@mcp-ts/sdk 2.4.1 → 2.4.3

package/dist/server/index.mjs

@@ -1666,12 +1666,12 @@ async function createStorage() {
   }
   if (type === "supabase") {
     const url = process.env.SUPABASE_URL;
-    const key = process.env.SUPABASE_SERVICE_ROLE_KEY || process.env.SUPABASE_ANON_KEY;
+    const key = process.env.SUPABASE_SECRET_KEY || process.env.SUPABASE_ANON_KEY;
     if (!url || !key) {
-      console.warn('[mcp-ts][Storage] Explicit selection "supabase" requires SUPABASE_URL and SUPABASE_SERVICE_ROLE_KEY.');
+      console.warn('[mcp-ts][Storage] Explicit selection "supabase" requires SUPABASE_URL and SUPABASE_SECRET_KEY.');
     } else {
-      if (!process.env.SUPABASE_SERVICE_ROLE_KEY) {
-        console.warn('[mcp-ts][Storage] \u26A0\uFE0F  Warning: Using "SUPABASE_ANON_KEY" for server-side storage. You may encounter RLS policy violations. "SUPABASE_SERVICE_ROLE_KEY" is recommended.');
+      if (!process.env.SUPABASE_SECRET_KEY) {
+        console.warn('[mcp-ts][Storage] \u26A0\uFE0F  Warning: Using "SUPABASE_ANON_KEY" for server-side storage. You may encounter RLS policy violations. "SUPABASE_SECRET_KEY" is recommended.');
       }
       try {
         const { createClient } = await import('@supabase/supabase-js');
@@ -1726,13 +1726,13 @@ async function createStorage() {
     console.log(`[mcp-ts][Storage] Auto-detection: "sqlite" (${process.env.MCP_TS_STORAGE_SQLITE_PATH})`);
     return await initializeStorage(new SqliteStorage({ path: process.env.MCP_TS_STORAGE_SQLITE_PATH }));
   }
-  if (process.env.SUPABASE_URL && (process.env.SUPABASE_SERVICE_ROLE_KEY || process.env.SUPABASE_ANON_KEY)) {
+  if (process.env.SUPABASE_URL && (process.env.SUPABASE_SECRET_KEY || process.env.SUPABASE_ANON_KEY)) {
     try {
       const { createClient } = await import('@supabase/supabase-js');
       const url = process.env.SUPABASE_URL;
-      const key = process.env.SUPABASE_SERVICE_ROLE_KEY || process.env.SUPABASE_ANON_KEY;
-      if (!process.env.SUPABASE_SERVICE_ROLE_KEY) {
-        console.warn('[mcp-ts][Storage] \u26A0\uFE0F Warning: Using "SUPABASE_ANON_KEY" for server-side storage. You may encounter RLS policy violations. "SUPABASE_SERVICE_ROLE_KEY" is recommended.');
+      const key = process.env.SUPABASE_SECRET_KEY || process.env.SUPABASE_ANON_KEY;
+      if (!process.env.SUPABASE_SECRET_KEY) {
+        console.warn('[mcp-ts][Storage] \u26A0\uFE0F Warning: Using "SUPABASE_ANON_KEY" for server-side storage. You may encounter RLS policy violations. "SUPABASE_SECRET_KEY" is recommended.');
       }
       const client = createClient(url, key);
       console.log('[mcp-ts][Storage] Auto-detection: "supabase" (via SUPABASE_URL)');
@@ -2230,7 +2230,6 @@ var MCPClient = class {
           const response = await fetch(url, { ...init, signal });
           const hasSessionHeader = init?.headers && new Headers(init.headers).has("mcp-session-id");
           if (response.status === 404 && hasSessionHeader) {
-            this.client = null;
             throw new Error("MCP_SESSION_EXPIRED: Downstream session was not found on the server.");
           }
           return response;
@@ -2611,7 +2610,9 @@ var MCPClient = class {
         method: "tools/list",
         params: {}
       };
-      const result = await this.client.request(request, ListToolsResultSchema);
+      const result = await this.withRetry(
+        () => this.client.request(request, ListToolsResultSchema)
+      );
       if (this.serverId) {
         this._onConnectionEvent.fire({
           type: "tools_discovered",
@@ -2651,7 +2652,9 @@ var MCPClient = class {
       }
     };
     try {
-      const result = await this.client.request(request, CallToolResultSchema);
+      const result = await this.withRetry(
+        () => this.client.request(request, CallToolResultSchema)
+      );
       this._onObservabilityEvent.fire({
         type: "mcp:client:tool_call",
         level: "info",
@@ -2703,7 +2706,9 @@ var MCPClient = class {
         method: "prompts/list",
         params: {}
       };
-      const result = await this.client.request(request, ListPromptsResultSchema);
+      const result = await this.withRetry(
+        () => this.client.request(request, ListPromptsResultSchema)
+      );
       this.emitStateChange("READY");
       this.emitProgress(`Discovered ${result.prompts.length} prompts`);
       return result;
@@ -2732,7 +2737,9 @@ var MCPClient = class {
         arguments: args
       }
     };
-    return await this.client.request(request, GetPromptResultSchema);
+    return await this.withRetry(
+      () => this.client.request(request, GetPromptResultSchema)
+    );
   }
   /**
    * Lists all available resources from the connected MCP server
@@ -2749,7 +2756,9 @@ var MCPClient = class {
         method: "resources/list",
         params: {}
       };
-      const result = await this.client.request(request, ListResourcesResultSchema);
+      const result = await this.withRetry(
+        () => this.client.request(request, ListResourcesResultSchema)
+      );
       this.emitStateChange("READY");
       this.emitProgress(`Discovered ${result.resources.length} resources`);
       return result;
@@ -2776,7 +2785,36 @@ var MCPClient = class {
         uri
       }
     };
-    return await this.client.request(request, ReadResourceResultSchema);
+    return await this.withRetry(
+      () => this.client.request(request, ReadResourceResultSchema)
+    );
+  }
+  /**
+   * Wraps an MCP request with automatic transport-session recovery.
+   *
+   * When the downstream MCP server rejects the request with a 404 indicating
+   * the transport session has expired, this method tears down the stale SDK
+   * client and transport, calls {@link reconnect} to negotiate a fresh session,
+   * and retries the request once.
+   *
+   * Non-transient errors (network failures, auth errors, etc.) propagate as-is.
+   */
+  async withRetry(fn) {
+    try {
+      return await fn();
+    } catch (error) {
+      if (!(error instanceof Error && error.message.includes("MCP_SESSION_EXPIRED"))) throw error;
+      if (this.client) {
+        try {
+          await this.client.close();
+        } catch {
+        }
+        this.transport = null;
+        this.client = null;
+      }
+      await this.reconnect();
+      return await fn();
+    }
   }
   /**
    * Reconnects to MCP server using existing OAuth provider from Redis
@@ -2789,6 +2827,12 @@ var MCPClient = class {
     if (!this.oauthProvider) {
       throw new Error("OAuth provider not initialized");
     }
+    if (this.client) {
+      try {
+        await this.client.close();
+      } catch {
+      }
+    }
     this.client = new Client(
       {
         name: MCP_CLIENT_NAME,
@@ -2924,17 +2968,14 @@ var DEFAULT_RETRY_DELAY_MS = 1e3;
 var CONNECTION_BATCH_SIZE = 5;
 var MultiSessionClient = class {
   /**
-   * Creates a new MultiSessionClient for the given user userId.
-   *
-   * @param userId - A unique string identifying the user (e.g. user ID or email).
-   * @param options  - Optional tuning for connection timeout, retry count, and retry delay.
-   *                   Falls back to sensible defaults if not provided.
+   * @param userId - Unique identifier for the user (e.g. user ID or email).
+   * @param options - Optional tuning and lifecycle hooks.
    */
   constructor(userId, options = {}) {
     __publicField(this, "clients", []);
+    __publicField(this, "connectionPromises", /* @__PURE__ */ new Map());
     __publicField(this, "userId");
     __publicField(this, "options");
-    __publicField(this, "connectionPromises", /* @__PURE__ */ new Map());
     this.userId = userId;
     this.options = {
       timeout: DEFAULT_TIMEOUT_MS,
@@ -2943,28 +2984,97 @@ var MultiSessionClient = class {
       ...options
     };
   }
+  // -----------------------------------------------------------------------
+  // Public API
+  // -----------------------------------------------------------------------
   /**
-   * Fetches all sessions for this userId from storage and returns only the
-   * ones that are ready to connect.
+   * Fetches active sessions and establishes connections to all of them.
    *
-   * A session is considered connectable when:
-   * - It has a `serverId`, `serverUrl`, and `callbackUrl` (i.e. it was fully initialized)
-   * - Its status is `active`. Pending sessions are skipped here
-   *   and let the OAuth flow complete separately before we try to reconnect them.
+   * Call this once after creating the client. On long-running servers you
+   * can cache the `MultiSessionClient` instance and call `connect()` on
+   * each request — already-connected sessions are skipped internally.
    */
-  async getActiveSessions() {
-    const sessionList = await sessions.list(this.userId);
-    const valid = sessionList.filter(
+  async connect() {
+    const sessions2 = await this.fetchActiveSessions();
+    const activeSessionIds = new Set(sessions2.map((s) => s.sessionId));
+    for (const client of this.clients) {
+      if (!activeSessionIds.has(client.getSessionId())) {
+        this.options.onSessionEvicted?.(client.getSessionId());
+      }
+    }
+    this.clients = this.clients.filter((c) => activeSessionIds.has(c.getSessionId()));
+    await this.connectInBatches(sessions2);
+  }
+  /**
+   * Drops all cached `MCPClient` instances and reconnects fresh from storage.
+   *
+   * Call this when downstream MCP servers have expired their transport sessions
+   * (e.g. after a remote server restart) and subsequent tool calls return
+   * "Session not found. Reconnect without session header." errors.
+   *
+   * OAuth tokens are preserved in the storage backend — no re-authentication
+   * is required. Only the in-memory transport sessions are cleared.
+   */
+  async reconnect() {
+    await this.disconnect();
+    await this.connect();
+  }
+  /**
+   * Returns all currently connected `MCPClient` instances.
+   *
+   * Use this to enumerate available tools across all connected servers,
+   * or to route a tool call to the right client by `serverId`.
+   */
+  getClients() {
+    return this.clients;
+  }
+  /**
+   * Removes and disconnects a single session by ID.
+   *
+   * @returns `true` if the session was found and removed, `false` if not found.
+   */
+  async removeSession(sessionId) {
+    const idx = this.clients.findIndex((c) => c.getSessionId() === sessionId);
+    if (idx === -1) return false;
+    const [client] = this.clients.splice(idx, 1);
+    await client.disconnect();
+    return true;
+  }
+  /**
+   * Gracefully disconnects all active MCP clients and clears the internal list.
+   *
+   * For Streamable HTTP sessions, each client sends an HTTP DELETE to its MCP
+   * endpoint per the spec before closing locally. All disconnects run in
+   * parallel so shutdown is not serialised across many sessions.
+   *
+   * Call this during server shutdown or when a user logs out to free up
+   * underlying transport resources (SSE streams, HTTP connections, etc.).
+   */
+  async disconnect() {
+    await Promise.all(this.clients.map((client) => client.disconnect()));
+    this.clients = [];
+  }
+  // -----------------------------------------------------------------------
+  // Internals
+  // -----------------------------------------------------------------------
+  /**
+   * Resolves the list of sessions to connect.
+   *
+   * Uses the custom `sessionProvider` when provided, otherwise falls back
+   * to querying the storage backend via `sessions.list(userId)`.
+   */
+  async fetchActiveSessions() {
+    const sessionList = this.options.sessionProvider ? await this.options.sessionProvider() : await sessions.list(this.userId);
+    return sessionList.filter(
       (s) => s.serverId && s.serverUrl && s.callbackUrl && s.status === "active"
     );
-    return valid;
   }
   /**
-   * Connects to a list of sessions in controlled batches of `CONNECTION_BATCH_SIZE`.
+   * Connects a list of sessions in controlled batches.
    *
-   * Batching prevents overwhelming the event loop or external servers when a user
-   * has many active MCP sessions (e.g. 20+ servers). Within each batch, sessions
-   * are connected concurrently using `Promise.all` for speed.
+   * Batching prevents overwhelming the event loop or external servers when
+   * a user has many active MCP sessions. Within each batch, sessions are
+   * connected concurrently using `Promise.all`.
    */
   async connectInBatches(sessions2) {
     for (let i = 0; i < sessions2.length; i += CONNECTION_BATCH_SIZE) {
@@ -2973,17 +3083,16 @@ var MultiSessionClient = class {
     }
   }
   /**
-   * Connects a single session, with built-in deduplication to prevent race conditions.
+   * Connects a single session, with deduplication to prevent race conditions.
    *
-   * - If a client for this session already exists and is connected, returns immediately.
-   * - If the existing client entry is no longer connected (e.g. it was explicitly
-   *   disconnected), it is evicted so that `establishConnectionWithRetries` creates a
-   *   fresh transport — preventing "Client already connected" errors from the SDK.
-   * - If a connection attempt for this session is already in-flight (e.g. from a
-   *   concurrent call), it joins the existing promise instead of starting a new one.
-   *   This is the key concurrency lock — the `connectionPromises` map acts as a
-   *   per-session mutex so we never spin up two physical connections for the same session.
-   * - On completion (success or failure), the promise is cleaned up from the map.
+   * - If a client for this session already exists and is connected, returns
+   *   immediately.
+   * - If the existing client entry is no longer connected (e.g. explicit
+   *   disconnect), it is evicted so a fresh transport is created.
+   * - If a connection attempt for this session is already in-flight, the
+   *   existing promise is reused as a per-session mutex.
+   * - On completion (success or failure), the promise is cleaned up from
+   *   the connectionPromises map.
    */
   async connectSession(session) {
     const existing = this.clients.find((c) => c.getSessionId() === session.sessionId);
@@ -2991,6 +3100,7 @@ var MultiSessionClient = class {
       if (existing.isConnected()) {
         return;
       }
+      this.options.onSessionEvicted?.(existing.getSessionId());
       this.clients = this.clients.filter((c) => c !== existing);
     }
     if (this.connectionPromises.has(session.sessionId)) {
@@ -3005,22 +3115,19 @@ var MultiSessionClient = class {
     }
   }
   /**
-   * The core connection loop for a single session.
+   * Core connection loop for a single session with retry logic.
    *
-   * Attempts to establish a physical MCP connection, retrying up to `maxRetries` times
-   * if the connection fails. Each attempt:
-   * 1. Creates a fresh `MCPClient` instance from the session data.
-   * 2. Races the connect call against a timeout promise — if the server doesn't respond
-   *    within `timeoutMs`, the attempt is aborted and counted as a failure.
-   * 3. On success, replaces any stale client entry for this session in the `clients` array.
+   * 1. Creates a fresh `MCPClient` from the session data.
+   * 2. Races `client.connect()` against a timeout.
+   * 3. On success, replaces any stale entry and fires `onSessionConnected`.
    * 4. On failure, waits `retryDelay` ms before the next attempt.
    *
-   * If all attempts are exhausted, logs an error and returns silently (does not throw),
-   * so a single bad server doesn't block the rest of the batch from connecting.
+   * If all attempts are exhausted, logs an error and returns silently so
+   * a single bad server doesn't block the rest of the batch.
    */
   async establishConnectionWithRetries(session) {
-    const maxRetries = this.options.maxRetries ?? DEFAULT_MAX_RETRIES;
-    const retryDelay = this.options.retryDelay ?? DEFAULT_RETRY_DELAY_MS;
+    const maxRetries = this.options.maxRetries;
+    const retryDelay = this.options.retryDelay;
     let lastError;
     for (let attempt = 0; attempt <= maxRetries; attempt++) {
       try {
@@ -3034,10 +3141,13 @@ var MultiSessionClient = class {
           transportType: session.transportType,
           headers: session.headers
         });
-        const timeoutMs = this.options.timeout ?? DEFAULT_TIMEOUT_MS;
+        const timeoutMs = this.options.timeout;
         let timeoutTimer;
         const timeoutPromise = new Promise((_, reject) => {
-          timeoutTimer = setTimeout(() => reject(new Error(`Connection timed out after ${timeoutMs}ms`)), timeoutMs);
+          timeoutTimer = setTimeout(
+            () => reject(new Error(`Connection timed out after ${timeoutMs}ms`)),
+            timeoutMs
+          );
         });
         try {
           await Promise.race([client.connect(), timeoutPromise]);
@@ -3046,6 +3156,7 @@ var MultiSessionClient = class {
         }
         this.clients = this.clients.filter((c) => c.getSessionId() !== session.sessionId);
         this.clients.push(client);
+        this.options.onSessionConnected?.(session.sessionId, client);
         return;
       } catch (error) {
         lastError = error;
@@ -3054,58 +3165,11 @@ var MultiSessionClient = class {
         }
       }
     }
-    console.error(`[MultiSessionClient] Failed to connect to session ${session.sessionId} after ${maxRetries + 1} attempts:`, lastError);
-  }
-  /**
-   * The main entry point. Fetches all active sessions for this userId from
-   * storage and establishes connections to all of them in batches.
-   *
-   * Call this once after creating the client. On traditional servers, you can
-   * cache the `MultiSessionClient` instance after calling `connect()` to avoid
-   * re-fetching and re-connecting on every request.
-   */
-  async connect() {
-    const sessions2 = await this.getActiveSessions();
-    const activeSessionIds = new Set(sessions2.map((s) => s.sessionId));
-    this.clients = this.clients.filter((c) => activeSessionIds.has(c.getSessionId()));
-    await this.connectInBatches(sessions2);
-  }
-  /**
-   * Drops all cached `MCPClient` instances and reconnects fresh from storage.
-   *
-   * Call this when downstream MCP servers have expired their transport sessions
-   * (e.g. after a remote server restart) and subsequent tool calls return
-   * "Session not found. Reconnect without session header." errors.
-   *
-   * OAuth tokens are preserved in the storage backend — no re-authentication
-   * is required. Only the in-memory transport sessions are cleared.
-   */
-  async reconnect() {
-    await this.disconnect();
-    await this.connect();
-  }
-  /**
-   * Returns all currently connected `MCPClient` instances.
-   *
-   * Use this to enumerate available tools across all connected servers,
-   * or to route a tool call to the right client by `serverId`.
-   */
-  getClients() {
-    return this.clients;
-  }
-  /**
-   * Gracefully disconnects all active MCP clients and clears the internal client list.
-   *
-   * For Streamable HTTP sessions, each client sends an HTTP DELETE to its MCP
-   * endpoint per the spec before closing locally. All disconnects run in
-   * parallel so shutdown is not serialised across many sessions.
-   *
-   * Call this during server shutdown or when a user logs out to free up
-   * underlying transport resources (SSE streams, HTTP connections, etc.).
-   */
-  async disconnect() {
-    await Promise.all(this.clients.map((client) => client.disconnect()));
-    this.clients = [];
+    this.options.onSessionFailed?.(session.sessionId, lastError);
+    console.error(
+      `[MultiSessionClient] Failed to connect to session ${session.sessionId} after ${maxRetries + 1} attempts:`,
+      lastError
+    );
   }
 };