effect 4.0.1 → 4.0.2

package/dist/ai/McpServer.js

@@ -517,6 +517,7 @@ const runWithRuntime = /*#__PURE__*/Effect.fnUntraced(function* (options, runtim
       }
     });
   });
+  let writeFromClient;
   const handlers = yield* runtime.installHandlers({
     core: internalState.get(server).core,
     subscribeServerNotifications: PubSub.subscribe(serverNotifications),
@@ -663,170 +664,198 @@ const runWithRuntime = /*#__PURE__*/Effect.fnUntraced(function* (options, runtim
       }
       return protocol.send(clientId, response);
     },
-    run: f => protocol.run((clientId, request_) => {
-      const fiber = Fiber.getCurrent();
-      const request = request_;
-      const httpRequest = isHttp ? Context.getOrUndefined(fiber.context, HttpServerRequest.HttpServerRequest) : undefined;
-      if (httpRequest !== undefined && request._tag !== "Eof") {
-        appendPreResponseHandlerUnsafe(httpRequest, (_, response) => Effect.succeed(response.status === 200 && response.body._tag === "Uint8Array" && response.body.contentLength === 0 ? HttpServerResponse.empty({
-          headers: Headers.remove(response.headers, "content-type"),
-          status: 202
-        }) : response));
-      }
-      switch (request._tag) {
-        case "Request":
-          {
-            const headers = isHttp ? Context.getUnsafe(Fiber.getCurrent().context, HttpServerRequest.HttpServerRequest).headers : Headers.fromInput(request.headers);
-            const cancellationRequest = request.tag === "notifications/cancelled" && typeof request.payload === "object" && request.payload !== null && "requestId" in request.payload && (typeof request.payload.requestId === "string" || typeof request.payload.requestId === "number") ? activeRequests.get(clientId)?.get(requestKey(request.payload.requestId)) : undefined;
-            const prepare = cancellationRequest === undefined ? runtime.prepareRequest(clientId, headers, request) : Effect.succeed(cancellationRequest.prepared);
-            return Effect.gen(function* () {
-              const prepared = yield* prepare;
-              const clientState = clientStates.get(clientId);
-              if (isHttp && clientState === undefined) {
-                // HTTP EOF only ends the request body; handlers and streamed replies may still be running.
-                yield* Scope.addFinalizer(Context.getUnsafe(fiber.context, Scope.Scope), Effect.sync(() => disconnectClient(clientId)));
-              }
-              const session = prepared.binding;
-              const selectedProtocol = prepared.protocol;
-              // Select before dated payload decoding: legacy requests use
-              // their session's adapter; modern requests carry their own version.
-              clientStates.set(clientId, {
-                protocol: selectedProtocol,
-                profile: prepared.profile ?? clientState?.profile,
-                sessionHeaders: isHttp && headers[MCP_SESSION_ID_HEADER] !== undefined ? Headers.fromInput({
-                  [MCP_SESSION_ID_HEADER]: headers[MCP_SESSION_ID_HEADER]
-                }) : clientState?.sessionHeaders
-              });
-              if (request.tag === MCP_INVALID_BATCH_METHOD) {
-                return yield* sendRequestError(clientId, request.id, new InvalidRequest({
-                  message: "JSON-RPC batches are not supported"
-                }));
-              }
-              if (httpRequest !== undefined && session !== undefined) {
-                appendPreResponseHandlerUnsafe(httpRequest, (_, res) => Effect.succeed(HttpServerResponse.setHeader(res, MCP_PROTOCOL_VERSION_HEADER, session.protocol.protocolVersion)));
-              }
-              const routedRequest = runtime.routeClientRequest(selectedProtocol, request);
-              const rpc = runtime.clientRpcs.requests.get(routedRequest.tag);
-              const isClientNotification = selectedProtocol.clientNotificationRpcs.requests.has(request.tag);
-              if (rpc && isClientNotification && request.isNotification) {
-                if (!session && selectedProtocol.runtime._tag === "Stateful") {
-                  if (httpRequest) {
-                    appendPreResponseHandlerUnsafe(httpRequest, () => Effect.succeed(HttpServerResponse.empty({
-                      status: headers[MCP_SESSION_ID_HEADER] === undefined ? 400 : 404
-                    })));
-                  }
-                  return;
+    run: f => {
+      writeFromClient = f;
+      return protocol.run((clientId, request_) => {
+        const fiber = Fiber.getCurrent();
+        const request = request_;
+        const httpRequest = isHttp ? Context.getOrUndefined(fiber.context, HttpServerRequest.HttpServerRequest) : undefined;
+        if (httpRequest !== undefined && request._tag !== "Eof") {
+          appendPreResponseHandlerUnsafe(httpRequest, (_, response) => Effect.succeed(response.status === 200 && response.body._tag === "Uint8Array" && response.body.contentLength === 0 ? HttpServerResponse.empty({
+            headers: Headers.remove(response.headers, "content-type"),
+            status: 202
+          }) : response));
+        }
+        switch (request._tag) {
+          case "Request":
+            {
+              const headers = isHttp ? Context.getUnsafe(Fiber.getCurrent().context, HttpServerRequest.HttpServerRequest).headers : Headers.fromInput(request.headers);
+              const cancellationRequest = request.tag === "notifications/cancelled" && typeof request.payload === "object" && request.payload !== null && "requestId" in request.payload && (typeof request.payload.requestId === "string" || typeof request.payload.requestId === "number") ? activeRequests.get(clientId)?.get(requestKey(request.payload.requestId)) : undefined;
+              const prepare = cancellationRequest === undefined ? runtime.prepareRequest(clientId, headers, request) : Effect.succeed(cancellationRequest.prepared);
+              return Effect.gen(function* () {
+                const prepared = yield* prepare;
+                const clientState = clientStates.get(clientId);
+                if (isHttp && clientState === undefined) {
+                  // HTTP EOF only ends the request body; handlers and streamed replies may still be running.
+                  yield* Scope.addFinalizer(Context.getUnsafe(fiber.context, Scope.Scope), Effect.sync(() => disconnectClient(clientId)));
                 }
-                const decode = selectedProtocol.payloadCodecs(rpc).decode(request.payload);
-                return yield* Effect.gen(function* () {
-                  const payload = yield* decode;
-                  if (request.tag === "notifications/cancelled") {
-                    const cancellation = yield* selectedProtocol.normalizeCancellation(payload);
-                    const key = requestKey(cancellation.requestId);
-                    let ownerClientId = clientId;
-                    if (isHttp) {
-                      if (session === undefined) {
-                        return;
+                const session = prepared.binding;
+                const selectedProtocol = prepared.protocol;
+                // Select before dated payload decoding: legacy requests use
+                // their session's adapter; modern requests carry their own version.
+                clientStates.set(clientId, {
+                  protocol: selectedProtocol,
+                  profile: prepared.profile ?? clientState?.profile,
+                  sessionHeaders: isHttp && headers[MCP_SESSION_ID_HEADER] !== undefined ? Headers.fromInput({
+                    [MCP_SESSION_ID_HEADER]: headers[MCP_SESSION_ID_HEADER]
+                  }) : clientState?.sessionHeaders
+                });
+                if (request.tag === MCP_INVALID_BATCH_METHOD) {
+                  return yield* sendRequestError(clientId, request.id, new InvalidRequest({
+                    message: "JSON-RPC batches are not supported"
+                  }));
+                }
+                if (httpRequest !== undefined && session !== undefined) {
+                  appendPreResponseHandlerUnsafe(httpRequest, (_, res) => Effect.succeed(runtime.resolveRequest(clientId, headers) === undefined ? HttpServerResponse.empty({
+                    status: 404
+                  }) : HttpServerResponse.setHeader(res, MCP_PROTOCOL_VERSION_HEADER, session.protocol.protocolVersion)));
+                }
+                const routedRequest = runtime.routeClientRequest(selectedProtocol, request);
+                const rpc = runtime.clientRpcs.requests.get(routedRequest.tag);
+                const isClientNotification = selectedProtocol.clientNotificationRpcs.requests.has(request.tag);
+                if (rpc && isClientNotification && request.isNotification) {
+                  if (!session && selectedProtocol.runtime._tag === "Stateful") {
+                    if (httpRequest) {
+                      appendPreResponseHandlerUnsafe(httpRequest, () => Effect.succeed(HttpServerResponse.empty({
+                        status: headers[MCP_SESSION_ID_HEADER] === undefined ? 400 : 404
+                      })));
+                    }
+                    return;
+                  }
+                  const decode = selectedProtocol.payloadCodecs(rpc).decode(request.payload);
+                  return yield* Effect.gen(function* () {
+                    const payload = yield* decode;
+                    if (request.tag === "notifications/cancelled") {
+                      const cancellation = yield* selectedProtocol.normalizeCancellation(payload);
+                      const key = requestKey(cancellation.requestId);
+                      let ownerClientId = clientId;
+                      if (isHttp) {
+                        if (session === undefined) {
+                          return;
+                        }
+                        // Each HTTP POST has its own transport ID, but cancellation belongs to the session.
+                        const owner = Array.from(activeRequests).find(([, requests]) => requests.get(key)?.prepared.binding === session);
+                        if (owner === undefined) {
+                          return;
+                        }
+                        ownerClientId = owner[0];
                       }
-                      // Each HTTP POST has its own transport ID, but cancellation belongs to the session.
-                      const owner = Array.from(activeRequests).find(([, requests]) => requests.get(key)?.prepared.binding === session);
-                      if (owner === undefined) {
+                      if (!cancelRequest(ownerClientId, cancellation.requestId)) {
                         return;
                       }
-                      ownerClientId = owner[0];
+                      return yield* f(ownerClientId, {
+                        _tag: "Interrupt",
+                        requestId: cancellation.requestId
+                      });
                     }
-                    if (!cancelRequest(ownerClientId, cancellation.requestId)) {
-                      return;
-                    }
-                    return yield* f(ownerClientId, {
-                      _tag: "Interrupt",
-                      requestId: cancellation.requestId
-                    });
+                    const handler = handlers.mapUnsafe.get(rpc.key);
+                    const handled = handler ? handler.handler(payload, {
+                      rpc,
+                      requestId: RpcMessage.RequestId(request.id),
+                      client: new Rpc.ServerClient(clientId),
+                      headers
+                    }) : Effect.void;
+                    return yield* prepared.requestContext === undefined ? handled : Effect.provideService(handled, McpRequestContext, prepared.requestContext);
+                  }).pipe(Effect.ignoreCause);
+                }
+                if (!rpc || isClientNotification) {
+                  if (request.isNotification) {
+                    return;
                   }
-                  const handler = handlers.mapUnsafe.get(rpc.key);
-                  const handled = handler ? handler.handler(payload, {
-                    rpc,
+                  return yield* sendRequestError(clientId, request.id, new MethodNotFound({
+                    message: `Method not found: ${request.tag}`
+                  }));
+                }
+                const decoded = yield* Effect.result(selectedProtocol.payloadCodecs(rpc).decode(request.payload));
+                if (Result.isFailure(decoded)) {
+                  return yield* request.isNotification ? Effect.void : sendRequestError(clientId, request.id, new InvalidParams({
+                    message: "Invalid method parameters"
+                  }));
+                }
+                if (request.isNotification !== true) {
+                  const requests = activeRequests.get(clientId) ?? new Map();
+                  requests.set(requestKey(request.id), {
                     requestId: RpcMessage.RequestId(request.id),
-                    client: new Rpc.ServerClient(clientId),
-                    headers
-                  }) : Effect.void;
-                  return yield* prepared.requestContext === undefined ? handled : Effect.provideService(handled, McpRequestContext, prepared.requestContext);
-                }).pipe(Effect.ignoreCause);
-              }
-              if (!rpc || isClientNotification) {
-                if (request.isNotification) {
-                  return;
+                    prepared,
+                    cancelled: false
+                  });
+                  activeRequests.set(clientId, requests);
                 }
-                return yield* sendRequestError(clientId, request.id, new MethodNotFound({
-                  message: `Method not found: ${request.tag}`
-                }));
-              }
-              const decoded = yield* Effect.result(selectedProtocol.payloadCodecs(rpc).decode(request.payload));
-              if (Result.isFailure(decoded)) {
-                return yield* request.isNotification ? Effect.void : sendRequestError(clientId, request.id, new InvalidParams({
-                  message: "Invalid method parameters"
-                }));
-              }
-              if (request.isNotification !== true) {
-                const requests = activeRequests.get(clientId) ?? new Map();
-                requests.set(requestKey(request.id), {
-                  prepared,
-                  cancelled: false
-                });
-                activeRequests.set(clientId, requests);
-              }
-              const handled = f(clientId, routedRequest);
-              return yield* prepared.requestContext === undefined ? handled : Effect.provideService(handled, McpRequestContext, prepared.requestContext);
-            }).pipe(Effect.catch(error => request.isNotification ? Effect.void : sendRequestError(clientId, request.id, Predicate.isTagged(error, "ProtocolError") ? McpProtocolInternal.ProtocolError.fromFeature(error) : new InvalidParams({
-              message: "Invalid request metadata"
-            }))));
-          }
-        case "Ping":
-        case "Ack":
-        case "Interrupt":
-          return f(clientId, request);
-        case "Eof":
-          if (!isHttp) {
-            disconnectClient(clientId);
-          }
-          return f(clientId, request);
-        case "Pong":
-        case "Exit":
-        case "Chunk":
-        case "ClientProtocolError":
-        case "Defect":
-          {
-            const requestId = request._tag === "Exit" ? requestKey(request.requestId) : undefined;
-            const session = isHttp ? runtime.resolveRequest(clientId, Context.getUnsafe(Fiber.getCurrent().context, HttpServerRequest.HttpServerRequest).headers) : undefined;
-            const waiting = requestId === undefined ? undefined : reverseRequestClients.get(requestId);
-            const reverseKey = waiting?.find(key => isHttp ? key.profile === session?.negotiatedProfile : key.clientId === clientId);
-            if (request._tag === "Exit" && reverseKey === undefined) {
-              return Effect.void;
+                const handled = f(clientId, routedRequest);
+                return yield* prepared.requestContext === undefined ? handled : Effect.provideService(handled, McpRequestContext, prepared.requestContext);
+              }).pipe(Effect.catch(error => request.isNotification ? Effect.void : sendRequestError(clientId, request.id, Predicate.isTagged(error, "ProtocolError") ? McpProtocolInternal.ProtocolError.fromFeature(error) : new InvalidParams({
+                message: "Invalid request metadata"
+              }))));
             }
-            if (reverseKey !== undefined && requestId !== undefined) {
-              removeReverseRequestClient(requestId, reverseKey);
+          case "Ping":
+          case "Ack":
+          case "Interrupt":
+            return f(clientId, request);
+          case "Eof":
+            if (!isHttp) {
+              disconnectClient(clientId);
             }
-            const targetClientId = reverseKey?.clientId ?? clientId;
-            const clientState = clientStates.get(targetClientId);
-            const selectedProtocol = clientState?.protocol ?? runtime.protocols[0];
-            const profile = reverseKey?.profile ?? clientState?.profile ?? {
-              protocolVersion: selectedProtocol.protocolVersion,
-              clientCapabilities: {},
-              clientInfo: {
-                name: "unknown",
-                version: "unknown"
+            return f(clientId, request);
+          case "Pong":
+          case "Exit":
+          case "Chunk":
+          case "ClientProtocolError":
+          case "Defect":
+            {
+              const requestId = request._tag === "Exit" ? requestKey(request.requestId) : undefined;
+              const session = isHttp ? runtime.resolveRequest(clientId, Context.getUnsafe(Fiber.getCurrent().context, HttpServerRequest.HttpServerRequest).headers) : undefined;
+              const waiting = requestId === undefined ? undefined : reverseRequestClients.get(requestId);
+              const reverseKey = waiting?.find(key => isHttp ? key.profile === session?.negotiatedProfile : key.clientId === clientId);
+              if (request._tag === "Exit" && reverseKey === undefined) {
+                return Effect.void;
+              }
+              if (reverseKey !== undefined && requestId !== undefined) {
+                removeReverseRequestClient(requestId, reverseKey);
               }
-            };
-            return RcMap.get(clients, new McpClientKey({
-              clientId: targetClientId,
-              profile
-            })).pipe(Effect.flatMap(({
-              write
-            }) => write(request)), Effect.scoped);
+              const targetClientId = reverseKey?.clientId ?? clientId;
+              const clientState = clientStates.get(targetClientId);
+              const selectedProtocol = clientState?.protocol ?? runtime.protocols[0];
+              const profile = reverseKey?.profile ?? clientState?.profile ?? {
+                protocolVersion: selectedProtocol.protocolVersion,
+                clientCapabilities: {},
+                clientInfo: {
+                  name: "unknown",
+                  version: "unknown"
+                }
+              };
+              return RcMap.get(clients, new McpClientKey({
+                clientId: targetClientId,
+                profile
+              })).pipe(Effect.flatMap(({
+                write
+              }) => write(request)), Effect.scoped);
+            }
+        }
+      });
+    }
+  });
+  if (isHttp) {
+    // Stop requests that can no longer receive client replies after termination.
+    yield* runtime.onSessionTerminated(binding => {
+      const interrupts = [];
+      for (const [clientId, requests] of activeRequests) {
+        for (const {
+          prepared,
+          requestId
+        } of requests.values()) {
+          if (prepared.binding === binding && cancelRequest(clientId, requestId)) {
+            interrupts.push(writeFromClient(clientId, {
+              _tag: "Interrupt",
+              requestId
+            }));
           }
+        }
       }
-    })
-  });
+      return Effect.all(interrupts, {
+        discard: true
+      });
+    });
+  }
   const {
     notificationDelivery,
     notifications
@@ -1061,19 +1090,28 @@ const mcpStdioSerialization = protocols => {
  * **Details**
  *
  * POST serves JSON-RPC and accepted notification-only requests return `202`.
- * Modern routing-header mismatches and unsupported protocol versions return
- * JSON-RPC errors with status `400`; unknown modern RPC methods return a
- * JSON-RPC method-not-found error with status `404`. Unsupported HTTP methods
- * return `405`. Requests carrying an `Origin` header are rejected unless the
- * exact origin appears in `allowedOrigins`; Origin-less non-browser clients
+ * Header mismatches, unsupported protocol versions, and invalid session-header
+ * usage return JSON-RPC errors with status `400`.
+ * Unknown modern RPC methods return a JSON-RPC method-not-found error with
+ * status `404`. Session requests without `MCP-Protocol-Version` use the version
+ * negotiated at initialization. Unsupported HTTP methods return `405`.
+ * Requests with an `Origin` header are rejected unless the exact origin
+ * appears in `allowedOrigins`; Origin-less non-browser clients
  * remain valid. The surrounding HTTP server remains responsible for binding
  * to an appropriate interface and installing authentication.
  *
+ * With `allowSessionTermination`, a DELETE carrying `Mcp-Session-Id` ends that
+ * session with `204` and interrupts its in-flight requests; later requests with
+ * that id get `404`. DELETE validates the session and `MCP-Protocol-Version`
+ * headers like POST. Without the option, or when only sessionless revisions
+ * such as `v2026_07_28` are configured, DELETE returns `405`. Any caller
+ * holding a session id can end that session, so authenticate requests in the
+ * surrounding router.
+ *
  * `layerHttp` always implements the single-endpoint Streamable HTTP topology.
  * Using `v2024_11_05` here is a custom compatibility transport for that
  * revision's schema. It does not implement the historical two-endpoint
- * HTTP+SSE transport, GET SSE, event resumption, session expiry, or client
- * session termination.
+ * HTTP+SSE transport, GET SSE, event resumption, or session expiry.
  *
  * @see {@link layerStdio} for exposing the server over stdio
  * @see {@link layer} for the base MCP server layer without a transport protocol
@@ -1084,17 +1122,7 @@ const mcpStdioSerialization = protocols => {
  */
 export const layerHttp = options => {
   const runtime = McpRuntime.layer(options.protocols);
-  const methodNotAllowedResponse = HttpServerResponse.empty({
-    status: 405,
-    headers: {
-      allow: "POST"
-    }
-  });
-  const methodNotAllowed = request => isAllowedMcpOrigin(request, options.allowedOrigins) ? Effect.succeed(methodNotAllowedResponse) : Effect.succeed(HttpServerResponse.empty({
-    status: 403
-  }));
-  const routes = Layer.mergeAll(HttpRouter.add("GET", options.path, methodNotAllowed), HttpRouter.add("PUT", options.path, methodNotAllowed), HttpRouter.add("PATCH", options.path, methodNotAllowed), HttpRouter.add("DELETE", options.path, methodNotAllowed), HttpRouter.add("OPTIONS", options.path, methodNotAllowed));
-  return Layer.merge(layerWithRuntime(options, "http"), routes).pipe(Layer.provide(layerMcpProtocolHttp(options)), Layer.provide(runtime), Layer.provide(RpcSerialization.layerJsonRpc()));
+  return layerWithRuntime(options, "http").pipe(Layer.provide(layerMcpProtocolHttp(options)), Layer.provide(runtime), Layer.provide(RpcSerialization.layerJsonRpc()));
 };
 const layerMcpProtocolHttp = options => Layer.effect(RpcServer.Protocol)(Effect.gen(function* () {
   const runtime = yield* McpRuntime.ServerRuntime;
@@ -1103,6 +1131,22 @@ const layerMcpProtocolHttp = options => Layer.effect(RpcServer.Protocol)(Effect.
     protocol
   } = yield* RpcServer.makeProtocolWithHttpEffect().pipe(Effect.provideService(RpcSerialization.RpcSerialization, mcpHttpSerialization));
   const router = yield* HttpRouter.HttpRouter;
+  const allowSessionTermination = options.allowSessionTermination === true && runtime.protocols.some(protocol => protocol.runtime._tag === "Stateful");
+  const forbidden = Effect.succeed(HttpServerResponse.empty({
+    status: 403
+  }));
+  const withAllowedOrigin = handler => request => isAllowedMcpOrigin(request, options.allowedOrigins) ? handler(request) : forbidden;
+  const methodNotAllowedResponse = Effect.succeed(HttpServerResponse.empty({
+    status: 405,
+    headers: {
+      allow: allowSessionTermination ? "POST, DELETE" : "POST"
+    }
+  }));
+  const methodNotAllowed = withAllowedOrigin(() => methodNotAllowedResponse);
+  for (const method of ["GET", "PUT", "PATCH", "OPTIONS"]) {
+    yield* router.add(method, options.path, methodNotAllowed);
+  }
+  yield* router.add("DELETE", options.path, allowSessionTermination ? withAllowedOrigin(request => runtime.terminateHttpSession(request.headers)) : methodNotAllowed);
   yield* router.add("POST", options.path, request => {
     if (!isAllowedMcpOrigin(request, options.allowedOrigins)) {
       return Effect.succeed(HttpServerResponse.empty({