@mcp-ts/sdk 2.4.2 → 2.4.4

package/dist/{multi-session-client-CWs-AE78.d.mts → multi-session-client-ChQrBZhF.d.mts}

@@ -1,4 +1,4 @@
-import { m as Event, M as McpConnectionEvent, t as McpObservabilityEvent, s as McpConnectionState, A as ToolClientProvider } from './types-CjczQwNX.mjs';
+import { m as Event, M as McpConnectionEvent, t as McpObservabilityEvent, s as McpConnectionState, A as ToolClientProvider } from './types-Bf-7GOLW.mjs';
 import { ListToolsResult, CallToolResult, ListPromptsResult, GetPromptResult, ListResourcesResult, ReadResourceResult } from '@modelcontextprotocol/sdk/types.js';
 import { OAuthClientProvider } from '@modelcontextprotocol/sdk/client/auth.js';
 import { OAuthClientMetadata, OAuthClientInformationMixed, OAuthClientInformationFull, OAuthTokens } from '@modelcontextprotocol/sdk/shared/auth.js';
@@ -184,12 +184,11 @@ declare class MCPClient {
      */
     private getTransport;
     /**
-     * Initializes client components (client, transport, OAuth provider)
-     * Loads missing configuration from Redis session store if needed
-     * This method is idempotent and safe to call multiple times
+     * Ensures session metadata and OAuth provider are loaded.
+     * Does NOT create the SDK Client — callers that need one create it themselves.
      * @private
      */
-    private initialize;
+    private ensureSession;
     /**
      * Saves current session state to the session store
      * Creates new session if it doesn't exist, updates if it does
@@ -264,6 +263,17 @@ declare class MCPClient {
      * @throws {Error} When client is not connected
      */
     readResource(uri: string): Promise<ReadResourceResult>;
+    /**
+     * Wraps an MCP request with automatic transport-session recovery.
+     *
+     * When the downstream MCP server rejects the request with a 404 indicating
+     * the transport session has expired, this method tears down the stale SDK
+     * client and transport, calls {@link reconnect} to negotiate a fresh session,
+     * and retries the request once.
+     *
+     * Non-transient errors (network failures, auth errors, etc.) propagate as-is.
+     */
+    private withRetry;
     /**
      * Reconnects to MCP server using existing OAuth provider from Redis
      * Used for session restoration in serverless environments
@@ -534,6 +544,12 @@ declare class MultiSessionClient implements ToolClientProvider {
      * or to route a tool call to the right client by `serverId`.
      */
     getClients(): MCPClient[];
+    /**
+     * Removes and disconnects a single session by ID.
+     *
+     * @returns `true` if the session was found and removed, `false` if not found.
+     */
+    removeSession(sessionId: string): Promise<boolean>;
     /**
      * Gracefully disconnects all active MCP clients and clears the internal list.
      *

package/dist/{multi-session-client-BluyCPo9.d.ts → multi-session-client-QOOPdEVp.d.ts}

@@ -1,4 +1,4 @@
-import { m as Event, M as McpConnectionEvent, t as McpObservabilityEvent, s as McpConnectionState, A as ToolClientProvider } from './types-CjczQwNX.js';
+import { m as Event, M as McpConnectionEvent, t as McpObservabilityEvent, s as McpConnectionState, A as ToolClientProvider } from './types-Bf-7GOLW.js';
 import { ListToolsResult, CallToolResult, ListPromptsResult, GetPromptResult, ListResourcesResult, ReadResourceResult } from '@modelcontextprotocol/sdk/types.js';
 import { OAuthClientProvider } from '@modelcontextprotocol/sdk/client/auth.js';
 import { OAuthClientMetadata, OAuthClientInformationMixed, OAuthClientInformationFull, OAuthTokens } from '@modelcontextprotocol/sdk/shared/auth.js';
@@ -184,12 +184,11 @@ declare class MCPClient {
      */
     private getTransport;
     /**
-     * Initializes client components (client, transport, OAuth provider)
-     * Loads missing configuration from Redis session store if needed
-     * This method is idempotent and safe to call multiple times
+     * Ensures session metadata and OAuth provider are loaded.
+     * Does NOT create the SDK Client — callers that need one create it themselves.
      * @private
      */
-    private initialize;
+    private ensureSession;
     /**
      * Saves current session state to the session store
      * Creates new session if it doesn't exist, updates if it does
@@ -264,6 +263,17 @@ declare class MCPClient {
      * @throws {Error} When client is not connected
      */
     readResource(uri: string): Promise<ReadResourceResult>;
+    /**
+     * Wraps an MCP request with automatic transport-session recovery.
+     *
+     * When the downstream MCP server rejects the request with a 404 indicating
+     * the transport session has expired, this method tears down the stale SDK
+     * client and transport, calls {@link reconnect} to negotiate a fresh session,
+     * and retries the request once.
+     *
+     * Non-transient errors (network failures, auth errors, etc.) propagate as-is.
+     */
+    private withRetry;
     /**
      * Reconnects to MCP server using existing OAuth provider from Redis
      * Used for session restoration in serverless environments
@@ -534,6 +544,12 @@ declare class MultiSessionClient implements ToolClientProvider {
      * or to route a tool call to the right client by `serverId`.
      */
     getClients(): MCPClient[];
+    /**
+     * Removes and disconnects a single session by ID.
+     *
+     * @returns `true` if the session was found and removed, `false` if not found.
+     */
+    removeSession(sessionId: string): Promise<boolean>;
     /**
      * Gracefully disconnects all active MCP clients and clears the internal list.
      *

package/dist/server/index.d.mts

@@ -1,8 +1,8 @@
-import { c as SessionMutationListener, e as SessionStore } from '../multi-session-client-CWs-AE78.mjs';
-export { M as MCPClient, a as MultiSessionClient, S as Session, b as SessionMutationEvent, d as SessionMutationType, f as StorageOAuthClientProvider } from '../multi-session-client-CWs-AE78.mjs';
+import { c as SessionMutationListener, e as SessionStore } from '../multi-session-client-ChQrBZhF.mjs';
+export { M as MCPClient, a as MultiSessionClient, S as Session, b as SessionMutationEvent, d as SessionMutationType, f as StorageOAuthClientProvider } from '../multi-session-client-ChQrBZhF.mjs';
 export { U as UnauthorizedError, s as sanitizeServerLabel } from '../utils-DELRKQPU.mjs';
-import { M as McpConnectionEvent, t as McpObservabilityEvent, x as McpRpcResponse, w as McpRpcRequest } from '../types-CjczQwNX.mjs';
-export { a as CallToolRequest, b as CallToolResponse, f as ConnectRequest, g as ConnectResponse, k as Disposable, E as Emitter, m as Event, q as ListToolsResponse, s as McpConnectionState, T as ToolClient, A as ToolClientProvider, B as ToolInfo } from '../types-CjczQwNX.mjs';
+import { M as McpConnectionEvent, t as McpObservabilityEvent, x as McpRpcResponse, w as McpRpcRequest } from '../types-Bf-7GOLW.mjs';
+export { a as CallToolRequest, b as CallToolResponse, f as ConnectRequest, g as ConnectResponse, k as Disposable, E as Emitter, m as Event, q as ListToolsResponse, s as McpConnectionState, T as ToolClient, A as ToolClientProvider, B as ToolInfo } from '../types-Bf-7GOLW.mjs';
 export { OAuthClientInformation, OAuthClientInformationFull, OAuthClientMetadata, OAuthTokens } from '@modelcontextprotocol/sdk/shared/auth.js';
 export { CallToolResult, ListToolsResult, Tool } from '@modelcontextprotocol/sdk/types.js';
 import '@modelcontextprotocol/sdk/client/auth.js';

package/dist/server/index.d.ts

@@ -1,8 +1,8 @@
-import { c as SessionMutationListener, e as SessionStore } from '../multi-session-client-BluyCPo9.js';
-export { M as MCPClient, a as MultiSessionClient, S as Session, b as SessionMutationEvent, d as SessionMutationType, f as StorageOAuthClientProvider } from '../multi-session-client-BluyCPo9.js';
+import { c as SessionMutationListener, e as SessionStore } from '../multi-session-client-QOOPdEVp.js';
+export { M as MCPClient, a as MultiSessionClient, S as Session, b as SessionMutationEvent, d as SessionMutationType, f as StorageOAuthClientProvider } from '../multi-session-client-QOOPdEVp.js';
 export { U as UnauthorizedError, s as sanitizeServerLabel } from '../utils-DELRKQPU.js';
-import { M as McpConnectionEvent, t as McpObservabilityEvent, x as McpRpcResponse, w as McpRpcRequest } from '../types-CjczQwNX.js';
-export { a as CallToolRequest, b as CallToolResponse, f as ConnectRequest, g as ConnectResponse, k as Disposable, E as Emitter, m as Event, q as ListToolsResponse, s as McpConnectionState, T as ToolClient, A as ToolClientProvider, B as ToolInfo } from '../types-CjczQwNX.js';
+import { M as McpConnectionEvent, t as McpObservabilityEvent, x as McpRpcResponse, w as McpRpcRequest } from '../types-Bf-7GOLW.js';
+export { a as CallToolRequest, b as CallToolResponse, f as ConnectRequest, g as ConnectResponse, k as Disposable, E as Emitter, m as Event, q as ListToolsResponse, s as McpConnectionState, T as ToolClient, A as ToolClientProvider, B as ToolInfo } from '../types-Bf-7GOLW.js';
 export { OAuthClientInformation, OAuthClientInformationFull, OAuthClientMetadata, OAuthTokens } from '@modelcontextprotocol/sdk/shared/auth.js';
 export { CallToolResult, ListToolsResult, Tool } from '@modelcontextprotocol/sdk/types.js';
 import '@modelcontextprotocol/sdk/client/auth.js';

package/dist/server/index.js

@@ -1734,12 +1734,12 @@ async function createStorage() {
   }
   if (type === "supabase") {
     const url = process.env.SUPABASE_URL;
-    const key = process.env.SUPABASE_SERVICE_ROLE_KEY || process.env.SUPABASE_ANON_KEY;
+    const key = process.env.SUPABASE_SECRET_KEY || process.env.SUPABASE_ANON_KEY;
     if (!url || !key) {
-      console.warn('[mcp-ts][Storage] Explicit selection "supabase" requires SUPABASE_URL and SUPABASE_SERVICE_ROLE_KEY.');
+      console.warn('[mcp-ts][Storage] Explicit selection "supabase" requires SUPABASE_URL and SUPABASE_SECRET_KEY.');
     } else {
-      if (!process.env.SUPABASE_SERVICE_ROLE_KEY) {
-        console.warn('[mcp-ts][Storage] \u26A0\uFE0F  Warning: Using "SUPABASE_ANON_KEY" for server-side storage. You may encounter RLS policy violations. "SUPABASE_SERVICE_ROLE_KEY" is recommended.');
+      if (!process.env.SUPABASE_SECRET_KEY) {
+        console.warn('[mcp-ts][Storage] \u26A0\uFE0F  Warning: Using "SUPABASE_ANON_KEY" for server-side storage. You may encounter RLS policy violations. "SUPABASE_SECRET_KEY" is recommended.');
       }
       try {
         const { createClient } = await import('@supabase/supabase-js');
@@ -1794,13 +1794,13 @@ async function createStorage() {
     console.log(`[mcp-ts][Storage] Auto-detection: "sqlite" (${process.env.MCP_TS_STORAGE_SQLITE_PATH})`);
     return await initializeStorage(new SqliteStorage({ path: process.env.MCP_TS_STORAGE_SQLITE_PATH }));
   }
-  if (process.env.SUPABASE_URL && (process.env.SUPABASE_SERVICE_ROLE_KEY || process.env.SUPABASE_ANON_KEY)) {
+  if (process.env.SUPABASE_URL && (process.env.SUPABASE_SECRET_KEY || process.env.SUPABASE_ANON_KEY)) {
     try {
       const { createClient } = await import('@supabase/supabase-js');
       const url = process.env.SUPABASE_URL;
-      const key = process.env.SUPABASE_SERVICE_ROLE_KEY || process.env.SUPABASE_ANON_KEY;
-      if (!process.env.SUPABASE_SERVICE_ROLE_KEY) {
-        console.warn('[mcp-ts][Storage] \u26A0\uFE0F Warning: Using "SUPABASE_ANON_KEY" for server-side storage. You may encounter RLS policy violations. "SUPABASE_SERVICE_ROLE_KEY" is recommended.');
+      const key = process.env.SUPABASE_SECRET_KEY || process.env.SUPABASE_ANON_KEY;
+      if (!process.env.SUPABASE_SECRET_KEY) {
+        console.warn('[mcp-ts][Storage] \u26A0\uFE0F Warning: Using "SUPABASE_ANON_KEY" for server-side storage. You may encounter RLS policy violations. "SUPABASE_SECRET_KEY" is recommended.');
       }
       const client = createClient(url, key);
       console.log('[mcp-ts][Storage] Auto-detection: "supabase" (via SUPABASE_URL)');
@@ -2149,7 +2149,7 @@ var MCPClient = class {
    * @param options - Client configuration options
    */
   constructor(options) {
-    __publicField(this, "client", null);
+    __publicField(this, "client");
     __publicField(this, "oauthProvider", null);
     __publicField(this, "transport", null);
     __publicField(this, "userId");
@@ -2190,6 +2190,21 @@ var MCPClient = class {
     this.clientUri = options.clientUri;
     this.logoUri = options.logoUri;
     this.policyUri = options.policyUri;
+    this.client = new index_js.Client(
+      {
+        name: MCP_CLIENT_NAME,
+        version: MCP_CLIENT_VERSION
+      },
+      {
+        capabilities: {
+          extensions: {
+            "io.modelcontextprotocol/ui": {
+              mimeTypes: ["text/html+mcp"]
+            }
+          }
+        }
+      }
+    );
   }
   /**
    * Emit a connection state change event
@@ -2300,7 +2315,6 @@ var MCPClient = class {
           const response = await fetch(url, { ...init, signal });
           const hasSessionHeader = init?.headers && new Headers(init.headers).has("mcp-session-id");
           if (response.status === 404 && hasSessionHeader) {
-            this.client = null;
             throw new Error("MCP_SESSION_EXPIRED: Downstream session was not found on the server.");
           }
           return response;
@@ -2316,13 +2330,12 @@ var MCPClient = class {
     }
   }
   /**
-   * Initializes client components (client, transport, OAuth provider)
-   * Loads missing configuration from Redis session store if needed
-   * This method is idempotent and safe to call multiple times
+   * Ensures session metadata and OAuth provider are loaded.
+   * Does NOT create the SDK Client — callers that need one create it themselves.
    * @private
    */
-  async initialize() {
-    if (this.client && this.oauthProvider) {
+  async ensureSession() {
+    if (this.oauthProvider) {
       return;
     }
     this.emitStateChange("INITIALIZING");
@@ -2365,23 +2378,6 @@ var MCPClient = class {
         }
       });
     }
-    if (!this.client) {
-      this.client = new index_js.Client(
-        {
-          name: MCP_CLIENT_NAME,
-          version: MCP_CLIENT_VERSION
-        },
-        {
-          capabilities: {
-            extensions: {
-              "io.modelcontextprotocol/ui": {
-                mimeTypes: ["text/html+mcp"]
-              }
-            }
-          }
-        }
-      );
-    }
     if (existingSession === null) {
       existingSession = await sessions.get(this.userId, this.sessionId);
     }
@@ -2498,17 +2494,16 @@ var MCPClient = class {
    * @throws {Error} When connection fails for other reasons
    */
   async connect() {
-    if (this.client?.transport) {
+    if (this.client.transport) {
       this.transport = null;
       try {
         await this.client.close();
       } catch {
       }
-      this.client = null;
     }
-    await this.initialize();
-    if (!this.client || !this.oauthProvider) {
-      const error = "Client or OAuth provider not initialized";
+    await this.ensureSession();
+    if (!this.oauthProvider) {
+      const error = "OAuth provider not initialized";
       this.emitError(error, "connection");
       this.emitStateChange("FAILED");
       throw new Error(error);
@@ -2575,7 +2570,7 @@ var MCPClient = class {
   async finishAuth(authCode, state) {
     this.emitStateChange("AUTHENTICATING");
     this.emitProgress("Exchanging authorization code for tokens...");
-    await this.initialize();
+    await this.ensureSession();
     if (!this.oauthProvider) {
       const error = "OAuth provider not initialized";
       this.emitError(error, "auth");
@@ -2681,7 +2676,9 @@ var MCPClient = class {
         method: "tools/list",
         params: {}
       };
-      const result = await this.client.request(request, types_js.ListToolsResultSchema);
+      const result = await this.withRetry(
+        () => this.client.request(request, types_js.ListToolsResultSchema)
+      );
       if (this.serverId) {
         this._onConnectionEvent.fire({
           type: "tools_discovered",
@@ -2721,7 +2718,9 @@ var MCPClient = class {
       }
     };
     try {
-      const result = await this.client.request(request, types_js.CallToolResultSchema);
+      const result = await this.withRetry(
+        () => this.client.request(request, types_js.CallToolResultSchema)
+      );
       this._onObservabilityEvent.fire({
         type: "mcp:client:tool_call",
         level: "info",
@@ -2773,7 +2772,9 @@ var MCPClient = class {
         method: "prompts/list",
         params: {}
       };
-      const result = await this.client.request(request, types_js.ListPromptsResultSchema);
+      const result = await this.withRetry(
+        () => this.client.request(request, types_js.ListPromptsResultSchema)
+      );
       this.emitStateChange("READY");
       this.emitProgress(`Discovered ${result.prompts.length} prompts`);
       return result;
@@ -2802,7 +2803,9 @@ var MCPClient = class {
         arguments: args
       }
     };
-    return await this.client.request(request, types_js.GetPromptResultSchema);
+    return await this.withRetry(
+      () => this.client.request(request, types_js.GetPromptResultSchema)
+    );
   }
   /**
    * Lists all available resources from the connected MCP server
@@ -2819,7 +2822,9 @@ var MCPClient = class {
         method: "resources/list",
         params: {}
       };
-      const result = await this.client.request(request, types_js.ListResourcesResultSchema);
+      const result = await this.withRetry(
+        () => this.client.request(request, types_js.ListResourcesResultSchema)
+      );
       this.emitStateChange("READY");
       this.emitProgress(`Discovered ${result.resources.length} resources`);
       return result;
@@ -2846,7 +2851,35 @@ var MCPClient = class {
         uri
       }
     };
-    return await this.client.request(request, types_js.ReadResourceResultSchema);
+    return await this.withRetry(
+      () => this.client.request(request, types_js.ReadResourceResultSchema)
+    );
+  }
+  /**
+   * Wraps an MCP request with automatic transport-session recovery.
+   *
+   * When the downstream MCP server rejects the request with a 404 indicating
+   * the transport session has expired, this method tears down the stale SDK
+   * client and transport, calls {@link reconnect} to negotiate a fresh session,
+   * and retries the request once.
+   *
+   * Non-transient errors (network failures, auth errors, etc.) propagate as-is.
+   */
+  async withRetry(fn) {
+    try {
+      return await fn();
+    } catch (error) {
+      if (!(error instanceof Error && error.message.includes("MCP_SESSION_EXPIRED"))) throw error;
+      if (this.client.transport) {
+        try {
+          await this.client.close();
+        } catch {
+        }
+        this.transport = null;
+      }
+      await this.reconnect();
+      return await fn();
+    }
   }
   /**
    * Reconnects to MCP server using existing OAuth provider from Redis
@@ -2855,20 +2888,9 @@ var MCPClient = class {
    * @throws {Error} When OAuth provider is not initialized
    */
   async reconnect() {
-    await this.initialize();
-    if (!this.oauthProvider) {
-      throw new Error("OAuth provider not initialized");
-    }
-    this.client = new index_js.Client(
-      {
-        name: MCP_CLIENT_NAME,
-        version: MCP_CLIENT_VERSION
-      },
-      { capabilities: {} }
-    );
-    const tt = this.transportType || "streamable-http";
-    this.transport = this.getTransport(tt);
-    await this.client.connect(this.transport);
+    await this.ensureSession();
+    if (!this.oauthProvider) throw new Error("OAuth provider not initialized");
+    await this.connect();
   }
   /**
    * Completely removes the session from Redis including all OAuth data
@@ -2876,7 +2898,7 @@ var MCPClient = class {
    */
   async clearSession() {
     try {
-      await this.initialize();
+      await this.ensureSession();
     } catch (error) {
       console.warn("[MCPClient] Initialization failed during clearSession:", error);
     }
@@ -2891,7 +2913,7 @@ var MCPClient = class {
    * @returns True if connected, false otherwise
    */
   isConnected() {
-    return this.client !== null;
+    return this.client.transport !== void 0;
   }
   /**
    * Disconnects from the MCP server and cleans up resources.
@@ -2909,10 +2931,12 @@ var MCPClient = class {
       } catch {
       }
     }
-    if (this.client) {
-      this.client.close();
+    if (this.client.transport) {
+      try {
+        await this.client.close();
+      } catch {
+      }
     }
-    this.client = null;
     this.oauthProvider = null;
     this.transport = null;
     if (this.serverId) {
@@ -3055,6 +3079,18 @@ var MultiSessionClient = class {
   getClients() {
     return this.clients;
   }
+  /**
+   * Removes and disconnects a single session by ID.
+   *
+   * @returns `true` if the session was found and removed, `false` if not found.
+   */
+  async removeSession(sessionId) {
+    const idx = this.clients.findIndex((c) => c.getSessionId() === sessionId);
+    if (idx === -1) return false;
+    const [client] = this.clients.splice(idx, 1);
+    await client.disconnect();
+    return true;
+  }
   /**
    * Gracefully disconnects all active MCP clients and clears the internal list.
    *