@mcp-ts/sdk 2.4.0 → 2.4.2

package/dist/server/index.mjs

@@ -2218,7 +2218,7 @@ var MCPClient = class {
        * Observation: SDK 1.24.0+ connections may hang indefinitely in some environments.
        * This wrapper enforces a timeout and properly uses AbortController to unblock the request.
        */
-      fetch: (url, init) => {
+      fetch: async (url, init) => {
         const timeout = 3e4;
         const controller = new AbortController();
         const timeoutId = setTimeout(() => controller.abort(), timeout);
@@ -2226,7 +2226,17 @@ var MCPClient = class {
           // @ts-ignore: AbortSignal.any is available in Node 20+
           AbortSignal.any ? AbortSignal.any([init.signal, controller.signal]) : controller.signal
         ) : controller.signal;
-        return fetch(url, { ...init, signal }).finally(() => clearTimeout(timeoutId));
+        try {
+          const response = await fetch(url, { ...init, signal });
+          const hasSessionHeader = init?.headers && new Headers(init.headers).has("mcp-session-id");
+          if (response.status === 404 && hasSessionHeader) {
+            this.client = null;
+            throw new Error("MCP_SESSION_EXPIRED: Downstream session was not found on the server.");
+          }
+          return response;
+        } finally {
+          clearTimeout(timeoutId);
+        }
       }
     };
     if (type === "sse") {
@@ -2418,6 +2428,14 @@ var MCPClient = class {
    * @throws {Error} When connection fails for other reasons
    */
   async connect() {
+    if (this.client?.transport) {
+      this.transport = null;
+      try {
+        await this.client.close();
+      } catch {
+      }
+      this.client = null;
+    }
     await this.initialize();
     if (!this.client || !this.oauthProvider) {
       const error = "Client or OAuth provider not initialized";
@@ -2796,7 +2814,7 @@ var MCPClient = class {
       await this.oauthProvider.invalidateCredentials("all");
     }
     await sessions.delete(this.userId, this.sessionId);
-    this.disconnect();
+    await this.disconnect();
   }
   /**
    * Checks if the client is currently connected to an MCP server
@@ -2806,10 +2824,21 @@ var MCPClient = class {
     return this.client !== null;
   }
   /**
-   * Disconnects from the MCP server and cleans up resources
-   * Does not remove session from Redis - use clearSession() for that
+   * Disconnects from the MCP server and cleans up resources.
+   * Does not remove session from Redis — use clearSession() for that.
+   *
+   * For Streamable HTTP sessions, sends an HTTP DELETE to the MCP endpoint
+   * before closing, as recommended by the MCP Streamable HTTP spec
+   * (section "Session Management", rule 5). This is best-effort — errors
+   * (e.g. server already restarted, 404/405 responses) are silently ignored.
    */
-  disconnect(reason) {
+  async disconnect() {
+    if (this.transport instanceof StreamableHTTPClientTransport) {
+      try {
+        await this.transport.terminateSession();
+      } catch {
+      }
+    }
     if (this.client) {
       this.client.close();
     }
@@ -2821,7 +2850,6 @@ var MCPClient = class {
         type: "disconnected",
         sessionId: this.sessionId,
         serverId: this.serverId,
-        reason,
         timestamp: Date.now()
       });
       this._onObservabilityEvent.fire({
@@ -2830,9 +2858,7 @@ var MCPClient = class {
         message: `Disconnected from ${this.serverId}`,
         sessionId: this.sessionId,
         serverId: this.serverId,
-        payload: {
-          reason: reason || "unknown"
-        },
+        payload: {},
         timestamp: Date.now(),
         id: nanoid()
       });
@@ -2898,17 +2924,14 @@ var DEFAULT_RETRY_DELAY_MS = 1e3;
 var CONNECTION_BATCH_SIZE = 5;
 var MultiSessionClient = class {
   /**
-   * Creates a new MultiSessionClient for the given user userId.
-   *
-   * @param userId - A unique string identifying the user (e.g. user ID or email).
-   * @param options  - Optional tuning for connection timeout, retry count, and retry delay.
-   *                   Falls back to sensible defaults if not provided.
+   * @param userId - Unique identifier for the user (e.g. user ID or email).
+   * @param options - Optional tuning and lifecycle hooks.
    */
   constructor(userId, options = {}) {
     __publicField(this, "clients", []);
+    __publicField(this, "connectionPromises", /* @__PURE__ */ new Map());
     __publicField(this, "userId");
     __publicField(this, "options");
-    __publicField(this, "connectionPromises", /* @__PURE__ */ new Map());
     this.userId = userId;
     this.options = {
       timeout: DEFAULT_TIMEOUT_MS,
@@ -2917,28 +2940,85 @@ var MultiSessionClient = class {
       ...options
     };
   }
+  // -----------------------------------------------------------------------
+  // Public API
+  // -----------------------------------------------------------------------
   /**
-   * Fetches all sessions for this userId from storage and returns only the
-   * ones that are ready to connect.
+   * Fetches active sessions and establishes connections to all of them.
    *
-   * A session is considered connectable when:
-   * - It has a `serverId`, `serverUrl`, and `callbackUrl` (i.e. it was fully initialized)
-   * - Its status is `active`. Pending sessions are skipped here
-   *   and let the OAuth flow complete separately before we try to reconnect them.
+   * Call this once after creating the client. On long-running servers you
+   * can cache the `MultiSessionClient` instance and call `connect()` on
+   * each request — already-connected sessions are skipped internally.
    */
-  async getActiveSessions() {
-    const sessionList = await sessions.list(this.userId);
-    const valid = sessionList.filter(
+  async connect() {
+    const sessions2 = await this.fetchActiveSessions();
+    const activeSessionIds = new Set(sessions2.map((s) => s.sessionId));
+    for (const client of this.clients) {
+      if (!activeSessionIds.has(client.getSessionId())) {
+        this.options.onSessionEvicted?.(client.getSessionId());
+      }
+    }
+    this.clients = this.clients.filter((c) => activeSessionIds.has(c.getSessionId()));
+    await this.connectInBatches(sessions2);
+  }
+  /**
+   * Drops all cached `MCPClient` instances and reconnects fresh from storage.
+   *
+   * Call this when downstream MCP servers have expired their transport sessions
+   * (e.g. after a remote server restart) and subsequent tool calls return
+   * "Session not found. Reconnect without session header." errors.
+   *
+   * OAuth tokens are preserved in the storage backend — no re-authentication
+   * is required. Only the in-memory transport sessions are cleared.
+   */
+  async reconnect() {
+    await this.disconnect();
+    await this.connect();
+  }
+  /**
+   * Returns all currently connected `MCPClient` instances.
+   *
+   * Use this to enumerate available tools across all connected servers,
+   * or to route a tool call to the right client by `serverId`.
+   */
+  getClients() {
+    return this.clients;
+  }
+  /**
+   * Gracefully disconnects all active MCP clients and clears the internal list.
+   *
+   * For Streamable HTTP sessions, each client sends an HTTP DELETE to its MCP
+   * endpoint per the spec before closing locally. All disconnects run in
+   * parallel so shutdown is not serialised across many sessions.
+   *
+   * Call this during server shutdown or when a user logs out to free up
+   * underlying transport resources (SSE streams, HTTP connections, etc.).
+   */
+  async disconnect() {
+    await Promise.all(this.clients.map((client) => client.disconnect()));
+    this.clients = [];
+  }
+  // -----------------------------------------------------------------------
+  // Internals
+  // -----------------------------------------------------------------------
+  /**
+   * Resolves the list of sessions to connect.
+   *
+   * Uses the custom `sessionProvider` when provided, otherwise falls back
+   * to querying the storage backend via `sessions.list(userId)`.
+   */
+  async fetchActiveSessions() {
+    const sessionList = this.options.sessionProvider ? await this.options.sessionProvider() : await sessions.list(this.userId);
+    return sessionList.filter(
       (s) => s.serverId && s.serverUrl && s.callbackUrl && s.status === "active"
     );
-    return valid;
   }
   /**
-   * Connects to a list of sessions in controlled batches of `CONNECTION_BATCH_SIZE`.
+   * Connects a list of sessions in controlled batches.
    *
-   * Batching prevents overwhelming the event loop or external servers when a user
-   * has many active MCP sessions (e.g. 20+ servers). Within each batch, sessions
-   * are connected concurrently using `Promise.all` for speed.
+   * Batching prevents overwhelming the event loop or external servers when
+   * a user has many active MCP sessions. Within each batch, sessions are
+   * connected concurrently using `Promise.all`.
    */
   async connectInBatches(sessions2) {
     for (let i = 0; i < sessions2.length; i += CONNECTION_BATCH_SIZE) {
@@ -2947,19 +3027,25 @@ var MultiSessionClient = class {
     }
   }
   /**
-   * Connects a single session, with built-in deduplication to prevent race conditions.
+   * Connects a single session, with deduplication to prevent race conditions.
    *
-   * - If a client for this session already exists and is connected, returns immediately.
-   * - If a connection attempt for this session is already in-flight (e.g. from a
-   *   concurrent call), it joins the existing promise instead of starting a new one.
-   *   This is the key concurrency lock — the `connectionPromises` map acts as a
-   *   per-session mutex so we never spin up two physical connections for the same session.
-   * - On completion (success or failure), the promise is cleaned up from the map.
+   * - If a client for this session already exists and is connected, returns
+   *   immediately.
+   * - If the existing client entry is no longer connected (e.g. explicit
+   *   disconnect), it is evicted so a fresh transport is created.
+   * - If a connection attempt for this session is already in-flight, the
+   *   existing promise is reused as a per-session mutex.
+   * - On completion (success or failure), the promise is cleaned up from
+   *   the connectionPromises map.
    */
   async connectSession(session) {
-    const existingClient = this.clients.find((c) => c.getSessionId() === session.sessionId);
-    if (existingClient?.isConnected()) {
-      return;
+    const existing = this.clients.find((c) => c.getSessionId() === session.sessionId);
+    if (existing) {
+      if (existing.isConnected()) {
+        return;
+      }
+      this.options.onSessionEvicted?.(existing.getSessionId());
+      this.clients = this.clients.filter((c) => c !== existing);
     }
     if (this.connectionPromises.has(session.sessionId)) {
       return this.connectionPromises.get(session.sessionId);
@@ -2973,22 +3059,19 @@ var MultiSessionClient = class {
     }
   }
   /**
-   * The core connection loop for a single session.
+   * Core connection loop for a single session with retry logic.
    *
-   * Attempts to establish a physical MCP connection, retrying up to `maxRetries` times
-   * if the connection fails. Each attempt:
-   * 1. Creates a fresh `MCPClient` instance from the session data.
-   * 2. Races the connect call against a timeout promise — if the server doesn't respond
-   *    within `timeoutMs`, the attempt is aborted and counted as a failure.
-   * 3. On success, replaces any stale client entry for this session in the `clients` array.
+   * 1. Creates a fresh `MCPClient` from the session data.
+   * 2. Races `client.connect()` against a timeout.
+   * 3. On success, replaces any stale entry and fires `onSessionConnected`.
    * 4. On failure, waits `retryDelay` ms before the next attempt.
    *
-   * If all attempts are exhausted, logs an error and returns silently (does not throw),
-   * so a single bad server doesn't block the rest of the batch from connecting.
+   * If all attempts are exhausted, logs an error and returns silently so
+   * a single bad server doesn't block the rest of the batch.
    */
   async establishConnectionWithRetries(session) {
-    const maxRetries = this.options.maxRetries ?? DEFAULT_MAX_RETRIES;
-    const retryDelay = this.options.retryDelay ?? DEFAULT_RETRY_DELAY_MS;
+    const maxRetries = this.options.maxRetries;
+    const retryDelay = this.options.retryDelay;
     let lastError;
     for (let attempt = 0; attempt <= maxRetries; attempt++) {
       try {
@@ -3002,10 +3085,13 @@ var MultiSessionClient = class {
           transportType: session.transportType,
           headers: session.headers
         });
-        const timeoutMs = this.options.timeout ?? DEFAULT_TIMEOUT_MS;
+        const timeoutMs = this.options.timeout;
         let timeoutTimer;
         const timeoutPromise = new Promise((_, reject) => {
-          timeoutTimer = setTimeout(() => reject(new Error(`Connection timed out after ${timeoutMs}ms`)), timeoutMs);
+          timeoutTimer = setTimeout(
+            () => reject(new Error(`Connection timed out after ${timeoutMs}ms`)),
+            timeoutMs
+          );
         });
         try {
           await Promise.race([client.connect(), timeoutPromise]);
@@ -3014,6 +3100,7 @@ var MultiSessionClient = class {
         }
         this.clients = this.clients.filter((c) => c.getSessionId() !== session.sessionId);
         this.clients.push(client);
+        this.options.onSessionConnected?.(session.sessionId, client);
         return;
       } catch (error) {
         lastError = error;
@@ -3022,38 +3109,11 @@ var MultiSessionClient = class {
         }
       }
     }
-    console.error(`[MultiSessionClient] Failed to connect to session ${session.sessionId} after ${maxRetries + 1} attempts:`, lastError);
-  }
-  /**
-   * The main entry point. Fetches all active sessions for this userId from
-   * storage and establishes connections to all of them in batches.
-   *
-   * Call this once after creating the client. On traditional servers, you can
-   * cache the `MultiSessionClient` instance after calling `connect()` to avoid
-   * re-fetching and re-connecting on every request.
-   */
-  async connect() {
-    const sessions2 = await this.getActiveSessions();
-    await this.connectInBatches(sessions2);
-  }
-  /**
-   * Returns all currently connected `MCPClient` instances.
-   *
-   * Use this to enumerate available tools across all connected servers,
-   * or to route a tool call to the right client by `serverId`.
-   */
-  getClients() {
-    return this.clients;
-  }
-  /**
-   * Gracefully disconnects all active MCP clients and clears the internal client list.
-   *
-   * Call this during server shutdown or when a user logs out to free up
-   * underlying transport resources (SSE streams, HTTP connections, etc.).
-   */
-  disconnect() {
-    this.clients.forEach((client) => client.disconnect());
-    this.clients = [];
+    this.options.onSessionFailed?.(session.sessionId, lastError);
+    console.error(
+      `[MultiSessionClient] Failed to connect to session ${session.sessionId} after ${maxRetries + 1} attempts:`,
+      lastError
+    );
   }
 };
 
@@ -3282,7 +3342,6 @@ var SSEConnectionManager = class {
     const client = this.clients.get(sessionId);
     if (client) {
       await client.clearSession();
-      client.disconnect();
       this.clients.delete(sessionId);
     } else {
       await sessions.delete(this.userId, sessionId);
@@ -3491,14 +3550,14 @@ var SSEConnectionManager = class {
   /**
    * Cleanup and close all connections
    */
-  dispose() {
+  async dispose() {
     this.isActive = false;
     if (this.heartbeatTimer) {
       clearInterval(this.heartbeatTimer);
     }
-    for (const client of this.clients.values()) {
-      client.disconnect();
-    }
+    await Promise.all(
+      Array.from(this.clients.values()).map((client) => client.disconnect())
+    );
     this.clients.clear();
   }
 };