@mcp-ts/sdk 2.5.2 → 2.6.0

package/dist/index.mjs

@@ -4,6 +4,7 @@ import { StreamableHTTPClientTransport } from '@modelcontextprotocol/sdk/client/
 import { SSEClientTransport } from '@modelcontextprotocol/sdk/client/sse.js';
 import { UnauthorizedError as UnauthorizedError$1 } from '@modelcontextprotocol/sdk/client/auth.js';
 import { ListToolsResultSchema, CallToolResultSchema, ListPromptsResultSchema, GetPromptResultSchema, ListResourcesResultSchema, ReadResourceResultSchema } from '@modelcontextprotocol/sdk/types.js';
+import { AsyncLocalStorage } from 'async_hooks';
 import * as fs2 from 'fs';
 import { promises } from 'fs';
 import * as path from 'path';
@@ -277,7 +278,6 @@ var RedisStorageBackend = class {
   constructor(redis2) {
     this.redis = redis2;
     __publicField(this, "KEY_PREFIX", "mcp:session:");
-    __publicField(this, "CREDENTIALS_KEY_PREFIX", "mcp:credentials:");
     __publicField(this, "USER_ID_KEY_PREFIX", "mcp:userId:");
     __publicField(this, "USER_ID_KEY_SUFFIX", ":sessions");
   }
@@ -296,9 +296,6 @@ var RedisStorageBackend = class {
   getSessionKey(userId, sessionId) {
     return `${this.KEY_PREFIX}${userId}:${sessionId}`;
   }
-  getCredentialsKey(userId, sessionId) {
-    return `${this.CREDENTIALS_KEY_PREFIX}${userId}:${sessionId}`;
-  }
   /**
    * Generates Redis key for tracking all sessions for a user
    * @private
@@ -388,48 +385,54 @@ var RedisStorageBackend = class {
   }
   async patchCredentials(userId, sessionId, data) {
     const sessionKey = this.getSessionKey(userId, sessionId);
-    const credentialsKey = this.getCredentialsKey(userId, sessionId);
-    const sessionExists = await this.redis.exists(sessionKey);
-    if (!sessionExists) {
+    const currentStr = await this.redis.get(sessionKey);
+    if (!currentStr) {
       throw new Error(`Session ${sessionId} not found for userId ${userId}`);
     }
-    const session = await this.get(userId, sessionId);
-    const currentTtl = await this.redis.ttl(sessionKey);
-    const effectiveTtl = currentTtl > 0 && session ? currentTtl : resolveSessionRedisTtlSeconds(session ?? { status: "pending" });
-    const currentStr = await this.redis.get(credentialsKey);
-    const current = currentStr ? JSON.parse(currentStr) : { sessionId, userId };
-    const credentials = { ...current, ...data, sessionId, userId };
-    if (effectiveTtl > 0) {
-      await this.redis.set(credentialsKey, JSON.stringify(credentials), "EX", effectiveTtl);
-    } else {
-      await this.redis.set(credentialsKey, JSON.stringify(credentials));
-    }
+    const current = JSON.parse(currentStr);
+    const updated = { ...current, ...data, sessionId, userId };
+    const effectiveTtl = resolveSessionRedisTtlSeconds(updated);
+    await this.redis.set(sessionKey, JSON.stringify(updated), "EX", effectiveTtl);
   }
-  async get(userId, sessionId) {
+  async get(userId, sessionId, options) {
     try {
       const sessionKey = this.getSessionKey(userId, sessionId);
       const sessionDataStr = await this.redis.get(sessionKey);
-      if (!sessionDataStr) {
-        return null;
+      if (!sessionDataStr) return null;
+      const session = normalizeStoredSession(JSON.parse(sessionDataStr));
+      if (!options?.includeCredentials) {
+        const { clientInformation, tokens, codeVerifier, codeVerifierChallenge, codeVerifierNonce, clientId, oauthState, ...sessionOnly } = session;
+        return sessionOnly;
       }
-      const session = JSON.parse(sessionDataStr);
-      return normalizeStoredSession(session);
+      return session;
     } catch (error) {
       console.error("[RedisStorageBackend] Failed to get session:", error);
       return null;
     }
   }
   async getCredentials(userId, sessionId) {
-    const session = await this.get(userId, sessionId);
+    const session = await this.get(userId, sessionId, { includeCredentials: true });
     if (!session) return null;
-    const credentialsStr = await this.redis.get(this.getCredentialsKey(userId, sessionId));
-    return credentialsStr ? JSON.parse(credentialsStr) : { sessionId, userId };
+    const { clientInformation, tokens, codeVerifier, codeVerifierChallenge, codeVerifierNonce, clientId, oauthState } = session;
+    return {
+      sessionId,
+      userId,
+      clientInformation,
+      tokens,
+      codeVerifier,
+      codeVerifierChallenge,
+      codeVerifierNonce,
+      clientId,
+      oauthState
+    };
   }
   async clearCredentials(userId, sessionId) {
     await this.patchCredentials(userId, sessionId, {
       clientInformation: null,
       tokens: null,
       codeVerifier: null,
+      codeVerifierChallenge: null,
+      codeVerifierNonce: null,
       clientId: null,
       oauthState: null
     });
@@ -462,10 +465,9 @@ var RedisStorageBackend = class {
   async delete(userId, sessionId) {
     try {
       const sessionKey = this.getSessionKey(userId, sessionId);
-      const credentialsKey = this.getCredentialsKey(userId, sessionId);
       const userIdKey = this.getUserIdKey(userId);
       await this.redis.srem(userIdKey, sessionId);
-      await this.redis.del(sessionKey, credentialsKey);
+      await this.redis.del(sessionKey);
     } catch (error) {
       console.error("[RedisStorageBackend] Failed to remove session:", error);
     }
@@ -496,9 +498,8 @@ var RedisStorageBackend = class {
   async clearAll() {
     try {
       const keys = await this.scanKeys(`${this.KEY_PREFIX}*`);
-      const credentialKeys = await this.scanKeys(`${this.CREDENTIALS_KEY_PREFIX}*`);
       const userIdKeys = await this.scanKeys(`${this.USER_ID_KEY_PREFIX}*${this.USER_ID_KEY_SUFFIX}`);
-      const allKeys = [...keys, ...credentialKeys, ...userIdKeys];
+      const allKeys = [...keys, ...userIdKeys];
       if (allKeys.length > 0) {
         await this.redis.del(...allKeys);
       }
@@ -522,7 +523,6 @@ var RedisStorageBackend = class {
         const staleSessionIds = sessionIds.filter((_, index) => existenceChecks[index] === 0);
         if (staleSessionIds.length > 0) {
           await this.redis.srem(userIdKey, ...staleSessionIds);
-          await this.redis.del(...staleSessionIds.map((sessionId) => this.getCredentialsKey(userId, sessionId)));
         }
         const remainingCount = await this.redis.scard(userIdKey);
         if (remainingCount === 0) {
@@ -547,7 +547,6 @@ var MemoryStorageBackend = class {
   constructor() {
     // Map<userId:sessionId, Session>
     __publicField(this, "sessions", /* @__PURE__ */ new Map());
-    __publicField(this, "credentials", /* @__PURE__ */ new Map());
     // Map<userId, Set<sessionId>>
     __publicField(this, "userIdSessions", /* @__PURE__ */ new Map());
   }
@@ -585,26 +584,46 @@ var MemoryStorageBackend = class {
   }
   async patchCredentials(userId, sessionId, data) {
     const sessionKey = this.getSessionKey(userId, sessionId);
-    if (!this.sessions.has(sessionKey)) {
+    const current = this.sessions.get(sessionKey);
+    if (!current) {
       throw new Error(`Session ${sessionId} not found`);
     }
-    const current = this.credentials.get(sessionKey) ?? { sessionId, userId };
-    this.credentials.set(sessionKey, { ...current, ...data, sessionId, userId });
+    this.sessions.set(sessionKey, { ...current, ...data, sessionId, userId });
   }
-  async get(userId, sessionId) {
+  async get(userId, sessionId, options) {
     const sessionKey = this.getSessionKey(userId, sessionId);
-    return this.sessions.get(sessionKey) || null;
+    const session = this.sessions.get(sessionKey) || null;
+    if (!session) return session;
+    if (!options?.includeCredentials) {
+      const { clientInformation, tokens, codeVerifier, codeVerifierChallenge, codeVerifierNonce, clientId, oauthState, ...sessionOnly } = session;
+      return sessionOnly;
+    }
+    return session;
   }
   async getCredentials(userId, sessionId) {
     const sessionKey = this.getSessionKey(userId, sessionId);
-    if (!this.sessions.has(sessionKey)) return null;
-    return this.credentials.get(sessionKey) ?? { sessionId, userId };
+    const session = this.sessions.get(sessionKey);
+    if (!session) return null;
+    const { clientInformation, tokens, codeVerifier, codeVerifierChallenge, codeVerifierNonce, clientId, oauthState } = session;
+    return {
+      sessionId,
+      userId,
+      clientInformation,
+      tokens,
+      codeVerifier,
+      codeVerifierChallenge,
+      codeVerifierNonce,
+      clientId,
+      oauthState
+    };
   }
   async clearCredentials(userId, sessionId) {
     await this.patchCredentials(userId, sessionId, {
       clientInformation: null,
       tokens: null,
       codeVerifier: null,
+      codeVerifierChallenge: null,
+      codeVerifierNonce: null,
       clientId: null,
       oauthState: null
     });
@@ -628,7 +647,6 @@ var MemoryStorageBackend = class {
   async delete(userId, sessionId) {
     const sessionKey = this.getSessionKey(userId, sessionId);
     this.sessions.delete(sessionKey);
-    this.credentials.delete(sessionKey);
     const set = this.userIdSessions.get(userId);
     if (set) {
       set.delete(sessionId);
@@ -642,14 +660,12 @@ var MemoryStorageBackend = class {
   }
   async clearAll() {
     this.sessions.clear();
-    this.credentials.clear();
     this.userIdSessions.clear();
   }
   async cleanupExpired() {
     for (const [key, session] of this.sessions.entries()) {
       if (!isSessionExpired(session)) continue;
       this.sessions.delete(key);
-      this.credentials.delete(key);
       const set = this.userIdSessions.get(session.userId);
       if (set) {
         set.delete(session.sessionId);
@@ -669,7 +685,6 @@ var FileStorageBackend = class {
   constructor(options = {}) {
     __publicField(this, "filePath");
     __publicField(this, "memoryCache", null);
-    __publicField(this, "credentialsCache", null);
     __publicField(this, "initialized", false);
     this.filePath = options.path || "./sessions.json";
   }
@@ -684,22 +699,15 @@ var FileStorageBackend = class {
       const data = await promises.readFile(this.filePath, "utf-8");
       const json = JSON.parse(data);
       this.memoryCache = /* @__PURE__ */ new Map();
-      this.credentialsCache = /* @__PURE__ */ new Map();
       if (Array.isArray(json.sessions)) {
         json.sessions.forEach((s) => {
           const session = normalizeStoredSession(s);
           this.memoryCache.set(this.getSessionKey(session.userId || "unknown", session.sessionId), session);
         });
       }
-      if (Array.isArray(json.credentials)) {
-        json.credentials.forEach((c) => {
-          this.credentialsCache.set(this.getSessionKey(c.userId, c.sessionId), c);
-        });
-      }
     } catch (error) {
       if (error.code === "ENOENT") {
         this.memoryCache = /* @__PURE__ */ new Map();
-        this.credentialsCache = /* @__PURE__ */ new Map();
         await this.flush();
       } else {
         console.error("[FileStorage] Failed to load sessions:", error);
@@ -713,10 +721,9 @@ var FileStorageBackend = class {
     if (!this.initialized) await this.init();
   }
   async flush() {
-    if (!this.memoryCache || !this.credentialsCache) return;
+    if (!this.memoryCache) return;
     await promises.writeFile(this.filePath, JSON.stringify({
-      sessions: Array.from(this.memoryCache.values()),
-      credentials: Array.from(this.credentialsCache.values())
+      sessions: Array.from(this.memoryCache.values())
     }, null, 2), "utf-8");
   }
   getSessionKey(userId, sessionId) {
@@ -751,29 +758,49 @@ var FileStorageBackend = class {
   async patchCredentials(userId, sessionId, data) {
     await this.ensureInitialized();
     const sessionKey = this.getSessionKey(userId, sessionId);
-    if (!this.memoryCache.has(sessionKey)) {
+    const current = this.memoryCache.get(sessionKey);
+    if (!current) {
       throw new Error(`Session ${sessionId} not found`);
     }
-    const current = this.credentialsCache.get(sessionKey) ?? { sessionId, userId };
-    this.credentialsCache.set(sessionKey, { ...current, ...data, sessionId, userId });
+    this.memoryCache.set(sessionKey, { ...current, ...data, sessionId, userId });
     await this.flush();
   }
-  async get(userId, sessionId) {
+  async get(userId, sessionId, options) {
     await this.ensureInitialized();
     const sessionKey = this.getSessionKey(userId, sessionId);
-    return this.memoryCache.get(sessionKey) || null;
+    const session = this.memoryCache.get(sessionKey) || null;
+    if (!session) return null;
+    if (!options?.includeCredentials) {
+      const { clientInformation, tokens, codeVerifier, codeVerifierChallenge, codeVerifierNonce, clientId, oauthState, ...sessionOnly } = session;
+      return sessionOnly;
+    }
+    return session;
   }
   async getCredentials(userId, sessionId) {
     await this.ensureInitialized();
     const sessionKey = this.getSessionKey(userId, sessionId);
-    if (!this.memoryCache.has(sessionKey)) return null;
-    return this.credentialsCache.get(sessionKey) ?? { sessionId, userId };
+    const session = this.memoryCache.get(sessionKey);
+    if (!session) return null;
+    const { clientInformation, tokens, codeVerifier, codeVerifierChallenge, codeVerifierNonce, clientId, oauthState } = session;
+    return {
+      sessionId,
+      userId,
+      clientInformation,
+      tokens,
+      codeVerifier,
+      codeVerifierChallenge,
+      codeVerifierNonce,
+      clientId,
+      oauthState
+    };
   }
   async clearCredentials(userId, sessionId) {
     await this.patchCredentials(userId, sessionId, {
       clientInformation: null,
       tokens: null,
       codeVerifier: null,
+      codeVerifierChallenge: null,
+      codeVerifierNonce: null,
       clientId: null,
       oauthState: null
     });
@@ -790,7 +817,6 @@ var FileStorageBackend = class {
     await this.ensureInitialized();
     const sessionKey = this.getSessionKey(userId, sessionId);
     const deleted = this.memoryCache.delete(sessionKey);
-    this.credentialsCache.delete(sessionKey);
     if (deleted) {
       await this.flush();
     }
@@ -802,7 +828,6 @@ var FileStorageBackend = class {
   async clearAll() {
     await this.ensureInitialized();
     this.memoryCache.clear();
-    this.credentialsCache.clear();
     await this.flush();
   }
   async cleanupExpired() {
@@ -811,7 +836,6 @@ var FileStorageBackend = class {
     for (const [key, session] of this.memoryCache.entries()) {
       if (!isSessionExpired(session)) continue;
       this.memoryCache.delete(key);
-      this.credentialsCache.delete(key);
       changed = true;
     }
     if (changed) {
@@ -825,12 +849,10 @@ var SqliteStorage = class {
   constructor(options = {}) {
     __publicField(this, "db", null);
     __publicField(this, "table");
-    __publicField(this, "credentialsTable");
     __publicField(this, "initialized", false);
     __publicField(this, "dbPath");
     this.dbPath = options.path || "./sessions.db";
     this.table = options.table || "mcp_sessions";
-    this.credentialsTable = `${this.table}_credentials`;
   }
   async init() {
     if (this.initialized) return;
@@ -850,13 +872,6 @@ var SqliteStorage = class {
                     expiresAt INTEGER
                 );
                 CREATE INDEX IF NOT EXISTS idx_${this.table}_userId ON ${this.table}(userId);
-                CREATE TABLE IF NOT EXISTS ${this.credentialsTable} (
-                    sessionId TEXT NOT NULL,
-                    userId TEXT NOT NULL,
-                    data TEXT NOT NULL,
-                    PRIMARY KEY (userId, sessionId),
-                    FOREIGN KEY (sessionId) REFERENCES ${this.table}(sessionId) ON DELETE CASCADE
-                );
             `);
       this.initialized = true;
       console.log(`[mcp-ts][Storage] SQLite: \u2713 database at ${this.dbPath} verified.`);
@@ -913,41 +928,54 @@ var SqliteStorage = class {
   }
   async patchCredentials(userId, sessionId, data) {
     this.ensureInitialized();
-    if (!await this.get(userId, sessionId)) {
+    const currentSession = await this.get(userId, sessionId, { includeCredentials: true });
+    if (!currentSession) {
       throw new Error(`Session ${sessionId} not found for userId ${userId}`);
     }
-    const current = await this.getCredentials(userId, sessionId) ?? { sessionId, userId };
-    const credentials = { ...current, ...data, sessionId, userId };
+    const updated = { ...currentSession, ...data, sessionId, userId };
     const stmt = this.db.prepare(
-      `INSERT INTO ${this.credentialsTable} (sessionId, userId, data)
-             VALUES (?, ?, ?)
-             ON CONFLICT(userId, sessionId) DO UPDATE SET data = excluded.data`
+      `UPDATE ${this.table} SET data = ? WHERE sessionId = ? AND userId = ?`
     );
-    stmt.run(sessionId, userId, JSON.stringify(credentials));
+    stmt.run(JSON.stringify(updated), sessionId, userId);
   }
-  async get(userId, sessionId) {
+  async get(userId, sessionId, options) {
     this.ensureInitialized();
     const stmt = this.db.prepare(
       `SELECT data FROM ${this.table} WHERE sessionId = ? AND userId = ?`
     );
     const row = stmt.get(sessionId, userId);
     if (!row) return null;
-    return normalizeStoredSession(JSON.parse(row.data));
+    const session = normalizeStoredSession(JSON.parse(row.data));
+    if (!options?.includeCredentials) {
+      const { clientInformation, tokens, codeVerifier, codeVerifierChallenge, codeVerifierNonce, clientId, oauthState, ...sessionOnly } = session;
+      return sessionOnly;
+    }
+    return session;
   }
   async getCredentials(userId, sessionId) {
     this.ensureInitialized();
-    if (!await this.get(userId, sessionId)) return null;
-    const stmt = this.db.prepare(
-      `SELECT data FROM ${this.credentialsTable} WHERE sessionId = ? AND userId = ?`
-    );
-    const row = stmt.get(sessionId, userId);
-    return row ? JSON.parse(row.data) : { sessionId, userId };
+    const session = await this.get(userId, sessionId, { includeCredentials: true });
+    if (!session) return null;
+    const { clientInformation, tokens, codeVerifier, codeVerifierChallenge, codeVerifierNonce, clientId, oauthState } = session;
+    return {
+      sessionId,
+      userId,
+      clientInformation,
+      tokens,
+      codeVerifier,
+      codeVerifierChallenge,
+      codeVerifierNonce,
+      clientId,
+      oauthState
+    };
   }
   async clearCredentials(userId, sessionId) {
     await this.patchCredentials(userId, sessionId, {
       clientInformation: null,
       tokens: null,
       codeVerifier: null,
+      codeVerifierChallenge: null,
+      codeVerifierNonce: null,
       clientId: null,
       oauthState: null
     });
@@ -973,9 +1001,6 @@ var SqliteStorage = class {
     const stmt = this.db.prepare(
       `DELETE FROM ${this.table} WHERE sessionId = ? AND userId = ?`
     );
-    this.db.prepare(
-      `DELETE FROM ${this.credentialsTable} WHERE sessionId = ? AND userId = ?`
-    ).run(sessionId, userId);
     stmt.run(sessionId, userId);
   }
   async listAllIds() {
@@ -986,7 +1011,6 @@ var SqliteStorage = class {
   }
   async clearAll() {
     this.ensureInitialized();
-    this.db.prepare(`DELETE FROM ${this.credentialsTable}`).run();
     const stmt = this.db.prepare(`DELETE FROM ${this.table}`);
     stmt.run();
   }
@@ -1000,14 +1024,6 @@ var SqliteStorage = class {
         deleteStmt.run(row.sessionId, row.userId);
       }
     }
-    this.db.prepare(
-      `DELETE FROM ${this.credentialsTable}
-             WHERE NOT EXISTS (
-                SELECT 1 FROM ${this.table}
-                WHERE ${this.table}.sessionId = ${this.credentialsTable}.sessionId
-                  AND ${this.table}.userId = ${this.credentialsTable}.userId
-             )`
-    ).run();
   }
   async disconnect() {
     if (this.db) {
@@ -1089,7 +1105,6 @@ var SupabaseStorageBackend = class {
   }
   async init() {
     await this.assertTable("mcp_sessions", "session_id");
-    await this.assertTable("mcp_credentials", "session_id");
     console.log("[mcp-ts][Storage] Supabase: storage tables verified.");
   }
   async assertTable(table, column) {
@@ -1120,18 +1135,13 @@ var SupabaseStorageBackend = class {
       headers: decryptObject(row.headers),
       authUrl: row.auth_url,
       status: row.status ?? "pending",
-      toolPolicy: normalizeToolPolicy(row.tool_policy)
-    };
-  }
-  mapRowToCredentials(row, userId, sessionId) {
-    return {
-      sessionId,
-      userId,
-      clientInformation: decryptObject(row?.client_information),
-      tokens: decryptObject(row?.tokens),
-      codeVerifier: decryptObject(row?.code_verifier),
-      clientId: row?.client_id,
-      oauthState: row?.oauth_state
+      toolPolicy: normalizeToolPolicy(row.tool_policy),
+      clientInformation: decryptObject(row.client_information),
+      tokens: decryptObject(row.tokens),
+      codeVerifier: decryptObject(row.code_verifier),
+      clientId: row.client_id,
+      oauthState: row.oauth_state,
+      enabled: row.enabled ?? true
     };
   }
   hasCredentialData(data) {
@@ -1189,6 +1199,7 @@ var SupabaseStorageBackend = class {
     if ("headers" in data) updateData.headers = encryptObject(data.headers);
     if ("authUrl" in data) updateData.auth_url = data.authUrl ?? null;
     if ("toolPolicy" in data) updateData.tool_policy = normalizeToolPolicy(data.toolPolicy);
+    if ("enabled" in data) updateData.enabled = data.enabled;
     const shouldUpdateSession = Object.keys(updateData).some((key) => key !== "updated_at");
     let updatedRows = null;
     if (shouldUpdateSession) {
@@ -1210,23 +1221,22 @@ var SupabaseStorageBackend = class {
   }
   async patchCredentials(userId, sessionId, data) {
     if (!this.hasCredentialData(data)) return;
-    const row = {
-      user_id: userId,
-      session_id: sessionId,
+    const updateData = {
       updated_at: (/* @__PURE__ */ new Date()).toISOString()
     };
-    if ("clientInformation" in data) row.client_information = data.clientInformation == null ? null : encryptObject(data.clientInformation);
-    if ("tokens" in data) row.tokens = data.tokens == null ? null : encryptObject(data.tokens);
-    if ("codeVerifier" in data) row.code_verifier = data.codeVerifier == null ? null : encryptObject(data.codeVerifier);
-    if ("clientId" in data) row.client_id = data.clientId ?? null;
-    if ("oauthState" in data) row.oauth_state = data.oauthState ?? null;
-    const { error } = await this.supabase.from("mcp_credentials").upsert(row, { onConflict: "user_id,session_id" });
+    if ("clientInformation" in data) updateData.client_information = data.clientInformation == null ? null : encryptObject(data.clientInformation);
+    if ("tokens" in data) updateData.tokens = data.tokens == null ? null : encryptObject(data.tokens);
+    if ("codeVerifier" in data) updateData.code_verifier = data.codeVerifier == null ? null : encryptObject(data.codeVerifier);
+    if ("clientId" in data) updateData.client_id = data.clientId ?? null;
+    if ("oauthState" in data) updateData.oauth_state = data.oauthState ?? null;
+    const { error } = await this.supabase.from("mcp_sessions").update(updateData).eq("user_id", userId).eq("session_id", sessionId);
     if (error) {
       throw new Error(`Failed to update credentials: ${error.message}`);
     }
   }
-  async get(userId, sessionId) {
-    const { data, error } = await this.supabase.from("mcp_sessions").select("*").eq("user_id", userId).eq("session_id", sessionId).maybeSingle();
+  async get(userId, sessionId, options) {
+    const selection = options?.includeCredentials ? "*" : "session_id, user_id, server_id, server_name, server_url, transport_type, callback_url, created_at, updated_at, expires_at, headers, auth_url, status, tool_policy, enabled";
+    const { data, error } = await this.supabase.from("mcp_sessions").select(selection).eq("user_id", userId).eq("session_id", sessionId).maybeSingle();
     if (error) {
       console.error("[SupabaseStorage] Failed to get session:", error);
       return null;
@@ -1235,19 +1245,21 @@ var SupabaseStorageBackend = class {
     return this.mapRowToSessionData(data);
   }
   async getCredentials(userId, sessionId) {
-    const { data, error } = await this.supabase.from("mcp_credentials").select("*").eq("user_id", userId).eq("session_id", sessionId).maybeSingle();
+    const { data, error } = await this.supabase.from("mcp_sessions").select("client_information, tokens, code_verifier, client_id, oauth_state").eq("user_id", userId).eq("session_id", sessionId).maybeSingle();
     if (error) {
       console.error("[SupabaseStorage] Failed to get credentials:", error);
       return null;
     }
-    if (data) {
-      return this.mapRowToCredentials(data, userId, sessionId);
-    }
-    const { data: sessionRows, error: sessionError } = await this.supabase.from("mcp_sessions").select("id").eq("user_id", userId).eq("session_id", sessionId);
-    if (sessionError || !sessionRows || sessionRows.length === 0) {
-      return null;
-    }
-    return { sessionId, userId };
+    if (!data) return null;
+    return {
+      sessionId,
+      userId,
+      clientInformation: decryptObject(data.client_information),
+      tokens: decryptObject(data.tokens),
+      codeVerifier: decryptObject(data.code_verifier),
+      clientId: data.client_id,
+      oauthState: data.oauth_state
+    };
   }
   async list(userId) {
     const { data, error } = await this.supabase.from("mcp_sessions").select("*").eq("user_id", userId);
@@ -1258,7 +1270,14 @@ var SupabaseStorageBackend = class {
     return data.map((row) => this.mapRowToSessionData(row));
   }
   async clearCredentials(userId, sessionId) {
-    const { error } = await this.supabase.from("mcp_credentials").delete().eq("user_id", userId).eq("session_id", sessionId);
+    const { error } = await this.supabase.from("mcp_sessions").update({
+      client_information: null,
+      tokens: null,
+      code_verifier: null,
+      client_id: null,
+      oauth_state: null,
+      updated_at: (/* @__PURE__ */ new Date()).toISOString()
+    }).eq("user_id", userId).eq("session_id", sessionId);
     if (error) {
       throw new Error(`Failed to clear credentials: ${error.message}`);
     }
@@ -1286,10 +1305,6 @@ var SupabaseStorageBackend = class {
     return data.map((row) => row.session_id);
   }
   async clearAll() {
-    const { error: credentialsError } = await this.supabase.from("mcp_credentials").delete().neq("session_id", "");
-    if (credentialsError) {
-      console.error("[SupabaseStorage] Failed to clear credentials:", credentialsError);
-    }
     const { error } = await this.supabase.from("mcp_sessions").delete().neq("session_id", "");
     if (error) {
       console.error("[SupabaseStorage] Failed to clear sessions:", error);
@@ -1315,16 +1330,12 @@ var NeonStorageBackend = class {
   constructor(sql, options = {}) {
     this.sql = sql;
     __publicField(this, "tableName");
-    __publicField(this, "credentialsTableName");
     const schema = options.schema || "public";
     const table = options.table || "mcp_sessions";
-    const credentialsTable = options.credentialsTable || "mcp_credentials";
     this.tableName = `${this.quoteIdentifier(schema)}.${this.quoteIdentifier(table)}`;
-    this.credentialsTableName = `${this.quoteIdentifier(schema)}.${this.quoteIdentifier(credentialsTable)}`;
   }
   async init() {
     await this.assertTable(this.tableName, "mcp_sessions");
-    await this.assertTable(this.credentialsTableName, "mcp_credentials");
     console.log("[mcp-ts][Storage] Neon: storage tables verified.");
   }
   async assertTable(qualifiedName, displayName) {
@@ -1362,18 +1373,13 @@ var NeonStorageBackend = class {
       headers: decryptObject(row.headers),
       authUrl: row.auth_url ?? void 0,
       status: row.status ?? "pending",
-      toolPolicy: normalizeToolPolicy(row.tool_policy)
-    };
-  }
-  mapRowToCredentials(row, userId, sessionId) {
-    return {
-      sessionId,
-      userId,
+      toolPolicy: normalizeToolPolicy(row.tool_policy),
       clientInformation: decryptObject(row.client_information),
       tokens: decryptObject(row.tokens),
       codeVerifier: decryptObject(row.code_verifier),
       clientId: row.client_id ?? void 0,
-      oauthState: row.oauth_state
+      oauthState: row.oauth_state,
+      enabled: row.enabled ?? true
     };
   }
   hasCredentialData(data) {
@@ -1443,7 +1449,7 @@ var NeonStorageBackend = class {
     const updatedSession = { ...currentSession, ...data };
     const status = updatedSession.status ?? "pending";
     const expiresAt = resolveSessionExpiresAt(status);
-    const shouldUpdateSession = "serverId" in data || "serverName" in data || "serverUrl" in data || "transportType" in data || "callbackUrl" in data || "status" in data || "headers" in data || "authUrl" in data || "toolPolicy" in data;
+    const shouldUpdateSession = "serverId" in data || "serverName" in data || "serverUrl" in data || "transportType" in data || "callbackUrl" in data || "status" in data || "headers" in data || "authUrl" in data || "toolPolicy" in data || "enabled" in data;
     if (shouldUpdateSession) {
       const setClauses = [];
       const values = [];
@@ -1466,6 +1472,9 @@ var NeonStorageBackend = class {
         const toolPolicy = normalizeToolPolicy(updatedSession.toolPolicy, policyUpdatedAt) ?? { mode: "all", toolIds: [], updatedAt: policyUpdatedAt };
         addSet("tool_policy", toolPolicy);
       }
+      if ("enabled" in data) {
+        addSet("enabled", updatedSession.enabled);
+      }
       setClauses.push("updated_at = now()");
       const updatedRows = await this.sql.query(
         `UPDATE ${this.tableName}
@@ -1481,45 +1490,45 @@ var NeonStorageBackend = class {
   }
   async patchCredentials(userId, sessionId, data) {
     if (!this.hasCredentialData(data)) return;
-    await this.sql.query(
-      `INSERT INTO ${this.credentialsTableName} (
-                user_id,
-                session_id,
-                client_information,
-                tokens,
-                code_verifier,
-                client_id,
-                oauth_state,
-                updated_at
-            ) VALUES ($1, $2, $3, $4, $5, $6, $7, now())
-            ON CONFLICT (user_id, session_id)
-            DO UPDATE SET
-                client_information = CASE WHEN $8 THEN EXCLUDED.client_information ELSE ${this.credentialsTableName}.client_information END,
-                tokens = CASE WHEN $9 THEN EXCLUDED.tokens ELSE ${this.credentialsTableName}.tokens END,
-                code_verifier = CASE WHEN $10 THEN EXCLUDED.code_verifier ELSE ${this.credentialsTableName}.code_verifier END,
-                client_id = CASE WHEN $11 THEN EXCLUDED.client_id ELSE ${this.credentialsTableName}.client_id END,
-                oauth_state = CASE WHEN $12 THEN EXCLUDED.oauth_state ELSE ${this.credentialsTableName}.oauth_state END,
-                updated_at = now()`,
-      [
-        userId,
-        sessionId,
-        "clientInformation" in data ? data.clientInformation == null ? null : encryptObject(data.clientInformation) : null,
-        "tokens" in data ? data.tokens == null ? null : encryptObject(data.tokens) : null,
-        "codeVerifier" in data ? data.codeVerifier == null ? null : encryptObject(data.codeVerifier) : null,
-        "clientId" in data ? data.clientId ?? null : null,
-        "oauthState" in data ? data.oauthState ?? null : null,
-        "clientInformation" in data,
-        "tokens" in data,
-        "codeVerifier" in data,
-        "clientId" in data,
-        "oauthState" in data
-      ]
+    const setClauses = [];
+    const values = [];
+    let paramIndex = 1;
+    const addSet = (column, value) => {
+      setClauses.push(`${column} = $${paramIndex++}`);
+      values.push(value);
+    };
+    if ("clientInformation" in data) {
+      addSet("client_information", data.clientInformation == null ? null : encryptObject(data.clientInformation));
+    }
+    if ("tokens" in data) {
+      addSet("tokens", data.tokens == null ? null : encryptObject(data.tokens));
+    }
+    if ("codeVerifier" in data) {
+      addSet("code_verifier", data.codeVerifier == null ? null : encryptObject(data.codeVerifier));
+    }
+    if ("clientId" in data) {
+      addSet("client_id", data.clientId ?? null);
+    }
+    if ("oauthState" in data) {
+      addSet("oauth_state", data.oauthState ?? null);
+    }
+    setClauses.push("updated_at = now()");
+    const updatedRows = await this.sql.query(
+      `UPDATE ${this.tableName}
+             SET ${setClauses.join(", ")}
+             WHERE user_id = $${paramIndex++} AND session_id = $${paramIndex++}
+             RETURNING id`,
+      [...values, userId, sessionId]
     );
+    if (updatedRows.length === 0) {
+      throw new Error(`Session ${sessionId} not found for userId ${userId}`);
+    }
   }
-  async get(userId, sessionId) {
+  async get(userId, sessionId, options) {
     try {
+      const selection = options?.includeCredentials ? "*" : "session_id, user_id, server_id, server_name, server_url, transport_type, callback_url, created_at, updated_at, expires_at, headers, auth_url, status, tool_policy, enabled";
       const rows = await this.sql.query(
-        `SELECT * FROM ${this.tableName} WHERE user_id = $1 AND session_id = $2`,
+        `SELECT ${selection} FROM ${this.tableName} WHERE user_id = $1 AND session_id = $2`,
         [userId, sessionId]
       );
       if (!rows[0]) return null;
@@ -1531,18 +1540,22 @@ var NeonStorageBackend = class {
   }
   async getCredentials(userId, sessionId) {
     try {
-      const credentialRows = await this.sql.query(
-        `SELECT * FROM ${this.credentialsTableName} WHERE user_id = $1 AND session_id = $2`,
-        [userId, sessionId]
-      );
-      if (credentialRows[0]) {
-        return this.mapRowToCredentials(credentialRows[0], userId, sessionId);
-      }
-      const sessionRows = await this.sql.query(
-        `SELECT id FROM ${this.tableName} WHERE user_id = $1 AND session_id = $2`,
+      const rows = await this.sql.query(
+        `SELECT client_information, tokens, code_verifier, client_id, oauth_state
+                 FROM ${this.tableName} WHERE user_id = $1 AND session_id = $2`,
         [userId, sessionId]
       );
-      return sessionRows[0] ? { sessionId, userId } : null;
+      if (!rows[0]) return null;
+      const row = rows[0];
+      return {
+        sessionId,
+        userId,
+        clientInformation: decryptObject(row.client_information),
+        tokens: decryptObject(row.tokens),
+        codeVerifier: decryptObject(row.code_verifier),
+        clientId: row.client_id ?? void 0,
+        oauthState: row.oauth_state
+      };
     } catch (error) {
       console.error("[NeonStorage] Failed to get credentials:", error);
       return null;
@@ -1563,7 +1576,9 @@ var NeonStorageBackend = class {
   async clearCredentials(userId, sessionId) {
     try {
       await this.sql.query(
-        `DELETE FROM ${this.credentialsTableName} WHERE user_id = $1 AND session_id = $2`,
+        `UPDATE ${this.tableName}
+                 SET client_information = null, tokens = null, code_verifier = null, client_id = null, oauth_state = null, updated_at = now()
+                 WHERE user_id = $1 AND session_id = $2`,
         [userId, sessionId]
       );
     } catch (error) {
@@ -1605,7 +1620,6 @@ var NeonStorageBackend = class {
   }
   async clearAll() {
     try {
-      await this.sql.query(`DELETE FROM ${this.credentialsTableName}`);
       await this.sql.query(`DELETE FROM ${this.tableName}`);
     } catch (error) {
       console.error("[NeonStorage] Failed to clear sessions:", error);
@@ -1847,6 +1861,60 @@ function onSessionMutation(listener) {
     sessionMutationListeners.delete(listener);
   };
 }
+function withDbObservability(store, emit) {
+  const readMethods = /* @__PURE__ */ new Set([
+    "get",
+    "getCredentials",
+    "list",
+    "listIds",
+    "listAllIds"
+  ]);
+  return new Proxy(store, {
+    get(target, prop, receiver) {
+      const original = Reflect.get(target, prop, receiver);
+      if (typeof original !== "function") return original;
+      return (...args) => {
+        const method = prop;
+        const isRead = readMethods.has(prop);
+        const start = performance.now();
+        const emitEvent = (error) => {
+          emit({
+            type: isRead ? "db:read" : "db:write",
+            level: error ? "error" : "debug",
+            message: `${method}(${args.map(
+              (a) => typeof a === "string" ? a.slice(0, 24) : typeof a
+            ).join(", ")})`,
+            sessionId: typeof args[1] === "string" ? args[1] : void 0,
+            payload: {
+              method,
+              argTypes: args.map((a) => typeof a),
+              durationMs: performance.now() - start,
+              ...error ? { error } : {}
+            },
+            timestamp: Date.now()
+          });
+        };
+        try {
+          const result = original.apply(target, args);
+          if (result instanceof Promise) {
+            return result.then((r) => {
+              emitEvent();
+              return r;
+            }).catch((e) => {
+              emitEvent(String(e));
+              throw e;
+            });
+          }
+          emitEvent();
+          return result;
+        } catch (e) {
+          emitEvent(String(e));
+          throw e;
+        }
+      };
+    }
+  });
+}
 var sessions = new Proxy({}, {
   get(_target, prop) {
     return async (...args) => {
@@ -1866,6 +1934,24 @@ var sessions = new Proxy({}, {
 });
 
 // src/server/mcp/storage-oauth-provider.ts
+var codeVerifierContext = new AsyncLocalStorage();
+function runWithCodeVerifierState(verifier, method, fn) {
+  return codeVerifierContext.run({ verifier, method }, fn);
+}
+function base64UrlEncode(bytes) {
+  let binary = "";
+  for (const byte of bytes) {
+    binary += String.fromCharCode(byte);
+  }
+  return btoa(binary).replace(/\+/g, "-").replace(/\//g, "_").replace(/=+$/, "");
+}
+async function createCodeChallenge(verifier) {
+  const digest = await crypto.subtle.digest(
+    "SHA-256",
+    new TextEncoder().encode(verifier)
+  );
+  return base64UrlEncode(new Uint8Array(digest));
+}
 var StorageOAuthClientProvider = class {
   /**
    * Creates a new session-backed OAuth provider
@@ -1881,8 +1967,12 @@ var StorageOAuthClientProvider = class {
     __publicField(this, "logoUri");
     __publicField(this, "policyUri");
     __publicField(this, "clientSecret");
+    __publicField(this, "_store");
     __publicField(this, "_authUrl");
     __publicField(this, "_clientId");
+    __publicField(this, "_cachedCodeVerifier");
+    __publicField(this, "_hasCodeVerifier", false);
+    __publicField(this, "_cachedTokens");
     __publicField(this, "onRedirectCallback");
     this.userId = options.userId;
     this.serverId = options.serverId;
@@ -1894,6 +1984,8 @@ var StorageOAuthClientProvider = class {
     this.policyUri = options.policyUri;
     this._clientId = options.clientId;
     this.clientSecret = options.clientSecret;
+    this._cachedTokens = options.cachedTokens;
+    this._store = options.sessionStore ?? sessions;
     this.onRedirectCallback = options.onRedirect;
   }
   get clientMetadata() {
@@ -1921,7 +2013,7 @@ var StorageOAuthClientProvider = class {
    * @private
    */
   async getCredentials() {
-    const data = await sessions.getCredentials(this.userId, this.sessionId);
+    const data = await this._store.getCredentials(this.userId, this.sessionId);
     if (!data) {
       return { userId: this.userId, sessionId: this.sessionId };
     }
@@ -1934,26 +2026,33 @@ var StorageOAuthClientProvider = class {
    * @throws Error if session doesn't exist (session must be created by controller layer)
    */
   async patchCredentials(data) {
-    await sessions.patchCredentials(this.userId, this.sessionId, data);
+    await this._store.patchCredentials(this.userId, this.sessionId, data);
   }
   /**
-   * Retrieves stored OAuth client information
+   * Retrieves stored OAuth client information.
    */
   async clientInformation() {
-    const data = await this.getCredentials();
-    if (data.clientId && !this._clientId) {
-      this._clientId = data.clientId;
+    if (this._clientId) {
+      return {
+        client_id: this._clientId,
+        ...this.clientSecret ? { client_secret: this.clientSecret } : {}
+      };
     }
-    if (data.clientInformation) {
-      return data.clientInformation;
+    const data = await this.getCredentials();
+    if (this._cachedTokens === void 0) {
+      this._cachedTokens = data.tokens ?? null;
     }
-    if (!this._clientId) {
-      return void 0;
+    if (data.clientId) {
+      this._clientId = data.clientId;
+      if (data.clientInformation) {
+        return data.clientInformation;
+      }
+      return {
+        client_id: data.clientId,
+        ...this.clientSecret ? { client_secret: this.clientSecret } : {}
+      };
     }
-    return {
-      client_id: this._clientId,
-      ...this.clientSecret ? { client_secret: this.clientSecret } : {}
-    };
+    return void 0;
   }
   /**
    * Stores OAuth client information
@@ -1970,11 +2069,30 @@ var StorageOAuthClientProvider = class {
    */
   async saveTokens(tokens) {
     await this.patchCredentials({ tokens });
+    this._cachedTokens = tokens;
+  }
+  /**
+   * Persists static client credentials to DB immediately on creation.
+   * Ensures getOrCreateClient() finds them on rehydration, even when the
+   * server allows anonymous connect and never triggers DCR.
+   */
+  async initializeCredentials() {
+    if (this._clientId) {
+      await this.patchCredentials({
+        clientId: this._clientId,
+        clientInformation: {
+          client_id: this._clientId,
+          ...this.clientSecret ? { client_secret: this.clientSecret } : {}
+        }
+      });
+    }
   }
   get authUrl() {
     return this._authUrl;
   }
   async state() {
+    this._cachedCodeVerifier = void 0;
+    this._hasCodeVerifier = false;
     const nonce = nanoid(32);
     await this.patchCredentials({
       oauthState: {
@@ -1995,7 +2113,7 @@ var StorageOAuthClientProvider = class {
     if (parsed.sessionId !== this.sessionId) {
       return { valid: false, error: "OAuth state mismatch" };
     }
-    const data = await sessions.getCredentials(this.userId, parsed.sessionId);
+    const data = await this._store.getCredentials(this.userId, parsed.sessionId);
     if (!data) {
       return { valid: false, error: "Session not found" };
     }
@@ -2020,49 +2138,77 @@ var StorageOAuthClientProvider = class {
   }
   async redirectToAuthorization(authUrl) {
     this._authUrl = authUrl.toString();
-    await sessions.update(this.userId, this.sessionId, { authUrl: this._authUrl });
+    const codeChallenge = authUrl.searchParams.get("code_challenge");
+    const state = authUrl.searchParams.get("state");
+    if (this._cachedCodeVerifier && codeChallenge && state) {
+      const expectedChallenge = await createCodeChallenge(this._cachedCodeVerifier);
+      if (expectedChallenge === codeChallenge) {
+        const parsed = parseOAuthState(state);
+        if (parsed) {
+          await this.patchCredentials({
+            codeVerifier: this._cachedCodeVerifier
+          });
+        }
+      }
+    }
     if (this.onRedirectCallback) {
       this.onRedirectCallback(authUrl.toString());
     }
   }
   async invalidateCredentials(scope) {
     if (scope === "all") {
-      await sessions.delete(this.userId, this.sessionId);
+      this._cachedTokens = void 0;
+      await this._store.delete(this.userId, this.sessionId);
     } else {
       const updates = {};
       if (scope === "client") {
         updates.clientInformation = null;
         updates.clientId = null;
       } else if (scope === "tokens") {
+        this._cachedTokens = void 0;
         updates.tokens = null;
       } else if (scope === "verifier") {
+        this._cachedCodeVerifier = void 0;
+        this._hasCodeVerifier = false;
         updates.codeVerifier = null;
       }
       await this.patchCredentials(updates);
     }
   }
   async saveCodeVerifier(verifier) {
-    const data = await this.getCredentials();
-    if (data.codeVerifier) {
+    if (this._hasCodeVerifier) {
       return;
     }
-    await this.patchCredentials({ codeVerifier: verifier });
+    this._cachedCodeVerifier = verifier;
+    this._hasCodeVerifier = true;
   }
   async codeVerifier() {
-    const data = await this.getCredentials();
-    if (data.clientId && !this._clientId) {
-      this._clientId = data.clientId;
+    if (this._cachedCodeVerifier) {
+      return this._cachedCodeVerifier;
+    }
+    const ctx = codeVerifierContext.getStore();
+    if (ctx?.verifier) {
+      return ctx.verifier;
     }
-    if (!data.codeVerifier) {
-      throw new Error("No code verifier found");
+    const data = await this.getCredentials();
+    if (data.codeVerifier) {
+      return data.codeVerifier;
     }
-    return data.codeVerifier;
+    throw new Error("No code verifier found");
   }
   async deleteCodeVerifier() {
-    await this.patchCredentials({ codeVerifier: null });
+    this._cachedCodeVerifier = void 0;
+    this._hasCodeVerifier = false;
+    await this.patchCredentials({
+      codeVerifier: null
+    });
   }
   async tokens() {
+    if (this._cachedTokens !== void 0) {
+      return this._cachedTokens ?? void 0;
+    }
     const data = await this.getCredentials();
+    this._cachedTokens = data.tokens ?? null;
     if (data.clientId && !this._clientId) {
       this._clientId = data.clientId;
     }
@@ -2223,23 +2369,10 @@ var MCPClient = class {
     __publicField(this, "client");
     __publicField(this, "oauthProvider", null);
     __publicField(this, "transport", null);
-    __publicField(this, "userId");
-    __publicField(this, "serverId");
-    __publicField(this, "sessionId");
-    __publicField(this, "serverName");
-    __publicField(this, "transportType");
-    __publicField(this, "serverUrl");
-    __publicField(this, "callbackUrl");
-    __publicField(this, "onRedirect");
-    __publicField(this, "clientId");
-    __publicField(this, "clientSecret");
-    __publicField(this, "headers");
-    /** OAuth Client Metadata */
-    __publicField(this, "clientName");
-    __publicField(this, "clientUri");
-    __publicField(this, "logoUri");
-    __publicField(this, "policyUri");
+    __publicField(this, "config");
     __publicField(this, "createdAt");
+    __publicField(this, "_serverInfo");
+    __publicField(this, "_store");
     /** Event emitters for connection lifecycle */
     __publicField(this, "_onConnectionEvent", new Emitter());
     __publicField(this, "onConnectionEvent", this._onConnectionEvent.event);
@@ -2255,21 +2388,8 @@ var MCPClient = class {
      * the memory when the client is no longer needed.
      */
     __publicField(this, "cachedTools", null);
-    this.serverUrl = options.serverUrl;
-    this.serverName = options.serverName;
-    this.callbackUrl = options.callbackUrl;
-    this.onRedirect = options.onRedirect;
-    this.userId = options.userId;
-    this.serverId = options.serverId;
-    this.sessionId = options.sessionId;
-    this.transportType = options.transportType;
-    this.clientId = options.clientId;
-    this.clientSecret = options.clientSecret;
-    this.headers = options.headers;
-    this.clientName = options.clientName;
-    this.clientUri = options.clientUri;
-    this.logoUri = options.logoUri;
-    this.policyUri = options.policyUri;
+    this.config = { ...options };
+    this._store = options.sessionStore ?? sessions;
     this.client = new Client(
       {
         name: MCP_CLIENT_NAME,
@@ -2286,6 +2406,21 @@ var MCPClient = class {
       }
     );
   }
+  /** Shared session-shaped data for ensureSession and saveSession */
+  get session() {
+    return {
+      sessionId: this.config.sessionId,
+      userId: this.config.userId,
+      serverId: this.config.serverId,
+      serverName: this.config.serverName,
+      serverUrl: this.config.serverUrl,
+      callbackUrl: this.config.callbackUrl,
+      transportType: this.config.transportType || "streamable-http",
+      headers: this.config.headers,
+      createdAt: this.createdAt ?? Date.now(),
+      updatedAt: Date.now()
+    };
+  }
   /**
    * Emit a connection state change event
    * @private
@@ -2293,13 +2428,13 @@ var MCPClient = class {
   emitStateChange(newState) {
     const previousState = this.currentState;
     this.currentState = newState;
-    if (!this.serverId) return;
+    if (!this.config.serverId) return;
     this._onConnectionEvent.fire({
       type: "state_changed",
-      sessionId: this.sessionId,
-      serverId: this.serverId,
-      serverName: this.serverName || this.serverId,
-      serverUrl: this.serverUrl || "",
+      sessionId: this.config.sessionId,
+      serverId: this.config.serverId,
+      serverName: this.config.serverName || this.config.serverId,
+      serverUrl: this.config.serverUrl || "",
       createdAt: this.createdAt,
       state: newState,
       previousState,
@@ -2310,8 +2445,8 @@ var MCPClient = class {
       level: "info",
       message: `Connection state: ${previousState} \u2192 ${newState}`,
       displayMessage: `State changed to ${newState}`,
-      sessionId: this.sessionId,
-      serverId: this.serverId,
+      sessionId: this.config.sessionId,
+      serverId: this.config.serverId,
       payload: { previousState, newState },
       timestamp: Date.now(),
       id: nanoid()
@@ -2322,11 +2457,11 @@ var MCPClient = class {
    * @private
    */
   emitError(error, errorType = "unknown") {
-    if (!this.serverId) return;
+    if (!this.config.serverId) return;
     this._onConnectionEvent.fire({
       type: "error",
-      sessionId: this.sessionId,
-      serverId: this.serverId,
+      sessionId: this.config.sessionId,
+      serverId: this.config.serverId,
       error,
       errorType,
       timestamp: Date.now()
@@ -2336,8 +2471,8 @@ var MCPClient = class {
       level: "error",
       message: error,
       displayMessage: error,
-      sessionId: this.sessionId,
-      serverId: this.serverId,
+      sessionId: this.config.sessionId,
+      serverId: this.config.serverId,
       payload: { errorType, error },
       timestamp: Date.now(),
       id: nanoid()
@@ -2348,11 +2483,11 @@ var MCPClient = class {
    * @private
    */
   emitProgress(message) {
-    if (!this.serverId) return;
+    if (!this.config.serverId) return;
     this._onConnectionEvent.fire({
       type: "progress",
-      sessionId: this.sessionId,
-      serverId: this.serverId,
+      sessionId: this.config.sessionId,
+      serverId: this.config.serverId,
       message,
       timestamp: Date.now()
     });
@@ -2370,14 +2505,14 @@ var MCPClient = class {
    * @private
    */
   getTransport(type) {
-    if (!this.serverUrl) {
+    if (!this.config.serverUrl) {
       throw new Error("Server URL is required to create transport");
     }
-    const baseUrl = new URL(this.serverUrl);
-    const hasAuthorizationHeader = Object.keys(this.headers || {}).some((key) => key.toLowerCase() === "authorization");
+    const baseUrl = new URL(this.config.serverUrl);
+    const hasAuthorizationHeader = Object.keys(this.config.headers || {}).some((key) => key.toLowerCase() === "authorization");
     const transportOptions = {
       ...!hasAuthorizationHeader && { authProvider: this.oauthProvider },
-      ...this.headers && { requestInit: { headers: this.headers } },
+      ...this.config.headers && { requestInit: { headers: this.config.headers } },
       /**
        * Custom fetch implementation to handle connection timeouts.
        * Observation: SDK 1.24.0+ connections may hang indefinitely in some environments.
@@ -2415,78 +2550,74 @@ var MCPClient = class {
    * @private
    */
   async ensureSession() {
-    if (this.oauthProvider) {
-      return;
-    }
+    if (this.oauthProvider) return;
     this.emitStateChange("INITIALIZING");
     this.emitProgress("Loading session configuration...");
-    let existingSession = null;
-    if (!this.serverUrl || !this.callbackUrl || !this.serverId) {
-      existingSession = await sessions.get(this.userId, this.sessionId);
-      if (!existingSession) {
-        throw new Error(`Session not found: ${this.sessionId}`);
+    if (!this.config.serverUrl || !this.config.callbackUrl || !this.config.serverId) {
+      const existingSession2 = await this._store.get(this.config.userId, this.config.sessionId);
+      if (!existingSession2) {
+        throw new Error(`Session not found: ${this.config.sessionId}`);
       }
-      this.serverUrl = this.serverUrl || existingSession.serverUrl;
-      this.callbackUrl = this.callbackUrl || existingSession.callbackUrl;
-      this.serverName = this.serverName || existingSession.serverName;
-      this.serverId = this.serverId || existingSession.serverId || "unknown";
-      this.headers = this.headers || existingSession.headers;
-      this.createdAt = existingSession.createdAt;
-    }
-    if (!this.serverUrl || !this.callbackUrl || !this.serverId) {
+      this.config.serverUrl = this.config.serverUrl || existingSession2.serverUrl;
+      this.config.callbackUrl = this.config.callbackUrl || existingSession2.callbackUrl;
+      this.config.serverName = this.config.serverName || existingSession2.serverName;
+      this.config.serverId = this.config.serverId || existingSession2.serverId || "unknown";
+      this.config.headers = this.config.headers || existingSession2.headers;
+      this.createdAt = existingSession2.createdAt;
+    }
+    if (!this.config.serverUrl || !this.config.callbackUrl || !this.config.serverId) {
       throw new Error("Missing required connection metadata");
     }
-    if (!this.oauthProvider) {
-      if (!this.serverId) {
-        throw new Error("serverId required for OAuth provider initialization");
-      }
-      this.oauthProvider = new StorageOAuthClientProvider({
-        userId: this.userId,
-        serverId: this.serverId,
-        sessionId: this.sessionId,
-        redirectUrl: this.callbackUrl,
-        clientName: this.clientName,
-        clientUri: this.clientUri,
-        logoUri: this.logoUri,
-        policyUri: this.policyUri,
-        clientId: this.clientId,
-        clientSecret: this.clientSecret,
-        onRedirect: (redirectUrl) => {
-          if (this.onRedirect) {
-            this.onRedirect(redirectUrl);
-          }
+    this.oauthProvider = new StorageOAuthClientProvider({
+      userId: this.config.userId,
+      serverId: this.config.serverId,
+      sessionId: this.config.sessionId,
+      redirectUrl: this.config.callbackUrl,
+      clientName: this.config.clientName,
+      clientUri: this.config.clientUri,
+      logoUri: this.config.logoUri,
+      policyUri: this.config.policyUri,
+      clientId: this.config.clientId,
+      clientSecret: this.config.clientSecret,
+      cachedTokens: this.config.cachedCredentials?.tokens,
+      sessionStore: this._store,
+      onRedirect: (redirectUrl) => {
+        if (this.config.serverId) {
+          this._onConnectionEvent.fire({
+            type: "auth_required",
+            sessionId: this.config.sessionId,
+            serverId: this.config.serverId,
+            authUrl: redirectUrl,
+            timestamp: Date.now()
+          });
         }
-      });
-    }
-    if (existingSession === null) {
-      existingSession = await sessions.get(this.userId, this.sessionId);
-    }
-    if (!existingSession && this.serverId && this.serverUrl && this.callbackUrl) {
+        if (this.config.onRedirect) {
+          this.config.onRedirect(redirectUrl);
+        }
+      }
+    });
+    const existingSession = this.config.hasSession ? {} : await this._store.get(this.config.userId, this.config.sessionId);
+    if (!existingSession) {
       this.createdAt = Date.now();
       const updatedAt = this.createdAt;
       this._onObservabilityEvent.fire({
         type: "mcp:client:session_created",
         level: "info",
-        message: `Creating pending session ${this.sessionId} for connection setup`,
-        sessionId: this.sessionId,
-        serverId: this.serverId,
+        message: `Creating pending session ${this.config.sessionId} for connection setup`,
+        sessionId: this.config.sessionId,
+        serverId: this.config.serverId,
         timestamp: Date.now(),
         id: nanoid()
       });
-      await sessions.create({
-        sessionId: this.sessionId,
-        userId: this.userId,
-        serverId: this.serverId,
-        serverName: this.serverName,
-        serverUrl: this.serverUrl,
-        callbackUrl: this.callbackUrl,
-        transportType: this.transportType || "streamable-http",
-        headers: this.headers,
-        createdAt: this.createdAt,
+      await this._store.create({
+        ...this.session,
         updatedAt,
         status: "pending"
       });
     }
+    if (!existingSession && this.oauthProvider instanceof StorageOAuthClientProvider) {
+      await this.oauthProvider.initializeCredentials();
+    }
   }
   /**
    * Saves current session state to the session store
@@ -2494,34 +2625,14 @@ var MCPClient = class {
    * @param status - Session lifecycle status used by storage cleanup
    * @private
    */
-  async saveSession(status = "active", existingSession) {
-    if (!this.sessionId || !this.serverId || !this.serverUrl || !this.callbackUrl) {
+  async saveSession(status = "active") {
+    if (!this.config.sessionId || !this.config.serverId || !this.config.serverUrl || !this.config.callbackUrl) {
       return;
     }
-    const sessionData = {
-      sessionId: this.sessionId,
-      userId: this.userId,
-      serverId: this.serverId,
-      serverName: this.serverName,
-      serverUrl: this.serverUrl,
-      callbackUrl: this.callbackUrl,
-      transportType: this.transportType || "streamable-http",
-      headers: this.headers,
-      createdAt: this.createdAt || Date.now(),
-      updatedAt: Date.now(),
+    await this._store.update(this.config.userId, this.config.sessionId, {
+      ...this.session,
       status
-    };
-    if (status === "active") {
-      sessionData.authUrl = null;
-    }
-    if (existingSession === void 0) {
-      existingSession = await sessions.get(this.userId, this.sessionId);
-    }
-    if (existingSession) {
-      await sessions.update(this.userId, this.sessionId, sessionData);
-    } else {
-      await sessions.create(sessionData);
-    }
+    });
   }
   /**
    * Removes transient setup/auth sessions without masking the original error.
@@ -2529,7 +2640,7 @@ var MCPClient = class {
    */
   async deleteTransientSession() {
     try {
-      await sessions.delete(this.userId, this.sessionId);
+      await this._store.delete(this.config.userId, this.config.sessionId);
     } catch {
     }
   }
@@ -2539,7 +2650,7 @@ var MCPClient = class {
    * @private
    */
   async tryConnect() {
-    const transportsToTry = this.transportType ? [this.transportType] : ["streamable-http", "sse"];
+    const transportsToTry = this.config.transportType ? [this.config.transportType] : ["streamable-http", "sse"];
     let lastError;
     for (const currentType of transportsToTry) {
       const isLastAttempt = currentType === transportsToTry[transportsToTry.length - 1];
@@ -2547,6 +2658,7 @@ var MCPClient = class {
         const transport = this.getTransport(currentType);
         this.transport = transport;
         await this.client.connect(transport);
+        this._serverInfo = this.client.getServerVersion();
         return { transportType: currentType };
       } catch (error) {
         lastError = error;
@@ -2562,8 +2674,8 @@ var MCPClient = class {
         this._onObservabilityEvent.fire({
           level: "warn",
           message: `Transport ${currentType} failed, falling back`,
-          sessionId: this.sessionId,
-          serverId: this.serverId,
+          sessionId: this.config.sessionId,
+          serverId: this.config.serverId,
           metadata: {
             failedTransport: currentType,
             error: errorMessage
@@ -2606,15 +2718,15 @@ var MCPClient = class {
     try {
       this.emitStateChange("CONNECTING");
       const { transportType } = await this.tryConnect();
-      this.transportType = transportType;
+      this.config.transportType = transportType;
       this.emitStateChange("CONNECTED");
       this.emitProgress("Connected successfully");
       this._onObservabilityEvent.fire({
         type: "mcp:client:session_saved",
         level: "info",
-        message: `Saving active session ${this.sessionId} (connect success)`,
-        sessionId: this.sessionId,
-        serverId: this.serverId,
+        message: `Saving active session ${this.config.sessionId} (connect success)`,
+        sessionId: this.config.sessionId,
+        serverId: this.config.serverId,
         timestamp: Date.now(),
         id: nanoid()
       });
@@ -2637,23 +2749,23 @@ var MCPClient = class {
         this._onObservabilityEvent.fire({
           type: "mcp:client:session_saved",
           level: "info",
-          message: `Saving pending OAuth session ${this.sessionId}`,
-          sessionId: this.sessionId,
-          serverId: this.serverId,
+          message: `Saving pending OAuth session ${this.config.sessionId}`,
+          sessionId: this.config.sessionId,
+          serverId: this.config.serverId,
           timestamp: Date.now(),
           id: nanoid()
         });
         await this.saveSession("pending");
-        if (this.serverId) {
+        if (this.config.serverId) {
           this._onConnectionEvent.fire({
             type: "auth_required",
-            sessionId: this.sessionId,
-            serverId: this.serverId,
+            sessionId: this.config.sessionId,
+            serverId: this.config.serverId,
             authUrl,
             timestamp: Date.now()
           });
-          if (authUrl && this.onRedirect) {
-            this.onRedirect(authUrl);
+          if (authUrl && this.config.onRedirect) {
+            this.config.onRedirect(authUrl);
           }
         }
         throw new UnauthorizedError("OAuth authorization required");
@@ -2662,9 +2774,9 @@ var MCPClient = class {
       this.emitError(errorMessage, "connection");
       this.emitStateChange("FAILED");
       try {
-        const existingSession = await sessions.get(this.userId, this.sessionId);
+        const existingSession = await this._store.get(this.config.userId, this.config.sessionId);
         if (!existingSession || existingSession.status !== "active") {
-          await sessions.delete(this.userId, this.sessionId);
+          await this._store.delete(this.config.userId, this.config.sessionId);
         }
       } catch {
       }
@@ -2689,16 +2801,16 @@ var MCPClient = class {
       throw new Error(error);
     }
     if (state) {
-      const stateCheck = await this.oauthProvider.checkState(state);
-      if (!stateCheck.valid) {
-        const error = stateCheck.error || "Invalid OAuth state";
-        this.emitError(error, "auth");
+      try {
+        await this.oauthProvider.consumeState(state);
+      } catch (error) {
+        const msg = error instanceof Error ? error.message : "Invalid OAuth state";
+        this.emitError(msg, "auth");
         this.emitStateChange("FAILED");
-        throw new Error(error);
+        throw error;
       }
-      await this.oauthProvider.consumeState(state);
     }
-    const transportsToTry = this.transportType ? [this.transportType] : ["streamable-http", "sse"];
+    const transportsToTry = this.config.transportType ? [this.config.transportType] : ["streamable-http", "sse"];
     let lastError;
     let tokensExchanged = false;
     let authenticatedStateEmitted = false;
@@ -2725,14 +2837,15 @@ var MCPClient = class {
           }
         }
         await this.client.connect(this.transport);
-        this.transportType = currentType;
+        this._serverInfo = this.client.getServerVersion();
+        this.config.transportType = currentType;
         this.emitStateChange("CONNECTED");
         this._onObservabilityEvent.fire({
           type: "mcp:client:session_saved",
           level: "info",
-          message: `Saving active session ${this.sessionId} (OAuth complete)`,
-          sessionId: this.sessionId,
-          serverId: this.serverId,
+          message: `Saving active session ${this.config.sessionId} (OAuth complete)`,
+          sessionId: this.config.sessionId,
+          serverId: this.config.serverId,
           timestamp: Date.now(),
           id: nanoid()
         });
@@ -2805,11 +2918,11 @@ var MCPClient = class {
     this.emitStateChange("DISCOVERING");
     try {
       const result = await this.fetchTools();
-      if (this.serverId) {
+      if (this.config.serverId) {
         this._onConnectionEvent.fire({
           type: "tools_discovered",
-          sessionId: this.sessionId,
-          serverId: this.serverId,
+          sessionId: this.config.sessionId,
+          serverId: this.config.serverId,
           toolCount: result.tools.length,
           tools: result.tools,
           timestamp: Date.now()
@@ -2849,8 +2962,8 @@ var MCPClient = class {
         level: "info",
         message: `Tool ${toolName} called successfully`,
         displayMessage: `Called tool ${toolName}`,
-        sessionId: this.sessionId,
-        serverId: this.serverId,
+        sessionId: this.config.sessionId,
+        serverId: this.config.serverId,
         payload: {
           toolName,
           args: toolArgs
@@ -2866,8 +2979,8 @@ var MCPClient = class {
         level: "error",
         message: errorMessage,
         displayMessage: `Failed to call tool ${toolName}`,
-        sessionId: this.sessionId,
-        serverId: this.serverId,
+        sessionId: this.config.sessionId,
+        serverId: this.config.serverId,
         payload: {
           errorType: "tool_execution",
           error: errorMessage,
@@ -3015,8 +3128,8 @@ var MCPClient = class {
         type: "mcp:client:error",
         level: "warn",
         message: "Initialization failed during clearSession",
-        sessionId: this.sessionId,
-        serverId: this.serverId,
+        sessionId: this.config.sessionId,
+        serverId: this.config.serverId,
         payload: { error: String(error) },
         timestamp: Date.now(),
         id: nanoid()
@@ -3025,7 +3138,7 @@ var MCPClient = class {
     if (this.oauthProvider) {
       await this.oauthProvider.invalidateCredentials("all");
     }
-    await sessions.delete(this.userId, this.sessionId);
+    await this._store.delete(this.config.userId, this.config.sessionId);
     await this.disconnect();
   }
   /**
@@ -3059,19 +3172,19 @@ var MCPClient = class {
     }
     this.oauthProvider = null;
     this.transport = null;
-    if (this.serverId) {
+    if (this.config.serverId) {
       this._onConnectionEvent.fire({
         type: "disconnected",
-        sessionId: this.sessionId,
-        serverId: this.serverId,
+        sessionId: this.config.sessionId,
+        serverId: this.config.serverId,
         timestamp: Date.now()
       });
       this._onObservabilityEvent.fire({
         type: "mcp:client:disconnect",
         level: "info",
-        message: `Disconnected from ${this.serverId}`,
-        sessionId: this.sessionId,
-        serverId: this.serverId,
+        message: `Disconnected from ${this.config.serverId}`,
+        sessionId: this.config.sessionId,
+        serverId: this.config.serverId,
         payload: {},
         timestamp: Date.now(),
         id: nanoid()
@@ -3096,42 +3209,52 @@ var MCPClient = class {
    * @returns Server URL or empty string if not set
    */
   getServerUrl() {
-    return this.serverUrl || "";
+    return this.config.serverUrl || "";
   }
   /**
    * Gets the OAuth callback URL
    * @returns Callback URL or empty string if not set
    */
   getCallbackUrl() {
-    return this.callbackUrl || "";
+    return this.config.callbackUrl || "";
   }
   /**
    * Gets the transport type being used
    * @returns Transport type (defaults to 'streamable-http')
    */
   getTransportType() {
-    return this.transportType || "streamable-http";
+    return this.config.transportType || "streamable-http";
+  }
+  /**
+   * Gets the full server metadata from the MCP initialize response.
+   * Includes name, version, icons, title, description, and website URL.
+   * Returns undefined if the client hasn't connected yet.
+   */
+  getServerInfo() {
+    return this._serverInfo;
   }
   /**
-   * Gets the human-readable server name
+   * Gets the human-readable server name.
+   * Prefers the server's reported title/name from the initialize response,
+   * falling back to the name provided at construction or session metadata.
    * @returns Server name or undefined
    */
   getServerName() {
-    return this.serverName;
+    return this.config.serverName;
   }
   /**
    * Gets the server ID
    * @returns Server ID or undefined
    */
   getServerId() {
-    return this.serverId;
+    return this.config.serverId;
   }
   /**
    * Gets the session ID
    * @returns Session ID
    */
   getSessionId() {
-    return this.sessionId;
+    return this.config.sessionId;
   }
 };
 
@@ -3154,6 +3277,14 @@ var ToolPolicyGateway = class {
   getServerId() {
     return this.client.getServerId?.();
   }
+  /**
+   * Returns the full server metadata from the underlying client, if available.
+   * Includes name, version, icons, title, description, and website URL.
+   * Available only after the client has connected and completed initialization.
+   */
+  getServerInfo() {
+    return this.client.getServerInfo?.();
+  }
   /**
    * Returns the human-readable server name from the underlying client, if available.
    */
@@ -3282,6 +3413,7 @@ var MultiSessionClient = class {
     __publicField(this, "connectionPromises", /* @__PURE__ */ new Map());
     __publicField(this, "userId");
     __publicField(this, "options");
+    __publicField(this, "_store");
     this.userId = userId;
     this.options = {
       timeout: DEFAULT_TIMEOUT_MS,
@@ -3289,6 +3421,7 @@ var MultiSessionClient = class {
       retryDelay: DEFAULT_RETRY_DELAY_MS,
       ...options
     };
+    this._store = options.onObservabilityEvent ? withDbObservability(options.sessionStore ?? sessions, options.onObservabilityEvent) : options.sessionStore ?? sessions;
   }
   // -----------------------------------------------------------------------
   // Public API
@@ -3372,9 +3505,9 @@ var MultiSessionClient = class {
    * to querying the storage backend via `sessions.list(userId)`.
    */
   async fetchActiveSessions() {
-    const sessionList = this.options.sessionProvider ? await this.options.sessionProvider() : await sessions.list(this.userId);
+    const sessionList = this.options.sessionProvider ? await this.options.sessionProvider() : await this._store.list(this.userId);
     return sessionList.filter(
-      (s) => s.serverId && s.serverUrl && s.callbackUrl && s.status === "active"
+      (s) => s.serverId && s.serverUrl && s.callbackUrl && s.status === "active" && s.enabled !== false
     );
   }
   /**
@@ -3447,8 +3580,13 @@ var MultiSessionClient = class {
           callbackUrl: session.callbackUrl,
           serverName: session.serverName,
           transportType: session.transportType,
-          headers: session.headers
+          headers: session.headers,
+          hasSession: true,
+          sessionStore: this._store
         });
+        if (this.options.onObservabilityEvent) {
+          client.onObservabilityEvent(this.options.onObservabilityEvent);
+        }
         const timeoutMs = this.options.timeout;
         let timeoutTimer;
         const timeoutPromise = new Promise((_, reject) => {
@@ -3503,130 +3641,188 @@ function isConnectionEvent(event) {
 }
 
 // src/server/handlers/sse-handler.ts
-var DEFAULT_HEARTBEAT_INTERVAL = 3e4;
+var DEFAULT_HEARTBEAT_MS = 3e4;
 function normalizeHeaders(headers) {
   if (!headers || typeof headers !== "object") return void 0;
-  const entries = Object.entries(headers).map(([key, value]) => [key.trim(), String(value).trim()]).filter(([key, value]) => key.length > 0 && value.length > 0);
+  const entries = Object.entries(headers).map(([k, v]) => [k.trim(), String(v).trim()]).filter(([k, v]) => k.length > 0 && v.length > 0);
   return entries.length > 0 ? Object.fromEntries(entries) : void 0;
 }
+function validatingStateEvent(sessionId, session) {
+  return {
+    type: "state_changed",
+    sessionId,
+    serverId: session.serverId ?? "unknown",
+    serverName: session.serverName ?? "Unknown",
+    serverUrl: session.serverUrl,
+    state: "VALIDATING",
+    previousState: "DISCONNECTED",
+    timestamp: Date.now()
+  };
+}
+function connectionErrorEvent(sessionId, serverId, error, errorType) {
+  return {
+    type: "error",
+    sessionId,
+    serverId: serverId ?? "unknown",
+    error: error instanceof Error ? error.message : "Connection failed",
+    errorType,
+    timestamp: Date.now()
+  };
+}
 var SSEConnectionManager = class {
+  // -----------------------------------------------------------------------
+  // Constructor
+  // -----------------------------------------------------------------------
+  /**
+   * @param options  - Handler configuration (userId, auth, metadata, heartbeat, observability).
+   * @param sendEvent - Callback that writes a typed event onto the SSE stream.
+   */
   constructor(options, sendEvent) {
     this.options = options;
     this.sendEvent = sendEvent;
+    // -----------------------------------------------------------------------
+    // State
+    // -----------------------------------------------------------------------
     __publicField(this, "userId");
+    /** Active MCP transports keyed by sessionId. */
     __publicField(this, "clients", /* @__PURE__ */ new Map());
+    /** Instrumented session store — always wraps `sessions` with DB observability. */
+    __publicField(this, "observedStore");
     __publicField(this, "heartbeatTimer");
-    __publicField(this, "isActive", true);
+    __publicField(this, "active", true);
     this.userId = options.userId;
+    this.observedStore = withDbObservability(sessions, (event) => this.sendEvent(event));
     this.startHeartbeat();
   }
+  // -----------------------------------------------------------------------
+  // Public API
+  // -----------------------------------------------------------------------
   /**
-   * Get resolved client metadata (dynamic > static > defaults)
-   */
-  async getResolvedClientMetadata(request) {
-    let metadata = {};
-    if (this.options.clientDefaults) {
-      metadata = { ...this.options.clientDefaults };
-    }
-    if (this.options.getClientMetadata) {
-      const dynamicMetadata = await this.options.getClientMetadata(request);
-      metadata = { ...metadata, ...dynamicMetadata };
-    }
-    return metadata;
-  }
-  /**
-   * Start heartbeat to keep connection alive
-   */
-  startHeartbeat() {
-    const interval = this.options.heartbeatInterval ?? DEFAULT_HEARTBEAT_INTERVAL;
-    this.heartbeatTimer = setInterval(() => {
-      if (this.isActive) {
-        this.sendEvent({
-          level: "debug",
-          message: "heartbeat",
-          timestamp: Date.now()
-        });
-      }
-    }, interval);
-  }
-  /**
-   * Handle incoming RPC requests
-   * Returns the RPC response directly for immediate HTTP response (bypassing SSE latency)
+   * Dispatches an incoming RPC request, emits timing observability,
+   * and returns the response.
+   *
+   * Emits `rpc:start` before dispatch and `rpc:end` on completion
+   * (success or error), each carrying the method name, sessionId, and
+   * duration. All events flow through the unified `onObservability`
+   * and the SSE stream.
+   *
+   * @param request - The deserialized RPC envelope.
+   * @returns The RPC response (success or error).
    */
   async handleRequest(request) {
+    const method = request.method;
+    const sessionId = request.params?.sessionId;
+    const t0 = performance.now();
+    this.sendEvent({
+      type: "rpc:start",
+      level: "debug",
+      message: method,
+      sessionId,
+      timestamp: Date.now()
+    });
     try {
-      let result;
-      switch (request.method) {
-        case "listSessions":
-          result = await this.listSessions();
-          break;
-        case "connect":
-          result = await this.connect(request.params);
-          break;
-        case "reconnect":
-          result = await this.reconnect(request.params);
-          break;
-        case "disconnect":
-          result = await this.disconnect(request.params);
-          break;
-        case "listTools":
-          result = await this.listTools(request.params);
-          break;
-        case "setToolPolicy":
-          result = await this.setToolPolicy(request.params);
-          break;
-        case "getToolPolicy":
-          result = await this.getToolPolicy(request.params);
-          break;
-        case "callTool":
-          result = await this.callTool(request.params);
-          break;
-        case "getSession":
-          result = await this.getSession(request.params);
-          break;
-        case "finishAuth":
-          result = await this.finishAuth(request.params);
-          break;
-        case "listPrompts":
-          result = await this.listPrompts(request.params);
-          break;
-        case "getPrompt":
-          result = await this.getPrompt(request.params);
-          break;
-        case "listResources":
-          result = await this.listResources(request.params);
-          break;
-        case "readResource":
-          result = await this.readResource(request.params);
-          break;
-        default:
-          throw new Error(`Unknown method: ${request.method}`);
-      }
-      const response = {
-        id: request.id,
-        result
-      };
+      const result = await this.dispatchImpl(request);
+      this.sendEvent({
+        type: "rpc:end",
+        level: "debug",
+        message: method,
+        sessionId,
+        payload: { durationMs: performance.now() - t0 },
+        timestamp: Date.now()
+      });
+      const response = { id: request.id, result };
       this.sendEvent(response);
       return response;
     } catch (error) {
-      const errorResponse = {
+      this.sendEvent({
+        type: "rpc:end",
+        level: "error",
+        message: method,
+        sessionId,
+        payload: { durationMs: performance.now() - t0, error: String(error) },
+        timestamp: Date.now()
+      });
+      const response = {
         id: request.id,
         error: {
           code: RpcErrorCodes.EXECUTION_ERROR,
           message: error instanceof Error ? error.message : "Unknown error"
         }
       };
-      this.sendEvent(errorResponse);
-      return errorResponse;
+      this.sendEvent(response);
+      return response;
+    }
+  }
+  /**
+   * Tears down all active MCP transports and stops the heartbeat timer.
+   *
+   * Disconnects are issued in parallel across all sessions. After calling
+   * this method the manager instance should be discarded.
+   */
+  async dispose() {
+    this.active = false;
+    if (this.heartbeatTimer) clearInterval(this.heartbeatTimer);
+    await Promise.all(
+      Array.from(this.clients.values()).map((c) => c.disconnect())
+    );
+    this.clients.clear();
+  }
+  // -----------------------------------------------------------------------
+  // RPC Dispatch (raw — called by handleRequest which adds timing)
+  // -----------------------------------------------------------------------
+  /**
+   * Routes an RPC method name to the appropriate private handler.
+   *
+   * @throws {Error} When the method name is unrecognized.
+   */
+  async dispatchImpl(request) {
+    switch (request.method) {
+      case "listSessions":
+        return this.listSessions();
+      case "connect":
+        return this.connect(request.params);
+      case "reconnect":
+        return this.reconnect(request.params);
+      case "disconnect":
+        return this.disconnect(request.params);
+      case "listTools":
+        return this.listTools(request.params);
+      case "setToolPolicy":
+        return this.setToolPolicy(request.params);
+      case "getToolPolicy":
+        return this.getToolPolicy(request.params);
+      case "updateSession":
+        return this.updateSession(request.params);
+      case "callTool":
+        return this.callTool(request.params);
+      case "getSession":
+        return this.getSession(request.params);
+      case "finishAuth":
+        return this.finishAuth(request.params);
+      case "listPrompts":
+        return this.listPrompts(request.params);
+      case "getPrompt":
+        return this.getPrompt(request.params);
+      case "listResources":
+        return this.listResources(request.params);
+      case "readResource":
+        return this.readResource(request.params);
+      default:
+        throw new Error(`Unknown RPC method: ${request.method}`);
     }
   }
+  // -----------------------------------------------------------------------
+  // Session Query
+  // -----------------------------------------------------------------------
   /**
-   * Get all sessions for the current userId
+   * Lists all sessions owned by the current user.
+   *
+   * Returns a lightweight view — session metadata only, no credential fields.
    */
   async listSessions() {
-    const sessionList = await sessions.list(this.userId);
+    const all = await sessions.list(this.userId);
     return {
-      sessions: sessionList.map((s) => ({
+      sessions: all.map((s) => ({
         sessionId: s.sessionId,
         serverId: s.serverId,
         serverName: s.serverName,
@@ -3635,211 +3831,203 @@ var SSEConnectionManager = class {
         createdAt: s.createdAt,
         updatedAt: s.updatedAt ?? s.createdAt,
         status: s.status ?? "pending",
-        toolPolicy: s.toolPolicy
+        toolPolicy: s.toolPolicy,
+        enabled: s.enabled ?? true
       }))
     };
   }
   /**
-   * Connect to an MCP server
+   * Restores and validates a previously persisted session.
+   *
+   * Loads the full session row (including credentials) from storage, creates
+   * a new MCP transport, connects to the remote server, and emits the
+   * discovered (policy-filtered) tool list via SSE.
    */
-  async connect(params) {
-    const { serverName, serverUrl, callbackUrl, transportType } = params;
-    const headers = normalizeHeaders(params.headers);
-    const serverId = params.serverId && params.serverId.length <= 12 ? params.serverId : generateServerId();
-    const existingSessions = await sessions.list(this.userId);
-    const duplicate = existingSessions.find(
-      (s) => s.serverId === serverId || s.serverUrl === serverUrl
-    );
-    if (duplicate) {
-      if (duplicate.status === "pending") {
-        await this.getSession({ sessionId: duplicate.sessionId });
-        return {
-          sessionId: duplicate.sessionId,
-          success: true
-        };
-      }
-      throw new Error(`Connection already exists for server: ${duplicate.serverUrl || duplicate.serverId} (${duplicate.serverName})`);
-    }
-    const sessionId = await sessions.generateSessionId();
+  async getSession(params) {
+    const session = await this.requireSession(params.sessionId);
+    this.sendEvent(validatingStateEvent(params.sessionId, session));
     try {
-      const clientMetadata = await this.getResolvedClientMetadata();
-      const client = new MCPClient({
-        userId: this.userId,
-        sessionId,
-        serverId,
-        serverName,
-        serverUrl,
-        callbackUrl,
-        transportType,
-        headers,
-        ...clientMetadata
-        // Spread client metadata (clientName, clientUri, logoUri, policyUri)
-      });
-      this.clients.set(sessionId, client);
-      client.onConnectionEvent((event) => {
-        this.emitConnectionEvent(event);
-      });
-      client.onObservabilityEvent((event) => {
-        this.sendEvent(event);
-      });
+      const client = this.restoreClient(session);
+      this.attachClientEvents(client);
       await client.connect();
-      await this.listPolicyFilteredTools(sessionId);
-      return {
-        sessionId,
-        success: true
-      };
+      this.clients.set(params.sessionId, client);
+      const { result } = await this.listPolicyFilteredTools(params.sessionId);
+      return { success: true, toolCount: result.tools.length };
     } catch (error) {
-      if (error instanceof UnauthorizedError) {
-        this.clients.delete(sessionId);
-        return {
-          sessionId,
-          success: true
-        };
-      }
-      this.emitConnectionEvent({
-        type: "error",
-        sessionId,
-        serverId,
-        error: error instanceof Error ? error.message : "Connection failed",
-        errorType: "connection",
-        timestamp: Date.now()
-      });
-      this.clients.delete(sessionId);
+      this.sendEvent(connectionErrorEvent(params.sessionId, session.serverId, error, "validation"));
       throw error;
     }
   }
+  // -----------------------------------------------------------------------
+  // Connection Lifecycle
+  // -----------------------------------------------------------------------
   /**
-   * Reconnect to an MCP server — tears down the active client transport/connection
-   * and creates a fresh connection while reusing the existing session credentials in a single RPC call.
+   * Initiates a connection to a new MCP server.
+   *
+   * If a session for the same `serverId` or `serverUrl` already exists and
+   * is still in a `pending` (OAuth) state, the existing session is resumed
+   * instead of creating a duplicate.
+   *
+   * `UnauthorizedError` is treated as a pending-auth state and returned as
+   * a successful result (the client will then redirect to the auth URL).
    */
-  async reconnect(params) {
-    const { serverId: rawServerId, serverName, serverUrl, callbackUrl, transportType } = params;
+  async connect(params) {
     const headers = normalizeHeaders(params.headers);
-    const serverId = rawServerId && rawServerId.length <= 12 ? rawServerId : generateServerId();
-    const existingSessions = await sessions.list(this.userId);
-    const duplicate = existingSessions.find(
-      (s) => s.serverId === serverId || s.serverUrl === serverUrl
-    );
-    const sessionId = duplicate ? duplicate.sessionId : await sessions.generateSessionId();
-    if (duplicate) {
-      const existingClient = this.clients.get(duplicate.sessionId);
-      if (existingClient) {
-        await existingClient.disconnect();
-        this.clients.delete(duplicate.sessionId);
+    const serverId = this.normalizeServerId(params.serverId);
+    const existing = await this.findExistingSession(serverId, params.serverUrl);
+    if (existing) {
+      if (existing.status === "pending") {
+        return this.getSession({ sessionId: existing.sessionId }).then(() => ({
+          sessionId: existing.sessionId,
+          success: true
+        }));
       }
+      throw new Error(
+        `Connection already exists for server: ${existing.serverUrl ?? existing.serverId} (${existing.serverName})`
+      );
     }
-    try {
-      const clientMetadata = await this.getResolvedClientMetadata();
-      const client = new MCPClient({
-        userId: this.userId,
-        sessionId,
-        serverId,
-        serverName,
-        serverUrl,
-        callbackUrl,
-        transportType,
-        headers,
-        ...clientMetadata
-      });
-      this.clients.set(sessionId, client);
-      client.onConnectionEvent((event) => {
-        this.emitConnectionEvent(event);
-      });
-      client.onObservabilityEvent((event) => {
-        this.sendEvent(event);
-      });
-      await client.connect();
-      await this.listPolicyFilteredTools(sessionId);
-      return { sessionId, success: true };
-    } catch (error) {
-      if (error instanceof UnauthorizedError) {
-        this.clients.delete(sessionId);
-        return { sessionId, success: true };
+    const sessionId = await sessions.generateSessionId();
+    const metadata = await this.getResolvedClientMetadata();
+    const client = new MCPClient({
+      userId: this.userId,
+      sessionId,
+      serverId,
+      serverName: params.serverName,
+      serverUrl: params.serverUrl,
+      callbackUrl: params.callbackUrl,
+      transportType: params.transportType,
+      headers,
+      sessionStore: this.observedStore,
+      ...metadata
+    });
+    this.cacheClient(sessionId, client);
+    return this.connectAndDiscover(client, sessionId, serverId);
+  }
+  /**
+   * Reconnects to an MCP server by tearing down the active transport if one
+   * exists and instantiating a fresh connection, reusing the existing session
+   * (and its stored credentials / DCR client info) from the database.
+   */
+  async reconnect(params) {
+    const headers = normalizeHeaders(params.headers);
+    const serverId = this.normalizeServerId(params.serverId);
+    const existing = await this.findExistingSession(serverId, params.serverUrl);
+    const sessionId = existing ? existing.sessionId : await sessions.generateSessionId();
+    if (existing) {
+      const staleClient = this.clients.get(existing.sessionId);
+      if (staleClient) {
+        await staleClient.disconnect();
+        this.clients.delete(existing.sessionId);
       }
-      this.emitConnectionEvent({
-        type: "error",
-        sessionId,
-        serverId,
-        error: error instanceof Error ? error.message : "Connection failed",
-        errorType: "connection",
-        timestamp: Date.now()
-      });
-      this.clients.delete(sessionId);
-      throw error;
     }
+    const metadata = await this.getResolvedClientMetadata();
+    const client = new MCPClient({
+      userId: this.userId,
+      sessionId,
+      serverId,
+      serverName: params.serverName,
+      serverUrl: params.serverUrl,
+      callbackUrl: params.callbackUrl,
+      transportType: params.transportType,
+      headers,
+      sessionStore: this.observedStore,
+      ...metadata
+    });
+    this.cacheClient(sessionId, client);
+    return this.connectAndDiscover(client, sessionId, serverId);
   }
   /**
-   * Disconnect from an MCP server
+   * Disconnects from an MCP server.
+   *
+   * If an active in-memory transport exists it delegates to `clearSession()`
+   * (which sends the server an HTTP DELETE per the Streamable spec). If no
+   * active transport is available (orphaned session from a failed OAuth flow),
+   * the session row is removed directly from storage.
    */
   async disconnect(params) {
-    const { sessionId } = params;
-    const client = this.clients.get(sessionId);
+    const client = this.clients.get(params.sessionId);
     if (client) {
       await client.clearSession();
-      this.clients.delete(sessionId);
+      this.clients.delete(params.sessionId);
     } else {
-      await sessions.delete(this.userId, sessionId);
+      await sessions.delete(this.userId, params.sessionId);
     }
     return { success: true };
   }
+  // -----------------------------------------------------------------------
+  // OAuth
+  // -----------------------------------------------------------------------
   /**
-   * Get an existing client or create and connect a new one for the session.
+   * Completes the OAuth 2.1 authorization code flow for a pending session.
+   *
+   * Loads the stored session (with credentials), creates a fresh `MCPClient`,
+   * and calls `finishAuth` inside a {@link runWithCodeVerifierState} context
+   * so the PKCE code verifier is available without a DB read.
+   *
+   * The session's stored `transportType` is intentionally **omitted** from the
+   * client config — this lets `MCPClient` auto-negotiate (try Streamable HTTP
+   * first, fall back to SSE), which is required for servers like Neon that
+   * only support SSE transport.
    */
-  async getOrCreateClient(sessionId) {
-    const existing = this.clients.get(sessionId);
-    if (existing) {
-      return existing;
-    }
-    const session = await sessions.get(this.userId, sessionId);
-    if (!session) {
-      throw new Error("Session not found");
+  async finishAuth(params) {
+    const parsed = parseOAuthState(params.state);
+    const sessionId = parsed?.sessionId ?? params.state;
+    const session = await this.requireSession(sessionId);
+    try {
+      const clientId = session.clientId ?? void 0;
+      const clientSecret = session.clientInformation?.client_secret ?? void 0;
+      const client = new MCPClient({
+        userId: this.userId,
+        sessionId,
+        serverId: session.serverId,
+        serverName: session.serverName,
+        serverUrl: session.serverUrl,
+        callbackUrl: session.callbackUrl,
+        headers: session.headers,
+        clientId,
+        clientSecret,
+        hasSession: true,
+        cachedCredentials: { tokens: session.tokens ?? void 0 },
+        sessionStore: this.observedStore
+      });
+      this.attachClientEvents(client);
+      await runWithCodeVerifierState(
+        session.codeVerifier ?? "",
+        "S256",
+        () => client.finishAuth(params.code, params.state)
+      );
+      this.clients.set(sessionId, client);
+      const { result } = await this.listPolicyFilteredTools(sessionId);
+      return { success: true, toolCount: result.tools.length };
+    } catch (error) {
+      this.sendEvent(connectionErrorEvent(sessionId, session.serverId, error, "auth"));
+      throw error;
     }
-    const client = new MCPClient({
-      userId: this.userId,
-      sessionId,
-      // These fields are optional in MCPClient, but when rehydrating a known
-      // stored session on the server we pass them explicitly to preserve the
-      // original transport/connection metadata instead of relying on lazy
-      // reloading during initialize().
-      serverId: session.serverId,
-      serverName: session.serverName,
-      serverUrl: session.serverUrl,
-      callbackUrl: session.callbackUrl,
-      transportType: session.transportType,
-      headers: session.headers
-    });
-    client.onConnectionEvent((event) => this.emitConnectionEvent(event));
-    client.onObservabilityEvent((event) => this.sendEvent(event));
-    await client.connect();
-    this.clients.set(sessionId, client);
-    return client;
   }
+  // -----------------------------------------------------------------------
+  // Tool Discovery & Policy
+  // -----------------------------------------------------------------------
   /**
-   * Fetches all tools from the remote MCP server and emits a `tools_discovered` event.
+   * Fetches the complete tool list from the remote MCP server and emits a
+   * `tools_discovered` SSE event with two lists:
    *
-   * Two lists are always published together:
-   * - `tools`    — policy-filtered list that agents are allowed to call.
-   * - `allTools` — the complete, unfiltered list used by the management UI so
-   *                that blocked tools still appear as checkboxes in the dialog.
+   * - `tools`     — policy-filtered (what agents are allowed to call)
+   * - `allTools`  — complete, unfiltered (used by the management UI)
    *
-   * `fetchTools()` is called first (populates the in-memory cache), then
-   * `gateway.listTools()` re-uses that cache internally — so only one remote
-   * network round-trip is made regardless of how many callers follow.
+   * Only a single network round-trip is made: `fetchTools()` populates the
+   * in-memory cache, then `gateway.listTools()` reuses that cache.
    *
-   * @param sessionId - The session whose tools should be discovered.
-   * @returns The session record and the policy-filtered tool list.
-   * @throws {Error} When the session does not exist in the store.
+   * @param sessionId - The session to discover tools for.
+   * @returns The session record and the filtered tool result.
+   * @throws {Error} If the session does not exist in storage.
    */
   async listPolicyFilteredTools(sessionId) {
-    const session = await sessions.get(this.userId, sessionId);
-    if (!session) {
-      throw new Error("Session not found");
-    }
+    const session = await this.requireSession(sessionId);
     const client = await this.getOrCreateClient(sessionId);
     const allTools = await client.fetchTools().catch(() => ({ tools: [] }));
     const gateway = createToolPolicyGateway(this.userId, sessionId, client);
     const result = await gateway.listTools();
-    this.emitConnectionEvent({
+    this.sendEvent({
       type: "tools_discovered",
       sessionId,
       serverId: session.serverId ?? "unknown",
@@ -3851,254 +4039,254 @@ var SSEConnectionManager = class {
     return { session, result };
   }
   /**
-   * Returns the policy-filtered tool list for a session (agent-facing).
-   * Internally re-uses `listPolicyFilteredTools` which also emits a
-   * `tools_discovered` SSE event to keep client state up to date.
+   * Returns the policy-filtered tool list for a session.
+   *
+   * Delegates to {@link listPolicyFilteredTools}, which also emits a
+   * `tools_discovered` SSE event to keep the client state current.
    */
   async listTools(params) {
-    const { sessionId } = params;
-    const { result } = await this.listPolicyFilteredTools(sessionId);
+    const { result } = await this.listPolicyFilteredTools(params.sessionId);
     return { tools: result.tools };
   }
   /**
-   * Get all raw tools with effective access state for management UI.
+   * Returns all raw tools annotated with their effective policy state
+   * for display in the management UI.
    */
   async getToolPolicy(params) {
-    const { sessionId } = params;
-    const session = await sessions.get(this.userId, sessionId);
-    if (!session) {
-      throw new Error("Session not found");
-    }
-    const client = await this.getOrCreateClient(sessionId);
+    const session = await this.requireSession(params.sessionId);
+    const client = await this.getOrCreateClient(params.sessionId);
     const allTools = await client.fetchTools();
-    const toolPolicy = session.toolPolicy ?? {
+    const policy = session.toolPolicy ?? {
       mode: "all",
       toolIds: [],
       updatedAt: session.updatedAt ?? session.createdAt
     };
     const serverId = session.serverId ?? "unknown";
-    const tools = allTools.tools.map((tool) => ({
-      ...tool,
-      toolId: createToolId(serverId, tool.name),
-      allowed: isToolAllowed(toolPolicy, tool.name, session.serverId)
+    const tools = allTools.tools.map((t) => ({
+      ...t,
+      toolId: createToolId(serverId, t.name),
+      allowed: isToolAllowed(policy, t.name, session.serverId)
     }));
     return {
-      toolPolicy,
+      toolPolicy: policy,
       tools,
       toolCount: tools.length,
-      allowedToolCount: tools.filter((tool) => tool.allowed).length
+      allowedToolCount: tools.filter((t) => t.allowed).length
     };
   }
   /**
-   * Persists a new tool access policy for a session and broadcasts the updated
-   * filtered tool list to all connected browser clients via a `tools_discovered` event.
-   *
-   * Both `tools` (policy-filtered) and `allTools` (complete list) are emitted
-   * so the management UI can immediately reflect the new checkbox states without
-   * an additional round-trip to the server.
+   * Persists a new tool access policy and broadcasts the updated filtered
+   * tool list via a `tools_discovered` SSE event.
    *
-   * @param params - Session ID and the new `{ mode, toolIds }` policy to apply.
-   * @throws {Error} When the session does not exist or the policy references unknown tool IDs.
+   * @throws {Error} If the session does not exist or the policy references
+   *                 tool IDs that don't match any known tool.
    */
   async setToolPolicy(params) {
-    const { sessionId } = params;
-    const session = await sessions.get(this.userId, sessionId);
-    if (!session) {
-      throw new Error("Session not found");
-    }
-    const client = await this.getOrCreateClient(sessionId);
+    const session = await this.requireSession(params.sessionId);
+    const client = await this.getOrCreateClient(params.sessionId);
     const allTools = await client.fetchTools();
-    const toolPolicy = normalizeToolPolicyForUpdate(params.toolPolicy);
-    validateToolPolicyAgainstTools(toolPolicy, allTools.tools, session.serverId);
-    await sessions.update(this.userId, sessionId, { toolPolicy });
-    const filteredTools = createToolPolicyGateway(this.userId, sessionId, client).filterTools({ ...session, toolPolicy }, allTools.tools);
-    this.emitConnectionEvent({
+    const policy = normalizeToolPolicyForUpdate(params.toolPolicy);
+    validateToolPolicyAgainstTools(policy, allTools.tools, session.serverId);
+    await sessions.update(this.userId, params.sessionId, { toolPolicy: policy });
+    const filtered = createToolPolicyGateway(
+      this.userId,
+      params.sessionId,
+      client
+    ).filterTools({ ...session, toolPolicy: policy }, allTools.tools);
+    this.sendEvent({
       type: "tools_discovered",
-      sessionId,
+      sessionId: params.sessionId,
       serverId: session.serverId ?? "unknown",
-      toolCount: filteredTools.length,
-      tools: filteredTools,
+      toolCount: filtered.length,
+      tools: filtered,
       allTools: allTools.tools,
       timestamp: Date.now()
     });
-    return {
-      success: true,
-      toolPolicy,
-      tools: filteredTools,
-      toolCount: filteredTools.length
-    };
-  }
-  /**
-   * Proxies a tool invocation to the remote MCP server.
-   * Resolves the client for the given session and delegates to the tool router.
-   */
-  async callTool(params) {
-    const { sessionId, toolName, toolArgs } = params;
-    const client = await this.getOrCreateClient(sessionId);
-    const result = await createToolPolicyGateway(this.userId, sessionId, client).callTool(toolName, toolArgs);
-    const meta = result._meta || {};
-    return {
-      ...result,
-      _meta: {
-        ...meta,
-        sessionId
-      }
-    };
+    return { success: true, toolPolicy: policy, tools: filtered, toolCount: filtered.length };
   }
   /**
-   * Restore and validate an existing session
+   * Enables or disables a session for agent tool discovery.
+   *
+   * Disabled sessions retain their OAuth tokens and connection metadata
+   * but are hidden from `MultiSessionClient.connect()` and blocked from
+   * RPC tool access. Re-enabling does not require re-authentication.
+   *
+   * @param params - `{ sessionId, enabled: boolean }`
+   * @returns `{ success: true }`
+   * @throws {Error} If the session does not exist.
    */
-  async getSession(params) {
-    const { sessionId } = params;
-    const session = await sessions.get(this.userId, sessionId);
-    if (!session) {
-      throw new Error("Session not found");
-    }
-    this.emitConnectionEvent({
-      type: "state_changed",
-      sessionId,
-      serverId: session.serverId ?? "unknown",
-      serverName: session.serverName ?? "Unknown",
-      serverUrl: session.serverUrl,
-      state: "VALIDATING",
-      previousState: "DISCONNECTED",
-      timestamp: Date.now()
-    });
-    try {
-      const clientMetadata = await this.getResolvedClientMetadata();
-      const client = new MCPClient({
-        userId: this.userId,
-        sessionId,
-        // These fields are optional in MCPClient, but when rehydrating a known
-        // stored session on the server we pass them explicitly to preserve the
-        // original transport/connection metadata instead of relying on lazy
-        // reloading during initialize().
-        serverId: session.serverId,
-        serverName: session.serverName,
-        serverUrl: session.serverUrl,
-        callbackUrl: session.callbackUrl,
-        transportType: session.transportType,
-        headers: session.headers,
-        ...clientMetadata
-      });
-      client.onConnectionEvent((event) => this.emitConnectionEvent(event));
-      client.onObservabilityEvent((event) => this.sendEvent(event));
-      await client.connect();
-      this.clients.set(sessionId, client);
-      const { result: tools } = await this.listPolicyFilteredTools(sessionId);
-      return { success: true, toolCount: tools.tools.length };
-    } catch (error) {
-      this.emitConnectionEvent({
-        type: "error",
-        sessionId,
-        serverId: session.serverId ?? "unknown",
-        error: error instanceof Error ? error.message : "Validation failed",
-        errorType: "validation",
-        timestamp: Date.now()
-      });
-      throw error;
-    }
+  async updateSession(params) {
+    await this.requireSession(params.sessionId);
+    await sessions.update(this.userId, params.sessionId, { enabled: params.enabled });
+    return { success: true };
   }
+  // -----------------------------------------------------------------------
+  // Tool Execution
+  // -----------------------------------------------------------------------
   /**
-   * Complete OAuth authorization flow
+   * Proxies a tool invocation to the remote MCP server.
+   *
+   * Resolves (or creates) the transport for the given session, runs the call
+   * through the tool-policy gateway, and injects `sessionId` into the result
+   * metadata so the client can route the response without scanning all sessions.
    */
-  async finishAuth(params) {
-    const { code } = params;
-    const oauthState = params.state;
-    const parsedState = parseOAuthState(oauthState);
-    const sessionId = parsedState?.sessionId || oauthState;
-    const session = await sessions.get(this.userId, sessionId);
-    if (!session) {
-      throw new Error("Session not found");
-    }
-    try {
-      const client = new MCPClient({
-        userId: this.userId,
-        sessionId,
-        // These fields are optional in MCPClient, but when rehydrating a known
-        // stored session on the server we pass them explicitly to preserve the
-        // original connection metadata instead of relying on lazy
-        // reloading during initialize().
-        serverId: session.serverId,
-        serverName: session.serverName,
-        serverUrl: session.serverUrl,
-        callbackUrl: session.callbackUrl,
-        // NOTE: transportType is intentionally omitted here.
-        // The session's stored transportType is a placeholder ('streamable-http')
-        // set before transport negotiation. Omitting it lets MCPClient auto-negotiate
-        // (try streamable_http → SSE fallback), which is critical for servers like
-        // Neon that only support SSE transport.
-        headers: session.headers
-      });
-      client.onConnectionEvent((event) => this.emitConnectionEvent(event));
-      await client.finishAuth(code, oauthState);
-      this.clients.set(sessionId, client);
-      const { result: tools } = await this.listPolicyFilteredTools(sessionId);
-      return { success: true, toolCount: tools.tools.length };
-    } catch (error) {
-      this.emitConnectionEvent({
-        type: "error",
-        sessionId,
-        serverId: session.serverId ?? "unknown",
-        error: error instanceof Error ? error.message : "OAuth completion failed",
-        errorType: "auth",
-        timestamp: Date.now()
-      });
-      throw error;
-    }
+  async callTool(params) {
+    const client = await this.getOrCreateClient(params.sessionId);
+    const result = await createToolPolicyGateway(
+      this.userId,
+      params.sessionId,
+      client
+    ).callTool(params.toolName, params.toolArgs);
+    return { ...result, _meta: { ...result._meta ?? {}, sessionId: params.sessionId } };
   }
-  /**
-   * List prompts from a session
-   */
+  // -----------------------------------------------------------------------
+  // Prompts
+  // -----------------------------------------------------------------------
+  /** Lists all prompts exposed by the remote MCP server. */
   async listPrompts(params) {
-    const { sessionId } = params;
-    const client = await this.getOrCreateClient(sessionId);
+    const client = await this.getOrCreateClient(params.sessionId);
     const result = await client.listPrompts();
     return { prompts: result.prompts };
   }
-  /**
-   * Get a specific prompt
-   */
+  /** Retrieves a specific prompt by name with optional arguments. */
   async getPrompt(params) {
-    const { sessionId, name, args } = params;
-    const client = await this.getOrCreateClient(sessionId);
-    return await client.getPrompt(name, args);
+    const client = await this.getOrCreateClient(params.sessionId);
+    return client.getPrompt(params.name, params.args);
   }
-  /**
-   * List resources from a session
-   */
+  // -----------------------------------------------------------------------
+  // Resources
+  // -----------------------------------------------------------------------
+  /** Lists all resources exposed by the remote MCP server. */
   async listResources(params) {
-    const { sessionId } = params;
-    const client = await this.getOrCreateClient(sessionId);
+    const client = await this.getOrCreateClient(params.sessionId);
     const result = await client.listResources();
     return { resources: result.resources };
   }
+  /** Reads a specific resource identified by URI. */
+  async readResource(params) {
+    const client = await this.getOrCreateClient(params.sessionId);
+    return client.readResource(params.uri);
+  }
+  // -----------------------------------------------------------------------
+  // Internal Helpers
+  // -----------------------------------------------------------------------
+  /** Resolves client metadata: `getClientMetadata()` → `clientDefaults` → `{}`. */
+  async getResolvedClientMetadata(request) {
+    let metadata = this.options.clientDefaults ? { ...this.options.clientDefaults } : {};
+    if (this.options.getClientMetadata) {
+      metadata = { ...metadata, ...await this.options.getClientMetadata(request) };
+    }
+    return metadata;
+  }
+  /** Ensures the given session exists in storage and throws otherwise. */
+  async requireSession(sessionId) {
+    const session = await sessions.get(this.userId, sessionId, { includeCredentials: true });
+    if (!session) throw new Error(`Session ${sessionId} not found`);
+    return session;
+  }
+  /** Finds an existing session matching the given serverId or serverUrl. */
+  async findExistingSession(serverId, serverUrl) {
+    const all = await sessions.list(this.userId);
+    return all.find((s) => s.serverId === serverId || s.serverUrl === serverUrl);
+  }
+  /** Normalizes a serverId to max 12 chars (DeepSeek/OpenAI 64-char tool-name limit). */
+  normalizeServerId(raw) {
+    return raw && raw.length <= 12 ? raw : generateServerId();
+  }
   /**
-   * Read a specific resource
+   * Returns the cached in-memory transport for `sessionId`, or creates one
+   * from the persisted session row (with credentials) and connects it.
    */
-  async readResource(params) {
-    const { sessionId, uri } = params;
-    const client = await this.getOrCreateClient(sessionId);
-    return client.readResource(uri);
+  async getOrCreateClient(sessionId) {
+    const existing = this.clients.get(sessionId);
+    if (existing) return existing;
+    const session = await this.requireSession(sessionId);
+    if (session.enabled === false) {
+      throw new Error("Session is disabled \u2014 re-enable it via updateSession to access tools");
+    }
+    const client = this.restoreClient(session);
+    this.attachClientEvents(client);
+    await client.connect();
+    this.clients.set(sessionId, client);
+    return client;
+  }
+  /**
+   * Builds an `MCPClient` from a stored session row.
+   *
+   * Extracts `clientId` and `clientSecret` from the session's credential
+   * fields and passes `hasSession: true` + `cachedCredentials` so the client
+   * can skip redundant existence checks and credential reads.
+   */
+  restoreClient(session) {
+    const clientId = session.clientId ?? void 0;
+    const clientSecret = session.clientInformation?.client_secret ?? void 0;
+    return new MCPClient({
+      userId: this.userId,
+      sessionId: session.sessionId,
+      serverId: session.serverId,
+      serverName: session.serverName,
+      serverUrl: session.serverUrl,
+      callbackUrl: session.callbackUrl,
+      transportType: session.transportType,
+      headers: session.headers,
+      clientId,
+      clientSecret,
+      hasSession: true,
+      cachedCredentials: { tokens: session.tokens ?? void 0 },
+      sessionStore: this.observedStore
+    });
   }
   /**
-   * Emit connection event
+   * Wires connection and observability events from the client into the
+   * unified observability channel. Connection events go to `sendEvent`
+   * (SSE stream); observability events go to `emitObs` (user callback
+   * + SSE stream).
    */
-  emitConnectionEvent(event) {
-    this.sendEvent(event);
+  attachClientEvents(client) {
+    client.onConnectionEvent((e) => this.sendEvent(e));
+    client.onObservabilityEvent((e) => this.sendEvent(e));
   }
   /**
-   * Cleanup and close all connections
+   * Registers the client in the in-memory cache and attaches its event
+   * listeners to the unified observability channel.
    */
-  async dispose() {
-    this.isActive = false;
-    if (this.heartbeatTimer) {
-      clearInterval(this.heartbeatTimer);
+  cacheClient(sessionId, client) {
+    this.attachClientEvents(client);
+    this.clients.set(sessionId, client);
+  }
+  /**
+   * Attempts a `client.connect()` and, on success, discovers tools.
+   *
+   * If the server responds with `UnauthorizedError`, the session is
+   * treated as pending OAuth — a successful result is returned with
+   * the sessionId so the browser client can redirect to the auth URL.
+   *
+   * For any other error an `error` connection event is emitted and the
+   * client is removed from the in-memory cache before re-throwing.
+   */
+  async connectAndDiscover(client, sessionId, serverId) {
+    try {
+      await client.connect();
+      await this.listPolicyFilteredTools(sessionId);
+      return { sessionId, success: true };
+    } catch (error) {
+      if (error instanceof UnauthorizedError) {
+        this.clients.delete(sessionId);
+        return { sessionId, success: true };
+      }
+      this.sendEvent(connectionErrorEvent(sessionId, serverId, error, "connection"));
+      this.clients.delete(sessionId);
+      throw error;
     }
-    await Promise.all(
-      Array.from(this.clients.values()).map((client) => client.disconnect())
-    );
-    this.clients.clear();
+  }
+  /** Starts the periodic heartbeat timer. */
+  startHeartbeat() {
+    const ms = this.options.heartbeatInterval ?? DEFAULT_HEARTBEAT_MS;
+    this.heartbeatTimer = setInterval(() => {
+      if (this.active) {
+        this.sendEvent({ level: "debug", message: "heartbeat", timestamp: Date.now() });
+      }
+    }, ms);
   }
 };
 function createSSEHandler(options) {
@@ -4127,8 +4315,7 @@ function createSSEHandler(options) {
       });
       req.on("end", async () => {
         try {
-          const request = JSON.parse(body);
-          await manager.handleRequest(request);
+          await manager.handleRequest(JSON.parse(body));
         } catch {
         }
       });
@@ -4334,6 +4521,9 @@ var SSEClient = class {
   async getToolPolicy(sessionId) {
     return this.sendRequest("getToolPolicy", { sessionId });
   }
+  async updateSession(sessionId, enabled) {
+    return this.sendRequest("updateSession", { sessionId, enabled });
+  }
   async listTools(sessionId) {
     return this.sendRequest("listTools", { sessionId });
   }
@@ -6200,6 +6390,6 @@ function globToRegExp(pattern) {
   return new RegExp(regexPattern);
 }
 
-export { APP_HOST_DEFAULTS, AppHost, AuthenticationError, ConfigurationError, ConnectionError, DEFAULT_CLIENT_NAME, DEFAULT_CLIENT_URI, DEFAULT_HEARTBEAT_INTERVAL_MS, DEFAULT_LOGO_URI, DEFAULT_MCP_APP_CSP, DEFAULT_POLICY_URI, DORMANT_SESSION_EXPIRATION_MS, DORMANT_SESSION_EXPIRATION_SECONDS, DisposableStore, Emitter, InvalidStateError, MCPClient, MCP_CLIENT_NAME, MCP_CLIENT_VERSION, McpError, MultiSessionClient, NotConnectedError, PENDING_SESSION_EXPIRATION_SECONDS, REDIS_KEY_PREFIX, RpcErrorCodes, SANDBOX_PROXY_READY_METHOD, SANDBOX_RESOURCE_READY_METHOD, SOFTWARE_ID, SOFTWARE_VERSION, SSEClient, SSEConnectionManager, STATE_EXPIRATION_MS, SchemaCompressor, SessionNotFoundError, SessionValidationError, StorageOAuthClientProvider, ToolExecutionError, ToolIndex, ToolRouter, UnauthorizedError, createExecuteToolDefinition, createGetSchemaToolDefinition, createListServersToolDefinition, createNextMcpHandler, createRegexSearchToolDefinition, createSSEHandler, createSearchToolDefinition, executeMetaTool, findToolByName, getToolUiResourceUri, isCallToolSuccess, isConnectAuthRequired, isConnectError, isConnectSuccess, isListToolsSuccess, isMetaTool, onSessionMutation, resolveMetaToolProxy, sanitizeServerLabel, sessions };
+export { APP_HOST_DEFAULTS, AppHost, AuthenticationError, ConfigurationError, ConnectionError, DEFAULT_CLIENT_NAME, DEFAULT_CLIENT_URI, DEFAULT_HEARTBEAT_INTERVAL_MS, DEFAULT_LOGO_URI, DEFAULT_MCP_APP_CSP, DEFAULT_POLICY_URI, DORMANT_SESSION_EXPIRATION_MS, DORMANT_SESSION_EXPIRATION_SECONDS, DisposableStore, Emitter, InvalidStateError, MCPClient, MCP_CLIENT_NAME, MCP_CLIENT_VERSION, McpError, MultiSessionClient, NotConnectedError, PENDING_SESSION_EXPIRATION_SECONDS, REDIS_KEY_PREFIX, RpcErrorCodes, SANDBOX_PROXY_READY_METHOD, SANDBOX_RESOURCE_READY_METHOD, SOFTWARE_ID, SOFTWARE_VERSION, SSEClient, SSEConnectionManager, STATE_EXPIRATION_MS, SchemaCompressor, SessionNotFoundError, SessionValidationError, StorageOAuthClientProvider, ToolExecutionError, ToolIndex, ToolRouter, UnauthorizedError, createExecuteToolDefinition, createGetSchemaToolDefinition, createListServersToolDefinition, createNextMcpHandler, createRegexSearchToolDefinition, createSSEHandler, createSearchToolDefinition, decryptObject, encryptObject, executeMetaTool, findToolByName, getToolUiResourceUri, isCallToolSuccess, isConnectAuthRequired, isConnectError, isConnectSuccess, isListToolsSuccess, isMetaTool, onSessionMutation, resolveMetaToolProxy, sanitizeServerLabel, sessions, withDbObservability };
 //# sourceMappingURL=index.mjs.map
 //# sourceMappingURL=index.mjs.map