@nanobpm/urban 0.90.0 → 0.90.2

package/dist/cli.js

@@ -433,6 +433,30 @@ export async function main(argv) {
             return 1;
     }
 }
+/**
+ * Flush a Node writable stdio stream, resolving once its buffered writes have drained to the OS.
+ * `process.stdout`/`stderr` connected to a *pipe* is asynchronous in Node: `console.log` buffers
+ * the write and an immediate `process.exit()` abandons anything not yet handed to the OS, so a
+ * large reply (> the 64 KB pipe buffer on Linux) is silently truncated. Writing an empty chunk and
+ * waiting for its completion callback drains the prior writes first. Deno's stdio has no such
+ * `write(chunk, cb)` shape (its `console.log` is synchronous), so its absence is a no-op flush.
+ */
+function flushStream(stream) {
+    return new Promise((resolve) => {
+        if (!stream || typeof stream.write !== "function") {
+            resolve();
+            return;
+        }
+        stream.write("", () => resolve());
+    });
+}
+/** Drain both stdout and stderr before an explicit `process.exit` so no buffered output is lost. */
+async function flushStdio() {
+    const p = processGlobal();
+    if (!p)
+        return;
+    await Promise.all([flushStream(p.stdout), flushStream(p.stderr)]);
+}
 const proc = processGlobal();
 const deno = denoGlobal();
 const importMetaMain = Reflect.get(import.meta, "main");
@@ -450,11 +474,14 @@ if (importMetaMain === true || nodeMain) {
         else if (deno?.exit)
             deno.exit(code);
     };
-    main(argv).then((code) => {
-        if (code >= 0)
+    main(argv).then(async (code) => {
+        if (code >= 0) {
+            await flushStdio();
             exit(code);
-    }, (err) => {
+        }
+    }, async (err) => {
         console.error(errorMessage(err));
+        await flushStdio();
         exit(1);
     });
 }

package/dist/runtime/adapters/globals.d.ts

@@ -7,12 +7,23 @@ export interface DenoRuntimeGlobal {
     exit?: (code: number) => void;
     addSignalListener?: (sig: string, cb: () => void) => void;
 }
+/**
+ * The subset of a Node writable stdio stream (`process.stdout` / `process.stderr`) we depend on:
+ * a `write` that accepts a completion callback fired once the chunk has flushed to the OS. Deno's
+ * stdio streams do not expose this shape; callers treat its absence as "already synchronous, no
+ * flush needed" (see `flushStdio` in cli.ts).
+ */
+export interface WritableStdio {
+    write?: (chunk: string, cb: () => void) => void;
+}
 export interface ProcessRuntimeGlobal {
     argv?: string[];
     exit?: (code: number) => void;
     stdin?: AsyncIterable<Uint8Array | string> & {
         setEncoding?(encoding: string): void;
     };
+    stdout?: WritableStdio;
+    stderr?: WritableStdio;
     on?: (sig: string, cb: () => void) => void;
 }
 export declare function denoGlobal(): DenoRuntimeGlobal | undefined;

package/dist/runtime/core/modules/mcp.js

@@ -1073,6 +1073,17 @@ export function mountMcp(ctx, app, apiRoutes) {
         if (!session) {
             const messages = Array.isArray(parsedBody) ? parsedBody : [parsedBody];
             if (!messages.some((m) => isInitializeRequest(m))) {
+                // A session id was supplied but is not (or no longer) resident — e.g. the client is
+                // holding a session minted by a previous process that a restart wiped from the in-memory
+                // map. Per the MCP Streamable-HTTP spec a terminated/unknown session id MUST answer 404 so
+                // the client transparently re-initializes; only a genuinely missing id is a 400 bad client.
+                if (sessionId) {
+                    return json({
+                        jsonrpc: "2.0",
+                        error: { code: -32001, message: `Session not found: unknown or expired ${SESSION_HEADER}.` },
+                        id: null,
+                    }, 404);
+                }
                 return json({
                     jsonrpc: "2.0",
                     error: { code: -32000, message: "Bad Request: no valid session id, and not an initialize request." },

package/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "@nanobpm/urban",
-	"version": "0.90.0",
+	"version": "0.90.2",
 	"description": "Urban: build and run code-first apps on Nano — runtime, derivation toolkit, and CLI in one. Author durable processes with @nanobpm/workflow (defineFlow), a typed datasource, forms, triggers and surfaces from a nano.app.json manifest, on Node or Deno.",
 	"license": "Apache-2.0",
 	"type": "module",

package/src/cli.test.ts

@@ -1,7 +1,14 @@
 import { test } from "node:test";
 import assert from "node:assert/strict";
+import { spawn } from "node:child_process";
+import { mkdtemp, mkdir, writeFile, rm } from "node:fs/promises";
+import { tmpdir } from "node:os";
+import { join } from "node:path";
+import { fileURLToPath } from "node:url";
 import { cmdData } from "./cli.ts";
 import { isRecord } from "./runtime/core/guards.ts";
+import { createNodeHost } from "./runtime/adapters/node.ts";
+import { runDataOp } from "./runtime/core/modules/dataops.ts";
 
 // The `urban data` gateway's contract (see cmdData's docstring): *every* reply — including an
 // unreadable request — is a parseable `{ ok: false, error }` envelope on stdout AND the process
@@ -41,3 +48,85 @@ test("urban data exits 0 with a parseable envelope on an unreadable request", as
   if (typeof reply.error !== "string") throw new TypeError("expected string error");
   assert.match(reply.error, /^bad request: /);
 });
+
+// Regression guard for nanobpm/nano-ide#549: `urban data`'s success path prints the full reply
+// with `console.log`, then the top-level runner calls `process.exit(code)`. In Node, stdout
+// connected to a *pipe* is asynchronous — an immediate `process.exit` abandons anything still
+// buffered, truncating the reply at the OS pipe-buffer boundary (65536 bytes on Linux) so the
+// console host fails to `JSON.parse` it ("EOF … column 65536"). The fix drains stdout before the
+// explicit exit. This test spawns the real CLI on a datasource whose query result serialises to
+// well over 64 KB, reads the piped stdout, and asserts the parent parses a complete envelope whose
+// byte length matches the untruncated JSON. It FAILS before the fix (truncated at 65536) and
+// passes after.
+test("urban data streams a > 64 KB reply without truncation through an explicit process.exit", async () => {
+  const dir = await mkdtemp(join(tmpdir(), "urban-data-large-"));
+  try {
+    await mkdir(join(dir, "db", "migrations"), { recursive: true });
+    await writeFile(
+      join(dir, "nano.app.json"),
+      JSON.stringify({
+        schemaVersion: 1,
+        id: "big",
+        name: "Big",
+        data: {
+          default: "app",
+          sources: { app: { driver: "sqlite", url: "file:./db/app.db", migrations: "db/migrations" } },
+        },
+      }),
+    );
+    await writeFile(
+      join(dir, "db", "migrations", "001_big.sql"),
+      "CREATE TABLE big (id INTEGER PRIMARY KEY, payload TEXT NOT NULL);",
+    );
+    // 2000 rows × ~128-char payload → a query reply of roughly 300 KB, comfortably past the 64 KB
+    // pipe boundary. A single recursive-CTE INSERT (no inner `;`) so the migration splitter keeps
+    // it as one statement.
+    await writeFile(
+      join(dir, "db", "migrations", "002_seed.sql"),
+      "INSERT INTO big (id, payload) WITH RECURSIVE seq(n) AS (SELECT 1 UNION ALL SELECT n + 1 FROM seq WHERE n < 2000) SELECT n, printf('%0128d', n) FROM seq;",
+    );
+
+    const host = createNodeHost({ cwd: dir });
+    await runDataOp(host, ".", "nano.app.json", { op: "migrate" });
+    const query = { op: "query", sql: "SELECT * FROM big ORDER BY id" } as const;
+    const result = await runDataOp(host, ".", "nano.app.json", query);
+    const expected = `${JSON.stringify({ ok: true, ...result })}\n`;
+    const expectedBytes = Buffer.byteLength(expected);
+    assert.ok(
+      expectedBytes > 65536,
+      `fixture too small (${expectedBytes} bytes) to exercise the pipe-buffer boundary`,
+    );
+
+    const cli = fileURLToPath(new URL("./cli.ts", import.meta.url));
+    const { stdout, code, signal } = await new Promise<{
+      stdout: Buffer;
+      code: number | null;
+      signal: NodeJS.Signals | null;
+    }>((resolve, reject) => {
+      const child = spawn(
+        process.execPath,
+        ["--experimental-strip-types", cli, "data", "--root", dir],
+        { stdio: ["pipe", "pipe", "inherit"] },
+      );
+      const chunks: Buffer[] = [];
+      child.stdout.on("data", (c: Buffer) => chunks.push(c));
+      child.on("error", reject);
+      child.on("close", (code, signal) => resolve({ stdout: Buffer.concat(chunks), code, signal }));
+      child.stdin.end(JSON.stringify(query));
+    });
+
+    assert.equal(signal, null, `CLI killed by signal ${signal}`);
+    assert.equal(code, 0, `CLI exited ${code}, expected 0`);
+    assert.equal(
+      stdout.byteLength,
+      expectedBytes,
+      `stdout truncated: got ${stdout.byteLength} bytes, expected ${expectedBytes}`,
+    );
+    const reply: unknown = JSON.parse(stdout.toString("utf8"));
+    assert.ok(isRecord(reply));
+    assert.equal(reply.ok, true);
+    assert.deepEqual(reply, { ok: true, ...result });
+  } finally {
+    await rm(dir, { recursive: true, force: true });
+  }
+});

package/src/cli.ts

@@ -22,6 +22,7 @@ import {
   selectHost,
 } from "./runtime/index.ts";
 import { denoGlobal, processGlobal } from "./runtime/adapters/globals.ts";
+import type { WritableStdio } from "./runtime/adapters/globals.ts";
 import { errorMessage, isRecord } from "./runtime/core/guards.ts";
 import { scaffold, slugify } from "create-urban-app";
 import type { DataRequest } from "./runtime/index.ts";
@@ -446,6 +447,31 @@ export async function main(argv: string[]): Promise<number> {
   }
 }
 
+/**
+ * Flush a Node writable stdio stream, resolving once its buffered writes have drained to the OS.
+ * `process.stdout`/`stderr` connected to a *pipe* is asynchronous in Node: `console.log` buffers
+ * the write and an immediate `process.exit()` abandons anything not yet handed to the OS, so a
+ * large reply (> the 64 KB pipe buffer on Linux) is silently truncated. Writing an empty chunk and
+ * waiting for its completion callback drains the prior writes first. Deno's stdio has no such
+ * `write(chunk, cb)` shape (its `console.log` is synchronous), so its absence is a no-op flush.
+ */
+function flushStream(stream: WritableStdio | undefined): Promise<void> {
+  return new Promise((resolve) => {
+    if (!stream || typeof stream.write !== "function") {
+      resolve();
+      return;
+    }
+    stream.write("", () => resolve());
+  });
+}
+
+/** Drain both stdout and stderr before an explicit `process.exit` so no buffered output is lost. */
+async function flushStdio(): Promise<void> {
+  const p = processGlobal();
+  if (!p) return;
+  await Promise.all([flushStream(p.stdout), flushStream(p.stderr)]);
+}
+
 const proc = processGlobal();
 const deno = denoGlobal();
 const importMetaMain: unknown = Reflect.get(import.meta, "main");
@@ -462,11 +488,15 @@ if (importMetaMain === true || nodeMain) {
     else if (deno?.exit) deno.exit(code);
   };
   main(argv).then(
-    (code) => {
-      if (code >= 0) exit(code);
+    async (code) => {
+      if (code >= 0) {
+        await flushStdio();
+        exit(code);
+      }
     },
-    (err) => {
+    async (err) => {
       console.error(errorMessage(err));
+      await flushStdio();
       exit(1);
     },
   );

package/src/runtime/adapters/globals.ts

@@ -8,10 +8,22 @@ export interface DenoRuntimeGlobal {
   addSignalListener?: (sig: string, cb: () => void) => void;
 }
 
+/**
+ * The subset of a Node writable stdio stream (`process.stdout` / `process.stderr`) we depend on:
+ * a `write` that accepts a completion callback fired once the chunk has flushed to the OS. Deno's
+ * stdio streams do not expose this shape; callers treat its absence as "already synchronous, no
+ * flush needed" (see `flushStdio` in cli.ts).
+ */
+export interface WritableStdio {
+  write?: (chunk: string, cb: () => void) => void;
+}
+
 export interface ProcessRuntimeGlobal {
   argv?: string[];
   exit?: (code: number) => void;
   stdin?: AsyncIterable<Uint8Array | string> & { setEncoding?(encoding: string): void };
+  stdout?: WritableStdio;
+  stderr?: WritableStdio;
   on?: (sig: string, cb: () => void) => void;
 }
 

package/src/runtime/core/modules/mcp.test.ts

@@ -251,6 +251,40 @@ test("a POST without a session and without an initialize request is a 400", asyn
   assert.equal(res.status, 400);
 });
 
+test("a tools/call carrying an unknown/stale mcp-session-id is a 404, not a 400 (restart recovery)", async () => {
+  // A restart wipes the in-memory sessions map; a client still holding a session id from the
+  // previous process hits this branch. Per the MCP Streamable-HTTP spec the correct signal is 404
+  // (session terminated/expired) so the client transparently re-initializes — a 400 leaves the
+  // client hanging until its own request timeout instead of auto-reconnecting.
+  const { router } = buildHarness();
+  const res = await router(
+    mcpPost(
+      { jsonrpc: "2.0", id: 1, method: "tools/call", params: { name: "listInvoices", arguments: {} } },
+      { "mcp-session-id": "stale-session-from-a-previous-process" },
+    ),
+  );
+  assert.equal(res.status, 404, `an unknown session id must be 404, got ${res.status}: ${res.body}`);
+});
+
+test("a present-but-unknown mcp-session-id WITH an initialize body still mints a fresh session", async () => {
+  // The client is already reconnecting — carrying a stale id alongside an initialize must not be
+  // rejected; it establishes a brand-new session exactly as a bare initialize would.
+  const { router } = buildHarness();
+  const res = await router(
+    mcpPost(
+      {
+        jsonrpc: "2.0",
+        id: 0,
+        method: "initialize",
+        params: { protocolVersion: "2025-06-18", capabilities: {}, clientInfo: { name: "test", version: "1.0" } },
+      },
+      { "mcp-session-id": "stale-session-from-a-previous-process" },
+    ),
+  );
+  assert.equal(res.status ?? 200, 200, `initialize with a stale id must be 200, got ${res.status}: ${res.body}`);
+  assert.ok(res.headers?.["mcp-session-id"], "a fresh session id must be assigned");
+});
+
 // ---- tool projection --------------------------------------------------------------------------
 
 test("every app operation projects to a tool; read tools are annotated read-only, mutating ones destructive", async () => {

package/src/runtime/core/modules/mcp.ts

@@ -1230,6 +1230,20 @@ export function mountMcp(ctx: RuntimeContext, app: AppApi, apiRoutes: Route[]):
     if (!session) {
       const messages = Array.isArray(parsedBody) ? parsedBody : [parsedBody];
       if (!messages.some((m) => isInitializeRequest(m))) {
+        // A session id was supplied but is not (or no longer) resident — e.g. the client is
+        // holding a session minted by a previous process that a restart wiped from the in-memory
+        // map. Per the MCP Streamable-HTTP spec a terminated/unknown session id MUST answer 404 so
+        // the client transparently re-initializes; only a genuinely missing id is a 400 bad client.
+        if (sessionId) {
+          return json(
+            {
+              jsonrpc: "2.0",
+              error: { code: -32001, message: `Session not found: unknown or expired ${SESSION_HEADER}.` },
+              id: null,
+            },
+            404,
+          );
+        }
         return json(
           {
             jsonrpc: "2.0",