResult, GetPromptResult, ListResourcesResult, ReadResourceResult } from '@modelcontextprotocol/sdk/types.js';
 import { OAuthClientProvider } from '@modelcontextprotocol/sdk/client/auth.js';
 import { OAuthClientMetadata, OAuthClientInformationMixed, OAuthClientInformationFull, OAuthTokens } from '@modelcontextprotocol/sdk/shared/auth.js';
@@ -282,10 +282,15 @@ declare class MCPClient {
      */
     isConnected(): boolean;
     /**
-     * Disconnects from the MCP server and cleans up resources
-     * Does not remove session from Redis - use clearSession() for that
+     * Disconnects from the MCP server and cleans up resources.
+     * Does not remove session from Redis — use clearSession() for that.
+     *
+     * For Streamable HTTP sessions, sends an HTTP DELETE to the MCP endpoint
+     * before closing, as recommended by the MCP Streamable HTTP spec
+     * (section "Session Management", rule 5). This is best-effort — errors
+     * (e.g. server already restarted, 404/405 responses) are silently ignored.
      */
-    disconnect(reason?: string): void;
+    disconnect(): Promise<void>;
     /**
      * Dispose of all event emitters
      * Call this when the client is no longer needed
@@ -387,6 +392,9 @@ declare class MultiSessionClient {
      * Connects a single session, with built-in deduplication to prevent race conditions.
      *
      * - If a client for this session already exists and is connected, returns immediately.
+     * - If the existing client entry is no longer connected (e.g. it was explicitly
+     *   disconnected), it is evicted so that `establishConnectionWithRetries` creates a
+     *   fresh transport — preventing "Client already connected" errors from the SDK.
      * - If a connection attempt for this session is already in-flight (e.g. from a
      *   concurrent call), it joins the existing promise instead of starting a new one.
      *   This is the key concurrency lock — the `connectionPromises` map acts as a
@@ -418,6 +426,17 @@ declare class MultiSessionClient {
      * re-fetching and re-connecting on every request.
      */
     connect(): Promise<void>;
+    /**
+     * Drops all cached `MCPClient` instances and reconnects fresh from storage.
+     *
+     * Call this when downstream MCP servers have expired their transport sessions
+     * (e.g. after a remote server restart) and subsequent tool calls return
+     * "Session not found. Reconnect without session header." errors.
+     *
+     * OAuth tokens are preserved in the storage backend — no re-authentication
+     * is required. Only the in-memory transport sessions are cleared.
+     */
+    reconnect(): Promise<void>;
     /**
      * Returns all currently connected `MCPClient` instances.
      *
@@ -428,10 +447,14 @@ declare class MultiSessionClient {
     /**
      * Gracefully disconnects all active MCP clients and clears the internal client list.
      *
+     * For Streamable HTTP sessions, each client sends an HTTP DELETE to its MCP
+     * endpoint per the spec before closing locally. All disconnects run in
+     * parallel so shutdown is not serialised across many sessions.
+     *
      * Call this during server shutdown or when a user logs out to free up
      * underlying transport resources (SSE streams, HTTP connections, etc.).
      */
-    disconnect(): void;
+    disconnect(): Promise<void>;
 }
 
 export { MCPClient as M, StorageOAuthClientProvider as S, MultiSessionClient as a };

package/dist/{multi-session-client-CIMUGF8S.d.mts → multi-session-client-k-9RvWvi.d.mts}

@@ -1,4 +1,4 @@
-import { b as Event, M as McpConnectionEvent, d as McpObservabilityEvent, c as McpConnectionState } from './events-CK3N--3g.mjs';
+import { b as Event, M as McpConnectionEvent, d as McpObservabilityEvent, c as McpConnectionState } from './events-C4m7tK1U.mjs';
 import { ListToolsResult, CallToolResult, ListPromptsResult, GetPromptResult, ListResourcesResult, ReadResourceResult } from '@modelcontextprotocol/sdk/types.js';
 import { OAuthClientProvider } from '@modelcontextprotocol/sdk/client/auth.js';
 import { OAuthClientMetadata, OAuthClientInformationMixed, OAuthClientInformationFull, OAuthTokens } from '@modelcontextprotocol/sdk/shared/auth.js';
@@ -282,10 +282,15 @@ declare class MCPClient {
      */
     isConnected(): boolean;
     /**
-     * Disconnects from the MCP server and cleans up resources
-     * Does not remove session from Redis - use clearSession() for that
+     * Disconnects from the MCP server and cleans up resources.
+     * Does not remove session from Redis — use clearSession() for that.
+     *
+     * For Streamable HTTP sessions, sends an HTTP DELETE to the MCP endpoint
+     * before closing, as recommended by the MCP Streamable HTTP spec
+     * (section "Session Management", rule 5). This is best-effort — errors
+     * (e.g. server already restarted, 404/405 responses) are silently ignored.
      */
-    disconnect(reason?: string): void;
+    disconnect(): Promise<void>;
     /**
      * Dispose of all event emitters
      * Call this when the client is no longer needed
@@ -387,6 +392,9 @@ declare class MultiSessionClient {
      * Connects a single session, with built-in deduplication to prevent race conditions.
      *
      * - If a client for this session already exists and is connected, returns immediately.
+     * - If the existing client entry is no longer connected (e.g. it was explicitly
+     *   disconnected), it is evicted so that `establishConnectionWithRetries` creates a
+     *   fresh transport — preventing "Client already connected" errors from the SDK.
      * - If a connection attempt for this session is already in-flight (e.g. from a
      *   concurrent call), it joins the existing promise instead of starting a new one.
      *   This is the key concurrency lock — the `connectionPromises` map acts as a
@@ -418,6 +426,17 @@ declare class MultiSessionClient {
      * re-fetching and re-connecting on every request.
      */
     connect(): Promise<void>;
+    /**
+     * Drops all cached `MCPClient` instances and reconnects fresh from storage.
+     *
+     * Call this when downstream MCP servers have expired their transport sessions
+     * (e.g. after a remote server restart) and subsequent tool calls return
+     * "Session not found. Reconnect without session header." errors.
+     *
+     * OAuth tokens are preserved in the storage backend — no re-authentication
+     * is required. Only the in-memory transport sessions are cleared.
+     */
+    reconnect(): Promise<void>;
     /**
      * Returns all currently connected `MCPClient` instances.
      *
@@ -428,10 +447,14 @@ declare class MultiSessionClient {
     /**
      * Gracefully disconnects all active MCP clients and clears the internal client list.
      *
+     * For Streamable HTTP sessions, each client sends an HTTP DELETE to its MCP
+     * endpoint per the spec before closing locally. All disconnects run in
+     * parallel so shutdown is not serialised across many sessions.
+     *
      * Call this during server shutdown or when a user logs out to free up
      * underlying transport resources (SSE streams, HTTP connections, etc.).
      */
-    disconnect(): void;
+    disconnect(): Promise<void>;
 }
 
 export { MCPClient as M, StorageOAuthClientProvider as S, MultiSessionClient as a };

package/dist/server/index.d.mts

@@ -1,9 +1,9 @@
-export { M as MCPClient, a as MultiSessionClient, S as StorageOAuthClientProvider } from '../multi-session-client-CIMUGF8S.mjs';
+export { M as MCPClient, a as MultiSessionClient, S as StorageOAuthClientProvider } from '../multi-session-client-k-9RvWvi.mjs';
 export { U as UnauthorizedError, s as sanitizeServerLabel } from '../utils-DELRKQPU.mjs';
 import { OAuthClientInformationMixed, OAuthTokens } from '@modelcontextprotocol/sdk/shared/auth.js';
 export { OAuthClientInformation, OAuthClientInformationFull, OAuthClientMetadata, OAuthTokens } from '@modelcontextprotocol/sdk/shared/auth.js';
-import { M as McpConnectionEvent, d as McpObservabilityEvent } from '../events-CK3N--3g.mjs';
-export { D as Disposable, E as Emitter, b as Event, c as McpConnectionState } from '../events-CK3N--3g.mjs';
+import { M as McpConnectionEvent, d as McpObservabilityEvent } from '../events-C4m7tK1U.mjs';
+export { D as Disposable, E as Emitter, b as Event, c as McpConnectionState } from '../events-C4m7tK1U.mjs';
 import { r as McpRpcResponse, q as McpRpcRequest } from '../types-DCk_IF4L.mjs';
 export { a as CallToolRequest, b as CallToolResponse, f as ConnectRequest, g as ConnectResponse, n as ListToolsResponse, T as ToolClient, u as ToolClientProvider, v as ToolInfo } from '../types-DCk_IF4L.mjs';
 export { CallToolResult, ListToolsResult, Tool } from '@modelcontextprotocol/sdk/types.js';
@@ -249,7 +249,7 @@ declare class SSEConnectionManager {
     /**
      * Cleanup and close all connections
      */
-    dispose(): void;
+    dispose(): Promise<void>;
 }
 /**
  * Create an SSE endpoint handler compatible with Node.js HTTP frameworks.

package/dist/server/index.d.ts

@@ -1,9 +1,9 @@
-export { M as MCPClient, a as MultiSessionClient, S as StorageOAuthClientProvider } from '../multi-session-client-CnvZEGPY.js';
+export { M as MCPClient, a as MultiSessionClient, S as StorageOAuthClientProvider } from '../multi-session-client-Bwm-efqg.js';
 export { U as UnauthorizedError, s as sanitizeServerLabel } from '../utils-DELRKQPU.js';
 import { OAuthClientInformationMixed, OAuthTokens } from '@modelcontextprotocol/sdk/shared/auth.js';
 export { OAuthClientInformation, OAuthClientInformationFull, OAuthClientMetadata, OAuthTokens } from '@modelcontextprotocol/sdk/shared/auth.js';
-import { M as McpConnectionEvent, d as McpObservabilityEvent } from '../events-CK3N--3g.js';
-export { D as Disposable, E as Emitter, b as Event, c as McpConnectionState } from '../events-CK3N--3g.js';
+import { M as McpConnectionEvent, d as McpObservabilityEvent } from '../events-C4m7tK1U.js';
+export { D as Disposable, E as Emitter, b as Event, c as McpConnectionState } from '../events-C4m7tK1U.js';
 import { r as McpRpcResponse, q as McpRpcRequest } from '../types-DCk_IF4L.js';
 export { a as CallToolRequest, b as CallToolResponse, f as ConnectRequest, g as ConnectResponse, n as ListToolsResponse, T as ToolClient, u as ToolClientProvider, v as ToolInfo } from '../types-DCk_IF4L.js';
 export { CallToolResult, ListToolsResult, Tool } from '@modelcontextprotocol/sdk/types.js';
@@ -249,7 +249,7 @@ declare class SSEConnectionManager {
     /**
      * Cleanup and close all connections
      */
-    dispose(): void;
+    dispose(): Promise<void>;
 }
 /**
  * Create an SSE endpoint handler compatible with Node.js HTTP frameworks.

package/dist/server/index.js

@@ -2288,7 +2288,7 @@ var MCPClient = class {
        * Observation: SDK 1.24.0+ connections may hang indefinitely in some environments.
        * This wrapper enforces a timeout and properly uses AbortController to unblock the request.
        */
-      fetch: (url, init) => {
+      fetch: async (url, init) => {
         const timeout = 3e4;
         const controller = new AbortController();
         const timeoutId = setTimeout(() => controller.abort(), timeout);
@@ -2296,7 +2296,17 @@ var MCPClient = class {
           // @ts-ignore: AbortSignal.any is available in Node 20+
           AbortSignal.any ? AbortSignal.any([init.signal, controller.signal]) : controller.signal
         ) : controller.signal;
-        return fetch(url, { ...init, signal }).finally(() => clearTimeout(timeoutId));
+        try {
+          const response = await fetch(url, { ...init, signal });
+          const hasSessionHeader = init?.headers && new Headers(init.headers).has("mcp-session-id");
+          if (response.status === 404 && hasSessionHeader) {
+            this.client = null;
+            throw new Error("MCP_SESSION_EXPIRED: Downstream session was not found on the server.");
+          }
+          return response;
+        } finally {
+          clearTimeout(timeoutId);
+        }
       }
     };
     if (type === "sse") {
@@ -2488,6 +2498,14 @@ var MCPClient = class {
    * @throws {Error} When connection fails for other reasons
    */
   async connect() {
+    if (this.client?.transport) {
+      this.transport = null;
+      try {
+        await this.client.close();
+      } catch {
+      }
+      this.client = null;
+    }
     await this.initialize();
     if (!this.client || !this.oauthProvider) {
       const error = "Client or OAuth provider not initialized";
@@ -2866,7 +2884,7 @@ var MCPClient = class {
       await this.oauthProvider.invalidateCredentials("all");
     }
     await sessions.delete(this.userId, this.sessionId);
-    this.disconnect();
+    await this.disconnect();
   }
   /**
    * Checks if the client is currently connected to an MCP server
@@ -2876,10 +2894,21 @@ var MCPClient = class {
     return this.client !== null;
   }
   /**
-   * Disconnects from the MCP server and cleans up resources
-   * Does not remove session from Redis - use clearSession() for that
+   * Disconnects from the MCP server and cleans up resources.
+   * Does not remove session from Redis — use clearSession() for that.
+   *
+   * For Streamable HTTP sessions, sends an HTTP DELETE to the MCP endpoint
+   * before closing, as recommended by the MCP Streamable HTTP spec
+   * (section "Session Management", rule 5). This is best-effort — errors
+   * (e.g. server already restarted, 404/405 responses) are silently ignored.
    */
-  disconnect(reason) {
+  async disconnect() {
+    if (this.transport instanceof streamableHttp_js.StreamableHTTPClientTransport) {
+      try {
+        await this.transport.terminateSession();
+      } catch {
+      }
+    }
     if (this.client) {
       this.client.close();
     }
@@ -2891,7 +2920,6 @@ var MCPClient = class {
         type: "disconnected",
         sessionId: this.sessionId,
         serverId: this.serverId,
-        reason,
         timestamp: Date.now()
       });
       this._onObservabilityEvent.fire({
@@ -2900,9 +2928,7 @@ var MCPClient = class {
         message: `Disconnected from ${this.serverId}`,
         sessionId: this.sessionId,
         serverId: this.serverId,
-        payload: {
-          reason: reason || "unknown"
-        },
+        payload: {},
         timestamp: Date.now(),
         id: nanoid.nanoid()
       });
@@ -3021,6 +3047,9 @@ var MultiSessionClient = class {
    * Connects a single session, with built-in deduplication to prevent race conditions.
    *
    * - If a client for this session already exists and is connected, returns immediately.
+   * - If the existing client entry is no longer connected (e.g. it was explicitly
+   *   disconnected), it is evicted so that `establishConnectionWithRetries` creates a
+   *   fresh transport — preventing "Client already connected" errors from the SDK.
    * - If a connection attempt for this session is already in-flight (e.g. from a
    *   concurrent call), it joins the existing promise instead of starting a new one.
    *   This is the key concurrency lock — the `connectionPromises` map acts as a
@@ -3028,9 +3057,12 @@ var MultiSessionClient = class {
    * - On completion (success or failure), the promise is cleaned up from the map.
    */
   async connectSession(session) {
-    const existingClient = this.clients.find((c) => c.getSessionId() === session.sessionId);
-    if (existingClient?.isConnected()) {
-      return;
+    const existing = this.clients.find((c) => c.getSessionId() === session.sessionId);
+    if (existing) {
+      if (existing.isConnected()) {
+        return;
+      }
+      this.clients = this.clients.filter((c) => c !== existing);
     }
     if (this.connectionPromises.has(session.sessionId)) {
       return this.connectionPromises.get(session.sessionId);
@@ -3105,8 +3137,24 @@ var MultiSessionClient = class {
    */
   async connect() {
     const sessions2 = await this.getActiveSessions();
+    const activeSessionIds = new Set(sessions2.map((s) => s.sessionId));
+    this.clients = this.clients.filter((c) => activeSessionIds.has(c.getSessionId()));
     await this.connectInBatches(sessions2);
   }
+  /**
+   * Drops all cached `MCPClient` instances and reconnects fresh from storage.
+   *
+   * Call this when downstream MCP servers have expired their transport sessions
+   * (e.g. after a remote server restart) and subsequent tool calls return
+   * "Session not found. Reconnect without session header." errors.
+   *
+   * OAuth tokens are preserved in the storage backend — no re-authentication
+   * is required. Only the in-memory transport sessions are cleared.
+   */
+  async reconnect() {
+    await this.disconnect();
+    await this.connect();
+  }
   /**
    * Returns all currently connected `MCPClient` instances.
    *
@@ -3119,11 +3167,15 @@ var MultiSessionClient = class {
   /**
    * Gracefully disconnects all active MCP clients and clears the internal client list.
    *
+   * For Streamable HTTP sessions, each client sends an HTTP DELETE to its MCP
+   * endpoint per the spec before closing locally. All disconnects run in
+   * parallel so shutdown is not serialised across many sessions.
+   *
    * Call this during server shutdown or when a user logs out to free up
    * underlying transport resources (SSE streams, HTTP connections, etc.).
    */
-  disconnect() {
-    this.clients.forEach((client) => client.disconnect());
+  async disconnect() {
+    await Promise.all(this.clients.map((client) => client.disconnect()));
     this.clients = [];
   }
 };
@@ -3357,7 +3409,6 @@ var SSEConnectionManager = class {
     const client = this.clients.get(sessionId);
     if (client) {
       await client.clearSession();
-      client.disconnect();
       this.clients.delete(sessionId);
     } else {
       await sessions.delete(this.userId, sessionId);
@@ -3566,14 +3617,14 @@ var SSEConnectionManager = class {
   /**
    * Cleanup and close all connections
    */
-  dispose() {
+  async dispose() {
     this.isActive = false;
     if (this.heartbeatTimer) {
       clearInterval(this.heartbeatTimer);
     }
-    for (const client of this.clients.values()) {
-      client.disconnect();
-    }
+    await Promise.all(
+      Array.from(this.clients.values()).map((client) => client.disconnect())
+    );
     this.clients.clear();
   }
 };